@webiny/project-aws 0.0.0-unstable.3c5210ad37

package/pulumi/apps/core/webinyWatchCommand/handler.d.ts

@@ -0,0 +1,28 @@
+export function handler(event: any): Promise<{
+    isAuthenticated: boolean;
+    principalId?: undefined;
+    policyDocuments?: undefined;
+    disconnectAfterInSeconds?: undefined;
+    refreshAfterInSeconds?: undefined;
+} | {
+    isAuthenticated: boolean;
+    principalId: string;
+    policyDocuments: {
+        Version: string;
+        Statement: ({
+            Effect: string;
+            Action: string;
+            Resource: string;
+        } | {
+            Effect: string;
+            Action: string;
+            Resource: string[];
+        } | {
+            Effect: string;
+            Action: string[];
+            Resource: string[];
+        })[];
+    }[];
+    disconnectAfterInSeconds: number;
+    refreshAfterInSeconds: number;
+}>;

package/pulumi/apps/core/webinyWatchCommand/handler.js

@@ -0,0 +1,37 @@
+exports.handler = async event => {
+  const urlParams = new URLSearchParams(event.protocolData.http.queryString);
+  const WEBINY_WATCH_COMMAND_TOPIC = process.env.WEBINY_WATCH_COMMAND_TOPIC;
+  if (urlParams.get("x-webiny-watch-command-topic") !== WEBINY_WATCH_COMMAND_TOPIC) {
+    return {
+      isAuthenticated: false
+    };
+  }
+  return {
+    isAuthenticated: true,
+    principalId: "Unauthenticated",
+    policyDocuments: [{
+      Version: "2012-10-17",
+      Statement: [{
+        Effect: "Allow",
+        Action: "iot:Connect",
+        Resource: "arn:aws:iot:*:*:client/*"
+      }, {
+        Effect: "Allow",
+        Action: "iot:Subscribe",
+        Resource: [`arn:aws:iot:*:*:topicfilter/${WEBINY_WATCH_COMMAND_TOPIC}`]
+      }, {
+        Effect: "Allow",
+        Action: "iot:Publish",
+        Resource: [`arn:aws:iot:*:*:topic/${WEBINY_WATCH_COMMAND_TOPIC}`]
+      }, {
+        Effect: "Allow",
+        Action: ["iot:Receive"],
+        Resource: [`arn:aws:iot:*:*:topic/${WEBINY_WATCH_COMMAND_TOPIC}`]
+      }]
+    }],
+    disconnectAfterInSeconds: 3600,
+    refreshAfterInSeconds: 300
+  };
+};
+
+//# sourceMappingURL=handler.js.map

package/pulumi/apps/core/webinyWatchCommand/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["exports","handler","event","urlParams","URLSearchParams","protocolData","http","queryString","WEBINY_WATCH_COMMAND_TOPIC","process","env","get","isAuthenticated","principalId","policyDocuments","Version","Statement","Effect","Action","Resource","disconnectAfterInSeconds","refreshAfterInSeconds"],"sources":["handler.js"],"sourcesContent":["exports.handler = async event => {\n    const urlParams = new URLSearchParams(event.protocolData.http.queryString);\n\n    const WEBINY_WATCH_COMMAND_TOPIC = process.env.WEBINY_WATCH_COMMAND_TOPIC;\n    if (urlParams.get(\"x-webiny-watch-command-topic\") !== WEBINY_WATCH_COMMAND_TOPIC) {\n        return {\n            isAuthenticated: false\n        };\n    }\n\n    return {\n        isAuthenticated: true,\n        principalId: \"Unauthenticated\",\n        policyDocuments: [\n            {\n                Version: \"2012-10-17\",\n                Statement: [\n                    {\n                        Effect: \"Allow\",\n                        Action: \"iot:Connect\",\n                        Resource: \"arn:aws:iot:*:*:client/*\"\n                    },\n                    {\n                        Effect: \"Allow\",\n                        Action: \"iot:Subscribe\",\n                        Resource: [`arn:aws:iot:*:*:topicfilter/${WEBINY_WATCH_COMMAND_TOPIC}`]\n                    },\n                    {\n                        Effect: \"Allow\",\n                        Action: \"iot:Publish\",\n                        Resource: [`arn:aws:iot:*:*:topic/${WEBINY_WATCH_COMMAND_TOPIC}`]\n                    },\n                    {\n                        Effect: \"Allow\",\n                        Action: [\"iot:Receive\"],\n                        Resource: [`arn:aws:iot:*:*:topic/${WEBINY_WATCH_COMMAND_TOPIC}`]\n                    }\n                ]\n            }\n        ],\n        disconnectAfterInSeconds: 3600,\n        refreshAfterInSeconds: 300\n    };\n};\n"],"mappings":"AAAAA,OAAO,CAACC,OAAO,GAAG,MAAMC,KAAK,IAAI;EAC7B,MAAMC,SAAS,GAAG,IAAIC,eAAe,CAACF,KAAK,CAACG,YAAY,CAACC,IAAI,CAACC,WAAW,CAAC;EAE1E,MAAMC,0BAA0B,GAAGC,OAAO,CAACC,GAAG,CAACF,0BAA0B;EACzE,IAAIL,SAAS,CAACQ,GAAG,CAAC,8BAA8B,CAAC,KAAKH,0BAA0B,EAAE;IAC9E,OAAO;MACHI,eAAe,EAAE;IACrB,CAAC;EACL;EAEA,OAAO;IACHA,eAAe,EAAE,IAAI;IACrBC,WAAW,EAAE,iBAAiB;IAC9BC,eAAe,EAAE,CACb;MACIC,OAAO,EAAE,YAAY;MACrBC,SAAS,EAAE,CACP;QACIC,MAAM,EAAE,OAAO;QACfC,MAAM,EAAE,aAAa;QACrBC,QAAQ,EAAE;MACd,CAAC,EACD;QACIF,MAAM,EAAE,OAAO;QACfC,MAAM,EAAE,eAAe;QACvBC,QAAQ,EAAE,CAAC,+BAA+BX,0BAA0B,EAAE;MAC1E,CAAC,EACD;QACIS,MAAM,EAAE,OAAO;QACfC,MAAM,EAAE,aAAa;QACrBC,QAAQ,EAAE,CAAC,yBAAyBX,0BAA0B,EAAE;MACpE,CAAC,EACD;QACIS,MAAM,EAAE,OAAO;QACfC,MAAM,EAAE,CAAC,aAAa,CAAC;QACvBC,QAAQ,EAAE,CAAC,yBAAyBX,0BAA0B,EAAE;MACpE,CAAC;IAET,CAAC,CACJ;IACDY,wBAAwB,EAAE,IAAI;IAC9BC,qBAAqB,EAAE;EAC3B,CAAC;AACL,CAAC","ignoreList":[]}

package/pulumi/apps/createAppBucket.d.ts

@@ -0,0 +1,17 @@
+import * as aws from "@pulumi/aws";
+import { type PulumiApp } from "@webiny/pulumi";
+export declare function createPublicAppBucket(app: PulumiApp, name: string): {
+    bucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket").Bucket>;
+    bucketAcl: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketAcl").BucketAcl>;
+    bucketOwnershipControls: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketOwnershipControls").BucketOwnershipControls>;
+    origin: aws.types.input.cloudfront.DistributionOrigin;
+};
+export declare function createPrivateAppBucket(app: PulumiApp, name: string): {
+    bucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket").Bucket>;
+    bucketOwnershipControls: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketOwnershipControls").BucketOwnershipControls>;
+    bucketAcl: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketAcl").BucketAcl>;
+    originIdentity: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/originAccessIdentity").OriginAccessIdentity>;
+    origin: aws.types.input.cloudfront.DistributionOrigin;
+    bucketPublicAccessBlock: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPublicAccessBlock").BucketPublicAccessBlock>;
+    bucketPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPolicy").BucketPolicy>;
+};

package/pulumi/apps/createAppBucket.js

@@ -0,0 +1,152 @@
+import * as aws from "@pulumi/aws";
+import { ApiOutput } from "./api/index.js";
+import { getEnvVariableAwsRegion } from "../env/awsRegion.js";
+export function createPublicAppBucket(app, name) {
+  const bucket = app.addResource(aws.s3.Bucket, {
+    name: name,
+    config: {
+      forceDestroy: true,
+      website: {
+        indexDocument: "index.html",
+        errorDocument: "_NOT_FOUND_PAGE_/index.html"
+      }
+    }
+  });
+  const bucketOwnershipControls = app.addResource(aws.s3.BucketOwnershipControls, {
+    name: `${name}-ownership-controls`,
+    config: {
+      bucket: bucket.output.id,
+      rule: {
+        objectOwnership: "BucketOwnerPreferred"
+      }
+    }
+  });
+  const bucketAcl = app.addResource(aws.s3.BucketAcl, {
+    name: `${name}-acl`,
+    config: {
+      bucket: bucket.output.id,
+      acl: aws.s3.CannedAcl.PublicRead
+    },
+    opts: {
+      dependsOn: [bucketOwnershipControls.output]
+    }
+  });
+  const origin = {
+    originId: bucket.output.arn,
+    domainName: bucket.output.websiteEndpoint,
+    customOriginConfig: {
+      originProtocolPolicy: "http-only",
+      httpPort: 80,
+      httpsPort: 443,
+      originSslProtocols: ["TLSv1.2"]
+    }
+  };
+  return {
+    bucket,
+    bucketAcl,
+    bucketOwnershipControls,
+    origin
+  };
+}
+
+// Forces S3 buckets to be available only through a cloudfront distribution.
+// Requires `ApiOutput` module to be loaded.
+export function createPrivateAppBucket(app, name) {
+  const api = app.getModule(ApiOutput);
+  const bucket = app.addResource(aws.s3.Bucket, {
+    name: name,
+    config: {
+      forceDestroy: true
+    }
+  });
+  const bucketOwnershipControls = app.addResource(aws.s3.BucketOwnershipControls, {
+    name: `${name}-ownership-controls`,
+    config: {
+      bucket: bucket.output.id,
+      rule: {
+        objectOwnership: "BucketOwnerPreferred"
+      }
+    }
+  });
+  const bucketAcl = app.addResource(aws.s3.BucketAcl, {
+    name: `${name}-acl`,
+    config: {
+      bucket: bucket.output.id,
+      acl: aws.s3.CannedAcl.Private
+    },
+    opts: {
+      dependsOn: [bucketOwnershipControls.output]
+    }
+  });
+
+  // Origin Identity is a kind of AWS user that represents Cloudfront distribution
+  // We can add IAM policies to it later, to allow accessing private S3 bucket
+  const originIdentity = app.addResource(aws.cloudfront.OriginAccessIdentity, {
+    name: `${name}-origin-identity`,
+    config: {}
+  });
+  const origin = {
+    originId: bucket.output.arn,
+    domainName: bucket.output.bucket.apply(
+    // We need to create a regional domain name. Otherwise, we'll run into the following issue:
+    // https://aws.amazon.com/premiumsupport/knowledge-center/s3-http-307-response/
+    name => `${name}.s3.${getEnvVariableAwsRegion()}.amazonaws.com`),
+    s3OriginConfig: {
+      originAccessIdentity: originIdentity.output.cloudfrontAccessIdentityPath
+    }
+  };
+
+  // block any public access
+  const bucketPublicAccessBlock = app.addResource(aws.s3.BucketPublicAccessBlock, {
+    name: `${name}-bucket-block-access`,
+    config: {
+      bucket: bucket.output.id,
+      blockPublicAcls: true,
+      blockPublicPolicy: true,
+      ignorePublicAcls: true,
+      restrictPublicBuckets: true
+    }
+  });
+
+  // Create an IAM policy to allow access to S3 bucket from cloudfront
+  const bucketPolicy = app.addResource(aws.s3.BucketPolicy, {
+    name: `${name}-bucket-policy`,
+    config: {
+      bucket: bucket.output.bucket,
+      policy: {
+        Version: "2012-10-17",
+        Statement: bucket.output.arn.apply(arn => {
+          const statements = [{
+            Effect: "Allow",
+            Principal: {
+              AWS: originIdentity.output.iamArn
+            },
+            // we need GetObject to retrieve objects from S3
+            // and ListBucket allows to properly handle non-existing files (404)
+            Action: ["s3:ListBucket", "s3:GetObject"],
+            Resource: [`${arn}`, `${arn}/*`]
+          }, {
+            Effect: "Allow",
+            Principal: {
+              AWS: api.graphqlLambdaRole
+            },
+            Action: ["s3:GetObjectAcl", "s3:DeleteObject", "s3:PutObjectAcl", "s3:PutObject", "s3:GetObject", "s3:ListBucket"],
+            Resource: [`${arn}`, `${arn}/*`]
+          }];
+          return statements;
+        })
+      }
+    }
+  });
+  return {
+    bucket,
+    bucketOwnershipControls,
+    bucketAcl,
+    originIdentity,
+    origin,
+    bucketPublicAccessBlock,
+    bucketPolicy
+  };
+}
+
+//# sourceMappingURL=createAppBucket.js.map

package/pulumi/apps/createAppBucket.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","ApiOutput","getEnvVariableAwsRegion","createPublicAppBucket","app","name","bucket","addResource","s3","Bucket","config","forceDestroy","website","indexDocument","errorDocument","bucketOwnershipControls","BucketOwnershipControls","output","id","rule","objectOwnership","bucketAcl","BucketAcl","acl","CannedAcl","PublicRead","opts","dependsOn","origin","originId","arn","domainName","websiteEndpoint","customOriginConfig","originProtocolPolicy","httpPort","httpsPort","originSslProtocols","createPrivateAppBucket","api","getModule","Private","originIdentity","cloudfront","OriginAccessIdentity","apply","s3OriginConfig","originAccessIdentity","cloudfrontAccessIdentityPath","bucketPublicAccessBlock","BucketPublicAccessBlock","blockPublicAcls","blockPublicPolicy","ignorePublicAcls","restrictPublicBuckets","bucketPolicy","BucketPolicy","policy","Version","Statement","statements","Effect","Principal","AWS","iamArn","Action","Resource","graphqlLambdaRole"],"sources":["createAppBucket.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { type PulumiApp } from \"@webiny/pulumi\";\nimport { ApiOutput } from \"~/pulumi/apps/api/index.js\";\nimport { getEnvVariableAwsRegion } from \"~/pulumi/env/awsRegion.js\";\n\nexport function createPublicAppBucket(app: PulumiApp, name: string) {\n    const bucket = app.addResource(aws.s3.Bucket, {\n        name: name,\n        config: {\n            forceDestroy: true,\n            website: {\n                indexDocument: \"index.html\",\n                errorDocument: \"_NOT_FOUND_PAGE_/index.html\"\n            }\n        }\n    });\n\n    const bucketOwnershipControls = app.addResource(aws.s3.BucketOwnershipControls, {\n        name: `${name}-ownership-controls`,\n        config: {\n            bucket: bucket.output.id,\n            rule: {\n                objectOwnership: \"BucketOwnerPreferred\"\n            }\n        }\n    });\n\n    const bucketAcl = app.addResource(aws.s3.BucketAcl, {\n        name: `${name}-acl`,\n        config: {\n            bucket: bucket.output.id,\n            acl: aws.s3.CannedAcl.PublicRead\n        },\n        opts: {\n            dependsOn: [bucketOwnershipControls.output]\n        }\n    });\n\n    const origin: aws.types.input.cloudfront.DistributionOrigin = {\n        originId: bucket.output.arn,\n        domainName: bucket.output.websiteEndpoint,\n        customOriginConfig: {\n            originProtocolPolicy: \"http-only\",\n            httpPort: 80,\n            httpsPort: 443,\n            originSslProtocols: [\"TLSv1.2\"]\n        }\n    };\n\n    return {\n        bucket,\n        bucketAcl,\n        bucketOwnershipControls,\n        origin\n    };\n}\n\n// Forces S3 buckets to be available only through a cloudfront distribution.\n// Requires `ApiOutput` module to be loaded.\nexport function createPrivateAppBucket(app: PulumiApp, name: string) {\n    const api = app.getModule(ApiOutput);\n\n    const bucket = app.addResource(aws.s3.Bucket, {\n        name: name,\n        config: {\n            forceDestroy: true\n        }\n    });\n\n    const bucketOwnershipControls = app.addResource(aws.s3.BucketOwnershipControls, {\n        name: `${name}-ownership-controls`,\n        config: {\n            bucket: bucket.output.id,\n            rule: {\n                objectOwnership: \"BucketOwnerPreferred\"\n            }\n        }\n    });\n\n    const bucketAcl = app.addResource(aws.s3.BucketAcl, {\n        name: `${name}-acl`,\n        config: {\n            bucket: bucket.output.id,\n            acl: aws.s3.CannedAcl.Private\n        },\n        opts: {\n            dependsOn: [bucketOwnershipControls.output]\n        }\n    });\n\n    // Origin Identity is a kind of AWS user that represents Cloudfront distribution\n    // We can add IAM policies to it later, to allow accessing private S3 bucket\n    const originIdentity = app.addResource(aws.cloudfront.OriginAccessIdentity, {\n        name: `${name}-origin-identity`,\n        config: {}\n    });\n\n    const origin: aws.types.input.cloudfront.DistributionOrigin = {\n        originId: bucket.output.arn,\n        domainName: bucket.output.bucket.apply(\n            // We need to create a regional domain name. Otherwise, we'll run into the following issue:\n            // https://aws.amazon.com/premiumsupport/knowledge-center/s3-http-307-response/\n            name => `${name}.s3.${getEnvVariableAwsRegion()}.amazonaws.com`\n        ),\n        s3OriginConfig: {\n            originAccessIdentity: originIdentity.output.cloudfrontAccessIdentityPath\n        }\n    };\n\n    // block any public access\n    const bucketPublicAccessBlock = app.addResource(aws.s3.BucketPublicAccessBlock, {\n        name: `${name}-bucket-block-access`,\n        config: {\n            bucket: bucket.output.id,\n            blockPublicAcls: true,\n            blockPublicPolicy: true,\n            ignorePublicAcls: true,\n            restrictPublicBuckets: true\n        }\n    });\n\n    // Create an IAM policy to allow access to S3 bucket from cloudfront\n    const bucketPolicy = app.addResource(aws.s3.BucketPolicy, {\n        name: `${name}-bucket-policy`,\n        config: {\n            bucket: bucket.output.bucket,\n            policy: {\n                Version: \"2012-10-17\",\n                Statement: bucket.output.arn.apply(arn => {\n                    const statements: aws.iam.PolicyStatement[] = [\n                        {\n                            Effect: \"Allow\",\n                            Principal: { AWS: originIdentity.output.iamArn },\n                            // we need GetObject to retrieve objects from S3\n                            // and ListBucket allows to properly handle non-existing files (404)\n                            Action: [\"s3:ListBucket\", \"s3:GetObject\"],\n                            Resource: [`${arn}`, `${arn}/*`]\n                        },\n                        {\n                            Effect: \"Allow\",\n                            Principal: {\n                                AWS: api.graphqlLambdaRole\n                            },\n                            Action: [\n                                \"s3:GetObjectAcl\",\n                                \"s3:DeleteObject\",\n                                \"s3:PutObjectAcl\",\n                                \"s3:PutObject\",\n                                \"s3:GetObject\",\n                                \"s3:ListBucket\"\n                            ],\n                            Resource: [`${arn}`, `${arn}/*`]\n                        }\n                    ];\n\n                    return statements;\n                })\n            }\n        }\n    });\n\n    return {\n        bucket,\n        bucketOwnershipControls,\n        bucketAcl,\n        originIdentity,\n        origin,\n        bucketPublicAccessBlock,\n        bucketPolicy\n    };\n}\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAElC,SAASC,SAAS;AAClB,SAASC,uBAAuB;AAEhC,OAAO,SAASC,qBAAqBA,CAACC,GAAc,EAAEC,IAAY,EAAE;EAChE,MAAMC,MAAM,GAAGF,GAAG,CAACG,WAAW,CAACP,GAAG,CAACQ,EAAE,CAACC,MAAM,EAAE;IAC1CJ,IAAI,EAAEA,IAAI;IACVK,MAAM,EAAE;MACJC,YAAY,EAAE,IAAI;MAClBC,OAAO,EAAE;QACLC,aAAa,EAAE,YAAY;QAC3BC,aAAa,EAAE;MACnB;IACJ;EACJ,CAAC,CAAC;EAEF,MAAMC,uBAAuB,GAAGX,GAAG,CAACG,WAAW,CAACP,GAAG,CAACQ,EAAE,CAACQ,uBAAuB,EAAE;IAC5EX,IAAI,EAAE,GAAGA,IAAI,qBAAqB;IAClCK,MAAM,EAAE;MACJJ,MAAM,EAAEA,MAAM,CAACW,MAAM,CAACC,EAAE;MACxBC,IAAI,EAAE;QACFC,eAAe,EAAE;MACrB;IACJ;EACJ,CAAC,CAAC;EAEF,MAAMC,SAAS,GAAGjB,GAAG,CAACG,WAAW,CAACP,GAAG,CAACQ,EAAE,CAACc,SAAS,EAAE;IAChDjB,IAAI,EAAE,GAAGA,IAAI,MAAM;IACnBK,MAAM,EAAE;MACJJ,MAAM,EAAEA,MAAM,CAACW,MAAM,CAACC,EAAE;MACxBK,GAAG,EAAEvB,GAAG,CAACQ,EAAE,CAACgB,SAAS,CAACC;IAC1B,CAAC;IACDC,IAAI,EAAE;MACFC,SAAS,EAAE,CAACZ,uBAAuB,CAACE,MAAM;IAC9C;EACJ,CAAC,CAAC;EAEF,MAAMW,MAAqD,GAAG;IAC1DC,QAAQ,EAAEvB,MAAM,CAACW,MAAM,CAACa,GAAG;IAC3BC,UAAU,EAAEzB,MAAM,CAACW,MAAM,CAACe,eAAe;IACzCC,kBAAkB,EAAE;MAChBC,oBAAoB,EAAE,WAAW;MACjCC,QAAQ,EAAE,EAAE;MACZC,SAAS,EAAE,GAAG;MACdC,kBAAkB,EAAE,CAAC,SAAS;IAClC;EACJ,CAAC;EAED,OAAO;IACH/B,MAAM;IACNe,SAAS;IACTN,uBAAuB;IACvBa;EACJ,CAAC;AACL;;AAEA;AACA;AACA,OAAO,SAASU,sBAAsBA,CAAClC,GAAc,EAAEC,IAAY,EAAE;EACjE,MAAMkC,GAAG,GAAGnC,GAAG,CAACoC,SAAS,CAACvC,SAAS,CAAC;EAEpC,MAAMK,MAAM,GAAGF,GAAG,CAACG,WAAW,CAACP,GAAG,CAACQ,EAAE,CAACC,MAAM,EAAE;IAC1CJ,IAAI,EAAEA,IAAI;IACVK,MAAM,EAAE;MACJC,YAAY,EAAE;IAClB;EACJ,CAAC,CAAC;EAEF,MAAMI,uBAAuB,GAAGX,GAAG,CAACG,WAAW,CAACP,GAAG,CAACQ,EAAE,CAACQ,uBAAuB,EAAE;IAC5EX,IAAI,EAAE,GAAGA,IAAI,qBAAqB;IAClCK,MAAM,EAAE;MACJJ,MAAM,EAAEA,MAAM,CAACW,MAAM,CAACC,EAAE;MACxBC,IAAI,EAAE;QACFC,eAAe,EAAE;MACrB;IACJ;EACJ,CAAC,CAAC;EAEF,MAAMC,SAAS,GAAGjB,GAAG,CAACG,WAAW,CAACP,GAAG,CAACQ,EAAE,CAACc,SAAS,EAAE;IAChDjB,IAAI,EAAE,GAAGA,IAAI,MAAM;IACnBK,MAAM,EAAE;MACJJ,MAAM,EAAEA,MAAM,CAACW,MAAM,CAACC,EAAE;MACxBK,GAAG,EAAEvB,GAAG,CAACQ,EAAE,CAACgB,SAAS,CAACiB;IAC1B,CAAC;IACDf,IAAI,EAAE;MACFC,SAAS,EAAE,CAACZ,uBAAuB,CAACE,MAAM;IAC9C;EACJ,CAAC,CAAC;;EAEF;EACA;EACA,MAAMyB,cAAc,GAAGtC,GAAG,CAACG,WAAW,CAACP,GAAG,CAAC2C,UAAU,CAACC,oBAAoB,EAAE;IACxEvC,IAAI,EAAE,GAAGA,IAAI,kBAAkB;IAC/BK,MAAM,EAAE,CAAC;EACb,CAAC,CAAC;EAEF,MAAMkB,MAAqD,GAAG;IAC1DC,QAAQ,EAAEvB,MAAM,CAACW,MAAM,CAACa,GAAG;IAC3BC,UAAU,EAAEzB,MAAM,CAACW,MAAM,CAACX,MAAM,CAACuC,KAAK;IAClC;IACA;IACAxC,IAAI,IAAI,GAAGA,IAAI,OAAOH,uBAAuB,CAAC,CAAC,gBACnD,CAAC;IACD4C,cAAc,EAAE;MACZC,oBAAoB,EAAEL,cAAc,CAACzB,MAAM,CAAC+B;IAChD;EACJ,CAAC;;EAED;EACA,MAAMC,uBAAuB,GAAG7C,GAAG,CAACG,WAAW,CAACP,GAAG,CAACQ,EAAE,CAAC0C,uBAAuB,EAAE;IAC5E7C,IAAI,EAAE,GAAGA,IAAI,sBAAsB;IACnCK,MAAM,EAAE;MACJJ,MAAM,EAAEA,MAAM,CAACW,MAAM,CAACC,EAAE;MACxBiC,eAAe,EAAE,IAAI;MACrBC,iBAAiB,EAAE,IAAI;MACvBC,gBAAgB,EAAE,IAAI;MACtBC,qBAAqB,EAAE;IAC3B;EACJ,CAAC,CAAC;;EAEF;EACA,MAAMC,YAAY,GAAGnD,GAAG,CAACG,WAAW,CAACP,GAAG,CAACQ,EAAE,CAACgD,YAAY,EAAE;IACtDnD,IAAI,EAAE,GAAGA,IAAI,gBAAgB;IAC7BK,MAAM,EAAE;MACJJ,MAAM,EAAEA,MAAM,CAACW,MAAM,CAACX,MAAM;MAC5BmD,MAAM,EAAE;QACJC,OAAO,EAAE,YAAY;QACrBC,SAAS,EAAErD,MAAM,CAACW,MAAM,CAACa,GAAG,CAACe,KAAK,CAACf,GAAG,IAAI;UACtC,MAAM8B,UAAqC,GAAG,CAC1C;YACIC,MAAM,EAAE,OAAO;YACfC,SAAS,EAAE;cAAEC,GAAG,EAAErB,cAAc,CAACzB,MAAM,CAAC+C;YAAO,CAAC;YAChD;YACA;YACAC,MAAM,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC;YACzCC,QAAQ,EAAE,CAAC,GAAGpC,GAAG,EAAE,EAAE,GAAGA,GAAG,IAAI;UACnC,CAAC,EACD;YACI+B,MAAM,EAAE,OAAO;YACfC,SAAS,EAAE;cACPC,GAAG,EAAExB,GAAG,CAAC4B;YACb,CAAC;YACDF,MAAM,EAAE,CACJ,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,eAAe,CAClB;YACDC,QAAQ,EAAE,CAAC,GAAGpC,GAAG,EAAE,EAAE,GAAGA,GAAG,IAAI;UACnC,CAAC,CACJ;UAED,OAAO8B,UAAU;QACrB,CAAC;MACL;IACJ;EACJ,CAAC,CAAC;EAEF,OAAO;IACHtD,MAAM;IACNS,uBAAuB;IACvBM,SAAS;IACTqB,cAAc;IACdd,MAAM;IACNqB,uBAAuB;IACvBM;EACJ,CAAC;AACL","ignoreList":[]}

package/pulumi/apps/customDomain.d.ts

@@ -0,0 +1,9 @@
+import { type Input } from "@pulumi/pulumi";
+import type * as aws from "@pulumi/aws";
+import { type PulumiAppResource } from "@webiny/pulumi";
+export interface CustomDomainParams {
+    domains: Input<string[]>;
+    acmCertificateArn: Input<string>;
+    sslSupportMethod?: Input<string>;
+}
+export declare function applyCustomDomain(cloudfront: PulumiAppResource<typeof aws.cloudfront.Distribution>, params: CustomDomainParams): void;

package/pulumi/apps/customDomain.js

@@ -0,0 +1,9 @@
+export function applyCustomDomain(cloudfront, params) {
+  cloudfront.config.aliases(params.domains);
+  cloudfront.config.viewerCertificate({
+    acmCertificateArn: params.acmCertificateArn,
+    sslSupportMethod: params.sslSupportMethod ?? "sni-only"
+  });
+}
+
+//# sourceMappingURL=customDomain.js.map

package/pulumi/apps/customDomain.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["applyCustomDomain","cloudfront","params","config","aliases","domains","viewerCertificate","acmCertificateArn","sslSupportMethod"],"sources":["customDomain.ts"],"sourcesContent":["import { type Input } from \"@pulumi/pulumi\";\nimport type * as aws from \"@pulumi/aws\";\nimport { type PulumiAppResource } from \"@webiny/pulumi\";\n\nexport interface CustomDomainParams {\n    domains: Input<string[]>;\n    acmCertificateArn: Input<string>;\n    sslSupportMethod?: Input<string>;\n}\n\nexport function applyCustomDomain(\n    cloudfront: PulumiAppResource<typeof aws.cloudfront.Distribution>,\n    params: CustomDomainParams\n) {\n    cloudfront.config.aliases(params.domains);\n\n    cloudfront.config.viewerCertificate({\n        acmCertificateArn: params.acmCertificateArn,\n        sslSupportMethod: params.sslSupportMethod ?? \"sni-only\"\n    });\n}\n"],"mappings":"AAUA,OAAO,SAASA,iBAAiBA,CAC7BC,UAAiE,EACjEC,MAA0B,EAC5B;EACED,UAAU,CAACE,MAAM,CAACC,OAAO,CAACF,MAAM,CAACG,OAAO,CAAC;EAEzCJ,UAAU,CAACE,MAAM,CAACG,iBAAiB,CAAC;IAChCC,iBAAiB,EAAEL,MAAM,CAACK,iBAAiB;IAC3CC,gBAAgB,EAAEN,MAAM,CAACM,gBAAgB,IAAI;EACjD,CAAC,CAAC;AACN","ignoreList":[]}

package/pulumi/apps/extensions/getAwsTagsFromExtension.d.ts

@@ -0,0 +1,2 @@
+import { type IProjectConfigModel } from "@webiny/project/abstractions/models/index.js";
+export declare const getAwsTagsFromExtension: (projectConfig: IProjectConfigModel) => Record<string, string>;

package/pulumi/apps/extensions/getAwsTagsFromExtension.js

@@ -0,0 +1,10 @@
+import { AwsTags as awsTagsExt } from "../../extensions/AwsTags.js";
+export const getAwsTagsFromExtension = projectConfig => {
+  const awsTags = {};
+  projectConfig.extensionsByType(awsTagsExt).forEach(ext => {
+    Object.assign(awsTags, ext.params.tags);
+  });
+  return awsTags;
+};
+
+//# sourceMappingURL=getAwsTagsFromExtension.js.map

package/pulumi/apps/extensions/getAwsTagsFromExtension.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["AwsTags","awsTagsExt","getAwsTagsFromExtension","projectConfig","awsTags","extensionsByType","forEach","ext","Object","assign","params","tags"],"sources":["getAwsTagsFromExtension.ts"],"sourcesContent":["import { type IProjectConfigModel } from \"@webiny/project/abstractions/models/index.js\";\nimport { AwsTags as awsTagsExt } from \"~/pulumi/extensions/AwsTags.js\";\n\nexport const getAwsTagsFromExtension = (projectConfig: IProjectConfigModel) => {\n    const awsTags: Record<string, string> = {};\n    projectConfig.extensionsByType(awsTagsExt).forEach(ext => {\n        Object.assign(awsTags, ext.params.tags);\n    });\n\n    return awsTags;\n};\n"],"mappings":"AACA,SAASA,OAAO,IAAIC,UAAU;AAE9B,OAAO,MAAMC,uBAAuB,GAAIC,aAAkC,IAAK;EAC3E,MAAMC,OAA+B,GAAG,CAAC,CAAC;EAC1CD,aAAa,CAACE,gBAAgB,CAACJ,UAAU,CAAC,CAACK,OAAO,CAACC,GAAG,IAAI;IACtDC,MAAM,CAACC,MAAM,CAACL,OAAO,EAAEG,GAAG,CAACG,MAAM,CAACC,IAAI,CAAC;EAC3C,CAAC,CAAC;EAEF,OAAOP,OAAO;AAClB,CAAC","ignoreList":[]}

package/pulumi/apps/extensions/getBgDeploymentsConfigFromExtension.d.ts

@@ -0,0 +1,23 @@
+import { type IProjectConfigModel } from "@webiny/project/abstractions/models/index.js";
+export declare const getBgDeploymentsConfigFromExtension: (projectConfig: IProjectConfigModel) => false | {
+    enabled: boolean;
+    domains: {
+        domains: {
+            api: [string, ...string[]];
+            admin: [string, ...string[]];
+            website: [string, ...string[]];
+            preview: [string, ...string[]];
+        };
+        acmCertificateArn: string;
+        sslSupportMethod: "sni-only" | "vip";
+    };
+    deployments: [{
+        name: string;
+        env: string;
+        variant: string;
+    }, {
+        name: string;
+        env: string;
+        variant: string;
+    }];
+};

package/pulumi/apps/extensions/getBgDeploymentsConfigFromExtension.js

@@ -0,0 +1,10 @@
+import { BlueGreenDeployments as bgDeploymentsExt } from "../../extensions/BlueGreenDeployments.js";
+export const getBgDeploymentsConfigFromExtension = projectConfig => {
+  const [bgDeploymentsExtension] = projectConfig.extensionsByType(bgDeploymentsExt);
+  if (!bgDeploymentsExtension) {
+    return false;
+  }
+  return bgDeploymentsExtension.params;
+};
+
+//# sourceMappingURL=getBgDeploymentsConfigFromExtension.js.map

package/pulumi/apps/extensions/getBgDeploymentsConfigFromExtension.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["BlueGreenDeployments","bgDeploymentsExt","getBgDeploymentsConfigFromExtension","projectConfig","bgDeploymentsExtension","extensionsByType","params"],"sources":["getBgDeploymentsConfigFromExtension.ts"],"sourcesContent":["import { BlueGreenDeployments as bgDeploymentsExt } from \"~/pulumi/extensions/BlueGreenDeployments.js\";\nimport { type IProjectConfigModel } from \"@webiny/project/abstractions/models/index.js\";\n\nexport const getBgDeploymentsConfigFromExtension = (projectConfig: IProjectConfigModel) => {\n    const [bgDeploymentsExtension] = projectConfig.extensionsByType(bgDeploymentsExt);\n    if (!bgDeploymentsExtension) {\n        return false;\n    }\n\n    return bgDeploymentsExtension.params;\n};\n"],"mappings":"AAAA,SAASA,oBAAoB,IAAIC,gBAAgB;AAGjD,OAAO,MAAMC,mCAAmC,GAAIC,aAAkC,IAAK;EACvF,MAAM,CAACC,sBAAsB,CAAC,GAAGD,aAAa,CAACE,gBAAgB,CAACJ,gBAAgB,CAAC;EACjF,IAAI,CAACG,sBAAsB,EAAE;IACzB,OAAO,KAAK;EAChB;EAEA,OAAOA,sBAAsB,CAACE,MAAM;AACxC,CAAC","ignoreList":[]}

package/pulumi/apps/extensions/getOsConfigFromExtension.d.ts

@@ -0,0 +1,7 @@
+import { type IProjectConfigModel } from "@webiny/project/abstractions/models/index.js";
+export declare const getOsConfigFromExtension: (projectConfig: IProjectConfigModel) => boolean | Omit<{
+    enabled?: boolean | undefined;
+    domainName?: string | undefined;
+    indexPrefix?: string | undefined;
+    sharedIndexes?: boolean | undefined;
+}, "enabled"> | undefined;

package/pulumi/apps/extensions/getOsConfigFromExtension.js

@@ -0,0 +1,33 @@
+import { OpenSearch as openSearchExt } from "../../extensions/OpenSearch.js";
+export const getOsConfigFromExtension = projectConfig => {
+  const [openSearchExtension] = projectConfig.extensionsByType(openSearchExt);
+  if (!openSearchExtension) {
+    // OpenSearch not used.
+    return undefined;
+  }
+  const {
+    enabled,
+    domainName,
+    indexPrefix,
+    sharedIndexes
+  } = openSearchExtension.params;
+  if (enabled === false) {
+    return false;
+  }
+  if (domainName || indexPrefix || sharedIndexes) {
+    const openSearch = {};
+    if (domainName) {
+      openSearch.domainName = domainName;
+    }
+    if (indexPrefix) {
+      openSearch.indexPrefix = indexPrefix;
+    }
+    if (sharedIndexes) {
+      openSearch.sharedIndexes = sharedIndexes;
+    }
+    return openSearch;
+  }
+  return true;
+};
+
+//# sourceMappingURL=getOsConfigFromExtension.js.map

package/pulumi/apps/extensions/getOsConfigFromExtension.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["OpenSearch","openSearchExt","getOsConfigFromExtension","projectConfig","openSearchExtension","extensionsByType","undefined","enabled","domainName","indexPrefix","sharedIndexes","params","openSearch"],"sources":["getOsConfigFromExtension.ts"],"sourcesContent":["import { OpenSearch as openSearchExt } from \"~/pulumi/extensions/OpenSearch.js\";\nimport { type IProjectConfigModel } from \"@webiny/project/abstractions/models/index.js\";\n\nexport const getOsConfigFromExtension = (projectConfig: IProjectConfigModel) => {\n    const [openSearchExtension] = projectConfig.extensionsByType(openSearchExt);\n    if (!openSearchExtension) {\n        // OpenSearch not used.\n        return undefined;\n    }\n\n    const { enabled, domainName, indexPrefix, sharedIndexes } = openSearchExtension.params;\n    if (enabled === false) {\n        return false;\n    }\n\n    if (domainName || indexPrefix || sharedIndexes) {\n        const openSearch: Omit<typeof openSearchExtension.params, \"enabled\"> = {};\n        if (domainName) {\n            openSearch.domainName = domainName;\n        }\n\n        if (indexPrefix) {\n            openSearch.indexPrefix = indexPrefix;\n        }\n\n        if (sharedIndexes) {\n            openSearch.sharedIndexes = sharedIndexes;\n        }\n\n        return openSearch;\n    }\n\n    return true;\n};\n"],"mappings":"AAAA,SAASA,UAAU,IAAIC,aAAa;AAGpC,OAAO,MAAMC,wBAAwB,GAAIC,aAAkC,IAAK;EAC5E,MAAM,CAACC,mBAAmB,CAAC,GAAGD,aAAa,CAACE,gBAAgB,CAACJ,aAAa,CAAC;EAC3E,IAAI,CAACG,mBAAmB,EAAE;IACtB;IACA,OAAOE,SAAS;EACpB;EAEA,MAAM;IAAEC,OAAO;IAAEC,UAAU;IAAEC,WAAW;IAAEC;EAAc,CAAC,GAAGN,mBAAmB,CAACO,MAAM;EACtF,IAAIJ,OAAO,KAAK,KAAK,EAAE;IACnB,OAAO,KAAK;EAChB;EAEA,IAAIC,UAAU,IAAIC,WAAW,IAAIC,aAAa,EAAE;IAC5C,MAAME,UAA8D,GAAG,CAAC,CAAC;IACzE,IAAIJ,UAAU,EAAE;MACZI,UAAU,CAACJ,UAAU,GAAGA,UAAU;IACtC;IAEA,IAAIC,WAAW,EAAE;MACbG,UAAU,CAACH,WAAW,GAAGA,WAAW;IACxC;IAEA,IAAIC,aAAa,EAAE;MACfE,UAAU,CAACF,aAAa,GAAGA,aAAa;IAC5C;IAEA,OAAOE,UAAU;EACrB;EAEA,OAAO,IAAI;AACf,CAAC","ignoreList":[]}

package/pulumi/apps/extensions/getVpcConfigFromExtension.d.ts

@@ -0,0 +1,15 @@
+import { type IProjectConfigModel } from "@webiny/project/abstractions/models/index.js";
+export declare const getVpcConfigFromExtension: (projectConfig: IProjectConfigModel) => boolean | Omit<{
+    enabled: boolean;
+    useVpcEndpoints?: boolean | undefined;
+    useExistingVpc?: {
+        lambdaFunctionsVpcConfig: {
+            securityGroupIds: string[];
+            subnetIds: string[];
+        };
+        openSearchDomainVpcConfig?: {
+            securityGroupIds: string[];
+            subnetIds: string[];
+        } | undefined;
+    } | undefined;
+}, "enabled"> | undefined;

package/pulumi/apps/extensions/getVpcConfigFromExtension.js

@@ -0,0 +1,29 @@
+import { Vpc as vpcExt } from "../../extensions/Vpc.js";
+export const getVpcConfigFromExtension = projectConfig => {
+  const [vpcExtension] = projectConfig.extensionsByType(vpcExt);
+  if (!vpcExtension) {
+    // VPC automatically used with production environments.
+    return undefined;
+  }
+  const {
+    enabled,
+    useVpcEndpoints,
+    useExistingVpc
+  } = vpcExtension.params;
+  if (enabled === false) {
+    return false;
+  }
+  if (useVpcEndpoints || useExistingVpc) {
+    const vpc = {};
+    if (useVpcEndpoints) {
+      vpc.useVpcEndpoints = useVpcEndpoints;
+    }
+    if (useExistingVpc) {
+      vpc.useExistingVpc = useExistingVpc;
+    }
+    return vpc;
+  }
+  return true;
+};
+
+//# sourceMappingURL=getVpcConfigFromExtension.js.map

package/pulumi/apps/extensions/getVpcConfigFromExtension.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["Vpc","vpcExt","getVpcConfigFromExtension","projectConfig","vpcExtension","extensionsByType","undefined","enabled","useVpcEndpoints","useExistingVpc","params","vpc"],"sources":["getVpcConfigFromExtension.ts"],"sourcesContent":["import { Vpc as vpcExt } from \"~/pulumi/extensions/Vpc.js\";\nimport { type IProjectConfigModel } from \"@webiny/project/abstractions/models/index.js\";\n\nexport const getVpcConfigFromExtension = (projectConfig: IProjectConfigModel) => {\n    const [vpcExtension] = projectConfig.extensionsByType(vpcExt);\n    if (!vpcExtension) {\n        // VPC automatically used with production environments.\n        return undefined;\n    }\n\n    const { enabled, useVpcEndpoints, useExistingVpc } = vpcExtension.params;\n    if (enabled === false) {\n        return false;\n    }\n\n    if (useVpcEndpoints || useExistingVpc) {\n        const vpc: Omit<typeof vpcExtension.params, \"enabled\"> = {};\n\n        if (useVpcEndpoints) {\n            vpc.useVpcEndpoints = useVpcEndpoints;\n        }\n\n        if (useExistingVpc) {\n            vpc.useExistingVpc = useExistingVpc;\n        }\n\n        return vpc;\n    }\n\n    return true;\n};\n"],"mappings":"AAAA,SAASA,GAAG,IAAIC,MAAM;AAGtB,OAAO,MAAMC,yBAAyB,GAAIC,aAAkC,IAAK;EAC7E,MAAM,CAACC,YAAY,CAAC,GAAGD,aAAa,CAACE,gBAAgB,CAACJ,MAAM,CAAC;EAC7D,IAAI,CAACG,YAAY,EAAE;IACf;IACA,OAAOE,SAAS;EACpB;EAEA,MAAM;IAAEC,OAAO;IAAEC,eAAe;IAAEC;EAAe,CAAC,GAAGL,YAAY,CAACM,MAAM;EACxE,IAAIH,OAAO,KAAK,KAAK,EAAE;IACnB,OAAO,KAAK;EAChB;EAEA,IAAIC,eAAe,IAAIC,cAAc,EAAE;IACnC,MAAME,GAAgD,GAAG,CAAC,CAAC;IAE3D,IAAIH,eAAe,EAAE;MACjBG,GAAG,CAACH,eAAe,GAAGA,eAAe;IACzC;IAEA,IAAIC,cAAc,EAAE;MAChBE,GAAG,CAACF,cAAc,GAAGA,cAAc;IACvC;IAEA,OAAOE,GAAG;EACd;EAEA,OAAO,IAAI;AACf,CAAC","ignoreList":[]}

package/pulumi/apps/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./core/index.js";
+export * from "./common/index.js";
+export * from "./api/index.js";
+export * from "./react/index.js";
+export * from "./admin/index.js";
+export type { CustomDomainParams } from "./customDomain.js";

package/pulumi/apps/index.js

@@ -0,0 +1,8 @@
+export * from "./core/index.js";
+export * from "./common/index.js";
+export * from "./api/index.js";
+export * from "./react/index.js";
+export * from "./admin/index.js";
+export {};
+
+//# sourceMappingURL=index.js.map

package/pulumi/apps/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["index.ts"],"sourcesContent":["export * from \"./core/index.js\";\nexport * from \"./common/index.js\";\nexport * from \"./api/index.js\";\nexport * from \"./react/index.js\";\nexport * from \"./admin/index.js\";\nexport type { CustomDomainParams } from \"./customDomain.js\";\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AAAiC","ignoreList":[]}

package/pulumi/apps/lambdaUtils.d.ts

@@ -0,0 +1,11 @@
+import type * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import type { PulumiApp } from "@webiny/pulumi";
+export * from "../utils/lambdaEnvVariables.js";
+interface LambdaRoleParams {
+    name: string;
+    policy?: pulumi.Output<aws.iam.Policy>;
+    executionRole?: pulumi.Input<string>;
+}
+export declare function createLambdaRole(app: PulumiApp, params: LambdaRoleParams): import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role.js").Role>;
+export declare const createLambdaRoleWithoutVpc: (app: PulumiApp, params: LambdaRoleParams) => import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role.js").Role>;

package/pulumi/apps/lambdaUtils.js

@@ -0,0 +1,70 @@
+import * as aws from "@pulumi/aws";
+import { VpcConfig } from "./common/index.js";
+export * from "../utils/lambdaEnvVariables.js";
+const createLambdaRoleWithoutExecution = (app, params) => {
+  const role = app.addResource(aws.iam.Role, {
+    name: params.name,
+    config: {
+      assumeRolePolicy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Action: "sts:AssumeRole",
+          Principal: {
+            Service: "lambda.amazonaws.com"
+          },
+          Effect: "Allow"
+        }]
+      }
+    },
+    meta: {
+      isLambdaFunctionRole: true
+    }
+  });
+  if (params.policy) {
+    app.addResource(aws.iam.RolePolicyAttachment, {
+      name: `${params.name}-policy`,
+      config: {
+        role: role.output,
+        policyArn: params.policy.arn
+      }
+    });
+  }
+  if (params.executionRole) {
+    // If execution role is set, use it.
+    app.addResource(aws.iam.RolePolicyAttachment, {
+      name: `${params.name}-execution-role`,
+      config: {
+        role: role.output,
+        policyArn: params.executionRole
+      }
+    });
+  }
+  return role;
+};
+export function createLambdaRole(app, params) {
+  const role = createLambdaRoleWithoutExecution(app, params);
+
+  // Add default execution role.
+  const vpc = app.getModule(VpcConfig);
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `${params.name}-default-execution-role`,
+    config: {
+      role: role.output,
+      policyArn: vpc.enabled.apply(enabled => enabled ? aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole : aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole)
+    }
+  });
+  return role;
+}
+export const createLambdaRoleWithoutVpc = (app, params) => {
+  const role = createLambdaRoleWithoutExecution(app, params);
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `${params.name}-default-execution-role`,
+    config: {
+      role: role.output,
+      policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole
+    }
+  });
+  return role;
+};
+
+//# sourceMappingURL=lambdaUtils.js.map

package/pulumi/apps/lambdaUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","VpcConfig","createLambdaRoleWithoutExecution","app","params","role","addResource","iam","Role","name","config","assumeRolePolicy","Version","Statement","Action","Principal","Service","Effect","meta","isLambdaFunctionRole","policy","RolePolicyAttachment","output","policyArn","arn","executionRole","createLambdaRole","vpc","getModule","enabled","apply","ManagedPolicy","AWSLambdaVPCAccessExecutionRole","AWSLambdaBasicExecutionRole","createLambdaRoleWithoutVpc"],"sources":["lambdaUtils.ts"],"sourcesContent":["import type * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\nimport type { PulumiApp } from \"@webiny/pulumi\";\nimport { VpcConfig } from \"./common/index.js\";\n\nexport * from \"../utils/lambdaEnvVariables.js\";\n\ninterface LambdaRoleParams {\n    name: string;\n    policy?: pulumi.Output<aws.iam.Policy>;\n    executionRole?: pulumi.Input<string>;\n}\n\nconst createLambdaRoleWithoutExecution = (app: PulumiApp, params: LambdaRoleParams) => {\n    const role = app.addResource(aws.iam.Role, {\n        name: params.name,\n        config: {\n            assumeRolePolicy: {\n                Version: \"2012-10-17\",\n                Statement: [\n                    {\n                        Action: \"sts:AssumeRole\",\n                        Principal: {\n                            Service: \"lambda.amazonaws.com\"\n                        },\n                        Effect: \"Allow\"\n                    }\n                ]\n            }\n        },\n        meta: { isLambdaFunctionRole: true }\n    });\n\n    if (params.policy) {\n        app.addResource(aws.iam.RolePolicyAttachment, {\n            name: `${params.name}-policy`,\n            config: {\n                role: role.output,\n                policyArn: params.policy.arn\n            }\n        });\n    }\n\n    if (params.executionRole) {\n        // If execution role is set, use it.\n        app.addResource(aws.iam.RolePolicyAttachment, {\n            name: `${params.name}-execution-role`,\n            config: {\n                role: role.output,\n                policyArn: params.executionRole\n            }\n        });\n    }\n    return role;\n};\n\nexport function createLambdaRole(app: PulumiApp, params: LambdaRoleParams) {\n    const role = createLambdaRoleWithoutExecution(app, params);\n\n    // Add default execution role.\n    const vpc = app.getModule(VpcConfig);\n\n    app.addResource(aws.iam.RolePolicyAttachment, {\n        name: `${params.name}-default-execution-role`,\n        config: {\n            role: role.output,\n            policyArn: vpc.enabled.apply(enabled =>\n                enabled\n                    ? aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole\n                    : aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole\n            )\n        }\n    });\n\n    return role;\n}\n\nexport const createLambdaRoleWithoutVpc = (app: PulumiApp, params: LambdaRoleParams) => {\n    const role = createLambdaRoleWithoutExecution(app, params);\n\n    app.addResource(aws.iam.RolePolicyAttachment, {\n        name: `${params.name}-default-execution-role`,\n        config: {\n            role: role.output,\n            policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole\n        }\n    });\n\n    return role;\n};\n"],"mappings":"AACA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAElC,SAASC,SAAS;AAElB;AAQA,MAAMC,gCAAgC,GAAGA,CAACC,GAAc,EAAEC,MAAwB,KAAK;EACnF,MAAMC,IAAI,GAAGF,GAAG,CAACG,WAAW,CAACN,GAAG,CAACO,GAAG,CAACC,IAAI,EAAE;IACvCC,IAAI,EAAEL,MAAM,CAACK,IAAI;IACjBC,MAAM,EAAE;MACJC,gBAAgB,EAAE;QACdC,OAAO,EAAE,YAAY;QACrBC,SAAS,EAAE,CACP;UACIC,MAAM,EAAE,gBAAgB;UACxBC,SAAS,EAAE;YACPC,OAAO,EAAE;UACb,CAAC;UACDC,MAAM,EAAE;QACZ,CAAC;MAET;IACJ,CAAC;IACDC,IAAI,EAAE;MAAEC,oBAAoB,EAAE;IAAK;EACvC,CAAC,CAAC;EAEF,IAAIf,MAAM,CAACgB,MAAM,EAAE;IACfjB,GAAG,CAACG,WAAW,CAACN,GAAG,CAACO,GAAG,CAACc,oBAAoB,EAAE;MAC1CZ,IAAI,EAAE,GAAGL,MAAM,CAACK,IAAI,SAAS;MAC7BC,MAAM,EAAE;QACJL,IAAI,EAAEA,IAAI,CAACiB,MAAM;QACjBC,SAAS,EAAEnB,MAAM,CAACgB,MAAM,CAACI;MAC7B;IACJ,CAAC,CAAC;EACN;EAEA,IAAIpB,MAAM,CAACqB,aAAa,EAAE;IACtB;IACAtB,GAAG,CAACG,WAAW,CAACN,GAAG,CAACO,GAAG,CAACc,oBAAoB,EAAE;MAC1CZ,IAAI,EAAE,GAAGL,MAAM,CAACK,IAAI,iBAAiB;MACrCC,MAAM,EAAE;QACJL,IAAI,EAAEA,IAAI,CAACiB,MAAM;QACjBC,SAAS,EAAEnB,MAAM,CAACqB;MACtB;IACJ,CAAC,CAAC;EACN;EACA,OAAOpB,IAAI;AACf,CAAC;AAED,OAAO,SAASqB,gBAAgBA,CAACvB,GAAc,EAAEC,MAAwB,EAAE;EACvE,MAAMC,IAAI,GAAGH,gCAAgC,CAACC,GAAG,EAAEC,MAAM,CAAC;;EAE1D;EACA,MAAMuB,GAAG,GAAGxB,GAAG,CAACyB,SAAS,CAAC3B,SAAS,CAAC;EAEpCE,GAAG,CAACG,WAAW,CAACN,GAAG,CAACO,GAAG,CAACc,oBAAoB,EAAE;IAC1CZ,IAAI,EAAE,GAAGL,MAAM,CAACK,IAAI,yBAAyB;IAC7CC,MAAM,EAAE;MACJL,IAAI,EAAEA,IAAI,CAACiB,MAAM;MACjBC,SAAS,EAAEI,GAAG,CAACE,OAAO,CAACC,KAAK,CAACD,OAAO,IAChCA,OAAO,GACD7B,GAAG,CAACO,GAAG,CAACwB,aAAa,CAACC,+BAA+B,GACrDhC,GAAG,CAACO,GAAG,CAACwB,aAAa,CAACE,2BAChC;IACJ;EACJ,CAAC,CAAC;EAEF,OAAO5B,IAAI;AACf;AAEA,OAAO,MAAM6B,0BAA0B,GAAGA,CAAC/B,GAAc,EAAEC,MAAwB,KAAK;EACpF,MAAMC,IAAI,GAAGH,gCAAgC,CAACC,GAAG,EAAEC,MAAM,CAAC;EAE1DD,GAAG,CAACG,WAAW,CAACN,GAAG,CAACO,GAAG,CAACc,oBAAoB,EAAE;IAC1CZ,IAAI,EAAE,GAAGL,MAAM,CAACK,IAAI,yBAAyB;IAC7CC,MAAM,EAAE;MACJL,IAAI,EAAEA,IAAI,CAACiB,MAAM;MACjBC,SAAS,EAAEvB,GAAG,CAACO,GAAG,CAACwB,aAAa,CAACE;IACrC;EACJ,CAAC,CAAC;EAEF,OAAO5B,IAAI;AACf,CAAC","ignoreList":[]}

package/pulumi/apps/react/createReactPulumiApp.d.ts

@@ -0,0 +1,32 @@
+import * as aws from "@pulumi/aws";
+import { type PulumiAppParamCallback } from "@webiny/pulumi";
+import { type CustomDomainParams } from "../customDomain.js";
+import { type AppName } from "@webiny/project";
+export type ReactPulumiApp = ReturnType<typeof createReactPulumiApp>;
+export interface CreateReactPulumiAppParams {
+    /**
+     * A name of the app, e.g., "user-area"
+     */
+    name: AppName;
+    /**
+     * A folder where the app is located, e.g., "apps/user-area"
+     */
+    folder: string;
+    /** Custom domain configuration */
+    domains?: PulumiAppParamCallback<CustomDomainParams>;
+    /**
+     * Provides a way to adjust existing Pulumi code (cloud infrastructure resources)
+     * or add additional ones into the mix.
+     */
+    pulumi?: (app: ReactPulumiApp) => void | Promise<void>;
+}
+export declare const createReactPulumiApp: (projectAppParams: CreateReactPulumiAppParams) => import("@webiny/pulumi").PulumiApp<{
+    cloudfront: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/distribution.js").Distribution>;
+    bucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket.js").Bucket>;
+    bucketOwnershipControls: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketOwnershipControls.js").BucketOwnershipControls>;
+    bucketAcl: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketAcl.js").BucketAcl>;
+    originIdentity: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/originAccessIdentity.js").OriginAccessIdentity>;
+    origin: aws.types.input.cloudfront.DistributionOrigin;
+    bucketPublicAccessBlock: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPublicAccessBlock.js").BucketPublicAccessBlock>;
+    bucketPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPolicy.js").BucketPolicy>;
+}> & import("~/pulumi/utils/withServiceManifest.js").WithServiceManifest;