@pwrdrvr/microapps-cdk 0.4.0-alpha.10 → 0.4.0-alpha.12

package/.jsii

@@ -3464,7 +3464,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroApps.ts",
-        "line": 318
+        "line": 323
       },
       "name": "IMicroApps",
       "properties": [
@@ -3477,7 +3477,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 320
+            "line": 325
           },
           "name": "cf",
           "type": {
@@ -3493,7 +3493,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 326
+            "line": 331
           },
           "name": "s3",
           "type": {
@@ -3509,7 +3509,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 329
+            "line": 334
           },
           "name": "svcs",
           "type": {
@@ -3525,7 +3525,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 332
+            "line": 337
           },
           "name": "apigwy",
           "optional": true,
@@ -3542,7 +3542,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 323
+            "line": 328
           },
           "name": "edgeToOrigin",
           "optional": true,
@@ -3646,7 +3646,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsChildDeployer.ts",
-        "line": 68
+        "line": 70
       },
       "name": "IMicroAppsChildDeployer",
       "properties": [
@@ -3659,7 +3659,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsChildDeployer.ts",
-            "line": 72
+            "line": 74
           },
           "name": "deployerFunc",
           "type": {
@@ -3872,7 +3872,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsSvcs.ts",
-        "line": 186
+        "line": 191
       },
       "name": "IMicroAppsSvcs",
       "properties": [
@@ -3885,7 +3885,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 195
+            "line": 200
           },
           "name": "deployerFunc",
           "type": {
@@ -3901,7 +3901,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 190
+            "line": 195
           },
           "name": "table",
           "type": {
@@ -3917,7 +3917,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 200
+            "line": 205
           },
           "name": "routerFunc",
           "optional": true,
@@ -3980,7 +3980,7 @@
         },
         "locationInModule": {
           "filename": "src/MicroApps.ts",
-          "line": 381
+          "line": 386
         },
         "parameters": [
           {
@@ -4010,7 +4010,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/MicroApps.ts",
-        "line": 355
+        "line": 360
       },
       "name": "MicroApps",
       "properties": [
@@ -4022,7 +4022,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 357
+            "line": 362
           },
           "name": "cf",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroApps",
@@ -4038,7 +4038,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 367
+            "line": 372
           },
           "name": "s3",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroApps",
@@ -4054,7 +4054,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 377
+            "line": 382
           },
           "name": "svcs",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroApps",
@@ -4070,7 +4070,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 372
+            "line": 377
           },
           "name": "apigwy",
           "optional": true,
@@ -4087,7 +4087,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 362
+            "line": 367
           },
           "name": "edgeToOrigin",
           "optional": true,
@@ -4818,7 +4818,7 @@
         },
         "locationInModule": {
           "filename": "src/MicroAppsChildDeployer.ts",
-          "line": 84
+          "line": 86
         },
         "parameters": [
           {
@@ -4848,7 +4848,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/MicroAppsChildDeployer.ts",
-        "line": 78
+        "line": 80
       },
       "name": "MicroAppsChildDeployer",
       "properties": [
@@ -4860,7 +4860,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsChildDeployer.ts",
-            "line": 80
+            "line": 82
           },
           "name": "deployerFunc",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsChildDeployer",
@@ -4895,29 +4895,13 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsChildDeployer.ts",
-            "line": 37
+            "line": 39
           },
           "name": "appEnv",
           "type": {
             "primitive": "string"
           }
         },
-        {
-          "abstract": true,
-          "docs": {
-            "stability": "experimental",
-            "summary": "ARN of the IAM Role for the Edge to Origin Lambda Function."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "src/MicroAppsChildDeployer.ts",
-            "line": 22
-          },
-          "name": "edgeToOriginRoleARN",
-          "type": {
-            "primitive": "string"
-          }
-        },
         {
           "abstract": true,
           "docs": {
@@ -4945,7 +4929,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsChildDeployer.ts",
-            "line": 45
+            "line": 47
           },
           "name": "assetNameRoot",
           "optional": true,
@@ -4964,7 +4948,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsChildDeployer.ts",
-            "line": 53
+            "line": 55
           },
           "name": "assetNameSuffix",
           "optional": true,
@@ -4983,7 +4967,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsChildDeployer.ts",
-            "line": 62
+            "line": 64
           },
           "name": "deployerTimeout",
           "optional": true,
@@ -4991,6 +4975,24 @@
             "fqn": "aws-cdk-lib.Duration"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "For child accounts this can be blank as it is retrieved from the parent Deployer",
+            "stability": "experimental",
+            "summary": "ARN of the IAM Role for the Edge to Origin Lambda Function."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsChildDeployer.ts",
+            "line": 24
+          },
+          "name": "edgeToOriginRoleARN",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -5002,7 +5004,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsChildDeployer.ts",
-            "line": 31
+            "line": 33
           },
           "name": "removalPolicy",
           "optional": true,
@@ -5692,6 +5694,28 @@
             }
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Additional IAM Role ARNs that should be allowed to invoke apps in child accounts."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroApps.ts",
+            "line": 317
+          },
+          "name": "edgeToOriginRoleARNs",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -5806,7 +5830,7 @@
           "abstract": true,
           "docs": {
             "example": "[ 'AROA1234567890123' ]",
-            "remarks": "AROAs of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy.\nThis allows sessions that assume the IAM Role to be excluded from the\nDENY rules on the S3 Bucket Policy.\n\nTypically any admin roles / users that need to view or manage the S3 Bucket\nwould be added to this list.\n\nRoles / users that are used directly, not assumed, can be added to `s3PolicyBypassRoleNames` instead.\n\nNote: This AROA must be specified to prevent this policy from locking\nout non-root sessions that have assumed the admin role.\n\nThe notPrincipals will only match the role name exactly and will not match\nany session that has assumed the role since notPrincipals does not allow\nwildcard matches and does not do wildcard matches implicitly either.\n\nThe AROA must be used because there are only 3 Principal variables available:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable\n  aws:username, aws:userid, aws:PrincipalTag\n\nFor an assumed role, aws:username is blank, aws:userid is:\n  [unique id AKA AROA for Role]:[session name]\n\nTable of unique ID prefixes such as AROA:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes\n\nThe name of the role is simply not available for an assumed role and, if it was,\na complicated comparison would be requierd to prevent exclusion\nof applying the Deny Rule to roles from other accounts.\n\nTo get the AROA with the AWS CLI:\n   aws iam get-role --role-name ROLE-NAME\n   aws iam get-user -–user-name USER-NAME",
+            "remarks": "AROAs of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy.\nThis allows sessions that assume the IAM Role to be excluded from the\nDENY rules on the S3 Bucket Policy.\n\nTypically any admin roles / users that need to view or manage the S3 Bucket\nwould be added to this list.\n\nRoles / users that are used directly, not assumed, can be added to `s3PolicyBypassRoleNames` instead.\n\nNote: This AROA must be specified to prevent this policy from locking\nout non-root sessions that have assumed the admin role.\n\nThe notPrincipals will only match the role name exactly and will not match\nany session that has assumed the role since notPrincipals does not allow\nwildcard matches and does not do wildcard matches implicitly either.\n\nThe AROA must be used because there are only 3 Principal variables available:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable\n  aws:username, aws:userid, aws:PrincipalTag\n\nFor an assumed role, aws:username is blank, aws:userid is:\n  [unique id AKA AROA for Role]:[session name]\n\nTable of unique ID prefixes such as AROA:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes\n\nThe name of the role is simply not available for an assumed role and, if it was,\na complicated comparison would be requierd to prevent exclusion\nof applying the Deny Rule to roles from other accounts.\n\nTo get the AROA with the AWS CLI:\n   aws iam get-role --role-name ROLE-NAME\n   aws iam get-user --user-name USER-NAME",
             "see": "s3StrictBucketPolicy",
             "stability": "experimental",
             "summary": "Applies when using s3StrictBucketPolicy = true."
@@ -6242,7 +6266,7 @@
         },
         "locationInModule": {
           "filename": "src/MicroAppsSvcs.ts",
-          "line": 224
+          "line": 229
         },
         "parameters": [
           {
@@ -6272,7 +6296,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/MicroAppsSvcs.ts",
-        "line": 207
+        "line": 212
       },
       "name": "MicroAppsSvcs",
       "properties": [
@@ -6284,7 +6308,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 215
+            "line": 220
           },
           "name": "deployerFunc",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsSvcs",
@@ -6300,7 +6324,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 210
+            "line": 215
           },
           "name": "table",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsSvcs",
@@ -6316,7 +6340,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 220
+            "line": 225
           },
           "name": "routerFunc",
           "optional": true,
@@ -6464,6 +6488,28 @@
             "fqn": "aws-cdk-lib.Duration"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "ARN of the IAM Role for the Edge to Origin Lambda Function."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsSvcs.ts",
+            "line": 185
+          },
+          "name": "edgeToOriginRoleARN",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -6541,7 +6587,7 @@
           "abstract": true,
           "docs": {
             "example": "[ 'AROA1234567890123' ]",
-            "remarks": "AROAs of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy.\nThis allows sessions that assume the IAM Role to be excluded from the\nDENY rules on the S3 Bucket Policy.\n\nTypically any admin roles / users that need to view or manage the S3 Bucket\nwould be added to this list.\n\nRoles / users that are used directly, not assumed, can be added to `s3PolicyBypassRoleNames` instead.\n\nNote: This AROA must be specified to prevent this policy from locking\nout non-root sessions that have assumed the admin role.\n\nThe notPrincipals will only match the role name exactly and will not match\nany session that has assumed the role since notPrincipals does not allow\nwildcard matches and does not do wildcard matches implicitly either.\n\nThe AROA must be used because there are only 3 Principal variables available:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable\n  aws:username, aws:userid, aws:PrincipalTag\n\nFor an assumed role, aws:username is blank, aws:userid is:\n  [unique id AKA AROA for Role]:[session name]\n\nTable of unique ID prefixes such as AROA:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes\n\nThe name of the role is simply not available for an assumed role and, if it was,\na complicated comparison would be requierd to prevent exclusion\nof applying the Deny Rule to roles from other accounts.\n\nTo get the AROA with the AWS CLI:\n   aws iam get-role --role-name ROLE-NAME\n   aws iam get-user -–user-name USER-NAME",
+            "remarks": "AROAs of the IAM Role to exclude from the DENY rules on the S3 Bucket Policy.\nThis allows sessions that assume the IAM Role to be excluded from the\nDENY rules on the S3 Bucket Policy.\n\nTypically any admin roles / users that need to view or manage the S3 Bucket\nwould be added to this list.\n\nRoles / users that are used directly, not assumed, can be added to `s3PolicyBypassRoleNames` instead.\n\nNote: This AROA must be specified to prevent this policy from locking\nout non-root sessions that have assumed the admin role.\n\nThe notPrincipals will only match the role name exactly and will not match\nany session that has assumed the role since notPrincipals does not allow\nwildcard matches and does not do wildcard matches implicitly either.\n\nThe AROA must be used because there are only 3 Principal variables available:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable\n  aws:username, aws:userid, aws:PrincipalTag\n\nFor an assumed role, aws:username is blank, aws:userid is:\n  [unique id AKA AROA for Role]:[session name]\n\nTable of unique ID prefixes such as AROA:\n  https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes\n\nThe name of the role is simply not available for an assumed role and, if it was,\na complicated comparison would be requierd to prevent exclusion\nof applying the Deny Rule to roles from other accounts.\n\nTo get the AROA with the AWS CLI:\n   aws iam get-role --role-name ROLE-NAME\n   aws iam get-user --user-name USER-NAME",
             "see": "s3StrictBucketPolicy",
             "stability": "experimental",
             "summary": "Applies when using s3StrictBucketPolicy = true."
@@ -6776,6 +6822,6 @@
       "symbolId": "src/MicroAppsTable:MicroAppsTableProps"
     }
   },
-  "version": "0.4.0-alpha.10",
-  "fingerprint": "8oyqSC2IQLqQ+9tJgfexdZ6YRrHAy1hrOh71tTygVBw="
+  "version": "0.4.0-alpha.12",
+  "fingerprint": "nmDRjf10WDndSwmxRGXznBtFHlZ8v9o2LT42944Dhwg="
 }

package/API.md

@@ -979,14 +979,6 @@ Application environment, passed as `NODE_ENV` to the Router and Deployer Lambda
 
 ---
 
-##### `edgeToOriginRoleARN`<sup>Required</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsChildDeployerProps.edgeToOriginRoleARN"></a>
-
-- *Type:* `string`
-
-ARN of the IAM Role for the Edge to Origin Lambda Function.
-
----
-
 ##### `parentDeployerLambdaARN`<sup>Required</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsChildDeployerProps.parentDeployerLambdaARN"></a>
 
 - *Type:* `string`
@@ -1024,6 +1016,16 @@ For larger applications this needs to be set up to 2-5 minutes for the S3 copy
 
 ---
 
+##### `edgeToOriginRoleARN`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsChildDeployerProps.edgeToOriginRoleARN"></a>
+
+- *Type:* `string`
+
+ARN of the IAM Role for the Edge to Origin Lambda Function.
+
+For child accounts this can be blank as it is retrieved from the parent Deployer
+
+---
+
 ##### `removalPolicy`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsChildDeployerProps.removalPolicy"></a>
 
 - *Type:* [`aws-cdk-lib.RemovalPolicy`](#aws-cdk-lib.RemovalPolicy)
@@ -1330,6 +1332,14 @@ Additional edge lambda functions.
 
 ---
 
+##### `edgeToOriginRoleARNs`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.edgeToOriginRoleARNs"></a>
+
+- *Type:* `string`[]
+
+Additional IAM Role ARNs that should be allowed to invoke apps in child accounts.
+
+---
+
 ##### `originRegion`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsProps.originRegion"></a>
 
 - *Type:* `string`
@@ -1432,7 +1442,7 @@ of applying the Deny Rule to roles from other accounts.
 
 To get the AROA with the AWS CLI:
    aws iam get-role --role-name ROLE-NAME
-   aws iam get-user -–user-name USER-NAME
+   aws iam get-user --user-name USER-NAME
 
 > s3StrictBucketPolicy
 
@@ -1655,6 +1665,14 @@ For larger applications this needs to be set up to 2-5 minutes for the S3 copy
 
 ---
 
+##### `edgeToOriginRoleARN`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsSvcsProps.edgeToOriginRoleARN"></a>
+
+- *Type:* `string`[]
+
+ARN of the IAM Role for the Edge to Origin Lambda Function.
+
+---
+
 ##### `httpApi`<sup>Optional</sup> <a name="@pwrdrvr/microapps-cdk.MicroAppsSvcsProps.httpApi"></a>
 
 - *Type:* [`@aws-cdk/aws-apigatewayv2-alpha.HttpApi`](#@aws-cdk/aws-apigatewayv2-alpha.HttpApi)
@@ -1730,7 +1748,7 @@ of applying the Deny Rule to roles from other accounts.
 
 To get the AROA with the AWS CLI:
    aws iam get-role --role-name ROLE-NAME
-   aws iam get-user -–user-name USER-NAME
+   aws iam get-user --user-name USER-NAME
 
 > s3StrictBucketPolicy
 

package/changelog.md

@@ -1,2 +1,2 @@
 
-## [0.4.0-alpha.10](https://github.com/pwrdrvr/microapps-core/compare/v0.4.0-alpha.9...v0.4.0-alpha.10) (2023-04-26)
+## [0.4.0-alpha.12](https://github.com/pwrdrvr/microapps-core/compare/v0.4.0-alpha.11...v0.4.0-alpha.12) (2023-05-19)

package/lib/MicroApps.d.ts

@@ -135,7 +135,7 @@ export interface MicroAppsProps {
      *
      * To get the AROA with the AWS CLI:
      *   aws iam get-role --role-name ROLE-NAME
-     *   aws iam get-user -–user-name USER-NAME
+     *   aws iam get-user --user-name USER-NAME
      *
      * @example [ 'AROA1234567890123' ]
      *
@@ -282,6 +282,10 @@ export interface MicroAppsProps {
      * @default none
      */
     readonly allowedLocalePrefixes?: string[];
+    /**
+     * Additional IAM Role ARNs that should be allowed to invoke apps in child accounts
+     */
+    readonly edgeToOriginRoleARNs?: string[];
 }
 /**
  * Represents a MicroApps