@webiny/pulumi-aws 5.25.0-beta.6 → 5.25.1-beta.1

package/apps/api/ApiGateway.js

@@ -0,0 +1,90 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ApiGateway = void 0;
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+var _pulumiSdk = require("@webiny/pulumi-sdk");
+
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+
+const ApiGateway = (0, _pulumiSdk.defineAppModule)({
+  name: "ApiGateway",
+
+  config(app, routesConfig) {
+    const api = app.addResource(aws.apigatewayv2.Api, {
+      name: "api-gateway",
+      config: {
+        protocolType: "HTTP",
+        description: "Main API gateway"
+      }
+    });
+    const stage = app.addResource(aws.apigatewayv2.Stage, {
+      name: "default",
+      config: {
+        apiId: api.output.id,
+        autoDeploy: true
+      }
+    });
+    const routes = {};
+
+    for (const name of Object.keys(routesConfig)) {
+      addRoute(name, routesConfig[name]);
+    }
+
+    return {
+      api,
+      stage,
+      routes,
+      addRoute
+    };
+
+    function addRoute(name, params) {
+      const route = createRoute(app, api.output, name, params);
+      routes[name] = route;
+    }
+  }
+
+});
+exports.ApiGateway = ApiGateway;
+
+function createRoute(app, api, name, params) {
+  const integration = app.addResource(aws.apigatewayv2.Integration, {
+    name: name,
+    config: {
+      description: "GraphQL API Integration",
+      apiId: api.id,
+      integrationType: "AWS_PROXY",
+      integrationMethod: params.method,
+      integrationUri: params.function,
+      passthroughBehavior: "WHEN_NO_MATCH"
+    }
+  });
+  const route = app.addResource(aws.apigatewayv2.Route, {
+    name: name,
+    config: {
+      apiId: api.id,
+      routeKey: `${params.method} ${params.path}`,
+      target: integration.output.id.apply(value => `integrations/${value}`)
+    }
+  });
+  const permission = app.addResource(aws.lambda.Permission, {
+    name: `allow-${name}`,
+    config: {
+      action: "lambda:InvokeFunction",
+      function: params.function,
+      principal: "apigateway.amazonaws.com",
+      sourceArn: api.executionArn.apply(arn => `${arn}/*/*${params.path}`)
+    }
+  });
+  return {
+    integration,
+    route,
+    permission
+  };
+}

package/apps/api/ApiGateway.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["ApiGateway.ts"],"names":["ApiGateway","name","config","app","routesConfig","api","addResource","aws","apigatewayv2","Api","protocolType","description","stage","Stage","apiId","output","id","autoDeploy","routes","Object","keys","addRoute","params","route","createRoute","integration","Integration","integrationType","integrationMethod","method","integrationUri","function","passthroughBehavior","Route","routeKey","path","target","apply","value","permission","lambda","Permission","action","principal","sourceArn","executionArn","arn"],"mappings":";;;;;;;AAAA;;AAEA;;;;;;AAUO,MAAMA,UAAU,GAAG,gCAAgB;AACtCC,EAAAA,IAAI,EAAE,YADgC;;AAEtCC,EAAAA,MAAM,CAACC,GAAD,EAAiBC,YAAjB,EAA+D;AACjE,UAAMC,GAAG,GAAGF,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,YAAJ,CAAiBC,GAAjC,EAAsC;AAC9CR,MAAAA,IAAI,EAAE,aADwC;AAE9CC,MAAAA,MAAM,EAAE;AACJQ,QAAAA,YAAY,EAAE,MADV;AAEJC,QAAAA,WAAW,EAAE;AAFT;AAFsC,KAAtC,CAAZ;AAQA,UAAMC,KAAK,GAAGT,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,YAAJ,CAAiBK,KAAjC,EAAwC;AAClDZ,MAAAA,IAAI,EAAE,SAD4C;AAElDC,MAAAA,MAAM,EAAE;AACJY,QAAAA,KAAK,EAAET,GAAG,CAACU,MAAJ,CAAWC,EADd;AAEJC,QAAAA,UAAU,EAAE;AAFR;AAF0C,KAAxC,CAAd;AAQA,UAAMC,MAAsD,GAAG,EAA/D;;AAEA,SAAK,MAAMjB,IAAX,IAAmBkB,MAAM,CAACC,IAAP,CAAYhB,YAAZ,CAAnB,EAA8C;AAC1CiB,MAAAA,QAAQ,CAACpB,IAAD,EAAOG,YAAY,CAACH,IAAD,CAAnB,CAAR;AACH;;AAED,WAAO;AACHI,MAAAA,GADG;AAEHO,MAAAA,KAFG;AAGHM,MAAAA,MAHG;AAIHG,MAAAA;AAJG,KAAP;;AAOA,aAASA,QAAT,CAAkBpB,IAAlB,EAAgCqB,MAAhC,EAAwD;AACpD,YAAMC,KAAK,GAAGC,WAAW,CAACrB,GAAD,EAAME,GAAG,CAACU,MAAV,EAAkBd,IAAlB,EAAwBqB,MAAxB,CAAzB;AACAJ,MAAAA,MAAM,CAACjB,IAAD,CAAN,GAAesB,KAAf;AACH;AACJ;;AApCqC,CAAhB,CAAnB;;;AAuCP,SAASC,WAAT,CACIrB,GADJ,EAEIE,GAFJ,EAGIJ,IAHJ,EAIIqB,MAJJ,EAKE;AACE,QAAMG,WAAW,GAAGtB,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,YAAJ,CAAiBkB,WAAjC,EAA8C;AAC9DzB,IAAAA,IAAI,EAAEA,IADwD;AAE9DC,IAAAA,MAAM,EAAE;AACJS,MAAAA,WAAW,EAAE,yBADT;AAEJG,MAAAA,KAAK,EAAET,GAAG,CAACW,EAFP;AAGJW,MAAAA,eAAe,EAAE,WAHb;AAIJC,MAAAA,iBAAiB,EAAEN,MAAM,CAACO,MAJtB;AAKJC,MAAAA,cAAc,EAAER,MAAM,CAACS,QALnB;AAMJC,MAAAA,mBAAmB,EAAE;AANjB;AAFsD,GAA9C,CAApB;AAYA,QAAMT,KAAK,GAAGpB,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,YAAJ,CAAiByB,KAAjC,EAAwC;AAClDhC,IAAAA,IAAI,EAAEA,IAD4C;AAElDC,IAAAA,MAAM,EAAE;AACJY,MAAAA,KAAK,EAAET,GAAG,CAACW,EADP;AAEJkB,MAAAA,QAAQ,EAAG,GAAEZ,MAAM,CAACO,MAAO,IAAGP,MAAM,CAACa,IAAK,EAFtC;AAGJC,MAAAA,MAAM,EAAEX,WAAW,CAACV,MAAZ,CAAmBC,EAAnB,CAAsBqB,KAAtB,CAA4BC,KAAK,IAAK,gBAAeA,KAAM,EAA3D;AAHJ;AAF0C,GAAxC,CAAd;AASA,QAAMC,UAAU,GAAGpC,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACiC,MAAJ,CAAWC,UAA3B,EAAuC;AACtDxC,IAAAA,IAAI,EAAG,SAAQA,IAAK,EADkC;AAEtDC,IAAAA,MAAM,EAAE;AACJwC,MAAAA,MAAM,EAAE,uBADJ;AAEJX,MAAAA,QAAQ,EAAET,MAAM,CAACS,QAFb;AAGJY,MAAAA,SAAS,EAAE,0BAHP;AAIJC,MAAAA,SAAS,EAAEvC,GAAG,CAACwC,YAAJ,CAAiBR,KAAjB,CAAuBS,GAAG,IAAK,GAAEA,GAAI,OAAMxB,MAAM,CAACa,IAAK,EAAvD;AAJP;AAF8C,GAAvC,CAAnB;AAUA,SAAO;AACHV,IAAAA,WADG;AAEHF,IAAAA,KAFG;AAGHgB,IAAAA;AAHG,GAAP;AAKH","sourcesContent":["import * as aws from \"@pulumi/aws\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { defineAppModule, PulumiApp, PulumiAppModule } from \"@webiny/pulumi-sdk\";\n\nexport interface ApiRouteParams {\n    path: pulumi.Input<string>;\n    method: pulumi.Input<string>;\n    function: pulumi.Input<string>;\n}\n\nexport type ApiGateway = PulumiAppModule<typeof ApiGateway>;\n\nexport const ApiGateway = defineAppModule({\n    name: \"ApiGateway\",\n    config(app: PulumiApp, routesConfig: Record<string, ApiRouteParams>) {\n        const api = app.addResource(aws.apigatewayv2.Api, {\n            name: \"api-gateway\",\n            config: {\n                protocolType: \"HTTP\",\n                description: \"Main API gateway\"\n            }\n        });\n\n        const stage = app.addResource(aws.apigatewayv2.Stage, {\n            name: \"default\",\n            config: {\n                apiId: api.output.id,\n                autoDeploy: true\n            }\n        });\n\n        const routes: Record<string, ReturnType<typeof createRoute>> = {};\n\n        for (const name of Object.keys(routesConfig)) {\n            addRoute(name, routesConfig[name]);\n        }\n\n        return {\n            api,\n            stage,\n            routes,\n            addRoute\n        };\n\n        function addRoute(name: string, params: ApiRouteParams) {\n            const route = createRoute(app, api.output, name, params);\n            routes[name] = route;\n        }\n    }\n});\n\nfunction createRoute(\n    app: PulumiApp,\n    api: pulumi.Output<aws.apigatewayv2.Api>,\n    name: string,\n    params: ApiRouteParams\n) {\n    const integration = app.addResource(aws.apigatewayv2.Integration, {\n        name: name,\n        config: {\n            description: \"GraphQL API Integration\",\n            apiId: api.id,\n            integrationType: \"AWS_PROXY\",\n            integrationMethod: params.method,\n            integrationUri: params.function,\n            passthroughBehavior: \"WHEN_NO_MATCH\"\n        }\n    });\n\n    const route = app.addResource(aws.apigatewayv2.Route, {\n        name: name,\n        config: {\n            apiId: api.id,\n            routeKey: `${params.method} ${params.path}`,\n            target: integration.output.id.apply(value => `integrations/${value}`)\n        }\n    });\n\n    const permission = app.addResource(aws.lambda.Permission, {\n        name: `allow-${name}`,\n        config: {\n            action: \"lambda:InvokeFunction\",\n            function: params.function,\n            principal: \"apigateway.amazonaws.com\",\n            sourceArn: api.executionArn.apply(arn => `${arn}/*/*${params.path}`)\n        }\n    });\n\n    return {\n        integration,\n        route,\n        permission\n    };\n}\n"]}

package/apps/api/ApiGraphql.d.ts

@@ -0,0 +1,27 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { PulumiAppModule } from "@webiny/pulumi-sdk";
+import { Vpc } from "./ApiVpc";
+interface GraphqlParams {
+    env: Record<string, any>;
+    primaryDynamodbTableArn: pulumi.Input<string>;
+    primaryDynamodbTableName: pulumi.Input<string>;
+    primaryDynamodbTableHashKey: pulumi.Input<string>;
+    primaryDynamodbTableRangeKey: pulumi.Input<string>;
+    fileManagerBucketId: pulumi.Input<string>;
+    cognitoUserPoolArn: pulumi.Input<string>;
+    apwSchedulerEventRule: pulumi.Output<aws.cloudwatch.EventRule>;
+    apwSchedulerEventTarget: pulumi.Output<aws.cloudwatch.EventTarget>;
+    awsAccountId: pulumi.Input<string>;
+    awsRegion: pulumi.Input<string>;
+    vpc: Vpc | undefined;
+}
+export declare type ApiGraphql = PulumiAppModule<typeof ApiGraphql>;
+export declare const ApiGraphql: import("@webiny/pulumi-sdk").PulumiAppModuleDefinition<{
+    role: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Role>;
+    policy: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Policy>;
+    functions: {
+        graphql: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.lambda.Function>;
+    };
+}, GraphqlParams>;
+export {};

package/apps/api/ApiGraphql.js

@@ -0,0 +1,128 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ApiGraphql = void 0;
+
+var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
+
+var _path = _interopRequireDefault(require("path"));
+
+var pulumi = _interopRequireWildcard(require("@pulumi/pulumi"));
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+var _pulumiSdk = require("@webiny/pulumi-sdk");
+
+var _ApiLambdaUtils = require("./ApiLambdaUtils");
+
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+
+function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); enumerableOnly && (symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
+
+function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? ownKeys(Object(source), !0).forEach(function (key) { (0, _defineProperty2.default)(target, key, source[key]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } return target; }
+
+const ApiGraphql = (0, _pulumiSdk.defineAppModule)({
+  name: "ApiGraphql",
+
+  config(app, params) {
+    const policy = createGraphqlLambdaPolicy(app, params);
+    const role = (0, _ApiLambdaUtils.createLambdaRole)(app, {
+      name: "api-lambda-role",
+      policy: policy.output,
+      vpc: params.vpc
+    });
+    const graphql = app.addResource(aws.lambda.Function, {
+      name: "graphql",
+      config: {
+        runtime: "nodejs14.x",
+        handler: "handler.handler",
+        role: role.output.arn,
+        timeout: 30,
+        memorySize: 512,
+        code: new pulumi.asset.AssetArchive({
+          ".": new pulumi.asset.FileArchive(_path.default.join(app.ctx.appDir, "code/graphql/build"))
+        }),
+        environment: {
+          variables: _objectSpread(_objectSpread({}, params.env), {}, {
+            AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1",
+            WCP_ENVIRONMENT_API_KEY: String(process.env["WCP_ENVIRONMENT_API_KEY"])
+          })
+        },
+        vpcConfig: params.vpc ? {
+          subnetIds: params.vpc.subnets.private.map(subNet => subNet.output.id),
+          securityGroupIds: [params.vpc.vpc.output.defaultSecurityGroupId]
+        } : undefined
+      }
+    });
+    /**
+     * Store meta information like "mainGraphqlFunctionArn" in APW settings at deploy time.
+     *
+     * Note: We can't pass "mainGraphqlFunctionArn" as env variable due to circular dependency between
+     * "graphql" lambda and "api-apw-scheduler-execute-action" lambda.
+     */
+
+    app.addResource(aws.dynamodb.TableItem, {
+      name: "apwSettings",
+      config: {
+        tableName: params.primaryDynamodbTableName,
+        hashKey: params.primaryDynamodbTableHashKey,
+        rangeKey: pulumi.output(params.primaryDynamodbTableRangeKey).apply(key => key || "SK"),
+        item: pulumi.interpolate`{
+              "PK": {"S": "APW#SETTINGS"},
+              "SK": {"S": "A"},
+              "mainGraphqlFunctionArn": {"S": "${graphql.output.arn}"},
+              "eventRuleName": {"S": "${params.apwSchedulerEventRule.name}"},
+              "eventTargetId": {"S": "${params.apwSchedulerEventTarget.targetId}"}
+            }`
+      }
+    });
+    return {
+      role,
+      policy,
+      functions: {
+        graphql
+      }
+    };
+  }
+
+});
+exports.ApiGraphql = ApiGraphql;
+
+function createGraphqlLambdaPolicy(app, params) {
+  return app.addResource(aws.iam.Policy, {
+    name: "ApiGraphqlLambdaPolicy",
+    config: {
+      description: "This policy enables access to Dynamodb, S3, Lambda and Cognito IDP",
+      policy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Sid: "PermissionForDynamodb",
+          Effect: "Allow",
+          Action: ["dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:ConditionCheckItem", "dynamodb:CreateBackup", "dynamodb:CreateTable", "dynamodb:CreateTableReplica", "dynamodb:DeleteBackup", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DeleteTableReplica", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeExport", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:DisableKinesisStreamingDestination", "dynamodb:EnableKinesisStreamingDestination", "dynamodb:ExportTableToPointInTime", "dynamodb:GetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:ListBackups", "dynamodb:ListContributorInsights", "dynamodb:ListExports", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:PartiQLDelete", "dynamodb:PartiQLInsert", "dynamodb:PartiQLSelect", "dynamodb:PartiQLUpdate", "dynamodb:PurchaseReservedCapacityOfferings", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:RestoreTableFromBackup", "dynamodb:RestoreTableToPointInTime", "dynamodb:Scan", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateContributorInsights", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTableReplicaAutoScaling", "dynamodb:UpdateTimeToLive"],
+          Resource: [pulumi.interpolate`${params.primaryDynamodbTableArn}`, pulumi.interpolate`${params.primaryDynamodbTableArn}/*`]
+        }, {
+          Sid: "PermissionForS3",
+          Effect: "Allow",
+          Action: ["s3:GetObjectAcl", "s3:DeleteObject", "s3:PutObjectAcl", "s3:PutObject", "s3:GetObject"],
+          Resource: pulumi.interpolate`arn:aws:s3:::${params.fileManagerBucketId}/*`
+        }, {
+          Sid: "PermissionForLambda",
+          Effect: "Allow",
+          Action: ["lambda:InvokeFunction"],
+          Resource: pulumi.interpolate`arn:aws:lambda:${params.awsRegion}:${params.awsAccountId}:function:*`
+        }, {
+          Sid: "PermissionForCognitoIdp",
+          Effect: "Allow",
+          Action: "cognito-idp:*",
+          Resource: pulumi.interpolate`${params.cognitoUserPoolArn}`
+        }]
+      }
+    }
+  });
+}

package/apps/api/ApiGraphql.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["ApiGraphql.ts"],"names":["ApiGraphql","name","config","app","params","policy","createGraphqlLambdaPolicy","role","output","vpc","graphql","addResource","aws","lambda","Function","runtime","handler","arn","timeout","memorySize","code","pulumi","asset","AssetArchive","FileArchive","path","join","ctx","appDir","environment","variables","env","AWS_NODEJS_CONNECTION_REUSE_ENABLED","WCP_ENVIRONMENT_API_KEY","String","process","vpcConfig","subnetIds","subnets","private","map","subNet","id","securityGroupIds","defaultSecurityGroupId","undefined","dynamodb","TableItem","tableName","primaryDynamodbTableName","hashKey","primaryDynamodbTableHashKey","rangeKey","primaryDynamodbTableRangeKey","apply","key","item","interpolate","apwSchedulerEventRule","apwSchedulerEventTarget","targetId","functions","iam","Policy","description","Version","Statement","Sid","Effect","Action","Resource","primaryDynamodbTableArn","fileManagerBucketId","awsRegion","awsAccountId","cognitoUserPoolArn"],"mappings":";;;;;;;;;;;AAAA;;AACA;;AACA;;AAEA;;AAEA;;;;;;;;;;AAmBO,MAAMA,UAAU,GAAG,gCAAgB;AACtCC,EAAAA,IAAI,EAAE,YADgC;;AAEtCC,EAAAA,MAAM,CAACC,GAAD,EAAiBC,MAAjB,EAAwC;AAC1C,UAAMC,MAAM,GAAGC,yBAAyB,CAACH,GAAD,EAAMC,MAAN,CAAxC;AACA,UAAMG,IAAI,GAAG,sCAAiBJ,GAAjB,EAAsB;AAC/BF,MAAAA,IAAI,EAAE,iBADyB;AAE/BI,MAAAA,MAAM,EAAEA,MAAM,CAACG,MAFgB;AAG/BC,MAAAA,GAAG,EAAEL,MAAM,CAACK;AAHmB,KAAtB,CAAb;AAMA,UAAMC,OAAO,GAAGP,GAAG,CAACQ,WAAJ,CAAgBC,GAAG,CAACC,MAAJ,CAAWC,QAA3B,EAAqC;AACjDb,MAAAA,IAAI,EAAE,SAD2C;AAEjDC,MAAAA,MAAM,EAAE;AACJa,QAAAA,OAAO,EAAE,YADL;AAEJC,QAAAA,OAAO,EAAE,iBAFL;AAGJT,QAAAA,IAAI,EAAEA,IAAI,CAACC,MAAL,CAAYS,GAHd;AAIJC,QAAAA,OAAO,EAAE,EAJL;AAKJC,QAAAA,UAAU,EAAE,GALR;AAMJC,QAAAA,IAAI,EAAE,IAAIC,MAAM,CAACC,KAAP,CAAaC,YAAjB,CAA8B;AAChC,eAAK,IAAIF,MAAM,CAACC,KAAP,CAAaE,WAAjB,CACDC,cAAKC,IAAL,CAAUvB,GAAG,CAACwB,GAAJ,CAAQC,MAAlB,EAA0B,oBAA1B,CADC;AAD2B,SAA9B,CANF;AAWJC,QAAAA,WAAW,EAAE;AACTC,UAAAA,SAAS,kCACF1B,MAAM,CAAC2B,GADL;AAELC,YAAAA,mCAAmC,EAAE,GAFhC;AAGLC,YAAAA,uBAAuB,EAAEC,MAAM,CAACC,OAAO,CAACJ,GAAR,CAAY,yBAAZ,CAAD;AAH1B;AADA,SAXT;AAkBJK,QAAAA,SAAS,EAAEhC,MAAM,CAACK,GAAP,GACL;AACI4B,UAAAA,SAAS,EAAEjC,MAAM,CAACK,GAAP,CAAW6B,OAAX,CAAmBC,OAAnB,CAA2BC,GAA3B,CAA+BC,MAAM,IAAIA,MAAM,CAACjC,MAAP,CAAckC,EAAvD,CADf;AAEIC,UAAAA,gBAAgB,EAAE,CAACvC,MAAM,CAACK,GAAP,CAAWA,GAAX,CAAeD,MAAf,CAAsBoC,sBAAvB;AAFtB,SADK,GAKLC;AAvBF;AAFyC,KAArC,CAAhB;AA6BA;AACR;AACA;AACA;AACA;AACA;;AACQ1C,IAAAA,GAAG,CAACQ,WAAJ,CAAgBC,GAAG,CAACkC,QAAJ,CAAaC,SAA7B,EAAwC;AACpC9C,MAAAA,IAAI,EAAE,aAD8B;AAEpCC,MAAAA,MAAM,EAAE;AACJ8C,QAAAA,SAAS,EAAE5C,MAAM,CAAC6C,wBADd;AAEJC,QAAAA,OAAO,EAAE9C,MAAM,CAAC+C,2BAFZ;AAGJC,QAAAA,QAAQ,EAAE/B,MAAM,CACXb,MADK,CACEJ,MAAM,CAACiD,4BADT,EAELC,KAFK,CAECC,GAAG,IAAIA,GAAG,IAAI,IAFf,CAHN;AAMJC,QAAAA,IAAI,EAAEnC,MAAM,CAACoC,WAAY;AACzC;AACA;AACA,iDAAiD/C,OAAO,CAACF,MAAR,CAAeS,GAAI;AACpE,wCAAwCb,MAAM,CAACsD,qBAAP,CAA6BzD,IAAK;AAC1E,wCAAwCG,MAAM,CAACuD,uBAAP,CAA+BC,QAAS;AAChF;AAZoB;AAF4B,KAAxC;AAkBA,WAAO;AACHrD,MAAAA,IADG;AAEHF,MAAAA,MAFG;AAGHwD,MAAAA,SAAS,EAAE;AACPnD,QAAAA;AADO;AAHR,KAAP;AAOH;;AAtEqC,CAAhB,CAAnB;;;AAyEP,SAASJ,yBAAT,CAAmCH,GAAnC,EAAmDC,MAAnD,EAA0E;AACtE,SAAOD,GAAG,CAACQ,WAAJ,CAAgBC,GAAG,CAACkD,GAAJ,CAAQC,MAAxB,EAAgC;AACnC9D,IAAAA,IAAI,EAAE,wBAD6B;AAEnCC,IAAAA,MAAM,EAAE;AACJ8D,MAAAA,WAAW,EAAE,oEADT;AAEJ3D,MAAAA,MAAM,EAAE;AACJ4D,QAAAA,OAAO,EAAE,YADL;AAEJC,QAAAA,SAAS,EAAE,CACP;AACIC,UAAAA,GAAG,EAAE,uBADT;AAEIC,UAAAA,MAAM,EAAE,OAFZ;AAGIC,UAAAA,MAAM,EAAE,CACJ,uBADI,EAEJ,yBAFI,EAGJ,6BAHI,EAIJ,uBAJI,EAKJ,sBALI,EAMJ,6BANI,EAOJ,uBAPI,EAQJ,qBARI,EASJ,sBATI,EAUJ,6BAVI,EAWJ,yBAXI,EAYJ,oCAZI,EAaJ,sCAbI,EAcJ,yBAdI,EAeJ,8CAfI,EAgBJ,yBAhBI,EAiBJ,mCAjBI,EAkBJ,4CAlBI,EAmBJ,yBAnBI,EAoBJ,wBApBI,EAqBJ,0CArBI,EAsBJ,6BAtBI,EAuBJ,6CAvBI,EAwBJ,4CAxBI,EAyBJ,mCAzBI,EA0BJ,kBA1BI,EA2BJ,qBA3BI,EA4BJ,2BA5BI,EA6BJ,sBA7BI,EA8BJ,kCA9BI,EA+BJ,sBA/BI,EAgCJ,sBAhCI,EAiCJ,qBAjCI,EAkCJ,6BAlCI,EAmCJ,wBAnCI,EAoCJ,wBApCI,EAqCJ,wBArCI,EAsCJ,wBAtCI,EAuCJ,4CAvCI,EAwCJ,kBAxCI,EAyCJ,gBAzCI,EA0CJ,iCA1CI,EA2CJ,oCA3CI,EA4CJ,eA5CI,EA6CJ,kCA7CI,EA8CJ,oCA9CI,EA+CJ,qBA/CI,EAgDJ,sBAhDI,EAiDJ,wCAjDI,EAkDJ,2BAlDI,CAHZ;AAuDIC,UAAAA,QAAQ,EAAE,CACNjD,MAAM,CAACoC,WAAY,GAAErD,MAAM,CAACmE,uBAAwB,EAD9C,EAENlD,MAAM,CAACoC,WAAY,GAAErD,MAAM,CAACmE,uBAAwB,IAF9C;AAvDd,SADO,EA6DP;AACIJ,UAAAA,GAAG,EAAE,iBADT;AAEIC,UAAAA,MAAM,EAAE,OAFZ;AAGIC,UAAAA,MAAM,EAAE,CACJ,iBADI,EAEJ,iBAFI,EAGJ,iBAHI,EAIJ,cAJI,EAKJ,cALI,CAHZ;AAUIC,UAAAA,QAAQ,EAAEjD,MAAM,CAACoC,WAAY,gBAAerD,MAAM,CAACoE,mBAAoB;AAV3E,SA7DO,EAyEP;AACIL,UAAAA,GAAG,EAAE,qBADT;AAEIC,UAAAA,MAAM,EAAE,OAFZ;AAGIC,UAAAA,MAAM,EAAE,CAAC,uBAAD,CAHZ;AAIIC,UAAAA,QAAQ,EAAEjD,MAAM,CAACoC,WAAY,kBAAiBrD,MAAM,CAACqE,SAAU,IAAGrE,MAAM,CAACsE,YAAa;AAJ1F,SAzEO,EA+EP;AACIP,UAAAA,GAAG,EAAE,yBADT;AAEIC,UAAAA,MAAM,EAAE,OAFZ;AAGIC,UAAAA,MAAM,EAAE,eAHZ;AAIIC,UAAAA,QAAQ,EAAEjD,MAAM,CAACoC,WAAY,GAAErD,MAAM,CAACuE,kBAAmB;AAJ7D,SA/EO;AAFP;AAFJ;AAF2B,GAAhC,CAAP;AA+FH","sourcesContent":["import path from \"path\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nimport { defineAppModule, PulumiApp, PulumiAppModule } from \"@webiny/pulumi-sdk\";\nimport { Vpc } from \"./ApiVpc\";\nimport { createLambdaRole } from \"./ApiLambdaUtils\";\n\ninterface GraphqlParams {\n    env: Record<string, any>;\n    primaryDynamodbTableArn: pulumi.Input<string>;\n    primaryDynamodbTableName: pulumi.Input<string>;\n    primaryDynamodbTableHashKey: pulumi.Input<string>;\n    primaryDynamodbTableRangeKey: pulumi.Input<string>;\n    fileManagerBucketId: pulumi.Input<string>;\n    cognitoUserPoolArn: pulumi.Input<string>;\n    apwSchedulerEventRule: pulumi.Output<aws.cloudwatch.EventRule>;\n    apwSchedulerEventTarget: pulumi.Output<aws.cloudwatch.EventTarget>;\n    awsAccountId: pulumi.Input<string>;\n    awsRegion: pulumi.Input<string>;\n    vpc: Vpc | undefined;\n}\n\nexport type ApiGraphql = PulumiAppModule<typeof ApiGraphql>;\n\nexport const ApiGraphql = defineAppModule({\n    name: \"ApiGraphql\",\n    config(app: PulumiApp, params: GraphqlParams) {\n        const policy = createGraphqlLambdaPolicy(app, params);\n        const role = createLambdaRole(app, {\n            name: \"api-lambda-role\",\n            policy: policy.output,\n            vpc: params.vpc\n        });\n\n        const graphql = app.addResource(aws.lambda.Function, {\n            name: \"graphql\",\n            config: {\n                runtime: \"nodejs14.x\",\n                handler: \"handler.handler\",\n                role: role.output.arn,\n                timeout: 30,\n                memorySize: 512,\n                code: new pulumi.asset.AssetArchive({\n                    \".\": new pulumi.asset.FileArchive(\n                        path.join(app.ctx.appDir, \"code/graphql/build\")\n                    )\n                }),\n                environment: {\n                    variables: {\n                        ...params.env,\n                        AWS_NODEJS_CONNECTION_REUSE_ENABLED: \"1\",\n                        WCP_ENVIRONMENT_API_KEY: String(process.env[\"WCP_ENVIRONMENT_API_KEY\"])\n                    }\n                },\n                vpcConfig: params.vpc\n                    ? {\n                          subnetIds: params.vpc.subnets.private.map(subNet => subNet.output.id),\n                          securityGroupIds: [params.vpc.vpc.output.defaultSecurityGroupId]\n                      }\n                    : undefined\n            }\n        });\n\n        /**\n         * Store meta information like \"mainGraphqlFunctionArn\" in APW settings at deploy time.\n         *\n         * Note: We can't pass \"mainGraphqlFunctionArn\" as env variable due to circular dependency between\n         * \"graphql\" lambda and \"api-apw-scheduler-execute-action\" lambda.\n         */\n        app.addResource(aws.dynamodb.TableItem, {\n            name: \"apwSettings\",\n            config: {\n                tableName: params.primaryDynamodbTableName,\n                hashKey: params.primaryDynamodbTableHashKey,\n                rangeKey: pulumi\n                    .output(params.primaryDynamodbTableRangeKey)\n                    .apply(key => key || \"SK\"),\n                item: pulumi.interpolate`{\n              \"PK\": {\"S\": \"APW#SETTINGS\"},\n              \"SK\": {\"S\": \"A\"},\n              \"mainGraphqlFunctionArn\": {\"S\": \"${graphql.output.arn}\"},\n              \"eventRuleName\": {\"S\": \"${params.apwSchedulerEventRule.name}\"},\n              \"eventTargetId\": {\"S\": \"${params.apwSchedulerEventTarget.targetId}\"}\n            }`\n            }\n        });\n\n        return {\n            role,\n            policy,\n            functions: {\n                graphql\n            }\n        };\n    }\n});\n\nfunction createGraphqlLambdaPolicy(app: PulumiApp, params: GraphqlParams) {\n    return app.addResource(aws.iam.Policy, {\n        name: \"ApiGraphqlLambdaPolicy\",\n        config: {\n            description: \"This policy enables access to Dynamodb, S3, Lambda and Cognito IDP\",\n            policy: {\n                Version: \"2012-10-17\",\n                Statement: [\n                    {\n                        Sid: \"PermissionForDynamodb\",\n                        Effect: \"Allow\",\n                        Action: [\n                            \"dynamodb:BatchGetItem\",\n                            \"dynamodb:BatchWriteItem\",\n                            \"dynamodb:ConditionCheckItem\",\n                            \"dynamodb:CreateBackup\",\n                            \"dynamodb:CreateTable\",\n                            \"dynamodb:CreateTableReplica\",\n                            \"dynamodb:DeleteBackup\",\n                            \"dynamodb:DeleteItem\",\n                            \"dynamodb:DeleteTable\",\n                            \"dynamodb:DeleteTableReplica\",\n                            \"dynamodb:DescribeBackup\",\n                            \"dynamodb:DescribeContinuousBackups\",\n                            \"dynamodb:DescribeContributorInsights\",\n                            \"dynamodb:DescribeExport\",\n                            \"dynamodb:DescribeKinesisStreamingDestination\",\n                            \"dynamodb:DescribeLimits\",\n                            \"dynamodb:DescribeReservedCapacity\",\n                            \"dynamodb:DescribeReservedCapacityOfferings\",\n                            \"dynamodb:DescribeStream\",\n                            \"dynamodb:DescribeTable\",\n                            \"dynamodb:DescribeTableReplicaAutoScaling\",\n                            \"dynamodb:DescribeTimeToLive\",\n                            \"dynamodb:DisableKinesisStreamingDestination\",\n                            \"dynamodb:EnableKinesisStreamingDestination\",\n                            \"dynamodb:ExportTableToPointInTime\",\n                            \"dynamodb:GetItem\",\n                            \"dynamodb:GetRecords\",\n                            \"dynamodb:GetShardIterator\",\n                            \"dynamodb:ListBackups\",\n                            \"dynamodb:ListContributorInsights\",\n                            \"dynamodb:ListExports\",\n                            \"dynamodb:ListStreams\",\n                            \"dynamodb:ListTables\",\n                            \"dynamodb:ListTagsOfResource\",\n                            \"dynamodb:PartiQLDelete\",\n                            \"dynamodb:PartiQLInsert\",\n                            \"dynamodb:PartiQLSelect\",\n                            \"dynamodb:PartiQLUpdate\",\n                            \"dynamodb:PurchaseReservedCapacityOfferings\",\n                            \"dynamodb:PutItem\",\n                            \"dynamodb:Query\",\n                            \"dynamodb:RestoreTableFromBackup\",\n                            \"dynamodb:RestoreTableToPointInTime\",\n                            \"dynamodb:Scan\",\n                            \"dynamodb:UpdateContinuousBackups\",\n                            \"dynamodb:UpdateContributorInsights\",\n                            \"dynamodb:UpdateItem\",\n                            \"dynamodb:UpdateTable\",\n                            \"dynamodb:UpdateTableReplicaAutoScaling\",\n                            \"dynamodb:UpdateTimeToLive\"\n                        ],\n                        Resource: [\n                            pulumi.interpolate`${params.primaryDynamodbTableArn}`,\n                            pulumi.interpolate`${params.primaryDynamodbTableArn}/*`\n                        ]\n                    },\n                    {\n                        Sid: \"PermissionForS3\",\n                        Effect: \"Allow\",\n                        Action: [\n                            \"s3:GetObjectAcl\",\n                            \"s3:DeleteObject\",\n                            \"s3:PutObjectAcl\",\n                            \"s3:PutObject\",\n                            \"s3:GetObject\"\n                        ],\n                        Resource: pulumi.interpolate`arn:aws:s3:::${params.fileManagerBucketId}/*`\n                    },\n                    {\n                        Sid: \"PermissionForLambda\",\n                        Effect: \"Allow\",\n                        Action: [\"lambda:InvokeFunction\"],\n                        Resource: pulumi.interpolate`arn:aws:lambda:${params.awsRegion}:${params.awsAccountId}:function:*`\n                    },\n                    {\n                        Sid: \"PermissionForCognitoIdp\",\n                        Effect: \"Allow\",\n                        Action: \"cognito-idp:*\",\n                        Resource: pulumi.interpolate`${params.cognitoUserPoolArn}`\n                    }\n                ]\n            }\n        }\n    });\n}\n"]}

package/apps/api/ApiHeadlessCMS.d.ts

@@ -0,0 +1,18 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { PulumiAppModule } from "@webiny/pulumi-sdk";
+import { Vpc } from "./ApiVpc";
+interface HeadlessCMSParams {
+    env: Record<string, any>;
+    primaryDynamodbTableArn: pulumi.Input<string>;
+    vpc: Vpc | undefined;
+}
+export declare type ApiHeadlessCMS = PulumiAppModule<typeof ApiHeadlessCMS>;
+export declare const ApiHeadlessCMS: import("@webiny/pulumi-sdk").PulumiAppModuleDefinition<{
+    role: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Role>;
+    policy: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Policy>;
+    functions: {
+        graphql: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.lambda.Function>;
+    };
+}, HeadlessCMSParams>;
+export {};

package/apps/api/ApiHeadlessCMS.js

@@ -0,0 +1,90 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ApiHeadlessCMS = void 0;
+
+var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
+
+var _path = _interopRequireDefault(require("path"));
+
+var pulumi = _interopRequireWildcard(require("@pulumi/pulumi"));
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+var _pulumiSdk = require("@webiny/pulumi-sdk");
+
+var _ApiLambdaUtils = require("./ApiLambdaUtils");
+
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+
+function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); enumerableOnly && (symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
+
+function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? ownKeys(Object(source), !0).forEach(function (key) { (0, _defineProperty2.default)(target, key, source[key]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } return target; }
+
+const ApiHeadlessCMS = (0, _pulumiSdk.defineAppModule)({
+  name: "ApiHeadlessCMS",
+
+  config(app, params) {
+    const policy = createHeadlessCmsLambdaPolicy(app, params);
+    const role = (0, _ApiLambdaUtils.createLambdaRole)(app, {
+      name: "headless-cms-lambda-role",
+      policy: policy.output,
+      vpc: params.vpc
+    });
+    const graphql = app.addResource(aws.lambda.Function, {
+      name: "headless-cms",
+      config: {
+        runtime: "nodejs14.x",
+        handler: "handler.handler",
+        role: role.output.arn,
+        timeout: 30,
+        memorySize: 512,
+        code: new pulumi.asset.AssetArchive({
+          ".": new pulumi.asset.FileArchive(_path.default.join(app.ctx.appDir, "code/headlessCMS/build"))
+        }),
+        environment: {
+          variables: _objectSpread(_objectSpread({}, params.env), {}, {
+            AWS_NODEJS_CONNECTION_REUSE_ENABLED: "1"
+          })
+        },
+        vpcConfig: params.vpc ? {
+          subnetIds: params.vpc.subnets.private.map(subNet => subNet.output.id),
+          securityGroupIds: [params.vpc.vpc.output.defaultSecurityGroupId]
+        } : undefined
+      }
+    });
+    return {
+      role,
+      policy,
+      functions: {
+        graphql
+      }
+    };
+  }
+
+});
+exports.ApiHeadlessCMS = ApiHeadlessCMS;
+
+function createHeadlessCmsLambdaPolicy(app, params) {
+  return app.addResource(aws.iam.Policy, {
+    name: "HeadlessCmsLambdaPolicy",
+    config: {
+      description: "This policy enables access to Dynamodb streams",
+      policy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Sid: "PermissionDynamodb",
+          Effect: "Allow",
+          Action: ["dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:ConditionCheckItem", "dynamodb:CreateBackup", "dynamodb:CreateTable", "dynamodb:CreateTableReplica", "dynamodb:DeleteBackup", "dynamodb:DeleteItem", "dynamodb:DeleteTable", "dynamodb:DeleteTableReplica", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeExport", "dynamodb:DescribeKinesisStreamingDestination", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTableReplicaAutoScaling", "dynamodb:DescribeTimeToLive", "dynamodb:DisableKinesisStreamingDestination", "dynamodb:EnableKinesisStreamingDestination", "dynamodb:ExportTableToPointInTime", "dynamodb:GetItem", "dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:ListBackups", "dynamodb:ListContributorInsights", "dynamodb:ListExports", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "dynamodb:PartiQLDelete", "dynamodb:PartiQLInsert", "dynamodb:PartiQLSelect", "dynamodb:PartiQLUpdate", "dynamodb:PurchaseReservedCapacityOfferings", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:RestoreTableFromBackup", "dynamodb:RestoreTableToPointInTime", "dynamodb:Scan", "dynamodb:UpdateContinuousBackups", "dynamodb:UpdateContributorInsights", "dynamodb:UpdateItem", "dynamodb:UpdateTable", "dynamodb:UpdateTableReplicaAutoScaling", "dynamodb:UpdateTimeToLive"],
+          Resource: [pulumi.interpolate`${params.primaryDynamodbTableArn}`, pulumi.interpolate`${params.primaryDynamodbTableArn}/*`]
+        }]
+      }
+    }
+  });
+}

package/apps/api/ApiHeadlessCMS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["ApiHeadlessCMS.ts"],"names":["ApiHeadlessCMS","name","config","app","params","policy","createHeadlessCmsLambdaPolicy","role","output","vpc","graphql","addResource","aws","lambda","Function","runtime","handler","arn","timeout","memorySize","code","pulumi","asset","AssetArchive","FileArchive","path","join","ctx","appDir","environment","variables","env","AWS_NODEJS_CONNECTION_REUSE_ENABLED","vpcConfig","subnetIds","subnets","private","map","subNet","id","securityGroupIds","defaultSecurityGroupId","undefined","functions","iam","Policy","description","Version","Statement","Sid","Effect","Action","Resource","interpolate","primaryDynamodbTableArn"],"mappings":";;;;;;;;;;;AAAA;;AACA;;AACA;;AAEA;;AAGA;;;;;;;;;;AAUO,MAAMA,cAAc,GAAG,gCAAgB;AAC1CC,EAAAA,IAAI,EAAE,gBADoC;;AAE1CC,EAAAA,MAAM,CAACC,GAAD,EAAiBC,MAAjB,EAA4C;AAC9C,UAAMC,MAAM,GAAGC,6BAA6B,CAACH,GAAD,EAAMC,MAAN,CAA5C;AACA,UAAMG,IAAI,GAAG,sCAAiBJ,GAAjB,EAAsB;AAC/BF,MAAAA,IAAI,EAAE,0BADyB;AAE/BI,MAAAA,MAAM,EAAEA,MAAM,CAACG,MAFgB;AAG/BC,MAAAA,GAAG,EAAEL,MAAM,CAACK;AAHmB,KAAtB,CAAb;AAMA,UAAMC,OAAO,GAAGP,GAAG,CAACQ,WAAJ,CAAgBC,GAAG,CAACC,MAAJ,CAAWC,QAA3B,EAAqC;AACjDb,MAAAA,IAAI,EAAE,cAD2C;AAEjDC,MAAAA,MAAM,EAAE;AACJa,QAAAA,OAAO,EAAE,YADL;AAEJC,QAAAA,OAAO,EAAE,iBAFL;AAGJT,QAAAA,IAAI,EAAEA,IAAI,CAACC,MAAL,CAAYS,GAHd;AAIJC,QAAAA,OAAO,EAAE,EAJL;AAKJC,QAAAA,UAAU,EAAE,GALR;AAMJC,QAAAA,IAAI,EAAE,IAAIC,MAAM,CAACC,KAAP,CAAaC,YAAjB,CAA8B;AAChC,eAAK,IAAIF,MAAM,CAACC,KAAP,CAAaE,WAAjB,CACDC,cAAKC,IAAL,CAAUvB,GAAG,CAACwB,GAAJ,CAAQC,MAAlB,EAA0B,wBAA1B,CADC;AAD2B,SAA9B,CANF;AAWJC,QAAAA,WAAW,EAAE;AACTC,UAAAA,SAAS,kCACF1B,MAAM,CAAC2B,GADL;AAELC,YAAAA,mCAAmC,EAAE;AAFhC;AADA,SAXT;AAiBJC,QAAAA,SAAS,EAAE7B,MAAM,CAACK,GAAP,GACL;AACIyB,UAAAA,SAAS,EAAE9B,MAAM,CAACK,GAAP,CAAW0B,OAAX,CAAmBC,OAAnB,CAA2BC,GAA3B,CAA+BC,MAAM,IAAIA,MAAM,CAAC9B,MAAP,CAAc+B,EAAvD,CADf;AAEIC,UAAAA,gBAAgB,EAAE,CAACpC,MAAM,CAACK,GAAP,CAAWA,GAAX,CAAeD,MAAf,CAAsBiC,sBAAvB;AAFtB,SADK,GAKLC;AAtBF;AAFyC,KAArC,CAAhB;AA4BA,WAAO;AACHnC,MAAAA,IADG;AAEHF,MAAAA,MAFG;AAGHsC,MAAAA,SAAS,EAAE;AACPjC,QAAAA;AADO;AAHR,KAAP;AAOH;;AA7CyC,CAAhB,CAAvB;;;AAgDP,SAASJ,6BAAT,CAAuCH,GAAvC,EAAuDC,MAAvD,EAAkF;AAC9E,SAAOD,GAAG,CAACQ,WAAJ,CAAgBC,GAAG,CAACgC,GAAJ,CAAQC,MAAxB,EAAgC;AACnC5C,IAAAA,IAAI,EAAE,yBAD6B;AAEnCC,IAAAA,MAAM,EAAE;AACJ4C,MAAAA,WAAW,EAAE,gDADT;AAEJzC,MAAAA,MAAM,EAAE;AACJ0C,QAAAA,OAAO,EAAE,YADL;AAEJC,QAAAA,SAAS,EAAE,CACP;AACIC,UAAAA,GAAG,EAAE,oBADT;AAEIC,UAAAA,MAAM,EAAE,OAFZ;AAGIC,UAAAA,MAAM,EAAE,CACJ,uBADI,EAEJ,yBAFI,EAGJ,6BAHI,EAIJ,uBAJI,EAKJ,sBALI,EAMJ,6BANI,EAOJ,uBAPI,EAQJ,qBARI,EASJ,sBATI,EAUJ,6BAVI,EAWJ,yBAXI,EAYJ,oCAZI,EAaJ,sCAbI,EAcJ,yBAdI,EAeJ,8CAfI,EAgBJ,yBAhBI,EAiBJ,mCAjBI,EAkBJ,4CAlBI,EAmBJ,yBAnBI,EAoBJ,wBApBI,EAqBJ,0CArBI,EAsBJ,6BAtBI,EAuBJ,6CAvBI,EAwBJ,4CAxBI,EAyBJ,mCAzBI,EA0BJ,kBA1BI,EA2BJ,qBA3BI,EA4BJ,2BA5BI,EA6BJ,sBA7BI,EA8BJ,kCA9BI,EA+BJ,sBA/BI,EAgCJ,sBAhCI,EAiCJ,qBAjCI,EAkCJ,6BAlCI,EAmCJ,wBAnCI,EAoCJ,wBApCI,EAqCJ,wBArCI,EAsCJ,wBAtCI,EAuCJ,4CAvCI,EAwCJ,kBAxCI,EAyCJ,gBAzCI,EA0CJ,iCA1CI,EA2CJ,oCA3CI,EA4CJ,eA5CI,EA6CJ,kCA7CI,EA8CJ,oCA9CI,EA+CJ,qBA/CI,EAgDJ,sBAhDI,EAiDJ,wCAjDI,EAkDJ,2BAlDI,CAHZ;AAuDIC,UAAAA,QAAQ,EAAE,CACN/B,MAAM,CAACgC,WAAY,GAAEjD,MAAM,CAACkD,uBAAwB,EAD9C,EAENjC,MAAM,CAACgC,WAAY,GAAEjD,MAAM,CAACkD,uBAAwB,IAF9C;AAvDd,SADO;AAFP;AAFJ;AAF2B,GAAhC,CAAP;AAuEH","sourcesContent":["import path from \"path\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\n\nimport { defineAppModule, PulumiApp, PulumiAppModule } from \"@webiny/pulumi-sdk\";\n\nimport { Vpc } from \"./ApiVpc\";\nimport { createLambdaRole } from \"./ApiLambdaUtils\";\n\ninterface HeadlessCMSParams {\n    env: Record<string, any>;\n    primaryDynamodbTableArn: pulumi.Input<string>;\n    vpc: Vpc | undefined;\n}\n\nexport type ApiHeadlessCMS = PulumiAppModule<typeof ApiHeadlessCMS>;\n\nexport const ApiHeadlessCMS = defineAppModule({\n    name: \"ApiHeadlessCMS\",\n    config(app: PulumiApp, params: HeadlessCMSParams) {\n        const policy = createHeadlessCmsLambdaPolicy(app, params);\n        const role = createLambdaRole(app, {\n            name: \"headless-cms-lambda-role\",\n            policy: policy.output,\n            vpc: params.vpc\n        });\n\n        const graphql = app.addResource(aws.lambda.Function, {\n            name: \"headless-cms\",\n            config: {\n                runtime: \"nodejs14.x\",\n                handler: \"handler.handler\",\n                role: role.output.arn,\n                timeout: 30,\n                memorySize: 512,\n                code: new pulumi.asset.AssetArchive({\n                    \".\": new pulumi.asset.FileArchive(\n                        path.join(app.ctx.appDir, \"code/headlessCMS/build\")\n                    )\n                }),\n                environment: {\n                    variables: {\n                        ...params.env,\n                        AWS_NODEJS_CONNECTION_REUSE_ENABLED: \"1\"\n                    }\n                },\n                vpcConfig: params.vpc\n                    ? {\n                          subnetIds: params.vpc.subnets.private.map(subNet => subNet.output.id),\n                          securityGroupIds: [params.vpc.vpc.output.defaultSecurityGroupId]\n                      }\n                    : undefined\n            }\n        });\n\n        return {\n            role,\n            policy,\n            functions: {\n                graphql\n            }\n        };\n    }\n});\n\nfunction createHeadlessCmsLambdaPolicy(app: PulumiApp, params: HeadlessCMSParams) {\n    return app.addResource(aws.iam.Policy, {\n        name: \"HeadlessCmsLambdaPolicy\",\n        config: {\n            description: \"This policy enables access to Dynamodb streams\",\n            policy: {\n                Version: \"2012-10-17\",\n                Statement: [\n                    {\n                        Sid: \"PermissionDynamodb\",\n                        Effect: \"Allow\",\n                        Action: [\n                            \"dynamodb:BatchGetItem\",\n                            \"dynamodb:BatchWriteItem\",\n                            \"dynamodb:ConditionCheckItem\",\n                            \"dynamodb:CreateBackup\",\n                            \"dynamodb:CreateTable\",\n                            \"dynamodb:CreateTableReplica\",\n                            \"dynamodb:DeleteBackup\",\n                            \"dynamodb:DeleteItem\",\n                            \"dynamodb:DeleteTable\",\n                            \"dynamodb:DeleteTableReplica\",\n                            \"dynamodb:DescribeBackup\",\n                            \"dynamodb:DescribeContinuousBackups\",\n                            \"dynamodb:DescribeContributorInsights\",\n                            \"dynamodb:DescribeExport\",\n                            \"dynamodb:DescribeKinesisStreamingDestination\",\n                            \"dynamodb:DescribeLimits\",\n                            \"dynamodb:DescribeReservedCapacity\",\n                            \"dynamodb:DescribeReservedCapacityOfferings\",\n                            \"dynamodb:DescribeStream\",\n                            \"dynamodb:DescribeTable\",\n                            \"dynamodb:DescribeTableReplicaAutoScaling\",\n                            \"dynamodb:DescribeTimeToLive\",\n                            \"dynamodb:DisableKinesisStreamingDestination\",\n                            \"dynamodb:EnableKinesisStreamingDestination\",\n                            \"dynamodb:ExportTableToPointInTime\",\n                            \"dynamodb:GetItem\",\n                            \"dynamodb:GetRecords\",\n                            \"dynamodb:GetShardIterator\",\n                            \"dynamodb:ListBackups\",\n                            \"dynamodb:ListContributorInsights\",\n                            \"dynamodb:ListExports\",\n                            \"dynamodb:ListStreams\",\n                            \"dynamodb:ListTables\",\n                            \"dynamodb:ListTagsOfResource\",\n                            \"dynamodb:PartiQLDelete\",\n                            \"dynamodb:PartiQLInsert\",\n                            \"dynamodb:PartiQLSelect\",\n                            \"dynamodb:PartiQLUpdate\",\n                            \"dynamodb:PurchaseReservedCapacityOfferings\",\n                            \"dynamodb:PutItem\",\n                            \"dynamodb:Query\",\n                            \"dynamodb:RestoreTableFromBackup\",\n                            \"dynamodb:RestoreTableToPointInTime\",\n                            \"dynamodb:Scan\",\n                            \"dynamodb:UpdateContinuousBackups\",\n                            \"dynamodb:UpdateContributorInsights\",\n                            \"dynamodb:UpdateItem\",\n                            \"dynamodb:UpdateTable\",\n                            \"dynamodb:UpdateTableReplicaAutoScaling\",\n                            \"dynamodb:UpdateTimeToLive\"\n                        ],\n                        Resource: [\n                            pulumi.interpolate`${params.primaryDynamodbTableArn}`,\n                            pulumi.interpolate`${params.primaryDynamodbTableArn}/*`\n                        ]\n                    }\n                ]\n            }\n        }\n    });\n}\n"]}

package/apps/api/ApiLambdaUtils.d.ts

@@ -0,0 +1,11 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { PulumiApp } from "@webiny/pulumi-sdk";
+import { Vpc } from "./ApiVpc";
+interface LambdaRoleParams {
+    name: string;
+    policy: pulumi.Output<aws.iam.Policy>;
+    vpc: Vpc | undefined;
+}
+export declare function createLambdaRole(app: PulumiApp, params: LambdaRoleParams): import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Role>;
+export {};

package/apps/api/ApiLambdaUtils.js

@@ -0,0 +1,45 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createLambdaRole = createLambdaRole;
+
+var aws = _interopRequireWildcard(require("@pulumi/aws"));
+
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+
+function createLambdaRole(app, params) {
+  const role = app.addResource(aws.iam.Role, {
+    name: params.name,
+    config: {
+      assumeRolePolicy: {
+        Version: "2012-10-17",
+        Statement: [{
+          Action: "sts:AssumeRole",
+          Principal: {
+            Service: "lambda.amazonaws.com"
+          },
+          Effect: "Allow"
+        }]
+      }
+    }
+  });
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `${params.name}-policy`,
+    config: {
+      role: role.output,
+      policyArn: params.policy.arn
+    }
+  });
+  app.addResource(aws.iam.RolePolicyAttachment, {
+    name: `${params.name}-execution-role`,
+    config: {
+      role: role.output,
+      policyArn: params.vpc ? aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole : aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole
+    }
+  });
+  return role;
+}

package/apps/api/ApiLambdaUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["ApiLambdaUtils.ts"],"names":["createLambdaRole","app","params","role","addResource","aws","iam","Role","name","config","assumeRolePolicy","Version","Statement","Action","Principal","Service","Effect","RolePolicyAttachment","output","policyArn","policy","arn","vpc","ManagedPolicy","AWSLambdaVPCAccessExecutionRole","AWSLambdaBasicExecutionRole"],"mappings":";;;;;;;AACA;;;;;;AAWO,SAASA,gBAAT,CAA0BC,GAA1B,EAA0CC,MAA1C,EAAoE;AACvE,QAAMC,IAAI,GAAGF,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,GAAJ,CAAQC,IAAxB,EAA8B;AACvCC,IAAAA,IAAI,EAAEN,MAAM,CAACM,IAD0B;AAEvCC,IAAAA,MAAM,EAAE;AACJC,MAAAA,gBAAgB,EAAE;AACdC,QAAAA,OAAO,EAAE,YADK;AAEdC,QAAAA,SAAS,EAAE,CACP;AACIC,UAAAA,MAAM,EAAE,gBADZ;AAEIC,UAAAA,SAAS,EAAE;AACPC,YAAAA,OAAO,EAAE;AADF,WAFf;AAKIC,UAAAA,MAAM,EAAE;AALZ,SADO;AAFG;AADd;AAF+B,GAA9B,CAAb;AAkBAf,EAAAA,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,GAAJ,CAAQW,oBAAxB,EAA8C;AAC1CT,IAAAA,IAAI,EAAG,GAAEN,MAAM,CAACM,IAAK,SADqB;AAE1CC,IAAAA,MAAM,EAAE;AACJN,MAAAA,IAAI,EAAEA,IAAI,CAACe,MADP;AAEJC,MAAAA,SAAS,EAAEjB,MAAM,CAACkB,MAAP,CAAcC;AAFrB;AAFkC,GAA9C;AAQApB,EAAAA,GAAG,CAACG,WAAJ,CAAgBC,GAAG,CAACC,GAAJ,CAAQW,oBAAxB,EAA8C;AAC1CT,IAAAA,IAAI,EAAG,GAAEN,MAAM,CAACM,IAAK,iBADqB;AAE1CC,IAAAA,MAAM,EAAE;AACJN,MAAAA,IAAI,EAAEA,IAAI,CAACe,MADP;AAEJC,MAAAA,SAAS,EAAEjB,MAAM,CAACoB,GAAP,GACLjB,GAAG,CAACC,GAAJ,CAAQiB,aAAR,CAAsBC,+BADjB,GAELnB,GAAG,CAACC,GAAJ,CAAQiB,aAAR,CAAsBE;AAJxB;AAFkC,GAA9C;AAUA,SAAOtB,IAAP;AACH","sourcesContent":["import * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\nimport { PulumiApp } from \"@webiny/pulumi-sdk\";\n\nimport { Vpc } from \"./ApiVpc\";\n\ninterface LambdaRoleParams {\n    name: string;\n    policy: pulumi.Output<aws.iam.Policy>;\n    vpc: Vpc | undefined;\n}\n\nexport function createLambdaRole(app: PulumiApp, params: LambdaRoleParams) {\n    const role = app.addResource(aws.iam.Role, {\n        name: params.name,\n        config: {\n            assumeRolePolicy: {\n                Version: \"2012-10-17\",\n                Statement: [\n                    {\n                        Action: \"sts:AssumeRole\",\n                        Principal: {\n                            Service: \"lambda.amazonaws.com\"\n                        },\n                        Effect: \"Allow\"\n                    }\n                ]\n            }\n        }\n    });\n\n    app.addResource(aws.iam.RolePolicyAttachment, {\n        name: `${params.name}-policy`,\n        config: {\n            role: role.output,\n            policyArn: params.policy.arn\n        }\n    });\n\n    app.addResource(aws.iam.RolePolicyAttachment, {\n        name: `${params.name}-execution-role`,\n        config: {\n            role: role.output,\n            policyArn: params.vpc\n                ? aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole\n                : aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole\n        }\n    });\n\n    return role;\n}\n"]}

package/apps/api/ApiPageBuilder.d.ts

@@ -0,0 +1,40 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from "@pulumi/aws";
+import { PulumiAppModule } from "@webiny/pulumi-sdk";
+import { Vpc } from "./ApiVpc";
+interface PageBuilderParams {
+    env: Record<string, any>;
+    primaryDynamodbTableArn: pulumi.Input<string>;
+    fileManagerBucketId: pulumi.Input<string>;
+    cognitoUserPoolArn: pulumi.Input<string>;
+    awsAccountId: pulumi.Input<string>;
+    awsRegion: pulumi.Input<string>;
+    vpc: Vpc | undefined;
+}
+export declare type ApiPageBuilder = PulumiAppModule<typeof ApiPageBuilder>;
+export declare const ApiPageBuilder: import("@webiny/pulumi-sdk").PulumiAppModuleDefinition<{
+    updateSettings: {
+        role: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Role>;
+        policy: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Policy>;
+        functions: {
+            update: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.lambda.Function>;
+        };
+    };
+    exportPages: {
+        role: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Role>;
+        policy: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Policy>;
+        functions: {
+            process: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.lambda.Function>;
+            combine: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.lambda.Function>;
+        };
+    };
+    importPages: {
+        role: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Role>;
+        policy: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.iam.Policy>;
+        functions: {
+            create: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.lambda.Function>;
+            process: import("@webiny/pulumi-sdk").PulumiAppResource<typeof aws.lambda.Function>;
+        };
+    };
+}, PageBuilderParams>;
+export {};