@quadnix/octo-aws-cdk 0.1.0 → 0.2.0

package/dist/resources/cloudfront-invalidation/index.schema.js

@@ -0,0 +1,110 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseResourceSchema, Schema, Validate } from '@quadnix/octo';
+/**
+ * The distribution an invalidation is issued against. Structural, so any resource publishing a
+ * distribution id satisfies it.
+ *
+ * @internal
+ */
+export class InvalidationDistributionSchema extends BaseResourceSchema {
+    constructor() {
+        super(...arguments);
+        this.response = Schema({
+            DistributionId: 'E000000000000',
+        });
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => {
+            const subjects = [];
+            if (value.DistributionId) {
+                subjects.push(value.DistributionId);
+            }
+            return subjects;
+        },
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], InvalidationDistributionSchema.prototype, "response", void 0);
+/**
+ * The `CloudFrontInvalidationSchema` class is the schema for the `CloudFrontInvalidation` resource,
+ * which drops what CloudFront's edge locations are holding for a distribution.
+ *
+ * Terraform provisions no part of it. There is no managed resource in the AWS provider for an
+ * invalidation, because an invalidation is not a thing that exists - it is a call that runs and
+ * finishes. So this is an external resource: octo issues `CreateInvalidation` itself, through the
+ * `octo run-action` callback terraform makes mid-apply.
+ *
+ * It exists because the alternative is silent. A distribution serving a bucket caches an object for
+ * as long as its cache policy says, which for `Managed-CachingOptimized` is a day, and an S3 object
+ * carries no `Cache-Control` of its own. Without this, uploading a new version of a site reports
+ * success and changes nothing a visitor can see until the next day.
+ *
+ * @group Resources/CloudFrontInvalidation
+ *
+ * @hideconstructor
+ *
+ * @overrideProperty parents - The distribution whose edge caches are dropped.
+ * ```mermaid
+ * graph TD;
+ *   cloudfront_distribution((CloudFront<br>Distribution)) --> cloudfront_invalidation((CloudFront<br>Invalidation))
+ * ```
+ * @overrideProperty resourceId - The resource id is of format `cloudfront-invalidation-<distribution-name>`.
+ */
+export class CloudFrontInvalidationSchema extends BaseResourceSchema {
+    constructor() {
+        super(...arguments);
+        /**
+         * Input properties.
+         * * `properties.awsAccountId` - The AWS account id.
+         * * `properties.contentVersion` - What the distribution is currently serving. It is not read by
+         * the call; it is the whole trigger. Octo re-runs this resource when this value moves, and does
+         * nothing when it does not, so whoever owns the content decides when an invalidation happens by
+         * deciding what this says. A digest over the published files is the usual answer.
+         * * `properties.paths` - The paths to drop, e.g. `/*`. AWS bills per path beyond the first
+         * thousand a month, and `/*` counts as one.
+         */
+        this.properties = Schema();
+        /**
+         * Saved response.
+         * * `response.InvalidationId` - The id AWS assigned the invalidation that ran.
+         */
+        this.response = Schema({
+            InvalidationId: 'I000000000000',
+        });
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => [
+            value.awsAccountId,
+            value.contentVersion,
+            ...value.paths,
+        ],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontInvalidationSchema.prototype, "properties", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => {
+            const subjects = [];
+            if (value.InvalidationId) {
+                subjects.push(value.InvalidationId);
+            }
+            return subjects;
+        },
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontInvalidationSchema.prototype, "response", void 0);
+//# sourceMappingURL=index.schema.js.map

package/dist/resources/cloudfront-invalidation/index.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/cloudfront-invalidation/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,kBAAkB;IAAtE;;QAWW,aAAQ,GAAG,MAAM,CAEvB;YACD,cAAc,EAAE,eAAe;SAChC,CAAC,CAAC;IACL,CAAC;CAAA;AALU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAiD,EAAY,EAAE;YACxE,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;gEAKC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,4BAA6B,SAAQ,kBAAkB;IAApE;;QACE;;;;;;;;;WASG;QASM,eAAU,GAAG,MAAM,EAIxB,CAAC;QAEL;;;WAGG;QAWM,aAAQ,GAAG,MAAM,CAEvB;YACD,cAAc,EAAE,eAAe;SAChC,CAAC,CAAC;IACL,CAAC;CAAA;AAzBU;IARR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAiD,EAAY,EAAE,CAAC;YACzE,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,cAAc;YACpB,GAAG,KAAK,CAAC,KAAK;SACf;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;gEAKG;AAgBI;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA+C,EAAY,EAAE;YACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;8DAKC"}

package/dist/resources/s3-website/index.schema.d.ts

@@ -1,4 +1,15 @@
 import { BaseResourceSchema } from '@quadnix/octo';
+/**
+ * A CloudFront distribution this bucket serves. Structural, so the bucket never has to know what
+ * kind of resource is in front of it - only that it publishes an ARN to name in a policy.
+ *
+ * @internal
+ */
+export declare class WebsiteDistributionSchema extends BaseResourceSchema {
+    response: {
+        Arn?: string;
+    };
+}
 /**
  * The `S3WebsiteSchema` class is the schema for the `S3Website` resource,
  * which represents the AWS Simple Storage Service (S3) Website resource.
@@ -20,11 +31,17 @@ export declare class S3WebsiteSchema extends BaseResourceSchema {
      * * `properties.Bucket` - The name of the bucket.
      * * `properties.ErrorDocument` - Path of the error document, e.g. `error.html`.
      * * `properties.IndexDocument` - Path of the index document, e.g. `index.html`.
+     * * `properties.distributionResourceIds` - The distributions allowed to read this bucket, each
+     * granted one statement in the policy below. It is also what decides how the bucket is reached:
+     * empty leaves the bucket public on its S3 website endpoint, over plain HTTP, and anything else
+     * closes it so that the distributions in front of it are the only way in. Two facts would
+     * disagree eventually, so there is only this one.
      */
     properties: {
         awsAccountId: string;
         awsRegionId: string;
         Bucket: string;
+        distributionResourceIds: string[];
         ErrorDocument: string;
         IndexDocument: string;
     };
@@ -32,10 +49,13 @@ export declare class S3WebsiteSchema extends BaseResourceSchema {
      * Saved response.
      * * `response.Arn` - The ARN of the bucket.
      * * `response.awsRegionId` - The AWS region id.
+     * * `response.RegionalDomainName` - The bucket's REST endpoint, which is what a CloudFront origin
+     * points at.
      */
     response: {
         Arn?: string;
         awsRegionId?: string;
+        RegionalDomainName?: string;
     };
     sourcePathDigests: {
         [remotePath: string]: string;

package/dist/resources/s3-website/index.schema.js

@@ -8,6 +8,33 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { BaseResourceSchema, Schema, Validate } from '@quadnix/octo';
+/**
+ * A CloudFront distribution this bucket serves. Structural, so the bucket never has to know what
+ * kind of resource is in front of it - only that it publishes an ARN to name in a policy.
+ *
+ * @internal
+ */
+export class WebsiteDistributionSchema extends BaseResourceSchema {
+    constructor() {
+        super(...arguments);
+        this.response = Schema({
+            Arn: 'arn:aws:cloudfront::000000000000:distribution/E000000000000',
+        });
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => {
+            const subjects = [];
+            if (value.Arn) {
+                subjects.push(value.Arn);
+            }
+            return subjects;
+        },
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], WebsiteDistributionSchema.prototype, "response", void 0);
 /**
  * The `S3WebsiteSchema` class is the schema for the `S3Website` resource,
  * which represents the AWS Simple Storage Service (S3) Website resource.
@@ -31,16 +58,24 @@ export class S3WebsiteSchema extends BaseResourceSchema {
          * * `properties.Bucket` - The name of the bucket.
          * * `properties.ErrorDocument` - Path of the error document, e.g. `error.html`.
          * * `properties.IndexDocument` - Path of the index document, e.g. `index.html`.
+         * * `properties.distributionResourceIds` - The distributions allowed to read this bucket, each
+         * granted one statement in the policy below. It is also what decides how the bucket is reached:
+         * empty leaves the bucket public on its S3 website endpoint, over plain HTTP, and anything else
+         * closes it so that the distributions in front of it are the only way in. Two facts would
+         * disagree eventually, so there is only this one.
          */
         this.properties = Schema();
         /**
          * Saved response.
          * * `response.Arn` - The ARN of the bucket.
          * * `response.awsRegionId` - The AWS region id.
+         * * `response.RegionalDomainName` - The bucket's REST endpoint, which is what a CloudFront origin
+         * points at.
          */
         this.response = Schema({
             Arn: 'arn:aws:s3:::mock-website-bucket',
             awsRegionId: 'us-east-1',
+            RegionalDomainName: 'mock-website-bucket.s3.us-east-1.amazonaws.com',
         });
         this.sourcePathDigests = Schema({});
     }
@@ -68,6 +103,9 @@ __decorate([
             if (value.awsRegionId) {
                 subjects.push(value.awsRegionId);
             }
+            if (value.RegionalDomainName) {
+                subjects.push(value.RegionalDomainName);
+            }
             return subjects;
         },
         options: { minLength: 1 },

package/dist/resources/s3-website/index.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/s3-website/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IAAvD;;QACE;;;;;;;WAOG;QAWM,eAAU,GAAG,MAAM,EAMxB,CAAC;QAEL;;;;WAIG;QAcM,aAAQ,GAAG,MAAM,CAGvB;YACD,GAAG,EAAE,kCAAkC;YACvC,WAAW,EAAE,WAAW;SACzB,CAAC,CAAC;QAEH,sBAAiB,GAAG,MAAM,CAAmC,EAAE,CAAC,CAAC;IACnE,CAAC;CAAA;AAnCU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAoC,EAAY,EAAE,CAAC;YAC5D,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,aAAa;SACpB;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;mDAOG;AAoBI;IAbR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE;YACzD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDAOC"}
+{"version":3,"file":"index.schema.js","sourceRoot":"","sources":["../../../src/resources/s3-website/index.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAErE;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,kBAAkB;IAAjE;;QAWW,aAAQ,GAAG,MAAM,CAEvB;YACD,GAAG,EAAE,6DAA6D;SACnE,CAAC,CAAC;IACL,CAAC;CAAA;AALU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA4C,EAAY,EAAE;YACnE,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;2DAKC;AAGL;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IAAvD;;QACE;;;;;;;;;;;;WAYG;QAWM,eAAU,GAAG,MAAM,EAOxB,CAAC;QAEL;;;;;;WAMG;QAiBM,aAAQ,GAAG,MAAM,CAIvB;YACD,GAAG,EAAE,kCAAkC;YACvC,WAAW,EAAE,WAAW;YACxB,kBAAkB,EAAE,gDAAgD;SACrE,CAAC,CAAC;QAEH,sBAAiB,GAAG,MAAM,CAAmC,EAAE,CAAC,CAAC;IACnE,CAAC;CAAA;AA3CU;IAVR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAoC,EAAY,EAAE,CAAC;YAC5D,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,aAAa;SACpB;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;mDAQG;AAyBI;IAhBR,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAkC,EAAY,EAAE;YACzD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;iDASC"}

package/dist/resources/s3-website/s3-website.resource.d.ts

@@ -1,5 +1,5 @@
-import { AResource, ATerraformResource, type BaseResourceSchema, Diff, type TerraformModuleScope } from '@quadnix/octo';
-import { S3WebsiteSchema } from './index.schema.js';
+import { AResource, ATerraformResource, type BaseResourceSchema, Diff, type MatchingResource, type TerraformModuleScope } from '@quadnix/octo';
+import { S3WebsiteSchema, type WebsiteDistributionSchema } from './index.schema.js';
 /**
  * @internal
  */
@@ -14,6 +14,7 @@ type IManifest = {
  * @internal
  */
 export declare class S3Website extends ATerraformResource<S3WebsiteSchema, S3Website> {
+    parents: MatchingResource<WebsiteDistributionSchema>[];
     properties: S3WebsiteSchema['properties'];
     response: S3WebsiteSchema['response'];
     private readonly manifest;
@@ -21,11 +22,27 @@ export declare class S3Website extends ATerraformResource<S3WebsiteSchema, S3Web
     /**
      * @internal
      */
-    constructor(resourceId: string, properties: S3WebsiteSchema['properties']);
+    constructor(resourceId: string, properties: S3WebsiteSchema['properties'], parents?: MatchingResource<WebsiteDistributionSchema>[]);
     /**
      * @internal
      */
     static unSynth<S extends BaseResourceSchema, T>(deserializationClass: any, resource: S, deReferenceResource: (context: string) => Promise<AResource<BaseResourceSchema, any>>): Promise<T>;
+    /**
+     * Admits one CloudFront distribution to this bucket.
+     *
+     * The grant is a statement in the policy this bucket already owns, rather than a policy of the
+     * distribution's own: `aws_s3_bucket_policy` writes a bucket's whole policy, so two of them
+     * pointed at one bucket would take turns overwriting each other. Adding a statement leaves every
+     * other statement alone, and dropping a distribution drops only its own.
+     *
+     * The statement names the distribution by ARN, which AWS assigns, so this bucket becomes the
+     * distribution's child and reads it as a reference. The distribution does not reference the bucket
+     * back - it writes this bucket's hostname down instead - because two folders referencing each
+     * other is a cycle terragrunt cannot order.
+     *
+     * @internal
+     */
+    addCloudFrontAccess(distribution: MatchingResource<WebsiteDistributionSchema>): void;
     /**
      * @internal
      */

package/dist/resources/s3-website/s3-website.resource.js

@@ -18,8 +18,8 @@ let S3Website = class S3Website extends ATerraformResource {
     /**
      * @internal
      */
-    constructor(resourceId, properties) {
-        super(resourceId, properties, []);
+    constructor(resourceId, properties, parents = []) {
+        super(resourceId, properties, parents);
         this.manifest = {};
         this.sourcePathDigests = {};
     }
@@ -32,16 +32,46 @@ let S3Website = class S3Website extends ATerraformResource {
         s3Website.sourcePathDigests = digests ? { ...digests } : {};
         return s3Website;
     }
+    /**
+     * Admits one CloudFront distribution to this bucket.
+     *
+     * The grant is a statement in the policy this bucket already owns, rather than a policy of the
+     * distribution's own: `aws_s3_bucket_policy` writes a bucket's whole policy, so two of them
+     * pointed at one bucket would take turns overwriting each other. Adding a statement leaves every
+     * other statement alone, and dropping a distribution drops only its own.
+     *
+     * The statement names the distribution by ARN, which AWS assigns, so this bucket becomes the
+     * distribution's child and reads it as a reference. The distribution does not reference the bucket
+     * back - it writes this bucket's hostname down instead - because two folders referencing each
+     * other is a cycle terragrunt cannot order.
+     *
+     * @internal
+     */
+    addCloudFrontAccess(distribution) {
+        const distributionResourceId = distribution.getActual().resourceId;
+        if (this.properties.distributionResourceIds.includes(distributionResourceId)) {
+            return;
+        }
+        const { childToParentDependency, parentToChildDependency } = distribution.addChild('resourceId', this, 'resourceId');
+        childToParentDependency.addBehavior('update-cloudfront-access', DiffAction.UPDATE, 'resourceId', DiffAction.ADD);
+        parentToChildDependency.addBehavior('resourceId', DiffAction.DELETE, 'update-cloudfront-access', DiffAction.UPDATE);
+        this.properties.distributionResourceIds.push(distributionResourceId);
+    }
     /**
      * @internal
      */
     async diffProperties(previous) {
-        if (!DiffUtility.isObjectDeepEquals(previous.properties, this.properties)) {
+        if (!DiffUtility.isObjectDeepEquals(previous.properties, this.properties, ['distributionResourceIds'])) {
             return [
                 new Diff(this, DiffAction.REPLACE, 'resourceId', this.getContext(), 'Bucket is force-new on aws_s3_bucket; a change recreates the bucket'),
             ];
         }
         const diffs = [];
+        // Putting a distribution in front of the bucket, or taking one away, rewrites how the bucket is
+        // reached and who may read it, without touching the bucket itself.
+        if (!DiffUtility.isObjectDeepEquals({ distributionResourceIds: [...previous.properties.distributionResourceIds].sort() }, { distributionResourceIds: [...this.properties.distributionResourceIds].sort() })) {
+            diffs.push(new Diff(this, DiffAction.UPDATE, 'update-cloudfront-access', [...this.properties.distributionResourceIds]));
+        }
         // Only propose a content update when the digests differ from what was last committed.
         if (!DiffUtility.isObjectDeepEquals(previous.sourcePathDigests, this.sourcePathDigests)) {
             diffs.push(new Diff(this, DiffAction.UPDATE, 'update-source-paths', JSON.parse(JSON.stringify(this.manifest))));
@@ -83,33 +113,59 @@ let S3Website = class S3Website extends ATerraformResource {
         s3WebsiteOctoResource.output({
             Arn: terraform.raw(`${s3WebsiteTFResource.address}.arn`),
             awsRegionId: this.properties.awsRegionId,
+            RegionalDomainName: terraform.raw(`${s3WebsiteTFResource.address}.bucket_regional_domain_name`),
         });
-        s3WebsiteOctoResource.addTerraformResource('aws_s3_bucket_website_configuration', `${this.resourceId}_website_bucket_config`, {
-            bucket: terraform.raw(`${s3WebsiteTFResource.address}.id`),
-            error_document: { key: this.properties.ErrorDocument },
-            index_document: { suffix: this.properties.IndexDocument },
-        });
+        // A bucket with nothing in front of it is reached directly, and a bucket with a distribution in
+        // front of it is reached through that. There is no third way, and no separate input saying so.
+        const isPublic = this.properties.distributionResourceIds.length === 0;
+        // A website endpoint is reachable only over plain HTTP and only from a public bucket, so it is
+        // emitted for a public bucket alone. Behind a distribution the same two documents are served
+        // through its root object and error responses.
+        if (isPublic) {
+            s3WebsiteOctoResource.addTerraformResource('aws_s3_bucket_website_configuration', `${this.resourceId}_website_bucket_config`, {
+                bucket: terraform.raw(`${s3WebsiteTFResource.address}.id`),
+                error_document: { key: this.properties.ErrorDocument },
+                index_document: { suffix: this.properties.IndexDocument },
+            });
+        }
         s3WebsiteOctoResource.addTerraformResource('aws_s3_bucket_public_access_block', `${this.resourceId}_website_bucket_public_access`, {
-            block_public_acls: false,
-            block_public_policy: false,
+            block_public_acls: !isPublic,
+            block_public_policy: !isPublic,
             bucket: terraform.raw(`${s3WebsiteTFResource.address}.id`),
-            ignore_public_acls: false,
-            restrict_public_buckets: false,
+            ignore_public_acls: !isPublic,
+            restrict_public_buckets: !isPublic,
         });
-        s3WebsiteOctoResource.addTerraformResource('aws_s3_bucket_policy', `${this.resourceId}_website_bucket_public_read_policy`, {
-            bucket: terraform.raw(`${s3WebsiteTFResource.address}.id`),
-            policy: terraform.jsonencode({
-                Statement: [
-                    {
-                        Action: ['s3:GetObject'],
-                        Effect: 'Allow',
-                        Principal: '*',
-                        Resource: [terraform.raw(`"\${${s3WebsiteTFResource.address}.arn}/*"`)],
-                        Sid: PolicyUtility.getSafeSid('PublicReadGetObject'),
+        // One policy, whatever is reading the bucket. A public bucket is one anonymous statement; a
+        // closed one is a statement per distribution, each naming that distribution alone, so no other
+        // distribution can read the bucket by pointing at it.
+        const statements = isPublic
+            ? [
+                {
+                    Action: ['s3:GetObject'],
+                    Effect: 'Allow',
+                    Principal: '*',
+                    Resource: [terraform.raw(`"\${${s3WebsiteTFResource.address}.arn}/*"`)],
+                    Sid: PolicyUtility.getSafeSid('PublicReadGetObject'),
+                },
+            ]
+            : this.properties.distributionResourceIds.map((distributionResourceId) => {
+                const distribution = this.parents.find((p) => p.getActual().resourceId === distributionResourceId);
+                return {
+                    Action: ['s3:GetObject'],
+                    Condition: {
+                        StringEquals: {
+                            'AWS:SourceArn': terraform.getRef(distribution, 'Arn'),
+                        },
                     },
-                ],
-                Version: '2012-10-17',
-            }),
+                    Effect: 'Allow',
+                    Principal: { Service: 'cloudfront.amazonaws.com' },
+                    Resource: [terraform.raw(`"\${${s3WebsiteTFResource.address}.arn}/*"`)],
+                    Sid: PolicyUtility.getSafeSid(`AllowCloudFrontRead-${distributionResourceId}`),
+                };
+            });
+        s3WebsiteOctoResource.addTerraformResource('aws_s3_bucket_policy', `${this.resourceId}_website_bucket_policy`, {
+            bucket: terraform.raw(`${s3WebsiteTFResource.address}.id`),
+            policy: terraform.jsonencode({ Statement: statements, Version: '2012-10-17' }),
         });
         for (const [remotePath, { digest, filePath }] of Object.entries(this.manifest)) {
             if (digest === 'deleted') {
@@ -147,7 +203,7 @@ let S3Website = class S3Website extends ATerraformResource {
 };
 S3Website = __decorate([
     Resource('@octo', 's3-website', S3WebsiteSchema),
-    __metadata("design:paramtypes", [String, Object])
+    __metadata("design:paramtypes", [String, Object, Array])
 ], S3Website);
 export { S3Website };
 //# sourceMappingURL=s3-website.resource.js.map

package/dist/resources/s3-website/s3-website.resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"s3-website.resource.js","sourceRoot":"","sources":["../../../src/resources/s3-website/s3-website.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,SAAS,EACT,kBAAkB,EAElB,IAAI,EACJ,UAAU,EACV,WAAW,EACX,QAAQ,GAET,MAAM,eAAe,CAAC;AACvB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAOpD;;GAEG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,kBAA8C;IAO3E;;OAEG;IACH,YAAY,UAAkB,EAAE,UAAyC;QACvE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QARnB,aAAQ,GAAc,EAAE,CAAC;QAElC,sBAAiB,GAAyC,EAAE,CAAC;IAOrE,CAAC;IAED;;OAEG;IACH,MAAM,CAAU,KAAK,CAAC,OAAO,CAC3B,oBAAyB,EACzB,QAAW,EACX,mBAAqF;QAErF,MAAM,SAAS,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAc,CAAC;QAC1G,MAAM,OAAO,GAAI,QAAuC,CAAC,iBAAiB,CAAC;QAC3E,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,SAAc,CAAC;IACxB,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,cAAc,CAAC,QAAmB;QAC/C,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,qEAAqE,CACtE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,sFAAsF;QACtF,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxF,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,MAAM,EACjB,qBAAqB,EACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAC1C,CACF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACM,UAAU,CAAC,IAAU;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;YAE7B,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,MAAM,EACjB,qBAAqB,EACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAC1C,CACF,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK;QACZ,OAAO;YACL,GAAG,KAAK,CAAC,KAAK,EAAE;YAChB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,qBAAqB,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAiB,EAAE;YAClF,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;SAC7F,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,oBAAoB,CACpE,eAAe,EACf,GAAG,IAAI,CAAC,UAAU,iBAAiB,EACnC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CACnC,CAAC;QACF,qBAAqB,CAAC,MAAM,CAAC;YAC3B,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;YACxD,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;SACzC,CAAC,CAAC;QAEH,qBAAqB,CAAC,oBAAoB,CACxC,qCAAqC,EACrC,GAAG,IAAI,CAAC,UAAU,wBAAwB,EAC1C;YACE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,KAAK,CAAC;YAC1D,cAAc,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE;YACtD,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE;SAC1D,CACF,CAAC;QACF,qBAAqB,CAAC,oBAAoB,CACxC,mCAAmC,EACnC,GAAG,IAAI,CAAC,UAAU,+BAA+B,EACjD;YACE,iBAAiB,EAAE,KAAK;YACxB,mBAAmB,EAAE,KAAK;YAC1B,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,KAAK,CAAC;YAC1D,kBAAkB,EAAE,KAAK;YACzB,uBAAuB,EAAE,KAAK;SAC/B,CACF,CAAC;QACF,qBAAqB,CAAC,oBAAoB,CACxC,sBAAsB,EACtB,GAAG,IAAI,CAAC,UAAU,oCAAoC,EACtD;YACE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,KAAK,CAAC;YAC1D,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC;gBAC3B,SAAS,EAAE;oBACT;wBACE,MAAM,EAAE,CAAC,cAAc,CAAC;wBACxB,MAAM,EAAE,OAAO;wBACf,SAAS,EAAE,GAAG;wBACd,QAAQ,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,mBAAmB,CAAC,OAAO,UAAU,CAAC,CAAC;wBACvE,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC;qBACrD;iBACF;gBACD,OAAO,EAAE,YAAY;aACtB,CAAC;SACH,CACF,CAAC;QAEF,KAAK,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,0BAA0B,CAAC;YAC3E,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChD,qBAAqB,CAAC,oBAAoB,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,UAAU,SAAS,SAAS,EAAE,EAAE;gBAClG,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,KAAK,CAAC;gBAC1D,YAAY,EAAE,WAAW;gBACzB,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,SAAS,GAAG,CAAC;gBAC5C,GAAG,EAAE,UAAU;gBACf,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,YAAuB;QACpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAE9C,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAA;AA7LY,SAAS;IADrB,QAAQ,CAAY,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC;;GAC/C,SAAS,CA6LrB"}
+{"version":3,"file":"s3-website.resource.js","sourceRoot":"","sources":["../../../src/resources/s3-website/s3-website.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,SAAS,EACT,kBAAkB,EAElB,IAAI,EACJ,UAAU,EACV,WAAW,EAEX,QAAQ,GAET,MAAM,eAAe,CAAC;AACvB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EAAE,eAAe,EAAkC,MAAM,mBAAmB,CAAC;AAOpF;;GAEG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,kBAA8C;IAQ3E;;OAEG;IACH,YACE,UAAkB,EAClB,UAAyC,EACzC,UAAyD,EAAE;QAE3D,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAZxB,aAAQ,GAAc,EAAE,CAAC;QAElC,sBAAiB,GAAyC,EAAE,CAAC;IAWrE,CAAC;IAED;;OAEG;IACH,MAAM,CAAU,KAAK,CAAC,OAAO,CAC3B,oBAAyB,EACzB,QAAW,EACX,mBAAqF;QAErF,MAAM,SAAS,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAc,CAAC;QAC1G,MAAM,OAAO,GAAI,QAAuC,CAAC,iBAAiB,CAAC;QAC3E,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,SAAc,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,CAAC,YAAyD;QAC3E,MAAM,sBAAsB,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC;QACnE,IAAI,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAChF,YAAY,EACZ,IAAI,EACJ,YAAY,CACb,CAAC;QACF,uBAAuB,CAAC,WAAW,CAAC,0BAA0B,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACjH,uBAAuB,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,0BAA0B,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAEpH,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,cAAc,CAAC,QAAmB;QAC/C,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC;YACvG,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,qEAAqE,CACtE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,gGAAgG;QAChG,mEAAmE;QACnE,IACE,CAAC,WAAW,CAAC,kBAAkB,CAC7B,EAAE,uBAAuB,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,EAAE,EACpF,EAAE,uBAAuB,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,EAAE,CACjF,EACD,CAAC;YACD,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,0BAA0B,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAC5G,CAAC;QACJ,CAAC;QAED,sFAAsF;QACtF,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxF,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,MAAM,EACjB,qBAAqB,EACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAC1C,CACF,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACM,UAAU,CAAC,IAAU;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,CAAC;YAE7B,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,MAAM,EACjB,qBAAqB,EACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAC1C,CACF,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACM,KAAK;QACZ,OAAO;YACL,GAAG,KAAK,CAAC,KAAK,EAAE;YAChB,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,qBAAqB,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAiB,EAAE;YAClF,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;SAC7F,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,oBAAoB,CACpE,eAAe,EACf,GAAG,IAAI,CAAC,UAAU,iBAAiB,EACnC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CACnC,CAAC;QACF,qBAAqB,CAAC,MAAM,CAAC;YAC3B,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,MAAM,CAAC;YACxD,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;YACxC,kBAAkB,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,8BAA8B,CAAC;SAChG,CAAC,CAAC;QAEH,gGAAgG;QAChG,+FAA+F;QAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,MAAM,KAAK,CAAC,CAAC;QAEtE,+FAA+F;QAC/F,6FAA6F;QAC7F,+CAA+C;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,qBAAqB,CAAC,oBAAoB,CACxC,qCAAqC,EACrC,GAAG,IAAI,CAAC,UAAU,wBAAwB,EAC1C;gBACE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,KAAK,CAAC;gBAC1D,cAAc,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE;gBACtD,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE;aAC1D,CACF,CAAC;QACJ,CAAC;QAED,qBAAqB,CAAC,oBAAoB,CACxC,mCAAmC,EACnC,GAAG,IAAI,CAAC,UAAU,+BAA+B,EACjD;YACE,iBAAiB,EAAE,CAAC,QAAQ;YAC5B,mBAAmB,EAAE,CAAC,QAAQ;YAC9B,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,KAAK,CAAC;YAC1D,kBAAkB,EAAE,CAAC,QAAQ;YAC7B,uBAAuB,EAAE,CAAC,QAAQ;SACnC,CACF,CAAC;QAEF,4FAA4F;QAC5F,+FAA+F;QAC/F,sDAAsD;QACtD,MAAM,UAAU,GAAG,QAAQ;YACzB,CAAC,CAAC;gBACE;oBACE,MAAM,EAAE,CAAC,cAAc,CAAC;oBACxB,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,GAAG;oBACd,QAAQ,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,mBAAmB,CAAC,OAAO,UAAU,CAAC,CAAC;oBACvE,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC;iBACrD;aACF;YACH,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,sBAAsB,EAAE,EAAE;gBACrE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,UAAU,KAAK,sBAAsB,CAAE,CAAC;gBAEpG,OAAO;oBACL,MAAM,EAAE,CAAC,cAAc,CAAC;oBACxB,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC;yBACvD;qBACF;oBACD,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBAClD,QAAQ,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,mBAAmB,CAAC,OAAO,UAAU,CAAC,CAAC;oBACvE,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,uBAAuB,sBAAsB,EAAE,CAAC;iBAC/E,CAAC;YACJ,CAAC,CAAC,CAAC;QAEP,qBAAqB,CAAC,oBAAoB,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC,UAAU,wBAAwB,EAAE;YAC7G,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,KAAK,CAAC;YAC1D,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;SAC/E,CAAC,CAAC;QAEH,KAAK,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,0BAA0B,CAAC;YAC3E,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChD,qBAAqB,CAAC,oBAAoB,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,UAAU,SAAS,SAAS,EAAE,EAAE;gBAClG,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,OAAO,KAAK,CAAC;gBAC1D,YAAY,EAAE,WAAW;gBACzB,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,SAAS,GAAG,CAAC;gBAC5C,GAAG,EAAE,UAAU;gBACf,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,YAAuB;QACpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAE9C,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAA;AA1QY,SAAS;IADrB,QAAQ,CAAY,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC;;GAC/C,SAAS,CA0QrB"}

package/package.json

@@ -3,6 +3,7 @@
     "url": "https://github.com/quadnix/octo/issues"
   },
   "dependencies": {
+    "@aws-sdk/client-cloudfront": "~3.743.0",
     "@aws-sdk/client-ecr": "~3.743.0",
     "@aws-sdk/credential-provider-ini": "~3.743.0",
     "@quadnix/octo": "~0.1.0",
@@ -79,6 +80,8 @@
     "./resources/alb-listener/schema": "./dist/resources/alb-listener/index.schema.js",
     "./resources/alb-target-group/schema": "./dist/resources/alb-target-group/index.schema.js",
     "./resources/alb/schema": "./dist/resources/alb/index.schema.js",
+    "./resources/cloudfront-distribution/schema": "./dist/resources/cloudfront-distribution/index.schema.js",
+    "./resources/cloudfront-invalidation/schema": "./dist/resources/cloudfront-invalidation/index.schema.js",
     "./resources/dynamodb-global/schema": "./dist/resources/dynamodb-global/index.schema.js",
     "./resources/dynamodb/schema": "./dist/resources/dynamodb/index.schema.js",
     "./resources/ecr-image-tag/schema": "./dist/resources/ecr-image-tag/index.schema.js",
@@ -156,7 +159,7 @@
   },
   "type": "module",
   "types": "./dist/index.d.ts",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "scripts": {
     "build": "rimraf dist && tsc -p tsconfig.build.json",
     "check:circular-dependency": "dpdm --no-tree --exit-code circular:1 --no-warning ./dist/**/*.js",