@sst-community/sst 4.21.1 → 5.0.0-alpha.2

package/platform/src/components/aws/helpers/provider.ts

@@ -0,0 +1,36 @@
+import { runtime } from "@pulumi/pulumi";
+import { Provider, Region } from "@pulumi/aws";
+import { lazy } from "../../../util/lazy";
+
+const useProviderCache = lazy(() => new Map<string, Provider>());
+
+export const useProvider = (region: Region) => {
+  const cache = useProviderCache();
+  const existing = cache.get(region);
+  if (existing) return existing;
+  const config = runtime.allConfig();
+  for (const key in config) {
+    const value = config[key];
+    delete config[key];
+    const [prefix, real] = key.split(":");
+    if (prefix !== "aws") continue;
+
+    // Array and Object values are JSON encoded, ie.
+    // {
+    //   allowedAccountIds: '["112245769880"]',
+    //   defaultTags: '{"tags":{"sst:app":"playground","sst:stage":"frank"}}',
+    //   region: 'us-east-1'
+    // }
+    try {
+      config[real] = JSON.parse(value);
+    } catch (e) {
+      config[real] = value;
+    }
+  }
+  const provider = new Provider(`AwsProvider.sst.${region}`, {
+    ...config,
+    region,
+  });
+  cache.set(region, provider);
+  return provider;
+};

package/platform/src/components/aws/helpers/queue-policy.ts

@@ -0,0 +1,33 @@
+import { Input, output } from "@pulumi/pulumi";
+import { iam } from "@pulumi/aws";
+import { parseQueueArn } from "./arn";
+
+/**
+ * The args for a queue policy that lets AWS services send messages to a
+ * queue: SNS for topic subscriptions, S3 for bucket notifications, and
+ * EventBridge for bus subscriptions.
+ */
+export function sendPolicyArgs(queueArn: Input<string>) {
+  const arn = output(queueArn);
+  return {
+    queueUrl: arn.apply((arn) => parseQueueArn(arn).queueUrl),
+    policy: iam.getPolicyDocumentOutput({
+      statements: [
+        {
+          actions: ["sqs:SendMessage"],
+          resources: [arn],
+          principals: [
+            {
+              type: "Service",
+              identifiers: [
+                "sns.amazonaws.com",
+                "s3.amazonaws.com",
+                "events.amazonaws.com",
+              ],
+            },
+          ],
+        },
+      ],
+    }).json,
+  };
+}

package/platform/src/components/aws/helpers/rds.ts

@@ -0,0 +1,212 @@
+import { all, type Output, type Resource } from "@pulumi/pulumi";
+import { iam, rds, secretsmanager } from "@pulumi/aws";
+import { plain, withDefault } from "../../args";
+import type { Input } from "../../input";
+import { VisibleError } from "../../error";
+import { type SizeGbTb, toGBs } from "../../size";
+
+/**
+ * An RDS Proxy in front of the database.
+ */
+export interface ProxyArgs {
+  /**
+   * Additional credentials the proxy can use to connect to the database. You don't
+   * need to specify the master user credentials as they are always added by default.
+   *
+   * :::note
+   * This component will not create the database users listed here. You need to
+   * create them manually in the database.
+   * :::
+   *
+   * The list and each username have to be plain values. A password can be an output.
+   *
+   * @example
+   * ```js
+   * {
+   *   credentials: [
+   *     {
+   *       username: "metabase",
+   *       password: "Passw0rd!"
+   *     }
+   *   ]
+   * }
+   * ```
+   *
+   * You can use a [`Secret`](/docs/component/secret) to manage the password.
+   *
+   * ```js
+   * {
+   *   credentials: [
+   *     {
+   *       username: "metabase",
+   *       password: new sst.Secret("MyDBPassword").value
+   *     }
+   *   ]
+   * }
+   * ```
+   */
+  credentials?: {
+    /**
+     * The username of the user.
+     */
+    username: string;
+    /**
+     * The password of the user.
+     */
+    password: Input<string>;
+  }[];
+}
+
+/** A user the proxy can connect to the database as, besides the master user. */
+export type ProxyCredential = NonNullable<ProxyArgs["credentials"]>[number];
+
+/**
+ * How far a database's storage can grow, in GB, from its `storage` arg.
+ *
+ * @param database The database, for the error messages: "MyDatabase Postgres".
+ */
+export function maxStorage(
+  storage: Input<SizeGbTb | undefined> | undefined,
+  blueGreen: Input<boolean>,
+  database: string,
+) {
+  const limit = withDefault<SizeGbTb, number>(storage, "20 GB", (v) => {
+    const size = toGBs(v);
+    if (size < 20)
+      throw new VisibleError(
+        `Storage must be at least 20 GB for the ${database} database.`,
+      );
+    if (size > 65536)
+      throw new VisibleError(
+        `Storage cannot be greater than 65536 GB (64 TB) for the ${database} database.`,
+      );
+    return size;
+  });
+  // Blue/green deployments require maxAllocatedStorage to be at least
+  // 10% higher than allocatedStorage for autoscaling headroom.
+  return all([limit, blueGreen]).apply(([limit, blueGreen]) =>
+    blueGreen ? Math.max(limit, 22) : limit,
+  );
+}
+
+/** The args of a read replica of a database instance. */
+export function replicaArgs(
+  instance: rds.Instance,
+  replica: number,
+): rds.InstanceArgs {
+  return {
+    replicateSourceDb: instance.identifier,
+    dbName: instance.dbName.apply((dbName) => `${dbName}_replica${replica}`),
+    dbSubnetGroupName: instance.dbSubnetGroupName,
+    availabilityZone: instance.availabilityZone,
+    engine: instance.engine,
+    engineVersion: instance.engineVersion,
+    instanceClass: instance.instanceClass,
+    username: instance.username,
+    password: instance.password.apply((v) => v!),
+    parameterGroupName: instance.parameterGroupName,
+    applyImmediately: true,
+    skipFinalSnapshot: true,
+    storageEncrypted: instance.storageEncrypted.apply((v) => v!),
+    storageType: instance.storageType,
+    allocatedStorage: instance.allocatedStorage,
+    maxAllocatedStorage: instance.maxAllocatedStorage.apply((v) => v!),
+  };
+}
+
+/**
+ * The additional users a proxy can connect as, from its `credentials`. The
+ * list and each username decide which secrets are created, so they have to
+ * be plain values.
+ *
+ * @param name The database's name, for the error messages.
+ */
+export function proxyCredentials(
+  credentials: ProxyCredential[] | undefined,
+  name: string,
+): ProxyCredential[] {
+  const list =
+    plain(credentials, `The "proxy.credentials" of the "${name}" database`) ??
+    [];
+  return list.map((credential) => ({
+    username: plain(
+      credential.username,
+      `The "username" in the "proxy.credentials" of the "${name}" database`,
+    ),
+    password: credential.password,
+  }));
+}
+
+/** The args of the role that lets a proxy read the secrets it connects with. */
+export function proxyRoleArgs(secrets: secretsmanager.Secret[]): iam.RoleArgs {
+  return {
+    assumeRolePolicy: iam.assumeRolePolicyForPrincipal({
+      Service: "rds.amazonaws.com",
+    }),
+    inlinePolicies: [
+      {
+        name: "inline",
+        policy: iam.getPolicyDocumentOutput({
+          statements: [
+            {
+              actions: ["secretsmanager:GetSecretValue"],
+              resources: secrets.map((secret) => secret.arn),
+            },
+          ],
+        }).json,
+      },
+    ],
+  };
+}
+
+/**
+ * The args of a proxy that connects with the credentials in the given
+ * secrets.
+ */
+export function proxyArgs(
+  engineFamily: Input<"POSTGRESQL" | "MYSQL">,
+  secrets: secretsmanager.Secret[],
+  role: iam.Role,
+  subnets: Input<Input<string>[]>,
+): rds.ProxyArgs {
+  return {
+    engineFamily,
+    auths: secrets.map((secret) => ({
+      authScheme: "SECRETS",
+      iamAuth: "DISABLED",
+      secretArn: secret.arn,
+    })),
+    roleArn: role.arn,
+    vpcSubnetIds: subnets,
+  };
+}
+
+/**
+ * The id of the secret that holds the master user's credentials of a
+ * database SST created. One of the database's tags names it.
+ *
+ * @param tag The tag that holds the secret's id.
+ * @param notFound The error for a database that doesn't have the tag.
+ */
+export function credentialsSecretOf(
+  database: { tagsAll: Output<Record<string, string>> },
+  tag: string,
+  notFound: string,
+) {
+  return database.tagsAll.apply((tags) => {
+    if (!tags?.[tag]) throw new VisibleError(notFound);
+    return tags[tag];
+  });
+}
+
+/**
+ * The master user's password, read from the secret that holds the database's
+ * credentials.
+ *
+ * @param parent The component that's reading it.
+ */
+export function storedPassword(secretId: Input<string>, parent: Resource) {
+  return secretsmanager
+    .getSecretVersionOutput({ secretId }, { parent })
+    .secretString.apply((v) => JSON.parse(v).password as string);
+}

package/platform/src/components/aws/helpers/site-builder.ts

@@ -0,0 +1,41 @@
+import { output, CustomResourceOptions } from "@pulumi/pulumi";
+import { Semaphore } from "../../../util/semaphore";
+import { local } from "@pulumi/command";
+
+const limiter = new Semaphore(
+  parseInt(process.env.SST_BUILD_CONCURRENCY_SITE || "1"),
+);
+
+export function siteBuilder(
+  name: string,
+  args: local.CommandArgs,
+  opts?: CustomResourceOptions,
+) {
+  // Wait for all arg values to be resolved before acquiring the semaphore.
+  return output(args).apply(async (args) => {
+    await limiter.acquire(name);
+
+    let waitOn;
+
+    const command = new local.Command(name, args, opts);
+    waitOn = command.urn;
+
+    // When running `sst diff` or `sst refresh`, `local.Command`'s `create` and `update` are not called.
+    // So we also run `local.runOutput` to get the output of the command.
+    if ($cli.command === "diff" || $cli.command === "refresh") {
+      waitOn = local.runOutput(
+        {
+          command: args.create!,
+          dir: args.dir,
+          environment: args.environment,
+        },
+        opts,
+      ).stdout;
+    }
+
+    return waitOn.apply(() => {
+      limiter.release();
+      return command;
+    });
+  });
+}

package/platform/src/components/aws/helpers/subscriber.ts

@@ -0,0 +1,23 @@
+import { Input, output } from "@pulumi/pulumi";
+import { FunctionArgs, FunctionArn } from "../function.js";
+import { Queue } from "../queue";
+
+export function isFunctionSubscriber(
+  subscriber?: Input<string | FunctionArgs | FunctionArn>,
+) {
+  if (!subscriber) return output(false);
+
+  return output(subscriber).apply(
+    (subscriber) =>
+      typeof subscriber === "string" || typeof subscriber.handler === "string",
+  );
+}
+
+export function isQueueSubscriber(subscriber?: Input<string | Queue>) {
+  if (!subscriber) return output(false);
+
+  return output(subscriber).apply(
+    (subscriber) =>
+      typeof subscriber === "string" || subscriber instanceof Queue,
+  );
+}

package/platform/src/components/aws/helpers/vpc.ts

@@ -0,0 +1,27 @@
+import { Vpc as OriginalVpc } from "../vpc";
+
+/**
+ * A `Vpc` component. Today that's the 4.x `Vpc`. When it's ported, the V5 one
+ * is added here and to `isVpc()`, and every V5 component that takes a VPC
+ * takes either. They read its `id`, `publicSubnets`, `privateSubnets`,
+ * `securityGroups`, `nodes.vpc` and `nodes.cloudmapNamespace`.
+ */
+export type AnyVpc = OriginalVpc;
+
+/** Whether a `vpc` arg is a `Vpc` component, and not the ids of a VPC. */
+export function isVpc(vpc: unknown): vpc is AnyVpc {
+  return vpc instanceof OriginalVpc;
+}
+
+// The args of a component that takes a VPC, with a `vpc` that can be either
+// kind of `Vpc`:
+//
+//   interface RedisArgs extends V5Args<TakesVpc<OriginalRedisArgs>, typeof parts> {}
+//
+// (Not a doc comment: an interface that extends this would show it as its own
+// description in the generated docs.)
+export type TakesVpc<Args> = {
+  [K in keyof Args]: K extends "vpc"
+    ? AnyVpc | Exclude<Args[K], OriginalVpc>
+    : Args[K];
+};

package/platform/src/components/aws/https-redirect.ts

@@ -0,0 +1,216 @@
+import { ComponentResourceOptions, all, output } from "@pulumi/pulumi";
+import { DnsValidatedCertificate } from "./dns-validated-certificate.js";
+import { Bucket } from "./bucket.js";
+import { Component } from "../component.js";
+import { logicalName, physicalName } from "../naming.js";
+import { useProvider } from "./helpers/provider.js";
+import { Input } from "../input.js";
+import { Dns } from "../dns.js";
+import { cloudfront, s3 } from "@pulumi/aws";
+import { CF_BLOCK_CLOUDFRONT_URL_INJECTION } from "./router.js";
+
+/**
+ * Properties to configure an HTTPS Redirect
+ */
+export interface HttpsRedirectArgs {
+  /**
+   * The redirect target fully qualified domain name (FQDN). An alias record
+   * will be created that points to your CloudFront distribution. Root domain
+   * or sub-domain can be supplied.
+   */
+  targetDomain: Input<string>;
+  /**
+   * The domain names that will redirect to `targetDomain`
+   *
+   * @default Domain name of the hosted zone
+   */
+  sourceDomains: Input<string[]>;
+  /**
+   * The ARN of an ACM (AWS Certificate Manager) certificate that proves ownership of the
+   * domain. By default, a certificate is created and validated automatically.
+   */
+  cert?: Input<string>;
+  /**
+   * The DNS adapter you want to use for managing DNS records.
+   */
+  dns?: Input<Dns & {}>;
+}
+
+/**
+ * Allows creating a domainA -> domainB redirect using CloudFront and S3.
+ * You can specify multiple domains to be redirected.
+ */
+export class HttpsRedirect extends Component {
+  constructor(
+    name: string,
+    args: HttpsRedirectArgs,
+    opts?: ComponentResourceOptions,
+  ) {
+    super(__pulumiType, name, args, opts);
+
+    const parent = this;
+
+    validateArgs();
+    const certificateArn = createSsl();
+    const bucket = createBucket();
+    const bucketWebsite = createBucketWebsite();
+    const distribution = createDistribution();
+    createDnsRecords();
+
+    function validateArgs() {
+      if (!args.dns && !args.cert)
+        throw new Error(
+          `Need to provide a validated certificate via "cert" when DNS is disabled`,
+        );
+    }
+
+    function createSsl() {
+      if (args.cert) return args.cert;
+
+      return new DnsValidatedCertificate(
+        `${name}Ssl`,
+        {
+          domainName: output(args.sourceDomains).apply((domains) => domains[0]),
+          alternativeNames: output(args.sourceDomains).apply((domains) =>
+            domains.slice(1),
+          ),
+          dns: args.dns!,
+        },
+        { parent, provider: useProvider("us-east-1") },
+      ).arn;
+    }
+
+    function createBucket() {
+      return new Bucket(`${name}Bucket`, {}, { parent });
+    }
+
+    function createBucketWebsite() {
+      return new s3.BucketWebsiteConfiguration(
+        `${name}BucketWebsite`,
+        {
+          bucket: bucket.name,
+          redirectAllRequestsTo: {
+            hostName: args.targetDomain,
+            protocol: "https",
+          },
+        },
+        { parent },
+      );
+    }
+
+    function createDistribution() {
+      return new cloudfront.Distribution(
+        `${name}Distribution`,
+        {
+          enabled: true,
+          waitForDeployment: false,
+          aliases: args.sourceDomains,
+          restrictions: {
+            geoRestriction: {
+              restrictionType: "none",
+            },
+          },
+          comment: all([args.targetDomain, args.sourceDomains]).apply(
+            ([targetDomain, sourceDomains]) => {
+              const comment = `Redirect to ${targetDomain} from ${sourceDomains.join(
+                ", ",
+              )}`;
+              return comment.length > 128
+                ? comment.slice(0, 125) + "..."
+                : comment;
+            },
+          ),
+          priceClass: "PriceClass_All",
+          viewerCertificate: {
+            acmCertificateArn: certificateArn,
+            sslSupportMethod: "sni-only",
+          },
+          defaultCacheBehavior: {
+            allowedMethods: ["GET", "HEAD", "OPTIONS"],
+            targetOriginId: "s3Origin",
+            viewerProtocolPolicy: "redirect-to-https",
+            cachedMethods: ["GET", "HEAD"],
+            forwardedValues: {
+              cookies: { forward: "none" },
+              queryString: false,
+            },
+            functionAssociations: [
+              {
+                eventType: "viewer-request",
+                functionArn: new cloudfront.Function(
+                  `${name}CloudfrontFunctionRequest`,
+                  {
+                    name: physicalName(64, `${name}CloudfrontFunctionRequest`),
+                    runtime: "cloudfront-js-2.0",
+                    code: `
+import cf from "cloudfront";
+async function handler(event) {
+  ${CF_BLOCK_CLOUDFRONT_URL_INJECTION}
+  return event.request;
+}`,
+                  },
+                  { ignoreChanges: ["name"] },
+                ).arn,
+              },
+            ],
+          },
+          origins: [
+            {
+              originId: "s3Origin",
+              domainName: bucketWebsite.websiteEndpoint,
+              customOriginConfig: {
+                httpPort: 80,
+                httpsPort: 443,
+                originProtocolPolicy: "http-only",
+                originSslProtocols: ["TLSv1.2"],
+              },
+            },
+          ],
+        },
+        { parent },
+      );
+    }
+
+    function createDnsRecords() {
+      if (!args.dns) return;
+
+      all([args.dns, args.sourceDomains]).apply(([dns, sourceDomains]) => {
+        const existing: string[] = [];
+        for (const [i, recordName] of sourceDomains.entries()) {
+          // Note: The way `dns` is implemented, the logical name for the DNS record is
+          // based on the sanitized version of the record name (ie. logicalName()). This
+          // means the logical name for `*.sst.sh` and `sst.sh` will trash b/c `*.` is
+          // stripped out.
+          // ```
+          // domain: {
+          //   name: "*.sst.sh",
+          //   aliases: ['sst.sh'],
+          // },
+          // ```
+          //
+          // Ideally, we don't sanitize the logical name. But that's a breaking change.
+          //
+          // As a workaround, starting v3.19.2, we prefix the logical name with a unique
+          // index for records with logical names that will trash.
+          const key = logicalName(recordName);
+          const namePrefix = existing.includes(key) ? `${name}${i}` : name;
+          existing.push(key);
+
+          dns.createAlias(
+            namePrefix,
+            {
+              name: recordName,
+              aliasName: distribution.domainName,
+              aliasZone: distribution.hostedZoneId,
+            },
+            { parent },
+          );
+        }
+      });
+    }
+  }
+}
+
+const __pulumiType = "sst:aws:HttpsRedirect";
+// @ts-expect-error
+HttpsRedirect.__pulumiType = __pulumiType;

package/platform/src/components/aws/iam-edit.ts

@@ -0,0 +1,50 @@
+import { Input, jsonStringify, output, UnwrappedObject } from "@pulumi/pulumi";
+import { iam } from "@pulumi/aws";
+import { Prettify } from "../component";
+
+type PartialUnwrappedPolicyDocument = {
+  Id?: string;
+  Version: "2008-10-17" | "2012-10-17";
+  Statement: Input<iam.PolicyStatement>[];
+};
+
+/**
+ * A helper to modify the AWS IAM policy.
+ *
+ * The IAM policy document is normally in the form of a JSON string. This helper decodes
+ * the string into a JSON object and passes it to the callback. Allowing you to modify the
+ * policy document in a type-safe way.
+ *
+ * @example
+ *
+ * For example, this comes in handy when you are transforming the policy of a component.
+ *
+ * ```ts title="sst.config.ts" "sst.aws.iamEdit"
+ * new sst.aws.Bucket("MyBucket", {
+ *   transform: {
+ *     policy: (args) => {
+ *       args.policy = sst.aws.iamEdit(args.policy, (policy) => {
+ *         policy.Statement.push({
+ *           Effect: "Allow",
+ *           Action: "s3:PutObject",
+ *           Principal: { Service: "ses.amazonaws.com" },
+ *           Resource: $interpolate`arn:aws:s3:::${args.bucket}/*`,
+ *         });
+ *       });
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export function iamEdit(
+  policy: Input<iam.PolicyDocument | string>,
+  cb: (doc: Prettify<PartialUnwrappedPolicyDocument>) => void,
+) {
+  return output(policy).apply((v) => {
+    const json = typeof v === "string" ? JSON.parse(v) : v;
+    cb(json);
+    return iam.getPolicyDocumentOutput({
+      sourcePolicyDocuments: [jsonStringify(json)],
+    }).json;
+  });
+}