@webiny/project-aws 0.0.0-unstable.61c048f412

package/pulumi/apps/api/createApiPulumiApp.js

@@ -0,0 +1,282 @@
+import * as aws from "@pulumi/aws";
+import { createPulumiApp, isResourceOfType } from "@webiny/pulumi";
+import { ApiBackgroundTask, ApiCloudfront, ApiFileManager, ApiGateway, ApiGraphql, ApiMigration, ApiWebsocket, CoreOutput, VpcConfig } from "../index.js";
+import { addDomainsUrlsOutputs, withCommonLambdaEnvVariables, withServiceManifest } from "../../utils/index.js";
+import { getEnvVariableAwsRegion } from "../../env/awsRegion.js";
+// import { attachSyncSystem } from "../syncSystem/api/index.js";
+import { applyAwsResourceTags, getAwsAccountId } from "../awsUtils.js";
+import { ApiScheduler } from "./ApiScheduler.js";
+import { getProjectSdk } from "@webiny/project";
+import { getVpcConfigFromExtension } from "../extensions/getVpcConfigFromExtension.js";
+import { getOsConfigFromExtension } from "../extensions/getOsConfigFromExtension.js";
+import { License } from "@webiny/wcp";
+import { handleGuardDutyEvents } from "./handleGuardDutyEvents.js";
+import { ApiPulumi } from "@webiny/project/abstractions/index.js";
+export const createApiPulumiApp = () => {
+  const baseApp = createPulumiApp({
+    name: "api",
+    path: "apps/api",
+    program: async app => {
+      const sdk = await getProjectSdk();
+      const projectConfig = await sdk.getProjectConfig();
+      const pulumiResourceNamePrefix = await sdk.getPulumiResourceNamePrefix();
+      const vpcExtensionsConfig = getVpcConfigFromExtension(projectConfig);
+      const openSearchExtensionConfig = getOsConfigFromExtension(projectConfig);
+      let searchEngineParams = null;
+      if (openSearchExtensionConfig) {
+        searchEngineParams = openSearchExtensionConfig;
+      }
+      if (searchEngineParams) {
+        const params = searchEngineParams;
+        if (typeof params === "object") {
+          if (params.domainName) {
+            process.env.AWS_OS_DOMAIN_NAME = params.domainName;
+          }
+          if (params.indexPrefix) {
+            process.env.OPENSEARCH_INDEX_PREFIX = params.indexPrefix;
+          }
+          if (params.sharedIndexes) {
+            process.env.OPENSEARCH_SHARED_INDEXES = "true";
+          }
+        }
+      }
+      if (pulumiResourceNamePrefix) {
+        app.onResource(resource => {
+          if (!resource.name.startsWith(pulumiResourceNamePrefix)) {
+            resource.name = `${pulumiResourceNamePrefix}${resource.name}`;
+          }
+        });
+      }
+
+      // <-------------------- Enterprise start -------------------->
+      app.addHandler(async () => {
+        const license = await License.fromEnvironment();
+        const usingAdvancedVpcParams = vpcExtensionsConfig && typeof vpcExtensionsConfig !== "boolean";
+        if (license.canUseFileManagerThreatDetection()) {
+          handleGuardDutyEvents(app);
+        }
+
+        // Not using advanced VPC params? Then immediately exit.
+        if (usingAdvancedVpcParams) {
+          const {
+            onResource,
+            addResource
+          } = app;
+          const {
+            useExistingVpc
+          } = vpcExtensionsConfig;
+
+          // 1. We first deal with "existing VPC" setup.
+          if (useExistingVpc) {
+            if (!useExistingVpc.lambdaFunctionsVpcConfig) {
+              throw new Error("Cannot specify `useExistingVpc` parameter because the `lambdaFunctionsVpcConfig` parameter wasn't provided.");
+            }
+            onResource(resource => {
+              if (isResourceOfType(resource, aws.lambda.Function)) {
+                const canUseVpc = resource.meta.canUseVpc !== false;
+                if (canUseVpc) {
+                  resource.config.vpcConfig(useExistingVpc.lambdaFunctionsVpcConfig);
+                }
+              }
+              if (isResourceOfType(resource, aws.iam.Role)) {
+                if (resource.meta.isLambdaFunctionRole) {
+                  addResource(aws.iam.RolePolicyAttachment, {
+                    name: `${resource.name}-vpc-access-execution-role`,
+                    config: {
+                      role: resource.output.name,
+                      policyArn: aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole
+                    }
+                  });
+                }
+              }
+            });
+          }
+        }
+      });
+      // <-------------------- Enterprise end -------------------->
+
+      // Overrides must be applied via a handler, registered at the very start of the program.
+      // By doing this, we're ensuring user's adjustments are not applied to late.
+      const pulumiHandlers = sdk.getContainer().resolve(ApiPulumi);
+      app.addHandler(() => {
+        return pulumiHandlers.execute(app);
+      });
+      const isProduction = app.env.isProduction;
+
+      // Register core output as a module available to all the other modules
+      const core = app.addModule(CoreOutput);
+
+      // Register VPC config module to be available to other modules.
+      const vpcEnabled = vpcExtensionsConfig === true || typeof vpcExtensionsConfig === "object" || isProduction;
+      app.addModule(VpcConfig, {
+        enabled: vpcEnabled
+      });
+      const graphql = app.addModule(ApiGraphql, {
+        env: {
+          COGNITO_REGION: getEnvVariableAwsRegion(),
+          COGNITO_USER_POOL_ID: core.cognitoUserPoolId,
+          DB_TABLE: core.primaryDynamodbTableName,
+          DB_TABLE_LOG: core.logDynamodbTableName,
+          DB_TABLE_AUDIT_LOGS: core.auditLogsDynamodbTableName,
+          DB_TABLE_OPENSEARCH: core.opensearchDynamodbTableName,
+          OPENSEARCH_ENDPOINT: core.opensearchDomainEndpoint,
+          // Not required. Useful for testing purposes / ephemeral environments.
+          // https://www.webiny.com/docs/key-topics/ci-cd/testing/slow-ephemeral-environments
+          OPENSEARCH_INDEX_PREFIX: process.env.OPENSEARCH_INDEX_PREFIX,
+          OPENSEARCH_SHARED_INDEXES: process.env.OPENSEARCH_SHARED_INDEXES,
+          S3_BUCKET: core.fileManagerBucketId,
+          EVENT_BUS: core.eventBusArn,
+          // TODO: move to okta plugin
+          OKTA_ISSUER: process.env["OKTA_ISSUER"]
+        }
+      });
+      const websocket = app.addModule(ApiWebsocket);
+      const fileManager = app.addModule(ApiFileManager, {
+        env: {
+          DB_TABLE: core.primaryDynamodbTableName,
+          DB_TABLE_LOG: core.logDynamodbTableName,
+          DB_TABLE_AUDIT_LOGS: core.auditLogsDynamodbTableName
+        }
+      });
+      const apiGateway = app.addModule(ApiGateway, {
+        "graphql-post": {
+          path: "/graphql",
+          method: "POST",
+          function: graphql.functions.graphql.output.arn
+        },
+        "graphql-options": {
+          path: "/graphql",
+          method: "OPTIONS",
+          function: graphql.functions.graphql.output.arn
+        },
+        "files-any": {
+          path: "/files/{path+}",
+          method: "ANY",
+          function: fileManager.functions.download.output.arn
+        },
+        "private-any": {
+          path: "/private/{path+}",
+          method: "ANY",
+          function: fileManager.functions.download.output.arn
+        },
+        "cms-post": {
+          path: "/cms/{key+}",
+          method: "POST",
+          function: graphql.functions.graphql.output.arn
+        },
+        "cms-options": {
+          path: "/cms/{key+}",
+          method: "OPTIONS",
+          function: graphql.functions.graphql.output.arn
+        },
+        "redirects-get": {
+          path: "/wb/redirects",
+          method: "GET",
+          function: graphql.functions.graphql.output.arn
+        },
+        "redirects-options": {
+          path: "/wb/redirects",
+          method: "OPTIONS",
+          function: graphql.functions.graphql.output.arn
+        },
+        "files-catch-all": {
+          path: "/{path+}",
+          method: "ANY",
+          function: fileManager.functions.download.output.arn
+        }
+      });
+      const cloudfront = app.addModule(ApiCloudfront);
+      const backgroundTask = app.addModule(ApiBackgroundTask);
+      const migration = app.addModule(ApiMigration);
+      const scheduler = app.addModule(ApiScheduler);
+
+      // const domains = app.getParam(projectAppParams.domains);
+      // if (domains) {
+      //     applyCustomDomain(cloudfront, domains);
+      // }
+
+      app.addOutputs({
+        awsAccountId: getAwsAccountId(app),
+        region: aws.config.region,
+        cognitoUserPoolId: core.cognitoUserPoolId,
+        cognitoAppClientId: core.cognitoAppClientId,
+        cognitoUserPoolPasswordPolicy: core.cognitoUserPoolPasswordPolicy,
+        dynamoDbTable: core.primaryDynamodbTableName,
+        auditLogsDynamoDbTable: core.auditLogsDynamodbTableName,
+        migrationLambdaArn: migration.function.output.arn,
+        graphqlLambdaName: graphql.functions.graphql.output.name,
+        graphqlLambdaRole: graphql.role.output.arn,
+        graphqlLambdaRoleName: graphql.role.output.name,
+        backgroundTaskLambdaArn: backgroundTask.backgroundTask.output.arn,
+        backgroundTaskStepFunctionArn: backgroundTask.stepFunction.output.arn,
+        fileManagerDownloadLambdaArn: fileManager.functions.download.output.arn,
+        websocketApiId: websocket.websocketApi.output.id,
+        websocketApiUrl: websocket.websocketApiUrl,
+        schedulerLambdaInvokeRole: scheduler.invokeRole.output.arn
+      });
+
+      // Only add `dynamoDbOpensearchTable` output if using search engine (ES/OS).
+      if (searchEngineParams) {
+        app.addOutputs({
+          dynamoDbOpensearchTable: core.opensearchDynamodbTableName
+        });
+      }
+      app.addHandler(() => {
+        addDomainsUrlsOutputs({
+          app,
+          cloudfrontDistribution: cloudfront,
+          map: {
+            distributionDomain: "cloudfrontApiDomain",
+            distributionUrl: "cloudfrontApiUrl",
+            usedDomain: "apiDomain",
+            usedUrl: "apiUrl"
+          }
+        });
+      });
+      // /**
+      //  * We need to attach the Sync System if it exists.
+      //  */
+      // await attachSyncSystem({
+      //     app,
+      //     core,
+      //     env: app.params.run.env
+      // });
+
+      // Applies internal and user-defined AWS tags.
+      await applyAwsResourceTags("api");
+      return {
+        fileManager,
+        graphql,
+        apiGateway,
+        websocket,
+        cloudfront,
+        migration,
+        backgroundTask,
+        scheduler
+      };
+    }
+  });
+  const app = withServiceManifest(withCommonLambdaEnvVariables(baseApp));
+  app.addHandler(() => {
+    app.addServiceManifest({
+      name: "api",
+      manifest: {
+        bgTaskSfn: baseApp.resources.backgroundTask.stepFunction.output.arn,
+        cloudfront: {
+          distributionId: baseApp.resources.cloudfront.output.id,
+          domain: baseApp.resources.cloudfront.output.domainName.apply(v => `https://${v}`)
+        }
+      }
+    });
+    app.addServiceManifest({
+      name: "scheduler",
+      manifest: {
+        lambdaArn: baseApp.resources.graphql.functions.graphql.output.arn,
+        roleArn: baseApp.resources.scheduler.invokeRole.output.arn
+      }
+    });
+  });
+  return app;
+};
+
+//# sourceMappingURL=createApiPulumiApp.js.map

package/pulumi/apps/api/createApiPulumiApp.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createPulumiApp","isResourceOfType","ApiBackgroundTask","ApiCloudfront","ApiFileManager","ApiGateway","ApiGraphql","ApiMigration","ApiWebsocket","CoreOutput","VpcConfig","addDomainsUrlsOutputs","withCommonLambdaEnvVariables","withServiceManifest","getEnvVariableAwsRegion","applyAwsResourceTags","getAwsAccountId","ApiScheduler","getProjectSdk","getVpcConfigFromExtension","getOsConfigFromExtension","License","handleGuardDutyEvents","ApiPulumi","createApiPulumiApp","baseApp","name","path","program","app","sdk","projectConfig","getProjectConfig","pulumiResourceNamePrefix","getPulumiResourceNamePrefix","vpcExtensionsConfig","openSearchExtensionConfig","searchEngineParams","params","domainName","process","env","AWS_OS_DOMAIN_NAME","indexPrefix","OPENSEARCH_INDEX_PREFIX","sharedIndexes","OPENSEARCH_SHARED_INDEXES","onResource","resource","startsWith","addHandler","license","fromEnvironment","usingAdvancedVpcParams","canUseFileManagerThreatDetection","addResource","useExistingVpc","lambdaFunctionsVpcConfig","Error","lambda","Function","canUseVpc","meta","config","vpcConfig","iam","Role","isLambdaFunctionRole","RolePolicyAttachment","role","output","policyArn","ManagedPolicy","AWSLambdaVPCAccessExecutionRole","pulumiHandlers","getContainer","resolve","execute","isProduction","core","addModule","vpcEnabled","enabled","graphql","COGNITO_REGION","COGNITO_USER_POOL_ID","cognitoUserPoolId","DB_TABLE","primaryDynamodbTableName","DB_TABLE_LOG","logDynamodbTableName","DB_TABLE_AUDIT_LOGS","auditLogsDynamodbTableName","DB_TABLE_OPENSEARCH","opensearchDynamodbTableName","OPENSEARCH_ENDPOINT","opensearchDomainEndpoint","S3_BUCKET","fileManagerBucketId","EVENT_BUS","eventBusArn","OKTA_ISSUER","websocket","fileManager","apiGateway","method","function","functions","arn","download","cloudfront","backgroundTask","migration","scheduler","addOutputs","awsAccountId","region","cognitoAppClientId","cognitoUserPoolPasswordPolicy","dynamoDbTable","auditLogsDynamoDbTable","migrationLambdaArn","graphqlLambdaName","graphqlLambdaRole","graphqlLambdaRoleName","backgroundTaskLambdaArn","backgroundTaskStepFunctionArn","stepFunction","fileManagerDownloadLambdaArn","websocketApiId","websocketApi","id","websocketApiUrl","schedulerLambdaInvokeRole","invokeRole","dynamoDbOpensearchTable","cloudfrontDistribution","map","distributionDomain","distributionUrl","usedDomain","usedUrl","addServiceManifest","manifest","bgTaskSfn","resources","distributionId","domain","apply","v","lambdaArn","roleArn"],"sources":["createApiPulumiApp.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { createPulumiApp, isResourceOfType, type PulumiApp } from \"@webiny/pulumi\";\nimport {\n    ApiBackgroundTask,\n    ApiCloudfront,\n    ApiFileManager,\n    ApiGateway,\n    ApiGraphql,\n    ApiMigration,\n    ApiWebsocket,\n    CoreOutput,\n    VpcConfig\n} from \"~/pulumi/apps/index.js\";\nimport {\n    addDomainsUrlsOutputs,\n    withCommonLambdaEnvVariables,\n    withServiceManifest\n} from \"~/pulumi/utils/index.js\";\nimport { getEnvVariableAwsRegion } from \"~/pulumi/env/awsRegion.js\";\n// import { attachSyncSystem } from \"../syncSystem/api/index.js\";\nimport { applyAwsResourceTags, getAwsAccountId } from \"~/pulumi/apps/awsUtils.js\";\nimport type { WithServiceManifest } from \"~/pulumi/utils/withServiceManifest.js\";\nimport { ApiScheduler } from \"~/pulumi/apps/api/ApiScheduler.js\";\nimport { getProjectSdk } from \"@webiny/project\";\nimport { getVpcConfigFromExtension } from \"~/pulumi/apps/extensions/getVpcConfigFromExtension.js\";\nimport { getOsConfigFromExtension } from \"~/pulumi/apps/extensions/getOsConfigFromExtension.js\";\nimport { License } from \"@webiny/wcp\";\nimport { handleGuardDutyEvents } from \"./handleGuardDutyEvents.js\";\nimport { ApiPulumi } from \"@webiny/project/abstractions/index.js\";\n\nexport type ApiPulumiApp = ReturnType<typeof createApiPulumiApp>;\n\nexport const createApiPulumiApp = () => {\n    const baseApp = createPulumiApp({\n        name: \"api\",\n        path: \"apps/api\",\n        program: async (app: PulumiApp & WithServiceManifest) => {\n            const sdk = await getProjectSdk();\n            const projectConfig = await sdk.getProjectConfig();\n\n            const pulumiResourceNamePrefix = await sdk.getPulumiResourceNamePrefix();\n            const vpcExtensionsConfig = getVpcConfigFromExtension(projectConfig);\n            const openSearchExtensionConfig = getOsConfigFromExtension(projectConfig);\n\n            let searchEngineParams: typeof openSearchExtensionConfig | null = null;\n\n            if (openSearchExtensionConfig) {\n                searchEngineParams = openSearchExtensionConfig;\n            }\n\n            if (searchEngineParams) {\n                const params = searchEngineParams;\n                if (typeof params === \"object\") {\n                    if (params.domainName) {\n                        process.env.AWS_OS_DOMAIN_NAME = params.domainName;\n                    }\n\n                    if (params.indexPrefix) {\n                        process.env.OPENSEARCH_INDEX_PREFIX = params.indexPrefix;\n                    }\n\n                    if (params.sharedIndexes) {\n                        process.env.OPENSEARCH_SHARED_INDEXES = \"true\";\n                    }\n                }\n            }\n\n            if (pulumiResourceNamePrefix) {\n                app.onResource(resource => {\n                    if (!resource.name.startsWith(pulumiResourceNamePrefix)) {\n                        resource.name = `${pulumiResourceNamePrefix}${resource.name}`;\n                    }\n                });\n            }\n\n            // <-------------------- Enterprise start -------------------->\n            app.addHandler(async () => {\n                const license = await License.fromEnvironment();\n\n                const usingAdvancedVpcParams =\n                    vpcExtensionsConfig && typeof vpcExtensionsConfig !== \"boolean\";\n\n                if (license.canUseFileManagerThreatDetection()) {\n                    handleGuardDutyEvents(app as ApiPulumiApp);\n                }\n\n                // Not using advanced VPC params? Then immediately exit.\n                if (usingAdvancedVpcParams) {\n                    const { onResource, addResource } = app;\n                    const { useExistingVpc } = vpcExtensionsConfig;\n\n                    // 1. We first deal with \"existing VPC\" setup.\n                    if (useExistingVpc) {\n                        if (!useExistingVpc.lambdaFunctionsVpcConfig) {\n                            throw new Error(\n                                \"Cannot specify `useExistingVpc` parameter because the `lambdaFunctionsVpcConfig` parameter wasn't provided.\"\n                            );\n                        }\n\n                        onResource(resource => {\n                            if (isResourceOfType(resource, aws.lambda.Function)) {\n                                const canUseVpc = resource.meta.canUseVpc !== false;\n                                if (canUseVpc) {\n                                    resource.config.vpcConfig(\n                                        useExistingVpc!.lambdaFunctionsVpcConfig\n                                    );\n                                }\n                            }\n\n                            if (isResourceOfType(resource, aws.iam.Role)) {\n                                if (resource.meta.isLambdaFunctionRole) {\n                                    addResource(aws.iam.RolePolicyAttachment, {\n                                        name: `${resource.name}-vpc-access-execution-role`,\n                                        config: {\n                                            role: resource.output.name,\n                                            policyArn:\n                                                aws.iam.ManagedPolicy\n                                                    .AWSLambdaVPCAccessExecutionRole\n                                        }\n                                    });\n                                }\n                            }\n                        });\n                    }\n                }\n            });\n            // <-------------------- Enterprise end -------------------->\n\n            // Overrides must be applied via a handler, registered at the very start of the program.\n            // By doing this, we're ensuring user's adjustments are not applied to late.\n            const pulumiHandlers = sdk.getContainer().resolve(ApiPulumi);\n\n            app.addHandler(() => {\n                return pulumiHandlers.execute(app as unknown as ApiPulumiApp);\n            });\n\n            const isProduction = app.env.isProduction;\n\n            // Register core output as a module available to all the other modules\n            const core = app.addModule(CoreOutput);\n\n            // Register VPC config module to be available to other modules.\n            const vpcEnabled =\n                vpcExtensionsConfig === true ||\n                typeof vpcExtensionsConfig === \"object\" ||\n                isProduction;\n\n            app.addModule(VpcConfig, { enabled: vpcEnabled });\n\n            const graphql = app.addModule(ApiGraphql, {\n                env: {\n                    COGNITO_REGION: getEnvVariableAwsRegion(),\n                    COGNITO_USER_POOL_ID: core.cognitoUserPoolId,\n                    DB_TABLE: core.primaryDynamodbTableName,\n                    DB_TABLE_LOG: core.logDynamodbTableName,\n                    DB_TABLE_AUDIT_LOGS: core.auditLogsDynamodbTableName,\n                    DB_TABLE_OPENSEARCH: core.opensearchDynamodbTableName,\n                    OPENSEARCH_ENDPOINT: core.opensearchDomainEndpoint,\n\n                    // Not required. Useful for testing purposes / ephemeral environments.\n                    // https://www.webiny.com/docs/key-topics/ci-cd/testing/slow-ephemeral-environments\n                    OPENSEARCH_INDEX_PREFIX: process.env.OPENSEARCH_INDEX_PREFIX,\n                    OPENSEARCH_SHARED_INDEXES: process.env.OPENSEARCH_SHARED_INDEXES,\n\n                    S3_BUCKET: core.fileManagerBucketId,\n                    EVENT_BUS: core.eventBusArn,\n                    // TODO: move to okta plugin\n                    OKTA_ISSUER: process.env[\"OKTA_ISSUER\"]\n                }\n            });\n\n            const websocket = app.addModule(ApiWebsocket);\n\n            const fileManager = app.addModule(ApiFileManager, {\n                env: {\n                    DB_TABLE: core.primaryDynamodbTableName,\n                    DB_TABLE_LOG: core.logDynamodbTableName,\n                    DB_TABLE_AUDIT_LOGS: core.auditLogsDynamodbTableName\n                }\n            });\n\n            const apiGateway = app.addModule(ApiGateway, {\n                \"graphql-post\": {\n                    path: \"/graphql\",\n                    method: \"POST\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"graphql-options\": {\n                    path: \"/graphql\",\n                    method: \"OPTIONS\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"files-any\": {\n                    path: \"/files/{path+}\",\n                    method: \"ANY\",\n                    function: fileManager.functions.download.output.arn\n                },\n                \"private-any\": {\n                    path: \"/private/{path+}\",\n                    method: \"ANY\",\n                    function: fileManager.functions.download.output.arn\n                },\n                \"cms-post\": {\n                    path: \"/cms/{key+}\",\n                    method: \"POST\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"cms-options\": {\n                    path: \"/cms/{key+}\",\n                    method: \"OPTIONS\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"redirects-get\": {\n                    path: \"/wb/redirects\",\n                    method: \"GET\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"redirects-options\": {\n                    path: \"/wb/redirects\",\n                    method: \"OPTIONS\",\n                    function: graphql.functions.graphql.output.arn\n                },\n                \"files-catch-all\": {\n                    path: \"/{path+}\",\n                    method: \"ANY\",\n                    function: fileManager.functions.download.output.arn\n                }\n            });\n\n            const cloudfront = app.addModule(ApiCloudfront);\n            const backgroundTask = app.addModule(ApiBackgroundTask);\n            const migration = app.addModule(ApiMigration);\n            const scheduler = app.addModule(ApiScheduler);\n\n            // const domains = app.getParam(projectAppParams.domains);\n            // if (domains) {\n            //     applyCustomDomain(cloudfront, domains);\n            // }\n\n            app.addOutputs({\n                awsAccountId: getAwsAccountId(app),\n                region: aws.config.region,\n                cognitoUserPoolId: core.cognitoUserPoolId,\n                cognitoAppClientId: core.cognitoAppClientId,\n                cognitoUserPoolPasswordPolicy: core.cognitoUserPoolPasswordPolicy,\n                dynamoDbTable: core.primaryDynamodbTableName,\n                auditLogsDynamoDbTable: core.auditLogsDynamodbTableName,\n                migrationLambdaArn: migration.function.output.arn,\n                graphqlLambdaName: graphql.functions.graphql.output.name,\n                graphqlLambdaRole: graphql.role.output.arn,\n                graphqlLambdaRoleName: graphql.role.output.name,\n                backgroundTaskLambdaArn: backgroundTask.backgroundTask.output.arn,\n                backgroundTaskStepFunctionArn: backgroundTask.stepFunction.output.arn,\n                fileManagerDownloadLambdaArn: fileManager.functions.download.output.arn,\n                websocketApiId: websocket.websocketApi.output.id,\n                websocketApiUrl: websocket.websocketApiUrl,\n                schedulerLambdaInvokeRole: scheduler.invokeRole.output.arn\n            });\n\n            // Only add `dynamoDbOpensearchTable` output if using search engine (ES/OS).\n            if (searchEngineParams) {\n                app.addOutputs({\n                    dynamoDbOpensearchTable: core.opensearchDynamodbTableName\n                });\n            }\n\n            app.addHandler(() => {\n                addDomainsUrlsOutputs({\n                    app,\n                    cloudfrontDistribution: cloudfront,\n                    map: {\n                        distributionDomain: \"cloudfrontApiDomain\",\n                        distributionUrl: \"cloudfrontApiUrl\",\n                        usedDomain: \"apiDomain\",\n                        usedUrl: \"apiUrl\"\n                    }\n                });\n            });\n            // /**\n            //  * We need to attach the Sync System if it exists.\n            //  */\n            // await attachSyncSystem({\n            //     app,\n            //     core,\n            //     env: app.params.run.env\n            // });\n\n            // Applies internal and user-defined AWS tags.\n            await applyAwsResourceTags(\"api\");\n\n            return {\n                fileManager,\n                graphql,\n                apiGateway,\n                websocket,\n                cloudfront,\n                migration,\n                backgroundTask,\n                scheduler\n            };\n        }\n    });\n\n    const app = withServiceManifest(withCommonLambdaEnvVariables(baseApp));\n\n    app.addHandler(() => {\n        app.addServiceManifest({\n            name: \"api\",\n            manifest: {\n                bgTaskSfn: baseApp.resources.backgroundTask.stepFunction.output.arn,\n                cloudfront: {\n                    distributionId: baseApp.resources.cloudfront.output.id,\n                    domain: baseApp.resources.cloudfront.output.domainName.apply(\n                        v => `https://${v}`\n                    )\n                }\n            }\n        });\n\n        app.addServiceManifest({\n            name: \"scheduler\",\n            manifest: {\n                lambdaArn: baseApp.resources.graphql.functions.graphql.output.arn,\n                roleArn: baseApp.resources.scheduler.invokeRole.output.arn\n            }\n        });\n    });\n\n    return app;\n};\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAClC,SAASC,eAAe,EAAEC,gBAAgB,QAAwB,gBAAgB;AAClF,SACIC,iBAAiB,EACjBC,aAAa,EACbC,cAAc,EACdC,UAAU,EACVC,UAAU,EACVC,YAAY,EACZC,YAAY,EACZC,UAAU,EACVC,SAAS;AAEb,SACIC,qBAAqB,EACrBC,4BAA4B,EAC5BC,mBAAmB;AAEvB,SAASC,uBAAuB;AAChC;AACA,SAASC,oBAAoB,EAAEC,eAAe;AAE9C,SAASC,YAAY;AACrB,SAASC,aAAa,QAAQ,iBAAiB;AAC/C,SAASC,yBAAyB;AAClC,SAASC,wBAAwB;AACjC,SAASC,OAAO,QAAQ,aAAa;AACrC,SAASC,qBAAqB;AAC9B,SAASC,SAAS,QAAQ,uCAAuC;AAIjE,OAAO,MAAMC,kBAAkB,GAAGA,CAAA,KAAM;EACpC,MAAMC,OAAO,GAAGzB,eAAe,CAAC;IAC5B0B,IAAI,EAAE,KAAK;IACXC,IAAI,EAAE,UAAU;IAChBC,OAAO,EAAE,MAAOC,GAAoC,IAAK;MACrD,MAAMC,GAAG,GAAG,MAAMZ,aAAa,CAAC,CAAC;MACjC,MAAMa,aAAa,GAAG,MAAMD,GAAG,CAACE,gBAAgB,CAAC,CAAC;MAElD,MAAMC,wBAAwB,GAAG,MAAMH,GAAG,CAACI,2BAA2B,CAAC,CAAC;MACxE,MAAMC,mBAAmB,GAAGhB,yBAAyB,CAACY,aAAa,CAAC;MACpE,MAAMK,yBAAyB,GAAGhB,wBAAwB,CAACW,aAAa,CAAC;MAEzE,IAAIM,kBAA2D,GAAG,IAAI;MAEtE,IAAID,yBAAyB,EAAE;QAC3BC,kBAAkB,GAAGD,yBAAyB;MAClD;MAEA,IAAIC,kBAAkB,EAAE;QACpB,MAAMC,MAAM,GAAGD,kBAAkB;QACjC,IAAI,OAAOC,MAAM,KAAK,QAAQ,EAAE;UAC5B,IAAIA,MAAM,CAACC,UAAU,EAAE;YACnBC,OAAO,CAACC,GAAG,CAACC,kBAAkB,GAAGJ,MAAM,CAACC,UAAU;UACtD;UAEA,IAAID,MAAM,CAACK,WAAW,EAAE;YACpBH,OAAO,CAACC,GAAG,CAACG,uBAAuB,GAAGN,MAAM,CAACK,WAAW;UAC5D;UAEA,IAAIL,MAAM,CAACO,aAAa,EAAE;YACtBL,OAAO,CAACC,GAAG,CAACK,yBAAyB,GAAG,MAAM;UAClD;QACJ;MACJ;MAEA,IAAIb,wBAAwB,EAAE;QAC1BJ,GAAG,CAACkB,UAAU,CAACC,QAAQ,IAAI;UACvB,IAAI,CAACA,QAAQ,CAACtB,IAAI,CAACuB,UAAU,CAAChB,wBAAwB,CAAC,EAAE;YACrDe,QAAQ,CAACtB,IAAI,GAAG,GAAGO,wBAAwB,GAAGe,QAAQ,CAACtB,IAAI,EAAE;UACjE;QACJ,CAAC,CAAC;MACN;;MAEA;MACAG,GAAG,CAACqB,UAAU,CAAC,YAAY;QACvB,MAAMC,OAAO,GAAG,MAAM9B,OAAO,CAAC+B,eAAe,CAAC,CAAC;QAE/C,MAAMC,sBAAsB,GACxBlB,mBAAmB,IAAI,OAAOA,mBAAmB,KAAK,SAAS;QAEnE,IAAIgB,OAAO,CAACG,gCAAgC,CAAC,CAAC,EAAE;UAC5ChC,qBAAqB,CAACO,GAAmB,CAAC;QAC9C;;QAEA;QACA,IAAIwB,sBAAsB,EAAE;UACxB,MAAM;YAAEN,UAAU;YAAEQ;UAAY,CAAC,GAAG1B,GAAG;UACvC,MAAM;YAAE2B;UAAe,CAAC,GAAGrB,mBAAmB;;UAE9C;UACA,IAAIqB,cAAc,EAAE;YAChB,IAAI,CAACA,cAAc,CAACC,wBAAwB,EAAE;cAC1C,MAAM,IAAIC,KAAK,CACX,6GACJ,CAAC;YACL;YAEAX,UAAU,CAACC,QAAQ,IAAI;cACnB,IAAI/C,gBAAgB,CAAC+C,QAAQ,EAAEjD,GAAG,CAAC4D,MAAM,CAACC,QAAQ,CAAC,EAAE;gBACjD,MAAMC,SAAS,GAAGb,QAAQ,CAACc,IAAI,CAACD,SAAS,KAAK,KAAK;gBACnD,IAAIA,SAAS,EAAE;kBACXb,QAAQ,CAACe,MAAM,CAACC,SAAS,CACrBR,cAAc,CAAEC,wBACpB,CAAC;gBACL;cACJ;cAEA,IAAIxD,gBAAgB,CAAC+C,QAAQ,EAAEjD,GAAG,CAACkE,GAAG,CAACC,IAAI,CAAC,EAAE;gBAC1C,IAAIlB,QAAQ,CAACc,IAAI,CAACK,oBAAoB,EAAE;kBACpCZ,WAAW,CAACxD,GAAG,CAACkE,GAAG,CAACG,oBAAoB,EAAE;oBACtC1C,IAAI,EAAE,GAAGsB,QAAQ,CAACtB,IAAI,4BAA4B;oBAClDqC,MAAM,EAAE;sBACJM,IAAI,EAAErB,QAAQ,CAACsB,MAAM,CAAC5C,IAAI;sBAC1B6C,SAAS,EACLxE,GAAG,CAACkE,GAAG,CAACO,aAAa,CAChBC;oBACb;kBACJ,CAAC,CAAC;gBACN;cACJ;YACJ,CAAC,CAAC;UACN;QACJ;MACJ,CAAC,CAAC;MACF;;MAEA;MACA;MACA,MAAMC,cAAc,GAAG5C,GAAG,CAAC6C,YAAY,CAAC,CAAC,CAACC,OAAO,CAACrD,SAAS,CAAC;MAE5DM,GAAG,CAACqB,UAAU,CAAC,MAAM;QACjB,OAAOwB,cAAc,CAACG,OAAO,CAAChD,GAA8B,CAAC;MACjE,CAAC,CAAC;MAEF,MAAMiD,YAAY,GAAGjD,GAAG,CAACY,GAAG,CAACqC,YAAY;;MAEzC;MACA,MAAMC,IAAI,GAAGlD,GAAG,CAACmD,SAAS,CAACvE,UAAU,CAAC;;MAEtC;MACA,MAAMwE,UAAU,GACZ9C,mBAAmB,KAAK,IAAI,IAC5B,OAAOA,mBAAmB,KAAK,QAAQ,IACvC2C,YAAY;MAEhBjD,GAAG,CAACmD,SAAS,CAACtE,SAAS,EAAE;QAAEwE,OAAO,EAAED;MAAW,CAAC,CAAC;MAEjD,MAAME,OAAO,GAAGtD,GAAG,CAACmD,SAAS,CAAC1E,UAAU,EAAE;QACtCmC,GAAG,EAAE;UACD2C,cAAc,EAAEtE,uBAAuB,CAAC,CAAC;UACzCuE,oBAAoB,EAAEN,IAAI,CAACO,iBAAiB;UAC5CC,QAAQ,EAAER,IAAI,CAACS,wBAAwB;UACvCC,YAAY,EAAEV,IAAI,CAACW,oBAAoB;UACvCC,mBAAmB,EAAEZ,IAAI,CAACa,0BAA0B;UACpDC,mBAAmB,EAAEd,IAAI,CAACe,2BAA2B;UACrDC,mBAAmB,EAAEhB,IAAI,CAACiB,wBAAwB;UAElD;UACA;UACApD,uBAAuB,EAAEJ,OAAO,CAACC,GAAG,CAACG,uBAAuB;UAC5DE,yBAAyB,EAAEN,OAAO,CAACC,GAAG,CAACK,yBAAyB;UAEhEmD,SAAS,EAAElB,IAAI,CAACmB,mBAAmB;UACnCC,SAAS,EAAEpB,IAAI,CAACqB,WAAW;UAC3B;UACAC,WAAW,EAAE7D,OAAO,CAACC,GAAG,CAAC,aAAa;QAC1C;MACJ,CAAC,CAAC;MAEF,MAAM6D,SAAS,GAAGzE,GAAG,CAACmD,SAAS,CAACxE,YAAY,CAAC;MAE7C,MAAM+F,WAAW,GAAG1E,GAAG,CAACmD,SAAS,CAAC5E,cAAc,EAAE;QAC9CqC,GAAG,EAAE;UACD8C,QAAQ,EAAER,IAAI,CAACS,wBAAwB;UACvCC,YAAY,EAAEV,IAAI,CAACW,oBAAoB;UACvCC,mBAAmB,EAAEZ,IAAI,CAACa;QAC9B;MACJ,CAAC,CAAC;MAEF,MAAMY,UAAU,GAAG3E,GAAG,CAACmD,SAAS,CAAC3E,UAAU,EAAE;QACzC,cAAc,EAAE;UACZsB,IAAI,EAAE,UAAU;UAChB8E,MAAM,EAAE,MAAM;UACdC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,iBAAiB,EAAE;UACfjF,IAAI,EAAE,UAAU;UAChB8E,MAAM,EAAE,SAAS;UACjBC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,WAAW,EAAE;UACTjF,IAAI,EAAE,gBAAgB;UACtB8E,MAAM,EAAE,KAAK;UACbC,QAAQ,EAAEH,WAAW,CAACI,SAAS,CAACE,QAAQ,CAACvC,MAAM,CAACsC;QACpD,CAAC;QACD,aAAa,EAAE;UACXjF,IAAI,EAAE,kBAAkB;UACxB8E,MAAM,EAAE,KAAK;UACbC,QAAQ,EAAEH,WAAW,CAACI,SAAS,CAACE,QAAQ,CAACvC,MAAM,CAACsC;QACpD,CAAC;QACD,UAAU,EAAE;UACRjF,IAAI,EAAE,aAAa;UACnB8E,MAAM,EAAE,MAAM;UACdC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,aAAa,EAAE;UACXjF,IAAI,EAAE,aAAa;UACnB8E,MAAM,EAAE,SAAS;UACjBC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,eAAe,EAAE;UACbjF,IAAI,EAAE,eAAe;UACrB8E,MAAM,EAAE,KAAK;UACbC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,mBAAmB,EAAE;UACjBjF,IAAI,EAAE,eAAe;UACrB8E,MAAM,EAAE,SAAS;UACjBC,QAAQ,EAAEvB,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC;QAC/C,CAAC;QACD,iBAAiB,EAAE;UACfjF,IAAI,EAAE,UAAU;UAChB8E,MAAM,EAAE,KAAK;UACbC,QAAQ,EAAEH,WAAW,CAACI,SAAS,CAACE,QAAQ,CAACvC,MAAM,CAACsC;QACpD;MACJ,CAAC,CAAC;MAEF,MAAME,UAAU,GAAGjF,GAAG,CAACmD,SAAS,CAAC7E,aAAa,CAAC;MAC/C,MAAM4G,cAAc,GAAGlF,GAAG,CAACmD,SAAS,CAAC9E,iBAAiB,CAAC;MACvD,MAAM8G,SAAS,GAAGnF,GAAG,CAACmD,SAAS,CAACzE,YAAY,CAAC;MAC7C,MAAM0G,SAAS,GAAGpF,GAAG,CAACmD,SAAS,CAAC/D,YAAY,CAAC;;MAE7C;MACA;MACA;MACA;;MAEAY,GAAG,CAACqF,UAAU,CAAC;QACXC,YAAY,EAAEnG,eAAe,CAACa,GAAG,CAAC;QAClCuF,MAAM,EAAErH,GAAG,CAACgE,MAAM,CAACqD,MAAM;QACzB9B,iBAAiB,EAAEP,IAAI,CAACO,iBAAiB;QACzC+B,kBAAkB,EAAEtC,IAAI,CAACsC,kBAAkB;QAC3CC,6BAA6B,EAAEvC,IAAI,CAACuC,6BAA6B;QACjEC,aAAa,EAAExC,IAAI,CAACS,wBAAwB;QAC5CgC,sBAAsB,EAAEzC,IAAI,CAACa,0BAA0B;QACvD6B,kBAAkB,EAAET,SAAS,CAACN,QAAQ,CAACpC,MAAM,CAACsC,GAAG;QACjDc,iBAAiB,EAAEvC,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAAC5C,IAAI;QACxDiG,iBAAiB,EAAExC,OAAO,CAACd,IAAI,CAACC,MAAM,CAACsC,GAAG;QAC1CgB,qBAAqB,EAAEzC,OAAO,CAACd,IAAI,CAACC,MAAM,CAAC5C,IAAI;QAC/CmG,uBAAuB,EAAEd,cAAc,CAACA,cAAc,CAACzC,MAAM,CAACsC,GAAG;QACjEkB,6BAA6B,EAAEf,cAAc,CAACgB,YAAY,CAACzD,MAAM,CAACsC,GAAG;QACrEoB,4BAA4B,EAAEzB,WAAW,CAACI,SAAS,CAACE,QAAQ,CAACvC,MAAM,CAACsC,GAAG;QACvEqB,cAAc,EAAE3B,SAAS,CAAC4B,YAAY,CAAC5D,MAAM,CAAC6D,EAAE;QAChDC,eAAe,EAAE9B,SAAS,CAAC8B,eAAe;QAC1CC,yBAAyB,EAAEpB,SAAS,CAACqB,UAAU,CAAChE,MAAM,CAACsC;MAC3D,CAAC,CAAC;;MAEF;MACA,IAAIvE,kBAAkB,EAAE;QACpBR,GAAG,CAACqF,UAAU,CAAC;UACXqB,uBAAuB,EAAExD,IAAI,CAACe;QAClC,CAAC,CAAC;MACN;MAEAjE,GAAG,CAACqB,UAAU,CAAC,MAAM;QACjBvC,qBAAqB,CAAC;UAClBkB,GAAG;UACH2G,sBAAsB,EAAE1B,UAAU;UAClC2B,GAAG,EAAE;YACDC,kBAAkB,EAAE,qBAAqB;YACzCC,eAAe,EAAE,kBAAkB;YACnCC,UAAU,EAAE,WAAW;YACvBC,OAAO,EAAE;UACb;QACJ,CAAC,CAAC;MACN,CAAC,CAAC;MACF;MACA;MACA;MACA;MACA;MACA;MACA;MACA;;MAEA;MACA,MAAM9H,oBAAoB,CAAC,KAAK,CAAC;MAEjC,OAAO;QACHwF,WAAW;QACXpB,OAAO;QACPqB,UAAU;QACVF,SAAS;QACTQ,UAAU;QACVE,SAAS;QACTD,cAAc;QACdE;MACJ,CAAC;IACL;EACJ,CAAC,CAAC;EAEF,MAAMpF,GAAG,GAAGhB,mBAAmB,CAACD,4BAA4B,CAACa,OAAO,CAAC,CAAC;EAEtEI,GAAG,CAACqB,UAAU,CAAC,MAAM;IACjBrB,GAAG,CAACiH,kBAAkB,CAAC;MACnBpH,IAAI,EAAE,KAAK;MACXqH,QAAQ,EAAE;QACNC,SAAS,EAAEvH,OAAO,CAACwH,SAAS,CAAClC,cAAc,CAACgB,YAAY,CAACzD,MAAM,CAACsC,GAAG;QACnEE,UAAU,EAAE;UACRoC,cAAc,EAAEzH,OAAO,CAACwH,SAAS,CAACnC,UAAU,CAACxC,MAAM,CAAC6D,EAAE;UACtDgB,MAAM,EAAE1H,OAAO,CAACwH,SAAS,CAACnC,UAAU,CAACxC,MAAM,CAAC/B,UAAU,CAAC6G,KAAK,CACxDC,CAAC,IAAI,WAAWA,CAAC,EACrB;QACJ;MACJ;IACJ,CAAC,CAAC;IAEFxH,GAAG,CAACiH,kBAAkB,CAAC;MACnBpH,IAAI,EAAE,WAAW;MACjBqH,QAAQ,EAAE;QACNO,SAAS,EAAE7H,OAAO,CAACwH,SAAS,CAAC9D,OAAO,CAACwB,SAAS,CAACxB,OAAO,CAACb,MAAM,CAACsC,GAAG;QACjE2C,OAAO,EAAE9H,OAAO,CAACwH,SAAS,CAAChC,SAAS,CAACqB,UAAU,CAAChE,MAAM,CAACsC;MAC3D;IACJ,CAAC,CAAC;EACN,CAAC,CAAC;EAEF,OAAO/E,GAAG;AACd,CAAC","ignoreList":[]}

package/pulumi/apps/api/handleGuardDutyEvents.d.ts

@@ -0,0 +1,2 @@
+import { type ApiPulumiApp } from "../../../pulumi/index.js";
+export declare const handleGuardDutyEvents: (app: ApiPulumiApp) => void;

package/pulumi/apps/api/handleGuardDutyEvents.js

@@ -0,0 +1,55 @@
+import * as aws from "@pulumi/aws";
+import { CoreOutput } from "../../index.js";
+export const handleGuardDutyEvents = app => {
+  const core = app.getModule(CoreOutput);
+  const graphql = app.resources.graphql.functions.graphql;
+  const baseConfig = graphql.config.clone();
+  const threatDetectionHandler = app.addResource(aws.lambda.Function, {
+    name: "fm-threat-detection",
+    config: {
+      ...baseConfig,
+      memorySize: 1024,
+      description: "Handles Guard Duty threat scan results.",
+      environment: {
+        variables: graphql.output.environment.apply(env => {
+          return {
+            WEBINY_FUNCTION_TYPE: "threat-detection-event-handler",
+            ...env?.variables
+          };
+        })
+      },
+      loggingConfig: {
+        logFormat: "JSON"
+      }
+    }
+  });
+  const eventRule = app.addResource(aws.cloudwatch.EventRule, {
+    name: `fm-bucket-malware-protection-event-rule`,
+    config: {
+      eventBusName: core.eventBusName,
+      eventPattern: JSON.stringify({
+        source: ["aws.guardduty"],
+        "detail-type": ["GuardDuty Malware Protection Object Scan Result"]
+      })
+    }
+  });
+  app.addResource(aws.lambda.Permission, {
+    name: "fm-bucket-malware-protection-event-permission",
+    config: {
+      action: "lambda:InvokeFunction",
+      function: threatDetectionHandler.output.arn,
+      principal: "events.amazonaws.com",
+      sourceArn: eventRule.output.arn
+    }
+  });
+  app.addResource(aws.cloudwatch.EventTarget, {
+    name: `fm-bucket-malware-protection-event-target`,
+    config: {
+      rule: eventRule.output.name,
+      arn: threatDetectionHandler.output.arn,
+      eventBusName: core.eventBusName
+    }
+  });
+};
+
+//# sourceMappingURL=handleGuardDutyEvents.js.map

package/pulumi/apps/api/handleGuardDutyEvents.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","CoreOutput","handleGuardDutyEvents","app","core","getModule","graphql","resources","functions","baseConfig","config","clone","threatDetectionHandler","addResource","lambda","Function","name","memorySize","description","environment","variables","output","apply","env","WEBINY_FUNCTION_TYPE","loggingConfig","logFormat","eventRule","cloudwatch","EventRule","eventBusName","eventPattern","JSON","stringify","source","Permission","action","function","arn","principal","sourceArn","EventTarget","rule"],"sources":["handleGuardDutyEvents.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { type ApiPulumiApp, CoreOutput } from \"~/pulumi/index.js\";\n\nexport const handleGuardDutyEvents = (app: ApiPulumiApp) => {\n    const core = app.getModule(CoreOutput);\n    const graphql = app.resources.graphql.functions.graphql;\n\n    const baseConfig = graphql.config.clone();\n\n    const threatDetectionHandler = app.addResource(aws.lambda.Function, {\n        name: \"fm-threat-detection\",\n        config: {\n            ...baseConfig,\n            memorySize: 1024,\n            description: \"Handles Guard Duty threat scan results.\",\n            environment: {\n                variables: graphql.output.environment.apply(env => {\n                    return {\n                        WEBINY_FUNCTION_TYPE: \"threat-detection-event-handler\",\n                        ...env?.variables\n                    };\n                })\n            },\n            loggingConfig: {\n                logFormat: \"JSON\"\n            }\n        }\n    });\n\n    const eventRule = app.addResource(aws.cloudwatch.EventRule, {\n        name: `fm-bucket-malware-protection-event-rule`,\n        config: {\n            eventBusName: core.eventBusName,\n            eventPattern: JSON.stringify({\n                source: [\"aws.guardduty\"],\n                \"detail-type\": [\"GuardDuty Malware Protection Object Scan Result\"]\n            })\n        }\n    });\n\n    app.addResource(aws.lambda.Permission, {\n        name: \"fm-bucket-malware-protection-event-permission\",\n        config: {\n            action: \"lambda:InvokeFunction\",\n            function: threatDetectionHandler.output.arn,\n            principal: \"events.amazonaws.com\",\n            sourceArn: eventRule.output.arn\n        }\n    });\n\n    app.addResource(aws.cloudwatch.EventTarget, {\n        name: `fm-bucket-malware-protection-event-target`,\n        config: {\n            rule: eventRule.output.name,\n            arn: threatDetectionHandler.output.arn,\n            eventBusName: core.eventBusName\n        }\n    });\n};\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAClC,SAA4BC,UAAU;AAEtC,OAAO,MAAMC,qBAAqB,GAAIC,GAAiB,IAAK;EACxD,MAAMC,IAAI,GAAGD,GAAG,CAACE,SAAS,CAACJ,UAAU,CAAC;EACtC,MAAMK,OAAO,GAAGH,GAAG,CAACI,SAAS,CAACD,OAAO,CAACE,SAAS,CAACF,OAAO;EAEvD,MAAMG,UAAU,GAAGH,OAAO,CAACI,MAAM,CAACC,KAAK,CAAC,CAAC;EAEzC,MAAMC,sBAAsB,GAAGT,GAAG,CAACU,WAAW,CAACb,GAAG,CAACc,MAAM,CAACC,QAAQ,EAAE;IAChEC,IAAI,EAAE,qBAAqB;IAC3BN,MAAM,EAAE;MACJ,GAAGD,UAAU;MACbQ,UAAU,EAAE,IAAI;MAChBC,WAAW,EAAE,yCAAyC;MACtDC,WAAW,EAAE;QACTC,SAAS,EAAEd,OAAO,CAACe,MAAM,CAACF,WAAW,CAACG,KAAK,CAACC,GAAG,IAAI;UAC/C,OAAO;YACHC,oBAAoB,EAAE,gCAAgC;YACtD,GAAGD,GAAG,EAAEH;UACZ,CAAC;QACL,CAAC;MACL,CAAC;MACDK,aAAa,EAAE;QACXC,SAAS,EAAE;MACf;IACJ;EACJ,CAAC,CAAC;EAEF,MAAMC,SAAS,GAAGxB,GAAG,CAACU,WAAW,CAACb,GAAG,CAAC4B,UAAU,CAACC,SAAS,EAAE;IACxDb,IAAI,EAAE,yCAAyC;IAC/CN,MAAM,EAAE;MACJoB,YAAY,EAAE1B,IAAI,CAAC0B,YAAY;MAC/BC,YAAY,EAAEC,IAAI,CAACC,SAAS,CAAC;QACzBC,MAAM,EAAE,CAAC,eAAe,CAAC;QACzB,aAAa,EAAE,CAAC,iDAAiD;MACrE,CAAC;IACL;EACJ,CAAC,CAAC;EAEF/B,GAAG,CAACU,WAAW,CAACb,GAAG,CAACc,MAAM,CAACqB,UAAU,EAAE;IACnCnB,IAAI,EAAE,+CAA+C;IACrDN,MAAM,EAAE;MACJ0B,MAAM,EAAE,uBAAuB;MAC/BC,QAAQ,EAAEzB,sBAAsB,CAACS,MAAM,CAACiB,GAAG;MAC3CC,SAAS,EAAE,sBAAsB;MACjCC,SAAS,EAAEb,SAAS,CAACN,MAAM,CAACiB;IAChC;EACJ,CAAC,CAAC;EAEFnC,GAAG,CAACU,WAAW,CAACb,GAAG,CAAC4B,UAAU,CAACa,WAAW,EAAE;IACxCzB,IAAI,EAAE,2CAA2C;IACjDN,MAAM,EAAE;MACJgC,IAAI,EAAEf,SAAS,CAACN,MAAM,CAACL,IAAI;MAC3BsB,GAAG,EAAE1B,sBAAsB,CAACS,MAAM,CAACiB,GAAG;MACtCR,YAAY,EAAE1B,IAAI,CAAC0B;IACvB;EACJ,CAAC,CAAC;AACN,CAAC","ignoreList":[]}

package/pulumi/apps/api/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./ApiBackgroundTask.js";
+export * from "./ApiCloudfront.js";
+export * from "./ApiFileManager.js";
+export * from "./ApiGateway.js";
+export * from "./ApiGraphql.js";
+export * from "./ApiMigration.js";
+export * from "./createApiPulumiApp.js";
+export * from "./ApiOutput.js";
+export * from "./ApiWebsocket.js";

package/pulumi/apps/api/index.js

@@ -0,0 +1,11 @@
+export * from "./ApiBackgroundTask.js";
+export * from "./ApiCloudfront.js";
+export * from "./ApiFileManager.js";
+export * from "./ApiGateway.js";
+export * from "./ApiGraphql.js";
+export * from "./ApiMigration.js";
+export * from "./createApiPulumiApp.js";
+export * from "./ApiOutput.js";
+export * from "./ApiWebsocket.js";
+
+//# sourceMappingURL=index.js.map

package/pulumi/apps/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["index.ts"],"sourcesContent":["export * from \"./ApiBackgroundTask.js\";\nexport * from \"./ApiCloudfront.js\";\nexport * from \"./ApiFileManager.js\";\nexport * from \"./ApiGateway.js\";\nexport * from \"./ApiGraphql.js\";\nexport * from \"./ApiMigration.js\";\nexport * from \"./createApiPulumiApp.js\";\nexport * from \"./ApiOutput.js\";\nexport * from \"./ApiWebsocket.js\";\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","ignoreList":[]}

package/pulumi/apps/awsUtils.d.ts

@@ -0,0 +1,5 @@
+import { type PulumiApp } from "@webiny/pulumi";
+import { type AppName } from "@webiny/project";
+export declare function getAwsAccountId(app: PulumiApp): import("@pulumi/pulumi").Output<string>;
+export declare function getAwsRegion(app: PulumiApp): import("@pulumi/pulumi").Output<"af-south-1" | "ap-east-1" | "ap-east-2" | "ap-northeast-1" | "ap-northeast-2" | "ap-northeast-3" | "ap-south-1" | "ap-south-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-southeast-3" | "ap-southeast-4" | "ap-southeast-5" | "ap-southeast-7" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-central-2" | "eu-north-1" | "eu-south-1" | "eu-south-2" | "eu-west-1" | "eu-west-2" | "eu-west-3" | "il-central-1" | "me-central-1" | "me-south-1" | "mx-central-1" | "sa-east-1" | "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "cn-north-1" | "cn-northwest-1" | "us-gov-east-1" | "us-gov-west-1" | "us-iso-east-1" | "us-iso-west-1" | "us-isob-east-1" | "eu-isoe-west-1">;
+export declare function applyAwsResourceTags(appName: AppName): Promise<void>;

package/pulumi/apps/awsUtils.js

@@ -0,0 +1,34 @@
+import * as aws from "@pulumi/aws";
+import { tagResources } from "../utils/index.js";
+import { getEnvVariableWebinyProjectName } from "../env/projectName.js";
+import { getEnvVariableWebinyEnv } from "../env/env.js";
+import { getEnvVariableWebinyVariant } from "../env/variant.js";
+import { getProjectSdk } from "@webiny/project";
+import { AwsTags as awsTagsExt } from "../extensions/AwsTags.js";
+export function getAwsAccountId(app) {
+  return app.addHandler(() => {
+    return aws.getCallerIdentity({}).then(x => x.accountId);
+  });
+}
+export function getAwsRegion(app) {
+  return app.addHandler(() => {
+    return aws.config.requireRegion();
+  });
+}
+export async function applyAwsResourceTags(appName) {
+  const sdk = await getProjectSdk();
+  const projectConfig = await sdk.getProjectConfig();
+  const awsTagsFromExtensions = {};
+  projectConfig.extensionsByType(awsTagsExt).forEach(ext => {
+    Object.assign(awsTagsFromExtensions, ext.params.tags);
+  });
+  tagResources({
+    ...awsTagsFromExtensions,
+    WbyApp: appName,
+    WbyProjectName: getEnvVariableWebinyProjectName(),
+    WbyEnvironment: getEnvVariableWebinyEnv(),
+    WbyEnvironmentVariant: getEnvVariableWebinyVariant()
+  });
+}
+
+//# sourceMappingURL=awsUtils.js.map

package/pulumi/apps/awsUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","tagResources","getEnvVariableWebinyProjectName","getEnvVariableWebinyEnv","getEnvVariableWebinyVariant","getProjectSdk","AwsTags","awsTagsExt","getAwsAccountId","app","addHandler","getCallerIdentity","then","x","accountId","getAwsRegion","config","requireRegion","applyAwsResourceTags","appName","sdk","projectConfig","getProjectConfig","awsTagsFromExtensions","extensionsByType","forEach","ext","Object","assign","params","tags","WbyApp","WbyProjectName","WbyEnvironment","WbyEnvironmentVariant"],"sources":["awsUtils.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { type PulumiApp } from \"@webiny/pulumi\";\nimport { tagResources } from \"~/pulumi/utils/index.js\";\nimport { getEnvVariableWebinyProjectName } from \"~/pulumi/env/projectName.js\";\nimport { getEnvVariableWebinyEnv } from \"~/pulumi/env/env.js\";\nimport { getEnvVariableWebinyVariant } from \"~/pulumi/env/variant.js\";\nimport { type AppName, getProjectSdk } from \"@webiny/project\";\nimport { AwsTags as awsTagsExt } from \"~/pulumi/extensions/AwsTags.js\";\n\nexport function getAwsAccountId(app: PulumiApp) {\n    return app.addHandler(() => {\n        return aws.getCallerIdentity({}).then(x => x.accountId);\n    });\n}\n\nexport function getAwsRegion(app: PulumiApp) {\n    return app.addHandler(() => {\n        return aws.config.requireRegion();\n    });\n}\n\nexport async function applyAwsResourceTags(appName: AppName) {\n    const sdk = await getProjectSdk();\n    const projectConfig = await sdk.getProjectConfig();\n\n    const awsTagsFromExtensions: Record<string, string> = {};\n    projectConfig.extensionsByType(awsTagsExt).forEach(ext => {\n        Object.assign(awsTagsFromExtensions, ext.params.tags);\n    });\n\n    tagResources({\n        ...awsTagsFromExtensions,\n        WbyApp: appName,\n        WbyProjectName: getEnvVariableWebinyProjectName(),\n        WbyEnvironment: getEnvVariableWebinyEnv(),\n        WbyEnvironmentVariant: getEnvVariableWebinyVariant()\n    });\n}\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAElC,SAASC,YAAY;AACrB,SAASC,+BAA+B;AACxC,SAASC,uBAAuB;AAChC,SAASC,2BAA2B;AACpC,SAAuBC,aAAa,QAAQ,iBAAiB;AAC7D,SAASC,OAAO,IAAIC,UAAU;AAE9B,OAAO,SAASC,eAAeA,CAACC,GAAc,EAAE;EAC5C,OAAOA,GAAG,CAACC,UAAU,CAAC,MAAM;IACxB,OAAOV,GAAG,CAACW,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAACC,IAAI,CAACC,CAAC,IAAIA,CAAC,CAACC,SAAS,CAAC;EAC3D,CAAC,CAAC;AACN;AAEA,OAAO,SAASC,YAAYA,CAACN,GAAc,EAAE;EACzC,OAAOA,GAAG,CAACC,UAAU,CAAC,MAAM;IACxB,OAAOV,GAAG,CAACgB,MAAM,CAACC,aAAa,CAAC,CAAC;EACrC,CAAC,CAAC;AACN;AAEA,OAAO,eAAeC,oBAAoBA,CAACC,OAAgB,EAAE;EACzD,MAAMC,GAAG,GAAG,MAAMf,aAAa,CAAC,CAAC;EACjC,MAAMgB,aAAa,GAAG,MAAMD,GAAG,CAACE,gBAAgB,CAAC,CAAC;EAElD,MAAMC,qBAA6C,GAAG,CAAC,CAAC;EACxDF,aAAa,CAACG,gBAAgB,CAACjB,UAAU,CAAC,CAACkB,OAAO,CAACC,GAAG,IAAI;IACtDC,MAAM,CAACC,MAAM,CAACL,qBAAqB,EAAEG,GAAG,CAACG,MAAM,CAACC,IAAI,CAAC;EACzD,CAAC,CAAC;EAEF7B,YAAY,CAAC;IACT,GAAGsB,qBAAqB;IACxBQ,MAAM,EAAEZ,OAAO;IACfa,cAAc,EAAE9B,+BAA+B,CAAC,CAAC;IACjD+B,cAAc,EAAE9B,uBAAuB,CAAC,CAAC;IACzC+B,qBAAqB,EAAE9B,2BAA2B,CAAC;EACvD,CAAC,CAAC;AACN","ignoreList":[]}

package/pulumi/apps/blueGreen/BlueGreenRouterApiGateway.d.ts

@@ -0,0 +1,11 @@
+import * as aws from "@pulumi/aws";
+import type { PulumiAppModule } from "@webiny/pulumi";
+export type BlueGreenRouterApiGateway = PulumiAppModule<typeof BlueGreenRouterApiGateway>;
+export interface IBlueGreenRouterApiGatewayParams {
+    region: aws.Provider;
+    protect: boolean;
+}
+export declare const BlueGreenRouterApiGateway: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    apiStage: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/stage").Stage>;
+    apiGateway: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2/api").Api>;
+}, IBlueGreenRouterApiGatewayParams>;

package/pulumi/apps/blueGreen/BlueGreenRouterApiGateway.js

@@ -0,0 +1,44 @@
+import * as aws from "@pulumi/aws";
+import { createAppModule } from "@webiny/pulumi";
+export const BlueGreenRouterApiGateway = createAppModule({
+  name: "BlueGreenRouterApiGateway",
+  config(app, params) {
+    const apiGateway = app.addResource(aws.apigatewayv2.Api, {
+      name: "blueGreenRouterApi",
+      opts: {
+        protect: params.protect,
+        provider: params.region
+      },
+      config: {
+        protocolType: "HTTP",
+        description: "Blue / Green Router API"
+      }
+    });
+    const apiStage = app.addResource(aws.apigatewayv2.Stage, {
+      name: "blue-green-stage",
+      opts: {
+        protect: params.protect,
+        provider: params.region
+      },
+      config: {
+        apiId: apiGateway.output.id,
+        autoDeploy: true,
+        name: app.params.run.env,
+        defaultRouteSettings: {
+          // Only enable when debugging. Note that by default, API Gateway does not
+          // have the required permissions to write logs to CloudWatch logs. More:
+          // https://coady.tech/aws-cloudwatch-logs-arn/
+          // loggingLevel: "INFO",
+          throttlingBurstLimit: 5000,
+          throttlingRateLimit: 10000
+        }
+      }
+    });
+    return {
+      apiStage,
+      apiGateway
+    };
+  }
+});
+
+//# sourceMappingURL=BlueGreenRouterApiGateway.js.map

package/pulumi/apps/blueGreen/BlueGreenRouterApiGateway.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createAppModule","BlueGreenRouterApiGateway","name","config","app","params","apiGateway","addResource","apigatewayv2","Api","opts","protect","provider","region","protocolType","description","apiStage","Stage","apiId","output","id","autoDeploy","run","env","defaultRouteSettings","throttlingBurstLimit","throttlingRateLimit"],"sources":["BlueGreenRouterApiGateway.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport type { PulumiApp, PulumiAppModule } from \"@webiny/pulumi\";\nimport { createAppModule } from \"@webiny/pulumi\";\n\nexport type BlueGreenRouterApiGateway = PulumiAppModule<typeof BlueGreenRouterApiGateway>;\n\nexport interface IBlueGreenRouterApiGatewayParams {\n    region: aws.Provider;\n    protect: boolean;\n}\n\nexport const BlueGreenRouterApiGateway = createAppModule({\n    name: \"BlueGreenRouterApiGateway\",\n    config(app: PulumiApp, params: IBlueGreenRouterApiGatewayParams) {\n        const apiGateway = app.addResource(aws.apigatewayv2.Api, {\n            name: \"blueGreenRouterApi\",\n            opts: {\n                protect: params.protect,\n                provider: params.region\n            },\n            config: {\n                protocolType: \"HTTP\",\n                description: \"Blue / Green Router API\"\n            }\n        });\n\n        const apiStage = app.addResource(aws.apigatewayv2.Stage, {\n            name: \"blue-green-stage\",\n            opts: {\n                protect: params.protect,\n                provider: params.region\n            },\n            config: {\n                apiId: apiGateway.output.id,\n                autoDeploy: true,\n                name: app.params.run.env,\n                defaultRouteSettings: {\n                    // Only enable when debugging. Note that by default, API Gateway does not\n                    // have the required permissions to write logs to CloudWatch logs. More:\n                    // https://coady.tech/aws-cloudwatch-logs-arn/\n                    // loggingLevel: \"INFO\",\n                    throttlingBurstLimit: 5000,\n                    throttlingRateLimit: 10000\n                }\n            }\n        });\n\n        return {\n            apiStage,\n            apiGateway\n        };\n    }\n});\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAElC,SAASC,eAAe,QAAQ,gBAAgB;AAShD,OAAO,MAAMC,yBAAyB,GAAGD,eAAe,CAAC;EACrDE,IAAI,EAAE,2BAA2B;EACjCC,MAAMA,CAACC,GAAc,EAAEC,MAAwC,EAAE;IAC7D,MAAMC,UAAU,GAAGF,GAAG,CAACG,WAAW,CAACR,GAAG,CAACS,YAAY,CAACC,GAAG,EAAE;MACrDP,IAAI,EAAE,oBAAoB;MAC1BQ,IAAI,EAAE;QACFC,OAAO,EAAEN,MAAM,CAACM,OAAO;QACvBC,QAAQ,EAAEP,MAAM,CAACQ;MACrB,CAAC;MACDV,MAAM,EAAE;QACJW,YAAY,EAAE,MAAM;QACpBC,WAAW,EAAE;MACjB;IACJ,CAAC,CAAC;IAEF,MAAMC,QAAQ,GAAGZ,GAAG,CAACG,WAAW,CAACR,GAAG,CAACS,YAAY,CAACS,KAAK,EAAE;MACrDf,IAAI,EAAE,kBAAkB;MACxBQ,IAAI,EAAE;QACFC,OAAO,EAAEN,MAAM,CAACM,OAAO;QACvBC,QAAQ,EAAEP,MAAM,CAACQ;MACrB,CAAC;MACDV,MAAM,EAAE;QACJe,KAAK,EAAEZ,UAAU,CAACa,MAAM,CAACC,EAAE;QAC3BC,UAAU,EAAE,IAAI;QAChBnB,IAAI,EAAEE,GAAG,CAACC,MAAM,CAACiB,GAAG,CAACC,GAAG;QACxBC,oBAAoB,EAAE;UAClB;UACA;UACA;UACA;UACAC,oBAAoB,EAAE,IAAI;UAC1BC,mBAAmB,EAAE;QACzB;MACJ;IACJ,CAAC,CAAC;IAEF,OAAO;MACHV,QAAQ;MACRV;IACJ,CAAC;EACL;AACJ,CAAC,CAAC","ignoreList":[]}

package/pulumi/apps/blueGreen/BlueGreenRouterCloudFront.d.ts

@@ -0,0 +1,17 @@
+import * as aws from "@pulumi/aws";
+import type { PulumiAppModule } from "@webiny/pulumi";
+import type { GetCachePolicyResult } from "@pulumi/aws/cloudfront/getCachePolicy.js";
+import type { GetOriginRequestPolicyResult } from "@pulumi/aws/cloudfront/getOriginRequestPolicy.js";
+import type { IResolvedDomains } from "./types.js";
+export type BlueGreenRouterCloudFront = PulumiAppModule<typeof BlueGreenRouterCloudFront>;
+export interface IBlueGreenRouterCloudFrontConfig {
+    region: aws.Provider;
+    protect: boolean;
+    domains: IResolvedDomains;
+    cachePolicyId: GetCachePolicyResult;
+    originRequestPolicyId: GetOriginRequestPolicyResult;
+}
+export declare const BlueGreenRouterCloudFront: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    cloudFront: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/distribution.js").Distribution>;
+    cloudFrontFunction: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/function.js").Function>;
+}, IBlueGreenRouterCloudFrontConfig>;