@jaypie/constructs 1.2.53 → 1.2.55

package/dist/esm/JaypieDistribution.d.ts

@@ -8,6 +8,17 @@ import { LambdaDestination } from "aws-cdk-lib/aws-s3-notifications";
 import * as wafv2 from "aws-cdk-lib/aws-wafv2";
 import { Construct } from "constructs";
 import { HostConfig } from "./helpers";
+/**
+ * One entry in a `waf.allow` list. Names one or more URL paths and, for each
+ * managed rule group key, the sub-rule names to flip from `block` to `count`
+ * on that path set. See JaypieWafConfig.allow.
+ */
+export interface JaypieWafAllowEntry {
+    /** URL path or paths. Trailing `*` → STARTS_WITH; otherwise EXACTLY. */
+    path: string | string[];
+    /** Managed-rule-group keys (e.g. AWSManagedRulesCommonRuleSet) → sub-rule names. */
+    [ruleGroupKey: string]: string | string[] | undefined;
+}
 export interface JaypieWafConfig {
     /**
      * Unique name for this distribution's WAF resources. Required when passing a
@@ -76,6 +87,26 @@ export interface JaypieWafConfig {
      * @default 2000
      */
     rateLimitPerIp?: number;
+    /**
+     * Path-scoped relaxations layered on top of the default managed-rule groups.
+     * Each entry names one or more URL paths and, for each managed rule group
+     * key, the sub-rule names to flip from `block` to `count` on that path set.
+     * Strict default action is preserved on every other path.
+     *
+     * Composes with `managedRuleOverrides`: the baseline override list applies
+     * to both the relaxed and strict emissions of a group; entries in `allow`
+     * additionally relax specific (path × sub-rule) intersections.
+     *
+     * @example
+     * allow: [
+     *   {
+     *     path: "/hooks/*",
+     *     AWSManagedRulesCommonRuleSet: ["ExploitablePaths_URIPATH"],
+     *     AWSManagedRulesKnownBadInputsRuleSet: ["CrossSiteScripting_BODY"],
+     *   },
+     * ]
+     */
+    allow?: JaypieWafAllowEntry | JaypieWafAllowEntry[];
     /**
      * Use an existing WebACL ARN instead of creating one
      */

package/dist/esm/JaypieMigration.d.ts

@@ -1,4 +1,5 @@
 import { Construct } from "constructs";
+import * as cdk from "aws-cdk-lib";
 import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import { JaypieLambda } from "./JaypieLambda";
@@ -16,6 +17,8 @@ export interface JaypieMigrationProps {
     secrets?: SecretsArrayItem[];
     /** DynamoDB tables to grant read/write access */
     tables?: dynamodb.ITable[];
+    /** Lambda timeout. Defaults to 15 minutes (Lambda max). */
+    timeout?: cdk.Duration;
 }
 export declare class JaypieMigration extends Construct {
     readonly lambda: JaypieLambda;

package/dist/esm/index.js

@@ -10,6 +10,7 @@ import * as route53Targets from 'aws-cdk-lib/aws-route53-targets';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import { DatadogLambda } from 'datadog-cdk-constructs-v2';
 import { ConfigurationError } from '@jaypie/errors';
+import * as iam from 'aws-cdk-lib/aws-iam';
 import { Role, PolicyStatement, Policy, FederatedPrincipal, Effect, ServicePrincipal, ManagedPolicy } from 'aws-cdk-lib/aws-iam';
 import * as acm from 'aws-cdk-lib/aws-certificatemanager';
 import * as logs from 'aws-cdk-lib/aws-logs';
@@ -2680,13 +2681,110 @@ class JaypieDistribution extends Construct {
             }
             else {
                 // Create new WebACL
-                const { managedRuleOverrides, managedRuleScopeDowns, managedRules = DEFAULT_MANAGED_RULES$1, rateLimitPerIp = DEFAULT_RATE_LIMIT$1, } = wafConfig;
+                const { allow, managedRuleOverrides, managedRuleScopeDowns, managedRules = DEFAULT_MANAGED_RULES$1, rateLimitPerIp = DEFAULT_RATE_LIMIT$1, } = wafConfig;
+                const allowEntries = allow
+                    ? Array.isArray(allow)
+                        ? allow
+                        : [allow]
+                    : [];
+                const groupAllowances = {};
+                for (const entry of allowEntries) {
+                    const paths = Array.isArray(entry.path) ? entry.path : [entry.path];
+                    for (const key of Object.keys(entry)) {
+                        if (key === "path")
+                            continue;
+                        const raw = entry[key];
+                        if (raw == null)
+                            continue;
+                        const ruleNames = Array.isArray(raw) ? raw : [raw];
+                        if (!groupAllowances[key])
+                            groupAllowances[key] = [];
+                        groupAllowances[key].push({ paths, ruleNames });
+                    }
+                }
+                const pathToStatement = (path) => {
+                    const isPrefix = path.endsWith("*");
+                    return {
+                        byteMatchStatement: {
+                            fieldToMatch: { uriPath: {} },
+                            positionalConstraint: isPrefix ? "STARTS_WITH" : "EXACTLY",
+                            searchString: isPrefix ? path.slice(0, -1) : path,
+                            textTransformations: [{ priority: 0, type: "NONE" }],
+                        },
+                    };
+                };
+                const pathsToStatement = (paths) => {
+                    if (paths.length === 1)
+                        return pathToStatement(paths[0]);
+                    return {
+                        orStatement: { statements: paths.map(pathToStatement) },
+                    };
+                };
+                const andScopeDown = (base, extra) => base ? { andStatement: { statements: [base, extra] } } : extra;
                 let priority = 0;
                 const rules = [];
                 // Add managed rule groups
                 for (const ruleName of managedRules) {
-                    const ruleActionOverrides = managedRuleOverrides?.[ruleName];
-                    const scopeDownStatement = managedRuleScopeDowns?.[ruleName];
+                    const baseOverrides = managedRuleOverrides?.[ruleName];
+                    const baseScopeDown = managedRuleScopeDowns?.[ruleName];
+                    const allowances = groupAllowances[ruleName];
+                    if (!allowances || allowances.length === 0) {
+                        rules.push({
+                            name: ruleName,
+                            priority: priority++,
+                            overrideAction: { none: {} },
+                            statement: {
+                                managedRuleGroupStatement: {
+                                    name: ruleName,
+                                    vendorName: "AWS",
+                                    ...(baseOverrides && { ruleActionOverrides: baseOverrides }),
+                                    ...(baseScopeDown && { scopeDownStatement: baseScopeDown }),
+                                },
+                            },
+                            visibilityConfig: {
+                                cloudWatchMetricsEnabled: true,
+                                metricName: ruleName,
+                                sampledRequestsEnabled: true,
+                            },
+                        });
+                        continue;
+                    }
+                    // Emit one relaxed rule per allow entry that names this group
+                    allowances.forEach(({ paths, ruleNames }, index) => {
+                        const entryOverrides = ruleNames.map((n) => ({
+                            name: n,
+                            actionToUse: { count: {} },
+                        }));
+                        const combinedOverrides = [
+                            ...(baseOverrides ?? []),
+                            ...entryOverrides,
+                        ];
+                        const relaxedScopeDown = andScopeDown(baseScopeDown, pathsToStatement(paths));
+                        const relaxedName = `${ruleName}-allow-${index}`;
+                        rules.push({
+                            name: relaxedName,
+                            priority: priority++,
+                            overrideAction: { none: {} },
+                            statement: {
+                                managedRuleGroupStatement: {
+                                    name: ruleName,
+                                    vendorName: "AWS",
+                                    ruleActionOverrides: combinedOverrides,
+                                    scopeDownStatement: relaxedScopeDown,
+                                },
+                            },
+                            visibilityConfig: {
+                                cloudWatchMetricsEnabled: true,
+                                metricName: relaxedName,
+                                sampledRequestsEnabled: true,
+                            },
+                        });
+                    });
+                    // Emit one strict rule whose scope-down excludes every relaxed path
+                    const allPaths = allowances.flatMap((a) => a.paths);
+                    const strictScopeDown = andScopeDown(baseScopeDown, {
+                        notStatement: { statement: pathsToStatement(allPaths) },
+                    });
                     rules.push({
                         name: ruleName,
                         priority: priority++,
@@ -2695,8 +2793,8 @@ class JaypieDistribution extends Construct {
                             managedRuleGroupStatement: {
                                 name: ruleName,
                                 vendorName: "AWS",
-                                ...(ruleActionOverrides && { ruleActionOverrides }),
-                                ...(scopeDownStatement && { scopeDownStatement }),
+                                ...(baseOverrides && { ruleActionOverrides: baseOverrides }),
+                                scopeDownStatement: strictScopeDown,
                             },
                         },
                         visibilityConfig: {
@@ -3524,11 +3622,18 @@ class JaypieInfrastructureStack extends JaypieStack {
     }
 }
 
+const DYNAMODB_CONTROL_PLANE_ACTIONS = [
+    "dynamodb:DescribeContinuousBackups",
+    "dynamodb:DescribeTable",
+    "dynamodb:DescribeTimeToLive",
+    "dynamodb:UpdateContinuousBackups",
+    "dynamodb:UpdateTable",
+    "dynamodb:UpdateTimeToLive",
+];
 class JaypieMigration extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
-        const { code, dependencies = [], environment, handler = "index.handler", secrets = [], tables = [], } = props;
-        // Migration Lambda — 5 minute timeout for long-running migrations
+        const { code, dependencies = [], environment, handler = "index.handler", secrets = [], tables = [], timeout = cdk.Duration.minutes(15), } = props;
         this.lambda = new JaypieLambda(this, "MigrationLambda", {
             code,
             description: "DynamoDB migration custom resource",
@@ -3537,8 +3642,20 @@ class JaypieMigration extends Construct {
             roleTag: CDK$2.ROLE.PROCESSING,
             secrets,
             tables,
-            timeout: cdk.Duration.minutes(5),
+            timeout,
         });
+        // Grant control-plane perms on the passed tables so migrations that
+        // alter table shape (GSIs, TTL, streams, backups) succeed. JaypieLambda
+        // only grants data-plane access via grantReadWriteData. Issue #339.
+        if (tables.length > 0) {
+            this.lambda.addToRolePolicy(new iam.PolicyStatement({
+                actions: DYNAMODB_CONTROL_PLANE_ACTIONS,
+                resources: tables.flatMap((table) => [
+                    table.tableArn,
+                    `${table.tableArn}/index/*`,
+                ]),
+            }));
+        }
         // Custom Resource provider wrapping the Lambda
         const provider = new cr.Provider(this, "MigrationProvider", {
             onEventHandler: this.lambda,