sst 2.0.14 → 2.0.16

package/constructs/Auth.js

@@ -1,5 +1,5 @@
 import * as ssm from "aws-cdk-lib/aws-ssm";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Construct } from "constructs";
 import { Stack } from "./Stack.js";
 import { ENVIRONMENT_PLACEHOLDER, getEnvironmentKey, getParameterPath, } from "./util/functionBinding.js";
@@ -37,7 +37,22 @@ export class Auth extends Construct {
         this.id = id;
         const stack = Stack.of(scope);
         this.authenticator = props.authenticator;
-        new CustomResource(this, "StackMetadata", {
+        const policy = new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    actions: [
+                        "ssm:GetParameter",
+                        "ssm:PutParameter",
+                        "ssm:DeleteParameter",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter/*`,
+                    ],
+                }),
+            ],
+        });
+        stack.customResourceHandler.role?.attachInlinePolicy(policy);
+        const resource = new CustomResource(this, "StackMetadata", {
             serviceToken: stack.customResourceHandler.functionArn,
             resourceType: "Custom::AuthKeys",
             properties: {
@@ -45,16 +60,7 @@ export class Auth extends Construct {
                 privatePath: getParameterPath(this, PRIVATE_KEY_PROP),
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
-            actions: [
-                "ssm:GetParameter",
-                "ssm:PutParameter",
-                "ssm:DeleteParameter",
-            ],
-            resources: [
-                `arn:${stack.partition}:ssm:${stack.region}:${stack.account}:parameter/*`,
-            ],
-        }));
+        resource.node.addDependency(policy);
     }
     /** @internal */
     getConstructMetadata() {

package/constructs/EdgeFunction.d.ts

@@ -1,5 +1,5 @@
 import { Construct, IConstruct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Role } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import { Size } from "./util/size.js";
 import { Duration } from "./util/duration.js";
@@ -23,7 +23,7 @@ export interface EdgeFunctionProps {
     scopeOverride?: IConstruct;
 }
 export declare class EdgeFunction extends Construct {
-    role: iam.Role;
+    role: Role;
     functionArn: string;
     private scope;
     private versionId;

package/constructs/EdgeFunction.js

@@ -3,7 +3,7 @@ import url from "url";
 import path from "path";
 import crypto from "crypto";
 import { Construct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Effect, Role, Policy, PolicyStatement, CompositePrincipal, ServicePrincipal, ManagedPolicy, } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
 import { Lazy, Duration as CdkDuration, CustomResource, } from "aws-cdk-lib";
@@ -95,10 +95,10 @@ ${exports}
     createRole() {
         const { permissions } = this.props;
         // Create function role
-        const role = new iam.Role(this.scope, `ServerLambdaRole`, {
-            assumedBy: new iam.CompositePrincipal(new iam.ServicePrincipal("lambda.amazonaws.com"), new iam.ServicePrincipal("edgelambda.amazonaws.com")),
+        const role = new Role(this.scope, `ServerLambdaRole`, {
+            assumedBy: new CompositePrincipal(new ServicePrincipal("lambda.amazonaws.com"), new ServicePrincipal("edgelambda.amazonaws.com")),
             managedPolicies: [
-                iam.ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
+                ManagedPolicy.fromManagedPolicyArn(this, "EdgeLambdaPolicy", `arn:${Stack.of(this).partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`),
             ],
         });
         // Attach permission
@@ -150,6 +150,16 @@ ${exports}
         //       They need to be replaced with real values before the Lambda
         //       functions get deployed.
         const stack = Stack.of(this);
+        const policy = new Policy(this, "AssetReplacerPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["s3:GetObject", "s3:PutObject"],
+                    resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+                }),
+            ],
+        });
+        stack.customResourceHandler.role?.attachInlinePolicy(policy);
         const resource = new CustomResource(this.scope, "AssetReplacer", {
             serviceToken: stack.customResourceHandler.functionArn,
             resourceType: "Custom::AssetReplacer",
@@ -159,11 +169,7 @@ ${exports}
                 replacements: this.getLambdaContentReplaceValues(),
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: ["s3:GetObject", "s3:PutObject"],
-            resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
-        }));
+        resource.node.addDependency(policy);
         return resource;
     }
     createSingletonBucketCR() {
@@ -183,8 +189,8 @@ ${exports}
             timeout: CdkDuration.minutes(15),
             memorySize: 1024,
             initialPolicy: [
-                new iam.PolicyStatement({
-                    effect: iam.Effect.ALLOW,
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
                     actions: ["s3:*"],
                     resources: ["*"],
                 }),
@@ -215,8 +221,8 @@ ${exports}
                 timeout: CdkDuration.minutes(15),
                 memorySize: 1024,
                 initialPolicy: [
-                    new iam.PolicyStatement({
-                        effect: iam.Effect.ALLOW,
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
                         actions: ["lambda:*", "s3:*"],
                         resources: ["*"],
                     }),
@@ -253,8 +259,8 @@ ${exports}
                 timeout: CdkDuration.minutes(15),
                 memorySize: 1024,
                 initialPolicy: [
-                    new iam.PolicyStatement({
-                        effect: iam.Effect.ALLOW,
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
                         actions: ["lambda:*"],
                         resources: ["*"],
                     }),

package/constructs/SsrFunction.js

@@ -2,7 +2,7 @@ import url from "url";
 import path from "path";
 import spawn from "cross-spawn";
 import { Construct } from "constructs";
-import * as iam from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import * as logs from "aws-cdk-lib/aws-logs";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
@@ -78,6 +78,16 @@ export class SsrFunction extends Construct {
         //       They need to be replaced with real values before the Lambda
         //       functions get deployed.
         const stack = Stack.of(this);
+        const policy = new Policy(this, "AssetReplacerPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["s3:GetObject", "s3:PutObject"],
+                    resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
+                }),
+            ],
+        });
+        stack.customResourceHandler.role?.attachInlinePolicy(policy);
         const resource = new CustomResource(this, "AssetReplacer", {
             serviceToken: stack.customResourceHandler.functionArn,
             resourceType: "Custom::AssetReplacer",
@@ -87,11 +97,7 @@ export class SsrFunction extends Construct {
                 replacements: this.getLambdaContentReplaceValues(),
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new iam.PolicyStatement({
-            effect: iam.Effect.ALLOW,
-            actions: ["s3:GetObject", "s3:PutObject"],
-            resources: [`arn:${stack.partition}:s3:::${asset.s3BucketName}/*`],
-        }));
+        resource.node.addDependency(policy);
         return resource;
     }
     getLambdaContentReplaceValues() {

package/constructs/SsrSite.js

@@ -8,7 +8,7 @@ import { execSync } from "child_process";
 import { Construct } from "constructs";
 import { Fn, Token, Duration as CdkDuration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import { Bucket } from "aws-cdk-lib/aws-s3";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Function, Code, Runtime, FunctionUrlAuthType, } from "aws-cdk-lib/aws-lambda";
 import { HostedZone, ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
 import { Asset } from "aws-cdk-lib/aws-s3-assets";
@@ -100,8 +100,7 @@ export class SsrSite extends Construct {
             : this.createCloudFrontDistributionForRegional();
         this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
-        const invalidationCR = this.createCloudFrontInvalidation();
-        invalidationCR.node.addDependency(this.distribution);
+        this.createCloudFrontInvalidation();
         // Connect Custom Domain to CloudFront Distribution
         this.createRoute53Records();
     }
@@ -553,6 +552,21 @@ export class SsrSite extends Construct {
     }
     createCloudFrontInvalidation() {
         const stack = Stack.of(this);
+        const policy = new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: [
+                        "cloudfront:GetInvalidation",
+                        "cloudfront:CreateInvalidation",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+                    ],
+                }),
+            ],
+        });
+        stack.customResourceHandler.role?.attachInlinePolicy(policy);
         const resource = new CustomResource(this, "CloudFrontInvalidator", {
             serviceToken: stack.customResourceHandler.functionArn,
             resourceType: "Custom::CloudFrontInvalidator",
@@ -563,16 +577,7 @@ export class SsrSite extends Construct {
                 waitForInvalidation: this.props.waitForInvalidation,
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
-            effect: Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: [
-                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
-            ],
-        }));
+        resource.node.addDependency(policy);
         return resource;
     }
     /////////////////////

package/constructs/StaticSite.js

@@ -7,7 +7,7 @@ import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
-import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
@@ -427,6 +427,21 @@ interface ImportMeta {
             .createHash("md5")
             .update(assets.map(({ assetHash }) => assetHash).join(""))
             .digest("hex");
+        const policy = new Policy(this, "CloudFrontInvalidatorPolicy", {
+            statements: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: [
+                        "cloudfront:GetInvalidation",
+                        "cloudfront:CreateInvalidation",
+                    ],
+                    resources: [
+                        `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
+                    ],
+                }),
+            ],
+        });
+        stack.customResourceHandler.role?.attachInlinePolicy(policy);
         const resource = new CustomResource(this, "CloudFrontInvalidator", {
             serviceToken: stack.customResourceHandler.functionArn,
             resourceType: "Custom::CloudFrontInvalidator",
@@ -437,16 +452,7 @@ interface ImportMeta {
                 waitForInvalidation: this.props.waitForInvalidation,
             },
         });
-        stack.customResourceHandler.role?.addToPrincipalPolicy(new PolicyStatement({
-            effect: Effect.ALLOW,
-            actions: [
-                "cloudfront:GetInvalidation",
-                "cloudfront:CreateInvalidation",
-            ],
-            resources: [
-                `arn:${stack.partition}:cloudfront::${stack.account}:distribution/${this.distribution.distributionId}`,
-            ],
-        }));
+        resource.node.addDependency(policy);
         return resource;
     }
     /////////////////////

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.0.14",
+  "version": "2.0.16",
   "bin": {
     "sst": "cli/sst.js"
   },