@pipeline-builder/pipeline-core 0.0.1

package/lib/core/role.js

@@ -0,0 +1,117 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { Duration, Stack } from 'aws-cdk-lib';
+import { Effect, ManagedPolicy, OpenIdConnectPrincipal, OpenIdConnectProvider, PolicyStatement, Role, ServicePrincipal, } from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+import { UniqueId } from './id-generator.js';
+import { Config } from '../config/app-config.js';
+/**
+ * Resolve a RoleConfig into a CDK IRole.
+ * Uses discriminated union narrowing to delegate to the appropriate CDK lookup.
+ *
+ * @param scope - CDK construct scope
+ * @param id - UniqueId instance for generating unique construct IDs
+ * @param config - Role configuration to resolve
+ * @returns Resolved CDK IRole ready to pass to CodePipeline
+ */
+export function resolveRole(scope, id, config) {
+    switch (config.type) {
+        case 'roleArn':
+            return Role.fromRoleArn(scope, id.generate('role:arn'), config.options.roleArn, {
+                mutable: config.options.mutable,
+            });
+        case 'roleName':
+            return Role.fromRoleName(scope, id.generate('role:name'), config.options.roleName, {
+                mutable: config.options.mutable,
+            });
+        case 'codeBuildDefault':
+            return createCodeBuildDefaultRole(scope, id, config.options);
+        case 'oidc':
+            return createOidcRole(scope, id, config.options);
+        default: {
+            const _exhaustive = config;
+            throw new Error(`Unknown role config type: ${_exhaustive.type}`);
+        }
+    }
+}
+/**
+ * Creates a new IAM role with CodeBuild service principal and CloudWatch Logs permissions.
+ */
+function createCodeBuildDefaultRole(scope, id, options) {
+    const role = new Role(scope, id.generate('role:codebuild'), {
+        assumedBy: new ServicePrincipal('codebuild.amazonaws.com'),
+        ...(options.roleName && { roleName: options.roleName }),
+    });
+    const stack = Stack.of(scope);
+    const logGroupPrefix = Config.get('aws').logging.groupName;
+    // Derive ARN pattern from the configured log group name (strip trailing segment for wildcard)
+    const logGroupPattern = logGroupPrefix.replace(/\/[^/]*$/, '/*');
+    role.addToPolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: [
+            'logs:CreateLogGroup',
+            'logs:CreateLogStream',
+            'logs:PutLogEvents',
+        ],
+        resources: [
+            `arn:aws:logs:${stack.region}:${stack.account}:log-group:${logGroupPattern}:*`,
+        ],
+    }));
+    return role;
+}
+/**
+ * Creates a new IAM role with an OIDC federated trust principal.
+ *
+ * Supports either referencing an existing OIDC provider by ARN
+ * or creating a new one from issuer URL + client IDs.
+ */
+function createOidcRole(scope, id, options) {
+    if (options.providerArn && options.issuer) {
+        throw new Error('OIDC role config must specify either providerArn or issuer, not both');
+    }
+    let provider;
+    if (options.providerArn) {
+        provider = OpenIdConnectProvider.fromOpenIdConnectProviderArn(scope, id.generate('oidc:provider'), options.providerArn);
+    }
+    else if (options.issuer) {
+        provider = new OpenIdConnectProvider(scope, id.generate('oidc:provider'), {
+            url: options.issuer,
+            clientIds: options.clientIds ?? ['sts.amazonaws.com'],
+            thumbprints: options.thumbprints,
+        });
+    }
+    else {
+        throw new Error('OIDC role config requires either providerArn or issuer');
+    }
+    const principal = new OpenIdConnectPrincipal(provider, {
+        ...(options.conditions && { StringEquals: options.conditions }),
+        ...(options.conditionsLike && { StringLike: options.conditionsLike }),
+    });
+    const role = new Role(scope, id.generate('role:oidc'), {
+        assumedBy: principal,
+        ...(options.roleName && { roleName: options.roleName }),
+        ...(options.description && { description: options.description }),
+        ...(options.maxSessionDuration && {
+            maxSessionDuration: Duration.seconds(options.maxSessionDuration),
+        }),
+        ...(options.permissionsBoundaryArn && {
+            permissionsBoundary: ManagedPolicy.fromManagedPolicyArn(scope, id.generate('oidc:boundary'), options.permissionsBoundaryArn),
+        }),
+    });
+    if (options.managedPolicyArns) {
+        for (const arn of options.managedPolicyArns) {
+            role.addManagedPolicy(ManagedPolicy.fromManagedPolicyArn(scope, id.generate('oidc:policy'), arn));
+        }
+    }
+    if (options.policyStatements) {
+        for (const stmt of options.policyStatements) {
+            role.addToPolicy(new PolicyStatement({
+                effect: stmt.effect === 'Deny' ? Effect.DENY : Effect.ALLOW,
+                actions: stmt.actions,
+                resources: stmt.resources,
+            }));
+        }
+    }
+    return role;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb3JlL3JvbGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0NBQStDO0FBQy9DLHNDQUFzQztBQUV0QyxPQUFPLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEVBQ0wsTUFBTSxFQUdOLGFBQWEsRUFDYixzQkFBc0IsRUFDdEIscUJBQXFCLEVBQ3JCLGVBQWUsRUFDZixJQUFJLEVBQ0osZ0JBQWdCLEdBQ2pCLE1BQU0scUJBQXFCLENBQUM7QUFDN0IsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLFlBQVksQ0FBQztBQUN2QyxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFFN0MsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRWpEOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxVQUFVLFdBQVcsQ0FDekIsS0FBZ0IsRUFDaEIsRUFBWSxFQUNaLE1BQWtCO0lBRWxCLFFBQVEsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3BCLEtBQUssU0FBUztZQUNaLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRTtnQkFDOUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTzthQUNoQyxDQUFDLENBQUM7UUFDTCxLQUFLLFVBQVU7WUFDYixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUU7Z0JBQ2pGLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU87YUFDaEMsQ0FBQyxDQUFDO1FBQ0wsS0FBSyxrQkFBa0I7WUFDckIsT0FBTywwQkFBMEIsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUMvRCxLQUFLLE1BQU07WUFDVCxPQUFPLGNBQWMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNuRCxTQUFTLENBQUM7WUFDUixNQUFNLFdBQVcsR0FBVSxNQUFNLENBQUM7WUFDbEMsTUFBTSxJQUFJLEtBQUssQ0FBQyw2QkFBOEIsV0FBMEIsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ25GLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBUywwQkFBMEIsQ0FDakMsS0FBZ0IsRUFDaEIsRUFBWSxFQUNaLE9BQW9DO0lBRXBDLE1BQU0sSUFBSSxHQUFHLElBQUksSUFBSSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLGdCQUFnQixDQUFDLEVBQUU7UUFDMUQsU0FBUyxFQUFFLElBQUksZ0JBQWdCLENBQUMseUJBQXlCLENBQUM7UUFDMUQsR0FBRyxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVEsRUFBRSxDQUFDO0tBQ3hELENBQUMsQ0FBQztJQUVILE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDOUIsTUFBTSxjQUFjLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDO0lBQzNELDhGQUE4RjtJQUM5RixNQUFNLGVBQWUsR0FBRyxjQUFjLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUNqRSxJQUFJLENBQUMsV0FBVyxDQUNkLElBQUksZUFBZSxDQUFDO1FBQ2xCLE1BQU0sRUFBRSxNQUFNLENBQUMsS0FBSztRQUNwQixPQUFPLEVBQUU7WUFDUCxxQkFBcUI7WUFDckIsc0JBQXNCO1lBQ3RCLG1CQUFtQjtTQUNwQjtRQUNELFNBQVMsRUFBRTtZQUNULGdCQUFnQixLQUFLLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxPQUFPLGNBQWMsZUFBZSxJQUFJO1NBQy9FO0tBQ0YsQ0FBQyxDQUNILENBQUM7SUFFRixPQUFPLElBQUksQ0FBQztBQUNkLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILFNBQVMsY0FBYyxDQUNyQixLQUFnQixFQUNoQixFQUFZLEVBQ1osT0FBd0I7SUFFeEIsSUFBSSxPQUFPLENBQUMsV0FBVyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUMxQyxNQUFNLElBQUksS0FBSyxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDMUYsQ0FBQztJQUVELElBQUksUUFBZ0MsQ0FBQztJQUVyQyxJQUFJLE9BQU8sQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUN4QixRQUFRLEdBQUcscUJBQXFCLENBQUMsNEJBQTRCLENBQzNELEtBQUssRUFDTCxFQUFFLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUM1QixPQUFPLENBQUMsV0FBVyxDQUNwQixDQUFDO0lBQ0osQ0FBQztTQUFNLElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzFCLFFBQVEsR0FBRyxJQUFJLHFCQUFxQixDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFO1lBQ3hFLEdBQUcsRUFBRSxPQUFPLENBQUMsTUFBTTtZQUNuQixTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVMsSUFBSSxDQUFDLG1CQUFtQixDQUFDO1lBQ3JELFdBQVcsRUFBRSxPQUFPLENBQUMsV0FBVztTQUNqQyxDQUFDLENBQUM7SUFDTCxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sSUFBSSxLQUFLLENBQUMsd0RBQXdELENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBRUQsTUFBTSxTQUFTLEdBQUcsSUFBSSxzQkFBc0IsQ0FBQyxRQUFRLEVBQUU7UUFDckQsR0FBRyxDQUFDLE9BQU8sQ0FBQyxVQUFVLElBQUksRUFBRSxZQUFZLEVBQUUsT0FBTyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQy9ELEdBQUcsQ0FBQyxPQUFPLENBQUMsY0FBYyxJQUFJLEVBQUUsVUFBVSxFQUFFLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQztLQUN0RSxDQUFDLENBQUM7SUFFSCxNQUFNLElBQUksR0FBRyxJQUFJLElBQUksQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRTtRQUNyRCxTQUFTLEVBQUUsU0FBUztRQUNwQixHQUFHLENBQUMsT0FBTyxDQUFDLFFBQVEsSUFBSSxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDdkQsR0FBRyxDQUFDLE9BQU8sQ0FBQyxXQUFXLElBQUksRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ2hFLEdBQUcsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLElBQUk7WUFDaEMsa0JBQWtCLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUM7U0FDakUsQ0FBQztRQUNGLEdBQUcsQ0FBQyxPQUFPLENBQUMsc0JBQXNCLElBQUk7WUFDcEMsbUJBQW1CLEVBQUUsYUFBYSxDQUFDLG9CQUFvQixDQUNyRCxLQUFLLEVBQ0wsRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUMsRUFDNUIsT0FBTyxDQUFDLHNCQUFzQixDQUMvQjtTQUNGLENBQUM7S0FDSCxDQUFDLENBQUM7SUFFSCxJQUFJLE9BQU8sQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQzlCLEtBQUssTUFBTSxHQUFHLElBQUksT0FBTyxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDNUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxvQkFBb0IsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ3BHLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxPQUFPLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztRQUM3QixLQUFLLE1BQU0sSUFBSSxJQUFJLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQzVDLElBQUksQ0FBQyxXQUFXLENBQ2QsSUFBSSxlQUFlLENBQUM7Z0JBQ2xCLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUs7Z0JBQzNELE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztnQkFDckIsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO2FBQzFCLENBQUMsQ0FDSCxDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgRHVyYXRpb24sIFN0YWNrIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHtcbiAgRWZmZWN0LFxuICB0eXBlIElPcGVuSWRDb25uZWN0UHJvdmlkZXIsXG4gIHR5cGUgSVJvbGUsXG4gIE1hbmFnZWRQb2xpY3ksXG4gIE9wZW5JZENvbm5lY3RQcmluY2lwYWwsXG4gIE9wZW5JZENvbm5lY3RQcm92aWRlcixcbiAgUG9saWN5U3RhdGVtZW50LFxuICBSb2xlLFxuICBTZXJ2aWNlUHJpbmNpcGFsLFxufSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgVW5pcXVlSWQgfSBmcm9tICcuL2lkLWdlbmVyYXRvci5qcyc7XG5pbXBvcnQgdHlwZSB7IENvZGVCdWlsZERlZmF1bHRSb2xlT3B0aW9ucywgT2lkY1JvbGVPcHRpb25zLCBSb2xlQ29uZmlnIH0gZnJvbSAnLi9yb2xlLXR5cGVzLmpzJztcbmltcG9ydCB7IENvbmZpZyB9IGZyb20gJy4uL2NvbmZpZy9hcHAtY29uZmlnLmpzJztcblxuLyoqXG4gKiBSZXNvbHZlIGEgUm9sZUNvbmZpZyBpbnRvIGEgQ0RLIElSb2xlLlxuICogVXNlcyBkaXNjcmltaW5hdGVkIHVuaW9uIG5hcnJvd2luZyB0byBkZWxlZ2F0ZSB0byB0aGUgYXBwcm9wcmlhdGUgQ0RLIGxvb2t1cC5cbiAqXG4gKiBAcGFyYW0gc2NvcGUgLSBDREsgY29uc3RydWN0IHNjb3BlXG4gKiBAcGFyYW0gaWQgLSBVbmlxdWVJZCBpbnN0YW5jZSBmb3IgZ2VuZXJhdGluZyB1bmlxdWUgY29uc3RydWN0IElEc1xuICogQHBhcmFtIGNvbmZpZyAtIFJvbGUgY29uZmlndXJhdGlvbiB0byByZXNvbHZlXG4gKiBAcmV0dXJucyBSZXNvbHZlZCBDREsgSVJvbGUgcmVhZHkgdG8gcGFzcyB0byBDb2RlUGlwZWxpbmVcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHJlc29sdmVSb2xlKFxuICBzY29wZTogQ29uc3RydWN0LFxuICBpZDogVW5pcXVlSWQsXG4gIGNvbmZpZzogUm9sZUNvbmZpZyxcbik6IElSb2xlIHtcbiAgc3dpdGNoIChjb25maWcudHlwZSkge1xuICAgIGNhc2UgJ3JvbGVBcm4nOlxuICAgICAgcmV0dXJuIFJvbGUuZnJvbVJvbGVBcm4oc2NvcGUsIGlkLmdlbmVyYXRlKCdyb2xlOmFybicpLCBjb25maWcub3B0aW9ucy5yb2xlQXJuLCB7XG4gICAgICAgIG11dGFibGU6IGNvbmZpZy5vcHRpb25zLm11dGFibGUsXG4gICAgICB9KTtcbiAgICBjYXNlICdyb2xlTmFtZSc6XG4gICAgICByZXR1cm4gUm9sZS5mcm9tUm9sZU5hbWUoc2NvcGUsIGlkLmdlbmVyYXRlKCdyb2xlOm5hbWUnKSwgY29uZmlnLm9wdGlvbnMucm9sZU5hbWUsIHtcbiAgICAgICAgbXV0YWJsZTogY29uZmlnLm9wdGlvbnMubXV0YWJsZSxcbiAgICAgIH0pO1xuICAgIGNhc2UgJ2NvZGVCdWlsZERlZmF1bHQnOlxuICAgICAgcmV0dXJuIGNyZWF0ZUNvZGVCdWlsZERlZmF1bHRSb2xlKHNjb3BlLCBpZCwgY29uZmlnLm9wdGlvbnMpO1xuICAgIGNhc2UgJ29pZGMnOlxuICAgICAgcmV0dXJuIGNyZWF0ZU9pZGNSb2xlKHNjb3BlLCBpZCwgY29uZmlnLm9wdGlvbnMpO1xuICAgIGRlZmF1bHQ6IHtcbiAgICAgIGNvbnN0IF9leGhhdXN0aXZlOiBuZXZlciA9IGNvbmZpZztcbiAgICAgIHRocm93IG5ldyBFcnJvcihgVW5rbm93biByb2xlIGNvbmZpZyB0eXBlOiAkeyhfZXhoYXVzdGl2ZSBhcyBSb2xlQ29uZmlnKS50eXBlfWApO1xuICAgIH1cbiAgfVxufVxuXG4vKipcbiAqIENyZWF0ZXMgYSBuZXcgSUFNIHJvbGUgd2l0aCBDb2RlQnVpbGQgc2VydmljZSBwcmluY2lwYWwgYW5kIENsb3VkV2F0Y2ggTG9ncyBwZXJtaXNzaW9ucy5cbiAqL1xuZnVuY3Rpb24gY3JlYXRlQ29kZUJ1aWxkRGVmYXVsdFJvbGUoXG4gIHNjb3BlOiBDb25zdHJ1Y3QsXG4gIGlkOiBVbmlxdWVJZCxcbiAgb3B0aW9uczogQ29kZUJ1aWxkRGVmYXVsdFJvbGVPcHRpb25zLFxuKTogSVJvbGUge1xuICBjb25zdCByb2xlID0gbmV3IFJvbGUoc2NvcGUsIGlkLmdlbmVyYXRlKCdyb2xlOmNvZGVidWlsZCcpLCB7XG4gICAgYXNzdW1lZEJ5OiBuZXcgU2VydmljZVByaW5jaXBhbCgnY29kZWJ1aWxkLmFtYXpvbmF3cy5jb20nKSxcbiAgICAuLi4ob3B0aW9ucy5yb2xlTmFtZSAmJiB7IHJvbGVOYW1lOiBvcHRpb25zLnJvbGVOYW1lIH0pLFxuICB9KTtcblxuICBjb25zdCBzdGFjayA9IFN0YWNrLm9mKHNjb3BlKTtcbiAgY29uc3QgbG9nR3JvdXBQcmVmaXggPSBDb25maWcuZ2V0KCdhd3MnKS5sb2dnaW5nLmdyb3VwTmFtZTtcbiAgLy8gRGVyaXZlIEFSTiBwYXR0ZXJuIGZyb20gdGhlIGNvbmZpZ3VyZWQgbG9nIGdyb3VwIG5hbWUgKHN0cmlwIHRyYWlsaW5nIHNlZ21lbnQgZm9yIHdpbGRjYXJkKVxuICBjb25zdCBsb2dHcm91cFBhdHRlcm4gPSBsb2dHcm91cFByZWZpeC5yZXBsYWNlKC9cXC9bXi9dKiQvLCAnLyonKTtcbiAgcm9sZS5hZGRUb1BvbGljeShcbiAgICBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgIGVmZmVjdDogRWZmZWN0LkFMTE9XLFxuICAgICAgYWN0aW9uczogW1xuICAgICAgICAnbG9nczpDcmVhdGVMb2dHcm91cCcsXG4gICAgICAgICdsb2dzOkNyZWF0ZUxvZ1N0cmVhbScsXG4gICAgICAgICdsb2dzOlB1dExvZ0V2ZW50cycsXG4gICAgICBdLFxuICAgICAgcmVzb3VyY2VzOiBbXG4gICAgICAgIGBhcm46YXdzOmxvZ3M6JHtzdGFjay5yZWdpb259OiR7c3RhY2suYWNjb3VudH06bG9nLWdyb3VwOiR7bG9nR3JvdXBQYXR0ZXJufToqYCxcbiAgICAgIF0sXG4gICAgfSksXG4gICk7XG5cbiAgcmV0dXJuIHJvbGU7XG59XG5cbi8qKlxuICogQ3JlYXRlcyBhIG5ldyBJQU0gcm9sZSB3aXRoIGFuIE9JREMgZmVkZXJhdGVkIHRydXN0IHByaW5jaXBhbC5cbiAqXG4gKiBTdXBwb3J0cyBlaXRoZXIgcmVmZXJlbmNpbmcgYW4gZXhpc3RpbmcgT0lEQyBwcm92aWRlciBieSBBUk5cbiAqIG9yIGNyZWF0aW5nIGEgbmV3IG9uZSBmcm9tIGlzc3VlciBVUkwgKyBjbGllbnQgSURzLlxuICovXG5mdW5jdGlvbiBjcmVhdGVPaWRjUm9sZShcbiAgc2NvcGU6IENvbnN0cnVjdCxcbiAgaWQ6IFVuaXF1ZUlkLFxuICBvcHRpb25zOiBPaWRjUm9sZU9wdGlvbnMsXG4pOiBJUm9sZSB7XG4gIGlmIChvcHRpb25zLnByb3ZpZGVyQXJuICYmIG9wdGlvbnMuaXNzdWVyKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdPSURDIHJvbGUgY29uZmlnIG11c3Qgc3BlY2lmeSBlaXRoZXIgcHJvdmlkZXJBcm4gb3IgaXNzdWVyLCBub3QgYm90aCcpO1xuICB9XG5cbiAgbGV0IHByb3ZpZGVyOiBJT3BlbklkQ29ubmVjdFByb3ZpZGVyO1xuXG4gIGlmIChvcHRpb25zLnByb3ZpZGVyQXJuKSB7XG4gICAgcHJvdmlkZXIgPSBPcGVuSWRDb25uZWN0UHJvdmlkZXIuZnJvbU9wZW5JZENvbm5lY3RQcm92aWRlckFybihcbiAgICAgIHNjb3BlLFxuICAgICAgaWQuZ2VuZXJhdGUoJ29pZGM6cHJvdmlkZXInKSxcbiAgICAgIG9wdGlvbnMucHJvdmlkZXJBcm4sXG4gICAgKTtcbiAgfSBlbHNlIGlmIChvcHRpb25zLmlzc3Vlcikge1xuICAgIHByb3ZpZGVyID0gbmV3IE9wZW5JZENvbm5lY3RQcm92aWRlcihzY29wZSwgaWQuZ2VuZXJhdGUoJ29pZGM6cHJvdmlkZXInKSwge1xuICAgICAgdXJsOiBvcHRpb25zLmlzc3VlcixcbiAgICAgIGNsaWVudElkczogb3B0aW9ucy5jbGllbnRJZHMgPz8gWydzdHMuYW1hem9uYXdzLmNvbSddLFxuICAgICAgdGh1bWJwcmludHM6IG9wdGlvbnMudGh1bWJwcmludHMsXG4gICAgfSk7XG4gIH0gZWxzZSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKCdPSURDIHJvbGUgY29uZmlnIHJlcXVpcmVzIGVpdGhlciBwcm92aWRlckFybiBvciBpc3N1ZXInKTtcbiAgfVxuXG4gIGNvbnN0IHByaW5jaXBhbCA9IG5ldyBPcGVuSWRDb25uZWN0UHJpbmNpcGFsKHByb3ZpZGVyLCB7XG4gICAgLi4uKG9wdGlvbnMuY29uZGl0aW9ucyAmJiB7IFN0cmluZ0VxdWFsczogb3B0aW9ucy5jb25kaXRpb25zIH0pLFxuICAgIC4uLihvcHRpb25zLmNvbmRpdGlvbnNMaWtlICYmIHsgU3RyaW5nTGlrZTogb3B0aW9ucy5jb25kaXRpb25zTGlrZSB9KSxcbiAgfSk7XG5cbiAgY29uc3Qgcm9sZSA9IG5ldyBSb2xlKHNjb3BlLCBpZC5nZW5lcmF0ZSgncm9sZTpvaWRjJyksIHtcbiAgICBhc3N1bWVkQnk6IHByaW5jaXBhbCxcbiAgICAuLi4ob3B0aW9ucy5yb2xlTmFtZSAmJiB7IHJvbGVOYW1lOiBvcHRpb25zLnJvbGVOYW1lIH0pLFxuICAgIC4uLihvcHRpb25zLmRlc2NyaXB0aW9uICYmIHsgZGVzY3JpcHRpb246IG9wdGlvbnMuZGVzY3JpcHRpb24gfSksXG4gICAgLi4uKG9wdGlvbnMubWF4U2Vzc2lvbkR1cmF0aW9uICYmIHtcbiAgICAgIG1heFNlc3Npb25EdXJhdGlvbjogRHVyYXRpb24uc2Vjb25kcyhvcHRpb25zLm1heFNlc3Npb25EdXJhdGlvbiksXG4gICAgfSksXG4gICAgLi4uKG9wdGlvbnMucGVybWlzc2lvbnNCb3VuZGFyeUFybiAmJiB7XG4gICAgICBwZXJtaXNzaW9uc0JvdW5kYXJ5OiBNYW5hZ2VkUG9saWN5LmZyb21NYW5hZ2VkUG9saWN5QXJuKFxuICAgICAgICBzY29wZSxcbiAgICAgICAgaWQuZ2VuZXJhdGUoJ29pZGM6Ym91bmRhcnknKSxcbiAgICAgICAgb3B0aW9ucy5wZXJtaXNzaW9uc0JvdW5kYXJ5QXJuLFxuICAgICAgKSxcbiAgICB9KSxcbiAgfSk7XG5cbiAgaWYgKG9wdGlvbnMubWFuYWdlZFBvbGljeUFybnMpIHtcbiAgICBmb3IgKGNvbnN0IGFybiBvZiBvcHRpb25zLm1hbmFnZWRQb2xpY3lBcm5zKSB7XG4gICAgICByb2xlLmFkZE1hbmFnZWRQb2xpY3koTWFuYWdlZFBvbGljeS5mcm9tTWFuYWdlZFBvbGljeUFybihzY29wZSwgaWQuZ2VuZXJhdGUoJ29pZGM6cG9saWN5JyksIGFybikpO1xuICAgIH1cbiAgfVxuXG4gIGlmIChvcHRpb25zLnBvbGljeVN0YXRlbWVudHMpIHtcbiAgICBmb3IgKGNvbnN0IHN0bXQgb2Ygb3B0aW9ucy5wb2xpY3lTdGF0ZW1lbnRzKSB7XG4gICAgICByb2xlLmFkZFRvUG9saWN5KFxuICAgICAgICBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgICBlZmZlY3Q6IHN0bXQuZWZmZWN0ID09PSAnRGVueScgPyBFZmZlY3QuREVOWSA6IEVmZmVjdC5BTExPVyxcbiAgICAgICAgICBhY3Rpb25zOiBzdG10LmFjdGlvbnMsXG4gICAgICAgICAgcmVzb3VyY2VzOiBzdG10LnJlc291cmNlcyxcbiAgICAgICAgfSksXG4gICAgICApO1xuICAgIH1cbiAgfVxuXG4gIHJldHVybiByb2xlO1xufVxuIl19

package/lib/core/security-group-types.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Security group configuration using explicit security group IDs
+ *
+ * Looks up existing security groups by their IDs via `SecurityGroup.fromSecurityGroupId`.
+ *
+ * @example
+ * ```typescript
+ * const sg: SecurityGroupIdsConfig = {
+ *   type: 'securityGroupIds',
+ *   options: {
+ *     securityGroupIds: ['sg-12345678', 'sg-87654321'],
+ *   }
+ * };
+ * ```
+ */
+export interface SecurityGroupIdsConfig {
+    readonly type: 'securityGroupIds';
+    readonly options: SecurityGroupIdsOptions;
+}
+/**
+ * Security group configuration using name-based lookup
+ *
+ * Looks up an existing security group by name and VPC ID
+ * via `SecurityGroup.fromLookupByName`.
+ *
+ * @example
+ * ```typescript
+ * const sg: SecurityGroupLookupConfig = {
+ *   type: 'securityGroupLookup',
+ *   options: {
+ *     securityGroupName: 'my-codebuild-sg',
+ *     vpcId: 'vpc-0a1b2c3d4e5f6a7b8',
+ *   }
+ * };
+ * ```
+ */
+export interface SecurityGroupLookupConfig {
+    readonly type: 'securityGroupLookup';
+    readonly options: SecurityGroupLookupOptions;
+}
+/**
+ * Configuration options for security group lookup by IDs
+ */
+export interface SecurityGroupIdsOptions {
+    /**
+     * List of security group IDs
+     * @example ['sg-12345678', 'sg-87654321']
+     */
+    readonly securityGroupIds: string[];
+    /**
+     * Whether the imported security groups can be modified by attaching
+     * ingress/egress rules. Set to false to avoid additional API calls
+     * during synthesis.
+     * @default true
+     */
+    readonly mutable?: boolean;
+}
+/**
+ * Configuration options for security group lookup by name
+ */
+export interface SecurityGroupLookupOptions {
+    /**
+     * Name of the security group to look up
+     * @example 'my-codebuild-sg'
+     */
+    readonly securityGroupName: string;
+    /**
+     * VPC ID that contains the security group.
+     * Required for name-based lookup.
+     * @example 'vpc-0a1b2c3d4e5f6a7b8'
+     */
+    readonly vpcId: string;
+}
+/**
+ * Union type of all supported security group configurations.
+ *
+ * Used at the pipeline level (`CodeBuildDefaults.securityGroups`) to specify
+ * security groups for CodeBuild actions.
+ *
+ * Each variant resolves to CDK `ISecurityGroup[]`:
+ * - SecurityGroupIdsConfig: Security groups looked up by IDs
+ * - SecurityGroupLookupConfig: Security group looked up by name + VPC
+ */
+export type SecurityGroupConfig = SecurityGroupIdsConfig | SecurityGroupLookupConfig;

package/lib/core/security-group-types.js

@@ -0,0 +1,4 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjdXJpdHktZ3JvdXAtdHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29yZS9zZWN1cml0eS1ncm91cC10eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogU2VjdXJpdHkgZ3JvdXAgY29uZmlndXJhdGlvbiB1c2luZyBleHBsaWNpdCBzZWN1cml0eSBncm91cCBJRHNcbiAqXG4gKiBMb29rcyB1cCBleGlzdGluZyBzZWN1cml0eSBncm91cHMgYnkgdGhlaXIgSURzIHZpYSBgU2VjdXJpdHlHcm91cC5mcm9tU2VjdXJpdHlHcm91cElkYC5cbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3Qgc2c6IFNlY3VyaXR5R3JvdXBJZHNDb25maWcgPSB7XG4gKiAgIHR5cGU6ICdzZWN1cml0eUdyb3VwSWRzJyxcbiAqICAgb3B0aW9uczoge1xuICogICAgIHNlY3VyaXR5R3JvdXBJZHM6IFsnc2ctMTIzNDU2NzgnLCAnc2ctODc2NTQzMjEnXSxcbiAqICAgfVxuICogfTtcbiAqIGBgYFxuICovXG5leHBvcnQgaW50ZXJmYWNlIFNlY3VyaXR5R3JvdXBJZHNDb25maWcge1xuICByZWFkb25seSB0eXBlOiAnc2VjdXJpdHlHcm91cElkcyc7XG4gIHJlYWRvbmx5IG9wdGlvbnM6IFNlY3VyaXR5R3JvdXBJZHNPcHRpb25zO1xufVxuXG4vKipcbiAqIFNlY3VyaXR5IGdyb3VwIGNvbmZpZ3VyYXRpb24gdXNpbmcgbmFtZS1iYXNlZCBsb29rdXBcbiAqXG4gKiBMb29rcyB1cCBhbiBleGlzdGluZyBzZWN1cml0eSBncm91cCBieSBuYW1lIGFuZCBWUEMgSURcbiAqIHZpYSBgU2VjdXJpdHlHcm91cC5mcm9tTG9va3VwQnlOYW1lYC5cbiAqXG4gKiBAZXhhbXBsZVxuICogYGBgdHlwZXNjcmlwdFxuICogY29uc3Qgc2c6IFNlY3VyaXR5R3JvdXBMb29rdXBDb25maWcgPSB7XG4gKiAgIHR5cGU6ICdzZWN1cml0eUdyb3VwTG9va3VwJyxcbiAqICAgb3B0aW9uczoge1xuICogICAgIHNlY3VyaXR5R3JvdXBOYW1lOiAnbXktY29kZWJ1aWxkLXNnJyxcbiAqICAgICB2cGNJZDogJ3ZwYy0wYTFiMmMzZDRlNWY2YTdiOCcsXG4gKiAgIH1cbiAqIH07XG4gKiBgYGBcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTZWN1cml0eUdyb3VwTG9va3VwQ29uZmlnIHtcbiAgcmVhZG9ubHkgdHlwZTogJ3NlY3VyaXR5R3JvdXBMb29rdXAnO1xuICByZWFkb25seSBvcHRpb25zOiBTZWN1cml0eUdyb3VwTG9va3VwT3B0aW9ucztcbn1cblxuLyoqXG4gKiBDb25maWd1cmF0aW9uIG9wdGlvbnMgZm9yIHNlY3VyaXR5IGdyb3VwIGxvb2t1cCBieSBJRHNcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTZWN1cml0eUdyb3VwSWRzT3B0aW9ucyB7XG4gIC8qKlxuICAgKiBMaXN0IG9mIHNlY3VyaXR5IGdyb3VwIElEc1xuICAgKiBAZXhhbXBsZSBbJ3NnLTEyMzQ1Njc4JywgJ3NnLTg3NjU0MzIxJ11cbiAgICovXG4gIHJlYWRvbmx5IHNlY3VyaXR5R3JvdXBJZHM6IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBXaGV0aGVyIHRoZSBpbXBvcnRlZCBzZWN1cml0eSBncm91cHMgY2FuIGJlIG1vZGlmaWVkIGJ5IGF0dGFjaGluZ1xuICAgKiBpbmdyZXNzL2VncmVzcyBydWxlcy4gU2V0IHRvIGZhbHNlIHRvIGF2b2lkIGFkZGl0aW9uYWwgQVBJIGNhbGxzXG4gICAqIGR1cmluZyBzeW50aGVzaXMuXG4gICAqIEBkZWZhdWx0IHRydWVcbiAgICovXG4gIHJlYWRvbmx5IG11dGFibGU/OiBib29sZWFuO1xufVxuXG4vKipcbiAqIENvbmZpZ3VyYXRpb24gb3B0aW9ucyBmb3Igc2VjdXJpdHkgZ3JvdXAgbG9va3VwIGJ5IG5hbWVcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTZWN1cml0eUdyb3VwTG9va3VwT3B0aW9ucyB7XG4gIC8qKlxuICAgKiBOYW1lIG9mIHRoZSBzZWN1cml0eSBncm91cCB0byBsb29rIHVwXG4gICAqIEBleGFtcGxlICdteS1jb2RlYnVpbGQtc2cnXG4gICAqL1xuICByZWFkb25seSBzZWN1cml0eUdyb3VwTmFtZTogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBWUEMgSUQgdGhhdCBjb250YWlucyB0aGUgc2VjdXJpdHkgZ3JvdXAuXG4gICAqIFJlcXVpcmVkIGZvciBuYW1lLWJhc2VkIGxvb2t1cC5cbiAgICogQGV4YW1wbGUgJ3ZwYy0wYTFiMmMzZDRlNWY2YTdiOCdcbiAgICovXG4gIHJlYWRvbmx5IHZwY0lkOiBzdHJpbmc7XG59XG5cbi8qKlxuICogVW5pb24gdHlwZSBvZiBhbGwgc3VwcG9ydGVkIHNlY3VyaXR5IGdyb3VwIGNvbmZpZ3VyYXRpb25zLlxuICpcbiAqIFVzZWQgYXQgdGhlIHBpcGVsaW5lIGxldmVsIChgQ29kZUJ1aWxkRGVmYXVsdHMuc2VjdXJpdHlHcm91cHNgKSB0byBzcGVjaWZ5XG4gKiBzZWN1cml0eSBncm91cHMgZm9yIENvZGVCdWlsZCBhY3Rpb25zLlxuICpcbiAqIEVhY2ggdmFyaWFudCByZXNvbHZlcyB0byBDREsgYElTZWN1cml0eUdyb3VwW11gOlxuICogLSBTZWN1cml0eUdyb3VwSWRzQ29uZmlnOiBTZWN1cml0eSBncm91cHMgbG9va2VkIHVwIGJ5IElEc1xuICogLSBTZWN1cml0eUdyb3VwTG9va3VwQ29uZmlnOiBTZWN1cml0eSBncm91cCBsb29rZWQgdXAgYnkgbmFtZSArIFZQQ1xuICovXG5leHBvcnQgdHlwZSBTZWN1cml0eUdyb3VwQ29uZmlnID0gU2VjdXJpdHlHcm91cElkc0NvbmZpZyB8IFNlY3VyaXR5R3JvdXBMb29rdXBDb25maWc7XG4iXX0=

package/lib/core/security-group.d.ts

@@ -0,0 +1,14 @@
+import { type ISecurityGroup } from 'aws-cdk-lib/aws-ec2';
+import { Construct } from 'constructs';
+import { UniqueId } from './id-generator.js';
+import type { SecurityGroupConfig } from './security-group-types.js';
+/**
+ * Resolve a SecurityGroupConfig into CDK ISecurityGroup[].
+ * Uses discriminated union narrowing to delegate to the appropriate CDK lookup.
+ *
+ * @param scope - CDK construct scope
+ * @param id - UniqueId instance for generating unique construct IDs
+ * @param config - Security group configuration to resolve
+ * @returns Resolved CDK ISecurityGroup array
+ */
+export declare function resolveSecurityGroup(scope: Construct, id: UniqueId, config: SecurityGroupConfig): ISecurityGroup[];

package/lib/core/security-group.js

@@ -0,0 +1,33 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+import { SecurityGroup, Vpc } from 'aws-cdk-lib/aws-ec2';
+import { Construct } from 'constructs';
+import { UniqueId } from './id-generator.js';
+/**
+ * Resolve a SecurityGroupConfig into CDK ISecurityGroup[].
+ * Uses discriminated union narrowing to delegate to the appropriate CDK lookup.
+ *
+ * @param scope - CDK construct scope
+ * @param id - UniqueId instance for generating unique construct IDs
+ * @param config - Security group configuration to resolve
+ * @returns Resolved CDK ISecurityGroup array
+ */
+export function resolveSecurityGroup(scope, id, config) {
+    switch (config.type) {
+        case 'securityGroupIds':
+            return config.options.securityGroupIds.map((sgId) => SecurityGroup.fromSecurityGroupId(scope, id.generate('sg:id'), sgId, { mutable: config.options.mutable }));
+        case 'securityGroupLookup': {
+            const vpc = Vpc.fromLookup(scope, id.generate('sg:vpc'), {
+                vpcId: config.options.vpcId,
+            });
+            return [
+                SecurityGroup.fromLookupByName(scope, id.generate('sg:lookup'), config.options.securityGroupName, vpc),
+            ];
+        }
+        default: {
+            const _exhaustive = config;
+            throw new Error(`Unknown security group config type: ${_exhaustive.type}`);
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjdXJpdHktZ3JvdXAuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29yZS9zZWN1cml0eS1ncm91cC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDLE9BQU8sRUFBdUIsYUFBYSxFQUFFLEdBQUcsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQzlFLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSxZQUFZLENBQUM7QUFDdkMsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBRzdDOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxVQUFVLG9CQUFvQixDQUNsQyxLQUFnQixFQUNoQixFQUFZLEVBQ1osTUFBMkI7SUFFM0IsUUFBUSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDcEIsS0FBSyxrQkFBa0I7WUFDckIsT0FBTyxNQUFNLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FDeEMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLGFBQWEsQ0FBQyxtQkFBbUIsQ0FDekMsS0FBSyxFQUNMLEVBQUUsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQ3BCLElBQUksRUFDSixFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUNwQyxDQUNGLENBQUM7UUFDSixLQUFLLHFCQUFxQixFQUFFLENBQUM7WUFDM0IsTUFBTSxHQUFHLEdBQUcsR0FBRyxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRTtnQkFDdkQsS0FBSyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSzthQUM1QixDQUFDLENBQUM7WUFDSCxPQUFPO2dCQUNMLGFBQWEsQ0FBQyxnQkFBZ0IsQ0FDNUIsS0FBSyxFQUNMLEVBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQ3hCLE1BQU0sQ0FBQyxPQUFPLENBQUMsaUJBQWlCLEVBQ2hDLEdBQUcsQ0FDSjthQUNGLENBQUM7UUFDSixDQUFDO1FBQ0QsU0FBUyxDQUFDO1lBQ1IsTUFBTSxXQUFXLEdBQVUsTUFBTSxDQUFDO1lBQ2xDLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXdDLFdBQW1DLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN0RyxDQUFDO0lBQ0gsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuaW1wb3J0IHsgdHlwZSBJU2VjdXJpdHlHcm91cCwgU2VjdXJpdHlHcm91cCwgVnBjIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWVjMic7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IFVuaXF1ZUlkIH0gZnJvbSAnLi9pZC1nZW5lcmF0b3IuanMnO1xuaW1wb3J0IHR5cGUgeyBTZWN1cml0eUdyb3VwQ29uZmlnIH0gZnJvbSAnLi9zZWN1cml0eS1ncm91cC10eXBlcy5qcyc7XG5cbi8qKlxuICogUmVzb2x2ZSBhIFNlY3VyaXR5R3JvdXBDb25maWcgaW50byBDREsgSVNlY3VyaXR5R3JvdXBbXS5cbiAqIFVzZXMgZGlzY3JpbWluYXRlZCB1bmlvbiBuYXJyb3dpbmcgdG8gZGVsZWdhdGUgdG8gdGhlIGFwcHJvcHJpYXRlIENESyBsb29rdXAuXG4gKlxuICogQHBhcmFtIHNjb3BlIC0gQ0RLIGNvbnN0cnVjdCBzY29wZVxuICogQHBhcmFtIGlkIC0gVW5pcXVlSWQgaW5zdGFuY2UgZm9yIGdlbmVyYXRpbmcgdW5pcXVlIGNvbnN0cnVjdCBJRHNcbiAqIEBwYXJhbSBjb25maWcgLSBTZWN1cml0eSBncm91cCBjb25maWd1cmF0aW9uIHRvIHJlc29sdmVcbiAqIEByZXR1cm5zIFJlc29sdmVkIENESyBJU2VjdXJpdHlHcm91cCBhcnJheVxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVzb2x2ZVNlY3VyaXR5R3JvdXAoXG4gIHNjb3BlOiBDb25zdHJ1Y3QsXG4gIGlkOiBVbmlxdWVJZCxcbiAgY29uZmlnOiBTZWN1cml0eUdyb3VwQ29uZmlnLFxuKTogSVNlY3VyaXR5R3JvdXBbXSB7XG4gIHN3aXRjaCAoY29uZmlnLnR5cGUpIHtcbiAgICBjYXNlICdzZWN1cml0eUdyb3VwSWRzJzpcbiAgICAgIHJldHVybiBjb25maWcub3B0aW9ucy5zZWN1cml0eUdyb3VwSWRzLm1hcChcbiAgICAgICAgKHNnSWQpID0+IFNlY3VyaXR5R3JvdXAuZnJvbVNlY3VyaXR5R3JvdXBJZChcbiAgICAgICAgICBzY29wZSxcbiAgICAgICAgICBpZC5nZW5lcmF0ZSgnc2c6aWQnKSxcbiAgICAgICAgICBzZ0lkLFxuICAgICAgICAgIHsgbXV0YWJsZTogY29uZmlnLm9wdGlvbnMubXV0YWJsZSB9LFxuICAgICAgICApLFxuICAgICAgKTtcbiAgICBjYXNlICdzZWN1cml0eUdyb3VwTG9va3VwJzoge1xuICAgICAgY29uc3QgdnBjID0gVnBjLmZyb21Mb29rdXAoc2NvcGUsIGlkLmdlbmVyYXRlKCdzZzp2cGMnKSwge1xuICAgICAgICB2cGNJZDogY29uZmlnLm9wdGlvbnMudnBjSWQsXG4gICAgICB9KTtcbiAgICAgIHJldHVybiBbXG4gICAgICAgIFNlY3VyaXR5R3JvdXAuZnJvbUxvb2t1cEJ5TmFtZShcbiAgICAgICAgICBzY29wZSxcbiAgICAgICAgICBpZC5nZW5lcmF0ZSgnc2c6bG9va3VwJyksXG4gICAgICAgICAgY29uZmlnLm9wdGlvbnMuc2VjdXJpdHlHcm91cE5hbWUsXG4gICAgICAgICAgdnBjLFxuICAgICAgICApLFxuICAgICAgXTtcbiAgICB9XG4gICAgZGVmYXVsdDoge1xuICAgICAgY29uc3QgX2V4aGF1c3RpdmU6IG5ldmVyID0gY29uZmlnO1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBVbmtub3duIHNlY3VyaXR5IGdyb3VwIGNvbmZpZyB0eXBlOiAkeyhfZXhoYXVzdGl2ZSBhcyBTZWN1cml0eUdyb3VwQ29uZmlnKS50eXBlfWApO1xuICAgIH1cbiAgfVxufVxuIl19

package/lib/handlers/plugin-lookup-handler.d.ts

@@ -0,0 +1,32 @@
+import type { CloudFormationCustomResourceEvent, CloudFormationCustomResourceResponse } from 'aws-lambda';
+/**
+ * Lambda handler for CloudFormation Custom Resource that performs plugin lookup.
+ *
+ * Authenticates using JWT token from AWS Secrets Manager (PLATFORM_SECRET_NAME env var).
+ * Create the secret with: `pipeline-manager infra store-token`
+ *
+ * Request Types:
+ * - Create/Update: fetches and returns plugin configuration from API
+ * - Delete: no-op (always succeeds)
+ *
+ * Response:
+ * - Success: Returns base64-encoded plugin JSON in Data.ResultValue
+ * - Failure: Returns error message in Reason
+ *
+ * @param event - CloudFormation custom resource event
+ * @returns CloudFormation response
+ *
+ * @example
+ * Custom Resource Properties:
+ * ```json
+ * {
+ *   "baseURL": "https://api.example.com",
+ *   "pluginFilter": {
+ *     "name": "nodejs-build",
+ *     "version": "1.0.0",
+ *     "isActive": true
+ *   }
+ * }
+ * ```
+ */
+export declare const handler: (event: CloudFormationCustomResourceEvent) => Promise<CloudFormationCustomResourceResponse>;