@gradientedge/cdk-utils 5.13.0 → 6.0.1

package/dist/src/lib/construct/api-to-eventbridge-target-with-sns/main.js

@@ -0,0 +1,631 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiToEventBridgeTargetWithSns = void 0;
+const cdk = __importStar(require("aws-cdk-lib"));
+const apig = __importStar(require("aws-cdk-lib/aws-apigateway"));
+const events = __importStar(require("aws-cdk-lib/aws-events"));
+const eventstargets = __importStar(require("aws-cdk-lib/aws-events-targets"));
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const destinations = __importStar(require("aws-cdk-lib/aws-lambda-destinations"));
+const common_1 = require("../../common");
+const helper = __importStar(require("../../helper"));
+const api_destined_lambda_1 = require("./api-destined-lambda");
+/**
+ * @stability stable
+ * @category cdk-utils.api-to-eventbridge-target
+ * @subcategory construct
+ * @classdesc Provides a construct to create and deploy API Gateway invocations to EventBridge
+ *
+ * <b>Architecture</b> ![Architecture](./ApiToEventBridgeTargetWithSns.jpg)
+ *
+ * @example
+ * import { ApiToEventBridgeTargetWithSns, ApiToEventBridgeTargetProps } '@gradientedge/cdk-utils'
+ * import { Construct } from 'constructs'
+ *
+ * class CustomConstruct extends ApiToEventBridgeTargetWithSns {
+ *   constructor(parent: Construct, id: string, props: ApiToEventBridgeTargetProps) {
+ *     super(parent, id, props)
+ *     this.props = props
+ *     this.id = id
+ *     this.initResources()
+ *   }
+ * }
+ *
+ */
+class ApiToEventBridgeTargetWithSns extends common_1.CommonConstruct {
+    props;
+    id;
+    /* application related resources */
+    applicationSecrets;
+    /* destined lambda related resources */
+    apiDestinedLambda;
+    /* event related resources */
+    apiEvent;
+    /* rest restApi related resources */
+    apiDestinedRestApi;
+    apiResource;
+    constructor(parent, id, props) {
+        super(parent, id, props);
+        this.props = props;
+        this.id = id;
+        this.apiDestinedLambda = new api_destined_lambda_1.ApiDestinedLambda();
+        this.apiEvent = new helper.ApiToEventbridgeTargetEvent();
+        this.apiDestinedRestApi = new helper.ApiToEventbridgeTargetRestApi();
+        this.apiResource = 'notify';
+    }
+    initResources() {
+        /* application related resources */
+        this.resolveSecrets();
+        /* core resources */
+        this.resolveHostedZone();
+        this.resolveCertificate();
+        /* optional custom event bus */
+        this.createApiDestinedEventBus();
+        /* destined lambda related resources */
+        this.createApiDestinedLambdaPolicy();
+        this.createApiDestinedLambdaRole();
+        this.createApiDestinedLambdaEnvironment();
+        this.createApiDestinedLambdaLayers();
+        this.createApiDestinedLambdaDestinations();
+        this.createApiDestinedLambdaFunction();
+        /* event related resources */
+        this.createApiDestinationLogGroupSuccess();
+        this.createApiDestinationRuleSuccess();
+        this.createApiDestinationLogGroupFailure();
+        this.createApiDestinationRuleFailure();
+        /* restApi related resources */
+        this.createApiDestinedTopicRole();
+        this.createApiDestinedTopic();
+        this.createApiDestinedIntegrationRequestParameters();
+        this.createApiDestinedIntegrationRequestTemplates();
+        this.createApiDestinedIntegrationResponse();
+        this.createApiDestinedIntegrationErrorResponse();
+        this.createApiDestinedIntegration();
+        this.createApiDestinedRestApi();
+        this.createApiDestinedResource();
+        this.createApiDestinedResponseModel();
+        this.createApiDestinedErrorResponseModel();
+        this.createApiDestinedMethodResponse();
+        this.createApiDestinedMethodErrorResponse();
+        this.createApiDestinedResourceMethod();
+        this.createApiDomain();
+        this.createApiBasePathMapping();
+        this.createApiRouteAssets();
+    }
+    /**
+     * @summary Method to resolve secrets from SecretsManager
+     * - To be implemented in the overriding method in the implementation class
+     * @protected
+     */
+    resolveSecrets() {
+        this.applicationSecrets = [];
+    }
+    /**
+     * @summary Method to resolve a hosted zone based on domain attributes
+     * @protected
+     */
+    resolveHostedZone() {
+        this.apiDestinedRestApi.hostedZone = this.route53Manager.withHostedZoneFromFullyQualifiedDomainName(`${this.id}-hosted-zone`, this, this.props.useExistingHostedZone);
+    }
+    /**
+     * @summary Method to resolve a certificate based on attributes
+     * @protected
+     */
+    resolveCertificate() {
+        if (this.props.api.useExisting)
+            return;
+        if (this.props.api.certificate.useExistingCertificate &&
+            this.props.api.certificate.certificateSsmName &&
+            this.props.api.certificate.certificateRegion) {
+            this.props.api.certificate.certificateArn = this.ssmManager.readStringParameterFromRegion(`${this.id}-certificate-param`, this, this.props.api.certificate.certificateSsmName, this.props.api.certificate.certificateRegion);
+        }
+        this.apiDestinedRestApi.certificate = this.acmManager.resolveCertificate(`${this.id}-certificate`, this, this.props.api.certificate);
+    }
+    /**
+     * @summary Method to create iam policy for Api Destined Lambda function
+     * @protected
+     */
+    createApiDestinedLambdaPolicy() {
+        if (this.props.api.useExisting)
+            return;
+        this.apiDestinedLambda.policy = new iam.PolicyDocument({
+            statements: [this.iamManager.statementForPutEvents([this.apiEvent.eventBus.eventBusArn])],
+        });
+    }
+    /**
+     * @summary Method to create iam role for Api Destined Lambda function
+     * @protected
+     */
+    createApiDestinedLambdaRole() {
+        if (this.props.api.useExisting)
+            return;
+        this.apiDestinedLambda.role = this.iamManager.createRoleForLambda(`${this.id}-lambda-destined-role`, this, this.apiDestinedLambda.policy);
+    }
+    /**
+     * @summary Method to create environment variables for Api Destined Lambda function
+     * @protected
+     */
+    createApiDestinedLambdaEnvironment() {
+        if (this.props.api.useExisting)
+            return;
+        this.apiDestinedLambda.environment = {
+            NODE_ENV: this.props.nodeEnv,
+            LOG_LEVEL: this.props.logLevel,
+            TZ: this.props.timezone,
+            SOURCE_ID: this.id,
+        };
+    }
+    /**
+     * @summary Method to create layers for Api Destined Lambda function
+     * @protected
+     */
+    createApiDestinedLambdaLayers() {
+        if (this.props.api.useExisting)
+            return;
+        const layers = [];
+        if (this.props.lambda && this.props.lambda.layerSource) {
+            layers.push(this.lambdaManager.createLambdaLayer(`${this.id}-lambda-destined-layer`, this, this.props.lambda.layerSource));
+        }
+        this.apiDestinedLambda.layers = layers;
+    }
+    /**
+     * @summary Method to create destination for Api Destined function
+     * @protected
+     */
+    createApiDestinedLambdaDestinations() {
+        if (this.props.api.useExisting)
+            return;
+        this.apiDestinedLambda.destinationSuccess = new destinations.EventBridgeDestination(this.apiEvent.eventBus);
+        this.apiDestinedLambda.destinationFailure = new destinations.EventBridgeDestination(this.apiEvent.eventBus);
+    }
+    /**
+     * @summary Method to create lambda function for Api Destined
+     * @protected
+     */
+    createApiDestinedLambdaFunction() {
+        if (this.props.api.useExisting)
+            return;
+        if (!this.props.lambda || !this.props.lambda.source)
+            throw 'Api Destined Lambda props undefined';
+        this.apiDestinedLambda.function = this.lambdaManager.createLambdaFunction(`${this.id}-lambda-destined`, this, {
+            ...this.props.lambda.function,
+            ...{
+                onSuccess: this.apiDestinedLambda.destinationSuccess,
+                onFailure: this.apiDestinedLambda.destinationFailure,
+            },
+        }, this.apiDestinedLambda.role, this.apiDestinedLambda.layers, this.props.lambda.source, this.props.lambda.handler ?? 'lambda.handler', this.apiDestinedLambda.environment);
+    }
+    /**
+     * @summary Method to create or use an existing eventbus for api destined payload deliveries
+     * @protected
+     */
+    createApiDestinedEventBus() {
+        if (this.props.api.useExisting) {
+            this.apiEvent.eventBus = events.EventBus.fromEventBusName(this, `${this.id}-destined-event-bus`, `${this.props.event.eventBusName}-${this.props.stage}`);
+            return;
+        }
+        this.apiEvent.eventBus = this.eventManager.createEventBus(`${this.id}-destined-event-bus`, this, {
+            eventBusName: `${this.props.event.eventBusName}`,
+        });
+    }
+    /**
+     * @summary Method to create a log group for successful api destined payload deliveries
+     * @protected
+     */
+    createApiDestinationLogGroupSuccess() {
+        if (this.props.api.useExisting)
+            return;
+        this.apiEvent.logGroupSuccess = this.logManager.createLogGroup(`${this.id}-destination-success-log`, this, {
+            ...{
+                logGroupName: `/${this.id}/events/api-destination-success`,
+            },
+            ...this.props.event.logGroupSuccess,
+        });
+    }
+    /**
+     * Method to create EventBridge rule with lambda target for success
+     * @protected
+     */
+    createApiDestinationRuleSuccess() {
+        if (this.props.api.useExisting)
+            return;
+        this.props.event.ruleSuccess = {
+            ...{
+                ruleName: `${this.id}-api-destination-success`,
+                eventPattern: {
+                    detail: {
+                        requestContext: {
+                            condition: ['Success'],
+                        },
+                        responsePayload: {
+                            source: ['custom:api-destined-lambda'],
+                            sourceId: [this.id],
+                        },
+                    },
+                },
+            },
+            ...this.props.event.ruleSuccess,
+        };
+        this.apiEvent.ruleSuccess = this.eventManager.createRule(`${this.id}-api-destination-rule-success`, this, this.props.event.ruleSuccess, this.apiEvent.eventBus, [new eventstargets.CloudWatchLogGroup(this.apiEvent.logGroupSuccess)]);
+    }
+    /**
+     * @summary Method to create a log group for failed api destined payload deliveries
+     * @protected
+     */
+    createApiDestinationLogGroupFailure() {
+        if (this.props.api.useExisting)
+            return;
+        this.apiEvent.logGroupFailure = this.logManager.createLogGroup(`${this.id}-destination-failure-log`, this, {
+            ...{
+                logGroupName: `/${this.id}/events/api-destination-failure`,
+            },
+            ...this.props.event.logGroupFailure,
+        });
+    }
+    /**
+     * Method to create EventBridge rule with lambda target for failure
+     * @protected
+     */
+    createApiDestinationRuleFailure() {
+        if (this.props.api.useExisting)
+            return;
+        this.props.event.ruleFailure = {
+            ...{
+                ruleName: `${this.id}-api-destination-failure`,
+                eventPattern: {
+                    detail: {
+                        responsePayload: {
+                            errorType: ['Error'],
+                        },
+                    },
+                },
+            },
+            ...this.props.event.ruleFailure,
+        };
+        this.apiEvent.ruleFailure = this.eventManager.createRule(`${this.id}-api-destination-rule-failure`, this, this.props.event.ruleFailure, this.apiEvent.eventBus, [new eventstargets.CloudWatchLogGroup(this.apiEvent.logGroupFailure)]);
+    }
+    /**
+     * @summary Method to create a role for sns topic
+     * @protected
+     */
+    createApiDestinedTopicRole() {
+        this.apiDestinedRestApi.role = new iam.Role(this, `${this.id}-sns-rest-api-role`, {
+            assumedBy: new iam.ServicePrincipal('apigateway.amazonaws.com'),
+        });
+    }
+    /**
+     * @summary Method to create API destined SNS topic
+     * @protected
+     */
+    createApiDestinedTopic() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.topic = this.snsManager.createLambdaNotificationService(`${this.id}-destined-topic`, this, {
+            topicName: `${this.id}-destined-topic`,
+        }, this.apiDestinedLambda.function);
+        if (this.apiDestinedRestApi.role) {
+            this.apiDestinedRestApi.topic.grantPublish(this.apiDestinedRestApi.role);
+        }
+    }
+    /**
+     * @summary Method to create api integration request parameters
+     * @protected
+     */
+    createApiDestinedIntegrationRequestParameters() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.integrationRequestParameters = {
+            'integration.request.header.Content-Type': "'application/x-www-form-urlencoded'",
+        };
+    }
+    /**
+     * @summary Method to create api integration request templates
+     * @protected
+     */
+    createApiDestinedIntegrationRequestTemplates() {
+        if (!this.props.api.withResource)
+            return;
+        if (!this.apiDestinedRestApi.topic)
+            throw 'Topic undefined';
+        this.apiDestinedRestApi.integrationRequestTemplates = {
+            'application/json': [
+                'Action=Publish',
+                `TargetArn=$util.urlEncode('${this.apiDestinedRestApi.topic.topicArn}')`,
+                'Message=$util.urlEncode($input.body)',
+                'Version=2010-03-31',
+            ].join('&'),
+        };
+    }
+    /**
+     * @summary Method to create api integration response
+     * @protected
+     */
+    createApiDestinedIntegrationResponse() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.integrationResponse = this.props.api.integrationResponse ?? {
+            ...{
+                statusCode: '200',
+                responseTemplates: {
+                    'application/json': JSON.stringify({ message: 'Payload Submitted' }),
+                },
+            },
+        };
+    }
+    /**
+     * @summary Method to create api integration error response
+     * @protected
+     */
+    createApiDestinedIntegrationErrorResponse() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.integrationErrorResponse = {
+            ...{
+                selectionPattern: '^\\[Error\\].*',
+                statusCode: '400',
+                responseTemplates: {
+                    'application/json': JSON.stringify({
+                        state: 'error',
+                        message: "$util.escapeJavaScript($input.path('$.errorMessage'))",
+                    }),
+                },
+                responseParameters: {
+                    'method.response.header.Content-Type': "'application/json'",
+                    'method.response.header.Access-Control-Allow-Origin': "'*'",
+                    'method.response.header.Access-Control-Allow-Credentials': "'true'",
+                },
+            },
+            ...this.props.api.integrationErrorResponse,
+        };
+    }
+    /**
+     * @summary Method to create api integration
+     * @protected
+     */
+    createApiDestinedIntegration() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.integration = new apig.Integration({
+            type: apig.IntegrationType.AWS,
+            integrationHttpMethod: 'POST',
+            uri: `arn:aws:apigateway:${this.props.region}:sns:path//`,
+            options: {
+                ...{
+                    credentialsRole: this.apiDestinedRestApi.role,
+                    requestParameters: this.apiDestinedRestApi.integrationRequestParameters,
+                    requestTemplates: this.apiDestinedRestApi.integrationRequestTemplates,
+                    passthroughBehavior: apig.PassthroughBehavior.NEVER,
+                    integrationResponses: [
+                        this.apiDestinedRestApi.integrationResponse,
+                        this.apiDestinedRestApi.integrationErrorResponse,
+                    ],
+                },
+                ...this.props.api.integrationOptions,
+            },
+        });
+    }
+    /**
+     * @summary Method to create api integration method response
+     * @protected
+     */
+    createApiDestinedMethodResponse() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.methodResponse = {
+            ...{
+                statusCode: '200',
+                responseParameters: {
+                    'method.response.header.Content-Type': true,
+                    'method.response.header.Access-Control-Allow-Origin': true,
+                    'method.response.header.Access-Control-Allow-Credentials': true,
+                },
+                responseModels: {
+                    'application/json': this.apiDestinedRestApi.responseModel,
+                },
+            },
+            ...this.props.api.methodResponse,
+        };
+    }
+    /**
+     * @summary Method to create api integration method error response
+     * @protected
+     */
+    createApiDestinedMethodErrorResponse() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.methodErrorResponse = {
+            ...{
+                statusCode: '400',
+                responseParameters: {
+                    'method.response.header.Content-Type': true,
+                    'method.response.header.Access-Control-Allow-Origin': true,
+                    'method.response.header.Access-Control-Allow-Credentials': true,
+                },
+                responseModels: {
+                    'application/json': this.apiDestinedRestApi.errorResponseModel,
+                },
+            },
+            ...this.props.api.methodErrorResponse,
+        };
+    }
+    /**
+     * @summary Method to create rest restApi for Api
+     * @protected
+     */
+    createApiDestinedRestApi() {
+        if (this.props.api.useExisting && this.props.api.importedRestApiRef) {
+            this.apiDestinedRestApi.api = apig.RestApi.fromRestApiId(this, `${this.id}-sns-rest-api`, cdk.Fn.importValue(this.props.api.importedRestApiRef));
+            return;
+        }
+        const accessLogGroup = this.logManager.createLogGroup(`${this.id}-sns-rest-api-access-log`, this, {
+            logGroupName: `/custom/api/${this.id}-destined-rest-api-access`,
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+        });
+        this.apiDestinedRestApi.api = new apig.RestApi(this, `${this.id}-sns-rest-api`, {
+            ...{
+                defaultIntegration: this.apiDestinedRestApi.integration,
+                defaultMethodOptions: {
+                    methodResponses: [this.apiDestinedRestApi.methodResponse, this.apiDestinedRestApi.methodErrorResponse],
+                },
+                deployOptions: {
+                    dataTraceEnabled: true,
+                    description: `${this.id} - ${this.props.stage} stage`,
+                    loggingLevel: apig.MethodLoggingLevel.INFO,
+                    metricsEnabled: true,
+                    stageName: this.props.stage,
+                    accessLogDestination: new apig.LogGroupLogDestination(accessLogGroup),
+                    accessLogFormat: apig.AccessLogFormat.jsonWithStandardFields(),
+                },
+                endpointConfiguration: {
+                    types: [apig.EndpointType.REGIONAL],
+                },
+                defaultCorsPreflightOptions: {
+                    allowOrigins: apig.Cors.ALL_ORIGINS,
+                    allowMethods: ['POST'],
+                    allowHeaders: apig.Cors.DEFAULT_HEADERS,
+                },
+                restApiName: `${this.id}-destined-rest-api-${this.props.stage}`,
+            },
+            ...this.props.api,
+        });
+        this.addCfnOutput(`${this.id}-restApiId`, this.apiDestinedRestApi.api.restApiId);
+        this.addCfnOutput(`${this.id}-restApiRootResourceId`, this.apiDestinedRestApi.api.root.resourceId);
+    }
+    /**
+     * @summary Method to create api integration response model
+     * @protected
+     */
+    createApiDestinedResponseModel() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.responseModel = new apig.Model(this, `${this.id}-response-model`, {
+            restApi: this.apiDestinedRestApi.api,
+            ...{
+                contentType: 'application/json',
+                modelName: 'ResponseModel',
+                schema: {
+                    schema: apig.JsonSchemaVersion.DRAFT4,
+                    title: 'pollResponse',
+                    type: apig.JsonSchemaType.OBJECT,
+                    properties: { message: { type: apig.JsonSchemaType.STRING } },
+                },
+            },
+            ...this.props.api.responseModel,
+        });
+    }
+    /**
+     * @summary Method to create api integration error response model
+     * @protected
+     */
+    createApiDestinedErrorResponseModel() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.errorResponseModel = new apig.Model(this, `${this.id}-error-response-model`, {
+            restApi: this.apiDestinedRestApi.api,
+            ...{
+                contentType: 'application/json',
+                modelName: 'ErrorResponseModel',
+                schema: {
+                    schema: apig.JsonSchemaVersion.DRAFT4,
+                    title: 'errorResponse',
+                    type: apig.JsonSchemaType.OBJECT,
+                    properties: {
+                        state: { type: apig.JsonSchemaType.STRING },
+                        message: { type: apig.JsonSchemaType.STRING },
+                    },
+                },
+            },
+            ...this.props.api.errorResponseModel,
+        });
+    }
+    /**
+     * @summary Method to create api integration resource
+     * @protected
+     */
+    createApiDestinedResource() {
+        if (!this.props.api.withResource)
+            return;
+        let rootResource;
+        if (this.props.api.withResource && this.props.api.importedRestApiRootResourceRef) {
+            rootResource = apig.Resource.fromResourceAttributes(this, `${this.id}-root-resource`, {
+                resourceId: cdk.Fn.importValue(this.props.api.importedRestApiRootResourceRef),
+                restApi: this.apiDestinedRestApi.api,
+                path: '/',
+            });
+        }
+        else {
+            rootResource = this.apiDestinedRestApi.api.root;
+        }
+        this.apiDestinedRestApi.resource = rootResource.addResource(this.props.api.resource ?? this.apiResource);
+    }
+    /**
+     * @summary Method to create api integration resource method
+     * @protected
+     */
+    createApiDestinedResourceMethod() {
+        if (!this.props.api.withResource)
+            return;
+        this.apiDestinedRestApi.method = this.apiDestinedRestApi.resource.addMethod('POST', this.apiDestinedRestApi.integration, {
+            authorizer: this.apiDestinedRestApi.authoriser,
+            methodResponses: [this.apiDestinedRestApi.methodResponse, this.apiDestinedRestApi.methodErrorResponse],
+        });
+    }
+    /**
+     * @summary Method to create custom restApi domain for Api API
+     * @protected
+     */
+    createApiDomain() {
+        if (this.props.api.useExisting)
+            return;
+        this.apiDestinedRestApi.domain = this.apiManager.createApiDomain(`${this.id}-api-domain`, this, this.isProductionStage() || this.props.skipStageForARecords
+            ? `${this.props.apiSubDomain}.${this.fullyQualifiedDomainName}`
+            : `${this.props.apiSubDomain}-${this.props.stage}.${this.fullyQualifiedDomainName}`, this.apiDestinedRestApi.certificate);
+    }
+    /**
+     * @summary Method to create base path mappings for Api API
+     * @protected
+     */
+    createApiBasePathMapping() {
+        if (this.props.api.useExisting)
+            return;
+        new apig.BasePathMapping(this, `${this.id}-base-bath-mapping`, {
+            basePath: '',
+            domainName: this.apiDestinedRestApi.domain,
+            restApi: this.apiDestinedRestApi.api,
+            stage: this.apiDestinedRestApi.api.deploymentStage,
+        });
+    }
+    /**
+     * @summary Method to create route53 records for Api API
+     * @protected
+     */
+    createApiRouteAssets() {
+        if (this.props.api.useExisting)
+            return;
+        this.route53Manager.createApiGatewayARecord(`${this.id}-custom-domain-a-record`, this, this.props.apiSubDomain, this.apiDestinedRestApi.domain, this.apiDestinedRestApi.hostedZone, this.props.skipStageForARecords);
+    }
+}
+exports.ApiToEventBridgeTargetWithSns = ApiToEventBridgeTargetWithSns;

package/dist/src/lib/construct/graphql-api-lambda/main.js

@@ -120,7 +120,7 @@ class GraphQLApiLambda extends common_1.CommonConstruct {
      */
     createLambdaPolicy() {
         this.graphQLApiLambdaPolicy = new iam.PolicyDocument({
-            statements: [this.iamManager.statementForReadSecrets(this)],
+            statements: [this.iamManager.statementForCreateAnyLogStream()],
         });
     }
     /**

package/dist/src/lib/construct/index.d.ts

@@ -1,4 +1,5 @@
 export * from './api-to-eventbridge-target';
+export * from './api-to-eventbridge-target-with-sns';
 export * from './graphql-api-lambda';
 export * from './graphql-api-lambda-with-cache';
 export * from './site-with-ecs-backend';

package/dist/src/lib/construct/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./api-to-eventbridge-target"), exports);
+__exportStar(require("./api-to-eventbridge-target-with-sns"), exports);
 __exportStar(require("./graphql-api-lambda"), exports);
 __exportStar(require("./graphql-api-lambda-with-cache"), exports);
 __exportStar(require("./site-with-ecs-backend"), exports);

package/dist/src/lib/construct/site-with-ecs-backend/main.js

@@ -166,7 +166,7 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
      */
     createEcsPolicy() {
         this.siteEcsPolicy = new iam.PolicyDocument({
-            statements: [this.iamManager.statementForReadSecrets(this)],
+            statements: [this.iamManager.statementForCreateAnyLogStream()],
         });
     }
     /**

package/dist/src/lib/{construct/api-to-eventbridge-target/api-destination-event.d.ts → helper/api-to-eventbridge-target-event.d.ts}

@@ -1,16 +1,18 @@
 import * as events from 'aws-cdk-lib/aws-events';
 import * as logs from 'aws-cdk-lib/aws-logs';
-import * as types from '../../types/aws';
+import * as types from '../types/aws';
 /**
  * @stability stable
  * @category cdk-utils.api-to-eventbridge-target
  * @subcategory member
- * @classdesc Provides a construct to contain event resources for ApiToEventBridgeTarget
+ * @classdesc Provides a construct to contain event resources for ApiToEventBridgeTargetWithSns
  */
-export declare class ApiDestinationEvent implements types.ApiDestinationEventType {
+export declare class ApiToEventbridgeTargetEvent implements types.ApiToEventBridgeTargetEventType {
     eventBus: events.IEventBus;
+    logGroup: logs.LogGroup;
     logGroupFailure: logs.LogGroup;
     logGroupSuccess: logs.LogGroup;
+    rule: events.Rule;
     ruleFailure: events.Rule;
     ruleSuccess: events.Rule;
 }