@jaypie/constructs 1.2.53 → 1.2.54

package/dist/cjs/index.cjs

@@ -9,7 +9,7 @@ var route53Targets = require('aws-cdk-lib/aws-route53-targets');
 var secretsmanager = require('aws-cdk-lib/aws-secretsmanager');
 var datadogCdkConstructsV2 = require('datadog-cdk-constructs-v2');
 var errors = require('@jaypie/errors');
-var awsIam = require('aws-cdk-lib/aws-iam');
+var iam = require('aws-cdk-lib/aws-iam');
 var acm = require('aws-cdk-lib/aws-certificatemanager');
 var logs = require('aws-cdk-lib/aws-logs');
 var lambda = require('aws-cdk-lib/aws-lambda');
@@ -56,6 +56,7 @@ var apiGateway__namespace = /*#__PURE__*/_interopNamespaceDefault(apiGateway);
 var route53__namespace = /*#__PURE__*/_interopNamespaceDefault(route53);
 var route53Targets__namespace = /*#__PURE__*/_interopNamespaceDefault(route53Targets);
 var secretsmanager__namespace = /*#__PURE__*/_interopNamespaceDefault(secretsmanager);
+var iam__namespace = /*#__PURE__*/_interopNamespaceDefault(iam);
 var acm__namespace = /*#__PURE__*/_interopNamespaceDefault(acm);
 var logs__namespace = /*#__PURE__*/_interopNamespaceDefault(logs);
 var lambda__namespace = /*#__PURE__*/_interopNamespaceDefault(lambda);
@@ -476,22 +477,22 @@ function extendDatadogRole(scope, options) {
     }
     const { id = "DatadogCustomPolicy", project, service = CDK$2.SERVICE.DATADOG, } = options || {};
     // Lookup the Datadog role
-    const datadogRole = awsIam.Role.fromRoleArn(scope, "DatadogRole", datadogRoleArn);
+    const datadogRole = iam.Role.fromRoleArn(scope, "DatadogRole", datadogRoleArn);
     // Build policy statements
     const statements = [
         // Allow view budget
-        new awsIam.PolicyStatement({
+        new iam.PolicyStatement({
             actions: ["budgets:ViewBudget"],
             resources: ["*"],
         }),
         // Allow describe log groups
-        new awsIam.PolicyStatement({
+        new iam.PolicyStatement({
             actions: ["logs:DescribeLogGroups"],
             resources: ["*"],
         }),
     ];
     // Create the custom policy
-    const datadogCustomPolicy = new awsIam.Policy(scope, id, {
+    const datadogCustomPolicy = new iam.Policy(scope, id, {
         roles: [datadogRole],
         statements,
     });
@@ -2327,22 +2328,22 @@ class JaypieDatadogBucket extends constructs.Construct {
         }
         const { project, service = CDK$2.SERVICE.DATADOG } = options || {};
         // Lookup the Datadog role
-        const datadogRole = awsIam.Role.fromRoleArn(this, "DatadogRole", datadogRoleArn);
+        const datadogRole = iam.Role.fromRoleArn(this, "DatadogRole", datadogRoleArn);
         // Build policy statements for bucket access
         const statements = [
             // Allow list bucket
-            new awsIam.PolicyStatement({
+            new iam.PolicyStatement({
                 actions: ["s3:ListBucket"],
                 resources: [this.bucket.bucketArn],
             }),
             // Allow read and write to the bucket
-            new awsIam.PolicyStatement({
+            new iam.PolicyStatement({
                 actions: ["s3:GetObject", "s3:PutObject"],
                 resources: [`${this.bucket.bucketArn}/*`],
             }),
         ];
         // Create the custom policy
-        const datadogBucketPolicy = new awsIam.Policy(this, "DatadogBucketPolicy", {
+        const datadogBucketPolicy = new iam.Policy(this, "DatadogBucketPolicy", {
             roles: [datadogRole],
             statements,
         });
@@ -3348,8 +3349,8 @@ class JaypieGitHubDeployRole extends constructs.Construct {
         }
         const sponsor = propsSponsor || process.env.PROJECT_SPONSOR || envRepoOrganization;
         // Create the IAM role
-        this._role = new awsIam.Role(this, "GitHubActionsRole", {
-            assumedBy: new awsIam.FederatedPrincipal(oidcProviderArn, {
+        this._role = new iam.Role(this, "GitHubActionsRole", {
+            assumedBy: new iam.FederatedPrincipal(oidcProviderArn, {
                 StringLike: {
                     "token.actions.githubusercontent.com:sub": repoRestriction,
                 },
@@ -3359,12 +3360,12 @@ class JaypieGitHubDeployRole extends constructs.Construct {
         });
         cdk.Tags.of(this._role).add(CDK$2.TAG.ROLE, CDK$2.ROLE.DEPLOY);
         // Allow the role to access the GitHub OIDC provider
-        this._role.addToPolicy(new awsIam.PolicyStatement({
+        this._role.addToPolicy(new iam.PolicyStatement({
             actions: ["sts:AssumeRoleWithWebIdentity"],
             resources: [`arn:aws:iam::${accountId}:oidc-provider/*`],
         }));
         // Allow the role to deploy CDK apps
-        this._role.addToPolicy(new awsIam.PolicyStatement({
+        this._role.addToPolicy(new iam.PolicyStatement({
             actions: [
                 "cloudformation:CreateStack",
                 "cloudformation:DeleteStack",
@@ -3381,12 +3382,12 @@ class JaypieGitHubDeployRole extends constructs.Construct {
                 "ssm:GetParameter",
                 "ssm:GetParameters",
             ],
-            effect: awsIam.Effect.ALLOW,
+            effect: iam.Effect.ALLOW,
             resources: ["*"],
         }));
-        this._role.addToPolicy(new awsIam.PolicyStatement({
+        this._role.addToPolicy(new iam.PolicyStatement({
             actions: ["iam:PassRole", "sts:AssumeRole"],
-            effect: awsIam.Effect.ALLOW,
+            effect: iam.Effect.ALLOW,
             resources: [
                 "arn:aws:iam::*:role/cdk-hnb659fds-deploy-role-*",
                 "arn:aws:iam::*:role/cdk-hnb659fds-file-publishing-*",
@@ -3399,14 +3400,14 @@ class JaypieGitHubDeployRole extends constructs.Construct {
             if (!sponsor) {
                 throw new errors.ConfigurationError("Cannot grant default ECR permissions without a sponsor. Set sponsor prop, PROJECT_SPONSOR, CDK_ENV_REPO, or PROJECT_REPO, or pass `ecr: false`");
             }
-            this._role.addToPolicy(new awsIam.PolicyStatement({
+            this._role.addToPolicy(new iam.PolicyStatement({
                 actions: ["ecr:GetAuthorizationToken"],
-                effect: awsIam.Effect.ALLOW,
+                effect: iam.Effect.ALLOW,
                 resources: ["*"],
             }));
-            this._role.addToPolicy(new awsIam.PolicyStatement({
+            this._role.addToPolicy(new iam.PolicyStatement({
                 actions: ECR_PUSH_ACTIONS,
-                effect: awsIam.Effect.ALLOW,
+                effect: iam.Effect.ALLOW,
                 resources: [`arn:aws:ecr:*:${accountId}:repository/${sponsor}-*`],
             }));
         }
@@ -3560,6 +3561,14 @@ class JaypieInfrastructureStack extends JaypieStack {
     }
 }
 
+const DYNAMODB_CONTROL_PLANE_ACTIONS = [
+    "dynamodb:DescribeContinuousBackups",
+    "dynamodb:DescribeTable",
+    "dynamodb:DescribeTimeToLive",
+    "dynamodb:UpdateContinuousBackups",
+    "dynamodb:UpdateTable",
+    "dynamodb:UpdateTimeToLive",
+];
 class JaypieMigration extends constructs.Construct {
     constructor(scope, id, props) {
         super(scope, id);
@@ -3575,6 +3584,18 @@ class JaypieMigration extends constructs.Construct {
             tables,
             timeout: cdk__namespace.Duration.minutes(5),
         });
+        // Grant control-plane perms on the passed tables so migrations that
+        // alter table shape (GSIs, TTL, streams, backups) succeed. JaypieLambda
+        // only grants data-plane access via grantReadWriteData. Issue #339.
+        if (tables.length > 0) {
+            this.lambda.addToRolePolicy(new iam__namespace.PolicyStatement({
+                actions: DYNAMODB_CONTROL_PLANE_ACTIONS,
+                resources: tables.flatMap((table) => [
+                    table.tableArn,
+                    `${table.tableArn}/index/*`,
+                ]),
+            }));
+        }
         // Custom Resource provider wrapping the Lambda
         const provider = new cr__namespace.Provider(this, "MigrationProvider", {
             onEventHandler: this.lambda,
@@ -3837,21 +3858,21 @@ class JaypieOrganizationTrail extends constructs.Construct {
             ],
         });
         // Add CloudTrail bucket policies
-        this.bucket.addToResourcePolicy(new awsIam.PolicyStatement({
+        this.bucket.addToResourcePolicy(new iam.PolicyStatement({
             actions: ["s3:GetBucketAcl"],
-            effect: awsIam.Effect.ALLOW,
-            principals: [new awsIam.ServicePrincipal("cloudtrail.amazonaws.com")],
+            effect: iam.Effect.ALLOW,
+            principals: [new iam.ServicePrincipal("cloudtrail.amazonaws.com")],
             resources: [this.bucket.bucketArn],
         }));
-        this.bucket.addToResourcePolicy(new awsIam.PolicyStatement({
+        this.bucket.addToResourcePolicy(new iam.PolicyStatement({
             actions: ["s3:PutObject"],
             conditions: {
                 StringEquals: {
                     "s3:x-amz-acl": "bucket-owner-full-control",
                 },
             },
-            effect: awsIam.Effect.ALLOW,
-            principals: [new awsIam.ServicePrincipal("cloudtrail.amazonaws.com")],
+            effect: iam.Effect.ALLOW,
+            principals: [new iam.ServicePrincipal("cloudtrail.amazonaws.com")],
             resources: [`${this.bucket.bucketArn}/*`],
         }));
         // Add tags to bucket
@@ -3966,9 +3987,9 @@ class JaypieSsoPermissions extends constructs.Construct {
                 ],
             },
             managedPolicies: [
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
                     .managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
             ],
             sessionDuration: cdk.Duration.hours(1).toIsoString(),
             tags: [
@@ -4047,10 +4068,10 @@ class JaypieSsoPermissions extends constructs.Construct {
                 ],
             },
             managedPolicies: [
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
                     .managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
                     .managedPolicyArn,
             ],
             sessionDuration: cdk.Duration.hours(12).toIsoString(),
@@ -4109,12 +4130,12 @@ class JaypieSsoPermissions extends constructs.Construct {
                 ],
             },
             managedPolicies: [
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
                     .managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                iam.ManagedPolicy.fromAwsManagedPolicyName("AWSManagementConsoleBasicUserAccess").managedPolicyArn,
+                iam.ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
                     .managedPolicyArn,
-                awsIam.ManagedPolicy.fromAwsManagedPolicyName("job-function/SystemAdministrator").managedPolicyArn,
+                iam.ManagedPolicy.fromAwsManagedPolicyName("job-function/SystemAdministrator").managedPolicyArn,
             ],
             sessionDuration: cdk.Duration.hours(4).toIsoString(),
             tags: [
@@ -4345,8 +4366,8 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
         }
         let bucketDeployRole;
         if (repo) {
-            bucketDeployRole = new awsIam.Role(this, "DestinationBucketDeployRole", {
-                assumedBy: new awsIam.FederatedPrincipal(cdk.Fn.importValue(CDK$2.IMPORT.OIDC_PROVIDER), {
+            bucketDeployRole = new iam.Role(this, "DestinationBucketDeployRole", {
+                assumedBy: new iam.FederatedPrincipal(cdk.Fn.importValue(CDK$2.IMPORT.OIDC_PROVIDER), {
                     StringLike: {
                         "token.actions.githubusercontent.com:sub": repo,
                     },
@@ -4355,8 +4376,8 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             });
             cdk.Tags.of(bucketDeployRole).add(CDK$2.TAG.ROLE, CDK$2.ROLE.DEPLOY);
             // Allow the role to write to the bucket
-            bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
-                effect: awsIam.Effect.ALLOW,
+            bucketDeployRole.addToPolicy(new iam.PolicyStatement({
+                effect: iam.Effect.ALLOW,
                 actions: [
                     "s3:DeleteObject",
                     "s3:GetObject",
@@ -4365,16 +4386,16 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
                 ],
                 resources: [`${this.bucket.bucketArn}/*`],
             }));
-            bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
-                effect: awsIam.Effect.ALLOW,
+            bucketDeployRole.addToPolicy(new iam.PolicyStatement({
+                effect: iam.Effect.ALLOW,
                 actions: ["s3:ListBucket"],
                 resources: [this.bucket.bucketArn],
             }));
             // Allow the role to describe the current stack
             const stack = cdk.Stack.of(this);
-            bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
+            bucketDeployRole.addToPolicy(new iam.PolicyStatement({
                 actions: ["cloudformation:DescribeStacks"],
-                effect: awsIam.Effect.ALLOW,
+                effect: iam.Effect.ALLOW,
                 resources: [
                     `arn:aws:cloudformation:${stack.region}:${stack.account}:stack/${stack.stackName}/*`,
                 ],
@@ -4561,8 +4582,8 @@ class JaypieWebDeploymentBucket extends constructs.Construct {
             });
             // Add CloudFront invalidation permission to deploy role if it exists
             if (bucketDeployRole) {
-                bucketDeployRole.addToPolicy(new awsIam.PolicyStatement({
-                    effect: awsIam.Effect.ALLOW,
+                bucketDeployRole.addToPolicy(new iam.PolicyStatement({
+                    effect: iam.Effect.ALLOW,
                     actions: ["cloudfront:CreateInvalidation"],
                     resources: [
                         `arn:aws:cloudfront::${cdk.Stack.of(this).account}:distribution/${this.distribution.distributionId}`,