@venturekit/infra 0.0.14 → 0.0.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/identity-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,
|
|
1
|
+
{"version":3,"file":"identity-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/identity-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAe1B,MAAM,WAAW,yBAA0B,SAAQ,GAAG,CAAC,UAAU;IAC/D,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IAEpB,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IAEd,yCAAyC;IACzC,SAAS,EAAE,SAAS,CAAC;IAErB;;;OAGG;IACH,cAAc,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,oBAAqB,SAAQ,GAAG,CAAC,KAAK;IACjD;;;;OAIG;IACH,SAAgB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAa;IAErE,SAAgB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAa;IAE5E;;;;OAIG;IACH,SAAgB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAa;IAEjF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAE7B,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,yBAAyB;IAY1E,OAAO,CAAC,UAAU;CA0NnB"}
|
|
@@ -62,9 +62,19 @@
|
|
|
62
62
|
import * as cdk from 'aws-cdk-lib';
|
|
63
63
|
import * as cognito from 'aws-cdk-lib/aws-cognito';
|
|
64
64
|
import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
|
|
65
|
-
import { DATA_SAFETY_CONFIG } from '@venturekit/core';
|
|
65
|
+
import { DATA_SAFETY_CONFIG, } from '@venturekit/core';
|
|
66
66
|
import { writeSsm } from './shared/cross-stack-refs.js';
|
|
67
67
|
import { identityKeys } from './shared/ssm-keys.js';
|
|
68
|
+
/**
|
|
69
|
+
* Config vocabulary (`envConfig.identity.featurePlan`) → CDK enum.
|
|
70
|
+
* Declared as a total record so a new plan in `@venturekit/core`
|
|
71
|
+
* fails the build here instead of silently falling back.
|
|
72
|
+
*/
|
|
73
|
+
const FEATURE_PLANS = {
|
|
74
|
+
lite: cognito.FeaturePlan.LITE,
|
|
75
|
+
essentials: cognito.FeaturePlan.ESSENTIALS,
|
|
76
|
+
plus: cognito.FeaturePlan.PLUS,
|
|
77
|
+
};
|
|
68
78
|
export class VentureIdentityStack extends cdk.Stack {
|
|
69
79
|
/**
|
|
70
80
|
* In-process accessors for sibling stacks (the app stack reads
|
|
@@ -96,6 +106,11 @@ export class VentureIdentityStack extends cdk.Stack {
|
|
|
96
106
|
// Stable logical ID: `auth-{intent.id}` — preset changes never
|
|
97
107
|
// trigger a replacement (which would orphan every user record).
|
|
98
108
|
const logicalId = `auth-${intent.id}`;
|
|
109
|
+
// Per-MAU pricing tier for the pool. Every preset resolves to
|
|
110
|
+
// `lite`; a stage opts into a paid tier with
|
|
111
|
+
// `identity: { featurePlan: … }` in its env config. Changing it
|
|
112
|
+
// on an existing pool is an in-place update, not a replacement.
|
|
113
|
+
const featurePlan = FEATURE_PLANS[envConfig.identity.featurePlan];
|
|
99
114
|
const passwordPolicy = intent.passwordStrength === 'strong'
|
|
100
115
|
? {
|
|
101
116
|
minLength: 12,
|
|
@@ -165,10 +180,17 @@ export class VentureIdentityStack extends cdk.Stack {
|
|
|
165
180
|
// logged. Losing a User Pool means losing every user identity
|
|
166
181
|
// + password hash; users must re-register via password reset.
|
|
167
182
|
deletionProtection: isStrictRetain,
|
|
168
|
-
//
|
|
169
|
-
//
|
|
170
|
-
//
|
|
171
|
-
|
|
183
|
+
// Cognito feature plan (`UserPoolTier`) — the per-MAU pricing
|
|
184
|
+
// tier, resolved from the preset (`envConfig.identity`). ALWAYS
|
|
185
|
+
// sent explicitly: when the property is omitted AWS defaults the
|
|
186
|
+
// pool to Essentials ($0.015/MAU), which is not a default any
|
|
187
|
+
// preset asks for.
|
|
188
|
+
featurePlan,
|
|
189
|
+
// Threat protection (compromised-credentials detection +
|
|
190
|
+
// risk-based adaptive authentication) is the one pool feature
|
|
191
|
+
// AWS gates behind Plus, so it tracks the plan exactly —
|
|
192
|
+
// enabling it on any lower plan is rejected at CreateUserPool.
|
|
193
|
+
advancedSecurityMode: featurePlan === cognito.FeaturePlan.PLUS
|
|
172
194
|
? cognito.AdvancedSecurityMode.ENFORCED
|
|
173
195
|
: undefined,
|
|
174
196
|
accountRecovery: cognito.AccountRecovery.EMAIL_ONLY,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-stack.js","sourceRoot":"","sources":["../../src/cdk/identity-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,
|
|
1
|
+
{"version":3,"file":"identity-stack.js","sourceRoot":"","sources":["../../src/cdk/identity-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EACL,kBAAkB,GAInB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,aAAa,GAAoD;IACrE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;IAC9B,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU;IAC1C,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;CAC/B,CAAC;AAmBF,MAAM,OAAO,oBAAqB,SAAQ,GAAG,CAAC,KAAK;IACjD;;;;OAIG;IACa,SAAS,GAAkC,IAAI,GAAG,EAAE,CAAC;IAErD,UAAU,GAAwC,IAAI,GAAG,EAAE,CAAC;IAE5E;;;;OAIG;IACa,gBAAgB,GAAuC,IAAI,GAAG,EAAE,CAAC;IAEhE,cAAc,CAAU;IAEzC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAgC;QACxE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAChE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC,aAAa,KAAK,QAAQ,CAAC;QAElE,IAAI,CAAC,cAAc,CAAC,IAAI;YAAE,OAAO;QACjC,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,UAAU,CAChB,MAAW,EACX,WAAmB,EACnB,KAAa,EACb,SAAoB;QAEpB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC3C,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,SAAS,GAAG,QAAQ,MAAM,CAAC,EAAE,EAAE,CAAC;QAEtC,8DAA8D;QAC9D,6CAA6C;QAC7C,gEAAgE;QAChE,gEAAgE;QAChE,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAElE,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,KAAK,QAAQ;YACzD,CAAC,CAAC;gBACE,SAAS,EAAE,EAAE;gBACb,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,IAAI;aACrB;YACH,CAAC,CAAC;gBACE,SAAS,EAAE,CAAC;gBACZ,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,KAAK;aACtB,CAAC;QAEN,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,0DAA0D;QAC1D,gEAAgE;QAChE,gEAAgE;QAChE,mDAAmD;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,0DAA0D;QAC1D,cAAc;QACd,MAAM,eAAe,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACtE,CAAC,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,gBAAgB,GAA6C,EAAE,CAAC;QACtE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC;gBACnD,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE;YACrD,YAAY,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE;YACpD,6DAA6D;YAC7D,gEAAgE;YAChE,iBAAiB,EAAE,MAAM,CAAC,WAAW,IAAI,KAAK;YAC9C,4DAA4D;YAC5D,2DAA2D;YAC3D,4DAA4D;YAC5D,aAAa,EAAE;gBACb,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;gBACnD,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;gBACpD,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK;aAC3D;YACD,UAAU,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;gBACnD,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;aACrD;YACD,cAAc;YACd,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,UAAU;gBAC5B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;gBACtB,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU;oBACzB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;oBACtB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG;YACrB,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;YACpF,2DAA2D;YAC3D,4DAA4D;YAC5D,4DAA4D;YAC5D,2DAA2D;YAC3D,8DAA8D;YAC9D,8DAA8D;YAC9D,kBAAkB,EAAE,cAAc;YAClC,8DAA8D;YAC9D,gEAAgE;YAChE,iEAAiE;YACjE,8DAA8D;YAC9D,mBAAmB;YACnB,WAAW;YACX,yDAAyD;YACzD,8DAA8D;YAC9D,yDAAyD;YACzD,+DAA+D;YAC/D,oBAAoB,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,IAAI;gBAC5D,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ;gBACvC,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,UAAU;YACnD,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC9D,OAAO,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAExC,iEAAiE;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE1B,+DAA+D;QAC/D,2DAA2D;QAC3D,iEAAiE;QACjE,0DAA0D;QAC1D,8DAA8D;QAC9D,+DAA+D;QAC/D,mCAAmC;QACnC,MAAM,kBAAkB,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtD,IAAI,aAAiD,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE;gBAChD,SAAS,EAAE;oBACT,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;oBACb,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD;gBACD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,0BAA0B,EAAE,IAAI;gBAChC,4DAA4D;gBAC5D,4DAA4D;gBAC5D,yDAAyD;gBACzD,wDAAwD;gBACxD,2DAA2D;gBAC3D,4DAA4D;gBAC5D,gDAAgD;gBAChD,wDAAwD;gBACxD,yCAAyC;aAC1C,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,aAAa,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,aAAc,CAAC,CAAC;QAE/C,kEAAkE;QAClE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,UAAU,EAAE;YAC1F,WAAW,EAAE,kCAAkC,MAAM,CAAC,EAAE,GAAG;SAC5D,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE;YAC5F,WAAW,EAAE,uEAAuE;SACrF,CAAC,CAAC;QACH,QAAQ,CACN,IAAI,EACJ,YAAY,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC3D,aAAc,CAAC,gBAAgB,EAC/B,EAAE,WAAW,EAAE,2CAA2C,MAAM,CAAC,EAAE,GAAG,EAAE,CACzE,CAAC;QAEF,kEAAkE;QAClE,4DAA4D;QAC5D,kEAAkE;QAClE,gEAAgE;QAChE,kDAAkD;QAClD,EAAE;QACF,4DAA4D;QAC5D,4DAA4D;QAC5D,EAAE;QACF,wDAAwD;QACxD,qDAAqD;QACrD,4DAA4D;QAC5D,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CACtC,IAAI,EACJ,GAAG,SAAS,cAAc,QAAQ,EAAE,EACpC;gBACE,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,SAAS,MAAM,CAAC,EAAE,IAAI,QAAQ,EAAE;gBAC9E,WAAW,EACT,gCAAgC,QAAQ,qBAAqB;oBAC7D,iBAAiB,MAAM,CAAC,EAAE,iCAAiC;gBAC7D,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC;oBACxD,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC;iBAC7D;gBACD,yDAAyD;gBACzD,0DAA0D;gBAC1D,0DAA0D;gBAC1D,qDAAqD;gBACrD,yDAAyD;gBACzD,4CAA4C;gBAC5C,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;aACrF,CACF,CAAC;YACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,QAAQ,CACN,IAAI,EACJ,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,EACxE,MAAM,CAAC,SAAS,EAChB;gBACE,WAAW,EACT,aAAa,QAAQ,oCAAoC,MAAM,CAAC,EAAE,KAAK;oBACvE,+DAA+D;aAClE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@venturekit/infra",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.16",
|
|
4
4
|
"description": "VentureKit infrastructure - AWS CDK constructs",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -41,8 +41,8 @@
|
|
|
41
41
|
],
|
|
42
42
|
"license": "Apache-2.0",
|
|
43
43
|
"dependencies": {
|
|
44
|
-
"@venturekit/core": "0.0.
|
|
45
|
-
"aws-cdk-lib": "^2.
|
|
44
|
+
"@venturekit/core": "0.0.16",
|
|
45
|
+
"aws-cdk-lib": "^2.262.1",
|
|
46
46
|
"constructs": "^10.7.1",
|
|
47
47
|
"esbuild": "^0.28.1"
|
|
48
48
|
},
|