@reventlessdev/reventless-aws 3.0.0-alpha.252 → 3.0.0-alpha.254

package/src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs

@@ -0,0 +1,261 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S3$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/S3.res.mjs";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as ClientS3 from "@aws-sdk/client-s3";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as DynamoDb_Util_Helpers$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_Util_Helpers.res.mjs";
+import * as Upload_PendingTag$ReventlessAws from "./Upload_PendingTag.res.mjs";
+
+function getEnv(k) {
+  let v = process.env[k];
+  if (v !== undefined && v !== "") {
+    return v;
+  }
+}
+
+function parseEnvObject(k) {
+  let match = Stdlib_Option.map(getEnv(k), s => JSON.parse(s));
+  if (match !== undefined) {
+    if (typeof match === "object" && match !== null && !Array.isArray(match)) {
+      return match;
+    } else {
+      return {};
+    }
+  } else {
+    return {};
+  }
+}
+
+function decodeStore(json) {
+  if (typeof json !== "object" || json === null || Array.isArray(json)) {
+    return;
+  }
+  let match = Stdlib_Option.flatMap(json["bucket"], Stdlib_JSON.Decode.string);
+  let match$1 = Stdlib_Option.flatMap(json["prefix"], Stdlib_JSON.Decode.string);
+  if (match !== undefined && match$1 !== undefined) {
+    return {
+      bucket: match,
+      prefix: match$1
+    };
+  }
+}
+
+let stores = Object.fromEntries(Stdlib_Array.filterMap(Object.entries(parseEnvObject("UPLOAD_STORES")), param => {
+  let k = param[0];
+  return Stdlib_Option.map(decodeStore(param[1]), c => [
+    k,
+    c
+  ]);
+}));
+
+function decodeRefField(json) {
+  if (typeof json !== "object" || json === null || Array.isArray(json)) {
+    return;
+  }
+  let match = Stdlib_Option.flatMap(json["field"], Stdlib_JSON.Decode.string);
+  let match$1 = Stdlib_Option.flatMap(json["store"], Stdlib_JSON.Decode.string);
+  if (match !== undefined && match$1 !== undefined) {
+    return {
+      field: match,
+      many: Primitive_object.equal(Stdlib_Option.flatMap(json["arity"], Stdlib_JSON.Decode.string), "many"),
+      store: match$1
+    };
+  }
+}
+
+function decodeEventFields(json) {
+  if (typeof json === "object" && json !== null && !Array.isArray(json)) {
+    return Object.fromEntries(Object.entries(json).map(param => {
+      let v = param[1];
+      let tmp;
+      tmp = Array.isArray(v) ? Stdlib_Array.filterMap(v, decodeRefField) : [];
+      return [
+        param[0],
+        tmp
+      ];
+    }));
+  } else {
+    return {};
+  }
+}
+
+let refFieldsByTable = Object.fromEntries(Object.entries(parseEnvObject("CLAIM_REF_FIELDS")).map(param => [
+  param[0],
+  decodeEventFields(param[1])
+]));
+
+function tableNameFromEventSourceArn(arn) {
+  let parts = arn.split("/");
+  let match = parts[0];
+  let match$1 = parts[1];
+  let match$2 = parts[2];
+  if (match !== undefined && match$1 !== undefined && match$2 !== undefined && match$2 === "stream" && match.endsWith(":table")) {
+    return match$1;
+  }
+}
+
+function refsOfField(data, field) {
+  let match = data[field.field];
+  if (match === undefined) {
+    return [];
+  }
+  if (Array.isArray(match)) {
+    if (field.many) {
+      return Stdlib_Array.filterMap(match, v => {
+        if (typeof v === "string" && v !== "") {
+          return v;
+        }
+      });
+    } else {
+      return [];
+    }
+  }
+  switch (typeof match) {
+    case "string" :
+      if (!field.many && match !== "") {
+        return [match];
+      } else {
+        return [];
+      }
+    default:
+      return [];
+  }
+}
+
+function keyOfRef(storageRef) {
+  if (storageRef.startsWith("/")) {
+    return storageRef.slice(1, storageRef.length);
+  } else {
+    return storageRef;
+  }
+}
+
+function resolveTarget(store, storageRef) {
+  let match = stores[store];
+  if (match === undefined) {
+    return {
+      TAG: "Error",
+      _0: `unknown_store ` + store
+    };
+  }
+  let key = keyOfRef(storageRef);
+  if (key.startsWith(match.prefix + `/`)) {
+    return {
+      TAG: "Ok",
+      _0: {
+        bucket: match.bucket,
+        key: key
+      }
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: `not_in_store ` + store + ` ` + storageRef
+    };
+  }
+}
+
+async function claim(bucket, key) {
+  try {
+    let current = await S3$AwsSdk.GetObjectTaggingCommand.send(new ClientS3.GetObjectTaggingCommand({
+      Bucket: bucket,
+      Key: key
+    }));
+    let tagSet = Stdlib_Option.getOr(current.TagSet, []);
+    let remaining = tagSet.filter(t => t.Key !== Upload_PendingTag$ReventlessAws.key);
+    if (remaining.length !== tagSet.length) {
+      await S3$AwsSdk.PutObjectTaggingCommand.send(new ClientS3.PutObjectTaggingCommand({
+        Bucket: bucket,
+        Key: key,
+        Tagging: {
+          TagSet: remaining
+        }
+      }));
+      return;
+    } else {
+      return;
+    }
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    let match = Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.name);
+    if (match !== undefined) {
+      switch (match) {
+        case "NoSuchKey" :
+        case "NotFound" :
+          return;
+        default:
+          throw exn;
+      }
+    } else {
+      throw exn;
+    }
+  }
+}
+
+function targetsOfRecord(record) {
+  let match = Stdlib_Option.flatMap(tableNameFromEventSourceArn(record.eventSourceARN), t => refFieldsByTable[t]);
+  let match$1 = Stdlib_Option.flatMap(record.dynamodb, d => d.NewImage);
+  if (match === undefined) {
+    return [];
+  }
+  if (match$1 === undefined) {
+    return [];
+  }
+  let row = DynamoDb_Util_Helpers$AwsSdk.unmarshallDict(undefined, match$1);
+  let match$2 = Stdlib_Option.flatMap(row["event"], Stdlib_JSON.Decode.string);
+  let match$3 = row["data"];
+  if (match$2 !== undefined) {
+    if (match$3 !== undefined) {
+      if (typeof match$3 === "object" && match$3 !== null && !Array.isArray(match$3)) {
+        return Stdlib_Option.getOr(match[match$2], []).flatMap(field => Stdlib_Array.filterMap(refsOfField(match$3, field), storageRef => {
+          let target = resolveTarget(field.store, storageRef);
+          if (target.TAG === "Ok") {
+            return target._0;
+          }
+          console.error("Upload_Claim: refusing ref outside a declared store —", target._0);
+        }));
+      } else {
+        return [];
+      }
+    } else {
+      return [];
+    }
+  } else {
+    return [];
+  }
+}
+
+async function handler(event) {
+  let targets = event.Records.filter(r => r.eventName === "INSERT").flatMap(targetsOfRecord);
+  return await Stdlib_Array.reduce(targets, Promise.resolve(), (acc, param) => {
+    let key = param.key;
+    let bucket = param.bucket;
+    return acc.then(() => claim(bucket, key));
+  });
+}
+
+let S3;
+
+export {
+  S3,
+  getEnv,
+  parseEnvObject,
+  decodeStore,
+  stores,
+  decodeRefField,
+  decodeEventFields,
+  refFieldsByTable,
+  tableNameFromEventSourceArn,
+  refsOfField,
+  keyOfRef,
+  resolveTarget,
+  claim,
+  targetsOfRecord,
+  handler,
+}
+/* stores Not a pure module */

package/src/adapter/Upload/Upload_PendingTag.res

@@ -0,0 +1,41 @@
+// The tag that makes "nobody has committed a reference to this object yet"
+// visible to S3 itself.
+//
+// One definition, three readers, and they must agree exactly or the mechanism
+// deletes live data:
+//   - the mint side writes it on the presigned PUT (`Upload_Presign_S3_Ops`),
+//   - the claim side removes it when a committed event carries the ref
+//     (`Upload_Claim_S3_Ops`),
+//   - the bucket's lifecycle rule expires what still carries it
+//     (`Capability_ObjectStore_S3`).
+// A rule filtered on a key the mint side never writes matches *nothing*, which
+// fails safe; a claim side that strips a different key leaves every object
+// tagged, which does not. Hence one module rather than three string literals.
+//
+// Runtime-pure and Pulumi-free on purpose: two of the three readers are Lambda
+// handlers shipped as EntryPoint modules, so a deploy-time import here would
+// leak `@pulumi/pulumi` into their cold-start graph.
+//
+// The tag's meaning is deliberately "not yet claimed", never "safe to delete".
+// Nothing reads it as permission; the lifecycle rule adds an age condition of
+// its own, and it is opt-in per store.
+
+/** Tag key. `:` is a legal S3 tag-key character, and the `reventless:` prefix
+    keeps the framework's tags from colliding with a deployment's own. */
+let key = "reventless:pending"
+
+/** Tag value. A single-valued tag: the key's presence is the fact, and the
+    value exists only because S3 tags are pairs. */
+let value = "true"
+
+/**
+The `Tagging` parameter of a `PutObject`, in the URL-encoded query-string form
+S3 specifies for that header.
+
+The colon is percent-encoded here because the value is parsed as a query string
+by S3, so its key/value separators are the only characters that may appear raw.
+The SDK hoists this into the presigned URL's query string (verified against a
+live bucket: a PUT that sends nothing but `Content-Type` still lands the tag),
+so the caller needs no cooperation and cannot opt out.
+*/
+let putObjectTagging = `${key->encodeURIComponent}=${value->encodeURIComponent}`

package/src/adapter/Upload/Upload_PendingTag.res.mjs

@@ -0,0 +1,15 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let key = "reventless:pending";
+
+let value = "true";
+
+let putObjectTagging = encodeURIComponent(key) + `=` + encodeURIComponent(value);
+
+export {
+  key,
+  value,
+  putObjectTagging,
+}
+/* putObjectTagging Not a pure module */

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -11,7 +11,7 @@
 // There is no Function URL and no anonymous surface: authentication is the platform
 // API's Cognito authorizer, and the verified caller identity reaches the handler in
 // the resolver payload (see the JS resolver code below). This is route B of
-// [docs/plans/upload-release-path.md]; the anonymous Function URL and the unverified
+// [docs/plans/done/upload-release-path.md]; the anonymous Function URL and the unverified
 // `decodeJwtSub` the mint side used to carry are gone.
 //
 // Why an EntryPoint and not a Pulumi `CallbackFunction`: the handler needs the AWS
@@ -106,6 +106,11 @@ let make = (
   // `GetObject` backs the `HeadObject` the age check reads. One Lambda covers every
   // declared store (route B1) — but its reach is still the union of those prefixes,
   // not a wildcard, so it cannot touch a key outside a declared store.
+  //
+  // `PutObjectTagging` is what lets the presigned PUT carry the pending tag: a
+  // presigned request runs with the *signer's* permissions, so tag-on-put fails
+  // with AccessDenied without it — and an untagged object is one the sweep can
+  // never reach.
   let _policy =
     resolvedStores->Pulumi.Output.apply(list => {
       let arns = list->Array.map(((_, bucket, prefix)) => `arn:aws:s3:::${bucket}/${prefix}/*`)
@@ -124,7 +129,12 @@ let make = (
               {
                 sid: "AllowUploadObjectAccess",
                 effect: Allow,
-                actions: Actions(["s3:PutObject", "s3:DeleteObject", "s3:GetObject"]),
+                actions: Actions([
+                  "s3:PutObject",
+                  "s3:PutObjectTagging",
+                  "s3:DeleteObject",
+                  "s3:GetObject",
+                ]),
                 resources: Resources(arns),
               },
             ],

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -64,6 +64,7 @@ function make(api, stores, releaseWindowSecondsOpt, nameOpt, opts) {
           Effect: "Allow",
           Action: [
             "s3:PutObject",
+            "s3:PutObjectTagging",
             "s3:DeleteObject",
             "s3:GetObject"
           ],

package/src/adapter/Upload/Upload_Presign_S3_Ops.res

@@ -25,6 +25,7 @@ type putObjectInput = {
   @as("Bucket") bucket: string,
   @as("Key") key: string,
   @as("ContentType") contentType?: string,
+  @as("Tagging") tagging?: string,
 }
 type putObjectCommand
 
@@ -123,6 +124,10 @@ type releaseOutcome = Released | Refused(string)
 // Key must sit under this store's served prefix (`not_in_store`) and under the
 // caller's own identity segment within it (`not_yours`); an empty `sub` is
 // `unauthenticated` (the authorizer should have refused first — this is a guard).
+//
+// One prefix, not a set: changing a store's prefix strands the refs already
+// minted under the old one, so a prefix change is a breaking change resolved by
+// emptying the store and re-seeding, never by carrying both prefixes forever.
 let scopeCheck = (~key: string, ~sub: string, ~servedPrefix: string): result<unit, string> =>
   if sub == "" {
     Error("unauthenticated")
@@ -221,7 +226,18 @@ let handlePresign = async (
   // served prefix so the CloudFront `{prefix}/*` behavior fronts it, and namespaced
   // by the verified `sub` so the release rule can tell one caller's objects apart.
   let key = `${servedPrefix}/${sub}/${NodeCrypto.randomUUID()}/${fileName}`
-  let command = makePutObjectCommand({bucket, key, contentType: ?args.contentType})
+  // The object is provisional from the moment the bytes land: it carries the
+  // pending tag until a committed event referencing it strips it (see
+  // `Upload_Claim_S3_Ops`). Written into the signature here, not asked of the
+  // caller — the SDK hoists `x-amz-tagging` into the presigned URL's query
+  // string, so a client that PUTs exactly as it always has still gets tagged
+  // bytes, and cannot opt out.
+  let command = makePutObjectCommand({
+    bucket,
+    key,
+    contentType: ?args.contentType,
+    tagging: Upload_PendingTag.putObjectTagging,
+  })
   let uploadUrl = await getSignedUrl(client, command, {expiresIn: 300})
   // Same-origin relative ref `/{key}`: the served bucket is fronted read-only by the
   // UI's own CloudFront distribution under `{prefix}/*`, so a command stores this

package/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs

@@ -10,6 +10,7 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as ClientS3 from "@aws-sdk/client-s3";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as S3RequestPresigner from "@aws-sdk/s3-request-presigner";
+import * as Upload_PendingTag$ReventlessAws from "./Upload_PendingTag.res.mjs";
 
 function getEnv(k) {
   let v = process.env[k];
@@ -175,7 +176,8 @@ async function handlePresign(client, bucket, servedPrefix, sub, args) {
   let command = new ClientS3.PutObjectCommand({
     Bucket: bucket,
     Key: key,
-    ContentType: args.contentType
+    ContentType: args.contentType,
+    Tagging: Upload_PendingTag$ReventlessAws.putObjectTagging
   });
   let uploadUrl = await S3RequestPresigner.getSignedUrl(client, command, {
     expiresIn: 300

package/src/capability/Capability_ObjectStore_S3.res

@@ -37,6 +37,14 @@
 
 open PulumiAws
 
+/** One prefix in this bucket whose never-claimed uploads expire, and after how
+    many days. A list rather than a scalar because a shared-layout bucket holds
+    several stores, and expiry is opt-in per store. */
+type pendingExpiry = {
+  prefix: string,
+  days: int,
+}
+
 // Browser direct-PUT needs CORS. These defaults match what deployments wrote by
 // hand; `~corsRules` overrides them for a store the browser never touches.
 let defaultCorsRules: S3.Bucket.corsRules = [
@@ -64,13 +72,19 @@ let defaultCorsRules: S3.Bucket.corsRules = [
     `~protect` (default on) blocks `pulumi destroy` and accidental replacement.
     `~forceDestroy` is its counterpart for disposable stacks: a protected bucket
     cannot be torn down, so a PR stack would leak exactly the buckets that
-    sharing exists to save. */
+    sharing exists to save.
+
+    `~expirePending` turns on the sweep of never-claimed uploads. One entry per
+    prefix rather than one setting for the bucket, because a shared-layout
+    bucket holds several stores and the setting is each store's own — see the
+    comment on the rule below before setting it. */
 let make = (
   ~name: string,
   ~keyPrefix: string=Upload_Presign_S3.defaultServedPrefix,
   ~plugin: option<string>=?,
   ~protect: bool=true,
   ~forceDestroy: bool=false,
+  ~expirePending: array<pendingExpiry>=[],
   ~corsRules: S3.Bucket.corsRules=defaultCorsRules,
   ~opts: option<Pulumi.CustomResourceOptions.t>=?,
 ): ReventlessInfra.Platform.objectStore => {
@@ -92,11 +106,38 @@ let make = (
     protect,
   }
 
+  // Expire objects nobody ever claimed — the half of abandonment the release
+  // path cannot reach, because the client that would have released them is
+  // gone (tab closed, navigation, dead network).
+  //
+  // Filtered on the pending tag **and** this store's served prefix, never on
+  // either alone, and written per store rather than once per bucket — a shared
+  // bucket holds several stores, and expiring a neighbouring store's objects on
+  // this store's setting would be exactly the wrong kind of surprise on a
+  // bucket created with `protect: true`.
+  //
+  // What makes it safe is what it *cannot* match. An object minted before this
+  // mechanism existed carries no tag; a claimed object has had its tag stripped.
+  // Neither is inside the filter, so the rule's blast radius is precisely
+  // "uploaded here, and no committed event references it". The one way it
+  // deletes live data is a claim component that stopped and was not noticed —
+  // which is why the claimer alarms on its own lag, why this is opt-in per
+  // store, and why the plan sequences reconciliation before the first store
+  // turns it on.
+  let lifecycleRules = expirePending->Array.map(({prefix, days}) => {
+    S3.Bucket.id: `reventless-pending-expiry-${prefix->String.replaceAll("/", "-")}`,
+    enabled: true,
+    prefix: `${prefix}/`,
+    tags: Dict.fromArray([(Upload_PendingTag.key, Upload_PendingTag.value)]),
+    expiration: {days: days},
+  })
+
   let bucket = S3.Bucket.make(
     ~name,
     ~args={
       corsRules: corsRules->Pulumi.Input.make,
       forceDestroy: forceDestroy->Pulumi.Input.make,
+      lifecycleRules: lifecycleRules->Pulumi.Input.make,
       tags: AWS.Tags.make(
         ~name,
         ~kind,

package/src/capability/Capability_ObjectStore_S3.res.mjs

@@ -3,6 +3,7 @@
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as AWS_Tags$ReventlessAws from "../adapter/AWS_Tags.res.mjs";
+import * as Upload_PendingTag$ReventlessAws from "../adapter/Upload/Upload_PendingTag.res.mjs";
 import * as Upload_Presign_S3$ReventlessAws from "../adapter/Upload/Upload_Presign_S3.res.mjs";
 
 let defaultCorsRules = [{
@@ -18,10 +19,11 @@ let defaultCorsRules = [{
     maxAgeSeconds: 3000
   }];
 
-function make(name, keyPrefixOpt, plugin, protectOpt, forceDestroyOpt, corsRulesOpt, opts) {
+function make(name, keyPrefixOpt, plugin, protectOpt, forceDestroyOpt, expirePendingOpt, corsRulesOpt, opts) {
   let keyPrefix = keyPrefixOpt !== undefined ? keyPrefixOpt : Upload_Presign_S3$ReventlessAws.defaultServedPrefix;
   let protect = protectOpt !== undefined ? protectOpt : true;
   let forceDestroy = forceDestroyOpt !== undefined ? forceDestroyOpt : false;
+  let expirePending = expirePendingOpt !== undefined ? expirePendingOpt : [];
   let corsRules = corsRulesOpt !== undefined ? corsRulesOpt : defaultCorsRules;
   let match = plugin !== undefined ? [
       "Plugin",
@@ -32,9 +34,25 @@ function make(name, keyPrefixOpt, plugin, protectOpt, forceDestroyOpt, corsRules
     ];
   let newrecord = {...Stdlib_Option.getOr(opts, {})};
   newrecord.protect = protect;
+  let lifecycleRules = expirePending.map(param => {
+    let prefix = param.prefix;
+    return {
+      enabled: true,
+      expiration: {
+        days: param.days
+      },
+      id: `reventless-pending-expiry-` + prefix.replaceAll("/", "-"),
+      prefix: prefix + `/`,
+      tags: Object.fromEntries([[
+          Upload_PendingTag$ReventlessAws.key,
+          Upload_PendingTag$ReventlessAws.value
+        ]])
+    };
+  });
   let bucket = new (Aws.s3.Bucket)(name, {
     corsRules: corsRules,
     forceDestroy: forceDestroy,
+    lifecycleRules: lifecycleRules,
     tags: AWS_Tags$ReventlessAws.make(name, match[0], {
       TAG: "Other",
       _0: "ObjectStore"

package/src/components/Api/AppSync_Adapter.res

@@ -549,6 +549,42 @@ let _makeApiResourceWith = (
   }
   let graphQLApi = AppSync.GraphQLApi.make(~name, ~args=apiArgs, ~opts=Some(customOpts))
 
+  // Managed log group with tiered retention for AppSync's own field-resolver logs,
+  // which land in `/aws/appsync/apis/<id>` and otherwise live forever with no
+  // retention. Managed on every stack by default (bar any in
+  // `unmanagedLogGroupStacks`), same as the Lambda groups. The name derives from
+  // the API id output so it matches the group AppSync writes to, and Pulumi
+  // therefore tears it down with the API.
+  let stack = Pulumi.Pulumi.getStackName()
+  let prodStacks = Util_HostUiDomain.resolveProdStacks()
+  let unmanagedStacks = Util_LogRetention.parseUnmanagedStacks(
+    Util_LocalConfig.get("unmanagedLogGroupStacks")->Option.getOr(""),
+  )
+  if Util_LogRetention.managesLogGroup(~stack, ~unmanagedStacks) {
+    let _ = Cloudwatch.LogGroup.make(
+      ~name=`${name}AppSyncLogGroup`,
+      ~args={
+        name: graphQLApi.id
+        ->Pulumi.Output.apply(id => `/aws/appsync/apis/${id}`)
+        ->Pulumi.Output.asInput,
+        retentionInDays: Util_LogRetention.retentionDaysFor(
+          ~stack,
+          ~prodStacks,
+          ~configOverride=?Util_LocalConfig.get("logRetentionDays")->Option.flatMap(s =>
+            Int.fromString(s)
+          ),
+        )->Pulumi.Input.make,
+        tags: AWS.Tags.make(
+          ~name=`${name}AppSyncLogGroup`,
+          ~kind=ReventlessCore.ComponentType.Plugin,
+          ~role=Logs,
+          ~scope=Plugin,
+        ),
+      },
+      ~opts=customOpts,
+    )
+  }
+
   (graphQLApi->Pulumi.Output.make, iamRole->Pulumi.Output.make)
 }
 

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Effect from "@reventlessdev/rescript-effect/src/Effect.res.mjs";
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Nodecrypto from "node:crypto";
@@ -15,7 +16,10 @@ import * as AWS_Tags$ReventlessAws from "../../adapter/AWS_Tags.res.mjs";
 import * as ClientAppsync from "@aws-sdk/client-appsync";
 import * as Auth_Cognito$ReventlessAws from "../../adapter/Auth/Auth_Cognito.res.mjs";
 import * as AppSync_Error$ReventlessAws from "../../errors/AppSync_Error.res.mjs";
+import * as Util_LocalConfig$ReventlessAws from "../../util/Util_LocalConfig.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as Util_HostUiDomain$ReventlessAws from "../../util/Util_HostUiDomain.res.mjs";
+import * as Util_LogRetention$ReventlessAws from "../../util/Util_LogRetention.res.mjs";
 import * as AppSync_SdlDecorate$ReventlessAws from "./AppSync_SdlDecorate.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
@@ -308,6 +312,16 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
     tags: apiArgs_tags
   };
   let graphQLApi = new (Aws.appsync.GraphQLApi)(name, apiArgs, customOpts);
+  let stack = Pulumi.getStack();
+  let prodStacks = Util_HostUiDomain$ReventlessAws.resolveProdStacks();
+  let unmanagedStacks = Util_LogRetention$ReventlessAws.parseUnmanagedStacks(Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("unmanagedLogGroupStacks"), ""));
+  if (Util_LogRetention$ReventlessAws.managesLogGroup(stack, unmanagedStacks)) {
+    new (Aws.cloudwatch.LogGroup)(name + `AppSyncLogGroup`, {
+      name: graphQLApi.id.apply(id => `/aws/appsync/apis/` + id),
+      retentionInDays: Util_LogRetention$ReventlessAws.retentionDaysFor(stack, prodStacks, Stdlib_Option.flatMap(Util_LocalConfig$ReventlessAws.get("logRetentionDays"), s => Stdlib_Int.fromString(s, undefined))),
+      tags: AWS_Tags$ReventlessAws.make(name + `AppSyncLogGroup`, "Plugin", "Logs", "Plugin", undefined, undefined, undefined, undefined)
+    }, customOpts);
+  }
   return [
     Pulumi.output(graphQLApi),
     Pulumi.output(iamRole)