@webiny/project-aws 0.0.0-unstable.61c048f412

package/pulumi/apps/core/CoreAuditLogsDynamo.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createAppModule","CoreAuditLogsDynamo","name","config","app","params","addResource","dynamodb","Table","attributes","type","billingMode","hashKey","rangeKey","globalSecondaryIndexes","projectionType","ttl","attributeName","enabled","opts","protect"],"sources":["CoreAuditLogsDynamo.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport type { PulumiApp, PulumiAppModule } from \"@webiny/pulumi\";\nimport { createAppModule } from \"@webiny/pulumi\";\n\nexport type CoreAuditLogsDynamo = PulumiAppModule<typeof CoreAuditLogsDynamo>;\n\nexport const CoreAuditLogsDynamo = createAppModule({\n    name: \"AuditLogsDynamoDb\",\n    config(app: PulumiApp, params: { protect: boolean }) {\n        return app.addResource(aws.dynamodb.Table, {\n            name: \"webiny-audit-logs\",\n            config: {\n                attributes: [\n                    { name: \"PK\", type: \"S\" },\n                    { name: \"SK\", type: \"S\" },\n                    { name: \"GSI_TENANT\", type: \"S\" },\n                    { name: \"GSI1_PK\", type: \"S\" },\n                    { name: \"GSI1_SK\", type: \"N\" },\n                    { name: \"GSI2_PK\", type: \"S\" },\n                    { name: \"GSI2_SK\", type: \"N\" },\n                    { name: \"GSI3_PK\", type: \"S\" },\n                    { name: \"GSI3_SK\", type: \"N\" },\n                    { name: \"GSI4_PK\", type: \"S\" },\n                    { name: \"GSI4_SK\", type: \"N\" },\n                    { name: \"GSI5_PK\", type: \"S\" },\n                    { name: \"GSI5_SK\", type: \"N\" },\n                    { name: \"GSI6_PK\", type: \"S\" },\n                    { name: \"GSI6_SK\", type: \"N\" },\n                    { name: \"GSI7_PK\", type: \"S\" },\n                    { name: \"GSI7_SK\", type: \"N\" },\n                    { name: \"GSI8_PK\", type: \"S\" },\n                    { name: \"GSI8_SK\", type: \"N\" },\n                    { name: \"GSI9_PK\", type: \"S\" },\n                    { name: \"GSI9_SK\", type: \"N\" }\n                ],\n                billingMode: \"PAY_PER_REQUEST\",\n                hashKey: \"PK\",\n                rangeKey: \"SK\",\n                globalSecondaryIndexes: [\n                    {\n                        name: \"GSI_TENANT\",\n                        hashKey: \"GSI_TENANT\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI1\",\n                        hashKey: \"GSI1_PK\",\n                        rangeKey: \"GSI1_SK\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI2\",\n                        hashKey: \"GSI2_PK\",\n                        rangeKey: \"GSI2_SK\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI3\",\n                        hashKey: \"GSI3_PK\",\n                        rangeKey: \"GSI3_SK\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI4\",\n                        hashKey: \"GSI4_PK\",\n                        rangeKey: \"GSI4_SK\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI5\",\n                        hashKey: \"GSI5_PK\",\n                        rangeKey: \"GSI5_SK\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI6\",\n                        hashKey: \"GSI6_PK\",\n                        rangeKey: \"GSI6_SK\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI7\",\n                        hashKey: \"GSI7_PK\",\n                        rangeKey: \"GSI7_SK\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI8\",\n                        hashKey: \"GSI8_PK\",\n                        rangeKey: \"GSI8_SK\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI9\",\n                        hashKey: \"GSI9_PK\",\n                        rangeKey: \"GSI9_SK\",\n                        projectionType: \"KEYS_ONLY\"\n                    }\n                ],\n                ttl: {\n                    attributeName: \"expiresAt\",\n                    enabled: true\n                }\n            },\n            opts: {\n                protect: params.protect\n            }\n        });\n    }\n});\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAElC,SAASC,eAAe,QAAQ,gBAAgB;AAIhD,OAAO,MAAMC,mBAAmB,GAAGD,eAAe,CAAC;EAC/CE,IAAI,EAAE,mBAAmB;EACzBC,MAAMA,CAACC,GAAc,EAAEC,MAA4B,EAAE;IACjD,OAAOD,GAAG,CAACE,WAAW,CAACP,GAAG,CAACQ,QAAQ,CAACC,KAAK,EAAE;MACvCN,IAAI,EAAE,mBAAmB;MACzBC,MAAM,EAAE;QACJM,UAAU,EAAE,CACR;UAAEP,IAAI,EAAE,IAAI;UAAEQ,IAAI,EAAE;QAAI,CAAC,EACzB;UAAER,IAAI,EAAE,IAAI;UAAEQ,IAAI,EAAE;QAAI,CAAC,EACzB;UAAER,IAAI,EAAE,YAAY;UAAEQ,IAAI,EAAE;QAAI,CAAC,EACjC;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,CACjC;QACDC,WAAW,EAAE,iBAAiB;QAC9BC,OAAO,EAAE,IAAI;QACbC,QAAQ,EAAE,IAAI;QACdC,sBAAsB,EAAE,CACpB;UACIZ,IAAI,EAAE,YAAY;UAClBU,OAAO,EAAE,YAAY;UACrBG,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,CACJ;QACDC,GAAG,EAAE;UACDC,aAAa,EAAE,WAAW;UAC1BC,OAAO,EAAE;QACb;MACJ,CAAC;MACDC,IAAI,EAAE;QACFC,OAAO,EAAEf,MAAM,CAACe;MACpB;IACJ,CAAC,CAAC;EACN;AACJ,CAAC,CAAC","ignoreList":[]}

package/pulumi/apps/core/CoreCognito.d.ts

@@ -0,0 +1,10 @@
+import { type PulumiAppModule } from "@webiny/pulumi";
+export interface CoreCognitoParams {
+    protect: boolean;
+    useEmailAsUsername: boolean;
+}
+export type CoreCognito = PulumiAppModule<typeof CoreCognito>;
+export declare const CoreCognito: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    userPool: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cognito/userPool").UserPool>;
+    userPoolClient: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cognito/userPoolClient").UserPoolClient>;
+}, CoreCognitoParams>;

package/pulumi/apps/core/CoreCognito.js

@@ -0,0 +1,110 @@
+import * as aws from "@pulumi/aws";
+import { createAppModule } from "@webiny/pulumi";
+export const CoreCognito = createAppModule({
+  name: "Cognito",
+  config(app, params) {
+    const userPool = app.addResource(aws.cognito.UserPool, {
+      name: "user-pool",
+      config: {
+        passwordPolicy: {
+          minimumLength: 8,
+          requireLowercase: false,
+          requireNumbers: false,
+          requireSymbols: false,
+          requireUppercase: false,
+          temporaryPasswordValidityDays: 7
+        },
+        adminCreateUserConfig: {
+          allowAdminCreateUserOnly: true
+        },
+        autoVerifiedAttributes: ["email"],
+        emailConfiguration: {
+          emailSendingAccount: "COGNITO_DEFAULT"
+        },
+        // In a legacy setup we use email as username.
+        // We need to provide a way for users to have this setup,
+        // because changing it would require whole cognito pool to be recreated.
+        usernameAttributes: params.useEmailAsUsername ? ["email"] : undefined,
+        aliasAttributes: params.useEmailAsUsername ? undefined : ["preferred_username"],
+        lambdaConfig: {},
+        mfaConfiguration: "OFF",
+        userPoolAddOns: {
+          advancedSecurityMode: "OFF" /* required */
+        },
+        verificationMessageTemplate: {
+          defaultEmailOption: "CONFIRM_WITH_CODE"
+        },
+        accountRecoverySetting: {
+          recoveryMechanisms: [{
+            name: "verified_email",
+            priority: 1
+          }]
+        },
+        schemas: [{
+          attributeDataType: "String",
+          name: "email",
+          required: true,
+          developerOnlyAttribute: false,
+          mutable: true,
+          stringAttributeConstraints: {
+            maxLength: "2048",
+            minLength: "0"
+          }
+        }, {
+          attributeDataType: "String",
+          name: "family_name",
+          required: true,
+          developerOnlyAttribute: false,
+          mutable: true,
+          stringAttributeConstraints: {
+            maxLength: "2048",
+            minLength: "0"
+          }
+        }, {
+          attributeDataType: "String",
+          name: "given_name",
+          required: true,
+          developerOnlyAttribute: false,
+          mutable: true,
+          stringAttributeConstraints: {
+            maxLength: "2048",
+            minLength: "0"
+          }
+        }, {
+          attributeDataType: "String",
+          name: "id",
+          required: false,
+          developerOnlyAttribute: false,
+          mutable: true,
+          stringAttributeConstraints: {
+            maxLength: "36",
+            minLength: "0"
+          }
+        }]
+      },
+      opts: {
+        protect: params.protect
+      }
+    });
+    const userPoolClient = app.addResource(aws.cognito.UserPoolClient, {
+      name: "user-pool-client",
+      config: {
+        userPoolId: userPool.output.id,
+        accessTokenValidity: 60,
+        idTokenValidity: 60,
+        refreshTokenValidity: 30,
+        tokenValidityUnits: {
+          accessToken: "minutes",
+          idToken: "minutes",
+          refreshToken: "days"
+        }
+      }
+    });
+    return {
+      userPool,
+      userPoolClient
+    };
+  }
+});
+
+//# sourceMappingURL=CoreCognito.js.map

package/pulumi/apps/core/CoreCognito.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createAppModule","CoreCognito","name","config","app","params","userPool","addResource","cognito","UserPool","passwordPolicy","minimumLength","requireLowercase","requireNumbers","requireSymbols","requireUppercase","temporaryPasswordValidityDays","adminCreateUserConfig","allowAdminCreateUserOnly","autoVerifiedAttributes","emailConfiguration","emailSendingAccount","usernameAttributes","useEmailAsUsername","undefined","aliasAttributes","lambdaConfig","mfaConfiguration","userPoolAddOns","advancedSecurityMode","verificationMessageTemplate","defaultEmailOption","accountRecoverySetting","recoveryMechanisms","priority","schemas","attributeDataType","required","developerOnlyAttribute","mutable","stringAttributeConstraints","maxLength","minLength","opts","protect","userPoolClient","UserPoolClient","userPoolId","output","id","accessTokenValidity","idTokenValidity","refreshTokenValidity","tokenValidityUnits","accessToken","idToken","refreshToken"],"sources":["CoreCognito.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { createAppModule, type PulumiApp, type PulumiAppModule } from \"@webiny/pulumi\";\n\nexport interface CoreCognitoParams {\n    protect: boolean;\n    useEmailAsUsername: boolean;\n}\n\nexport type CoreCognito = PulumiAppModule<typeof CoreCognito>;\n\nexport const CoreCognito = createAppModule({\n    name: \"Cognito\",\n    config(app: PulumiApp, params: CoreCognitoParams) {\n        const userPool = app.addResource(aws.cognito.UserPool, {\n            name: \"user-pool\",\n            config: {\n                passwordPolicy: {\n                    minimumLength: 8,\n                    requireLowercase: false,\n                    requireNumbers: false,\n                    requireSymbols: false,\n                    requireUppercase: false,\n                    temporaryPasswordValidityDays: 7\n                },\n                adminCreateUserConfig: {\n                    allowAdminCreateUserOnly: true\n                },\n                autoVerifiedAttributes: [\"email\"],\n                emailConfiguration: {\n                    emailSendingAccount: \"COGNITO_DEFAULT\"\n                },\n                // In a legacy setup we use email as username.\n                // We need to provide a way for users to have this setup,\n                // because changing it would require whole cognito pool to be recreated.\n                usernameAttributes: params.useEmailAsUsername ? [\"email\"] : undefined,\n                aliasAttributes: params.useEmailAsUsername ? undefined : [\"preferred_username\"],\n                lambdaConfig: {},\n                mfaConfiguration: \"OFF\",\n                userPoolAddOns: {\n                    advancedSecurityMode: \"OFF\" /* required */\n                },\n                verificationMessageTemplate: {\n                    defaultEmailOption: \"CONFIRM_WITH_CODE\"\n                },\n                accountRecoverySetting: {\n                    recoveryMechanisms: [{ name: \"verified_email\", priority: 1 }]\n                },\n                schemas: [\n                    {\n                        attributeDataType: \"String\",\n                        name: \"email\",\n                        required: true,\n                        developerOnlyAttribute: false,\n                        mutable: true,\n                        stringAttributeConstraints: {\n                            maxLength: \"2048\",\n                            minLength: \"0\"\n                        }\n                    },\n                    {\n                        attributeDataType: \"String\",\n                        name: \"family_name\",\n                        required: true,\n                        developerOnlyAttribute: false,\n                        mutable: true,\n                        stringAttributeConstraints: {\n                            maxLength: \"2048\",\n                            minLength: \"0\"\n                        }\n                    },\n                    {\n                        attributeDataType: \"String\",\n                        name: \"given_name\",\n                        required: true,\n                        developerOnlyAttribute: false,\n                        mutable: true,\n                        stringAttributeConstraints: {\n                            maxLength: \"2048\",\n                            minLength: \"0\"\n                        }\n                    },\n                    {\n                        attributeDataType: \"String\",\n                        name: \"id\",\n                        required: false,\n                        developerOnlyAttribute: false,\n                        mutable: true,\n                        stringAttributeConstraints: {\n                            maxLength: \"36\",\n                            minLength: \"0\"\n                        }\n                    }\n                ]\n            },\n            opts: {\n                protect: params.protect\n            }\n        });\n\n        const userPoolClient = app.addResource(aws.cognito.UserPoolClient, {\n            name: \"user-pool-client\",\n            config: {\n                userPoolId: userPool.output.id,\n                accessTokenValidity: 60,\n                idTokenValidity: 60,\n                refreshTokenValidity: 30,\n                tokenValidityUnits: {\n                    accessToken: \"minutes\",\n                    idToken: \"minutes\",\n                    refreshToken: \"days\"\n                }\n            }\n        });\n\n        return {\n            userPool,\n            userPoolClient\n        };\n    }\n});\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAClC,SAASC,eAAe,QAA8C,gBAAgB;AAStF,OAAO,MAAMC,WAAW,GAAGD,eAAe,CAAC;EACvCE,IAAI,EAAE,SAAS;EACfC,MAAMA,CAACC,GAAc,EAAEC,MAAyB,EAAE;IAC9C,MAAMC,QAAQ,GAAGF,GAAG,CAACG,WAAW,CAACR,GAAG,CAACS,OAAO,CAACC,QAAQ,EAAE;MACnDP,IAAI,EAAE,WAAW;MACjBC,MAAM,EAAE;QACJO,cAAc,EAAE;UACZC,aAAa,EAAE,CAAC;UAChBC,gBAAgB,EAAE,KAAK;UACvBC,cAAc,EAAE,KAAK;UACrBC,cAAc,EAAE,KAAK;UACrBC,gBAAgB,EAAE,KAAK;UACvBC,6BAA6B,EAAE;QACnC,CAAC;QACDC,qBAAqB,EAAE;UACnBC,wBAAwB,EAAE;QAC9B,CAAC;QACDC,sBAAsB,EAAE,CAAC,OAAO,CAAC;QACjCC,kBAAkB,EAAE;UAChBC,mBAAmB,EAAE;QACzB,CAAC;QACD;QACA;QACA;QACAC,kBAAkB,EAAEjB,MAAM,CAACkB,kBAAkB,GAAG,CAAC,OAAO,CAAC,GAAGC,SAAS;QACrEC,eAAe,EAAEpB,MAAM,CAACkB,kBAAkB,GAAGC,SAAS,GAAG,CAAC,oBAAoB,CAAC;QAC/EE,YAAY,EAAE,CAAC,CAAC;QAChBC,gBAAgB,EAAE,KAAK;QACvBC,cAAc,EAAE;UACZC,oBAAoB,EAAE,KAAK,CAAC;QAChC,CAAC;QACDC,2BAA2B,EAAE;UACzBC,kBAAkB,EAAE;QACxB,CAAC;QACDC,sBAAsB,EAAE;UACpBC,kBAAkB,EAAE,CAAC;YAAE/B,IAAI,EAAE,gBAAgB;YAAEgC,QAAQ,EAAE;UAAE,CAAC;QAChE,CAAC;QACDC,OAAO,EAAE,CACL;UACIC,iBAAiB,EAAE,QAAQ;UAC3BlC,IAAI,EAAE,OAAO;UACbmC,QAAQ,EAAE,IAAI;UACdC,sBAAsB,EAAE,KAAK;UAC7BC,OAAO,EAAE,IAAI;UACbC,0BAA0B,EAAE;YACxBC,SAAS,EAAE,MAAM;YACjBC,SAAS,EAAE;UACf;QACJ,CAAC,EACD;UACIN,iBAAiB,EAAE,QAAQ;UAC3BlC,IAAI,EAAE,aAAa;UACnBmC,QAAQ,EAAE,IAAI;UACdC,sBAAsB,EAAE,KAAK;UAC7BC,OAAO,EAAE,IAAI;UACbC,0BAA0B,EAAE;YACxBC,SAAS,EAAE,MAAM;YACjBC,SAAS,EAAE;UACf;QACJ,CAAC,EACD;UACIN,iBAAiB,EAAE,QAAQ;UAC3BlC,IAAI,EAAE,YAAY;UAClBmC,QAAQ,EAAE,IAAI;UACdC,sBAAsB,EAAE,KAAK;UAC7BC,OAAO,EAAE,IAAI;UACbC,0BAA0B,EAAE;YACxBC,SAAS,EAAE,MAAM;YACjBC,SAAS,EAAE;UACf;QACJ,CAAC,EACD;UACIN,iBAAiB,EAAE,QAAQ;UAC3BlC,IAAI,EAAE,IAAI;UACVmC,QAAQ,EAAE,KAAK;UACfC,sBAAsB,EAAE,KAAK;UAC7BC,OAAO,EAAE,IAAI;UACbC,0BAA0B,EAAE;YACxBC,SAAS,EAAE,IAAI;YACfC,SAAS,EAAE;UACf;QACJ,CAAC;MAET,CAAC;MACDC,IAAI,EAAE;QACFC,OAAO,EAAEvC,MAAM,CAACuC;MACpB;IACJ,CAAC,CAAC;IAEF,MAAMC,cAAc,GAAGzC,GAAG,CAACG,WAAW,CAACR,GAAG,CAACS,OAAO,CAACsC,cAAc,EAAE;MAC/D5C,IAAI,EAAE,kBAAkB;MACxBC,MAAM,EAAE;QACJ4C,UAAU,EAAEzC,QAAQ,CAAC0C,MAAM,CAACC,EAAE;QAC9BC,mBAAmB,EAAE,EAAE;QACvBC,eAAe,EAAE,EAAE;QACnBC,oBAAoB,EAAE,EAAE;QACxBC,kBAAkB,EAAE;UAChBC,WAAW,EAAE,SAAS;UACtBC,OAAO,EAAE,SAAS;UAClBC,YAAY,EAAE;QAClB;MACJ;IACJ,CAAC,CAAC;IAEF,OAAO;MACHlD,QAAQ;MACRuC;IACJ,CAAC;EACL;AACJ,CAAC,CAAC","ignoreList":[]}

package/pulumi/apps/core/CoreDynamo.d.ts

@@ -0,0 +1,5 @@
+import { type PulumiAppModule } from "@webiny/pulumi";
+export type CoreDynamo = PulumiAppModule<typeof CoreDynamo>;
+export declare const CoreDynamo: import("@webiny/pulumi").PulumiAppModuleDefinition<import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/dynamodb/table").Table>, {
+    protect: boolean;
+}>;

package/pulumi/apps/core/CoreDynamo.js

@@ -0,0 +1,61 @@
+import * as aws from "@pulumi/aws";
+import { createAppModule } from "@webiny/pulumi";
+export const CoreDynamo = createAppModule({
+  name: "DynamoDb",
+  config(app, params) {
+    return app.addResource(aws.dynamodb.Table, {
+      name: "webiny",
+      config: {
+        attributes: [{
+          name: "PK",
+          type: "S"
+        }, {
+          name: "SK",
+          type: "S"
+        }, {
+          name: "GSI_TENANT",
+          type: "S"
+        }, {
+          name: "GSI1_PK",
+          type: "S"
+        }, {
+          name: "GSI1_SK",
+          type: "S"
+        }, {
+          name: "GSI2_PK",
+          type: "S"
+        }, {
+          name: "GSI2_SK",
+          type: "S"
+        }],
+        billingMode: "PAY_PER_REQUEST",
+        hashKey: "PK",
+        rangeKey: "SK",
+        globalSecondaryIndexes: [{
+          name: "GSI_TENANT",
+          hashKey: "GSI_TENANT",
+          projectionType: "KEYS_ONLY"
+        }, {
+          name: "GSI1",
+          hashKey: "GSI1_PK",
+          rangeKey: "GSI1_SK",
+          projectionType: "ALL"
+        }, {
+          name: "GSI2",
+          hashKey: "GSI2_PK",
+          rangeKey: "GSI2_SK",
+          projectionType: "ALL"
+        }],
+        ttl: {
+          attributeName: "expiresAt",
+          enabled: true
+        }
+      },
+      opts: {
+        protect: params.protect
+      }
+    });
+  }
+});
+
+//# sourceMappingURL=CoreDynamo.js.map

package/pulumi/apps/core/CoreDynamo.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createAppModule","CoreDynamo","name","config","app","params","addResource","dynamodb","Table","attributes","type","billingMode","hashKey","rangeKey","globalSecondaryIndexes","projectionType","ttl","attributeName","enabled","opts","protect"],"sources":["CoreDynamo.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { createAppModule, type PulumiApp, type PulumiAppModule } from \"@webiny/pulumi\";\n\nexport type CoreDynamo = PulumiAppModule<typeof CoreDynamo>;\n\nexport const CoreDynamo = createAppModule({\n    name: \"DynamoDb\",\n    config(app: PulumiApp, params: { protect: boolean }) {\n        return app.addResource(aws.dynamodb.Table, {\n            name: \"webiny\",\n            config: {\n                attributes: [\n                    { name: \"PK\", type: \"S\" },\n                    { name: \"SK\", type: \"S\" },\n                    { name: \"GSI_TENANT\", type: \"S\" },\n                    { name: \"GSI1_PK\", type: \"S\" },\n                    { name: \"GSI1_SK\", type: \"S\" },\n                    { name: \"GSI2_PK\", type: \"S\" },\n                    { name: \"GSI2_SK\", type: \"S\" }\n                ],\n                billingMode: \"PAY_PER_REQUEST\",\n                hashKey: \"PK\",\n                rangeKey: \"SK\",\n                globalSecondaryIndexes: [\n                    {\n                        name: \"GSI_TENANT\",\n                        hashKey: \"GSI_TENANT\",\n                        projectionType: \"KEYS_ONLY\"\n                    },\n                    {\n                        name: \"GSI1\",\n                        hashKey: \"GSI1_PK\",\n                        rangeKey: \"GSI1_SK\",\n                        projectionType: \"ALL\"\n                    },\n                    {\n                        name: \"GSI2\",\n                        hashKey: \"GSI2_PK\",\n                        rangeKey: \"GSI2_SK\",\n                        projectionType: \"ALL\"\n                    }\n                ],\n                ttl: {\n                    attributeName: \"expiresAt\",\n                    enabled: true\n                }\n            },\n            opts: {\n                protect: params.protect\n            }\n        });\n    }\n});\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAClC,SAASC,eAAe,QAA8C,gBAAgB;AAItF,OAAO,MAAMC,UAAU,GAAGD,eAAe,CAAC;EACtCE,IAAI,EAAE,UAAU;EAChBC,MAAMA,CAACC,GAAc,EAAEC,MAA4B,EAAE;IACjD,OAAOD,GAAG,CAACE,WAAW,CAACP,GAAG,CAACQ,QAAQ,CAACC,KAAK,EAAE;MACvCN,IAAI,EAAE,QAAQ;MACdC,MAAM,EAAE;QACJM,UAAU,EAAE,CACR;UAAEP,IAAI,EAAE,IAAI;UAAEQ,IAAI,EAAE;QAAI,CAAC,EACzB;UAAER,IAAI,EAAE,IAAI;UAAEQ,IAAI,EAAE;QAAI,CAAC,EACzB;UAAER,IAAI,EAAE,YAAY;UAAEQ,IAAI,EAAE;QAAI,CAAC,EACjC;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,EAC9B;UAAER,IAAI,EAAE,SAAS;UAAEQ,IAAI,EAAE;QAAI,CAAC,CACjC;QACDC,WAAW,EAAE,iBAAiB;QAC9BC,OAAO,EAAE,IAAI;QACbC,QAAQ,EAAE,IAAI;QACdC,sBAAsB,EAAE,CACpB;UACIZ,IAAI,EAAE,YAAY;UAClBU,OAAO,EAAE,YAAY;UACrBG,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,EACD;UACIb,IAAI,EAAE,MAAM;UACZU,OAAO,EAAE,SAAS;UAClBC,QAAQ,EAAE,SAAS;UACnBE,cAAc,EAAE;QACpB,CAAC,CACJ;QACDC,GAAG,EAAE;UACDC,aAAa,EAAE,WAAW;UAC1BC,OAAO,EAAE;QACb;MACJ,CAAC;MACDC,IAAI,EAAE;QACFC,OAAO,EAAEf,MAAM,CAACe;MACpB;IACJ,CAAC,CAAC;EACN;AACJ,CAAC,CAAC","ignoreList":[]}

package/pulumi/apps/core/CoreEventBus.d.ts

@@ -0,0 +1 @@
+export declare const CoreEventBus: import("@webiny/pulumi").PulumiAppModuleDefinition<import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch/eventBus").EventBus>, void>;

package/pulumi/apps/core/CoreEventBus.js

@@ -0,0 +1,13 @@
+import * as aws from "@pulumi/aws";
+import { createAppModule } from "@webiny/pulumi";
+export const CoreEventBus = createAppModule({
+  name: "CoreEventBus",
+  config(app) {
+    return app.addResource(aws.cloudwatch.EventBus, {
+      name: "event-bus",
+      config: {}
+    });
+  }
+});
+
+//# sourceMappingURL=CoreEventBus.js.map

package/pulumi/apps/core/CoreEventBus.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createAppModule","CoreEventBus","name","config","app","addResource","cloudwatch","EventBus"],"sources":["CoreEventBus.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { createAppModule, type PulumiApp } from \"@webiny/pulumi\";\n\nexport const CoreEventBus = createAppModule({\n    name: \"CoreEventBus\",\n    config(app: PulumiApp) {\n        return app.addResource(aws.cloudwatch.EventBus, {\n            name: \"event-bus\",\n            config: {}\n        });\n    }\n});\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAClC,SAASC,eAAe,QAAwB,gBAAgB;AAEhE,OAAO,MAAMC,YAAY,GAAGD,eAAe,CAAC;EACxCE,IAAI,EAAE,cAAc;EACpBC,MAAMA,CAACC,GAAc,EAAE;IACnB,OAAOA,GAAG,CAACC,WAAW,CAACN,GAAG,CAACO,UAAU,CAACC,QAAQ,EAAE;MAC5CL,IAAI,EAAE,WAAW;MACjBC,MAAM,EAAE,CAAC;IACb,CAAC,CAAC;EACN;AACJ,CAAC,CAAC","ignoreList":[]}

package/pulumi/apps/core/CoreFileManager.d.ts

@@ -0,0 +1,8 @@
+import { type PulumiAppModule } from "@webiny/pulumi";
+export type CoreFileManger = PulumiAppModule<typeof CoreFileManger>;
+export declare const CoreFileManger: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    bucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket").Bucket>;
+    blockPublicAccessBlock: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPublicAccessBlock").BucketPublicAccessBlock>;
+}, {
+    protect: boolean;
+}>;

package/pulumi/apps/core/CoreFileManager.js

@@ -0,0 +1,44 @@
+import * as aws from "@pulumi/aws";
+import { createAppModule } from "@webiny/pulumi";
+export const CoreFileManger = createAppModule({
+  name: "FileManagerBucket",
+  config(app, params) {
+    const name = "fm-bucket";
+    const bucket = app.addResource(aws.s3.Bucket, {
+      name,
+      config: {
+        acl: aws.s3.CannedAcl.Private,
+        // We definitely don't want to force-destroy if "protected" flag is true.
+        forceDestroy: !params.protect,
+        // We need these rules to be able to upload to this bucket from the browser.
+        corsRules: [{
+          allowedHeaders: ["*"],
+          allowedMethods: ["POST", "GET", "PUT"],
+          allowedOrigins: ["*"],
+          maxAgeSeconds: 3000
+        }]
+      },
+      opts: {
+        protect: params.protect
+      }
+    });
+
+    // Block any public access
+    const blockPublicAccessBlock = app.addResource(aws.s3.BucketPublicAccessBlock, {
+      name: `${name}-block-public-access`,
+      config: {
+        bucket: bucket.output.id,
+        blockPublicAcls: true,
+        blockPublicPolicy: true,
+        ignorePublicAcls: true,
+        restrictPublicBuckets: true
+      }
+    });
+    return {
+      bucket,
+      blockPublicAccessBlock
+    };
+  }
+});
+
+//# sourceMappingURL=CoreFileManager.js.map

package/pulumi/apps/core/CoreFileManager.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["aws","createAppModule","CoreFileManger","name","config","app","params","bucket","addResource","s3","Bucket","acl","CannedAcl","Private","forceDestroy","protect","corsRules","allowedHeaders","allowedMethods","allowedOrigins","maxAgeSeconds","opts","blockPublicAccessBlock","BucketPublicAccessBlock","output","id","blockPublicAcls","blockPublicPolicy","ignorePublicAcls","restrictPublicBuckets"],"sources":["CoreFileManager.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { createAppModule, type PulumiApp, type PulumiAppModule } from \"@webiny/pulumi\";\n\nexport type CoreFileManger = PulumiAppModule<typeof CoreFileManger>;\n\nexport const CoreFileManger = createAppModule({\n    name: \"FileManagerBucket\",\n    config(app: PulumiApp, params: { protect: boolean }) {\n        const name = \"fm-bucket\";\n\n        const bucket = app.addResource(aws.s3.Bucket, {\n            name,\n            config: {\n                acl: aws.s3.CannedAcl.Private,\n                // We definitely don't want to force-destroy if \"protected\" flag is true.\n                forceDestroy: !params.protect,\n                // We need these rules to be able to upload to this bucket from the browser.\n                corsRules: [\n                    {\n                        allowedHeaders: [\"*\"],\n                        allowedMethods: [\"POST\", \"GET\", \"PUT\"],\n                        allowedOrigins: [\"*\"],\n                        maxAgeSeconds: 3000\n                    }\n                ]\n            },\n            opts: {\n                protect: params.protect\n            }\n        });\n\n        // Block any public access\n        const blockPublicAccessBlock = app.addResource(aws.s3.BucketPublicAccessBlock, {\n            name: `${name}-block-public-access`,\n            config: {\n                bucket: bucket.output.id,\n                blockPublicAcls: true,\n                blockPublicPolicy: true,\n                ignorePublicAcls: true,\n                restrictPublicBuckets: true\n            }\n        });\n\n        return {\n            bucket,\n            blockPublicAccessBlock\n        };\n    }\n});\n"],"mappings":"AAAA,OAAO,KAAKA,GAAG,MAAM,aAAa;AAClC,SAASC,eAAe,QAA8C,gBAAgB;AAItF,OAAO,MAAMC,cAAc,GAAGD,eAAe,CAAC;EAC1CE,IAAI,EAAE,mBAAmB;EACzBC,MAAMA,CAACC,GAAc,EAAEC,MAA4B,EAAE;IACjD,MAAMH,IAAI,GAAG,WAAW;IAExB,MAAMI,MAAM,GAAGF,GAAG,CAACG,WAAW,CAACR,GAAG,CAACS,EAAE,CAACC,MAAM,EAAE;MAC1CP,IAAI;MACJC,MAAM,EAAE;QACJO,GAAG,EAAEX,GAAG,CAACS,EAAE,CAACG,SAAS,CAACC,OAAO;QAC7B;QACAC,YAAY,EAAE,CAACR,MAAM,CAACS,OAAO;QAC7B;QACAC,SAAS,EAAE,CACP;UACIC,cAAc,EAAE,CAAC,GAAG,CAAC;UACrBC,cAAc,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;UACtCC,cAAc,EAAE,CAAC,GAAG,CAAC;UACrBC,aAAa,EAAE;QACnB,CAAC;MAET,CAAC;MACDC,IAAI,EAAE;QACFN,OAAO,EAAET,MAAM,CAACS;MACpB;IACJ,CAAC,CAAC;;IAEF;IACA,MAAMO,sBAAsB,GAAGjB,GAAG,CAACG,WAAW,CAACR,GAAG,CAACS,EAAE,CAACc,uBAAuB,EAAE;MAC3EpB,IAAI,EAAE,GAAGA,IAAI,sBAAsB;MACnCC,MAAM,EAAE;QACJG,MAAM,EAAEA,MAAM,CAACiB,MAAM,CAACC,EAAE;QACxBC,eAAe,EAAE,IAAI;QACrBC,iBAAiB,EAAE,IAAI;QACvBC,gBAAgB,EAAE,IAAI;QACtBC,qBAAqB,EAAE;MAC3B;IACJ,CAAC,CAAC;IAEF,OAAO;MACHtB,MAAM;MACNe;IACJ,CAAC;EACL;AACJ,CAAC,CAAC","ignoreList":[]}

package/pulumi/apps/core/CoreOpenSearch.d.ts

@@ -0,0 +1,16 @@
+import * as aws from "@pulumi/aws";
+import { type PulumiAppRemoteResource, type PulumiAppResource, type PulumiAppResourceConstructor } from "@webiny/pulumi";
+export interface OpenSearchParams {
+    protect: boolean;
+}
+export declare const OpenSearch: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    domain: PulumiAppResource<PulumiAppResourceConstructor<import("@pulumi/aws/opensearch/domain.js").Domain, any>> | PulumiAppRemoteResource<aws.opensearch.GetDomainResult>;
+    domainPolicy: PulumiAppResource<typeof import("@pulumi/aws/opensearch/domainPolicy.js").DomainPolicy> | undefined;
+    table: PulumiAppResource<typeof import("@pulumi/aws/dynamodb/table.js").Table>;
+    dynamoToElastic: {
+        role: PulumiAppResource<typeof import("@pulumi/aws/iam/role.js").Role>;
+        policy: PulumiAppResource<typeof import("@pulumi/aws/iam/policy.js").Policy>;
+        lambda: PulumiAppResource<typeof import("@pulumi/aws/lambda/function.js").Function>;
+        eventSourceMapping: PulumiAppResource<typeof import("@pulumi/aws/lambda/eventSourceMapping.js").EventSourceMapping>;
+    };
+}, OpenSearchParams>;

package/pulumi/apps/core/CoreOpenSearch.js

@@ -0,0 +1,299 @@
+/**
+ * Important documents to read:
+ *
+ * https://docs.aws.amazon.com/opensearch-service/latest/developerguide/limits.html#network-limits
+ */
+import path from "path";
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import * as random from "@pulumi/random";
+import { createAppModule } from "@webiny/pulumi";
+import { getAwsAccountId } from "../awsUtils.js";
+import { CoreVpc } from "./CoreVpc.js";
+import { LAMBDA_RUNTIME } from "../../constants.js";
+import { LogDynamo } from "./LogDynamo.js";
+function getDevClusterConfig() {
+  return {
+    instanceType: "t3.small.search"
+  };
+}
+function getProdClusterConfig() {
+  return {
+    // For production deployments, we create 3 instances and configure multi-AZ across 3 zones.
+    instanceType: "t3.medium.search",
+    instanceCount: 3,
+    zoneAwarenessEnabled: true,
+    zoneAwarenessConfig: {
+      availabilityZoneCount: 3
+    }
+  };
+}
+const OS_ENGINE_VERSION = "OpenSearch_3.3";
+export const OpenSearch = createAppModule({
+  name: "OpenSearch",
+  config(app, params) {
+    const isProduction = app.env.isProduction;
+    const vpc = app.getModule(CoreVpc, {
+      optional: true
+    });
+    const logDynamoDbTable = app.getModule(LogDynamo);
+
+    // This needs to be implemented in order to be able to use a shared OpenSearch cluster.
+    let domain;
+    let domainPolicy;
+    if (process.env.AWS_OS_DOMAIN_NAME) {
+      const domainName = String(process.env.AWS_OS_DOMAIN_NAME);
+      // This can be useful for testing purposes in ephemeral environments. More information here:
+      // https://www.webiny.com/docs/key-topics/ci-cd/testing/slow-ephemeral-environments
+      domain = app.addRemoteResource(domainName, () => {
+        return aws.opensearch.getDomain({
+          domainName
+        }, {
+          async: true
+        });
+      });
+    } else {
+      const randomId = new random.RandomId("osDomainRandomId", {
+        byteLength: 8
+      });
+      const namePrefix = app.getParam(app.params.create.pulumiResourceNamePrefix) || "";
+      const domainLogicalName = "webiny-js";
+      const domainPhysicalName = randomId.hex.apply(hex => {
+        return `${namePrefix}${domainLogicalName}-${hex.slice(-7)}`;
+      });
+      domain = app.addResource(aws.opensearch.Domain, {
+        name: domainLogicalName,
+        config: {
+          domainName: domainPhysicalName,
+          engineVersion: OS_ENGINE_VERSION,
+          clusterConfig: isProduction ? getProdClusterConfig() : getDevClusterConfig(),
+          vpcOptions: vpc ? {
+            subnetIds: vpc.subnets.private.map(s => s.output.id),
+            securityGroupIds: [vpc.vpc.output.defaultSecurityGroupId]
+          } : undefined,
+          ebsOptions: {
+            ebsEnabled: true,
+            volumeSize: 10,
+            volumeType: "gp2"
+          },
+          advancedOptions: {
+            "rest.action.multi.allow_explicit_index": "true"
+          },
+          snapshotOptions: {
+            automatedSnapshotStartHour: 23
+          }
+        },
+        opts: {
+          protect: params.protect
+        }
+      });
+
+      /**
+       * Domain policy defines who can access your OpenSearch Domain.
+       * For details on OpenSearch security, read the official documentation:
+       * https://docs.aws.amazon.com/openSearch-service/latest/developerguide/security.html
+       */
+      const accountId = getAwsAccountId(app);
+      domainPolicy = app.addResource(aws.opensearch.DomainPolicy, {
+        name: `${domainLogicalName}-policy`,
+        config: {
+          domainName: domain.output.domainName,
+          accessPolicies: pulumi.all([accountId, domain.output.arn]).apply(([accountId, domainArn]) => {
+            return JSON.stringify({
+              Version: "2012-10-17",
+              Statement: [
+              /**
+               * Allow requests signed with current account
+               */
+              {
+                Effect: "Allow",
+                Principal: {
+                  AWS: accountId
+                },
+                Action: "es:*",
+                Resource: `${domainArn}/*`
+              }]
+            });
+          })
+        },
+        opts: {
+          protect: params.protect
+        }
+      });
+    }
+
+    /**
+     * Create a table for OpenSearch records. All ES records are stored in this table to dramatically improve
+     * performance and stability on write operations (especially massive data imports). This table also serves as a backup and
+     * a single source of truth for your OpenSearch domain. Streaming is enabled on this table, and it will
+     * allow asynchronous synchronization of data with OpenSearch domain.
+     */
+    const table = app.addResource(aws.dynamodb.Table, {
+      name: "webiny-es",
+      config: {
+        attributes: [{
+          name: "PK",
+          type: "S"
+        }, {
+          name: "SK",
+          type: "S"
+        }, {
+          name: "GSI_TENANT",
+          type: "S"
+        }],
+        streamEnabled: true,
+        streamViewType: "NEW_AND_OLD_IMAGES",
+        billingMode: "PAY_PER_REQUEST",
+        hashKey: "PK",
+        rangeKey: "SK",
+        globalSecondaryIndexes: [{
+          name: "GSI_TENANT",
+          hashKey: "GSI_TENANT",
+          projectionType: "KEYS_ONLY"
+        }],
+        ttl: {
+          attributeName: "expiresAt",
+          enabled: true
+        }
+      },
+      opts: {
+        protect: params.protect
+      }
+    });
+    const roleName = "dynamo-to-elastic-lambda-role";
+    const role = app.addResource(aws.iam.Role, {
+      name: roleName,
+      config: {
+        assumeRolePolicy: {
+          Version: "2012-10-17",
+          Statement: [{
+            Action: "sts:AssumeRole",
+            Principal: {
+              Service: "lambda.amazonaws.com"
+            },
+            Effect: "Allow"
+          }]
+        }
+      },
+      meta: {
+        isLambdaFunctionRole: true
+      }
+    });
+    const policy = getDynamoDbToElasticLambdaPolicy(app, domain.output);
+    app.addResource(aws.iam.RolePolicyAttachment, {
+      name: `${roleName}-DynamoDbToElasticLambdaPolicy`,
+      config: {
+        role: role.output,
+        policyArn: policy.output.arn
+      }
+    });
+
+    // Only use `AWSLambdaVPCAccessExecutionRole` policy if VPC feature is enabled.
+    if (vpc) {
+      app.addResource(aws.iam.RolePolicyAttachment, {
+        name: `${roleName}-AWSLambdaVPCAccessExecutionRole`,
+        config: {
+          role: role.output,
+          policyArn: aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole
+        }
+      });
+    } else {
+      app.addResource(aws.iam.RolePolicyAttachment, {
+        name: `${roleName}-AWSLambdaBasicExecutionRole`,
+        config: {
+          role: role.output,
+          policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole
+        }
+      });
+    }
+    app.addResource(aws.iam.RolePolicyAttachment, {
+      name: `${roleName}-AWSLambdaDynamoDBExecutionRole`,
+      config: {
+        role: role.output,
+        policyArn: aws.iam.ManagedPolicy.AWSLambdaDynamoDBExecutionRole
+      }
+    });
+
+    /**
+     * This Lambda will process the stream events from DynamoDB table that contains OpenSearch items.
+     * OpenSearch can't take large amount of individual writes in a short period of time, so this way
+     * we store data for OpenSearch in a DynamoDB table, and asynchronously insert it into OpenSearch
+     * using batching.
+     */
+    const lambda = app.addResource(aws.lambda.Function, {
+      name: "dynamo-to-elastic",
+      config: {
+        role: role.output.arn,
+        runtime: LAMBDA_RUNTIME,
+        handler: "handler.handler",
+        timeout: 900,
+        memorySize: 1024,
+        environment: {
+          variables: {
+            DEBUG: String(process.env.DEBUG),
+            OPENSEARCH_ENDPOINT: domain.output.endpoint,
+            DB_TABLE_LOG: logDynamoDbTable.output.name
+          }
+        },
+        description: "Process DynamoDB Stream.",
+        code: new pulumi.asset.AssetArchive({
+          ".": new pulumi.asset.FileArchive(path.join(app.paths.workspace, "dynamoToElastic/build"))
+        }),
+        vpcConfig: vpc ? {
+          subnetIds: vpc.subnets.private.map(s => s.output.id),
+          securityGroupIds: [vpc.vpc.output.defaultSecurityGroupId]
+        } : undefined,
+        loggingConfig: {
+          logFormat: "JSON"
+        }
+      }
+    });
+    const eventSourceMapping = app.addResource(aws.lambda.EventSourceMapping, {
+      name: "dynamo-to-elastic",
+      config: {
+        eventSourceArn: table.output.streamArn,
+        functionName: lambda.output.arn,
+        startingPosition: "LATEST",
+        maximumRetryAttempts: 3,
+        batchSize: 50,
+        maximumBatchingWindowInSeconds: 1
+      }
+    });
+    app.addOutputs({
+      opensearchDomainArn: domain.output.arn,
+      opensearchDomainEndpoint: domain.output.endpoint,
+      opensearchDynamodbTableArn: table.output.arn,
+      opensearchDynamodbTableName: table.output.name
+    });
+    return {
+      domain,
+      domainPolicy,
+      table,
+      dynamoToElastic: {
+        role,
+        policy,
+        lambda,
+        eventSourceMapping
+      }
+    };
+  }
+});
+function getDynamoDbToElasticLambdaPolicy(app, domain) {
+  return app.addResource(aws.iam.Policy, {
+    name: "DynamoDbToElasticLambdaPolicy-updated",
+    config: {
+      description: "This policy enables access to ES and Dynamodb streams",
+      policy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Sid: "PermissionForES",
+          Effect: "Allow",
+          Action: ["es:ESHttpGet", "es:ESHttpDelete", "es:ESHttpPatch", "es:ESHttpPost", "es:ESHttpPut", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:UpdateItem"],
+          Resource: [pulumi.interpolate`${domain.arn}`, pulumi.interpolate`${domain.arn}/*`]
+        }]
+      }
+    }
+  });
+}
+
+//# sourceMappingURL=CoreOpenSearch.js.map