@pwrdrvr/microapps-cdk 0.0.24 → 0.0.28

package/.jsii

@@ -1281,7 +1281,7 @@
         },
         "locationInModule": {
           "filename": "src/MicroApps.ts",
-          "line": 133
+          "line": 188
         },
         "parameters": [
           {
@@ -1308,7 +1308,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/MicroApps.ts",
-        "line": 123
+        "line": 178
       },
       "name": "MicroApps"
     },
@@ -1337,7 +1337,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 95
+            "line": 150
           },
           "name": "account",
           "type": {
@@ -1437,7 +1437,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 110
+            "line": 165
           },
           "name": "domainNameEdge",
           "type": {
@@ -1454,7 +1454,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 117
+            "line": 172
           },
           "name": "domainNameOrigin",
           "type": {
@@ -1504,7 +1504,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 103
+            "line": 158
           },
           "name": "region",
           "type": {
@@ -1514,17 +1514,17 @@
         {
           "abstract": true,
           "docs": {
-            "example": "AROA1234567890123",
-            "remarks": "This allows sessions that assume the IAM Role to be excluded from the\nDENY rules on the S3 Bucket Policy.",
+            "default": "- none",
             "stability": "stable",
-            "summary": "AROA of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy."
+            "summary": "Suffix to add to asset names, such as -[env]-pr-[prNum]."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 87
+            "line": 38
           },
-          "name": "s3PolicyBypassAROA",
+          "name": "assetNameSuffix",
+          "optional": true,
           "type": {
             "primitive": "string"
           }
@@ -1532,51 +1532,85 @@
         {
           "abstract": true,
           "docs": {
-            "default": "AdminAccess",
+            "default": "false",
             "stability": "stable",
-            "summary": "IAM Role name to exclude from the DENY rules on the S3 Bucket Policy."
+            "summary": "Automatically destroy all assets when stack is deleted."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 78
+            "line": 17
           },
-          "name": "s3PolicyBypassRoleName",
+          "name": "autoDeleteEverything",
+          "optional": true,
           "type": {
-            "primitive": "string"
+            "primitive": "boolean"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "default": "- none",
+            "example": "[ 'AROA1234567890123' ]",
+            "remarks": "AROAs of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy.\nThis allows sessions that assume the IAM Role to be excluded from the\nDENY rules on the S3 Bucket Policy.\n\nTypically any admin roles / users that need to view or manage the S3 Bucket\nwould be added to this list.\n\nRoles / users that are used directly, not assumed, can be added to `s3PolicyBypassRoleNames` instead.\n\nNote: This AROA must be specified to prevent this policy from locking\nout non-root sessions that have assumed the admin role.\n\nThe notPrincipals will only match the role name exactly and will not match\nany session that has assumed the role since notPrincipals does not allow\nwildcard matches and does not do wildcard matches implicitly either.\n\nThe AROA must be used because there are only 3 Principal variables available:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable\n  aws:username, aws:userid, aws:PrincipalTag\n\nFor an assumed role, aws:username is blank, aws:userid is:\n  [unique id AKA AROA for Role]:[session name]\n\nTable of unique ID prefixes such as AROA:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes\n\nThe name of the role is simply not available for an assumed role and, if it was,\na complicated comparison would be requierd to prevent exclusion\nof applying the Deny Rule to roles from other accounts.\n\nTo get the AROA with the AWS CLI:\n   aws iam get-role --role-name ROLE-NAME\n   aws iam get-user -–user-name USER-NAME",
+            "see": "s3StrictBucketPolicy",
             "stability": "stable",
-            "summary": "Suffix to add to asset names, such as -[env]-pr-[prNum]."
+            "summary": "Applies when using s3StrictBucketPolicy = true."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 38
+            "line": 142
           },
-          "name": "assetNameSuffix",
+          "name": "s3PolicyBypassAROAs",
           "optional": true,
           "type": {
-            "primitive": "string"
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "example": "['arn:aws:iam::1234567890123:role/AdminAccess', 'arn:aws:iam::1234567890123:user/MyAdminUser']",
+            "remarks": "IAM Role or IAM User names to exclude from the DENY rules on the S3 Bucket Policy.\n\nRoles that are Assumed must instead have their AROA added to `s3PolicyBypassAROAs`.\n\nTypically any admin roles / users that need to view or manage the S3 Bucket\nwould be added to this list.",
+            "see": "s3PolicyBypassAROAs",
+            "stability": "stable",
+            "summary": "Applies when using s3StrictBucketPolicy = true."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroApps.ts",
+            "line": 99
+          },
+          "name": "s3PolicyBypassPrincipalARNs",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
           }
         },
         {
           "abstract": true,
           "docs": {
             "default": "false",
+            "remarks": "This setting should be used when applications are less than\nfully trusted.",
             "stability": "stable",
-            "summary": "Automatically destroy all assets when stack is deleted."
+            "summary": "Use a strict S3 Bucket Policy that prevents applications from reading/writing/modifying/deleting files in the S3 Bucket outside of the path that is specific to their app/version."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 17
+            "line": 83
           },
-          "name": "autoDeleteEverything",
+          "name": "s3StrictBucketPolicy",
           "optional": true,
           "type": {
             "primitive": "boolean"
@@ -1585,6 +1619,6 @@
       ]
     }
   },
-  "version": "0.0.24",
-  "fingerprint": "e6LDGiAjF4Gfy51zxiHZsZaft99IdeBGzU2Ap6yP4v8="
+  "version": "0.0.28",
+  "fingerprint": "pN31x9a1Ge6xzfe9ibawLdds8o7PqA7OvCumMeTj+74="
 }

package/API.md

@@ -142,41 +142,94 @@ AWS Region that the stack is being deployed to, this is required for importing t
 
 ---
 
-##### `s3PolicyBypassAROA`<sup>Required</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.s3PolicyBypassAROA"></a>
+##### `assetNameSuffix`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.assetNameSuffix"></a>
 
 - *Type:* `string`
+- *Default:* none
+
+Suffix to add to asset names, such as -[env]-pr-[prNum].
+
+---
+
+##### `autoDeleteEverything`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.autoDeleteEverything"></a>
+
+- *Type:* `boolean`
+- *Default:* false
 
-AROA of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy.
+Automatically destroy all assets when stack is deleted.
+
+---
 
+##### `s3PolicyBypassAROAs`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.s3PolicyBypassAROAs"></a>
+
+- *Type:* `string`[]
+
+Applies when using s3StrictBucketPolicy = true.
+
+AROAs of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy.
 This allows sessions that assume the IAM Role to be excluded from the
 DENY rules on the S3 Bucket Policy.
 
----
+Typically any admin roles / users that need to view or manage the S3 Bucket
+would be added to this list.
 
-##### `s3PolicyBypassRoleName`<sup>Required</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.s3PolicyBypassRoleName"></a>
+Roles / users that are used directly, not assumed, can be added to `s3PolicyBypassRoleNames` instead.
 
-- *Type:* `string`
-- *Default:* AdminAccess
+Note: This AROA must be specified to prevent this policy from locking
+out non-root sessions that have assumed the admin role.
+
+The notPrincipals will only match the role name exactly and will not match
+any session that has assumed the role since notPrincipals does not allow
+wildcard matches and does not do wildcard matches implicitly either.
+
+The AROA must be used because there are only 3 Principal variables available:
+  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable
+  aws:username, aws:userid, aws:PrincipalTag
+
+For an assumed role, aws:username is blank, aws:userid is:
+  [unique id AKA AROA for Role]:[session name]
+
+Table of unique ID prefixes such as AROA:
+  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes
 
-IAM Role name to exclude from the DENY rules on the S3 Bucket Policy.
+The name of the role is simply not available for an assumed role and, if it was,
+a complicated comparison would be requierd to prevent exclusion
+of applying the Deny Rule to roles from other accounts.
+
+To get the AROA with the AWS CLI:
+   aws iam get-role --role-name ROLE-NAME
+   aws iam get-user -–user-name USER-NAME
+
+> s3StrictBucketPolicy
 
 ---
 
-##### `assetNameSuffix`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.assetNameSuffix"></a>
+##### `s3PolicyBypassPrincipalARNs`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.s3PolicyBypassPrincipalARNs"></a>
 
-- *Type:* `string`
-- *Default:* none
+- *Type:* `string`[]
 
-Suffix to add to asset names, such as -[env]-pr-[prNum].
+Applies when using s3StrictBucketPolicy = true.
+
+IAM Role or IAM User names to exclude from the DENY rules on the S3 Bucket Policy.
+
+Roles that are Assumed must instead have their AROA added to `s3PolicyBypassAROAs`.
+
+Typically any admin roles / users that need to view or manage the S3 Bucket
+would be added to this list.
+
+> s3PolicyBypassAROAs
 
 ---
 
-##### `autoDeleteEverything`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.autoDeleteEverything"></a>
+##### `s3StrictBucketPolicy`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.s3StrictBucketPolicy"></a>
 
 - *Type:* `boolean`
 - *Default:* false
 
-Automatically destroy all assets when stack is deleted.
+Use a strict S3 Bucket Policy that prevents applications from reading/writing/modifying/deleting files in the S3 Bucket outside of the path that is specific to their app/version.
+
+This setting should be used when applications are less than
+fully trusted.
 
 ---
 

package/lib/MicroApps.d.ts

@@ -70,24 +70,76 @@ export interface MicroAppsProps {
      */
     readonly certOrigin: acm.ICertificate;
     /**
-     * IAM Role name to exclude from the DENY rules on the S3 Bucket Policy.
+     * Use a strict S3 Bucket Policy that prevents applications from reading/writing/modifying/deleting files in the S3 Bucket outside of the path that is specific to their app/version.
      *
-     * @default AdminAccess
+     * This setting should be used when applications are less than
+     * fully trusted.
+     *
+     * @default false
+     * @stability stable
+     */
+    readonly s3StrictBucketPolicy?: boolean;
+    /**
+     * Applies when using s3StrictBucketPolicy = true.
+     *
+     * IAM Role or IAM User names to exclude from the DENY rules on the S3 Bucket Policy.
+     *
+     * Roles that are Assumed must instead have their AROA added to `s3PolicyBypassAROAs`.
+     *
+     * Typically any admin roles / users that need to view or manage the S3 Bucket
+     * would be added to this list.
+     *
+     * @see s3PolicyBypassAROAs
      * @stability stable
+     * @example
+     *
+     * ['arn:aws:iam::1234567890123:role/AdminAccess', 'arn:aws:iam::1234567890123:user/MyAdminUser']
      */
-    readonly s3PolicyBypassRoleName: string;
+    readonly s3PolicyBypassPrincipalARNs?: string[];
     /**
-     * AROA of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy.
+     * Applies when using s3StrictBucketPolicy = true.
      *
+     * AROAs of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy.
      * This allows sessions that assume the IAM Role to be excluded from the
      * DENY rules on the S3 Bucket Policy.
      *
+     * Typically any admin roles / users that need to view or manage the S3 Bucket
+     * would be added to this list.
+     *
+     * Roles / users that are used directly, not assumed, can be added to `s3PolicyBypassRoleNames` instead.
+     *
+     * Note: This AROA must be specified to prevent this policy from locking
+     * out non-root sessions that have assumed the admin role.
+     *
+     * The notPrincipals will only match the role name exactly and will not match
+     * any session that has assumed the role since notPrincipals does not allow
+     * wildcard matches and does not do wildcard matches implicitly either.
+     *
+     * The AROA must be used because there are only 3 Principal variables available:
+     *   https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable
+     *   aws:username, aws:userid, aws:PrincipalTag
+     *
+     * For an assumed role, aws:username is blank, aws:userid is:
+     *   [unique id AKA AROA for Role]:[session name]
+     *
+     * Table of unique ID prefixes such as AROA:
+     *   https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes
+     *
+     * The name of the role is simply not available for an assumed role and, if it was,
+     * a complicated comparison would be requierd to prevent exclusion
+     * of applying the Deny Rule to roles from other accounts.
+     *
+     * To get the AROA with the AWS CLI:
+     *    aws iam get-role --role-name ROLE-NAME
+     *    aws iam get-user -–user-name USER-NAME
+     *
+     * @see s3StrictBucketPolicy
      * @stability stable
      * @example
      *
-     * AROA1234567890123
+     * [ 'AROA1234567890123' ]
      */
-    readonly s3PolicyBypassAROA: string;
+    readonly s3PolicyBypassAROAs?: string[];
     /**
      * AWS Account ID that the stack is being deployed to, this is required for importing the R53 Zone.
      *

package/lib/MicroApps.js

@@ -21,7 +21,7 @@ class MicroApps extends cdk.Construct {
         if (props === undefined) {
             throw new Error('props must be set');
         }
-        const { domainName, domainNameEdge, domainNameOrigin, assetNameRoot = 'microapps', assetNameSuffix = '', autoDeleteEverything = false, r53ZoneID, r53ZoneName, certEdge, account, region, appEnv = 'dev', certOrigin, s3PolicyBypassAROA, s3PolicyBypassRoleName = 'AdminAccess', } = props;
+        const { domainName, domainNameEdge, domainNameOrigin, assetNameRoot = 'microapps', assetNameSuffix = '', autoDeleteEverything = false, r53ZoneID, r53ZoneName, certEdge, account, region, appEnv = 'dev', certOrigin, s3PolicyBypassAROAs, s3PolicyBypassPrincipalARNs, s3StrictBucketPolicy, } = props;
         const reverseDomainName = MicroApps.reverseDomain(domainName);
         const s3 = new MicroAppsS3_1.MicroAppsS3(this, 'microapps-s3', {
             autoDeleteEverything,
@@ -58,8 +58,9 @@ class MicroApps extends cdk.Construct {
             region,
             appEnv,
             certOrigin,
-            s3PolicyBypassAROA,
-            s3PolicyBypassRoleName,
+            s3PolicyBypassAROAs,
+            s3PolicyBypassPrincipalARNs,
+            s3StrictBucketPolicy,
         });
     }
     // input like 'example.com.' will return as 'com.example'
@@ -73,5 +74,5 @@ class MicroApps extends cdk.Construct {
 }
 exports.MicroApps = MicroApps;
 _a = JSII_RTTI_SYMBOL_1;
-MicroApps[_a] = { fqn: "@pwrdrvr/microapps-cdk.MicroApps", version: "0.0.24" };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiTWljcm9BcHBzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL01pY3JvQXBwcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUNBLHFDQUFxQztBQUNyQywrQ0FBNEM7QUFDNUMsK0NBQTRDO0FBQzVDLG1EQUFnRDs7Ozs7O0FBbURoRCxNQUFhLFNBQVUsU0FBUSxHQUFHLENBQUMsU0FBUzs7OztJQVUxQyxZQUFZLEtBQW9CLEVBQUUsRUFBVSxFQUFFLEtBQXNCO1FBQ2xFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsbUJBQW1CLENBQUMsQ0FBQztTQUN0QztRQUVELE1BQU0sRUFDSixVQUFVLEVBQ1YsY0FBYyxFQUNkLGdCQUFnQixFQUNoQixhQUFhLEdBQUcsV0FBVyxFQUMzQixlQUFlLEdBQUcsRUFBRSxFQUNwQixvQkFBb0IsR0FBRyxLQUFLLEVBQzVCLFNBQVMsRUFDVCxXQUFXLEVBQ1gsUUFBUSxFQUNSLE9BQU8sRUFDUCxNQUFNLEVBQ04sTUFBTSxHQUFHLEtBQUssRUFDZCxVQUFVLEVBQ1Ysa0JBQWtCLEVBQ2xCLHNCQUFzQixHQUFHLGFBQWEsR0FDdkMsR0FBRyxLQUFLLENBQUM7UUFDVixNQUFNLGlCQUFpQixHQUFHLFNBQVMsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLENBQUM7UUFFOUQsTUFBTSxFQUFFLEdBQUcsSUFBSSx5QkFBVyxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUU7WUFDL0Msb0JBQW9CO1lBQ3BCLGlCQUFpQjtZQUNqQixhQUFhO1lBQ2IsZUFBZTtTQUNoQixDQUFDLENBQUM7UUFDSCxNQUFNLEVBQUUsR0FBRyxJQUFJLHlCQUFXLENBQUMsSUFBSSxFQUFFLHNCQUFzQixFQUFFO1lBQ3ZELFNBQVMsRUFBRSxFQUFFO1lBQ2IsYUFBYTtZQUNiLGVBQWU7WUFDZixVQUFVO1lBQ1YsaUJBQWlCO1lBQ2pCLGNBQWM7WUFDZCxnQkFBZ0I7WUFDaEIsb0JBQW9CO1lBQ3BCLFNBQVM7WUFDVCxXQUFXO1lBQ1gsUUFBUTtTQUNULENBQUMsQ0FBQztRQUNILElBQUksNkJBQWEsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUU7WUFDeEMsY0FBYyxFQUFFLEVBQUU7WUFDbEIsU0FBUyxFQUFFLEVBQUU7WUFDYixhQUFhO1lBQ2IsZUFBZTtZQUNmLFVBQVU7WUFDVixpQkFBaUI7WUFDakIsY0FBYztZQUNkLGdCQUFnQjtZQUNoQixvQkFBb0I7WUFDcEIsU0FBUztZQUNULFdBQVc7WUFDWCxPQUFPO1lBQ1AsTUFBTTtZQUNOLE1BQU07WUFDTixVQUFVO1lBQ1Ysa0JBQWtCO1lBQ2xCLHNCQUFzQjtTQUN2QixDQUFDLENBQUM7SUFDTCxDQUFDO0lBekVELHlEQUF5RDtJQUNqRCxNQUFNLENBQUMsYUFBYSxDQUFDLE1BQWM7UUFDekMsSUFBSSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUN4QyxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDbkIsS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7U0FDeEI7UUFDRCxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDekIsQ0FBQzs7QUFSSCw4QkEyRUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBhY20gZnJvbSAnQGF3cy1jZGsvYXdzLWNlcnRpZmljYXRlbWFuYWdlcic7XG5pbXBvcnQgKiBhcyBjZGsgZnJvbSAnQGF3cy1jZGsvY29yZSc7XG5pbXBvcnQgeyBNaWNyb0FwcHNDRiB9IGZyb20gJy4vTWljcm9BcHBzQ0YnO1xuaW1wb3J0IHsgTWljcm9BcHBzUzMgfSBmcm9tICcuL01pY3JvQXBwc1MzJztcbmltcG9ydCB7IE1pY3JvQXBwc1N2Y3MgfSBmcm9tICcuL01pY3JvQXBwc1N2Y3MnO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbmV4cG9ydCBpbnRlcmZhY2UgTWljcm9BcHBzUHJvcHMge1xuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IGF1dG9EZWxldGVFdmVyeXRoaW5nPzogYm9vbGVhbjtcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IGFwcEVudjogc3RyaW5nO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IGFzc2V0TmFtZVJvb3Q6IHN0cmluZztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgYXNzZXROYW1lU3VmZml4Pzogc3RyaW5nO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSBkb21haW5OYW1lOiBzdHJpbmc7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSByNTNab25lTmFtZTogc3RyaW5nO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSByNTNab25lSUQ6IHN0cmluZztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSBjZXJ0RWRnZTogYWNtLklDZXJ0aWZpY2F0ZTtcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSBjZXJ0T3JpZ2luOiBhY20uSUNlcnRpZmljYXRlO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgczNQb2xpY3lCeXBhc3NSb2xlTmFtZTogc3RyaW5nO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgczNQb2xpY3lCeXBhc3NBUk9BOiBzdHJpbmc7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSBhY2NvdW50OiBzdHJpbmc7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IHJlZ2lvbjogc3RyaW5nO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IGRvbWFpbk5hbWVFZGdlOiBzdHJpbmc7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgZG9tYWluTmFtZU9yaWdpbjogc3RyaW5nO1xufVxuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG5leHBvcnQgY2xhc3MgTWljcm9BcHBzIGV4dGVuZHMgY2RrLkNvbnN0cnVjdCB7XG4gIC8vIGlucHV0IGxpa2UgJ2V4YW1wbGUuY29tLicgd2lsbCByZXR1cm4gYXMgJ2NvbS5leGFtcGxlJ1xuICBwcml2YXRlIHN0YXRpYyByZXZlcnNlRG9tYWluKGRvbWFpbjogc3RyaW5nKTogc3RyaW5nIHtcbiAgICBsZXQgcGFydHMgPSBkb21haW4uc3BsaXQoJy4nKS5yZXZlcnNlKCk7XG4gICAgaWYgKHBhcnRzWzBdID09PSAnJykge1xuICAgICAgcGFydHMgPSBwYXJ0cy5zbGljZSgxKTtcbiAgICB9XG4gICAgcmV0dXJuIHBhcnRzLmpvaW4oJy4nKTtcbiAgfVxuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBjZGsuQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wcz86IE1pY3JvQXBwc1Byb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGlmIChwcm9wcyA9PT0gdW5kZWZpbmVkKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ3Byb3BzIG11c3QgYmUgc2V0Jyk7XG4gICAgfVxuXG4gICAgY29uc3Qge1xuICAgICAgZG9tYWluTmFtZSxcbiAgICAgIGRvbWFpbk5hbWVFZGdlLFxuICAgICAgZG9tYWluTmFtZU9yaWdpbixcbiAgICAgIGFzc2V0TmFtZVJvb3QgPSAnbWljcm9hcHBzJyxcbiAgICAgIGFzc2V0TmFtZVN1ZmZpeCA9ICcnLFxuICAgICAgYXV0b0RlbGV0ZUV2ZXJ5dGhpbmcgPSBmYWxzZSxcbiAgICAgIHI1M1pvbmVJRCxcbiAgICAgIHI1M1pvbmVOYW1lLFxuICAgICAgY2VydEVkZ2UsXG4gICAgICBhY2NvdW50LFxuICAgICAgcmVnaW9uLFxuICAgICAgYXBwRW52ID0gJ2RldicsXG4gICAgICBjZXJ0T3JpZ2luLFxuICAgICAgczNQb2xpY3lCeXBhc3NBUk9BLFxuICAgICAgczNQb2xpY3lCeXBhc3NSb2xlTmFtZSA9ICdBZG1pbkFjY2VzcycsXG4gICAgfSA9IHByb3BzO1xuICAgIGNvbnN0IHJldmVyc2VEb21haW5OYW1lID0gTWljcm9BcHBzLnJldmVyc2VEb21haW4oZG9tYWluTmFtZSk7XG5cbiAgICBjb25zdCBzMyA9IG5ldyBNaWNyb0FwcHNTMyh0aGlzLCAnbWljcm9hcHBzLXMzJywge1xuICAgICAgYXV0b0RlbGV0ZUV2ZXJ5dGhpbmcsXG4gICAgICByZXZlcnNlRG9tYWluTmFtZSxcbiAgICAgIGFzc2V0TmFtZVJvb3QsXG4gICAgICBhc3NldE5hbWVTdWZmaXgsXG4gICAgfSk7XG4gICAgY29uc3QgY2YgPSBuZXcgTWljcm9BcHBzQ0YodGhpcywgJ21pY3JvYXBwcy1jbG91ZGZyb250Jywge1xuICAgICAgczNFeHBvcnRzOiBzMyxcbiAgICAgIGFzc2V0TmFtZVJvb3QsXG4gICAgICBhc3NldE5hbWVTdWZmaXgsXG4gICAgICBkb21haW5OYW1lLFxuICAgICAgcmV2ZXJzZURvbWFpbk5hbWUsXG4gICAgICBkb21haW5OYW1lRWRnZSxcbiAgICAgIGRvbWFpbk5hbWVPcmlnaW4sXG4gICAgICBhdXRvRGVsZXRlRXZlcnl0aGluZyxcbiAgICAgIHI1M1pvbmVJRCxcbiAgICAgIHI1M1pvbmVOYW1lLFxuICAgICAgY2VydEVkZ2UsXG4gICAgfSk7XG4gICAgbmV3IE1pY3JvQXBwc1N2Y3ModGhpcywgJ21pY3JvYXBwcy1zdmNzJywge1xuICAgICAgY2ZTdGFja0V4cG9ydHM6IGNmLFxuICAgICAgczNFeHBvcnRzOiBzMyxcbiAgICAgIGFzc2V0TmFtZVJvb3QsXG4gICAgICBhc3NldE5hbWVTdWZmaXgsXG4gICAgICBkb21haW5OYW1lLFxuICAgICAgcmV2ZXJzZURvbWFpbk5hbWUsXG4gICAgICBkb21haW5OYW1lRWRnZSxcbiAgICAgIGRvbWFpbk5hbWVPcmlnaW4sXG4gICAgICBhdXRvRGVsZXRlRXZlcnl0aGluZyxcbiAgICAgIHI1M1pvbmVJRCxcbiAgICAgIHI1M1pvbmVOYW1lLFxuICAgICAgYWNjb3VudCxcbiAgICAgIHJlZ2lvbixcbiAgICAgIGFwcEVudixcbiAgICAgIGNlcnRPcmlnaW4sXG4gICAgICBzM1BvbGljeUJ5cGFzc0FST0EsXG4gICAgICBzM1BvbGljeUJ5cGFzc1JvbGVOYW1lLFxuICAgIH0pO1xuICB9XG59XG4iXX0=
+MicroApps[_a] = { fqn: "@pwrdrvr/microapps-cdk.MicroApps", version: "0.0.28" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiTWljcm9BcHBzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL01pY3JvQXBwcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUNBLHFDQUFxQztBQUNyQywrQ0FBNEM7QUFDNUMsK0NBQTRDO0FBQzVDLG1EQUFnRDs7Ozs7O0FBc0RoRCxNQUFhLFNBQVUsU0FBUSxHQUFHLENBQUMsU0FBUzs7OztJQVUxQyxZQUFZLEtBQW9CLEVBQUUsRUFBVSxFQUFFLEtBQXNCO1FBQ2xFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsbUJBQW1CLENBQUMsQ0FBQztTQUN0QztRQUVELE1BQU0sRUFDSixVQUFVLEVBQ1YsY0FBYyxFQUNkLGdCQUFnQixFQUNoQixhQUFhLEdBQUcsV0FBVyxFQUMzQixlQUFlLEdBQUcsRUFBRSxFQUNwQixvQkFBb0IsR0FBRyxLQUFLLEVBQzVCLFNBQVMsRUFDVCxXQUFXLEVBQ1gsUUFBUSxFQUNSLE9BQU8sRUFDUCxNQUFNLEVBQ04sTUFBTSxHQUFHLEtBQUssRUFDZCxVQUFVLEVBQ1YsbUJBQW1CLEVBQ25CLDJCQUEyQixFQUMzQixvQkFBb0IsR0FDckIsR0FBRyxLQUFLLENBQUM7UUFDVixNQUFNLGlCQUFpQixHQUFHLFNBQVMsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLENBQUM7UUFFOUQsTUFBTSxFQUFFLEdBQUcsSUFBSSx5QkFBVyxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUU7WUFDL0Msb0JBQW9CO1lBQ3BCLGlCQUFpQjtZQUNqQixhQUFhO1lBQ2IsZUFBZTtTQUNoQixDQUFDLENBQUM7UUFDSCxNQUFNLEVBQUUsR0FBRyxJQUFJLHlCQUFXLENBQUMsSUFBSSxFQUFFLHNCQUFzQixFQUFFO1lBQ3ZELFNBQVMsRUFBRSxFQUFFO1lBQ2IsYUFBYTtZQUNiLGVBQWU7WUFDZixVQUFVO1lBQ1YsaUJBQWlCO1lBQ2pCLGNBQWM7WUFDZCxnQkFBZ0I7WUFDaEIsb0JBQW9CO1lBQ3BCLFNBQVM7WUFDVCxXQUFXO1lBQ1gsUUFBUTtTQUNULENBQUMsQ0FBQztRQUNILElBQUksNkJBQWEsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUU7WUFDeEMsY0FBYyxFQUFFLEVBQUU7WUFDbEIsU0FBUyxFQUFFLEVBQUU7WUFDYixhQUFhO1lBQ2IsZUFBZTtZQUNmLFVBQVU7WUFDVixpQkFBaUI7WUFDakIsY0FBYztZQUNkLGdCQUFnQjtZQUNoQixvQkFBb0I7WUFDcEIsU0FBUztZQUNULFdBQVc7WUFDWCxPQUFPO1lBQ1AsTUFBTTtZQUNOLE1BQU07WUFDTixVQUFVO1lBQ1YsbUJBQW1CO1lBQ25CLDJCQUEyQjtZQUMzQixvQkFBb0I7U0FDckIsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQTNFRCx5REFBeUQ7SUFDakQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFjO1FBQ3pDLElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDeEMsSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1lBQ25CLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1NBQ3hCO1FBQ0QsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3pCLENBQUM7O0FBUkgsOEJBNkVDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgYWNtIGZyb20gJ0Bhd3MtY2RrL2F3cy1jZXJ0aWZpY2F0ZW1hbmFnZXInO1xuaW1wb3J0ICogYXMgY2RrIGZyb20gJ0Bhd3MtY2RrL2NvcmUnO1xuaW1wb3J0IHsgTWljcm9BcHBzQ0YgfSBmcm9tICcuL01pY3JvQXBwc0NGJztcbmltcG9ydCB7IE1pY3JvQXBwc1MzIH0gZnJvbSAnLi9NaWNyb0FwcHNTMyc7XG5pbXBvcnQgeyBNaWNyb0FwcHNTdmNzIH0gZnJvbSAnLi9NaWNyb0FwcHNTdmNzJztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG5leHBvcnQgaW50ZXJmYWNlIE1pY3JvQXBwc1Byb3BzIHtcbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSBhdXRvRGVsZXRlRXZlcnl0aGluZz86IGJvb2xlYW47XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSBhcHBFbnY6IHN0cmluZztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSBhc3NldE5hbWVSb290OiBzdHJpbmc7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IGFzc2V0TmFtZVN1ZmZpeD86IHN0cmluZztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgZG9tYWluTmFtZTogc3RyaW5nO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgcjUzWm9uZU5hbWU6IHN0cmluZztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgcjUzWm9uZUlEOiBzdHJpbmc7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgY2VydEVkZ2U6IGFjbS5JQ2VydGlmaWNhdGU7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgY2VydE9yaWdpbjogYWNtLklDZXJ0aWZpY2F0ZTtcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgczNTdHJpY3RCdWNrZXRQb2xpY3k/OiBib29sZWFuO1xuXG4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgczNQb2xpY3lCeXBhc3NQcmluY2lwYWxBUk5zPzogc3RyaW5nW107XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IHMzUG9saWN5QnlwYXNzQVJPQXM/OiBzdHJpbmdbXTtcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXG4gIHJlYWRvbmx5IGFjY291bnQ6IHN0cmluZztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgcmVnaW9uOiBzdHJpbmc7XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbiAgcmVhZG9ubHkgZG9tYWluTmFtZUVkZ2U6IHN0cmluZztcblxuICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFxuICByZWFkb25seSBkb21haW5OYW1lT3JpZ2luOiBzdHJpbmc7XG59XG5cbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcbmV4cG9ydCBjbGFzcyBNaWNyb0FwcHMgZXh0ZW5kcyBjZGsuQ29uc3RydWN0IHtcbiAgLy8gaW5wdXQgbGlrZSAnZXhhbXBsZS5jb20uJyB3aWxsIHJldHVybiBhcyAnY29tLmV4YW1wbGUnXG4gIHByaXZhdGUgc3RhdGljIHJldmVyc2VEb21haW4oZG9tYWluOiBzdHJpbmcpOiBzdHJpbmcge1xuICAgIGxldCBwYXJ0cyA9IGRvbWFpbi5zcGxpdCgnLicpLnJldmVyc2UoKTtcbiAgICBpZiAocGFydHNbMF0gPT09ICcnKSB7XG4gICAgICBwYXJ0cyA9IHBhcnRzLnNsaWNlKDEpO1xuICAgIH1cbiAgICByZXR1cm4gcGFydHMuam9pbignLicpO1xuICB9XG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IGNkay5Db25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzPzogTWljcm9BcHBzUHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuXG4gICAgaWYgKHByb3BzID09PSB1bmRlZmluZWQpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcigncHJvcHMgbXVzdCBiZSBzZXQnKTtcbiAgICB9XG5cbiAgICBjb25zdCB7XG4gICAgICBkb21haW5OYW1lLFxuICAgICAgZG9tYWluTmFtZUVkZ2UsXG4gICAgICBkb21haW5OYW1lT3JpZ2luLFxuICAgICAgYXNzZXROYW1lUm9vdCA9ICdtaWNyb2FwcHMnLFxuICAgICAgYXNzZXROYW1lU3VmZml4ID0gJycsXG4gICAgICBhdXRvRGVsZXRlRXZlcnl0aGluZyA9IGZhbHNlLFxuICAgICAgcjUzWm9uZUlELFxuICAgICAgcjUzWm9uZU5hbWUsXG4gICAgICBjZXJ0RWRnZSxcbiAgICAgIGFjY291bnQsXG4gICAgICByZWdpb24sXG4gICAgICBhcHBFbnYgPSAnZGV2JyxcbiAgICAgIGNlcnRPcmlnaW4sXG4gICAgICBzM1BvbGljeUJ5cGFzc0FST0FzLFxuICAgICAgczNQb2xpY3lCeXBhc3NQcmluY2lwYWxBUk5zLFxuICAgICAgczNTdHJpY3RCdWNrZXRQb2xpY3ksXG4gICAgfSA9IHByb3BzO1xuICAgIGNvbnN0IHJldmVyc2VEb21haW5OYW1lID0gTWljcm9BcHBzLnJldmVyc2VEb21haW4oZG9tYWluTmFtZSk7XG5cbiAgICBjb25zdCBzMyA9IG5ldyBNaWNyb0FwcHNTMyh0aGlzLCAnbWljcm9hcHBzLXMzJywge1xuICAgICAgYXV0b0RlbGV0ZUV2ZXJ5dGhpbmcsXG4gICAgICByZXZlcnNlRG9tYWluTmFtZSxcbiAgICAgIGFzc2V0TmFtZVJvb3QsXG4gICAgICBhc3NldE5hbWVTdWZmaXgsXG4gICAgfSk7XG4gICAgY29uc3QgY2YgPSBuZXcgTWljcm9BcHBzQ0YodGhpcywgJ21pY3JvYXBwcy1jbG91ZGZyb250Jywge1xuICAgICAgczNFeHBvcnRzOiBzMyxcbiAgICAgIGFzc2V0TmFtZVJvb3QsXG4gICAgICBhc3NldE5hbWVTdWZmaXgsXG4gICAgICBkb21haW5OYW1lLFxuICAgICAgcmV2ZXJzZURvbWFpbk5hbWUsXG4gICAgICBkb21haW5OYW1lRWRnZSxcbiAgICAgIGRvbWFpbk5hbWVPcmlnaW4sXG4gICAgICBhdXRvRGVsZXRlRXZlcnl0aGluZyxcbiAgICAgIHI1M1pvbmVJRCxcbiAgICAgIHI1M1pvbmVOYW1lLFxuICAgICAgY2VydEVkZ2UsXG4gICAgfSk7XG4gICAgbmV3IE1pY3JvQXBwc1N2Y3ModGhpcywgJ21pY3JvYXBwcy1zdmNzJywge1xuICAgICAgY2ZTdGFja0V4cG9ydHM6IGNmLFxuICAgICAgczNFeHBvcnRzOiBzMyxcbiAgICAgIGFzc2V0TmFtZVJvb3QsXG4gICAgICBhc3NldE5hbWVTdWZmaXgsXG4gICAgICBkb21haW5OYW1lLFxuICAgICAgcmV2ZXJzZURvbWFpbk5hbWUsXG4gICAgICBkb21haW5OYW1lRWRnZSxcbiAgICAgIGRvbWFpbk5hbWVPcmlnaW4sXG4gICAgICBhdXRvRGVsZXRlRXZlcnl0aGluZyxcbiAgICAgIHI1M1pvbmVJRCxcbiAgICAgIHI1M1pvbmVOYW1lLFxuICAgICAgYWNjb3VudCxcbiAgICAgIHJlZ2lvbixcbiAgICAgIGFwcEVudixcbiAgICAgIGNlcnRPcmlnaW4sXG4gICAgICBzM1BvbGljeUJ5cGFzc0FST0FzLFxuICAgICAgczNQb2xpY3lCeXBhc3NQcmluY2lwYWxBUk5zLFxuICAgICAgczNTdHJpY3RCdWNrZXRQb2xpY3ksXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/MicroAppsSvcs.d.ts

@@ -17,8 +17,9 @@ interface MicroAppsSvcsStackProps extends cdk.ResourceProps {
     readonly certOrigin: acm.ICertificate;
     readonly r53ZoneName: string;
     readonly r53ZoneID: string;
-    readonly s3PolicyBypassAROA: string;
-    readonly s3PolicyBypassRoleName: string;
+    readonly s3StrictBucketPolicy?: boolean;
+    readonly s3PolicyBypassAROAs?: string[];
+    readonly s3PolicyBypassPrincipalARNs?: string[];
     readonly account: string;
     readonly region: string;
 }