@jaypie/constructs 1.2.52 → 1.2.54

package/dist/cjs/JaypieWebDeploymentBucket.d.ts

@@ -1,4 +1,4 @@
-import { RemovalPolicy } from "aws-cdk-lib";
+import { CfnOutput, RemovalPolicy } from "aws-cdk-lib";
 import * as acm from "aws-cdk-lib/aws-certificatemanager";
 import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
 import { AddToResourcePolicyResult, PolicyStatement } from "aws-cdk-lib/aws-iam";
@@ -123,6 +123,23 @@ export declare class JaypieWebDeploymentBucket extends Construct implements s3.I
     readonly wafLogBucket?: s3.IBucket;
     readonly webAcl?: wafv2.CfnWebACL;
     constructor(scope: Construct, id: string, props?: JaypieWebDeploymentBucketProps);
+    /**
+     * Emit stack-level CfnOutputs with stable, hash-free logical IDs so they can
+     * be read directly from `cdk-outputs.json` without prefix-matching. Skips
+     * outputs whose underlying resource is absent.
+     *
+     * Logical IDs (with optional `prefix`):
+     * - `${prefix}DestinationBucketName`
+     * - `${prefix}DestinationBucketDeployRoleArn` (when a deploy role exists)
+     * - `${prefix}DistributionId` (when a distribution exists)
+     * - `${prefix}CertificateArn` (when a certificate exists)
+     *
+     * @returns map of created outputs keyed by their logical ID
+     */
+    exportOutputs(options?: {
+        prefix?: string;
+        scope?: Construct;
+    }): Record<string, CfnOutput>;
     private resolveWafConfig;
     private isExportNameObject;
     private resolveLogBucket;

package/dist/cjs/helpers/__tests__/constructWafLogBucketName.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cjs/helpers/constructWafLogBucketName.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Build a WAF log bucket name shaped like
+ * `aws-waf-logs-${env}-${key}-${name}-waf-${nonce}` (or `-waf-` only when
+ * `name` is empty). The `aws-waf-logs-` prefix is required by AWS WAF, and
+ * `-${PROJECT_NONCE}` is preserved verbatim for uniqueness; the middle is
+ * truncated when needed to fit S3's 63-char limit.
+ */
+export declare function constructWafLogBucketName(name?: string): string;

package/dist/cjs/helpers/index.d.ts

@@ -2,6 +2,7 @@ export { addDatadogLayers } from "./addDatadogLayers";
 export { constructEnvName } from "./constructEnvName";
 export { constructStackName } from "./constructStackName";
 export { constructTagger } from "./constructTagger";
+export { constructWafLogBucketName } from "./constructWafLogBucketName";
 export { envHostname, HostConfig } from "./envHostname";
 export { extendDatadogRole, ExtendDatadogRoleOptions, } from "./extendDatadogRole";
 export { clearAllCertificateCaches, clearCertificateCache, resolveCertificate, ResolveCertificateOptions, } from "./resolveCertificate";

package/dist/cjs/index.cjs

@@ -9,7 +9,7 @@ var route53Targets = require('aws-cdk-lib/aws-route53-targets');
 var secretsmanager = require('aws-cdk-lib/aws-secretsmanager');
 var datadogCdkConstructsV2 = require('datadog-cdk-constructs-v2');
 var errors = require('@jaypie/errors');
-var awsIam = require('aws-cdk-lib/aws-iam');
+var iam = require('aws-cdk-lib/aws-iam');
 var acm = require('aws-cdk-lib/aws-certificatemanager');
 var logs = require('aws-cdk-lib/aws-logs');
 var lambda = require('aws-cdk-lib/aws-lambda');
@@ -56,6 +56,7 @@ var apiGateway__namespace = /*#__PURE__*/_interopNamespaceDefault(apiGateway);
 var route53__namespace = /*#__PURE__*/_interopNamespaceDefault(route53);
 var route53Targets__namespace = /*#__PURE__*/_interopNamespaceDefault(route53Targets);
 var secretsmanager__namespace = /*#__PURE__*/_interopNamespaceDefault(secretsmanager);
+var iam__namespace = /*#__PURE__*/_interopNamespaceDefault(iam);
 var acm__namespace = /*#__PURE__*/_interopNamespaceDefault(acm);
 var logs__namespace = /*#__PURE__*/_interopNamespaceDefault(logs);
 var lambda__namespace = /*#__PURE__*/_interopNamespaceDefault(lambda);
@@ -401,6 +402,29 @@ function constructTagger(construct, { name } = {}) {
     return true;
 }
 
+const AWS_WAF_LOGS_PREFIX = "aws-waf-logs-";
+const S3_BUCKET_NAME_MAX_LENGTH = 63;
+/**
+ * Build a WAF log bucket name shaped like
+ * `aws-waf-logs-${env}-${key}-${name}-waf-${nonce}` (or `-waf-` only when
+ * `name` is empty). The `aws-waf-logs-` prefix is required by AWS WAF, and
+ * `-${PROJECT_NONCE}` is preserved verbatim for uniqueness; the middle is
+ * truncated when needed to fit S3's 63-char limit.
+ */
+function constructWafLogBucketName(name) {
+    const nonce = (process.env.PROJECT_NONCE ?? "cfe2").toLowerCase();
+    const nonceSuffix = `-${nonce}`;
+    const innerName = name ? `${name}-waf` : "waf";
+    const middle = constructEnvName(innerName)
+        .toLowerCase()
+        .slice(0, -nonceSuffix.length);
+    const maxMiddleLength = S3_BUCKET_NAME_MAX_LENGTH - AWS_WAF_LOGS_PREFIX.length - nonceSuffix.length;
+    const truncated = middle.length > maxMiddleLength
+        ? middle.slice(0, maxMiddleLength).replace(/-+$/, "")
+        : middle;
+    return `${AWS_WAF_LOGS_PREFIX}${truncated}${nonceSuffix}`;
+}
+
 function envHostname({ component, domain, env, subdomain, } = {}) {
     const resolvedDomain = domain || process.env.CDK_ENV_DOMAIN || process.env.CDK_ENV_HOSTED_ZONE;
     if (!resolvedDomain) {
@@ -453,22 +477,22 @@ function extendDatadogRole(scope, options) {
     }
     const { id = "DatadogCustomPolicy", project, service = CDK$2.SERVICE.DATADOG, } = options || {};
     // Lookup the Datadog role
-    const datadogRole = awsIam.Role.fromRoleArn(scope, "DatadogRole", datadogRoleArn);
+    const datadogRole = iam.Role.fromRoleArn(scope, "DatadogRole", datadogRoleArn);
     // Build policy statements
     const statements = [
         // Allow view budget
-        new awsIam.PolicyStatement({
+        new iam.PolicyStatement({
             actions: ["budgets:ViewBudget"],
             resources: ["*"],
         }),
         // Allow describe log groups
-        new awsIam.PolicyStatement({
+        new iam.PolicyStatement({
             actions: ["logs:DescribeLogGroups"],
             resources: ["*"],
         }),
     ];
     // Create the custom policy
-    const datadogCustomPolicy = new awsIam.Policy(scope, id, {
+    const datadogCustomPolicy = new iam.Policy(scope, id, {
         roles: [datadogRole],
         statements,
     });
@@ -2304,22 +2328,22 @@ class JaypieDatadogBucket extends constructs.Construct {
         }
         const { project, service = CDK$2.SERVICE.DATADOG } = options || {};
         // Lookup the Datadog role
-        const datadogRole = awsIam.Role.fromRoleArn(this, "DatadogRole", datadogRoleArn);
+        const datadogRole = iam.Role.fromRoleArn(this, "DatadogRole", datadogRoleArn);
         // Build policy statements for bucket access
         const statements = [
             // Allow list bucket
-            new awsIam.PolicyStatement({
+            new iam.PolicyStatement({
                 actions: ["s3:ListBucket"],
                 resources: [this.bucket.bucketArn],
             }),
             // Allow read and write to the bucket
-            new awsIam.PolicyStatement({
+            new iam.PolicyStatement({
                 actions: ["s3:GetObject", "s3:PutObject"],
                 resources: [`${this.bucket.bucketArn}/*`],
             }),
         ];
         // Create the custom policy
-        const datadogBucketPolicy = new awsIam.Policy(this, "DatadogBucketPolicy", {
+        const datadogBucketPolicy = new iam.Policy(this, "DatadogBucketPolicy", {
             roles: [datadogRole],
             statements,
         });
@@ -2765,9 +2789,7 @@ class JaypieDistribution extends constructs.Construct {
                 const wafLogBucketId = wafConfig.name
                     ? constructEnvName(`${wafConfig.name}-WafLogBucket`)
                     : constructEnvName("WafLogBucket");
-                const wafLogBucketName = wafConfig.name
-                    ? `aws-waf-logs-${constructEnvName(`${wafConfig.name}-waf`).toLowerCase()}`
-                    : `aws-waf-logs-${constructEnvName("waf").toLowerCase()}`;
+                const wafLogBucketName = constructWafLogBucketName(wafConfig.name);
                 const createdBucket = new s3__namespace.Bucket(this, wafLogBucketId, {
                     bucketName: wafLogBucketName,
                     lifecycleRules: [
@@ -3327,8 +3349,8 @@ class JaypieGitHubDeployRole extends constructs.Construct {
         }
         const sponsor = propsSponsor || process.env.PROJECT_SPONSOR || envRepoOrganization;
         // Create the IAM role
-        this._role = new awsIam.Role(this, "GitHubActionsRole", {
-            assumedBy: new awsIam.FederatedPrincipal(oidcProviderArn, {
+        this._role = new iam.Role(this, "GitHubActionsRole", {
+            assumedBy: new iam.FederatedPrincipal(oidcProviderArn, {
                 StringLike: {
                     "token.actions.githubusercontent.com:sub": repoRestriction,
                 },
@@ -3338,12 +3360,12 @@ class JaypieGitHubDeployRole extends constructs.Construct {
         });
         cdk.Tags.of(this._role).add(CDK$2.TAG.ROLE, CDK$2.ROLE.DEPLOY);
         // Allow the role to access the GitHub OIDC provider
-        this._role.addToPolicy(new awsIam.PolicyStatement({
+        this._role.addToPolicy(new iam.PolicyStatement({
             actions: ["sts:AssumeRoleWithWebIdentity"],
             resources: [`arn:aws:iam::${accountId}:oidc-provider/*`],
         }));
         // Allow the role to deploy CDK apps
-        this._role.addToPolicy(new awsIam.PolicyStatement({
+        this._role.addToPolicy(new iam.PolicyStatement({
             actions: [
                 "cloudformation:CreateStack",
                 "cloudformation:DeleteStack",
@@ -3360,12 +3382,12 @@ class JaypieGitHubDeployRole extends constructs.Construct {
                 "ssm:GetParameter",
                 "ssm:GetParameters",
             ],
-            effect: awsIam.Effect.ALLOW,
+            effect: iam.Effect.ALLOW,
             resources: ["*"],
         }));
-        this._role.addToPolicy(new awsIam.PolicyStatement({
+        this._role.addToPolicy(new iam.PolicyStatement({
             actions: ["iam:PassRole", "sts:AssumeRole"],
-            effect: awsIam.Effect.ALLOW,
+            effect: iam.Effect.ALLOW,
             resources: [
                 "arn:aws:iam::*:role/cdk-hnb659fds-deploy-role-*",
                 "arn:aws:iam::*:role/cdk-hnb659fds-file-publishing-*",
@@ -3378,14 +3400,14 @@ class JaypieGitHubDeployRole extends constructs.Construct {
             if (!sponsor) {
                 throw new errors.ConfigurationError("Cannot grant default ECR permissions without a sponsor. Set sponsor prop, PROJECT_SPONSOR, CDK_ENV_REPO, or PROJECT_REPO, or pass `ecr: false`");
             }
-            this._role.addToPolicy(new awsIam.PolicyStatement({
+            this._role.addToPolicy(new iam.PolicyStatement({
                 actions: ["ecr:GetAuthorizationToken"],
-                effect: awsIam.Effect.ALLOW,
+                effect: iam.Effect.ALLOW,
                 resources: ["*"],
             }));
-            this._role.addToPolicy(new awsIam.PolicyStatement({
+            this._role.addToPolicy(new iam.PolicyStatement({
                 actions: ECR_PUSH_ACTIONS,
-                effect: awsIam.Effect.ALLOW,
+                effect: iam.Effect.ALLOW,
                 resources: [`arn:aws:ecr:*:${accountId}:repository/${sponsor}-*`],
             }));
         }
@@ -3539,6 +3561,14 @@ class JaypieInfrastructureStack extends JaypieStack {
     }
 }
 
+const DYNAMODB_CONTROL_PLANE_ACTIONS = [
+    "dynamodb:DescribeContinuousBackups",
+    "dynamodb:DescribeTable",
+    "dynamodb:DescribeTimeToLive",
+    "dynamodb:UpdateContinuousBackups",
+    "dynamodb:UpdateTable",
+    "dynamodb:UpdateTimeToLive",
+];
 class JaypieMigration extends constructs.Construct {
     constructor(scope, id, props) {
         super(scope, id);
@@ -3554,6 +3584,18 @@ class JaypieMigration extends constructs.Construct {
             tables,
             timeout: cdk__namespace.Duration.minutes(5),
         });
+        // Grant control-plane perms on the passed tables so migrations that
+        // alter table shape (GSIs, TTL, streams, backups) succeed. JaypieLambda
+        // only grants data-plane access via grantReadWriteData. Issue #339.
+        if (tables.length > 0) {
+            this.lambda.addToRolePolicy(new iam__namespace.PolicyStatement({
+                actions: DYNAMODB_CONTROL_PLANE_ACTIONS,
+                resources: tables.flatMap((table) => [
+                    table.tableArn,
+                    `${table.tableArn}/index/*`,
+                ]),
+            }));
+        }
         // Custom Resource provider wrapping the Lambda
         const provider = new cr__namespace.Provider(this, "MigrationProvider", {
             onEventHandler: this.lambda,
@@ -3816,21 +3858,21 @@ class JaypieOrganizationTrail extends constructs.Construct {
             ],
         });
         // Add CloudTrail bucket policies
-        this.bucket.addToResourcePolicy(new awsIam.PolicyStatement({
+        this.bucket.addToResourcePolicy(new iam.PolicyStatement({
             actions: ["s3:GetBucketAcl"],
-            effect: awsIam.Effect.ALLOW,
-            principals: [new awsIam.ServicePrincipal("cloudtrail.amazonaws.com")],
+            effect: iam.Effect.ALLOW,
+            principals: [new iam.ServicePrincipal("cloudtrail.amazonaws.com")],
             resources: [this.bucket.bucketArn],
         }));
-        this.bucket.addToResourcePolicy(new awsIam.PolicyStatement({
+        this.bucket.addToResourcePolicy(new iam.PolicyStatement({
             actions: ["s3:PutObject"],
             conditions: {
                 StringEquals: {
                     "s3:x-amz-acl": "bucket-owner-full-control",
                 },
             },
-            effect: awsIam.Effect.ALLOW,
-            principals: [new awsIam.ServicePrincipal("cloudtrail.amazonaws.com")],
+            effect: iam.Effect.ALLOW,
+            principals: [new iam.ServicePrincipal("cloudtrail.amazonaws.com")],
             resources: [`${this.bucket.bucketArn}/*`],
         }));
         // Add tags to bucket
@@ -3945,9 +3987,9 @@ class JaypieSsoPermissions extends constructs.Construct {
                 ],
             },
             managedPolicies: [
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
                     .managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
             ],
             sessionDuration: cdk.Duration.hours(1).toIsoString(),
             tags: [
@@ -4026,10 +4068,10 @@ class JaypieSsoPermissions extends constructs.Construct {
                 ],
             },
             managedPolicies: [
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
                     .managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
                     .managedPolicyArn,
             ],
             sessionDuration: cdk.Duration.hours(12).toIsoString(),
@@ -4088,12 +4130,12 @@ class JaypieSsoPermissions extends constructs.Construct {
                 ],
             },
             managedPolicies: [
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
                     .managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
                     .managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("job-function/SystemAdministrator").managedPolicyArn,
+                iam.ManagedPolicy.fromAwsManagedPolicyName("job-function/SystemAdministrator").managedPolicyArn,
             ],
             sessionDuration: cdk.Duration.hours(4).toIsoString(),
             tags: [
@@ -4324,8 +4366,8 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
         }
         let bucketDeployRole;
         if (repo) {
-            bucketDeployRole = new awsIam.Role(this, "DestinationBucketDeployRole", {
-                assumedBy: new awsIam.FederatedPrincipal(cdk.Fn.importValue(CDK$2.IMPORT.OIDC_PROVIDER), {
+            bucketDeployRole = new iam.Role(this, "DestinationBucketDeployRole", {
+                assumedBy: new iam.FederatedPrincipal(cdk.Fn.importValue(CDK$2.IMPORT.OIDC_PROVIDER), {
                     StringLike: {
                         "token.actions.githubusercontent.com:sub": repo,
                     },
@@ -4334,8 +4376,8 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             });
             cdk.Tags.of(bucketDeployRole).add(CDK$2.TAG.ROLE, CDK$2.ROLE.DEPLOY);
             // Allow the role to write to the bucket
-            bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
-                effect: awsIam.Effect.ALLOW,
+            bucketDeployRole.addToPolicy(new iam.PolicyStatement({
+                effect: iam.Effect.ALLOW,
                 actions: [
                     "s3:DeleteObject",
                     "s3:GetObject",
@@ -4344,16 +4386,16 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
                 ],
                 resources: [`${this.bucket.bucketArn}/*`],
             }));
-            bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
-                effect: awsIam.Effect.ALLOW,
+            bucketDeployRole.addToPolicy(new iam.PolicyStatement({
+                effect: iam.Effect.ALLOW,
                 actions: ["s3:ListBucket"],
                 resources: [this.bucket.bucketArn],
             }));
             // Allow the role to describe the current stack
             const stack = cdk.Stack.of(this);
-            bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
+            bucketDeployRole.addToPolicy(new iam.PolicyStatement({
                 actions: ["cloudformation:DescribeStacks"],
-                effect: awsIam.Effect.ALLOW,
+                effect: iam.Effect.ALLOW,
                 resources: [
                     `arn:aws:cloudformation:${stack.region}:${stack.account}:stack/${stack.stackName}/*`,
                 ],
@@ -4540,8 +4582,8 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             });
             // Add CloudFront invalidation permission to deploy role if it exists
             if (bucketDeployRole) {
-                bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
-                    effect: awsIam.Effect.ALLOW,
+                bucketDeployRole.addToPolicy(new iam.PolicyStatement({
+                    effect: iam.Effect.ALLOW,
                     actions: ["cloudfront:CreateInvalidation"],
                     resources: [
                         `arn:aws:cloudfront::${cdk.Stack.of(this).account}:distribution/${this.distribution.distributionId}`,
@@ -4622,7 +4664,7 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
                 let wafLogBucket;
                 if (wafLogBucketProp === true) {
                     const wafLogBucketId = constructEnvName(`${wafConfig.name}-WafLogBucket`);
-                    const wafLogBucketName = `aws-waf-logs-${constructEnvName(`${wafConfig.name}-waf`).toLowerCase()}`;
+                    const wafLogBucketName = constructWafLogBucketName(wafConfig.name);
                     const createdBucket = new s3__namespace.Bucket(this, wafLogBucketId, {
                         bucketName: wafLogBucketName,
                         lifecycleRules: [
@@ -4661,6 +4703,41 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             }
         }
     }
+    /**
+     * Emit stack-level CfnOutputs with stable, hash-free logical IDs so they can
+     * be read directly from `cdk-outputs.json` without prefix-matching. Skips
+     * outputs whose underlying resource is absent.
+     *
+     * Logical IDs (with optional `prefix`):
+     * - `${prefix}DestinationBucketName`
+     * - `${prefix}DestinationBucketDeployRoleArn` (when a deploy role exists)
+     * - `${prefix}DistributionId` (when a distribution exists)
+     * - `${prefix}CertificateArn` (when a certificate exists)
+     *
+     * @returns map of created outputs keyed by their logical ID
+     */
+    exportOutputs(options = {}) {
+        const { prefix = "", scope = cdk.Stack.of(this) } = options;
+        const outputs = {};
+        const create = (id, value) => {
+            const logicalId = `${prefix}${id}`;
+            const output = new cdk.CfnOutput(scope, `${logicalId}Export`, { value });
+            output.overrideLogicalId(logicalId);
+            outputs[logicalId] = output;
+            return output;
+        };
+        create("DestinationBucketName", this.bucket.bucketName);
+        if (this.deployRoleArn) {
+            create("DestinationBucketDeployRoleArn", this.deployRoleArn);
+        }
+        if (this.distribution) {
+            create("DistributionId", this.distribution.distributionId);
+        }
+        if (this.certificate) {
+            create("CertificateArn", this.certificate.certificateArn);
+        }
+        return outputs;
+    }
     resolveWafConfig(wafProp, defaultName) {
         if (wafProp === false)
             return undefined;
@@ -5238,6 +5315,7 @@ exports.clearSecretsCache = clearSecretsCache;
 exports.constructEnvName = constructEnvName;
 exports.constructStackName = constructStackName;
 exports.constructTagger = constructTagger;
+exports.constructWafLogBucketName = constructWafLogBucketName;
 exports.ensureRoute53QueryLoggingPolicy = ensureRoute53QueryLoggingPolicy;
 exports.envHostname = envHostname;
 exports.extendDatadogRole = extendDatadogRole;