@servicevic-oss/cdk-cleanup-certificate-validation-records 0.0.2

package/API.md

@@ -0,0 +1,202 @@
+# API Reference <a name="API Reference" id="api-reference"></a>
+
+## Constructs <a name="Constructs" id="Constructs"></a>
+
+### CertificateValidationRecordCleanup <a name="CertificateValidationRecordCleanup" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup"></a>
+
+This constructs will take care of deleting the orphaned route53 records that ACM will leave behind when deleting a DNS validated certificate.
+
+#### Initializers <a name="Initializers" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.Initializer"></a>
+
+```typescript
+import { CertificateValidationRecordCleanup } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'
+
+new CertificateValidationRecordCleanup(scope: Construct, id: string, props: CertificateValidationRecordCleanupProps)
+```
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.Initializer.parameter.scope">scope</a></code> | <code>constructs.Construct</code> | *No description.* |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.Initializer.parameter.id">id</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.Initializer.parameter.props">props</a></code> | <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanupProps">CertificateValidationRecordCleanupProps</a></code> | *No description.* |
+
+---
+
+##### `scope`<sup>Required</sup> <a name="scope" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.Initializer.parameter.scope"></a>
+
+- *Type:* constructs.Construct
+
+---
+
+##### `id`<sup>Required</sup> <a name="id" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.Initializer.parameter.id"></a>
+
+- *Type:* string
+
+---
+
+##### `props`<sup>Required</sup> <a name="props" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.Initializer.parameter.props"></a>
+
+- *Type:* <a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanupProps">CertificateValidationRecordCleanupProps</a>
+
+---
+
+#### Methods <a name="Methods" id="Methods"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.toString">toString</a></code> | Returns a string representation of this construct. |
+
+---
+
+##### `toString` <a name="toString" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.toString"></a>
+
+```typescript
+public toString(): string
+```
+
+Returns a string representation of this construct.
+
+#### Static Functions <a name="Static Functions" id="Static Functions"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.isConstruct">isConstruct</a></code> | Checks if `x` is a construct. |
+
+---
+
+##### ~~`isConstruct`~~ <a name="isConstruct" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.isConstruct"></a>
+
+```typescript
+import { CertificateValidationRecordCleanup } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'
+
+CertificateValidationRecordCleanup.isConstruct(x: any)
+```
+
+Checks if `x` is a construct.
+
+###### `x`<sup>Required</sup> <a name="x" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.isConstruct.parameter.x"></a>
+
+- *Type:* any
+
+Any object.
+
+---
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.handlerFunction">handlerFunction</a></code> | <code>aws-cdk-lib.aws_lambda_nodejs.NodejsFunction</code> | *No description.* |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.provider">provider</a></code> | <code>aws-cdk-lib.custom_resources.Provider</code> | *No description.* |
+
+---
+
+##### `node`<sup>Required</sup> <a name="node" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.node"></a>
+
+```typescript
+public readonly node: Node;
+```
+
+- *Type:* constructs.Node
+
+The tree node.
+
+---
+
+##### `handlerFunction`<sup>Required</sup> <a name="handlerFunction" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.handlerFunction"></a>
+
+```typescript
+public readonly handlerFunction: NodejsFunction;
+```
+
+- *Type:* aws-cdk-lib.aws_lambda_nodejs.NodejsFunction
+
+---
+
+##### `provider`<sup>Required</sup> <a name="provider" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.provider"></a>
+
+```typescript
+public readonly provider: Provider;
+```
+
+- *Type:* aws-cdk-lib.custom_resources.Provider
+
+---
+
+#### Constants <a name="Constants" id="Constants"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.HANDLER_UID">HANDLER_UID</a></code> | <code>string</code> | *No description.* |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.PROVIDER_UID">PROVIDER_UID</a></code> | <code>string</code> | *No description.* |
+
+---
+
+##### `HANDLER_UID`<sup>Required</sup> <a name="HANDLER_UID" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.HANDLER_UID"></a>
+
+```typescript
+public readonly HANDLER_UID: string;
+```
+
+- *Type:* string
+
+---
+
+##### `PROVIDER_UID`<sup>Required</sup> <a name="PROVIDER_UID" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup.property.PROVIDER_UID"></a>
+
+```typescript
+public readonly PROVIDER_UID: string;
+```
+
+- *Type:* string
+
+---
+
+## Structs <a name="Structs" id="Structs"></a>
+
+### CertificateValidationRecordCleanupProps <a name="CertificateValidationRecordCleanupProps" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanupProps"></a>
+
+#### Initializer <a name="Initializer" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanupProps.Initializer"></a>
+
+```typescript
+import { CertificateValidationRecordCleanupProps } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'
+
+const certificateValidationRecordCleanupProps: CertificateValidationRecordCleanupProps = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanupProps.property.certificate">certificate</a></code> | <code>aws-cdk-lib.aws_certificatemanager.ICertificate</code> | The ACM certificate that created the validation records. |
+| <code><a href="#@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanupProps.property.hostedZone">hostedZone</a></code> | <code>aws-cdk-lib.aws_route53.IHostedZone</code> | The Route53 hosted zone where the certificate validation records have been created for a certificate. |
+
+---
+
+##### `certificate`<sup>Required</sup> <a name="certificate" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanupProps.property.certificate"></a>
+
+```typescript
+public readonly certificate: ICertificate;
+```
+
+- *Type:* aws-cdk-lib.aws_certificatemanager.ICertificate
+
+The ACM certificate that created the validation records.
+
+---
+
+##### `hostedZone`<sup>Required</sup> <a name="hostedZone" id="@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanupProps.property.hostedZone"></a>
+
+```typescript
+public readonly hostedZone: IHostedZone;
+```
+
+- *Type:* aws-cdk-lib.aws_route53.IHostedZone
+
+The Route53 hosted zone where the certificate validation records have been created for a certificate.
+
+---
+
+
+

package/LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2024 Matteo Sessa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,128 @@
+# cdk-cleanup-certificate-validation-records
+
+This CDK construct takes care of cleaning up the orphaned Route53 CNAME validation records
+left behind when deleting a certificate that had DNS validation enabled.
+
+The issue is better explained here: https://github.com/aws/aws-cdk/issues/11201
+
+## Usage
+
+### Explicit instantiation
+
+The construct can be instantiated explicitely to cleanup after a specific certificate
+
+```typescript
+import * as cdk from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { CertificateValidationRecordCleanup } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'
+
+export class TestStack extends cdk.Stack {
+  constructor(scope: Construct, id: string, props: TestStackProps) {
+    super(scope, id, props);
+
+    zone = new cdk.aws_route53.PublicHostedZone(this, 'Zone', {
+      zoneName: 'my.zone.net',
+    });
+
+    const cert1 = new cdk.aws_certificatemanager.Certificate(this, 'Cert', {
+      domainName: `mydomain.${envHostedZoneExternal.zoneName}`,
+      validation: cdk.aws_certificatemanager.CertificateValidation.fromDns(zone),
+      subjectAlternativeNames: [
+        `mydomain2.${zone.zoneName}`,
+        `mydomain3.${zone.zoneName}`,
+      ],
+    });
+    const cert2 = new cdk.aws_certificatemanager.Certificate(this, 'Cert', {
+      domainName: `another.${envHostedZoneExternal.zoneName}`,
+      validation: cdk.aws_certificatemanager.CertificateValidation.fromDns(zone),
+    });
+
+    new CertificateValidationRecordCleanup(this, `cleanup-${cert1.node.id}`, {
+      certificate: cert1,
+      hostedZone: envHostedZoneExternal,
+    });
+
+    new CertificateValidationRecordCleanup(this, `cleanup-${cert2.node.id}`, {
+      certificate: cert2,
+      hostedZone: envHostedZoneExternal,
+    });
+  };
+}
+```
+
+### Implicit instantiation using Aspects with knowledge of the hosted zone
+
+The construct can be instantiated automatically against any Certificate resource created within a stack
+through the use of Aspects
+
+In this example, we have knowledge of the hosted zone
+
+```typescript
+import * as cdk from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { CertificateValidationRecordCleanup } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'
+
+export class TestStack extends cdk.Stack {
+  constructor(scope: Construct, id: string, props: TestStackProps) {
+    super(scope, id, props);
+
+    zone = new cdk.aws_route53.PublicHostedZone(this, 'Zone', {
+      zoneName: 'my.zone.net',
+    });
+
+    new cdk.aws_certificatemanager.Certificate(this, 'Cert', {
+      domainName: `mydomain.${envHostedZoneExternal.zoneName}`,
+      validation: cdk.aws_certificatemanager.CertificateValidation.fromDns(zone),
+      subjectAlternativeNames: [
+        `mydomain2.${zone.zoneName}`,
+        `mydomain3.${zone.zoneName}`,
+      ],
+    });
+    new cdk.aws_certificatemanager.Certificate(this, 'Cert', {
+      domainName: `another.${envHostedZoneExternal.zoneName}`,
+      validation: cdk.aws_certificatemanager.CertificateValidation.fromDns(zone),
+    });
+
+    cdk.Aspects.of(this).add({
+      visit: (c) => {
+        if (c instanceof cdk.aws_certificatemanager.Certificate) {
+          new CertificateValidationRecordCleanup(this, `cleanup-${c.node.id}`, {
+            certificate: c,
+            hostedZone: zone,
+          });
+        }
+      },
+    });
+  };
+}
+```
+
+### Implicit instantiation using Aspects without knowledge of the hosted zone
+
+The construct can be instantiated automatically against any Certificate resource created within a stack
+through the use of Aspects
+
+In this example, we have no knowledge of the hosted zone used to validate the certificate so we use a bit of brute force to derive it from the Certificate L1 resource
+
+```typescript
+import * as cdk from 'aws-cdk-lib';
+import { CertificateValidationRecordCleanup } from '@servicevic-oss/cdk-cleanup-certificate-validation-records'
+
+const app = new cdk.App();
+
+const blackBoxStack = new BlackBoxStack(app, 'my-blackbox-stack');
+  
+cdk.Aspects.of(blackBoxStack).add({
+  visit: (c) => {
+    if (c instanceof cdk.aws_certificatemanager.Certificate) {
+      const cfnRes = c.node.defaultChild as cdk.aws_certificatemanager.CfnCertificate;
+      const valOpts = (cfnRes.domainValidationOptions as cdk.aws_certificatemanager.CfnCertificate.DomainValidationOptionProperty[])[0];
+
+      new CertificateValidationRecordCleanup(c, `cleanup-${c.node.id}`, {
+        certificate: c,
+        hostedZone: cdk.aws_route53.HostedZone.fromHostedZoneId(c, `lookup-${c.node.id}`, valOpts.hostedZoneId!),
+      });
+    }
+  },
+});
+```

package/lib/cleanup-certificate-validation-records.handler.d.ts

@@ -0,0 +1,9 @@
+import { CdkCustomResourceEvent, CdkCustomResourceResponse, Handler } from 'aws-lambda';
+export interface CleanupCertificateValidationRecordsRequestProperties {
+    readonly HostedZoneId: string;
+    readonly CertificateArn: string;
+}
+export type CleanupCertificateValidationRecordsCustomResourceEvent = CdkCustomResourceEvent & {
+    readonly ResourceProperties: CleanupCertificateValidationRecordsRequestProperties;
+};
+export declare const handler: Handler<CleanupCertificateValidationRecordsCustomResourceEvent, CdkCustomResourceResponse>;

package/lib/cleanup-certificate-validation-records.handler.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const acm = require("@aws-sdk/client-acm");
+const route53 = require("@aws-sdk/client-route-53");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const retry = require('async-await-retry');
+const handler = async (event, context) => {
+    console.log('Received event', JSON.stringify(event, null, 4));
+    console.log('Received context', JSON.stringify(context, null, 4));
+    if (!event.ResourceProperties.HostedZoneId) {
+        throw new Error('missing required resource property: HostedZoneId');
+    }
+    if (!event.ResourceProperties.CertificateArn) {
+        throw new Error('missing required resource property: CertificateArn');
+    }
+    if (event.RequestType === 'Delete') {
+        const acmClient = new acm.ACMClient();
+        const route53Client = new route53.Route53Client();
+        console.log(`retrieving certificate with arn ${event.ResourceProperties.CertificateArn}`);
+        const response = await (acmClient.send(new acm.DescribeCertificateCommand({
+            CertificateArn: event.ResourceProperties.CertificateArn,
+        })));
+        if (!response.Certificate || !response.Certificate.DomainValidationOptions) {
+            console.log('received ambigous response from api', JSON.stringify(response, null, 4));
+            throw new Error('received ambigous response from api');
+        }
+        // Collect all successful DNS validations for the certificate
+        const dnsValidations = response.Certificate.DomainValidationOptions.filter(dvo => dvo.ValidationStatus == 'SUCCESS' && dvo.ValidationMethod == 'DNS' && dvo.ResourceRecord);
+        // Collect all records for the validations
+        const recordsToDelete = dnsValidations.map(v => v.ResourceRecord.Name);
+        console.log(`deleting the following records from route53 hosted zone ${event.ResourceProperties.HostedZoneId}`, JSON.stringify(recordsToDelete, null, 4));
+        const retriable = async () => {
+            const getRecordsResponse = await route53Client.send(new route53.ListResourceRecordSetsCommand({
+                HostedZoneId: event.ResourceProperties.HostedZoneId,
+            }));
+            const recordSetsForValidations = getRecordsResponse.ResourceRecordSets.filter(rs => recordsToDelete.includes(rs.Name));
+            // Prepare a DNS change request to delete all the validation records
+            const changes = recordSetsForValidations.map(r => ({
+                Action: 'DELETE',
+                ResourceRecordSet: {
+                    Name: r.Name,
+                    Type: r.Type,
+                    ResourceRecords: r.ResourceRecords,
+                    TTL: r.TTL,
+                },
+            }));
+            if (changes.length > 0) {
+                await (route53Client.send(new route53.ChangeResourceRecordSetsCommand({
+                    HostedZoneId: event.ResourceProperties.HostedZoneId,
+                    ChangeBatch: {
+                        Changes: changes,
+                    },
+                })));
+            }
+        };
+        try {
+            await retry(retriable, undefined, { interval: 1000 });
+        }
+        catch (err) {
+            console.error('The function execution failed!', err);
+        }
+    }
+    return {
+        PhysicalResourceId: `cleanup-${event.ResourceProperties.HostedZoneId}-${event.ResourceProperties.CertificateArn}`,
+    };
+};
+exports.handler = handler;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xlYW51cC1jZXJ0aWZpY2F0ZS12YWxpZGF0aW9uLXJlY29yZHMuaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9jbGVhbnVwLWNlcnRpZmljYXRlLXZhbGlkYXRpb24tcmVjb3Jkcy5oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJDQUEyQztBQUMzQyxvREFBb0Q7QUFFcEQsaUVBQWlFO0FBQ2pFLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0FBV3BDLE1BQU0sT0FBTyxHQUErRixLQUFLLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO0lBQzFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDOUQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUVsRSxJQUFJLENBQUMsS0FBSyxDQUFDLGtCQUFrQixDQUFDLFlBQVksRUFBRSxDQUFDO1FBQzNDLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUM3QyxNQUFNLElBQUksS0FBSyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUVELElBQUksS0FBSyxDQUFDLFdBQVcsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNuQyxNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUN0QyxNQUFNLGFBQWEsR0FBRyxJQUFJLE9BQU8sQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUVsRCxPQUFPLENBQUMsR0FBRyxDQUFDLG1DQUFtQyxLQUFLLENBQUMsa0JBQWtCLENBQUMsY0FBYyxFQUFFLENBQUMsQ0FBQztRQUUxRixNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsQ0FBQywwQkFBMEIsQ0FBQztZQUN4RSxjQUFjLEVBQUUsS0FBSyxDQUFDLGtCQUFrQixDQUFDLGNBQWM7U0FDeEQsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUVMLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1lBQzNFLE9BQU8sQ0FBQyxHQUFHLENBQUMscUNBQXFDLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDdEYsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFFRCw2REFBNkQ7UUFDN0QsTUFBTSxjQUFjLEdBQUcsUUFBUSxDQUFDLFdBQVcsQ0FBQyx1QkFBdUIsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLElBQUksU0FBUyxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsSUFBSSxLQUFLLElBQUksR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBRTVLLDBDQUEwQztRQUMxQyxNQUFNLGVBQWUsR0FBRyxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLGNBQWUsQ0FBQyxJQUFLLENBQUMsQ0FBQztRQUV6RSxPQUFPLENBQUMsR0FBRyxDQUFDLDJEQUEyRCxLQUFLLENBQUMsa0JBQWtCLENBQUMsWUFBWSxFQUFFLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxlQUFlLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFHMUosTUFBTSxTQUFTLEdBQUcsS0FBSyxJQUFJLEVBQUU7WUFDM0IsTUFBTSxrQkFBa0IsR0FBRyxNQUFNLGFBQWEsQ0FBQyxJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsNkJBQTZCLENBQUM7Z0JBQzVGLFlBQVksRUFBRSxLQUFLLENBQUMsa0JBQWtCLENBQUMsWUFBWTthQUNwRCxDQUFDLENBQUMsQ0FBQztZQUNKLE1BQU0sd0JBQXdCLEdBQUcsa0JBQWtCLENBQUMsa0JBQW1CLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsSUFBSyxDQUFDLENBQUMsQ0FBQztZQUV6SCxvRUFBb0U7WUFDcEUsTUFBTSxPQUFPLEdBQXFCLHdCQUF3QixDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7Z0JBQ25FLE1BQU0sRUFBRSxRQUFRO2dCQUNoQixpQkFBaUIsRUFBRTtvQkFDakIsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJO29CQUNaLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSTtvQkFDWixlQUFlLEVBQUUsQ0FBQyxDQUFDLGVBQWU7b0JBQ2xDLEdBQUcsRUFBRSxDQUFDLENBQUMsR0FBRztpQkFDWDthQUNGLENBQUMsQ0FBQyxDQUFDO1lBRUosSUFBSSxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUN2QixNQUFNLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxJQUFJLE9BQU8sQ0FBQywrQkFBK0IsQ0FBQztvQkFDcEUsWUFBWSxFQUFFLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxZQUFZO29CQUNuRCxXQUFXLEVBQUU7d0JBQ1gsT0FBTyxFQUFFLE9BQU87cUJBQ2pCO2lCQUNGLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDUCxDQUFDO1FBQ0gsQ0FBQyxDQUFDO1FBRUYsSUFBSSxDQUFDO1lBQ0gsTUFBTSxLQUFLLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1lBQ2IsT0FBTyxDQUFDLEtBQUssQ0FBQyxnQ0FBZ0MsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUN2RCxDQUFDO0lBQ0gsQ0FBQztJQUVELE9BQU87UUFDTCxrQkFBa0IsRUFBRSxXQUFXLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxZQUFZLElBQUksS0FBSyxDQUFDLGtCQUFrQixDQUFDLGNBQWMsRUFBRTtLQUNsSCxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBeEVXLFFBQUEsT0FBTyxXQXdFbEIiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBhY20gZnJvbSAnQGF3cy1zZGsvY2xpZW50LWFjbSc7XG5pbXBvcnQgKiBhcyByb3V0ZTUzIGZyb20gJ0Bhd3Mtc2RrL2NsaWVudC1yb3V0ZS01Myc7XG5pbXBvcnQgeyBDZGtDdXN0b21SZXNvdXJjZUV2ZW50LCBDZGtDdXN0b21SZXNvdXJjZVJlc3BvbnNlLCBIYW5kbGVyIH0gZnJvbSAnYXdzLWxhbWJkYSc7XG4vLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgQHR5cGVzY3JpcHQtZXNsaW50L25vLXJlcXVpcmUtaW1wb3J0c1xuY29uc3QgcmV0cnkgPSByZXF1aXJlKCdhc3luYy1hd2FpdC1yZXRyeScpO1xuXG5leHBvcnQgaW50ZXJmYWNlIENsZWFudXBDZXJ0aWZpY2F0ZVZhbGlkYXRpb25SZWNvcmRzUmVxdWVzdFByb3BlcnRpZXMge1xuICByZWFkb25seSBIb3N0ZWRab25lSWQ6IHN0cmluZztcbiAgcmVhZG9ubHkgQ2VydGlmaWNhdGVBcm46IHN0cmluZztcbn1cblxuZXhwb3J0IHR5cGUgQ2xlYW51cENlcnRpZmljYXRlVmFsaWRhdGlvblJlY29yZHNDdXN0b21SZXNvdXJjZUV2ZW50ID0gQ2RrQ3VzdG9tUmVzb3VyY2VFdmVudCAmIHtcbiAgcmVhZG9ubHkgUmVzb3VyY2VQcm9wZXJ0aWVzOiBDbGVhbnVwQ2VydGlmaWNhdGVWYWxpZGF0aW9uUmVjb3Jkc1JlcXVlc3RQcm9wZXJ0aWVzO1xufVxuXG5leHBvcnQgY29uc3QgaGFuZGxlcjogSGFuZGxlcjxDbGVhbnVwQ2VydGlmaWNhdGVWYWxpZGF0aW9uUmVjb3Jkc0N1c3RvbVJlc291cmNlRXZlbnQsIENka0N1c3RvbVJlc291cmNlUmVzcG9uc2U+ID0gYXN5bmMgKGV2ZW50LCBjb250ZXh0KSA9PiB7XG4gIGNvbnNvbGUubG9nKCdSZWNlaXZlZCBldmVudCcsIEpTT04uc3RyaW5naWZ5KGV2ZW50LCBudWxsLCA0KSk7XG4gIGNvbnNvbGUubG9nKCdSZWNlaXZlZCBjb250ZXh0JywgSlNPTi5zdHJpbmdpZnkoY29udGV4dCwgbnVsbCwgNCkpO1xuXG4gIGlmICghZXZlbnQuUmVzb3VyY2VQcm9wZXJ0aWVzLkhvc3RlZFpvbmVJZCkge1xuICAgIHRocm93IG5ldyBFcnJvcignbWlzc2luZyByZXF1aXJlZCByZXNvdXJjZSBwcm9wZXJ0eTogSG9zdGVkWm9uZUlkJyk7XG4gIH1cbiAgaWYgKCFldmVudC5SZXNvdXJjZVByb3BlcnRpZXMuQ2VydGlmaWNhdGVBcm4pIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ21pc3NpbmcgcmVxdWlyZWQgcmVzb3VyY2UgcHJvcGVydHk6IENlcnRpZmljYXRlQXJuJyk7XG4gIH1cblxuICBpZiAoZXZlbnQuUmVxdWVzdFR5cGUgPT09ICdEZWxldGUnKSB7XG4gICAgY29uc3QgYWNtQ2xpZW50ID0gbmV3IGFjbS5BQ01DbGllbnQoKTtcbiAgICBjb25zdCByb3V0ZTUzQ2xpZW50ID0gbmV3IHJvdXRlNTMuUm91dGU1M0NsaWVudCgpO1xuXG4gICAgY29uc29sZS5sb2coYHJldHJpZXZpbmcgY2VydGlmaWNhdGUgd2l0aCBhcm4gJHtldmVudC5SZXNvdXJjZVByb3BlcnRpZXMuQ2VydGlmaWNhdGVBcm59YCk7XG5cbiAgICBjb25zdCByZXNwb25zZSA9IGF3YWl0IChhY21DbGllbnQuc2VuZChuZXcgYWNtLkRlc2NyaWJlQ2VydGlmaWNhdGVDb21tYW5kKHtcbiAgICAgIENlcnRpZmljYXRlQXJuOiBldmVudC5SZXNvdXJjZVByb3BlcnRpZXMuQ2VydGlmaWNhdGVBcm4sXG4gICAgfSkpKTtcblxuICAgIGlmICghcmVzcG9uc2UuQ2VydGlmaWNhdGUgfHwgIXJlc3BvbnNlLkNlcnRpZmljYXRlLkRvbWFpblZhbGlkYXRpb25PcHRpb25zKSB7XG4gICAgICBjb25zb2xlLmxvZygncmVjZWl2ZWQgYW1iaWdvdXMgcmVzcG9uc2UgZnJvbSBhcGknLCBKU09OLnN0cmluZ2lmeShyZXNwb25zZSwgbnVsbCwgNCkpO1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdyZWNlaXZlZCBhbWJpZ291cyByZXNwb25zZSBmcm9tIGFwaScpO1xuICAgIH1cblxuICAgIC8vIENvbGxlY3QgYWxsIHN1Y2Nlc3NmdWwgRE5TIHZhbGlkYXRpb25zIGZvciB0aGUgY2VydGlmaWNhdGVcbiAgICBjb25zdCBkbnNWYWxpZGF0aW9ucyA9IHJlc3BvbnNlLkNlcnRpZmljYXRlLkRvbWFpblZhbGlkYXRpb25PcHRpb25zLmZpbHRlcihkdm8gPT4gZHZvLlZhbGlkYXRpb25TdGF0dXMgPT0gJ1NVQ0NFU1MnICYmIGR2by5WYWxpZGF0aW9uTWV0aG9kID09ICdETlMnICYmIGR2by5SZXNvdXJjZVJlY29yZCk7XG5cbiAgICAvLyBDb2xsZWN0IGFsbCByZWNvcmRzIGZvciB0aGUgdmFsaWRhdGlvbnNcbiAgICBjb25zdCByZWNvcmRzVG9EZWxldGUgPSBkbnNWYWxpZGF0aW9ucy5tYXAodiA9PiB2LlJlc291cmNlUmVjb3JkIS5OYW1lISk7XG5cbiAgICBjb25zb2xlLmxvZyhgZGVsZXRpbmcgdGhlIGZvbGxvd2luZyByZWNvcmRzIGZyb20gcm91dGU1MyBob3N0ZWQgem9uZSAke2V2ZW50LlJlc291cmNlUHJvcGVydGllcy5Ib3N0ZWRab25lSWR9YCwgSlNPTi5zdHJpbmdpZnkocmVjb3Jkc1RvRGVsZXRlLCBudWxsLCA0KSk7XG5cblxuICAgIGNvbnN0IHJldHJpYWJsZSA9IGFzeW5jICgpID0+IHtcbiAgICAgIGNvbnN0IGdldFJlY29yZHNSZXNwb25zZSA9IGF3YWl0IHJvdXRlNTNDbGllbnQuc2VuZChuZXcgcm91dGU1My5MaXN0UmVzb3VyY2VSZWNvcmRTZXRzQ29tbWFuZCh7XG4gICAgICAgIEhvc3RlZFpvbmVJZDogZXZlbnQuUmVzb3VyY2VQcm9wZXJ0aWVzLkhvc3RlZFpvbmVJZCxcbiAgICAgIH0pKTtcbiAgICAgIGNvbnN0IHJlY29yZFNldHNGb3JWYWxpZGF0aW9ucyA9IGdldFJlY29yZHNSZXNwb25zZS5SZXNvdXJjZVJlY29yZFNldHMhLmZpbHRlcihycyA9PiByZWNvcmRzVG9EZWxldGUuaW5jbHVkZXMocnMuTmFtZSEpKTtcblxuICAgICAgLy8gUHJlcGFyZSBhIEROUyBjaGFuZ2UgcmVxdWVzdCB0byBkZWxldGUgYWxsIHRoZSB2YWxpZGF0aW9uIHJlY29yZHNcbiAgICAgIGNvbnN0IGNoYW5nZXM6IHJvdXRlNTMuQ2hhbmdlW10gPSByZWNvcmRTZXRzRm9yVmFsaWRhdGlvbnMubWFwKHIgPT4gKHtcbiAgICAgICAgQWN0aW9uOiAnREVMRVRFJyxcbiAgICAgICAgUmVzb3VyY2VSZWNvcmRTZXQ6IHtcbiAgICAgICAgICBOYW1lOiByLk5hbWUsXG4gICAgICAgICAgVHlwZTogci5UeXBlLFxuICAgICAgICAgIFJlc291cmNlUmVjb3Jkczogci5SZXNvdXJjZVJlY29yZHMsXG4gICAgICAgICAgVFRMOiByLlRUTCxcbiAgICAgICAgfSxcbiAgICAgIH0pKTtcblxuICAgICAgaWYgKGNoYW5nZXMubGVuZ3RoID4gMCkge1xuICAgICAgICBhd2FpdCAocm91dGU1M0NsaWVudC5zZW5kKG5ldyByb3V0ZTUzLkNoYW5nZVJlc291cmNlUmVjb3JkU2V0c0NvbW1hbmQoe1xuICAgICAgICAgIEhvc3RlZFpvbmVJZDogZXZlbnQuUmVzb3VyY2VQcm9wZXJ0aWVzLkhvc3RlZFpvbmVJZCxcbiAgICAgICAgICBDaGFuZ2VCYXRjaDoge1xuICAgICAgICAgICAgQ2hhbmdlczogY2hhbmdlcyxcbiAgICAgICAgICB9LFxuICAgICAgICB9KSkpO1xuICAgICAgfVxuICAgIH07XG5cbiAgICB0cnkge1xuICAgICAgYXdhaXQgcmV0cnkocmV0cmlhYmxlLCB1bmRlZmluZWQsIHsgaW50ZXJ2YWw6IDEwMDAgfSk7XG4gICAgfSBjYXRjaCAoZXJyKSB7XG4gICAgICBjb25zb2xlLmVycm9yKCdUaGUgZnVuY3Rpb24gZXhlY3V0aW9uIGZhaWxlZCEnLCBlcnIpO1xuICAgIH1cbiAgfVxuXG4gIHJldHVybiB7XG4gICAgUGh5c2ljYWxSZXNvdXJjZUlkOiBgY2xlYW51cC0ke2V2ZW50LlJlc291cmNlUHJvcGVydGllcy5Ib3N0ZWRab25lSWR9LSR7ZXZlbnQuUmVzb3VyY2VQcm9wZXJ0aWVzLkNlcnRpZmljYXRlQXJufWAsXG4gIH07XG59OyJdfQ==

package/lib/index.d.ts

@@ -0,0 +1,25 @@
+import * as cdk from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+export interface CertificateValidationRecordCleanupProps {
+    /**
+     * The Route53 hosted zone where the certificate validation records have been created for a certificate
+     */
+    readonly hostedZone: cdk.aws_route53.IHostedZone;
+    /**
+     * The ACM certificate that created the validation records
+     */
+    readonly certificate: cdk.aws_certificatemanager.ICertificate;
+}
+/**
+ * This constructs will take care of deleting the orphaned route53 records that ACM will
+ * leave behind when deleting a DNS validated certificate
+ */
+export declare class CertificateValidationRecordCleanup extends Construct {
+    static readonly HANDLER_UID = "CertRecordsCleanupHandler-2B663BAB-7981";
+    static readonly PROVIDER_UID = "CertRecordsCleanupProvider-57EBF059-2E26";
+    readonly handlerFunction: cdk.aws_lambda_nodejs.NodejsFunction;
+    readonly provider: cdk.custom_resources.Provider;
+    constructor(scope: Construct, id: string, props: CertificateValidationRecordCleanupProps);
+    private getOrCreateFunction;
+    private getOrCreateProvider;
+}

package/lib/index.js

@@ -0,0 +1,63 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertificateValidationRecordCleanup = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const path_1 = require("path");
+const cdk = require("aws-cdk-lib");
+const constructs_1 = require("constructs");
+/**
+ * This constructs will take care of deleting the orphaned route53 records that ACM will
+ * leave behind when deleting a DNS validated certificate
+ */
+class CertificateValidationRecordCleanup extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.handlerFunction = this.getOrCreateFunction();
+        this.provider = this.getOrCreateProvider();
+        this.handlerFunction.role?.addToPrincipalPolicy(new cdk.aws_iam.PolicyStatement({
+            actions: ['acm:DescribeCertificate'],
+            resources: [props.certificate.certificateArn],
+        }));
+        this.handlerFunction.role?.addToPrincipalPolicy(new cdk.aws_iam.PolicyStatement({
+            actions: [
+                'route53:ChangeResourceRecordSets',
+                'route53:ListResourceRecordSets',
+            ],
+            resources: [props.hostedZone.hostedZoneArn],
+        }));
+        new cdk.CustomResource(this, 'Resource', {
+            serviceToken: this.provider.serviceToken,
+            resourceType: 'Custom::CertificateValidationRecordCleanup',
+            properties: {
+                HostedZoneId: props.hostedZone.hostedZoneId,
+                CertificateArn: props.certificate.certificateArn,
+            },
+        });
+        this.node.addDependency(props.certificate, props.hostedZone);
+    }
+    getOrCreateFunction() {
+        const id = CertificateValidationRecordCleanup.HANDLER_UID;
+        const stack = cdk.Stack.of(this);
+        return stack.node.tryFindChild(id) ?? new cdk.aws_lambda_nodejs.NodejsFunction(stack, id, {
+            description: 'Handler function for the CertificateValidationRecordCleanup construct',
+            entry: (0, path_1.join)(__dirname, 'cleanup-certificate-validation-records.handler.ts'),
+            logRetention: cdk.aws_logs.RetentionDays.ONE_WEEK,
+            timeout: cdk.Duration.minutes(2),
+        });
+    }
+    getOrCreateProvider() {
+        const id = CertificateValidationRecordCleanup.PROVIDER_UID;
+        const stack = cdk.Stack.of(this);
+        return stack.node.tryFindChild(id) ?? new cdk.custom_resources.Provider(stack, id, {
+            onEventHandler: this.handlerFunction,
+            logRetention: cdk.aws_logs.RetentionDays.ONE_WEEK,
+        });
+    }
+}
+exports.CertificateValidationRecordCleanup = CertificateValidationRecordCleanup;
+_a = JSII_RTTI_SYMBOL_1;
+CertificateValidationRecordCleanup[_a] = { fqn: "@servicevic-oss/cdk-cleanup-certificate-validation-records.CertificateValidationRecordCleanup", version: "0.0.2" };
+CertificateValidationRecordCleanup.HANDLER_UID = 'CertRecordsCleanupHandler-2B663BAB-7981';
+CertificateValidationRecordCleanup.PROVIDER_UID = 'CertRecordsCleanupProvider-57EBF059-2E26';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSwrQkFBNEI7QUFDNUIsbUNBQW1DO0FBQ25DLDJDQUF1QztBQWV2Qzs7O0dBR0c7QUFDSCxNQUFhLGtDQUFtQyxTQUFRLHNCQUFTO0lBTy9ELFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBOEM7UUFDdEYsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUVqQixJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBQ2xELElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUM7UUFFM0MsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLEVBQUUsb0JBQW9CLENBQUMsSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQztZQUM5RSxPQUFPLEVBQUUsQ0FBQyx5QkFBeUIsQ0FBQztZQUNwQyxTQUFTLEVBQUUsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLGNBQWMsQ0FBQztTQUM5QyxDQUFDLENBQUMsQ0FBQztRQUNKLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxFQUFFLG9CQUFvQixDQUFDLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQUM7WUFDOUUsT0FBTyxFQUFFO2dCQUNQLGtDQUFrQztnQkFDbEMsZ0NBQWdDO2FBQ2pDO1lBQ0QsU0FBUyxFQUFFLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUM7U0FDNUMsQ0FBQyxDQUFDLENBQUM7UUFFSixJQUFJLEdBQUcsQ0FBQyxjQUFjLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRTtZQUN2QyxZQUFZLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZO1lBQ3hDLFlBQVksRUFBRSw0Q0FBNEM7WUFDMUQsVUFBVSxFQUFFO2dCQUNWLFlBQVksRUFBRSxLQUFLLENBQUMsVUFBVSxDQUFDLFlBQVk7Z0JBQzNDLGNBQWMsRUFBRSxLQUFLLENBQUMsV0FBVyxDQUFDLGNBQWM7YUFDakQ7U0FDRixDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUMvRCxDQUFDO0lBRU8sbUJBQW1CO1FBQ3pCLE1BQU0sRUFBRSxHQUFHLGtDQUFrQyxDQUFDLFdBQVcsQ0FBQztRQUMxRCxNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNqQyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBeUMsSUFBSSxJQUFJLEdBQUcsQ0FBQyxpQkFBaUIsQ0FBQyxjQUFjLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNoSSxXQUFXLEVBQUUsdUVBQXVFO1lBQ3BGLEtBQUssRUFBRSxJQUFBLFdBQUksRUFBQyxTQUFTLEVBQUUsbURBQW1ELENBQUM7WUFDM0UsWUFBWSxFQUFFLEdBQUcsQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLFFBQVE7WUFDakQsT0FBTyxFQUFFLEdBQUcsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztTQUNqQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU8sbUJBQW1CO1FBQ3pCLE1BQU0sRUFBRSxHQUFHLGtDQUFrQyxDQUFDLFlBQVksQ0FBQztRQUMzRCxNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNqQyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBa0MsSUFBSSxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNsSCxjQUFjLEVBQUUsSUFBSSxDQUFDLGVBQWU7WUFDcEMsWUFBWSxFQUFFLEdBQUcsQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLFFBQVE7U0FDbEQsQ0FBQyxDQUFDO0lBQ0wsQ0FBQzs7QUF2REgsZ0ZBd0RDOzs7QUF2RGlCLDhDQUFXLEdBQUcseUNBQXlDLENBQUM7QUFDeEQsK0NBQVksR0FBRywwQ0FBMEMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGpvaW4gfSBmcm9tICdwYXRoJztcbmltcG9ydCAqIGFzIGNkayBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcblxuZXhwb3J0IGludGVyZmFjZSBDZXJ0aWZpY2F0ZVZhbGlkYXRpb25SZWNvcmRDbGVhbnVwUHJvcHMge1xuICAvKipcbiAgICogVGhlIFJvdXRlNTMgaG9zdGVkIHpvbmUgd2hlcmUgdGhlIGNlcnRpZmljYXRlIHZhbGlkYXRpb24gcmVjb3JkcyBoYXZlIGJlZW4gY3JlYXRlZCBmb3IgYSBjZXJ0aWZpY2F0ZVxuICAgKi9cbiAgcmVhZG9ubHkgaG9zdGVkWm9uZTogY2RrLmF3c19yb3V0ZTUzLklIb3N0ZWRab25lO1xuXG4gIC8qKlxuICAgKiBUaGUgQUNNIGNlcnRpZmljYXRlIHRoYXQgY3JlYXRlZCB0aGUgdmFsaWRhdGlvbiByZWNvcmRzXG4gICAqL1xuICByZWFkb25seSBjZXJ0aWZpY2F0ZTogY2RrLmF3c19jZXJ0aWZpY2F0ZW1hbmFnZXIuSUNlcnRpZmljYXRlO1xufVxuXG5cbi8qKlxuICogVGhpcyBjb25zdHJ1Y3RzIHdpbGwgdGFrZSBjYXJlIG9mIGRlbGV0aW5nIHRoZSBvcnBoYW5lZCByb3V0ZTUzIHJlY29yZHMgdGhhdCBBQ00gd2lsbFxuICogbGVhdmUgYmVoaW5kIHdoZW4gZGVsZXRpbmcgYSBETlMgdmFsaWRhdGVkIGNlcnRpZmljYXRlXG4gKi9cbmV4cG9ydCBjbGFzcyBDZXJ0aWZpY2F0ZVZhbGlkYXRpb25SZWNvcmRDbGVhbnVwIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgc3RhdGljIHJlYWRvbmx5IEhBTkRMRVJfVUlEID0gJ0NlcnRSZWNvcmRzQ2xlYW51cEhhbmRsZXItMkI2NjNCQUItNzk4MSc7XG4gIHN0YXRpYyByZWFkb25seSBQUk9WSURFUl9VSUQgPSAnQ2VydFJlY29yZHNDbGVhbnVwUHJvdmlkZXItNTdFQkYwNTktMkUyNic7XG5cbiAgcHVibGljIHJlYWRvbmx5IGhhbmRsZXJGdW5jdGlvbjogY2RrLmF3c19sYW1iZGFfbm9kZWpzLk5vZGVqc0Z1bmN0aW9uO1xuICBwdWJsaWMgcmVhZG9ubHkgcHJvdmlkZXI6IGNkay5jdXN0b21fcmVzb3VyY2VzLlByb3ZpZGVyO1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBDZXJ0aWZpY2F0ZVZhbGlkYXRpb25SZWNvcmRDbGVhbnVwUHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuXG4gICAgdGhpcy5oYW5kbGVyRnVuY3Rpb24gPSB0aGlzLmdldE9yQ3JlYXRlRnVuY3Rpb24oKTtcbiAgICB0aGlzLnByb3ZpZGVyID0gdGhpcy5nZXRPckNyZWF0ZVByb3ZpZGVyKCk7XG5cbiAgICB0aGlzLmhhbmRsZXJGdW5jdGlvbi5yb2xlPy5hZGRUb1ByaW5jaXBhbFBvbGljeShuZXcgY2RrLmF3c19pYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgIGFjdGlvbnM6IFsnYWNtOkRlc2NyaWJlQ2VydGlmaWNhdGUnXSxcbiAgICAgIHJlc291cmNlczogW3Byb3BzLmNlcnRpZmljYXRlLmNlcnRpZmljYXRlQXJuXSxcbiAgICB9KSk7XG4gICAgdGhpcy5oYW5kbGVyRnVuY3Rpb24ucm9sZT8uYWRkVG9QcmluY2lwYWxQb2xpY3kobmV3IGNkay5hd3NfaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICBhY3Rpb25zOiBbXG4gICAgICAgICdyb3V0ZTUzOkNoYW5nZVJlc291cmNlUmVjb3JkU2V0cycsXG4gICAgICAgICdyb3V0ZTUzOkxpc3RSZXNvdXJjZVJlY29yZFNldHMnLFxuICAgICAgXSxcbiAgICAgIHJlc291cmNlczogW3Byb3BzLmhvc3RlZFpvbmUuaG9zdGVkWm9uZUFybl0sXG4gICAgfSkpO1xuXG4gICAgbmV3IGNkay5DdXN0b21SZXNvdXJjZSh0aGlzLCAnUmVzb3VyY2UnLCB7XG4gICAgICBzZXJ2aWNlVG9rZW46IHRoaXMucHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgcmVzb3VyY2VUeXBlOiAnQ3VzdG9tOjpDZXJ0aWZpY2F0ZVZhbGlkYXRpb25SZWNvcmRDbGVhbnVwJyxcbiAgICAgIHByb3BlcnRpZXM6IHtcbiAgICAgICAgSG9zdGVkWm9uZUlkOiBwcm9wcy5ob3N0ZWRab25lLmhvc3RlZFpvbmVJZCxcbiAgICAgICAgQ2VydGlmaWNhdGVBcm46IHByb3BzLmNlcnRpZmljYXRlLmNlcnRpZmljYXRlQXJuLFxuICAgICAgfSxcbiAgICB9KTtcblxuICAgIHRoaXMubm9kZS5hZGREZXBlbmRlbmN5KHByb3BzLmNlcnRpZmljYXRlLCBwcm9wcy5ob3N0ZWRab25lKTtcbiAgfVxuXG4gIHByaXZhdGUgZ2V0T3JDcmVhdGVGdW5jdGlvbigpOiBjZGsuYXdzX2xhbWJkYV9ub2RlanMuTm9kZWpzRnVuY3Rpb24ge1xuICAgIGNvbnN0IGlkID0gQ2VydGlmaWNhdGVWYWxpZGF0aW9uUmVjb3JkQ2xlYW51cC5IQU5ETEVSX1VJRDtcbiAgICBjb25zdCBzdGFjayA9IGNkay5TdGFjay5vZih0aGlzKTtcbiAgICByZXR1cm4gc3RhY2subm9kZS50cnlGaW5kQ2hpbGQoaWQpIGFzIGNkay5hd3NfbGFtYmRhX25vZGVqcy5Ob2RlanNGdW5jdGlvbiA/PyBuZXcgY2RrLmF3c19sYW1iZGFfbm9kZWpzLk5vZGVqc0Z1bmN0aW9uKHN0YWNrLCBpZCwge1xuICAgICAgZGVzY3JpcHRpb246ICdIYW5kbGVyIGZ1bmN0aW9uIGZvciB0aGUgQ2VydGlmaWNhdGVWYWxpZGF0aW9uUmVjb3JkQ2xlYW51cCBjb25zdHJ1Y3QnLFxuICAgICAgZW50cnk6IGpvaW4oX19kaXJuYW1lLCAnY2xlYW51cC1jZXJ0aWZpY2F0ZS12YWxpZGF0aW9uLXJlY29yZHMuaGFuZGxlci50cycpLFxuICAgICAgbG9nUmV0ZW50aW9uOiBjZGsuYXdzX2xvZ3MuUmV0ZW50aW9uRGF5cy5PTkVfV0VFSyxcbiAgICAgIHRpbWVvdXQ6IGNkay5EdXJhdGlvbi5taW51dGVzKDIpLFxuICAgIH0pO1xuICB9XG5cbiAgcHJpdmF0ZSBnZXRPckNyZWF0ZVByb3ZpZGVyKCk6IGNkay5jdXN0b21fcmVzb3VyY2VzLlByb3ZpZGVyIHtcbiAgICBjb25zdCBpZCA9IENlcnRpZmljYXRlVmFsaWRhdGlvblJlY29yZENsZWFudXAuUFJPVklERVJfVUlEO1xuICAgIGNvbnN0IHN0YWNrID0gY2RrLlN0YWNrLm9mKHRoaXMpO1xuICAgIHJldHVybiBzdGFjay5ub2RlLnRyeUZpbmRDaGlsZChpZCkgYXMgY2RrLmN1c3RvbV9yZXNvdXJjZXMuUHJvdmlkZXIgPz8gbmV3IGNkay5jdXN0b21fcmVzb3VyY2VzLlByb3ZpZGVyKHN0YWNrLCBpZCwge1xuICAgICAgb25FdmVudEhhbmRsZXI6IHRoaXMuaGFuZGxlckZ1bmN0aW9uLFxuICAgICAgbG9nUmV0ZW50aW9uOiBjZGsuYXdzX2xvZ3MuUmV0ZW50aW9uRGF5cy5PTkVfV0VFSyxcbiAgICB9KTtcbiAgfVxufVxuIl19

package/node_modules/@aws-crypto/crc32/CHANGELOG.md

@@ -0,0 +1,76 @@
+# Change Log
+
+All notable changes to this project will be documented in this file.
+See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
+
+# [3.0.0](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/v2.0.2...v3.0.0) (2023-01-12)
+
+- feat!: replace Hash implementations with Checksum interface (#492) ([da43dc0](https://github.com/aws/aws-sdk-js-crypto-helpers/commit/da43dc0fdf669d9ebb5bfb1b1f7c79e46c4aaae1)), closes [#492](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/492)
+
+### BREAKING CHANGES
+
+- All classes that implemented `Hash` now implement `Checksum`.
+
+## [2.0.2](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/v2.0.1...v2.0.2) (2022-09-07)
+
+### Bug Fixes
+
+- **#337:** update @aws-sdk/types ([#373](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/373)) ([b26a811](https://github.com/aws/aws-sdk-js-crypto-helpers/commit/b26a811a392f5209c7ec7e57251500d4d78f97ff)), closes [#337](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/337)
+
+## [2.0.1](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/v2.0.0...v2.0.1) (2021-12-09)
+
+**Note:** Version bump only for package @aws-crypto/crc32
+
+# [2.0.0](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/v1.2.2...v2.0.0) (2021-10-25)
+
+**Note:** Version bump only for package @aws-crypto/crc32
+
+## [1.2.2](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/v1.2.1...v1.2.2) (2021-10-12)
+
+### Bug Fixes
+
+- **crc32c:** ie11 does not support Array.from ([#221](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/221)) ([5f49547](https://github.com/aws/aws-sdk-js-crypto-helpers/commit/5f495472ab8988cf203e0f2a70a51f7e1fcd7e60))
+
+## [1.2.1](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/v1.2.0...v1.2.1) (2021-09-17)
+
+**Note:** Version bump only for package @aws-crypto/crc32
+
+# [1.2.0](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/v1.1.1...v1.2.0) (2021-09-17)
+
+### Features
+
+- Add AwsCrc32 Hash ([f5d7e81](https://github.com/aws/aws-sdk-js-crypto-helpers/commit/f5d7e815fcbe0f8da1edb855fea3bd33eb1edc15))
+
+# [1.1.0](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/@aws-crypto/crc32@1.0.0...@aws-crypto/crc32@1.1.0) (2021-08-11)
+
+### Features
+
+- Create CRC-32C implementation ([#201](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/201)) ([e43c7ec](https://github.com/aws/aws-sdk-js-crypto-helpers/commit/e43c7ecd30d6499fa696f5839ecc30502a34b8b6))
+
+# [1.0.0](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/@aws-crypto/crc32@1.0.0-alpha.0...@aws-crypto/crc32@1.0.0) (2020-10-22)
+
+**Note:** Version bump only for package @aws-crypto/crc32
+
+# [1.0.0-alpha.0](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/@aws-crypto/crc32@0.1.0-preview.4...@aws-crypto/crc32@1.0.0-alpha.0) (2020-02-07)
+
+**Note:** Version bump only for package @aws-crypto/crc32
+
+# [0.1.0-preview.4](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/@aws-crypto/crc32@0.1.0-preview.2...@aws-crypto/crc32@0.1.0-preview.4) (2020-01-16)
+
+### Bug Fixes
+
+- Changed package.json files to point to the right Git repo ([#9](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/9)) ([028245d](https://github.com/aws/aws-sdk-js-crypto-helpers/commit/028245d72e642ca98d82226afb300eb154503c4a)), closes [#8](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/8)
+- lerna version maintains package-lock ([#14](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/14)) ([2ef29e1](https://github.com/aws/aws-sdk-js-crypto-helpers/commit/2ef29e13779703a5c9b32e93d18918fcb33b7272)), closes [#13](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/13)
+
+# [0.1.0-preview.3](https://github.com/aws/aws-sdk-js-crypto-helpers/compare/@aws-crypto/crc32@0.1.0-preview.2...@aws-crypto/crc32@0.1.0-preview.3) (2019-11-15)
+
+### Bug Fixes
+
+- Changed package.json files to point to the right Git repo ([#9](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/9)) ([028245d](https://github.com/aws/aws-sdk-js-crypto-helpers/commit/028245d72e642ca98d82226afb300eb154503c4a)), closes [#8](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/8)
+- lerna version maintains package-lock ([#14](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/14)) ([2ef29e1](https://github.com/aws/aws-sdk-js-crypto-helpers/commit/2ef29e13779703a5c9b32e93d18918fcb33b7272)), closes [#13](https://github.com/aws/aws-sdk-js-crypto-helpers/issues/13)
+
+# [0.1.0-preview.2](https://github.com/aws/aws-javascript-crypto-helpers/compare/@aws-crypto/crc32@0.1.0-preview.1...@aws-crypto/crc32@0.1.0-preview.2) (2019-10-30)
+
+### Bug Fixes
+
+- remove /src/ from .npmignore (for sourcemaps) ([#5](https://github.com/aws/aws-javascript-crypto-helpers/issues/5)) ([ec52056](https://github.com/aws/aws-javascript-crypto-helpers/commit/ec52056))