sst 2.0.0-rc.64 → 2.0.0-rc.66

package/cli/commands/deploy.js

@@ -63,7 +63,7 @@ export const deploy = (program) => program.command("deploy [filter]", "Deploy yo
         process.exit(1);
     }
     const component = render(React.createElement(DeploymentUI, { assembly: assembly }));
-    const results = await Stacks.deployMany(assembly.stacks);
+    const results = await Stacks.deployMany(target);
     component.clear();
     component.unmount();
     printDeploymentResults(assembly, results);

package/cli/commands/dev.js

@@ -74,7 +74,7 @@ export const dev = (program) => program.command(["dev", "start"], "Work on your
         });
         bus.subscribe("function.build.failed", async (evt) => {
             const info = useFunctions().fromID(evt.properties.functionID);
-            if (!info.enableLiveDev)
+            if (info.enableLiveDev === false)
                 return;
             Colors.gap();
             Colors.line(Colors.danger("✖ "), "Build failed", info.handler);
@@ -153,6 +153,7 @@ export const dev = (program) => program.command(["dev", "start"], "Work on your
                 deploy(assembly);
             }
             catch (ex) {
+                isWorking = false;
                 spinner.fail();
                 Colors.line(ex.stack
                     .split("\n")

package/cli/sst.js

@@ -38,8 +38,10 @@ consoleCommand(program);
 diff(program);
 version(program);
 telemetry(program);
-// @ts-expect-error
-process.setSourceMapsEnabled(true);
+if ("setSourceMapsEnabled" in process) {
+    // @ts-expect-error
+    process.setSourceMapsEnabled(true);
+}
 process.removeAllListeners("uncaughtException");
 process.on("uncaughtException", (err) => {
     Logger.debug(err);

package/cli/ui/deploy.js

@@ -23,7 +23,7 @@ export const DeploymentUI = (props) => {
                         ? Colors.dim(`${stackNameToId(event.StackName)} ${readable} ${event.ResourceType}`)
                         : Colors.dim(`${stackNameToId(event.StackName)} ${event.ResourceType}`), Stacks.isFailed(event.ResourceStatus)
                         ? Colors.danger(event.ResourceStatus)
-                        : Colors.dim(event.ResourceStatus));
+                        : Colors.dim(event.ResourceStatus), Stacks.isFailed(event.ResourceStatus) && event.ResourceStatusReason);
                     const { [event.LogicalResourceId]: _, ...next } = previous;
                     return next;
                 }

package/constructs/ApiGatewayV1Api.d.ts

@@ -491,7 +491,7 @@ export declare class ApiGatewayV1Api<Authorizers extends Record<string, ApiGatew
         /**
          * The internally created certificate
          */
-        certificate?: acm.Certificate | acm.DnsValidatedCertificate;
+        certificate?: acm.ICertificate;
     };
     private _deployment?;
     private _customDomainUrl?;

package/constructs/ApiGatewayV1Api.js

@@ -9,6 +9,7 @@ import * as apigV1AccessLog from "./util/apiGatewayV1AccessLog.js";
 import { Stack } from "./Stack.js";
 import { toCdkDuration } from "./util/duration.js";
 import { getFunctionRef, isCDKConstruct } from "./Construct.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { Function as Fn, } from "./Function.js";
 const allowedMethods = [
     "ANY",
@@ -447,7 +448,7 @@ export class ApiGatewayV1Api extends Construct {
         /////////////////////
         if (!apigDomainName && !certificate) {
             if (endpointType === "edge") {
-                certificate = new acm.DnsValidatedCertificate(this, "CrossRegionCertificate", {
+                certificate = new DnsValidatedCertificate(this, "CrossRegionCertificate", {
                     domainName: domainName,
                     hostedZone: hostedZone,
                     region: "us-east-1",

package/constructs/Auth.js

@@ -112,6 +112,7 @@ export class Auth extends Construct {
                 [path]: {
                     type: "function",
                     function: this.authenticator,
+                    authorizer: "none",
                 },
             });
             // Auth construct has two types of Function bindinds:

package/constructs/BaseSite.d.ts

@@ -1,6 +1,6 @@
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
-import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import { IHostedZone } from "aws-cdk-lib/aws-route53";
+import { ErrorResponse, DistributionProps, BehaviorOptions, IOrigin } from "aws-cdk-lib/aws-cloudfront";
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 /**
  * The customDomain for this website. SST supports domains that are hosted either on [Route 53](https://aws.amazon.com/route53/) or externally.
  *
@@ -61,13 +61,13 @@ export interface BaseSiteDomainProps {
         /**
          * Import the underlying Route 53 hosted zone.
          */
-        hostedZone?: route53.IHostedZone;
+        hostedZone?: IHostedZone;
         /**
          * Import the certificate for the domain. By default, SST will create a certificate with the domain name. The certificate will be created in the `us-east-1`(N. Virginia) region as required by AWS CloudFront.
          *
          * Set this option if you have an existing certificate in the `us-east-1` region in AWS Certificate Manager you want to use.
          */
-        certificate?: acm.ICertificate;
+        certificate?: ICertificate;
     };
 }
 export interface BaseSiteEnvironmentOutputsInfo {
@@ -82,11 +82,11 @@ export interface BaseSiteReplaceProps {
     search: string;
     replace: string;
 }
-export declare function buildErrorResponsesForRedirectToIndex(indexPage: string): cloudfront.ErrorResponse[];
-export declare function buildErrorResponsesFor404ErrorPage(errorPage: string): cloudfront.ErrorResponse[];
-export interface BaseSiteCdkDistributionProps extends Omit<cloudfront.DistributionProps, "defaultBehavior"> {
-    defaultBehavior?: Omit<cloudfront.BehaviorOptions, "origin"> & {
-        origin?: cloudfront.IOrigin;
+export declare function buildErrorResponsesForRedirectToIndex(indexPage: string): ErrorResponse[];
+export declare function buildErrorResponsesFor404ErrorPage(errorPage: string): ErrorResponse[];
+export interface BaseSiteCdkDistributionProps extends Omit<DistributionProps, "defaultBehavior"> {
+    defaultBehavior?: Omit<BehaviorOptions, "origin"> & {
+        origin?: IOrigin;
     };
 }
 export declare function getBuildCmdEnvironment(siteEnvironment?: {

package/constructs/BaseSite.js

@@ -1,4 +1,4 @@
-import * as cdk from "aws-cdk-lib";
+import { Token } from "aws-cdk-lib";
 export function buildErrorResponsesForRedirectToIndex(indexPage) {
     return [
         {
@@ -35,7 +35,7 @@ export function getBuildCmdEnvironment(siteEnvironment) {
     //
     const buildCmdEnvironment = {};
     Object.entries(siteEnvironment || {}).forEach(([key, value]) => {
-        buildCmdEnvironment[key] = cdk.Token.isUnresolved(value)
+        buildCmdEnvironment[key] = Token.isUnresolved(value)
             ? `{{ ${key} }}`
             : value;
     });

package/constructs/EventBus.js

@@ -183,7 +183,7 @@ export class EventBus extends Construct {
                 eventBusName: this.cdk.eventBus.eventBusName,
                 rules: Object.entries(this.targetsData).map(([ruleName, rule]) => ({
                     key: ruleName,
-                    targets: Object.values(rule).map(getFunctionRef),
+                    targets: Object.values(rule).map(getFunctionRef).filter(Boolean),
                     targetNames: Object.keys(rule),
                 })),
             },

package/constructs/NextjsSite.js

@@ -112,8 +112,7 @@ export class NextjsSite extends SsrSite {
             allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
             cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
             compress: true,
-            cachePolicy: cdk?.cachePolicies?.serverRequests ??
-                this.createCloudFrontServerCachePolicy(),
+            cachePolicy: cdk?.serverCachePolicy ?? this.createCloudFrontServerCachePolicy(),
             edgeLambdas: isMiddlewareEnabled
                 ? [
                     {

package/constructs/SsrSite.d.ts

@@ -147,18 +147,13 @@ export interface SsrSiteProps {
          */
         distribution?: SsrCdkDistributionProps;
         /**
-         * Override the default CloudFront cache policies created internally.
+         * Override the CloudFront cache policy properties for responses from the
+         * server rendering Lambda.
+         *
+         * @note The default cache policy that is used in the abscene of this property
+         * is one that performs no caching of the server response.
          */
-        cachePolicies?: {
-            /**
-             * Override the CloudFront cache policy properties for responses from the
-             * server rendering Lambda.
-             *
-             * @note The default cache policy that is used in the abscene of this property
-             * is one that performs no caching of the server response.
-             */
-            serverRequests?: ICachePolicy;
-        };
+        serverCachePolicy?: ICachePolicy;
         server?: Pick<FunctionProps, "vpc" | "vpcSubnets" | "securityGroups" | "allowAllOutbound" | "allowPublicSubnet" | "architecture">;
     };
 }

package/constructs/SsrSite.js

@@ -13,15 +13,15 @@ import { Function, Code, Runtime, FunctionUrlAuthType, } from "aws-cdk-lib/aws-l
 import { HostedZone, ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
 import { Asset } from "aws-cdk-lib/aws-s3-assets";
 import { Distribution, ViewerProtocolPolicy, AllowedMethods, CachedMethods, LambdaEdgeEventType, CachePolicy, CacheQueryStringBehavior, CacheHeaderBehavior, CacheCookieBehavior, } from "aws-cdk-lib/aws-cloudfront";
-import { DnsValidatedCertificate, } from "aws-cdk-lib/aws-certificatemanager";
 import { AwsCliLayer } from "aws-cdk-lib/lambda-layer-awscli";
 import { S3Origin, HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
-import { HttpsRedirect } from "aws-cdk-lib/aws-route53-patterns";
 import { Stack } from "./Stack.js";
 import { Logger } from "../logger.js";
 import { isCDKConstruct } from "./Construct.js";
 import { getBuildCmdEnvironment, } from "./BaseSite.js";
+import { HttpsRedirect } from "./cdk/website-redirect.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { attachPermissionsToRole } from "./util/permission.js";
 import { ENVIRONMENT_PLACEHOLDER, getParameterPath, } from "./util/functionBinding.js";
 import { SiteEnv } from "../site-env.js";
@@ -483,8 +483,7 @@ export class SsrSite extends Construct {
             allowedMethods: AllowedMethods.ALLOW_ALL,
             cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
             compress: true,
-            cachePolicy: cdk?.cachePolicies?.serverRequests ??
-                this.createCloudFrontServerCachePolicy(),
+            cachePolicy: cdk?.serverCachePolicy ?? this.createCloudFrontServerCachePolicy(),
             ...(cfDistributionProps.defaultBehavior || {}),
         };
     }
@@ -497,8 +496,7 @@ export class SsrSite extends Construct {
             allowedMethods: AllowedMethods.ALLOW_ALL,
             cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
             compress: true,
-            cachePolicy: cdk?.cachePolicies?.serverRequests ??
-                this.createCloudFrontServerCachePolicy(),
+            cachePolicy: cdk?.serverCachePolicy ?? this.createCloudFrontServerCachePolicy(),
             ...(cfDistributionProps.defaultBehavior || {}),
             // concatenate edgeLambdas
             edgeLambdas: [

package/constructs/StaticSite.js

@@ -7,17 +7,17 @@ import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
-import * as acm from "aws-cdk-lib/aws-certificatemanager";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
-import * as route53Patterns from "aws-cdk-lib/aws-route53-patterns";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
 import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
 import * as cfOrigins from "aws-cdk-lib/aws-cloudfront-origins";
 import { AwsCliLayer } from "aws-cdk-lib/lambda-layer-awscli";
 import { Stack } from "./Stack.js";
 import { getBuildCmdEnvironment, buildErrorResponsesFor404ErrorPage, buildErrorResponsesForRedirectToIndex, } from "./BaseSite.js";
+import { HttpsRedirect } from "./cdk/website-redirect.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { isCDKConstruct } from "./Construct.js";
 import { ENVIRONMENT_PLACEHOLDER, getParameterPath, } from "./util/functionBinding.js";
 import { gray } from "colorette";
@@ -519,7 +519,7 @@ interface ImportMeta {
         // HostedZone is set for Route 53 domains
         if (this.hostedZone) {
             if (typeof customDomain === "string") {
-                acmCertificate = new acm.DnsValidatedCertificate(this, "Certificate", {
+                acmCertificate = new DnsValidatedCertificate(this, "Certificate", {
                     domainName: customDomain,
                     hostedZone: this.hostedZone,
                     region: "us-east-1",
@@ -529,7 +529,7 @@ interface ImportMeta {
                 acmCertificate = customDomain.cdk.certificate;
             }
             else {
-                acmCertificate = new acm.DnsValidatedCertificate(this, "Certificate", {
+                acmCertificate = new DnsValidatedCertificate(this, "Certificate", {
                     domainName: customDomain.domainName,
                     hostedZone: this.hostedZone,
                     region: "us-east-1",
@@ -568,7 +568,7 @@ interface ImportMeta {
         new route53.AaaaRecord(this, "AliasRecordAAAA", recordProps);
         // Create Alias redirect record
         if (domainAlias) {
-            new route53Patterns.HttpsRedirect(this, "Redirect", {
+            new HttpsRedirect(this, "Redirect", {
                 zone: this.hostedZone,
                 recordNames: [domainAlias],
                 targetDomain: recordName,

package/constructs/cdk/certificate-base.d.ts

@@ -0,0 +1,18 @@
+import { Metric, MetricOptions } from "aws-cdk-lib/aws-cloudwatch";
+import { Resource } from "aws-cdk-lib";
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+/**
+ * Shared implementation details of ICertificate implementations.
+ *
+ * @internal
+ */
+export declare abstract class CertificateBase extends Resource implements ICertificate {
+    abstract readonly certificateArn: string;
+    /**
+     * If the certificate is provisionned in a different region than the
+     * containing stack, this should be the region in which the certificate lives
+     * so we can correctly create `Metric` instances.
+     */
+    protected readonly region?: string;
+    metricDaysToExpiry(props?: MetricOptions): Metric;
+}

package/constructs/cdk/certificate-base.js

@@ -0,0 +1,26 @@
+import { Metric, Stats } from "aws-cdk-lib/aws-cloudwatch";
+import { Duration, Resource } from "aws-cdk-lib";
+/**
+ * Shared implementation details of ICertificate implementations.
+ *
+ * @internal
+ */
+export class CertificateBase extends Resource {
+    /**
+     * If the certificate is provisionned in a different region than the
+     * containing stack, this should be the region in which the certificate lives
+     * so we can correctly create `Metric` instances.
+     */
+    region;
+    metricDaysToExpiry(props) {
+        return new Metric({
+            period: Duration.days(1),
+            ...props,
+            dimensionsMap: { CertificateArn: this.certificateArn },
+            metricName: "DaysToExpiry",
+            namespace: "AWS/CertificateManager",
+            region: this.region,
+            statistic: Stats.MINIMUM,
+        });
+    }
+}

package/constructs/cdk/dns-validated-certificate.d.ts

@@ -0,0 +1,77 @@
+import { Construct } from "constructs";
+import { ITaggable, TagManager, RemovalPolicy } from "aws-cdk-lib";
+import { CertificateProps, ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import { CertificateBase } from "./certificate-base.js";
+/**
+ * Properties to create a DNS validated certificate managed by AWS Certificate Manager
+ *
+ */
+export interface DnsValidatedCertificateProps extends CertificateProps {
+    /**
+     * Route 53 Hosted Zone used to perform DNS validation of the request.  The zone
+     * must be authoritative for the domain name specified in the Certificate Request.
+     */
+    readonly hostedZone: route53.IHostedZone;
+    /**
+     * AWS region that will host the certificate. This is needed especially
+     * for certificates used for CloudFront distributions, which require the region
+     * to be us-east-1.
+     *
+     * @default the region the stack is deployed in.
+     */
+    readonly region?: string;
+    /**
+     * An endpoint of Route53 service, which is not necessary as AWS SDK could figure
+     * out the right endpoints for most regions, but for some regions such as those in
+     * aws-cn partition, the default endpoint is not working now, hence the right endpoint
+     * need to be specified through this prop.
+     *
+     * Route53 is not been officially launched in China, it is only available for AWS
+     * internal accounts now. To make DnsValidatedCertificate work for internal accounts
+     * now, a special endpoint needs to be provided.
+     *
+     * @default - The AWS SDK will determine the Route53 endpoint to use based on region
+     */
+    readonly route53Endpoint?: string;
+    /**
+     * Role to use for the custom resource that creates the validated certificate
+     *
+     * @default - A new role will be created
+     */
+    readonly customResourceRole?: iam.IRole;
+    /**
+     * When set to true, when the DnsValidatedCertificate is deleted,
+     * the associated Route53 validation records are removed.
+     *
+     * CAUTION: If multiple certificates share the same domains (and same validation records),
+     * this can cause the other certificates to fail renewal and/or not validate.
+     * Not recommended for production use.
+     *
+     * @default false
+     */
+    readonly cleanupRoute53Records?: boolean;
+}
+/**
+ * A certificate managed by AWS Certificate Manager.  Will be automatically
+ * validated using DNS validation against the specified Route 53 hosted zone.
+ *
+ * @resource AWS::CertificateManager::Certificate
+ */
+export declare class DnsValidatedCertificate extends CertificateBase implements ICertificate, ITaggable {
+    readonly certificateArn: string;
+    /**
+     * Resource Tags.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html#cfn-certificatemanager-certificate-tags
+     */
+    readonly tags: TagManager;
+    protected readonly region?: string;
+    private normalizedZoneName;
+    private hostedZoneId;
+    private domainName;
+    private _removalPolicy?;
+    constructor(scope: Construct, id: string, props: DnsValidatedCertificateProps);
+    applyRemovalPolicy(policy: RemovalPolicy): void;
+    private validateDnsValidatedCertificate;
+}

package/constructs/cdk/dns-validated-certificate.js

@@ -0,0 +1,125 @@
+import url from "url";
+import * as path from "path";
+import { Token, TagManager, TagType, Duration, Stack, CustomResource, Lazy, } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import { CertificateBase } from "./certificate-base.js";
+const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
+/**
+ * A certificate managed by AWS Certificate Manager.  Will be automatically
+ * validated using DNS validation against the specified Route 53 hosted zone.
+ *
+ * @resource AWS::CertificateManager::Certificate
+ */
+export class DnsValidatedCertificate extends CertificateBase {
+    certificateArn;
+    /**
+     * Resource Tags.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html#cfn-certificatemanager-certificate-tags
+     */
+    tags;
+    region;
+    normalizedZoneName;
+    hostedZoneId;
+    domainName;
+    _removalPolicy;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.region = props.region;
+        this.domainName = props.domainName;
+        // check if domain name is 64 characters or less
+        if (!Token.isUnresolved(props.domainName) && props.domainName.length > 64) {
+            throw new Error("Domain name must be 64 characters or less");
+        }
+        this.normalizedZoneName = props.hostedZone.zoneName;
+        // Remove trailing `.` from zone name
+        if (this.normalizedZoneName.endsWith(".")) {
+            this.normalizedZoneName = this.normalizedZoneName.substring(0, this.normalizedZoneName.length - 1);
+        }
+        // Remove any `/hostedzone/` prefix from the Hosted Zone ID
+        this.hostedZoneId = props.hostedZone.hostedZoneId.replace(/^\/hostedzone\//, "");
+        this.tags = new TagManager(TagType.MAP, "AWS::CertificateManager::Certificate");
+        let certificateTransparencyLoggingPreference;
+        if (props.transparencyLoggingEnabled !== undefined) {
+            certificateTransparencyLoggingPreference =
+                props.transparencyLoggingEnabled ? "ENABLED" : "DISABLED";
+        }
+        const requestorFunction = new lambda.Function(this, "CertificateRequestorFunction", {
+            code: lambda.Code.fromAsset(path.join(__dirname, "../../support/certificate-requestor")),
+            handler: "index.certificateRequestHandler",
+            runtime: lambda.Runtime.NODEJS_14_X,
+            timeout: Duration.minutes(15),
+            role: props.customResourceRole,
+        });
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: [
+                "acm:RequestCertificate",
+                "acm:DescribeCertificate",
+                "acm:DeleteCertificate",
+                "acm:AddTagsToCertificate",
+            ],
+            resources: ["*"],
+        }));
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: ["route53:GetChange"],
+            resources: ["*"],
+        }));
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: ["route53:changeResourceRecordSets"],
+            resources: [
+                `arn:${Stack.of(requestorFunction).partition}:route53:::hostedzone/${this.hostedZoneId}`,
+            ],
+            conditions: {
+                "ForAllValues:StringEquals": {
+                    "route53:ChangeResourceRecordSetsRecordTypes": ["CNAME"],
+                    "route53:ChangeResourceRecordSetsActions": props.cleanupRoute53Records ? ["UPSERT", "DELETE"] : ["UPSERT"],
+                },
+                "ForAllValues:StringLike": {
+                    "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
+                        addWildcard(props.domainName),
+                        ...(props.subjectAlternativeNames ?? []).map((d) => addWildcard(d)),
+                    ],
+                },
+            },
+        }));
+        const certificate = new CustomResource(this, "CertificateRequestorResource", {
+            serviceToken: requestorFunction.functionArn,
+            properties: {
+                DomainName: props.domainName,
+                SubjectAlternativeNames: Lazy.list({ produce: () => props.subjectAlternativeNames }, { omitEmpty: true }),
+                CertificateTransparencyLoggingPreference: certificateTransparencyLoggingPreference,
+                HostedZoneId: this.hostedZoneId,
+                Region: props.region,
+                Route53Endpoint: props.route53Endpoint,
+                RemovalPolicy: Lazy.any({ produce: () => this._removalPolicy }),
+                // Custom resources properties are always converted to strings; might as well be explict here.
+                CleanupRecords: props.cleanupRoute53Records ? "true" : undefined,
+                Tags: Lazy.list({ produce: () => this.tags.renderTags() }),
+            },
+        });
+        this.certificateArn = certificate.getAtt("Arn").toString();
+        this.node.addValidation({
+            validate: () => this.validateDnsValidatedCertificate(),
+        });
+    }
+    applyRemovalPolicy(policy) {
+        this._removalPolicy = policy;
+    }
+    validateDnsValidatedCertificate() {
+        const errors = [];
+        // Ensure the zone name is a parent zone of the certificate domain name
+        if (!Token.isUnresolved(this.normalizedZoneName) &&
+            this.domainName !== this.normalizedZoneName &&
+            !this.domainName.endsWith("." + this.normalizedZoneName)) {
+            errors.push(`DNS zone ${this.normalizedZoneName} is not authoritative for certificate domain name ${this.domainName}`);
+        }
+        return errors;
+    }
+}
+// https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/specifying-rrset-conditions.html
+function addWildcard(domainName) {
+    if (domainName.startsWith("*.")) {
+        return domainName;
+    }
+    return `*.${domainName}`;
+}

package/constructs/cdk/website-redirect.d.ts

@@ -0,0 +1,53 @@
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import { IHostedZone } from "aws-cdk-lib/aws-route53";
+import { Construct } from "constructs";
+/**
+ * Properties to configure an HTTPS Redirect
+ */
+export interface HttpsRedirectProps {
+    /**
+     * Hosted zone of the domain which will be used to create alias record(s) from
+     * domain names in the hosted zone to the target domain. The hosted zone must
+     * contain entries for the domain name(s) supplied through `recordNames` that
+     * will redirect to the target domain.
+     *
+     * Domain names in the hosted zone can include a specific domain (example.com)
+     * and its subdomains (acme.example.com, zenith.example.com).
+     *
+     */
+    readonly zone: IHostedZone;
+    /**
+     * The redirect target fully qualified domain name (FQDN). An alias record
+     * will be created that points to your CloudFront distribution. Root domain
+     * or sub-domain can be supplied.
+     */
+    readonly targetDomain: string;
+    /**
+     * The domain names that will redirect to `targetDomain`
+     *
+     * @default - the domain name of the hosted zone
+     */
+    readonly recordNames?: string[];
+    /**
+     * The AWS Certificate Manager (ACM) certificate that will be associated with
+     * the CloudFront distribution that will be created. If provided, the certificate must be
+     * stored in us-east-1 (N. Virginia)
+     *
+     * @default - A new certificate is created in us-east-1 (N. Virginia)
+     */
+    readonly certificate?: ICertificate;
+}
+/**
+ * Allows creating a domainA -> domainB redirect using CloudFront and S3.
+ * You can specify multiple domains to be redirected.
+ */
+export declare class HttpsRedirect extends Construct {
+    constructor(scope: Construct, id: string, props: HttpsRedirectProps);
+    /**
+     * Creates a certificate.
+     *
+     * This is also safe to upgrade since the new certificate will be created and updated
+     * on the CloudFront distribution before the old one is deleted.
+     */
+    private createCertificate;
+}