@takumi-stack/core 1.0.0 → 1.0.1

package/prefab/utils/deploy-pipeline/index.ts

@@ -0,0 +1,172 @@
+import * as awsCodebuild from 'aws-cdk-lib/aws-codebuild';
+import { RemovalPolicy } from 'aws-cdk-lib';
+import { Artifact, Pipeline } from 'aws-cdk-lib/aws-codepipeline';
+import { CodeBuildAction, CodeStarConnectionsSourceAction } from 'aws-cdk-lib/aws-codepipeline-actions';
+import { DetailType, NotificationRule } from 'aws-cdk-lib/aws-codestarnotifications';
+import { IManagedPolicy, ManagedPolicy, PolicyStatement, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import { Bucket } from 'aws-cdk-lib/aws-s3';
+import { StringParameter } from 'aws-cdk-lib/aws-ssm';
+import { Construct } from 'constructs';
+
+import { ServiceStack, getBucketName, getLogicalName } from '../../../common';
+
+import { TopicFunction } from '../../compute/function/topic-function';
+import { ParameterSecret } from '../config/parameter-secret';
+
+export type DeployPipelineProps = {
+  preDeployCommands?: string[];
+  postDeployCommands?: string[];
+  codeBuildProjectParams?: Partial<awsCodebuild.ProjectProps>;
+  useExtraSlackNotification?: boolean;
+};
+
+export class DeployPipelinePrefab extends Construct {
+  constructor(service: ServiceStack, params: DeployPipelineProps) {
+    super(service, getLogicalName(DeployPipelinePrefab.name));
+
+    const overriddenService: ServiceStack = Object.assign({ props: { ...service.props } }, service);
+    overriddenService.props.isSingleProjectAccount = false;
+
+    if (overriddenService.props.ephemeralEnvName) return;
+
+    const repositoryOwner = StringParameter.valueFromLookup(this, 'pipeline-default-repository-owner');
+    const repositoryConnection = StringParameter.valueFromLookup(this, 'pipeline-default-repository-connection');
+
+    const sourceCodeArtifact = new Artifact('sourceCode');
+    const sourceCodeAction = new CodeStarConnectionsSourceAction({
+      actionName: 'FetchRepo',
+      branch: overriddenService.props.deployBranch,
+      repo: overriddenService.props.repositoryName,
+      output: sourceCodeArtifact,
+      owner: repositoryOwner,
+      connectionArn: repositoryConnection,
+    });
+
+    const deploymentRole = new Role(this, 'DeployRole', { assumedBy: new ServicePrincipal('codebuild.amazonaws.com') });
+    const policy: IManagedPolicy = ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess');
+    deploymentRole.addManagedPolicy(policy);
+
+    const workerCommands =
+      StringParameter.valueFromLookup(this, 'pipeline-deploy-worker-role') !== 'null'
+        ? [
+            'output=$(aws sts assume-role --role-arn "$DEPLOY_WORKER_ROLE" --role-session-name "CDK" --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" --output text)',
+            "var1=$(echo \"$output\" | awk -F'\t' '{print $1}')",
+            "var2=$(echo \"$output\" | awk -F'\t' '{print $2}')",
+            "var3=$(echo \"$output\" | awk -F'\t' '{print $3}')",
+            'export AWS_ACCESS_KEY_ID=$var1',
+            'export AWS_SECRET_ACCESS_KEY=$var2',
+            'export AWS_SESSION_TOKEN=$var3',
+          ]
+        : [];
+
+    const codebuildProject = new awsCodebuild.Project(this, 'CodebuildProject', {
+      projectName: `${overriddenService.props.projectName}-${overriddenService.props.envName}`,
+      role: deploymentRole,
+      environment: {
+        computeType: awsCodebuild.ComputeType.LARGE,
+        buildImage: awsCodebuild.LinuxBuildImage.STANDARD_7_0,
+      },
+      buildSpec: awsCodebuild.BuildSpec.fromObject({
+        version: '0.2',
+        phases: {
+          install: {
+            'runtime-versions': { nodejs: 18 },
+          },
+          pre_build: {
+            commands: [
+              ...workerCommands,
+              'npm install --global yarn',
+              'npm set //npm.pkg.github.com/:_authToken $GITHUB_TOKEN',
+              'yarn --prod',
+              ...(params.preDeployCommands || []),
+            ],
+          },
+          build: {
+            commands: [`yarn deploy ${overriddenService.props.envName}`],
+          },
+          post_build: {
+            commands: params.postDeployCommands || [],
+          },
+        },
+      }),
+      ...params.codeBuildProjectParams,
+      // I put this at the end because we need to prevent to override the environment variables
+      environmentVariables: {
+        GITHUB_TOKEN: {
+          type: awsCodebuild.BuildEnvironmentVariableType.PARAMETER_STORE,
+          value: 'pipeline-default-repository-token',
+        },
+        DEPLOY_WORKER_ROLE: {
+          type: awsCodebuild.BuildEnvironmentVariableType.PARAMETER_STORE,
+          value: 'pipeline-deploy-worker-role',
+        },
+        ...params.codeBuildProjectParams?.environmentVariables,
+      },
+    });
+
+    const deployAction = new CodeBuildAction({
+      actionName: 'Deploy',
+      input: sourceCodeArtifact,
+      project: codebuildProject,
+    });
+
+    const pipeline = new Pipeline(this, 'Pipeline', {
+      crossAccountKeys: false,
+      pipelineName: `${overriddenService.props.projectName}-${overriddenService.props.envName}`,
+      artifactBucket: new Bucket(this, 'bucket', {
+        bucketName: getBucketName('bucket', overriddenService.props),
+        autoDeleteObjects: true,
+        removalPolicy: RemovalPolicy.DESTROY,
+      }),
+      stages: [
+        { stageName: 'Source', actions: [sourceCodeAction] },
+        { stageName: 'Deploy', actions: [deployAction] },
+      ],
+    });
+
+    if (overriddenService.props.pipelineNotificationSlackChannel) {
+      const extraSlackNotification = 'extra-slack-notification';
+      const defaultSlackToken = new ParameterSecret(service, { existingName: 'pipeline-default-slack-token' });
+      const modifiers = [getPipelineExecution(), defaultSlackToken.useModReader('DEFAULT_SLACK_TOKEN_PARAMETER')];
+
+      if (params.useExtraSlackNotification) {
+        const extraSlackNotificationParam = new ParameterSecret(service, { name: extraSlackNotification });
+        modifiers.push(extraSlackNotificationParam.useModReader('SLACK_EXTRA_CONFIG_NAME'));
+      }
+
+      const topicFunction = new TopicFunction(service, {
+        customTopicParams: { name: 'notifications' },
+        name: 'send-to-slack',
+        baseFunctionFolder: __dirname,
+        modifiers,
+        ...(overriddenService.props.isDemoProject ? {} : { compiled: true }),
+        environment: {
+          REPOSITORY_OWNER: repositoryOwner,
+          REPOSITORY_NAME: overriddenService.props.repositoryName,
+          DEFAULT_SLACK_CHANNEL: overriddenService.props.pipelineNotificationSlackChannel,
+        },
+      });
+
+      new NotificationRule(this, 'Notification', {
+        notificationRuleName: `${overriddenService.props.projectName}-${overriddenService.props.envName}`,
+        detailType: DetailType.FULL,
+        source: pipeline,
+        targets: [topicFunction.customTopic.topic],
+        events: ['codepipeline-pipeline-pipeline-execution-failed', 'codepipeline-pipeline-pipeline-execution-succeeded'],
+      });
+    }
+  }
+}
+// }
+
+const getPipelineExecution = (): ((lambda: NodejsFunction) => void) => {
+  return (lambda: NodejsFunction): void => {
+    lambda.role?.addToPrincipalPolicy(
+      new PolicyStatement({
+        actions: ['codepipeline:GetPipelineExecution'],
+        resources: ['*'],
+      })
+    );
+  };
+};

package/prefab/utils/deploy-pipeline/platform/get-pipeline-detail.ts

@@ -0,0 +1,31 @@
+import { CodePipelineClient, GetPipelineExecutionCommand } from '@aws-sdk/client-codepipeline';
+
+const codepipeline = new CodePipelineClient({});
+
+export type PipelineDetail = {
+  commitId: string;
+  commitMessage: string;
+};
+
+export const getPipelineDetail = async (pipelineName: string, executionId: string): Promise<PipelineDetail> => {
+  const { pipelineExecution } = await codepipeline.send(
+    new GetPipelineExecutionCommand({
+      pipelineName: pipelineName,
+      pipelineExecutionId: executionId,
+    })
+  );
+
+  if (!pipelineExecution) throw new Error('Missing pipelineExecution');
+
+  const detail = pipelineExecution.artifactRevisions
+    ?.filter((a) => a.name === 'sourceCode')
+    .map((a) => {
+      return {
+        commitId: a.revisionId || '',
+        commitMessage: JSON.parse(a.revisionSummary || '{}')['CommitMessage'],
+      };
+    });
+
+  if (!detail || !detail[0]) throw new Error('Missing artifactRevision');
+  return detail[0];
+};

package/prefab/utils/deploy-pipeline/platform/get-slack-payload.ts

@@ -0,0 +1,38 @@
+import { SlackNotificationPayload } from '../entities';
+
+export const getSlackPayload = (pipelineName: string, state: string, commitId: string, commitMessage: string): SlackNotificationPayload => {
+  const commitUrl = `https://github.com/${process.env.REPOSITORY_OWNER}/${process.env.REPOSITORY_NAME}/commit/${commitId}`;
+  const url = `https://us-east-1.console.aws.amazon.com/codesuite/codepipeline/pipelines/${pipelineName}/view?region=us-east-1`;
+  const fallback = ':robot_face: *[Deploy Pipeline]* :robot_face:\n';
+  const color = state === 'FAILED' ? '#D00000' : '#00d02d';
+  const fieldState =
+    state === 'FAILED'
+      ? [
+          {
+            title: 'Status: [Pipeline Failed]',
+            short: false,
+            value: `_For more details <${url}|Go to AWS Console>_ `,
+          },
+        ]
+      : [
+          {
+            title: 'Status: [Pipeline Finished]',
+            short: false,
+            value: `Deployed at: ${new Date().toDateString()}`,
+          },
+        ];
+
+  return {
+    color,
+    fallback,
+    fields: [
+      { title: 'Pipeline', short: false, value: pipelineName },
+      {
+        title: 'Commit',
+        short: false,
+        value: `${commitMessage} \n\n _For more details <${commitUrl}|Go to GitHub>_`,
+      },
+      ...fieldState,
+    ],
+  };
+};

package/prefab/utils/deploy-pipeline/platform/send-to-slack.ts

@@ -0,0 +1,16 @@
+import { apiCall } from '@takumi-stack/sdk';
+
+import { Slack } from '../catalog/integrations';
+import { SlackNotificationPayload, SlackNotificationConfig } from '../entities';
+
+export const sendToSlack = async (slackNotificationPayload: SlackNotificationPayload, slackNotificationConfig: SlackNotificationConfig) => {
+  const { fallback, color, fields } = slackNotificationPayload;
+  await apiCall(
+    Slack.config,
+    {
+      pathParams: { token: slackNotificationConfig.token },
+      body: { attachments: [{ pretext: fallback, fallback, color, fields }], channel: slackNotificationConfig.channel },
+    },
+    { tracingMeta: {}, ignoreResponse: true }
+  );
+};

package/prefab/utils/duration.ts

@@ -0,0 +1 @@
+export { Duration } from 'aws-cdk-lib/core';

package/prefab/utils/index.ts

@@ -0,0 +1,4 @@
+export * from './config';
+export * from './deploy-pipeline';
+export * from './ses';
+export * from './duration';

package/prefab/utils/ses/index.ts

@@ -0,0 +1,134 @@
+import { UserPoolSESOptions } from '../../../node_modules/aws-cdk-lib/aws-cognito/lib';
+import { NodejsFunction } from '../../../node_modules/aws-cdk-lib/aws-lambda-nodejs/lib/function';
+import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { CnameRecord, HostedZone, IHostedZone } from 'aws-cdk-lib/aws-route53';
+import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from 'aws-cdk-lib/custom-resources';
+import { Construct } from 'constructs';
+
+import { BaseGlobalProps, ServiceStack, getDomain, getLogicalName } from '../../../common';
+
+export class SesDomain extends Construct {
+  constructor(service: ServiceStack) {
+    super(service, getLogicalName(SesDomain.name));
+
+    const domain = getDomain('', service.props);
+    const zone = this.getHostedZone(domain);
+
+    const verifyDomainIdentity = this.verifyDomainIdentity(domain);
+
+    const verifyDomainDkim = this.verifyDomainDkim(domain);
+    verifyDomainDkim.node.addDependency(verifyDomainIdentity);
+
+    this.addDkimRecords(verifyDomainDkim, zone, domain);
+  }
+
+  private verifyDomainIdentity(domainName: string): AwsCustomResource {
+    return new AwsCustomResource(this, 'VerifyDomainIdentity', {
+      installLatestAwsSdk: true,
+      onCreate: {
+        service: 'SES',
+        action: 'verifyDomainIdentity',
+        parameters: {
+          Domain: domainName,
+        },
+        physicalResourceId: PhysicalResourceId.fromResponse('VerificationToken'),
+      },
+      onUpdate: {
+        service: 'SES',
+        action: 'verifyDomainIdentity',
+        parameters: {
+          Domain: domainName,
+        },
+        physicalResourceId: PhysicalResourceId.fromResponse('VerificationToken'),
+      },
+      onDelete: {
+        service: 'SES',
+        action: 'deleteIdentity',
+        parameters: {
+          Identity: domainName,
+        },
+      },
+      policy: generateSesPolicyForCustomResource('VerifyDomainIdentity', 'DeleteIdentity'),
+    });
+  }
+
+  private verifyDomainDkim(domainName: string): AwsCustomResource {
+    return new AwsCustomResource(this, 'VerifyDomainDkim', {
+      installLatestAwsSdk: true,
+      onCreate: {
+        service: 'SES',
+        action: 'verifyDomainDkim',
+        parameters: {
+          Domain: domainName,
+        },
+        physicalResourceId: PhysicalResourceId.of(`${domainName}-verify-domain-dkim`),
+      },
+      onUpdate: {
+        service: 'SES',
+        action: 'verifyDomainDkim',
+        parameters: {
+          Domain: domainName,
+        },
+        physicalResourceId: PhysicalResourceId.of(`${domainName}-verify-domain-dkim`),
+      },
+      policy: generateSesPolicyForCustomResource('VerifyDomainDkim'),
+    });
+  }
+
+  private getHostedZone(domainName: string): IHostedZone {
+    return HostedZone.fromLookup(this, 'Zone', {
+      domainName: domainName,
+    });
+  }
+
+  private addDkimRecords(verifyDomainDkim: AwsCustomResource, zone: IHostedZone, domainName: string) {
+    [0, 1, 2].forEach((val) => {
+      const dkimToken = verifyDomainDkim.getResponseField(`DkimTokens.${val}`);
+      const cnameRecord = new CnameRecord(this, 'SesDkimVerificationRecord' + val, {
+        zone,
+        recordName: `${dkimToken}._domainkey.${domainName}`,
+        domainName: `${dkimToken}.dkim.amazonses.com`,
+      });
+      cnameRecord.node.addDependency(verifyDomainDkim);
+    });
+  }
+
+  // Custom Methods
+  public useMod(mods: (() => any)[]): (lambda: NodejsFunction) => void {
+    return (lambda: NodejsFunction): void => {
+      mods.map((fn) => fn()(lambda));
+    };
+  }
+
+  public static modifier = {
+    emailSender: (): ((lambda: NodejsFunction) => void) => {
+      return (lambda: NodejsFunction): void => {
+        lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ['ses:SendRawEmail'], resources: ['*'] }));
+      };
+    },
+    smsSender: (): ((lambda: NodejsFunction) => void) => {
+      return (lambda: NodejsFunction): void => {
+        lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ['sns:Publish'], resources: ['*'] }));
+      };
+    },
+  };
+
+  public static getCognitoRef(props: BaseGlobalProps): UserPoolSESOptions {
+    return {
+      // emailSendingAccount: 'DEVELOPER',
+      fromEmail: props.emailSender,
+      sesVerifiedDomain: getDomain('', props),
+      // sourceArn: `arn:aws:ses:${props.regionName}:${props.deployTarget['services'].account}:identity/${getDomain('', props)}`,
+    };
+  }
+}
+
+export function generateSesPolicyForCustomResource(...methods: string[]): AwsCustomResourcePolicy {
+  return AwsCustomResourcePolicy.fromStatements([
+    new PolicyStatement({
+      actions: methods.map((method) => 'ses:' + method),
+      effect: Effect.ALLOW,
+      resources: ['*'],
+    }),
+  ]);
+}

package/readme.md

@@ -0,0 +1,78 @@
+# CC-CORE
+
+`CC-CORE` serves as the fundamental library upon which CC is built, providing the essential framework for creating the entire application infrastructure. Based on CDK, it offers extensibility through native commands, thereby leveraging the inherent advantages of being strongly opinionated.
+
+Each individual component, or Prefab, within `CC-CORE` embodies production-ready capabilities, adhering rigorously to established standards of quality, performance, and security. This opinionated approach ensures that every element encapsulated within `CC-CORE` contributes to a robust and reliable application, aligning seamlessly with the highest benchmarks in terms of quality, performance, and security.
+
+By leveraging `CC-CORE`, developers benefit from a structured, opinionated framework that not only streamlines infrastructure creation but also upholds uncompromising standards of excellence across the entire application ecosystem.
+
+---
+
+### This package includes:
+
+### `common`
+
+Includes primary definitions for foundational pieces like:
+
+- `coordinator.ts`: Module for coordinating tasks.
+- `modifier.ts`: Utilities for modifying data.
+- `service.ts`: Service-related functionalities.
+
+And also the folder `naming` for naming conventions and `synth` for CDK generation helpers
+
+### `prefab`
+
+Houses different high level infra components:
+
+- `analytics`: Modules related to analytics:
+  - `events`: Automatic data ingestion for Event Bridge events
+- `auth`: Authentication-related modules:
+  - `cognito-pool`: Cognito pool functionalities.
+- `compute`: Computational modules:
+  - `fargate`: Fargate-related modules.
+  - `function`: Lambda functions with different kind of triggers:
+    - `api-function`: API function modules.
+    - `base-function`: Base function modules.
+    - `cognito-function`: Cognito function modules.
+    - `cron-function`: Cron job function modules.
+    - `event-function`: Event function modules.
+    - `queue-function`: Queue function modules.
+    - `topic-function`: Topic function modules.
+- `frontend`: Infra for Frontend-related functionalities:
+  - `spa`: Single Page Application modules.
+  - `ssr`: Server-Side Rendering modules.
+- `gateway`: Gateway-related modules:
+  - `alb-public`: ALB Public modules.
+  - `api`: API-related modules.
+  - `app-sync`: App Sync modules.
+  - `cdn-api`: CDN API modules.
+  - `cdn-asset`: CDN Asset modules.
+- `integration`: Integration modules:
+  - `event-bus`: Event bus integration modules.
+  - `queue`: Queue integration modules.
+  - `topic`: Topic integration modules.
+- `networking`: Networking-related modules:
+  - `dns-domain-ref`: DNS domain reference modules.
+  - `dns-subdomain-certificate`: DNS subdomain certificate modules.
+  - `dns-subdomain-hosted-zone`: DNS subdomain hosted zone modules.
+  - `vpc`: VPC modules.
+  - `waf`: WAF modules.
+- `storage`: Storage-related modules:
+  - `bucket`: Bucket-related modules.
+  - `dynamo`: DynamoDB-related modules.
+  - `rds`: RDS-related modules.
+  - `timestream`: Timestream-related modules.
+- `util`: Utility modules:
+  - `config`: Configuration-related utilities.
+  - `deploy-pipeline`: Deployment pipeline utilities.
+  - `ses`: SES (Simple Email Service) utilities.
+
+### `script`
+
+Scripts and commands for various tasks:
+
+- `config-command`: Configuration command scripts.
+- `index.ts`: Index file for scripts.
+- `output-command`: Output command scripts.
+
+---

package/script/config-command/bootstrap.ts

@@ -0,0 +1,108 @@
+/* eslint-disable no-console */
+import { execSync } from 'child_process';
+
+import {
+  BaseEnvName,
+  BaseGlobalEnv,
+  BaseDeployTargetName,
+  BaseGlobalConstConfig,
+  BaseGlobalEnvConfig,
+  BaseGlobalDeployTargetConfig,
+  preScript,
+  BaseRegionName,
+  assumeRole,
+} from '../../common';
+
+import { ConfigCommand } from '..';
+
+export const bootstrap: ConfigCommand = async <
+  GlobalConst,
+  AllowedEnv extends BaseEnvName = BaseEnvName,
+  GlobalEnv extends BaseGlobalEnv = BaseGlobalEnv,
+  DeployTargetName extends BaseDeployTargetName = BaseDeployTargetName,
+>(
+  globalConstConfig: BaseGlobalConstConfig<GlobalConst>,
+  globalEnvConfig: BaseGlobalEnvConfig<AllowedEnv, GlobalEnv>,
+  globalDeployTargetConfig: BaseGlobalDeployTargetConfig<AllowedEnv, DeployTargetName>,
+  args: string[]
+): Promise<void> => {
+  try {
+    console.log('<< Bootstrap Started >>');
+
+    const { envName, envNameInput, roleName, outputFile, servicesNames, accountMap, bootstrappingServices, landingZones } = await preScript(
+      globalConstConfig,
+      globalEnvConfig,
+      globalDeployTargetConfig,
+      args
+    );
+
+    const accountArr = accountMap.split(' ');
+    const deployAccount: string = accountArr.find((a) => a.includes('deploy'))?.split('=')[1] || '';
+    const serviceAccount: string = accountArr.find((a) => a.includes('services'))?.split('=')[1] || '';
+    const dnsAccount: string = accountArr.find((a) => a.includes('dnsShared'))?.split('=')[1] || '';
+
+    const region = globalDeployTargetConfig[envName as AllowedEnv]['services' as DeployTargetName]['region'];
+
+    await runBootstrap(landingZones, serviceAccount, region, roleName, envNameInput, outputFile, accountMap, servicesNames);
+
+    await runBootstrap(landingZones, deployAccount, region, roleName, envNameInput, outputFile, accountMap, servicesNames);
+
+    if (dnsAccount !== deployAccount) {
+      await runBootstrap(landingZones, dnsAccount, region, roleName, envNameInput, outputFile, accountMap, servicesNames);
+    }
+
+    if (bootstrappingServices) {
+      const command = `npx cdk deploy \
+      --require-approval='never' \
+      --cloudformation-execution-policies=arn:aws:iam::aws:policy/AdministratorAccess \
+      --context env=${envNameInput} \
+      --context isBootstrapping=true \
+      --context assume-role-credentials:writeIamRoleName=${roleName} \
+      --context assume-role-credentials:readIamRoleName=${roleName} \
+      --outputs-file ${outputFile} \
+      ${accountMap} ${bootstrappingServices}`;
+
+      execSync(command, { stdio: 'inherit', env: process.env });
+    }
+  } catch (error) {
+    process.exit(1);
+  }
+};
+
+const runBootstrap = async (
+  landingZones: string[],
+  account: string,
+  region: BaseRegionName,
+  roleName: string,
+  envNameInput: string,
+  outputFile: string,
+  accountMap: string,
+  serviceName: string
+) => {
+  const command = `npx cdk bootstrap ${account}/${region} \
+    --require-approval='never' \
+    ${landingZones.map((lz) => `--trust ${lz}`).join(' ')} \
+    ${landingZones.map((lz) => `--trust-for-lookup ${lz}`).join(' ')} \
+    --no-bootstrap-customer-key \
+    --require-approval='never' \
+    --cloudformation-execution-policies=arn:aws:iam::aws:policy/AdministratorAccess \
+    --context env=${envNameInput} \
+    --outputs-file ${outputFile} \
+    ${accountMap} ${serviceName}`;
+
+  const role = await assumeRole({ account, region }, roleName).catch((e) => {
+    console.log(e);
+    throw e;
+  });
+
+  execSync(command, {
+    stdio: 'inherit',
+    env: {
+      ...process.env,
+      AWS_ACCESS_KEY_ID: role.credentials.accessKeyId,
+      AWS_SECRET_ACCESS_KEY: role.credentials.secretAccessKey,
+      AWS_SESSION_TOKEN: role.credentials.sessionToken,
+      AWS_REGION: role.region,
+    },
+  });
+};