sst 2.0.14 → 2.0.15

package/constructs/Auth.js

@@ -1,5 +1,5 @@
 import * as ssm from "aws-cdk-lib/aws-ssm";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Construct } from "constructs";
 import { Stack } from "./Stack.js";
 import { ENVIRONMENT_PLACEHOLDER, getEnvironmentKey, getParameterPath, } from "./util/functionBinding.js";
@@ -45,14 +45,18 @@ export class Auth extends Construct {
                 privatePath: getParameterPath(this, PRIVATE_KEY_PROP),
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
-            actions: [
-                "ssm:GetParameter",
-                "ssm:PutParameter",
-                "ssm:DeleteParameter",
-            ],
-            resources: [
-                `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter/*`,
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    actions: [
+                        "ssm:GetParameter",
+                        "ssm:PutParameter",
+                        "ssm:DeleteParameter",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter/*`,
+                    ],
+                }),
             ],
         }));
     }

package/constructs/EdgeFunction.d.ts

@@ -1,5 +1,5 @@
 import { Construct, IConstruct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Role } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import { Size } from "./util/size.js";
 import { Duration } from "./util/duration.js";
@@ -23,7 +23,7 @@ export interface EdgeFunctionProps {
     scopeOverride?: IConstruct;
 }
 export declare class EdgeFunction extends Construct {
-    role: iam.Role;
+    role: Role;
     functionArn: string;
     private scope;
     private versionId;

package/constructs/EdgeFunction.js

@@ -3,7 +3,7 @@ import url from "url";
 import path from "path";
 import crypto from "crypto";
 import { Construct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Effect, Role, Policy, PolicyStatement, CompositePrincipal, ServicePrincipal, ManagedPolicy, } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
 import { Lazy, Duration as CdkDuration, CustomResource, } from "aws-cdk-lib";
@@ -95,10 +95,10 @@ ${exports}
     createRole() {
         const { permissions } = this.props;
         // Create function role
-        const role = new iam.Role(this.scope, `ServerLambdaRole`, {
-            assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal("lambda.amazonaws.com"), new iam.ServicePrincipal("edgelambda.amazonaws.com")),
+        const role = new Role(this.scope, `ServerLambdaRole`, {
+            assumedBy: new CompositePrincipal(new ServicePrincipal("lambda.amazonaws.com"), new ServicePrincipal("edgelambda.amazonaws.com")),
             managedPolicies: [
-                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
+                ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
             ],
         });
         // Attach permission
@@ -159,10 +159,14 @@ ${exports}
                 replacements: this.getLambdaContentReplaceValues(),
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: ["s3:GetObject", "s3:PutObject"],
-            resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "AssetReplacerPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["s3:GetObject", "s3:PutObject"],
+                    resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+                }),
+            ],
         }));
         return resource;
     }
@@ -183,8 +187,8 @@ ${exports}
             timeout: CdkDuration.minutes(15),
             memorySize: 1024,
             initialPolicy: [
-                new iam.PolicyStatement({
-                    effect: iam.Effect.ALLOW,
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
                     actions: ["s3:*"],
                     resources: ["*"],
                 }),
@@ -215,8 +219,8 @@ ${exports}
                 timeout: CdkDuration.minutes(15),
                 memorySize: 1024,
                 initialPolicy: [
-                    new iam.PolicyStatement({
-                        effect: iam.Effect.ALLOW,
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
                         actions: ["lambda:*", "s3:*"],
                         resources: ["*"],
                     }),
@@ -253,8 +257,8 @@ ${exports}
                 timeout: CdkDuration.minutes(15),
                 memorySize: 1024,
                 initialPolicy: [
-                    new iam.PolicyStatement({
-                        effect: iam.Effect.ALLOW,
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
                         actions: ["lambda:*"],
                         resources: ["*"],
                     }),

package/constructs/SsrFunction.js

@@ -2,7 +2,7 @@ import url from "url";
 import path from "path";
 import spawn from "cross-spawn";
 import { Construct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import * as logs from "aws-cdk-lib/aws-logs";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
@@ -87,10 +87,14 @@ export class SsrFunction extends Construct {
                 replacements: this.getLambdaContentReplaceValues(),
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: ["s3:GetObject", "s3:PutObject"],
-            resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "AssetReplacerPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["s3:GetObject", "s3:PutObject"],
+                    resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+                }),
+            ],
         }));
         return resource;
     }

package/constructs/SsrSite.js

@@ -8,7 +8,7 @@ import { execSync } from "child_process";
 import { Construct } from "constructs";
 import { Fn, Token, Duration as CdkDuration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import { Bucket } from "aws-cdk-lib/aws-s3";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Function, Code, Runtime, FunctionUrlAuthType, } from "aws-cdk-lib/aws-lambda";
 import { HostedZone, ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
 import { Asset } from "aws-cdk-lib/aws-s3-assets";
@@ -100,8 +100,7 @@ export class SsrSite extends Construct {
             : this.createCloudFrontDistributionForRegional();
         this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
-        const invalidationCR = this.createCloudFrontInvalidation();
-        invalidationCR.node.addDependency(this.distribution);
+        this.createCloudFrontInvalidation();
         // Connect Custom Domain to CloudFront Distribution
         this.createRoute53Records();
     }
@@ -563,14 +562,18 @@ export class SsrSite extends Construct {
                 waitForInvalidation: this.props.waitForInvalidation,
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
-            effect: Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: [
-                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: [
+                        "cloudfront:GetInvalidation",
+                        "cloudfront:CreateInvalidation",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+                    ],
+                }),
             ],
         }));
         return resource;

package/constructs/StaticSite.js

@@ -7,7 +7,7 @@ import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
@@ -437,14 +437,18 @@ interface ImportMeta {
                 waitForInvalidation: this.props.waitForInvalidation,
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
-            effect: Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: [
-                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+        stack.customResourceHandler.role?.attachInlinePolicy(new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: [
+                        "cloudfront:GetInvalidation",
+                        "cloudfront:CreateInvalidation",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+                    ],
+                }),
             ],
         }));
         return resource;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.0.14",
+  "version": "2.0.15",
   "bin": {
     "sst": "cli/sst.js"
   },