sst 2.15.0 → 2.16.0

package/cdk/deployments.js

@@ -0,0 +1,362 @@
+// Copied from https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk/lib/api/cloudformation-deployments.ts
+import * as cxapi from "@aws-cdk/cx-api";
+import * as cdk_assets from "cdk-assets";
+import { AssetManifest } from "cdk-assets";
+import { debug, warning } from "sst-aws-cdk/lib/logging.js";
+import { buildAssets, publishAssets, PublishingAws, EVENT_TO_LOGGER, } from "sst-aws-cdk/lib/util/asset-publishing.js";
+import { Mode } from "sst-aws-cdk/lib/api/aws-auth/credentials.js";
+import { deployStack, destroyStack, makeBodyParameterAndUpload, } from "./deploy-stack.js";
+import { loadCurrentTemplateWithNestedStacks, loadCurrentTemplate, } from "sst-aws-cdk/lib/api/nested-stack-helpers.js";
+import { ToolkitInfo } from "sst-aws-cdk/lib/api/toolkit-info.js";
+import { CloudFormationStack, } from "sst-aws-cdk/lib/api/util/cloudformation.js";
+import { replaceEnvPlaceholders } from "sst-aws-cdk/lib/api/util/placeholders.js";
+import { callWithRetry } from "./util.js";
+/**
+ * Scope for a single set of deployments from a set of Cloud Assembly Artifacts
+ *
+ * Manages lookup of SDKs, Bootstrap stacks, etc.
+ */
+export class Deployments {
+    props;
+    sdkProvider;
+    toolkitInfoCache = new Map();
+    sdkCache = new Map();
+    publisherCache = new Map();
+    constructor(props) {
+        this.props = props;
+        this.sdkProvider = props.sdkProvider;
+    }
+    async readCurrentTemplateWithNestedStacks(rootStackArtifact, retrieveProcessedTemplate = false) {
+        const sdk = (await this.prepareSdkWithLookupOrDeployRole(rootStackArtifact))
+            .stackSdk;
+        return (await loadCurrentTemplateWithNestedStacks(rootStackArtifact, sdk, retrieveProcessedTemplate)).deployedTemplate;
+    }
+    async readCurrentTemplate(stackArtifact) {
+        debug(`Reading existing template for stack ${stackArtifact.displayName}.`);
+        const sdk = (await this.prepareSdkWithLookupOrDeployRole(stackArtifact))
+            .stackSdk;
+        return loadCurrentTemplate(stackArtifact, sdk);
+    }
+    async resourceIdentifierSummaries(stackArtifact, toolkitStackName) {
+        debug(`Retrieving template summary for stack ${stackArtifact.displayName}.`);
+        // Currently, needs to use `deploy-role` since it may need to read templates in the staging
+        // bucket which have been encrypted with a KMS key (and lookup-role may not read encrypted things)
+        const { stackSdk, resolvedEnvironment } = await this.prepareSdkFor(stackArtifact, undefined, Mode.ForReading);
+        const cfn = stackSdk.cloudFormation();
+        const toolkitInfo = await this.lookupToolkit(resolvedEnvironment, stackSdk, toolkitStackName);
+        // Upload the template, if necessary, before passing it to CFN
+        const cfnParam = await makeBodyParameterAndUpload(stackArtifact, resolvedEnvironment, toolkitInfo, this.sdkProvider, stackSdk);
+        const response = await cfn.getTemplateSummary(cfnParam).promise();
+        if (!response.ResourceIdentifierSummaries) {
+            debug('GetTemplateSummary API call did not return "ResourceIdentifierSummaries"');
+        }
+        return response.ResourceIdentifierSummaries ?? [];
+    }
+    async deployStack(options) {
+        let deploymentMethod = options.deploymentMethod;
+        if (options.changeSetName || options.execute !== undefined) {
+            if (deploymentMethod) {
+                throw new Error("You cannot supply both 'deploymentMethod' and 'changeSetName/execute'. Supply one or the other.");
+            }
+            deploymentMethod = {
+                method: "change-set",
+                changeSetName: options.changeSetName,
+                execute: options.execute,
+            };
+        }
+        const { stackSdk, resolvedEnvironment, cloudFormationRoleArn } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
+        const toolkitInfo = await callWithRetry(() => this.lookupToolkit(resolvedEnvironment, stackSdk, options.toolkitStackName));
+        // Do a verification of the bootstrap stack version
+        await this.validateBootstrapStackVersion(options.stack.stackName, options.stack.requiresBootstrapStackVersion, options.stack.bootstrapStackVersionSsmParameter, toolkitInfo);
+        // Deploy assets
+        const assetArtifacts = options.stack.dependencies.filter(cxapi.AssetManifestArtifact.isAssetManifestArtifact);
+        for (const asset of assetArtifacts) {
+            const manifest = AssetManifest.fromFile(asset.file);
+            //await buildAssets(manifest, sdkProvider, resolvedEnvironment, {
+            //});
+            await publishAssets(manifest, this.sdkProvider, resolvedEnvironment, {
+                buildAssets: true,
+                quiet: options.quiet,
+                parallel: options.assetParallelism,
+            });
+        }
+        return deployStack({
+            stack: options.stack,
+            noMonitor: true,
+            resolvedEnvironment,
+            deployName: options.deployName,
+            notificationArns: options.notificationArns,
+            quiet: options.quiet,
+            sdk: stackSdk,
+            sdkProvider: this.sdkProvider,
+            roleArn: cloudFormationRoleArn,
+            reuseAssets: options.reuseAssets,
+            toolkitInfo,
+            tags: options.tags,
+            deploymentMethod,
+            force: options.force,
+            parameters: options.parameters,
+            usePreviousParameters: options.usePreviousParameters,
+            progress: options.progress,
+            ci: options.ci,
+            rollback: options.rollback,
+            hotswap: options.hotswap,
+            extraUserAgent: options.extraUserAgent,
+            resourcesToImport: options.resourcesToImport,
+            overrideTemplate: options.overrideTemplate,
+            assetParallelism: options.assetParallelism,
+        });
+    }
+    async destroyStack(options) {
+        const { stackSdk, cloudFormationRoleArn: roleArn } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
+        return destroyStack({
+            sdk: stackSdk,
+            roleArn,
+            stack: options.stack,
+            deployName: options.deployName,
+            quiet: options.quiet,
+            ci: options.ci,
+        });
+    }
+    async stackExists(options) {
+        const { stackSdk } = await this.prepareSdkFor(options.stack, undefined, Mode.ForReading);
+        const stack = await CloudFormationStack.lookup(stackSdk.cloudFormation(), options.deployName ?? options.stack.stackName);
+        return stack.exists;
+    }
+    async prepareSdkWithLookupOrDeployRole(stackArtifact) {
+        // try to assume the lookup role
+        try {
+            const result = await this.prepareSdkWithLookupRoleFor(stackArtifact);
+            if (result.didAssumeRole) {
+                return {
+                    resolvedEnvironment: result.resolvedEnvironment,
+                    stackSdk: result.sdk,
+                };
+            }
+        }
+        catch { }
+        // fall back to the deploy role
+        return this.prepareSdkFor(stackArtifact, undefined, Mode.ForReading);
+    }
+    /**
+     * Get the environment necessary for touching the given stack
+     *
+     * Returns the following:
+     *
+     * - The resolved environment for the stack (no more 'unknown-account/unknown-region')
+     * - SDK loaded with the right credentials for calling `CreateChangeSet`.
+     * - The Execution Role that should be passed to CloudFormation.
+     */
+    async prepareSdkFor(stack, roleArn, mode) {
+        if (!stack.environment) {
+            throw new Error(`The stack ${stack.displayName} does not have an environment`);
+        }
+        const resolvedEnvironment = await this.sdkProvider.resolveEnvironment(stack.environment);
+        // Substitute any placeholders with information about the current environment
+        const arns = await replaceEnvPlaceholders({
+            assumeRoleArn: stack.assumeRoleArn,
+            // Use the override if given, otherwise use the field from the stack
+            cloudFormationRoleArn: roleArn ?? stack.cloudFormationExecutionRoleArn,
+        }, resolvedEnvironment, this.sdkProvider);
+        const stackSdk = await this.cachedSdkForEnvironment(resolvedEnvironment, mode, {
+            assumeRoleArn: arns.assumeRoleArn,
+            assumeRoleExternalId: stack.assumeRoleExternalId,
+        });
+        return {
+            stackSdk: stackSdk.sdk,
+            resolvedEnvironment,
+            cloudFormationRoleArn: arns.cloudFormationRoleArn,
+        };
+    }
+    /**
+     * Try to use the bootstrap lookupRole. There are two scenarios that are handled here
+     *  1. The lookup role may not exist (it was added in bootstrap stack version 7)
+     *  2. The lookup role may not have the correct permissions (ReadOnlyAccess was added in
+     *      bootstrap stack version 8)
+     *
+     * In the case of 1 (lookup role doesn't exist) `forEnvironment` will either:
+     *   1. Return the default credentials if the default credentials are for the stack account
+     *   2. Throw an error if the default credentials are not for the stack account.
+     *
+     * If we successfully assume the lookup role we then proceed to 2 and check whether the bootstrap
+     * stack version is valid. If it is not we throw an error which should be handled in the calling
+     * function (and fallback to use a different role, etc)
+     *
+     * If we do not successfully assume the lookup role, but do get back the default credentials
+     * then return those and note that we are returning the default credentials. The calling
+     * function can then decide to use them or fallback to another role.
+     */
+    async prepareSdkWithLookupRoleFor(stack) {
+        const resolvedEnvironment = await this.sdkProvider.resolveEnvironment(stack.environment);
+        // Substitute any placeholders with information about the current environment
+        const arns = await replaceEnvPlaceholders({
+            lookupRoleArn: stack.lookupRole?.arn,
+        }, resolvedEnvironment, this.sdkProvider);
+        // try to assume the lookup role
+        const warningMessage = `Could not assume ${arns.lookupRoleArn}, proceeding anyway.`;
+        const upgradeMessage = `(To get rid of this warning, please upgrade to bootstrap version >= ${stack.lookupRole?.requiresBootstrapStackVersion})`;
+        try {
+            const stackSdk = await this.cachedSdkForEnvironment(resolvedEnvironment, Mode.ForReading, {
+                assumeRoleArn: arns.lookupRoleArn,
+                assumeRoleExternalId: stack.lookupRole?.assumeRoleExternalId,
+            });
+            // if we succeed in assuming the lookup role, make sure we have the correct bootstrap stack version
+            if (stackSdk.didAssumeRole &&
+                stack.lookupRole?.bootstrapStackVersionSsmParameter &&
+                stack.lookupRole.requiresBootstrapStackVersion) {
+                const version = await ToolkitInfo.versionFromSsmParameter(stackSdk.sdk, stack.lookupRole.bootstrapStackVersionSsmParameter);
+                if (version < stack.lookupRole.requiresBootstrapStackVersion) {
+                    throw new Error(`Bootstrap stack version '${stack.lookupRole.requiresBootstrapStackVersion}' is required, found version '${version}'.`);
+                }
+                // we may not have assumed the lookup role because one was not provided
+                // if that is the case then don't print the upgrade warning
+            }
+            else if (!stackSdk.didAssumeRole &&
+                stack.lookupRole?.requiresBootstrapStackVersion) {
+                warning(upgradeMessage);
+            }
+            return { ...stackSdk, resolvedEnvironment };
+        }
+        catch (e) {
+            debug(e);
+            // only print out the warnings if the lookupRole exists AND there is a required
+            // bootstrap version, otherwise the warnings will print `undefined`
+            if (stack.lookupRole && stack.lookupRole.requiresBootstrapStackVersion) {
+                warning(warningMessage);
+                warning(upgradeMessage);
+            }
+            throw e;
+        }
+    }
+    /**
+     * Look up the toolkit for a given environment, using a given SDK
+     */
+    async lookupToolkit(resolvedEnvironment, sdk, toolkitStackName) {
+        const key = `${resolvedEnvironment.account}:${resolvedEnvironment.region}:${toolkitStackName}`;
+        const existing = this.toolkitInfoCache.get(key);
+        if (existing) {
+            return existing;
+        }
+        const ret = await ToolkitInfo.lookup(resolvedEnvironment, sdk, toolkitStackName);
+        this.toolkitInfoCache.set(key, ret);
+        return ret;
+    }
+    async prepareAndValidateAssets(asset, options) {
+        const { stackSdk, resolvedEnvironment } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
+        const toolkitInfo = await this.lookupToolkit(resolvedEnvironment, stackSdk, options.toolkitStackName);
+        const stackEnv = await this.sdkProvider.resolveEnvironment(options.stack.environment);
+        await this.validateBootstrapStackVersion(options.stack.stackName, asset.requiresBootstrapStackVersion, asset.bootstrapStackVersionSsmParameter, toolkitInfo);
+        const manifest = AssetManifest.fromFile(asset.file);
+        return { manifest, stackEnv };
+    }
+    /**
+     * Build all assets in a manifest
+     *
+     * @deprecated Use `buildSingleAsset` instead
+     */
+    async buildAssets(asset, options) {
+        const { manifest, stackEnv } = await this.prepareAndValidateAssets(asset, options);
+        await buildAssets(manifest, this.sdkProvider, stackEnv, options.buildOptions);
+    }
+    /**
+     * Publish all assets in a manifest
+     *
+     * @deprecated Use `publishSingleAsset` instead
+     */
+    async publishAssets(asset, options) {
+        const { manifest, stackEnv } = await this.prepareAndValidateAssets(asset, options);
+        await publishAssets(manifest, this.sdkProvider, stackEnv, options.publishOptions);
+    }
+    /**
+     * Build a single asset from an asset manifest
+     */
+    // eslint-disable-next-line max-len
+    async buildSingleAsset(assetArtifact, assetManifest, asset, options) {
+        const { stackSdk, resolvedEnvironment: stackEnv } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
+        const toolkitInfo = await this.lookupToolkit(stackEnv, stackSdk, options.toolkitStackName);
+        await this.validateBootstrapStackVersion(options.stack.stackName, assetArtifact.requiresBootstrapStackVersion, assetArtifact.bootstrapStackVersionSsmParameter, toolkitInfo);
+        const publisher = this.cachedPublisher(assetManifest, stackEnv, options.stackName);
+        await publisher.buildEntry(asset);
+    }
+    /**
+     * Publish a single asset from an asset manifest
+     */
+    // eslint-disable-next-line max-len
+    async publishSingleAsset(assetManifest, asset, options) {
+        const { resolvedEnvironment: stackEnv } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
+        // No need to validate anymore, we already did that during build
+        const publisher = this.cachedPublisher(assetManifest, stackEnv, options.stackName);
+        await publisher.publishEntry(asset);
+    }
+    /**
+     * Return whether a single asset has been published already
+     */
+    async isSingleAssetPublished(assetManifest, asset, options) {
+        const { resolvedEnvironment: stackEnv } = await this.prepareSdkFor(options.stack, options.roleArn, Mode.ForWriting);
+        const publisher = this.cachedPublisher(assetManifest, stackEnv, options.stackName);
+        return publisher.isEntryPublished(asset);
+    }
+    /**
+     * Validate that the bootstrap stack has the right version for this stack
+     */
+    async validateBootstrapStackVersion(stackName, requiresBootstrapStackVersion, bootstrapStackVersionSsmParameter, toolkitInfo) {
+        if (requiresBootstrapStackVersion === undefined) {
+            return;
+        }
+        try {
+            await toolkitInfo.validateVersion(requiresBootstrapStackVersion, bootstrapStackVersionSsmParameter);
+        }
+        catch (e) {
+            throw new Error(`${stackName}: ${e.message}`);
+        }
+    }
+    async cachedSdkForEnvironment(environment, mode, options) {
+        const cacheKey = [
+            environment.account,
+            environment.region,
+            `${mode}`,
+            options?.assumeRoleArn ?? "",
+            options?.assumeRoleExternalId ?? "",
+        ].join(":");
+        const existing = this.sdkCache.get(cacheKey);
+        if (existing) {
+            return existing;
+        }
+        const ret = await this.sdkProvider.forEnvironment(environment, mode, options);
+        this.sdkCache.set(cacheKey, ret);
+        return ret;
+    }
+    cachedPublisher(assetManifest, env, stackName) {
+        const existing = this.publisherCache.get(assetManifest);
+        if (existing) {
+            return existing;
+        }
+        const prefix = stackName ? `${stackName}: ` : "";
+        const publisher = new cdk_assets.AssetPublishing(assetManifest, {
+            aws: new PublishingAws(this.sdkProvider, env),
+            progressListener: new ParallelSafeAssetProgress(prefix, this.props.quiet ?? false),
+        });
+        this.publisherCache.set(assetManifest, publisher);
+        return publisher;
+    }
+}
+/**
+ * Asset progress that doesn't do anything with percentages (currently)
+ */
+class ParallelSafeAssetProgress {
+    prefix;
+    quiet;
+    constructor(prefix, quiet) {
+        this.prefix = prefix;
+        this.quiet = quiet;
+    }
+    onPublishEvent(type, event) {
+        const handler = this.quiet && type !== "fail" ? debug : EVENT_TO_LOGGER[type];
+        handler(`${this.prefix} ${type}: ${event.message}`);
+    }
+}
+/**
+ * @deprecated Use 'Deployments' instead
+ */
+export class CloudFormationDeployments extends Deployments {
+}

package/constructs/RDS.d.ts

@@ -1,7 +1,7 @@
 import { Construct } from "constructs";
-import * as ec2 from "aws-cdk-lib/aws-ec2";
-import * as rds from "aws-cdk-lib/aws-rds";
-import * as secretsManager from "aws-cdk-lib/aws-secretsmanager";
+import { IVpc } from "aws-cdk-lib/aws-ec2";
+import { AuroraCapacityUnit, Endpoint, IServerlessCluster, ServerlessCluster, ServerlessClusterProps } from "aws-cdk-lib/aws-rds";
+import { ISecret } from "aws-cdk-lib/aws-secretsmanager";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn } from "./Function.js";
 import { FunctionBindingProps } from "./util/functionBinding.js";
@@ -44,13 +44,13 @@ export interface RDSProps {
          *
          * @default "ACU_2"
          */
-        minCapacity?: keyof typeof rds.AuroraCapacityUnit;
+        minCapacity?: keyof typeof AuroraCapacityUnit;
         /**
          * The maximum capacity for the cluster.
          *
          * @default "ACU_16"
          */
-        maxCapacity?: keyof typeof rds.AuroraCapacityUnit;
+        maxCapacity?: keyof typeof AuroraCapacityUnit;
     };
     /**
      * Path to the directory that contains the migration scripts. The `RDS` construct uses [Kysely](https://kysely-org.github.io/kysely/) to run and manage schema migrations. The `migrations` prop should point to the folder where your migration files are.
@@ -128,16 +128,16 @@ export interface RDSProps {
          * });
          * ```
          */
-        cluster?: rds.IServerlessCluster | RDSCdkServerlessClusterProps;
+        cluster?: IServerlessCluster | RDSCdkServerlessClusterProps;
         /**
          * Required when importing existing RDS Serverless v1 Cluster.
          */
-        secret?: secretsManager.ISecret;
+        secret?: ISecret;
     };
 }
 export type RDSEngineType = RDSProps["engine"];
-export interface RDSCdkServerlessClusterProps extends Omit<rds.ServerlessClusterProps, "vpc" | "engine" | "defaultDatabaseName" | "scaling"> {
-    vpc?: ec2.IVpc;
+export interface RDSCdkServerlessClusterProps extends Omit<ServerlessClusterProps, "vpc" | "engine" | "defaultDatabaseName" | "scaling"> {
+    vpc?: IVpc;
 }
 /**
  * The `RDS` construct is a higher level CDK construct that makes it easy to create an [RDS Serverless Cluster](https://aws.amazon.com/rds/).
@@ -159,7 +159,7 @@ export declare class RDS extends Construct implements SSTConstruct {
         /**
          * The ARN of the internally created CDK ServerlessCluster instance.
          */
-        cluster: rds.ServerlessCluster;
+        cluster: ServerlessCluster;
     };
     /**
      * The ARN of the internally created CDK ServerlessCluster instance.
@@ -179,7 +179,7 @@ export declare class RDS extends Construct implements SSTConstruct {
     /**
      * The ARN of the internally created RDS Serverless Cluster.
      */
-    get clusterEndpoint(): rds.Endpoint;
+    get clusterEndpoint(): Endpoint;
     /**
      * The default database name of the RDS Serverless Cluster.
      */

package/constructs/RDS.js

@@ -5,9 +5,11 @@ import url from "url";
 import * as crypto from "crypto";
 import { Construct } from "constructs";
 import { Duration as CDKDuration, CustomResource } from "aws-cdk-lib/core";
-import * as ec2 from "aws-cdk-lib/aws-ec2";
-import * as rds from "aws-cdk-lib/aws-rds";
-import * as lambda from "aws-cdk-lib/aws-lambda";
+import { SubnetType, Vpc } from "aws-cdk-lib/aws-ec2";
+import { AuroraCapacityUnit, AuroraEngineVersion, AuroraMysqlEngineVersion, AuroraPostgresEngineVersion, DatabaseClusterEngine, ServerlessCluster, } from "aws-cdk-lib/aws-rds";
+import { Code, Function, Runtime } from "aws-cdk-lib/aws-lambda";
+import { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Stack } from "./Stack.js";
 import { getFunctionRef, isCDKConstruct } from "./Construct.js";
 import { Function as Fn } from "./Function.js";
 const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
@@ -185,33 +187,33 @@ export class RDS extends Construct {
     }
     getEngine(engine) {
         if (engine === "mysql5.6") {
-            return rds.DatabaseClusterEngine.aurora({
-                version: rds.AuroraEngineVersion.VER_10A,
+            return DatabaseClusterEngine.aurora({
+                version: AuroraEngineVersion.VER_10A,
             });
         }
         else if (engine === "mysql5.7") {
-            return rds.DatabaseClusterEngine.auroraMysql({
-                version: rds.AuroraMysqlEngineVersion.VER_2_07_1,
+            return DatabaseClusterEngine.auroraMysql({
+                version: AuroraMysqlEngineVersion.VER_2_07_1,
             });
         }
         else if (engine === "postgresql10.14") {
-            return rds.DatabaseClusterEngine.auroraPostgres({
-                version: rds.AuroraPostgresEngineVersion.VER_10_14,
+            return DatabaseClusterEngine.auroraPostgres({
+                version: AuroraPostgresEngineVersion.VER_10_14,
             });
         }
         else if (engine === "postgresql11.13") {
-            return rds.DatabaseClusterEngine.auroraPostgres({
-                version: rds.AuroraPostgresEngineVersion.VER_11_13,
+            return DatabaseClusterEngine.auroraPostgres({
+                version: AuroraPostgresEngineVersion.VER_11_13,
             });
         }
         else if (engine === "postgresql11.16") {
-            return rds.DatabaseClusterEngine.auroraPostgres({
-                version: rds.AuroraPostgresEngineVersion.VER_11_16,
+            return DatabaseClusterEngine.auroraPostgres({
+                version: AuroraPostgresEngineVersion.VER_11_16,
             });
         }
         else if (engine === "postgresql13.9") {
-            return rds.DatabaseClusterEngine.auroraPostgres({
-                version: rds.AuroraPostgresEngineVersion.VER_13_9,
+            return DatabaseClusterEngine.auroraPostgres({
+                version: AuroraPostgresEngineVersion.VER_13_9,
             });
         }
         throw new Error(`The specified "engine" is not supported for sst.RDS. Only mysql5.6, mysql5.7, postgresql11.13, postgresql11.16, and postgres13.9 engines are currently supported.`);
@@ -223,15 +225,15 @@ export class RDS extends Construct {
                 : scaling?.autoPause === true || scaling?.autoPause === undefined
                     ? CDKDuration.minutes(5)
                     : CDKDuration.minutes(scaling?.autoPause),
-            minCapacity: rds.AuroraCapacityUnit[scaling?.minCapacity || "ACU_2"],
-            maxCapacity: rds.AuroraCapacityUnit[scaling?.maxCapacity || "ACU_16"],
+            minCapacity: AuroraCapacityUnit[scaling?.minCapacity || "ACU_2"],
+            maxCapacity: AuroraCapacityUnit[scaling?.maxCapacity || "ACU_16"],
         };
     }
     getVpc(props) {
         if (props.vpc) {
             return props.vpc;
         }
-        return new ec2.Vpc(this, "vpc", {
+        return new Vpc(this, "vpc", {
             natGateways: 0,
         });
     }
@@ -240,14 +242,14 @@ export class RDS extends Construct {
             return props.vpcSubnets;
         }
         return {
-            subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+            subnetType: SubnetType.PRIVATE_ISOLATED,
         };
     }
     createCluster() {
         const { engine, defaultDatabaseName, scaling, cdk } = this.props;
         const app = this.node.root;
         const clusterProps = (cdk?.cluster || {});
-        return new rds.ServerlessCluster(this, "Cluster", {
+        return new ServerlessCluster(this, "Cluster", {
             clusterIdentifier: app.logicalPrefixedName(this.node.id),
             ...clusterProps,
             defaultDatabaseName: defaultDatabaseName,
@@ -307,12 +309,18 @@ export class RDS extends Construct {
     createMigrationCustomResource(migrations) {
         const app = this.node.root;
         // Create custom resource handler
-        const handler = new lambda.Function(this, "MigrationHandler", {
-            code: lambda.Code.fromAsset(path.join(__dirname, "../support/script-function")),
-            runtime: lambda.Runtime.NODEJS_16_X,
+        const handler = new Function(this, "MigrationHandler", {
+            code: Code.fromAsset(path.join(__dirname, "../support/script-function")),
+            runtime: Runtime.NODEJS_16_X,
             handler: "index.handler",
             timeout: CDKDuration.minutes(15),
             memorySize: 1024,
+            initialPolicy: [
+                new PolicyStatement({
+                    actions: ["cloudformation:DescribeStacks"],
+                    resources: [Stack.of(this).stackId],
+                }),
+            ],
         });
         this.migratorFunction?.grantInvoke(handler);
         // Note: "MigrationsHash" is generated to ensure the Custom Resource function

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.15.0",
+  "version": "2.16.0",
   "bin": {
     "sst": "cli/sst.js"
   },
@@ -25,12 +25,12 @@
   },
   "homepage": "https://sst.dev",
   "dependencies": {
-    "@aws-cdk/aws-apigatewayv2-alpha": "^2.79.1-alpha.0",
-    "@aws-cdk/aws-apigatewayv2-authorizers-alpha": "^2.79.1-alpha.0",
-    "@aws-cdk/aws-apigatewayv2-integrations-alpha": "^2.79.1-alpha.0",
-    "@aws-cdk/cloud-assembly-schema": "2.79.1",
-    "@aws-cdk/cloudformation-diff": "2.79.1",
-    "@aws-cdk/cx-api": "2.79.1",
+    "@aws-cdk/aws-apigatewayv2-alpha": "^2.84.0-alpha.0",
+    "@aws-cdk/aws-apigatewayv2-authorizers-alpha": "^2.84.0-alpha.0",
+    "@aws-cdk/aws-apigatewayv2-integrations-alpha": "^2.84.0-alpha.0",
+    "@aws-cdk/cloud-assembly-schema": "2.84.0",
+    "@aws-cdk/cloudformation-diff": "2.84.0",
+    "@aws-cdk/cx-api": "2.84.0",
     "@aws-sdk/client-cloudformation": "^3.279.0",
     "@aws-sdk/client-eventbridge": "^3.342.0",
     "@aws-sdk/client-iam": "^3.279.0",
@@ -52,11 +52,11 @@
     "@babel/plugin-syntax-typescript": "^7.21.4",
     "@trpc/server": "9.16.0",
     "adm-zip": "^0.5.10",
-    "aws-cdk-lib": "2.79.1",
+    "aws-cdk-lib": "2.84.0",
     "aws-iot-device-sdk": "^2.2.12",
     "aws-sdk": "^2.1326.0",
     "builtin-modules": "3.2.0",
-    "cdk-assets": "2.79.1",
+    "cdk-assets": "2.84.0",
     "chalk": "^5.2.0",
     "chokidar": "^3.5.3",
     "ci-info": "^3.7.0",
@@ -84,7 +84,7 @@
     "ora": "^6.1.2",
     "react": "18.2.0",
     "remeda": "^1.3.0",
-    "sst-aws-cdk": "2.62.2-3",
+    "sst-aws-cdk": "2.84.0",
     "tree-kill": "^1.2.2",
     "undici": "^5.12.0",
     "uuid": "^9.0.0",