@jaypie/constructs 1.2.20 → 1.2.22

package/dist/cjs/JaypieWebSocket.d.ts

@@ -109,7 +109,7 @@ export declare class JaypieWebSocket extends Construct {
     get callbackUrl(): string;
     /**
      * Grant a Lambda function permission to manage WebSocket connections
-     * (post to connections, delete connections).
+     * (post messages to connections, get connection info, delete connections).
      */
     grantManageConnections(grantee: lambda.IFunction): iam.Grant;
 }

package/dist/cjs/index.cjs

@@ -9,7 +9,7 @@ var route53Targets = require('aws-cdk-lib/aws-route53-targets');
 var secretsmanager = require('aws-cdk-lib/aws-secretsmanager');
 var datadogCdkConstructsV2 = require('datadog-cdk-constructs-v2');
 var errors = require('@jaypie/errors');
-var iam = require('aws-cdk-lib/aws-iam');
+var awsIam = require('aws-cdk-lib/aws-iam');
 var acm = require('aws-cdk-lib/aws-certificatemanager');
 var lambda = require('aws-cdk-lib/aws-lambda');
 var logDestinations = require('aws-cdk-lib/aws-logs-destinations');
@@ -54,7 +54,6 @@ var apiGateway__namespace = /*#__PURE__*/_interopNamespaceDefault(apiGateway);
 var route53__namespace = /*#__PURE__*/_interopNamespaceDefault(route53);
 var route53Targets__namespace = /*#__PURE__*/_interopNamespaceDefault(route53Targets);
 var secretsmanager__namespace = /*#__PURE__*/_interopNamespaceDefault(secretsmanager);
-var iam__namespace = /*#__PURE__*/_interopNamespaceDefault(iam);
 var acm__namespace = /*#__PURE__*/_interopNamespaceDefault(acm);
 var lambda__namespace = /*#__PURE__*/_interopNamespaceDefault(lambda);
 var logDestinations__namespace = /*#__PURE__*/_interopNamespaceDefault(logDestinations);
@@ -439,22 +438,22 @@ function extendDatadogRole(scope, options) {
     }
     const { id = "DatadogCustomPolicy", project, service = CDK$2.SERVICE.DATADOG, } = options || {};
     // Lookup the Datadog role
-    const datadogRole = iam.Role.fromRoleArn(scope, "DatadogRole", datadogRoleArn);
+    const datadogRole = awsIam.Role.fromRoleArn(scope, "DatadogRole", datadogRoleArn);
     // Build policy statements
     const statements = [
         // Allow view budget
-        new iam.PolicyStatement({
+        new awsIam.PolicyStatement({
             actions: ["budgets:ViewBudget"],
             resources: ["*"],
         }),
         // Allow describe log groups
-        new iam.PolicyStatement({
+        new awsIam.PolicyStatement({
             actions: ["logs:DescribeLogGroups"],
             resources: ["*"],
         }),
     ];
     // Create the custom policy
-    const datadogCustomPolicy = new iam.Policy(scope, id, {
+    const datadogCustomPolicy = new awsIam.Policy(scope, id, {
         roles: [datadogRole],
         statements,
     });
@@ -2230,22 +2229,22 @@ class JaypieDatadogBucket extends constructs.Construct {
         }
         const { project, service = CDK$2.SERVICE.DATADOG } = options || {};
         // Lookup the Datadog role
-        const datadogRole = iam.Role.fromRoleArn(this, "DatadogRole", datadogRoleArn);
+        const datadogRole = awsIam.Role.fromRoleArn(this, "DatadogRole", datadogRoleArn);
         // Build policy statements for bucket access
         const statements = [
             // Allow list bucket
-            new iam.PolicyStatement({
+            new awsIam.PolicyStatement({
                 actions: ["s3:ListBucket"],
                 resources: [this.bucket.bucketArn],
             }),
             // Allow read and write to the bucket
-            new iam.PolicyStatement({
+            new awsIam.PolicyStatement({
                 actions: ["s3:GetObject", "s3:PutObject"],
                 resources: [`${this.bucket.bucketArn}/*`],
             }),
         ];
         // Create the custom policy
-        const datadogBucketPolicy = new iam.Policy(this, "DatadogBucketPolicy", {
+        const datadogBucketPolicy = new awsIam.Policy(this, "DatadogBucketPolicy", {
             roles: [datadogRole],
             statements,
         });
@@ -3014,8 +3013,8 @@ class JaypieGitHubDeployRole extends constructs.Construct {
             repoRestriction = `repo:${organization}/*:*`;
         }
         // Create the IAM role
-        this._role = new iam.Role(this, "GitHubActionsRole", {
-            assumedBy: new iam.FederatedPrincipal(oidcProviderArn, {
+        this._role = new awsIam.Role(this, "GitHubActionsRole", {
+            assumedBy: new awsIam.FederatedPrincipal(oidcProviderArn, {
                 StringLike: {
                     "token.actions.githubusercontent.com:sub": repoRestriction,
                 },
@@ -3025,12 +3024,12 @@ class JaypieGitHubDeployRole extends constructs.Construct {
         });
         cdk.Tags.of(this._role).add(CDK$2.TAG.ROLE, CDK$2.ROLE.DEPLOY);
         // Allow the role to access the GitHub OIDC provider
-        this._role.addToPolicy(new iam.PolicyStatement({
+        this._role.addToPolicy(new awsIam.PolicyStatement({
             actions: ["sts:AssumeRoleWithWebIdentity"],
             resources: [`arn:aws:iam::${accountId}:oidc-provider/*`],
         }));
         // Allow the role to deploy CDK apps
-        this._role.addToPolicy(new iam.PolicyStatement({
+        this._role.addToPolicy(new awsIam.PolicyStatement({
             actions: [
                 "cloudformation:CreateStack",
                 "cloudformation:DeleteStack",
@@ -3047,12 +3046,12 @@ class JaypieGitHubDeployRole extends constructs.Construct {
                 "s3:GetObject",
                 "s3:ListBucket",
             ],
-            effect: iam.Effect.ALLOW,
+            effect: awsIam.Effect.ALLOW,
             resources: ["*"],
         }));
-        this._role.addToPolicy(new iam.PolicyStatement({
+        this._role.addToPolicy(new awsIam.PolicyStatement({
             actions: ["iam:PassRole", "sts:AssumeRole"],
-            effect: iam.Effect.ALLOW,
+            effect: awsIam.Effect.ALLOW,
             resources: [
                 "arn:aws:iam::*:role/cdk-hnb659fds-deploy-role-*",
                 "arn:aws:iam::*:role/cdk-hnb659fds-file-publishing-*",
@@ -3147,7 +3146,7 @@ class JaypieHostedZone extends constructs.Construct {
             cdk__namespace.Tags.of(this.logGroup).add(CDK$2.TAG.PROJECT, project);
         }
         // Grant Route 53 permissions to write to the log group
-        this.logGroup.grantWrite(new iam.ServicePrincipal(SERVICE.ROUTE53));
+        this.logGroup.grantWrite(new awsIam.ServicePrincipal(SERVICE.ROUTE53));
         // Add destination based on configuration
         if (destination !== false) {
             const lambdaDestination = destination === true
@@ -3445,21 +3444,21 @@ class JaypieOrganizationTrail extends constructs.Construct {
             ],
         });
         // Add CloudTrail bucket policies
-        this.bucket.addToResourcePolicy(new iam.PolicyStatement({
+        this.bucket.addToResourcePolicy(new awsIam.PolicyStatement({
             actions: ["s3:GetBucketAcl"],
-            effect: iam.Effect.ALLOW,
-            principals: [new iam.ServicePrincipal("cloudtrail.amazonaws.com")],
+            effect: awsIam.Effect.ALLOW,
+            principals: [new awsIam.ServicePrincipal("cloudtrail.amazonaws.com")],
             resources: [this.bucket.bucketArn],
         }));
-        this.bucket.addToResourcePolicy(new iam.PolicyStatement({
+        this.bucket.addToResourcePolicy(new awsIam.PolicyStatement({
             actions: ["s3:PutObject"],
             conditions: {
                 StringEquals: {
                     "s3:x-amz-acl": "bucket-owner-full-control",
                 },
             },
-            effect: iam.Effect.ALLOW,
-            principals: [new iam.ServicePrincipal("cloudtrail.amazonaws.com")],
+            effect: awsIam.Effect.ALLOW,
+            principals: [new awsIam.ServicePrincipal("cloudtrail.amazonaws.com")],
             resources: [`${this.bucket.bucketArn}/*`],
         }));
         // Add tags to bucket
@@ -3552,9 +3551,9 @@ class JaypieSsoPermissions extends constructs.Construct {
                 ],
             },
             managedPolicies: [
-                iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
+                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
                     .managedPolicyArn,
-                iam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
             ],
             sessionDuration: cdk.Duration.hours(1).toIsoString(),
             tags: [
@@ -3633,10 +3632,10 @@ class JaypieSsoPermissions extends constructs.Construct {
                 ],
             },
             managedPolicies: [
-                iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
                     .managedPolicyArn,
-                iam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
-                iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                awsIam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
                     .managedPolicyArn,
             ],
             sessionDuration: cdk.Duration.hours(12).toIsoString(),
@@ -3668,6 +3667,7 @@ class JaypieSsoPermissions extends constructs.Construct {
                             "cloudformation:*",
                             "cloudwatch:*",
                             "cost-optimization-hub:*",
+                            "dynamodb:*",
                             "ec2:*",
                             "iam:Get*",
                             "iam:List*",
@@ -3691,12 +3691,12 @@ class JaypieSsoPermissions extends constructs.Construct {
                 ],
             },
             managedPolicies: [
-                iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
                     .managedPolicyArn,
-                iam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
-                iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                awsIam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
                     .managedPolicyArn,
-                iam.ManagedPolicy.fromAwsManagedPolicyName("job-function/SystemAdministrator").managedPolicyArn,
+                awsIam.ManagedPolicy.fromAwsManagedPolicyName("job-function/SystemAdministrator").managedPolicyArn,
             ],
             sessionDuration: cdk.Duration.hours(4).toIsoString(),
             tags: [
@@ -3909,8 +3909,8 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             repo = `repo:${process.env.CDK_ENV_REPO}:*`;
         }
         if (repo) {
-            const bucketDeployRole = new iam.Role(this, "DestinationBucketDeployRole", {
-                assumedBy: new iam.FederatedPrincipal(cdk.Fn.importValue(CDK$2.IMPORT.OIDC_PROVIDER), {
+            const bucketDeployRole = new awsIam.Role(this, "DestinationBucketDeployRole", {
+                assumedBy: new awsIam.FederatedPrincipal(cdk.Fn.importValue(CDK$2.IMPORT.OIDC_PROVIDER), {
                     StringLike: {
                         "token.actions.githubusercontent.com:sub": repo,
                     },
@@ -3919,8 +3919,8 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             });
             cdk.Tags.of(bucketDeployRole).add(CDK$2.TAG.ROLE, CDK$2.ROLE.DEPLOY);
             // Allow the role to write to the bucket
-            bucketDeployRole.addToPolicy(new iam.PolicyStatement({
-                effect: iam.Effect.ALLOW,
+            bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
+                effect: awsIam.Effect.ALLOW,
                 actions: [
                     "s3:DeleteObject",
                     "s3:GetObject",
@@ -3929,16 +3929,16 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
                 ],
                 resources: [`${this.bucket.bucketArn}/*`],
             }));
-            bucketDeployRole.addToPolicy(new iam.PolicyStatement({
-                effect: iam.Effect.ALLOW,
+            bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
+                effect: awsIam.Effect.ALLOW,
                 actions: ["s3:ListBucket"],
                 resources: [this.bucket.bucketArn],
             }));
             // Allow the role to describe the current stack
             const stack = cdk.Stack.of(this);
-            bucketDeployRole.addToPolicy(new iam.PolicyStatement({
+            bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
                 actions: ["cloudformation:DescribeStacks"],
-                effect: iam.Effect.ALLOW,
+                effect: awsIam.Effect.ALLOW,
                 resources: [
                     `arn:aws:cloudformation:${stack.region}:${stack.account}:stack/${stack.stackName}/*`,
                 ],
@@ -4339,21 +4339,12 @@ class JaypieWebSocket extends constructs.Construct {
     //
     /**
      * Grant a Lambda function permission to manage WebSocket connections
-     * (post to connections, delete connections).
+     * (post messages to connections, get connection info, delete connections).
      */
     grantManageConnections(grantee) {
-        return iam__namespace.Grant.addToPrincipal({
-            actions: ["execute-api:ManageConnections"],
-            grantee: grantee.grantPrincipal,
-            resourceArns: [
-                cdk.Stack.of(this).formatArn({
-                    arnFormat: cdk.ArnFormat.SLASH_RESOURCE_SLASH_RESOURCE_NAME,
-                    resource: this._api.apiId,
-                    resourceName: `${this._stage.stageName}/POST/@connections/*`,
-                    service: "execute-api",
-                }),
-            ],
-        });
+        // Use the CDK's built-in grantManageConnections which properly grants
+        // permissions for all @connections methods (POST, GET, DELETE) across all stages
+        return this._api.grantManageConnections(grantee);
     }
 }