cdk-local 0.6.0 → 0.7.1

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { i as createLocalInvokeCommand, n as createLocalRunTaskCommand, r as createLocalStartApiCommand, t as createLocalStartServiceCommand } from "./local-start-service-irdy6U57.js";
+import { i as createLocalInvokeCommand, n as createLocalRunTaskCommand, r as createLocalStartApiCommand, t as createLocalStartServiceCommand } from "./local-start-service-Bh1z2yKs.js";
 import { Command } from "commander";
 
 //#region src/cli/index.ts
 const program = new Command();
-program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.6.0");
+program.name("cdkl").description("Run AWS CDK stacks locally with Docker.").version("0.7.1");
 program.addCommand(createLocalInvokeCommand());
 program.addCommand(createLocalStartApiCommand());
 program.addCommand(createLocalRunTaskCommand());

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/local/state-resolver.ts","../src/local/local-state-provider.ts","../src/cli/commands/local-state-source.ts","../src/local/embed-config.ts","../src/cli/commands/local-invoke.ts","../src/cli/commands/local-start-api.ts","../src/cli/commands/local-run-task.ts","../src/cli/commands/local-start-service.ts","../src/local/cfn-local-state-provider.ts"],"mappings":";;;;UAuLiB,aAAA;EAEf,UAAA;EAGA,YAAA;EAGA,UAAA,EAAY,MAAA;EAcZ,kBAAA,GAAqB,MAAA;EAGrB,UAAA,GAAa,MAAA;EAGb,YAAA;EAGA,QAAA,GAAW,MAAA;EAmBX,cAAA;EAMA,mBAAA;EAyBA,aAAA;AAAA;;;UCxIe,gBAAA;EACf,SAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAqBe,kBAAA;EAOf,aAAA,CAAc,UAAA,WAAqB,OAAA;EAQnC,qBAAA,CACE,aAAA,UACA,cAAA,UACA,UAAA,WACC,OAAA;AAAA;AAAA,UAGY,mBAAA;EAEf,SAAA,EAAW,MAAA,SAAe,aAAA;EAE1B,gBAAA,GAAmB,gBAAA;EAOnB,kBAAA,GAAqB,kBAAA;EAOrB,cAAA;AAAA;;;UCrJe,gBAAA;EAQf,SAAA,EAAW,MAAA,SAAe,aAAA;EAO1B,OAAA,EAAS,MAAA;EAOT,MAAA;AAAA;AAAA,UAsBe,kBAAA;EAAA,SAMN,KAAA;EAQT,IAAA,CAAK,SAAA,UAAmB,WAAA,uBAAkC,OAAA,CAAQ,gBAAA;EAalE,uBAAA,CAAwB,cAAA,WAAyB,OAAA,CAAQ,kBAAA;EAKzD,OAAA;AAAA;;;UC9Ee,uBAAA;EAOf,YAAA;EAEA,MAAA;EAEA,OAAA;EAMA,WAAA;EAAA,CAEC,GAAA;AAAA;AAAA,KAQS,yBAAA,IAA6B,OAAA,EAAS,uBAAA,KAA4B,kBAAA;AAAA,KAUlE,mBAAA,GAAsB,MAAA,SAAe,yBAAA;AAAA,iBAUjC,mBAAA,CAAoB,YAAA,oBAAgC,SAAA;AAAA,iBAapD,gBAAA,CAAiB,IAAA,EAAM,IAAA,CAAK,uBAAA;AAAA,iBAgB5B,gBAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,6BACd,WAAA;AAAA,cAqBW,qBAAA,SAA8B,KAAA;cAC7B,OAAA;AAAA;AAAA,iBAkBE,wCAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,mBACd,gBAAA;AAAA,iBAiCc,wBAAA,CACd,OAAA,EAAS,uBAAA,EACT,SAAA,UACA,WAAA,sBACA,mBAAA,GAAsB,mBAAA,GACrB,kBAAA;;;UCtLc,mBAAA;EAMf,OAAA;EAOA,UAAA;EAMA,WAAA;EAOA,kBAAA;EAMA,gBAAA;EAMA,SAAA;AAAA;;;UC8Ee,+BAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA22BA,wBAAA,CAAyB,IAAA,GAAM,+BAAA,GAAuC,OAAA;;;UCzvBrE,iCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAy1FA,0BAAA,CAA2B,IAAA,GAAM,iCAAA,GAAyC,OAAA;;;UCr/FzE,gCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAseA,yBAAA,CAA0B,IAAA,GAAM,gCAAA,GAAwC,OAAA;;;UC5evE,qCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAipBA,8BAAA,CACd,IAAA,GAAM,qCAAA,GACL,OAAA;;;UC/qBc,4BAAA;EAOf,YAAA;EAKA,MAAA;EAiBA,OAAA;AAAA;AAAA,cAGW,qBAAA,YAAiC,kBAAA;EAAA,SAG5B,KAAA;EAAA,iBACC,YAAA;EAAA,iBACA,MAAA;EAAA,QAKT,MAAA;EAAA,iBACS,aAAA;EAAA,QAQT,QAAA;cAEI,IAAA,EAAM,4BAAA;EAAA,QAOV,SAAA;EA+BK,IAAA,CACX,UAAA,UACA,YAAA,uBACC,OAAA,CAAQ,gBAAA;EA4DE,uBAAA,CACX,eAAA,WACC,OAAA,CAAQ,kBAAA;EAiEJ,OAAA,CAAA;AAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/local/state-resolver.ts","../src/local/local-state-provider.ts","../src/cli/commands/local-state-source.ts","../src/local/embed-config.ts","../src/cli/commands/local-invoke.ts","../src/cli/commands/local-start-api.ts","../src/cli/commands/local-run-task.ts","../src/cli/commands/local-start-service.ts","../src/local/cfn-local-state-provider.ts"],"mappings":";;;;UAuLiB,aAAA;EAEf,UAAA;EAGA,YAAA;EAGA,UAAA,EAAY,MAAA;EAcZ,kBAAA,GAAqB,MAAA;EAGrB,UAAA,GAAa,MAAA;EAGb,YAAA;EAGA,QAAA,GAAW,MAAA;EAmBX,cAAA;EAMA,mBAAA;EAyBA,aAAA;AAAA;;;UCxIe,gBAAA;EACf,SAAA;EACA,MAAA;EACA,SAAA;EACA,SAAA;AAAA;AAAA,UAqBe,kBAAA;EAOf,aAAA,CAAc,UAAA,WAAqB,OAAA;EAQnC,qBAAA,CACE,aAAA,UACA,cAAA,UACA,UAAA,WACC,OAAA;AAAA;AAAA,UAGY,mBAAA;EAEf,SAAA,EAAW,MAAA,SAAe,aAAA;EAE1B,gBAAA,GAAmB,gBAAA;EAOnB,kBAAA,GAAqB,kBAAA;EAOrB,cAAA;AAAA;;;UCrJe,gBAAA;EAQf,SAAA,EAAW,MAAA,SAAe,aAAA;EAO1B,OAAA,EAAS,MAAA;EAOT,MAAA;AAAA;AAAA,UAsBe,kBAAA;EAAA,SAMN,KAAA;EAQT,IAAA,CAAK,SAAA,UAAmB,WAAA,uBAAkC,OAAA,CAAQ,gBAAA;EAalE,uBAAA,CAAwB,cAAA,WAAyB,OAAA,CAAQ,kBAAA;EAKzD,OAAA;AAAA;;;UC9Ee,uBAAA;EAOf,YAAA;EAEA,MAAA;EAEA,OAAA;EAMA,WAAA;EAAA,CAEC,GAAA;AAAA;AAAA,KAQS,yBAAA,IAA6B,OAAA,EAAS,uBAAA,KAA4B,kBAAA;AAAA,KAUlE,mBAAA,GAAsB,MAAA,SAAe,yBAAA;AAAA,iBAUjC,mBAAA,CAAoB,YAAA,oBAAgC,SAAA;AAAA,iBAapD,gBAAA,CAAiB,IAAA,EAAM,IAAA,CAAK,uBAAA;AAAA,iBAgB5B,gBAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,6BACd,WAAA;AAAA,cAqBW,qBAAA,SAA8B,KAAA;cAC7B,OAAA;AAAA;AAAA,iBAkBE,wCAAA,CACd,OAAA,EAAS,IAAA,CAAK,uBAAA,mBACd,gBAAA;AAAA,iBAiCc,wBAAA,CACd,OAAA,EAAS,uBAAA,EACT,SAAA,UACA,WAAA,sBACA,mBAAA,GAAsB,mBAAA,GACrB,kBAAA;;;UCtLc,mBAAA;EAMf,OAAA;EAOA,UAAA;EAMA,WAAA;EAOA,kBAAA;EAMA,gBAAA;EAMA,SAAA;AAAA;;;UC8Ee,+BAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA22BA,wBAAA,CAAyB,IAAA,GAAM,+BAAA,GAAuC,OAAA;;;UCzvBrE,iCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBA07FA,0BAAA,CAA2B,IAAA,GAAM,iCAAA,GAAyC,OAAA;;;UCtlGzE,gCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAseA,yBAAA,CAA0B,IAAA,GAAM,gCAAA,GAAwC,OAAA;;;UC5evE,qCAAA;EACf,mBAAA,GAAsB,mBAAA;EAEtB,WAAA,GAAc,mBAAA;AAAA;AAAA,iBAipBA,8BAAA,CACd,IAAA,GAAM,qCAAA,GACL,OAAA;;;UC/qBc,4BAAA;EAOf,YAAA;EAKA,MAAA;EAiBA,OAAA;AAAA;AAAA,cAGW,qBAAA,YAAiC,kBAAA;EAAA,SAG5B,KAAA;EAAA,iBACC,YAAA;EAAA,iBACA,MAAA;EAAA,QAKT,MAAA;EAAA,iBACS,aAAA;EAAA,QAQT,QAAA;cAEI,IAAA,EAAM,4BAAA;EAAA,QAOV,SAAA;EA+BK,IAAA,CACX,UAAA,UACA,YAAA,uBACC,OAAA,CAAQ,gBAAA;EA4DE,uBAAA,CACX,eAAA,WACC,OAAA,CAAQ,kBAAA;EAiEJ,OAAA,CAAA;AAAA"}

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as LocalStateSourceError, c as rejectExplicitCfnStackWithMultipleStacks, d as CfnLocalStateProvider, i as createLocalInvokeCommand, l as resolveCfnRegion, n as createLocalRunTaskCommand, o as createLocalStateProvider, r as createLocalStartApiCommand, s as isCfnFlagPresent, t as createLocalStartServiceCommand, u as resolveCfnStackName } from "./local-start-service-irdy6U57.js";
+import { a as LocalStateSourceError, c as rejectExplicitCfnStackWithMultipleStacks, d as CfnLocalStateProvider, i as createLocalInvokeCommand, l as resolveCfnRegion, n as createLocalRunTaskCommand, o as createLocalStateProvider, r as createLocalStartApiCommand, s as isCfnFlagPresent, t as createLocalStartServiceCommand, u as resolveCfnStackName } from "./local-start-service-Bh1z2yKs.js";
 
 export { CfnLocalStateProvider, LocalStateSourceError, createLocalInvokeCommand, createLocalRunTaskCommand, createLocalStartApiCommand, createLocalStartServiceCommand, createLocalStateProvider, isCfnFlagPresent, rejectExplicitCfnStackWithMultipleStacks, resolveCfnRegion, resolveCfnStackName };

package/dist/{local-start-service-irdy6U57.js → local-start-service-Bh1z2yKs.js}

@@ -12135,20 +12135,30 @@ function base64UrlDecodeToBuffer(input) {
 *   4. Compare the recomputed signature against the header's `signature`
 *      value (constant-time compare).
 *
-* # Local-vs-deployed semantics (per `feedback_match_aws_default_over_opinionated.md`)
+* # Local-vs-deployed semantics
 *
 * Verification can only succeed when the request was signed with the
-* **same** credentials the local server can read. When the request's
-* `Credential=AKID/...` scope names a different access-key-id than the
-* one the dev has locally, cdk-local cannot reproduce the signing key — we
-* **warn-and-pass** in that case (allow + log a one-line warn), matching
-* AWS's "verify locally what we can; defer real authorization to deploy
-* time" model. Refusing would force every dev with a SigV4-signed client
-* to use the exact same credential the local server sees, which is rarely
-* what they want.
-*
-* Genuinely missing / malformed signatures **are** rejected — those would
-* never reach the deployed API either.
+* **same** credentials the local server can read. SigV4 is an HMAC
+* (shared-secret) signature: reproducing it requires the signer's secret
+* key. For a foreign access-key-id — a federated / Cognito Identity Pool /
+* cross-account signer — cdk-local does not have that secret and AWS never
+* publishes it, so local verification is **impossible**. The deployed API
+* Gateway CAN verify the very same request because AWS holds the secret;
+* this asymmetry is a local-only limitation, not a sign the request is
+* invalid.
+*
+* When the request's `Credential=AKID/...` scope names a different
+* access-key-id than the one the dev has locally, we therefore **deny by
+* default** (fail-closed). A fail-open default would let anyone forge an
+* `Authorization: AWS4-HMAC-SHA256 Credential=AKID-X/...` header and be
+* admitted as principal `AKID-X` against handler code that trusts
+* `event.requestContext.identity.accessKey`. The `--allow-unverified-sigv4`
+* flag (or an OAC-fronted Function URL, where CloudFront re-signs the
+* origin request in production) is the explicit opt-in to **warn-and-pass**
+* instead: allow + a one-line warn + an obviously-fake principalId.
+*
+* Genuinely missing / malformed signatures **are** rejected too — those
+* would never reach the deployed API either.
 *
 * # NOT IN SCOPE
 *
@@ -12267,7 +12277,7 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 	} catch (err) {
 		const reason = err instanceof Error ? err.message : String(err);
 		if (!opts.allowUnverified) {
-			logger.warn(`AWS_IAM authorizer: failed to resolve local AWS credentials (${reason}). Denying request; configure AWS credentials or pass --allow-unverified-sigv4 to opt into the warn-and-pass dev behavior.`);
+			logger.warn(`AWS_IAM authorizer: could not resolve local AWS credentials (${reason}), so the request's SigV4 signature cannot be verified — SigV4 is an HMAC (shared-secret) signature, and reproducing it requires credentials cdk-local can read. This is a local-only limitation (the deployed API Gateway verifies the same request against AWS's copy of the secret), not a rejection of an invalid request. Denying by default; configure AWS credentials, or pass --allow-unverified-sigv4 to warn-and-pass in dev.`);
 			return {
 				allow: false,
 				identityHash: void 0
@@ -12285,7 +12295,7 @@ async function verifySigV4(req, loadCredentials, opts = {}) {
 		const dedupKey = parsed.credentialAccessKeyId.toLowerCase();
 		if (!opts.allowUnverified) {
 			if (!warned || !warned.has(dedupKey)) {
-				logger.warn(`AWS_IAM authorizer: request signed with foreign access-key-id '${parsed.credentialAccessKeyId}'. Denying; pass --allow-unverified-sigv4 to opt into the warn-and-pass dev behavior, or call with credentials whose access-key-id matches your local one.`);
+				logger.warn(`AWS_IAM authorizer: request signed with access-key-id '${parsed.credentialAccessKeyId}', which differs from the AWS credentials cdk-local resolved locally. SigV4 is an HMAC (shared-secret) signature, so cdk-local can only verify signatures made with its own credentials — never a federated / Cognito Identity Pool / cross-account signer's (the deployed API Gateway verifies the same request because AWS holds that secret). This is a local-only limitation, not a rejection of an invalid request. Denying by default; pass --allow-unverified-sigv4 to warn-and-pass in dev, or sign the request with the same credentials cdk-local resolves locally.`);
 				warned?.add(dedupKey);
 			}
 			return {
@@ -14312,7 +14322,9 @@ async function localStartApiCommand(target, options, extraStateProviders) {
 				skipPull: options.pull === false,
 				...options.layerRoleArn !== void 0 && { layerRoleArn: options.layerRoleArn },
 				...profileCredentials && { profileCredentials },
-				...profileCredsFile && { profileCredsFile }
+				...profileCredsFile && { profileCredsFile },
+				...profileCredentials?.region && { profileRegion: profileCredentials.region },
+				...options.stackRegion && { stackRegionOverride: options.stackRegion }
 			});
 			specs.set(logicalId, spec);
 		}
@@ -14834,7 +14846,7 @@ function warnIamRoutes(routesWithAuth) {
 * missing, runtime not supported).
 */
 async function buildContainerSpec(args) {
-	const { logicalId, stacks, overrides, assumeRole, containerHost, debugPort, stsRegion, inlineTmpDirs, layerTmpDirs, stateByStack, skipPull, layerRoleArn, profileCredentials, profileCredsFile } = args;
+	const { logicalId, stacks, overrides, assumeRole, containerHost, debugPort, stsRegion, inlineTmpDirs, layerTmpDirs, stateByStack, skipPull, layerRoleArn, profileCredentials, profileCredsFile, profileRegion, stackRegionOverride } = args;
 	const lambda = resolveLambdaByLogicalId(logicalId, stacks);
 	let codeDir;
 	let optDir;
@@ -14895,6 +14907,14 @@ async function buildContainerSpec(args) {
 			dockerEnv["AWS_PROFILE"] = profileCredsFile.profileName;
 		}
 	}
+	if (!dockerEnv["AWS_REGION"]) {
+		const fallbackRegion = resolveContainerFallbackRegion({
+			stackRegionOverride,
+			synthRegion: lambda.stack.region,
+			profileRegion
+		});
+		if (fallbackRegion) dockerEnv["AWS_REGION"] = fallbackRegion;
+	}
 	if (debugPort !== void 0) dockerEnv["NODE_OPTIONS"] = `--inspect-brk=0.0.0.0:${debugPort}`;
 	const tmpfs = lambda.ephemeralStorageMb !== void 0 ? {
 		target: "/tmp",
@@ -15296,6 +15316,18 @@ function forwardAwsEnv(env) {
 * common dev session; long-running `--watch` sessions that outlive
 * the creds need a cdk-local restart (deferred refresh out of scope for
 * v1, see issue #654).
+*
+* Also resolves the profile's configured `region` (from `~/.aws/config`'s
+* `region = ...` for this profile) off the same client config. The
+* synthesized credentials file we mount into the container carries only
+* the credential triple — no `region =` — so without this the container
+* boots with creds but no region, and a handler's ambient-region SDK call
+* (`new XxxClient({})`) fails with "Region is missing". The caller seeds
+* the container's `AWS_REGION` fallback with it (see
+* {@link resolveContainerFallbackRegion}). Region resolution is
+* best-effort: a profile with no region (or any resolution failure)
+* yields `region: undefined` rather than throwing — a missing region is
+* not a missing-credentials error.
 */
 async function resolveProfileCredentials(profile) {
 	const { STSClient } = await import("@aws-sdk/client-sts");
@@ -15304,16 +15336,52 @@ async function resolveProfileCredentials(profile) {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
 		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) throw new Error(`--profile '${profile}': credential provider chain resolved without usable credentials. Check \`aws sso login --profile ` + profile + "` for SSO profiles, or `~/.aws/credentials` / `~/.aws/config` for regular profiles.");
+		let region;
+		try {
+			const regionProvider = sts.config.region;
+			const resolved = typeof regionProvider === "function" ? await regionProvider() : regionProvider;
+			if (typeof resolved === "string" && resolved.length > 0) region = resolved;
+		} catch {
+			region = void 0;
+		}
 		return {
 			accessKeyId: creds.accessKeyId,
 			secretAccessKey: creds.secretAccessKey,
-			...creds.sessionToken && { sessionToken: creds.sessionToken }
+			...creds.sessionToken && { sessionToken: creds.sessionToken },
+			...region && { region }
 		};
 	} finally {
 		sts.destroy();
 	}
 }
 /**
+* Resolve the fallback `AWS_REGION` for a Lambda container when neither
+* the assume-role STS region nor a forwarded `AWS_REGION` /
+* `AWS_DEFAULT_REGION` env var already set one.
+*
+* Precedence mirrors where the deployed function would actually run, so a
+* handler's ambient-region SDK call (`new XxxClient({})`) reaches the same
+* region locally as the resources it is bound to:
+*
+*   1. `--stack-region` — explicit; also drives the `--from-cfn-stack` CFn
+*      client, so the container matches the region the bound stack was read
+*      from.
+*   2. the synth-derived stack region — `env.region` on the CDK stack, read
+*      from the cloud assembly manifest (`StackInfo.region`). Previously
+*      used only host-side for the `--from-cfn-stack` CFn client; never
+*      injected into the container.
+*   3. the `--profile`'s configured region — `~/.aws/config`'s `region =`
+*      for the profile. `--profile` injected credentials but not this.
+*
+* Returns `undefined` when none is known; the caller leaves `AWS_REGION`
+* unset so the SDK's own "Region is missing" surfaces (the correct signal
+* for a region-agnostic stack with no profile region and no `AWS_REGION`
+* env).
+*/
+function resolveContainerFallbackRegion(args) {
+	return args.stackRegionOverride ?? args.synthRegion ?? args.profileRegion;
+}
+/**
 * Issue an STS AssumeRole and return temporary credentials. Mirrors
 * `cdkl invoke`'s helper byte-for-byte; lifted here so the
 * start-api command stays self-contained.
@@ -18226,4 +18294,4 @@ function createLocalStartServiceCommand(opts = {}) {
 
 //#endregion
 export { LocalStateSourceError as a, rejectExplicitCfnStackWithMultipleStacks as c, CfnLocalStateProvider as d, createLocalInvokeCommand as i, resolveCfnRegion as l, createLocalRunTaskCommand as n, createLocalStateProvider as o, createLocalStartApiCommand as r, isCfnFlagPresent as s, createLocalStartServiceCommand as t, resolveCfnStackName as u };
-//# sourceMappingURL=local-start-service-irdy6U57.js.map
+//# sourceMappingURL=local-start-service-Bh1z2yKs.js.map