sst 2.1.14 → 2.1.15

package/bootstrap.d.ts

@@ -2,4 +2,4 @@ export declare const useBootstrap: () => Promise<{
     version: string;
     bucket: string;
 }>;
-export declare function bootstrapSST(tags: Record<string, string>): Promise<void>;
+export declare function bootstrapSST(tags?: Record<string, string>, publicAccessBlockConfiguration?: boolean): Promise<void>;

package/bootstrap.js

@@ -38,7 +38,7 @@ export const useBootstrap = Context.memo(async () => {
             await bootstrapCDK();
         }
         if (needToBootstrapSST) {
-            await bootstrapSST({});
+            await bootstrapSST();
             // fetch bootstrap status
             sstStatus = await loadSSTStatus();
             if (!sstStatus)
@@ -81,7 +81,11 @@ async function loadCDKStatus() {
         }
     }
 }
-export async function bootstrapSST(tags) {
+export async function bootstrapSST(tags, publicAccessBlockConfiguration) {
+    // Normalize input
+    tags = tags || {};
+    publicAccessBlockConfiguration =
+        publicAccessBlockConfiguration === false ? false : true;
     // Create bootstrap stack
     const project = useProject();
     const app = new App();
@@ -99,7 +103,9 @@ export async function bootstrapSST(tags) {
         encryption: BucketEncryption.S3_MANAGED,
         removalPolicy: RemovalPolicy.DESTROY,
         autoDeleteObjects: true,
-        blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+        blockPublicAccess: publicAccessBlockConfiguration
+            ? BlockPublicAccess.BLOCK_ALL
+            : undefined,
     });
     // Create Function and subscribe to CloudFormation events
     const fn = new Function(stack, "MetadataHandler", {

package/cli/commands/bootstrap.d.ts

@@ -12,4 +12,6 @@ export declare const bootstrap: (program: Program) => import("yargs").Argv<{
     role: string | undefined;
 } & {
     tags: string[] | undefined;
+} & {
+    "public-access-block-configuration": boolean;
 }>;

package/cli/commands/bootstrap.js

@@ -1,7 +1,13 @@
-export const bootstrap = (program) => program.command("bootstrap", "Create the SST bootstrap stack", (yargs) => yargs.option("tags", {
+export const bootstrap = (program) => program.command("bootstrap", "Create the SST bootstrap stack", (yargs) => yargs
+    .option("tags", {
     type: "array",
     string: true,
     describe: "Tags to add for the bootstrap stack",
+})
+    .option("public-access-block-configuration", {
+    type: "boolean",
+    default: true,
+    describe: "Block public access configuration on SST bootstrap bucket",
 }), async (args) => {
     const { createSpinner } = await import("../spinner.js");
     const { Colors } = await import("../colors.js");
@@ -15,7 +21,7 @@ export const bootstrap = (program) => program.command("bootstrap", "Create the S
         Colors.line(`${Colors.primary(`➜`)}  Using tags`, tags);
     }
     const spinner = createSpinner(" Deploying bootstrap stack").start();
-    await bootstrapSST(tags);
+    await bootstrapSST(tags, args.publicAccessBlockConfiguration);
     spinner.succeed(Colors.bold(` Bootstrapped account ${identity.Account} in region ${project.config.region}`));
     process.exit(0);
 });

package/constructs/Stack.js

@@ -164,12 +164,18 @@ export class Stack extends cdk.Stack {
             if (value === undefined) {
                 throw new Error(`The stack output "${key}" is undefined`);
             }
-            else if (typeof value === "string") {
-                new cdk.CfnOutput(this, key, { value });
-            }
-            else {
-                new cdk.CfnOutput(this, key, value);
-            }
+            // Note: add "SSTStackOutput" prefix to the CfnOutput id to ensure the id
+            //       does not thrash w/ construct ids in the stack. So users can do this:
+            //       ```
+            //       const table = new Table(stack, "myTable");
+            //       stack.addOutputs({ myTable: table.name });
+            //       ```
+            //       And then we override the logical id so the actual output name is
+            //       still "myTable".
+            const output = typeof value === "string"
+                ? new cdk.CfnOutput(this, `SSTStackOutput${key}`, { value })
+                : new cdk.CfnOutput(this, `SSTStackOutput${key}`, value);
+            output.overrideLogicalId(key);
         });
     }
     createCustomResourceHandler() {

package/constructs/WebSocketApi.js

@@ -77,9 +77,10 @@ export class WebSocketApi extends Construct {
         return Object.keys(this.functions);
     }
     get _connectionsArn() {
+        this.cdk.webSocketApi.grantManageConnections;
         return Stack.of(this).formatArn({
             service: "execute-api",
-            resourceName: `${this.cdk.webSocketStage.stageName}/POST/*`,
+            resourceName: "*/*/@connections/*",
             resource: this.cdk.webSocketApi.apiId,
         });
     }
@@ -201,7 +202,9 @@ export class WebSocketApi extends Construct {
                     value: this.customDomainUrl || this.url,
                 },
             },
-            permissions: {},
+            permissions: {
+                "execute-api:ManageConnections": [this._connectionsArn],
+            },
         };
     }
     createWebSocketApi() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.1.14",
+  "version": "2.1.15",
   "bin": {
     "sst": "cli/sst.js"
   },

package/sst.mjs

@@ -2809,7 +2809,9 @@ async function loadCDKStatus() {
     }
   }
 }
-async function bootstrapSST(tags) {
+async function bootstrapSST(tags, publicAccessBlockConfiguration) {
+  tags = tags || {};
+  publicAccessBlockConfiguration = publicAccessBlockConfiguration === false ? false : true;
   const project = useProject();
   const app = new App();
   const stack = new Stack(app, STACK_NAME, {
@@ -2824,7 +2826,7 @@ async function bootstrapSST(tags) {
     encryption: BucketEncryption.S3_MANAGED,
     removalPolicy: RemovalPolicy.DESTROY,
     autoDeleteObjects: true,
-    blockPublicAccess: BlockPublicAccess.BLOCK_ALL
+    blockPublicAccess: publicAccessBlockConfiguration ? BlockPublicAccess.BLOCK_ALL : void 0
   });
   const fn = new Function(stack, "MetadataHandler", {
     code: Code.fromAsset(
@@ -3000,7 +3002,7 @@ var init_bootstrap = __esm({
           await bootstrapCDK();
         }
         if (needToBootstrapSST) {
-          await bootstrapSST({});
+          await bootstrapSST();
           sstStatus = await loadSSTStatus();
           if (!sstStatus)
             throw new VisibleError("Failed to load bootstrap stack status");
@@ -7736,6 +7738,10 @@ var bootstrap = (program2) => program2.command(
     type: "array",
     string: true,
     describe: "Tags to add for the bootstrap stack"
+  }).option("public-access-block-configuration", {
+    type: "boolean",
+    default: true,
+    describe: "Block public access configuration on SST bootstrap bucket"
   }),
   async (args) => {
     const { createSpinner: createSpinner2 } = await Promise.resolve().then(() => (init_spinner(), spinner_exports));
@@ -7752,7 +7758,7 @@ var bootstrap = (program2) => program2.command(
       Colors2.line(`${Colors2.primary(`\u279C`)}  Using tags`, tags);
     }
     const spinner = createSpinner2(" Deploying bootstrap stack").start();
-    await bootstrapSST2(tags);
+    await bootstrapSST2(tags, args.publicAccessBlockConfiguration);
     spinner.succeed(
       Colors2.bold(
         ` Bootstrapped account ${identity.Account} in region ${project.config.region}`