@webiny/pulumi-aws 0.0.0-mt-1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Webiny
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,16 @@
+# @webiny/pulumi-aws
+
+[![](https://img.shields.io/npm/dw/@webiny/pulumi-aws.svg)](https://www.npmjs.com/package/@webiny/pulumi-aws)
+[![](https://img.shields.io/npm/v/@webiny/pulumi-aws.svg)](https://www.npmjs.com/package/@webiny/pulumi-aws)
+[![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=flat-square)](https://github.com/prettier/prettier)
+[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](http://makeapullrequest.com)
+
+A set of custom Pulumi components for Webiny.
+
+### Example
+
+```ts
+import { WebsiteTenantRouter } from "@webiny/pulumi-aws";
+
+const router = new WebsiteTenantRouter("tenant-router");
+```

package/components/tenantRouter/WebsiteTenantRouter.ts

@@ -0,0 +1,105 @@
+import { readFileSync } from "fs";
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { getStackOutput } from "@webiny/cli-plugin-deploy-pulumi/utils";
+
+interface Config {
+    apiFolder?: string;
+}
+
+interface Params {
+    region: string;
+    dynamoDbTable: string;
+}
+
+function createFunctionArchive({ dynamoDbTable, region }: Params) {
+    const handler = readFileSync(__dirname + "/functions/origin/request.js", "utf-8");
+
+    const source = handler
+        .replace("{DB_TABLE_NAME}", dynamoDbTable)
+        .replace("{DB_TABLE_REGION}", region);
+
+    return new pulumi.asset.AssetArchive({
+        "index.js": new pulumi.asset.StringAsset(source)
+    });
+}
+
+export class WebsiteTenantRouter extends pulumi.ComponentResource {
+    public readonly originRequest: aws.lambda.Function;
+
+    constructor(name: string, config: Config = {}, opts = {}) {
+        super("webiny:aws:WebsiteTenantRouter", name, {}, opts);
+
+        const { region, dynamoDbTable } = getStackOutput({
+            folder: config.apiFolder || "api",
+            env: String(process.env.WEBINY_ENV)
+        });
+
+        const callerIdentity = pulumi.output(aws.getCallerIdentity({}));
+
+        const tenantRouterPolicy = new aws.iam.Policy(`${name}-policy`, {
+            name: `${name}-policy`,
+            policy: {
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Sid: "PermissionForDynamodb",
+                        Effect: "Allow",
+                        Action: ["dynamodb:GetItem"],
+                        Resource: [
+                            pulumi.interpolate`arn:aws:dynamodb:${region}:${callerIdentity.accountId}:table/${dynamoDbTable}`,
+                            pulumi.interpolate`arn:aws:dynamodb:${region}:${callerIdentity.accountId}:table/${dynamoDbTable}/*`
+                        ]
+                    }
+                ]
+            }
+        });
+
+        const role = new aws.iam.Role(
+            `${name}-role`,
+            {
+                managedPolicyArns: [aws.iam.ManagedPolicies.AWSLambdaBasicExecutionRole],
+                assumeRolePolicy: {
+                    Version: "2012-10-17",
+                    Statement: [
+                        {
+                            Action: "sts:AssumeRole",
+                            Principal: aws.iam.Principals.LambdaPrincipal,
+                            Effect: "Allow"
+                        },
+                        {
+                            Action: "sts:AssumeRole",
+                            Principal: aws.iam.Principals.EdgeLambdaPrincipal,
+                            Effect: "Allow"
+                        }
+                    ]
+                }
+            },
+            { parent: this }
+        );
+
+        new aws.iam.RolePolicyAttachment(`${name}-dynamodb`, {
+            role,
+            policyArn: tenantRouterPolicy.arn
+        });
+
+        // Some resources _must_ be put in us-east-1, such as Lambda at Edge.
+        const awsUsEast1 = new aws.Provider("us-east-1", { region: "us-east-1" });
+
+        this.originRequest = new aws.lambda.Function(
+            `${name}-origin-request`,
+            {
+                publish: true,
+                runtime: "nodejs14.x",
+                handler: "index.handler",
+                role: role.arn,
+                timeout: 5,
+                memorySize: 128,
+                code: createFunctionArchive({ region, dynamoDbTable })
+            },
+            { provider: awsUsEast1, parent: this }
+        );
+
+        this.registerOutputs();
+    }
+}

package/components/tenantRouter/functions/origin/request.js

@@ -0,0 +1,40 @@
+const { DocumentClient } = require("aws-sdk/clients/dynamodb");
+
+const DB_TABLE_NAME = "{DB_TABLE_NAME}";
+const DB_TABLE_REGION = "{DB_TABLE_REGION}";
+
+const documentClient = new DocumentClient({
+    convertEmptyValues: true,
+    region: DB_TABLE_REGION
+});
+
+exports.handler = async event => {
+    const request = event.Records[0].cf.request;
+    // console.log(JSON.stringify(event.Records[0].cf, null, 2));
+
+    const requestedDomain = request.headers.host[0].value;
+    const originDomain = request.origin.custom.domainName;
+
+    // Find tenant by domain
+    const params = {
+        TableName: DB_TABLE_NAME,
+        Key: {
+            PK: `DOMAIN#${requestedDomain}`,
+            SK: "A"
+        }
+    };
+
+    const { Item } = await documentClient.get(params).promise();
+
+    if (Item) {
+        const from = request.uri;
+        request.uri = `/${Item.tenant}${from}`;
+        console.log(`Rewriting request from "${from}" to "${request.uri}"`);
+    } else {
+        console.log(`Failed to find a tenant for domain "${requestedDomain}"`);
+    }
+    // Restore the Host header
+    request.headers.host[0].value = originDomain;
+
+    return request;
+};

package/index.ts

@@ -0,0 +1 @@
+export { WebsiteTenantRouter } from "./components/tenantRouter/WebsiteTenantRouter";

package/package.json

@@ -0,0 +1,37 @@
+{
+	"name": "@webiny/pulumi-aws",
+	"version": "0.0.0-mt-1",
+	"main": "index.ts",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/webiny/webiny-js.git"
+	},
+	"description": "A set of custom Pulumi components for Webiny, to use with AWS.",
+	"author": "Webiny Ltd",
+	"license": "MIT",
+	"publishConfig": {
+		"access": "public",
+		"directory": "."
+	},
+	"files": [
+		"index.ts",
+		"components"
+	],
+	"dependencies": {
+		"@pulumi/aws": "^4.10.0",
+		"@pulumi/pulumi": "< 3.18.0",
+		"@webiny/cli-plugin-deploy-pulumi": "0.0.0-mt-1"
+	},
+	"devDependencies": {
+		"@types/node": "^10.0.0"
+	},
+	"adio": {
+		"ignore": {
+			"dependencies": [
+				"@pulumi/pulumi",
+				"@pulumi/aws"
+			]
+		}
+	},
+	"gitHead": "37736d8456a6ecb342a6c3645060bd9a3f2d4bb0"
+}