carlin 1.26.9 → 1.27.1

package/dist/deploy/baseStack/getBucket.template.js

@@ -2,43 +2,45 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getBucketTemplate = void 0;
 const config_1 = require("./config");
-const getBucketTemplate = () => ({
-    AWSTemplateFormatVersion: '2010-09-09',
-    Resources: {
-        [config_1.BASE_STACK_BUCKET_LOGICAL_NAME]: {
-            Type: 'AWS::S3::Bucket',
-            DeletionPolicy: 'Retain',
-            Properties: {
-                LifecycleConfiguration: {
-                    Rules: [
-                        {
-                            ExpirationInDays: 1,
-                            Prefix: config_1.BASE_STACK_BUCKET_TEMPLATES_FOLDER,
-                            Status: 'Enabled',
-                        },
-                        {
-                            NoncurrentVersionExpirationInDays: 3,
-                            Status: 'Enabled',
-                        },
-                    ],
-                },
-                /**
-                 * This is necessary because if we update Lambda code without change
-                 * CloudFormation template, the Lambda will not be updated.
-                 */
-                VersioningConfiguration: {
-                    Status: 'Enabled',
+const getBucketTemplate = () => {
+    return {
+        AWSTemplateFormatVersion: '2010-09-09',
+        Resources: {
+            [config_1.BASE_STACK_BUCKET_LOGICAL_NAME]: {
+                Type: 'AWS::S3::Bucket',
+                DeletionPolicy: 'Retain',
+                Properties: {
+                    LifecycleConfiguration: {
+                        Rules: [
+                            {
+                                ExpirationInDays: 1,
+                                Prefix: config_1.BASE_STACK_BUCKET_TEMPLATES_FOLDER,
+                                Status: 'Enabled',
+                            },
+                            {
+                                NoncurrentVersionExpirationInDays: 3,
+                                Status: 'Enabled',
+                            },
+                        ],
+                    },
+                    /**
+                     * This is necessary because if we update Lambda code without change
+                     * CloudFormation template, the Lambda will not be updated.
+                     */
+                    VersioningConfiguration: {
+                        Status: 'Enabled',
+                    },
                 },
             },
         },
-    },
-    Outputs: {
-        [config_1.BASE_STACK_BUCKET_LOGICAL_NAME]: {
-            Value: { Ref: config_1.BASE_STACK_BUCKET_LOGICAL_NAME },
-            Export: {
-                Name: config_1.BASE_STACK_BUCKET_NAME_EXPORTED_NAME,
+        Outputs: {
+            [config_1.BASE_STACK_BUCKET_LOGICAL_NAME]: {
+                Value: { Ref: config_1.BASE_STACK_BUCKET_LOGICAL_NAME },
+                Export: {
+                    Name: config_1.BASE_STACK_BUCKET_NAME_EXPORTED_NAME,
+                },
             },
         },
-    },
-});
+    };
+};
 exports.getBucketTemplate = getBucketTemplate;

package/dist/deploy/s3.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deleteS3Directory = exports.emptyS3Directory = exports.uploadDirectoryToS3 = exports.getAllFilesInsideADirectory = exports.uploadFileToS3 = exports.getBucketKeyUrl = exports.s3 = void 0;
+exports.deleteS3Directory = exports.emptyS3Directory = exports.uploadDirectoryToS3 = exports.copyRoot404To404Index = exports.getAllFilesInsideADirectory = exports.uploadFileToS3 = exports.getBucketKeyUrl = exports.s3 = void 0;
 /* eslint-disable no-restricted-syntax */
 /* eslint-disable no-await-in-loop */
 const aws_sdk_1 = require("aws-sdk");
@@ -62,6 +62,41 @@ const getAllFilesInsideADirectory = async ({ directory, }) => {
     return allFiles;
 };
 exports.getAllFilesInsideADirectory = getAllFilesInsideADirectory;
+/**
+ * Docusaurus 2 has a 404.html file in the root of the build folder. This
+ * function copies it to 404/index.html so that it can be served by S3 and
+ * CloudFront.
+ */
+const copyRoot404To404Index = async ({ bucket }) => {
+    try {
+        const root404Exists = await exports.s3
+            .headObject({
+            Bucket: bucket,
+            Key: '404.html',
+        })
+            .promise()
+            .catch(() => {
+            /**
+             * If the file does not exist, return false.
+             */
+            return false;
+        });
+        if (root404Exists) {
+            await exports.s3
+                .copyObject({
+                Bucket: bucket,
+                CopySource: `${bucket}/404.html`,
+                Key: '404/index.html',
+            })
+                .promise();
+        }
+    }
+    catch (err) {
+        npmlog_1.default.error(logPrefix, `Cannot copy 404.html to 404/index.html`);
+        throw err;
+    }
+};
+exports.copyRoot404To404Index = copyRoot404To404Index;
 const uploadDirectoryToS3 = async ({ bucket, bucketKey = '', directory, }) => {
     npmlog_1.default.info(logPrefix, `Uploading directory ${directory}/ to ${bucket}/${bucketKey}...`);
     const allFiles = await (0, exports.getAllFilesInsideADirectory)({ directory });

package/dist/deploy/staticApp/removeOldVersions.js

@@ -29,14 +29,23 @@ const removeOldVersions = async ({ bucket }) => {
         const { CommonPrefixes = [] } = await s3_1.s3
             .listObjectsV2({ Bucket: bucket, Delimiter: '/' })
             .promise();
-        const versions = CommonPrefixes === null || CommonPrefixes === void 0 ? void 0 : CommonPrefixes.map(({ Prefix }) => Prefix === null || Prefix === void 0 ? void 0 : Prefix.replace('/', '')).filter((version) => semver_1.default.valid(version)).sort((a, b) => (semver_1.default.gt(a, b) ? -1 : 1));
+        const versions = CommonPrefixes === null || CommonPrefixes === void 0 ? void 0 : CommonPrefixes.map(({ Prefix }) => {
+            return Prefix === null || Prefix === void 0 ? void 0 : Prefix.replace('/', '');
+        }).filter((version) => {
+            return semver_1.default.valid(version);
+        }).sort((a, b) => {
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            return semver_1.default.gt(a, b) ? -1 : 1;
+        });
         /**
          * Keep the 3 most recent versions.
          */
         versions.shift();
         versions.shift();
         versions.shift();
-        await Promise.all(versions.map((version) => (0, s3_1.deleteS3Directory)({ bucket, directory: `${version}` })));
+        await Promise.all(versions.map((version) => {
+            return (0, s3_1.deleteS3Directory)({ bucket, directory: `${version}` });
+        }));
     }
     catch (error) {
         npmlog_1.default.info(logPrefix, `Cannot remove older versions from "${bucket}" bucket.`);

package/dist/deploy/staticApp/staticApp.template.js

@@ -1,13 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getStaticAppTemplate = exports.ROUTE_53_RECORD_SET_GROUP_LOGICAL_ID = exports.CLOUDFRONT_DISTRIBUTION_LOGICAL_ID = void 0;
+exports.getStaticAppTemplate = exports.ERROR_DOCUMENT = exports.ROUTE_53_RECORD_SET_GROUP_LOGICAL_ID = exports.CLOUDFRONT_ORIGIN_ACCESS_CONTROL_LOGICAL_ID = exports.CLOUDFRONT_DISTRIBUTION_LOGICAL_ID = exports.STATIC_APP_BUCKET_LOGICAL_ID = void 0;
 const utils_1 = require("../../utils");
-const getOriginShieldRegion_1 = require("./getOriginShieldRegion");
 const PACKAGE_VERSION = (0, utils_1.getPackageVersion)();
-const STATIC_APP_BUCKET_LOGICAL_ID = 'StaticBucket';
-const CLOUDFRONT_DISTRIBUTION_ID = 'CloudFrontDistributionId';
+exports.STATIC_APP_BUCKET_LOGICAL_ID = 'StaticBucket';
 exports.CLOUDFRONT_DISTRIBUTION_LOGICAL_ID = 'CloudFrontDistribution';
+exports.CLOUDFRONT_ORIGIN_ACCESS_CONTROL_LOGICAL_ID = 'OriginAccessControl';
 exports.ROUTE_53_RECORD_SET_GROUP_LOGICAL_ID = 'Route53RecordSetGroup';
+exports.ERROR_DOCUMENT = '404/index.html';
 /**
  * Name: Managed-CachingDisabled
  * ID: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
@@ -26,11 +26,11 @@ const ORIGIN_REQUEST_POLICY_ID = '88a5eaf4-2fd4-4709-b370-b4c650ea3fcf';
  * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-response-headers-policies.html
  */
 const ORIGIN_RESPONSE_POLICY_ID = 'eaab4381-ed33-4a86-88ca-d9558dc6cd63';
-const getBaseTemplate = ({ spa, }) => {
+const getBucketStaticWebsiteTemplate = ({ spa, }) => {
     return {
         AWSTemplateFormatVersion: '2010-09-09',
         Resources: {
-            [STATIC_APP_BUCKET_LOGICAL_ID]: {
+            [exports.STATIC_APP_BUCKET_LOGICAL_ID]: {
                 Type: 'AWS::S3::Bucket',
                 Properties: {
                     CorsConfiguration: {
@@ -44,16 +44,19 @@ const getBaseTemplate = ({ spa, }) => {
                             },
                         ],
                     },
+                    PublicAccessBlockConfiguration: {
+                        BlockPublicPolicy: false,
+                    },
                     WebsiteConfiguration: {
                         IndexDocument: `index.html`,
-                        ErrorDocument: spa ? 'index.html' : '404/index.html',
+                        ErrorDocument: spa ? 'index.html' : exports.ERROR_DOCUMENT,
                     },
                 },
             },
-            [`${STATIC_APP_BUCKET_LOGICAL_ID}S3BucketPolicy`]: {
+            [`${exports.STATIC_APP_BUCKET_LOGICAL_ID}S3BucketPolicy`]: {
                 Type: 'AWS::S3::BucketPolicy',
                 Properties: {
-                    Bucket: { Ref: STATIC_APP_BUCKET_LOGICAL_ID },
+                    Bucket: { Ref: exports.STATIC_APP_BUCKET_LOGICAL_ID },
                     PolicyDocument: {
                         Statement: [
                             {
@@ -65,7 +68,7 @@ const getBaseTemplate = ({ spa, }) => {
                                         '',
                                         [
                                             'arn:aws:s3:::',
-                                            { Ref: STATIC_APP_BUCKET_LOGICAL_ID },
+                                            { Ref: exports.STATIC_APP_BUCKET_LOGICAL_ID },
                                             '/*',
                                         ],
                                     ],
@@ -80,14 +83,74 @@ const getBaseTemplate = ({ spa, }) => {
             BucketWebsiteURL: {
                 Description: 'Bucket static app website URL',
                 Value: {
-                    'Fn::GetAtt': [STATIC_APP_BUCKET_LOGICAL_ID, 'WebsiteURL'],
+                    'Fn::GetAtt': [exports.STATIC_APP_BUCKET_LOGICAL_ID, 'WebsiteURL'],
                 },
             },
         },
     };
 };
-const getCloudFrontTemplate = ({ acm, aliases = [], cloudfront, spa, hostedZoneName, region, }) => {
-    const template = { ...getBaseTemplate({ cloudfront, spa }) };
+const getCloudFrontTemplate = ({ acm, aliases = [], spa, hostedZoneName, }) => {
+    const template = {
+        AWSTemplateFormatVersion: '2010-09-09',
+        Resources: {
+            [exports.STATIC_APP_BUCKET_LOGICAL_ID]: {
+                Type: 'AWS::S3::Bucket',
+                Properties: {
+                    PublicAccessBlockConfiguration: {
+                        BlockPublicPolicy: false,
+                    },
+                },
+            },
+            [`${exports.STATIC_APP_BUCKET_LOGICAL_ID}S3BucketPolicy`]: {
+                Type: 'AWS::S3::BucketPolicy',
+                Properties: {
+                    Bucket: { Ref: exports.STATIC_APP_BUCKET_LOGICAL_ID },
+                    PolicyDocument: {
+                        Statement: [
+                            /**
+                             * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+                             */
+                            {
+                                Sid: 'AllowCloudFrontServicePrincipalReadOnly',
+                                Effect: 'Allow',
+                                Principal: {
+                                    Service: 'cloudfront.amazonaws.com',
+                                },
+                                Action: 's3:GetObject',
+                                Resource: {
+                                    'Fn::Join': [
+                                        '',
+                                        [
+                                            'arn:aws:s3:::',
+                                            { Ref: exports.STATIC_APP_BUCKET_LOGICAL_ID },
+                                            '/*',
+                                        ],
+                                    ],
+                                },
+                                Condition: {
+                                    StringEquals: {
+                                        'AWS:SourceArn': 
+                                        // 'arn:aws:cloudfront::<AWS account ID>:distribution/<CloudFront distribution ID>',
+                                        {
+                                            'Fn::Join': [
+                                                '',
+                                                [
+                                                    'arn:aws:cloudfront::',
+                                                    { Ref: 'AWS::AccountId' },
+                                                    ':distribution/',
+                                                    { Ref: exports.CLOUDFRONT_DISTRIBUTION_LOGICAL_ID },
+                                                ],
+                                            ],
+                                        },
+                                    },
+                                },
+                            },
+                        ],
+                    },
+                },
+            },
+        },
+    };
     const cloudFrontResources = {
         [exports.CLOUDFRONT_DISTRIBUTION_LOGICAL_ID]: {
             Type: 'AWS::CloudFront::Distribution',
@@ -112,7 +175,7 @@ const getCloudFrontTemplate = ({ acm, aliases = [], cloudfront, spa, hostedZoneN
                             ErrorCachingMinTTL: 0,
                             ErrorCode: errorCode,
                             ResponseCode: 404,
-                            ResponsePagePath: '/404',
+                            ResponsePagePath: '/' + exports.ERROR_DOCUMENT,
                         };
                     }),
                     DefaultCacheBehavior: {
@@ -130,51 +193,54 @@ const getCloudFrontTemplate = ({ acm, aliases = [], cloudfront, spa, hostedZoneN
                          */
                         CachePolicyId: CACHE_POLICY_ID,
                         ResponseHeadersPolicyId: ORIGIN_RESPONSE_POLICY_ID,
-                        TargetOriginId: { Ref: STATIC_APP_BUCKET_LOGICAL_ID },
+                        TargetOriginId: { Ref: exports.STATIC_APP_BUCKET_LOGICAL_ID },
                         ViewerProtocolPolicy: 'redirect-to-https',
                     },
-                    DefaultRootObject: spa ? 'index.html' : undefined,
+                    DefaultRootObject: 'index.html',
                     Enabled: true,
                     HttpVersion: 'http2',
                     Origins: [
                         {
-                            CustomOriginConfig: {
-                                OriginProtocolPolicy: 'http-only',
-                            },
-                            /**
-                             * https://github.com/aws/aws-cdk/issues/1882#issuecomment-629141467
-                             */
                             DomainName: {
-                                'Fn::Select': [
-                                    1,
-                                    {
-                                        'Fn::Split': [
-                                            '//',
-                                            {
-                                                'Fn::GetAtt': [
-                                                    STATIC_APP_BUCKET_LOGICAL_ID,
-                                                    'WebsiteURL',
-                                                ],
-                                            },
-                                        ],
-                                    },
+                                'Fn::GetAtt': [exports.STATIC_APP_BUCKET_LOGICAL_ID, 'DomainName'],
+                            },
+                            Id: { Ref: exports.STATIC_APP_BUCKET_LOGICAL_ID },
+                            OriginAccessControlId: {
+                                'Fn::GetAtt': [
+                                    exports.CLOUDFRONT_ORIGIN_ACCESS_CONTROL_LOGICAL_ID,
+                                    'Id',
                                 ],
                             },
-                            Id: { Ref: STATIC_APP_BUCKET_LOGICAL_ID },
                             /**
-                             * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region
+                             * Note: As of September 2022, an empty OriginAccessIdentity must be specified in S3OriginConfig.
                              */
-                            ...(region && {
-                                OriginShield: {
-                                    Enabled: true,
-                                    OriginShieldRegion: (0, getOriginShieldRegion_1.getOriginShieldRegion)(region),
-                                },
-                            }),
+                            S3OriginConfig: {
+                                OriginAccessIdentity: '',
+                            },
                         },
                     ],
                 },
             },
         },
+        [exports.CLOUDFRONT_ORIGIN_ACCESS_CONTROL_LOGICAL_ID]: {
+            Type: 'AWS::CloudFront::OriginAccessControl',
+            Properties: {
+                OriginAccessControlConfig: {
+                    Description: {
+                        'Fn::Sub': [
+                            'Default Origin Access Control for ${Project} project.',
+                            { Project: { Ref: 'Project' } },
+                        ],
+                    },
+                    Name: {
+                        Ref: 'AWS::StackName',
+                    },
+                    OriginAccessControlOriginType: 's3',
+                    SigningBehavior: 'always',
+                    SigningProtocol: 'sigv4',
+                },
+            },
+        },
     };
     if (acm) {
         const acmRegex = /^arn:aws:acm:[-a-z0-9]+:\d{12}:certificate\/[-a-z0-9]+$/;
@@ -251,12 +317,14 @@ const getCloudFrontTemplate = ({ acm, aliases = [], cloudfront, spa, hostedZoneN
     /**
      * Add aliases output to template.
      */
-    const aliasesOutput = (aliases || []).reduce((acc, alias, index) => ({
-        ...acc,
-        [`Alias${index}URL`]: {
-            Value: `https://${alias}`,
-        },
-    }), {});
+    const aliasesOutput = (aliases || []).reduce((acc, alias, index) => {
+        return {
+            ...acc,
+            [`Alias${index}URL`]: {
+                Value: `https://${alias}`,
+            },
+        };
+    }, {});
     /**
      * Add CloudFront Distribution ID and CloudFront URL to template.
      */
@@ -276,7 +344,7 @@ const getCloudFrontTemplate = ({ acm, aliases = [], cloudfront, spa, hostedZoneN
                 ],
             },
         },
-        [CLOUDFRONT_DISTRIBUTION_ID]: {
+        CloudFrontDistributionId: {
             Value: {
                 Ref: exports.CLOUDFRONT_DISTRIBUTION_LOGICAL_ID,
             },
@@ -298,6 +366,6 @@ const getStaticAppTemplate = ({ acm, aliases, cloudfront, spa, hostedZoneName, r
             region,
         });
     }
-    return getBaseTemplate({ cloudfront, spa });
+    return getBucketStaticWebsiteTemplate({ spa });
 };
 exports.getStaticAppTemplate = getStaticAppTemplate;

package/dist/deploy/staticApp/uploadBuiltAppToS3.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.uploadBuiltAppToS3 = void 0;
-const findDefaultBuildFolder_1 = require("./findDefaultBuildFolder");
 const s3_1 = require("../s3");
+const findDefaultBuildFolder_1 = require("./findDefaultBuildFolder");
 const uploadBuiltAppToS3 = async ({ buildFolder: directory, bucket, }) => {
     /**
      * Only empty directory if the number of the files inside $directory.
@@ -20,6 +20,7 @@ const uploadBuiltAppToS3 = async ({ buildFolder: directory, bucket, }) => {
     if (defaultDirectory) {
         await (0, s3_1.emptyS3Directory)({ bucket });
         await (0, s3_1.uploadDirectoryToS3)({ bucket, directory: defaultDirectory });
+        await (0, s3_1.copyRoot404To404Index)({ bucket });
         return;
     }
     throw new Error(`build-folder option wasn't provided and files weren't found in ${findDefaultBuildFolder_1.defaultBuildFolders.join(', ')} directories.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "carlin",
-  "version": "1.26.9",
+  "version": "1.27.1",
   "description": "",
   "license": "GPL-3.0",
   "author": "Pedro Arantes <arantespp@gmail.com> (https://twitter.com/arantespp)",
@@ -71,5 +71,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "f30779a5ea50d60cf3099e5fde712e1ef7b7882c"
+  "gitHead": "3d6ffa89bf6f83619ac12a3688e8250e47c1a8c6"
 }

package/dist/deploy/staticApp/getOriginShieldRegion.js

@@ -1,30 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getOriginShieldRegion = void 0;
-/**
- * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region
- * @param region
- */
-const getOriginShieldRegion = (region) => {
-    switch (region) {
-        case 'us-west-1':
-            return 'us-west-2';
-        case 'af-south-1':
-            return 'eu-west-1';
-        case 'ap-east-1':
-            return 'ap-southeast-1';
-        case 'ca-central-1':
-            return 'us-east-1';
-        case 'eu-south-1':
-            return 'eu-central-1';
-        case 'eu-west-3':
-            return 'eu-west-2';
-        case 'eu-north-1':
-            return 'eu-west-2';
-        case 'me-south-1':
-            return 'ap-south-1';
-        default:
-            return region;
-    }
-};
-exports.getOriginShieldRegion = getOriginShieldRegion;