sst 2.0.0-rc.29 → 2.0.0-rc.30

package/constructs/Auth.js

@@ -67,7 +67,7 @@ export class Auth extends Construct {
             },
             permissions: {
                 "ssm:GetParameters": [
-                    `arn:aws:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, PUBLIC_KEY_PROP)}`
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, PUBLIC_KEY_PROP)}`
                 ]
             }
         };
@@ -117,7 +117,7 @@ export class Auth extends Construct {
                     actions: ["ssm:GetParameters"],
                     effect: Effect.ALLOW,
                     resources: [
-                        `arn:aws:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "*")}`
+                        `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "*")}`
                     ]
                 })
             ]);

package/constructs/EdgeFunction.js

@@ -97,7 +97,7 @@ ${exports}
         const role = new iam.Role(this.scope, `ServerLambdaRole`, {
             assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal("lambda.amazonaws.com"), new iam.ServicePrincipal("edgelambda.amazonaws.com")),
             managedPolicies: [
-                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"),
+                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
             ],
         });
         // Attach permission
@@ -171,7 +171,7 @@ ${exports}
         provider.role?.addToPrincipalPolicy(new iam.PolicyStatement({
             effect: iam.Effect.ALLOW,
             actions: ["s3:*"],
-            resources: [`arn:aws:s3:::${asset.s3BucketName}/${asset.s3ObjectKey}`],
+            resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/${asset.s3ObjectKey}`],
         }));
         // Create custom resource to replace the code
         const resource = new CustomResource(this.scope, resId, {

package/constructs/Job.d.ts

@@ -135,7 +135,7 @@ export interface JobCDKProps {
      * new Job(stack, "MyJob", {
      *   handler: "src/job.handler",
      *   cdk: {
-     *     vpc: Vpc.fromLookup(this, "VPC", {
+     *     vpc: Vpc.fromLookup(stack, "VPC", {
      *       vpcId: "vpc-xxxxxxxxxx",
      *     }),
      *   }

package/constructs/Job.js

@@ -6,6 +6,7 @@ import { Construct } from "constructs";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as codebuild from "aws-cdk-lib/aws-codebuild";
+import { Stack } from "./Stack.js";
 import { Function } from "./Function.js";
 import { toCdkDuration } from "./util/duration.js";
 import { attachPermissionsToRole } from "./util/permission.js";
@@ -252,7 +253,7 @@ export class Job extends Construct {
                 actions: ["s3:*"],
                 effect: iam.Effect.ALLOW,
                 resources: [
-                    `arn:aws:s3:::${codeConfig.s3Location?.bucketName}/${codeConfig.s3Location?.objectKey}`,
+                    `arn:${Stack.of(this).partition}:s3:::${codeConfig.s3Location?.bucketName}/${codeConfig.s3Location?.objectKey}`,
                 ],
             }),
         ]);

package/constructs/Secret.js

@@ -1,4 +1,5 @@
 import { Construct } from "constructs";
+import { Stack } from "./Stack.js";
 import { ENVIRONMENT_PLACEHOLDER, getParameterPath, getParameterFallbackPath } from "./util/functionBinding.js";
 /**
  * The `Secret` construct is a higher level CDK construct that makes it easy to manage app secrets.
@@ -32,6 +33,7 @@ export class Secret extends Construct {
     /** @internal */
     getFunctionBinding() {
         const app = this.node.root;
+        const partition = Stack.of(this).partition;
         return {
             clientPackage: "config",
             variables: {
@@ -43,8 +45,8 @@ export class Secret extends Construct {
             },
             permissions: {
                 "ssm:GetParameters": [
-                    `arn:aws:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "value")}`,
-                    `arn:aws:ssm:${app.region}:${app.account}:parameter${getParameterFallbackPath(this, "value")}`
+                    `arn:${partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "value")}`,
+                    `arn:${partition}:ssm:${app.region}:${app.account}:parameter${getParameterFallbackPath(this, "value")}`
                 ],
             },
         };

package/constructs/SsrSite.js

@@ -213,7 +213,7 @@ export class SsrSite extends Construct {
             },
             permissions: {
                 "ssm:GetParameters": [
-                    `arn:aws:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
                 ],
             },
         };

package/constructs/Stack.js

@@ -207,10 +207,10 @@ export class Stack extends cdk.Stack {
         const app = useApp();
         // Add permissions to migrate SSM paths for secrets
         this.customResourceHandler.addToRolePolicy(new iam.PolicyStatement({
-            actions: ["ssm:GetParametersByPath", "ssm:PutParameter"],
+            actions: ["ssm:GetParametersByPath", "ssm:PutParameter", "sns:Publish"],
             resources: [
-                `arn:aws:ssm:${app.region}:${app.account}:parameter/sst/${app.name}/${app.stage}/*`,
-                `arn:aws:ssm:${app.region}:${app.account}:parameter/sst/${app.name}/.fallback/*`,
+                `arn:${this.partition}1:ssm:${app.region}:${app.account}:parameter/sst/${app.name}/${app.stage}/*`,
+                `arn:${this.partition}2:ssm:${app.region}:${app.account}:parameter/sst/${app.name}/.fallback/*`,
             ],
         }));
         new cdk.CustomResource(this, "SecretsMigration", {

package/constructs/StaticSite.js

@@ -161,7 +161,7 @@ export class StaticSite extends Construct {
             },
             permissions: {
                 "ssm:GetParameters": [
-                    `arn:aws:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
                 ],
             },
         };

package/constructs/deprecated/NextjsSite.js

@@ -253,7 +253,7 @@ export class NextjsSite extends Construct {
             },
             permissions: {
                 "ssm:GetParameters": [
-                    `arn:aws:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
                 ],
             },
         };
@@ -391,7 +391,7 @@ export class NextjsSite extends Construct {
         const role = new iam.Role(this, `EdgeLambdaRole`, {
             assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal("lambda.amazonaws.com"), new iam.ServicePrincipal("edgelambda.amazonaws.com")),
             managedPolicies: [
-                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"),
+                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
             ],
         });
         // Attach permission
@@ -473,7 +473,7 @@ export class NextjsSite extends Construct {
         provider.role?.addToPrincipalPolicy(new iam.PolicyStatement({
             effect: iam.Effect.ALLOW,
             actions: ["s3:*"],
-            resources: [`arn:aws:s3:::${asset.s3BucketName}/${asset.s3ObjectKey}`],
+            resources: [`arn:${Stack.of(this).partition}:s3:::${asset.s3BucketName}/${asset.s3ObjectKey}`],
         }));
         // Create custom resource
         const resource = new CustomResource(this, resId, {

package/constructs/util/apiGatewayV2Domain.js

@@ -32,7 +32,7 @@ function buildDataForStringInput(scope, customDomain) {
     }
     assertDomainNameIsLowerCase(customDomain);
     const domainName = customDomain;
-    const hostedZoneDomain = domainName.split(".").slice(1).join(".");
+    const hostedZoneDomain = parseRoute53Domain(domainName);
     const hostedZone = lookupHostedZone(scope, hostedZoneDomain);
     const certificate = createCertificate(scope, domainName, hostedZone);
     const apigDomain = createApigDomain(scope, domainName, certificate);
@@ -71,7 +71,7 @@ function buildDataForInternalDomainInput(scope, customDomain) {
         hostedZone = customDomain.cdk.hostedZone;
     }
     else {
-        const hostedZoneDomain = domainName.split(".").slice(1).join(".");
+        const hostedZoneDomain = parseRoute53Domain(domainName);
         hostedZone = lookupHostedZone(scope, hostedZoneDomain);
     }
     // Create certificate
@@ -199,3 +199,12 @@ function assertDomainNameIsLowerCase(domainName) {
         throw new Error(`The domain name needs to be in lowercase`);
     }
 }
+function parseRoute53Domain(domainName) {
+    const parts = domainName.split(".");
+    // If the domain contains subdomain, ie. api.example.com,
+    // strip the subdomain and use the root domain, ie. example.com.
+    // Otherwise, use the domain as is.
+    return parts.length <= 2
+        ? domainName
+        : parts.slice(1).join(".");
+}

package/constructs/util/permission.js

@@ -85,23 +85,23 @@ function permissionsToStatementsAndGrants(permissions) {
         ////////////////////////////////////
         else if (permission instanceof Api) {
             const httpApi = permission.cdk.httpApi;
-            const { account, region } = Stack.of(httpApi);
+            const { account, region, partition } = Stack.of(httpApi);
             statements.push(buildPolicyStatement("execute-api:Invoke", [
-                `arn:aws:execute-api:${region}:${account}:${httpApi.httpApiId}/*`
+                `arn:${partition}:execute-api:${region}:${account}:${httpApi.httpApiId}/*`
             ]));
         }
         else if (permission instanceof ApiGatewayV1Api) {
             const restApi = permission.cdk.restApi;
-            const { account, region } = Stack.of(restApi);
+            const { account, region, partition } = Stack.of(restApi);
             statements.push(buildPolicyStatement("execute-api:Invoke", [
-                `arn:aws:execute-api:${region}:${account}:${restApi.restApiId}/*`
+                `arn:${partition}:execute-api:${region}:${account}:${restApi.restApiId}/*`
             ]));
         }
         else if (permission instanceof WebSocketApi) {
             const webSocketApi = permission.cdk.webSocketApi;
-            const { account, region } = Stack.of(webSocketApi);
+            const { account, region, partition } = Stack.of(webSocketApi);
             statements.push(buildPolicyStatement("execute-api:Invoke", [
-                `arn:aws:execute-api:${region}:${account}:${webSocketApi.apiId}/*`
+                `arn:${partition}:execute-api:${region}:${account}:${webSocketApi.apiId}/*`
             ]));
             statements.push(buildPolicyStatement("execute-api:ManageConnections", [
                 permission._connectionsArn
@@ -109,9 +109,9 @@ function permissionsToStatementsAndGrants(permissions) {
         }
         else if (permission instanceof AppSyncApi) {
             const graphqlApi = permission.cdk.graphqlApi;
-            const { account, region } = Stack.of(graphqlApi);
+            const { account, region, partition } = Stack.of(graphqlApi);
             statements.push(buildPolicyStatement("appsync:GraphQL", [
-                `arn:aws:appsync:${region}:${account}:apis/${graphqlApi.apiId}/*`
+                `arn:${partition}:appsync:${region}:${account}:apis/${graphqlApi.apiId}/*`
             ]));
         }
         else if (permission instanceof Table) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.0.0-rc.29",
+  "version": "2.0.0-rc.30",
   "bin": {
     "sst": "cli/sst.js"
   },