@quadnix/octo-aws-cdk 0.0.19 → 0.2.0

package/dist/resources/s3-storage/s3-storage.resource.js

@@ -7,16 +7,23 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { AResource, DependencyRelationship, Diff, DiffAction, DiffUtility, MatchingResource, Resource, ResourceError, } from '@quadnix/octo';
+import { AResource, ATerraformResource, DependencyRelationship, Diff, DiffAction, DiffUtility, MatchingResource, Resource, } from '@quadnix/octo';
+import { PolicyUtility } from '../../utilities/policy/policy.utility.js';
 import { S3StorageSchema } from './index.schema.js';
 /**
  * @internal
  */
-let S3Storage = class S3Storage extends AResource {
+let S3Storage = class S3Storage extends ATerraformResource {
+    /**
+     * @internal
+     */
     constructor(resourceId, properties, parents) {
         super(resourceId, properties, parents || []);
         this.updatePrincipalResourceDependencyBehaviors((parents || []).map((p) => p.getActual()));
     }
+    /**
+     * @internal
+     */
     addPermission(principal, remoteDirectoryPath, options) {
         const principalResourceId = principal.getActual().resourceId;
         const existingPermission = this.properties.permissions.find((p) => p.principalResourceId === principalResourceId && p.remoteDirectoryPath === remoteDirectoryPath);
@@ -36,19 +43,14 @@ let S3Storage = class S3Storage extends AResource {
             });
         }
     }
-    async diffInverse(diff, deReferenceResource) {
-        if (diff.field === 'update-permissions' && diff.action === DiffAction.UPDATE) {
-            // All changes to properties.permissions is in this single diff, invoking one single action.
-            // There is no need to individually clone properties. A single clone is enough.
-            this.clonePropertiesInPlace(diff.node);
-        }
-        else {
-            await super.diffInverse(diff, deReferenceResource);
-        }
-    }
+    /**
+     * @internal
+     */
     async diffProperties(previous) {
         if (!DiffUtility.isObjectDeepEquals(previous.properties, this.properties, ['permissions'])) {
-            throw new ResourceError('Cannot update S3 Storage immutable properties once it has been created!', this);
+            return [
+                new Diff(this, DiffAction.REPLACE, 'resourceId', this.getContext(), 'Bucket is force-new on aws_s3_bucket; a change recreates the bucket'),
+            ];
         }
         const diffs = [];
         const manifestDiff = {};
@@ -101,6 +103,9 @@ let S3Storage = class S3Storage extends AResource {
         }
         return diffs;
     }
+    /**
+     * @internal
+     */
     diffUnpack(diff) {
         if (diff.action === DiffAction.ADD && diff.field === 'resourceId') {
             const diffs = [diff];
@@ -131,6 +136,64 @@ let S3Storage = class S3Storage extends AResource {
             return [diff];
         }
     }
+    /**
+     * @internal
+     */
+    async toHCL(terraform) {
+        const s3StorageOctoResource = terraform.addOctoTerraformResource(this, {
+            provider: { accountId: this.properties.awsAccountId, regionId: this.properties.awsRegionId },
+        });
+        const s3StorageTFResource = s3StorageOctoResource.addTerraformResource('aws_s3_bucket', this.resourceId, {
+            bucket: this.properties.Bucket,
+        });
+        s3StorageOctoResource.output({
+            Arn: terraform.raw(`${s3StorageTFResource.address}.arn`),
+        });
+        if (this.properties.permissions.length > 0) {
+            const statements = [];
+            for (const permission of this.properties.permissions) {
+                const principalParent = this.parents.find((p) => p.getActual().resourceId === permission.principalResourceId);
+                const principalArn = terraform.getRef(principalParent, 'Arn');
+                const resources = [
+                    `arn:aws:s3:::${this.properties.Bucket}/${permission.remoteDirectoryPath}`,
+                    `arn:aws:s3:::${this.properties.Bucket}/${permission.remoteDirectoryPath}/*`,
+                ];
+                if (permission.allowRead) {
+                    statements.push({
+                        Action: ['s3:GetObject'],
+                        Effect: 'Allow',
+                        Principal: { AWS: [principalArn] },
+                        Resource: resources,
+                        Sid: PolicyUtility.getSafeSid(`${permission.principalResourceId}-ReadPermission`),
+                    });
+                }
+                if (permission.allowWrite) {
+                    statements.push({
+                        Action: ['s3:PutObject'],
+                        Effect: 'Allow',
+                        Principal: { AWS: [principalArn] },
+                        Resource: resources,
+                        Sid: PolicyUtility.getSafeSid(`${permission.principalResourceId}-WritePermission`),
+                    });
+                }
+            }
+            if (statements.length > 0) {
+                s3StorageOctoResource.addTerraformResource('aws_s3_bucket_policy', `${this.resourceId}-policy`, {
+                    bucket: terraform.raw(`${s3StorageTFResource.address}.id`),
+                    policy: terraform.jsonencode({
+                        Statement: statements,
+                        Version: '2012-10-17',
+                    }),
+                });
+            }
+        }
+        if (Object.keys(this.tags).length > 0) {
+            s3StorageTFResource.attribute('tags', this.tags);
+        }
+    }
+    /**
+     * @internal
+     */
     updatePrincipalResourceDependencyBehaviors(principalResourceParents) {
         for (const principal of principalResourceParents) {
             const s3StorageToPrincipalResourceDep = this.getDependency(principal, DependencyRelationship.CHILD);

package/dist/resources/s3-storage/s3-storage.resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"s3-storage.resource.js","sourceRoot":"","sources":["../../../src/resources/s3-storage/s3-storage.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,WAAW,EAEX,gBAAgB,EAChB,QAAQ,EACR,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAgC,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAWlF;;GAEG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,SAAqC;IAKlE,YACE,UAAkB,EAClB,UAAyC,EACzC,OAAqD;QAErD,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QAE7C,IAAI,CAAC,0CAA0C,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,aAAa,CACX,SAAoD,EACpD,mBAA2B,EAC3B,OAAoD;QAEpD,MAAM,mBAAmB,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC;QAE7D,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CACzD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,KAAK,mBAAmB,IAAI,CAAC,CAAC,mBAAmB,KAAK,mBAAmB,CACtG,CAAC;QACF,IAAI,kBAAkB,EAAE,CAAC;YACvB,kBAAkB,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACjD,kBAAkB,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;YAClH,uBAAuB,CAAC,WAAW,CAAC,oBAAoB,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;YAC3G,uBAAuB,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAE9G,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;gBAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,mBAAmB;gBACnB,mBAAmB;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEQ,KAAK,CAAC,WAAW,CACxB,IAAqB,EACrB,mBAA2D;QAE3D,IAAI,IAAI,CAAC,KAAK,KAAK,oBAAoB,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7E,4FAA4F;YAC5F,+EAA+E;YAC/E,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEQ,KAAK,CAAC,cAAc,CAAC,QAAmB;QAC/C,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,aAAa,CAAC,yEAAyE,EAAE,IAAI,CAAC,CAAC;QAC3G,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,CAAC;QACzB,MAAM,YAAY,GAA0B,EAAE,CAAC;QAE/C,KAAK,MAAM,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CACxD,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,mBAAmB,KAAK,kBAAkB,CAAC,mBAAmB;gBAChE,CAAC,CAAC,mBAAmB,KAAK,kBAAkB,CAAC,mBAAmB,CACnE,CAAC;YACF,IAAI,iBAAiB,EAAE,CAAC;gBACtB,IACE,iBAAiB,CAAC,SAAS,KAAK,kBAAkB,CAAC,SAAS;oBAC5D,iBAAiB,CAAC,UAAU,KAAK,kBAAkB,CAAC,UAAU,EAC9D,CAAC;oBACD,IAAI,kBAAkB,CAAC,mBAAmB,IAAI,YAAY,EAAE,CAAC;wBAC3D,YAAY,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;4BAC1F,4BAA4B,CAAC;oBACjC,CAAC;yBAAM,CAAC;wBACN,YAAY,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,GAAG;4BACrD,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B;yBACvE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,kBAAkB,CAAC,mBAAmB,IAAI,YAAY,EAAE,CAAC;oBAC3D,YAAY,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;wBAC1F,4BAA4B,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,GAAG;wBACrD,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B;qBACvE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,iBAAiB,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAC7D,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,mBAAmB,KAAK,iBAAiB,CAAC,mBAAmB;gBAC/D,CAAC,CAAC,mBAAmB,KAAK,iBAAiB,CAAC,mBAAmB,CAClE,CAAC;YACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,IAAI,iBAAiB,CAAC,mBAAmB,IAAI,YAAY,EAAE,CAAC;oBAC1D,YAAY,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,mBAAmB,CAAC;wBACxF,yBAAyB,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,GAAG;wBACpD,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,yBAAyB;qBACnE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,MAAM,EACjB,oBAAoB,EACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CACzC,CACF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEQ,UAAU,CAAC,IAAU;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,YAAY,GAA0B,EAAE,CAAC;YAE/C,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBACrD,IAAI,UAAU,CAAC,mBAAmB,IAAI,YAAY,EAAE,CAAC;oBACnD,YAAY,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,yBAAyB,CAAC;gBAC3G,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG;wBAC7C,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,yBAAyB;qBAC5D,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,MAAM,EACjB,oBAAoB,EACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CACzC,CACF,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA8B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE;oBACrE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1C,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;iBACX,CAAC,CACH,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,0CAA0C,CAChD,wBAAmE;QAEnE,KAAK,MAAM,SAAS,IAAI,wBAAwB,EAAE,CAAC;YACjD,MAAM,+BAA+B,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,sBAAsB,CAAC,KAAK,CAAE,CAAC;YACrG,MAAM,+BAA+B,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,sBAAsB,CAAC,MAAM,CAAE,CAAC;YAEtG,0DAA0D;YAC1D,+BAA+B,CAAC,WAAW,CACzC,oBAAoB,EACpB,UAAU,CAAC,MAAM,EACjB,YAAY,EACZ,UAAU,CAAC,GAAG,CACf,CAAC;YACF,6DAA6D;YAC7D,+BAA+B,CAAC,WAAW,CACzC,YAAY,EACZ,UAAU,CAAC,MAAM,EACjB,oBAAoB,EACpB,UAAU,CAAC,MAAM,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAhMY,SAAS;IADrB,QAAQ,CAAY,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC;;GAC/C,SAAS,CAgMrB"}
+{"version":3,"file":"s3-storage.resource.js","sourceRoot":"","sources":["../../../src/resources/s3-storage/s3-storage.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,WAAW,EAEX,gBAAgB,EAChB,QAAQ,GAET,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EAAgC,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAWlF;;GAEG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,kBAA8C;IAK3E;;OAEG;IACH,YACE,UAAkB,EAClB,UAAyC,EACzC,OAAqD;QAErD,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QAE7C,IAAI,CAAC,0CAA0C,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;OAEG;IACH,aAAa,CACX,SAAoD,EACpD,mBAA2B,EAC3B,OAAoD;QAEpD,MAAM,mBAAmB,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC;QAE7D,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CACzD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,KAAK,mBAAmB,IAAI,CAAC,CAAC,mBAAmB,KAAK,mBAAmB,CACtG,CAAC;QACF,IAAI,kBAAkB,EAAE,CAAC;YACvB,kBAAkB,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACjD,kBAAkB,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;YAClH,uBAAuB,CAAC,WAAW,CAAC,oBAAoB,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;YAC3G,uBAAuB,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAE9G,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;gBAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,mBAAmB;gBACnB,mBAAmB;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,cAAc,CAAC,QAAmB;QAC/C,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAC3F,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,qEAAqE,CACtE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,CAAC;QACzB,MAAM,YAAY,GAA0B,EAAE,CAAC;QAE/C,KAAK,MAAM,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CACxD,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,mBAAmB,KAAK,kBAAkB,CAAC,mBAAmB;gBAChE,CAAC,CAAC,mBAAmB,KAAK,kBAAkB,CAAC,mBAAmB,CACnE,CAAC;YACF,IAAI,iBAAiB,EAAE,CAAC;gBACtB,IACE,iBAAiB,CAAC,SAAS,KAAK,kBAAkB,CAAC,SAAS;oBAC5D,iBAAiB,CAAC,UAAU,KAAK,kBAAkB,CAAC,UAAU,EAC9D,CAAC;oBACD,IAAI,kBAAkB,CAAC,mBAAmB,IAAI,YAAY,EAAE,CAAC;wBAC3D,YAAY,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;4BAC1F,4BAA4B,CAAC;oBACjC,CAAC;yBAAM,CAAC;wBACN,YAAY,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,GAAG;4BACrD,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B;yBACvE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,kBAAkB,CAAC,mBAAmB,IAAI,YAAY,EAAE,CAAC;oBAC3D,YAAY,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;wBAC1F,4BAA4B,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,GAAG;wBACrD,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B;qBACvE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,iBAAiB,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAC7D,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,mBAAmB,KAAK,iBAAiB,CAAC,mBAAmB;gBAC/D,CAAC,CAAC,mBAAmB,KAAK,iBAAiB,CAAC,mBAAmB,CAClE,CAAC;YACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,IAAI,iBAAiB,CAAC,mBAAmB,IAAI,YAAY,EAAE,CAAC;oBAC1D,YAAY,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,mBAAmB,CAAC;wBACxF,yBAAyB,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,GAAG;wBACpD,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,yBAAyB;qBACnE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,MAAM,EACjB,oBAAoB,EACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CACzC,CACF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACM,UAAU,CAAC,IAAU;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,YAAY,GAA0B,EAAE,CAAC;YAE/C,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBACrD,IAAI,UAAU,CAAC,mBAAmB,IAAI,YAAY,EAAE,CAAC;oBACnD,YAAY,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,yBAAyB,CAAC;gBAC3G,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG;wBAC7C,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,yBAAyB;qBAC5D,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,MAAM,EACjB,oBAAoB,EACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CACzC,CACF,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAA8B,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE;oBACrE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1C,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,EAAE;iBACX,CAAC,CACH,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,qBAAqB,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAiB,EAAE;YAClF,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;SAC7F,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,UAAU,EAAE;YACvG,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;SAC/B,CAAC,CAAC;QACH,qBAAqB,CAAC,MAAM,CAAC;YAC3B,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;SACzD,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAa,EAAE,CAAC;YAEhC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBACrD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,UAAU,KAAK,UAAU,CAAC,mBAAmB,CAAE,CAAC;gBAC/G,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;gBAC9D,MAAM,SAAS,GAAG;oBAChB,gBAAgB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE;oBAC1E,gBAAgB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,mBAAmB,IAAI;iBAC7E,CAAC;gBAEF,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;oBACzB,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,CAAC,cAAc,CAAC;wBACxB,MAAM,EAAE,OAAO;wBACf,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE;wBAClC,QAAQ,EAAE,SAAS;wBACnB,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,mBAAmB,iBAAiB,CAAC;qBAClF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;oBAC1B,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,CAAC,cAAc,CAAC;wBACxB,MAAM,EAAE,OAAO;wBACf,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE;wBAClC,QAAQ,EAAE,SAAS;wBACnB,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC,mBAAmB,kBAAkB,CAAC;qBACnF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,qBAAqB,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC,UAAU,SAAS,EAAE;oBAC9F,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,KAAK,CAAC;oBAC1D,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;wBAC3B,SAAS,EAAE,UAAU;wBACrB,OAAO,EAAE,YAAY;qBACtB,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,0CAA0C,CAChD,wBAAmE;QAEnE,KAAK,MAAM,SAAS,IAAI,wBAAwB,EAAE,CAAC;YACjD,MAAM,+BAA+B,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,sBAAsB,CAAC,KAAK,CAAE,CAAC;YACrG,MAAM,+BAA+B,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,sBAAsB,CAAC,MAAM,CAAE,CAAC;YAEtG,0DAA0D;YAC1D,+BAA+B,CAAC,WAAW,CACzC,oBAAoB,EACpB,UAAU,CAAC,MAAM,EACjB,YAAY,EACZ,UAAU,CAAC,GAAG,CACf,CAAC;YACF,6DAA6D;YAC7D,+BAA+B,CAAC,WAAW,CACzC,YAAY,EACZ,UAAU,CAAC,MAAM,EACjB,oBAAoB,EACpB,UAAU,CAAC,MAAM,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAzQY,SAAS;IADrB,QAAQ,CAAY,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC;;GAC/C,SAAS,CAyQrB"}

package/dist/resources/s3-website/index.d.ts

@@ -1,6 +1 @@
-import './actions/add-s3-website.resource.action.js';
-import './actions/delete-s3-website.resource.action.js';
-import './actions/update-s3-website-tags.resource.action.js';
-import './actions/update-source-paths-in-s3-website.resource.action.js';
-import './actions/validate-s3-website.resource.action.js';
 export { S3Website } from './s3-website.resource.js';

package/dist/resources/s3-website/index.js

@@ -1,7 +1,2 @@
-import './actions/add-s3-website.resource.action.js';
-import './actions/delete-s3-website.resource.action.js';
-import './actions/update-s3-website-tags.resource.action.js';
-import './actions/update-source-paths-in-s3-website.resource.action.js';
-import './actions/validate-s3-website.resource.action.js';
 export { S3Website } from './s3-website.resource.js';
 //# sourceMappingURL=index.js.map

package/dist/resources/s3-website/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/resources/s3-website/index.ts"],"names":[],"mappings":"AAAA,OAAO,6CAA6C,CAAC;AACrD,OAAO,gDAAgD,CAAC;AACxD,OAAO,qDAAqD,CAAC;AAC7D,OAAO,gEAAgE,CAAC;AACxE,OAAO,kDAAkD,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/resources/s3-website/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/resources/s3-website/index.schema.d.ts

@@ -1,9 +1,20 @@
 import { BaseResourceSchema } from '@quadnix/octo';
+/**
+ * A CloudFront distribution this bucket serves. Structural, so the bucket never has to know what
+ * kind of resource is in front of it - only that it publishes an ARN to name in a policy.
+ *
+ * @internal
+ */
+export declare class WebsiteDistributionSchema extends BaseResourceSchema {
+    response: {
+        Arn?: string;
+    };
+}
 /**
  * The `S3WebsiteSchema` class is the schema for the `S3Website` resource,
  * which represents the AWS Simple Storage Service (S3) Website resource.
- * This resource can create a s3 website in AWS using the AWS JavaScript SDK V3 API.
- * See [official sdk docs](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/).
+ * Terraform provisions it as
+ * [`aws_s3_object`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object).
  *
  * @group Resources/S3Website
  *
@@ -20,11 +31,17 @@ export declare class S3WebsiteSchema extends BaseResourceSchema {
      * * `properties.Bucket` - The name of the bucket.
      * * `properties.ErrorDocument` - Path of the error document, e.g. `error.html`.
      * * `properties.IndexDocument` - Path of the index document, e.g. `index.html`.
+     * * `properties.distributionResourceIds` - The distributions allowed to read this bucket, each
+     * granted one statement in the policy below. It is also what decides how the bucket is reached:
+     * empty leaves the bucket public on its S3 website endpoint, over plain HTTP, and anything else
+     * closes it so that the distributions in front of it are the only way in. Two facts would
+     * disagree eventually, so there is only this one.
      */
     properties: {
         awsAccountId: string;
         awsRegionId: string;
         Bucket: string;
+        distributionResourceIds: string[];
         ErrorDocument: string;
         IndexDocument: string;
     };
@@ -32,9 +49,15 @@ export declare class S3WebsiteSchema extends BaseResourceSchema {
      * Saved response.
      * * `response.Arn` - The ARN of the bucket.
      * * `response.awsRegionId` - The AWS region id.
+     * * `response.RegionalDomainName` - The bucket's REST endpoint, which is what a CloudFront origin
+     * points at.
      */
     response: {
         Arn?: string;
         awsRegionId?: string;
+        RegionalDomainName?: string;
+    };
+    sourcePathDigests: {
+        [remotePath: string]: string;
     };
 }

package/dist/resources/s3-website/index.schema.js

@@ -8,11 +8,38 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { BaseResourceSchema, Schema, Validate } from '@quadnix/octo';
+/**
+ * A CloudFront distribution this bucket serves. Structural, so the bucket never has to know what
+ * kind of resource is in front of it - only that it publishes an ARN to name in a policy.
+ *
+ * @internal
+ */
+export class WebsiteDistributionSchema extends BaseResourceSchema {
+    constructor() {
+        super(...arguments);
+        this.response = Schema({
+            Arn: 'arn:aws:cloudfront::000000000000:distribution/E000000000000',
+        });
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => {
+            const subjects = [];
+            if (value.Arn) {
+                subjects.push(value.Arn);
+            }
+            return subjects;
+        },
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], WebsiteDistributionSchema.prototype, "response", void 0);
 /**
  * The `S3WebsiteSchema` class is the schema for the `S3Website` resource,
  * which represents the AWS Simple Storage Service (S3) Website resource.
- * This resource can create a s3 website in AWS using the AWS JavaScript SDK V3 API.
- * See [official sdk docs](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/).
+ * Terraform provisions it as
+ * [`aws_s3_object`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object).
  *
  * @group Resources/S3Website
  *
@@ -31,14 +58,26 @@ export class S3WebsiteSchema extends BaseResourceSchema {
          * * `properties.Bucket` - The name of the bucket.
          * * `properties.ErrorDocument` - Path of the error document, e.g. `error.html`.
          * * `properties.IndexDocument` - Path of the index document, e.g. `index.html`.
+         * * `properties.distributionResourceIds` - The distributions allowed to read this bucket, each
+         * granted one statement in the policy below. It is also what decides how the bucket is reached:
+         * empty leaves the bucket public on its S3 website endpoint, over plain HTTP, and anything else
+         * closes it so that the distributions in front of it are the only way in. Two facts would
+         * disagree eventually, so there is only this one.
          */
         this.properties = Schema();
         /**
          * Saved response.
          * * `response.Arn` - The ARN of the bucket.
          * * `response.awsRegionId` - The AWS region id.
+         * * `response.RegionalDomainName` - The bucket's REST endpoint, which is what a CloudFront origin
+         * points at.
          */
-        this.response = Schema();
+        this.response = Schema({
+            Arn: 'arn:aws:s3:::mock-website-bucket',
+            awsRegionId: 'us-east-1',
+            RegionalDomainName: 'mock-website-bucket.s3.us-east-1.amazonaws.com',
+        });
+        this.sourcePathDigests = Schema({});
     }
 }
 __decorate([
@@ -64,6 +103,9 @@ __decorate([
             if (value.awsRegionId) {
                 subjects.push(value.awsRegionId);
             }
+            if (value.RegionalDomainName) {
+                subjects.push(value.RegionalDomainName);
+            }
             return subjects;
         },
         options: { minLength: 1 },

package/dist/resources/s3-website/index.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/s3-website/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IAAvD;;QACE;;;;;;;WAOG;QAWM,eAAU,GAAG,MAAM,EAMxB,CAAC;QAEL;;;;WAIG;QAcM,aAAQ,GAAG,MAAM,EAGtB,CAAC;IACP,CAAC;CAAA;AA9BU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAoC,EAAY,EAAE,CAAC;YAC5D,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,aAAa;SACpB;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;mDAOG;AAoBI;IAbR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE;YACzD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDAIG"}
+{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/s3-website/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,kBAAkB;IAAjE;;QAWW,aAAQ,GAAG,MAAM,CAEvB;YACD,GAAG,EAAE,6DAA6D;SACnE,CAAC,CAAC;IACL,CAAC;CAAA;AALU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA4C,EAAY,EAAE;YACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;2DAKC;AAGL;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IAAvD;;QACE;;;;;;;;;;;;WAYG;QAWM,eAAU,GAAG,MAAM,EAOxB,CAAC;QAEL;;;;;;WAMG;QAiBM,aAAQ,GAAG,MAAM,CAIvB;YACD,GAAG,EAAE,kCAAkC;YACvC,WAAW,EAAE,WAAW;YACxB,kBAAkB,EAAE,gDAAgD;SACrE,CAAC,CAAC;QAEH,sBAAiB,GAAG,MAAM,CAAmC,EAAE,CAAC,CAAC;IACnE,CAAC;CAAA;AA3CU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAoC,EAAY,EAAE,CAAC;YAC5D,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,aAAa;SACpB;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;mDAQG;AAyBI;IAhBR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE;YACzD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDASC"}

package/dist/resources/s3-website/s3-website.resource.d.ts

@@ -1,21 +1,67 @@
-import { AResource, Diff } from '@quadnix/octo';
-import { S3WebsiteSchema } from './index.schema.js';
+import { AResource, ATerraformResource, type BaseResourceSchema, Diff, type MatchingResource, type TerraformModuleScope } from '@quadnix/octo';
+import { S3WebsiteSchema, type WebsiteDistributionSchema } from './index.schema.js';
 /**
  * @internal
  */
-export type S3WebsiteManifestDiff = {
-    [key: string]: ['add' | 'delete' | 'update', string];
+type IManifest = {
+    [key: string]: {
+        algorithm: 'sha1';
+        digest: string | 'deleted';
+        filePath: string;
+    };
 };
 /**
  * @internal
  */
-export declare class S3Website extends AResource<S3WebsiteSchema, S3Website> {
+export declare class S3Website extends ATerraformResource<S3WebsiteSchema, S3Website> {
+    parents: MatchingResource<WebsiteDistributionSchema>[];
     properties: S3WebsiteSchema['properties'];
     response: S3WebsiteSchema['response'];
-    private readonly manifestDiff;
-    constructor(resourceId: string, properties: S3WebsiteSchema['properties']);
-    diffInverse(diff: Diff, deReferenceResource: (resourceId: string) => Promise<never>): Promise<void>;
+    private readonly manifest;
+    private sourcePathDigests;
+    /**
+     * @internal
+     */
+    constructor(resourceId: string, properties: S3WebsiteSchema['properties'], parents?: MatchingResource<WebsiteDistributionSchema>[]);
+    /**
+     * @internal
+     */
+    static unSynth<S extends BaseResourceSchema, T>(deserializationClass: any, resource: S, deReferenceResource: (context: string) => Promise<AResource<BaseResourceSchema, any>>): Promise<T>;
+    /**
+     * Admits one CloudFront distribution to this bucket.
+     *
+     * The grant is a statement in the policy this bucket already owns, rather than a policy of the
+     * distribution's own: `aws_s3_bucket_policy` writes a bucket's whole policy, so two of them
+     * pointed at one bucket would take turns overwriting each other. Adding a statement leaves every
+     * other statement alone, and dropping a distribution drops only its own.
+     *
+     * The statement names the distribution by ARN, which AWS assigns, so this bucket becomes the
+     * distribution's child and reads it as a reference. The distribution does not reference the bucket
+     * back - it writes this bucket's hostname down instead - because two folders referencing each
+     * other is a cycle terragrunt cannot order.
+     *
+     * @internal
+     */
+    addCloudFrontAccess(distribution: MatchingResource<WebsiteDistributionSchema>): void;
+    /**
+     * @internal
+     */
     diffProperties(previous: S3Website): Promise<Diff[]>;
+    /**
+     * @internal
+     */
     diffUnpack(diff: Diff): Diff[];
-    updateManifestDiff(manifestDiff: S3WebsiteManifestDiff): void;
+    /**
+     * @internal
+     */
+    synth(): S3WebsiteSchema;
+    /**
+     * @internal
+     */
+    toHCL(terraform: TerraformModuleScope): Promise<void>;
+    /**
+     * @internal
+     */
+    updateManifest(manifestDiff: IManifest): void;
 }
+export {};

package/dist/resources/s3-website/s3-website.resource.js

@@ -7,46 +7,85 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { AResource, Diff, DiffAction, DiffUtility, Resource, ResourceError, } from '@quadnix/octo';
+import { AResource, ATerraformResource, Diff, DiffAction, DiffUtility, Resource, } from '@quadnix/octo';
+import mime from 'mime';
+import { PolicyUtility } from '../../utilities/policy/policy.utility.js';
 import { S3WebsiteSchema } from './index.schema.js';
 /**
  * @internal
  */
-let S3Website = class S3Website extends AResource {
-    constructor(resourceId, properties) {
-        super(resourceId, properties, []);
-        this.manifestDiff = {};
+let S3Website = class S3Website extends ATerraformResource {
+    /**
+     * @internal
+     */
+    constructor(resourceId, properties, parents = []) {
+        super(resourceId, properties, parents);
+        this.manifest = {};
+        this.sourcePathDigests = {};
     }
-    async diffInverse(diff, deReferenceResource) {
-        if (diff.field === 'update-source-paths' && diff.action === DiffAction.UPDATE) {
-            // do nothing, since nothing in node changes for this diff action.
-        }
-        else {
-            await super.diffInverse(diff, deReferenceResource);
+    /**
+     * @internal
+     */
+    static async unSynth(deserializationClass, resource, deReferenceResource) {
+        const s3Website = (await super.unSynth(deserializationClass, resource, deReferenceResource));
+        const digests = resource.sourcePathDigests;
+        s3Website.sourcePathDigests = digests ? { ...digests } : {};
+        return s3Website;
+    }
+    /**
+     * Admits one CloudFront distribution to this bucket.
+     *
+     * The grant is a statement in the policy this bucket already owns, rather than a policy of the
+     * distribution's own: `aws_s3_bucket_policy` writes a bucket's whole policy, so two of them
+     * pointed at one bucket would take turns overwriting each other. Adding a statement leaves every
+     * other statement alone, and dropping a distribution drops only its own.
+     *
+     * The statement names the distribution by ARN, which AWS assigns, so this bucket becomes the
+     * distribution's child and reads it as a reference. The distribution does not reference the bucket
+     * back - it writes this bucket's hostname down instead - because two folders referencing each
+     * other is a cycle terragrunt cannot order.
+     *
+     * @internal
+     */
+    addCloudFrontAccess(distribution) {
+        const distributionResourceId = distribution.getActual().resourceId;
+        if (this.properties.distributionResourceIds.includes(distributionResourceId)) {
+            return;
         }
+        const { childToParentDependency, parentToChildDependency } = distribution.addChild('resourceId', this, 'resourceId');
+        childToParentDependency.addBehavior('update-cloudfront-access', DiffAction.UPDATE, 'resourceId', DiffAction.ADD);
+        parentToChildDependency.addBehavior('resourceId', DiffAction.DELETE, 'update-cloudfront-access', DiffAction.UPDATE);
+        this.properties.distributionResourceIds.push(distributionResourceId);
     }
+    /**
+     * @internal
+     */
     async diffProperties(previous) {
-        if (!DiffUtility.isObjectDeepEquals(previous.properties, this.properties)) {
-            throw new ResourceError('Cannot update S3 Website immutable properties once it has been created!', this);
+        if (!DiffUtility.isObjectDeepEquals(previous.properties, this.properties, ['distributionResourceIds'])) {
+            return [
+                new Diff(this, DiffAction.REPLACE, 'resourceId', this.getContext(), 'Bucket is force-new on aws_s3_bucket; a change recreates the bucket'),
+            ];
         }
         const diffs = [];
-        if (this.manifestDiff && Object.keys(this.manifestDiff).length > 0) {
-            diffs.push(new Diff(this, DiffAction.UPDATE, 'update-source-paths', JSON.parse(JSON.stringify(this.manifestDiff))));
+        // Putting a distribution in front of the bucket, or taking one away, rewrites how the bucket is
+        // reached and who may read it, without touching the bucket itself.
+        if (!DiffUtility.isObjectDeepEquals({ distributionResourceIds: [...previous.properties.distributionResourceIds].sort() }, { distributionResourceIds: [...this.properties.distributionResourceIds].sort() })) {
+            diffs.push(new Diff(this, DiffAction.UPDATE, 'update-cloudfront-access', [...this.properties.distributionResourceIds]));
+        }
+        // Only propose a content update when the digests differ from what was last committed.
+        if (!DiffUtility.isObjectDeepEquals(previous.sourcePathDigests, this.sourcePathDigests)) {
+            diffs.push(new Diff(this, DiffAction.UPDATE, 'update-source-paths', JSON.parse(JSON.stringify(this.manifest))));
         }
         return diffs;
     }
+    /**
+     * @internal
+     */
     diffUnpack(diff) {
         if (diff.action === DiffAction.ADD && diff.field === 'resourceId') {
             const diffs = [diff];
-            if (this.manifestDiff && Object.keys(this.manifestDiff).length > 0) {
-                diffs.push(new Diff(this, DiffAction.UPDATE, 'update-source-paths', JSON.parse(JSON.stringify(this.manifestDiff))));
-            }
-            if (this.tags && Object.keys(this.tags).length > 0) {
-                diffs.push(new Diff(this, DiffAction.UPDATE, 'tags', {
-                    add: JSON.parse(JSON.stringify(this.tags)),
-                    delete: [],
-                    update: {},
-                }));
+            if (this.manifest && Object.keys(this.manifest).length > 0) {
+                diffs.push(new Diff(this, DiffAction.UPDATE, 'update-source-paths', JSON.parse(JSON.stringify(this.manifest))));
             }
             return diffs;
         }
@@ -54,15 +93,117 @@ let S3Website = class S3Website extends AResource {
             return [diff];
         }
     }
-    updateManifestDiff(manifestDiff) {
+    /**
+     * @internal
+     */
+    synth() {
+        return {
+            ...super.synth(),
+            sourcePathDigests: JSON.parse(JSON.stringify(this.sourcePathDigests)),
+        };
+    }
+    /**
+     * @internal
+     */
+    async toHCL(terraform) {
+        const s3WebsiteOctoResource = terraform.addOctoTerraformResource(this, {
+            provider: { accountId: this.properties.awsAccountId, regionId: this.properties.awsRegionId },
+        });
+        const s3WebsiteTFResource = s3WebsiteOctoResource.addTerraformResource('aws_s3_bucket', `${this.resourceId}_website_bucket`, { bucket: this.properties.Bucket });
+        s3WebsiteOctoResource.output({
+            Arn: terraform.raw(`${s3WebsiteTFResource.address}.arn`),
+            awsRegionId: this.properties.awsRegionId,
+            RegionalDomainName: terraform.raw(`${s3WebsiteTFResource.address}.bucket_regional_domain_name`),
+        });
+        // A bucket with nothing in front of it is reached directly, and a bucket with a distribution in
+        // front of it is reached through that. There is no third way, and no separate input saying so.
+        const isPublic = this.properties.distributionResourceIds.length === 0;
+        // A website endpoint is reachable only over plain HTTP and only from a public bucket, so it is
+        // emitted for a public bucket alone. Behind a distribution the same two documents are served
+        // through its root object and error responses.
+        if (isPublic) {
+            s3WebsiteOctoResource.addTerraformResource('aws_s3_bucket_website_configuration', `${this.resourceId}_website_bucket_config`, {
+                bucket: terraform.raw(`${s3WebsiteTFResource.address}.id`),
+                error_document: { key: this.properties.ErrorDocument },
+                index_document: { suffix: this.properties.IndexDocument },
+            });
+        }
+        s3WebsiteOctoResource.addTerraformResource('aws_s3_bucket_public_access_block', `${this.resourceId}_website_bucket_public_access`, {
+            block_public_acls: !isPublic,
+            block_public_policy: !isPublic,
+            bucket: terraform.raw(`${s3WebsiteTFResource.address}.id`),
+            ignore_public_acls: !isPublic,
+            restrict_public_buckets: !isPublic,
+        });
+        // One policy, whatever is reading the bucket. A public bucket is one anonymous statement; a
+        // closed one is a statement per distribution, each naming that distribution alone, so no other
+        // distribution can read the bucket by pointing at it.
+        const statements = isPublic
+            ? [
+                {
+                    Action: ['s3:GetObject'],
+                    Effect: 'Allow',
+                    Principal: '*',
+                    Resource: [terraform.raw(`"\${${s3WebsiteTFResource.address}.arn}/*"`)],
+                    Sid: PolicyUtility.getSafeSid('PublicReadGetObject'),
+                },
+            ]
+            : this.properties.distributionResourceIds.map((distributionResourceId) => {
+                const distribution = this.parents.find((p) => p.getActual().resourceId === distributionResourceId);
+                return {
+                    Action: ['s3:GetObject'],
+                    Condition: {
+                        StringEquals: {
+                            'AWS:SourceArn': terraform.getRef(distribution, 'Arn'),
+                        },
+                    },
+                    Effect: 'Allow',
+                    Principal: { Service: 'cloudfront.amazonaws.com' },
+                    Resource: [terraform.raw(`"\${${s3WebsiteTFResource.address}.arn}/*"`)],
+                    Sid: PolicyUtility.getSafeSid(`AllowCloudFrontRead-${distributionResourceId}`),
+                };
+            });
+        s3WebsiteOctoResource.addTerraformResource('aws_s3_bucket_policy', `${this.resourceId}_website_bucket_policy`, {
+            bucket: terraform.raw(`${s3WebsiteTFResource.address}.id`),
+            policy: terraform.jsonencode({ Statement: statements, Version: '2012-10-17' }),
+        });
+        for (const [remotePath, { digest, filePath }] of Object.entries(this.manifest)) {
+            if (digest === 'deleted') {
+                continue;
+            }
+            const safeLabel = PolicyUtility.getSafeSid(remotePath);
+            const contentType = mime.getType(remotePath) ?? 'application/octet-stream';
+            const sourceHcl = terraform.localPath(filePath);
+            s3WebsiteOctoResource.addTerraformResource('aws_s3_object', `${this.resourceId}_file_${safeLabel}`, {
+                bucket: terraform.raw(`${s3WebsiteTFResource.address}.id`),
+                content_type: contentType,
+                etag: terraform.raw(`filemd5(${sourceHcl})`),
+                key: remotePath,
+                source: terraform.raw(sourceHcl),
+            });
+        }
+        if (Object.keys(this.tags).length > 0) {
+            s3WebsiteTFResource.attribute('tags', this.tags);
+        }
+    }
+    /**
+     * @internal
+     */
+    updateManifest(manifestDiff) {
         for (const key of Object.keys(manifestDiff)) {
-            this.manifestDiff[key] = [...manifestDiff[key]];
+            this.manifest[key] = { ...manifestDiff[key] };
+            if (manifestDiff[key].digest === 'deleted') {
+                delete this.sourcePathDigests[key];
+            }
+            else {
+                this.sourcePathDigests[key] = manifestDiff[key].digest;
+            }
         }
     }
 };
 S3Website = __decorate([
     Resource('@octo', 's3-website', S3WebsiteSchema),
-    __metadata("design:paramtypes", [String, Object])
+    __metadata("design:paramtypes", [String, Object, Array])
 ], S3Website);
 export { S3Website };
 //# sourceMappingURL=s3-website.resource.js.map