@quadnix/octo-aws-cdk 0.2.0 → 0.2.1

package/dist/resources/lambda-function/lambda-function.resource.js

@@ -0,0 +1,199 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { ATerraformResource, DependencyRelationship, Diff, DiffAction, DiffUtility, Resource, hasNodeName, } from '@quadnix/octo';
+import { LambdaFunctionSchema } from './index.schema.js';
+/**
+ * @internal
+ */
+let LambdaFunction = class LambdaFunction extends ATerraformResource {
+    /**
+     * @internal
+     */
+    constructor(resourceId, properties, parents) {
+        super(resourceId, properties, parents);
+        this.updateLambdaFunctionIamRole();
+        this.updateLambdaFunctionImageTag();
+    }
+    /**
+     * Admits CloudFront distributions of the function's own account to its URL.
+     *
+     * @internal
+     */
+    allowCloudFrontOriginAccess() {
+        this.properties.allowCloudFrontOriginAccess = true;
+    }
+    /**
+     * @internal
+     */
+    async diff(previous) {
+        const diffs = await super.diff(previous);
+        let shouldConsolidateDiffs = false;
+        for (let i = diffs.length - 1; i >= 0; i--) {
+            if (diffs[i].field === 'parent' && hasNodeName(diffs[i].value, 'iam-role')) {
+                // Skip updating the function when its iam-role is updated.
+                diffs.splice(i, 1);
+            }
+            else if (diffs[i].field === 'parent' &&
+                hasNodeName(diffs[i].value, 'ecr-image-tag') &&
+                diffs[i].action !== DiffAction.UPDATE) {
+                // Consolidate a new image into a single UPDATE diff.
+                shouldConsolidateDiffs = true;
+                diffs.splice(i, 1);
+            }
+            else if (diffs[i].field === 'parent' && hasNodeName(diffs[i].value, 'ecr-image-tag')) {
+                // Skip updating the function when its ecr-image-tag is updated.
+                diffs.splice(i, 1);
+            }
+            else if (diffs[i].field === 'properties' && diffs[i].action === DiffAction.UPDATE) {
+                // Consolidate property diffs.
+                shouldConsolidateDiffs = true;
+                diffs.splice(i, 1);
+            }
+        }
+        if (shouldConsolidateDiffs) {
+            diffs.push(new Diff(this, DiffAction.UPDATE, 'resourceId', ''));
+        }
+        return diffs;
+    }
+    /**
+     * A function belongs to one account and one region, and its name is already in the resource id.
+     * Everything else Lambda edits in place.
+     *
+     * @internal
+     */
+    async diffProperties(previous) {
+        if (previous.properties.awsAccountId !== this.properties.awsAccountId ||
+            previous.properties.awsRegionId !== this.properties.awsRegionId) {
+            return [
+                new Diff(this, DiffAction.REPLACE, 'resourceId', this.getContext(), 'the account and region are force-new on aws_lambda_function; a change recreates the function'),
+            ];
+        }
+        if (!DiffUtility.isObjectDeepEquals(previous.properties, this.properties)) {
+            return [new Diff(this, DiffAction.UPDATE, 'properties', '')];
+        }
+        return [];
+    }
+    /**
+     * @internal
+     */
+    async toHCL(terraform) {
+        const [iamRoleParent, imageTagParent] = this.parents;
+        const environmentVariables = this.properties.environmentVariables;
+        const lambdaFunctionOctoResource = terraform.addOctoTerraformResource(this, {
+            provider: { accountId: this.properties.awsAccountId, regionId: this.properties.awsRegionId },
+        });
+        const lambdaFunctionTFResource = lambdaFunctionOctoResource.addTerraformResource('aws_lambda_function', this.resourceId, {
+            architectures: [this.properties.architecture],
+            ...(Object.keys(environmentVariables).length > 0
+                ? { environment: { variables: terraform.mapAttr(environmentVariables) } }
+                : {}),
+            function_name: this.properties.functionName,
+            ...(this.properties.imageCommand.length > 0 ? { image_config: { command: this.properties.imageCommand } } : {}),
+            image_uri: terraform.getRef(imageTagParent, 'imageUri'),
+            memory_size: this.properties.memoryInMegabytes,
+            package_type: 'Image',
+            ...(this.properties.reservedConcurrency === null
+                ? {}
+                : { reserved_concurrent_executions: this.properties.reservedConcurrency }),
+            role: terraform.getRef(iamRoleParent, 'Arn'),
+            timeout: this.properties.timeoutInSeconds,
+        });
+        // Answer on a URL only signed requests may call, and admit each caller to it.
+        const functionUrlTFResource = lambdaFunctionOctoResource.addTerraformResource('aws_lambda_function_url', `${this.resourceId}_url`, {
+            authorization_type: 'AWS_IAM',
+            function_name: terraform.raw(`${lambdaFunctionTFResource.address}.function_name`),
+            ...(this.properties.invokeMode === 'RESPONSE_STREAM' ? { invoke_mode: 'RESPONSE_STREAM' } : {}),
+        });
+        const functionUrl = terraform.raw(`${functionUrlTFResource.address}.function_url`);
+        const functionUrlDomainName = terraform.raw(`trimsuffix(trimprefix(${functionUrlTFResource.address}.function_url, "https://"), "/")`);
+        // A CloudFront distribution is admitted by account rather than by its ARN, because the distribution
+        // already references this function's URL, and referencing its ARN back would close a cycle.
+        const allowedCallers = [
+            ...this.properties.invokerAccountIds.map((accountId) => ({ label: accountId, principal: accountId })),
+            ...(this.properties.allowCloudFrontOriginAccess
+                ? [
+                    {
+                        label: 'cloudfront',
+                        principal: 'cloudfront.amazonaws.com',
+                        sourceAccount: this.properties.awsAccountId,
+                    },
+                ]
+                : []),
+        ];
+        for (const invoker of allowedCallers) {
+            const sourceAccount = invoker.sourceAccount ? { source_account: invoker.sourceAccount } : {};
+            lambdaFunctionOctoResource.addTerraformResource('aws_lambda_permission', `${this.resourceId}_url_invoker_${invoker.label}`, {
+                action: 'lambda:InvokeFunctionUrl',
+                function_name: terraform.raw(`${lambdaFunctionTFResource.address}.function_name`),
+                function_url_auth_type: 'AWS_IAM',
+                principal: invoker.principal,
+                ...sourceAccount,
+                statement_id: `AllowFunctionUrlInvokeFrom-${invoker.label}`,
+            });
+            // A URL caller also needs lambda:InvokeFunction; `invoked_via_function_url` is in hashicorp/aws >= 6.28.0.
+            lambdaFunctionOctoResource.addTerraformResource('aws_lambda_permission', `${this.resourceId}_url_invoker_${invoker.label}_invoke`, {
+                action: 'lambda:InvokeFunction',
+                function_name: terraform.raw(`${lambdaFunctionTFResource.address}.function_name`),
+                invoked_via_function_url: true,
+                principal: invoker.principal,
+                ...sourceAccount,
+                statement_id: `AllowInvokeViaFunctionUrlFrom-${invoker.label}`,
+            });
+        }
+        lambdaFunctionOctoResource.output({
+            Arn: terraform.raw(`${lambdaFunctionTFResource.address}.arn`),
+            FunctionName: terraform.raw(`${lambdaFunctionTFResource.address}.function_name`),
+            FunctionUrl: functionUrl,
+            FunctionUrlDomainName: functionUrlDomainName,
+        });
+        if (Object.keys(this.tags).length > 0) {
+            lambdaFunctionTFResource.attribute('tags', this.tags);
+        }
+    }
+    /**
+     * @internal
+     */
+    updateLambdaFunctionIamRole() {
+        const iamRoleParent = this.parents[0].getActual();
+        const lambdaFunctionToIamRoleDep = this.getDependency(iamRoleParent, DependencyRelationship.CHILD);
+        // Before updating lambda-function must add or replace iam-role.
+        lambdaFunctionToIamRoleDep.addBehavior('resourceId', DiffAction.UPDATE, 'resourceId', DiffAction.ADD);
+        lambdaFunctionToIamRoleDep.addBehavior('resourceId', DiffAction.UPDATE, 'resourceId', DiffAction.REPLACE);
+        // Before replacing lambda-function must replace iam-role.
+        lambdaFunctionToIamRoleDep.addBehavior('resourceId', DiffAction.REPLACE, 'resourceId', DiffAction.REPLACE);
+    }
+    /**
+     * Orders this function against the published image it runs.
+     *
+     * A published image is deleted by octo at commit, outside terraform's own ordering, so nothing
+     * else holds it back until the function has stopped naming it.
+     *
+     * @internal
+     */
+    updateLambdaFunctionImageTag() {
+        const imageTagParent = this.parents[1].getActual();
+        const lambdaFunctionToImageTagDep = this.getDependency(imageTagParent, DependencyRelationship.CHILD);
+        const imageTagToLambdaFunctionDep = imageTagParent.getDependency(this, DependencyRelationship.PARENT);
+        // Before updating or replacing lambda-function must add ecr-image-tag.
+        lambdaFunctionToImageTagDep.addBehavior('resourceId', DiffAction.UPDATE, 'resourceId', DiffAction.ADD);
+        lambdaFunctionToImageTagDep.addBehavior('resourceId', DiffAction.REPLACE, 'resourceId', DiffAction.ADD);
+        // Before deleting ecr-image-tag must update or replace lambda-function.
+        imageTagToLambdaFunctionDep.addBehavior('resourceId', DiffAction.DELETE, 'resourceId', DiffAction.UPDATE);
+        imageTagToLambdaFunctionDep.addBehavior('resourceId', DiffAction.DELETE, 'resourceId', DiffAction.REPLACE);
+    }
+};
+LambdaFunction = __decorate([
+    Resource('@octo', 'lambda-function', LambdaFunctionSchema, {
+        uniqueProperties: [{ path: 'functionName', within: ['awsAccountId', 'awsRegionId'] }],
+    }),
+    __metadata("design:paramtypes", [String, Object, Array])
+], LambdaFunction);
+export { LambdaFunction };
+//# sourceMappingURL=lambda-function.resource.js.map

package/dist/resources/lambda-function/lambda-function.resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lambda-function.resource.js","sourceRoot":"","sources":["../../../src/resources/lambda-function/lambda-function.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAEL,kBAAkB,EAClB,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,WAAW,EAEX,QAAQ,EAER,WAAW,GACZ,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;GAEG;AAII,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,kBAAwD;IAK1F;;OAEG;IACH,YACE,UAAkB,EAClB,UAA8C,EAC9C,OAA+E;QAE/E,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAEvC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,2BAA2B;QACzB,IAAI,CAAC,UAAU,CAAC,2BAA2B,GAAG,IAAI,CAAC;IACrD,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,IAAI,CAAC,QAAwB;QAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,sBAAsB,GAAG,KAAK,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAA4B,EAAE,UAAU,CAAC,EAAE,CAAC;gBAClG,2DAA2D;gBAC3D,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrB,CAAC;iBAAM,IACL,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAC3B,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAA4B,EAAE,eAAe,CAAC;gBACnE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EACrC,CAAC;gBACD,qDAAqD;gBACrD,sBAAsB,GAAG,IAAI,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAA4B,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC9G,gEAAgE;gBAChE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACpF,8BAA8B;gBAC9B,sBAAsB,GAAG,IAAI,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,sBAAsB,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACM,KAAK,CAAC,cAAc,CAAC,QAAwB;QACpD,IACE,QAAQ,CAAC,UAAU,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,CAAC,YAAY;YACjE,QAAQ,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,CAAC,WAAW,EAC/D,CAAC;YACD,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,8FAA8F,CAC/F;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACrD,MAAM,oBAAoB,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAElE,MAAM,0BAA0B,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAsB,EAAE;YAC5F,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;SAC7F,CAAC,CAAC;QAEH,MAAM,wBAAwB,GAAG,0BAA0B,CAAC,oBAAoB,CAC9E,qBAAqB,EACrB,IAAI,CAAC,UAAU,EACf;YACE,aAAa,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC;gBAC9C,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE;gBACzE,CAAC,CAAC,EAAE,CAAC;YACP,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY;YAC3C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/G,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC;YACvD,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB;YAC9C,YAAY,EAAE,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,KAAK,IAAI;gBAC9C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,8BAA8B,EAAE,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;YAC5E,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC;YAC5C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB;SAC1C,CACF,CAAC;QAEF,8EAA8E;QAC9E,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,oBAAoB,CAC3E,yBAAyB,EACzB,GAAG,IAAI,CAAC,UAAU,MAAM,EACxB;YACE,kBAAkB,EAAE,SAAS;YAC7B,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,wBAAwB,CAAC,OAAO,gBAAgB,CAAC;YACjF,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,iBAAiB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG,CACF,CAAC;QACF,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,OAAO,eAAe,CAAC,CAAC;QACnF,MAAM,qBAAqB,GAAG,SAAS,CAAC,GAAG,CACzC,yBAAyB,qBAAqB,CAAC,OAAO,kCAAkC,CACzF,CAAC;QAEF,oGAAoG;QACpG,4FAA4F;QAC5F,MAAM,cAAc,GAAmE;YACrF,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YACrG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B;gBAC7C,CAAC,CAAC;oBACE;wBACE,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,0BAA0B;wBACrC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY;qBAC5C;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,0BAA0B,CAAC,oBAAoB,CAC7C,uBAAuB,EACvB,GAAG,IAAI,CAAC,UAAU,gBAAgB,OAAO,CAAC,KAAK,EAAE,EACjD;gBACE,MAAM,EAAE,0BAA0B;gBAClC,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,wBAAwB,CAAC,OAAO,gBAAgB,CAAC;gBACjF,sBAAsB,EAAE,SAAS;gBACjC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,aAAa;gBAChB,YAAY,EAAE,8BAA8B,OAAO,CAAC,KAAK,EAAE;aAC5D,CACF,CAAC;YACF,2GAA2G;YAC3G,0BAA0B,CAAC,oBAAoB,CAC7C,uBAAuB,EACvB,GAAG,IAAI,CAAC,UAAU,gBAAgB,OAAO,CAAC,KAAK,SAAS,EACxD;gBACE,MAAM,EAAE,uBAAuB;gBAC/B,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,wBAAwB,CAAC,OAAO,gBAAgB,CAAC;gBACjF,wBAAwB,EAAE,IAAI;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,aAAa;gBAChB,YAAY,EAAE,iCAAiC,OAAO,CAAC,KAAK,EAAE;aAC/D,CACF,CAAC;QACJ,CAAC;QAED,0BAA0B,CAAC,MAAM,CAAC;YAChC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,wBAAwB,CAAC,OAAO,MAAM,CAAC;YAC7D,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,wBAAwB,CAAC,OAAO,gBAAgB,CAAC;YAChF,WAAW,EAAE,WAAW;YACxB,qBAAqB,EAAE,qBAAqB;SAC7C,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,wBAAwB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,2BAA2B;QACjC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAClD,MAAM,0BAA0B,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAE,CAAC;QAEpG,gEAAgE;QAChE,0BAA0B,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACtG,0BAA0B,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1G,0DAA0D;QAC1D,0BAA0B,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7G,CAAC;IAED;;;;;;;OAOG;IACK,4BAA4B;QAClC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACnD,MAAM,2BAA2B,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,sBAAsB,CAAC,KAAK,CAAE,CAAC;QACtG,MAAM,2BAA2B,GAAG,cAAc,CAAC,aAAa,CAAC,IAAI,EAAE,sBAAsB,CAAC,MAAM,CAAE,CAAC;QAEvG,uEAAuE;QACvE,2BAA2B,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACvG,2BAA2B,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACxG,wEAAwE;QACxE,2BAA2B,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1G,2BAA2B,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7G,CAAC;CACF,CAAA;AArOY,cAAc;IAH1B,QAAQ,CAAiB,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE;QAC1E,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;KACtF,CAAC;;GACW,cAAc,CAqO1B"}

package/dist/resources/nat-gateway/nat-gateway.resource.d.ts

@@ -1,23 +1,18 @@
 import { ATerraformResource, Diff, type MatchingResource, type TerraformModuleScope } from '@quadnix/octo';
 import type { InternetGatewaySchema } from '../internet-gateway/index.schema.js';
 import type { SubnetSchema } from '../subnet/index.schema.js';
-import type { VpcSchema } from '../vpc/index.schema.js';
 import { NatGatewaySchema } from './index.schema.js';
 /**
  * @internal
  */
 export declare class NatGateway extends ATerraformResource<NatGatewaySchema, NatGateway> {
-    parents: [
-        MatchingResource<VpcSchema>,
-        MatchingResource<InternetGatewaySchema>,
-        MatchingResource<SubnetSchema>
-    ];
+    parents: [MatchingResource<InternetGatewaySchema>, MatchingResource<SubnetSchema>];
     properties: NatGatewaySchema['properties'];
     response: NatGatewaySchema['response'];
     /**
      * @internal
      */
-    constructor(resourceId: string, properties: NatGatewaySchema['properties'], parents: [MatchingResource<VpcSchema>, MatchingResource<InternetGatewaySchema>, MatchingResource<SubnetSchema>]);
+    constructor(resourceId: string, properties: NatGatewaySchema['properties'], parents: [MatchingResource<InternetGatewaySchema>, MatchingResource<SubnetSchema>]);
     /**
      * @internal
      */

package/dist/resources/nat-gateway/nat-gateway.resource.js

@@ -35,7 +35,7 @@ let NatGateway = class NatGateway extends ATerraformResource {
      */
     async toHCL(terraform) {
         const natGatewayOctoResource = terraform.addOctoTerraformResource(this, {
-            explicitParents: [this.parents[0], this.parents[1]],
+            explicitParents: [this.parents[0]],
             provider: { accountId: this.properties.awsAccountId, regionId: this.properties.awsRegionId },
         });
         const eipTFResource = natGatewayOctoResource.addTerraformResource('aws_eip', `${this.resourceId}_eip`, {
@@ -44,7 +44,7 @@ let NatGateway = class NatGateway extends ATerraformResource {
         const natGatewayTFResource = natGatewayOctoResource.addTerraformResource('aws_nat_gateway', this.resourceId, {
             allocation_id: terraform.raw(`${eipTFResource.address}.id`),
             connectivity_type: this.properties.ConnectivityType,
-            subnet_id: terraform.getRef(this.parents[2], 'SubnetId'),
+            subnet_id: terraform.getRef(this.parents[1], 'SubnetId'),
         });
         natGatewayOctoResource.output({
             AllocationId: terraform.raw(`${eipTFResource.address}.id`),

package/dist/resources/nat-gateway/nat-gateway.resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"nat-gateway.resource.js","sourceRoot":"","sources":["../../../src/resources/nat-gateway/nat-gateway.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,kBAAkB,EAClB,IAAI,EACJ,UAAU,EACV,WAAW,EAEX,QAAQ,GAET,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;GAEG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,kBAAgD;IAS9E;;OAEG;IACH,YACE,UAAkB,EAClB,UAA0C,EAC1C,OAA+G;QAE/G,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,cAAc,CAAC,QAAoB;QAChD,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,0EAA0E,CAC3E;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,sBAAsB,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAkB,EAAE;YACpF,eAAe,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACnD,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;SAC7F,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,sBAAsB,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,MAAM,EAAE;YACrG,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC3G,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,KAAK,CAAC;YAC3D,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB;YACnD,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC;SACzD,CAAC,CAAC;QACH,sBAAsB,CAAC,MAAM,CAAC;YAC5B,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,KAAK,CAAC;YAC1D,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,OAAO,KAAK,CAAC;SAClE,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF,CAAA;AAnEY,UAAU;IADtB,QAAQ,CAAa,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC;;GAClD,UAAU,CAmEtB"}
+{"version":3,"file":"nat-gateway.resource.js","sourceRoot":"","sources":["../../../src/resources/nat-gateway/nat-gateway.resource.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,kBAAkB,EAClB,IAAI,EACJ,UAAU,EACV,WAAW,EAEX,QAAQ,GAET,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;GAEG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,kBAAgD;IAK9E;;OAEG;IACH,YACE,UAAkB,EAClB,UAA0C,EAC1C,OAAkF;QAElF,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,cAAc,CAAC,QAAoB;QAChD,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO;gBACL,IAAI,IAAI,CACN,IAAI,EACJ,UAAU,CAAC,OAAO,EAClB,YAAY,EACZ,IAAI,CAAC,UAAU,EAAE,EACjB,0EAA0E,CAC3E;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,KAAK,CAAC,SAA+B;QAClD,MAAM,sBAAsB,GAAG,SAAS,CAAC,wBAAwB,CAAC,IAAkB,EAAE;YACpF,eAAe,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;SAC7F,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,sBAAsB,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,MAAM,EAAE;YACrG,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC3G,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,KAAK,CAAC;YAC3D,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB;YACnD,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC;SACzD,CAAC,CAAC;QACH,sBAAsB,CAAC,MAAM,CAAC;YAC5B,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,KAAK,CAAC;YAC1D,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,OAAO,KAAK,CAAC;SAClE,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF,CAAA;AA/DY,UAAU;IADtB,QAAQ,CAAa,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC;;GAClD,UAAU,CA+DtB"}

package/dist/resources/s3-storage/index.schema.d.ts

@@ -1,4 +1,22 @@
 import { BaseResourceSchema } from '@quadnix/octo';
+declare const S3_STORAGE_CORS_METHODS: readonly ["DELETE", "GET", "HEAD", "POST", "PUT"];
+/**
+ * An HTTP method a CORS rule of the s3 storage may allow.
+ *
+ * @group Resources/S3Storage
+ */
+export type IS3StorageCorsMethod = (typeof S3_STORAGE_CORS_METHODS)[number];
+declare const S3_STORAGE_PRINCIPAL_TYPES: readonly ["aws", "cloudfront"];
+/**
+ * The kind of principal a permission admits.
+ * * `aws` - An IAM principal, such as a role, named by its ARN.
+ * * `cloudfront` - A CloudFront distribution, admitted through
+ * [origin access control](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html).
+ * It may only read.
+ *
+ * @group Resources/S3Storage
+ */
+export type IS3StoragePrincipalType = (typeof S3_STORAGE_PRINCIPAL_TYPES)[number];
 /**
  * Defines the schema for the s3 storage to allow permissions to a principal resource.
  *
@@ -7,6 +25,11 @@ import { BaseResourceSchema } from '@quadnix/octo';
  * @hideconstructor
  */
 export declare class S3StoragePermissionSchema {
+    /**
+     * The key prefix within the bucket this permission is for, e.g. `uploads`.
+     * If you want to allow access to the entire bucket, use empty string `''`.
+     */
+    accessPrefix: string;
     /**
      * Allow read.
      */
@@ -20,10 +43,73 @@ export declare class S3StoragePermissionSchema {
      */
     principalResourceId: string;
     /**
-     * The path within the bucket this permission is for.
-     * If you want to allow access to the entire bucket, use empty string `''`.
+     * The kind of principal the permission admits.
      */
-    remoteDirectoryPath: string;
+    principalType: "cloudfront" | "aws";
+}
+/**
+ * Defines the schema for a CORS rule of the s3 storage, which lets a page on another origin call the
+ * bucket from a browser, e.g. to upload through a presigned URL or read a range of an object.
+ *
+ * S3 answers a request with the first rule its origin, method and headers all match.
+ *
+ * @group Resources/S3Storage
+ *
+ * @hideconstructor
+ */
+export declare class S3StorageCorsRuleSchema {
+    /**
+     * The request headers the calling page may send, e.g. `['Range']` to read part of an object.
+     * A name may use one `*`, and `*` alone allows every header. Header names are not case-sensitive.
+     */
+    allowHeaders?: string[] | undefined;
+    /**
+     * The methods the calling page may use. See {@link IS3StorageCorsMethod}.
+     */
+    allowMethods: ("DELETE" | "GET" | "HEAD" | "POST" | "PUT")[];
+    /**
+     * The origins allowed to call, each a scheme, a host, and a port when it is not the default, e.g.
+     * `https://app.example.com`. An origin may use one `*`, e.g. `https://*.example.com`, and `*`
+     * alone allows every origin.
+     */
+    allowOrigins: string[];
+    /**
+     * The response headers the calling page may read beyond the ones every browser shows, e.g.
+     * `['ETag']`.
+     */
+    exposeHeaders?: string[] | undefined;
+    /**
+     * How long a browser may reuse the answer to a preflight request, in seconds. Omit it to let the
+     * browser decide.
+     */
+    maxAgeSeconds?: number | null | undefined;
+}
+/**
+ * Defines the schema for a lifecycle rule of the s3 storage, which expires the objects it matches
+ * some days after each was written.
+ *
+ * A rule matches the objects under its `prefix` that carry every one of its `tags`. With neither, it
+ * matches every object in the bucket.
+ *
+ * @group Resources/S3Storage
+ *
+ * @hideconstructor
+ */
+export declare class S3StorageLifecycleRuleSchema {
+    /**
+     * The number of days after an object was written that it expires and is deleted.
+     */
+    expirationInDays: number;
+    /**
+     * The key prefix the rule is limited to, e.g. `uploads/`. Omit it to match the whole bucket.
+     */
+    prefix?: string | undefined;
+    /**
+     * The tags an object must carry, every one of them, for the rule to match it, e.g. `{ upload: 'pending' }`.
+     */
+    tags?: {
+        [key: string]: string;
+    } | undefined;
 }
 /**
  * @internal
@@ -37,14 +123,23 @@ export declare class PrincipalResourceSchema extends BaseResourceSchema {
  * The `S3StorageSchema` class is the schema for the `S3Storage` resource,
  * which represents the AWS Simple Storage Service (S3) Bucket resource.
  * Terraform provisions it as
- * [`aws_s3_bucket`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) and
- * [`aws_s3_bucket_policy`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy).
+ * [`aws_s3_bucket`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket),
+ * [`aws_s3_bucket_public_access_block`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block)
+ * when public access is blocked, one
+ * [`aws_s3_object`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object)
+ * per uploaded file, and
+ * [`aws_s3_bucket_policy`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy)
+ * once a principal is admitted,
+ * [`aws_s3_bucket_cors_configuration`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration)
+ * once it has a CORS rule, and
+ * [`aws_s3_bucket_lifecycle_configuration`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration)
+ * once it has a lifecycle rule.
  *
  * @group Resources/S3Storage
  *
  * @hideconstructor
  *
- * @overrideProperty parents - This resource has parents.
+ * @overrideProperty parents - The principals admitted to the bucket.
  * ```mermaid
  * graph TD;
  *   principal_resource((Principal<br>Resource)) --> s3_storage((S3<br>Storage))
@@ -56,20 +151,37 @@ export declare class S3StorageSchema extends BaseResourceSchema {
      * Input properties.
      * * `properties.awsAccountId` - The AWS account id.
      * * `properties.awsRegionId` - The AWS region id.
+     * * `properties.blockPublicAccess` - Blocks every public ACL and public policy on the bucket.
      * * `properties.Bucket` - The name of the bucket.
+     * * `properties.corsRules` - The rules letting a page on another origin call the bucket. See {@link S3StorageCorsRuleSchema} for options.
+     * * `properties.lifecycleRules` - The rules expiring the bucket's objects. See {@link S3StorageLifecycleRuleSchema} for options.
      * * `properties.permissions` - The permissions for the bucket. See {@link S3StoragePermissionSchema} for options.
      */
     properties: {
         awsAccountId: string;
         awsRegionId: string;
+        blockPublicAccess: boolean;
         Bucket: string;
+        corsRules: S3StorageCorsRuleSchema[];
+        lifecycleRules: S3StorageLifecycleRuleSchema[];
         permissions: S3StoragePermissionSchema[];
     };
     /**
      * Saved response.
      * * `response.Arn` - The ARN of the bucket.
+     * * `response.awsRegionId` - The AWS region id.
+     * * `response.Bucket` - The name of the bucket, as terraform created it.
+     * * `response.RegionalDomainName` - The bucket's REST endpoint, which is what a CloudFront origin
+     * points at.
      */
     response: {
         Arn?: string;
+        awsRegionId?: string;
+        Bucket?: string;
+        RegionalDomainName?: string;
+    };
+    sourcePathDigests: {
+        [remotePath: string]: string;
     };
 }
+export {};