sst 2.0.12 → 2.0.14

package/constructs/Job.d.ts

@@ -140,7 +140,6 @@ export declare class Job extends Construct implements SSTConstruct {
     private readonly localId;
     private readonly props;
     private readonly job;
-    private readonly isLiveDevEnabled;
     readonly _jobInvoker: Function;
     constructor(scope: Construct, id: string, props: JobProps);
     getConstructMetadata(): {

package/constructs/Job.js

@@ -3,9 +3,9 @@ import url from "url";
 import path from "path";
 import fs from "fs/promises";
 import { Construct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
-import * as lambda from "aws-cdk-lib/aws-lambda";
-import * as codebuild from "aws-cdk-lib/aws-codebuild";
+import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
+import { AssetCode } from "aws-cdk-lib/aws-lambda";
+import { Project, LinuxBuildImage, BuildSpec, ComputeType, } from "aws-cdk-lib/aws-codebuild";
 import { Stack } from "./Stack.js";
 import { Function, useFunctions } from "./Function.js";
 import { toCdkDuration } from "./util/duration.js";
@@ -37,7 +37,6 @@ export class Job extends Construct {
     localId;
     props;
     job;
-    isLiveDevEnabled;
     _jobInvoker;
     constructor(scope, id, props) {
         super(scope, props.cdk?.id || id);
@@ -53,9 +52,9 @@ export class Job extends Construct {
             .replace(/\$/g, "-")
             .replace(/\//g, "-")
             .replace(/\./g, "-");
-        this.isLiveDevEnabled = this.props.enableLiveDev === false ? false : true;
+        const isLiveDevEnabled = app.local && (this.props.enableLiveDev === false ? false : true);
         this.job = this.createCodeBuildProject();
-        if (app.local && this.isLiveDevEnabled) {
+        if (isLiveDevEnabled) {
             this._jobInvoker = this.createLocalInvoker();
         }
         else {
@@ -129,7 +128,7 @@ export class Job extends Construct {
     }
     createCodeBuildProject() {
         const app = this.node.root;
-        return new codebuild.Project(this, "JobProject", {
+        return new Project(this, "JobProject", {
             vpc: this.props.cdk?.vpc,
             projectName: app.logicalPrefixedName(this.node.id),
             environment: {
@@ -139,7 +138,7 @@ export class Job extends Construct {
                 // purpose of this demo, I use STANDARD_5_0. It takes 30s to boot.
                 //buildImage: codebuild.LinuxBuildImage.STANDARD_6_0,
                 //buildImage: codebuild.LinuxBuildImage.STANDARD_5_0,
-                buildImage: codebuild.LinuxBuildImage.fromDockerRegistry("amazon/aws-lambda-nodejs:16"),
+                buildImage: LinuxBuildImage.fromDockerRegistry("amazon/aws-lambda-nodejs:16"),
                 computeType: this.normalizeMemorySize(this.props.memorySize || "3 GB"),
             },
             environmentVariables: {
@@ -148,7 +147,7 @@ export class Job extends Construct {
                 SST_SSM_PREFIX: { value: useProject().config.ssmPrefix },
             },
             timeout: this.normalizeTimeout(this.props.timeout || "8 hours"),
-            buildSpec: codebuild.BuildSpec.fromObject({
+            buildSpec: BuildSpec.fromObject({
                 version: "0.2",
                 phases: {
                     build: {
@@ -163,54 +162,40 @@ export class Job extends Construct {
     buildCodeBuildProjectCode() {
         const app = this.node.root;
         // Handle remove (ie. sst remove)
-        if (app.mode !== "deploy") {
-            // do nothing
-        }
-        // Handle build
-        else {
-            useDeferredTasks().add(async () => {
-                // Build function
-                /*
-                const bundled = await Runtime.Handler.bundle({
-                  id: this.localId,
-                  root: app.appPath,
-                  handler,
-                  runtime: "nodejs16.x",
-                  srcPath,
-                  bundle
-                })!;
-                */
-                // TODO: Fix
-                const bundle = await useRuntimeHandlers().build(this.node.addr, "deploy");
-                // handle copy files
-                // create wrapper that calls the handler
-                if (bundle.type === "error")
-                    throw new Error(`Failed to build job "${this.props.handler}"`);
-                const parsed = path.parse(bundle.handler);
-                await fs.writeFile(path.join(bundle.out, "handler-wrapper.js"), [
-                    `console.log("")`,
-                    `console.log("//////////////////////")`,
-                    `console.log("// Start of the job //")`,
-                    `console.log("//////////////////////")`,
-                    `console.log("")`,
-                    `import { ${parsed.ext.substring(1)} } from "./${path.join(parsed.dir, parsed.name)}.mjs";`,
-                    `const event = JSON.parse(process.env.SST_PAYLOAD);`,
-                    `const result = await ${parsed.name}(event);`,
-                    `console.log("")`,
-                    `console.log("----------------------")`,
-                    `console.log("")`,
-                    `console.log("Result:", result);`,
-                    `console.log("")`,
-                    `console.log("//////////////////////")`,
-                    `console.log("//  End of the job  //")`,
-                    `console.log("//////////////////////")`,
-                    `console.log("")`,
-                ].join("\n"));
-                const code = lambda.AssetCode.fromAsset(bundle.out);
-                this.updateCodeBuildProjectCode(code, "handler-wrapper.js");
-                // This should always be true b/c runtime is always Node.js
-            });
-        }
+        if (app.mode === "remove")
+            return;
+        useDeferredTasks().add(async () => {
+            // Build function
+            const bundle = await useRuntimeHandlers().build(this.node.addr, "deploy");
+            // create wrapper that calls the handler
+            if (bundle.type === "error")
+                throw new Error(`Failed to build job "${this.props.handler}"`);
+            const parsed = path.parse(bundle.handler);
+            const importName = parsed.ext.substring(1);
+            const importPath = `./${path.join(parsed.dir, parsed.name)}.mjs`;
+            await fs.writeFile(path.join(bundle.out, "handler-wrapper.mjs"), [
+                `console.log("")`,
+                `console.log("//////////////////////")`,
+                `console.log("// Start of the job //")`,
+                `console.log("//////////////////////")`,
+                `console.log("")`,
+                `import { ${importName} } from "${importPath}";`,
+                `const event = JSON.parse(process.env.SST_PAYLOAD);`,
+                `const result = await ${importName}(event);`,
+                `console.log("")`,
+                `console.log("----------------------")`,
+                `console.log("")`,
+                `console.log("Result:", result);`,
+                `console.log("")`,
+                `console.log("//////////////////////")`,
+                `console.log("//  End of the job  //")`,
+                `console.log("//////////////////////")`,
+                `console.log("")`,
+            ].join("\n"));
+            const code = AssetCode.fromAsset(bundle.out);
+            this.updateCodeBuildProjectCode(code, "handler-wrapper.mjs");
+            // This should always be true b/c runtime is always Node.js
+        });
     }
     updateCodeBuildProjectCode(code, script) {
         // Update job's commands
@@ -228,9 +213,9 @@ export class Job extends Construct {
             ].join("\n"),
         };
         this.attachPermissions([
-            new iam.PolicyStatement({
+            new PolicyStatement({
                 actions: ["s3:*"],
-                effect: iam.Effect.ALLOW,
+                effect: Effect.ALLOW,
                 resources: [
                     `arn:${Stack.of(this).partition}:s3:::${codeConfig.s3Location?.bucketName}/${codeConfig.s3Location?.objectKey}`,
                 ],
@@ -259,15 +244,15 @@ export class Job extends Construct {
     createCodeBuildInvoker() {
         const fn = new Function(this, this.node.id, {
             handler: path.join(__dirname, "../support/job-invoker/index.main"),
-            runtime: "nodejs16.x",
+            runtime: "nodejs18.x",
             timeout: 10,
             memorySize: 1024,
             environment: {
                 PROJECT_NAME: this.job.projectName,
             },
             permissions: [
-                new iam.PolicyStatement({
-                    effect: iam.Effect.ALLOW,
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
                     actions: ["codebuild:StartBuild"],
                     resources: [this.job.projectArn],
                 }),
@@ -289,9 +274,9 @@ export class Job extends Construct {
             // Bind permissions
             const permissions = bindPermissions(c);
             Object.entries(permissions).forEach(([action, resources]) => this.attachPermissionsForCodeBuild([
-                new iam.PolicyStatement({
+                new PolicyStatement({
                     actions: [action],
-                    effect: iam.Effect.ALLOW,
+                    effect: Effect.ALLOW,
                     resources,
                 }),
             ]));
@@ -308,16 +293,16 @@ export class Job extends Construct {
     }
     normalizeMemorySize(memorySize) {
         if (memorySize === "3 GB") {
-            return codebuild.ComputeType.SMALL;
+            return ComputeType.SMALL;
         }
         else if (memorySize === "7 GB") {
-            return codebuild.ComputeType.MEDIUM;
+            return ComputeType.MEDIUM;
         }
         else if (memorySize === "15 GB") {
-            return codebuild.ComputeType.LARGE;
+            return ComputeType.LARGE;
         }
         else if (memorySize === "145 GB") {
-            return codebuild.ComputeType.X2_LARGE;
+            return ComputeType.X2_LARGE;
         }
         throw new Error(`Invalid memory size value for the ${this.node.id} Job.`);
     }

package/constructs/SsrSite.js

@@ -100,7 +100,7 @@ export class SsrSite extends Construct {
             : this.createCloudFrontDistributionForRegional();
         this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
-        const invalidationCR = this.createCloudFrontInvalidation(cliLayer);
+        const invalidationCR = this.createCloudFrontInvalidation();
         invalidationCR.node.addDependency(this.distribution);
         // Connect Custom Domain to CloudFront Distribution
         this.createRoute53Records();
@@ -551,36 +551,29 @@ export class SsrSite extends Construct {
             comment: "SST server response cache policy",
         });
     }
-    createCloudFrontInvalidation(cliLayer) {
-        // Create a Lambda function that will be doing the invalidation
-        const invalidator = new Function(this, "CloudFrontInvalidator", {
-            code: Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-            layers: [cliLayer],
-            runtime: Runtime.PYTHON_3_7,
-            handler: "cf-invalidate.handler",
-            timeout: CdkDuration.minutes(15),
-            memorySize: 1024,
+    createCloudFrontInvalidation() {
+        const stack = Stack.of(this);
+        const resource = new CustomResource(this, "CloudFrontInvalidator", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::CloudFrontInvalidator",
+            properties: {
+                buildId: this.generateBuildId(),
+                distributionId: this.distribution.distributionId,
+                paths: ["/*"],
+                waitForInvalidation: this.props.waitForInvalidation,
+            },
         });
-        // Grant permissions to invalidate CF Distribution
-        invalidator.addToRolePolicy(new PolicyStatement({
+        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
             effect: Effect.ALLOW,
             actions: [
                 "cloudfront:GetInvalidation",
                 "cloudfront:CreateInvalidation",
             ],
-            resources: ["*"],
+            resources: [
+                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+            ],
         }));
-        return new CustomResource(this, "CloudFrontInvalidation", {
-            serviceToken: invalidator.functionArn,
-            resourceType: "Custom::SSTCloudFrontInvalidation",
-            properties: {
-                BuildId: this.generateBuildId(),
-                DistributionId: this.distribution.distributionId,
-                // TODO: Ignore the browser build path as it may speed up invalidation
-                DistributionPaths: ["/*"],
-                WaitForInvalidation: this.props.waitForInvalidation,
-            },
-        });
+        return resource;
     }
     /////////////////////
     // Custom Domain

package/constructs/Stack.js

@@ -1,3 +1,4 @@
+import fs from "fs";
 import url from "url";
 import * as path from "path";
 import * as cdk from "aws-cdk-lib";
@@ -172,9 +173,11 @@ export class Stack extends cdk.Stack {
         });
     }
     createCustomResourceHandler() {
+        const dir = path.join(__dirname, "../support/custom-resources/");
         return new lambda.Function(this, "CustomResourceHandler", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../support/custom-resources/"), {
-                assetHash: this.stackName + "-custom-resources-20230130",
+            code: lambda.Code.fromAsset(dir, {
+                //assetHash: this.stackName + "-custom-resources-20230130",
+                assetHash: this.stackName + fs.readFileSync(dir + "/index.mjs").toString(),
             }),
             handler: "index.handler",
             runtime: lambda.Runtime.NODEJS_16_X,

package/constructs/StaticSite.js

@@ -7,7 +7,7 @@ import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
@@ -91,7 +91,7 @@ export class StaticSite extends Construct {
         this.distribution = this.createCfDistribution();
         this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
-        const invalidationCR = this.createCloudFrontInvalidation(cliLayer, assets);
+        const invalidationCR = this.createCloudFrontInvalidation(assets);
         invalidationCR.node.addDependency(this.distribution);
         // Connect Custom Domain to CloudFront Distribution
         this.createRoute53Records();
@@ -420,41 +420,34 @@ interface ImportMeta {
             },
         });
     }
-    createCloudFrontInvalidation(cliLayer, assets) {
-        // Create a Lambda function that will be doing the invalidation
-        const invalidator = new lambda.Function(this, "CloudFrontInvalidator", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-            layers: [cliLayer],
-            runtime: lambda.Runtime.PYTHON_3_7,
-            handler: "cf-invalidate.handler",
-            timeout: Duration.minutes(15),
-            memorySize: 1024,
-        });
-        // Grant permissions to invalidate CF Distribution
-        invalidator.addToRolePolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: ["*"],
-        }));
+    createCloudFrontInvalidation(assets) {
+        const stack = Stack.of(this);
         // Need the AssetHash field so the CR gets updated on each deploy
         const assetsHash = crypto
             .createHash("md5")
             .update(assets.map(({ assetHash }) => assetHash).join(""))
             .digest("hex");
-        // Create custom resource
-        return new CustomResource(this, "CloudFrontInvalidation", {
-            serviceToken: invalidator.functionArn,
-            resourceType: "Custom::SSTCloudFrontInvalidation",
+        const resource = new CustomResource(this, "CloudFrontInvalidator", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::CloudFrontInvalidator",
             properties: {
-                AssetsHash: assetsHash,
-                DistributionId: this.distribution.distributionId,
-                DistributionPaths: ["/*"],
-                WaitForInvalidation: this.props.waitForInvalidation,
+                assetsHash,
+                distributionId: this.distribution.distributionId,
+                paths: ["/*"],
+                waitForInvalidation: this.props.waitForInvalidation,
             },
         });
+        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: [
+                "cloudfront:GetInvalidation",
+                "cloudfront:CreateInvalidation",
+            ],
+            resources: [
+                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+            ],
+        }));
+        return resource;
     }
     /////////////////////
     // Custom Domain

package/constructs/deprecated/NextjsSite.js

@@ -6,7 +6,7 @@ import { execSync } from "child_process";
 import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Role, Effect, PolicyStatement, CompositePrincipal, ServicePrincipal, ManagedPolicy, } from "aws-cdk-lib/aws-iam";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import * as logs from "aws-cdk-lib/aws-logs";
 import * as lambda from "aws-cdk-lib/aws-lambda";
@@ -388,10 +388,10 @@ export class NextjsSite extends Construct {
     createEdgeFunctionRole() {
         const { defaults } = this.props;
         // Create function role
-        const role = new iam.Role(this, `EdgeLambdaRole`, {
-            assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal("lambda.amazonaws.com"), new iam.ServicePrincipal("edgelambda.amazonaws.com")),
+        const role = new Role(this, `EdgeLambdaRole`, {
+            assumedBy: new CompositePrincipal(new ServicePrincipal("lambda.amazonaws.com"), new ServicePrincipal("edgelambda.amazonaws.com")),
             managedPolicies: [
-                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
+                ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
             ],
         });
         // Attach permission
@@ -470,8 +470,8 @@ export class NextjsSite extends Construct {
             });
         }
         // Allow provider to perform search/replace on the asset
-        provider.role?.addToPrincipalPolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
+        provider.role?.addToPrincipalPolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
             actions: ["s3:*"],
             resources: [
                 `arn:${Stack.of(this).partition}:s3:::${asset.s3BucketName}/${asset.s3ObjectKey}`,
@@ -813,24 +813,7 @@ export class NextjsSite extends Construct {
         return new cloudfront.OriginRequestPolicy(this, "ImageOriginRequest", NextjsSite.imageOriginRequestPolicyProps);
     }
     createCloudFrontInvalidation() {
-        // Create a Lambda function that will be doing the invalidation
-        const invalidator = new lambda.Function(this, "CloudFrontInvalidator", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../../support/base-site-custom-resource")),
-            layers: [this.awsCliLayer],
-            runtime: lambda.Runtime.PYTHON_3_7,
-            handler: "cf-invalidate.handler",
-            timeout: Duration.minutes(15),
-            memorySize: 1024,
-        });
-        // Grant permissions to invalidate CF Distribution
-        invalidator.addToRolePolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: ["*"],
-        }));
+        const stack = Stack.of(this);
         // need the BuildId field so this CR gets updated on each deploy
         let buildId;
         if (this.isPlaceholder) {
@@ -846,16 +829,27 @@ export class NextjsSite extends Construct {
             : this.props.waitForInvalidation === false
                 ? false
                 : true;
-        return new CustomResource(this, "CloudFrontInvalidation", {
-            serviceToken: invalidator.functionArn,
-            resourceType: "Custom::SSTCloudFrontInvalidation",
+        const resource = new CustomResource(this, "CloudFrontInvalidator", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::CloudFrontInvalidator",
             properties: {
-                BuildId: buildId,
-                DistributionId: this.cdk.distribution.distributionId,
-                DistributionPaths: ["/*"],
-                WaitForInvalidation: waitForInvalidation,
+                buildId,
+                distributionId: this.cdk.distribution.distributionId,
+                paths: ["/*"],
+                waitForInvalidation,
             },
         });
+        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: [
+                "cloudfront:GetInvalidation",
+                "cloudfront:CreateInvalidation",
+            ],
+            resources: [
+                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.cdk.distribution.distributionId}`,
+            ],
+        }));
+        return resource;
     }
     /////////////////////
     // Custom Domain

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.0.12",
+  "version": "2.0.14",
   "bin": {
     "sst": "cli/sst.js"
   },
@@ -30,6 +30,7 @@
     "@aws-cdk/cx-api": "2.62.2",
     "@aws-cdk/region-info": "2.62.2",
     "@aws-sdk/client-cloudformation": "3.208.0",
+    "@aws-sdk/client-cloudfront": "3.208.0",
     "@aws-sdk/client-iot": "3.208.0",
     "@aws-sdk/client-iot-data-plane": "3.208.0",
     "@aws-sdk/client-lambda": "3.208.0",

package/sst.mjs

@@ -4228,11 +4228,16 @@ async function deploy(stack) {
   const deployment = new CloudFormationDeployments2({
     sdkProvider: provider
   });
+  const stackTags = Object.entries(stack.tags ?? {}).map(([Key, Value]) => ({
+    Key,
+    Value
+  }));
   try {
     await addInUseExports(stack);
     const result = await deployment.deployStack({
       stack,
       quiet: true,
+      tags: stackTags,
       deploymentMethod: {
         method: "direct"
       }

package/stacks/deploy.js

@@ -74,11 +74,16 @@ export async function deploy(stack) {
     const deployment = new CloudFormationDeployments({
         sdkProvider: provider,
     });
+    const stackTags = Object.entries(stack.tags ?? {}).map(([Key, Value]) => ({
+        Key,
+        Value,
+    }));
     try {
         await addInUseExports(stack);
         const result = await deployment.deployStack({
             stack: stack,
             quiet: true,
+            tags: stackTags,
             deploymentMethod: {
                 method: "direct",
             },