@reventlessdev/reventless-aws 3.0.0-alpha.167

package/src/adapter/EventCollector/EventCollectorChannel.res

@@ -0,0 +1,6 @@
+let name = "EventCollectorChannel"
+
+module SQS = EventCollectorChannel_SQS
+module SQS_Runtime = EventCollectorChannel_SQS_Runtime
+module SQS_FIFO = EventCollectorChannel_SQS_FIFO
+module DynamoDbStream = EventCollectorChannel_DynamoDbStream

package/src/adapter/EventCollector/EventCollectorChannel.res.mjs

@@ -0,0 +1,21 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let name = "EventCollectorChannel";
+
+let SQS;
+
+let SQS_Runtime;
+
+let SQS_FIFO;
+
+let DynamoDbStream;
+
+export {
+  name,
+  SQS,
+  SQS_Runtime,
+  SQS_FIFO,
+  DynamoDbStream,
+}
+/* No side effect */

package/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream.res

@@ -0,0 +1,63 @@
+type callbackEvent = PulumiAws.Lambda.CallbackFunction.event
+type channelParts = unit
+type runtimeParts = Util.Lambda.runtimeParts
+
+let log = ReventlessCore.Logger.fromEnv()
+
+let connect = (
+  ~name,
+  ~channelSpecs: array<
+    ReventlessCore.EventCollector_Adapter.channelSpec<callbackEvent, 'context, channelParts>,
+  >,
+  ~runtime: ReventlessCore.Runtime.environment<runtimeParts>,
+  ~opts,
+) => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+
+  let lambda = runtime.parts.lambda
+  let lambdaRole = runtime.parts.lambdaRole
+
+  open EventCollectorChannel_Helpers
+
+  let queues = []
+  let eventTopics =
+    channelSpecs->Array.reduce(Dict.make(), (acc, {eventTopics}) => acc->Dict.assign(eventTopics))
+  let resources = channelSpecs->Array.map(({resources}) => resources)->Array.flat
+
+  lambda->connectLambda(name, lambdaRole, queues, eventTopics, resources, opts)
+}
+
+let make: ReventlessCore.EventCollector_Adapter.channelMaker<callbackEvent, 'context, channelParts> = (
+  ~name as _,
+  ~eventTopics,
+  ~opts as _,
+) => {
+  let eventTopicResources =
+    eventTopics
+    ->Dict.valuesToArray
+    ->Array.map(outputs => outputs.resources->Array.getUnsafe(0)) // FIXME
+
+  let enqueueEventNotSupported = (delay, id, messageBody) => {
+    // TODO: can we check this at deploy time ?
+    log.debug(
+      ~comp="EventCollectorChannel_DynamoDbStream",
+      ~data=Dict.fromArray([
+        ("delay", delay->JSON.stringifyAny->Option.getOr("")->JSON.Encode.string),
+        ("id", id->JSON.stringifyAny->Option.getOr("")->JSON.Encode.string),
+        ("messageBody", messageBody->JSON.stringifyAny->Option.getOr("")->JSON.Encode.string),
+      ])->JSON.Encode.object,
+      "supports no enqueueEvent",
+    )
+    Promise.resolve()
+  }
+
+  let handleChannelEvent = handleEvents =>
+    EventCollectorChannel_SQS_Runtime.handleDynamoDbEvent(handleEvents, ...)->Pulumi.Output.make
+
+  {
+    ReventlessCore.EventCollector_Adapter.parts: (),
+    resources: eventTopicResources,
+    enqueueEvent: enqueueEventNotSupported->Pulumi.Output.make,
+    handleChannelEvent,
+  }
+}

package/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream.res.mjs

@@ -0,0 +1,56 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as EventCollectorChannel_Helpers$ReventlessAws from "./EventCollectorChannel_Helpers.res.mjs";
+import * as EventCollectorChannel_SQS_Runtime$ReventlessAws from "./EventCollectorChannel_SQS_Runtime.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+function connect(name, channelSpecs, runtime, opts) {
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let lambda = runtime.parts.lambda;
+  let lambdaRole = runtime.parts.lambdaRole;
+  let queues = [];
+  let eventTopics = Stdlib_Array.reduce(channelSpecs, {}, (acc, param) => Object.assign(acc, param.eventTopics));
+  let resources = channelSpecs.map(param => param.resources).flat();
+  return EventCollectorChannel_Helpers$ReventlessAws.connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources, opts$1);
+}
+
+function make(param, eventTopics, param$1) {
+  let eventTopicResources = Object.values(eventTopics).map(outputs => outputs.resources[0]);
+  let enqueueEventNotSupported = (delay, id, messageBody) => {
+    log.debug("EventCollectorChannel_DynamoDbStream", Object.fromEntries([
+      [
+        "delay",
+        Stdlib_Option.getOr(JSON.stringify(delay), "")
+      ],
+      [
+        "id",
+        Stdlib_Option.getOr(JSON.stringify(id), "")
+      ],
+      [
+        "messageBody",
+        Stdlib_Option.getOr(JSON.stringify(messageBody), "")
+      ]
+    ]), "supports no enqueueEvent");
+    return Promise.resolve();
+  };
+  let handleChannelEvent = handleEvents => Pulumi.output(EventCollectorChannel_SQS_Runtime$ReventlessAws.handleDynamoDbEvent(handleEvents));
+  return {
+    parts: undefined,
+    resources: eventTopicResources,
+    enqueueEvent: Pulumi.output(enqueueEventNotSupported),
+    handleChannelEvent: handleChannelEvent
+  };
+}
+
+export {
+  log,
+  connect,
+  make,
+}
+/* log Not a pure module */

package/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream_Runtime.res

@@ -0,0 +1,20 @@
+let handleStreamEvent: (
+  ReventlessCore.EventCollector.jsonEventsHandler,
+  PulumiAws.DynamoDb.Stream.event,
+  _,
+) => Effect.t<unit, string, unit> = (handleEvents, streamEvent, _) => {
+  let jsons = streamEvent.records->Array.filterMap(record =>
+    switch record.eventSource {
+    | "aws:dynamodb" =>
+      switch record->Util.DynamoDbStream_Runtime.parseDynamoDbStreamRecordEvent {
+      | NewImage(_, newImage)
+      | NewAndOldImage(_, newImage, _) =>
+        Some(newImage)
+      | _ => None
+      }
+    | _eventSource => None
+    }
+  )
+
+  Stream.fromIterable(jsons)->handleEvents->Effect.map(_ => ())
+}

package/src/adapter/EventCollector/EventCollectorChannel_DynamoDbStream_Runtime.res.mjs

@@ -0,0 +1,32 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as Util_DynamoDbStream_Runtime$ReventlessAws from "../../util/Util_DynamoDbStream_Runtime.res.mjs";
+
+function handleStreamEvent(handleEvents, streamEvent, param) {
+  let jsons = Stdlib_Array.filterMap(streamEvent.Records, record => {
+    let _eventSource = record.eventSource;
+    if (_eventSource !== "aws:dynamodb") {
+      return;
+    }
+    let match = Util_DynamoDbStream_Runtime$ReventlessAws.parseDynamoDbStreamRecordEvent(record);
+    if (typeof match !== "object") {
+      return;
+    }
+    switch (match.TAG) {
+      case "OldImage" :
+        return;
+      case "NewImage" :
+      case "NewAndOldImage" :
+        return match._1;
+    }
+  });
+  return Effect.map(handleEvents(Stream.fromIterable(jsons)), () => {});
+}
+
+export {
+  handleStreamEvent,
+}
+/* effect/Effect Not a pure module */

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res

@@ -0,0 +1,266 @@
+open PulumiAws.PolicyDocument
+open ReventlessCore.Adapter
+open Adapter_Helpers
+
+let log = ReventlessCore.Logger.fromEnv()
+
+let toResources = (eventTopics: ReventlessCore.EventTopic.allOutputs) =>
+  eventTopics
+  ->Dict.valuesToArray
+  ->Array.flatMap(outputs => outputs.resources)
+  ->ReventlessCore.Adapter.resourcesToResolvedOutput
+
+let createQueuePolicy = (queue: PulumiAws.SQS.Queue.t, name, _resources, opts) => {
+  let _ =
+    (queue.arn, queue.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((queueArn, queueId)) => {
+      // SQS queue ARN is `arn:aws:sqs:<region>:<accountId>:<name>` — segment
+      // index 4 (0-based). Used to scope cross-plugin SNS sources to this
+      // account (aws:SourceAccount) and to topic names following the
+      // Reventless EventTopic naming convention (aws:SourceArn arnLike).
+      let accountId = queueArn->String.split(":")->Array.get(4)->Option.getOr("")
+      let queuePolicyDocument =
+        PulumiAws.PolicyDocument.make(
+          ~id=name ++ "QueuePolicy",
+          ~statements=[
+            // Single statement allows SendMessage from any SNS topic owned by
+            // this AWS account whose name matches the Reventless EventTopic
+            // naming convention. Replaces the previous per-topic arnEquals
+            // list so cross-plugin SNS subscriptions created at runtime by the
+            // admin's manageSubscriptions hook (Phase 3 Step 1) are accepted
+            // without requiring a redeploy of the receiving plugin. Security
+            // boundary: SourceAccount condition keeps third-party-account
+            // topics out; ArnLike + SNS service principal further narrows
+            // accepted senders to in-account EventTopic resources.
+            {
+              sid: "AllowReceiveSnsEvents",
+              principal: Principals({
+                service: PrincipalIds([AWS.SNS.principal]),
+              }),
+              effect: Allow,
+              actions: Actions(["sqs:SendMessage"]),
+              resources: Resource(queueArn),
+              conditions: {
+                stringEquals: [
+                  ("aws:SourceAccount", ConditionValue(accountId)),
+                ]->Dict.fromArray,
+                arnLike: [
+                  ("aws:SourceArn", ConditionValue(`arn:aws:sns:*:${accountId}:*EventTopic-*`)),
+                ]->Dict.fromArray,
+              },
+            },
+          ],
+        )
+        ->toJsonString
+        ->Pulumi.Input.make
+      let _queuePolicy = {
+        PulumiAws.SQS.QueuePolicy.make(
+          ~name,
+          ~args={
+            queueUrl: queueId->Pulumi.Input.make,
+            policy: queuePolicyDocument,
+          },
+          ~opts=Some(opts),
+        )
+      }
+    })
+}
+
+let subscribeQueue2SnsTopic = (queue, name, resources: array<ReventlessInfra.Adapter.resolvedResource>, opts) => {
+  let _snsTopicSubscriptions = resources->Array.map(resource => {
+    log.debug(~comp="EventCollector", `subscribeToSnsTopic: ${name} -> ${resource.name}`)
+    let subscription = Util_SQS.subscribeToSnsTopic(
+      ~queue,
+      ~targetName=name,
+      ~sourceName=resource.name,
+      ~topic=resource->ReventlessCore.AdapterDeploytime.resolvedToResource,
+      ~opts,
+    )
+    subscription.id->Pulumi.Output.apply(id => log.debug(~comp="EventCollector", `created SNS subscription: ${id} ${name}`))
+  })
+}
+
+let connectSqsQueue2SnsTopics = (queue: PulumiAws.SQS.Queue.t, name, eventTopics, opts) => {
+  let _ =
+    (eventTopics->toResources, queue.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((eventTopicResources, queueId)) => {
+      log.debug(
+        ~comp="EventCollector",
+        `connectSqsQueue2SnsTopics ${queueId}: ${eventTopicResources->Array.length->Int.toString} topic resource(s)`,
+      )
+      let snsResources = eventTopicResources->snsResources
+      queue->createQueuePolicy(name, snsResources, opts)
+      queue->subscribeQueue2SnsTopic(name, snsResources, opts)
+    })
+}
+
+let connectLambda = (
+  lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>,
+  name: string,
+  lambdaRole: PulumiAws.IAM.Role.t,
+  queues: array<PulumiAws.SQS.Queue.t>,
+  eventTopics: ReventlessCore.EventTopic.allOutputs,
+  resources: array<ReventlessInfra.Adapter.resource>,
+  opts: Pulumi.CustomResourceOptions.t,
+) => {
+  let _ =
+    (
+      eventTopics->toResources,
+      queues->Array.map(queue => queue.arn)->Pulumi.Output.all,
+      resources->ReventlessCore.Adapter.resourcesToResolvedOutput,
+    )
+    ->Pulumi.Output.all3
+    ->Pulumi.Output.apply(((eventTopicResources, queueArns, resources)) => {
+      log.debug(
+        ~comp="EventCollector",
+        `connectLambda ${name}: ${eventTopicResources->Array.length->Int.toString} topic resource(s), ${resources->Array.length->Int.toString} resource(s)`,
+      )
+
+      let dynamoDbStreamResources = eventTopicResources->dynamoDbStreamResources
+      let targetSnsResources = resources->snsResources
+      let targetSqsResources = resources->sqsResources
+      let targetDynamoDbResources = resources->dynamoDbResources
+
+      let allowLambdaReadDynamoDbStream =
+        dynamoDbStreamResources->Array.length > 0
+          ? Some(
+              PulumiAws.PolicyDocument.make(
+                ~id=name ++ "LambdaDynamoDbStreamPolicy",
+                ~statements=[
+                  {
+                    sid: "AllowLambdaReadDynamoDbStream",
+                    effect: Allow,
+                    actions: Actions([
+                      "dynamodb:DescribeStream",
+                      "dynamodb:GetRecords",
+                      "dynamodb:GetShardIterator",
+                      "dynamodb:ListStreams",
+                    ]),
+                    resources: Resources(dynamoDbStreamResources->urns),
+                  },
+                ],
+              ),
+            )
+          : None
+
+      let allowLambdaReadWriteDynamoDb =
+        targetDynamoDbResources->Array.length > 0
+          ? Some(
+              PulumiAws.PolicyDocument.make(
+                ~id=name ++ "LambdaAllowDynamoDbWrite",
+                ~statements=[
+                  {
+                    sid: "AllowLambdaReadWriteDynamoDb",
+                    effect: Allow,
+                    actions: Actions([
+                      "dynamodb:GetItem",
+                      "dynamodb:Query",
+                      "dynamodb:Scan",
+                      "dynamodb:BatchGetItem",
+                      "dynamodb:PutItem",
+                      "dynamodb:UpdateItem",
+                      "dynamodb:DeleteItem",
+                      "dynamodb:BatchWriteItem",
+                    ]),
+                    resources: Resources(targetDynamoDbResources->urns),
+                  },
+                ],
+              ),
+            )
+          : None
+
+      let allowLambdaPublishSNS =
+        targetSnsResources->Array.length > 0
+          ? Some(
+              PulumiAws.PolicyDocument.make(
+                ~id=name ++ "PublishSNS",
+                ~statements=[
+                  {
+                    sid: "AllowLambdaPublishSNS",
+                    effect: Allow,
+                    actions: Action("sns:Publish"),
+                    resources: Resources(targetSnsResources->urns),
+                  },
+                ],
+              ),
+            )
+          : None
+
+      let allowLambdaSendSQS =
+        targetSqsResources->Array.length > 0
+          ? Some(
+              PulumiAws.PolicyDocument.make(
+                ~id=name ++ "SendSQS",
+                ~statements=[
+                  {
+                    sid: "AllowLambdaSendSQS",
+                    effect: Allow,
+                    actions: Action("sqs:SendMessage"),
+                    resources: Resources(targetSqsResources->urns),
+                  },
+                ],
+              ),
+            )
+          : None
+
+      let allowLambdaReceiveSQS =
+        queueArns->Array.length > 0
+          ? Some(
+              PulumiAws.PolicyDocument.make(
+                ~id=name ++ "LambdaSQSPolicy",
+                ~statements=[
+                  {
+                    sid: "AllowLambdaReceiveSQS",
+                    effect: Allow,
+                    actions: Actions([
+                      "sqs:ReceiveMessage",
+                      "sqs:DeleteMessage",
+                      "sqs:GetQueueAttributes",
+                    ]),
+                    resources: Resources(queueArns),
+                  },
+                ],
+              ),
+            )
+          : None
+
+      let _lambdaPolicy = PulumiAws.IAM.RolePolicy.make(
+        ~name,
+        ~args={
+          policy: PulumiAws.PolicyDocument.mergePolicyDocuments(
+            name ++ "LambdaPolicy",
+            [
+              Some(PulumiAws.Lambda.defaultLoggingPolicyDocument),
+              allowLambdaReceiveSQS,
+              allowLambdaReadDynamoDbStream,
+              allowLambdaReadWriteDynamoDb,
+              allowLambdaPublishSNS,
+              allowLambdaSendSQS,
+            ]->Array.keepSome,
+          )->Pulumi.Output.asInput,
+          role: lambdaRole.id->Pulumi.Output.asInput,
+        },
+        ~opts,
+      )
+
+      let _eventSourceMappings =
+        dynamoDbStreamResources->Array.map(dynamoDbStreamResource =>
+          Util_EventSourceMapping.subscribe(
+            ~lambda,
+            ~targetName=name,
+            ~sourceName=dynamoDbStreamResource.name,
+            ~source=dynamoDbStreamResource->ReventlessCore.AdapterDeploytime.resolvedToResource,
+            ~opts,
+          )
+        )
+    })
+
+  let subscriptionResources = queues->Array.mapWithIndex((queue, idx) => {
+    let esmName = queues->Array.length > 1 ? `${name}Sqs${Int.toString(idx)}` : name
+    Util_EventSourceMapping.subscribeSqs(~lambda, ~name=esmName, ~queue, ~opts)
+  })
+
+  subscriptionResources
+}

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res.mjs

@@ -0,0 +1,166 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
+import * as Util_SQS$ReventlessAws from "../../util/Util_SQS.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
+import * as AdapterDeploytime$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/AdapterDeploytime.res.mjs";
+import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+function toResources(eventTopics) {
+  return Adapter$ReventlessCore.resourcesToResolvedOutput(Object.values(eventTopics).flatMap(outputs => outputs.resources));
+}
+
+function createQueuePolicy(queue, name, _resources, opts) {
+  Pulumi.all([
+    queue.arn,
+    queue.id
+  ]).apply(param => {
+    let queueArn = param[0];
+    let accountId = Stdlib_Option.getOr(queueArn.split(":")[4], "");
+    let queuePolicyDocument = PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
+        Sid: "AllowReceiveSnsEvents",
+        Principal: {
+          Service: [AWS$ReventlessAws.SNS.principal]
+        },
+        Effect: "Allow",
+        Action: ["sqs:SendMessage"],
+        Resource: queueArn,
+        Condition: {
+          StringEquals: Object.fromEntries([[
+              "aws:SourceAccount",
+              accountId
+            ]]),
+          ArnLike: Object.fromEntries([[
+              "aws:SourceArn",
+              `arn:aws:sns:*:` + accountId + `:*EventTopic-*`
+            ]])
+        }
+      }]));
+    new (Aws.sqs.QueuePolicy)(name, {
+      policy: queuePolicyDocument,
+      queueUrl: param[1]
+    }, opts);
+  });
+}
+
+function subscribeQueue2SnsTopic(queue, name, resources, opts) {
+  resources.map(resource => {
+    log.debug("EventCollector", undefined, `subscribeToSnsTopic: ` + name + ` -> ` + resource.name);
+    let subscription = Util_SQS$ReventlessAws.subscribeToSnsTopic(queue, name, resource.name, AdapterDeploytime$ReventlessCore.resolvedToResource(resource), opts);
+    return subscription.id.apply(id => log.debug("EventCollector", undefined, `created SNS subscription: ` + id + ` ` + name));
+  });
+}
+
+function connectSqsQueue2SnsTopics(queue, name, eventTopics, opts) {
+  Pulumi.all([
+    toResources(eventTopics),
+    queue.id
+  ]).apply(param => {
+    let eventTopicResources = param[0];
+    log.debug("EventCollector", undefined, `connectSqsQueue2SnsTopics ` + param[1] + `: ` + eventTopicResources.length.toString() + ` topic resource(s)`);
+    let snsResources = Adapter_Helpers$ReventlessAws.snsResources(eventTopicResources);
+    createQueuePolicy(queue, name, snsResources, opts);
+    subscribeQueue2SnsTopic(queue, name, snsResources, opts);
+  });
+}
+
+function connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources, opts) {
+  Pulumi.all([
+    toResources(eventTopics),
+    Pulumi.all(queues.map(queue => queue.arn)),
+    Adapter$ReventlessCore.resourcesToResolvedOutput(resources)
+  ]).apply(param => {
+    let resources = param[2];
+    let queueArns = param[1];
+    let eventTopicResources = param[0];
+    log.debug("EventCollector", undefined, `connectLambda ` + name + `: ` + eventTopicResources.length.toString() + ` topic resource(s), ` + resources.length.toString() + ` resource(s)`);
+    let dynamoDbStreamResources = Adapter_Helpers$ReventlessAws.dynamoDbStreamResources(eventTopicResources);
+    let targetSnsResources = Adapter_Helpers$ReventlessAws.snsResources(resources);
+    let targetSqsResources = Adapter_Helpers$ReventlessAws.sqsResources(resources);
+    let targetDynamoDbResources = Adapter_Helpers$ReventlessAws.dynamoDbResources(resources);
+    let allowLambdaReadDynamoDbStream = dynamoDbStreamResources.length !== 0 ? PolicyDocument$PulumiAws.make(undefined, name + "LambdaDynamoDbStreamPolicy", [{
+          Sid: "AllowLambdaReadDynamoDbStream",
+          Effect: "Allow",
+          Action: [
+            "dynamodb:DescribeStream",
+            "dynamodb:GetRecords",
+            "dynamodb:GetShardIterator",
+            "dynamodb:ListStreams"
+          ],
+          Resource: Adapter$ReventlessCore.urns(dynamoDbStreamResources)
+        }]) : undefined;
+    let allowLambdaReadWriteDynamoDb = targetDynamoDbResources.length !== 0 ? PolicyDocument$PulumiAws.make(undefined, name + "LambdaAllowDynamoDbWrite", [{
+          Sid: "AllowLambdaReadWriteDynamoDb",
+          Effect: "Allow",
+          Action: [
+            "dynamodb:GetItem",
+            "dynamodb:Query",
+            "dynamodb:Scan",
+            "dynamodb:BatchGetItem",
+            "dynamodb:PutItem",
+            "dynamodb:UpdateItem",
+            "dynamodb:DeleteItem",
+            "dynamodb:BatchWriteItem"
+          ],
+          Resource: Adapter$ReventlessCore.urns(targetDynamoDbResources)
+        }]) : undefined;
+    let allowLambdaPublishSNS = targetSnsResources.length !== 0 ? PolicyDocument$PulumiAws.make(undefined, name + "PublishSNS", [{
+          Sid: "AllowLambdaPublishSNS",
+          Effect: "Allow",
+          Action: "sns:Publish",
+          Resource: Adapter$ReventlessCore.urns(targetSnsResources)
+        }]) : undefined;
+    let allowLambdaSendSQS = targetSqsResources.length !== 0 ? PolicyDocument$PulumiAws.make(undefined, name + "SendSQS", [{
+          Sid: "AllowLambdaSendSQS",
+          Effect: "Allow",
+          Action: "sqs:SendMessage",
+          Resource: Adapter$ReventlessCore.urns(targetSqsResources)
+        }]) : undefined;
+    let allowLambdaReceiveSQS = queueArns.length !== 0 ? PolicyDocument$PulumiAws.make(undefined, name + "LambdaSQSPolicy", [{
+          Sid: "AllowLambdaReceiveSQS",
+          Effect: "Allow",
+          Action: [
+            "sqs:ReceiveMessage",
+            "sqs:DeleteMessage",
+            "sqs:GetQueueAttributes"
+          ],
+          Resource: queueArns
+        }]) : undefined;
+    new (Aws.iam.RolePolicy)(name, {
+      policy: PolicyDocument$PulumiAws.mergePolicyDocuments(name + "LambdaPolicy", Stdlib_Array.keepSome([
+        Lambda$PulumiAws.defaultLoggingPolicyDocument,
+        allowLambdaReceiveSQS,
+        allowLambdaReadDynamoDbStream,
+        allowLambdaReadWriteDynamoDb,
+        allowLambdaPublishSNS,
+        allowLambdaSendSQS
+      ])),
+      role: lambdaRole.id
+    }, opts);
+    dynamoDbStreamResources.map(dynamoDbStreamResource => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, dynamoDbStreamResource.name, AdapterDeploytime$ReventlessCore.resolvedToResource(dynamoDbStreamResource), opts));
+  });
+  return queues.map((queue, idx) => {
+    let esmName = queues.length > 1 ? name + `Sqs` + idx.toString() : name;
+    return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, esmName, queue, undefined, opts);
+  });
+}
+
+export {
+  log,
+  toResources,
+  createQueuePolicy,
+  subscribeQueue2SnsTopic,
+  connectSqsQueue2SnsTopics,
+  connectLambda,
+}
+/* log Not a pure module */