sst 2.0.0-rc.8 → 2.0.0

package/constructs/cdk/dns-validated-certificate.js

@@ -0,0 +1,125 @@
+import url from "url";
+import * as path from "path";
+import { Token, TagManager, TagType, Duration, Stack, CustomResource, Lazy, } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import { CertificateBase } from "./certificate-base.js";
+const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
+/**
+ * A certificate managed by AWS Certificate Manager.  Will be automatically
+ * validated using DNS validation against the specified Route 53 hosted zone.
+ *
+ * @resource AWS::CertificateManager::Certificate
+ */
+export class DnsValidatedCertificate extends CertificateBase {
+    certificateArn;
+    /**
+     * Resource Tags.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html#cfn-certificatemanager-certificate-tags
+     */
+    tags;
+    region;
+    normalizedZoneName;
+    hostedZoneId;
+    domainName;
+    _removalPolicy;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.region = props.region;
+        this.domainName = props.domainName;
+        // check if domain name is 64 characters or less
+        if (!Token.isUnresolved(props.domainName) && props.domainName.length > 64) {
+            throw new Error("Domain name must be 64 characters or less");
+        }
+        this.normalizedZoneName = props.hostedZone.zoneName;
+        // Remove trailing `.` from zone name
+        if (this.normalizedZoneName.endsWith(".")) {
+            this.normalizedZoneName = this.normalizedZoneName.substring(0, this.normalizedZoneName.length - 1);
+        }
+        // Remove any `/hostedzone/` prefix from the Hosted Zone ID
+        this.hostedZoneId = props.hostedZone.hostedZoneId.replace(/^\/hostedzone\//, "");
+        this.tags = new TagManager(TagType.MAP, "AWS::CertificateManager::Certificate");
+        let certificateTransparencyLoggingPreference;
+        if (props.transparencyLoggingEnabled !== undefined) {
+            certificateTransparencyLoggingPreference =
+                props.transparencyLoggingEnabled ? "ENABLED" : "DISABLED";
+        }
+        const requestorFunction = new lambda.Function(this, "CertificateRequestorFunction", {
+            code: lambda.Code.fromAsset(path.join(__dirname, "../../support/certificate-requestor")),
+            handler: "index.certificateRequestHandler",
+            runtime: lambda.Runtime.NODEJS_14_X,
+            timeout: Duration.minutes(15),
+            role: props.customResourceRole,
+        });
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: [
+                "acm:RequestCertificate",
+                "acm:DescribeCertificate",
+                "acm:DeleteCertificate",
+                "acm:AddTagsToCertificate",
+            ],
+            resources: ["*"],
+        }));
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: ["route53:GetChange"],
+            resources: ["*"],
+        }));
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: ["route53:changeResourceRecordSets"],
+            resources: [
+                `arn:${Stack.of(requestorFunction).partition}:route53:::hostedzone/${this.hostedZoneId}`,
+            ],
+            conditions: {
+                "ForAllValues:StringEquals": {
+                    "route53:ChangeResourceRecordSetsRecordTypes": ["CNAME"],
+                    "route53:ChangeResourceRecordSetsActions": props.cleanupRoute53Records ? ["UPSERT", "DELETE"] : ["UPSERT"],
+                },
+                "ForAllValues:StringLike": {
+                    "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
+                        addWildcard(props.domainName),
+                        ...(props.subjectAlternativeNames ?? []).map((d) => addWildcard(d)),
+                    ],
+                },
+            },
+        }));
+        const certificate = new CustomResource(this, "CertificateRequestorResource", {
+            serviceToken: requestorFunction.functionArn,
+            properties: {
+                DomainName: props.domainName,
+                SubjectAlternativeNames: Lazy.list({ produce: () => props.subjectAlternativeNames }, { omitEmpty: true }),
+                CertificateTransparencyLoggingPreference: certificateTransparencyLoggingPreference,
+                HostedZoneId: this.hostedZoneId,
+                Region: props.region,
+                Route53Endpoint: props.route53Endpoint,
+                RemovalPolicy: Lazy.any({ produce: () => this._removalPolicy }),
+                // Custom resources properties are always converted to strings; might as well be explict here.
+                CleanupRecords: props.cleanupRoute53Records ? "true" : undefined,
+                Tags: Lazy.list({ produce: () => this.tags.renderTags() }),
+            },
+        });
+        this.certificateArn = certificate.getAtt("Arn").toString();
+        this.node.addValidation({
+            validate: () => this.validateDnsValidatedCertificate(),
+        });
+    }
+    applyRemovalPolicy(policy) {
+        this._removalPolicy = policy;
+    }
+    validateDnsValidatedCertificate() {
+        const errors = [];
+        // Ensure the zone name is a parent zone of the certificate domain name
+        if (!Token.isUnresolved(this.normalizedZoneName) &&
+            this.domainName !== this.normalizedZoneName &&
+            !this.domainName.endsWith("." + this.normalizedZoneName)) {
+            errors.push(`DNS zone ${this.normalizedZoneName} is not authoritative for certificate domain name ${this.domainName}`);
+        }
+        return errors;
+    }
+}
+// https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/specifying-rrset-conditions.html
+function addWildcard(domainName) {
+    if (domainName.startsWith("*.")) {
+        return domainName;
+    }
+    return `*.${domainName}`;
+}

package/constructs/cdk/website-redirect.d.ts

@@ -0,0 +1,53 @@
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import { IHostedZone } from "aws-cdk-lib/aws-route53";
+import { Construct } from "constructs";
+/**
+ * Properties to configure an HTTPS Redirect
+ */
+export interface HttpsRedirectProps {
+    /**
+     * Hosted zone of the domain which will be used to create alias record(s) from
+     * domain names in the hosted zone to the target domain. The hosted zone must
+     * contain entries for the domain name(s) supplied through `recordNames` that
+     * will redirect to the target domain.
+     *
+     * Domain names in the hosted zone can include a specific domain (example.com)
+     * and its subdomains (acme.example.com, zenith.example.com).
+     *
+     */
+    readonly zone: IHostedZone;
+    /**
+     * The redirect target fully qualified domain name (FQDN). An alias record
+     * will be created that points to your CloudFront distribution. Root domain
+     * or sub-domain can be supplied.
+     */
+    readonly targetDomain: string;
+    /**
+     * The domain names that will redirect to `targetDomain`
+     *
+     * @default - the domain name of the hosted zone
+     */
+    readonly recordNames?: string[];
+    /**
+     * The AWS Certificate Manager (ACM) certificate that will be associated with
+     * the CloudFront distribution that will be created. If provided, the certificate must be
+     * stored in us-east-1 (N. Virginia)
+     *
+     * @default - A new certificate is created in us-east-1 (N. Virginia)
+     */
+    readonly certificate?: ICertificate;
+}
+/**
+ * Allows creating a domainA -> domainB redirect using CloudFront and S3.
+ * You can specify multiple domains to be redirected.
+ */
+export declare class HttpsRedirect extends Construct {
+    constructor(scope: Construct, id: string, props: HttpsRedirectProps);
+    /**
+     * Creates a certificate.
+     *
+     * This is also safe to upgrade since the new certificate will be created and updated
+     * on the CloudFront distribution before the old one is deleted.
+     */
+    private createCertificate;
+}

package/constructs/cdk/website-redirect.js

@@ -0,0 +1,77 @@
+import { CloudFrontWebDistribution, OriginProtocolPolicy, PriceClass, ViewerCertificate, ViewerProtocolPolicy, } from "aws-cdk-lib/aws-cloudfront";
+import { ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
+import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
+import { BlockPublicAccess, Bucket, RedirectProtocol, } from "aws-cdk-lib/aws-s3";
+import { ArnFormat, RemovalPolicy, Stack, Token } from "aws-cdk-lib";
+import cdkHelpers from "aws-cdk-lib/core/lib/helpers-internal";
+import { Construct } from "constructs";
+import { DnsValidatedCertificate } from "./dns-validated-certificate.js";
+const { md5hash } = cdkHelpers;
+/**
+ * Allows creating a domainA -> domainB redirect using CloudFront and S3.
+ * You can specify multiple domains to be redirected.
+ */
+export class HttpsRedirect extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const domainNames = props.recordNames ?? [props.zone.zoneName];
+        if (props.certificate) {
+            const certificateRegion = Stack.of(this).splitArn(props.certificate.certificateArn, ArnFormat.SLASH_RESOURCE_NAME).region;
+            if (!Token.isUnresolved(certificateRegion) &&
+                certificateRegion !== "us-east-1") {
+                throw new Error(`The certificate must be in the us-east-1 region and the certificate you provided is in ${certificateRegion}.`);
+            }
+        }
+        const redirectCert = props.certificate ?? this.createCertificate(domainNames, props.zone);
+        const redirectBucket = new Bucket(this, "RedirectBucket", {
+            websiteRedirect: {
+                hostName: props.targetDomain,
+                protocol: RedirectProtocol.HTTPS,
+            },
+            removalPolicy: RemovalPolicy.DESTROY,
+            blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+        });
+        const redirectDist = new CloudFrontWebDistribution(this, "RedirectDistribution", {
+            defaultRootObject: "",
+            originConfigs: [
+                {
+                    behaviors: [{ isDefaultBehavior: true }],
+                    customOriginSource: {
+                        domainName: redirectBucket.bucketWebsiteDomainName,
+                        originProtocolPolicy: OriginProtocolPolicy.HTTP_ONLY,
+                    },
+                },
+            ],
+            viewerCertificate: ViewerCertificate.fromAcmCertificate(redirectCert, {
+                aliases: domainNames,
+            }),
+            comment: `Redirect to ${props.targetDomain} from ${domainNames.join(", ")}`,
+            priceClass: PriceClass.PRICE_CLASS_ALL,
+            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        });
+        domainNames.forEach((domainName) => {
+            const hash = md5hash(domainName).slice(0, 6);
+            const aliasProps = {
+                recordName: domainName,
+                zone: props.zone,
+                target: RecordTarget.fromAlias(new CloudFrontTarget(redirectDist)),
+            };
+            new ARecord(this, `RedirectAliasRecord${hash}`, aliasProps);
+            new AaaaRecord(this, `RedirectAliasRecordSix${hash}`, aliasProps);
+        });
+    }
+    /**
+     * Creates a certificate.
+     *
+     * This is also safe to upgrade since the new certificate will be created and updated
+     * on the CloudFront distribution before the old one is deleted.
+     */
+    createCertificate(domainNames, zone) {
+        return new DnsValidatedCertificate(this, "RedirectCertificate", {
+            domainName: domainNames[0],
+            subjectAlternativeNames: domainNames,
+            hostedZone: zone,
+            region: "us-east-1",
+        });
+    }
+}

package/constructs/deferred_task.d.ts

@@ -1,4 +1,4 @@
-declare type Task = () => Promise<void>;
+type Task = () => Promise<void>;
 export declare const useDeferredTasks: () => {
     add(task: Task): void;
     run(): Promise<unknown>;

package/constructs/deprecated/NextjsSite.js

@@ -28,7 +28,7 @@ import { ENVIRONMENT_PLACEHOLDER, getParameterPath, } from "../util/functionBind
 import * as crossRegionHelper from "./cross-region-helper.js";
 import { gray, red } from "colorette";
 import { SiteEnv } from "../../site-env.js";
-import { useProject } from "../../app.js";
+import { useProject } from "../../project.js";
 const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
 /////////////////////
 // Construct
@@ -253,7 +253,7 @@ export class NextjsSite extends Construct {
             },
             permissions: {
                 "ssm:GetParameters": [
-                    `arn:aws:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
+                    `arn:${Stack.of(this).partition}:ssm:${app.region}:${app.account}:parameter${getParameterPath(this, "url")}`,
                 ],
             },
         };
@@ -265,7 +265,7 @@ export class NextjsSite extends Construct {
             throw new Error(`No build output found at "${siteOutputPath}" for the "${this.node.id}" NextjsSite.`);
         }
         // create zip files
-        const script = path.join(__dirname, "../../support/base-site-archiver.cjs");
+        const script = path.join(__dirname, "../../support/base-site-archiver.mjs");
         const zipPath = path.resolve(path.join(this.sstBuildDir, `NextjsSite-${this.node.id}-${this.node.addr}`));
         // clear zip path to ensure no partX.zip remain from previous build
         fs.rmSync(zipPath, {
@@ -391,7 +391,7 @@ export class NextjsSite extends Construct {
         const role = new iam.Role(this, `EdgeLambdaRole`, {
             assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal("lambda.amazonaws.com"), new iam.ServicePrincipal("edgelambda.amazonaws.com")),
             managedPolicies: [
-                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"),
+                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
             ],
         });
         // Attach permission
@@ -461,7 +461,7 @@ export class NextjsSite extends Construct {
         // Create provider if not already created
         if (!provider) {
             provider = new lambda.Function(stack, providerId, {
-                code: lambda.Code.fromAsset(path.join(__dirname, "../../support/edge-function-code-replacer")),
+                code: lambda.Code.fromAsset(path.join(__dirname, "../../support/sls-nextjs-site-function-code-replacer")),
                 layers: [this.awsCliLayer],
                 runtime: lambda.Runtime.PYTHON_3_7,
                 handler: "lambda-code-updater.handler",
@@ -473,7 +473,9 @@ export class NextjsSite extends Construct {
         provider.role?.addToPrincipalPolicy(new iam.PolicyStatement({
             effect: iam.Effect.ALLOW,
             actions: ["s3:*"],
-            resources: [`arn:aws:s3:::${asset.s3BucketName}/${asset.s3ObjectKey}`],
+            resources: [
+                `arn:${Stack.of(this).partition}:s3:::${asset.s3BucketName}/${asset.s3ObjectKey}`,
+            ],
         }));
         // Create custom resource
         const resource = new CustomResource(this, resId, {

package/constructs/index.d.ts

@@ -14,9 +14,7 @@ export * from "./Bucket.js";
 export * from "./Script.js";
 export * from "./EventBus.js";
 export * from "./Function.js";
-export * from "./GraphQLApi.js";
 export * from "./AppSyncApi.js";
-export * from "./DebugStack.js";
 export * from "./WebSocketApi.js";
 export * from "./KinesisStream.js";
 export * from "./ApiGatewayV1Api.js";
@@ -24,13 +22,9 @@ export * from "./NextjsSite.js";
 export * from "./RemixSite.js";
 export * from "./SolidStartSite.js";
 export * from "./StaticSite.js";
-export * from "./ViteStaticSite.js";
-export * from "./ReactStaticSite.js";
 export * from "./util/size.js";
 export * from "./util/duration.js";
 export * from "./util/permission.js";
 export * as Config from "./Config.js";
 export * as Metadata from "./Metadata.js";
-export * from "./DebugApp.js";
-export * from "./DebugStack.js";
 export { use, dependsOn, getStack, StackContext } from "./FunctionalStack.js";

package/constructs/index.js

@@ -14,9 +14,7 @@ export * from "./Bucket.js";
 export * from "./Script.js";
 export * from "./EventBus.js";
 export * from "./Function.js";
-export * from "./GraphQLApi.js";
 export * from "./AppSyncApi.js";
-export * from "./DebugStack.js";
 export * from "./WebSocketApi.js";
 export * from "./KinesisStream.js";
 export * from "./ApiGatewayV1Api.js";
@@ -24,13 +22,9 @@ export * from "./NextjsSite.js";
 export * from "./RemixSite.js";
 export * from "./SolidStartSite.js";
 export * from "./StaticSite.js";
-export * from "./ViteStaticSite.js";
-export * from "./ReactStaticSite.js";
 export * from "./util/size.js";
 export * from "./util/duration.js";
 export * from "./util/permission.js";
 export * as Config from "./Config.js";
 export * as Metadata from "./Metadata.js";
-export * from "./DebugApp.js";
-export * from "./DebugStack.js";
 export { use, dependsOn, getStack } from "./FunctionalStack.js";

package/constructs/util/apiGatewayV1AccessLog.d.ts

@@ -6,7 +6,7 @@ export interface AccessLogProps {
     destinationArn?: string;
     retention?: Lowercase<keyof typeof logs.RetentionDays>;
 }
-export declare type AccessLogData = {
+export type AccessLogData = {
     logGroup: logs.LogGroup | undefined;
     format: apig.AccessLogFormat;
     destination: apig.LogGroupLogDestination;

package/constructs/util/apiGatewayV2AccessLog.js

@@ -17,7 +17,7 @@ const defaultHttpFields = [
     // caller info
     `"ip":"$context.identity.sourceIp"`,
     `"userAgent":"$context.identity.userAgent"`,
-    `"cognitoIdentityId":"$context.identity.cognitoIdentityId"`
+    `"cognitoIdentityId":"$context.identity.cognitoIdentityId"`,
 ];
 const defaultWebSocketFields = [
     // request info
@@ -36,7 +36,7 @@ const defaultWebSocketFields = [
     `"userAgent":"$context.identity.userAgent"`,
     `"cognitoIdentityId":"$context.identity.cognitoIdentityId"`,
     `"connectedAt":"$context.connectedAt"`,
-    `"connectionId":"$context.connectionId"`
+    `"connectionId":"$context.connectionId"`,
 ];
 export function buildAccessLogData(scope, accessLog, apiStage, isDefaultStage) {
     if (accessLog === false) {
@@ -60,9 +60,9 @@ export function buildAccessLogData(scope, accessLog, apiStage, isDefaultStage) {
             logGroupName: [
                 `/aws/vendedlogs/apis`,
                 `/${cleanupLogGroupName(apiName)}-${apiStage.api.apiId}`,
-                `/${cleanupLogGroupName(apiStage.stageName)}`
+                `/${cleanupLogGroupName(apiStage.stageName)}`,
             ].join(""),
-            retention: buildLogGroupRetention(accessLog)
+            retention: buildLogGroupRetention(accessLog),
         });
         destinationArn = logGroup.logGroupArn;
     }

package/constructs/util/apiGatewayV2Domain.js

@@ -32,7 +32,7 @@ function buildDataForStringInput(scope, customDomain) {
     }
     assertDomainNameIsLowerCase(customDomain);
     const domainName = customDomain;
-    const hostedZoneDomain = domainName.split(".").slice(1).join(".");
+    const hostedZoneDomain = parseRoute53Domain(domainName);
     const hostedZone = lookupHostedZone(scope, hostedZoneDomain);
     const certificate = createCertificate(scope, domainName, hostedZone);
     const apigDomain = createApigDomain(scope, domainName, certificate);
@@ -71,7 +71,7 @@ function buildDataForInternalDomainInput(scope, customDomain) {
         hostedZone = customDomain.cdk.hostedZone;
     }
     else {
-        const hostedZoneDomain = domainName.split(".").slice(1).join(".");
+        const hostedZoneDomain = parseRoute53Domain(domainName);
         hostedZone = lookupHostedZone(scope, hostedZoneDomain);
     }
     // Create certificate
@@ -199,3 +199,10 @@ function assertDomainNameIsLowerCase(domainName) {
         throw new Error(`The domain name needs to be in lowercase`);
     }
 }
+function parseRoute53Domain(domainName) {
+    const parts = domainName.split(".");
+    // If the domain contains subdomain, ie. api.example.com,
+    // strip the subdomain and use the root domain, ie. example.com.
+    // Otherwise, use the domain as is.
+    return parts.length <= 2 ? domainName : parts.slice(1).join(".");
+}

package/constructs/util/appSyncApiDomain.d.ts

@@ -1,5 +1,5 @@
 import * as route53 from "aws-cdk-lib/aws-route53";
-import * as appsync from "@aws-cdk/aws-appsync-alpha";
+import * as appsync from "aws-cdk-lib/aws-appsync";
 import * as acm from "aws-cdk-lib/aws-certificatemanager";
 import { AppSyncApi } from "../AppSyncApi.js";
 export interface CustomDomainProps {

package/constructs/util/appSyncApiDomain.js

@@ -26,16 +26,13 @@ function buildDataForStringInput(scope, customDomain) {
     }
     assertDomainNameIsLowerCase(customDomain);
     const domainName = customDomain;
-    const hostedZoneDomain = domainName
-        .split(".")
-        .slice(1)
-        .join(".");
+    const hostedZoneDomain = domainName.split(".").slice(1).join(".");
     const hostedZone = lookupHostedZone(scope, hostedZoneDomain);
     const certificate = createCertificate(scope, domainName, hostedZone);
     createRecord(scope, hostedZone, domainName);
     return {
         certificate,
-        domainName
+        domainName,
     };
 }
 function buildDataForInternalDomainInput(scope, customDomain) {
@@ -63,10 +60,7 @@ function buildDataForInternalDomainInput(scope, customDomain) {
         hostedZone = customDomain.cdk.hostedZone;
     }
     else {
-        const hostedZoneDomain = domainName
-            .split(".")
-            .slice(1)
-            .join(".");
+        const hostedZoneDomain = domainName.split(".").slice(1).join(".");
         hostedZone = lookupHostedZone(scope, hostedZoneDomain);
     }
     // Create certificate
@@ -78,7 +72,7 @@ function buildDataForInternalDomainInput(scope, customDomain) {
     createRecord(scope, hostedZone, domainName);
     return {
         certificate,
-        domainName
+        domainName,
     };
 }
 function buildDataForExternalDomainInput(scope, customDomain) {
@@ -95,18 +89,18 @@ function buildDataForExternalDomainInput(scope, customDomain) {
     const certificate = customDomain.cdk.certificate;
     return {
         certificate,
-        domainName
+        domainName,
     };
 }
 function lookupHostedZone(scope, hostedZoneDomain) {
     return route53.HostedZone.fromLookup(scope, "HostedZone", {
-        domainName: hostedZoneDomain
+        domainName: hostedZoneDomain,
     });
 }
 function createCertificate(scope, domainName, hostedZone) {
     return new acm.Certificate(scope, "Certificate", {
         domainName,
-        validation: acm.CertificateValidation.fromDns(hostedZone)
+        validation: acm.CertificateValidation.fromDns(hostedZone),
     });
 }
 function createRecord(scope, hostedZone, domainName) {
@@ -117,8 +111,8 @@ function createRecord(scope, hostedZone, domainName) {
         domainName: Lazy.string({
             produce() {
                 return scope._cfnDomainName.attrAppSyncDomainName;
-            }
-        })
+            },
+        }),
     });
     // note: If domainName is a TOKEN string ie. ${TOKEN..}, the route53.ARecord
     //       construct will append ".${hostedZoneName}" to the end of the domain.

package/constructs/util/duration.d.ts

@@ -1,3 +1,3 @@
 import { Duration as CDKDuration } from "aws-cdk-lib";
-export declare type Duration = `${number} ${"second" | "seconds" | "minute" | "minutes" | "hour" | "hours" | "day" | "days"}`;
+export type Duration = `${number} ${"second" | "seconds" | "minute" | "minutes" | "hour" | "hours" | "day" | "days"}`;
 export declare function toCdkDuration(duration: Duration): CDKDuration;

package/constructs/util/functionBinding.js

@@ -19,7 +19,7 @@ export function bindParameters(c) {
     }
     const app = c.node.root;
     Object.entries(binding.variables)
-        .filter(([, variable]) => variable.parameter)
+        .filter(([, variable]) => variable.parameter !== undefined)
         .forEach(([prop, variable]) => {
         const resId = `Parameter_${prop}`;
         if (!c.node.tryFindChild(resId)) {

package/constructs/util/permission.d.ts

@@ -1,8 +1,8 @@
 import { IConstruct } from "constructs";
 import * as iam from "aws-cdk-lib/aws-iam";
-export declare type Permissions = "*" | Permission[];
-declare type SupportedPermissions = "execute-api" | "appsync" | "dynamodb" | "sns" | "sqs" | "events" | "kinesis" | "s3" | "rds-data" | "secretsmanager" | "lambda" | "ssm";
-declare type Permission = SupportedPermissions | Omit<string, SupportedPermissions> | IConstruct | [IConstruct, string] | iam.PolicyStatement;
+export type Permissions = "*" | Permission[];
+type SupportedPermissions = "execute-api" | "appsync" | "dynamodb" | "sns" | "sqs" | "events" | "kinesis" | "s3" | "rds-data" | "secretsmanager" | "lambda" | "ssm";
+type Permission = SupportedPermissions | Omit<string, SupportedPermissions> | IConstruct | [IConstruct, string] | iam.PolicyStatement;
 export declare function attachPermissionsToRole(role: iam.Role, permissions: Permissions): void;
 export declare function attachPermissionsToPolicy(policy: iam.Policy, permissions: Permissions): void;
 export {};

package/constructs/util/permission.js

@@ -1,7 +1,6 @@
 /* eslint-disable @typescript-eslint/ban-ts-comment*/
 import * as iam from "aws-cdk-lib/aws-iam";
 import { isCDKConstruct, isCDKConstructOf } from "../Construct.js";
-import { Logger } from "../../logger.js";
 import { Api } from "../Api.js";
 import { ApiGatewayV1Api } from "../ApiGatewayV1Api.js";
 import { Stack } from "../Stack.js";
@@ -18,8 +17,8 @@ import { RDS } from "../RDS.js";
 import { Job } from "../Job.js";
 export function attachPermissionsToRole(role, permissions) {
     const { statements, grants } = permissionsToStatementsAndGrants(permissions);
-    statements.forEach(statement => role.addToPolicy(statement));
-    grants.forEach(grant => {
+    statements.forEach((statement) => role.addToPolicy(statement));
+    grants.forEach((grant) => {
         const construct = grant[0];
         const methodName = grant[1];
         construct[methodName](role);
@@ -27,8 +26,8 @@ export function attachPermissionsToRole(role, permissions) {
 }
 export function attachPermissionsToPolicy(policy, permissions) {
     const { statements, grants } = permissionsToStatementsAndGrants(permissions);
-    statements.forEach(statement => policy.addStatements(statement));
-    grants.forEach(grant => {
+    statements.forEach((statement) => policy.addStatements(statement));
+    grants.forEach((grant) => {
         throw new Error(`Cannot attach the "${grant[1]}" permission to an IAM policy.`);
     });
 }
@@ -57,7 +56,7 @@ function permissionsToStatementsAndGrants(permissions) {
     if (permissions === "*") {
         return {
             statements: [buildPolicyStatement(permissions, ["*"])],
-            grants: []
+            grants: [],
         };
     }
     if (!Array.isArray(permissions)) {
@@ -85,33 +84,33 @@ function permissionsToStatementsAndGrants(permissions) {
         ////////////////////////////////////
         else if (permission instanceof Api) {
             const httpApi = permission.cdk.httpApi;
-            const { account, region } = Stack.of(httpApi);
+            const { account, region, partition } = Stack.of(httpApi);
             statements.push(buildPolicyStatement("execute-api:Invoke", [
-                `arn:aws:execute-api:${region}:${account}:${httpApi.httpApiId}/*`
+                `arn:${partition}:execute-api:${region}:${account}:${httpApi.httpApiId}/*`,
             ]));
         }
         else if (permission instanceof ApiGatewayV1Api) {
             const restApi = permission.cdk.restApi;
-            const { account, region } = Stack.of(restApi);
+            const { account, region, partition } = Stack.of(restApi);
             statements.push(buildPolicyStatement("execute-api:Invoke", [
-                `arn:aws:execute-api:${region}:${account}:${restApi.restApiId}/*`
+                `arn:${partition}:execute-api:${region}:${account}:${restApi.restApiId}/*`,
             ]));
         }
         else if (permission instanceof WebSocketApi) {
             const webSocketApi = permission.cdk.webSocketApi;
-            const { account, region } = Stack.of(webSocketApi);
+            const { account, region, partition } = Stack.of(webSocketApi);
             statements.push(buildPolicyStatement("execute-api:Invoke", [
-                `arn:aws:execute-api:${region}:${account}:${webSocketApi.apiId}/*`
+                `arn:${partition}:execute-api:${region}:${account}:${webSocketApi.apiId}/*`,
             ]));
             statements.push(buildPolicyStatement("execute-api:ManageConnections", [
-                permission._connectionsArn
+                permission._connectionsArn,
             ]));
         }
         else if (permission instanceof AppSyncApi) {
             const graphqlApi = permission.cdk.graphqlApi;
-            const { account, region } = Stack.of(graphqlApi);
+            const { account, region, partition } = Stack.of(graphqlApi);
             statements.push(buildPolicyStatement("appsync:GraphQL", [
-                `arn:aws:appsync:${region}:${account}:apis/${graphqlApi.apiId}/*`
+                `arn:${partition}:appsync:${region}:${account}:apis/${graphqlApi.apiId}/*`,
             ]));
         }
         else if (permission instanceof Table) {
@@ -177,7 +176,7 @@ function permissionsToStatementsAndGrants(permissions) {
         else if (permission.deliveryStreamArn &&
             permission.deliveryStreamName) {
             statements.push(buildPolicyStatement("firehose:*", [
-                permission.deliveryStreamArn
+                permission.deliveryStreamArn,
             ]));
         }
         else if (permission.bucketArn &&
@@ -212,7 +211,6 @@ function permissionsToStatementsAndGrants(permissions) {
             grants.push(permission);
         }
         else {
-            Logger.debug("permission object", permission);
             throw new Error(`The specified permissions are not supported.`);
         }
     });
@@ -222,6 +220,6 @@ function buildPolicyStatement(actions, resources) {
     return new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
         actions: typeof actions === "string" ? [actions] : actions,
-        resources
+        resources,
     });
 }

package/constructs/util/size.d.ts

@@ -1,3 +1,3 @@
 import * as cdk from "aws-cdk-lib";
-export declare type Size = `${number} ${"MB" | "GB"}`;
+export type Size = `${number} ${"MB" | "GB"}`;
 export declare function toCdkSize(size: Size): cdk.Size;