@justworkflowit/cdk-constructs 0.0.312 → 0.0.313

package/dist/constructs/justWorkflowItConstructs.d.ts

@@ -1,11 +1,16 @@
 import { Construct } from 'constructs';
+import { Role } from 'aws-cdk-lib/aws-iam';
 export interface JustWorkflowItConstructsProps {
     disambiguator: string;
     organizationId: string;
     workflowDefinitions: string[];
     ignoreDefinitionDeployerFailures?: boolean;
+    lambdaArns?: string[];
+    snsTopicArns?: string[];
+    sqsQueueArns?: string[];
 }
 export declare class JustWorkflowItConstructs extends Construct {
     private static readonly CONSTRUCT_ID_PREFIX;
+    readonly executionRole: Role;
     constructor(scope: Construct, props: JustWorkflowItConstructsProps);
 }

package/dist/constructs/justWorkflowItConstructs.js

@@ -95,11 +95,14 @@ class JustWorkflowItConstructs extends constructs_1.Construct {
         const secret = new aws_secretsmanager_1.Secret(this, 'JustWorkflowItAuthTokenSecret', {
             secretName,
             secretStringValue: aws_cdk_lib_1.SecretValue.unsafePlainText('REPLACE_ME_WITH_JUST_WORKFLOW_IT_AUTH_TOKEN'),
-            description: 'Paste your JustWorkflowIt API auth token here to enable secure communication.',
+            description: 'Replace this placeholder with your JustWorkflowIt API auth token to enable workflow deployment.',
         });
         const bucket = new aws_s3_1.Bucket(this, 'WorkflowDefinitionsBucket', {
             removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY,
             autoDeleteObjects: true,
+            blockPublicAccess: aws_s3_1.BlockPublicAccess.BLOCK_ALL,
+            enforceSSL: true,
+            encryption: aws_s3_1.BucketEncryption.S3_MANAGED,
         });
         // Upload each definition and collect its S3 key
         const definitionKeys = [];
@@ -149,20 +152,28 @@ class JustWorkflowItConstructs extends constructs_1.Construct {
         const executionRole = new aws_iam_1.Role(this, 'JustWorkflowItAutomationExecutionRole', {
             roleName: `JustWorkflowItExecutionRole`,
             assumedBy: new aws_iam_1.AccountPrincipal(JUSTWORKFLOWIT_PRODUCTION_ACCOUNT),
+            externalIds: [props.organizationId],
             description: 'Role assumed by JustWorkflowIt backend to perform workflow actions in this account.',
         });
-        executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
-            actions: ['lambda:InvokeFunction'],
-            resources: ['*'],
-        }));
-        executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
-            actions: ['sns:Publish'],
-            resources: ['*'],
-        }));
-        executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
-            actions: ['sqs:SendMessage'],
-            resources: ['*'],
-        }));
+        if (props.lambdaArns && props.lambdaArns.length > 0) {
+            executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
+                actions: ['lambda:InvokeFunction'],
+                resources: props.lambdaArns,
+            }));
+        }
+        if (props.snsTopicArns && props.snsTopicArns.length > 0) {
+            executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
+                actions: ['sns:Publish'],
+                resources: props.snsTopicArns,
+            }));
+        }
+        if (props.sqsQueueArns && props.sqsQueueArns.length > 0) {
+            executionRole.addToPolicy(new aws_iam_1.PolicyStatement({
+                actions: ['sqs:SendMessage'],
+                resources: props.sqsQueueArns,
+            }));
+        }
+        this.executionRole = executionRole;
     }
 }
 exports.JustWorkflowItConstructs = JustWorkflowItConstructs;