@mettlecast/domain-cdk-packer 0.2.72 → 0.2.74

package/dist/DomainStack.d.ts

@@ -17,6 +17,8 @@ export interface DomainStackProps extends cdk.StackProps {
     databaseUrl?: string;
     /** ARN of the RDS secret for DB credentials — added to Lambda env as DB_SECRET_ARN. */
     dbSecretArn?: string;
+    /** ARN of the shared AppSecret in Secrets Manager — injected as APP_SECRET_ARN env var. */
+    appSecretArn?: string;
     /** Cognito User Pool ARN — when provided, HTTP API routes are JWT-protected. */
     userPoolArn?: string;
     /** Cognito User Pool ID — preferred over parsing userPoolArn for JWT authorizer issuer. */

package/dist/DomainStack.js

@@ -64,7 +64,7 @@ export class DomainStack extends cdk.Stack {
      */
     constructor(scope, id, props) {
         super(scope, id, props);
-        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, userPoolArn, userPoolId, userPoolClientId, internalSubnetSelection, internetSubnetSelection, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials, disableCloudWatchDashboards } = props;
+        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, appSecretArn, userPoolArn, userPoolId, userPoolClientId, internalSubnetSelection, internetSubnetSelection, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials, disableCloudWatchDashboards } = props;
         const vpc = props.vpc ?? (props.vpcId
             ? ec2.Vpc.fromVpcAttributes(this, 'SharedVpc', {
                 vpcId: props.vpcId,
@@ -170,6 +170,9 @@ export class DomainStack extends cdk.Stack {
         if (userPoolId) {
             environment.COGNITO_USER_POOL_ID = userPoolId;
         }
+        if (appSecretArn) {
+            environment.APP_SECRET_ARN = appSecretArn;
+        }
         const resolveSubnetSelection = (access) => {
             if (access === 'internet')
                 return internetSubnetSelection ?? internalSubnetSelection;
@@ -535,6 +538,15 @@ export class DomainStack extends cdk.Stack {
                 }));
             }
         }
+        // Grant read access to the shared AppSecret for ctx.secrets population.
+        if (appSecretArn) {
+            for (const fn of allDomainLambdas) {
+                fn.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['secretsmanager:GetSecretValue'],
+                    resources: [appSecretArn],
+                }));
+            }
+        }
         // Replace the tenant-scoped role trust policy — only domain Lambdas can assume with tenantId tag
         // Use a single Statement with ArnLike wildcard to stay under the 2048-byte ACL size limit
         const cfnRole = tenantScopedRole.node.defaultChild;

package/dist/pack-domain.d.ts

@@ -41,6 +41,8 @@ export interface PackDomainOptions {
     databaseUrl?: string;
     /** ARN of the RDS secret for DB credentials. */
     dbSecretArn?: string;
+    /** ARN of the shared AppSecret in Secrets Manager — injected as APP_SECRET_ARN env var. */
+    appSecretArn?: string | undefined;
     /** EventBridge bus name; avoids ARN parsing when ARN is a dynamic reference. */
     eventBusName?: string;
     /** Project id used to prefix per-domain physical resource names (e.g. `mtc-dev-data-management`). */

package/dist/pack-domain.js

@@ -20,7 +20,8 @@ export function packDomain(registry, app, stackId, eventBusArn, options) {
             'userPoolId' in options ||
             'userPoolClientId' in options ||
             'databaseUrl' in options ||
-            'dbSecretArn' in options)
+            'dbSecretArn' in options ||
+            'appSecretArn' in options)
         ? { env: options }
         : options || {};
     return new DomainStack(app, stackId, {
@@ -43,6 +44,7 @@ export function packDomain(registry, app, stackId, eventBusArn, options) {
         userPoolClientId: opts.userPoolClientId,
         databaseUrl: opts.databaseUrl,
         dbSecretArn: opts.dbSecretArn,
+        appSecretArn: opts.appSecretArn,
         eventBusName: opts.eventBusName,
         projectId: opts.projectId,
         envCode: opts.envCode,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.72",
+  "version": "0.2.74",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",