@mstuercke/pulumi-modules 0.0.6 → 0.0.8

package/dist/auth0/Auth0.js

@@ -0,0 +1,81 @@
+import { Resource } from '@pulumi/pulumi';
+import { Client, ClientCredentials, Connection, ConnectionClient, Provider, Tenant, User } from '@pulumi/auth0';
+export class Auth0 extends Resource {
+    domain;
+    clientId;
+    constructor(id, args, opts) {
+        super('mstuercke:auth0:Auth0', id, false, undefined, opts);
+        const { projectId, environmentName, tenantDisplayName, clientDisplayName, domain, m2mClientId, allowedUrls, allowedLoginCallbackUrls, allowedLogoutCallbackUrls, nativeAppId, defaultUsers = [], disableSignup = false, } = args;
+        new Provider('provider', {}, { parent: this });
+        new Tenant('tenant', {
+            friendlyName: tenantDisplayName,
+            flags: {
+                enableClientConnections: false,
+            },
+        }, { parent: this });
+        const nativeAppCallbackUrls = nativeAppId
+            ? [
+                `${nativeAppId}.auth0://${domain}/ios/${nativeAppId}/callback`,
+                `${nativeAppId}.auth0://${domain}/android/${nativeAppId}/callback`,
+            ]
+            : [];
+        const client = new Client('client', {
+            name: clientDisplayName,
+            appType: 'spa',
+            callbacks: [...(allowedLoginCallbackUrls || allowedUrls), ...nativeAppCallbackUrls],
+            webOrigins: allowedUrls,
+            allowedLogoutUrls: [...(allowedLogoutCallbackUrls || allowedUrls), ...nativeAppCallbackUrls],
+            jwtConfiguration: {
+                alg: 'RS256',
+            },
+            addons: {},
+        }, { parent: this });
+        const connection = new Connection('password-authentication', {
+            name: `${projectId}-${environmentName}`,
+            strategy: 'auth0',
+            options: {
+                disableSignup: disableSignup,
+                bruteForceProtection: true,
+            },
+        }, { parent: this });
+        const m2mClientConnection = new ConnectionClient('password-authentication-m2m-client', {
+            clientId: m2mClientId,
+            connectionId: connection.id,
+        }, { parent: client });
+        const clientConnection = new ConnectionClient('password-authentication-client', {
+            clientId: client.id,
+            connectionId: connection.id,
+        }, { parent: client });
+        // TODO: Implement disabling of google-oauth2 (If possible, also disable "Username-Password-Authentication")
+        // // disable google-oauth2 on all clients
+        // const googleOauth2Connection = output(getConnection({name: 'google-oauth2'}))
+        // new ConnectionClients(
+        //   'google-oauth2-clien',
+        //   {
+        //     connectionId: googleOauth2Connection.id,
+        //     enabledClients: [],
+        //   },
+        //   {parent: client, dependsOn: [client]},
+        // )
+        new ClientCredentials('credentials', {
+            clientId: client.id,
+            authenticationMethod: 'none',
+        }, { parent: this });
+        for (const defaultUser of defaultUsers) {
+            const { name, email, emailVerified, password, appMetadata } = defaultUser;
+            new User(`default-user-${defaultUser.email}`, {
+                connectionName: connection.name,
+                name: name,
+                email: email,
+                emailVerified: emailVerified,
+                password: password,
+                appMetadata: appMetadata ? JSON.stringify(appMetadata) : undefined,
+            }, {
+                dependsOn: [m2mClientConnection, clientConnection],
+                parent: connection,
+            });
+        }
+        this.domain = domain;
+        this.clientId = client.id;
+    }
+}

package/dist/auth0/index.js

@@ -0,0 +1,5 @@
+import { Auth0 } from './Auth0';
+export * from './Auth0';
+export const auth0 = {
+    Auth0,
+};

package/dist/domain/getDomain.js

@@ -0,0 +1,14 @@
+import { acm, route53 } from '@pulumi/aws';
+export const getDomain = async (options) => {
+    const { usEast1Provider, name } = options;
+    const zone = await route53.getZone({ name });
+    const euCentral1Certificate = await acm.getCertificate({ domain: name });
+    const usEast1Certificate = await acm.getCertificate({ domain: name }, { provider: usEast1Provider });
+    return {
+        name: zone.name,
+        zoneId: zone.zoneId,
+        nameServers: zone.nameServers,
+        usEast1CertificateArn: usEast1Certificate.arn,
+        euCentral1CertificateArn: euCentral1Certificate.arn,
+    };
+};

package/dist/domain/index.js

@@ -0,0 +1,5 @@
+import { getDomain } from './getDomain';
+export * from './getDomain';
+export const domain = {
+    getDomain,
+};

package/dist/iam/SimpleIamRolePolicy.js

@@ -0,0 +1,115 @@
+import { iam } from '@pulumi/aws';
+import { output } from '@pulumi/pulumi';
+export class SimpleIamRolePolicy extends iam.RolePolicy {
+    constructor(iamRoleId, config, opts) {
+        switch (config.type) {
+            case 'custom':
+                super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, config.statements), opts);
+                break;
+            case 'dynamodb':
+                if (config.level !== 'full-access')
+                    throw mapError(config);
+                super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
+                    {
+                        Action: ['dynamodb:*'],
+                        Effect: 'Allow',
+                        Resource: output(config.tableArn).apply((tableArn) => [`${tableArn}`, `${tableArn}/*`]),
+                    },
+                ]), opts);
+                break;
+            case 'timestream':
+                if (config.level !== 'full-access')
+                    throw mapError(config);
+                super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
+                    {
+                        Action: ['timestream:*'],
+                        Effect: 'Allow',
+                        Resource: [config.dbArn, config.tableArn],
+                    },
+                    {
+                        Action: ['timestream:DescribeEndpoin'],
+                        Effect: 'Allow',
+                        Resource: ['*'],
+                    },
+                ]), opts);
+                break;
+            case 's3':
+                if (config.level !== 'full-access')
+                    throw mapError(config);
+                super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
+                    {
+                        Action: ['s3:*'],
+                        Effect: 'Allow',
+                        Resource: output(config.bucketArn).apply((bucketArn) => [`${bucketArn}`, `${bucketArn}/*`]),
+                    },
+                ]), opts);
+                break;
+            case 'cognito':
+                if (config.level !== 'full-access')
+                    throw mapError(config);
+                super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
+                    {
+                        Action: ['cognito-idp:*'],
+                        Effect: 'Allow',
+                        Resource: [config.userPoolArn],
+                    },
+                ]), opts);
+                break;
+            case 'websocket':
+                if (config.level !== 'full-access')
+                    throw mapError(config);
+                super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
+                    {
+                        Effect: 'Allow',
+                        Action: 'execute-api:*',
+                        Resource: config.apiArn,
+                    },
+                ]), opts);
+                break;
+            case 'sns':
+                if (config.level !== 'publish-message')
+                    throw mapError(config);
+                super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
+                    {
+                        Effect: 'Allow',
+                        Action: 'sns:Publish',
+                        Resource: config.snsTopicArn,
+                    },
+                ]), opts);
+                break;
+            case 'execute-lambda':
+                super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
+                    {
+                        Effect: 'Allow',
+                        Action: 'lambda:InvokeFunction',
+                        Resource: config.lambdaArn,
+                    },
+                ]), opts);
+                break;
+            case 'event-bridge':
+                super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
+                    {
+                        Effect: 'Allow',
+                        Action: ['events:DescribeRule', 'events:DisableRule', 'events:EnableRule'],
+                        Resource: config.ruleArn,
+                    },
+                ]), opts);
+                break;
+            default:
+                throw mapError(config);
+        }
+    }
+}
+function mapIamRolePolicyConfig(iamRoleId, name, statements) {
+    return {
+        role: iamRoleId,
+        name: name,
+        policy: {
+            Version: '2012-10-17',
+            Statement: statements,
+        },
+    };
+}
+function mapError(config) {
+    return new Error(`Unable to create policy with config: ${JSON.stringify(config)}`);
+}

package/dist/iam/SimpleIamRolePolicyConfig.js

@@ -0,0 +1 @@
+export {};

package/dist/iam/index.js

@@ -0,0 +1,6 @@
+import { SimpleIamRolePolicy } from './SimpleIamRolePolicy';
+export * from './SimpleIamRolePolicy';
+export * from './SimpleIamRolePolicyConfig';
+export const iam = {
+    SimpleIamRolePolicy,
+};

package/dist/index.js

@@ -0,0 +1,29 @@
+import { auth0 } from './auth0';
+import { domain } from './domain';
+import { iam } from './iam';
+import { rest } from './rest';
+import { lambda } from './lambda';
+import { mongodb } from './mongodb';
+import { s3 } from './s3';
+import { website } from './website';
+import { websocket } from './websocket';
+export * from './auth0';
+export * from './domain';
+export * from './iam';
+export * from './lambda';
+export * from './mongodb';
+export * from './rest';
+export * from './s3';
+export * from './website';
+export * from './websocket';
+export const mstuercke = {
+    auth0,
+    domain,
+    iam,
+    lambda,
+    mongodb,
+    rest,
+    s3,
+    website,
+    websocket: websocket,
+};

package/dist/lambda/NodeLambdaFunction.js

@@ -0,0 +1,71 @@
+import { iam, lambda } from '@pulumi/aws';
+import { getFile } from '@pulumi/archive';
+import { asset, Resource } from '@pulumi/pulumi';
+import { SimpleIamRolePolicy } from '../iam';
+export class NodeLambdaFunction extends Resource {
+    name;
+    arn;
+    invokeArn;
+    constructor(args, opts) {
+        super('mstuercke:lambda:NodeLambdaFunction', args.name, false, undefined, opts);
+        const { name, additionalIamRolePolicies = [], environmentVariables = undefined, runtime = 'nodejs22.x', functionHandler = 'lambdaFunction.lambdaHandler', memorySize = 128, timeoutSeconds = 30, projectId, } = args;
+        const role = new iam.Role(name, {
+            name: `${name}-lambda`,
+            assumeRolePolicy: JSON.stringify({
+                Version: '2012-10-17',
+                Statement: [
+                    {
+                        Action: 'sts:AssumeRole',
+                        Principal: { Service: 'lambda.amazonaws.com' },
+                        Effect: 'Allow',
+                    },
+                ],
+            }),
+            tags: {
+                project: projectId,
+            },
+        }, { parent: this });
+        role.id.apply((roleId) => {
+            new SimpleIamRolePolicy(roleId, {
+                type: 'custom',
+                name: 'logging',
+                statements: [
+                    {
+                        Effect: 'Allow',
+                        Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEven'],
+                        Resource: '*',
+                    },
+                ],
+            }, { parent: this });
+            for (const config of additionalIamRolePolicies) {
+                new SimpleIamRolePolicy(roleId, config, { parent: this });
+            }
+        });
+        const lambdaZip = getFile({
+            type: 'zip',
+            sourceDir: args.lambdaPath,
+            outputPath: `dist/lambda/${name}.zip`,
+        });
+        const lambdaFunction = new lambda.Function(name, {
+            name: name,
+            handler: functionHandler,
+            runtime: runtime,
+            memorySize: memorySize,
+            timeout: timeoutSeconds,
+            code: new asset.FileArchive(lambdaZip.then((lambdaZip) => lambdaZip.outputPath)),
+            sourceCodeHash: lambdaZip.then((lambdaZip) => lambdaZip.outputBase64sha256),
+            role: role.arn,
+            environment: {
+                variables: {
+                    ...environmentVariables,
+                },
+            },
+            tags: {
+                project: projectId,
+            },
+        }, { parent: this });
+        this.name = name;
+        this.arn = lambdaFunction.arn;
+        this.invokeArn = lambdaFunction.invokeArn;
+    }
+}

package/dist/lambda/WithInputs.js

@@ -0,0 +1 @@
+export {};

package/dist/lambda/index.js

@@ -0,0 +1,5 @@
+import { NodeLambdaFunction } from './NodeLambdaFunction';
+export * from './NodeLambdaFunction';
+export const lambda = {
+    NodeLambdaFunction,
+};

package/dist/mongodb/MongoDB.js

@@ -0,0 +1,51 @@
+import { Resource } from '@pulumi/pulumi';
+import { RandomPassword } from '@pulumi/random';
+import { DatabaseUser, Project, ProjectIpAccessList, Provider, ServerlessInstance } from '@pulumi/mongodbatlas';
+export class MongoDB extends Resource {
+    connectionString;
+    databaseName;
+    username;
+    password;
+    constructor(args, opts) {
+        const { organizationId, projectId, environmentName } = args;
+        super('mstuercke:mongodb:MongoDB', organizationId, false, undefined, opts);
+        new Provider('provider', {}, { parent: this });
+        const mongoProject = new Project('project', {
+            orgId: organizationId,
+            name: `${projectId}-${environmentName}`,
+            tags: {
+                project: projectId,
+            },
+        }, { parent: this });
+        new ProjectIpAccessList('network-access', {
+            projectId: mongoProject.id,
+            cidrBlock: '0.0.0.0/0',
+        }, { parent: mongoProject });
+        const mongoInstance = new ServerlessInstance('database', {
+            projectId: mongoProject.id,
+            name: `${projectId}-${environmentName}`,
+            providerSettingsBackingProviderName: 'AWS',
+            providerSettingsProviderName: 'SERVERLESS',
+            providerSettingsRegionName: 'EU_WEST_1', // Ireland
+        }, { parent: mongoProject });
+        const username = `${projectId}-${environmentName}`;
+        const password = new RandomPassword('password', {
+            length: 32,
+        }, { parent: mongoProject });
+        const databaseName = projectId;
+        new DatabaseUser('user', {
+            projectId: mongoProject.id,
+            username,
+            password: password.result,
+            authDatabaseName: 'admin',
+            roles: [
+                { roleName: 'dbAdmin', databaseName },
+                { roleName: 'readWrite', databaseName },
+            ],
+        }, { parent: mongoProject });
+        this.connectionString = mongoInstance.connectionStringsStandardSrv;
+        this.databaseName = databaseName;
+        this.username = username;
+        this.password = password.result;
+    }
+}

package/dist/mongodb/MongoDBCustomInstance.js

@@ -0,0 +1,32 @@
+import { Resource } from '@pulumi/pulumi';
+import { Project, ProjectIpAccessList, ServerlessInstance } from '@pulumi/mongodbatlas';
+export class MongoDBCustomInstance extends Resource {
+    mongoProjectId;
+    connectionString;
+    databaseName;
+    constructor(args, opts) {
+        const { organizationId, projectId, environmentName } = args;
+        super('mstuercke:mongodb:MongoDBCustomInstance', organizationId, false, undefined, opts);
+        const mongoProject = new Project('project', {
+            orgId: organizationId,
+            name: `${projectId}-${environmentName}`,
+            tags: {
+                project: projectId,
+            },
+        }, { parent: this });
+        new ProjectIpAccessList('network-access', {
+            projectId: mongoProject.id,
+            cidrBlock: '0.0.0.0/0',
+        }, { parent: this });
+        const mongoInstance = new ServerlessInstance('database', {
+            projectId: mongoProject.id,
+            name: `${projectId}-${environmentName}`,
+            providerSettingsBackingProviderName: 'AWS',
+            providerSettingsProviderName: 'SERVERLESS',
+            providerSettingsRegionName: 'EU_WEST_1', // Ireland
+        }, { parent: this });
+        this.mongoProjectId = mongoProject.id;
+        this.connectionString = mongoInstance.connectionStringsStandardSrv;
+        this.databaseName = `${projectId}-${environmentName}`;
+    }
+}

package/dist/mongodb/MongoDBDefaultInstance.js

@@ -0,0 +1,19 @@
+import { output, Resource } from '@pulumi/pulumi';
+import { getProject, getServerlessInstance } from '@pulumi/mongodbatlas';
+export class MongoDBDefaultInstance extends Resource {
+    mongoProjectId;
+    connectionString;
+    databaseName;
+    constructor(args, opts) {
+        const { organizationId, projectId, environmentName } = args;
+        super('mstuercke:mongodb:MongoDBDefaultInstance', organizationId, false, undefined, opts);
+        const mongoProject = output(getProject({ name: 'default' }));
+        const mongoInstance = mongoProject.id.apply((mongoProjectId) => output(getServerlessInstance({
+            projectId: mongoProjectId,
+            name: 'default',
+        })));
+        this.mongoProjectId = mongoProject.id;
+        this.connectionString = mongoInstance.connectionStringsStandardSrv;
+        this.databaseName = `${projectId}-${environmentName}`;
+    }
+}

package/dist/mongodb/MongoDBUser.js

@@ -0,0 +1,28 @@
+import { Resource } from '@pulumi/pulumi';
+import { RandomPassword } from '@pulumi/random';
+import { DatabaseUser } from '@pulumi/mongodbatlas';
+export class MongoDBUser extends Resource {
+    username;
+    password;
+    constructor(args, opts) {
+        const { mongoProjectId, databaseName, projectId, environmentName } = args;
+        const username = `${projectId}-${environmentName}`;
+        super('mstuercke:mongodb:MongoDBUser', username, false, undefined, opts);
+        const password = new RandomPassword('password', {
+            length: 32,
+            special: false,
+        }, { parent: this });
+        new DatabaseUser('user', {
+            projectId: mongoProjectId,
+            username,
+            password: password.result,
+            authDatabaseName: 'admin',
+            roles: [
+                { roleName: 'dbAdmin', databaseName },
+                { roleName: 'readWrite', databaseName },
+            ],
+        }, { parent: this });
+        this.username = username;
+        this.password = password.result;
+    }
+}

package/dist/mongodb/index.js

@@ -0,0 +1,11 @@
+import { MongoDBCustomInstance } from './MongoDBCustomInstance';
+import { MongoDBDefaultInstance } from './MongoDBDefaultInstance';
+import { MongoDBUser } from './MongoDBUser';
+export * from './MongoDBCustomInstance';
+export * from './MongoDBDefaultInstance';
+export * from './MongoDBUser';
+export const mongodb = {
+    MongoDBCustomInstance,
+    MongoDBDefaultInstance,
+    MongoDBUser,
+};

package/dist/rest/RestApi.js

@@ -0,0 +1,129 @@
+import * as aws from '@pulumi/aws';
+import { apigateway, lambda } from '@pulumi/aws';
+import { Record } from '@pulumi/aws/route53';
+import { BasePathMapping, DomainName } from '@pulumi/aws/apigateway';
+export class RestApi extends aws.apigateway.RestApi {
+    url;
+    constructor(id, args, opts) {
+        const { name, projectId, stageName = 'v1', domain } = args;
+        super(id, {
+            name,
+            tags: {
+                project: projectId,
+            },
+        }, opts);
+        const { lambdaFunction, timeoutSeconds = 29 } = args;
+        const proxyResource = new apigateway.Resource(`proxy`, {
+            restApi: this.id,
+            parentId: this.rootResourceId,
+            pathPart: '{proxy+}',
+        }, { parent: this });
+        const proxyMethod = new apigateway.Method(`proxy`, {
+            restApi: this.id,
+            resourceId: proxyResource.id,
+            httpMethod: 'ANY',
+            authorization: 'NONE',
+        }, { parent: proxyResource });
+        const lambdaIntegration = new apigateway.Integration(`proxy`, {
+            restApi: this.id,
+            resourceId: proxyResource.id,
+            httpMethod: proxyMethod.httpMethod,
+            integrationHttpMethod: 'POST',
+            type: 'AWS_PROXY',
+            uri: lambdaFunction.invokeArn,
+            timeoutMilliseconds: timeoutSeconds * 1000,
+        }, { parent: proxyMethod });
+        const proxyOptionsMethod = new apigateway.Method(`options`, {
+            restApi: this.id,
+            resourceId: proxyResource.id,
+            httpMethod: 'OPTIONS',
+            authorization: 'NONE',
+        }, { parent: proxyResource });
+        const lambdaIntegrationOptions = new apigateway.Integration(`options`, {
+            restApi: this.id,
+            resourceId: proxyResource.id,
+            httpMethod: proxyOptionsMethod.httpMethod,
+            integrationHttpMethod: 'POST',
+            type: 'AWS_PROXY',
+            uri: lambdaFunction.invokeArn,
+            timeoutMilliseconds: timeoutSeconds * 1000,
+        }, { parent: proxyOptionsMethod });
+        const proxyRootMethod = new apigateway.Method(`proxy-root`, {
+            restApi: this.id,
+            resourceId: this.rootResourceId,
+            httpMethod: 'ANY',
+            authorization: 'NONE',
+        }, { parent: this });
+        const lambdaRootIntegration = new apigateway.Integration(`proxy-root`, {
+            restApi: this.id,
+            resourceId: proxyRootMethod.resourceId,
+            httpMethod: proxyRootMethod.httpMethod,
+            integrationHttpMethod: 'POST',
+            type: 'AWS_PROXY',
+            uri: lambdaFunction.invokeArn,
+            timeoutMilliseconds: timeoutSeconds * 1000,
+        }, { parent: proxyRootMethod });
+        const proxyRootOptionsMethod = new apigateway.Method(`proxy-root-options`, {
+            restApi: this.id,
+            resourceId: this.rootResourceId,
+            httpMethod: 'OPTIONS',
+            authorization: 'NONE',
+        }, { parent: this });
+        const lambdaRootIntegrationOptions = new apigateway.Integration(`proxy-root-options`, {
+            restApi: this.id,
+            resourceId: proxyRootOptionsMethod.resourceId,
+            httpMethod: proxyRootOptionsMethod.httpMethod,
+            integrationHttpMethod: 'POST',
+            type: 'AWS_PROXY',
+            uri: lambdaFunction.invokeArn,
+            timeoutMilliseconds: timeoutSeconds * 1000,
+        }, { parent: proxyRootOptionsMethod });
+        new lambda.Permission(`rest-api`, {
+            statementId: 'AllowRestApiInvoke',
+            action: 'lambda:InvokeFunction',
+            function: lambdaFunction.name,
+            principal: 'apigateway.amazonaws.com',
+            sourceArn: this.executionArn.apply((executionArn) => `${executionArn}/*`),
+        }, { parent: lambdaFunction });
+        const deployment = new apigateway.Deployment(stageName, { restApi: this.id }, {
+            dependsOn: [
+                proxyMethod,
+                lambdaIntegration,
+                lambdaIntegrationOptions,
+                proxyRootMethod,
+                lambdaRootIntegration,
+                lambdaRootIntegrationOptions,
+            ],
+            parent: this,
+        });
+        const stage = new apigateway.Stage(stageName, {
+            restApi: this.id,
+            stageName: stageName,
+            deployment: deployment.id,
+            tags: { project: projectId },
+        }, { parent: deployment });
+        const domainName = new DomainName('domain', {
+            domainName: domain.fullName,
+            certificateArn: domain.usEast1CertificateArn,
+        }, { parent: this });
+        new Record('redirect', {
+            zoneId: domain.zoneId,
+            name: domain.fullName,
+            type: 'A',
+            aliases: [
+                {
+                    zoneId: domainName.cloudfrontZoneId,
+                    name: domainName.cloudfrontDomainName,
+                    evaluateTargetHealth: true,
+                },
+            ],
+            allowOverwrite: true,
+        }, { parent: domainName });
+        new BasePathMapping('root', {
+            restApi: this.id,
+            stageName: stage.stageName,
+            domainName: domainName.domainName,
+        }, { parent: stage });
+        this.url = `https://${domain.fullName}/`;
+    }
+}

package/dist/rest/index.js

@@ -0,0 +1,5 @@
+import { RestApi } from './RestApi';
+export * from './RestApi';
+export const rest = {
+    RestApi,
+};

package/dist/s3/PublicS3Bucket.js

@@ -0,0 +1,48 @@
+import { Bucket, BucketAclV2, BucketCorsConfigurationV2, BucketOwnershipControls, BucketPolicy, BucketPublicAccessBlock, } from '@pulumi/aws/s3';
+export class PublicS3Bucket extends Bucket {
+    constructor(id, args, opts) {
+        const { name, allowPresignedPost = false, tags } = args;
+        super(id, { bucket: name, tags }, opts);
+        const accessBlock = new BucketPublicAccessBlock('public-access', {
+            bucket: this.id,
+            blockPublicAcls: false,
+            blockPublicPolicy: false,
+            ignorePublicAcls: false,
+            restrictPublicBuckets: false,
+        }, { parent: this });
+        const ownershipControls = new BucketOwnershipControls('ownership', {
+            bucket: this.id,
+            rule: { objectOwnership: 'BucketOwnerPreferred' },
+        }, { parent: this, dependsOn: [accessBlock] });
+        new BucketAclV2('acl', {
+            bucket: this.id,
+            acl: 'public-read',
+        }, { parent: this, dependsOn: [ownershipControls] });
+        new BucketPolicy('policy', {
+            bucket: this.id,
+            policy: this.arn.apply((arn) => JSON.stringify({
+                Version: '2012-10-17',
+                Statement: [
+                    {
+                        Sid: 'Allow Public Access',
+                        Effect: 'Allow',
+                        Principal: '*',
+                        Action: 's3:GetObject',
+                        Resource: `${arn}/*`,
+                    },
+                ],
+            })),
+        }, { parent: this, dependsOn: [accessBlock] });
+        new BucketCorsConfigurationV2('allowAll', {
+            bucket: this.bucket,
+            corsRules: [
+                {
+                    maxAgeSeconds: 3000,
+                    allowedMethods: allowPresignedPost ? ['GET', 'POST'] : ['GET'],
+                    allowedHeaders: ['*'],
+                    allowedOrigins: ['*'],
+                },
+            ],
+        }, { parent: this });
+    }
+}

package/dist/s3/index.js

@@ -0,0 +1,5 @@
+import { PublicS3Bucket } from './PublicS3Bucket';
+export * from './PublicS3Bucket';
+export const s3 = {
+    PublicS3Bucket,
+};

package/dist/website/StaticWebsite.js

@@ -0,0 +1,129 @@
+import { Resource } from '@pulumi/pulumi';
+import { s3 } from '../s3';
+import { BucketObject } from '@pulumi/aws/s3';
+import { Distribution } from '@pulumi/aws/cloudfront';
+import { Record } from '@pulumi/aws/route53';
+import { readFilesRecursive } from './readFilesRecursive.js';
+export class StaticWebsite extends Resource {
+    url;
+    bucket;
+    constructor(id, args, opts) {
+        super('mstuercke:website:StaticWebsite', id, false, undefined, opts);
+        const { projectId, environmentName, filesPath, customDomain } = args;
+        const bucket = new s3.PublicS3Bucket('bucket', {
+            name: `${projectId}-web-${environmentName}`,
+            allowPresignedPost: false,
+            tags: {
+                project: projectId,
+            },
+        }, { parent: this });
+        for (const file of readFilesRecursive(filesPath)) {
+            new BucketObject(file.relativePath, {
+                key: file.relativePath,
+                bucket: bucket.id,
+                source: file.absolutePath,
+                contentType: file.mimeType,
+                etag: file.md5,
+                tags: {
+                    project: projectId,
+                },
+            }, { parent: bucket });
+        }
+        const cloudfront = new Distribution(`website`, {
+            enabled: true,
+            comment: `${projectId} (${environmentName})`,
+            defaultRootObject: 'index.html',
+            origins: [
+                {
+                    domainName: bucket.bucketRegionalDomainName,
+                    originId: bucket.id,
+                },
+            ],
+            defaultCacheBehavior: {
+                allowedMethods: ['GET', 'HEAD', 'OPTIONS'],
+                cachedMethods: ['GET', 'HEAD'],
+                targetOriginId: bucket.id,
+                viewerProtocolPolicy: 'redirect-to-https',
+                forwardedValues: {
+                    queryString: false,
+                    cookies: {
+                        forward: 'none',
+                    },
+                },
+            },
+            orderedCacheBehaviors: [
+                {
+                    pathPattern: 'index.html',
+                    allowedMethods: ['GET', 'HEAD', 'OPTIONS'],
+                    cachedMethods: ['GET', 'HEAD'],
+                    targetOriginId: bucket.id,
+                    viewerProtocolPolicy: 'redirect-to-https',
+                    defaultTtl: 0,
+                    maxTtl: 0,
+                    forwardedValues: {
+                        queryString: false,
+                        cookies: {
+                            forward: 'none',
+                        },
+                    },
+                },
+                {
+                    pathPattern: 'config.json',
+                    allowedMethods: ['GET', 'HEAD', 'OPTIONS'],
+                    cachedMethods: ['GET', 'HEAD'],
+                    targetOriginId: bucket.id,
+                    viewerProtocolPolicy: 'redirect-to-https',
+                    defaultTtl: 0,
+                    maxTtl: 0,
+                    forwardedValues: {
+                        queryString: false,
+                        cookies: {
+                            forward: 'none',
+                        },
+                    },
+                },
+            ],
+            customErrorResponses: [
+                {
+                    errorCode: 404,
+                    responsePagePath: '/index.html',
+                    responseCode: 200,
+                    errorCachingMinTtl: 0,
+                },
+            ],
+            restrictions: {
+                geoRestriction: {
+                    restrictionType: 'none',
+                },
+            },
+            viewerCertificate: customDomain
+                ? {
+                    acmCertificateArn: customDomain?.usEast1CertificateArn,
+                    sslSupportMethod: 'sni-only',
+                    minimumProtocolVersion: 'TLSv1.2_2019',
+                }
+                : { cloudfrontDefaultCertificate: true },
+            aliases: customDomain ? [customDomain?.fullName] : undefined,
+            tags: {
+                project: projectId,
+            },
+        }, { parent: this });
+        if (customDomain) {
+            new Record('redirect', {
+                zoneId: customDomain?.zoneId,
+                name: customDomain?.fullName,
+                type: 'A',
+                allowOverwrite: true,
+                aliases: [
+                    {
+                        zoneId: cloudfront.hostedZoneId,
+                        name: cloudfront.domainName,
+                        evaluateTargetHealth: false,
+                    },
+                ],
+            }, { parent: this });
+        }
+        this.url = `https://${customDomain?.fullName || cloudfront.domainName}`;
+        this.bucket = bucket;
+    }
+}

package/dist/website/index.js

@@ -0,0 +1,5 @@
+import { StaticWebsite } from './StaticWebsite';
+export * from './StaticWebsite';
+export const website = {
+    StaticWebsite,
+};

package/dist/website/readFilesRecursive.js

@@ -0,0 +1,23 @@
+import { createHash } from 'crypto';
+import fs from 'fs';
+import mime from 'mime';
+import { globSync } from 'glob';
+export function readFilesRecursive(dir) {
+    const files = globSync(`${dir}/**/*`, { nodir: true });
+    return files.reduce((previousValue, fullPath) => {
+        const content = fs.readFileSync(fullPath, 'base64');
+        const md5 = createHash('md5').update(content, 'base64').digest('hex');
+        const mimeType = mime.getType(fullPath);
+        if (!mimeType)
+            throw `Cannot determine mimeType for ${fullPath}`;
+        return [
+            ...previousValue,
+            {
+                absolutePath: fullPath,
+                relativePath: fullPath.replace(`${dir}/`, '').replace(dir, ''),
+                md5,
+                mimeType,
+            },
+        ];
+    }, []);
+}

package/dist/websocket/WebsocketApi.js

@@ -0,0 +1,130 @@
+import { Resource } from '@pulumi/pulumi';
+import { Api, ApiMapping, Deployment, DomainName, Integration, IntegrationResponse, Route, Stage, } from '@pulumi/aws/apigatewayv2';
+import { Policy, Role } from '@pulumi/aws/iam';
+import { Record } from '@pulumi/aws/route53';
+export class WebsocketApi extends Resource {
+    id;
+    url;
+    constructor(id, args, opts) {
+        super('mstuercke:websocket:WebsocketApi', id, false, undefined, opts);
+        const { name, lambdaFunction, routeThrottling, stageName = 'v1', domain, projectId } = args;
+        const api = new Api('api', {
+            name,
+            protocolType: 'WEBSOCKET',
+            routeSelectionExpression: '\\$default',
+            tags: {
+                project: projectId,
+            },
+        }, { parent: this });
+        const executeLambdaPolicy = new Policy('execute-lambda', {
+            name: `${name}-execute-lambda`,
+            path: '/',
+            policy: {
+                Version: '2012-10-17',
+                Statement: [
+                    {
+                        Action: 'lambda:InvokeFunction',
+                        Effect: 'Allow',
+                        Resource: lambdaFunction.arn,
+                    },
+                ],
+            },
+            tags: {
+                project: projectId,
+            },
+        }, { parent: api });
+        const wsApiRole = new Role('role', {
+            name: `${name}-role`,
+            assumeRolePolicy: JSON.stringify({
+                Version: '2012-10-17',
+                Statement: [
+                    {
+                        Effect: 'Allow',
+                        Action: 'sts:AssumeRole',
+                        Principal: { Service: 'apigateway.amazonaws.com' },
+                    },
+                ],
+            }),
+            tags: {
+                project: projectId,
+            },
+            managedPolicyArns: [executeLambdaPolicy.arn],
+        }, { parent: api });
+        const wsLambdaIntegration = new Integration('lambda-integration', {
+            apiId: api.id,
+            integrationType: 'AWS_PROXY',
+            integrationUri: lambdaFunction.invokeArn,
+            credentialsArn: wsApiRole.arn,
+            contentHandlingStrategy: 'CONVERT_TO_TEXT',
+            passthroughBehavior: 'WHEN_NO_MATCH',
+        }, { parent: this });
+        new IntegrationResponse('lambda-integration-response', {
+            apiId: api.id,
+            integrationId: wsLambdaIntegration.id,
+            integrationResponseKey: '/200/',
+        }, { parent: wsLambdaIntegration });
+        const routes = [];
+        const routeKeys = ['$connect', '$default', '$disconnect'];
+        for (const routeKey of routeKeys) {
+            const route = new Route(`${routeKey}-route`, {
+                apiId: api.id,
+                routeKey: routeKey,
+                target: wsLambdaIntegration.id.apply((id) => `integrations/${id}`),
+                authorizationType: 'NONE',
+            }, { parent: wsLambdaIntegration });
+            routes.push(route);
+        }
+        const deployment = new Deployment('deployment', {
+            apiId: api.id,
+        }, {
+            dependsOn: [wsLambdaIntegration, ...routes],
+            parent: api,
+        });
+        const stage = new Stage('stage', {
+            apiId: api.id,
+            name: stageName,
+            deploymentId: deployment.id,
+            defaultRouteSettings: {
+                throttlingRateLimit: routeThrottling?.rateLimit ?? 100,
+                throttlingBurstLimit: routeThrottling?.burstLimit ?? 100,
+            },
+            tags: {
+                project: projectId,
+            },
+        }, { parent: deployment });
+        const domainName = new DomainName('domain', {
+            domainName: domain.fullName,
+            domainNameConfiguration: {
+                certificateArn: domain.euCentral1CertificateArn,
+                endpointType: 'REGIONAL',
+                securityPolicy: 'TLS_1_2',
+            },
+        }, { parent: api });
+        new Record('redirect', {
+            zoneId: domain.zoneId,
+            name: domain.fullName,
+            type: 'A',
+            aliases: [
+                {
+                    zoneId: domainName.domainNameConfiguration.hostedZoneId,
+                    name: domainName.domainNameConfiguration.targetDomainName,
+                    evaluateTargetHealth: true,
+                },
+            ],
+            allowOverwrite: true,
+        }, { parent: api });
+        new ApiMapping('root', {
+            apiId: api.id,
+            domainName: domainName.id,
+            stage: stage.name,
+        }, { parent: api });
+        new ApiMapping('stage', {
+            apiId: api.id,
+            domainName: domainName.id,
+            stage: stage.name,
+            apiMappingKey: stage.name,
+        }, { parent: api });
+        this.id = api.id;
+        this.url = `wss://${domain.fullName}/`;
+    }
+}

package/dist/websocket/index.js

@@ -0,0 +1,5 @@
+import { WebsocketApi } from './WebsocketApi';
+export * from './WebsocketApi';
+export const websocket = {
+    WebsocketApi,
+};

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@mstuercke/pulumi-modules",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "files": [
-    "dist/**/!(*.test|*.fixture).ts",
+    "dist/**/!(*.test|*.fixture){.d.ts,.js}",
     "README.md"
   ],
   "exports": "./dist/index.js",