@webiny/pulumi-aws 0.0.0-ee-vpcs.549378cf03

package/apps/core/createCorePulumiApp.d.ts

@@ -0,0 +1,64 @@
+import { PulumiAppParam } from "@webiny/pulumi";
+export declare type CorePulumiApp = ReturnType<typeof createCorePulumiApp>;
+export interface CreateCorePulumiAppParams {
+    /**
+     * Secures against deleting database by accident.
+     * By default enabled in production environments.
+     */
+    protect?: PulumiAppParam<boolean>;
+    /**
+     * Enables ElasticSearch infrastructure.
+     * Note that it requires also changes in application code.
+     */
+    elasticSearch?: PulumiAppParam<boolean>;
+    /**
+     * Enables VPC for the application.
+     * By default enabled in production environments.
+     */
+    vpc?: PulumiAppParam<boolean>;
+    /**
+     * Additional settings for backwards compatibility.
+     */
+    legacy?: PulumiAppParam<CoreAppLegacyConfig>;
+    /**
+     * Provides a way to adjust existing Pulumi code (cloud infrastructure resources)
+     * or add additional ones into the mix.
+     */
+    pulumi?: (app: CorePulumiApp) => void | Promise<void>;
+    /**
+     * Prefixes names of all Pulumi cloud infrastructure resource with given prefix.
+     */
+    pulumiResourceNamePrefix?: PulumiAppParam<string>;
+}
+export interface CoreAppLegacyConfig {
+    useEmailAsUsername?: boolean;
+}
+export declare function createCorePulumiApp(projectAppParams?: CreateCorePulumiAppParams): import("@webiny/pulumi").PulumiApp<{
+    fileManagerBucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket").Bucket>;
+    eventBus: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch/eventBus").EventBus>;
+    elasticSearch: {
+        domain: import("@webiny/pulumi").PulumiAppResource<import("@webiny/pulumi").PulumiAppResourceConstructor<import("@pulumi/aws/elasticsearch/domain").Domain, any>> | import("@webiny/pulumi").PulumiAppRemoteResource<import("@pulumi/aws/elasticsearch").GetDomainResult>;
+        domainPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/elasticsearch/domainPolicy").DomainPolicy> | undefined;
+        table: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/dynamodb/table").Table>;
+        dynamoToElastic: {
+            role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role").Role>;
+            policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy").Policy>;
+            lambda: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+            eventSourceMapping: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/eventSourceMapping").EventSourceMapping>;
+        };
+    } | null;
+    userPool: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cognito/userPool").UserPool>;
+    userPoolClient: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cognito/userPoolClient").UserPoolClient>;
+    dynamoDbTable: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/dynamodb/table").Table>;
+    vpc: {
+        vpc: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/vpc").Vpc>;
+        subnets: {
+            public: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/subnet").Subnet>[];
+            private: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/subnet").Subnet>[];
+        };
+        routeTables: {
+            privateSubnets: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/routeTable").RouteTable>;
+            publicSubnets: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2/routeTable").RouteTable>;
+        };
+    } | null;
+}>;

package/apps/core/createCorePulumiApp.js

@@ -0,0 +1,104 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault").default;
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createCorePulumiApp = createCorePulumiApp;
+
+var _objectSpread2 = _interopRequireDefault(require("@babel/runtime/helpers/objectSpread2"));
+
+var _pulumi = require("@webiny/pulumi");
+
+var _CoreCognito = require("./CoreCognito");
+
+var _CoreDynamo = require("./CoreDynamo");
+
+var _CoreElasticSearch = require("./CoreElasticSearch");
+
+var _CoreEventBus = require("./CoreEventBus");
+
+var _CoreFileManager = require("./CoreFileManager");
+
+var _CoreVpc = require("./CoreVpc");
+
+var _utils = require("../../utils");
+
+function createCorePulumiApp(projectAppParams = {}) {
+  return (0, _pulumi.createPulumiApp)({
+    name: "core",
+    path: "apps/core",
+    config: projectAppParams,
+    program: async app => {
+      const pulumiResourceNamePrefix = app.getParam(projectAppParams.pulumiResourceNamePrefix);
+
+      if (pulumiResourceNamePrefix) {
+        app.onResource(resource => {
+          if (!resource.name.startsWith(pulumiResourceNamePrefix)) {
+            resource.name = `${pulumiResourceNamePrefix}${resource.name}`;
+          }
+        });
+      } // Overrides must be applied via a handler, registered at the very start of the program.
+      // By doing this, we're ensuring user's adjustments are not applied to late.
+
+
+      if (projectAppParams.pulumi) {
+        app.addHandler(() => {
+          return projectAppParams.pulumi(app);
+        });
+      }
+
+      const prod = app.params.run.env === "prod";
+      const protect = app.getParam(projectAppParams.protect) ?? prod;
+      const legacyConfig = app.getParam(projectAppParams.legacy) || {}; // Setup DynamoDB table
+
+      const dynamoDbTable = app.addModule(_CoreDynamo.CoreDynamo, {
+        protect
+      }); // Setup VPC
+
+      const vpcEnabled = app.getParam(projectAppParams === null || projectAppParams === void 0 ? void 0 : projectAppParams.vpc) ?? prod;
+      const vpc = vpcEnabled ? app.addModule(_CoreVpc.CoreVpc) : null; // Setup Cognito
+
+      const cognito = app.addModule(_CoreCognito.CoreCognito, {
+        protect,
+        useEmailAsUsername: legacyConfig.useEmailAsUsername ?? false
+      }); // Setup event bus
+
+      const eventBus = app.addModule(_CoreEventBus.CoreEventBus); // Setup file core bucket
+
+      const {
+        bucket: fileManagerBucket
+      } = app.addModule(_CoreFileManager.CoreFileManger, {
+        protect
+      });
+      const elasticSearch = app.getParam(projectAppParams === null || projectAppParams === void 0 ? void 0 : projectAppParams.elasticSearch) ? app.addModule(_CoreElasticSearch.ElasticSearch, {
+        protect
+      }) : null;
+      app.addOutputs({
+        fileManagerBucketId: fileManagerBucket.output.id,
+        primaryDynamodbTableArn: dynamoDbTable.output.arn,
+        primaryDynamodbTableName: dynamoDbTable.output.name,
+        primaryDynamodbTableHashKey: dynamoDbTable.output.hashKey,
+        primaryDynamodbTableRangeKey: dynamoDbTable.output.rangeKey,
+        cognitoUserPoolId: cognito.userPool.output.id,
+        cognitoUserPoolArn: cognito.userPool.output.arn,
+        cognitoUserPoolPasswordPolicy: cognito.userPool.output.passwordPolicy,
+        cognitoAppClientId: cognito.userPoolClient.output.id,
+        eventBusArn: eventBus.output.arn
+      });
+      (0, _utils.tagResources)({
+        WbyProjectName: String(process.env["WEBINY_PROJECT_NAME"]),
+        WbyEnvironment: String(process.env["WEBINY_ENV"])
+      });
+      return (0, _objectSpread2.default)((0, _objectSpread2.default)({
+        dynamoDbTable,
+        vpc
+      }, cognito), {}, {
+        fileManagerBucket,
+        eventBus,
+        elasticSearch
+      });
+    }
+  });
+}

package/apps/core/createCorePulumiApp.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createCorePulumiApp","projectAppParams","createPulumiApp","name","path","config","program","app","pulumiResourceNamePrefix","getParam","onResource","resource","startsWith","pulumi","addHandler","prod","params","run","env","protect","legacyConfig","legacy","dynamoDbTable","addModule","CoreDynamo","vpcEnabled","vpc","CoreVpc","cognito","CoreCognito","useEmailAsUsername","eventBus","CoreEventBus","bucket","fileManagerBucket","CoreFileManger","elasticSearch","ElasticSearch","addOutputs","fileManagerBucketId","output","id","primaryDynamodbTableArn","arn","primaryDynamodbTableName","primaryDynamodbTableHashKey","hashKey","primaryDynamodbTableRangeKey","rangeKey","cognitoUserPoolId","userPool","cognitoUserPoolArn","cognitoUserPoolPasswordPolicy","passwordPolicy","cognitoAppClientId","userPoolClient","eventBusArn","tagResources","WbyProjectName","String","process","WbyEnvironment"],"sources":["createCorePulumiApp.ts"],"sourcesContent":["import { createPulumiApp, PulumiAppParam } from \"@webiny/pulumi\";\nimport { CoreCognito } from \"./CoreCognito\";\nimport { CoreDynamo } from \"./CoreDynamo\";\nimport { ElasticSearch } from \"./CoreElasticSearch\";\nimport { CoreEventBus } from \"./CoreEventBus\";\nimport { CoreFileManger } from \"./CoreFileManager\";\nimport { CoreVpc } from \"./CoreVpc\";\nimport { tagResources } from \"~/utils\";\n\nexport type CorePulumiApp = ReturnType<typeof createCorePulumiApp>;\n\nexport interface CreateCorePulumiAppParams {\n    /**\n     * Secures against deleting database by accident.\n     * By default enabled in production environments.\n     */\n    protect?: PulumiAppParam<boolean>;\n\n    /**\n     * Enables ElasticSearch infrastructure.\n     * Note that it requires also changes in application code.\n     */\n    elasticSearch?: PulumiAppParam<boolean>;\n\n    /**\n     * Enables VPC for the application.\n     * By default enabled in production environments.\n     */\n    vpc?: PulumiAppParam<boolean>;\n\n    /**\n     * Additional settings for backwards compatibility.\n     */\n    legacy?: PulumiAppParam<CoreAppLegacyConfig>;\n\n    /**\n     * Provides a way to adjust existing Pulumi code (cloud infrastructure resources)\n     * or add additional ones into the mix.\n     */\n    pulumi?: (app: CorePulumiApp) => void | Promise<void>;\n\n    /**\n     * Prefixes names of all Pulumi cloud infrastructure resource with given prefix.\n     */\n    pulumiResourceNamePrefix?: PulumiAppParam<string>;\n}\n\nexport interface CoreAppLegacyConfig {\n    useEmailAsUsername?: boolean;\n}\n\nexport function createCorePulumiApp(projectAppParams: CreateCorePulumiAppParams = {}) {\n    return createPulumiApp({\n        name: \"core\",\n        path: \"apps/core\",\n        config: projectAppParams,\n        program: async app => {\n            const pulumiResourceNamePrefix = app.getParam(\n                projectAppParams.pulumiResourceNamePrefix\n            );\n            if (pulumiResourceNamePrefix) {\n                app.onResource(resource => {\n                    if (!resource.name.startsWith(pulumiResourceNamePrefix)) {\n                        resource.name = `${pulumiResourceNamePrefix}${resource.name}`;\n                    }\n                });\n            }\n\n            // Overrides must be applied via a handler, registered at the very start of the program.\n            // By doing this, we're ensuring user's adjustments are not applied to late.\n            if (projectAppParams.pulumi) {\n                app.addHandler(() => {\n                    return projectAppParams.pulumi!(app as CorePulumiApp);\n                });\n            }\n\n            const prod = app.params.run.env === \"prod\";\n            const protect = app.getParam(projectAppParams.protect) ?? prod;\n            const legacyConfig = app.getParam(projectAppParams.legacy) || {};\n\n            // Setup DynamoDB table\n            const dynamoDbTable = app.addModule(CoreDynamo, { protect });\n\n            // Setup VPC\n            const vpcEnabled = app.getParam(projectAppParams?.vpc) ?? prod;\n            const vpc = vpcEnabled ? app.addModule(CoreVpc) : null;\n\n            // Setup Cognito\n            const cognito = app.addModule(CoreCognito, {\n                protect,\n                useEmailAsUsername: legacyConfig.useEmailAsUsername ?? false\n            });\n\n            // Setup event bus\n            const eventBus = app.addModule(CoreEventBus);\n\n            // Setup file core bucket\n            const { bucket: fileManagerBucket } = app.addModule(CoreFileManger, { protect });\n\n            const elasticSearch = app.getParam(projectAppParams?.elasticSearch)\n                ? app.addModule(ElasticSearch, { protect })\n                : null;\n\n            app.addOutputs({\n                fileManagerBucketId: fileManagerBucket.output.id,\n                primaryDynamodbTableArn: dynamoDbTable.output.arn,\n                primaryDynamodbTableName: dynamoDbTable.output.name,\n                primaryDynamodbTableHashKey: dynamoDbTable.output.hashKey,\n                primaryDynamodbTableRangeKey: dynamoDbTable.output.rangeKey,\n                cognitoUserPoolId: cognito.userPool.output.id,\n                cognitoUserPoolArn: cognito.userPool.output.arn,\n                cognitoUserPoolPasswordPolicy: cognito.userPool.output.passwordPolicy,\n                cognitoAppClientId: cognito.userPoolClient.output.id,\n                eventBusArn: eventBus.output.arn\n            });\n\n            tagResources({\n                WbyProjectName: String(process.env[\"WEBINY_PROJECT_NAME\"]),\n                WbyEnvironment: String(process.env[\"WEBINY_ENV\"])\n            });\n\n            return {\n                dynamoDbTable,\n                vpc,\n                ...cognito,\n                fileManagerBucket,\n                eventBus,\n                elasticSearch\n            };\n        }\n    });\n}\n"],"mappings":";;;;;;;;;;;AAAA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AA4CO,SAASA,mBAAT,CAA6BC,gBAA2C,GAAG,EAA3E,EAA+E;EAClF,OAAO,IAAAC,uBAAA,EAAgB;IACnBC,IAAI,EAAE,MADa;IAEnBC,IAAI,EAAE,WAFa;IAGnBC,MAAM,EAAEJ,gBAHW;IAInBK,OAAO,EAAE,MAAMC,GAAN,IAAa;MAClB,MAAMC,wBAAwB,GAAGD,GAAG,CAACE,QAAJ,CAC7BR,gBAAgB,CAACO,wBADY,CAAjC;;MAGA,IAAIA,wBAAJ,EAA8B;QAC1BD,GAAG,CAACG,UAAJ,CAAeC,QAAQ,IAAI;UACvB,IAAI,CAACA,QAAQ,CAACR,IAAT,CAAcS,UAAd,CAAyBJ,wBAAzB,CAAL,EAAyD;YACrDG,QAAQ,CAACR,IAAT,GAAiB,GAAEK,wBAAyB,GAAEG,QAAQ,CAACR,IAAK,EAA5D;UACH;QACJ,CAJD;MAKH,CAViB,CAYlB;MACA;;;MACA,IAAIF,gBAAgB,CAACY,MAArB,EAA6B;QACzBN,GAAG,CAACO,UAAJ,CAAe,MAAM;UACjB,OAAOb,gBAAgB,CAACY,MAAjB,CAAyBN,GAAzB,CAAP;QACH,CAFD;MAGH;;MAED,MAAMQ,IAAI,GAAGR,GAAG,CAACS,MAAJ,CAAWC,GAAX,CAAeC,GAAf,KAAuB,MAApC;MACA,MAAMC,OAAO,GAAGZ,GAAG,CAACE,QAAJ,CAAaR,gBAAgB,CAACkB,OAA9B,KAA0CJ,IAA1D;MACA,MAAMK,YAAY,GAAGb,GAAG,CAACE,QAAJ,CAAaR,gBAAgB,CAACoB,MAA9B,KAAyC,EAA9D,CAtBkB,CAwBlB;;MACA,MAAMC,aAAa,GAAGf,GAAG,CAACgB,SAAJ,CAAcC,sBAAd,EAA0B;QAAEL;MAAF,CAA1B,CAAtB,CAzBkB,CA2BlB;;MACA,MAAMM,UAAU,GAAGlB,GAAG,CAACE,QAAJ,CAAaR,gBAAb,aAAaA,gBAAb,uBAAaA,gBAAgB,CAAEyB,GAA/B,KAAuCX,IAA1D;MACA,MAAMW,GAAG,GAAGD,UAAU,GAAGlB,GAAG,CAACgB,SAAJ,CAAcI,gBAAd,CAAH,GAA4B,IAAlD,CA7BkB,CA+BlB;;MACA,MAAMC,OAAO,GAAGrB,GAAG,CAACgB,SAAJ,CAAcM,wBAAd,EAA2B;QACvCV,OADuC;QAEvCW,kBAAkB,EAAEV,YAAY,CAACU,kBAAb,IAAmC;MAFhB,CAA3B,CAAhB,CAhCkB,CAqClB;;MACA,MAAMC,QAAQ,GAAGxB,GAAG,CAACgB,SAAJ,CAAcS,0BAAd,CAAjB,CAtCkB,CAwClB;;MACA,MAAM;QAAEC,MAAM,EAAEC;MAAV,IAAgC3B,GAAG,CAACgB,SAAJ,CAAcY,+BAAd,EAA8B;QAAEhB;MAAF,CAA9B,CAAtC;MAEA,MAAMiB,aAAa,GAAG7B,GAAG,CAACE,QAAJ,CAAaR,gBAAb,aAAaA,gBAAb,uBAAaA,gBAAgB,CAAEmC,aAA/B,IAChB7B,GAAG,CAACgB,SAAJ,CAAcc,gCAAd,EAA6B;QAAElB;MAAF,CAA7B,CADgB,GAEhB,IAFN;MAIAZ,GAAG,CAAC+B,UAAJ,CAAe;QACXC,mBAAmB,EAAEL,iBAAiB,CAACM,MAAlB,CAAyBC,EADnC;QAEXC,uBAAuB,EAAEpB,aAAa,CAACkB,MAAd,CAAqBG,GAFnC;QAGXC,wBAAwB,EAAEtB,aAAa,CAACkB,MAAd,CAAqBrC,IAHpC;QAIX0C,2BAA2B,EAAEvB,aAAa,CAACkB,MAAd,CAAqBM,OAJvC;QAKXC,4BAA4B,EAAEzB,aAAa,CAACkB,MAAd,CAAqBQ,QALxC;QAMXC,iBAAiB,EAAErB,OAAO,CAACsB,QAAR,CAAiBV,MAAjB,CAAwBC,EANhC;QAOXU,kBAAkB,EAAEvB,OAAO,CAACsB,QAAR,CAAiBV,MAAjB,CAAwBG,GAPjC;QAQXS,6BAA6B,EAAExB,OAAO,CAACsB,QAAR,CAAiBV,MAAjB,CAAwBa,cAR5C;QASXC,kBAAkB,EAAE1B,OAAO,CAAC2B,cAAR,CAAuBf,MAAvB,CAA8BC,EATvC;QAUXe,WAAW,EAAEzB,QAAQ,CAACS,MAAT,CAAgBG;MAVlB,CAAf;MAaA,IAAAc,mBAAA,EAAa;QACTC,cAAc,EAAEC,MAAM,CAACC,OAAO,CAAC1C,GAAR,CAAY,qBAAZ,CAAD,CADb;QAET2C,cAAc,EAAEF,MAAM,CAACC,OAAO,CAAC1C,GAAR,CAAY,YAAZ,CAAD;MAFb,CAAb;MAKA;QACII,aADJ;QAEII;MAFJ,GAGOE,OAHP;QAIIM,iBAJJ;QAKIH,QALJ;QAMIK;MANJ;IAQH;EA7EkB,CAAhB,CAAP;AA+EH"}

package/apps/core/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./CoreCognito";
+export * from "./CoreDynamo";
+export * from "./CoreEventBus";
+export * from "./CoreFileManager";
+export * from "./CoreVpc";
+export * from "./createCorePulumiApp";

package/apps/core/index.js

@@ -0,0 +1,83 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+
+var _CoreCognito = require("./CoreCognito");
+
+Object.keys(_CoreCognito).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _CoreCognito[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _CoreCognito[key];
+    }
+  });
+});
+
+var _CoreDynamo = require("./CoreDynamo");
+
+Object.keys(_CoreDynamo).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _CoreDynamo[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _CoreDynamo[key];
+    }
+  });
+});
+
+var _CoreEventBus = require("./CoreEventBus");
+
+Object.keys(_CoreEventBus).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _CoreEventBus[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _CoreEventBus[key];
+    }
+  });
+});
+
+var _CoreFileManager = require("./CoreFileManager");
+
+Object.keys(_CoreFileManager).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _CoreFileManager[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _CoreFileManager[key];
+    }
+  });
+});
+
+var _CoreVpc = require("./CoreVpc");
+
+Object.keys(_CoreVpc).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _CoreVpc[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _CoreVpc[key];
+    }
+  });
+});
+
+var _createCorePulumiApp = require("./createCorePulumiApp");
+
+Object.keys(_createCorePulumiApp).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _createCorePulumiApp[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _createCorePulumiApp[key];
+    }
+  });
+});

package/apps/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["index.ts"],"sourcesContent":["export * from \"./CoreCognito\";\nexport * from \"./CoreDynamo\";\nexport * from \"./CoreEventBus\";\nexport * from \"./CoreFileManager\";\nexport * from \"./CoreVpc\";\nexport * from \"./createCorePulumiApp\";\n"],"mappings":";;;;;;AAAA;;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}

package/apps/createAppBucket.d.ts

@@ -0,0 +1,13 @@
+import * as aws from "@pulumi/aws";
+import { PulumiApp } from "@webiny/pulumi";
+export declare function createPublicAppBucket(app: PulumiApp, name: string): {
+    bucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket").Bucket>;
+    origin: aws.types.input.cloudfront.DistributionOrigin;
+};
+export declare function createPrivateAppBucket(app: PulumiApp, name: string): {
+    bucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket").Bucket>;
+    originIdentity: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/originAccessIdentity").OriginAccessIdentity>;
+    origin: aws.types.input.cloudfront.DistributionOrigin;
+    bucketPublicAccessBlock: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPublicAccessBlock").BucketPublicAccessBlock>;
+    bucketPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPolicy").BucketPolicy>;
+};

package/apps/createAppBucket.js

@@ -0,0 +1,106 @@
+"use strict";
+
+var _interopRequireWildcard = require("@babel/runtime/helpers/interopRequireWildcard").default;
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createPrivateAppBucket = createPrivateAppBucket;
+exports.createPublicAppBucket = createPublicAppBucket;
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+function createPublicAppBucket(app, name) {
+  const bucket = app.addResource(aws.s3.Bucket, {
+    name: name,
+    config: {
+      acl: aws.s3.CannedAcl.PublicRead,
+      forceDestroy: true,
+      website: {
+        indexDocument: "index.html",
+        errorDocument: "_NOT_FOUND_PAGE_/index.html"
+      }
+    }
+  });
+  const origin = {
+    originId: bucket.output.arn,
+    domainName: bucket.output.websiteEndpoint,
+    customOriginConfig: {
+      originProtocolPolicy: "http-only",
+      httpPort: 80,
+      httpsPort: 443,
+      originSslProtocols: ["TLSv1.2"]
+    }
+  };
+  return {
+    bucket,
+    origin
+  };
+} // Forces S3 buckets to be available only through a cloudfront distribution.
+
+
+function createPrivateAppBucket(app, name) {
+  const bucket = app.addResource(aws.s3.Bucket, {
+    name: name,
+    config: {
+      acl: aws.s3.CannedAcl.Private,
+      forceDestroy: true
+    }
+  }); // Origin Identity is a kind of AWS user that represents Cloudfront distribution
+  // We can add IAM policies to it later, to allow accessing private S3 bucket
+
+  const originIdentity = app.addResource(aws.cloudfront.OriginAccessIdentity, {
+    name: `${name}-origin-identity`,
+    config: {}
+  });
+  const origin = {
+    originId: bucket.output.arn,
+    domainName: bucket.output.bucket.apply( // We need to create a regional domain name. Otherwise, we'll run into the following issue:
+    // https://aws.amazon.com/premiumsupport/knowledge-center/s3-http-307-response/
+    name => `${name}.s3.${String(process.env.AWS_REGION)}.amazonaws.com`),
+    s3OriginConfig: {
+      originAccessIdentity: originIdentity.output.cloudfrontAccessIdentityPath
+    }
+  }; // block any public access
+
+  const bucketPublicAccessBlock = app.addResource(aws.s3.BucketPublicAccessBlock, {
+    name: `${name}-bucket-block-access`,
+    config: {
+      bucket: bucket.output.id,
+      blockPublicAcls: true,
+      blockPublicPolicy: true,
+      ignorePublicAcls: true,
+      restrictPublicBuckets: true
+    }
+  }); // Create an IAM policy to allow access to S3 bucket from cloudfront
+
+  const bucketPolicy = app.addResource(aws.s3.BucketPolicy, {
+    name: `${name}-bucket-policy`,
+    config: {
+      bucket: bucket.output.bucket,
+      policy: {
+        Version: "2012-10-17",
+        Statement: bucket.output.arn.apply(arn => {
+          const statements = [{
+            Effect: "Allow",
+            Principal: {
+              AWS: originIdentity.output.iamArn
+            },
+            // we need GetObject to retrieve objects from S3
+            // and ListBucket allows to properly handle non-existing files (404)
+            Action: ["s3:ListBucket", "s3:GetObject"],
+            Resource: [`${arn}`, `${arn}/*`]
+          }];
+          return statements;
+        })
+      }
+    }
+  });
+  return {
+    bucket,
+    originIdentity,
+    origin,
+    bucketPublicAccessBlock,
+    bucketPolicy
+  };
+}

package/apps/createAppBucket.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createPublicAppBucket","app","name","bucket","addResource","aws","s3","Bucket","config","acl","CannedAcl","PublicRead","forceDestroy","website","indexDocument","errorDocument","origin","originId","output","arn","domainName","websiteEndpoint","customOriginConfig","originProtocolPolicy","httpPort","httpsPort","originSslProtocols","createPrivateAppBucket","Private","originIdentity","cloudfront","OriginAccessIdentity","apply","String","process","env","AWS_REGION","s3OriginConfig","originAccessIdentity","cloudfrontAccessIdentityPath","bucketPublicAccessBlock","BucketPublicAccessBlock","id","blockPublicAcls","blockPublicPolicy","ignorePublicAcls","restrictPublicBuckets","bucketPolicy","BucketPolicy","policy","Version","Statement","statements","Effect","Principal","AWS","iamArn","Action","Resource"],"sources":["createAppBucket.ts"],"sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport { PulumiApp } from \"@webiny/pulumi\";\n\nexport function createPublicAppBucket(app: PulumiApp, name: string) {\n    const bucket = app.addResource(aws.s3.Bucket, {\n        name: name,\n        config: {\n            acl: aws.s3.CannedAcl.PublicRead,\n            forceDestroy: true,\n            website: {\n                indexDocument: \"index.html\",\n                errorDocument: \"_NOT_FOUND_PAGE_/index.html\"\n            }\n        }\n    });\n\n    const origin: aws.types.input.cloudfront.DistributionOrigin = {\n        originId: bucket.output.arn,\n        domainName: bucket.output.websiteEndpoint,\n        customOriginConfig: {\n            originProtocolPolicy: \"http-only\",\n            httpPort: 80,\n            httpsPort: 443,\n            originSslProtocols: [\"TLSv1.2\"]\n        }\n    };\n\n    return {\n        bucket,\n        origin\n    };\n}\n\n// Forces S3 buckets to be available only through a cloudfront distribution.\nexport function createPrivateAppBucket(app: PulumiApp, name: string) {\n    const bucket = app.addResource(aws.s3.Bucket, {\n        name: name,\n        config: {\n            acl: aws.s3.CannedAcl.Private,\n            forceDestroy: true\n        }\n    });\n\n    // Origin Identity is a kind of AWS user that represents Cloudfront distribution\n    // We can add IAM policies to it later, to allow accessing private S3 bucket\n    const originIdentity = app.addResource(aws.cloudfront.OriginAccessIdentity, {\n        name: `${name}-origin-identity`,\n        config: {}\n    });\n\n    const origin: aws.types.input.cloudfront.DistributionOrigin = {\n        originId: bucket.output.arn,\n        domainName: bucket.output.bucket.apply(\n            // We need to create a regional domain name. Otherwise, we'll run into the following issue:\n            // https://aws.amazon.com/premiumsupport/knowledge-center/s3-http-307-response/\n            name => `${name}.s3.${String(process.env.AWS_REGION)}.amazonaws.com`\n        ),\n        s3OriginConfig: {\n            originAccessIdentity: originIdentity.output.cloudfrontAccessIdentityPath\n        }\n    };\n\n    // block any public access\n    const bucketPublicAccessBlock = app.addResource(aws.s3.BucketPublicAccessBlock, {\n        name: `${name}-bucket-block-access`,\n        config: {\n            bucket: bucket.output.id,\n            blockPublicAcls: true,\n            blockPublicPolicy: true,\n            ignorePublicAcls: true,\n            restrictPublicBuckets: true\n        }\n    });\n\n    // Create an IAM policy to allow access to S3 bucket from cloudfront\n    const bucketPolicy = app.addResource(aws.s3.BucketPolicy, {\n        name: `${name}-bucket-policy`,\n        config: {\n            bucket: bucket.output.bucket,\n            policy: {\n                Version: \"2012-10-17\",\n                Statement: bucket.output.arn.apply(arn => {\n                    const statements: aws.iam.PolicyStatement[] = [\n                        {\n                            Effect: \"Allow\",\n                            Principal: { AWS: originIdentity.output.iamArn },\n                            // we need GetObject to retrieve objects from S3\n                            // and ListBucket allows to properly handle non-existing files (404)\n                            Action: [\"s3:ListBucket\", \"s3:GetObject\"],\n                            Resource: [`${arn}`, `${arn}/*`]\n                        }\n                    ];\n\n                    return statements;\n                })\n            }\n        }\n    });\n\n    return {\n        bucket,\n        originIdentity,\n        origin,\n        bucketPublicAccessBlock,\n        bucketPolicy\n    };\n}\n"],"mappings":";;;;;;;;;;AAAA;;AAGO,SAASA,qBAAT,CAA+BC,GAA/B,EAA+CC,IAA/C,EAA6D;EAChE,MAAMC,MAAM,GAAGF,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,EAAJ,CAAOC,MAAvB,EAA+B;IAC1CL,IAAI,EAAEA,IADoC;IAE1CM,MAAM,EAAE;MACJC,GAAG,EAAEJ,GAAG,CAACC,EAAJ,CAAOI,SAAP,CAAiBC,UADlB;MAEJC,YAAY,EAAE,IAFV;MAGJC,OAAO,EAAE;QACLC,aAAa,EAAE,YADV;QAELC,aAAa,EAAE;MAFV;IAHL;EAFkC,CAA/B,CAAf;EAYA,MAAMC,MAAqD,GAAG;IAC1DC,QAAQ,EAAEd,MAAM,CAACe,MAAP,CAAcC,GADkC;IAE1DC,UAAU,EAAEjB,MAAM,CAACe,MAAP,CAAcG,eAFgC;IAG1DC,kBAAkB,EAAE;MAChBC,oBAAoB,EAAE,WADN;MAEhBC,QAAQ,EAAE,EAFM;MAGhBC,SAAS,EAAE,GAHK;MAIhBC,kBAAkB,EAAE,CAAC,SAAD;IAJJ;EAHsC,CAA9D;EAWA,OAAO;IACHvB,MADG;IAEHa;EAFG,CAAP;AAIH,C,CAED;;;AACO,SAASW,sBAAT,CAAgC1B,GAAhC,EAAgDC,IAAhD,EAA8D;EACjE,MAAMC,MAAM,GAAGF,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,EAAJ,CAAOC,MAAvB,EAA+B;IAC1CL,IAAI,EAAEA,IADoC;IAE1CM,MAAM,EAAE;MACJC,GAAG,EAAEJ,GAAG,CAACC,EAAJ,CAAOI,SAAP,CAAiBkB,OADlB;MAEJhB,YAAY,EAAE;IAFV;EAFkC,CAA/B,CAAf,CADiE,CASjE;EACA;;EACA,MAAMiB,cAAc,GAAG5B,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACyB,UAAJ,CAAeC,oBAA/B,EAAqD;IACxE7B,IAAI,EAAG,GAAEA,IAAK,kBAD0D;IAExEM,MAAM,EAAE;EAFgE,CAArD,CAAvB;EAKA,MAAMQ,MAAqD,GAAG;IAC1DC,QAAQ,EAAEd,MAAM,CAACe,MAAP,CAAcC,GADkC;IAE1DC,UAAU,EAAEjB,MAAM,CAACe,MAAP,CAAcf,MAAd,CAAqB6B,KAArB,EACR;IACA;IACA9B,IAAI,IAAK,GAAEA,IAAK,OAAM+B,MAAM,CAACC,OAAO,CAACC,GAAR,CAAYC,UAAb,CAAyB,gBAH7C,CAF8C;IAO1DC,cAAc,EAAE;MACZC,oBAAoB,EAAET,cAAc,CAACX,MAAf,CAAsBqB;IADhC;EAP0C,CAA9D,CAhBiE,CA4BjE;;EACA,MAAMC,uBAAuB,GAAGvC,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,EAAJ,CAAOmC,uBAAvB,EAAgD;IAC5EvC,IAAI,EAAG,GAAEA,IAAK,sBAD8D;IAE5EM,MAAM,EAAE;MACJL,MAAM,EAAEA,MAAM,CAACe,MAAP,CAAcwB,EADlB;MAEJC,eAAe,EAAE,IAFb;MAGJC,iBAAiB,EAAE,IAHf;MAIJC,gBAAgB,EAAE,IAJd;MAKJC,qBAAqB,EAAE;IALnB;EAFoE,CAAhD,CAAhC,CA7BiE,CAwCjE;;EACA,MAAMC,YAAY,GAAG9C,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,EAAJ,CAAO0C,YAAvB,EAAqC;IACtD9C,IAAI,EAAG,GAAEA,IAAK,gBADwC;IAEtDM,MAAM,EAAE;MACJL,MAAM,EAAEA,MAAM,CAACe,MAAP,CAAcf,MADlB;MAEJ8C,MAAM,EAAE;QACJC,OAAO,EAAE,YADL;QAEJC,SAAS,EAAEhD,MAAM,CAACe,MAAP,CAAcC,GAAd,CAAkBa,KAAlB,CAAwBb,GAAG,IAAI;UACtC,MAAMiC,UAAqC,GAAG,CAC1C;YACIC,MAAM,EAAE,OADZ;YAEIC,SAAS,EAAE;cAAEC,GAAG,EAAE1B,cAAc,CAACX,MAAf,CAAsBsC;YAA7B,CAFf;YAGI;YACA;YACAC,MAAM,EAAE,CAAC,eAAD,EAAkB,cAAlB,CALZ;YAMIC,QAAQ,EAAE,CAAE,GAAEvC,GAAI,EAAR,EAAY,GAAEA,GAAI,IAAlB;UANd,CAD0C,CAA9C;UAWA,OAAOiC,UAAP;QACH,CAbU;MAFP;IAFJ;EAF8C,CAArC,CAArB;EAwBA,OAAO;IACHjD,MADG;IAEH0B,cAFG;IAGHb,MAHG;IAIHwB,uBAJG;IAKHO;EALG,CAAP;AAOH"}

package/apps/customDomain.d.ts

@@ -0,0 +1,9 @@
+import { Input } from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { PulumiAppResource } from "@webiny/pulumi";
+export interface CustomDomainParams {
+    domains: Input<string[]>;
+    acmCertificateArn: Input<string>;
+    sslSupportMethod?: Input<string>;
+}
+export declare function applyCustomDomain(cloudfront: PulumiAppResource<typeof aws.cloudfront.Distribution>, params: CustomDomainParams): void;

package/apps/customDomain.js

@@ -0,0 +1,14 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.applyCustomDomain = applyCustomDomain;
+
+function applyCustomDomain(cloudfront, params) {
+  cloudfront.config.aliases(params.domains);
+  cloudfront.config.viewerCertificate({
+    acmCertificateArn: params.acmCertificateArn,
+    sslSupportMethod: params.sslSupportMethod ?? "sni-only"
+  });
+}

package/apps/customDomain.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["applyCustomDomain","cloudfront","params","config","aliases","domains","viewerCertificate","acmCertificateArn","sslSupportMethod"],"sources":["customDomain.ts"],"sourcesContent":["import { Input } from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\nimport { PulumiAppResource } from \"@webiny/pulumi\";\n\nexport interface CustomDomainParams {\n    domains: Input<string[]>;\n    acmCertificateArn: Input<string>;\n    sslSupportMethod?: Input<string>;\n}\n\nexport function applyCustomDomain(\n    cloudfront: PulumiAppResource<typeof aws.cloudfront.Distribution>,\n    params: CustomDomainParams\n) {\n    cloudfront.config.aliases(params.domains);\n\n    cloudfront.config.viewerCertificate({\n        acmCertificateArn: params.acmCertificateArn,\n        sslSupportMethod: params.sslSupportMethod ?? \"sni-only\"\n    });\n}\n"],"mappings":";;;;;;;AAUO,SAASA,iBAAT,CACHC,UADG,EAEHC,MAFG,EAGL;EACED,UAAU,CAACE,MAAX,CAAkBC,OAAlB,CAA0BF,MAAM,CAACG,OAAjC;EAEAJ,UAAU,CAACE,MAAX,CAAkBG,iBAAlB,CAAoC;IAChCC,iBAAiB,EAAEL,MAAM,CAACK,iBADM;IAEhCC,gBAAgB,EAAEN,MAAM,CAACM,gBAAP,IAA2B;EAFb,CAApC;AAIH"}

package/apps/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./core";
+export * from "./common";
+export * from "./api";
+export * from "./react";
+export * from "./admin";
+export * from "./website";
+export { CustomDomainParams } from "./customDomain";

package/apps/index.js

@@ -0,0 +1,100 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+var _exportNames = {
+  CustomDomainParams: true
+};
+Object.defineProperty(exports, "CustomDomainParams", {
+  enumerable: true,
+  get: function () {
+    return _customDomain.CustomDomainParams;
+  }
+});
+
+var _core = require("./core");
+
+Object.keys(_core).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _core[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _core[key];
+    }
+  });
+});
+
+var _common = require("./common");
+
+Object.keys(_common).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _common[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _common[key];
+    }
+  });
+});
+
+var _api = require("./api");
+
+Object.keys(_api).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _api[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _api[key];
+    }
+  });
+});
+
+var _react = require("./react");
+
+Object.keys(_react).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _react[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _react[key];
+    }
+  });
+});
+
+var _admin = require("./admin");
+
+Object.keys(_admin).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _admin[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _admin[key];
+    }
+  });
+});
+
+var _website = require("./website");
+
+Object.keys(_website).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _website[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _website[key];
+    }
+  });
+});
+
+var _customDomain = require("./customDomain");

package/apps/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["index.ts"],"sourcesContent":["export * from \"./core\";\nexport * from \"./common\";\nexport * from \"./api\";\nexport * from \"./react\";\nexport * from \"./admin\";\nexport * from \"./website\";\nexport { CustomDomainParams } from \"./customDomain\";\n"],"mappings":";;;;;;;;;;;;;;;AAAA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA"}

package/apps/lambdaUtils.d.ts

@@ -0,0 +1,10 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { PulumiApp } from "@webiny/pulumi";
+export * from "../utils/lambdaEnvVariables";
+interface LambdaRoleParams {
+    name: string;
+    policy?: pulumi.Output<aws.iam.Policy>;
+    executionRole?: pulumi.Input<string>;
+}
+export declare function createLambdaRole(app: PulumiApp, params: LambdaRoleParams): import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role").Role>;

package/apps/lambdaUtils.js

@@ -0,0 +1,82 @@
+"use strict";
+
+var _interopRequireWildcard = require("@babel/runtime/helpers/interopRequireWildcard").default;
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+var _exportNames = {
+  createLambdaRole: true
+};
+exports.createLambdaRole = createLambdaRole;
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+var _lambdaEnvVariables = require("../utils/lambdaEnvVariables");
+
+Object.keys(_lambdaEnvVariables).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _lambdaEnvVariables[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _lambdaEnvVariables[key];
+    }
+  });
+});
+
+var _common = require("./common");
+
+function createLambdaRole(app, params) {
+  const role = app.addResource(aws.iam.Role, {
+    name: params.name,
+    config: {
+      assumeRolePolicy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Action: "sts:AssumeRole",
+          Principal: {
+            Service: "lambda.amazonaws.com"
+          },
+          Effect: "Allow"
+        }]
+      }
+    },
+    meta: {
+      isLambdaFunctionRole: true
+    }
+  });
+
+  if (params.policy) {
+    app.addResource(aws.iam.RolePolicyAttachment, {
+      name: `${params.name}-policy`,
+      config: {
+        role: role.output,
+        policyArn: params.policy.arn
+      }
+    });
+  }
+
+  if (params.executionRole) {
+    // If execution role is set, use it.
+    app.addResource(aws.iam.RolePolicyAttachment, {
+      name: `${params.name}-execution-role`,
+      config: {
+        role: role.output,
+        policyArn: params.executionRole
+      }
+    });
+  } // Add default execution role.
+
+
+  const vpc = app.getModule(_common.VpcConfig);
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `${params.name}-default-execution-role`,
+    config: {
+      role: role.output,
+      policyArn: vpc.enabled.apply(enabled => enabled ? aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole : aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole)
+    }
+  });
+  return role;
+}