@guardian/cdk 61.1.4 → 61.3.0

package/lib/constructs/iam/policies/index.d.ts

@@ -4,6 +4,7 @@ export * from "./base-policy";
 export * from "./cloudwatch";
 export * from "./describe-ec2";
 export * from "./dynamodb";
+export * from "./kcl";
 export * from "./log-shipping";
 export * from "./parameter-store-read";
 export * from "./s3-get-object";

package/lib/constructs/iam/policies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,OAAO,CAAC;AACtB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,OAAO,CAAC"}

package/lib/constructs/iam/policies/index.js

@@ -20,6 +20,7 @@ __exportStar(require("./base-policy"), exports);
 __exportStar(require("./cloudwatch"), exports);
 __exportStar(require("./describe-ec2"), exports);
 __exportStar(require("./dynamodb"), exports);
+__exportStar(require("./kcl"), exports);
 __exportStar(require("./log-shipping"), exports);
 __exportStar(require("./parameter-store-read"), exports);
 __exportStar(require("./s3-get-object"), exports);

package/lib/constructs/iam/policies/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,gDAA8B;AAC9B,gDAA8B;AAC9B,+CAA6B;AAC7B,iDAA+B;AAC/B,6CAA2B;AAC3B,iDAA+B;AAC/B,yDAAuC;AACvC,kDAAgC;AAChC,kDAAgC;AAChC,wCAAsB","sourcesContent":["export * from \"./anghammarad\";\nexport * from \"./assume-role\";\nexport * from \"./base-policy\";\nexport * from \"./cloudwatch\";\nexport * from \"./describe-ec2\";\nexport * from \"./dynamodb\";\nexport * from \"./log-shipping\";\nexport * from \"./parameter-store-read\";\nexport * from \"./s3-get-object\";\nexport * from \"./s3-put-object\";\nexport * from \"./ses\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,gDAA8B;AAC9B,gDAA8B;AAC9B,+CAA6B;AAC7B,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,iDAA+B;AAC/B,yDAAuC;AACvC,kDAAgC;AAChC,kDAAgC;AAChC,wCAAsB","sourcesContent":["export * from \"./anghammarad\";\nexport * from \"./assume-role\";\nexport * from \"./base-policy\";\nexport * from \"./cloudwatch\";\nexport * from \"./describe-ec2\";\nexport * from \"./dynamodb\";\nexport * from \"./kcl\";\nexport * from \"./log-shipping\";\nexport * from \"./parameter-store-read\";\nexport * from \"./s3-get-object\";\nexport * from \"./s3-put-object\";\nexport * from \"./ses\";\n"]}

package/lib/constructs/iam/policies/kcl.d.ts

@@ -0,0 +1,17 @@
+import type { GuStack } from "../../core";
+import { GuPolicy } from "./base-policy";
+export interface KCLApplication {
+    streamName: string;
+    applicationName: string;
+}
+/**
+ * Creates an `AWS::IAM::Policy` to grant all the required permissions for the Kinesis Client Library
+ * (https://github.com/awslabs/amazon-kinesis-client) - specifically for KCL v3, which requires many
+ * additional permissions over KCL v2.
+ *
+ * @see https://docs.aws.amazon.com/streams/latest/dev/kcl-iam-permissions.html
+ */
+export declare class GuKCLPolicy extends GuPolicy {
+    constructor(scope: GuStack, id: string, props: KCLApplication);
+}
+//# sourceMappingURL=kcl.d.ts.map

package/lib/constructs/iam/policies/kcl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kcl.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/kcl.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB;AAuBD;;;;;;GAMG;AACH,qBAAa,WAAY,SAAQ,QAAQ;gBAC3B,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc;CAgC9D"}

package/lib/constructs/iam/policies/kcl.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuKCLPolicy = void 0;
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const base_policy_1 = require("./base-policy");
+const kinesisActions = [
+    "DescribeStream",
+    "DescribeStreamSummary",
+    "RegisterStreamConsumer",
+    "GetRecords",
+    "GetShardIterator",
+    "ListShards",
+];
+const kinesisEnhancedFanOutActions = ["SubscribeToShard", "DescribeStreamConsumer"];
+const actionsOnAllTables = [
+    "Scan",
+    "CreateTable",
+    "DescribeTable",
+    "GetItem",
+    "PutItem",
+];
+const additionalLeaseTableActions = ["UpdateTable", "UpdateItem", "DeleteItem"];
+/**
+ * Creates an `AWS::IAM::Policy` to grant all the required permissions for the Kinesis Client Library
+ * (https://github.com/awslabs/amazon-kinesis-client) - specifically for KCL v3, which requires many
+ * additional permissions over KCL v2.
+ *
+ * @see https://docs.aws.amazon.com/streams/latest/dev/kcl-iam-permissions.html
+ */
+class GuKCLPolicy extends base_policy_1.GuPolicy {
+    constructor(scope, id, props) {
+        function allow(actionType, actions, resources) {
+            return new aws_iam_1.PolicyStatement({
+                effect: aws_iam_1.Effect.ALLOW,
+                actions: actions.map((a) => `${actionType}:${a}`),
+                resources: resources.map((r) => `arn:aws:${actionType}:${scope.region}:${scope.account}:${r}`),
+            });
+        }
+        function allowDynamoDB(actions, tableOrIndexNames) {
+            return allow("dynamodb", actions, tableOrIndexNames.map((name) => `table/${name}`));
+        }
+        const leaseTable = props.applicationName;
+        const metricsTable = `${props.applicationName}-WorkerMetricStats`;
+        const coordinatorTable = `${props.applicationName}-CoordinatorState`;
+        super(scope, id, {
+            statements: [
+                allow("kinesis", kinesisActions, [`stream/${props.streamName}`]),
+                allow("kinesis", kinesisEnhancedFanOutActions, [`stream/${props.streamName}/consumer/*`]),
+                allowDynamoDB(actionsOnAllTables, [leaseTable, metricsTable, coordinatorTable]),
+                allowDynamoDB(additionalLeaseTableActions, [leaseTable]),
+                allowDynamoDB(["Query"], [`${leaseTable}/index/*`]),
+                allow("cloudwatch", ["PutMetricData"], ["*"]),
+            ],
+        });
+    }
+}
+exports.GuKCLPolicy = GuKCLPolicy;
+//# sourceMappingURL=kcl.js.map

package/lib/constructs/iam/policies/kcl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kcl.js","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/kcl.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAE9D,+CAAyC;AAOzC,MAAM,cAAc,GAAa;IAC/B,gBAAgB;IAChB,uBAAuB;IACvB,wBAAwB;IACxB,YAAY;IACZ,kBAAkB;IAClB,YAAY;CACb,CAAC;AAEF,MAAM,4BAA4B,GAAa,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;AAE9F,MAAM,kBAAkB,GAAa;IACnC,MAAM;IACN,aAAa;IACb,eAAe;IACf,SAAS;IACT,SAAS;CACV,CAAC;AAEF,MAAM,2BAA2B,GAAa,CAAC,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAE1F;;;;;;GAMG;AACH,MAAa,WAAY,SAAQ,sBAAQ;IACvC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAqB;QAC3D,SAAS,KAAK,CAAC,UAAkB,EAAE,OAAiB,EAAE,SAAmB;YACvE,OAAO,IAAI,yBAAe,CAAC;gBACzB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,IAAI,CAAC,EAAE,CAAC;gBACjD,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,UAAU,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,SAAS,aAAa,CAAC,OAAiB,EAAE,iBAA2B;YACnE,OAAO,KAAK,CACV,UAAU,EACV,OAAO,EACP,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,CACjD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC;QACzC,MAAM,YAAY,GAAG,GAAG,KAAK,CAAC,eAAe,oBAAoB,CAAC;QAClE,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,eAAe,mBAAmB,CAAC;QAErE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,UAAU,EAAE;gBACV,KAAK,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,UAAU,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBAChE,KAAK,CAAC,SAAS,EAAE,4BAA4B,EAAE,CAAC,UAAU,KAAK,CAAC,UAAU,aAAa,CAAC,CAAC;gBACzF,aAAa,CAAC,kBAAkB,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;gBAC/E,aAAa,CAAC,2BAA2B,EAAE,CAAC,UAAU,CAAC,CAAC;gBACxD,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,UAAU,UAAU,CAAC,CAAC;gBACnD,KAAK,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;aAC9C;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAjCD,kCAiCC","sourcesContent":["import { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport type { GuStack } from \"../../core\";\nimport { GuPolicy } from \"./base-policy\";\n\nexport interface KCLApplication {\n  streamName: string;\n  applicationName: string;\n}\n\nconst kinesisActions: string[] = [\n  \"DescribeStream\",\n  \"DescribeStreamSummary\",\n  \"RegisterStreamConsumer\",\n  \"GetRecords\",\n  \"GetShardIterator\",\n  \"ListShards\",\n];\n\nconst kinesisEnhancedFanOutActions: string[] = [\"SubscribeToShard\", \"DescribeStreamConsumer\"];\n\nconst actionsOnAllTables: string[] = [\n  \"Scan\",\n  \"CreateTable\", // Allow KCL creating the lease, metrics, and coordinator tables - see https://github.com/guardian/cdk/pull/2578#discussion_r1954061397\n  \"DescribeTable\",\n  \"GetItem\",\n  \"PutItem\",\n];\n\nconst additionalLeaseTableActions: string[] = [\"UpdateTable\", \"UpdateItem\", \"DeleteItem\"];\n\n/**\n * Creates an `AWS::IAM::Policy` to grant all the required permissions for the Kinesis Client Library\n * (https://github.com/awslabs/amazon-kinesis-client) - specifically for KCL v3, which requires many\n * additional permissions over KCL v2.\n *\n * @see https://docs.aws.amazon.com/streams/latest/dev/kcl-iam-permissions.html\n */\nexport class GuKCLPolicy extends GuPolicy {\n  constructor(scope: GuStack, id: string, props: KCLApplication) {\n    function allow(actionType: string, actions: string[], resources: string[]): PolicyStatement {\n      return new PolicyStatement({\n        effect: Effect.ALLOW,\n        actions: actions.map((a) => `${actionType}:${a}`),\n        resources: resources.map((r) => `arn:aws:${actionType}:${scope.region}:${scope.account}:${r}`),\n      });\n    }\n\n    function allowDynamoDB(actions: string[], tableOrIndexNames: string[]): PolicyStatement {\n      return allow(\n        \"dynamodb\",\n        actions,\n        tableOrIndexNames.map((name) => `table/${name}`),\n      );\n    }\n\n    const leaseTable = props.applicationName;\n    const metricsTable = `${props.applicationName}-WorkerMetricStats`;\n    const coordinatorTable = `${props.applicationName}-CoordinatorState`;\n\n    super(scope, id, {\n      statements: [\n        allow(\"kinesis\", kinesisActions, [`stream/${props.streamName}`]),\n        allow(\"kinesis\", kinesisEnhancedFanOutActions, [`stream/${props.streamName}/consumer/*`]),\n        allowDynamoDB(actionsOnAllTables, [leaseTable, metricsTable, coordinatorTable]),\n        allowDynamoDB(additionalLeaseTableActions, [leaseTable]),\n        allowDynamoDB([\"Query\"], [`${leaseTable}/index/*`]),\n        allow(\"cloudwatch\", [\"PutMetricData\"], [\"*\"]),\n      ],\n    });\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "61.1.4",
+  "version": "61.3.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [