@jaypie/constructs 1.1.48 → 1.1.50

package/dist/esm/index.js

@@ -1,22 +1,26 @@
+import { CDK as CDK$2, ConfigurationError, mergeDomain, isValidSubdomain, isValidHostname } from '@jaypie/cdk';
+export { CDK } from '@jaypie/cdk';
 import { Construct } from 'constructs';
 import * as cdk from 'aws-cdk-lib';
 import { Tags, Stack, Duration, RemovalPolicy, Fn, CfnOutput, SecretValue } from 'aws-cdk-lib';
 import * as acm from 'aws-cdk-lib/aws-certificatemanager';
 import * as apiGateway from 'aws-cdk-lib/aws-apigateway';
 import * as route53 from 'aws-cdk-lib/aws-route53';
-import { HostedZone } from 'aws-cdk-lib/aws-route53';
+import { TxtRecord, NsRecord, MxRecord, CnameRecord, ARecord, RecordTarget, HostedZone } from 'aws-cdk-lib/aws-route53';
 import * as route53Targets from 'aws-cdk-lib/aws-route53-targets';
-import { CDK as CDK$2, ConfigurationError, mergeDomain, isValidSubdomain, isValidHostname } from '@jaypie/cdk';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import { DatadogLambda } from 'datadog-cdk-constructs-v2';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as logDestinations from 'aws-cdk-lib/aws-logs-destinations';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as s3n from 'aws-cdk-lib/aws-s3-notifications';
 import * as sqs from 'aws-cdk-lib/aws-sqs';
 import * as lambdaEventSources from 'aws-cdk-lib/aws-lambda-event-sources';
-import { ServicePrincipal, Role, FederatedPrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';
+import { Role, FederatedPrincipal, PolicyStatement, Effect, ServicePrincipal, ManagedPolicy } from 'aws-cdk-lib/aws-iam';
 import { LogGroup, RetentionDays, FilterPattern } from 'aws-cdk-lib/aws-logs';
-import * as sso from 'aws-cdk-lib/aws-sso';
+import { CfnPermissionSet, CfnAssignment } from 'aws-cdk-lib/aws-sso';
+import { CfnApplication } from 'aws-cdk-lib/aws-sam';
+import { ConfigurationError as ConfigurationError$1 } from '@jaypie/errors';
 import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
 import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
 
@@ -215,6 +219,33 @@ function jaypieLambdaEnv(options = {}) {
     return environment;
 }
 
+const DEFAULT_FUNCTION_NAME$1 = "DatadogForwarderFunction";
+// Cache to store resolved functions
+// Using nested structure to support multiple functions per scope with automatic GC
+const functionCache = new WeakMap();
+function resolveDatadogForwarderFunction(scope, options) {
+    const { import: importValue, name } = options || {};
+    const functionName = name || DEFAULT_FUNCTION_NAME$1;
+    const importKey = importValue || CDK$2.IMPORT.DATADOG_LOG_FORWARDER;
+    // Create a cache key based on name and import
+    const cacheKey = `${functionName}:${importKey}`;
+    // Get or create scope cache
+    let scopeCache = functionCache.get(scope);
+    if (!scopeCache) {
+        scopeCache = new Map();
+        functionCache.set(scope, scopeCache);
+    }
+    // Return cached function if it exists
+    const cachedFunction = scopeCache.get(cacheKey);
+    if (cachedFunction) {
+        return cachedFunction;
+    }
+    // Create and cache the function
+    const func = lambda.Function.fromFunctionArn(scope, functionName, cdk.Fn.importValue(importKey));
+    scopeCache.set(cacheKey, func);
+    return func;
+}
+
 function resolveDatadogLayers(scope, options = {}) {
     const { datadogApiKeyArn, uniqueId } = options;
     let resolvedRegion = Stack.of(scope).region || "us-east-1";
@@ -234,6 +265,35 @@ function resolveDatadogLayers(scope, options = {}) {
     return [datadogNodeLayer, datadogExtensionLayer];
 }
 
+const DEFAULT_FUNCTION_NAME = "DatadogForwarderFunction";
+// Cache to store resolved logging destinations
+// Using nested structure to support multiple destinations per scope with automatic GC
+const destinationCache = new WeakMap();
+function resolveDatadogLoggingDestination(scope, options) {
+    const { import: importValue, name } = options || {};
+    // Create a cache key based on name and import (same as forwarder function)
+    const functionName = name || DEFAULT_FUNCTION_NAME;
+    const importKey = importValue || CDK$2.IMPORT.DATADOG_LOG_FORWARDER;
+    const cacheKey = `${functionName}:${importKey}`;
+    // Get or create scope cache
+    let scopeCache = destinationCache.get(scope);
+    if (!scopeCache) {
+        scopeCache = new Map();
+        destinationCache.set(scope, scopeCache);
+    }
+    // Return cached destination if it exists
+    const cachedDestination = scopeCache.get(cacheKey);
+    if (cachedDestination) {
+        return cachedDestination;
+    }
+    // Resolve the Datadog forwarder function
+    const datadogForwarderFunction = resolveDatadogForwarderFunction(scope, options);
+    // Create and cache the logging destination
+    const datadogLoggingDestination = new logDestinations.LambdaDestination(datadogForwarderFunction);
+    scopeCache.set(cacheKey, datadogLoggingDestination);
+    return datadogLoggingDestination;
+}
+
 function resolveHostedZone(scope, { name = "HostedZone", zone = process.env.CDK_ENV_HOSTED_ZONE, } = {}) {
     if (!zone) {
         throw new ConfigurationError("No `zone` provided. Set CDK_ENV_HOSTED_ZONE to use environment zone");
@@ -407,6 +467,11 @@ class JaypieApiGateway extends Construct {
     applyRemovalPolicy(policy) {
         this._api.applyRemovalPolicy(policy);
     }
+    get restApiRef() {
+        return {
+            restApiId: this._api.restApiId,
+        };
+    }
 }
 
 class JaypieStack extends Stack {
@@ -588,7 +653,10 @@ class JaypieLambda extends Construct {
         return this._reference.resourceArnsForGrantInvoke;
     }
     get functionRef() {
-        return this._reference.functionRef;
+        return {
+            functionArn: this._reference.functionArn,
+            functionName: this._reference.functionName,
+        };
     }
     addEventSource(source) {
         this._reference.addEventSource(source);
@@ -950,7 +1018,7 @@ class JaypieBucketQueuedLambda extends JaypieQueuedLambda {
     get policy() {
         return this._bucket.policy;
     }
-    addEventNotification(event, dest, filters) {
+    addEventNotification(event, dest, ...filters) {
         this._bucket.addEventNotification(event, dest, ...filters);
     }
     addObjectCreatedNotification(dest, ...filters) {
@@ -968,9 +1036,6 @@ class JaypieBucketQueuedLambda extends JaypieQueuedLambda {
     enableEventBridgeNotification() {
         this._bucket.enableEventBridgeNotification();
     }
-    grant(grantee, ...actions) {
-        return this._bucket.grant(grantee, ...actions);
-    }
     grantDelete(grantee, objectsKeyPattern) {
         return this._bucket.grantDelete(grantee, objectsKeyPattern);
     }
@@ -1013,54 +1078,17 @@ class JaypieBucketQueuedLambda extends JaypieQueuedLambda {
     virtualHostedUrlForObject(key, options) {
         return this._bucket.virtualHostedUrlForObject(key, options);
     }
-    // Bucket metrics
-    metricAllRequests(props) {
-        return this._bucket.metricAllRequests(props);
-    }
-    metricBucketSizeBytes(props) {
-        return this._bucket.metricBucketSizeBytes(props);
-    }
-    metricDeleteRequests(props) {
-        return this._bucket.metricDeleteRequests(props);
-    }
-    metricDownloadBytes(props) {
-        return this._bucket.metricDownloadBytes(props);
-    }
-    metricFirstByteLatency(props) {
-        return this._bucket.metricFirstByteLatency(props);
-    }
-    metricGetRequests(props) {
-        return this._bucket.metricGetRequests(props);
-    }
-    metricHeadRequests(props) {
-        return this._bucket.metricHeadRequests(props);
-    }
-    metricHttpRequests(props) {
-        return this._bucket.metricHttpRequests(props);
-    }
-    metricListRequests(props) {
-        return this._bucket.metricListRequests(props);
-    }
-    metricNumberOfObjects(props) {
-        return this._bucket.metricNumberOfObjects(props);
-    }
-    metricPostRequests(props) {
-        return this._bucket.metricPostRequests(props);
-    }
-    metricPutRequests(props) {
-        return this._bucket.metricPutRequests(props);
-    }
-    metricSelectRequests(props) {
-        return this._bucket.metricSelectRequests(props);
-    }
-    metricSelectScannedBytes(props) {
-        return this._bucket.metricSelectScannedBytes(props);
+    grantReplicationPermission(identity, props) {
+        return this._bucket.grantReplicationPermission(identity, props);
     }
-    metricUploadBytes(props) {
-        return this._bucket.metricUploadBytes(props);
+    addReplicationPolicy(policy) {
+        this._bucket.addReplicationPolicy(policy);
     }
-    metricSelectReturnedBytes(props) {
-        return this._bucket.metricSelectReturnedBytes(props);
+    get bucketRef() {
+        return {
+            bucketArn: this._bucket.bucketArn,
+            bucketName: this._bucket.bucketName,
+        };
     }
     // Override applyRemovalPolicy to apply to all resources
     applyRemovalPolicy(policy) {
@@ -1214,6 +1242,164 @@ class JaypieDatadogSecret extends JaypieEnvSecret {
     }
 }
 
+class JaypieDnsRecord extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { comment, recordName, type, values } = props;
+        const ttl = props.ttl || cdk.Duration.seconds(CDK$2.DNS.CONFIG.TTL);
+        // Resolve the hosted zone (supports both string and IHostedZone)
+        const zone = resolveHostedZone(scope, {
+            name: `${id}HostedZone`,
+            zone: props.zone,
+        });
+        // Common properties for all record types
+        const baseProps = {
+            comment,
+            recordName,
+            ttl,
+            zone,
+        };
+        // Create the appropriate record based on type
+        switch (type) {
+            case CDK$2.DNS.RECORD.A: {
+                if (!Array.isArray(values) || values.length === 0) {
+                    throw new ConfigurationError("A record requires at least one IP address");
+                }
+                this.record = new ARecord(this, "Record", {
+                    ...baseProps,
+                    target: RecordTarget.fromIpAddresses(...values),
+                });
+                break;
+            }
+            case CDK$2.DNS.RECORD.CNAME: {
+                if (!Array.isArray(values) || values.length === 0) {
+                    throw new ConfigurationError("CNAME record requires a domain name");
+                }
+                this.record = new CnameRecord(this, "Record", {
+                    ...baseProps,
+                    domainName: values[0],
+                });
+                break;
+            }
+            case CDK$2.DNS.RECORD.MX: {
+                if (!Array.isArray(values) || values.length === 0) {
+                    throw new ConfigurationError("MX record requires at least one mail server");
+                }
+                this.record = new MxRecord(this, "Record", {
+                    ...baseProps,
+                    values: values,
+                });
+                break;
+            }
+            case CDK$2.DNS.RECORD.NS: {
+                if (!Array.isArray(values) || values.length === 0) {
+                    throw new ConfigurationError("NS record requires at least one name server");
+                }
+                this.record = new NsRecord(this, "Record", {
+                    ...baseProps,
+                    values: values,
+                });
+                break;
+            }
+            case CDK$2.DNS.RECORD.TXT: {
+                if (!Array.isArray(values) || values.length === 0) {
+                    throw new ConfigurationError("TXT record requires at least one value");
+                }
+                this.record = new TxtRecord(this, "Record", {
+                    ...baseProps,
+                    values: values,
+                });
+                break;
+            }
+            default:
+                throw new ConfigurationError(`Unsupported DNS record type: ${type}. Supported types: A, CNAME, MX, NS, TXT`);
+        }
+        // Add standard tags to the DNS record
+        cdk.Tags.of(this.record).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.INFRASTRUCTURE);
+        cdk.Tags.of(this.record).add(CDK$2.TAG.ROLE, CDK$2.ROLE.NETWORKING);
+    }
+}
+
+class JaypieGitHubDeployRole extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { accountId, oidcProviderArn = Fn.importValue(CDK$2.IMPORT.OIDC_PROVIDER), output = true, repoRestriction: propsRepoRestriction, } = props;
+        // Resolve repoRestriction from props or environment variables
+        let repoRestriction = propsRepoRestriction;
+        if (!repoRestriction) {
+            const envRepo = process.env.CDK_ENV_REPO || process.env.PROJECT_REPO;
+            if (!envRepo) {
+                throw new ConfigurationError("No repoRestriction provided. Set repoRestriction prop, CDK_ENV_REPO, or PROJECT_REPO environment variable");
+            }
+            // Extract organization from owner/repo format and create org-wide restriction
+            const organization = envRepo.split("/")[0];
+            repoRestriction = `repo:${organization}/*:*`;
+        }
+        // Create the IAM role
+        this._role = new Role(this, "GitHubActionsRole", {
+            assumedBy: new FederatedPrincipal(oidcProviderArn, {
+                StringLike: {
+                    "token.actions.githubusercontent.com:sub": repoRestriction,
+                },
+            }, "sts:AssumeRoleWithWebIdentity"),
+            maxSessionDuration: Duration.hours(1),
+            path: "/",
+        });
+        Tags.of(this._role).add(CDK$2.TAG.ROLE, CDK$2.ROLE.DEPLOY);
+        // Allow the role to access the GitHub OIDC provider
+        this._role.addToPolicy(new PolicyStatement({
+            actions: ["sts:AssumeRoleWithWebIdentity"],
+            resources: [`arn:aws:iam::${accountId}:oidc-provider/*`],
+        }));
+        // Allow the role to deploy CDK apps
+        this._role.addToPolicy(new PolicyStatement({
+            actions: [
+                "cloudformation:CreateStack",
+                "cloudformation:DeleteStack",
+                "cloudformation:DescribeStackEvents",
+                "cloudformation:DescribeStackResource",
+                "cloudformation:DescribeStackResources",
+                "cloudformation:DescribeStacks",
+                "cloudformation:GetTemplate",
+                "cloudformation:SetStackPolicy",
+                "cloudformation:UpdateStack",
+                "cloudformation:ValidateTemplate",
+                "iam:PassRole",
+                "route53:ListHostedZones*",
+                "s3:GetObject",
+                "s3:ListBucket",
+            ],
+            effect: Effect.ALLOW,
+            resources: ["*"],
+        }));
+        this._role.addToPolicy(new PolicyStatement({
+            actions: ["iam:PassRole", "sts:AssumeRole"],
+            effect: Effect.ALLOW,
+            resources: [
+                "arn:aws:iam::*:role/cdk-hnb659fds-deploy-role-*",
+                "arn:aws:iam::*:role/cdk-hnb659fds-file-publishing-*",
+                "arn:aws:iam::*:role/cdk-readOnlyRole",
+            ],
+        }));
+        // Export the ARN of the role
+        if (output !== false) {
+            const outputId = typeof output === "string" ? output : "GitHubActionsRoleArn";
+            new CfnOutput(this, outputId, {
+                value: this._role.roleArn,
+            });
+        }
+    }
+    get role() {
+        return this._role;
+    }
+    get roleArn() {
+        return this._role.roleArn;
+    }
+    get roleName() {
+        return this._role.roleName;
+    }
+}
+
 class JaypieExpressLambda extends JaypieLambda {
     constructor(scope, id, props) {
         super(scope, id, {
@@ -1229,11 +1415,12 @@ const SERVICE = {
 };
 class JaypieHostedZone extends Construct {
     /**
-     * Create a new hosted zone with query logging
+     * Create a new hosted zone with query logging and optional DNS records
      */
     constructor(scope, id, props) {
         super(scope, id);
-        const { destination, zoneName, project } = props;
+        const { zoneName, project } = props;
+        const destination = props.destination ?? true;
         const service = props.service || CDK$2.SERVICE.INFRASTRUCTURE;
         // Create the log group
         this.logGroup = new LogGroup(this, "LogGroup", {
@@ -1250,10 +1437,13 @@ class JaypieHostedZone extends Construct {
         }
         // Grant Route 53 permissions to write to the log group
         this.logGroup.grantWrite(new ServicePrincipal(SERVICE.ROUTE53));
-        // Add destination if provided
-        if (destination) {
+        // Add destination based on configuration
+        if (destination !== false) {
+            const lambdaDestination = destination === true
+                ? resolveDatadogLoggingDestination(scope)
+                : destination;
             this.logGroup.addSubscriptionFilter("DatadogLambdaDestination", {
-                destination,
+                destination: lambdaDestination,
                 filterPattern: FilterPattern.allEvents(),
             });
         }
@@ -1268,6 +1458,21 @@ class JaypieHostedZone extends Construct {
         if (project) {
             cdk.Tags.of(this.hostedZone).add(CDK$2.TAG.PROJECT, project);
         }
+        // Create DNS records if provided
+        this.dnsRecords = [];
+        if (props.records) {
+            props.records.forEach((recordConfig, index) => {
+                const { id, ...recordProps } = recordConfig;
+                // Generate a default ID if not provided
+                const recordId = id ||
+                    `${recordProps.type}${recordProps.recordName ? `-${recordProps.recordName}` : ""}-${index}`;
+                const dnsRecord = new JaypieDnsRecord(this, recordId, {
+                    ...recordProps,
+                    zone: this.hostedZone,
+                });
+                this.dnsRecords.push(dnsRecord);
+            });
+        }
     }
 }
 
@@ -1316,276 +1521,348 @@ class JaypieOpenAiSecret extends JaypieEnvSecret {
 }
 
 /**
- * Permission set types with corresponding AWS managed policies
- */
-var PermissionSetType;
-(function (PermissionSetType) {
-    PermissionSetType["ADMINISTRATOR"] = "Administrator";
-    PermissionSetType["ANALYST"] = "Analyst";
-    PermissionSetType["DEVELOPER"] = "Developer";
-})(PermissionSetType || (PermissionSetType = {}));
-/**
- * Construct to simplify AWS SSO group management.
- * This construct encapsulates the complexity of creating permission sets
- * and assigning them to groups across multiple AWS accounts.
+ * JaypieSsoPermissions Construct
+ *
+ * Creates and manages AWS IAM Identity Center (SSO) permission sets and assignments
+ *
+ * @example
+ * const permissionSets = new JaypieSsoPermissions(this, "PermissionSets", {
+ *   iamIdentityCenterArn: "arn:aws:sso:::instance/...",
+ *   administratorGroupId: "b4c8b438-4031-7000-782d-5046945fb956",
+ *   analystGroupId: "2488f4e8-d061-708e-abe1-c315f0e30005",
+ *   developerGroupId: "b438a4f8-e0e1-707c-c6e8-21841daf9ad1",
+ *   administratorAccountAssignments: {
+ *     "211125635435": ["Administrator", "Analyst", "Developer"],
+ *     "381492033431": ["Administrator", "Analyst"],
+ *   },
+ *   analystAccountAssignments: {
+ *     "211125635435": ["Analyst", "Developer"],
+ *     "381492033431": [],
+ *   },
+ *   developerAccountAssignments: {
+ *     "211125635435": ["Analyst", "Developer"],
+ *     "381492033431": [],
+ *   },
+ * });
  */
-class JaypieSsoGroups extends Construct {
+class JaypieSsoPermissions extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        this.permissionSets = {};
-        this.instanceArn = props.instanceArn;
-        this.props = props;
-        // Create the permission sets
-        this.createAdministratorPermissionSet();
-        this.createAnalystPermissionSet();
-        this.createDeveloperPermissionSet();
-        // Create the assignments
-        this.createPermissionSetAssignments(props);
-    }
-    /**
-     * Creates the Administrator permission set with AdministratorAccess policy
-     * and billing access
-     */
-    createAdministratorPermissionSet() {
-        const defaultInlinePolicy = {
-            Version: "2012-10-17",
-            Statement: [
+        const { iamIdentityCenterArn, administratorGroupId, analystGroupId, developerGroupId, administratorAccountAssignments, analystAccountAssignments, developerAccountAssignments, } = props;
+        if (!iamIdentityCenterArn) {
+            // If no IAM Identity Center ARN provided, skip SSO setup
+            return;
+        }
+        //
+        // Permission Sets
+        //
+        this.administratorPermissionSet = new CfnPermissionSet(this, "AdministratorPermissionSet", {
+            // Required
+            instanceArn: iamIdentityCenterArn,
+            name: "Administrator",
+            // Optional
+            description: "Unrestricted access",
+            inlinePolicy: {
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: [
+                            "aws-portal:ViewUsage",
+                            "aws-portal:ViewBilling",
+                            "budgets:*",
+                            "cur:DescribeReportDefinitions",
+                            "cur:PutReportDefinition",
+                            "cur:DeleteReportDefinition",
+                            "cur:ModifyReportDefinition",
+                        ],
+                        Resource: "*",
+                    },
+                ],
+            },
+            managedPolicies: [
+                ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
+                    .managedPolicyArn,
+                ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+            ],
+            sessionDuration: Duration.hours(1).toIsoString(),
+            tags: [
                 {
-                    Effect: "Allow",
-                    Action: [
-                        "aws-portal:*",
-                        "budgets:*",
-                        "ce:*",
-                        "cost-optimization-hub:*",
-                    ],
-                    Resource: "*",
+                    key: CDK$2.TAG.SERVICE,
+                    value: CDK$2.SERVICE.SSO,
                 },
-            ],
-        };
-        // Merge with any additional policy statements provided for administrators
-        const mergedPolicy = this.mergeInlinePolicies(defaultInlinePolicy, this.props?.inlinePolicyStatements?.administrators);
-        const permissionSet = new sso.CfnPermissionSet(this, "AdministratorPermissionSet", {
-            instanceArn: this.instanceArn,
-            name: PermissionSetType.ADMINISTRATOR,
-            description: "Full administrative access to all AWS services and resources",
-            sessionDuration: Duration.hours(8).toIsoString(),
-            managedPolicies: ["arn:aws:iam::aws:policy/AdministratorAccess"],
-            inlinePolicy: mergedPolicy,
-        });
-        Tags.of(permissionSet).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
-        this.permissionSets[PermissionSetType.ADMINISTRATOR] = permissionSet;
-    }
-    /**
-     * Creates the Analyst permission set with ReadOnlyAccess policy
-     * and limited write access
-     */
-    createAnalystPermissionSet() {
-        const defaultInlinePolicy = {
-            Version: "2012-10-17",
-            Statement: [
                 {
-                    Effect: "Allow",
-                    Action: [
-                        "aws-portal:ViewBilling",
-                        "aws-portal:ViewAccount",
-                        "budgets:ViewBudget",
-                        "cloudwatch:PutDashboard",
-                        "cloudwatch:PutMetricData",
-                        "s3:PutObject",
-                        "s3:GetObject",
-                        "s3:ListBucket",
-                    ],
-                    Resource: "*",
+                    key: CDK$2.TAG.ROLE,
+                    value: CDK$2.ROLE.SECURITY,
                 },
             ],
-        };
-        // Merge with any additional policy statements provided for analysts
-        const mergedPolicy = this.mergeInlinePolicies(defaultInlinePolicy, this.props?.inlinePolicyStatements?.analysts);
-        const permissionSet = new sso.CfnPermissionSet(this, "AnalystPermissionSet", {
-            instanceArn: this.instanceArn,
-            name: PermissionSetType.ANALYST,
-            description: "Read-only access with billing visibility and limited write access",
-            sessionDuration: Duration.hours(4).toIsoString(),
-            managedPolicies: ["arn:aws:iam::aws:policy/ReadOnlyAccess"],
-            inlinePolicy: mergedPolicy,
         });
-        Tags.of(permissionSet).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
-        this.permissionSets[PermissionSetType.ANALYST] = permissionSet;
-    }
-    /**
-     * Creates the Developer permission set with SystemAdministrator policy
-     * and expanded write access
-     */
-    createDeveloperPermissionSet() {
-        const defaultInlinePolicy = {
-            Version: "2012-10-17",
-            Statement: [
+        this.analystPermissionSet = new CfnPermissionSet(this, "AnalystPermissionSet", {
+            // Required
+            instanceArn: iamIdentityCenterArn,
+            name: "Analyst",
+            // Optional
+            description: "Read-only access; may expand to limited write access",
+            inlinePolicy: {
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: [
+                            "aws-portal:ViewUsage",
+                            "aws-portal:ViewBilling",
+                            "budgets:Describe*",
+                            "budgets:View*",
+                            "ce:Get*",
+                            "ce:List*",
+                            "cloudformation:Describe*",
+                            "cloudformation:Get*",
+                            "cloudformation:List*",
+                            "cloudwatch:BatchGet*",
+                            "cloudwatch:Get*",
+                            "cloudwatch:List*",
+                            "cost-optimization-hub:Get*",
+                            "cost-optimization-hub:List*",
+                            "ec2:Describe*",
+                            "ec2:Get*",
+                            "ec2:List*",
+                            "ec2:Search*",
+                            "iam:Get*",
+                            "iam:List*",
+                            "iam:PassRole",
+                            "lambda:Get*",
+                            "lambda:List*",
+                            "logs:Describe*",
+                            "logs:Get*",
+                            "logs:List*",
+                            "pipes:Describe*",
+                            "pipes:List*",
+                            "s3:Get*",
+                            "s3:List*",
+                            "secretsmanager:GetRandomPassword",
+                            "secretsmanager:GetResourcePolicy",
+                            "secretsmanager:List*",
+                            "securityhub:Describe*",
+                            "securityhub:Get*",
+                            "securityhub:List*",
+                            "servicecatalog:Describe*",
+                            "sns:Get*",
+                            "sns:List*",
+                            "sqs:Get*",
+                            "sqs:List*",
+                            "states:Describe*",
+                            "states:Get*",
+                            "states:List*",
+                            "tag:*",
+                            "xray:*",
+                        ],
+                        Resource: "*",
+                    },
+                ],
+            },
+            managedPolicies: [
+                ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                    .managedPolicyArn,
+                ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                    .managedPolicyArn,
+            ],
+            sessionDuration: Duration.hours(12).toIsoString(),
+            tags: [
                 {
-                    Effect: "Allow",
-                    Action: [
-                        "cloudwatch:*",
-                        "logs:*",
-                        "lambda:*",
-                        "apigateway:*",
-                        "dynamodb:*",
-                        "s3:*",
-                        "sns:*",
-                        "sqs:*",
-                        "events:*",
-                        "ecr:*",
-                        "ecs:*",
-                        "codebuild:*",
-                    ],
-                    Resource: "*",
+                    key: CDK$2.TAG.SERVICE,
+                    value: CDK$2.SERVICE.SSO,
                 },
                 {
-                    Effect: "Deny",
-                    Action: [
-                        "iam:*User*",
-                        "iam:*Role*",
-                        "iam:*Policy*",
-                        "organizations:*",
-                        "account:*",
-                    ],
-                    Resource: "*",
+                    key: CDK$2.TAG.ROLE,
+                    value: CDK$2.ROLE.SECURITY,
                 },
             ],
-        };
-        // Merge with any additional policy statements provided for developers
-        const mergedPolicy = this.mergeInlinePolicies(defaultInlinePolicy, this.props?.inlinePolicyStatements?.developers);
-        const permissionSet = new sso.CfnPermissionSet(this, "DeveloperPermissionSet", {
-            instanceArn: this.instanceArn,
-            name: PermissionSetType.DEVELOPER,
-            description: "System administrator access with expanded write permissions",
-            sessionDuration: Duration.hours(8).toIsoString(),
+        });
+        this.developerPermissionSet = new CfnPermissionSet(this, "DeveloperPermissionSet", {
+            // Required
+            instanceArn: iamIdentityCenterArn,
+            name: "Developer",
+            // Optional
+            description: "Administrative access with limited restrictions",
+            inlinePolicy: {
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: [
+                            "budgets:*",
+                            "ce:*",
+                            "cloudformation:*",
+                            "cloudwatch:*",
+                            "cost-optimization-hub:*",
+                            "ec2:*",
+                            "iam:Get*",
+                            "iam:List*",
+                            "iam:PassRole",
+                            "lambda:*",
+                            "logs:*",
+                            "pipes:*",
+                            "s3:*",
+                            "secretsmanager:*",
+                            "securityhub:*",
+                            "servicecatalog:*",
+                            "sns:*",
+                            "sqs:*",
+                            "states:*",
+                            "tag:*",
+                            "xray:*",
+                        ],
+                        Resource: "*",
+                    },
+                ],
+            },
             managedPolicies: [
-                "arn:aws:iam::aws:policy/job-function/SystemAdministrator",
+                ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                    .managedPolicyArn,
+                ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                    .managedPolicyArn,
+                ManagedPolicy.fromAwsManagedPolicyName("job-function/SystemAdministrator").managedPolicyArn,
+            ],
+            sessionDuration: Duration.hours(4).toIsoString(),
+            tags: [
+                {
+                    key: CDK$2.TAG.SERVICE,
+                    value: CDK$2.SERVICE.SSO,
+                },
+                {
+                    key: CDK$2.TAG.ROLE,
+                    value: CDK$2.ROLE.SECURITY,
+                },
             ],
-            inlinePolicy: mergedPolicy,
         });
-        Tags.of(permissionSet).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
-        this.permissionSets[PermissionSetType.DEVELOPER] = permissionSet;
-    }
-    /**
-     * Gets the permission set for the specified type
-     */
-    getPermissionSet(type) {
-        return this.permissionSets[type];
+        // Map permission set names to their ARNs and labels
+        const permissionSetMap = {
+            Administrator: {
+                arn: this.administratorPermissionSet.attrPermissionSetArn,
+                label: "Administrator",
+            },
+            Analyst: {
+                arn: this.analystPermissionSet.attrPermissionSetArn,
+                label: "Analyst",
+            },
+            Developer: {
+                arn: this.developerPermissionSet.attrPermissionSetArn,
+                label: "Developer",
+            },
+        };
+        //
+        // Assignments
+        //
+        // Helper function to create assignments for a group
+        const createAssignments = (groupId, accountAssignments) => {
+            if (!groupId || !accountAssignments) {
+                return; // Skip if group ID or assignments not provided
+            }
+            Object.keys(accountAssignments).forEach((accountId) => {
+                const permissionSetNames = accountAssignments[accountId];
+                permissionSetNames.forEach((permissionSetName) => {
+                    const permissionSet = permissionSetMap[permissionSetName];
+                    if (!permissionSet) {
+                        throw new ConfigurationError(`Unknown permission set: ${permissionSetName}. Valid options: ${Object.keys(permissionSetMap).join(", ")}`);
+                    }
+                    const accountAssignment = new CfnAssignment(this, `AccountAssignment-${accountId}-${permissionSet.label}Role-${groupId}Group`, {
+                        // Required
+                        instanceArn: iamIdentityCenterArn,
+                        permissionSetArn: permissionSet.arn,
+                        principalId: groupId,
+                        principalType: CDK$2.PRINCIPAL_TYPE.GROUP,
+                        targetId: accountId,
+                        targetType: CDK$2.TARGET_TYPE.AWS_ACCOUNT,
+                    });
+                    Tags.of(accountAssignment).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
+                    Tags.of(accountAssignment).add(CDK$2.TAG.ROLE, CDK$2.ROLE.SECURITY);
+                });
+            });
+        };
+        // Create assignments for each group
+        createAssignments(administratorGroupId, administratorAccountAssignments);
+        createAssignments(analystGroupId, analystAccountAssignments);
+        createAssignments(developerGroupId, developerAccountAssignments);
     }
-    /**
-     * Merges default inline policies with additional user-provided policy statements
-     *
-     * @param defaultPolicy - The default policy object with Version and Statement properties
-     * @param additionalStatements - Optional additional policy statements to merge
-     * @returns The merged policy object
-     */
-    mergeInlinePolicies(defaultPolicy, additionalStatements) {
-        if (!additionalStatements || additionalStatements.length === 0) {
-            return defaultPolicy;
+}
+
+//
+//
+// Constants
+//
+const DEFAULT_APPLICATION_ID = "arn:aws:serverlessrepo:us-east-2:004480582608:applications/SSOSync";
+const DEFAULT_APPLICATION_VERSION = "2.3.3";
+const DEFAULT_GOOGLE_GROUP_MATCH = "name:AWS*";
+//
+//
+// Class
+//
+class JaypieSsoSyncApplication extends Construct {
+    constructor(scope, id = "SSOSyncApplication", props = {}) {
+        super(scope, id);
+        const { googleAdminEmail, googleAdminEmailEnvKey = "CDK_ENV_SSOSYNC_GOOGLE_ADMIN_EMAIL", googleCredentials, googleCredentialsEnvKey = "CDK_ENV_SSOSYNC_GOOGLE_CREDENTIALS", googleGroupMatch, googleGroupMatchEnvKey = "CDK_ENV_SSOSYNC_GOOGLE_GROUP_MATCH", identityStoreId, identityStoreIdEnvKey = "CDK_ENV_SSOSYNC_IDENTITY_STORE_ID", scimEndpointAccessToken, scimEndpointAccessTokenEnvKey = "CDK_ENV_SCIM_ENDPOINT_ACCESS_TOKEN", scimEndpointUrl, scimEndpointUrlEnvKey = "CDK_ENV_SSOSYNC_SCIM_ENDPOINT_URL", semanticVersion, semanticVersionEnvKey = "CDK_ENV_SSOSYNC_SEMANTIC_VERSION", ssoSyncApplicationId = DEFAULT_APPLICATION_ID, tags, } = props;
+        // Resolve all values from props or environment variables
+        const resolvedGoogleAdminEmail = googleAdminEmail || process.env[googleAdminEmailEnvKey];
+        const resolvedGoogleCredentials = googleCredentials || process.env[googleCredentialsEnvKey];
+        const resolvedGoogleGroupMatch = googleGroupMatch ||
+            process.env[googleGroupMatchEnvKey] ||
+            DEFAULT_GOOGLE_GROUP_MATCH;
+        const resolvedIdentityStoreId = identityStoreId || process.env[identityStoreIdEnvKey];
+        const resolvedScimEndpointAccessToken = scimEndpointAccessToken || process.env[scimEndpointAccessTokenEnvKey];
+        const resolvedScimEndpointUrl = scimEndpointUrl || process.env[scimEndpointUrlEnvKey];
+        const resolvedSemanticVersion = semanticVersion ||
+            process.env[semanticVersionEnvKey] ||
+            DEFAULT_APPLICATION_VERSION;
+        // Validate required parameters
+        const missingParams = [];
+        if (!resolvedGoogleAdminEmail) {
+            missingParams.push(`googleAdminEmail or ${googleAdminEmailEnvKey} environment variable`);
         }
-        // Create a deep copy of the default policy to avoid modifying the original
-        const mergedPolicy = JSON.parse(JSON.stringify(defaultPolicy));
-        // Add the additional statements to the existing statements
-        mergedPolicy.Statement = [
-            ...mergedPolicy.Statement,
-            ...additionalStatements,
-        ];
-        return mergedPolicy;
-    }
-    /**
-     * Creates assignments between permission sets, groups, and accounts
-     * based on the provided configuration
-     */
-    createPermissionSetAssignments(props) {
-        // Administrator assignments
-        this.assignAdministratorPermissions(props);
-        // Analyst assignments
-        this.assignAnalystPermissions(props);
-        // Developer assignments
-        this.assignDeveloperPermissions(props);
-    }
-    /**
-     * Assigns Administrator permissions to appropriate accounts
-     */
-    assignAdministratorPermissions(props) {
-        const administratorGroup = props.groupMap.administrators;
-        const administratorPermissionSet = this.permissionSets[PermissionSetType.ADMINISTRATOR];
-        // Administrators get access to all accounts
-        const allAccounts = [
-            ...props.accountMap.development,
-            ...props.accountMap.management,
-            ...props.accountMap.operations,
-            ...props.accountMap.production,
-            ...props.accountMap.sandbox,
-            ...props.accountMap.security,
-            ...props.accountMap.stage,
-        ];
-        // Create assignments for each account
-        allAccounts.forEach((accountId, index) => {
-            const assignment = new sso.CfnAssignment(this, `AdministratorAssignment${index}`, {
-                instanceArn: this.instanceArn,
-                permissionSetArn: administratorPermissionSet.attrPermissionSetArn,
-                principalId: administratorGroup,
-                principalType: "GROUP",
-                targetId: accountId,
-                targetType: "AWS_ACCOUNT",
-            });
-            Tags.of(assignment).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
-            Tags.of(assignment).add("Group", "administrators");
+        if (!resolvedGoogleCredentials) {
+            missingParams.push(`googleCredentials or ${googleCredentialsEnvKey} environment variable`);
+        }
+        if (!resolvedIdentityStoreId) {
+            missingParams.push(`identityStoreId or ${identityStoreIdEnvKey} environment variable`);
+        }
+        if (!resolvedScimEndpointAccessToken) {
+            missingParams.push(`scimEndpointAccessToken or ${scimEndpointAccessTokenEnvKey} environment variable`);
+        }
+        if (!resolvedScimEndpointUrl) {
+            missingParams.push(`scimEndpointUrl or ${scimEndpointUrlEnvKey} environment variable`);
+        }
+        if (missingParams.length > 0) {
+            throw new ConfigurationError$1(`JaypieSsoSyncApplication missing required configuration: ${missingParams.join(", ")}`);
+        }
+        // Create the SSO Sync Application
+        // Type assertion is safe because we validated all required values above
+        this._application = new CfnApplication(this, "Application", {
+            location: {
+                applicationId: ssoSyncApplicationId,
+                semanticVersion: resolvedSemanticVersion,
+            },
+            parameters: {
+                GoogleAdminEmail: resolvedGoogleAdminEmail,
+                GoogleCredentials: resolvedGoogleCredentials,
+                GoogleGroupMatch: resolvedGoogleGroupMatch,
+                IdentityStoreID: resolvedIdentityStoreId,
+                Region: Stack.of(this).region,
+                SCIMEndpointAccessToken: resolvedScimEndpointAccessToken,
+                SCIMEndpointUrl: resolvedScimEndpointUrl,
+            },
         });
-    }
-    /**
-     * Assigns Analyst permissions to appropriate accounts
-     */
-    assignAnalystPermissions(props) {
-        const analystGroup = props.groupMap.analysts;
-        const analystPermissionSet = this.permissionSets[PermissionSetType.ANALYST];
-        // Analysts get access to development, management, sandbox, and stage accounts
-        const analystAccounts = [
-            ...props.accountMap.development,
-            ...props.accountMap.management,
-            ...props.accountMap.sandbox,
-            ...props.accountMap.stage,
-        ];
-        // Create assignments for each account
-        analystAccounts.forEach((accountId, index) => {
-            const assignment = new sso.CfnAssignment(this, `AnalystAssignment${index}`, {
-                instanceArn: this.instanceArn,
-                permissionSetArn: analystPermissionSet.attrPermissionSetArn,
-                principalId: analystGroup,
-                principalType: "GROUP",
-                targetId: accountId,
-                targetType: "AWS_ACCOUNT",
-            });
-            Tags.of(assignment).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
-            Tags.of(assignment).add("Group", "analysts");
+        // Add tags
+        const defaultTags = {
+            [CDK$2.TAG.ROLE]: CDK$2.ROLE.SECURITY,
+        };
+        const allTags = { ...defaultTags, ...tags };
+        Object.entries(allTags).forEach(([key, value]) => {
+            Tags.of(this._application).add(key, value);
         });
     }
-    /**
-     * Assigns Developer permissions to appropriate accounts
-     */
-    assignDeveloperPermissions(props) {
-        const developerGroup = props.groupMap.developers;
-        const developerPermissionSet = this.permissionSets[PermissionSetType.DEVELOPER];
-        // Developers get access to development, sandbox, and stage accounts
-        const developerAccounts = [
-            ...props.accountMap.development,
-            ...props.accountMap.sandbox,
-            ...props.accountMap.stage,
-        ];
-        // Create assignments for each account
-        developerAccounts.forEach((accountId, index) => {
-            const assignment = new sso.CfnAssignment(this, `DeveloperAssignment${index}`, {
-                instanceArn: this.instanceArn,
-                permissionSetArn: developerPermissionSet.attrPermissionSetArn,
-                principalId: developerGroup,
-                principalType: "GROUP",
-                targetId: accountId,
-                targetType: "AWS_ACCOUNT",
-            });
-            Tags.of(assignment).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
-            Tags.of(assignment).add("Group", "developers");
-        });
+    get application() {
+        return this._application;
     }
 }
 
@@ -1847,7 +2124,13 @@ class JaypieWebDeploymentBucket extends Construct {
     applyRemovalPolicy(policy) {
         this.bucket.applyRemovalPolicy(policy);
     }
+    get bucketRef() {
+        return {
+            bucketArn: this.bucket.bucketArn,
+            bucketName: this.bucket.bucketName,
+        };
+    }
 }
 
-export { JaypieApiGateway, JaypieAppStack, JaypieBucketQueuedLambda, JaypieDatadogSecret, JaypieEnvSecret, JaypieExpressLambda, JaypieHostedZone, JaypieInfrastructureStack, JaypieLambda, JaypieMongoDbSecret, JaypieOpenAiSecret, JaypieQueuedLambda, JaypieSsoGroups, JaypieStack, JaypieTraceSigningKeySecret, JaypieWebDeploymentBucket, PermissionSetType, addDatadogLayers, constructEnvName, constructStackName, constructTagger, envHostname, isEnv, isProductionEnv, isSandboxEnv, jaypieLambdaEnv, resolveDatadogLayers, resolveHostedZone, resolveParamsAndSecrets };
+export { JaypieApiGateway, JaypieAppStack, JaypieBucketQueuedLambda, JaypieDatadogSecret, JaypieDnsRecord, JaypieEnvSecret, JaypieExpressLambda, JaypieGitHubDeployRole, JaypieHostedZone, JaypieInfrastructureStack, JaypieLambda, JaypieMongoDbSecret, JaypieOpenAiSecret, JaypieQueuedLambda, JaypieSsoPermissions, JaypieSsoSyncApplication, JaypieStack, JaypieTraceSigningKeySecret, JaypieWebDeploymentBucket, addDatadogLayers, constructEnvName, constructStackName, constructTagger, envHostname, isEnv, isProductionEnv, isSandboxEnv, jaypieLambdaEnv, resolveDatadogForwarderFunction, resolveDatadogLayers, resolveDatadogLoggingDestination, resolveHostedZone, resolveParamsAndSecrets };
 //# sourceMappingURL=index.js.map