sst 2.0.27 → 2.0.29

package/constructs/NextjsSite.js

@@ -10,6 +10,7 @@ import { SsrFunction } from "./SsrFunction.js";
 import { EdgeFunction } from "./EdgeFunction.js";
 import { SsrSite } from "./SsrSite.js";
 import { toCdkSize } from "./util/size.js";
+import { PolicyStatement } from "aws-cdk-lib/aws-iam";
 const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
 /**
  * The `NextjsSite` construct is a higher level CDK construct that makes it easy to create a Next.js app.
@@ -72,6 +73,12 @@ export class NextjsSite extends SsrSite {
             environment: {
                 BUCKET_NAME: this.cdk.bucket.bucketName,
             },
+            initialPolicy: [
+                new PolicyStatement({
+                    actions: ["s3:GetObject"],
+                    resources: [this.cdk.bucket.arnForObjects("*")],
+                }),
+            ],
         });
     }
     createMiddlewareEdgeFunctionForRegional() {

package/constructs/SsrSite.js

@@ -7,7 +7,7 @@ import spawn from "cross-spawn";
 import { execSync } from "child_process";
 import { Construct } from "constructs";
 import { Fn, Token, Duration as CdkDuration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
-import { Bucket } from "aws-cdk-lib/aws-s3";
+import { BlockPublicAccess, Bucket, } from "aws-cdk-lib/aws-s3";
 import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Function, Code, Runtime, FunctionUrlAuthType, } from "aws-cdk-lib/aws-lambda";
 import { HostedZone, ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
@@ -330,7 +330,8 @@ export class SsrSite extends Construct {
         else {
             const bucketProps = cdk?.bucket;
             return new Bucket(this, "S3Bucket", {
-                publicReadAccess: true,
+                publicReadAccess: false,
+                blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
                 autoDeleteObjects: true,
                 removalPolicy: RemovalPolicy.DESTROY,
                 ...bucketProps,

package/constructs/StaticSite.d.ts

@@ -1,8 +1,8 @@
 import { Construct } from "constructs";
-import * as s3 from "aws-cdk-lib/aws-s3";
-import * as acm from "aws-cdk-lib/aws-certificatemanager";
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
+import { Bucket, BucketProps, IBucket } from "aws-cdk-lib/aws-s3";
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import { IHostedZone } from "aws-cdk-lib/aws-route53";
+import { Distribution } from "aws-cdk-lib/aws-cloudfront";
 import { BaseSiteDomainProps, BaseSiteReplaceProps, BaseSiteCdkDistributionProps } from "./BaseSite.js";
 import { SSTConstruct } from "./Construct.js";
 import { FunctionBindingProps } from "./util/functionBinding.js";
@@ -240,7 +240,7 @@ export interface StaticSiteProps {
          * });
          * ```
          */
-        bucket?: s3.BucketProps | s3.IBucket;
+        bucket?: BucketProps | IBucket;
         /**
          * Configure the internally created CDK `Distribution` instance.
          *
@@ -301,10 +301,10 @@ export declare class StaticSite extends Construct implements SSTConstruct {
      * The internally created CDK resources.
      */
     get cdk(): {
-        bucket: s3.Bucket;
-        distribution: cloudfront.Distribution;
-        hostedZone: route53.IHostedZone | undefined;
-        certificate: acm.ICertificate | undefined;
+        bucket: Bucket;
+        distribution: Distribution;
+        hostedZone: IHostedZone | undefined;
+        certificate: ICertificate | undefined;
     };
     getConstructMetadata(): {
         type: "StaticSite";
@@ -325,7 +325,7 @@ export declare class StaticSite extends Construct implements SSTConstruct {
     private createCfDistribution;
     private createCloudFrontInvalidation;
     protected validateCustomDomainSettings(): void;
-    protected lookupHostedZone(): route53.IHostedZone | undefined;
+    protected lookupHostedZone(): IHostedZone | undefined;
     private createCertificate;
     protected createRoute53Records(): void;
     private getS3ContentReplaceValues;

package/constructs/StaticSite.js

@@ -5,14 +5,14 @@ import crypto from "crypto";
 import { execSync } from "child_process";
 import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
-import * as s3 from "aws-cdk-lib/aws-s3";
-import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
+import { BlockPublicAccess, Bucket, } from "aws-cdk-lib/aws-s3";
+import { Asset } from "aws-cdk-lib/aws-s3-assets";
 import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
-import * as lambda from "aws-cdk-lib/aws-lambda";
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
-import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
-import * as cfOrigins from "aws-cdk-lib/aws-cloudfront-origins";
+import { Code, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { HostedZone, ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
+import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
+import { Distribution, ViewerProtocolPolicy } from "aws-cdk-lib/aws-cloudfront";
+import { S3Origin } from "aws-cdk-lib/aws-cloudfront-origins";
 import { AwsCliLayer } from "aws-cdk-lib/lambda-layer-awscli";
 import { Stack } from "./Stack.js";
 import { getBuildCmdEnvironment, buildErrorResponsesFor404ErrorPage, buildErrorResponsesForRedirectToIndex, } from "./BaseSite.js";
@@ -252,7 +252,7 @@ interface ImportMeta {
             if (!fs.existsSync(zipFilePath)) {
                 break;
             }
-            assets.push(new s3Assets.Asset(this, `Asset${partId}`, {
+            assets.push(new Asset(this, `Asset${partId}`, {
                 path: zipFilePath,
             }));
         }
@@ -268,7 +268,7 @@ interface ImportMeta {
         if (!fs.existsSync(filenamesPath)) {
             throw new Error(`There was a problem generating the "${this.node.id}" StaticSite package.`);
         }
-        return new s3Assets.Asset(this, `AssetFilenames`, {
+        return new Asset(this, `AssetFilenames`, {
             path: filenamesPath,
         });
     }
@@ -288,7 +288,9 @@ interface ImportMeta {
             if (bucketProps?.websiteErrorDocument) {
                 throw new Error(`Do not configure the "s3Bucket.websiteErrorDocument". Use the "errorPage" to configure the StaticSite index page.`);
             }
-            return new s3.Bucket(this, "S3Bucket", {
+            return new Bucket(this, "S3Bucket", {
+                publicReadAccess: false,
+                blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
                 autoDeleteObjects: true,
                 removalPolicy: RemovalPolicy.DESTROY,
                 ...bucketProps,
@@ -309,10 +311,10 @@ interface ImportMeta {
             },
         ];
         // Create a Lambda function that will be doing the uploading
-        const uploader = new lambda.Function(this, "S3Uploader", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
+        const uploader = new Function(this, "S3Uploader", {
+            code: Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
             layers: [cliLayer],
-            runtime: lambda.Runtime.PYTHON_3_7,
+            runtime: Runtime.PYTHON_3_7,
             handler: "s3-upload.handler",
             timeout: Duration.minutes(15),
             memorySize: 1024,
@@ -320,10 +322,10 @@ interface ImportMeta {
         this.bucket.grantReadWrite(uploader);
         assets.forEach((asset) => asset.grantRead(uploader));
         // Create the custom resource function
-        const handler = new lambda.Function(this, "S3Handler", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
+        const handler = new Function(this, "S3Handler", {
+            code: Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
             layers: [cliLayer],
-            runtime: lambda.Runtime.PYTHON_3_7,
+            runtime: Runtime.PYTHON_3_7,
             handler: "s3-handler.handler",
             timeout: Duration.minutes(15),
             memorySize: 1024,
@@ -403,7 +405,7 @@ interface ImportMeta {
         const { cdk, errorPage } = this.props;
         const indexPage = this.props.indexPage || "index.html";
         // Create CloudFront distribution
-        return new cloudfront.Distribution(this, "Distribution", {
+        return new Distribution(this, "Distribution", {
             // these values can be overwritten by cfDistributionProps
             defaultRootObject: indexPage,
             errorResponses: !errorPage || errorPage === "redirect_to_index_page"
@@ -414,8 +416,8 @@ interface ImportMeta {
             domainNames: this.buildDistributionDomainNames(),
             certificate: this.certificate,
             defaultBehavior: {
-                origin: new cfOrigins.S3Origin(this.bucket),
-                viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+                origin: new S3Origin(this.bucket),
+                viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
                 ...cdk?.distribution?.defaultBehavior,
             },
         });
@@ -486,7 +488,7 @@ interface ImportMeta {
         }
         let hostedZone;
         if (typeof customDomain === "string") {
-            hostedZone = route53.HostedZone.fromLookup(this, "HostedZone", {
+            hostedZone = HostedZone.fromLookup(this, "HostedZone", {
                 domainName: customDomain,
             });
         }
@@ -494,7 +496,7 @@ interface ImportMeta {
             hostedZone = customDomain.cdk.hostedZone;
         }
         else if (typeof customDomain.hostedZone === "string") {
-            hostedZone = route53.HostedZone.fromLookup(this, "HostedZone", {
+            hostedZone = HostedZone.fromLookup(this, "HostedZone", {
                 domainName: customDomain.hostedZone,
             });
         }
@@ -503,7 +505,7 @@ interface ImportMeta {
             if (customDomain.isExternalDomain === true) {
                 return;
             }
-            hostedZone = route53.HostedZone.fromLookup(this, "HostedZone", {
+            hostedZone = HostedZone.fromLookup(this, "HostedZone", {
                 domainName: customDomain.domainName,
             });
         }
@@ -564,10 +566,10 @@ interface ImportMeta {
         const recordProps = {
             recordName,
             zone: this.hostedZone,
-            target: route53.RecordTarget.fromAlias(new route53Targets.CloudFrontTarget(this.distribution)),
+            target: RecordTarget.fromAlias(new CloudFrontTarget(this.distribution)),
         };
-        new route53.ARecord(this, "AliasRecord", recordProps);
-        new route53.AaaaRecord(this, "AliasRecordAAAA", recordProps);
+        new ARecord(this, "AliasRecord", recordProps);
+        new AaaaRecord(this, "AliasRecordAAAA", recordProps);
         // Create Alias redirect record
         if (domainAlias) {
             new HttpsRedirect(this, "Redirect", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.0.27",
+  "version": "2.0.29",
   "bin": {
     "sst": "cli/sst.js"
   },