sst 2.0.13 → 2.0.14

package/constructs/SsrSite.js

@@ -100,7 +100,7 @@ export class SsrSite extends Construct {
             : this.createCloudFrontDistributionForRegional();
         this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
-        const invalidationCR = this.createCloudFrontInvalidation(cliLayer);
+        const invalidationCR = this.createCloudFrontInvalidation();
         invalidationCR.node.addDependency(this.distribution);
         // Connect Custom Domain to CloudFront Distribution
         this.createRoute53Records();
@@ -551,36 +551,29 @@ export class SsrSite extends Construct {
             comment: "SST server response cache policy",
         });
     }
-    createCloudFrontInvalidation(cliLayer) {
-        // Create a Lambda function that will be doing the invalidation
-        const invalidator = new Function(this, "CloudFrontInvalidator", {
-            code: Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-            layers: [cliLayer],
-            runtime: Runtime.PYTHON_3_7,
-            handler: "cf-invalidate.handler",
-            timeout: CdkDuration.minutes(15),
-            memorySize: 1024,
+    createCloudFrontInvalidation() {
+        const stack = Stack.of(this);
+        const resource = new CustomResource(this, "CloudFrontInvalidator", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::CloudFrontInvalidator",
+            properties: {
+                buildId: this.generateBuildId(),
+                distributionId: this.distribution.distributionId,
+                paths: ["/*"],
+                waitForInvalidation: this.props.waitForInvalidation,
+            },
         });
-        // Grant permissions to invalidate CF Distribution
-        invalidator.addToRolePolicy(new PolicyStatement({
+        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
             effect: Effect.ALLOW,
             actions: [
                 "cloudfront:GetInvalidation",
                 "cloudfront:CreateInvalidation",
             ],
-            resources: ["*"],
+            resources: [
+                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+            ],
         }));
-        return new CustomResource(this, "CloudFrontInvalidation", {
-            serviceToken: invalidator.functionArn,
-            resourceType: "Custom::SSTCloudFrontInvalidation",
-            properties: {
-                BuildId: this.generateBuildId(),
-                DistributionId: this.distribution.distributionId,
-                // TODO: Ignore the browser build path as it may speed up invalidation
-                DistributionPaths: ["/*"],
-                WaitForInvalidation: this.props.waitForInvalidation,
-            },
-        });
+        return resource;
     }
     /////////////////////
     // Custom Domain

package/constructs/Stack.js

@@ -1,3 +1,4 @@
+import fs from "fs";
 import url from "url";
 import * as path from "path";
 import * as cdk from "aws-cdk-lib";
@@ -172,9 +173,11 @@ export class Stack extends cdk.Stack {
         });
     }
     createCustomResourceHandler() {
+        const dir = path.join(__dirname, "../support/custom-resources/");
         return new lambda.Function(this, "CustomResourceHandler", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../support/custom-resources/"), {
-                assetHash: this.stackName + "-custom-resources-20230130",
+            code: lambda.Code.fromAsset(dir, {
+                //assetHash: this.stackName + "-custom-resources-20230130",
+                assetHash: this.stackName + fs.readFileSync(dir + "/index.mjs").toString(),
             }),
             handler: "index.handler",
             runtime: lambda.Runtime.NODEJS_16_X,

package/constructs/StaticSite.js

@@ -7,7 +7,7 @@ import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
@@ -91,7 +91,7 @@ export class StaticSite extends Construct {
         this.distribution = this.createCfDistribution();
         this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
-        const invalidationCR = this.createCloudFrontInvalidation(cliLayer, assets);
+        const invalidationCR = this.createCloudFrontInvalidation(assets);
         invalidationCR.node.addDependency(this.distribution);
         // Connect Custom Domain to CloudFront Distribution
         this.createRoute53Records();
@@ -420,41 +420,34 @@ interface ImportMeta {
             },
         });
     }
-    createCloudFrontInvalidation(cliLayer, assets) {
-        // Create a Lambda function that will be doing the invalidation
-        const invalidator = new lambda.Function(this, "CloudFrontInvalidator", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-            layers: [cliLayer],
-            runtime: lambda.Runtime.PYTHON_3_7,
-            handler: "cf-invalidate.handler",
-            timeout: Duration.minutes(15),
-            memorySize: 1024,
-        });
-        // Grant permissions to invalidate CF Distribution
-        invalidator.addToRolePolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: ["*"],
-        }));
+    createCloudFrontInvalidation(assets) {
+        const stack = Stack.of(this);
         // Need the AssetHash field so the CR gets updated on each deploy
         const assetsHash = crypto
             .createHash("md5")
             .update(assets.map(({ assetHash }) => assetHash).join(""))
             .digest("hex");
-        // Create custom resource
-        return new CustomResource(this, "CloudFrontInvalidation", {
-            serviceToken: invalidator.functionArn,
-            resourceType: "Custom::SSTCloudFrontInvalidation",
+        const resource = new CustomResource(this, "CloudFrontInvalidator", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::CloudFrontInvalidator",
             properties: {
-                AssetsHash: assetsHash,
-                DistributionId: this.distribution.distributionId,
-                DistributionPaths: ["/*"],
-                WaitForInvalidation: this.props.waitForInvalidation,
+                assetsHash,
+                distributionId: this.distribution.distributionId,
+                paths: ["/*"],
+                waitForInvalidation: this.props.waitForInvalidation,
             },
         });
+        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: [
+                "cloudfront:GetInvalidation",
+                "cloudfront:CreateInvalidation",
+            ],
+            resources: [
+                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+            ],
+        }));
+        return resource;
     }
     /////////////////////
     // Custom Domain

package/constructs/deprecated/NextjsSite.js

@@ -6,7 +6,7 @@ import { execSync } from "child_process";
 import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Role, Effect, PolicyStatement, CompositePrincipal, ServicePrincipal, ManagedPolicy, } from "aws-cdk-lib/aws-iam";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import * as logs from "aws-cdk-lib/aws-logs";
 import * as lambda from "aws-cdk-lib/aws-lambda";
@@ -388,10 +388,10 @@ export class NextjsSite extends Construct {
     createEdgeFunctionRole() {
         const { defaults } = this.props;
         // Create function role
-        const role = new iam.Role(this, `EdgeLambdaRole`, {
-            assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal("lambda.amazonaws.com"), new iam.ServicePrincipal("edgelambda.amazonaws.com")),
+        const role = new Role(this, `EdgeLambdaRole`, {
+            assumedBy: new CompositePrincipal(new ServicePrincipal("lambda.amazonaws.com"), new ServicePrincipal("edgelambda.amazonaws.com")),
             managedPolicies: [
-                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
+                ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
             ],
         });
         // Attach permission
@@ -470,8 +470,8 @@ export class NextjsSite extends Construct {
             });
         }
         // Allow provider to perform search/replace on the asset
-        provider.role?.addToPrincipalPolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
+        provider.role?.addToPrincipalPolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
             actions: ["s3:*"],
             resources: [
                 `arn:${Stack.of(this).partition}:s3:::${asset.s3BucketName}/${asset.s3ObjectKey}`,
@@ -813,24 +813,7 @@ export class NextjsSite extends Construct {
         return new cloudfront.OriginRequestPolicy(this, "ImageOriginRequest", NextjsSite.imageOriginRequestPolicyProps);
     }
     createCloudFrontInvalidation() {
-        // Create a Lambda function that will be doing the invalidation
-        const invalidator = new lambda.Function(this, "CloudFrontInvalidator", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../../support/base-site-custom-resource")),
-            layers: [this.awsCliLayer],
-            runtime: lambda.Runtime.PYTHON_3_7,
-            handler: "cf-invalidate.handler",
-            timeout: Duration.minutes(15),
-            memorySize: 1024,
-        });
-        // Grant permissions to invalidate CF Distribution
-        invalidator.addToRolePolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: ["*"],
-        }));
+        const stack = Stack.of(this);
         // need the BuildId field so this CR gets updated on each deploy
         let buildId;
         if (this.isPlaceholder) {
@@ -846,16 +829,27 @@ export class NextjsSite extends Construct {
             : this.props.waitForInvalidation === false
                 ? false
                 : true;
-        return new CustomResource(this, "CloudFrontInvalidation", {
-            serviceToken: invalidator.functionArn,
-            resourceType: "Custom::SSTCloudFrontInvalidation",
+        const resource = new CustomResource(this, "CloudFrontInvalidator", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::CloudFrontInvalidator",
             properties: {
-                BuildId: buildId,
-                DistributionId: this.cdk.distribution.distributionId,
-                DistributionPaths: ["/*"],
-                WaitForInvalidation: waitForInvalidation,
+                buildId,
+                distributionId: this.cdk.distribution.distributionId,
+                paths: ["/*"],
+                waitForInvalidation,
             },
         });
+        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: [
+                "cloudfront:GetInvalidation",
+                "cloudfront:CreateInvalidation",
+            ],
+            resources: [
+                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.cdk.distribution.distributionId}`,
+            ],
+        }));
+        return resource;
     }
     /////////////////////
     // Custom Domain

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.0.13",
+  "version": "2.0.14",
   "bin": {
     "sst": "cli/sst.js"
   },
@@ -30,6 +30,7 @@
     "@aws-cdk/cx-api": "2.62.2",
     "@aws-cdk/region-info": "2.62.2",
     "@aws-sdk/client-cloudformation": "3.208.0",
+    "@aws-sdk/client-cloudfront": "3.208.0",
     "@aws-sdk/client-iot": "3.208.0",
     "@aws-sdk/client-iot-data-plane": "3.208.0",
     "@aws-sdk/client-lambda": "3.208.0",