@webiny/pulumi-aws 0.0.0-mt-3 → 0.0.0-unstable.1e66d121db

package/README.md

@@ -1,16 +1,328 @@
-# @webiny/pulumi-aws
+# `@webiny/pulumi-aws`
 
 [![](https://img.shields.io/npm/dw/@webiny/pulumi-aws.svg)](https://www.npmjs.com/package/@webiny/pulumi-aws)
 [![](https://img.shields.io/npm/v/@webiny/pulumi-aws.svg)](https://www.npmjs.com/package/@webiny/pulumi-aws)
 [![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=flat-square)](https://github.com/prettier/prettier)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](http://makeapullrequest.com)
 
-A set of custom Pulumi components for Webiny.
+A set of Pulumi apps that deploy Webiny CMS into Amazon Web Services (AWS).
 
-### Example
+## Table of Contents
+
+- [Installation](#installation)
+- [Overview](#overview)
+- [Examples](#examples)
+- [Reference](#reference)
+    - [Apps](#functions)
+        - [`createCoreApp`](#createCoreApp)
+        - [`createApiApp`](#createApiApp)
+        - [`createAdminApp`](#createAdminApp)
+        - [`createWebsiteApp`](#createWebsiteApp)
+
+## Installation
+
+```
+npm install --save @webiny/pulumi-aws
+```
+
+Or if you prefer yarn:
+
+```
+yarn add @webiny/pulumi-aws
+```
+
+## Overview
+
+A set of Pulumi apps that deploy Webiny CMS into Amazon Web Services (AWS). 
+
+> 💡 **TIP**
+>
+> Pulumi apps included in this package are automatically included in every Webiny project that's configured to be deployed into Amazon Web Services (AWS).
+
+## Examples
+
+| Example                           | Description                                                     |
+| --------------------------------- | --------------------------------------------------------------- |
+| [Initialization and Running the Apps](./docs/examples/initializationAndRunningTheApps.md) | Shows how the included apps are initialized and run. |
+
+## Reference
+
+### Apps
+
+#### `createCoreApp`
+
+<details>
+<summary>Type Declaration</summary>
+<p>
+
+```ts
+export interface CreateCoreAppParams {
+    /**
+     * Secures against deleting database by accident.
+     * By default enabled in production environments.
+     */
+    protect?: PulumiAppParam<boolean>;
+    /**
+     * Enables ElasticSearch infrastructure.
+     * Note that it requires also changes in application code.
+     */
+    elasticSearch?: PulumiAppParam<boolean>;
+    /**
+     * Enables VPC for the application.
+     * By default enabled in production environments.
+     */
+    vpc?: PulumiAppParam<boolean>;
+    /**
+     * Additional settings for backwards compatibility.
+     */
+    legacy?: PulumiAppParam<CoreAppLegacyConfig>;
+    
+    pulumi?: (app: ReturnType<typeof createStoragePulumiApp>) => void;
+}
+
+export interface CoreAppLegacyConfig {
+    useEmailAsUsername?: boolean;
+}
+
+export declare function createCoreApp(projectAppParams?: CreateCoreAppParams): import("@webiny/pulumi").PulumiApp<{
+    fileManagerBucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3").Bucket>;
+    eventBus: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch").EventBus>;
+    elasticSearch: {
+        domain: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/elasticsearch").Domain>;
+        domainPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/elasticsearch").DomainPolicy>;
+        table: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/dynamodb").Table>;
+        dynamoToElastic: {
+            role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Role>;
+            policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Policy>;
+            lambda: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").Function>;
+            eventSourceMapping: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").EventSourceMapping>;
+        };
+    } | null;
+    userPool: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cognito").UserPool>;
+    userPoolClient: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cognito").UserPoolClient>;
+    dynamoDbTable: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/dynamodb").Table>;
+    vpc: {
+        vpc: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2").Vpc>;
+        subnets: {
+            public: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2").Subnet>[];
+            private: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/ec2").Subnet>[];
+        };
+    } | null;
+}>;
+```
+
+</p>
+</details>
+
+Creates Storage Pulumi app.
 
 ```ts
-import { WebsiteTenantRouter } from "@webiny/pulumi-aws";
+// This is imported in our Pulumi program's entrypoint file (index.ts).
+import { createStoragePulumiApp } from "@webiny/pulumi-aws";
+
+export = async () => {
+  const coreApp = createCoreApp();
+
+  return coreApp.run();
+};
+```
+
+#### `createApiApp`
+
+<details>
+<summary>Type Declaration</summary>
+<p>
+
+```ts
+export interface CreateApiAppParams {
+    /**
+     * Enables or disables VPC for the API.
+     * For VPC to work you also have to enable it in the Storage application.
+     */
+    vpc?: PulumiAppParam<boolean>;
+    /** Custom domain configuration */
+    domain?(app: PulumiApp): CustomDomainParams | undefined | void;
+    pulumi?: (app: ReturnType<typeof createApiPulumiApp>) => void;
+}
+
+export declare const createApiPulumiApp: (projectAppParams?: CreateApiAppParams) => PulumiApp<{
+    fileManager: {
+        functions: {
+            transform: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").Function>;
+            manage: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").Function>;
+            download: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").Function>;
+        };
+        bucketNotification: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3").BucketNotification>;
+    };
+    graphql: {
+        role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Role>;
+        policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Policy>;
+        functions: {
+            graphql: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").Function>;
+        };
+    };
+    headlessCms: {
+        role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Role>;
+        policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Policy>;
+        functions: {
+            graphql: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").Function>;
+        };
+    };
+    apiGateway: {
+        api: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2").Api>;
+        stage: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2").Stage>;
+        routes: Record<string, {
+            integration: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2").Integration>;
+            route: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/apigatewayv2").Route>;
+            permission: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").Permission>;
+        }>;
+        addRoute: (name: string, params: import("..").ApiRouteParams) => void;
+    };
+    cloudfront: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront").Distribution>;
+    apwScheduler: {
+        executeAction: {
+            role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Role>;
+            policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Policy>;
+            lambda: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").Function>;
+        };
+        scheduleAction: {
+            role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Role>;
+            policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam").Policy>;
+            lambda: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda").Function>;
+        };
+        eventRule: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch").EventRule>;
+        eventTarget: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch").EventTarget>;
+    };
+}>;
+```
+
+</p>
+</details>
+
+Creates API Pulumi app.
+
+```ts
+// This is imported in our Pulumi program's entrypoint file (index.ts).
+import { createApiPulumiApp } from "@webiny/pulumi-aws";
+
+export = async () => {
+  const apiApp = createApiApp();
+
+  return apiApp.run();
+};
+```
+
+#### `createAdminApp`
+
+<details>
+<summary>Type Declaration</summary>
+<p>
+
+```ts
+import * as aws from "@pulumi/aws";
+import { PulumiApp } from "@webiny/pulumi";
+import { CustomDomainParams } from "../customDomain";
+
+export interface CreateAdminAppParams {
+    /** Custom domain configuration */
+    domain?(app: PulumiApp): CustomDomainParams | undefined | void;
+    pulumi?: (app: ReturnType<typeof createAdminPulumiApp>) => void;
+}
+
+export declare const createAdminPulumiApp: (projectAppParams: CreateAdminAppParams) => PulumiApp<{
+    cloudfront: import("@webiny/pulumi").PulumiAppResource<typeof aws.cloudfront.Distribution>;
+    bucket: import("@webiny/pulumi").PulumiAppResource<typeof aws.s3.Bucket>;
+    origin: aws.types.input.cloudfront.DistributionOrigin;
+}>;
+```
+
+</p>
+</details>
+
+Creates Admin Pulumi app.
+
+```ts
+// This is imported in our Pulumi program's entrypoint file (index.ts).
+import { createAdminPulumiApp } from "@webiny/pulumi-aws";
+
+export = async () => {
+  const adminApp = createAdminApp();
+
+  return adminApp.run();
+};
+```
+
+#### `createWebsiteApp`
+
+<details>
+<summary>Type Declaration</summary>
+<p>
+
+```ts
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { PulumiApp, PulumiAppParam } from "@webiny/pulumi";
+import { CustomDomainParams } from "../customDomain";
+export interface CreateWebsiteAppParams {
+    /** Custom domain configuration */
+    domain?(app: PulumiApp): CustomDomainParams | undefined | void;
+    /**
+     * Enables or disables VPC for the API.
+     * For VPC to work you also have to enable it in the `storage` application.
+     */
+    vpc?: PulumiAppParam<boolean | undefined>;
+    pulumi?: (app: ReturnType<typeof createWebsitePulumiApp>) => void;
+}
+export declare const createWebsitePulumiApp: (projectAppParams?: CreateWebsiteAppParams) => PulumiApp<{
+    prerendering: {
+        subscriber: {
+            policy: pulumi.Output<aws.iam.Policy>;
+            role: import("@webiny/pulumi").PulumiAppResource<typeof aws.iam.Role>;
+            lambda: import("@webiny/pulumi").PulumiAppResource<typeof aws.lambda.Function>;
+            eventRule: import("@webiny/pulumi").PulumiAppResource<typeof aws.cloudwatch.EventRule>;
+            eventPermission: import("@webiny/pulumi").PulumiAppResource<typeof aws.lambda.Permission>;
+            eventTarget: import("@webiny/pulumi").PulumiAppResource<typeof aws.cloudwatch.EventTarget>;
+        };
+        renderer: {
+            policy: pulumi.Output<aws.iam.Policy>;
+            role: import("@webiny/pulumi").PulumiAppResource<typeof aws.iam.Role>;
+            lambda: import("@webiny/pulumi").PulumiAppResource<typeof aws.lambda.Function>;
+            eventSourceMapping: import("@webiny/pulumi").PulumiAppResource<typeof aws.lambda.EventSourceMapping>;
+        };
+        flush: {
+            policy: pulumi.Output<aws.iam.Policy>;
+            role: import("@webiny/pulumi").PulumiAppResource<typeof aws.iam.Role>;
+            lambda: import("@webiny/pulumi").PulumiAppResource<typeof aws.lambda.Function>;
+            eventRule: import("@webiny/pulumi").PulumiAppResource<typeof aws.cloudwatch.EventRule>;
+            eventPermission: import("@webiny/pulumi").PulumiAppResource<typeof aws.lambda.Permission>;
+            eventTarget: import("@webiny/pulumi").PulumiAppResource<typeof aws.cloudwatch.EventTarget>;
+        };
+    };
+    app: {
+        cloudfront: import("@webiny/pulumi").PulumiAppResource<typeof aws.cloudfront.Distribution>;
+        bucket: import("@webiny/pulumi").PulumiAppResource<typeof aws.s3.Bucket>;
+        origin: aws.types.input.cloudfront.DistributionOrigin;
+    };
+    delivery: {
+        cloudfront: import("@webiny/pulumi").PulumiAppResource<typeof aws.cloudfront.Distribution>;
+        bucket: import("@webiny/pulumi").PulumiAppResource<typeof aws.s3.Bucket>;
+        origin: aws.types.input.cloudfront.DistributionOrigin;
+    };
+}>;
+```
+
+</p>
+</details>
+
+Creates Website Pulumi app.
+
+```ts
+// This is imported in our Pulumi program's entrypoint file (index.ts).
+import { createWebsitePulumiApp } from "@webiny/pulumi-aws";
+
+export = async () => {
+  const websiteApp = createWebsiteApp();
 
-const router = new WebsiteTenantRouter("tenant-router");
+  return websiteApp.run();
+};
 ```

package/apps/admin/createAdminPulumiApp.d.ts

@@ -0,0 +1,20 @@
+import { PulumiAppParamCallback } from "@webiny/pulumi";
+import { createReactPulumiApp, CustomDomainParams } from "..";
+export declare type AdminPulumiApp = ReturnType<typeof createReactPulumiApp>;
+export interface CreateAdminPulumiAppParams {
+    /** Custom domain configuration */
+    domains?: PulumiAppParamCallback<CustomDomainParams>;
+    /**
+     * Provides a way to adjust existing Pulumi code (cloud infrastructure resources)
+     * or add additional ones into the mix.
+     */
+    pulumi?: (app: AdminPulumiApp) => void | Promise<void>;
+}
+export declare const createAdminPulumiApp: (projectAppParams: CreateAdminPulumiAppParams) => import("@webiny/pulumi").PulumiApp<{
+    cloudfront: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/distribution").Distribution>;
+    bucket: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucket").Bucket>;
+    originIdentity: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudfront/originAccessIdentity").OriginAccessIdentity>;
+    origin: import("@pulumi/aws/types/input").cloudfront.DistributionOrigin;
+    bucketPublicAccessBlock: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPublicAccessBlock").BucketPublicAccessBlock>;
+    bucketPolicy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/s3/bucketPolicy").BucketPolicy>;
+}>;

package/apps/admin/createAdminPulumiApp.js

@@ -0,0 +1,21 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault").default;
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createAdminPulumiApp = void 0;
+
+var _objectSpread2 = _interopRequireDefault(require("@babel/runtime/helpers/objectSpread2"));
+
+var _ = require("./..");
+
+const createAdminPulumiApp = projectAppParams => {
+  return (0, _.createReactPulumiApp)((0, _objectSpread2.default)({
+    name: "admin",
+    folder: "apps/admin"
+  }, projectAppParams));
+};
+
+exports.createAdminPulumiApp = createAdminPulumiApp;

package/apps/admin/createAdminPulumiApp.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAdminPulumiApp","projectAppParams","createReactPulumiApp","name","folder"],"sources":["createAdminPulumiApp.ts"],"sourcesContent":["import { PulumiAppParamCallback } from \"@webiny/pulumi\";\nimport { createReactPulumiApp, CustomDomainParams } from \"~/apps\";\n\nexport type AdminPulumiApp = ReturnType<typeof createReactPulumiApp>;\n\nexport interface CreateAdminPulumiAppParams {\n    /** Custom domain configuration */\n    domains?: PulumiAppParamCallback<CustomDomainParams>;\n\n    /**\n     * Provides a way to adjust existing Pulumi code (cloud infrastructure resources)\n     * or add additional ones into the mix.\n     */\n    pulumi?: (app: AdminPulumiApp) => void | Promise<void>;\n}\n\nexport const createAdminPulumiApp = (projectAppParams: CreateAdminPulumiAppParams) => {\n    return createReactPulumiApp({\n        name: \"admin\",\n        folder: \"apps/admin\",\n        ...projectAppParams\n    });\n};\n"],"mappings":";;;;;;;;;;;AACA;;AAeO,MAAMA,oBAAoB,GAAIC,gBAAD,IAAkD;EAClF,OAAO,IAAAC,sBAAA;IACHC,IAAI,EAAE,OADH;IAEHC,MAAM,EAAE;EAFL,GAGAH,gBAHA,EAAP;AAKH,CANM"}

package/apps/admin/index.d.ts

@@ -0,0 +1 @@
+export * from "./createAdminPulumiApp";

package/apps/admin/index.js

@@ -0,0 +1,18 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+
+var _createAdminPulumiApp = require("./createAdminPulumiApp");
+
+Object.keys(_createAdminPulumiApp).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _createAdminPulumiApp[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _createAdminPulumiApp[key];
+    }
+  });
+});

package/apps/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["index.ts"],"sourcesContent":["export * from \"./createAdminPulumiApp\";\n"],"mappings":";;;;;;AAAA;;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}

package/apps/api/ApiApwScheduler.d.ts

@@ -0,0 +1,20 @@
+import { PulumiAppModule } from "@webiny/pulumi";
+interface ScheduleActionParams {
+    env: Record<string, any>;
+}
+export declare type ApiApwScheduler = PulumiAppModule<typeof ApiApwScheduler>;
+export declare const ApiApwScheduler: import("@webiny/pulumi").PulumiAppModuleDefinition<{
+    executeAction: {
+        role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role").Role>;
+        policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy").Policy>;
+        lambda: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+    };
+    scheduleAction: {
+        role: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/role").Role>;
+        policy: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/iam/policy").Policy>;
+        lambda: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/lambda/function").Function>;
+    };
+    eventRule: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch/eventRule").EventRule>;
+    eventTarget: import("@webiny/pulumi").PulumiAppResource<typeof import("@pulumi/aws/cloudwatch/eventTarget").EventTarget>;
+}, ScheduleActionParams>;
+export {};

package/apps/api/ApiApwScheduler.js

@@ -0,0 +1,240 @@
+"use strict";
+
+var _interopRequireWildcard = require("@babel/runtime/helpers/interopRequireWildcard").default;
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault").default;
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ApiApwScheduler = void 0;
+
+var _objectSpread2 = _interopRequireDefault(require("@babel/runtime/helpers/objectSpread2"));
+
+var _path = _interopRequireDefault(require("path"));
+
+var pulumi = _interopRequireWildcard(require("@pulumi/pulumi"));
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+var _pulumi2 = require("@webiny/pulumi");
+
+var _common = require("../common");
+
+var _lambdaUtils = require("../lambdaUtils");
+
+const LAMBDA_NAME_PREFIX = "apw-scheduler";
+const CREATE_RULE_LAMBDA = `${LAMBDA_NAME_PREFIX}-schedule-action-lambda`;
+const EXECUTE_ACTION_LAMBDA = `${LAMBDA_NAME_PREFIX}-execute-action-lambda`;
+const EVENT_RULE_NAME = `${LAMBDA_NAME_PREFIX}-event-rule`;
+const EVENT_RULE_TARGET = `${LAMBDA_NAME_PREFIX}-event-rule-target`;
+const ApiApwScheduler = (0, _pulumi2.createAppModule)({
+  name: "ApiApwScheduler",
+
+  config(app, params) {
+    const executeAction = createExecuteActionLambda(app, params);
+    const scheduleAction = createScheduleActionLambda(app, executeAction.lambda.output, params); // Create event rule.
+
+    const eventRule = app.addResource(aws.cloudwatch.EventRule, {
+      name: EVENT_RULE_NAME,
+      config: {
+        description: `Enable us to schedule an action in publishing workflow at a particular datetime`,
+        scheduleExpression: "cron(* * * * ? 2000)",
+        isEnabled: true
+      }
+    }); // Add required permission to the target lambda.
+
+    app.addResource(aws.lambda.Permission, {
+      name: "eventTargetPermission",
+      config: {
+        action: "lambda:InvokeFunction",
+        function: scheduleAction.lambda.output.arn,
+        principal: "events.amazonaws.com",
+        statementId: "allow-rule-invoke-" + EVENT_RULE_NAME
+      }
+    }); // Add lambda as target to the event rule.
+
+    const eventTarget = app.addResource(aws.cloudwatch.EventTarget, {
+      name: EVENT_RULE_TARGET,
+      config: {
+        rule: eventRule.output.name,
+        arn: scheduleAction.lambda.output.arn
+      }
+    });
+    return {
+      executeAction,
+      scheduleAction,
+      eventRule,
+      eventTarget
+    };
+  }
+
+});
+exports.ApiApwScheduler = ApiApwScheduler;
+
+function createExecuteActionLambda(app, params) {
+  const role = app.addResource(aws.iam.Role, {
+    name: `${EXECUTE_ACTION_LAMBDA}-role`,
+    config: {
+      assumeRolePolicy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Action: "sts:AssumeRole",
+          Principal: {
+            Service: "lambda.amazonaws.com"
+          },
+          Effect: "Allow"
+        }]
+      }
+    }
+  });
+  const policy = createExecuteActionLambdaPolicy(app);
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `${EXECUTE_ACTION_LAMBDA}-role-policy-attachment`,
+    config: {
+      role: role.output,
+      policyArn: policy.output.arn
+    }
+  });
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `${EXECUTE_ACTION_LAMBDA}-AWSLambdaBasicExecutionRole`,
+    config: {
+      role: role.output,
+      policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole
+    }
+  });
+  const lambda = app.addResource(aws.lambda.Function, {
+    name: EXECUTE_ACTION_LAMBDA,
+    config: {
+      role: role.output.arn,
+      runtime: "nodejs14.x",
+      handler: "handler.handler",
+      timeout: 60,
+      memorySize: 128,
+      description: "Handle execute action workflow in apw scheduler",
+      code: new pulumi.asset.AssetArchive({
+        ".": new pulumi.asset.FileArchive(_path.default.join(app.paths.workspace, "apw/executeAction/build"))
+      }),
+      environment: {
+        variables: (0, _lambdaUtils.getCommonLambdaEnvVariables)().apply(value => (0, _objectSpread2.default)((0, _objectSpread2.default)({}, value), params.env))
+      }
+    }
+  });
+  return {
+    role,
+    policy,
+    lambda
+  };
+}
+
+function createExecuteActionLambdaPolicy(app) {
+  const core = app.getModule(_common.CoreOutput);
+  return app.addResource(aws.iam.Policy, {
+    name: "ApwSchedulerExecuteActionLambdaPolicy",
+    config: {
+      description: "This policy enables access to cloudwatch event and lambda invocation",
+      policy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Sid: "PermissionLambda",
+          Effect: "Allow",
+          Action: ["lambda:InvokeFunction"],
+          Resource: ["*"]
+        }, {
+          Sid: "PermissionDynamoDB",
+          Effect: "Allow",
+          Action: ["dynamodb:Query", "dynamodb:GetItem", "dynamodb:DeleteItem"],
+          Resource: [pulumi.interpolate`${core.primaryDynamodbTableArn}`, pulumi.interpolate`${core.primaryDynamodbTableArn}/*`]
+        }]
+      }
+    }
+  });
+}
+
+function createScheduleActionLambda(app, executeLambda, params) {
+  const role = app.addResource(aws.iam.Role, {
+    name: `${CREATE_RULE_LAMBDA}-role`,
+    config: {
+      assumeRolePolicy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Action: "sts:AssumeRole",
+          Principal: {
+            Service: "lambda.amazonaws.com"
+          },
+          Effect: "Allow"
+        }]
+      }
+    }
+  });
+  const policy = createScheduleActionLambdaPolicy(app);
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `${CREATE_RULE_LAMBDA}-role-policy-attachment`,
+    config: {
+      role: role.output,
+      policyArn: policy.output.arn
+    }
+  });
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `${CREATE_RULE_LAMBDA}-AWSLambdaBasicExecutionRole`,
+    config: {
+      role: role.output,
+      policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole
+    }
+  });
+  const lambda = app.addResource(aws.lambda.Function, {
+    name: CREATE_RULE_LAMBDA,
+    config: {
+      role: role.output.arn,
+      runtime: "nodejs14.x",
+      handler: "handler.handler",
+      timeout: 60,
+      memorySize: 128,
+      description: "Handle schedule action workflow in apw scheduler",
+      code: new pulumi.asset.AssetArchive({
+        ".": new pulumi.asset.FileArchive(_path.default.join(app.paths.workspace, "apw/scheduleAction/build"))
+      }),
+      environment: {
+        variables: (0, _lambdaUtils.getCommonLambdaEnvVariables)().apply(value => (0, _objectSpread2.default)((0, _objectSpread2.default)((0, _objectSpread2.default)({}, value), params.env), {}, {
+          APW_SCHEDULER_EXECUTE_ACTION_HANDLER: executeLambda.arn // RULE_NAME: this.eventRule.name.apply(name => name),
+          // RULE_TARGET_ID: this.eventTarget.targetId.apply(id => id)
+
+        }))
+      }
+    }
+  });
+  return {
+    role,
+    policy,
+    lambda
+  };
+}
+
+function createScheduleActionLambdaPolicy(app) {
+  const core = app.getModule(_common.CoreOutput);
+  return app.addResource(aws.iam.Policy, {
+    name: "ApwSchedulerScheduleActionLambdaPolicy",
+    config: {
+      description: "This policy enables access to cloudwatch event and lambda invocation",
+      policy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Sid: "PermissionLambda",
+          Effect: "Allow",
+          Action: ["lambda:InvokeFunction"],
+          Resource: ["*"]
+        }, {
+          Sid: "PermissionDynamoDB",
+          Effect: "Allow",
+          Action: ["dynamodb:PutItem", "dynamodb:Query", "dynamodb:GetItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem"],
+          Resource: [pulumi.interpolate`${core.primaryDynamodbTableArn}`, pulumi.interpolate`${core.primaryDynamodbTableArn}/*`]
+        }, {
+          Sid: "PermissionEvents",
+          Effect: "Allow",
+          Action: ["events:DeleteRule", "events:PutTargets", "events:PutRule", "events:ListRules", "events:RemoveTargets", "events:ListTargetsByRule"],
+          Resource: ["*"]
+        }]
+      }
+    }
+  });
+}