quidproquo-deploy-awscdk 0.0.113 → 0.0.115

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/lib/constructs/basic/Function.js +6 -4
  2. package/lib/constructs/feature/core/keyValueStore/QpqCoreKeyValueStoreConstruct.js +20 -0
  3. package/lib/constructs/feature/core/storageDrive/QpqCoreStorageDriveConstruct.js +11 -9
  4. package/lib/stacks/ApiQpqServiceStack.d.ts +1 -1
  5. package/lib/stacks/ApiQpqServiceStack.js +3 -1
  6. package/lib/stacks/InfQpqServiceStack.js +1 -1
  7. package/lib/stacks/WebQpqServiceStack.d.ts +1 -1
  8. package/lib/stacks/WebQpqServiceStack.js +3 -1
  9. package/package.json +1 -1
  10. package/src/constructs/basic/Function.ts +6 -4
  11. package/src/constructs/feature/core/keyValueStore/QpqCoreKeyValueStoreConstruct.ts +24 -1
  12. package/src/constructs/feature/core/storageDrive/QpqCoreStorageDriveConstruct.ts +11 -11
  13. package/src/stacks/ApiQpqServiceStack.ts +4 -2
  14. package/src/stacks/InfQpqServiceStack.ts +1 -1
  15. package/src/stacks/WebQpqServiceStack.ts +4 -2
package/lib/constructs/basic/Function.js CHANGED
@@ -71,10 +71,10 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
71
71
  actions: ['lambda:InvokeFunction'],
72
72
  resources: ['arn:aws:lambda:*:*:function:*sfunc*'],
73
73
  }));
74
- // Let lambdas write to dynamo logs
74
+ // Let lambdas access s3
75
75
  this.lambdaFunction.addToRolePolicy(new aws_cdk_lib_1.aws_iam.PolicyStatement({
76
- actions: ['lambda:InvokeFunction'],
77
- resources: ['arn:aws:lambda:*:*:function:*sfunc*'],
76
+ actions: ['s3:GetObject', 's3:PutObject', 's3:ListBucket', 's3:DeleteObject'],
77
+ resources: ['arn:aws:s3:::*'],
78
78
  }));
79
79
  // We need access to dynamo log tables
80
80
  this.lambdaFunction.addToRolePolicy(new aws_cdk_lib_1.aws_iam.PolicyStatement({
@@ -86,7 +86,9 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
86
86
  // 'aws:ResourceTag/Name': '*qpqlog',
87
87
  // },
88
88
  // },
89
- resources: ['arn:aws:dynamodb:*:*:table/logs-*'],
89
+ // Actually all tables currently :/
90
+ resources: ['arn:aws:dynamodb:*:*:table/*'],
91
+ // resources: ['arn:aws:dynamodb:*:*:table/logs-*'],
90
92
  }));
91
93
  }
92
94
  }
package/lib/constructs/feature/core/keyValueStore/QpqCoreKeyValueStoreConstruct.js CHANGED
@@ -93,6 +93,26 @@ class QpqCoreKeyValueStoreConstruct extends QpqCoreKeyValueStoreConstructBase {
93
93
  });
94
94
  }
95
95
  this.table = table;
96
+ // Security ~ IF global is true
97
+ if (!!props.keyValueStoreConfig.owner) {
98
+ const policyStatement = new aws_cdk_lib_1.aws_iam.PolicyStatement({
99
+ sid: 'AllowAllEntitiesInAccount',
100
+ effect: aws_cdk_lib_1.aws_iam.Effect.ALLOW,
101
+ actions: [
102
+ 'dynamodb:GetItem',
103
+ 'dynamodb:PutItem',
104
+ 'dynamodb:Query',
105
+ 'dynamodb:Scan',
106
+ 'dynamodb:UpdateItem',
107
+ 'dynamodb:DeleteItem',
108
+ ],
109
+ resources: [table.tableArn],
110
+ });
111
+ const role = new aws_cdk_lib_1.aws_iam.Role(this, 'AllowAllEntitiesInAccountRole', {
112
+ assumedBy: new aws_cdk_lib_1.aws_iam.AccountPrincipal(props.awsAccountId),
113
+ });
114
+ role.addToPolicy(policyStatement);
115
+ }
96
116
  }
97
117
  }
98
118
  exports.QpqCoreKeyValueStoreConstruct = QpqCoreKeyValueStoreConstruct;
package/lib/constructs/feature/core/storageDrive/QpqCoreStorageDriveConstruct.js CHANGED
@@ -75,15 +75,17 @@ class QpqCoreStorageDriveConstruct extends QpqCoreStorageDriveConstructBase {
75
75
  },
76
76
  },
77
77
  }));
78
- if (props.storageDriveConfig.global) {
79
- this.bucket.addToResourcePolicy(new aws_cdk_lib_1.aws_iam.PolicyStatement({
80
- sid: 'AllowAllEntitiesInAccount',
81
- effect: aws_cdk_lib_1.aws_iam.Effect.ALLOW,
82
- principals: [new aws_cdk_lib_1.aws_iam.AccountPrincipal(props.awsAccountId)],
83
- actions: ['s3:GetObject', 's3:PutObject', 's3:ListBucket', 's3:DeleteObject'],
84
- resources: [this.bucket.arnForObjects('*'), this.bucket.bucketArn],
85
- }));
86
- }
78
+ // if (props.storageDriveConfig.global) {
79
+ // this.bucket.addToResourcePolicy(
80
+ // new aws_iam.PolicyStatement({
81
+ // sid: 'AllowAllEntitiesInAccount',
82
+ // effect: aws_iam.Effect.ALLOW,
83
+ // principals: [new aws_iam.AccountPrincipal(props.awsAccountId)],
84
+ // actions: ['s3:GetObject', 's3:PutObject', 's3:ListBucket', 's3:DeleteObject'],
85
+ // resources: [this.bucket.arnForObjects('*'), this.bucket.bucketArn],
86
+ // }),
87
+ // );
88
+ // }
87
89
  if (props.storageDriveConfig.copyPath) {
88
90
  const srcDir = quidproquo_core_1.qpqCoreUtils.getStorageDriveUploadFullPath(props.qpqConfig, props.storageDriveConfig);
89
91
  new aws_cdk_lib_1.aws_s3_deployment.BucketDeployment(this, 'bucket-deploy', {
package/lib/stacks/ApiQpqServiceStack.d.ts CHANGED
@@ -2,7 +2,7 @@ import { Construct } from 'constructs';
2
2
  import { QpqServiceStack, QpqServiceStackProps } from './base/QpqServiceStack';
3
3
  import { InfQpqServiceStack } from './InfQpqServiceStack';
4
4
  export interface ApiQpqServiceStackProps extends QpqServiceStackProps {
5
- infQpqServiceStack: InfQpqServiceStack;
5
+ infQpqServiceStack?: InfQpqServiceStack;
6
6
  }
7
7
  export declare class ApiQpqServiceStack extends QpqServiceStack {
8
8
  constructor(scope: Construct, id: string, props: ApiQpqServiceStackProps);
package/lib/stacks/ApiQpqServiceStack.js CHANGED
@@ -9,7 +9,9 @@ class ApiQpqServiceStack extends QpqServiceStack_1.QpqServiceStack {
9
9
  constructor(scope, id, props) {
10
10
  super(scope, id, props);
11
11
  // Add the inf stack as a dependency so it builds first
12
- this.addDependency(props.infQpqServiceStack);
12
+ if (props.infQpqServiceStack) {
13
+ this.addDependency(props.infQpqServiceStack);
14
+ }
13
15
  // Build Lambda Layers
14
16
  const layers = new constructs_1.LambdaLayers(this, 'lambda-layers', {
15
17
  awsAccountId: props.awsAccountId,
package/lib/stacks/InfQpqServiceStack.js CHANGED
@@ -62,7 +62,7 @@ class InfQpqServiceStack extends QpqServiceStack_1.QpqServiceStack {
62
62
  eventBusConfig: setting,
63
63
  }));
64
64
  // key value store
65
- const keyValueStores = quidproquo_core_1.qpqCoreUtils.getAllKeyValueStores(props.qpqConfig).map((setting) => new constructs_1.QpqCoreKeyValueStoreConstruct(this, quidproquo_core_1.qpqCoreUtils.getUniqueKeyForSetting(setting), {
65
+ const keyValueStores = quidproquo_core_1.qpqCoreUtils.getOwnedKeyValueStores(props.qpqConfig).map((setting) => new constructs_1.QpqCoreKeyValueStoreConstruct(this, quidproquo_core_1.qpqCoreUtils.getUniqueKeyForSetting(setting), {
66
66
  awsAccountId: props.awsAccountId,
67
67
  qpqConfig: props.qpqConfig,
68
68
  keyValueStoreConfig: setting,
package/lib/stacks/WebQpqServiceStack.d.ts CHANGED
@@ -2,7 +2,7 @@ import { Construct } from 'constructs';
2
2
  import { QpqServiceStack, QpqServiceStackProps } from './base/QpqServiceStack';
3
3
  import { InfQpqServiceStack } from './InfQpqServiceStack';
4
4
  export interface WebQpqServiceStackProps extends QpqServiceStackProps {
5
- infQpqServiceStack: InfQpqServiceStack;
5
+ infQpqServiceStack?: InfQpqServiceStack;
6
6
  }
7
7
  export declare class WebQpqServiceStack extends QpqServiceStack {
8
8
  constructor(scope: Construct, id: string, props: WebQpqServiceStackProps);
package/lib/stacks/WebQpqServiceStack.js CHANGED
@@ -9,7 +9,9 @@ class WebQpqServiceStack extends QpqServiceStack_1.QpqServiceStack {
9
9
  constructor(scope, id, props) {
10
10
  super(scope, id, props);
11
11
  // Add the inf stack as a dependency so it builds first
12
- this.addDependency(props.infQpqServiceStack);
12
+ if (props.infQpqServiceStack) {
13
+ this.addDependency(props.infQpqServiceStack);
14
+ }
13
15
  // Web entries
14
16
  const webEntries = quidproquo_webserver_1.qpqWebServerUtils.getWebEntryConfigs(props.qpqConfig).map((setting) => new constructs_1.QpqWebserverWebEntryConstruct(this, quidproquo_core_1.qpqCoreUtils.getUniqueKeyForSetting(setting), {
15
17
  awsAccountId: props.awsAccountId,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "quidproquo-deploy-awscdk",
3
- "version": "0.0.113",
3
+ "version": "0.0.115",
4
4
  "description": "",
5
5
  "main": "./lib/index.js",
6
6
  "types": "./lib/index.d.js",
package/src/constructs/basic/Function.ts CHANGED
@@ -89,11 +89,11 @@ export class Function extends QpqConstructBlock {
89
89
  }),
90
90
  );
91
91
 
92
- // Let lambdas write to dynamo logs
92
+ // Let lambdas access s3
93
93
  this.lambdaFunction.addToRolePolicy(
94
94
  new aws_iam.PolicyStatement({
95
- actions: ['lambda:InvokeFunction'],
96
- resources: ['arn:aws:lambda:*:*:function:*sfunc*'],
95
+ actions: ['s3:GetObject', 's3:PutObject', 's3:ListBucket', 's3:DeleteObject'],
96
+ resources: ['arn:aws:s3:::*'],
97
97
  }),
98
98
  );
99
99
 
@@ -109,7 +109,9 @@ export class Function extends QpqConstructBlock {
109
109
  // 'aws:ResourceTag/Name': '*qpqlog',
110
110
  // },
111
111
  // },
112
- resources: ['arn:aws:dynamodb:*:*:table/logs-*'],
112
+ // Actually all tables currently :/
113
+ resources: ['arn:aws:dynamodb:*:*:table/*'],
114
+ // resources: ['arn:aws:dynamodb:*:*:table/logs-*'],
113
115
  }),
114
116
  );
115
117
  }
package/src/constructs/feature/core/keyValueStore/QpqCoreKeyValueStoreConstruct.ts CHANGED
@@ -1,4 +1,4 @@
1
- import { KeyValueStoreQPQConfigSetting, QPQConfig, KvsKey } from 'quidproquo-core';
1
+ import { KeyValueStoreQPQConfigSetting, QPQConfig, KvsKey, qpqCoreUtils } from 'quidproquo-core';
2
2
  import { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';
3
3
 
4
4
  import { Construct } from 'constructs';
@@ -99,5 +99,28 @@ export class QpqCoreKeyValueStoreConstruct extends QpqCoreKeyValueStoreConstruct
99
99
  }
100
100
 
101
101
  this.table = table;
102
+
103
+ // Security ~ IF global is true
104
+ if (!!props.keyValueStoreConfig.owner) {
105
+ const policyStatement = new aws_iam.PolicyStatement({
106
+ sid: 'AllowAllEntitiesInAccount',
107
+ effect: aws_iam.Effect.ALLOW,
108
+ actions: [
109
+ 'dynamodb:GetItem',
110
+ 'dynamodb:PutItem',
111
+ 'dynamodb:Query',
112
+ 'dynamodb:Scan',
113
+ 'dynamodb:UpdateItem',
114
+ 'dynamodb:DeleteItem',
115
+ ],
116
+ resources: [table.tableArn],
117
+ });
118
+
119
+ const role = new aws_iam.Role(this, 'AllowAllEntitiesInAccountRole', {
120
+ assumedBy: new aws_iam.AccountPrincipal(props.awsAccountId),
121
+ });
122
+
123
+ role.addToPolicy(policyStatement);
124
+ }
102
125
  }
103
126
  }
package/src/constructs/feature/core/storageDrive/QpqCoreStorageDriveConstruct.ts CHANGED
@@ -83,17 +83,17 @@ export class QpqCoreStorageDriveConstruct extends QpqCoreStorageDriveConstructBa
83
83
  }),
84
84
  );
85
85
 
86
- if (props.storageDriveConfig.global) {
87
- this.bucket.addToResourcePolicy(
88
- new aws_iam.PolicyStatement({
89
- sid: 'AllowAllEntitiesInAccount',
90
- effect: aws_iam.Effect.ALLOW,
91
- principals: [new aws_iam.AccountPrincipal(props.awsAccountId)],
92
- actions: ['s3:GetObject', 's3:PutObject', 's3:ListBucket', 's3:DeleteObject'],
93
- resources: [this.bucket.arnForObjects('*'), this.bucket.bucketArn],
94
- }),
95
- );
96
- }
86
+ // if (props.storageDriveConfig.global) {
87
+ // this.bucket.addToResourcePolicy(
88
+ // new aws_iam.PolicyStatement({
89
+ // sid: 'AllowAllEntitiesInAccount',
90
+ // effect: aws_iam.Effect.ALLOW,
91
+ // principals: [new aws_iam.AccountPrincipal(props.awsAccountId)],
92
+ // actions: ['s3:GetObject', 's3:PutObject', 's3:ListBucket', 's3:DeleteObject'],
93
+ // resources: [this.bucket.arnForObjects('*'), this.bucket.bucketArn],
94
+ // }),
95
+ // );
96
+ // }
97
97
 
98
98
  if (props.storageDriveConfig.copyPath) {
99
99
  const srcDir = qpqCoreUtils.getStorageDriveUploadFullPath(
package/src/stacks/ApiQpqServiceStack.ts CHANGED
@@ -15,7 +15,7 @@ import {
15
15
  } from '../constructs';
16
16
 
17
17
  export interface ApiQpqServiceStackProps extends QpqServiceStackProps {
18
- infQpqServiceStack: InfQpqServiceStack;
18
+ infQpqServiceStack?: InfQpqServiceStack;
19
19
  }
20
20
 
21
21
  export class ApiQpqServiceStack extends QpqServiceStack {
@@ -23,7 +23,9 @@ export class ApiQpqServiceStack extends QpqServiceStack {
23
23
  super(scope, id, props);
24
24
 
25
25
  // Add the inf stack as a dependency so it builds first
26
- this.addDependency(props.infQpqServiceStack);
26
+ if (props.infQpqServiceStack) {
27
+ this.addDependency(props.infQpqServiceStack);
28
+ }
27
29
 
28
30
  // Build Lambda Layers
29
31
  const layers = new LambdaLayers(this, 'lambda-layers', {
package/src/stacks/InfQpqServiceStack.ts CHANGED
@@ -118,7 +118,7 @@ export class InfQpqServiceStack extends QpqServiceStack {
118
118
  );
119
119
 
120
120
  // key value store
121
- const keyValueStores = qpqCoreUtils.getAllKeyValueStores(props.qpqConfig).map(
121
+ const keyValueStores = qpqCoreUtils.getOwnedKeyValueStores(props.qpqConfig).map(
122
122
  (setting) =>
123
123
  new QpqCoreKeyValueStoreConstruct(this, qpqCoreUtils.getUniqueKeyForSetting(setting), {
124
124
  awsAccountId: props.awsAccountId,
package/src/stacks/WebQpqServiceStack.ts CHANGED
@@ -9,7 +9,7 @@ import { InfQpqServiceStack } from './InfQpqServiceStack';
9
9
  import { QpqWebserverWebEntryConstruct } from '../constructs';
10
10
 
11
11
  export interface WebQpqServiceStackProps extends QpqServiceStackProps {
12
- infQpqServiceStack: InfQpqServiceStack;
12
+ infQpqServiceStack?: InfQpqServiceStack;
13
13
  }
14
14
 
15
15
  export class WebQpqServiceStack extends QpqServiceStack {
@@ -17,7 +17,9 @@ export class WebQpqServiceStack extends QpqServiceStack {
17
17
  super(scope, id, props);
18
18
 
19
19
  // Add the inf stack as a dependency so it builds first
20
- this.addDependency(props.infQpqServiceStack);
20
+ if (props.infQpqServiceStack) {
21
+ this.addDependency(props.infQpqServiceStack);
22
+ }
21
23
 
22
24
  // Web entries
23
25
  const webEntries = qpqWebServerUtils.getWebEntryConfigs(props.qpqConfig).map(