@mettlecast/domain-cdk-packer 0.2.49 → 0.2.51

package/dist/DomainStack.js

@@ -199,7 +199,7 @@ export class DomainStack extends cdk.Stack {
                 else {
                     apiRoute = apiRouteBase;
                 }
-                addRouteToApi(this, fn, api.path, [toHttpMethod(api.method)], this.httpApi.httpApiId);
+                addRouteToApi(this, fn, `/${domainId}${api.path}`, [toHttpMethod(api.method)], this.httpApi.httpApiId);
             }
         }
         // Deploy webhooks as grouped Lambdas
@@ -242,7 +242,7 @@ export class DomainStack extends cdk.Stack {
             // Add routes for each webhook entry
             for (const webhook of registry.webhooks) {
                 const fn = webhookLambdas[0]; // Grouped Lambda or first dedicated
-                addRouteToApi(this, fn, webhook.path, [apigwv2.HttpMethod.POST], this.httpApi.httpApiId);
+                addRouteToApi(this, fn, `/${domainId}${webhook.path}`, [apigwv2.HttpMethod.POST], this.httpApi.httpApiId);
             }
         }
         // Deploy event subscribers as grouped Lambdas
@@ -452,21 +452,23 @@ export class DomainStack extends cdk.Stack {
             domainBucket.grantReadWrite(fn);
         }
         // Replace the tenant-scoped role trust policy — only domain Lambdas can assume with tenantId tag
+        // Use a single Statement with ArnLike wildcard to stay under the 2048-byte ACL size limit
         const cfnRole = tenantScopedRole.node.defaultChild;
-        cfnRole.assumeRolePolicyDocument = cdk.Lazy.any({
-            produce: () => ({
-                Version: '2012-10-17',
-                Statement: allDomainLambdas.map(fn => ({
+        const accountId = cdk.Stack.of(this).account;
+        const stackPrefix = cdk.Stack.of(this).stackName;
+        cfnRole.assumeRolePolicyDocument = {
+            Version: '2012-10-17',
+            Statement: [{
                     Effect: 'Allow',
-                    Principal: { AWS: fn.role.roleArn },
+                    Principal: { AWS: accountId },
                     Action: ['sts:AssumeRole', 'sts:TagSession'],
                     Condition: {
                         StringLike: { 'aws:RequestTag/tenantId': '*' },
                         'ForAllValues:StringEquals': { 'sts:TransitiveTagKeys': ['tenantId'] },
+                        ArnLike: { 'aws:PrincipalArn': `arn:aws:iam::${accountId}:role/${stackPrefix}*` },
                     },
-                })),
-            }),
-        });
+                }],
+        };
         // Attach tenant-scoped storage policy to the tenant-scoped role
         const tenantStoragePolicies = iamBuilder.forTenantScopedStorage({
             tableArn: domainTable.tableArn,
@@ -507,8 +509,8 @@ export class DomainStack extends cdk.Stack {
                 DB_SECRET_ARN: dbSecretArn ?? '',
             },
         });
-        addRouteToApi(this, healthConstruct.healthFn, '/_health', [apigwv2.HttpMethod.GET], this.httpApi.httpApiId);
-        addRouteToApi(this, healthConstruct.readyFn, '/_ready', [apigwv2.HttpMethod.GET], this.httpApi.httpApiId);
+        addRouteToApi(this, healthConstruct.healthFn, `/${domainId}/_health`, [apigwv2.HttpMethod.GET], this.httpApi.httpApiId);
+        addRouteToApi(this, healthConstruct.readyFn, `/${domainId}/_ready`, [apigwv2.HttpMethod.GET], this.httpApi.httpApiId);
         // Create CloudWatch dashboard for all primitives
         const allEndpoints = [
             ...registry.apis.map(a => ({ id: a.id, primitiveClass: 'api' })),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.49",
+  "version": "0.2.51",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",