@webiny/project-aws 0.0.0-unstable.3c5210ad37

package/pulumi/apps/api/backgroundTask/types.d.ts

@@ -0,0 +1,91 @@
+import type * as pulumi from "@pulumi/pulumi";
+/**
+ * Update types if required. Try to avoid generic objects
+ */
+export declare enum StepFunctionDefinitionStatesType {
+    Task = "Task",
+    Pass = "Pass",
+    Choice = "Choice",
+    Wait = "Wait",
+    Fail = "Fail",
+    Succeed = "Succeed"
+}
+export interface StepFunctionDefinitionStatesCatch {
+    ErrorEquals: string[];
+    Next: string;
+    ResultPath?: string;
+}
+export interface StepFunctionDefinitionStatesChoiceBase {
+    Variable: string;
+    Next: string;
+    StringEquals?: string;
+    StringMatches?: string;
+    IsPresent?: boolean;
+    IsNull?: boolean;
+}
+export interface StepFunctionDefinitionStatesChoiceAndItem {
+    Variable: string;
+    StringEquals?: string;
+    StringMatches?: string;
+    IsPresent?: boolean;
+    IsTimestamp?: boolean;
+    IsNumeric?: boolean;
+    NumericGreaterThan?: number;
+}
+export interface StepFunctionDefinitionStatesChoiceAnd {
+    And: StepFunctionDefinitionStatesChoiceAndItem[];
+    Next: string;
+}
+export type StepFunctionDefinitionStatesChoice = StepFunctionDefinitionStatesChoiceBase | StepFunctionDefinitionStatesChoiceAnd;
+export interface StepFunctionDefinitionStatesTypeBase {
+    Type: StepFunctionDefinitionStatesType;
+    Comment?: string;
+    InputPath?: string;
+    OutputPath?: string;
+}
+export interface StepFunctionDefinitionStatesTypeTask extends StepFunctionDefinitionStatesTypeBase {
+    Type: StepFunctionDefinitionStatesType.Task;
+    Resource: pulumi.Input<string>;
+    Next: string;
+    ResultPath?: string;
+    Parameters: Record<string, any>;
+    Catch: StepFunctionDefinitionStatesCatch[];
+    End?: boolean;
+}
+export interface StepFunctionDefinitionStatesTypePass extends StepFunctionDefinitionStatesTypeBase {
+    Type: StepFunctionDefinitionStatesType.Pass;
+    Next: string;
+    ResultPath?: string;
+    Parameters: Record<string, any>;
+    End?: boolean;
+}
+export interface StepFunctionDefinitionStatesTypeChoice extends StepFunctionDefinitionStatesTypeBase {
+    Type: StepFunctionDefinitionStatesType.Choice;
+    Choices: StepFunctionDefinitionStatesChoice[];
+    Default?: string;
+}
+export interface StepFunctionDefinitionStatesTypeFail extends StepFunctionDefinitionStatesTypeBase {
+    Type: StepFunctionDefinitionStatesType.Fail;
+    Error?: string;
+    Cause?: string;
+    CausePath?: string;
+    ErrorPath?: string;
+}
+export interface StepFunctionDefinitionStatesTypeSucceed extends StepFunctionDefinitionStatesTypeBase {
+    Type: StepFunctionDefinitionStatesType.Succeed;
+}
+export interface StepFunctionDefinitionStatesTypeWait extends StepFunctionDefinitionStatesTypeBase {
+    Next: string;
+    Seconds?: number;
+    Timestamp?: string;
+    SecondsPath?: string;
+    TimestampPath?: string;
+}
+export type StepFunctionDefinitionStatesTypes = StepFunctionDefinitionStatesTypeTask | StepFunctionDefinitionStatesTypePass | StepFunctionDefinitionStatesTypeChoice | StepFunctionDefinitionStatesTypeFail | StepFunctionDefinitionStatesTypeSucceed | StepFunctionDefinitionStatesTypeWait;
+export interface StepFunctionDefinition {
+    Comment: string;
+    StartAt: string;
+    States: {
+        [key: string]: StepFunctionDefinitionStatesTypes;
+    };
+}

package/pulumi/apps/api/backgroundTask/types.js

@@ -0,0 +1,14 @@
+/**
+ * Update types if required. Try to avoid generic objects
+ */
+export let StepFunctionDefinitionStatesType = /*#__PURE__*/function (StepFunctionDefinitionStatesType) {
+  StepFunctionDefinitionStatesType["Task"] = "Task";
+  StepFunctionDefinitionStatesType["Pass"] = "Pass";
+  StepFunctionDefinitionStatesType["Choice"] = "Choice";
+  StepFunctionDefinitionStatesType["Wait"] = "Wait";
+  StepFunctionDefinitionStatesType["Fail"] = "Fail";
+  StepFunctionDefinitionStatesType["Succeed"] = "Succeed";
+  return StepFunctionDefinitionStatesType;
+}({});
+
+//# sourceMappingURL=types.js.map

package/pulumi/apps/api/backgroundTask/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["StepFunctionDefinitionStatesType"],"sources":["types.ts"],"sourcesContent":["import type * as pulumi from \"@pulumi/pulumi\";\n\n/**\n * Update types if required. Try to avoid generic objects\n */\nexport enum StepFunctionDefinitionStatesType {\n    Task = \"Task\",\n    Pass = \"Pass\",\n    Choice = \"Choice\",\n    Wait = \"Wait\",\n    Fail = \"Fail\",\n    Succeed = \"Succeed\"\n}\n\nexport interface StepFunctionDefinitionStatesCatch {\n    ErrorEquals: string[];\n    Next: string;\n    ResultPath?: string;\n}\n\nexport interface StepFunctionDefinitionStatesChoiceBase {\n    Variable: string;\n    Next: string;\n    StringEquals?: string;\n    StringMatches?: string;\n    IsPresent?: boolean;\n    IsNull?: boolean;\n}\n\nexport interface StepFunctionDefinitionStatesChoiceAndItem {\n    Variable: string;\n    StringEquals?: string;\n    StringMatches?: string;\n    IsPresent?: boolean;\n    IsTimestamp?: boolean;\n    IsNumeric?: boolean;\n    NumericGreaterThan?: number;\n}\nexport interface StepFunctionDefinitionStatesChoiceAnd {\n    And: StepFunctionDefinitionStatesChoiceAndItem[];\n    Next: string;\n}\n\nexport type StepFunctionDefinitionStatesChoice =\n    | StepFunctionDefinitionStatesChoiceBase\n    | StepFunctionDefinitionStatesChoiceAnd;\n\nexport interface StepFunctionDefinitionStatesTypeBase {\n    Type: StepFunctionDefinitionStatesType;\n    Comment?: string;\n    InputPath?: string;\n    OutputPath?: string;\n}\n\nexport interface StepFunctionDefinitionStatesTypeTask extends StepFunctionDefinitionStatesTypeBase {\n    Type: StepFunctionDefinitionStatesType.Task;\n    Resource: pulumi.Input<string>;\n    Next: string;\n    ResultPath?: string;\n    Parameters: Record<string, any>;\n    Catch: StepFunctionDefinitionStatesCatch[];\n    End?: boolean;\n}\n\nexport interface StepFunctionDefinitionStatesTypePass extends StepFunctionDefinitionStatesTypeBase {\n    Type: StepFunctionDefinitionStatesType.Pass;\n    Next: string;\n    ResultPath?: string;\n    Parameters: Record<string, any>;\n    End?: boolean;\n}\n\nexport interface StepFunctionDefinitionStatesTypeChoice\n    extends StepFunctionDefinitionStatesTypeBase {\n    Type: StepFunctionDefinitionStatesType.Choice;\n    Choices: StepFunctionDefinitionStatesChoice[];\n    Default?: string;\n}\n\nexport interface StepFunctionDefinitionStatesTypeFail extends StepFunctionDefinitionStatesTypeBase {\n    Type: StepFunctionDefinitionStatesType.Fail;\n    Error?: string;\n    Cause?: string;\n    CausePath?: string;\n    ErrorPath?: string;\n}\n\nexport interface StepFunctionDefinitionStatesTypeSucceed\n    extends StepFunctionDefinitionStatesTypeBase {\n    Type: StepFunctionDefinitionStatesType.Succeed;\n}\n\nexport interface StepFunctionDefinitionStatesTypeWait extends StepFunctionDefinitionStatesTypeBase {\n    Next: string;\n    Seconds?: number;\n    Timestamp?: string;\n    SecondsPath?: string;\n    TimestampPath?: string;\n}\n\nexport type StepFunctionDefinitionStatesTypes =\n    | StepFunctionDefinitionStatesTypeTask\n    | StepFunctionDefinitionStatesTypePass\n    | StepFunctionDefinitionStatesTypeChoice\n    | StepFunctionDefinitionStatesTypeFail\n    | StepFunctionDefinitionStatesTypeSucceed\n    | StepFunctionDefinitionStatesTypeWait;\n\nexport interface StepFunctionDefinition {\n    Comment: string;\n    StartAt: string;\n    States: {\n        [key: string]: StepFunctionDefinitionStatesTypes;\n    };\n}\n"],"mappings":"AAEA;AACA;AACA;AACA,WAAYA,gCAAgC,0BAAhCA,gCAAgC;EAAhCA,gCAAgC;EAAhCA,gCAAgC;EAAhCA,gCAAgC;EAAhCA,gCAAgC;EAAhCA,gCAAgC;EAAhCA,gCAAgC;EAAA,OAAhCA,gCAAgC;AAAA","ignoreList":[]}

package/pulumi/apps/api/createApiPulumiApp.d.ts

@@ -0,0 +1,57 @@
+import { type PulumiApp } from "@webiny/pulumi";
+import type { WithServiceManifest } from "../../../pulumi/utils/withServiceManifest.js";
+export type ApiPulumiApp = ReturnType<typeof createApiPulumiApp>;
+export declare const createApiPulumiApp: () => PulumiApp<{
+    fileManager: {
+        functions: {
+            download: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function.js").Function>;
+        };
+    };
+    graphql: {
+        role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role.js").Role>;
+        policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy.js").Policy>;
+        functions: {
+            graphql: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function.js").Function>;
+        };
+        addRoute: (routeParams: import("~/pulumi/apps/index.js").AddRouteParams) => any;
+    };
+    apiGateway: {
+        api: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/api.js").Api>;
+        stage: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/stage.js").Stage>;
+        routes: Record<string, {
+            integration: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/integration.js").Integration>;
+            route: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/route.js").Route>;
+            permission: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/permission.js").Permission>;
+        }>;
+        addRoute: (name: string, params: import("~/pulumi/apps/index.js").ApiRouteParams) => void;
+    };
+    websocket: {
+        websocketApi: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/api.js").Api>;
+        websocketApiStage: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/stage.js").Stage>;
+        websocketApiConnectRoute: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/route.js").Route>;
+        websocketApiDisconnectRoute: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/route.js").Route>;
+        websocketApiDefaultRoute: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/route.js").Route>;
+        websocketLambdaPermission: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/permission.js").Permission>;
+        lambdaWebsocketPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy.js").Policy>;
+        lambdaWebsocketRolePolicyAttachment: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/rolePolicyAttachment.js").RolePolicyAttachment>;
+        websocketApiUrl: import("@pulumi/pulumi").Output<string>;
+    };
+    cloudfront: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/distribution.js").Distribution>;
+    migration: {
+        function: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function.js").Function>;
+    };
+    backgroundTask: {
+        backgroundTask: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function.js").Function>;
+        stepFunction: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/sfn/stateMachine.js").StateMachine>;
+        stepFunctionRole: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role.js").Role>;
+        stepFunctionPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy.js").Policy>;
+        eventPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy.js").Policy>;
+        eventRolePolicyAttachment: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/rolePolicyAttachment.js").RolePolicyAttachment>;
+        eventTarget: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch/eventTarget.js").EventTarget>;
+    };
+    scheduler: {
+        invokeRole: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role.js").Role>;
+        invokePolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/rolePolicy.js").RolePolicy>;
+        policyAttachment: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/rolePolicyAttachment.js").RolePolicyAttachment>;
+    };
+}> & import("../lambdaUtils.js").WithCommonLambdaEnvVariables & WithServiceManifest;

package/pulumi/apps/api/createApiPulumiApp.js

@@ -0,0 +1,281 @@
+import * as aws from "@pulumi/aws";
+import { createPulumiApp, isResourceOfType } from "@webiny/pulumi";
+import { ApiBackgroundTask, ApiCloudfront, ApiFileManager, ApiGateway, ApiGraphql, ApiMigration, ApiWebsocket, CoreOutput, VpcConfig } from "../index.js";
+import { addDomainsUrlsOutputs, withCommonLambdaEnvVariables, withServiceManifest } from "../../utils/index.js";
+import { getEnvVariableAwsRegion } from "../../env/awsRegion.js";
+// import { attachSyncSystem } from "../syncSystem/api/index.js";
+import { applyAwsResourceTags, getAwsAccountId } from "../awsUtils.js";
+import { ApiScheduler } from "./ApiScheduler.js";
+import { getProjectSdk } from "@webiny/project";
+import { getVpcConfigFromExtension } from "../extensions/getVpcConfigFromExtension.js";
+import { getOsConfigFromExtension } from "../extensions/getOsConfigFromExtension.js";
+import { handleGuardDutyEvents } from "./handleGuardDutyEvents.js";
+import { ApiPulumi } from "@webiny/project/abstractions/index.js";
+export const createApiPulumiApp = () => {
+  const baseApp = createPulumiApp({
+    name: "api",
+    path: "apps/api",
+    program: async app => {
+      const sdk = await getProjectSdk();
+      const projectConfig = await sdk.getProjectConfig();
+      const pulumiResourceNamePrefix = await sdk.getPulumiResourceNamePrefix();
+      const vpcExtensionsConfig = getVpcConfigFromExtension(projectConfig);
+      const openSearchExtensionConfig = getOsConfigFromExtension(projectConfig);
+      let searchEngineParams = null;
+      if (openSearchExtensionConfig) {
+        searchEngineParams = openSearchExtensionConfig;
+      }
+      if (searchEngineParams) {
+        const params = searchEngineParams;
+        if (typeof params === "object") {
+          if (params.domainName) {
+            process.env.AWS_OS_DOMAIN_NAME = params.domainName;
+          }
+          if (params.indexPrefix) {
+            process.env.OPENSEARCH_INDEX_PREFIX = params.indexPrefix;
+          }
+          if (params.sharedIndexes) {
+            process.env.OPENSEARCH_SHARED_INDEXES = "true";
+          }
+        }
+      }
+      if (pulumiResourceNamePrefix) {
+        app.onResource(resource => {
+          if (!resource.name.startsWith(pulumiResourceNamePrefix)) {
+            resource.name = `${pulumiResourceNamePrefix}${resource.name}`;
+          }
+        });
+      }
+
+      // <-------------------- Enterprise start -------------------->
+      app.addHandler(async () => {
+        const featureFlags = await sdk.getFeatureFlags();
+        const usingAdvancedVpcParams = vpcExtensionsConfig && typeof vpcExtensionsConfig !== "boolean";
+        if (featureFlags.isFileManagerThreatDetectionEnabled()) {
+          handleGuardDutyEvents(app);
+        }
+
+        // Not using advanced VPC params? Then immediately exit.
+        if (usingAdvancedVpcParams) {
+          const {
+            onResource,
+            addResource
+          } = app;
+          const {
+            useExistingVpc
+          } = vpcExtensionsConfig;
+
+          // 1. We first deal with "existing VPC" setup.
+          if (useExistingVpc) {
+            if (!useExistingVpc.lambdaFunctionsVpcConfig) {
+              throw new Error("Cannot specify `useExistingVpc` parameter because the `lambdaFunctionsVpcConfig` parameter wasn't provided.");
+            }
+            onResource(resource => {
+              if (isResourceOfType(resource, aws.lambda.Function)) {
+                const canUseVpc = resource.meta.canUseVpc !== false;
+                if (canUseVpc) {
+                  resource.config.vpcConfig(useExistingVpc.lambdaFunctionsVpcConfig);
+                }
+              }
+              if (isResourceOfType(resource, aws.iam.Role)) {
+                if (resource.meta.isLambdaFunctionRole) {
+                  addResource(aws.iam.RolePolicyAttachment, {
+                    name: `${resource.name}-vpc-access-execution-role`,
+                    config: {
+                      role: resource.output.name,
+                      policyArn: aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole
+                    }
+                  });
+                }
+              }
+            });
+          }
+        }
+      });
+      // <-------------------- Enterprise end -------------------->
+
+      // Overrides must be applied via a handler, registered at the very start of the program.
+      // By doing this, we're ensuring user's adjustments are not applied to late.
+      const pulumiHandlers = sdk.getContainer().resolve(ApiPulumi);
+      app.addHandler(() => {
+        return pulumiHandlers.execute(app);
+      });
+      const isProduction = app.env.isProduction;
+
+      // Register core output as a module available to all the other modules
+      const core = app.addModule(CoreOutput);
+
+      // Register VPC config module to be available to other modules.
+      const vpcEnabled = vpcExtensionsConfig === true || typeof vpcExtensionsConfig === "object" || isProduction;
+      app.addModule(VpcConfig, {
+        enabled: vpcEnabled
+      });
+      const graphql = app.addModule(ApiGraphql, {
+        env: {
+          COGNITO_REGION: getEnvVariableAwsRegion(),
+          COGNITO_USER_POOL_ID: core.cognitoUserPoolId,
+          DB_TABLE: core.primaryDynamodbTableName,
+          DB_TABLE_LOG: core.logDynamodbTableName,
+          DB_TABLE_AUDIT_LOGS: core.auditLogsDynamodbTableName,
+          DB_TABLE_OPENSEARCH: core.opensearchDynamodbTableName,
+          OPENSEARCH_ENDPOINT: core.opensearchDomainEndpoint,
+          // Not required. Useful for testing purposes / ephemeral environments.
+          // https://www.webiny.com/docs/key-topics/ci-cd/testing/slow-ephemeral-environments
+          OPENSEARCH_INDEX_PREFIX: process.env.OPENSEARCH_INDEX_PREFIX,
+          OPENSEARCH_SHARED_INDEXES: process.env.OPENSEARCH_SHARED_INDEXES,
+          S3_BUCKET: core.fileManagerBucketId,
+          EVENT_BUS: core.eventBusArn,
+          // TODO: move to okta plugin
+          OKTA_ISSUER: process.env["OKTA_ISSUER"]
+        }
+      });
+      const websocket = app.addModule(ApiWebsocket);
+      const fileManager = app.addModule(ApiFileManager, {
+        env: {
+          DB_TABLE: core.primaryDynamodbTableName,
+          DB_TABLE_LOG: core.logDynamodbTableName,
+          DB_TABLE_AUDIT_LOGS: core.auditLogsDynamodbTableName
+        }
+      });
+      const apiGateway = app.addModule(ApiGateway, {
+        "graphql-post": {
+          path: "/graphql",
+          method: "POST",
+          function: graphql.functions.graphql.output.arn
+        },
+        "graphql-options": {
+          path: "/graphql",
+          method: "OPTIONS",
+          function: graphql.functions.graphql.output.arn
+        },
+        "files-any": {
+          path: "/files/{path+}",
+          method: "ANY",
+          function: fileManager.functions.download.output.arn
+        },
+        "private-any": {
+          path: "/private/{path+}",
+          method: "ANY",
+          function: fileManager.functions.download.output.arn
+        },
+        "cms-post": {
+          path: "/cms/{key+}",
+          method: "POST",
+          function: graphql.functions.graphql.output.arn
+        },
+        "cms-options": {
+          path: "/cms/{key+}",
+          method: "OPTIONS",
+          function: graphql.functions.graphql.output.arn
+        },
+        "redirects-get": {
+          path: "/wb/redirects",
+          method: "GET",
+          function: graphql.functions.graphql.output.arn
+        },
+        "redirects-options": {
+          path: "/wb/redirects",
+          method: "OPTIONS",
+          function: graphql.functions.graphql.output.arn
+        },
+        "files-catch-all": {
+          path: "/{path+}",
+          method: "ANY",
+          function: fileManager.functions.download.output.arn
+        }
+      });
+      const cloudfront = app.addModule(ApiCloudfront);
+      const backgroundTask = app.addModule(ApiBackgroundTask);
+      const migration = app.addModule(ApiMigration);
+      const scheduler = app.addModule(ApiScheduler);
+
+      // const domains = app.getParam(projectAppParams.domains);
+      // if (domains) {
+      //     applyCustomDomain(cloudfront, domains);
+      // }
+
+      app.addOutputs({
+        awsAccountId: getAwsAccountId(app),
+        region: aws.config.region,
+        cognitoUserPoolId: core.cognitoUserPoolId,
+        cognitoAppClientId: core.cognitoAppClientId,
+        cognitoUserPoolPasswordPolicy: core.cognitoUserPoolPasswordPolicy,
+        dynamoDbTable: core.primaryDynamodbTableName,
+        auditLogsDynamoDbTable: core.auditLogsDynamodbTableName,
+        migrationLambdaArn: migration.function.output.arn,
+        graphqlLambdaName: graphql.functions.graphql.output.name,
+        graphqlLambdaRole: graphql.role.output.arn,
+        graphqlLambdaRoleName: graphql.role.output.name,
+        backgroundTaskLambdaArn: backgroundTask.backgroundTask.output.arn,
+        backgroundTaskStepFunctionArn: backgroundTask.stepFunction.output.arn,
+        fileManagerDownloadLambdaArn: fileManager.functions.download.output.arn,
+        websocketApiId: websocket.websocketApi.output.id,
+        websocketApiUrl: websocket.websocketApiUrl,
+        schedulerLambdaInvokeRole: scheduler.invokeRole.output.arn
+      });
+
+      // Only add `dynamoDbOpensearchTable` output if using search engine (ES/OS).
+      if (searchEngineParams) {
+        app.addOutputs({
+          dynamoDbOpensearchTable: core.opensearchDynamodbTableName
+        });
+      }
+      app.addHandler(() => {
+        addDomainsUrlsOutputs({
+          app,
+          cloudfrontDistribution: cloudfront,
+          map: {
+            distributionDomain: "cloudfrontApiDomain",
+            distributionUrl: "cloudfrontApiUrl",
+            usedDomain: "apiDomain",
+            usedUrl: "apiUrl"
+          }
+        });
+      });
+      // /**
+      //  * We need to attach the Sync System if it exists.
+      //  */
+      // await attachSyncSystem({
+      //     app,
+      //     core,
+      //     env: app.params.run.env
+      // });
+
+      // Applies internal and user-defined AWS tags.
+      await applyAwsResourceTags("api");
+      return {
+        fileManager,
+        graphql,
+        apiGateway,
+        websocket,
+        cloudfront,
+        migration,
+        backgroundTask,
+        scheduler
+      };
+    }
+  });
+  const app = withServiceManifest(withCommonLambdaEnvVariables(baseApp));
+  app.addHandler(() => {
+    app.addServiceManifest({
+      name: "api",
+      manifest: {
+        bgTaskSfn: baseApp.resources.backgroundTask.stepFunction.output.arn,
+        cloudfront: {
+          distributionId: baseApp.resources.cloudfront.output.id,
+          domain: baseApp.resources.cloudfront.output.domainName.apply(v => `https://${v}`)
+        }
+      }
+    });
+    app.addServiceManifest({
+      name: "scheduler",
+      manifest: {
+        lambdaArn: baseApp.resources.graphql.functions.graphql.output.arn,
+        roleArn: baseApp.resources.scheduler.invokeRole.output.arn
+      }
+    });
+  });
+  return app;
+};
+
+//# sourceMappingURL=createApiPulumiApp.js.map

package/pulumi/apps/api/createApiPulumiApp.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createPulumiApp","isResourceOfType","ApiBackgroundTask","ApiCloudfront","ApiFileManager","ApiGateway","ApiGraphql","ApiMigration","ApiWebsocket","CoreOutput","VpcConfig","addDomainsUrlsOutputs","withCommonLambdaEnvVariables","withServiceManifest","getEnvVariableAwsRegion","applyAwsResourceTags","getAwsAccountId","ApiScheduler","getProjectSdk","getVpcConfigFromExtension","getOsConfigFromExtension","handleGuardDutyEvents","ApiPulumi","createApiPulumiApp","baseApp","name","path","program","app","sdk","projectConfig","getProjectConfig","pulumiResourceNamePrefix","getPulumiResourceNamePrefix","vpcExtensionsConfig","openSearchExtensionConfig","searchEngineParams","params","domainName","process","env","AWS_OS_DOMAIN_NAME","indexPrefix","OPENSEARCH_INDEX_PREFIX","sharedIndexes","OPENSEARCH_SHARED_INDEXES","onResource","resource","startsWith","addHandler","featureFlags","getFeatureFlags","usingAdvancedVpcParams","isFileManagerThreatDetectionEnabled","addResource","useExistingVpc","lambdaFunctionsVpcConfig","Error","lambda","Function","canUseVpc","meta","config","vpcConfig","iam","Role","isLambdaFunctionRole","RolePolicyAttachment","role","output","policyArn","ManagedPolicy","AWSLambdaVPCAccessExecutionRole","pulumiHandlers","getContainer","resolve","execute","isProduction","core","addModule","vpcEnabled","enabled","graphql","COGNITO_REGION","COGNITO_USER_POOL_ID","cognitoUserPoolId","DB_TABLE","primaryDynamodbTableName","DB_TABLE_LOG","logDynamodbTableName","DB_TABLE_AUDIT_LOGS","auditLogsDynamodbTableName","DB_TABLE_OPENSEARCH","opensearchDynamodbTableName","OPENSEARCH_ENDPOINT","opensearchDomainEndpoint","S3_BUCKET","fileManagerBucketId","EVENT_BUS","eventBusArn","OKTA_ISSUER","websocket","fileManager","apiGateway","method","function","functions","arn","download","cloudfront","backgroundTask","migration","scheduler","addOutputs","awsAccountId","region","cognitoAppClientId","cognitoUserPoolPasswordPolicy","dynamoDbTable","auditLogsDynamoDbTable","migrationLambdaArn","graphqlLambdaName","graphqlLambdaRole","graphqlLambdaRoleName","backgroundTaskLambdaArn","backgroundTaskStepFunctionArn","stepFunction","fileManagerDownloadLambdaArn","websocketApiId","websocketApi","id","websocketApiUrl","schedulerLambdaInvokeRole","invokeRole","dynamoDbOpensearchTable","cloudfrontDistribution","map","distributionDomain","distributionUrl","usedDomain","usedUrl","addServiceManifest","manifest","bgTaskSfn","resources","distributionId","domain","apply","v","lambdaArn","roleArn"],"sources":["createApiPulumiApp.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { createPulumiApp, isResourceOfType, type PulumiApp } from \"@webiny/pulumi\";\nimport {\n    ApiBackgroundTask,\n    ApiCloudfront,\n    ApiFileManager,\n    ApiGateway,\n    ApiGraphql,\n    ApiMigration,\n    ApiWebsocket,\n    CoreOutput,\n    VpcConfig\n} from \"~/pulumi/apps/index.js\";\nimport {\n    addDomainsUrlsOutputs,\n    withCommonLambdaEnvVariables,\n    withServiceManifest\n} from \"~/pulumi/utils/index.js\";\nimport { getEnvVariableAwsRegion } from \"~/pulumi/env/awsRegion.js\";\n// import { attachSyncSystem } from \"../syncSystem/api/index.js\";\nimport { applyAwsResourceTags, getAwsAccountId } from \"~/pulumi/apps/awsUtils.js\";\nimport type { WithServiceManifest } from \"~/pulumi/utils/withServiceManifest.js\";\nimport { ApiScheduler } from \"~/pulumi/apps/api/ApiScheduler.js\";\nimport { getProjectSdk } from \"@webiny/project\";\nimport { getVpcConfigFromExtension } from \"~/pulumi/apps/extensions/getVpcConfigFromExtension.js\";\nimport { getOsConfigFromExtension } from \"~/pulumi/apps/extensions/getOsConfigFromExtension.js\";\nimport { handleGuardDutyEvents } from \"./handleGuardDutyEvents.js\";\nimport { ApiPulumi } from \"@webiny/project/abstractions/index.js\";\n\nexport type ApiPulumiApp = ReturnType<typeof createApiPulumiApp>;\n\nexport const createApiPulumiApp = () => {\n    const baseApp = createPulumiApp({\n        name: \"api\",\n        path: \"apps/api\",\n        program: async (app: PulumiApp & WithServiceManifest) => {\n            const sdk = await getProjectSdk();\n            const projectConfig = await sdk.getProjectConfig();\n\n            const pulumiResourceNamePrefix = await sdk.getPulumiResourceNamePrefix();\n            const vpcExtensionsConfig = getVpcConfigFromExtension(projectConfig);\n            const openSearchExtensionConfig = getOsConfigFromExtension(projectConfig);\n\n            let searchEngineParams: typeof openSearchExtensionConfig | null = null;\n\n            if (openSearchExtensionConfig) {\n                searchEngineParams = openSearchExtensionConfig;\n            }\n\n            if (searchEngineParams) {\n                const params = searchEngineParams;\n                if (typeof params === \"object\") {\n                    if (params.domainName) {\n                        process.env.AWS_OS_DOMAIN_NAME = params.domainName;\n                    }\n\n                    if (params.indexPrefix) {\n                        process.env.OPENSEARCH_INDEX_PREFIX = params.indexPrefix;\n                    }\n\n                    if (params.sharedIndexes) {\n                        process.env.OPENSEARCH_SHARED_INDEXES = \"true\";\n                    }\n                }\n            }\n\n            if (pulumiResourceNamePrefix) {\n                app.onResource(resource => {\n                    if (!resource.name.startsWith(pulumiResourceNamePrefix)) {\n                        resource.name = `${pulumiResourceNamePrefix}${resource.name}`;\n                    }\n                });\n            }\n\n            // <-------------------- Enterprise start -------------------->\n            app.addHandler(async () => {\n                const featureFlags = await sdk.getFeatureFlags();\n\n                const usingAdvancedVpcParams =\n                    vpcExtensionsConfig && typeof vpcExtensionsConfig !== \"boolean\";\n\n                if (featureFlags.isFileManagerThreatDetectionEnabled()) {\n                    handleGuardDutyEvents(app as ApiPulumiApp);\n                }\n\n                // Not using advanced VPC params? Then immediately exit.\n                if (usingAdvancedVpcParams) {\n                    const { onResource, addResource } = app;\n                    const { useExistingVpc } = vpcExtensionsConfig;\n\n                    // 1. We first deal with \"existing VPC\" setup.\n                    if (useExistingVpc) {\n                        if (!useExistingVpc.lambdaFunctionsVpcConfig) {\n                            throw new Error(\n                                \"Cannot specify `useExistingVpc` parameter because the `lambdaFunctionsVpcConfig` parameter wasn't provided.\"\n                            );\n                        }\n\n                        onResource(resource => {\n                            if (isResourceOfType(resource, aws.lambda.Function)) {\n                                const canUseVpc = resource.meta.canUseVpc !== false;\n                                if (canUseVpc) {\n                                    resource.config.vpcConfig(\n                                        useExistingVpc!.lambdaFunctionsVpcConfig\n                                    );\n                                }\n                            }\n\n                            if (isResourceOfType(resource, aws.iam.Role)) {\n                                if (resource.meta.isLambdaFunctionRole) {\n                                    addResource(aws.iam.RolePolicyAttachment, {\n                                        name: `${resource.name}-vpc-access-execution-role`,\n                                        config: {\n                                            role: resource.output.name,\n                                            policyArn:\n                                                aws.iam.ManagedPolicy\n                                                    .AWSLambdaVPCAccessExecutionRole\n                                        }\n                                    });\n                                }\n                            }\n                        });\n                    }\n                }\n            });\n            // <-------------------- Enterprise end -------------------->\n\n            // Overrides must be applied via a handler, registered at the very start of the program.\n            // By doing this, we're ensuring user's adjustments are not applied to late.\n            const pulumiHandlers = sdk.getContainer().resolve(ApiPulumi);\n\n            app.addHandler(() => {\n                return pulumiHandlers.execute(app as unknown as ApiPulumiApp);\n            });\n\n            const isProduction = app.env.isProduction;\n\n            // Register core output as a module available to all the other modules\n            const core = app.addModule(CoreOutput);\n\n            // Register VPC config module to be available to other modules.\n            const vpcEnabled =\n                vpcExtensionsConfig === true ||\n                typeof vpcExtensionsConfig === \"object\" ||\n                isProduction;\n\n            app.addModule(VpcConfig, { enabled: vpcEnabled });\n\n            const graphql = app.addModule(ApiGraphql, {\n                env: {\n                    COGNITO_REGION: getEnvVariableAwsRegion(),\n                    COGNITO_USER_POOL_ID: core.cognitoUserPoolId,\n                    DB_TABLE: core.primaryDynamodbTableName,\n                    DB_TABLE_LOG: core.logDynamodbTableName,\n                    DB_TABLE_AUDIT_LOGS: core.auditLogsDynamodbTableName,\n                    DB_TABLE_OPENSEARCH: core.opensearchDynamodbTableName,\n                    OPENSEARCH_ENDPOINT: core.opensearchDomainEndpoint,\n\n                    // Not required. Useful for testing purposes / ephemeral environments.\n                    // https://www.webiny.com/docs/key-topics/ci-cd/testing/slow-ephemeral-environments\n                    OPENSEARCH_INDEX_PREFIX: process.env.OPENSEARCH_INDEX_PREFIX,\n                    OPENSEARCH_SHARED_INDEXES: process.env.OPENSEARCH_SHARED_INDEXES,\n\n                    S3_BUCKET: core.fileManagerBucketId,\n                    EVENT_BUS: core.eventBusArn,\n                    // TODO: move to okta plugin\n                    OKTA_ISSUER: process.env[\"OKTA_ISSUER\"]\n                }\n            });\n\n            const websocket = app.addModule(ApiWebsocket);\n\n            const fileManager = app.addModule(ApiFileManager, {\n                env: {\n                    DB_TABLE: core.primaryDynamodbTableName,\n                    DB_TABLE_LOG: core.logDynamodbTableName,\n                    DB_TABLE_AUDIT_LOGS: core.auditLogsDynamodbTableName\n                }\n            });\n\n            const apiGateway = app.addModule(ApiGateway, {\n                \"graphql-post\": {\n                    path: \"/graphql\",\n                    method: \"POST\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"graphql-options\": {\n                    path: \"/graphql\",\n                    method: \"OPTIONS\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"files-any\": {\n                    path: \"/files/{path+}\",\n                    method: \"ANY\",\n                    function: fileManager.functions.download.output.arn\n                },\n                \"private-any\": {\n                    path: \"/private/{path+}\",\n                    method: \"ANY\",\n                    function: fileManager.functions.download.output.arn\n                },\n                \"cms-post\": {\n                    path: \"/cms/{key+}\",\n                    method: \"POST\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"cms-options\": {\n                    path: \"/cms/{key+}\",\n                    method: \"OPTIONS\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"redirects-get\": {\n                    path: \"/wb/redirects\",\n                    method: \"GET\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"redirects-options\": {\n                    path: \"/wb/redirects\",\n                    method: \"OPTIONS\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"files-catch-all\": {\n                    path: \"/{path+}\",\n                    method: \"ANY\",\n                    function: fileManager.functions.download.output.arn\n                }\n            });\n\n            const cloudfront = app.addModule(ApiCloudfront);\n            const backgroundTask = app.addModule(ApiBackgroundTask);\n            const migration = app.addModule(ApiMigration);\n            const scheduler = app.addModule(ApiScheduler);\n\n            // const domains = app.getParam(projectAppParams.domains);\n            // if (domains) {\n            //     applyCustomDomain(cloudfront, domains);\n            // }\n\n            app.addOutputs({\n                awsAccountId: getAwsAccountId(app),\n                region: aws.config.region,\n                cognitoUserPoolId: core.cognitoUserPoolId,\n                cognitoAppClientId: core.cognitoAppClientId,\n                cognitoUserPoolPasswordPolicy: core.cognitoUserPoolPasswordPolicy,\n                dynamoDbTable: core.primaryDynamodbTableName,\n                auditLogsDynamoDbTable: core.auditLogsDynamodbTableName,\n                migrationLambdaArn: migration.function.output.arn,\n                graphqlLambdaName: graphql.functions.graphql.output.name,\n                graphqlLambdaRole: graphql.role.output.arn,\n                graphqlLambdaRoleName: graphql.role.output.name,\n                backgroundTaskLambdaArn: backgroundTask.backgroundTask.output.arn,\n                backgroundTaskStepFunctionArn: backgroundTask.stepFunction.output.arn,\n                fileManagerDownloadLambdaArn: fileManager.functions.download.output.arn,\n                websocketApiId: websocket.websocketApi.output.id,\n                websocketApiUrl: websocket.websocketApiUrl,\n                schedulerLambdaInvokeRole: scheduler.invokeRole.output.arn\n            });\n\n            // Only add `dynamoDbOpensearchTable` output if using search engine (ES/OS).\n            if (searchEngineParams) {\n                app.addOutputs({\n                    dynamoDbOpensearchTable: core.opensearchDynamodbTableName\n                });\n            }\n\n            app.addHandler(() => {\n                addDomainsUrlsOutputs({\n                    app,\n                    cloudfrontDistribution: cloudfront,\n                    map: {\n                        distributionDomain: \"cloudfrontApiDomain\",\n                        distributionUrl: \"cloudfrontApiUrl\",\n                        usedDomain: \"apiDomain\",\n                        usedUrl: \"apiUrl\"\n                    }\n                });\n            });\n            // /**\n            //  * We need to attach the Sync System if it exists.\n            //  */\n            // await attachSyncSystem({\n            //     app,\n            //     core,\n            //     env: app.params.run.env\n            // });\n\n            // Applies internal and user-defined AWS tags.\n            await applyAwsResourceTags(\"api\");\n\n            return {\n                fileManager,\n                graphql,\n                apiGateway,\n                websocket,\n                cloudfront,\n                migration,\n                backgroundTask,\n                scheduler\n            };\n        }\n    });\n\n    const app = withServiceManifest(withCommonLambdaEnvVariables(baseApp));\n\n    app.addHandler(() => {\n        app.addServiceManifest({\n            name: \"api\",\n            manifest: {\n                bgTaskSfn: baseApp.resources.backgroundTask.stepFunction.output.arn,\n                cloudfront: {\n                    distributionId: baseApp.resources.cloudfront.output.id,\n                    domain: baseApp.resources.cloudfront.output.domainName.apply(\n                        v => `https://${v}`\n                    )\n                }\n            }\n        });\n\n        app.addServiceManifest({\n            name: \"scheduler\",\n            manifest: {\n                lambdaArn: baseApp.resources.graphql.functions.graphql.output.arn,\n                roleArn: baseApp.resources.scheduler.invokeRole.output.arn\n            }\n        });\n    });\n\n    return app;\n};\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAClC,SAASC,eAAe,EAAEC,gBAAgB,QAAwB,gBAAgB;AAClF,SACIC,iBAAiB,EACjBC,aAAa,EACbC,cAAc,EACdC,UAAU,EACVC,UAAU,EACVC,YAAY,EACZC,YAAY,EACZC,UAAU,EACVC,SAAS;AAEb,SACIC,qBAAqB,EACrBC,4BAA4B,EAC5BC,mBAAmB;AAEvB,SAASC,uBAAuB;AAChC;AACA,SAASC,oBAAoB,EAAEC,eAAe;AAE9C,SAASC,YAAY;AACrB,SAASC,aAAa,QAAQ,iBAAiB;AAC/C,SAASC,yBAAyB;AAClC,SAASC,wBAAwB;AACjC,SAASC,qBAAqB;AAC9B,SAASC,SAAS,QAAQ,uCAAuC;AAIjE,OAAO,MAAMC,kBAAkB,GAAGA,CAAA,KAAM;EACpC,MAAMC,OAAO,GAAGxB,eAAe,CAAC;IAC5ByB,IAAI,EAAE,KAAK;IACXC,IAAI,EAAE,UAAU;IAChBC,OAAO,EAAE,MAAOC,GAAoC,IAAK;MACrD,MAAMC,GAAG,GAAG,MAAMX,aAAa,CAAC,CAAC;MACjC,MAAMY,aAAa,GAAG,MAAMD,GAAG,CAACE,gBAAgB,CAAC,CAAC;MAElD,MAAMC,wBAAwB,GAAG,MAAMH,GAAG,CAACI,2BAA2B,CAAC,CAAC;MACxE,MAAMC,mBAAmB,GAAGf,yBAAyB,CAACW,aAAa,CAAC;MACpE,MAAMK,yBAAyB,GAAGf,wBAAwB,CAACU,aAAa,CAAC;MAEzE,IAAIM,kBAA2D,GAAG,IAAI;MAEtE,IAAID,yBAAyB,EAAE;QAC3BC,kBAAkB,GAAGD,yBAAyB;MAClD;MAEA,IAAIC,kBAAkB,EAAE;QACpB,MAAMC,MAAM,GAAGD,kBAAkB;QACjC,IAAI,OAAOC,MAAM,KAAK,QAAQ,EAAE;UAC5B,IAAIA,MAAM,CAACC,UAAU,EAAE;YACnBC,OAAO,CAACC,GAAG,CAACC,kBAAkB,GAAGJ,MAAM,CAACC,UAAU;UACtD;UAEA,IAAID,MAAM,CAACK,WAAW,EAAE;YACpBH,OAAO,CAACC,GAAG,CAACG,uBAAuB,GAAGN,MAAM,CAACK,WAAW;UAC5D;UAEA,IAAIL,MAAM,CAACO,aAAa,EAAE;YACtBL,OAAO,CAACC,GAAG,CAACK,yBAAyB,GAAG,MAAM;UAClD;QACJ;MACJ;MAEA,IAAIb,wBAAwB,EAAE;QAC1BJ,GAAG,CAACkB,UAAU,CAACC,QAAQ,IAAI;UACvB,IAAI,CAACA,QAAQ,CAACtB,IAAI,CAACuB,UAAU,CAAChB,wBAAwB,CAAC,EAAE;YACrDe,QAAQ,CAACtB,IAAI,GAAG,GAAGO,wBAAwB,GAAGe,QAAQ,CAACtB,IAAI,EAAE;UACjE;QACJ,CAAC,CAAC;MACN;;MAEA;MACAG,GAAG,CAACqB,UAAU,CAAC,YAAY;QACvB,MAAMC,YAAY,GAAG,MAAMrB,GAAG,CAACsB,eAAe,CAAC,CAAC;QAEhD,MAAMC,sBAAsB,GACxBlB,mBAAmB,IAAI,OAAOA,mBAAmB,KAAK,SAAS;QAEnE,IAAIgB,YAAY,CAACG,mCAAmC,CAAC,CAAC,EAAE;UACpDhC,qBAAqB,CAACO,GAAmB,CAAC;QAC9C;;QAEA;QACA,IAAIwB,sBAAsB,EAAE;UACxB,MAAM;YAAEN,UAAU;YAAEQ;UAAY,CAAC,GAAG1B,GAAG;UACvC,MAAM;YAAE2B;UAAe,CAAC,GAAGrB,mBAAmB;;UAE9C;UACA,IAAIqB,cAAc,EAAE;YAChB,IAAI,CAACA,cAAc,CAACC,wBAAwB,EAAE;cAC1C,MAAM,IAAIC,KAAK,CACX,6GACJ,CAAC;YACL;YAEAX,UAAU,CAACC,QAAQ,IAAI;cACnB,IAAI9C,gBAAgB,CAAC8C,QAAQ,EAAEhD,GAAG,CAAC2D,MAAM,CAACC,QAAQ,CAAC,EAAE;gBACjD,MAAMC,SAAS,GAAGb,QAAQ,CAACc,IAAI,CAACD,SAAS,KAAK,KAAK;gBACnD,IAAIA,SAAS,EAAE;kBACXb,QAAQ,CAACe,MAAM,CAACC,SAAS,CACrBR,cAAc,CAAEC,wBACpB,CAAC;gBACL;cACJ;cAEA,IAAIvD,gBAAgB,CAAC8C,QAAQ,EAAEhD,GAAG,CAACiE,GAAG,CAACC,IAAI,CAAC,EAAE;gBAC1C,IAAIlB,QAAQ,CAACc,IAAI,CAACK,oBAAoB,EAAE;kBACpCZ,WAAW,CAACvD,GAAG,CAACiE,GAAG,CAACG,oBAAoB,EAAE;oBACtC1C,IAAI,EAAE,GAAGsB,QAAQ,CAACtB,IAAI,4BAA4B;oBAClDqC,MAAM,EAAE;sBACJM,IAAI,EAAErB,QAAQ,CAACsB,MAAM,CAAC5C,IAAI;sBAC1B6C,SAAS,EACLvE,GAAG,CAACiE,GAAG,CAACO,aAAa,CAChBC;oBACb;kBACJ,CAAC,CAAC;gBACN;cACJ;YACJ,CAAC,CAAC;UACN;QACJ;MACJ,CAAC,CAAC;MACF;;MAEA;MACA;MACA,MAAMC,cAAc,GAAG5C,GAAG,CAAC6C,YAAY,CAAC,CAAC,CAACC,OAAO,CAACrD,SAAS,CAAC;MAE5DM,GAAG,CAACqB,UAAU,CAAC,MAAM;QACjB,OAAOwB,cAAc,CAACG,OAAO,CAAChD,GAA8B,CAAC;MACjE,CAAC,CAAC;MAEF,MAAMiD,YAAY,GAAGjD,GAAG,CAACY,GAAG,CAACqC,YAAY;;MAEzC;MACA,MAAMC,IAAI,GAAGlD,GAAG,CAACmD,SAAS,CAACtE,UAAU,CAAC;;MAEtC;MACA,MAAMuE,UAAU,GACZ9C,mBAAmB,KAAK,IAAI,IAC5B,OAAOA,mBAAmB,KAAK,QAAQ,IACvC2C,YAAY;MAEhBjD,GAAG,CAACmD,SAAS,CAACrE,SAAS,EAAE;QAAEuE,OAAO,EAAED;MAAW,CAAC,CAAC;MAEjD,MAAME,OAAO,GAAGtD,GAAG,CAACmD,SAAS,CAACzE,UAAU,EAAE;QACtCkC,GAAG,EAAE;UACD2C,cAAc,EAAErE,uBAAuB,CAAC,CAAC;UACzCsE,oBAAoB,EAAEN,IAAI,CAACO,iBAAiB;UAC5CC,QAAQ,EAAER,IAAI,CAACS,wBAAwB;UACvCC,YAAY,EAAEV,IAAI,CAACW,oBAAoB;UACvCC,mBAAmB,EAAEZ,IAAI,CAACa,0BAA0B;UACpDC,mBAAmB,EAAEd,IAAI,CAACe,2BAA2B;UACrDC,mBAAmB,EAAEhB,IAAI,CAACiB,wBAAwB;UAElD;UACA;UACApD,uBAAuB,EAAEJ,OAAO,CAACC,GAAG,CAACG,uBAAuB;UAC5DE,yBAAyB,EAAEN,OAAO,CAACC,GAAG,CAACK,yBAAyB;UAEhEmD,SAAS,EAAElB,IAAI,CAACmB,mBAAmB;UACnCC,SAAS,EAAEpB,IAAI,CAACqB,WAAW;UAC3B;UACAC,WAAW,EAAE7D,OAAO,CAACC,GAAG,CAAC,aAAa;QAC1C;MACJ,CAAC,CAAC;MAEF,MAAM6D,SAAS,GAAGzE,GAAG,CAACmD,SAAS,CAACvE,YAAY,CAAC;MAE7C,MAAM8F,WAAW,GAAG1E,GAAG,CAACmD,SAAS,CAAC3E,cAAc,EAAE;QAC9CoC,GAAG,EAAE;UACD8C,QAAQ,EAAER,IAAI,CAACS,wBAAwB;UACvCC,YAAY,EAAEV,IAAI,CAACW,oBAAoB;UACvCC,mBAAmB,EAAEZ,IAAI,CAACa;QAC9B;MACJ,CAAC,CAAC;MAEF,MAAMY,UAAU,GAAG3E,GAAG,CAACmD,SAAS,CAAC1E,UAAU,EAAE;QACzC,cAAc,EAAE;UACZqB,IAAI,EAAE,UAAU;UAChB8E,MAAM,EAAE,MAAM;UACdC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,iBAAiB,EAAE;UACfjF,IAAI,EAAE,UAAU;UAChB8E,MAAM,EAAE,SAAS;UACjBC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,WAAW,EAAE;UACTjF,IAAI,EAAE,gBAAgB;UACtB8E,MAAM,EAAE,KAAK;UACbC,QAAQ,EAAEH,WAAW,CAACI,SAAS,CAACE,QAAQ,CAACvC,MAAM,CAACsC;QACpD,CAAC;QACD,aAAa,EAAE;UACXjF,IAAI,EAAE,kBAAkB;UACxB8E,MAAM,EAAE,KAAK;UACbC,QAAQ,EAAEH,WAAW,CAACI,SAAS,CAACE,QAAQ,CAACvC,MAAM,CAACsC;QACpD,CAAC;QACD,UAAU,EAAE;UACRjF,IAAI,EAAE,aAAa;UACnB8E,MAAM,EAAE,MAAM;UACdC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,aAAa,EAAE;UACXjF,IAAI,EAAE,aAAa;UACnB8E,MAAM,EAAE,SAAS;UACjBC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,eAAe,EAAE;UACbjF,IAAI,EAAE,eAAe;UACrB8E,MAAM,EAAE,KAAK;UACbC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,mBAAmB,EAAE;UACjBjF,IAAI,EAAE,eAAe;UACrB8E,MAAM,EAAE,SAAS;UACjBC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,iBAAiB,EAAE;UACfjF,IAAI,EAAE,UAAU;UAChB8E,MAAM,EAAE,KAAK;UACbC,QAAQ,EAAEH,WAAW,CAACI,SAAS,CAACE,QAAQ,CAACvC,MAAM,CAACsC;QACpD;MACJ,CAAC,CAAC;MAEF,MAAME,UAAU,GAAGjF,GAAG,CAACmD,SAAS,CAAC5E,aAAa,CAAC;MAC/C,MAAM2G,cAAc,GAAGlF,GAAG,CAACmD,SAAS,CAAC7E,iBAAiB,CAAC;MACvD,MAAM6G,SAAS,GAAGnF,GAAG,CAACmD,SAAS,CAACxE,YAAY,CAAC;MAC7C,MAAMyG,SAAS,GAAGpF,GAAG,CAACmD,SAAS,CAAC9D,YAAY,CAAC;;MAE7C;MACA;MACA;MACA;;MAEAW,GAAG,CAACqF,UAAU,CAAC;QACXC,YAAY,EAAElG,eAAe,CAACY,GAAG,CAAC;QAClCuF,MAAM,EAAEpH,GAAG,CAAC+D,MAAM,CAACqD,MAAM;QACzB9B,iBAAiB,EAAEP,IAAI,CAACO,iBAAiB;QACzC+B,kBAAkB,EAAEtC,IAAI,CAACsC,kBAAkB;QAC3CC,6BAA6B,EAAEvC,IAAI,CAACuC,6BAA6B;QACjEC,aAAa,EAAExC,IAAI,CAACS,wBAAwB;QAC5CgC,sBAAsB,EAAEzC,IAAI,CAACa,0BAA0B;QACvD6B,kBAAkB,EAAET,SAAS,CAACN,QAAQ,CAACpC,MAAM,CAACsC,GAAG;QACjDc,iBAAiB,EAAEvC,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAAC5C,IAAI;QACxDiG,iBAAiB,EAAExC,OAAO,CAACd,IAAI,CAACC,MAAM,CAACsC,GAAG;QAC1CgB,qBAAqB,EAAEzC,OAAO,CAACd,IAAI,CAACC,MAAM,CAAC5C,IAAI;QAC/CmG,uBAAuB,EAAEd,cAAc,CAACA,cAAc,CAACzC,MAAM,CAACsC,GAAG;QACjEkB,6BAA6B,EAAEf,cAAc,CAACgB,YAAY,CAACzD,MAAM,CAACsC,GAAG;QACrEoB,4BAA4B,EAAEzB,WAAW,CAACI,SAAS,CAACE,QAAQ,CAACvC,MAAM,CAACsC,GAAG;QACvEqB,cAAc,EAAE3B,SAAS,CAAC4B,YAAY,CAAC5D,MAAM,CAAC6D,EAAE;QAChDC,eAAe,EAAE9B,SAAS,CAAC8B,eAAe;QAC1CC,yBAAyB,EAAEpB,SAAS,CAACqB,UAAU,CAAChE,MAAM,CAACsC;MAC3D,CAAC,CAAC;;MAEF;MACA,IAAIvE,kBAAkB,EAAE;QACpBR,GAAG,CAACqF,UAAU,CAAC;UACXqB,uBAAuB,EAAExD,IAAI,CAACe;QAClC,CAAC,CAAC;MACN;MAEAjE,GAAG,CAACqB,UAAU,CAAC,MAAM;QACjBtC,qBAAqB,CAAC;UAClBiB,GAAG;UACH2G,sBAAsB,EAAE1B,UAAU;UAClC2B,GAAG,EAAE;YACDC,kBAAkB,EAAE,qBAAqB;YACzCC,eAAe,EAAE,kBAAkB;YACnCC,UAAU,EAAE,WAAW;YACvBC,OAAO,EAAE;UACb;QACJ,CAAC,CAAC;MACN,CAAC,CAAC;MACF;MACA;MACA;MACA;MACA;MACA;MACA;MACA;;MAEA;MACA,MAAM7H,oBAAoB,CAAC,KAAK,CAAC;MAEjC,OAAO;QACHuF,WAAW;QACXpB,OAAO;QACPqB,UAAU;QACVF,SAAS;QACTQ,UAAU;QACVE,SAAS;QACTD,cAAc;QACdE;MACJ,CAAC;IACL;EACJ,CAAC,CAAC;EAEF,MAAMpF,GAAG,GAAGf,mBAAmB,CAACD,4BAA4B,CAACY,OAAO,CAAC,CAAC;EAEtEI,GAAG,CAACqB,UAAU,CAAC,MAAM;IACjBrB,GAAG,CAACiH,kBAAkB,CAAC;MACnBpH,IAAI,EAAE,KAAK;MACXqH,QAAQ,EAAE;QACNC,SAAS,EAAEvH,OAAO,CAACwH,SAAS,CAAClC,cAAc,CAACgB,YAAY,CAACzD,MAAM,CAACsC,GAAG;QACnEE,UAAU,EAAE;UACRoC,cAAc,EAAEzH,OAAO,CAACwH,SAAS,CAACnC,UAAU,CAACxC,MAAM,CAAC6D,EAAE;UACtDgB,MAAM,EAAE1H,OAAO,CAACwH,SAAS,CAACnC,UAAU,CAACxC,MAAM,CAAC/B,UAAU,CAAC6G,KAAK,CACxDC,CAAC,IAAI,WAAWA,CAAC,EACrB;QACJ;MACJ;IACJ,CAAC,CAAC;IAEFxH,GAAG,CAACiH,kBAAkB,CAAC;MACnBpH,IAAI,EAAE,WAAW;MACjBqH,QAAQ,EAAE;QACNO,SAAS,EAAE7H,OAAO,CAACwH,SAAS,CAAC9D,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC,GAAG;QACjE2C,OAAO,EAAE9H,OAAO,CAACwH,SAAS,CAAChC,SAAS,CAACqB,UAAU,CAAChE,MAAM,CAACsC;MAC3D;IACJ,CAAC,CAAC;EACN,CAAC,CAAC;EAEF,OAAO/E,GAAG;AACd,CAAC","ignoreList":[]}

package/pulumi/apps/api/handleGuardDutyEvents.d.ts

@@ -0,0 +1,2 @@
+import { type ApiPulumiApp } from "../../../pulumi/index.js";
+export declare const handleGuardDutyEvents: (app: ApiPulumiApp) => void;

package/pulumi/apps/api/handleGuardDutyEvents.js

@@ -0,0 +1,55 @@
+import * as aws from "@pulumi/aws";
+import { CoreOutput } from "../../index.js";
+export const handleGuardDutyEvents = app => {
+  const core = app.getModule(CoreOutput);
+  const graphql = app.resources.graphql.functions.graphql;
+  const baseConfig = graphql.config.clone();
+  const threatDetectionHandler = app.addResource(aws.lambda.Function, {
+    name: "fm-threat-detection",
+    config: {
+      ...baseConfig,
+      memorySize: 1024,
+      description: "Handles Guard Duty threat scan results.",
+      environment: {
+        variables: graphql.output.environment.apply(env => {
+          return {
+            WEBINY_FUNCTION_TYPE: "threat-detection-event-handler",
+            ...env?.variables
+          };
+        })
+      },
+      loggingConfig: {
+        logFormat: "JSON"
+      }
+    }
+  });
+  const eventRule = app.addResource(aws.cloudwatch.EventRule, {
+    name: `fm-bucket-malware-protection-event-rule`,
+    config: {
+      eventBusName: core.eventBusName,
+      eventPattern: JSON.stringify({
+        source: ["aws.guardduty"],
+        "detail-type": ["GuardDuty Malware Protection Object Scan Result"]
+      })
+    }
+  });
+  app.addResource(aws.lambda.Permission, {
+    name: "fm-bucket-malware-protection-event-permission",
+    config: {
+      action: "lambda:InvokeFunction",
+      function: threatDetectionHandler.output.arn,
+      principal: "events.amazonaws.com",
+      sourceArn: eventRule.output.arn
+    }
+  });
+  app.addResource(aws.cloudwatch.EventTarget, {
+    name: `fm-bucket-malware-protection-event-target`,
+    config: {
+      rule: eventRule.output.name,
+      arn: threatDetectionHandler.output.arn,
+      eventBusName: core.eventBusName
+    }
+  });
+};
+
+//# sourceMappingURL=handleGuardDutyEvents.js.map

package/pulumi/apps/api/handleGuardDutyEvents.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","CoreOutput","handleGuardDutyEvents","app","core","getModule","graphql","resources","functions","baseConfig","config","clone","threatDetectionHandler","addResource","lambda","Function","name","memorySize","description","environment","variables","output","apply","env","WEBINY_FUNCTION_TYPE","loggingConfig","logFormat","eventRule","cloudwatch","EventRule","eventBusName","eventPattern","JSON","stringify","source","Permission","action","function","arn","principal","sourceArn","EventTarget","rule"],"sources":["handleGuardDutyEvents.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { type ApiPulumiApp, CoreOutput } from \"~/pulumi/index.js\";\n\nexport const handleGuardDutyEvents = (app: ApiPulumiApp) => {\n    const core = app.getModule(CoreOutput);\n    const graphql = app.resources.graphql.functions.graphql;\n\n    const baseConfig = graphql.config.clone();\n\n    const threatDetectionHandler = app.addResource(aws.lambda.Function, {\n        name: \"fm-threat-detection\",\n        config: {\n            ...baseConfig,\n            memorySize: 1024,\n            description: \"Handles Guard Duty threat scan results.\",\n            environment: {\n                variables: graphql.output.environment.apply(env => {\n                    return {\n                        WEBINY_FUNCTION_TYPE: \"threat-detection-event-handler\",\n                        ...env?.variables\n                    };\n                })\n            },\n            loggingConfig: {\n                logFormat: \"JSON\"\n            }\n        }\n    });\n\n    const eventRule = app.addResource(aws.cloudwatch.EventRule, {\n        name: `fm-bucket-malware-protection-event-rule`,\n        config: {\n            eventBusName: core.eventBusName,\n            eventPattern: JSON.stringify({\n                source: [\"aws.guardduty\"],\n                \"detail-type\": [\"GuardDuty Malware Protection Object Scan Result\"]\n            })\n        }\n    });\n\n    app.addResource(aws.lambda.Permission, {\n        name: \"fm-bucket-malware-protection-event-permission\",\n        config: {\n            action: \"lambda:InvokeFunction\",\n            function: threatDetectionHandler.output.arn,\n            principal: \"events.amazonaws.com\",\n            sourceArn: eventRule.output.arn\n        }\n    });\n\n    app.addResource(aws.cloudwatch.EventTarget, {\n        name: `fm-bucket-malware-protection-event-target`,\n        config: {\n            rule: eventRule.output.name,\n            arn: threatDetectionHandler.output.arn,\n            eventBusName: core.eventBusName\n        }\n    });\n};\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAClC,SAA4BC,UAAU;AAEtC,OAAO,MAAMC,qBAAqB,GAAIC,GAAiB,IAAK;EACxD,MAAMC,IAAI,GAAGD,GAAG,CAACE,SAAS,CAACJ,UAAU,CAAC;EACtC,MAAMK,OAAO,GAAGH,GAAG,CAACI,SAAS,CAACD,OAAO,CAACE,SAAS,CAACF,OAAO;EAEvD,MAAMG,UAAU,GAAGH,OAAO,CAACI,MAAM,CAACC,KAAK,CAAC,CAAC;EAEzC,MAAMC,sBAAsB,GAAGT,GAAG,CAACU,WAAW,CAACb,GAAG,CAACc,MAAM,CAACC,QAAQ,EAAE;IAChEC,IAAI,EAAE,qBAAqB;IAC3BN,MAAM,EAAE;MACJ,GAAGD,UAAU;MACbQ,UAAU,EAAE,IAAI;MAChBC,WAAW,EAAE,yCAAyC;MACtDC,WAAW,EAAE;QACTC,SAAS,EAAEd,OAAO,CAACe,MAAM,CAACF,WAAW,CAACG,KAAK,CAACC,GAAG,IAAI;UAC/C,OAAO;YACHC,oBAAoB,EAAE,gCAAgC;YACtD,GAAGD,GAAG,EAAEH;UACZ,CAAC;QACL,CAAC;MACL,CAAC;MACDK,aAAa,EAAE;QACXC,SAAS,EAAE;MACf;IACJ;EACJ,CAAC,CAAC;EAEF,MAAMC,SAAS,GAAGxB,GAAG,CAACU,WAAW,CAACb,GAAG,CAAC4B,UAAU,CAACC,SAAS,EAAE;IACxDb,IAAI,EAAE,yCAAyC;IAC/CN,MAAM,EAAE;MACJoB,YAAY,EAAE1B,IAAI,CAAC0B,YAAY;MAC/BC,YAAY,EAAEC,IAAI,CAACC,SAAS,CAAC;QACzBC,MAAM,EAAE,CAAC,eAAe,CAAC;QACzB,aAAa,EAAE,CAAC,iDAAiD;MACrE,CAAC;IACL;EACJ,CAAC,CAAC;EAEF/B,GAAG,CAACU,WAAW,CAACb,GAAG,CAACc,MAAM,CAACqB,UAAU,EAAE;IACnCnB,IAAI,EAAE,+CAA+C;IACrDN,MAAM,EAAE;MACJ0B,MAAM,EAAE,uBAAuB;MAC/BC,QAAQ,EAAEzB,sBAAsB,CAACS,MAAM,CAACiB,GAAG;MAC3CC,SAAS,EAAE,sBAAsB;MACjCC,SAAS,EAAEb,SAAS,CAACN,MAAM,CAACiB;IAChC;EACJ,CAAC,CAAC;EAEFnC,GAAG,CAACU,WAAW,CAACb,GAAG,CAAC4B,UAAU,CAACa,WAAW,EAAE;IACxCzB,IAAI,EAAE,2CAA2C;IACjDN,MAAM,EAAE;MACJgC,IAAI,EAAEf,SAAS,CAACN,MAAM,CAACL,IAAI;MAC3BsB,GAAG,EAAE1B,sBAAsB,CAACS,MAAM,CAACiB,GAAG;MACtCR,YAAY,EAAE1B,IAAI,CAAC0B;IACvB;EACJ,CAAC,CAAC;AACN,CAAC","ignoreList":[]}

package/pulumi/apps/api/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./ApiBackgroundTask.js";
+export * from "./ApiCloudfront.js";
+export * from "./ApiFileManager.js";
+export * from "./ApiGateway.js";
+export * from "./ApiGraphql.js";
+export * from "./ApiMigration.js";
+export * from "./createApiPulumiApp.js";
+export * from "./ApiOutput.js";
+export * from "./ApiWebsocket.js";

package/pulumi/apps/api/index.js

@@ -0,0 +1,11 @@
+export * from "./ApiBackgroundTask.js";
+export * from "./ApiCloudfront.js";
+export * from "./ApiFileManager.js";
+export * from "./ApiGateway.js";
+export * from "./ApiGraphql.js";
+export * from "./ApiMigration.js";
+export * from "./createApiPulumiApp.js";
+export * from "./ApiOutput.js";
+export * from "./ApiWebsocket.js";
+
+//# sourceMappingURL=index.js.map

package/pulumi/apps/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["index.ts"],"sourcesContent":["export * from \"./ApiBackgroundTask.js\";\nexport * from \"./ApiCloudfront.js\";\nexport * from \"./ApiFileManager.js\";\nexport * from \"./ApiGateway.js\";\nexport * from \"./ApiGraphql.js\";\nexport * from \"./ApiMigration.js\";\nexport * from \"./createApiPulumiApp.js\";\nexport * from \"./ApiOutput.js\";\nexport * from \"./ApiWebsocket.js\";\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","ignoreList":[]}

package/pulumi/apps/awsUtils.d.ts

@@ -0,0 +1,5 @@
+import { type PulumiApp } from "@webiny/pulumi";
+import { type AppName } from "@webiny/project";
+export declare function getAwsAccountId(app: PulumiApp): import("@pulumi/pulumi").Output<string>;
+export declare function getAwsRegion(app: PulumiApp): import("@pulumi/pulumi").Output<"af-south-1" | "ap-east-1" | "ap-east-2" | "ap-northeast-1" | "ap-northeast-2" | "ap-northeast-3" | "ap-south-1" | "ap-south-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-southeast-3" | "ap-southeast-4" | "ap-southeast-5" | "ap-southeast-7" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-central-2" | "eu-north-1" | "eu-south-1" | "eu-south-2" | "eu-west-1" | "eu-west-2" | "eu-west-3" | "il-central-1" | "me-central-1" | "me-south-1" | "mx-central-1" | "sa-east-1" | "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "cn-north-1" | "cn-northwest-1" | "us-gov-east-1" | "us-gov-west-1" | "us-iso-east-1" | "us-iso-west-1" | "us-isob-east-1" | "eu-isoe-west-1">;
+export declare function applyAwsResourceTags(appName: AppName): Promise<void>;