@webiny/pulumi-aws 0.0.0-ee-vpcs.549378cf03

package/apps/api/ApiGateway.js

@@ -0,0 +1,88 @@
+"use strict";
+
+var _interopRequireWildcard = require("@babel/runtime/helpers/interopRequireWildcard").default;
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ApiGateway = void 0;
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+var _pulumi = require("@webiny/pulumi");
+
+const ApiGateway = (0, _pulumi.createAppModule)({
+  name: "ApiGateway",
+
+  config(app, routesConfig) {
+    const api = app.addResource(aws.apigatewayv2.Api, {
+      name: "api-gateway",
+      config: {
+        protocolType: "HTTP",
+        description: "Main API gateway"
+      }
+    });
+    const stage = app.addResource(aws.apigatewayv2.Stage, {
+      name: "default",
+      config: {
+        apiId: api.output.id,
+        autoDeploy: true
+      }
+    });
+    const routes = {};
+
+    for (const name of Object.keys(routesConfig)) {
+      addRoute(name, routesConfig[name]);
+    }
+
+    return {
+      api,
+      stage,
+      routes,
+      addRoute
+    };
+
+    function addRoute(name, params) {
+      const route = createRoute(app, api.output, name, params);
+      routes[name] = route;
+    }
+  }
+
+});
+exports.ApiGateway = ApiGateway;
+
+function createRoute(app, api, name, params) {
+  const integration = app.addResource(aws.apigatewayv2.Integration, {
+    name: name,
+    config: {
+      description: "GraphQL API Integration",
+      apiId: api.id,
+      integrationType: "AWS_PROXY",
+      integrationMethod: params.method,
+      integrationUri: params.function,
+      passthroughBehavior: "WHEN_NO_MATCH"
+    }
+  });
+  const route = app.addResource(aws.apigatewayv2.Route, {
+    name: name,
+    config: {
+      apiId: api.id,
+      routeKey: `${params.method} ${params.path}`,
+      target: integration.output.id.apply(value => `integrations/${value}`)
+    }
+  });
+  const permission = app.addResource(aws.lambda.Permission, {
+    name: `allow-${name}`,
+    config: {
+      action: "lambda:InvokeFunction",
+      function: params.function,
+      principal: "apigateway.amazonaws.com",
+      sourceArn: api.executionArn.apply(arn => `${arn}/*/*${params.path}`)
+    }
+  });
+  return {
+    integration,
+    route,
+    permission
+  };
+}

package/apps/api/ApiGateway.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ApiGateway","createAppModule","name","config","app","routesConfig","api","addResource","aws","apigatewayv2","Api","protocolType","description","stage","Stage","apiId","output","id","autoDeploy","routes","Object","keys","addRoute","params","route","createRoute","integration","Integration","integrationType","integrationMethod","method","integrationUri","function","passthroughBehavior","Route","routeKey","path","target","apply","value","permission","lambda","Permission","action","principal","sourceArn","executionArn","arn"],"sources":["ApiGateway.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { createAppModule, PulumiApp, PulumiAppModule } from \"@webiny/pulumi\";\n\nexport interface ApiRouteParams {\n    path: pulumi.Input<string>;\n    method: pulumi.Input<string>;\n    function: pulumi.Input<string>;\n}\n\nexport type ApiGateway = PulumiAppModule<typeof ApiGateway>;\n\nexport const ApiGateway = createAppModule({\n    name: \"ApiGateway\",\n    config(app: PulumiApp, routesConfig: Record<string, ApiRouteParams>) {\n        const api = app.addResource(aws.apigatewayv2.Api, {\n            name: \"api-gateway\",\n            config: {\n                protocolType: \"HTTP\",\n                description: \"Main API gateway\"\n            }\n        });\n\n        const stage = app.addResource(aws.apigatewayv2.Stage, {\n            name: \"default\",\n            config: {\n                apiId: api.output.id,\n                autoDeploy: true\n            }\n        });\n\n        const routes: Record<string, ReturnType<typeof createRoute>> = {};\n\n        for (const name of Object.keys(routesConfig)) {\n            addRoute(name, routesConfig[name]);\n        }\n\n        return {\n            api,\n            stage,\n            routes,\n            addRoute\n        };\n\n        function addRoute(name: string, params: ApiRouteParams) {\n            const route = createRoute(app, api.output, name, params);\n            routes[name] = route;\n        }\n    }\n});\n\nfunction createRoute(\n    app: PulumiApp,\n    api: pulumi.Output<aws.apigatewayv2.Api>,\n    name: string,\n    params: ApiRouteParams\n) {\n    const integration = app.addResource(aws.apigatewayv2.Integration, {\n        name: name,\n        config: {\n            description: \"GraphQL API Integration\",\n            apiId: api.id,\n            integrationType: \"AWS_PROXY\",\n            integrationMethod: params.method,\n            integrationUri: params.function,\n            passthroughBehavior: \"WHEN_NO_MATCH\"\n        }\n    });\n\n    const route = app.addResource(aws.apigatewayv2.Route, {\n        name: name,\n        config: {\n            apiId: api.id,\n            routeKey: `${params.method} ${params.path}`,\n            target: integration.output.id.apply(value => `integrations/${value}`)\n        }\n    });\n\n    const permission = app.addResource(aws.lambda.Permission, {\n        name: `allow-${name}`,\n        config: {\n            action: \"lambda:InvokeFunction\",\n            function: params.function,\n            principal: \"apigateway.amazonaws.com\",\n            sourceArn: api.executionArn.apply(arn => `${arn}/*/*${params.path}`)\n        }\n    });\n\n    return {\n        integration,\n        route,\n        permission\n    };\n}\n"],"mappings":";;;;;;;;;AAAA;;AAEA;;AAUO,MAAMA,UAAU,GAAG,IAAAC,uBAAA,EAAgB;EACtCC,IAAI,EAAE,YADgC;;EAEtCC,MAAM,CAACC,GAAD,EAAiBC,YAAjB,EAA+D;IACjE,MAAMC,GAAG,GAAGF,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,YAAJ,CAAiBC,GAAjC,EAAsC;MAC9CR,IAAI,EAAE,aADwC;MAE9CC,MAAM,EAAE;QACJQ,YAAY,EAAE,MADV;QAEJC,WAAW,EAAE;MAFT;IAFsC,CAAtC,CAAZ;IAQA,MAAMC,KAAK,GAAGT,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,YAAJ,CAAiBK,KAAjC,EAAwC;MAClDZ,IAAI,EAAE,SAD4C;MAElDC,MAAM,EAAE;QACJY,KAAK,EAAET,GAAG,CAACU,MAAJ,CAAWC,EADd;QAEJC,UAAU,EAAE;MAFR;IAF0C,CAAxC,CAAd;IAQA,MAAMC,MAAsD,GAAG,EAA/D;;IAEA,KAAK,MAAMjB,IAAX,IAAmBkB,MAAM,CAACC,IAAP,CAAYhB,YAAZ,CAAnB,EAA8C;MAC1CiB,QAAQ,CAACpB,IAAD,EAAOG,YAAY,CAACH,IAAD,CAAnB,CAAR;IACH;;IAED,OAAO;MACHI,GADG;MAEHO,KAFG;MAGHM,MAHG;MAIHG;IAJG,CAAP;;IAOA,SAASA,QAAT,CAAkBpB,IAAlB,EAAgCqB,MAAhC,EAAwD;MACpD,MAAMC,KAAK,GAAGC,WAAW,CAACrB,GAAD,EAAME,GAAG,CAACU,MAAV,EAAkBd,IAAlB,EAAwBqB,MAAxB,CAAzB;MACAJ,MAAM,CAACjB,IAAD,CAAN,GAAesB,KAAf;IACH;EACJ;;AApCqC,CAAhB,CAAnB;;;AAuCP,SAASC,WAAT,CACIrB,GADJ,EAEIE,GAFJ,EAGIJ,IAHJ,EAIIqB,MAJJ,EAKE;EACE,MAAMG,WAAW,GAAGtB,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,YAAJ,CAAiBkB,WAAjC,EAA8C;IAC9DzB,IAAI,EAAEA,IADwD;IAE9DC,MAAM,EAAE;MACJS,WAAW,EAAE,yBADT;MAEJG,KAAK,EAAET,GAAG,CAACW,EAFP;MAGJW,eAAe,EAAE,WAHb;MAIJC,iBAAiB,EAAEN,MAAM,CAACO,MAJtB;MAKJC,cAAc,EAAER,MAAM,CAACS,QALnB;MAMJC,mBAAmB,EAAE;IANjB;EAFsD,CAA9C,CAApB;EAYA,MAAMT,KAAK,GAAGpB,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,YAAJ,CAAiByB,KAAjC,EAAwC;IAClDhC,IAAI,EAAEA,IAD4C;IAElDC,MAAM,EAAE;MACJY,KAAK,EAAET,GAAG,CAACW,EADP;MAEJkB,QAAQ,EAAG,GAAEZ,MAAM,CAACO,MAAO,IAAGP,MAAM,CAACa,IAAK,EAFtC;MAGJC,MAAM,EAAEX,WAAW,CAACV,MAAZ,CAAmBC,EAAnB,CAAsBqB,KAAtB,CAA4BC,KAAK,IAAK,gBAAeA,KAAM,EAA3D;IAHJ;EAF0C,CAAxC,CAAd;EASA,MAAMC,UAAU,GAAGpC,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACiC,MAAJ,CAAWC,UAA3B,EAAuC;IACtDxC,IAAI,EAAG,SAAQA,IAAK,EADkC;IAEtDC,MAAM,EAAE;MACJwC,MAAM,EAAE,uBADJ;MAEJX,QAAQ,EAAET,MAAM,CAACS,QAFb;MAGJY,SAAS,EAAE,0BAHP;MAIJC,SAAS,EAAEvC,GAAG,CAACwC,YAAJ,CAAiBR,KAAjB,CAAuBS,GAAG,IAAK,GAAEA,GAAI,OAAMxB,MAAM,CAACa,IAAK,EAAvD;IAJP;EAF8C,CAAvC,CAAnB;EAUA,OAAO;IACHV,WADG;IAEHF,KAFG;IAGHgB;EAHG,CAAP;AAKH"}

package/apps/api/ApiGraphql.d.ts

@@ -0,0 +1,26 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { PulumiAppModule } from "@webiny/pulumi";
+interface GraphqlParams {
+    env: Record<string, any>;
+    apwSchedulerEventRule: pulumi.Output<aws.cloudwatch.EventRule>;
+    apwSchedulerEventTarget: pulumi.Output<aws.cloudwatch.EventTarget>;
+}
+export interface AddRouteParams {
+    /**
+     * Must be in kebab case (a-z and -)
+     */
+    name: string;
+    path: `/${string}`;
+    method: "DELETE" | "GET" | "HEAD" | "PATCH" | "POST" | "PUT" | "OPTIONS" | "ANY";
+}
+export declare type ApiGraphql = PulumiAppModule<typeof ApiGraphql>;
+export declare const ApiGraphql: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role").Role>;
+    policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy").Policy>;
+    functions: {
+        graphql: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+    };
+    addRoute: (routeParams: AddRouteParams) => any;
+}, GraphqlParams>;
+export {};

package/apps/api/ApiGraphql.js

@@ -0,0 +1,167 @@
+"use strict";
+
+var _interopRequireWildcard = require("@babel/runtime/helpers/interopRequireWildcard").default;
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault").default;
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ApiGraphql = void 0;
+
+var _objectSpread2 = _interopRequireDefault(require("@babel/runtime/helpers/objectSpread2"));
+
+var _path = _interopRequireDefault(require("path"));
+
+var pulumi = _interopRequireWildcard(require("@pulumi/pulumi"));
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+var _kebabCase = _interopRequireDefault(require("lodash/kebabCase"));
+
+var _pulumi2 = require("@webiny/pulumi");
+
+var _lambdaUtils = require("../lambdaUtils");
+
+var _ = require("./..");
+
+var _awsUtils = require("../awsUtils");
+
+const ApiGraphql = (0, _pulumi2.createAppModule)({
+  name: "ApiGraphql",
+
+  config(app, params) {
+    const core = app.getModule(_.CoreOutput);
+    const policy = createGraphqlLambdaPolicy(app);
+    const role = (0, _lambdaUtils.createLambdaRole)(app, {
+      name: "api-lambda-role",
+      policy: policy.output
+    });
+    const graphql = app.addResource(aws.lambda.Function, {
+      name: "graphql",
+      config: {
+        runtime: "nodejs14.x",
+        handler: "handler.handler",
+        role: role.output.arn,
+        timeout: 30,
+        memorySize: 512,
+        code: new pulumi.asset.AssetArchive({
+          ".": new pulumi.asset.FileArchive(_path.default.join(app.paths.workspace, "graphql/build"))
+        }),
+        environment: {
+          variables: (0, _lambdaUtils.getCommonLambdaEnvVariables)().apply(value => (0, _objectSpread2.default)((0, _objectSpread2.default)((0, _objectSpread2.default)({}, value), params.env), {}, {
+            AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
+          }))
+        },
+        vpcConfig: app.getModule(_.VpcConfig).functionVpcConfig
+      }
+    });
+    const headlessCmsModule = app.getModule(_.ApiHeadlessCMS);
+    const headlessCmsGraphQL = headlessCmsModule.functions.graphql;
+    /**
+     * Store meta information like "mainGraphqlFunctionArn" in APW settings at deploy time.
+     *
+     * Note: We can't pass "mainGraphqlFunctionArn" as env variable due to circular dependency between
+     * "graphql" lambda and "api-apw-scheduler-execute-action" lambda.
+     */
+
+    app.addResource(aws.dynamodb.TableItem, {
+      name: "apwSettings",
+      config: {
+        tableName: core.primaryDynamodbTableName,
+        hashKey: core.primaryDynamodbTableHashKey,
+        rangeKey: pulumi.output(core.primaryDynamodbTableRangeKey).apply(key => key || "SK"),
+        item: pulumi.interpolate`{
+              "PK": {"S": "APW#SETTINGS"},
+              "SK": {"S": "${app.params.run.variant || "default"}"},
+              "cmsGraphqlFunctionArn": {"S": "${headlessCmsGraphQL.output.arn}"},
+              "mainGraphqlFunctionArn": {"S": "${graphql.output.arn}"},
+              "eventRuleName": {"S": "${params.apwSchedulerEventRule.name}"},
+              "eventTargetId": {"S": "${params.apwSchedulerEventTarget.targetId}"}
+            }`
+      }
+    });
+    return {
+      role,
+      policy,
+      functions: {
+        graphql
+      },
+      addRoute: routeParams => {
+        const apiGateway = app.resources.apiGateway;
+
+        if (!apiGateway) {
+          console.log("Could not add route because there is no apiGateway in the resources.");
+          return;
+        }
+
+        const kebabName = (0, _kebabCase.default)(routeParams.name);
+
+        if (kebabName !== routeParams.name) {
+          console.log(`Route name is not allowed: "${routeParams.name}".`);
+          return;
+        }
+
+        return apiGateway.addRoute(routeParams.name, {
+          path: routeParams.path,
+          method: routeParams.method,
+          function: graphql.output.arn
+        });
+      }
+    };
+  }
+
+});
+exports.ApiGraphql = ApiGraphql;
+
+function createGraphqlLambdaPolicy(app) {
+  const coreOutput = app.getModule(_.CoreOutput);
+  const awsAccountId = (0, _awsUtils.getAwsAccountId)(app);
+  const awsRegion = (0, _awsUtils.getAwsRegion)(app);
+  return app.addResource(aws.iam.Policy, {
+    name: "ApiGraphqlLambdaPolicy",
+    config: {
+      description: "This policy enables access to Dynamodb, S3, Lambda and Cognito IDP",
+      // Core is pulumi.Output, so we need to run apply() to resolve policy based on it
+      policy: coreOutput.apply(core => {
+        const policy = {
+          Version: "2012-10-17",
+          Statement: [{
+            Sid: "PermissionForDynamodb",
+            Effect: "Allow",
+            Action: ["dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:ConditionCheckItem", "dynamodb:CreateBackup", "dynamodb:CreateTable", "dynamodb:CreateTableReplica", "dynamodb:DeleteBackup", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DeleteTableReplica", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeExport", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:DisableKinesisStreamingDestination", "dynamodb:EnableKinesisStreamingDestination", "dynamodb:ExportTableToPointInTime", "dynamodb:GetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:ListBackups", "dynamodb:ListContributorInsights", "dynamodb:ListExports", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:PartiQLDelete", "dynamodb:PartiQLInsert", "dynamodb:PartiQLSelect", "dynamodb:PartiQLUpdate", "dynamodb:PurchaseReservedCapacityOfferings", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:RestoreTableFromBackup", "dynamodb:RestoreTableToPointInTime", "dynamodb:Scan", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateContributorInsights", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTableReplicaAutoScaling", "dynamodb:UpdateTimeToLive"],
+            Resource: [`${core.primaryDynamodbTableArn}`, `${core.primaryDynamodbTableArn}/*`, // Attach permissions for elastic search dynamo as well (if ES is enabled).
+            ...(core.elasticsearchDynamodbTableArn ? [`${core.elasticsearchDynamodbTableArn}`, `${core.elasticsearchDynamodbTableArn}/*`] : [])]
+          }, {
+            Sid: "PermissionForS3",
+            Effect: "Allow",
+            Action: ["s3:GetObjectAcl", "s3:DeleteObject", "s3:PutObjectAcl", "s3:PutObject", "s3:GetObject"],
+            Resource: `arn:aws:s3:::${core.fileManagerBucketId}/*`
+          }, {
+            Sid: "PermissionForLambda",
+            Effect: "Allow",
+            Action: ["lambda:InvokeFunction"],
+            Resource: pulumi.interpolate`arn:aws:lambda:${awsRegion}:${awsAccountId}:function:*`
+          }, {
+            Sid: "PermissionForCognitoIdp",
+            Effect: "Allow",
+            Action: "cognito-idp:*",
+            Resource: `${core.cognitoUserPoolArn}`
+          }, {
+            Sid: "PermissionForEventBus",
+            Effect: "Allow",
+            Action: "events:PutEvents",
+            Resource: core.eventBusArn
+          }, // Attach permissions for elastic search domain as well (if ES is enabled).
+          ...(core.elasticsearchDomainArn ? [{
+            Sid: "PermissionForES",
+            Effect: "Allow",
+            Action: "es:*",
+            Resource: [`${core.elasticsearchDomainArn}`, `${core.elasticsearchDomainArn}/*`]
+          }] : [])]
+        };
+        return policy;
+      })
+    }
+  });
+}

package/apps/api/ApiGraphql.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ApiGraphql","createAppModule","name","config","app","params","core","getModule","CoreOutput","policy","createGraphqlLambdaPolicy","role","createLambdaRole","output","graphql","addResource","aws","lambda","Function","runtime","handler","arn","timeout","memorySize","code","pulumi","asset","AssetArchive","FileArchive","path","join","paths","workspace","environment","variables","getCommonLambdaEnvVariables","apply","value","env","AWS_NODEJS_CONNECTION_REUSE_ENABLED","vpcConfig","VpcConfig","functionVpcConfig","headlessCmsModule","ApiHeadlessCMS","headlessCmsGraphQL","functions","dynamodb","TableItem","tableName","primaryDynamodbTableName","hashKey","primaryDynamodbTableHashKey","rangeKey","primaryDynamodbTableRangeKey","key","item","interpolate","run","variant","apwSchedulerEventRule","apwSchedulerEventTarget","targetId","addRoute","routeParams","apiGateway","resources","console","log","kebabName","toKebabCase","method","function","coreOutput","awsAccountId","getAwsAccountId","awsRegion","getAwsRegion","iam","Policy","description","Version","Statement","Sid","Effect","Action","Resource","primaryDynamodbTableArn","elasticsearchDynamodbTableArn","fileManagerBucketId","cognitoUserPoolArn","eventBusArn","elasticsearchDomainArn"],"sources":["ApiGraphql.ts"],"sourcesContent":["import path from \"path\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\nimport toKebabCase from \"lodash/kebabCase\";\n\nimport { createAppModule, PulumiApp, PulumiAppModule } from \"@webiny/pulumi\";\nimport { createLambdaRole, getCommonLambdaEnvVariables } from \"../lambdaUtils\";\nimport { ApiHeadlessCMS, CoreOutput, VpcConfig } from \"~/apps\";\nimport { getAwsAccountId, getAwsRegion } from \"../awsUtils\";\n\ninterface GraphqlParams {\n    env: Record<string, any>;\n    apwSchedulerEventRule: pulumi.Output<aws.cloudwatch.EventRule>;\n    apwSchedulerEventTarget: pulumi.Output<aws.cloudwatch.EventTarget>;\n}\n\nexport interface AddRouteParams {\n    /**\n     * Must be in kebab case (a-z and -)\n     */\n    name: string;\n    path: `/${string}`;\n    method: \"DELETE\" | \"GET\" | \"HEAD\" | \"PATCH\" | \"POST\" | \"PUT\" | \"OPTIONS\" | \"ANY\";\n}\n\nexport type ApiGraphql = PulumiAppModule<typeof ApiGraphql>;\n\nexport const ApiGraphql = createAppModule({\n    name: \"ApiGraphql\",\n    config(app: PulumiApp, params: GraphqlParams) {\n        const core = app.getModule(CoreOutput);\n\n        const policy = createGraphqlLambdaPolicy(app);\n        const role = createLambdaRole(app, {\n            name: \"api-lambda-role\",\n            policy: policy.output\n        });\n\n        const graphql = app.addResource(aws.lambda.Function, {\n            name: \"graphql\",\n            config: {\n                runtime: \"nodejs14.x\",\n                handler: \"handler.handler\",\n                role: role.output.arn,\n                timeout: 30,\n                memorySize: 512,\n                code: new pulumi.asset.AssetArchive({\n                    \".\": new pulumi.asset.FileArchive(\n                        path.join(app.paths.workspace, \"graphql/build\")\n                    )\n                }),\n                environment: {\n                    variables: getCommonLambdaEnvVariables().apply(value => ({\n                        ...value,\n                        ...params.env,\n                        AWS_NODEJS_CONNECTION_REUSE_ENABLED: \"1\"\n                    }))\n                },\n                vpcConfig: app.getModule(VpcConfig).functionVpcConfig\n            }\n        });\n\n        const headlessCmsModule = app.getModule(ApiHeadlessCMS);\n\n        const headlessCmsGraphQL = headlessCmsModule.functions.graphql;\n        /**\n         * Store meta information like \"mainGraphqlFunctionArn\" in APW settings at deploy time.\n         *\n         * Note: We can't pass \"mainGraphqlFunctionArn\" as env variable due to circular dependency between\n         * \"graphql\" lambda and \"api-apw-scheduler-execute-action\" lambda.\n         */\n        app.addResource(aws.dynamodb.TableItem, {\n            name: \"apwSettings\",\n            config: {\n                tableName: core.primaryDynamodbTableName,\n                hashKey: core.primaryDynamodbTableHashKey,\n                rangeKey: pulumi\n                    .output(core.primaryDynamodbTableRangeKey)\n                    .apply(key => key || \"SK\"),\n                item: pulumi.interpolate`{\n              \"PK\": {\"S\": \"APW#SETTINGS\"},\n              \"SK\": {\"S\": \"${app.params.run.variant || \"default\"}\"},\n              \"cmsGraphqlFunctionArn\": {\"S\": \"${headlessCmsGraphQL.output.arn}\"},\n              \"mainGraphqlFunctionArn\": {\"S\": \"${graphql.output.arn}\"},\n              \"eventRuleName\": {\"S\": \"${params.apwSchedulerEventRule.name}\"},\n              \"eventTargetId\": {\"S\": \"${params.apwSchedulerEventTarget.targetId}\"}\n            }`\n            }\n        });\n\n        return {\n            role,\n            policy,\n            functions: {\n                graphql\n            },\n            addRoute: (routeParams: AddRouteParams) => {\n                const apiGateway: any = app.resources.apiGateway;\n                if (!apiGateway) {\n                    console.log(\n                        \"Could not add route because there is no apiGateway in the resources.\"\n                    );\n                    return;\n                }\n                const kebabName = toKebabCase(routeParams.name);\n                if (kebabName !== routeParams.name) {\n                    console.log(`Route name is not allowed: \"${routeParams.name}\".`);\n                    return;\n                }\n                return apiGateway.addRoute(routeParams.name, {\n                    path: routeParams.path,\n                    method: routeParams.method,\n                    function: graphql.output.arn\n                });\n            }\n        };\n    }\n});\n\nfunction createGraphqlLambdaPolicy(app: PulumiApp) {\n    const coreOutput = app.getModule(CoreOutput);\n    const awsAccountId = getAwsAccountId(app);\n    const awsRegion = getAwsRegion(app);\n\n    return app.addResource(aws.iam.Policy, {\n        name: \"ApiGraphqlLambdaPolicy\",\n        config: {\n            description: \"This policy enables access to Dynamodb, S3, Lambda and Cognito IDP\",\n            // Core is pulumi.Output, so we need to run apply() to resolve policy based on it\n            policy: coreOutput.apply(core => {\n                const policy: aws.iam.PolicyDocument = {\n                    Version: \"2012-10-17\",\n                    Statement: [\n                        {\n                            Sid: \"PermissionForDynamodb\",\n                            Effect: \"Allow\",\n                            Action: [\n                                \"dynamodb:BatchGetItem\",\n                                \"dynamodb:BatchWriteItem\",\n                                \"dynamodb:ConditionCheckItem\",\n                                \"dynamodb:CreateBackup\",\n                                \"dynamodb:CreateTable\",\n                                \"dynamodb:CreateTableReplica\",\n                                \"dynamodb:DeleteBackup\",\n                                \"dynamodb:DeleteItem\",\n                                \"dynamodb:DeleteTable\",\n                                \"dynamodb:DeleteTableReplica\",\n                                \"dynamodb:DescribeBackup\",\n                                \"dynamodb:DescribeContinuousBackups\",\n                                \"dynamodb:DescribeContributorInsights\",\n                                \"dynamodb:DescribeExport\",\n                                \"dynamodb:DescribeKinesisStreamingDestination\",\n                                \"dynamodb:DescribeLimits\",\n                                \"dynamodb:DescribeReservedCapacity\",\n                                \"dynamodb:DescribeReservedCapacityOfferings\",\n                                \"dynamodb:DescribeStream\",\n                                \"dynamodb:DescribeTable\",\n                                \"dynamodb:DescribeTableReplicaAutoScaling\",\n                                \"dynamodb:DescribeTimeToLive\",\n                                \"dynamodb:DisableKinesisStreamingDestination\",\n                                \"dynamodb:EnableKinesisStreamingDestination\",\n                                \"dynamodb:ExportTableToPointInTime\",\n                                \"dynamodb:GetItem\",\n                                \"dynamodb:GetRecords\",\n                                \"dynamodb:GetShardIterator\",\n                                \"dynamodb:ListBackups\",\n                                \"dynamodb:ListContributorInsights\",\n                                \"dynamodb:ListExports\",\n                                \"dynamodb:ListStreams\",\n                                \"dynamodb:ListTables\",\n                                \"dynamodb:ListTagsOfResource\",\n                                \"dynamodb:PartiQLDelete\",\n                                \"dynamodb:PartiQLInsert\",\n                                \"dynamodb:PartiQLSelect\",\n                                \"dynamodb:PartiQLUpdate\",\n                                \"dynamodb:PurchaseReservedCapacityOfferings\",\n                                \"dynamodb:PutItem\",\n                                \"dynamodb:Query\",\n                                \"dynamodb:RestoreTableFromBackup\",\n                                \"dynamodb:RestoreTableToPointInTime\",\n                                \"dynamodb:Scan\",\n                                \"dynamodb:UpdateContinuousBackups\",\n                                \"dynamodb:UpdateContributorInsights\",\n                                \"dynamodb:UpdateItem\",\n                                \"dynamodb:UpdateTable\",\n                                \"dynamodb:UpdateTableReplicaAutoScaling\",\n                                \"dynamodb:UpdateTimeToLive\"\n                            ],\n                            Resource: [\n                                `${core.primaryDynamodbTableArn}`,\n                                `${core.primaryDynamodbTableArn}/*`,\n                                // Attach permissions for elastic search dynamo as well (if ES is enabled).\n                                ...(core.elasticsearchDynamodbTableArn\n                                    ? [\n                                          `${core.elasticsearchDynamodbTableArn}`,\n                                          `${core.elasticsearchDynamodbTableArn}/*`\n                                      ]\n                                    : [])\n                            ]\n                        },\n                        {\n                            Sid: \"PermissionForS3\",\n                            Effect: \"Allow\",\n                            Action: [\n                                \"s3:GetObjectAcl\",\n                                \"s3:DeleteObject\",\n                                \"s3:PutObjectAcl\",\n                                \"s3:PutObject\",\n                                \"s3:GetObject\"\n                            ],\n                            Resource: `arn:aws:s3:::${core.fileManagerBucketId}/*`\n                        },\n                        {\n                            Sid: \"PermissionForLambda\",\n                            Effect: \"Allow\",\n                            Action: [\"lambda:InvokeFunction\"],\n                            Resource: pulumi.interpolate`arn:aws:lambda:${awsRegion}:${awsAccountId}:function:*`\n                        },\n                        {\n                            Sid: \"PermissionForCognitoIdp\",\n                            Effect: \"Allow\",\n                            Action: \"cognito-idp:*\",\n                            Resource: `${core.cognitoUserPoolArn}`\n                        },\n                        {\n                            Sid: \"PermissionForEventBus\",\n                            Effect: \"Allow\",\n                            Action: \"events:PutEvents\",\n                            Resource: core.eventBusArn\n                        },\n                        // Attach permissions for elastic search domain as well (if ES is enabled).\n                        ...(core.elasticsearchDomainArn\n                            ? [\n                                  {\n                                      Sid: \"PermissionForES\",\n                                      Effect: \"Allow\" as const,\n                                      Action: \"es:*\",\n                                      Resource: [\n                                          `${core.elasticsearchDomainArn}`,\n                                          `${core.elasticsearchDomainArn}/*`\n                                      ]\n                                  }\n                              ]\n                            : [])\n                    ]\n                };\n\n                return policy;\n            })\n        }\n    });\n}\n"],"mappings":";;;;;;;;;;;;;AAAA;;AACA;;AACA;;AACA;;AAEA;;AACA;;AACA;;AACA;;AAmBO,MAAMA,UAAU,GAAG,IAAAC,wBAAA,EAAgB;EACtCC,IAAI,EAAE,YADgC;;EAEtCC,MAAM,CAACC,GAAD,EAAiBC,MAAjB,EAAwC;IAC1C,MAAMC,IAAI,GAAGF,GAAG,CAACG,SAAJ,CAAcC,YAAd,CAAb;IAEA,MAAMC,MAAM,GAAGC,yBAAyB,CAACN,GAAD,CAAxC;IACA,MAAMO,IAAI,GAAG,IAAAC,6BAAA,EAAiBR,GAAjB,EAAsB;MAC/BF,IAAI,EAAE,iBADyB;MAE/BO,MAAM,EAAEA,MAAM,CAACI;IAFgB,CAAtB,CAAb;IAKA,MAAMC,OAAO,GAAGV,GAAG,CAACW,WAAJ,CAAgBC,GAAG,CAACC,MAAJ,CAAWC,QAA3B,EAAqC;MACjDhB,IAAI,EAAE,SAD2C;MAEjDC,MAAM,EAAE;QACJgB,OAAO,EAAE,YADL;QAEJC,OAAO,EAAE,iBAFL;QAGJT,IAAI,EAAEA,IAAI,CAACE,MAAL,CAAYQ,GAHd;QAIJC,OAAO,EAAE,EAJL;QAKJC,UAAU,EAAE,GALR;QAMJC,IAAI,EAAE,IAAIC,MAAM,CAACC,KAAP,CAAaC,YAAjB,CAA8B;UAChC,KAAK,IAAIF,MAAM,CAACC,KAAP,CAAaE,WAAjB,CACDC,aAAA,CAAKC,IAAL,CAAU1B,GAAG,CAAC2B,KAAJ,CAAUC,SAApB,EAA+B,eAA/B,CADC;QAD2B,CAA9B,CANF;QAWJC,WAAW,EAAE;UACTC,SAAS,EAAE,IAAAC,wCAAA,IAA8BC,KAA9B,CAAoCC,KAAK,4FAC7CA,KAD6C,GAE7ChC,MAAM,CAACiC,GAFsC;YAGhDC,mCAAmC,EAAE;UAHW,EAAzC;QADF,CAXT;QAkBJC,SAAS,EAAEpC,GAAG,CAACG,SAAJ,CAAckC,WAAd,EAAyBC;MAlBhC;IAFyC,CAArC,CAAhB;IAwBA,MAAMC,iBAAiB,GAAGvC,GAAG,CAACG,SAAJ,CAAcqC,gBAAd,CAA1B;IAEA,MAAMC,kBAAkB,GAAGF,iBAAiB,CAACG,SAAlB,CAA4BhC,OAAvD;IACA;AACR;AACA;AACA;AACA;AACA;;IACQV,GAAG,CAACW,WAAJ,CAAgBC,GAAG,CAAC+B,QAAJ,CAAaC,SAA7B,EAAwC;MACpC9C,IAAI,EAAE,aAD8B;MAEpCC,MAAM,EAAE;QACJ8C,SAAS,EAAE3C,IAAI,CAAC4C,wBADZ;QAEJC,OAAO,EAAE7C,IAAI,CAAC8C,2BAFV;QAGJC,QAAQ,EAAE5B,MAAM,CACXZ,MADK,CACEP,IAAI,CAACgD,4BADP,EAELlB,KAFK,CAECmB,GAAG,IAAIA,GAAG,IAAI,IAFf,CAHN;QAMJC,IAAI,EAAE/B,MAAM,CAACgC,WAAY;AACzC;AACA,6BAA6BrD,GAAG,CAACC,MAAJ,CAAWqD,GAAX,CAAeC,OAAf,IAA0B,SAAU;AACjE,gDAAgDd,kBAAkB,CAAChC,MAAnB,CAA0BQ,GAAI;AAC9E,iDAAiDP,OAAO,CAACD,MAAR,CAAeQ,GAAI;AACpE,wCAAwChB,MAAM,CAACuD,qBAAP,CAA6B1D,IAAK;AAC1E,wCAAwCG,MAAM,CAACwD,uBAAP,CAA+BC,QAAS;AAChF;MAboB;IAF4B,CAAxC;IAmBA,OAAO;MACHnD,IADG;MAEHF,MAFG;MAGHqC,SAAS,EAAE;QACPhC;MADO,CAHR;MAMHiD,QAAQ,EAAGC,WAAD,IAAiC;QACvC,MAAMC,UAAe,GAAG7D,GAAG,CAAC8D,SAAJ,CAAcD,UAAtC;;QACA,IAAI,CAACA,UAAL,EAAiB;UACbE,OAAO,CAACC,GAAR,CACI,sEADJ;UAGA;QACH;;QACD,MAAMC,SAAS,GAAG,IAAAC,kBAAA,EAAYN,WAAW,CAAC9D,IAAxB,CAAlB;;QACA,IAAImE,SAAS,KAAKL,WAAW,CAAC9D,IAA9B,EAAoC;UAChCiE,OAAO,CAACC,GAAR,CAAa,+BAA8BJ,WAAW,CAAC9D,IAAK,IAA5D;UACA;QACH;;QACD,OAAO+D,UAAU,CAACF,QAAX,CAAoBC,WAAW,CAAC9D,IAAhC,EAAsC;UACzC2B,IAAI,EAAEmC,WAAW,CAACnC,IADuB;UAEzC0C,MAAM,EAAEP,WAAW,CAACO,MAFqB;UAGzCC,QAAQ,EAAE1D,OAAO,CAACD,MAAR,CAAeQ;QAHgB,CAAtC,CAAP;MAKH;IAxBE,CAAP;EA0BH;;AAzFqC,CAAhB,CAAnB;;;AA4FP,SAASX,yBAAT,CAAmCN,GAAnC,EAAmD;EAC/C,MAAMqE,UAAU,GAAGrE,GAAG,CAACG,SAAJ,CAAcC,YAAd,CAAnB;EACA,MAAMkE,YAAY,GAAG,IAAAC,yBAAA,EAAgBvE,GAAhB,CAArB;EACA,MAAMwE,SAAS,GAAG,IAAAC,sBAAA,EAAazE,GAAb,CAAlB;EAEA,OAAOA,GAAG,CAACW,WAAJ,CAAgBC,GAAG,CAAC8D,GAAJ,CAAQC,MAAxB,EAAgC;IACnC7E,IAAI,EAAE,wBAD6B;IAEnCC,MAAM,EAAE;MACJ6E,WAAW,EAAE,oEADT;MAEJ;MACAvE,MAAM,EAAEgE,UAAU,CAACrC,KAAX,CAAiB9B,IAAI,IAAI;QAC7B,MAAMG,MAA8B,GAAG;UACnCwE,OAAO,EAAE,YAD0B;UAEnCC,SAAS,EAAE,CACP;YACIC,GAAG,EAAE,uBADT;YAEIC,MAAM,EAAE,OAFZ;YAGIC,MAAM,EAAE,CACJ,uBADI,EAEJ,yBAFI,EAGJ,6BAHI,EAIJ,uBAJI,EAKJ,sBALI,EAMJ,6BANI,EAOJ,uBAPI,EAQJ,qBARI,EASJ,sBATI,EAUJ,6BAVI,EAWJ,yBAXI,EAYJ,oCAZI,EAaJ,sCAbI,EAcJ,yBAdI,EAeJ,8CAfI,EAgBJ,yBAhBI,EAiBJ,mCAjBI,EAkBJ,4CAlBI,EAmBJ,yBAnBI,EAoBJ,wBApBI,EAqBJ,0CArBI,EAsBJ,6BAtBI,EAuBJ,6CAvBI,EAwBJ,4CAxBI,EAyBJ,mCAzBI,EA0BJ,kBA1BI,EA2BJ,qBA3BI,EA4BJ,2BA5BI,EA6BJ,sBA7BI,EA8BJ,kCA9BI,EA+BJ,sBA/BI,EAgCJ,sBAhCI,EAiCJ,qBAjCI,EAkCJ,6BAlCI,EAmCJ,wBAnCI,EAoCJ,wBApCI,EAqCJ,wBArCI,EAsCJ,wBAtCI,EAuCJ,4CAvCI,EAwCJ,kBAxCI,EAyCJ,gBAzCI,EA0CJ,iCA1CI,EA2CJ,oCA3CI,EA4CJ,eA5CI,EA6CJ,kCA7CI,EA8CJ,oCA9CI,EA+CJ,qBA/CI,EAgDJ,sBAhDI,EAiDJ,wCAjDI,EAkDJ,2BAlDI,CAHZ;YAuDIC,QAAQ,EAAE,CACL,GAAEhF,IAAI,CAACiF,uBAAwB,EAD1B,EAEL,GAAEjF,IAAI,CAACiF,uBAAwB,IAF1B,EAGN;YACA,IAAIjF,IAAI,CAACkF,6BAAL,GACE,CACK,GAAElF,IAAI,CAACkF,6BAA8B,EAD1C,EAEK,GAAElF,IAAI,CAACkF,6BAA8B,IAF1C,CADF,GAKE,EALN,CAJM;UAvDd,CADO,EAoEP;YACIL,GAAG,EAAE,iBADT;YAEIC,MAAM,EAAE,OAFZ;YAGIC,MAAM,EAAE,CACJ,iBADI,EAEJ,iBAFI,EAGJ,iBAHI,EAIJ,cAJI,EAKJ,cALI,CAHZ;YAUIC,QAAQ,EAAG,gBAAehF,IAAI,CAACmF,mBAAoB;UAVvD,CApEO,EAgFP;YACIN,GAAG,EAAE,qBADT;YAEIC,MAAM,EAAE,OAFZ;YAGIC,MAAM,EAAE,CAAC,uBAAD,CAHZ;YAIIC,QAAQ,EAAE7D,MAAM,CAACgC,WAAY,kBAAiBmB,SAAU,IAAGF,YAAa;UAJ5E,CAhFO,EAsFP;YACIS,GAAG,EAAE,yBADT;YAEIC,MAAM,EAAE,OAFZ;YAGIC,MAAM,EAAE,eAHZ;YAIIC,QAAQ,EAAG,GAAEhF,IAAI,CAACoF,kBAAmB;UAJzC,CAtFO,EA4FP;YACIP,GAAG,EAAE,uBADT;YAEIC,MAAM,EAAE,OAFZ;YAGIC,MAAM,EAAE,kBAHZ;YAIIC,QAAQ,EAAEhF,IAAI,CAACqF;UAJnB,CA5FO,EAkGP;UACA,IAAIrF,IAAI,CAACsF,sBAAL,GACE,CACI;YACIT,GAAG,EAAE,iBADT;YAEIC,MAAM,EAAE,OAFZ;YAGIC,MAAM,EAAE,MAHZ;YAIIC,QAAQ,EAAE,CACL,GAAEhF,IAAI,CAACsF,sBAAuB,EADzB,EAEL,GAAEtF,IAAI,CAACsF,sBAAuB,IAFzB;UAJd,CADJ,CADF,GAYE,EAZN,CAnGO;QAFwB,CAAvC;QAqHA,OAAOnF,MAAP;MACH,CAvHO;IAHJ;EAF2B,CAAhC,CAAP;AA+HH"}

package/apps/api/ApiHeadlessCMS.d.ts

@@ -0,0 +1,13 @@
+import { PulumiAppModule } from "@webiny/pulumi";
+interface HeadlessCMSParams {
+    env: Record<string, any>;
+}
+export declare type ApiHeadlessCMS = PulumiAppModule<typeof ApiHeadlessCMS>;
+export declare const ApiHeadlessCMS: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role").Role>;
+    policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy").Policy>;
+    functions: {
+        graphql: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+    };
+}, HeadlessCMSParams>;
+export {};

package/apps/api/ApiHeadlessCMS.js

@@ -0,0 +1,94 @@
+"use strict";
+
+var _interopRequireWildcard = require("@babel/runtime/helpers/interopRequireWildcard").default;
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault").default;
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ApiHeadlessCMS = void 0;
+
+var _objectSpread2 = _interopRequireDefault(require("@babel/runtime/helpers/objectSpread2"));
+
+var _path = _interopRequireDefault(require("path"));
+
+var pulumi = _interopRequireWildcard(require("@pulumi/pulumi"));
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+var _pulumi2 = require("@webiny/pulumi");
+
+var _lambdaUtils = require("../lambdaUtils");
+
+var _common = require("../common");
+
+const ApiHeadlessCMS = (0, _pulumi2.createAppModule)({
+  name: "ApiHeadlessCMS",
+
+  config(app, params) {
+    const policy = createHeadlessCmsLambdaPolicy(app);
+    const role = (0, _lambdaUtils.createLambdaRole)(app, {
+      name: "headless-cms-lambda-role",
+      policy: policy.output
+    });
+    const graphql = app.addResource(aws.lambda.Function, {
+      name: "headless-cms",
+      config: {
+        runtime: "nodejs14.x",
+        handler: "handler.handler",
+        role: role.output.arn,
+        timeout: 30,
+        memorySize: 512,
+        code: new pulumi.asset.AssetArchive({
+          ".": new pulumi.asset.FileArchive(_path.default.join(app.paths.workspace, "headlessCMS/build"))
+        }),
+        environment: {
+          variables: (0, _lambdaUtils.getCommonLambdaEnvVariables)().apply(value => (0, _objectSpread2.default)((0, _objectSpread2.default)((0, _objectSpread2.default)({}, value), params.env), {}, {
+            AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
+          }))
+        },
+        vpcConfig: app.getModule(_common.VpcConfig).functionVpcConfig
+      }
+    });
+    return {
+      role,
+      policy,
+      functions: {
+        graphql
+      }
+    };
+  }
+
+});
+exports.ApiHeadlessCMS = ApiHeadlessCMS;
+
+function createHeadlessCmsLambdaPolicy(app) {
+  const coreOutput = app.getModule(_common.CoreOutput);
+  return app.addResource(aws.iam.Policy, {
+    name: "HeadlessCmsLambdaPolicy",
+    config: {
+      description: "This policy enables access to Dynamodb streams",
+      // Core is pulumi.Output, so we need to run apply() to resolve policy based on it
+      policy: coreOutput.apply(core => {
+        const policy = {
+          Version: "2012-10-17",
+          Statement: [{
+            Sid: "PermissionDynamodb",
+            Effect: "Allow",
+            Action: ["dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:ConditionCheckItem", "dynamodb:CreateBackup", "dynamodb:CreateTable", "dynamodb:CreateTableReplica", "dynamodb:DeleteBackup", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DeleteTableReplica", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeExport", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:DisableKinesisStreamingDestination", "dynamodb:EnableKinesisStreamingDestination", "dynamodb:ExportTableToPointInTime", "dynamodb:GetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:ListBackups", "dynamodb:ListContributorInsights", "dynamodb:ListExports", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:PartiQLDelete", "dynamodb:PartiQLInsert", "dynamodb:PartiQLSelect", "dynamodb:PartiQLUpdate", "dynamodb:PurchaseReservedCapacityOfferings", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:RestoreTableFromBackup", "dynamodb:RestoreTableToPointInTime", "dynamodb:Scan", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateContributorInsights", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTableReplicaAutoScaling", "dynamodb:UpdateTimeToLive"],
+            Resource: [`${core.primaryDynamodbTableArn}`, `${core.primaryDynamodbTableArn}/*`, // Attach permissions for elastic search dynamo as well (if ES is enabled).
+            ...(core.elasticsearchDynamodbTableArn ? [`${core.elasticsearchDynamodbTableArn}`, `${core.elasticsearchDynamodbTableArn}/*`] : [])]
+          }, // Attach permissions for elastic search domain as well (if ES is enabled).
+          ...(core.elasticsearchDomainArn ? [{
+            Sid: "PermissionForES",
+            Effect: "Allow",
+            Action: "es:*",
+            Resource: [`${core.elasticsearchDomainArn}`, `${core.elasticsearchDomainArn}/*`]
+          }] : [])]
+        };
+        return policy;
+      })
+    }
+  });
+}

package/apps/api/ApiHeadlessCMS.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ApiHeadlessCMS","createAppModule","name","config","app","params","policy","createHeadlessCmsLambdaPolicy","role","createLambdaRole","output","graphql","addResource","aws","lambda","Function","runtime","handler","arn","timeout","memorySize","code","pulumi","asset","AssetArchive","FileArchive","path","join","paths","workspace","environment","variables","getCommonLambdaEnvVariables","apply","value","env","AWS_NODEJS_CONNECTION_REUSE_ENABLED","vpcConfig","getModule","VpcConfig","functionVpcConfig","functions","coreOutput","CoreOutput","iam","Policy","description","core","Version","Statement","Sid","Effect","Action","Resource","primaryDynamodbTableArn","elasticsearchDynamodbTableArn","elasticsearchDomainArn"],"sources":["ApiHeadlessCMS.ts"],"sourcesContent":["import path from \"path\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nimport { createAppModule, PulumiApp, PulumiAppModule } from \"@webiny/pulumi\";\n\nimport { createLambdaRole, getCommonLambdaEnvVariables } from \"../lambdaUtils\";\nimport { CoreOutput, VpcConfig } from \"../common\";\n\ninterface HeadlessCMSParams {\n    env: Record<string, any>;\n}\n\nexport type ApiHeadlessCMS = PulumiAppModule<typeof ApiHeadlessCMS>;\n\nexport const ApiHeadlessCMS = createAppModule({\n    name: \"ApiHeadlessCMS\",\n    config(app: PulumiApp, params: HeadlessCMSParams) {\n        const policy = createHeadlessCmsLambdaPolicy(app);\n        const role = createLambdaRole(app, {\n            name: \"headless-cms-lambda-role\",\n            policy: policy.output\n        });\n\n        const graphql = app.addResource(aws.lambda.Function, {\n            name: \"headless-cms\",\n            config: {\n                runtime: \"nodejs14.x\",\n                handler: \"handler.handler\",\n                role: role.output.arn,\n                timeout: 30,\n                memorySize: 512,\n                code: new pulumi.asset.AssetArchive({\n                    \".\": new pulumi.asset.FileArchive(\n                        path.join(app.paths.workspace, \"headlessCMS/build\")\n                    )\n                }),\n                environment: {\n                    variables: getCommonLambdaEnvVariables().apply(value => ({\n                        ...value,\n                        ...params.env,\n                        AWS_NODEJS_CONNECTION_REUSE_ENABLED: \"1\"\n                    }))\n                },\n                vpcConfig: app.getModule(VpcConfig).functionVpcConfig\n            }\n        });\n\n        return {\n            role,\n            policy,\n            functions: {\n                graphql\n            }\n        };\n    }\n});\n\nfunction createHeadlessCmsLambdaPolicy(app: PulumiApp) {\n    const coreOutput = app.getModule(CoreOutput);\n\n    return app.addResource(aws.iam.Policy, {\n        name: \"HeadlessCmsLambdaPolicy\",\n        config: {\n            description: \"This policy enables access to Dynamodb streams\",\n            // Core is pulumi.Output, so we need to run apply() to resolve policy based on it\n            policy: coreOutput.apply(core => {\n                const policy: aws.iam.PolicyDocument = {\n                    Version: \"2012-10-17\",\n                    Statement: [\n                        {\n                            Sid: \"PermissionDynamodb\",\n                            Effect: \"Allow\",\n                            Action: [\n                                \"dynamodb:BatchGetItem\",\n                                \"dynamodb:BatchWriteItem\",\n                                \"dynamodb:ConditionCheckItem\",\n                                \"dynamodb:CreateBackup\",\n                                \"dynamodb:CreateTable\",\n                                \"dynamodb:CreateTableReplica\",\n                                \"dynamodb:DeleteBackup\",\n                                \"dynamodb:DeleteItem\",\n                                \"dynamodb:DeleteTable\",\n                                \"dynamodb:DeleteTableReplica\",\n                                \"dynamodb:DescribeBackup\",\n                                \"dynamodb:DescribeContinuousBackups\",\n                                \"dynamodb:DescribeContributorInsights\",\n                                \"dynamodb:DescribeExport\",\n                                \"dynamodb:DescribeKinesisStreamingDestination\",\n                                \"dynamodb:DescribeLimits\",\n                                \"dynamodb:DescribeReservedCapacity\",\n                                \"dynamodb:DescribeReservedCapacityOfferings\",\n                                \"dynamodb:DescribeStream\",\n                                \"dynamodb:DescribeTable\",\n                                \"dynamodb:DescribeTableReplicaAutoScaling\",\n                                \"dynamodb:DescribeTimeToLive\",\n                                \"dynamodb:DisableKinesisStreamingDestination\",\n                                \"dynamodb:EnableKinesisStreamingDestination\",\n                                \"dynamodb:ExportTableToPointInTime\",\n                                \"dynamodb:GetItem\",\n                                \"dynamodb:GetRecords\",\n                                \"dynamodb:GetShardIterator\",\n                                \"dynamodb:ListBackups\",\n                                \"dynamodb:ListContributorInsights\",\n                                \"dynamodb:ListExports\",\n                                \"dynamodb:ListStreams\",\n                                \"dynamodb:ListTables\",\n                                \"dynamodb:ListTagsOfResource\",\n                                \"dynamodb:PartiQLDelete\",\n                                \"dynamodb:PartiQLInsert\",\n                                \"dynamodb:PartiQLSelect\",\n                                \"dynamodb:PartiQLUpdate\",\n                                \"dynamodb:PurchaseReservedCapacityOfferings\",\n                                \"dynamodb:PutItem\",\n                                \"dynamodb:Query\",\n                                \"dynamodb:RestoreTableFromBackup\",\n                                \"dynamodb:RestoreTableToPointInTime\",\n                                \"dynamodb:Scan\",\n                                \"dynamodb:UpdateContinuousBackups\",\n                                \"dynamodb:UpdateContributorInsights\",\n                                \"dynamodb:UpdateItem\",\n                                \"dynamodb:UpdateTable\",\n                                \"dynamodb:UpdateTableReplicaAutoScaling\",\n                                \"dynamodb:UpdateTimeToLive\"\n                            ],\n                            Resource: [\n                                `${core.primaryDynamodbTableArn}`,\n                                `${core.primaryDynamodbTableArn}/*`,\n                                // Attach permissions for elastic search dynamo as well (if ES is enabled).\n                                ...(core.elasticsearchDynamodbTableArn\n                                    ? [\n                                          `${core.elasticsearchDynamodbTableArn}`,\n                                          `${core.elasticsearchDynamodbTableArn}/*`\n                                      ]\n                                    : [])\n                            ]\n                        },\n                        // Attach permissions for elastic search domain as well (if ES is enabled).\n                        ...(core.elasticsearchDomainArn\n                            ? [\n                                  {\n                                      Sid: \"PermissionForES\",\n                                      Effect: \"Allow\" as const,\n                                      Action: \"es:*\",\n                                      Resource: [\n                                          `${core.elasticsearchDomainArn}`,\n                                          `${core.elasticsearchDomainArn}/*`\n                                      ]\n                                  }\n                              ]\n                            : [])\n                    ]\n                };\n\n                return policy;\n            })\n        }\n    });\n}\n"],"mappings":";;;;;;;;;;;;;AAAA;;AACA;;AACA;;AAEA;;AAEA;;AACA;;AAQO,MAAMA,cAAc,GAAG,IAAAC,wBAAA,EAAgB;EAC1CC,IAAI,EAAE,gBADoC;;EAE1CC,MAAM,CAACC,GAAD,EAAiBC,MAAjB,EAA4C;IAC9C,MAAMC,MAAM,GAAGC,6BAA6B,CAACH,GAAD,CAA5C;IACA,MAAMI,IAAI,GAAG,IAAAC,6BAAA,EAAiBL,GAAjB,EAAsB;MAC/BF,IAAI,EAAE,0BADyB;MAE/BI,MAAM,EAAEA,MAAM,CAACI;IAFgB,CAAtB,CAAb;IAKA,MAAMC,OAAO,GAAGP,GAAG,CAACQ,WAAJ,CAAgBC,GAAG,CAACC,MAAJ,CAAWC,QAA3B,EAAqC;MACjDb,IAAI,EAAE,cAD2C;MAEjDC,MAAM,EAAE;QACJa,OAAO,EAAE,YADL;QAEJC,OAAO,EAAE,iBAFL;QAGJT,IAAI,EAAEA,IAAI,CAACE,MAAL,CAAYQ,GAHd;QAIJC,OAAO,EAAE,EAJL;QAKJC,UAAU,EAAE,GALR;QAMJC,IAAI,EAAE,IAAIC,MAAM,CAACC,KAAP,CAAaC,YAAjB,CAA8B;UAChC,KAAK,IAAIF,MAAM,CAACC,KAAP,CAAaE,WAAjB,CACDC,aAAA,CAAKC,IAAL,CAAUvB,GAAG,CAACwB,KAAJ,CAAUC,SAApB,EAA+B,mBAA/B,CADC;QAD2B,CAA9B,CANF;QAWJC,WAAW,EAAE;UACTC,SAAS,EAAE,IAAAC,wCAAA,IAA8BC,KAA9B,CAAoCC,KAAK,4FAC7CA,KAD6C,GAE7C7B,MAAM,CAAC8B,GAFsC;YAGhDC,mCAAmC,EAAE;UAHW,EAAzC;QADF,CAXT;QAkBJC,SAAS,EAAEjC,GAAG,CAACkC,SAAJ,CAAcC,iBAAd,EAAyBC;MAlBhC;IAFyC,CAArC,CAAhB;IAwBA,OAAO;MACHhC,IADG;MAEHF,MAFG;MAGHmC,SAAS,EAAE;QACP9B;MADO;IAHR,CAAP;EAOH;;AAxCyC,CAAhB,CAAvB;;;AA2CP,SAASJ,6BAAT,CAAuCH,GAAvC,EAAuD;EACnD,MAAMsC,UAAU,GAAGtC,GAAG,CAACkC,SAAJ,CAAcK,kBAAd,CAAnB;EAEA,OAAOvC,GAAG,CAACQ,WAAJ,CAAgBC,GAAG,CAAC+B,GAAJ,CAAQC,MAAxB,EAAgC;IACnC3C,IAAI,EAAE,yBAD6B;IAEnCC,MAAM,EAAE;MACJ2C,WAAW,EAAE,gDADT;MAEJ;MACAxC,MAAM,EAAEoC,UAAU,CAACT,KAAX,CAAiBc,IAAI,IAAI;QAC7B,MAAMzC,MAA8B,GAAG;UACnC0C,OAAO,EAAE,YAD0B;UAEnCC,SAAS,EAAE,CACP;YACIC,GAAG,EAAE,oBADT;YAEIC,MAAM,EAAE,OAFZ;YAGIC,MAAM,EAAE,CACJ,uBADI,EAEJ,yBAFI,EAGJ,6BAHI,EAIJ,uBAJI,EAKJ,sBALI,EAMJ,6BANI,EAOJ,uBAPI,EAQJ,qBARI,EASJ,sBATI,EAUJ,6BAVI,EAWJ,yBAXI,EAYJ,oCAZI,EAaJ,sCAbI,EAcJ,yBAdI,EAeJ,8CAfI,EAgBJ,yBAhBI,EAiBJ,mCAjBI,EAkBJ,4CAlBI,EAmBJ,yBAnBI,EAoBJ,wBApBI,EAqBJ,0CArBI,EAsBJ,6BAtBI,EAuBJ,6CAvBI,EAwBJ,4CAxBI,EAyBJ,mCAzBI,EA0BJ,kBA1BI,EA2BJ,qBA3BI,EA4BJ,2BA5BI,EA6BJ,sBA7BI,EA8BJ,kCA9BI,EA+BJ,sBA/BI,EAgCJ,sBAhCI,EAiCJ,qBAjCI,EAkCJ,6BAlCI,EAmCJ,wBAnCI,EAoCJ,wBApCI,EAqCJ,wBArCI,EAsCJ,wBAtCI,EAuCJ,4CAvCI,EAwCJ,kBAxCI,EAyCJ,gBAzCI,EA0CJ,iCA1CI,EA2CJ,oCA3CI,EA4CJ,eA5CI,EA6CJ,kCA7CI,EA8CJ,oCA9CI,EA+CJ,qBA/CI,EAgDJ,sBAhDI,EAiDJ,wCAjDI,EAkDJ,2BAlDI,CAHZ;YAuDIC,QAAQ,EAAE,CACL,GAAEN,IAAI,CAACO,uBAAwB,EAD1B,EAEL,GAAEP,IAAI,CAACO,uBAAwB,IAF1B,EAGN;YACA,IAAIP,IAAI,CAACQ,6BAAL,GACE,CACK,GAAER,IAAI,CAACQ,6BAA8B,EAD1C,EAEK,GAAER,IAAI,CAACQ,6BAA8B,IAF1C,CADF,GAKE,EALN,CAJM;UAvDd,CADO,EAoEP;UACA,IAAIR,IAAI,CAACS,sBAAL,GACE,CACI;YACIN,GAAG,EAAE,iBADT;YAEIC,MAAM,EAAE,OAFZ;YAGIC,MAAM,EAAE,MAHZ;YAIIC,QAAQ,EAAE,CACL,GAAEN,IAAI,CAACS,sBAAuB,EADzB,EAEL,GAAET,IAAI,CAACS,sBAAuB,IAFzB;UAJd,CADJ,CADF,GAYE,EAZN,CArEO;QAFwB,CAAvC;QAuFA,OAAOlD,MAAP;MACH,CAzFO;IAHJ;EAF2B,CAAhC,CAAP;AAiGH"}

package/apps/api/ApiOutput.d.ts

@@ -0,0 +1,15 @@
+import { PulumiAppModule } from "@webiny/pulumi";
+export declare type ApiOutput = PulumiAppModule<typeof ApiOutput>;
+export declare const ApiOutput: import("@webiny/pulumi").PulumiAppModuleDefinition<import("@pulumi/pulumi").Output<import("@pulumi/pulumi").UnwrappedObject<{
+    apiDomain: string;
+    apiUrl: string;
+    apwSchedulerEventRule: string | undefined;
+    apwSchedulerEventTargetId: string | undefined;
+    apwSchedulerExecuteAction: string | undefined;
+    apwSchedulerScheduleAction: string | undefined;
+    cognitoAppClientId: string;
+    cognitoUserPoolId: string;
+    cognitoUserPoolPasswordPolicy: string;
+    dynamoDbTable: string;
+    region: string;
+}>>, void>;

package/apps/api/ApiOutput.js

@@ -0,0 +1,43 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ApiOutput = void 0;
+
+var _pulumi = require("@webiny/pulumi");
+
+var _utils = require("@webiny/cli-plugin-deploy-pulumi/utils");
+
+const ApiOutput = (0, _pulumi.createAppModule)({
+  name: "ApiOutput",
+
+  config(app) {
+    return app.addHandler(async () => {
+      const output = (0, _utils.getStackOutput)({
+        folder: "apps/api",
+        env: app.params.run.env
+      });
+
+      if (!output) {
+        throw new Error("API application is not deployed.");
+      }
+
+      return {
+        apiDomain: output["apiDomain"],
+        apiUrl: output["apiUrl"],
+        apwSchedulerEventRule: output["apwSchedulerEventRule"],
+        apwSchedulerEventTargetId: output["apwSchedulerEventTargetId"],
+        apwSchedulerExecuteAction: output["apwSchedulerExecuteAction"],
+        apwSchedulerScheduleAction: output["apwSchedulerScheduleAction"],
+        cognitoAppClientId: output["cognitoAppClientId"],
+        cognitoUserPoolId: output["cognitoUserPoolId"],
+        cognitoUserPoolPasswordPolicy: output["cognitoUserPoolPasswordPolicy"],
+        dynamoDbTable: output["dynamoDbTable"],
+        region: output["region"]
+      };
+    });
+  }
+
+});
+exports.ApiOutput = ApiOutput;

package/apps/api/ApiOutput.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ApiOutput","createAppModule","name","config","app","addHandler","output","getStackOutput","folder","env","params","run","Error","apiDomain","apiUrl","apwSchedulerEventRule","apwSchedulerEventTargetId","apwSchedulerExecuteAction","apwSchedulerScheduleAction","cognitoAppClientId","cognitoUserPoolId","cognitoUserPoolPasswordPolicy","dynamoDbTable","region"],"sources":["ApiOutput.ts"],"sourcesContent":["import { createAppModule, PulumiAppModule } from \"@webiny/pulumi\";\nimport { getStackOutput } from \"@webiny/cli-plugin-deploy-pulumi/utils\";\n\nexport type ApiOutput = PulumiAppModule<typeof ApiOutput>;\n\nexport const ApiOutput = createAppModule({\n    name: \"ApiOutput\",\n    config(app) {\n        return app.addHandler(async () => {\n            const output = getStackOutput({\n                folder: \"apps/api\",\n                env: app.params.run.env\n            });\n\n            if (!output) {\n                throw new Error(\"API application is not deployed.\");\n            }\n\n            return {\n                apiDomain: output[\"apiDomain\"] as string,\n                apiUrl: output[\"apiUrl\"] as string,\n                apwSchedulerEventRule: output[\"apwSchedulerEventRule\"] as string | undefined,\n                apwSchedulerEventTargetId: output[\"apwSchedulerEventTargetId\"] as\n                    | string\n                    | undefined,\n                apwSchedulerExecuteAction: output[\"apwSchedulerExecuteAction\"] as\n                    | string\n                    | undefined,\n                apwSchedulerScheduleAction: output[\"apwSchedulerScheduleAction\"] as\n                    | string\n                    | undefined,\n                cognitoAppClientId: output[\"cognitoAppClientId\"] as string,\n                cognitoUserPoolId: output[\"cognitoUserPoolId\"] as string,\n                cognitoUserPoolPasswordPolicy: output[\"cognitoUserPoolPasswordPolicy\"] as string,\n                dynamoDbTable: output[\"dynamoDbTable\"] as string,\n                region: output[\"region\"] as string\n            };\n        });\n    }\n});\n"],"mappings":";;;;;;;AAAA;;AACA;;AAIO,MAAMA,SAAS,GAAG,IAAAC,uBAAA,EAAgB;EACrCC,IAAI,EAAE,WAD+B;;EAErCC,MAAM,CAACC,GAAD,EAAM;IACR,OAAOA,GAAG,CAACC,UAAJ,CAAe,YAAY;MAC9B,MAAMC,MAAM,GAAG,IAAAC,qBAAA,EAAe;QAC1BC,MAAM,EAAE,UADkB;QAE1BC,GAAG,EAAEL,GAAG,CAACM,MAAJ,CAAWC,GAAX,CAAeF;MAFM,CAAf,CAAf;;MAKA,IAAI,CAACH,MAAL,EAAa;QACT,MAAM,IAAIM,KAAJ,CAAU,kCAAV,CAAN;MACH;;MAED,OAAO;QACHC,SAAS,EAAEP,MAAM,CAAC,WAAD,CADd;QAEHQ,MAAM,EAAER,MAAM,CAAC,QAAD,CAFX;QAGHS,qBAAqB,EAAET,MAAM,CAAC,uBAAD,CAH1B;QAIHU,yBAAyB,EAAEV,MAAM,CAAC,2BAAD,CAJ9B;QAOHW,yBAAyB,EAAEX,MAAM,CAAC,2BAAD,CAP9B;QAUHY,0BAA0B,EAAEZ,MAAM,CAAC,4BAAD,CAV/B;QAaHa,kBAAkB,EAAEb,MAAM,CAAC,oBAAD,CAbvB;QAcHc,iBAAiB,EAAEd,MAAM,CAAC,mBAAD,CAdtB;QAeHe,6BAA6B,EAAEf,MAAM,CAAC,+BAAD,CAflC;QAgBHgB,aAAa,EAAEhB,MAAM,CAAC,eAAD,CAhBlB;QAiBHiB,MAAM,EAAEjB,MAAM,CAAC,QAAD;MAjBX,CAAP;IAmBH,CA7BM,CAAP;EA8BH;;AAjCoC,CAAhB,CAAlB"}

package/apps/api/ApiPageBuilder.d.ts

@@ -0,0 +1,24 @@
+import { PulumiAppModule } from "@webiny/pulumi";
+interface PageBuilderParams {
+    env: Record<string, any>;
+}
+export declare type ApiPageBuilder = PulumiAppModule<typeof ApiPageBuilder>;
+export declare const ApiPageBuilder: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    export: {
+        role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role").Role>;
+        policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy").Policy>;
+        functions: {
+            process: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+            combine: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+        };
+    };
+    import: {
+        role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role").Role>;
+        policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy").Policy>;
+        functions: {
+            create: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+            process: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+        };
+    };
+}, PageBuilderParams>;
+export {};