sst 2.0.13 → 2.0.15

package/constructs/Auth.js

@@ -1,5 +1,5 @@
 import * as ssm from "aws-cdk-lib/aws-ssm";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Construct } from "constructs";
 import { Stack } from "./Stack.js";
 import { ENVIRONMENT_PLACEHOLDER, getEnvironmentKey, getParameterPath, } from "./util/functionBinding.js";
@@ -45,14 +45,18 @@ export class Auth extends Construct {
                 privatePath: getParameterPath(this, PRIVATE_KEY_PROP),
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
-            actions: [
-                "ssm:GetParameter",
-                "ssm:PutParameter",
-                "ssm:DeleteParameter",
-            ],
-            resources: [
-                `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter/*`,
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    actions: [
+                        "ssm:GetParameter",
+                        "ssm:PutParameter",
+                        "ssm:DeleteParameter",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter/*`,
+                    ],
+                }),
             ],
         }));
     }

package/constructs/EdgeFunction.d.ts

@@ -1,5 +1,5 @@
 import { Construct, IConstruct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Role } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import { Size } from "./util/size.js";
 import { Duration } from "./util/duration.js";
@@ -23,7 +23,7 @@ export interface EdgeFunctionProps {
     scopeOverride?: IConstruct;
 }
 export declare class EdgeFunction extends Construct {
-    role: iam.Role;
+    role: Role;
     functionArn: string;
     private scope;
     private versionId;

package/constructs/EdgeFunction.js

@@ -3,7 +3,7 @@ import url from "url";
 import path from "path";
 import crypto from "crypto";
 import { Construct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Effect, Role, Policy, PolicyStatement, CompositePrincipal, ServicePrincipal, ManagedPolicy, } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
 import { Lazy, Duration as CdkDuration, CustomResource, } from "aws-cdk-lib";
@@ -95,10 +95,10 @@ ${exports}
     createRole() {
         const { permissions } = this.props;
         // Create function role
-        const role = new iam.Role(this.scope, `ServerLambdaRole`, {
-            assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal("lambda.amazonaws.com"), new iam.ServicePrincipal("edgelambda.amazonaws.com")),
+        const role = new Role(this.scope, `ServerLambdaRole`, {
+            assumedBy: new CompositePrincipal(new ServicePrincipal("lambda.amazonaws.com"), new ServicePrincipal("edgelambda.amazonaws.com")),
             managedPolicies: [
-                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
+                ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
             ],
         });
         // Attach permission
@@ -159,10 +159,14 @@ ${exports}
                 replacements: this.getLambdaContentReplaceValues(),
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: ["s3:GetObject", "s3:PutObject"],
-            resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "AssetReplacerPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["s3:GetObject", "s3:PutObject"],
+                    resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+                }),
+            ],
         }));
         return resource;
     }
@@ -183,8 +187,8 @@ ${exports}
             timeout: CdkDuration.minutes(15),
             memorySize: 1024,
             initialPolicy: [
-                new iam.PolicyStatement({
-                    effect: iam.Effect.ALLOW,
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
                     actions: ["s3:*"],
                     resources: ["*"],
                 }),
@@ -215,8 +219,8 @@ ${exports}
                 timeout: CdkDuration.minutes(15),
                 memorySize: 1024,
                 initialPolicy: [
-                    new iam.PolicyStatement({
-                        effect: iam.Effect.ALLOW,
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
                         actions: ["lambda:*", "s3:*"],
                         resources: ["*"],
                     }),
@@ -253,8 +257,8 @@ ${exports}
                 timeout: CdkDuration.minutes(15),
                 memorySize: 1024,
                 initialPolicy: [
-                    new iam.PolicyStatement({
-                        effect: iam.Effect.ALLOW,
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
                         actions: ["lambda:*"],
                         resources: ["*"],
                     }),

package/constructs/SsrFunction.js

@@ -2,7 +2,7 @@ import url from "url";
 import path from "path";
 import spawn from "cross-spawn";
 import { Construct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import * as logs from "aws-cdk-lib/aws-logs";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
@@ -87,10 +87,14 @@ export class SsrFunction extends Construct {
                 replacements: this.getLambdaContentReplaceValues(),
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: ["s3:GetObject", "s3:PutObject"],
-            resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "AssetReplacerPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["s3:GetObject", "s3:PutObject"],
+                    resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+                }),
+            ],
         }));
         return resource;
     }

package/constructs/SsrSite.js

@@ -8,7 +8,7 @@ import { execSync } from "child_process";
 import { Construct } from "constructs";
 import { Fn, Token, Duration as CdkDuration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import { Bucket } from "aws-cdk-lib/aws-s3";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Function, Code, Runtime, FunctionUrlAuthType, } from "aws-cdk-lib/aws-lambda";
 import { HostedZone, ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
 import { Asset } from "aws-cdk-lib/aws-s3-assets";
@@ -100,8 +100,7 @@ export class SsrSite extends Construct {
             : this.createCloudFrontDistributionForRegional();
         this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
-        const invalidationCR = this.createCloudFrontInvalidation(cliLayer);
-        invalidationCR.node.addDependency(this.distribution);
+        this.createCloudFrontInvalidation();
         // Connect Custom Domain to CloudFront Distribution
         this.createRoute53Records();
     }
@@ -551,36 +550,33 @@ export class SsrSite extends Construct {
             comment: "SST server response cache policy",
         });
     }
-    createCloudFrontInvalidation(cliLayer) {
-        // Create a Lambda function that will be doing the invalidation
-        const invalidator = new Function(this, "CloudFrontInvalidator", {
-            code: Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-            layers: [cliLayer],
-            runtime: Runtime.PYTHON_3_7,
-            handler: "cf-invalidate.handler",
-            timeout: CdkDuration.minutes(15),
-            memorySize: 1024,
-        });
-        // Grant permissions to invalidate CF Distribution
-        invalidator.addToRolePolicy(new PolicyStatement({
-            effect: Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: ["*"],
-        }));
-        return new CustomResource(this, "CloudFrontInvalidation", {
-            serviceToken: invalidator.functionArn,
-            resourceType: "Custom::SSTCloudFrontInvalidation",
+    createCloudFrontInvalidation() {
+        const stack = Stack.of(this);
+        const resource = new CustomResource(this, "CloudFrontInvalidator", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::CloudFrontInvalidator",
             properties: {
-                BuildId: this.generateBuildId(),
-                DistributionId: this.distribution.distributionId,
-                // TODO: Ignore the browser build path as it may speed up invalidation
-                DistributionPaths: ["/*"],
-                WaitForInvalidation: this.props.waitForInvalidation,
+                buildId: this.generateBuildId(),
+                distributionId: this.distribution.distributionId,
+                paths: ["/*"],
+                waitForInvalidation: this.props.waitForInvalidation,
             },
         });
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: [
+                        "cloudfront:GetInvalidation",
+                        "cloudfront:CreateInvalidation",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+                    ],
+                }),
+            ],
+        }));
+        return resource;
     }
     /////////////////////
     // Custom Domain

package/constructs/Stack.js

@@ -1,3 +1,4 @@
+import fs from "fs";
 import url from "url";
 import * as path from "path";
 import * as cdk from "aws-cdk-lib";
@@ -172,9 +173,11 @@ export class Stack extends cdk.Stack {
         });
     }
     createCustomResourceHandler() {
+        const dir = path.join(__dirname, "../support/custom-resources/");
         return new lambda.Function(this, "CustomResourceHandler", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../support/custom-resources/"), {
-                assetHash: this.stackName + "-custom-resources-20230130",
+            code: lambda.Code.fromAsset(dir, {
+                //assetHash: this.stackName + "-custom-resources-20230130",
+                assetHash: this.stackName + fs.readFileSync(dir + "/index.mjs").toString(),
             }),
             handler: "index.handler",
             runtime: lambda.Runtime.NODEJS_16_X,

package/constructs/StaticSite.js

@@ -7,7 +7,7 @@ import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
@@ -91,7 +91,7 @@ export class StaticSite extends Construct {
         this.distribution = this.createCfDistribution();
         this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
-        const invalidationCR = this.createCloudFrontInvalidation(cliLayer, assets);
+        const invalidationCR = this.createCloudFrontInvalidation(assets);
         invalidationCR.node.addDependency(this.distribution);
         // Connect Custom Domain to CloudFront Distribution
         this.createRoute53Records();
@@ -420,41 +420,38 @@ interface ImportMeta {
             },
         });
     }
-    createCloudFrontInvalidation(cliLayer, assets) {
-        // Create a Lambda function that will be doing the invalidation
-        const invalidator = new lambda.Function(this, "CloudFrontInvalidator", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-            layers: [cliLayer],
-            runtime: lambda.Runtime.PYTHON_3_7,
-            handler: "cf-invalidate.handler",
-            timeout: Duration.minutes(15),
-            memorySize: 1024,
-        });
-        // Grant permissions to invalidate CF Distribution
-        invalidator.addToRolePolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: ["*"],
-        }));
+    createCloudFrontInvalidation(assets) {
+        const stack = Stack.of(this);
         // Need the AssetHash field so the CR gets updated on each deploy
         const assetsHash = crypto
             .createHash("md5")
             .update(assets.map(({ assetHash }) => assetHash).join(""))
             .digest("hex");
-        // Create custom resource
-        return new CustomResource(this, "CloudFrontInvalidation", {
-            serviceToken: invalidator.functionArn,
-            resourceType: "Custom::SSTCloudFrontInvalidation",
+        const resource = new CustomResource(this, "CloudFrontInvalidator", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::CloudFrontInvalidator",
             properties: {
-                AssetsHash: assetsHash,
-                DistributionId: this.distribution.distributionId,
-                DistributionPaths: ["/*"],
-                WaitForInvalidation: this.props.waitForInvalidation,
+                assetsHash,
+                distributionId: this.distribution.distributionId,
+                paths: ["/*"],
+                waitForInvalidation: this.props.waitForInvalidation,
             },
         });
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: [
+                        "cloudfront:GetInvalidation",
+                        "cloudfront:CreateInvalidation",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+                    ],
+                }),
+            ],
+        }));
+        return resource;
     }
     /////////////////////
     // Custom Domain

package/constructs/deprecated/NextjsSite.js

@@ -6,7 +6,7 @@ import { execSync } from "child_process";
 import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Role, Effect, PolicyStatement, CompositePrincipal, ServicePrincipal, ManagedPolicy, } from "aws-cdk-lib/aws-iam";
 import * as sqs from "aws-cdk-lib/aws-sqs";
 import * as logs from "aws-cdk-lib/aws-logs";
 import * as lambda from "aws-cdk-lib/aws-lambda";
@@ -388,10 +388,10 @@ export class NextjsSite extends Construct {
     createEdgeFunctionRole() {
         const { defaults } = this.props;
         // Create function role
-        const role = new iam.Role(this, `EdgeLambdaRole`, {
-            assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal("lambda.amazonaws.com"), new iam.ServicePrincipal("edgelambda.amazonaws.com")),
+        const role = new Role(this, `EdgeLambdaRole`, {
+            assumedBy: new CompositePrincipal(new ServicePrincipal("lambda.amazonaws.com"), new ServicePrincipal("edgelambda.amazonaws.com")),
             managedPolicies: [
-                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
+                ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
             ],
         });
         // Attach permission
@@ -470,8 +470,8 @@ export class NextjsSite extends Construct {
             });
         }
         // Allow provider to perform search/replace on the asset
-        provider.role?.addToPrincipalPolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
+        provider.role?.addToPrincipalPolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
             actions: ["s3:*"],
             resources: [
                 `arn:${Stack.of(this).partition}:s3:::${asset.s3BucketName}/${asset.s3ObjectKey}`,
@@ -813,24 +813,7 @@ export class NextjsSite extends Construct {
         return new cloudfront.OriginRequestPolicy(this, "ImageOriginRequest", NextjsSite.imageOriginRequestPolicyProps);
     }
     createCloudFrontInvalidation() {
-        // Create a Lambda function that will be doing the invalidation
-        const invalidator = new lambda.Function(this, "CloudFrontInvalidator", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../../support/base-site-custom-resource")),
-            layers: [this.awsCliLayer],
-            runtime: lambda.Runtime.PYTHON_3_7,
-            handler: "cf-invalidate.handler",
-            timeout: Duration.minutes(15),
-            memorySize: 1024,
-        });
-        // Grant permissions to invalidate CF Distribution
-        invalidator.addToRolePolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: ["*"],
-        }));
+        const stack = Stack.of(this);
         // need the BuildId field so this CR gets updated on each deploy
         let buildId;
         if (this.isPlaceholder) {
@@ -846,16 +829,27 @@ export class NextjsSite extends Construct {
             : this.props.waitForInvalidation === false
                 ? false
                 : true;
-        return new CustomResource(this, "CloudFrontInvalidation", {
-            serviceToken: invalidator.functionArn,
-            resourceType: "Custom::SSTCloudFrontInvalidation",
+        const resource = new CustomResource(this, "CloudFrontInvalidator", {
+            serviceToken: stack.customResourceHandler.functionArn,
+            resourceType: "Custom::CloudFrontInvalidator",
             properties: {
-                BuildId: buildId,
-                DistributionId: this.cdk.distribution.distributionId,
-                DistributionPaths: ["/*"],
-                WaitForInvalidation: waitForInvalidation,
+                buildId,
+                distributionId: this.cdk.distribution.distributionId,
+                paths: ["/*"],
+                waitForInvalidation,
             },
         });
+        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: [
+                "cloudfront:GetInvalidation",
+                "cloudfront:CreateInvalidation",
+            ],
+            resources: [
+                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.cdk.distribution.distributionId}`,
+            ],
+        }));
+        return resource;
     }
     /////////////////////
     // Custom Domain

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "bin": {
     "sst": "cli/sst.js"
   },
@@ -30,6 +30,7 @@
     "@aws-cdk/cx-api": "2.62.2",
     "@aws-cdk/region-info": "2.62.2",
     "@aws-sdk/client-cloudformation": "3.208.0",
+    "@aws-sdk/client-cloudfront": "3.208.0",
     "@aws-sdk/client-iot": "3.208.0",
     "@aws-sdk/client-iot-data-plane": "3.208.0",
     "@aws-sdk/client-lambda": "3.208.0",