@hot-updater/aws 1.0.0-rc.3 → 1.0.0-rc.4

package/dist/iac/index.cjs

@@ -9437,6 +9437,41 @@ const hasExpectedSchema = (table) => {
 	return keyAttributes.every((attributeName) => table?.AttributeDefinitions?.some(({ AttributeName, AttributeType }) => AttributeName === attributeName && AttributeType === "S")) && table?.BillingModeSummary?.BillingMode === "PAY_PER_REQUEST" && table.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && table.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && hasKeySchema(table?.KeySchema, primaryKeySchema) && hasKeySchema(updateIndex?.KeySchema, updateIndexKeySchema) && updateIndex?.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && updateIndex?.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && updateIndex?.Projection?.ProjectionType === "ALL";
 };
 const isResourceNotFound = (error) => typeof error === "object" && error !== null && Reflect.get(error, "name") === "ResourceNotFoundException";
+const buildDynamoDBCreateTableInput = (tableName) => ({
+	AttributeDefinitions: [
+		{
+			AttributeName: "pk",
+			AttributeType: "S"
+		},
+		{
+			AttributeName: "sk",
+			AttributeType: "S"
+		},
+		{
+			AttributeName: "gsi1pk",
+			AttributeType: "S"
+		},
+		{
+			AttributeName: "gsi1sk",
+			AttributeType: "S"
+		}
+	],
+	BillingMode: "PAY_PER_REQUEST",
+	DeletionProtectionEnabled: true,
+	GlobalSecondaryIndexes: [{
+		IndexName: DYNAMODB_UPDATE_INDEX_NAME,
+		KeySchema: [...updateIndexKeySchema],
+		Projection: { ProjectionType: "ALL" },
+		OnDemandThroughput: onDemandThroughput
+	}],
+	KeySchema: [...primaryKeySchema],
+	OnDemandThroughput: onDemandThroughput,
+	TableName: tableName
+});
+const buildDynamoDBBackupInput = (tableName) => ({
+	PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
+	TableName: tableName
+});
 var DynamoDBManager = class {
 	region;
 	client;
@@ -9457,37 +9492,7 @@ var DynamoDBManager = class {
 			if (error instanceof Error && error.name === "AccessDeniedException" && error.message.includes(DYNAMODB_DESCRIBE_TABLE_ACTION)) throw new DynamoDBPermissionError(tableName, this.region, error);
 			if (!isResourceNotFound(error)) throw error;
 		}
-		await this.client.createTable({
-			AttributeDefinitions: [
-				{
-					AttributeName: "pk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "sk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "gsi1pk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "gsi1sk",
-					AttributeType: "S"
-				}
-			],
-			BillingMode: "PAY_PER_REQUEST",
-			DeletionProtectionEnabled: true,
-			GlobalSecondaryIndexes: [{
-				IndexName: DYNAMODB_UPDATE_INDEX_NAME,
-				KeySchema: [...updateIndexKeySchema],
-				Projection: { ProjectionType: "ALL" },
-				OnDemandThroughput: onDemandThroughput
-			}],
-			KeySchema: [...primaryKeySchema],
-			OnDemandThroughput: onDemandThroughput,
-			TableName: tableName
-		});
+		await this.client.createTable(buildDynamoDBCreateTableInput(tableName));
 		await (0, _aws_sdk_client_dynamodb.waitUntilTableExists)({
 			client: this.client,
 			maxWaitTime: 120
@@ -9497,14 +9502,80 @@ var DynamoDBManager = class {
 	async ensureLifecycle(tableName) {
 		const { ContinuousBackupsDescription } = await this.client.describeContinuousBackups({ TableName: tableName });
 		if (ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus === "ENABLED") return;
-		await this.client.updateContinuousBackups({
-			PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
-			TableName: tableName
-		});
+		await this.client.updateContinuousBackups(buildDynamoDBBackupInput(tableName));
 	}
 };
 //#endregion
 //#region iac/iam.ts
+const buildDynamoDBPolicy = (region, accountId, tableName) => {
+	const tableArn = `arn:aws:dynamodb:${region}:${accountId}:table/${tableName}`;
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: ["dynamodb:Query"],
+			Effect: "Allow",
+			Resource: [`${tableArn}/index/${DYNAMODB_UPDATE_INDEX_NAME}`]
+		}, {
+			Action: [
+				"dynamodb:BatchGetItem",
+				"dynamodb:DeleteItem",
+				"dynamodb:GetItem",
+				"dynamodb:PutItem",
+				"dynamodb:Query",
+				"dynamodb:TransactWriteItems",
+				"dynamodb:UpdateItem"
+			],
+			Condition: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": [
+				"_hot-updater",
+				"bundles",
+				"bundle_patches",
+				DYNAMODB_CHANNEL_PARTITION,
+				DYNAMODB_CHANNEL_NAME_PARTITION,
+				DYNAMODB_INSIGHTS_PARTITION,
+				DYNAMODB_INSIGHTS_INSTALLATIONS_PARTITION,
+				DYNAMODB_INSIGHTS_EVENT_IDS_PARTITION,
+				`${DYNAMODB_INSIGHTS_BUNDLE_PREFIX}*`,
+				"_hot-updater#insights-user#*",
+				DYNAMODB_API_KEY_PARTITION,
+				DYNAMODB_API_KEY_HASH_PARTITION
+			] } },
+			Effect: "Allow",
+			Resource: [tableArn]
+		}]
+	};
+};
+const buildS3Policy = (bucketName) => {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: ["s3:ListBucket"],
+			Effect: "Allow",
+			Resource: [`arn:aws:s3:::${bucketName}`]
+		}, {
+			Action: ["s3:GetObject"],
+			Effect: "Allow",
+			Resource: [`arn:aws:s3:::${bucketName}/*`]
+		}]
+	};
+};
+const buildSsmPolicy = (region, accountId, parameterName) => {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Effect: "Allow",
+			Action: ["ssm:GetParameter"],
+			Resource: `arn:aws:ssm:${region}:${accountId}:parameter/${parameterName.replace(/^\/+/, "")}`
+		}]
+	};
+};
+const LAMBDA_EDGE_TRUST_POLICY = {
+	Version: "2012-10-17",
+	Statement: [{
+		Effect: "Allow",
+		Principal: { Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"] },
+		Action: "sts:AssumeRole"
+	}]
+};
 var IAMManager = class {
 	region;
 	credentials;
@@ -9521,75 +9592,22 @@ var IAMManager = class {
 		});
 	}
 	async ensureDynamoDBPolicy(iamClient, roleName, accountId, tableName) {
-		const tableArn = `arn:aws:dynamodb:${this.region}:${accountId}:table/${tableName}`;
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Action: ["dynamodb:Query"],
-					Effect: "Allow",
-					Resource: [`${tableArn}/index/${DYNAMODB_UPDATE_INDEX_NAME}`]
-				}, {
-					Action: [
-						"dynamodb:BatchGetItem",
-						"dynamodb:DeleteItem",
-						"dynamodb:GetItem",
-						"dynamodb:PutItem",
-						"dynamodb:Query",
-						"dynamodb:TransactWriteItems",
-						"dynamodb:UpdateItem"
-					],
-					Condition: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": [
-						"_hot-updater",
-						"bundles",
-						"bundle_patches",
-						DYNAMODB_CHANNEL_PARTITION,
-						DYNAMODB_CHANNEL_NAME_PARTITION,
-						DYNAMODB_INSIGHTS_PARTITION,
-						DYNAMODB_INSIGHTS_INSTALLATIONS_PARTITION,
-						DYNAMODB_INSIGHTS_EVENT_IDS_PARTITION,
-						`${DYNAMODB_INSIGHTS_BUNDLE_PREFIX}*`,
-						"_hot-updater#insights-user#*",
-						DYNAMODB_API_KEY_PARTITION,
-						DYNAMODB_API_KEY_HASH_PARTITION
-					] } },
-					Effect: "Allow",
-					Resource: [tableArn]
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildDynamoDBPolicy(this.region, accountId, tableName)),
 			PolicyName: "HotUpdaterDynamoDBReadAccess",
 			RoleName: roleName
 		});
 	}
 	async ensureS3Policy(iamClient, roleName, bucketName) {
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Action: ["s3:ListBucket"],
-					Effect: "Allow",
-					Resource: [`arn:aws:s3:::${bucketName}`]
-				}, {
-					Action: ["s3:GetObject"],
-					Effect: "Allow",
-					Resource: [`arn:aws:s3:::${bucketName}/*`]
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildS3Policy(bucketName)),
 			PolicyName: "HotUpdaterS3ReadAccess",
 			RoleName: roleName
 		});
 	}
 	async ensureSsmPolicy(iamClient, roleName, accountId, parameterName) {
-		const parameterPath = parameterName.replace(/^\/+/, "");
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Effect: "Allow",
-					Action: ["ssm:GetParameter"],
-					Resource: `arn:aws:ssm:${this.region}:${accountId}:parameter/${parameterPath}`
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildSsmPolicy(this.region, accountId, parameterName)),
 			PolicyName: "HotUpdaterSSMAccess",
 			RoleName: roleName
 		});
@@ -9604,14 +9622,7 @@ var IAMManager = class {
 			credentials: this.credentials
 		}).getCallerIdentity({})).Account;
 		if (!accountId) throw new Error("Failed to get AWS account ID");
-		const assumeRolePolicyDocument = JSON.stringify({
-			Version: "2012-10-17",
-			Statement: [{
-				Effect: "Allow",
-				Principal: { Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"] },
-				Action: "sts:AssumeRole"
-			}]
-		});
+		const assumeRolePolicyDocument = JSON.stringify(LAMBDA_EDGE_TRUST_POLICY);
 		const roleName = `hot-updater-edge-${(0, node_crypto.createHash)("sha256").update(options.lambdaName).digest("hex").slice(0, 16)}`;
 		try {
 			const { Role: existingRole } = await iamClient.getRole({ RoleName: roleName });
@@ -10282,6 +10293,12 @@ const runInit = async ({ build, envFile }) => {
 	_hot_updater_cli_tools.p.log.success("Done! 🎉");
 };
 //#endregion
+exports.LAMBDA_EDGE_TRUST_POLICY = LAMBDA_EDGE_TRUST_POLICY;
+exports.buildDynamoDBBackupInput = buildDynamoDBBackupInput;
+exports.buildDynamoDBCreateTableInput = buildDynamoDBCreateTableInput;
+exports.buildDynamoDBPolicy = buildDynamoDBPolicy;
+exports.buildS3Policy = buildS3Policy;
+exports.buildSsmPolicy = buildSsmPolicy;
 exports.prepareDynamoDBApiKey = prepareDynamoDBApiKey;
 exports.prepareDynamoDBDeployment = prepareDynamoDBDeployment;
 exports.runInit = runInit;

package/dist/iac/index.d.cts

@@ -1,5 +1,96 @@
 import { RunInitOptions } from "@hot-updater/cli-tools";
 import { ApiKeyModel } from "@hot-updater/plugin-core";
+//#region iac/dynamodb.d.ts
+declare const buildDynamoDBCreateTableInput: (tableName: string) => {
+  AttributeDefinitions: {
+    AttributeName: string;
+    AttributeType: "S";
+  }[];
+  BillingMode: "PAY_PER_REQUEST";
+  DeletionProtectionEnabled: true;
+  GlobalSecondaryIndexes: {
+    IndexName: string;
+    KeySchema: ({
+      readonly AttributeName: "gsi1pk";
+      readonly KeyType: "HASH";
+    } | {
+      readonly AttributeName: "gsi1sk";
+      readonly KeyType: "RANGE";
+    })[];
+    Projection: {
+      ProjectionType: "ALL";
+    };
+    OnDemandThroughput: {
+      readonly MaxReadRequestUnits: 4000;
+      readonly MaxWriteRequestUnits: 100;
+    };
+  }[];
+  KeySchema: ({
+    readonly AttributeName: "pk";
+    readonly KeyType: "HASH";
+  } | {
+    readonly AttributeName: "sk";
+    readonly KeyType: "RANGE";
+  })[];
+  OnDemandThroughput: {
+    readonly MaxReadRequestUnits: 4000;
+    readonly MaxWriteRequestUnits: 100;
+  };
+  TableName: string;
+};
+declare const buildDynamoDBBackupInput: (tableName: string) => {
+  PointInTimeRecoverySpecification: {
+    PointInTimeRecoveryEnabled: true;
+  };
+  TableName: string;
+};
+//#endregion
+//#region iac/iam.d.ts
+declare const buildDynamoDBPolicy: (region: string, accountId: string, tableName: string) => {
+  Version: string;
+  Statement: ({
+    Action: string[];
+    Effect: string;
+    Resource: string[];
+    Condition?: undefined;
+  } | {
+    Action: string[];
+    Condition: {
+      "ForAllValues:StringLike": {
+        "dynamodb:LeadingKeys": string[];
+      };
+    };
+    Effect: string;
+    Resource: string[];
+  })[];
+};
+declare const buildS3Policy: (bucketName: string) => {
+  Version: string;
+  Statement: {
+    Action: string[];
+    Effect: string;
+    Resource: string[];
+  }[];
+};
+declare const buildSsmPolicy: (region: string, accountId: string, parameterName: string) => {
+  Version: string;
+  Statement: {
+    Effect: string;
+    Action: string[];
+    Resource: string;
+  }[];
+};
+declare const LAMBDA_EDGE_TRUST_POLICY: {
+  Version: string;
+  Statement: {
+    Effect: string;
+    Principal: {
+      Service: string[];
+    };
+    Action: string;
+  }[];
+};
+//#endregion
 //#region iac/index.d.ts
 declare const prepareDynamoDBDeployment: (input: {
   readonly credentials: {
@@ -16,4 +107,4 @@ declare const prepareDynamoDBApiKey: (input: {
 }) => Promise<string>;
 declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
 //#endregion
-export { prepareDynamoDBApiKey, prepareDynamoDBDeployment, runInit };
+export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildS3Policy, buildSsmPolicy, prepareDynamoDBApiKey, prepareDynamoDBDeployment, runInit };

package/dist/iac/index.d.mts

@@ -1,5 +1,96 @@
-import { RunInitOptions } from "@hot-updater/cli-tools";
+import { InitError, RunInitOptions } from "@hot-updater/cli-tools";
 import { ApiKeyModel } from "@hot-updater/plugin-core";
+//#region iac/dynamodb.d.ts
+declare const buildDynamoDBCreateTableInput: (tableName: string) => {
+  AttributeDefinitions: {
+    AttributeName: string;
+    AttributeType: "S";
+  }[];
+  BillingMode: "PAY_PER_REQUEST";
+  DeletionProtectionEnabled: true;
+  GlobalSecondaryIndexes: {
+    IndexName: string;
+    KeySchema: ({
+      readonly AttributeName: "gsi1pk";
+      readonly KeyType: "HASH";
+    } | {
+      readonly AttributeName: "gsi1sk";
+      readonly KeyType: "RANGE";
+    })[];
+    Projection: {
+      ProjectionType: "ALL";
+    };
+    OnDemandThroughput: {
+      readonly MaxReadRequestUnits: 4000;
+      readonly MaxWriteRequestUnits: 100;
+    };
+  }[];
+  KeySchema: ({
+    readonly AttributeName: "pk";
+    readonly KeyType: "HASH";
+  } | {
+    readonly AttributeName: "sk";
+    readonly KeyType: "RANGE";
+  })[];
+  OnDemandThroughput: {
+    readonly MaxReadRequestUnits: 4000;
+    readonly MaxWriteRequestUnits: 100;
+  };
+  TableName: string;
+};
+declare const buildDynamoDBBackupInput: (tableName: string) => {
+  PointInTimeRecoverySpecification: {
+    PointInTimeRecoveryEnabled: true;
+  };
+  TableName: string;
+};
+//#endregion
+//#region iac/iam.d.ts
+declare const buildDynamoDBPolicy: (region: string, accountId: string, tableName: string) => {
+  Version: string;
+  Statement: ({
+    Action: string[];
+    Effect: string;
+    Resource: string[];
+    Condition?: undefined;
+  } | {
+    Action: string[];
+    Condition: {
+      "ForAllValues:StringLike": {
+        "dynamodb:LeadingKeys": string[];
+      };
+    };
+    Effect: string;
+    Resource: string[];
+  })[];
+};
+declare const buildS3Policy: (bucketName: string) => {
+  Version: string;
+  Statement: {
+    Action: string[];
+    Effect: string;
+    Resource: string[];
+  }[];
+};
+declare const buildSsmPolicy: (region: string, accountId: string, parameterName: string) => {
+  Version: string;
+  Statement: {
+    Effect: string;
+    Action: string[];
+    Resource: string;
+  }[];
+};
+declare const LAMBDA_EDGE_TRUST_POLICY: {
+  Version: string;
+  Statement: {
+    Effect: string;
+    Principal: {
+      Service: string[];
+    };
+    Action: string;
+  }[];
+};
+//#endregion
 //#region iac/index.d.ts
 declare const prepareDynamoDBDeployment: (input: {
   readonly credentials: {
@@ -16,4 +107,4 @@ declare const prepareDynamoDBApiKey: (input: {
 }) => Promise<string>;
 declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
 //#endregion
-export { prepareDynamoDBApiKey, prepareDynamoDBDeployment, runInit };
+export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildS3Policy, buildSsmPolicy, prepareDynamoDBApiKey, prepareDynamoDBDeployment, runInit };

package/dist/iac/index.mjs

@@ -9432,6 +9432,41 @@ const hasExpectedSchema = (table) => {
 	return keyAttributes.every((attributeName) => table?.AttributeDefinitions?.some(({ AttributeName, AttributeType }) => AttributeName === attributeName && AttributeType === "S")) && table?.BillingModeSummary?.BillingMode === "PAY_PER_REQUEST" && table.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && table.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && hasKeySchema(table?.KeySchema, primaryKeySchema) && hasKeySchema(updateIndex?.KeySchema, updateIndexKeySchema) && updateIndex?.OnDemandThroughput?.MaxReadRequestUnits === onDemandThroughput.MaxReadRequestUnits && updateIndex?.OnDemandThroughput?.MaxWriteRequestUnits === onDemandThroughput.MaxWriteRequestUnits && updateIndex?.Projection?.ProjectionType === "ALL";
 };
 const isResourceNotFound = (error) => typeof error === "object" && error !== null && Reflect.get(error, "name") === "ResourceNotFoundException";
+const buildDynamoDBCreateTableInput = (tableName) => ({
+	AttributeDefinitions: [
+		{
+			AttributeName: "pk",
+			AttributeType: "S"
+		},
+		{
+			AttributeName: "sk",
+			AttributeType: "S"
+		},
+		{
+			AttributeName: "gsi1pk",
+			AttributeType: "S"
+		},
+		{
+			AttributeName: "gsi1sk",
+			AttributeType: "S"
+		}
+	],
+	BillingMode: "PAY_PER_REQUEST",
+	DeletionProtectionEnabled: true,
+	GlobalSecondaryIndexes: [{
+		IndexName: DYNAMODB_UPDATE_INDEX_NAME,
+		KeySchema: [...updateIndexKeySchema],
+		Projection: { ProjectionType: "ALL" },
+		OnDemandThroughput: onDemandThroughput
+	}],
+	KeySchema: [...primaryKeySchema],
+	OnDemandThroughput: onDemandThroughput,
+	TableName: tableName
+});
+const buildDynamoDBBackupInput = (tableName) => ({
+	PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
+	TableName: tableName
+});
 var DynamoDBManager = class {
 	region;
 	client;
@@ -9452,37 +9487,7 @@ var DynamoDBManager = class {
 			if (error instanceof Error && error.name === "AccessDeniedException" && error.message.includes(DYNAMODB_DESCRIBE_TABLE_ACTION)) throw new DynamoDBPermissionError(tableName, this.region, error);
 			if (!isResourceNotFound(error)) throw error;
 		}
-		await this.client.createTable({
-			AttributeDefinitions: [
-				{
-					AttributeName: "pk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "sk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "gsi1pk",
-					AttributeType: "S"
-				},
-				{
-					AttributeName: "gsi1sk",
-					AttributeType: "S"
-				}
-			],
-			BillingMode: "PAY_PER_REQUEST",
-			DeletionProtectionEnabled: true,
-			GlobalSecondaryIndexes: [{
-				IndexName: DYNAMODB_UPDATE_INDEX_NAME,
-				KeySchema: [...updateIndexKeySchema],
-				Projection: { ProjectionType: "ALL" },
-				OnDemandThroughput: onDemandThroughput
-			}],
-			KeySchema: [...primaryKeySchema],
-			OnDemandThroughput: onDemandThroughput,
-			TableName: tableName
-		});
+		await this.client.createTable(buildDynamoDBCreateTableInput(tableName));
 		await waitUntilTableExists({
 			client: this.client,
 			maxWaitTime: 120
@@ -9492,14 +9497,80 @@ var DynamoDBManager = class {
 	async ensureLifecycle(tableName) {
 		const { ContinuousBackupsDescription } = await this.client.describeContinuousBackups({ TableName: tableName });
 		if (ContinuousBackupsDescription?.PointInTimeRecoveryDescription?.PointInTimeRecoveryStatus === "ENABLED") return;
-		await this.client.updateContinuousBackups({
-			PointInTimeRecoverySpecification: { PointInTimeRecoveryEnabled: true },
-			TableName: tableName
-		});
+		await this.client.updateContinuousBackups(buildDynamoDBBackupInput(tableName));
 	}
 };
 //#endregion
 //#region iac/iam.ts
+const buildDynamoDBPolicy = (region, accountId, tableName) => {
+	const tableArn = `arn:aws:dynamodb:${region}:${accountId}:table/${tableName}`;
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: ["dynamodb:Query"],
+			Effect: "Allow",
+			Resource: [`${tableArn}/index/${DYNAMODB_UPDATE_INDEX_NAME}`]
+		}, {
+			Action: [
+				"dynamodb:BatchGetItem",
+				"dynamodb:DeleteItem",
+				"dynamodb:GetItem",
+				"dynamodb:PutItem",
+				"dynamodb:Query",
+				"dynamodb:TransactWriteItems",
+				"dynamodb:UpdateItem"
+			],
+			Condition: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": [
+				"_hot-updater",
+				"bundles",
+				"bundle_patches",
+				DYNAMODB_CHANNEL_PARTITION,
+				DYNAMODB_CHANNEL_NAME_PARTITION,
+				DYNAMODB_INSIGHTS_PARTITION,
+				DYNAMODB_INSIGHTS_INSTALLATIONS_PARTITION,
+				DYNAMODB_INSIGHTS_EVENT_IDS_PARTITION,
+				`${DYNAMODB_INSIGHTS_BUNDLE_PREFIX}*`,
+				"_hot-updater#insights-user#*",
+				DYNAMODB_API_KEY_PARTITION,
+				DYNAMODB_API_KEY_HASH_PARTITION
+			] } },
+			Effect: "Allow",
+			Resource: [tableArn]
+		}]
+	};
+};
+const buildS3Policy = (bucketName) => {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: ["s3:ListBucket"],
+			Effect: "Allow",
+			Resource: [`arn:aws:s3:::${bucketName}`]
+		}, {
+			Action: ["s3:GetObject"],
+			Effect: "Allow",
+			Resource: [`arn:aws:s3:::${bucketName}/*`]
+		}]
+	};
+};
+const buildSsmPolicy = (region, accountId, parameterName) => {
+	return {
+		Version: "2012-10-17",
+		Statement: [{
+			Effect: "Allow",
+			Action: ["ssm:GetParameter"],
+			Resource: `arn:aws:ssm:${region}:${accountId}:parameter/${parameterName.replace(/^\/+/, "")}`
+		}]
+	};
+};
+const LAMBDA_EDGE_TRUST_POLICY = {
+	Version: "2012-10-17",
+	Statement: [{
+		Effect: "Allow",
+		Principal: { Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"] },
+		Action: "sts:AssumeRole"
+	}]
+};
 var IAMManager = class {
 	region;
 	credentials;
@@ -9516,75 +9587,22 @@ var IAMManager = class {
 		});
 	}
 	async ensureDynamoDBPolicy(iamClient, roleName, accountId, tableName) {
-		const tableArn = `arn:aws:dynamodb:${this.region}:${accountId}:table/${tableName}`;
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Action: ["dynamodb:Query"],
-					Effect: "Allow",
-					Resource: [`${tableArn}/index/${DYNAMODB_UPDATE_INDEX_NAME}`]
-				}, {
-					Action: [
-						"dynamodb:BatchGetItem",
-						"dynamodb:DeleteItem",
-						"dynamodb:GetItem",
-						"dynamodb:PutItem",
-						"dynamodb:Query",
-						"dynamodb:TransactWriteItems",
-						"dynamodb:UpdateItem"
-					],
-					Condition: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": [
-						"_hot-updater",
-						"bundles",
-						"bundle_patches",
-						DYNAMODB_CHANNEL_PARTITION,
-						DYNAMODB_CHANNEL_NAME_PARTITION,
-						DYNAMODB_INSIGHTS_PARTITION,
-						DYNAMODB_INSIGHTS_INSTALLATIONS_PARTITION,
-						DYNAMODB_INSIGHTS_EVENT_IDS_PARTITION,
-						`${DYNAMODB_INSIGHTS_BUNDLE_PREFIX}*`,
-						"_hot-updater#insights-user#*",
-						DYNAMODB_API_KEY_PARTITION,
-						DYNAMODB_API_KEY_HASH_PARTITION
-					] } },
-					Effect: "Allow",
-					Resource: [tableArn]
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildDynamoDBPolicy(this.region, accountId, tableName)),
 			PolicyName: "HotUpdaterDynamoDBReadAccess",
 			RoleName: roleName
 		});
 	}
 	async ensureS3Policy(iamClient, roleName, bucketName) {
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Action: ["s3:ListBucket"],
-					Effect: "Allow",
-					Resource: [`arn:aws:s3:::${bucketName}`]
-				}, {
-					Action: ["s3:GetObject"],
-					Effect: "Allow",
-					Resource: [`arn:aws:s3:::${bucketName}/*`]
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildS3Policy(bucketName)),
 			PolicyName: "HotUpdaterS3ReadAccess",
 			RoleName: roleName
 		});
 	}
 	async ensureSsmPolicy(iamClient, roleName, accountId, parameterName) {
-		const parameterPath = parameterName.replace(/^\/+/, "");
 		await iamClient.putRolePolicy({
-			PolicyDocument: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Effect: "Allow",
-					Action: ["ssm:GetParameter"],
-					Resource: `arn:aws:ssm:${this.region}:${accountId}:parameter/${parameterPath}`
-				}]
-			}),
+			PolicyDocument: JSON.stringify(buildSsmPolicy(this.region, accountId, parameterName)),
 			PolicyName: "HotUpdaterSSMAccess",
 			RoleName: roleName
 		});
@@ -9599,14 +9617,7 @@ var IAMManager = class {
 			credentials: this.credentials
 		}).getCallerIdentity({})).Account;
 		if (!accountId) throw new Error("Failed to get AWS account ID");
-		const assumeRolePolicyDocument = JSON.stringify({
-			Version: "2012-10-17",
-			Statement: [{
-				Effect: "Allow",
-				Principal: { Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"] },
-				Action: "sts:AssumeRole"
-			}]
-		});
+		const assumeRolePolicyDocument = JSON.stringify(LAMBDA_EDGE_TRUST_POLICY);
 		const roleName = `hot-updater-edge-${createHash("sha256").update(options.lambdaName).digest("hex").slice(0, 16)}`;
 		try {
 			const { Role: existingRole } = await iamClient.getRole({ RoleName: roleName });
@@ -10277,4 +10288,4 @@ const runInit = async ({ build, envFile }) => {
 	p.log.success("Done! 🎉");
 };
 //#endregion
-export { prepareDynamoDBApiKey, prepareDynamoDBDeployment, runInit };
+export { LAMBDA_EDGE_TRUST_POLICY, buildDynamoDBBackupInput, buildDynamoDBCreateTableInput, buildDynamoDBPolicy, buildS3Policy, buildSsmPolicy, prepareDynamoDBApiKey, prepareDynamoDBDeployment, runInit };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/aws",
   "type": "module",
-  "version": "1.0.0-rc.3",
+  "version": "1.0.0-rc.4",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -69,8 +69,8 @@
     "hono": "4.12.34",
     "aws-lambda": "1.0.7",
     "@hot-updater/cli-tools": "1.0.0-rc.3",
-    "@hot-updater/server": "1.0.0-rc.3",
-    "@hot-updater/plugin-core": "1.0.0-rc.3"
+    "@hot-updater/plugin-core": "1.0.0-rc.3",
+    "@hot-updater/server": "1.0.0-rc.3"
   },
   "scripts": {
     "build": "tsdown",