@jaypie/constructs 1.2.32 → 1.2.34

package/dist/cjs/index.d.ts

@@ -7,7 +7,7 @@ export { JaypieCertificate, JaypieCertificateProps } from "./JaypieCertificate";
 export { JaypieDatadogBucket, JaypieDatadogBucketProps, } from "./JaypieDatadogBucket";
 export { JaypieDatadogForwarder, JaypieDatadogForwarderProps, } from "./JaypieDatadogForwarder";
 export { JaypieDatadogSecret } from "./JaypieDatadogSecret";
-export { JaypieDistribution, JaypieDistributionProps, SecurityHeadersOverrides, } from "./JaypieDistribution";
+export { JaypieDistribution, JaypieDistributionProps, JaypieWafConfig, SecurityHeadersOverrides, } from "./JaypieDistribution";
 export { JaypieDnsRecord, JaypieDnsRecordProps } from "./JaypieDnsRecord";
 export { JaypieDynamoDb, JaypieDynamoDbProps } from "./JaypieDynamoDb";
 export type { IndexDefinition } from "@jaypie/fabric";
@@ -18,6 +18,7 @@ export { JaypieGitHubDeployRole, JaypieGitHubDeployRoleProps, } from "./JaypieGi
 export { JaypieHostedZone, JaypieHostedZoneRecordProps, } from "./JaypieHostedZone";
 export { JaypieInfrastructureStack } from "./JaypieInfrastructureStack";
 export { JaypieLambda, JaypieLambdaProps } from "./JaypieLambda";
+export { JaypieMigration, JaypieMigrationProps } from "./JaypieMigration";
 export { JaypieMongoDbSecret } from "./JaypieMongoDbSecret";
 export { DomainNameConfig, JaypieNextJs, JaypieNextjsProps, } from "./JaypieNextJs";
 export { JaypieOpenAiSecret } from "./JaypieOpenAiSecret";

package/dist/esm/JaypieDistribution.d.ts

@@ -5,8 +5,38 @@ import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import { LambdaDestination } from "aws-cdk-lib/aws-s3-notifications";
+import * as wafv2 from "aws-cdk-lib/aws-wafv2";
 import { Construct } from "constructs";
 import { HostConfig } from "./helpers";
+export interface JaypieWafConfig {
+    /**
+     * Whether WAF is enabled
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * WAF logging bucket.
+     * - true/undefined: create a logging bucket with Datadog forwarding (default)
+     * - false: disable WAF logging
+     * - IBucket: use an existing bucket (must have "aws-waf-logs-" prefix)
+     * @default true
+     */
+    logBucket?: boolean | s3.IBucket;
+    /**
+     * Managed rule group names to apply
+     * @default ["AWSManagedRulesCommonRuleSet", "AWSManagedRulesKnownBadInputsRuleSet"]
+     */
+    managedRules?: string[];
+    /**
+     * Rate limit per IP per 5-minute window
+     * @default 2000
+     */
+    rateLimitPerIp?: number;
+    /**
+     * Use an existing WebACL ARN instead of creating one
+     */
+    webAclArn?: string;
+}
 export interface SecurityHeadersOverrides {
     contentSecurityPolicy?: string;
     frameOption?: cloudfront.HeadersFrameOption;
@@ -99,6 +129,14 @@ export interface JaypieDistributionProps extends Omit<cloudfront.DistributionPro
      * @default CDK.ROLE.HOSTING
      */
     roleTag?: string;
+    /**
+     * WAF WebACL configuration for the CloudFront distribution.
+     * - true/undefined: create and attach a WebACL with sensible defaults
+     * - false: disable WAF
+     * - JaypieWafConfig: customize WAF behavior
+     * @default true
+     */
+    waf?: boolean | JaypieWafConfig;
     /**
      * The hosted zone for DNS records
      * @default CDK_ENV_API_HOSTED_ZONE || CDK_ENV_HOSTED_ZONE
@@ -116,11 +154,14 @@ export declare class JaypieDistribution extends Construct implements cloudfront.
     readonly host?: string;
     readonly logBucket?: s3.IBucket;
     readonly responseHeadersPolicy?: cloudfront.IResponseHeadersPolicy;
+    readonly wafLogBucket?: s3.IBucket;
+    readonly webAcl?: wafv2.CfnWebACL;
     constructor(scope: Construct, id: string, props: JaypieDistributionProps);
     private isIOrigin;
     private isIFunctionUrl;
     private isIFunction;
     private isExportNameObject;
+    private resolveWafConfig;
     private resolveLogBucket;
     get env(): {
         account: string;

package/dist/esm/JaypieDynamoDb.d.ts

@@ -89,6 +89,7 @@ export declare class JaypieDynamoDb extends Construct implements dynamodb.ITable
     get tableRef(): dynamodb.TableReference;
     get tableStreamArn(): string | undefined;
     get encryptionKey(): import("aws-cdk-lib/aws-kms").IKey | undefined;
+    get grants(): dynamodb.TableGrants;
     applyRemovalPolicy(policy: RemovalPolicy): void;
     grant(grantee: import("aws-cdk-lib/aws-iam").IGrantable, ...actions: string[]): import("aws-cdk-lib/aws-iam").Grant;
     grantFullAccess(grantee: import("aws-cdk-lib/aws-iam").IGrantable): import("aws-cdk-lib/aws-iam").Grant;

package/dist/esm/JaypieMigration.d.ts

@@ -0,0 +1,21 @@
+import { Construct } from "constructs";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import { JaypieLambda } from "./JaypieLambda";
+import type { SecretsArrayItem } from "./helpers/index.js";
+export interface JaypieMigrationProps {
+    /** Path to the bundled migration code (esbuild output directory) */
+    code: lambda.Code | string;
+    /** Constructs that must be created before the migration runs */
+    dependencies?: Construct[];
+    /** Lambda handler entry point */
+    handler?: string;
+    /** Secrets to make available to the migration Lambda */
+    secrets?: SecretsArrayItem[];
+    /** DynamoDB tables to grant read/write access */
+    tables?: dynamodb.ITable[];
+}
+export declare class JaypieMigration extends Construct {
+    readonly lambda: JaypieLambda;
+    constructor(scope: Construct, id: string, props: JaypieMigrationProps);
+}

package/dist/esm/JaypieOrganizationTrail.d.ts

@@ -1,4 +1,5 @@
 import { IBucket } from "aws-cdk-lib/aws-s3";
+import { CfnAnalyzer } from "aws-cdk-lib/aws-accessanalyzer";
 import { Trail } from "aws-cdk-lib/aws-cloudtrail";
 import { Construct } from "constructs";
 export interface JaypieOrganizationTrailProps {
@@ -26,11 +27,26 @@ export interface JaypieOrganizationTrailProps {
      * Optional project tag value
      */
     project?: string;
+    /**
+     * Whether to enable IAM Access Analyzer (organization-level)
+     * @default true
+     */
+    enableAccessAnalyzer?: boolean;
     /**
      * Whether to enable file validation for the trail
-     * @default false
+     * @default true
      */
     enableFileValidation?: boolean;
+    /**
+     * Whether to enable Lambda data events in CloudTrail
+     * @default true
+     */
+    enableLambdaDataEvents?: boolean;
+    /**
+     * Whether to enable S3 data events in CloudTrail
+     * @default false (opt-in due to potential high volume/cost)
+     */
+    enableS3DataEvents?: boolean;
     /**
      * Number of days before logs expire
      * @default 365
@@ -53,6 +69,7 @@ export interface JaypieOrganizationTrailProps {
     enableDatadogNotifications?: boolean;
 }
 export declare class JaypieOrganizationTrail extends Construct {
+    readonly analyzer?: CfnAnalyzer;
     readonly bucket: IBucket;
     readonly trail: Trail;
     /**

package/dist/esm/__tests__/JaypieMigration.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/__tests__/JaypieOrganizationTrail.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/index.d.ts

@@ -7,7 +7,7 @@ export { JaypieCertificate, JaypieCertificateProps } from "./JaypieCertificate";
 export { JaypieDatadogBucket, JaypieDatadogBucketProps, } from "./JaypieDatadogBucket";
 export { JaypieDatadogForwarder, JaypieDatadogForwarderProps, } from "./JaypieDatadogForwarder";
 export { JaypieDatadogSecret } from "./JaypieDatadogSecret";
-export { JaypieDistribution, JaypieDistributionProps, SecurityHeadersOverrides, } from "./JaypieDistribution";
+export { JaypieDistribution, JaypieDistributionProps, JaypieWafConfig, SecurityHeadersOverrides, } from "./JaypieDistribution";
 export { JaypieDnsRecord, JaypieDnsRecordProps } from "./JaypieDnsRecord";
 export { JaypieDynamoDb, JaypieDynamoDbProps } from "./JaypieDynamoDb";
 export type { IndexDefinition } from "@jaypie/fabric";
@@ -18,6 +18,7 @@ export { JaypieGitHubDeployRole, JaypieGitHubDeployRoleProps, } from "./JaypieGi
 export { JaypieHostedZone, JaypieHostedZoneRecordProps, } from "./JaypieHostedZone";
 export { JaypieInfrastructureStack } from "./JaypieInfrastructureStack";
 export { JaypieLambda, JaypieLambdaProps } from "./JaypieLambda";
+export { JaypieMigration, JaypieMigrationProps } from "./JaypieMigration";
 export { JaypieMongoDbSecret } from "./JaypieMongoDbSecret";
 export { DomainNameConfig, JaypieNextJs, JaypieNextjsProps, } from "./JaypieNextJs";
 export { JaypieOpenAiSecret } from "./JaypieOpenAiSecret";

package/dist/esm/index.js

@@ -24,10 +24,13 @@ import { Rule, RuleTargetInput } from 'aws-cdk-lib/aws-events';
 import { LambdaFunction } from 'aws-cdk-lib/aws-events-targets';
 import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
 import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
+import * as wafv2 from 'aws-cdk-lib/aws-wafv2';
 import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
 import { generateIndexName, DEFAULT_SORT_KEY } from '@jaypie/fabric';
+import * as cr from 'aws-cdk-lib/custom-resources';
 import { Nextjs } from 'cdk-nextjs-standalone';
 import * as path from 'path';
+import { CfnAnalyzer } from 'aws-cdk-lib/aws-accessanalyzer';
 import { Trail, ReadWriteType } from 'aws-cdk-lib/aws-cloudtrail';
 import { CfnPermissionSet, CfnAssignment } from 'aws-cdk-lib/aws-sso';
 import { CfnApplication } from 'aws-cdk-lib/aws-sam';
@@ -2340,10 +2343,15 @@ class JaypieDatadogSecret extends JaypieEnvSecret {
     }
 }
 
+const DEFAULT_RATE_LIMIT = 2000;
+const DEFAULT_MANAGED_RULES = [
+    "AWSManagedRulesCommonRuleSet",
+    "AWSManagedRulesKnownBadInputsRuleSet",
+];
 class JaypieDistribution extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { certificate: certificateProp = true, defaultBehavior: propsDefaultBehavior, destination: destinationProp = true, handler, host: propsHost, logBucket: logBucketProp, originReadTimeout = Duration.seconds(CDK$2.DURATION.CLOUDFRONT_API), responseHeadersPolicy: responseHeadersPolicyProp, roleTag = CDK$2.ROLE.API, securityHeaders: securityHeadersProp, streaming = false, zone: propsZone, ...distributionProps } = props;
+        const { certificate: certificateProp = true, defaultBehavior: propsDefaultBehavior, destination: destinationProp = true, handler, host: propsHost, logBucket: logBucketProp, originReadTimeout = Duration.seconds(CDK$2.DURATION.CLOUDFRONT_API), responseHeadersPolicy: responseHeadersPolicyProp, roleTag = CDK$2.ROLE.API, securityHeaders: securityHeadersProp, streaming = false, waf: wafProp = true, zone: propsZone, ...distributionProps } = props;
         // Validate environment variables
         if (process.env.CDK_ENV_API_SUBDOMAIN &&
             !isValidSubdomain(process.env.CDK_ENV_API_SUBDOMAIN)) {
@@ -2586,6 +2594,118 @@ class JaypieDistribution extends Construct {
         this.distributionDomainName = this.distribution.distributionDomainName;
         this.distributionId = this.distribution.distributionId;
         this.domainName = this.distribution.domainName;
+        // Create and attach WAF WebACL
+        let resolvedWebAclArn;
+        const wafConfig = this.resolveWafConfig(wafProp);
+        if (wafConfig) {
+            if (wafConfig.webAclArn) {
+                // Use existing WebACL
+                resolvedWebAclArn = wafConfig.webAclArn;
+                this.distribution.attachWebAclId(wafConfig.webAclArn);
+            }
+            else {
+                // Create new WebACL
+                const { managedRules = DEFAULT_MANAGED_RULES, rateLimitPerIp = DEFAULT_RATE_LIMIT, } = wafConfig;
+                let priority = 0;
+                const rules = [];
+                // Add managed rule groups
+                for (const ruleName of managedRules) {
+                    rules.push({
+                        name: ruleName,
+                        priority: priority++,
+                        overrideAction: { none: {} },
+                        statement: {
+                            managedRuleGroupStatement: {
+                                name: ruleName,
+                                vendorName: "AWS",
+                            },
+                        },
+                        visibilityConfig: {
+                            cloudWatchMetricsEnabled: true,
+                            metricName: ruleName,
+                            sampledRequestsEnabled: true,
+                        },
+                    });
+                }
+                // Add rate-based rule
+                rules.push({
+                    name: "RateLimitPerIp",
+                    priority: priority++,
+                    action: { block: {} },
+                    statement: {
+                        rateBasedStatement: {
+                            aggregateKeyType: "IP",
+                            limit: rateLimitPerIp,
+                        },
+                    },
+                    visibilityConfig: {
+                        cloudWatchMetricsEnabled: true,
+                        metricName: "RateLimitPerIp",
+                        sampledRequestsEnabled: true,
+                    },
+                });
+                const webAcl = new wafv2.CfnWebACL(this, "WebAcl", {
+                    defaultAction: { allow: {} },
+                    name: constructEnvName("WebAcl"),
+                    rules,
+                    scope: "CLOUDFRONT",
+                    visibilityConfig: {
+                        cloudWatchMetricsEnabled: true,
+                        metricName: constructEnvName("WebAcl"),
+                        sampledRequestsEnabled: true,
+                    },
+                });
+                this.webAcl = webAcl;
+                resolvedWebAclArn = webAcl.attrArn;
+                this.distribution.attachWebAclId(webAcl.attrArn);
+                Tags.of(webAcl).add(CDK$2.TAG.ROLE, roleTag);
+            }
+        }
+        // Create WAF logging
+        if (resolvedWebAclArn && wafConfig) {
+            const { logBucket: wafLogBucketProp = true } = wafConfig;
+            let wafLogBucket;
+            if (wafLogBucketProp === true) {
+                // Create inline WAF logging bucket with Datadog forwarding
+                const createdBucket = new s3.Bucket(this, constructEnvName("WafLogBucket"), {
+                    bucketName: `aws-waf-logs-${constructEnvName("waf").toLowerCase()}`,
+                    lifecycleRules: [
+                        {
+                            expiration: Duration.days(90),
+                            transitions: [
+                                {
+                                    storageClass: s3.StorageClass.INFREQUENT_ACCESS,
+                                    transitionAfter: Duration.days(30),
+                                },
+                            ],
+                        },
+                    ],
+                    objectOwnership: s3.ObjectOwnership.OBJECT_WRITER,
+                    removalPolicy: RemovalPolicy.RETAIN,
+                });
+                Tags.of(createdBucket).add(CDK$2.TAG.ROLE, CDK$2.ROLE.MONITORING);
+                // Add Datadog forwarder notification
+                if (destinationProp !== false) {
+                    const lambdaDestination = destinationProp === true
+                        ? new LambdaDestination(resolveDatadogForwarderFunction(this))
+                        : destinationProp;
+                    createdBucket.addEventNotification(s3.EventType.OBJECT_CREATED, lambdaDestination);
+                }
+                wafLogBucket = createdBucket;
+            }
+            else if (typeof wafLogBucketProp === "object") {
+                // Use provided IBucket
+                wafLogBucket = wafLogBucketProp;
+            }
+            // wafLogBucketProp === false → no logging
+            if (wafLogBucket) {
+                this.wafLogBucket = wafLogBucket;
+                new wafv2.CfnLoggingConfiguration(this, "WafLoggingConfig", {
+                    logDestinationConfigs: [wafLogBucket.bucketArn],
+                    resourceArn: resolvedWebAclArn,
+                });
+            }
+        }
         // Create DNS records if we have host and zone
         if (host && hostedZone) {
             const aRecord = new route53.ARecord(this, "AliasRecord", {
@@ -2632,6 +2752,15 @@ class JaypieDistribution extends Construct {
             "exportName" in value &&
             typeof value.exportName === "string");
     }
+    resolveWafConfig(wafProp) {
+        if (wafProp === false)
+            return undefined;
+        if (wafProp === true)
+            return {};
+        if (wafProp.enabled === false)
+            return undefined;
+        return wafProp;
+    }
     resolveLogBucket(logBucketProp) {
         // true = use account logging bucket
         if (logBucketProp === true) {
@@ -2895,6 +3024,9 @@ class JaypieDynamoDb extends Construct {
     get encryptionKey() {
         return this._table.encryptionKey;
     }
+    get grants() {
+        return this._table.grants;
+    }
     applyRemovalPolicy(policy) {
         this._table.applyRemovalPolicy(policy);
     }
@@ -3253,6 +3385,35 @@ class JaypieInfrastructureStack extends JaypieStack {
     }
 }
 
+class JaypieMigration extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { code, dependencies = [], handler = "index.handler", secrets = [], tables = [], } = props;
+        // Migration Lambda — 5 minute timeout for long-running migrations
+        this.lambda = new JaypieLambda(this, "MigrationLambda", {
+            code,
+            description: "DynamoDB migration custom resource",
+            handler,
+            roleTag: CDK$2.ROLE.PROCESSING,
+            secrets,
+            tables,
+            timeout: cdk.Duration.minutes(5),
+        });
+        // Custom Resource provider wrapping the Lambda
+        const provider = new cr.Provider(this, "MigrationProvider", {
+            onEventHandler: this.lambda,
+        });
+        // Custom Resource that triggers on every deploy
+        const resource = new cdk.CustomResource(this, "MigrationResource", {
+            serviceToken: provider.serviceToken,
+        });
+        // Ensure dependencies are created before the migration runs
+        for (const dep of dependencies) {
+            resource.node.addDependency(dep);
+        }
+    }
+}
+
 class JaypieMongoDbSecret extends JaypieEnvSecret {
     constructor(scope, id = "MongoConnectionString", props) {
         const defaultProps = {
@@ -3471,7 +3632,7 @@ class JaypieOrganizationTrail extends Construct {
         // Resolve options with defaults
         const { bucketName = process.env.PROJECT_NONCE
             ? `organization-cloudtrail-${process.env.PROJECT_NONCE}`
-            : "organization-cloudtrail", enableDatadogNotifications = true, enableFileValidation = false, expirationDays = 365, glacierTransitionDays = 180, infrequentAccessTransitionDays = 30, project, service = CDK$2.SERVICE.INFRASTRUCTURE, trailName = process.env.PROJECT_NONCE
+            : "organization-cloudtrail", enableAccessAnalyzer = true, enableDatadogNotifications = true, enableFileValidation = true, enableLambdaDataEvents = true, enableS3DataEvents = false, expirationDays = 365, glacierTransitionDays = 180, infrequentAccessTransitionDays = 30, project, service = CDK$2.SERVICE.INFRASTRUCTURE, trailName = process.env.PROJECT_NONCE
             ? `organization-cloudtrail-${process.env.PROJECT_NONCE}`
             : "organization-cloudtrail", } = props;
         // Create the S3 bucket for CloudTrail logs
@@ -3531,12 +3692,34 @@ class JaypieOrganizationTrail extends Construct {
             managementEvents: ReadWriteType.ALL,
             trailName,
         });
+        // Add data event selectors
+        if (enableLambdaDataEvents) {
+            this.trail.logAllLambdaDataEvents();
+        }
+        if (enableS3DataEvents) {
+            this.trail.logAllS3DataEvents();
+        }
         // Add tags to trail
         cdk.Tags.of(this.trail).add(CDK$2.TAG.SERVICE, service);
         cdk.Tags.of(this.trail).add(CDK$2.TAG.ROLE, CDK$2.ROLE.MONITORING);
         if (project) {
             cdk.Tags.of(this.trail).add(CDK$2.TAG.PROJECT, project);
         }
+        // Create IAM Access Analyzer
+        if (enableAccessAnalyzer) {
+            const analyzerName = process.env.PROJECT_NONCE
+                ? `organization-access-analyzer-${process.env.PROJECT_NONCE}`
+                : "organization-access-analyzer";
+            this.analyzer = new CfnAnalyzer(this, "AccessAnalyzer", {
+                analyzerName,
+                type: "ORGANIZATION",
+            });
+            cdk.Tags.of(this.analyzer).add(CDK$2.TAG.SERVICE, service);
+            cdk.Tags.of(this.analyzer).add(CDK$2.TAG.ROLE, CDK$2.ROLE.MONITORING);
+            if (project) {
+                cdk.Tags.of(this.analyzer).add(CDK$2.TAG.PROJECT, project);
+            }
+        }
     }
 }
 
@@ -4580,5 +4763,5 @@ class JaypieWebSocketTable extends Construct {
     }
 }
 
-export { CDK$2 as CDK, JaypieAccountLoggingBucket, JaypieApiGateway, JaypieAppStack, JaypieBucketQueuedLambda, JaypieCertificate, JaypieDatadogBucket, JaypieDatadogForwarder, JaypieDatadogSecret, JaypieDistribution, JaypieDnsRecord, JaypieDynamoDb, JaypieEnvSecret, JaypieEventsRule, JaypieExpressLambda, JaypieGitHubDeployRole, JaypieHostedZone, JaypieInfrastructureStack, JaypieLambda, JaypieMongoDbSecret, JaypieNextJs, JaypieOpenAiSecret, JaypieOrganizationTrail, JaypieQueuedLambda, JaypieSsoPermissions, JaypieSsoSyncApplication, JaypieStack, JaypieStaticWebBucket, JaypieTraceSigningKeySecret, JaypieWebDeploymentBucket, JaypieWebSocket, JaypieWebSocketLambda, JaypieWebSocketTable, addDatadogLayers, clearAllCertificateCaches, clearAllSecretsCaches, clearCertificateCache, clearSecretsCache, constructEnvName, constructStackName, constructTagger, envHostname, extendDatadogRole, isEnv, isProductionEnv, isSandboxEnv, isValidHostname$1 as isValidHostname, isValidSubdomain, jaypieLambdaEnv, mergeDomain, resolveCertificate, resolveDatadogForwarderFunction, resolveDatadogLayers, resolveDatadogLoggingDestination, resolveEnvironment, resolveHostedZone, resolveParamsAndSecrets, resolveSecrets };
+export { CDK$2 as CDK, JaypieAccountLoggingBucket, JaypieApiGateway, JaypieAppStack, JaypieBucketQueuedLambda, JaypieCertificate, JaypieDatadogBucket, JaypieDatadogForwarder, JaypieDatadogSecret, JaypieDistribution, JaypieDnsRecord, JaypieDynamoDb, JaypieEnvSecret, JaypieEventsRule, JaypieExpressLambda, JaypieGitHubDeployRole, JaypieHostedZone, JaypieInfrastructureStack, JaypieLambda, JaypieMigration, JaypieMongoDbSecret, JaypieNextJs, JaypieOpenAiSecret, JaypieOrganizationTrail, JaypieQueuedLambda, JaypieSsoPermissions, JaypieSsoSyncApplication, JaypieStack, JaypieStaticWebBucket, JaypieTraceSigningKeySecret, JaypieWebDeploymentBucket, JaypieWebSocket, JaypieWebSocketLambda, JaypieWebSocketTable, addDatadogLayers, clearAllCertificateCaches, clearAllSecretsCaches, clearCertificateCache, clearSecretsCache, constructEnvName, constructStackName, constructTagger, envHostname, extendDatadogRole, isEnv, isProductionEnv, isSandboxEnv, isValidHostname$1 as isValidHostname, isValidSubdomain, jaypieLambdaEnv, mergeDomain, resolveCertificate, resolveDatadogForwarderFunction, resolveDatadogLayers, resolveDatadogLoggingDestination, resolveEnvironment, resolveHostedZone, resolveParamsAndSecrets, resolveSecrets };
 //# sourceMappingURL=index.js.map