s3-secure-bucket 0.3.7 → 0.4.0

package/lib/s3-secure-bucket.d.ts

@@ -0,0 +1,43 @@
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import { Construct, IDependable } from 'constructs';
+import { S3SecureBucketProps } from './bucket-types';
+/**
+ * S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access,
+ * and encryption (S3-managed for log/origin/archive types; KMS-managed by default otherwise).
+ *
+ * @remarks
+ * Secure defaults applied regardless of `props`:
+ * - `removalPolicy`: {@link RemovalPolicy.RETAIN}
+ * - `publicReadAccess`: `false`
+ * - `blockPublicAccess`: {@link s3.BlockPublicAccess.BLOCK_ALL}
+ * - `enforceSSL`: `true`
+ * - `versioned`: `true` unless explicitly set in `props`
+ * - `objectOwnership`: {@link s3.ObjectOwnership.BUCKET_OWNER_ENFORCED} unless overridden
+ * - `accessControl`: {@link s3.BucketAccessControl.PRIVATE} unless overridden
+ *
+ * Bucket-type-specific behavior:
+ * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
+ * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable}.
+ * - {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET}: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`).
+ */
+export declare class S3SecureBucket extends s3.Bucket {
+    /**
+     * Set only when {@link S3SecureBucketProps.bucketType} is {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
+     * Use as a dependency target so load balancer access-log enablement runs after the bucket policy
+     * exists (ELB performs an immediate validation `PutObject` that fails if the policy is not applied yet).
+     *
+     * Example: `loadBalancer.node.addDependency(bucket.accessLogBucketPolicyDependable!)`.
+     *
+     * @default undefined when `bucketType` is not {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
+     */
+    readonly accessLogBucketPolicyDependable?: IDependable;
+    /**
+     * Creates a secure S3 bucket according to `bucketType` and merged `props`.
+     *
+     * @param scope - Parent construct, typically a {@link Stack}.
+     * @param id - Construct ID (stable logical ID segment).
+     * @param props - Optional {@link S3SecureBucketProps}; secure defaults override several {@link s3.BucketProps} fields.
+     * When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 property override.
+     */
+    constructor(scope: Construct, id: string, props?: S3SecureBucketProps);
+}

package/lib/s3-secure-bucket.js

@@ -0,0 +1,118 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.S3SecureBucket = void 0;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
+const bucket_policies_1 = require("./bucket-policies");
+const bucket_types_1 = require("./bucket-types");
+/**
+ * S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access,
+ * and encryption (S3-managed for log/origin/archive types; KMS-managed by default otherwise).
+ *
+ * @remarks
+ * Secure defaults applied regardless of `props`:
+ * - `removalPolicy`: {@link RemovalPolicy.RETAIN}
+ * - `publicReadAccess`: `false`
+ * - `blockPublicAccess`: {@link s3.BlockPublicAccess.BLOCK_ALL}
+ * - `enforceSSL`: `true`
+ * - `versioned`: `true` unless explicitly set in `props`
+ * - `objectOwnership`: {@link s3.ObjectOwnership.BUCKET_OWNER_ENFORCED} unless overridden
+ * - `accessControl`: {@link s3.BucketAccessControl.PRIVATE} unless overridden
+ *
+ * Bucket-type-specific behavior:
+ * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
+ * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable}.
+ * - {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET}: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`).
+ */
+class S3SecureBucket extends s3.Bucket {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "s3-secure-bucket.S3SecureBucket", version: "0.4.0" };
+    /**
+     * Set only when {@link S3SecureBucketProps.bucketType} is {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
+     * Use as a dependency target so load balancer access-log enablement runs after the bucket policy
+     * exists (ELB performs an immediate validation `PutObject` that fails if the policy is not applied yet).
+     *
+     * Example: `loadBalancer.node.addDependency(bucket.accessLogBucketPolicyDependable!)`.
+     *
+     * @default undefined when `bucketType` is not {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
+     */
+    accessLogBucketPolicyDependable;
+    /**
+     * Creates a secure S3 bucket according to `bucketType` and merged `props`.
+     *
+     * @param scope - Parent construct, typically a {@link Stack}.
+     * @param id - Construct ID (stable logical ID segment).
+     * @param props - Optional {@link S3SecureBucketProps}; secure defaults override several {@link s3.BucketProps} fields.
+     * When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 property override.
+     */
+    constructor(scope, id, props) {
+        const bucketType = props?.bucketType || bucket_types_1.S3SecureBucketType.DEFAULT_BUCKET;
+        super(scope, id, {
+            ...props,
+            removalPolicy: aws_cdk_lib_1.RemovalPolicy.RETAIN,
+            encryption: (0, bucket_types_1.resolveEncryptionDefault)(bucketType, props?.encryption),
+            accessControl: (() => {
+                if (!props?.accessControl) {
+                    return s3.BucketAccessControl.PRIVATE;
+                }
+                return props.accessControl;
+            })(),
+            eventBridgeEnabled: undefined,
+            publicReadAccess: false,
+            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+            enforceSSL: true,
+            versioned: props?.versioned !== undefined ? props.versioned : true,
+            objectOwnership: (() => {
+                if (props?.objectOwnership) {
+                    return props.objectOwnership;
+                }
+                return s3.ObjectOwnership.BUCKET_OWNER_ENFORCED;
+            })(),
+        });
+        const cfnBucket = this.node.defaultChild;
+        if (props?.eventBridgeEnabled === true) {
+            cfnBucket.addPropertyOverride('NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled', true);
+        }
+        const stack = aws_cdk_lib_1.Stack.of(this);
+        const policyResult = (0, bucket_policies_1.applyBucketPolicies)(bucketType, {
+            bucket: this,
+            stack,
+        });
+        this.accessLogBucketPolicyDependable = policyResult.accessLogBucketPolicyDependable;
+    }
+}
+exports.S3SecureBucket = S3SecureBucket;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiczMtc2VjdXJlLWJ1Y2tldC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9zMy1zZWN1cmUtYnVja2V0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSw2Q0FBbUQ7QUFDbkQsdURBQXlDO0FBRXpDLHVEQUF3RDtBQUN4RCxpREFJd0I7QUFFeEI7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQWtCRztBQUNILE1BQWEsY0FBZSxTQUFRLEVBQUUsQ0FBQyxNQUFNOztJQUMzQzs7Ozs7Ozs7T0FRRztJQUNhLCtCQUErQixDQUFlO0lBRTlEOzs7Ozs7O09BT0c7SUFDSCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTJCO1FBQ25FLE1BQU0sVUFBVSxHQUFHLEtBQUssRUFBRSxVQUFVLElBQUksaUNBQWtCLENBQUMsY0FBYyxDQUFDO1FBQzFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxLQUFLO1lBQ1IsYUFBYSxFQUFFLDJCQUFhLENBQUMsTUFBTTtZQUNuQyxVQUFVLEVBQUUsSUFBQSx1Q0FBd0IsRUFBQyxVQUFVLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQztZQUNuRSxhQUFhLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ25CLElBQUksQ0FBQyxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7b0JBQzFCLE9BQU8sRUFBRSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQztnQkFDeEMsQ0FBQztnQkFDRCxPQUFPLEtBQUssQ0FBQyxhQUFhLENBQUM7WUFDN0IsQ0FBQyxDQUFDLEVBQUU7WUFDSixrQkFBa0IsRUFBRSxTQUFTO1lBQzdCLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsaUJBQWlCLEVBQUUsRUFBRSxDQUFDLGlCQUFpQixDQUFDLFNBQVM7WUFDakQsVUFBVSxFQUFFLElBQUk7WUFDaEIsU0FBUyxFQUFFLEtBQUssRUFBRSxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJO1lBQ2xFLGVBQWUsRUFBRSxDQUFDLEdBQUcsRUFBRTtnQkFDckIsSUFBSSxLQUFLLEVBQUUsZUFBZSxFQUFFLENBQUM7b0JBQzNCLE9BQU8sS0FBSyxDQUFDLGVBQWUsQ0FBQztnQkFDL0IsQ0FBQztnQkFDRCxPQUFPLEVBQUUsQ0FBQyxlQUFlLENBQUMscUJBQXFCLENBQUM7WUFDbEQsQ0FBQyxDQUFDLEVBQUU7U0FDTCxDQUFDLENBQUM7UUFFSCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFlBQTRCLENBQUM7UUFDekQsSUFBSSxLQUFLLEVBQUUsa0JBQWtCLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdkMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLHVFQUF1RSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQy9HLENBQUM7UUFFRCxNQUFNLEtBQUssR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QixNQUFNLFlBQVksR0FBRyxJQUFBLHFDQUFtQixFQUFDLFVBQVUsRUFBRTtZQUNuRCxNQUFNLEVBQUUsSUFBSTtZQUNaLEtBQUs7U0FDTixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsK0JBQStCLEdBQUcsWUFBWSxDQUFDLCtCQUErQixDQUFDO0lBQ3RGLENBQUM7O0FBeERILHdDQXlEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFJlbW92YWxQb2xpY3ksIFN0YWNrIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB7IENvbnN0cnVjdCwgSURlcGVuZGFibGUgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IGFwcGx5QnVja2V0UG9saWNpZXMgfSBmcm9tICcuL2J1Y2tldC1wb2xpY2llcyc7XG5pbXBvcnQge1xuICByZXNvbHZlRW5jcnlwdGlvbkRlZmF1bHQsXG4gIFMzU2VjdXJlQnVja2V0UHJvcHMsXG4gIFMzU2VjdXJlQnVja2V0VHlwZSxcbn0gZnJvbSAnLi9idWNrZXQtdHlwZXMnO1xuXG4vKipcbiAqIFMzIGJ1Y2tldCB3aXRoIG9waW5pb25hdGVkIHNlY3VyZSBkZWZhdWx0czogcHJpdmF0ZSBBQ0xzLCBibG9jayBwdWJsaWMgYWNjZXNzLCBUTFMtb25seSBhY2Nlc3MsXG4gKiBhbmQgZW5jcnlwdGlvbiAoUzMtbWFuYWdlZCBmb3IgbG9nL29yaWdpbi9hcmNoaXZlIHR5cGVzOyBLTVMtbWFuYWdlZCBieSBkZWZhdWx0IG90aGVyd2lzZSkuXG4gKlxuICogQHJlbWFya3NcbiAqIFNlY3VyZSBkZWZhdWx0cyBhcHBsaWVkIHJlZ2FyZGxlc3Mgb2YgYHByb3BzYDpcbiAqIC0gYHJlbW92YWxQb2xpY3lgOiB7QGxpbmsgUmVtb3ZhbFBvbGljeS5SRVRBSU59XG4gKiAtIGBwdWJsaWNSZWFkQWNjZXNzYDogYGZhbHNlYFxuICogLSBgYmxvY2tQdWJsaWNBY2Nlc3NgOiB7QGxpbmsgczMuQmxvY2tQdWJsaWNBY2Nlc3MuQkxPQ0tfQUxMfVxuICogLSBgZW5mb3JjZVNTTGA6IGB0cnVlYFxuICogLSBgdmVyc2lvbmVkYDogYHRydWVgIHVubGVzcyBleHBsaWNpdGx5IHNldCBpbiBgcHJvcHNgXG4gKiAtIGBvYmplY3RPd25lcnNoaXBgOiB7QGxpbmsgczMuT2JqZWN0T3duZXJzaGlwLkJVQ0tFVF9PV05FUl9FTkZPUkNFRH0gdW5sZXNzIG92ZXJyaWRkZW5cbiAqIC0gYGFjY2Vzc0NvbnRyb2xgOiB7QGxpbmsgczMuQnVja2V0QWNjZXNzQ29udHJvbC5QUklWQVRFfSB1bmxlc3Mgb3ZlcnJpZGRlblxuICpcbiAqIEJ1Y2tldC10eXBlLXNwZWNpZmljIGJlaGF2aW9yOlxuICogLSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkRFUExPWU1FTlRfUElQRUxJTkVfQVJUSUZBQ1RfQlVDS0VUfTogbWF5IGF0dGFjaCBhIGRlcGxveS1yb2xlIHBvbGljeSB3aGVuIGEgbm9uLWRlZmF1bHQgYm9vdHN0cmFwIHF1YWxpZmllciBpcyBwcmVzZW50LlxuICogLSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfTogYWRkcyBsb2ctd3JpdGVyIHByaW5jaXBhbHM7IHNlZSB7QGxpbmsgUzNTZWN1cmVCdWNrZXQjYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZX0uXG4gKiAtIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURfV0FUQ0hfTE9HX0FSQ0hJVkVfQlVDS0VUfTogYWRkcyBDbG91ZFdhdGNoIExvZ3MgZXhwb3J0IHByaW5jaXBhbHMgKGBsb2dzLjxyZWdpb24+LmFtYXpvbmF3cy5jb21gKS5cbiAqL1xuZXhwb3J0IGNsYXNzIFMzU2VjdXJlQnVja2V0IGV4dGVuZHMgczMuQnVja2V0IHtcbiAgLyoqXG4gICAqIFNldCBvbmx5IHdoZW4ge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0gaXMge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0uXG4gICAqIFVzZSBhcyBhIGRlcGVuZGVuY3kgdGFyZ2V0IHNvIGxvYWQgYmFsYW5jZXIgYWNjZXNzLWxvZyBlbmFibGVtZW50IHJ1bnMgYWZ0ZXIgdGhlIGJ1Y2tldCBwb2xpY3lcbiAgICogZXhpc3RzIChFTEIgcGVyZm9ybXMgYW4gaW1tZWRpYXRlIHZhbGlkYXRpb24gYFB1dE9iamVjdGAgdGhhdCBmYWlscyBpZiB0aGUgcG9saWN5IGlzIG5vdCBhcHBsaWVkIHlldCkuXG4gICAqXG4gICAqIEV4YW1wbGU6IGBsb2FkQmFsYW5jZXIubm9kZS5hZGREZXBlbmRlbmN5KGJ1Y2tldC5hY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlISlgLlxuICAgKlxuICAgKiBAZGVmYXVsdCB1bmRlZmluZWQgd2hlbiBgYnVja2V0VHlwZWAgaXMgbm90IHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9LlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGU/OiBJRGVwZW5kYWJsZTtcblxuICAvKipcbiAgICogQ3JlYXRlcyBhIHNlY3VyZSBTMyBidWNrZXQgYWNjb3JkaW5nIHRvIGBidWNrZXRUeXBlYCBhbmQgbWVyZ2VkIGBwcm9wc2AuXG4gICAqXG4gICAqIEBwYXJhbSBzY29wZSAtIFBhcmVudCBjb25zdHJ1Y3QsIHR5cGljYWxseSBhIHtAbGluayBTdGFja30uXG4gICAqIEBwYXJhbSBpZCAtIENvbnN0cnVjdCBJRCAoc3RhYmxlIGxvZ2ljYWwgSUQgc2VnbWVudCkuXG4gICAqIEBwYXJhbSBwcm9wcyAtIE9wdGlvbmFsIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzfTsgc2VjdXJlIGRlZmF1bHRzIG92ZXJyaWRlIHNldmVyYWwge0BsaW5rIHMzLkJ1Y2tldFByb3BzfSBmaWVsZHMuXG4gICAqIFdoZW4gYGV2ZW50QnJpZGdlRW5hYmxlZGAgaXMgYHRydWVgLCBFdmVudEJyaWRnZSBub3RpZmljYXRpb24gaXMgZW5hYmxlZCB2aWEgYW4gTDEgcHJvcGVydHkgb3ZlcnJpZGUuXG4gICAqL1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wcz86IFMzU2VjdXJlQnVja2V0UHJvcHMpIHtcbiAgICBjb25zdCBidWNrZXRUeXBlID0gcHJvcHM/LmJ1Y2tldFR5cGUgfHwgUzNTZWN1cmVCdWNrZXRUeXBlLkRFRkFVTFRfQlVDS0VUO1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucHJvcHMsXG4gICAgICByZW1vdmFsUG9saWN5OiBSZW1vdmFsUG9saWN5LlJFVEFJTixcbiAgICAgIGVuY3J5cHRpb246IHJlc29sdmVFbmNyeXB0aW9uRGVmYXVsdChidWNrZXRUeXBlLCBwcm9wcz8uZW5jcnlwdGlvbiksXG4gICAgICBhY2Nlc3NDb250cm9sOiAoKCkgPT4ge1xuICAgICAgICBpZiAoIXByb3BzPy5hY2Nlc3NDb250cm9sKSB7XG4gICAgICAgICAgcmV0dXJuIHMzLkJ1Y2tldEFjY2Vzc0NvbnRyb2wuUFJJVkFURTtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gcHJvcHMuYWNjZXNzQ29udHJvbDtcbiAgICAgIH0pKCksXG4gICAgICBldmVudEJyaWRnZUVuYWJsZWQ6IHVuZGVmaW5lZCxcbiAgICAgIHB1YmxpY1JlYWRBY2Nlc3M6IGZhbHNlLFxuICAgICAgYmxvY2tQdWJsaWNBY2Nlc3M6IHMzLkJsb2NrUHVibGljQWNjZXNzLkJMT0NLX0FMTCxcbiAgICAgIGVuZm9yY2VTU0w6IHRydWUsXG4gICAgICB2ZXJzaW9uZWQ6IHByb3BzPy52ZXJzaW9uZWQgIT09IHVuZGVmaW5lZCA/IHByb3BzLnZlcnNpb25lZCA6IHRydWUsXG4gICAgICBvYmplY3RPd25lcnNoaXA6ICgoKSA9PiB7XG4gICAgICAgIGlmIChwcm9wcz8ub2JqZWN0T3duZXJzaGlwKSB7XG4gICAgICAgICAgcmV0dXJuIHByb3BzLm9iamVjdE93bmVyc2hpcDtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gczMuT2JqZWN0T3duZXJzaGlwLkJVQ0tFVF9PV05FUl9FTkZPUkNFRDtcbiAgICAgIH0pKCksXG4gICAgfSk7XG5cbiAgICBjb25zdCBjZm5CdWNrZXQgPSB0aGlzLm5vZGUuZGVmYXVsdENoaWxkIGFzIHMzLkNmbkJ1Y2tldDtcbiAgICBpZiAocHJvcHM/LmV2ZW50QnJpZGdlRW5hYmxlZCA9PT0gdHJ1ZSkge1xuICAgICAgY2ZuQnVja2V0LmFkZFByb3BlcnR5T3ZlcnJpZGUoJ05vdGlmaWNhdGlvbkNvbmZpZ3VyYXRpb24uRXZlbnRCcmlkZ2VDb25maWd1cmF0aW9uLkV2ZW50QnJpZGdlRW5hYmxlZCcsIHRydWUpO1xuICAgIH1cblxuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2YodGhpcyk7XG4gICAgY29uc3QgcG9saWN5UmVzdWx0ID0gYXBwbHlCdWNrZXRQb2xpY2llcyhidWNrZXRUeXBlLCB7XG4gICAgICBidWNrZXQ6IHRoaXMsXG4gICAgICBzdGFjayxcbiAgICB9KTtcbiAgICB0aGlzLmFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGUgPSBwb2xpY3lSZXN1bHQuYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZTtcbiAgfVxufVxuIl19

package/package.json

@@ -48,15 +48,15 @@
     "eslint-plugin-import": "^2.32.0",
     "jest": "^30.4.2",
     "jest-junit": "^17",
-    "jsii": "5.9.x",
+    "jsii": "6.0.x",
     "jsii-diff": "^1.138.0",
     "jsii-docgen": "^10.5.0",
     "jsii-pacmak": "^1.138.0",
-    "jsii-rosetta": "5.9.x",
+    "jsii-rosetta": "6.0.x",
     "projen": "^0.101.11",
     "ts-jest": "^29.4.11",
     "ts-node": "^10.9.2",
-    "typescript": "5.9.x"
+    "typescript": "6.0.x"
   },
   "peerDependencies": {
     "aws-cdk-lib": "^2.232.0",
@@ -70,8 +70,7 @@
   },
   "devEngines": {
     "packageManager": {
-      "name": "yarn",
-      "version": "1.22.22",
+      "name": "npm",
       "onFail": "ignore"
     }
   },
@@ -81,7 +80,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.7",
+  "version": "0.4.0",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [