@gradientedge/cdk-utils 8.155.0 → 8.156.0

package/dist/src/lib/aws/construct/lambda-with-iam-access/main.js

@@ -4,10 +4,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LambdaWithIamAccess = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
 const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const aws_lambda_1 = require("aws-cdk-lib/aws-lambda");
 const aws_secretsmanager_1 = require("aws-cdk-lib/aws-secretsmanager");
 const lodash_1 = __importDefault(require("lodash"));
 const common_1 = require("../../common");
+const services_1 = require("../../services");
 /**
  * @classdesc Provides a construct to create a lambda function with IAM access
  * @example
@@ -31,7 +35,7 @@ class LambdaWithIamAccess extends common_1.CommonConstruct {
     lambdaPolicy;
     lambdaRole;
     lambdaEnvironment;
-    lambdaLayers;
+    lambdaLayers = [];
     lambdaFunction;
     lambdaIamUser;
     lambdaUserAccessKey;
@@ -63,8 +67,18 @@ class LambdaWithIamAccess extends common_1.CommonConstruct {
         this.createIamUserForLambdaFunction();
         this.createIamSecretForLambdaFunction();
     }
-    resolveVpc() { }
-    resolveSecurityGroups() { }
+    resolveVpc() {
+        if (this.props.vpcName) {
+            this.lambdaVpc = this.vpcManager.retrieveCommonVpc(`${this.id}-vpc`, this, this.props.vpcName);
+        }
+    }
+    resolveSecurityGroups() {
+        if (this.props.securityGroupExportName) {
+            const lambdaSecurityGroup = aws_ec2_1.SecurityGroup.fromSecurityGroupId(this, `${this.id}-security-group`, aws_cdk_lib_1.Fn.importValue(this.props.securityGroupExportName));
+            this.addCfnOutput(`${this.id}-sg`, lambdaSecurityGroup.securityGroupId);
+            this.lambdaSecurityGroups = [lambdaSecurityGroup];
+        }
+    }
     resolveAccessPoint() { }
     resolveMountPath() { }
     resolveVpcSubnets() { }
@@ -73,14 +87,20 @@ class LambdaWithIamAccess extends common_1.CommonConstruct {
      */
     createLambdaPolicy() {
         this.lambdaPolicy = new aws_iam_1.PolicyDocument({
-            statements: [this.iamManager.statementForCreateAnyLogStream()],
+            statements: [this.iamManager.statementForCreateAnyLogStream(), this.iamManager.statementForPutXrayTelemetry()],
         });
+        if (this.props.configEnabled) {
+            this.lambdaPolicy.addStatements(this.iamManager.statementForReadAnyAppConfig(), this.iamManager.statementForAppConfigExecution());
+        }
     }
     /**
      * @summary Method to create iam role for Lambda function
      */
     createLambdaRole() {
         this.lambdaRole = this.iamManager.createRoleForLambda(`${this.id}-lambda-role`, this, this.lambdaPolicy);
+        if (this.props.vpcName) {
+            this.lambdaRole.addManagedPolicy(aws_iam_1.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'));
+        }
     }
     /**
      * @summary Method to create environment variables for Lambda function
@@ -97,17 +117,26 @@ class LambdaWithIamAccess extends common_1.CommonConstruct {
      */
     createLambdaLayers() {
         const layers = [];
-        if (!this.props.lambdaLayerSources)
-            return;
-        lodash_1.default.forEach(this.props.lambdaLayerSources, (source, index) => {
-            layers.push(this.lambdaManager.createLambdaLayer(`${this.id}-layer-${index}`, this, source));
-        });
-        this.lambdaLayers = layers;
+        if (this.props.lambdaLayerSources) {
+            lodash_1.default.forEach(this.props.lambdaLayerSources, (source, index) => {
+                layers.push(this.lambdaManager.createLambdaLayer(`${this.id}-layer-${index}`, this, source));
+            });
+            this.lambdaLayers = layers;
+        }
+        if (this.props.configEnabled) {
+            const appConfigExtensionLayer = aws_lambda_1.LayerVersion.fromLayerVersionArn(this, `${this.id}-ac-extlayer`, this.appConfigManager.getArnForAppConfigExtension(this, services_1.Architecture.ARM_64));
+            this.lambdaLayers.push(appConfigExtensionLayer);
+        }
     }
     /**
      * @summary Method to create lambda function
      */
     createLambdaFunction() {
+        if (this.props.lambdaInsightsVersion) {
+            lodash_1.default.assign(this.props.lambda, {
+                insightsVersion: this.props.lambdaInsightsVersion,
+            });
+        }
         this.lambdaFunction = this.lambdaManager.createLambdaFunction(`${this.id}-lambda`, this, this.props.lambda, this.lambdaRole, this.lambdaLayers, this.props.lambdaSource, this.props.lambdaHandler || 'index.handler', this.lambdaEnvironment, this.lambdaVpc, this.lambdaSecurityGroups, this.lambdaAccessPoint, this.lambdaMountPath, this.lambdaVpcSubnets);
     }
     /**
@@ -122,11 +151,28 @@ class LambdaWithIamAccess extends common_1.CommonConstruct {
             statements: [
                 new aws_iam_1.PolicyStatement({
                     actions: ['lambda:InvokeFunction'],
-                    resources: [this.lambdaFunction.functionArn],
+                    resources: [this.lambdaFunction.functionArn, `${this.lambdaFunction.functionArn}*`],
                 }),
             ],
             users: [this.lambdaIamUser],
         });
+        if (this.props.lambda.lambdaAliases && !lodash_1.default.isEmpty(this.props.lambda.lambdaAliases)) {
+            lodash_1.default.forEach(this.props.lambda.lambdaAliases, (alias, index) => {
+                new aws_iam_1.Policy(this, `${this.id}-alias-user-policy`, {
+                    policyName: `${this.id}-alias-policy-${index}-${this.props.stage}`,
+                    statements: [
+                        new aws_iam_1.PolicyStatement({
+                            actions: ['lambda:InvokeFunction'],
+                            resources: [
+                                aws_cdk_lib_1.Fn.importValue(`${this.id}-${alias.aliasName}AliasArn`),
+                                `${aws_cdk_lib_1.Fn.importValue(`${this.id}-${alias.aliasName}AliasArn`)}*`,
+                            ],
+                        }),
+                    ],
+                    users: [this.lambdaIamUser],
+                });
+            });
+        }
         this.lambdaUserAccessKey = new aws_iam_1.CfnAccessKey(this, `${this.id}-access-key-${this.props.stage}`, {
             userName: this.lambdaIamUser.userName,
         });

package/dist/src/lib/aws/construct/lambda-with-iam-access/types.d.ts

@@ -1,16 +1,20 @@
-import { AssetCode } from 'aws-cdk-lib/aws-lambda';
+import { AssetCode, LambdaInsightsVersion } from 'aws-cdk-lib/aws-lambda';
 import { SecretProps } from 'aws-cdk-lib/aws-secretsmanager';
 import { CommonStackProps } from '../../common';
 import { LambdaEnvironment, LambdaProps } from '../../services';
 export interface LambdaWithIamAccessProps extends CommonStackProps {
+    configEnabled?: boolean;
     lambda: LambdaProps;
     lambdaHandler?: string;
+    lambdaInsightsVersion?: LambdaInsightsVersion;
     lambdaLayerSources: AssetCode[];
     lambdaSecret: SecretProps;
     lambdaSource: AssetCode;
     logLevel: string;
     nodeEnv: string;
+    securityGroupExportName?: string;
     timezone: string;
+    vpcName?: string;
 }
 export interface LambdaWithIamAccessEnvironment extends LambdaEnvironment {
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradientedge/cdk-utils",
-  "version": "8.155.0",
+  "version": "8.156.0",
   "description": "Utilities for AWS CDK provisioning",
   "main": "dist/index.js",
   "engines": {

package/src/lib/aws/construct/lambda-with-iam-access/main.ts

@@ -1,11 +1,13 @@
-import { ISecurityGroup, IVpc, SubnetSelection } from 'aws-cdk-lib/aws-ec2'
+import { Fn } from 'aws-cdk-lib'
+import { ISecurityGroup, IVpc, SecurityGroup, SubnetSelection } from 'aws-cdk-lib/aws-ec2'
 import { IAccessPoint } from 'aws-cdk-lib/aws-efs'
-import { CfnAccessKey, Policy, PolicyDocument, PolicyStatement, Role, User } from 'aws-cdk-lib/aws-iam'
+import { CfnAccessKey, ManagedPolicy, Policy, PolicyDocument, PolicyStatement, Role, User } from 'aws-cdk-lib/aws-iam'
 import { AssetCode, IFunction, ILayerVersion, LayerVersion } from 'aws-cdk-lib/aws-lambda'
 import { CfnSecret, Secret } from 'aws-cdk-lib/aws-secretsmanager'
 import { Construct } from 'constructs'
 import _ from 'lodash'
 import { CommonConstruct } from '../../common'
+import { Architecture } from '../../services'
 import { LambdaWithIamAccessEnvironment, LambdaWithIamAccessProps } from './types'
 
 /**
@@ -32,7 +34,7 @@ export class LambdaWithIamAccess extends CommonConstruct {
   lambdaPolicy: PolicyDocument
   lambdaRole: Role
   lambdaEnvironment: LambdaWithIamAccessEnvironment
-  lambdaLayers: ILayerVersion[]
+  lambdaLayers: ILayerVersion[] = []
   lambdaFunction: IFunction
   lambdaIamUser: User
   lambdaUserAccessKey: CfnAccessKey
@@ -68,9 +70,23 @@ export class LambdaWithIamAccess extends CommonConstruct {
     this.createIamSecretForLambdaFunction()
   }
 
-  protected resolveVpc() {}
+  protected resolveVpc() {
+    if (this.props.vpcName) {
+      this.lambdaVpc = this.vpcManager.retrieveCommonVpc(`${this.id}-vpc`, this, this.props.vpcName)
+    }
+  }
 
-  protected resolveSecurityGroups() {}
+  protected resolveSecurityGroups() {
+    if (this.props.securityGroupExportName) {
+      const lambdaSecurityGroup = SecurityGroup.fromSecurityGroupId(
+        this,
+        `${this.id}-security-group`,
+        Fn.importValue(this.props.securityGroupExportName)
+      )
+      this.addCfnOutput(`${this.id}-sg`, lambdaSecurityGroup.securityGroupId)
+      this.lambdaSecurityGroups = [lambdaSecurityGroup]
+    }
+  }
 
   protected resolveAccessPoint() {}
 
@@ -83,8 +99,14 @@ export class LambdaWithIamAccess extends CommonConstruct {
    */
   protected createLambdaPolicy() {
     this.lambdaPolicy = new PolicyDocument({
-      statements: [this.iamManager.statementForCreateAnyLogStream()],
+      statements: [this.iamManager.statementForCreateAnyLogStream(), this.iamManager.statementForPutXrayTelemetry()],
     })
+    if (this.props.configEnabled) {
+      this.lambdaPolicy.addStatements(
+        this.iamManager.statementForReadAnyAppConfig(),
+        this.iamManager.statementForAppConfigExecution()
+      )
+    }
   }
 
   /**
@@ -92,6 +114,11 @@ export class LambdaWithIamAccess extends CommonConstruct {
    */
   protected createLambdaRole() {
     this.lambdaRole = this.iamManager.createRoleForLambda(`${this.id}-lambda-role`, this, this.lambdaPolicy)
+    if (this.props.vpcName) {
+      this.lambdaRole.addManagedPolicy(
+        ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole')
+      )
+    }
   }
 
   /**
@@ -111,19 +138,33 @@ export class LambdaWithIamAccess extends CommonConstruct {
   protected createLambdaLayers() {
     const layers: LayerVersion[] = []
 
-    if (!this.props.lambdaLayerSources) return
-
-    _.forEach(this.props.lambdaLayerSources, (source: AssetCode, index: number) => {
-      layers.push(this.lambdaManager.createLambdaLayer(`${this.id}-layer-${index}`, this, source))
-    })
+    if (this.props.lambdaLayerSources) {
+      _.forEach(this.props.lambdaLayerSources, (source: AssetCode, index: number) => {
+        layers.push(this.lambdaManager.createLambdaLayer(`${this.id}-layer-${index}`, this, source))
+      })
+      this.lambdaLayers = layers
+    }
 
-    this.lambdaLayers = layers
+    if (this.props.configEnabled) {
+      const appConfigExtensionLayer = LayerVersion.fromLayerVersionArn(
+        this,
+        `${this.id}-ac-extlayer`,
+        this.appConfigManager.getArnForAppConfigExtension(this, Architecture.ARM_64)
+      )
+      this.lambdaLayers.push(appConfigExtensionLayer)
+    }
   }
 
   /**
    * @summary Method to create lambda function
    */
   protected createLambdaFunction() {
+    if (this.props.lambdaInsightsVersion) {
+      _.assign(this.props.lambda, {
+        insightsVersion: this.props.lambdaInsightsVersion,
+      })
+    }
+
     this.lambdaFunction = this.lambdaManager.createLambdaFunction(
       `${this.id}-lambda`,
       this,
@@ -154,12 +195,30 @@ export class LambdaWithIamAccess extends CommonConstruct {
       statements: [
         new PolicyStatement({
           actions: ['lambda:InvokeFunction'],
-          resources: [this.lambdaFunction.functionArn],
+          resources: [this.lambdaFunction.functionArn, `${this.lambdaFunction.functionArn}*`],
         }),
       ],
       users: [this.lambdaIamUser],
     })
 
+    if (this.props.lambda.lambdaAliases && !_.isEmpty(this.props.lambda.lambdaAliases)) {
+      _.forEach(this.props.lambda.lambdaAliases, (alias, index) => {
+        new Policy(this, `${this.id}-alias-user-policy`, {
+          policyName: `${this.id}-alias-policy-${index}-${this.props.stage}`,
+          statements: [
+            new PolicyStatement({
+              actions: ['lambda:InvokeFunction'],
+              resources: [
+                Fn.importValue(`${this.id}-${alias.aliasName}AliasArn`),
+                `${Fn.importValue(`${this.id}-${alias.aliasName}AliasArn`)}*`,
+              ],
+            }),
+          ],
+          users: [this.lambdaIamUser],
+        })
+      })
+    }
+
     this.lambdaUserAccessKey = new CfnAccessKey(this, `${this.id}-access-key-${this.props.stage}`, {
       userName: this.lambdaIamUser.userName,
     })

package/src/lib/aws/construct/lambda-with-iam-access/types.ts

@@ -1,17 +1,21 @@
-import { AssetCode } from 'aws-cdk-lib/aws-lambda'
+import { AssetCode, LambdaInsightsVersion } from 'aws-cdk-lib/aws-lambda'
 import { SecretProps } from 'aws-cdk-lib/aws-secretsmanager'
 import { CommonStackProps } from '../../common'
 import { LambdaEnvironment, LambdaProps } from '../../services'
 
 export interface LambdaWithIamAccessProps extends CommonStackProps {
+  configEnabled?: boolean
   lambda: LambdaProps
   lambdaHandler?: string
+  lambdaInsightsVersion?: LambdaInsightsVersion
   lambdaLayerSources: AssetCode[]
   lambdaSecret: SecretProps
   lambdaSource: AssetCode
   logLevel: string
   nodeEnv: string
+  securityGroupExportName?: string
   timezone: string
+  vpcName?: string
 }
 
 export interface LambdaWithIamAccessEnvironment extends LambdaEnvironment {}