@reventlessdev/reventless-aws 3.0.0-alpha.167

package/src/util/Util_AppSync_Caller.res.mjs

@@ -0,0 +1,170 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as HashNode from "@smithy/hash-node";
+import * as SignatureV4 from "@smithy/signature-v4";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as CredentialProviderNode from "@aws-sdk/credential-provider-node";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let sha256 = HashNode.Hash.bind(null, "sha256");
+
+function graphqlEnum(name) {
+  return Object.fromEntries([[
+      "__enum",
+      name
+    ]]);
+}
+
+function jsonToLiteral(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (Array.isArray(value)) {
+    return `[` + value.map(jsonToLiteral).join(", ") + `]`;
+  }
+  switch (typeof value) {
+    case "boolean" :
+      if (value) {
+        return "true";
+      } else {
+        return "false";
+      }
+    case "string" :
+      let escaped = value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
+      return `"` + escaped + `"`;
+    case "number" :
+      return value.toString();
+    case "object" :
+      let match = value["__enum"];
+      if (typeof match === "string") {
+        return match;
+      }
+      let pairs = Object.entries(value).map(param => param[0] + `: ` + jsonToLiteral(param[1]));
+      return `{` + pairs.join(", ") + `}`;
+  }
+}
+
+function buildQuery(mutation, variablesDict) {
+  let args = Object.entries(variablesDict).map(param => param[0] + `: ` + jsonToLiteral(param[1])).join(", ");
+  return `mutation { ` + mutation + `(` + args + `) }`;
+}
+
+async function sendQuery(endpoint, region, queryString) {
+  let url = new URL(endpoint);
+  let hostname = url.hostname;
+  let path = url.pathname;
+  let body = JSON.stringify(Object.fromEntries([[
+      "query",
+      queryString
+    ]]));
+  let credProvider = CredentialProviderNode.defaultProvider();
+  let signer = new SignatureV4.SignatureV4({
+    service: "appsync",
+    region: region,
+    credentials: credProvider,
+    sha256: sha256
+  });
+  let headers = Object.fromEntries([
+    [
+      "content-type",
+      "application/json"
+    ],
+    [
+      "host",
+      hostname
+    ]
+  ]);
+  let request = {
+    method: "POST",
+    hostname: hostname,
+    path: path,
+    headers: headers,
+    body: body
+  };
+  let signed = await signer.sign(request);
+  let response = await fetch(endpoint, {
+    method: "POST",
+    headers: signed.headers,
+    body: signed.body
+  });
+  let json = await response.json();
+  let d = Stdlib_JSON.Decode.object(json);
+  if (d === undefined) {
+    return;
+  }
+  let errors = d["errors"];
+  if (errors !== undefined) {
+    log.error("Util_AppSync_Caller", errors, "query errors");
+    return;
+  } else {
+    return d["data"];
+  }
+}
+
+async function sendMutation(endpoint, region, mutation, variables) {
+  let url = new URL(endpoint);
+  let hostname = url.hostname;
+  let path = url.pathname;
+  let str = JSON.stringify(variables);
+  let variablesDict;
+  if (str !== undefined) {
+    let d = JSON.parse(str);
+    variablesDict = typeof d === "object" && d !== null && !Array.isArray(d) ? d : ({});
+  } else {
+    variablesDict = {};
+  }
+  let query = buildQuery(mutation, variablesDict);
+  let body = JSON.stringify(Object.fromEntries([[
+      "query",
+      query
+    ]]));
+  let credProvider = CredentialProviderNode.defaultProvider();
+  let signer = new SignatureV4.SignatureV4({
+    service: "appsync",
+    region: region,
+    credentials: credProvider,
+    sha256: sha256
+  });
+  let headers = Object.fromEntries([
+    [
+      "content-type",
+      "application/json"
+    ],
+    [
+      "host",
+      hostname
+    ]
+  ]);
+  let request = {
+    method: "POST",
+    hostname: hostname,
+    path: path,
+    headers: headers,
+    body: body
+  };
+  let signed = await signer.sign(request);
+  let response = await fetch(endpoint, {
+    method: "POST",
+    headers: signed.headers,
+    body: signed.body
+  });
+  let json = await response.json();
+  let errors = Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), d => d["errors"]);
+  if (errors !== undefined) {
+    return log.error("Util_AppSync_Caller", errors, mutation + ` errors`);
+  }
+}
+
+export {
+  log,
+  sha256,
+  graphqlEnum,
+  jsonToLiteral,
+  buildQuery,
+  sendQuery,
+  sendMutation,
+}
+/* log Not a pure module */

package/src/util/Util_Bundle.res

@@ -0,0 +1,255 @@
+// Node.js path bindings
+@module("path") external dirname: string => string = "dirname"
+@module("path") external join2: (string, string) => string = "join"
+@module("path") external relative: (string, string) => string = "relative"
+
+// Node.js fs bindings
+@module("fs") external existsSync: string => bool = "existsSync"
+@module("fs") external readFileSync: (string, string) => string = "readFileSync"
+type dirent
+@module("fs") external readdirSync: (string, {"withFileTypes": bool}) => array<dirent> = "readdirSync"
+@send external isDirectory: dirent => bool = "isDirectory"
+@get external direntName: dirent => string = "name"
+
+// Node.js crypto bindings
+type hashObj
+@module("crypto") external createHash: string => hashObj = "createHash"
+@send external update: (hashObj, string) => hashObj = "update"
+@send external digest: (hashObj, string) => string = "digest"
+
+// URL global
+type urlObj
+@new external newURL: string => urlObj = "URL"
+@get external pathname: urlObj => string = "pathname"
+
+// module.createRequire
+type requireFn
+@module("module") external createRequire: string => requireFn = "createRequire"
+@send external requireResolve: (requireFn, string) => string = "resolve"
+
+// process.cwd
+@val @scope("process") external cwd: unit => string = "cwd"
+
+// Module-level state: cache populated by getModuleSpecifier
+let packageRootCache: dict<string> = Dict.make()
+let localRequire: requireFn = createRequire(%raw("import.meta.url"))
+
+/**
+ * Convert an import.meta.url file URL to an npm module specifier.
+ * Walks up from the file to find the nearest package.json, reads the package name,
+ * and constructs the npm specifier from packageName + relative path.
+ */
+let getModuleSpecifier = (importMetaUrl: string): string => {
+  if !(importMetaUrl->String.startsWith("file://")) {
+    importMetaUrl
+  } else {
+    let filePath = newURL(importMetaUrl)->pathname
+    let dirRef = ref(dirname(filePath))
+    let resultRef: ref<option<string>> = ref(None)
+    while dirRef.contents != "/" && resultRef.contents->Option.isNone {
+      let dir = dirRef.contents
+      let pkgPath = join2(dir, "package.json")
+      if existsSync(pkgPath) {
+        let pkgText = readFileSync(pkgPath, "utf-8")
+        switch pkgText->JSON.parseOrThrow->JSON.Decode.object {
+        | Some(obj) =>
+          switch obj->Dict.get("name")->Option.flatMap(JSON.Decode.string) {
+          | Some(pkgName) =>
+            packageRootCache->Dict.set(pkgName, dir)
+            let relPath = relative(dir, filePath)
+            resultRef := Some(pkgName ++ "/" ++ relPath)
+          | None => dirRef := dirname(dir)
+          }
+        | None => dirRef := dirname(dir)
+        }
+      } else {
+        dirRef := dirname(dir)
+      }
+    }
+    switch resultRef.contents {
+    | Some(specifier) => specifier
+    | None => JsError.throwWithMessage(`No package.json found for ${filePath}`)
+    }
+  }
+}
+
+/**
+ * Extract the npm package name from a module specifier.
+ * Handles scoped packages (@scope/pkg/path) and unscoped (pkg/path).
+ */
+let extractPackageName = (specifier: string): string => {
+  let parts = specifier->String.split("/")
+  if specifier->String.startsWith("@") {
+    parts->Array.getUnsafe(0) ++ "/" ++ parts->Array.getUnsafe(1)
+  } else {
+    parts->Array.getUnsafe(0)
+  }
+}
+
+/**
+ * Resolve the root directory of an npm package.
+ * Fast path: populated by getModuleSpecifier when it walks the package tree.
+ */
+let resolvePackageRoot = (packageName: string): string => {
+  switch packageRootCache->Dict.get(packageName) {
+  | Some(cachedRoot) => cachedRoot
+  | None =>
+    try {
+      let pkgJsonPath = localRequire->requireResolve(packageName ++ "/package.json")
+      dirname(pkgJsonPath)
+    } catch {
+    | _ =>
+      let cwdRequire = createRequire(cwd() ++ "/index.js")
+      let pkgJsonPath = cwdRequire->requireResolve(packageName ++ "/package.json")
+      dirname(pkgJsonPath)
+    }
+  }
+}
+
+/**
+ * Compute a SHA256 hash of a string, returned as base64.
+ */
+let hashString = (str: string): string =>
+  createHash("sha256")->update(str)->digest("base64")
+
+let isSkippedDir = (n: string) =>
+  n == "node_modules" ||
+  n == "lib" ||
+  n == "cjs" ||
+  n == "dts" ||
+  n == "tests" ||
+  n == "test" ||
+  n == "__mocks__" ||
+  n == "__tests__" ||
+  n == ".git" ||
+  n == "coverage"
+
+// Reads file as a string for content hashing; Buffer would be slightly more
+// efficient but utf-8 keeps the hash stable across platforms and matches what
+// Lambda will execute.
+@module("fs") external readFileAsString: (string, string) => string = "readFileSync"
+
+let rec walkDir = (
+  ~dir: string,
+  ~prefix: string,
+  ~assets: dict<Pulumi.Archive.assetOrArchive>,
+  ~paths: array<(string, string)>,
+) => {
+  let entries = readdirSync(dir, {"withFileTypes": true})
+  entries->Array.forEach(entry => {
+    let entryName = entry->direntName
+    if entry->isDirectory {
+      if !isSkippedDir(entryName) {
+        let newPrefix = prefix == "" ? entryName : prefix ++ "/" ++ entryName
+        walkDir(~dir=join2(dir, entryName), ~prefix=newPrefix, ~assets, ~paths)
+      }
+    } else if entryName == "package.json" || entryName->String.endsWith(".mjs") || entryName->String.endsWith(".js") {
+      let relPath = prefix == "" ? entryName : prefix ++ "/" ++ entryName
+      let absPath = join2(dir, entryName)
+      assets->Dict.set(
+        relPath,
+        Pulumi.Asset.fileAsset(absPath)->Pulumi.Archive.assetToAssetOrArchive,
+      )
+      paths->Array.push((relPath, absPath))
+    }
+  })
+}
+
+/**
+ * Create a filtered AssetArchive from a package directory.
+ * Only includes *.mjs and package.json; excludes node_modules/, lib/, tests/, etc.
+ * Returns both the archive and a content hash covering every bundled file so
+ * callers can produce a sourceCodeHash that changes when any source changes.
+ */
+let createFilteredPackageArchive = (packageRoot: string): (Pulumi.Archive.t, string) => {
+  let assets: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
+  let paths: array<(string, string)> = []
+  walkDir(~dir=packageRoot, ~prefix="", ~assets, ~paths)
+  // Sort so the hash is stable across filesystem traversal order.
+  paths->Array.sort(((a, _), (b, _)) => String.compare(a, b))
+  let combined =
+    paths
+    ->Array.map(((relPath, absPath)) => `${relPath}:${readFileAsString(absPath, "utf-8")}`)
+    ->Array.join("\n---\n")
+  (Pulumi.Archive.assetArchive(assets), hashString(combined))
+}
+
+type codeArchive = {
+  code: Pulumi.Archive.t,
+  sourceCodeHash: string,
+}
+
+/**
+ * Build a Lambda code AssetArchive with a static re-export entry point and optional user packages.
+ * Centralises the archive-building pattern used by every runtime builder.
+ *
+ * When @reventlessdev/reventless-aws is bundled, effect is automatically co-bundled.
+ * The entry points in reventless-aws import effect statically, and ESM resolution
+ * walks up from /var/task/node_modules/reventless-aws/... — it never reaches the
+ * Lambda layer at /opt/nodejs/node_modules. Bundling effect alongside ensures it
+ * is found at /var/task/node_modules/effect.
+ */
+let buildCodeArchive = (
+  ~entryPointModule: string,
+  ~packageDirs: dict<string>,
+  // Extra string-typed assets to drop at the root of the asset zip. Keys are
+  // filenames (e.g. "pluginDefinition.json"); values are the file contents.
+  // The Lambda runtime extracts the zip to /var/task, so entry-point code can
+  // read each file via `readFileSync("/var/task/<filename>", "utf-8")` or
+  // (preferred) `readFileSync(new URL("./<filename>", import.meta.url))`.
+  // Used to ship payloads that would otherwise blow the 5120-byte
+  // UpdateFunctionConfiguration limit when packed into HANDLER_CONFIG.
+  ~extraStringAssets: dict<string>=Dict.make(),
+): codeArchive => {
+  let reExportCode = `export { handler } from "${entryPointModule}";`
+  let archiveContents: dict<Pulumi.Archive.assetOrArchive> = Dict.make()
+  archiveContents->Dict.set(
+    "index.mjs",
+    Pulumi.Asset.stringAsset(reExportCode)->Pulumi.Archive.assetToAssetOrArchive,
+  )
+  extraStringAssets->Dict.forEachWithKey((content, fileName) => {
+    archiveContents->Dict.set(
+      fileName,
+      Pulumi.Asset.stringAsset(content)->Pulumi.Archive.assetToAssetOrArchive,
+    )
+  })
+  // Co-bundle effect whenever reventless-aws is bundled (see comment above).
+  let allPackageDirs =
+    if packageDirs->Dict.has("@reventlessdev/reventless-aws") &&
+      !(packageDirs->Dict.has("effect")) {
+      let dirs = packageDirs->Dict.copy
+      dirs->Dict.set("effect", resolvePackageRoot("effect"))
+      dirs
+    } else {
+      packageDirs
+    }
+  let packageContentHashes: ref<array<string>> = ref([])
+  allPackageDirs->Dict.forEachWithKey((pkgRoot, pkgName) => {
+    let (archive, contentHash) = createFilteredPackageArchive(pkgRoot)
+    archiveContents->Dict.set(
+      `node_modules/${pkgName}`,
+      archive->Pulumi.Archive.archiveToAssetOrArchive,
+    )
+    packageContentHashes.contents->Array.push(`${pkgName}:${contentHash}`)
+  })
+  // Extra-asset content participates in the source hash so a change to
+  // pluginDefinition.json triggers a Lambda code update.
+  let extraHashEntries: array<string> = []
+  let extraKeys = extraStringAssets->Dict.keysToArray
+  extraKeys->Array.sort(String.compare)
+  extraKeys->Array.forEach(k => {
+    let v = extraStringAssets->Dict.get(k)->Option.getOr("")
+    extraHashEntries->Array.push(`${k}:${v}`)
+  })
+  let code = Pulumi.Archive.assetArchive(archiveContents)
+  packageContentHashes.contents->Array.sort(String.compare)
+  let sourceCodeHash =
+    hashString(
+      reExportCode ++
+      "\n---\n" ++
+      packageContentHashes.contents->Array.join(",") ++
+      "\n---\n" ++
+      extraHashEntries->Array.join("\n"),
+    )
+  {code, sourceCodeHash}
+}

package/src/util/Util_Bundle.res.mjs

@@ -0,0 +1,179 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Fs from "fs";
+import * as Path from "path";
+import * as Crypto from "crypto";
+import * as Module from "module";
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+
+let packageRootCache = {};
+
+let localRequire = Module.createRequire(import.meta.url);
+
+function getModuleSpecifier(importMetaUrl) {
+  if (!importMetaUrl.startsWith("file://")) {
+    return importMetaUrl;
+  }
+  let filePath = new URL(importMetaUrl).pathname;
+  let dirRef = Path.dirname(filePath);
+  let resultRef;
+  while (dirRef !== "/" && Stdlib_Option.isNone(resultRef)) {
+    let dir = dirRef;
+    let pkgPath = Path.join(dir, "package.json");
+    if (Fs.existsSync(pkgPath)) {
+      let pkgText = Fs.readFileSync(pkgPath, "utf-8");
+      let obj = Stdlib_JSON.Decode.object(JSON.parse(pkgText));
+      if (obj !== undefined) {
+        let pkgName = Stdlib_Option.flatMap(obj["name"], Stdlib_JSON.Decode.string);
+        if (pkgName !== undefined) {
+          packageRootCache[pkgName] = dir;
+          let relPath = Path.relative(dir, filePath);
+          resultRef = pkgName + "/" + relPath;
+        } else {
+          dirRef = Path.dirname(dir);
+        }
+      } else {
+        dirRef = Path.dirname(dir);
+      }
+    } else {
+      dirRef = Path.dirname(dir);
+    }
+  };
+  let specifier = resultRef;
+  if (specifier !== undefined) {
+    return specifier;
+  } else {
+    return Stdlib_JsError.throwWithMessage(`No package.json found for ` + filePath);
+  }
+}
+
+function extractPackageName(specifier) {
+  let parts = specifier.split("/");
+  if (specifier.startsWith("@")) {
+    return parts[0] + "/" + parts[1];
+  } else {
+    return parts[0];
+  }
+}
+
+function resolvePackageRoot(packageName) {
+  let cachedRoot = packageRootCache[packageName];
+  if (cachedRoot !== undefined) {
+    return cachedRoot;
+  }
+  try {
+    return Path.dirname(localRequire.resolve(packageName + "/package.json"));
+  } catch (exn) {
+    let cwdRequire = Module.createRequire(process.cwd() + "/index.js");
+    return Path.dirname(cwdRequire.resolve(packageName + "/package.json"));
+  }
+}
+
+function hashString(str) {
+  return Crypto.createHash("sha256").update(str).digest("base64");
+}
+
+function isSkippedDir(n) {
+  if (n === "node_modules" || n === "lib" || n === "cjs" || n === "dts" || n === "tests" || n === "test" || n === "__mocks__" || n === "__tests__" || n === ".git") {
+    return true;
+  } else {
+    return n === "coverage";
+  }
+}
+
+function walkDir(dir, prefix, assets, paths) {
+  let entries = Fs.readdirSync(dir, {
+    withFileTypes: true
+  });
+  entries.forEach(entry => {
+    let entryName = entry.name;
+    if (entry.isDirectory()) {
+      if (isSkippedDir(entryName)) {
+        return;
+      }
+      let newPrefix = prefix === "" ? entryName : prefix + "/" + entryName;
+      return walkDir(Path.join(dir, entryName), newPrefix, assets, paths);
+    }
+    if (!(entryName === "package.json" || entryName.endsWith(".mjs") || entryName.endsWith(".js"))) {
+      return;
+    }
+    let relPath = prefix === "" ? entryName : prefix + "/" + entryName;
+    let absPath = Path.join(dir, entryName);
+    assets[relPath] = new (Pulumi.asset.FileAsset)(absPath);
+    paths.push([
+      relPath,
+      absPath
+    ]);
+  });
+}
+
+function createFilteredPackageArchive(packageRoot) {
+  let assets = {};
+  let paths = [];
+  walkDir(packageRoot, "", assets, paths);
+  paths.sort((param, param$1) => Primitive_string.compare(param[0], param$1[0]));
+  let combined = paths.map(param => param[0] + `:` + Fs.readFileSync(param[1], "utf-8")).join("\n---\n");
+  return [
+    new (Pulumi.asset.AssetArchive)(assets),
+    hashString(combined)
+  ];
+}
+
+function buildCodeArchive(entryPointModule, packageDirs, extraStringAssetsOpt) {
+  let extraStringAssets = extraStringAssetsOpt !== undefined ? extraStringAssetsOpt : ({});
+  let reExportCode = `export { handler } from "` + entryPointModule + `";`;
+  let archiveContents = {};
+  archiveContents["index.mjs"] = new (Pulumi.asset.StringAsset)(reExportCode);
+  Stdlib_Dict.forEachWithKey(extraStringAssets, (content, fileName) => {
+    archiveContents[fileName] = new (Pulumi.asset.StringAsset)(content);
+  });
+  let allPackageDirs;
+  if ("@reventlessdev/reventless-aws" in packageDirs && !("effect" in packageDirs)) {
+    let dirs = Object.assign({}, packageDirs);
+    dirs["effect"] = resolvePackageRoot("effect");
+    allPackageDirs = dirs;
+  } else {
+    allPackageDirs = packageDirs;
+  }
+  let packageContentHashes = {
+    contents: []
+  };
+  Stdlib_Dict.forEachWithKey(allPackageDirs, (pkgRoot, pkgName) => {
+    let match = createFilteredPackageArchive(pkgRoot);
+    archiveContents[`node_modules/` + pkgName] = match[0];
+    packageContentHashes.contents.push(pkgName + `:` + match[1]);
+  });
+  let extraHashEntries = [];
+  let extraKeys = Object.keys(extraStringAssets);
+  extraKeys.sort(Primitive_string.compare);
+  extraKeys.forEach(k => {
+    let v = Stdlib_Option.getOr(extraStringAssets[k], "");
+    extraHashEntries.push(k + `:` + v);
+  });
+  let code = new (Pulumi.asset.AssetArchive)(archiveContents);
+  packageContentHashes.contents.sort(Primitive_string.compare);
+  let sourceCodeHash = hashString(reExportCode + "\n---\n" + packageContentHashes.contents.join(",") + "\n---\n" + extraHashEntries.join("\n"));
+  return {
+    code: code,
+    sourceCodeHash: sourceCodeHash
+  };
+}
+
+export {
+  packageRootCache,
+  localRequire,
+  getModuleSpecifier,
+  extractPackageName,
+  resolvePackageRoot,
+  hashString,
+  isSkippedDir,
+  walkDir,
+  createFilteredPackageArchive,
+  buildCodeArchive,
+}
+/* localRequire Not a pure module */

package/src/util/Util_Cloudwatch.res

@@ -0,0 +1,14 @@
+module EventRule = {
+  let toResource: PulumiAws.Cloudwatch.EventRule.t => ReventlessInfra.Adapter.resource = ({
+    id,
+    name,
+    arn,
+  }) =>
+    ReventlessInfra.Adapter.make(
+      ~name,
+      ~id,
+      ~urn=arn,
+      ~service=name->Pulumi.Output.apply(_ => AWS.CloudwatchEventRule.service),
+      ~resourceType="aws:cloudwatch:EventRule"->Pulumi.Output.make,
+    )
+}

package/src/util/Util_Cloudwatch.res.mjs

@@ -0,0 +1,19 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pulumi from "@pulumi/pulumi";
+import * as AWS$ReventlessAws from "../adapter/AWS.res.mjs";
+import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
+
+function toResource(param) {
+  let name = param.name;
+  return Adapter$ReventlessInfra.make(name, param.id, param.arn, name.apply(param => AWS$ReventlessAws.CloudwatchEventRule.service), undefined, undefined, undefined, Pulumi.output("aws:cloudwatch:EventRule"), undefined, undefined);
+}
+
+let EventRule = {
+  toResource: toResource
+};
+
+export {
+  EventRule,
+}
+/* @pulumi/pulumi Not a pure module */

package/src/util/Util_CognitoGroupUser.res

@@ -0,0 +1,39 @@
+let addUserGroup = (~name: string, ~userPoolId: Pulumi.Output.t<string>) =>
+  PulumiAws.Cognito.UserGroup.make(
+    ~name="UserGroup-" ++ name,
+    ~args={
+      PulumiAws.Cognito.UserGroup.name: name->Pulumi.Input.make,
+      userPoolId: userPoolId->Pulumi.Output.asInput,
+    },
+  )
+
+let makeAddRemoveUserToGroupPolicy = (
+  ~name: string,
+  ~userPoolArn: Pulumi.Output.t<string>,
+  ~opts: option<Pulumi.CustomResourceOptions.t>=?,
+) =>
+  userPoolArn->Pulumi.Output.apply(userPoolArn => {
+    open PulumiAws.PolicyDocument
+    PulumiAws.IAM.Policy.make(
+      ~name=name ++ "AddRemoveUserToGroup",
+      ~args={
+        PulumiAws.IAM.Policy.policy: PulumiAws.PolicyDocument.make(
+          ~id=name ++ "UserPoolPolicy",
+          ~statements=[
+            {
+              sid: "AllowAdminAddRemoveUserToGroup",
+              effect: Allow,
+              actions: Actions([
+                "cognito-idp:AdminAddUserToGroup",
+                "cognito-idp:AdminRemoveUserFromGroup",
+              ]),
+              resources: Resource(`${userPoolArn}`),
+            },
+          ],
+        )
+        ->toJsonString
+        ->Pulumi.Input.make,
+      },
+      ~opts?,
+    )
+  })