@sst-community/sst 4.21.1 → 5.0.0-alpha.2

package/platform/src/components/aws/helpers/apigateway-account.ts

@@ -0,0 +1,78 @@
+import { getPartitionOutput, apigateway, iam } from "@pulumi/aws";
+import {
+  ComponentResourceOptions,
+  ProviderResource,
+  jsonStringify,
+  interpolate,
+} from "@pulumi/pulumi";
+import { $print } from "../../component";
+import { lazy } from "../../../util/lazy";
+
+// The account is a singleton per provider, so gateways on the same provider
+// share one read. The read uses the first gateway's
+// `<Name>APIGatewayAccount` name.
+const useAccountReads = lazy(
+  () => new Map<ProviderResource | undefined, apigateway.Account>(),
+);
+
+function useAccountRead(namePrefix: string, opts: ComponentResourceOptions) {
+  const reads = useAccountReads();
+  const existing = reads.get(opts.provider);
+  if (existing) return existing;
+
+  const account = apigateway.Account.get(
+    `${namePrefix}APIGatewayAccount`,
+    "APIGatewayAccount",
+    undefined,
+    { provider: opts.provider },
+  );
+  reads.set(opts.provider, account);
+  return account;
+}
+
+let cloudWatchRole: iam.Role | undefined;
+
+function useCloudWatchRole(opts: ComponentResourceOptions) {
+  const partition = getPartitionOutput(undefined, opts).partition;
+  cloudWatchRole ??= new iam.Role(
+    `APIGatewayPushToCloudWatchLogsRole`,
+    {
+      assumeRolePolicy: jsonStringify({
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Principal: {
+              Service: "apigateway.amazonaws.com",
+            },
+            Action: "sts:AssumeRole",
+          },
+        ],
+      }),
+      managedPolicyArns: [
+        interpolate`arn:${partition}:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs`,
+      ],
+    },
+    { retainOnDelete: true, provider: opts.provider },
+  );
+  return cloudWatchRole;
+}
+
+export function setupApiGatewayAccount(
+  namePrefix: string,
+  opts: ComponentResourceOptions,
+) {
+  const account = useAccountRead(namePrefix, opts);
+
+  return account.cloudwatchRoleArn.apply((arn) => {
+    if (arn) return account;
+
+    return new apigateway.Account(
+      `${namePrefix}APIGatewayAccountSetup`,
+      {
+        cloudwatchRoleArn: useCloudWatchRole(opts).arn,
+      },
+      { retainOnDelete: true, provider: opts.provider },
+    );
+  });
+}

package/platform/src/components/aws/helpers/apigatewayv2-domain.ts

@@ -0,0 +1,144 @@
+import { Input } from "../../input";
+import { Dns } from "../../dns";
+
+export interface ApiGatewayV2DomainArgs {
+  /**
+   * Use an existing API Gateway domain name.
+   *
+   * By default, a new API Gateway domain name is created. If you'd like to use an existing
+   * domain name, set the `nameId` to the ID of the domain name and **do not** pass in `name`.
+   *
+   * @example
+   * ```js
+   * {
+   *   domain: {
+   *     nameId: "example.com"
+   *   }
+   * }
+   * ```
+   */
+  nameId?: Input<string>;
+  /**
+   * The custom domain you want to use.
+   *
+   * @example
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com"
+   *   }
+   * }
+   * ```
+   *
+   * Can also include subdomains based on the current stage.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: `${$app.stage}.example.com`
+   *   }
+   * }
+   * ```
+   */
+  name?: Input<string>;
+  /**
+   * The base mapping for the custom domain. This adds a suffix to the URL of the API.
+   *
+   * @example
+   *
+   * Given the following base path and domain name.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "api.example.com",
+   *     path: "v1"
+   *   }
+   * }
+   * ```
+   *
+   * The full URL of the API will be `https://api.example.com/v1/`.
+   *
+   * :::note
+   * There's an extra trailing slash when a base path is set.
+   * :::
+   *
+   * By default there is no base path, so if the `name` is `api.example.com`, the full URL will be `https://api.example.com`.
+   */
+  path?: Input<string>;
+  /**
+   * The ARN of an ACM (AWS Certificate Manager) certificate that proves ownership of the
+   * domain. By default, a certificate is created and validated automatically.
+   *
+   * :::tip
+   * You need to pass in a `cert` for domains that are not hosted on supported `dns` providers.
+   * :::
+   *
+   * To manually set up a domain on an unsupported provider, you'll need to:
+   *
+   * 1. [Validate that you own the domain](https://docs.aws.amazon.com/acm/latest/userguide/domain-ownership-validation.html) by creating an ACM certificate. You can either validate it by setting a DNS record or by verifying an email sent to the domain owner.
+   * 2. Once validated, set the certificate ARN as the `cert` and set `dns` to `false`.
+   * 3. Add the DNS records in your provider to point to the API Gateway URL.
+   *
+   * @example
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: false,
+   *     cert: "arn:aws:acm:us-east-1:112233445566:certificate/3a958790-8878-4cdc-a396-06d95064cf63"
+   *   }
+   * }
+   * ```
+   */
+  cert?: Input<string>;
+  /**
+   * The DNS provider to use for the domain. Defaults to the AWS.
+   *
+   * Takes an adapter that can create the DNS records on the provider. This can automate
+   * validating the domain and setting up the DNS routing.
+   *
+   * Supports Route 53, Cloudflare, and Vercel adapters. For other providers, you'll need
+   * to set `dns` to `false` and pass in a certificate validating ownership via `cert`.
+   *
+   * @default `sst.aws.dns`
+   *
+   * @example
+   *
+   * Specify the hosted zone ID for the Route 53 domain.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: sst.aws.dns({
+   *       zone: "Z2FDTNDATAQYW2"
+   *     })
+   *   }
+   * }
+   * ```
+   *
+   * Use a domain hosted on Cloudflare, needs the Cloudflare provider.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: sst.cloudflare.dns()
+   *   }
+   * }
+   * ```
+   *
+   * Use a domain hosted on Vercel, needs the Vercel provider.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: sst.vercel.dns()
+   *   }
+   * }
+   * ```
+   */
+  dns?: Input<false | (Dns & {})>;
+}

package/platform/src/components/aws/helpers/arn.ts

@@ -0,0 +1,182 @@
+import { aws } from "../..";
+import { VisibleError } from "../../error";
+
+export function parseFunctionArn(arn: string) {
+  // arn:aws:lambda:region:account-id:function:function-name
+  const functionName = arn.split(":")[6];
+  if (!arn.startsWith("arn:") || !functionName)
+    throw new VisibleError(
+      `The provided ARN "${arn}" is not a Lambda function ARN.`,
+    );
+  return { functionName };
+}
+
+export function splitQualifiedFunctionArn(arn: string) {
+  // Unqualified: arn:aws:lambda:region:account-id:function:function-name (7 parts)
+  // Qualified:   arn:aws:lambda:region:account-id:function:function-name:alias-or-version (8 parts)
+  const parts = arn.split(":");
+  if (parts.length <= 7) {
+    return { unqualifiedArn: arn, qualifier: undefined };
+  }
+  return {
+    unqualifiedArn: parts.slice(0, 7).join(":"),
+    qualifier: parts[7],
+  };
+}
+
+
+export function parseBucketArn(arn: string) {
+  // arn:aws:s3:::bucket-name
+  const bucketName = arn.split(":")[5];
+  if (!arn.startsWith("arn:") || !bucketName)
+    throw new VisibleError(
+      `The provided ARN "${arn}" is not an S3 bucket ARN.`,
+    );
+  return { bucketName };
+}
+
+export function parseTopicArn(arn: string) {
+  // arn:aws:sns:region:account-id:topic-name
+  const topicName = arn.split(":")[5];
+  if (!arn.startsWith("arn:") || !topicName)
+    throw new VisibleError(
+      `The provided ARN "${arn}" is not an SNS Topic ARN.`,
+    );
+  return { topicName };
+}
+
+export function parseQueueArn(arn: string) {
+  // arn:aws:sqs:region:account-id:queue-name
+  const [arnStr, , , region, accountId, queueName] = arn.split(":");
+  if (arnStr !== "arn" || !queueName)
+    throw new VisibleError(
+      `The provided ARN "${arn}" is not an SQS Queue ARN.`,
+    );
+  return {
+    queueName,
+    queueUrl: `https://sqs.${region}.amazonaws.com/${accountId}/${queueName}`,
+  };
+}
+
+export function parseDynamoArn(arn: string) {
+  // arn:aws:dynamodb:region:account-id:table/table-name
+  const tableName = arn.split("/")[1];
+  if (!arn.startsWith("arn:") || !tableName)
+    throw new VisibleError(
+      `The provided ARN "${arn}" is not a DynamoDB table ARN.`,
+    );
+  return { tableName };
+}
+
+export function parseDynamoStreamArn(streamArn: string) {
+  // ie. "arn:aws:dynamodb:us-east-1:112233445566:table/MyTable/stream/2024-02-25T23:17:55.264"
+  const parts = streamArn.split(":");
+  const tableName = parts[5]?.split("/")[1];
+  if (parts[0] !== "arn" || parts[2] !== "dynamodb" || !tableName)
+    throw new VisibleError(
+      `The provided ARN "${streamArn}" is not a DynamoDB stream ARN.`,
+    );
+  return { tableName };
+}
+
+export function parseKinesisStreamArn(streamArn: string) {
+  // ie. "arn:aws:kinesis:us-east-1:123456789012:stream/MyStream";
+  const parts = streamArn.split(":");
+  const streamName = parts[5]?.split("/")[1];
+  if (parts[0] !== "arn" || parts[2] !== "kinesis" || !streamName)
+    throw new VisibleError(
+      `The provided ARN "${streamArn}" is not a Kinesis stream ARN.`,
+    );
+  return { streamName };
+}
+
+export function parseEventBusArn(arn: string) {
+  // arn:aws:events:region:account-id:event-bus/bus-name
+  const busName = arn.split("/")[1];
+  if (!arn.startsWith("arn:") || !busName)
+    throw new VisibleError(
+      `The provided ARN "${arn}" is not a EventBridge event bus ARN.`,
+    );
+  return { busName };
+}
+
+export function parseRoleArn(arn: string) {
+  // arn:aws:iam::123456789012:role/MyRole
+  const roleName = arn.split("/")[1];
+  if (!arn.startsWith("arn:") || !roleName)
+    throw new VisibleError(`The provided ARN "${arn}" is not an IAM role ARN.`);
+  return { roleName };
+}
+
+export function parseLambdaEdgeArn(arn: string) {
+  // First validate it's a Lambda function ARN
+  const { functionName } = parseFunctionArn(arn);
+
+  // arn:aws:lambda:region:account-id:function:function-name:version
+  const parts = arn.split(":");
+  const region = parts[3];
+  const version = parts[7];
+
+  if (region !== "us-east-1") {
+    throw new VisibleError(
+      `Lambda@Edge functions must be deployed in us-east-1 region. Got region: ${region}`,
+    );
+  }
+
+  if (!version || version === "$LATEST") {
+    throw new VisibleError(
+      `Lambda@Edge requires a qualified ARN (with version). Got: ${arn}`,
+    );
+  }
+
+  return { functionName, region, version };
+}
+
+export function parseElasticSearch(arn: string) {
+  // arn:aws:es:region:account-id:domain/domain-name
+  const tableName = arn.split("/")[1];
+  if (!arn.startsWith("arn:") || !tableName)
+    throw new VisibleError(
+      `The provided ARN "${arn}" is not a ElasticSearch domain ARN.`,
+    );
+  return { tableName };
+}
+
+export function parseOpenSearch(arn: string) {
+  // arn:aws:opensearch:region:account-id:domain/domain-name
+  const tableName = arn.split("/")[1];
+  if (!arn.startsWith("arn:") || !tableName)
+    throw new VisibleError(
+      `The provided ARN "${arn}" is not a OpenSearch domain ARN.`,
+    );
+  return { tableName };
+}
+
+export function parseDsqlPublicEndpoint(arn: string) {
+  const parts = arn.split(":");
+  const region = parts[3];
+  const clusterId = parts[5]?.split("/")[1];
+  if (!arn.startsWith("arn:") || !clusterId)
+    throw new VisibleError(
+      `The provided ARN "${arn}" is not a DSQL cluster ARN.`,
+    );
+  return `${clusterId}.dsql.${region}.on.aws`;
+}
+
+export function parseDsqlPrivateEndpoint(
+  clusterArn: string,
+  dnsEntries: { dnsName?: string }[],
+) {
+  const clusterId = clusterArn.split(":")[5]?.split("/")[1];
+  if (!clusterArn.startsWith("arn:") || !clusterId)
+    throw new VisibleError(
+      `The provided ARN "${clusterArn}" is not a DSQL cluster ARN.`,
+    );
+  const wildcardEntry = dnsEntries.find((e) => e.dnsName?.startsWith("*."));
+  const privateDnsName = wildcardEntry?.dnsName ?? dnsEntries[0]?.dnsName;
+  if (!privateDnsName)
+    throw new VisibleError(
+      `The VPC endpoint has no DNS entries.`,
+    );
+  return privateDnsName.replace("*", clusterId);
+}

package/platform/src/components/aws/helpers/bootstrap.ts

@@ -0,0 +1,16 @@
+import { rpc } from "../../rpc/rpc";
+
+interface BootstrapData {
+  asset: string;
+  assetEcrRegistryId: string;
+  assetEcrUrl: string;
+  state: string;
+  appsyncHttp: string;
+  appsyncRealtime: string;
+}
+
+export const bootstrap = {
+  forRegion(region: string): Promise<BootstrapData> {
+    return rpc.call("Provider.Aws.Bootstrap", { region });
+  },
+};

package/platform/src/components/aws/helpers/client.ts

@@ -0,0 +1,76 @@
+import { StandardRetryStrategy } from "@aws-sdk/middleware-retry";
+export type {} from "@smithy/types";
+
+type ClientOptions = {
+  region?: string;
+  retrableErrors?: string[];
+};
+
+class AwsError extends Error {
+  requestID?: string;
+  statusCode?: number;
+}
+
+const printNoInternet = (() => {
+  let lastPrinted = 0;
+  return () => {
+    const now = Date.now();
+    if (now - lastPrinted > 5000) {
+      console.log("Waiting for internet connection...");
+      lastPrinted = now;
+    }
+  };
+})();
+
+export const useClient = <C extends any>(
+  client: new (config: any) => C,
+  opts?: ClientOptions,
+) => {
+  return new client({
+    region: opts?.region ?? process.env.SST_AWS_REGION,
+    credentials: process.env.SST_AWS_ACCESS_KEY_ID
+      ? {
+          accessKeyId: process.env.SST_AWS_ACCESS_KEY_ID,
+          sessionToken: process.env.SST_AWS_SESSION_TOKEN,
+          secretAccessKey: process.env.SST_AWS_SECRET_ACCESS_KEY,
+        }
+      : undefined,
+    retryStrategy: new StandardRetryStrategy(async () => 10000, {
+      retryDecider: (e: any) => {
+        // Handle no internet connection => retry
+        if (e.code === "ENOTFOUND") {
+          printNoInternet();
+          return true;
+        }
+
+        // Handle throttling errors => retry
+        if (
+          [
+            "ThrottlingException",
+            "Throttling",
+            "TooManyRequestsException",
+            "OperationAbortedException",
+            "TimeoutError",
+            "NetworkingError",
+            ...(opts?.retrableErrors ?? []),
+          ].includes(e.name)
+        ) {
+          return true;
+        }
+
+        return false;
+      },
+      delayDecider: (_, attempts) => {
+        return Math.min(1.5 ** attempts * 100, 5000);
+      },
+      // AWS SDK v3 has an idea of "retry tokens" which are used to
+      // prevent multiple retries from happening at the same time.
+      // This is a workaround to disable that.
+      retryQuota: {
+        hasRetryTokens: () => true,
+        releaseRetryTokens: () => {},
+        retrieveRetryTokens: () => 1,
+      },
+    }),
+  });
+};

package/platform/src/components/aws/helpers/container-builder.ts

@@ -0,0 +1,33 @@
+import { output, ComponentResourceOptions } from "@pulumi/pulumi";
+import { Semaphore } from "../../../util/semaphore";
+import { Image, ImageArgs } from "@pulumi/docker-build";
+
+const limiter = new Semaphore(
+  parseInt(process.env.SST_BUILD_CONCURRENCY_CONTAINER || "1"),
+);
+
+export function imageBuilder(
+  name: string,
+  args: ImageArgs,
+  opts?: ComponentResourceOptions,
+) {
+  // Wait for all arg values to be resolved before acquiring the semaphore.
+  return output(args).apply(async (args) => {
+    await limiter.acquire(name);
+
+    const image = new Image(
+      name,
+      {
+        ...(process.env.BUILDX_BUILDER
+          ? { builder: { name: process.env.BUILDX_BUILDER } }
+          : {}),
+        ...args,
+      },
+      opts,
+    );
+    return image.urn.apply(() => {
+      limiter.release();
+      return image;
+    });
+  });
+}

package/platform/src/components/aws/helpers/custom-domain.ts

@@ -0,0 +1,128 @@
+import type { Dns } from "../../dns";
+import type { Input } from "../../input";
+import { plain } from "../../args";
+import { VisibleError } from "../../error";
+import { dns as awsDns } from "../dns";
+
+/**
+ * What every V5 component takes for a custom domain. A component adds what's
+ * its own, like a base path.
+ */
+export interface CustomDomainArgs {
+  /**
+   * The custom domain you want to use.
+   *
+   * @example
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com"
+   *   }
+   * }
+   * ```
+   *
+   * Can also include subdomains based on the current stage.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: `${$app.stage}.example.com`
+   *   }
+   * }
+   * ```
+   */
+  name: Input<string>;
+  /**
+   * The DNS provider to use for the domain: an adapter that creates the DNS
+   * records, like `sst.aws.dns()`, `sst.cloudflare.dns()` or
+   * `sst.vercel.dns()`.
+   *
+   * For other providers, set `dns` to `false` and pass in a `cert`.
+   *
+   * @default `sst.aws.dns`
+   *
+   * @example
+   *
+   * Specify the hosted zone ID for the Route 53 domain.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: sst.aws.dns({
+   *       zone: "Z2FDTNDATAQYW2"
+   *     })
+   *   }
+   * }
+   * ```
+   *
+   * Use a domain hosted on Cloudflare, needs the Cloudflare provider.
+   *
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: sst.cloudflare.dns()
+   *   }
+   * }
+   * ```
+   */
+  dns?: false | Dns;
+  /**
+   * The ARN of an ACM (AWS Certificate Manager) certificate that proves ownership of the
+   * domain. By default, a certificate is created and validated automatically.
+   *
+   * :::tip
+   * You need to pass in a `cert` for domains that are not hosted on supported `dns` providers.
+   * :::
+   *
+   * @example
+   * ```js
+   * {
+   *   domain: {
+   *     name: "example.com",
+   *     dns: false,
+   *     cert: "arn:aws:acm:us-east-1:112233445566:certificate/3a958790-8878-4cdc-a396-06d95064cf63"
+   *   }
+   * }
+   * ```
+   */
+  cert?: Input<string>;
+}
+
+/**
+ * Work out how a component's custom domain is set up: its name, the DNS
+ * adapter that creates its records, and its certificate when the user brings
+ * one. Without a `cert` there is always a `dns`, to validate the certificate
+ * the component creates.
+ *
+ * ```ts
+ * const domain = customDomain(args.domain, `the "${name}" API`);
+ * const certificateArn =
+ *   domain.cert ??
+ *   this.part("certificate", { domainName: domain.name, dns: domain.dns! }).arn;
+ * // ... the service's own domain resource, then:
+ * domain.dns?.createAlias(name, { ... }, this.delegateOpts());
+ * ```
+ *
+ * @param domain The `domain` arg: a domain name, or the domain's args.
+ * @param owner What the domain belongs to, for error messages: `the "MyApi" API`.
+ */
+export function customDomain(
+  domain: string | Partial<CustomDomainArgs>,
+  owner: string,
+) {
+  plain(domain, `The "domain" of ${owner}`);
+  const { name, dns, cert } =
+    typeof domain === "string" ? ({ name: domain } as CustomDomainArgs) : domain;
+  if (!name) throw new VisibleError(`Domain "name" is required for ${owner}.`);
+
+  plain(dns, `The domain's "dns" in ${owner}`);
+  const adapter = dns === false ? undefined : dns ?? awsDns();
+  if (!adapter && !cert)
+    throw new VisibleError(
+      `Domain "cert" is required when "dns" is disabled for ${owner}.`,
+    );
+
+  return { name, dns: adapter, cert };
+}

package/platform/src/components/aws/helpers/event-source.ts

@@ -0,0 +1,41 @@
+import { Input, output } from "@pulumi/pulumi";
+import { DurationMinutes, toSeconds } from "../../duration";
+
+/**
+ * The event source mapping settings for a subscription's `filters`: each
+ * filter becomes a pattern, and a record is delivered when it matches one.
+ */
+export function filterCriteria(
+  filters?: Input<Input<Record<string, any>>[]>,
+) {
+  if (!filters) return undefined;
+  return {
+    filters: output(filters).apply((filters) =>
+      filters.map((filter) => ({ pattern: JSON.stringify(filter) })),
+    ),
+  };
+}
+
+/**
+ * The event source mapping settings for a subscription's `batch`: how many
+ * records to deliver at once, how long to wait for them, and whether the
+ * function can report the ones that failed.
+ */
+export function batchSettings(
+  batch?: Input<{
+    size?: Input<number>;
+    window?: Input<DurationMinutes>;
+    partialResponses?: Input<boolean>;
+  }>,
+) {
+  const settings = output(batch);
+  return {
+    batchSize: settings.apply((batch) => batch?.size ?? 10),
+    maximumBatchingWindowInSeconds: settings.apply((batch) =>
+      batch?.window ? toSeconds(batch.window) : 0,
+    ),
+    functionResponseTypes: settings.apply((batch) =>
+      batch?.partialResponses ? ["ReportBatchItemFailures"] : [],
+    ),
+  };
+}