@venturekit/infra 0.0.47 → 0.0.48
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -35,7 +35,10 @@
|
|
|
35
35
|
* - `configKeys.secretArn(secretId)` — the ARN of each
|
|
36
36
|
* SecretsManager-store secret. Consumers (app stack) read this
|
|
37
37
|
* to grant `secretsmanager:GetSecretValue` on a tightly-scoped
|
|
38
|
-
* resource and inject the ARN into Lambda env vars.
|
|
38
|
+
* resource and inject the ARN into Lambda env vars. It is also how
|
|
39
|
+
* ANOTHER venture reads the secret (`secrets[].external`): its
|
|
40
|
+
* config stack resolves this key at deploy and imports the secret,
|
|
41
|
+
* creating nothing — one credential, pasted once.
|
|
39
42
|
*
|
|
40
43
|
* - `configKeys.billingSecretArn(billingId)` — the ARN of each
|
|
41
44
|
* `billing` intent's payment-provider credential secret. Same
|
|
@@ -104,8 +107,8 @@ export interface VentureConfigStackProps extends cdk.StackProps {
|
|
|
104
107
|
infrastructure: VentureIntent;
|
|
105
108
|
}
|
|
106
109
|
export declare class VentureConfigStack extends cdk.Stack {
|
|
107
|
-
/** SecretsManager-store secrets, keyed by intent id. */
|
|
108
|
-
readonly secrets: Map<string, secretsmanager.
|
|
110
|
+
/** SecretsManager-store secrets, keyed by intent id — this venture's own, and the `external` ones it reads. */
|
|
111
|
+
readonly secrets: Map<string, secretsmanager.ISecret>;
|
|
109
112
|
/** SSM-store parameters, keyed by intent id. */
|
|
110
113
|
readonly parameters: Map<string, ssm.StringParameter>;
|
|
111
114
|
/** Payment-provider credential secrets, keyed by `billing` intent id. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/config-stack.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"config-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/config-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAuC1B,MAAM,WAAW,uBAAwB,SAAQ,GAAG,CAAC,UAAU;IAC7D,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAC;IAEpB,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IAEd,yCAAyC;IACzC,SAAS,EAAE,SAAS,CAAC;IAErB;;;OAGG;IACH,cAAc,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,kBAAmB,SAAQ,GAAG,CAAC,KAAK;IAC/C,+GAA+G;IAC/G,SAAgB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,CAAa;IAEzE,gDAAgD;IAChD,SAAgB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,CAAa;IAEzE,yEAAyE;IACzE,SAAgB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAa;IAE/E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAE7B,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;IAsBxE;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IA+C3B,OAAO,CAAC,YAAY;CAoGrB"}
|
package/dist/cdk/config-stack.js
CHANGED
|
@@ -35,7 +35,10 @@
|
|
|
35
35
|
* - `configKeys.secretArn(secretId)` — the ARN of each
|
|
36
36
|
* SecretsManager-store secret. Consumers (app stack) read this
|
|
37
37
|
* to grant `secretsmanager:GetSecretValue` on a tightly-scoped
|
|
38
|
-
* resource and inject the ARN into Lambda env vars.
|
|
38
|
+
* resource and inject the ARN into Lambda env vars. It is also how
|
|
39
|
+
* ANOTHER venture reads the secret (`secrets[].external`): its
|
|
40
|
+
* config stack resolves this key at deploy and imports the secret,
|
|
41
|
+
* creating nothing — one credential, pasted once.
|
|
39
42
|
*
|
|
40
43
|
* - `configKeys.billingSecretArn(billingId)` — the ARN of each
|
|
41
44
|
* `billing` intent's payment-provider credential secret. Same
|
|
@@ -124,7 +127,7 @@ const BILLING_SECRET_FIELDS = {
|
|
|
124
127
|
*/
|
|
125
128
|
const GENERATED_FILLER_FIELD = '_unused';
|
|
126
129
|
export class VentureConfigStack extends cdk.Stack {
|
|
127
|
-
/** SecretsManager-store secrets, keyed by intent id. */
|
|
130
|
+
/** SecretsManager-store secrets, keyed by intent id — this venture's own, and the `external` ones it reads. */
|
|
128
131
|
secrets = new Map();
|
|
129
132
|
/** SSM-store parameters, keyed by intent id. */
|
|
130
133
|
parameters = new Map();
|
|
@@ -145,6 +148,11 @@ export class VentureConfigStack extends cdk.Stack {
|
|
|
145
148
|
for (const intent of infrastructure.billing ?? []) {
|
|
146
149
|
this.createBillingSecret(intent, projectName, stage);
|
|
147
150
|
}
|
|
151
|
+
/* A venture that only reads other ventures' secrets owns no resource here, and CloudFormation
|
|
152
|
+
refuses a template without one: a free, inert handle keeps the stack deployable. */
|
|
153
|
+
if (this.secrets.size > 0 && !this.node.findAll().some((c) => c instanceof cdk.CfnResource)) {
|
|
154
|
+
new cdk.CfnWaitConditionHandle(this, 'ExternalSecretsOnly');
|
|
155
|
+
}
|
|
148
156
|
}
|
|
149
157
|
/**
|
|
150
158
|
* Provision one payment-provider credential secret as a placeholder.
|
|
@@ -193,6 +201,22 @@ export class VentureConfigStack extends cdk.Stack {
|
|
|
193
201
|
createSecret(intent, projectName, stage) {
|
|
194
202
|
const isStrictRetain = this.isStrictRetain;
|
|
195
203
|
const resourceName = `${projectName}-${intent.id}`;
|
|
204
|
+
if (intent.external) {
|
|
205
|
+
// Another venture's secret: import it by the ARN its config stack
|
|
206
|
+
// publishes, resolved at deploy time (the owner deploys first). The
|
|
207
|
+
// app stack injects and grants it like an owned one; nothing here is
|
|
208
|
+
// created, so nothing here is retained or destroyed.
|
|
209
|
+
if (intent.store !== 'secretsmanager') {
|
|
210
|
+
throw new Error(`[venturekit] secrets: '${intent.id}' is external — only a Secrets Manager secret can be shared; set store: 'secretsmanager'.`);
|
|
211
|
+
}
|
|
212
|
+
const project = typeof intent.external.project === 'string' ? intent.external.project.trim() : '';
|
|
213
|
+
if (!project)
|
|
214
|
+
throw new Error(`[venturekit] secrets: '${intent.id}' is external but names no owner (external.project).`);
|
|
215
|
+
const ownerId = intent.external.id ?? intent.id;
|
|
216
|
+
const arn = ssm.StringParameter.valueForStringParameter(this, configKeys.secretArn(project, stage, ownerId));
|
|
217
|
+
this.secrets.set(intent.id, secretsmanager.Secret.fromSecretCompleteArn(this, resourceName, arn));
|
|
218
|
+
return;
|
|
219
|
+
}
|
|
196
220
|
if (intent.store === 'secretsmanager') {
|
|
197
221
|
// `generate` shapes the initial random value for a secret that is
|
|
198
222
|
// used as generated rather than pasted over — a key shared between
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-stack.js","sourceRoot":"","sources":["../../src/cdk/config-stack.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"config-stack.js","sourceRoot":"","sources":["../../src/cdk/config-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EACL,kBAAkB,GAInB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C;;;GAGG;AACH,MAAM,qBAAqB,GAAyD;IAClF,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAmBzC,MAAM,OAAO,kBAAmB,SAAQ,GAAG,CAAC,KAAK;IAC/C,+GAA+G;IAC/F,OAAO,GAAwC,IAAI,GAAG,EAAE,CAAC;IAEzE,gDAAgD;IAChC,UAAU,GAAqC,IAAI,GAAG,EAAE,CAAC;IAEzE,yEAAyE;IACzD,cAAc,GAAuC,IAAI,GAAG,EAAE,CAAC;IAE9D,cAAc,CAAU;IAEzC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAA8B;QACtE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAChE,IAAI,CAAC,cAAc;YACjB,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;QAEtE,sEAAsE;QACtE,qEAAqE;QACrE,2CAA2C;QAC3C,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QACD;8FACsF;QACtF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5F,IAAI,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,mBAAmB,CACzB,MAAqB,EACrB,WAAmB,EACnB,KAAa;QAEb,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,sBAAsB,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,MAAM,CAAC,EAAE,cAAc,EAAE;YACjF,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,YAAY,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE;YACxF,WAAW,EACT,MAAM,CAAC,WAAW;gBAClB,GAAG,MAAM,CAAC,QAAQ,qCAAqC,MAAM,CAAC,EAAE,IAAI;oBAClE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;YAC1D,oBAAoB,EAAE;gBACpB,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC9C,iBAAiB,EAAE,sBAAsB;gBACzC,cAAc,EAAE,EAAE;gBAClB,kBAAkB,EAAE,IAAI;aACzB;YACD,iEAAiE;YACjE,oEAAoE;YACpE,mEAAmE;YACnE,2CAA2C;YAC3C,aAAa,EAAE,IAAI,CAAC,cAAc;gBAChC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM;gBAC1B,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAA+B,CAAC;YACxD,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE3C,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC1D,MAAM,CAAC,SAAS,EAChB;YACE,WAAW,EACT,GAAG,MAAM,CAAC,QAAQ,uCAAuC,MAAM,CAAC,EAAE,KAAK;gBACvE,+DAA+D;SAClE,CACF,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,MAAW,EAAE,WAAmB,EAAE,KAAa;QAClE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC3C,MAAM,YAAY,GAAG,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QAEnD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,kEAAkE;YAClE,oEAAoE;YACpE,qEAAqE;YACrE,qDAAqD;YACrD,IAAI,MAAM,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,EAAE,2FAA2F,CAAC,CAAC;YAClJ,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,EAAE,sDAAsD,CAAC,CAAC;YACzH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7G,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YACtC,kEAAkE;YAClE,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,8BAA8B;YAC9B,MAAM,oBAAoB,GAAqD,MAAM,CAAC,QAAQ;gBAC5F,CAAC,CAAC;oBACE,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE;oBAC5C,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,KAAK;oBACzD,YAAY,EAAE,KAAK;oBACnB,uBAAuB,EAAE,KAAK;iBAC/B;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE;gBAC3D,4DAA4D;gBAC5D,qDAAqD;gBACrD,+CAA+C;gBAC/C,UAAU,EAAE,GAAG,WAAW,IAAI,KAAK,IAAI,MAAM,CAAC,EAAE,EAAE;gBAClD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,cAAc,MAAM,CAAC,EAAE,EAAE;gBAC5D,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,oDAAoD;gBACpD,0DAA0D;gBAC1D,4DAA4D;gBAC5D,2BAA2B;gBAC3B,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;aACrF,CAAC,CAAC;YACH,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAA+B,CAAC;gBACxD,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACpE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEpC,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACnD,MAAM,CAAC,SAAS,EAChB;gBACE,WAAW,EACT,oCAAoC,MAAM,CAAC,EAAE,KAAK;oBAClD,sDAAsD;aACzD,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,2DAA2D;YAC3D,6DAA6D;YAC7D,yDAAyD;YACzD,6DAA6D;YAC7D,6DAA6D;YAC7D,0CAA0C;YAC1C,EAAE;YACF,kDAAkD;YAClD,wDAAwD;YACxD,2DAA2D;YAC3D,+DAA+D;YAC/D,iEAAiE;YACjE,8DAA8D;YAC9D,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CACV,wBAAwB,MAAM,CAAC,EAAE,2BAA2B;oBAC5D,8DAA8D;oBAC9D,6DAA6D;oBAC7D,wCAAwC;oBACxC,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE;gBACxD,aAAa,EAAE,IAAI,WAAW,IAAI,KAAK,IAAI,MAAM,CAAC,EAAE,EAAE;gBACtD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,iBAAiB,MAAM,CAAC,EAAE,EAAE;gBAC/D,0DAA0D;gBAC1D,yDAAyD;gBACzD,sDAAsD;gBACtD,gBAAgB;gBAChB,WAAW,EAAE,sCAAsC;gBACnD,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,QAAQ;aACjC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@venturekit/infra",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.48",
|
|
4
4
|
"description": "VentureKit infrastructure - AWS CDK constructs",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -41,7 +41,7 @@
|
|
|
41
41
|
],
|
|
42
42
|
"license": "Apache-2.0",
|
|
43
43
|
"dependencies": {
|
|
44
|
-
"@venturekit/core": "0.0.
|
|
44
|
+
"@venturekit/core": "0.0.48",
|
|
45
45
|
"aws-cdk-lib": "^2.268.0",
|
|
46
46
|
"constructs": "^10.7.1",
|
|
47
47
|
"esbuild": "^0.28.1"
|