sst 2.20.1 → 2.21.1

package/constructs/Function.d.ts

@@ -79,8 +79,9 @@ export interface FunctionProps extends Omit<FunctionOptions, "functionName" | "m
      */
     python?: PythonProps;
     /**
-     * Used to configure image function properties
+     * Used to configure container function properties
      */
+    container?: ContainerProps;
     /**
      * Hooks to run before and after function builds
      */
@@ -507,6 +508,18 @@ export interface JavaProps {
      */
     experimentalUseProvidedRuntime?: "provided" | "provided.al2";
 }
+export interface ContainerProps {
+    /**
+     * Specify or override the CMD on the Docker image.
+     * @example
+     * ```js
+     * container: {
+     *   cmd: ["index.handler"]
+     * }
+     * ```
+     */
+    cmd?: string[];
+}
 /**
  * Used to configure additional files to copy into the function bundle
  *

package/constructs/Function.js

@@ -208,6 +208,7 @@ export class Function extends CDKFunction {
                             ...(architecture?.dockerPlatform
                                 ? { platform: Platform.custom(architecture.dockerPlatform) }
                                 : {}),
+                            ...(props.container?.cmd ? { cmd: props.container.cmd } : {}),
                         }),
                         handler: CDKHandler.FROM_IMAGE,
                         runtime: CDKRuntime.FROM_IMAGE,

package/constructs/Job.d.ts

@@ -1,7 +1,8 @@
 import { Construct } from "constructs";
+import { Function as CdkFunction } from "aws-cdk-lib/aws-lambda";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { SSTConstruct } from "./Construct.js";
-import { Function, NodeJSProps, FunctionCopyFilesProps } from "./Function.js";
+import { NodeJSProps, FunctionCopyFilesProps } from "./Function.js";
 import { Duration } from "./util/duration.js";
 import { Permissions } from "./util/permission.js";
 import { FunctionBindingProps } from "./util/functionBinding.js";
@@ -9,10 +10,34 @@ import { ISecurityGroup, IVpc, SubnetSelection } from "aws-cdk-lib/aws-ec2";
 export type JobMemorySize = "3 GB" | "7 GB" | "15 GB" | "145 GB";
 export interface JobNodeJSProps extends NodeJSProps {
 }
+export interface JobContainerProps {
+    /**
+     * Specify or override the CMD on the Docker image.
+     * @example
+     * ```js
+     * container: {
+     *   cmd: ["python3", "my_script.py"]
+     * }
+     * ```
+     */
+    cmd: string[];
+}
 export interface JobProps {
     /**
-     * Path to the entry point and handler function. Of the format:
-     * `/path/to/file.function`.
+     * The runtime environment for the job.
+     * @default "nodejs"
+     * @example
+     * ```js
+     * new Function(stack, "Function", {
+     *   runtime: "container",
+     *   handler: "src/job",
+     * })
+     *```
+     */
+    runtime?: "nodejs" | "container";
+    /**
+     * For "nodejs" runtime, point to the entry point and handler function.
+     * Of the format: `/path/to/file.function`.
      *
      * @example
      * ```js
@@ -20,6 +45,17 @@ export interface JobProps {
      *   handler: "src/job.handler",
      * })
      *```
+     *
+     * For "container" runtime, point the handler to the directory containing
+     * the Dockerfile.
+     *
+     * @example
+     * ```js
+     * new Job(stack, "MyJob", {
+     *   runtime: "container",
+     *   handler: "src/job", // Dockerfile is at "src/job/Dockerfile"
+     * })
+     *```
      */
     handler: string;
     /**
@@ -65,6 +101,10 @@ export interface JobProps {
      * Used to configure nodejs function properties
      */
     nodejs?: JobNodeJSProps;
+    /**
+     * Used to configure container properties
+     */
+    container?: JobContainerProps;
     /**
      * Can be used to disable Live Lambda Development when using `sst start`. Useful for things like Custom Resources that need to execute during deployment.
      *
@@ -204,10 +244,10 @@ export interface JobProps {
  */
 export declare class Job extends Construct implements SSTConstruct {
     readonly id: string;
-    private readonly localId;
     private readonly props;
     private readonly job;
-    readonly _jobInvoker: Function;
+    private readonly liveDevJob?;
+    readonly _jobManager: CdkFunction;
     constructor(scope: Construct, id: string, props: JobProps);
     getConstructMetadata(): {
         type: "Job";
@@ -246,15 +286,16 @@ export declare class Job extends Construct implements SSTConstruct {
      * ```
      */
     addEnvironment(name: string, value: string): void;
-    private createCodeBuildProject;
+    private createCodeBuildJob;
+    private createLiveDevJob;
     private createLogRetention;
     private buildCodeBuildProjectCode;
-    private updateCodeBuildProjectCode;
-    private createLocalInvoker;
-    private createCodeBuildInvoker;
+    private createJobManager;
     private bindForCodeBuild;
     private attachPermissionsForCodeBuild;
     private addEnvironmentForCodeBuild;
+    private validateContainerProps;
     private normalizeMemorySize;
     private normalizeTimeout;
+    private convertJobRuntimeToFunctionRuntime;
 }

package/constructs/Job.js

@@ -2,8 +2,9 @@ import url from "url";
 import path from "path";
 import fs from "fs/promises";
 import { Construct } from "constructs";
+import { Duration as CdkDuration } from "aws-cdk-lib/core";
 import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
-import { AssetCode } from "aws-cdk-lib/aws-lambda";
+import { AssetCode, Code, Runtime, Function as CdkFunction, } from "aws-cdk-lib/aws-lambda";
 import { Project, LinuxBuildImage, BuildSpec, ComputeType, } from "aws-cdk-lib/aws-codebuild";
 import { RetentionDays, LogRetention } from "aws-cdk-lib/aws-logs";
 import { Stack } from "./Stack.js";
@@ -14,6 +15,7 @@ import { bindEnvironment, bindPermissions, getReferencedSecrets, } from "./util/
 import { useDeferredTasks } from "./deferred_task.js";
 import { useProject } from "../project.js";
 import { useRuntimeHandlers } from "../runtime/handlers.js";
+import { Platform } from "aws-cdk-lib/aws-ecr-assets";
 const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
 /////////////////////
 // Construct
@@ -34,43 +36,40 @@ const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
  */
 export class Job extends Construct {
     id;
-    localId;
     props;
     job;
-    _jobInvoker;
+    liveDevJob;
+    _jobManager;
     constructor(scope, id, props) {
         super(scope, props.cdk?.id || id);
         const app = this.node.root;
         const stack = Stack.of(scope);
         this.id = id;
         this.props = props;
-        useFunctions().add(this.node.addr, {
-            ...props,
-            runtime: "nodejs16.x",
-        });
-        this.localId = path.posix
-            .join(scope.node.path, id)
-            .replace(/\$/g, "-")
-            .replace(/\//g, "-")
-            .replace(/\./g, "-");
         const isLiveDevEnabled = app.mode === "dev" && (this.props.enableLiveDev === false ? false : true);
-        this.job = this.createCodeBuildProject();
-        this.createLogRetention();
+        this.validateContainerProps();
+        this.job = this.createCodeBuildJob();
         if (!stack.isActive) {
-            this._jobInvoker = this.createCodeBuildInvoker();
+            this._jobManager = this.createJobManager();
         }
         else if (isLiveDevEnabled) {
-            this._jobInvoker = this.createLocalInvoker();
+            this.liveDevJob = this.createLiveDevJob();
+            this._jobManager = this.createJobManager();
         }
         else {
-            this._jobInvoker = this.createCodeBuildInvoker();
+            this._jobManager = this.createJobManager();
             this.buildCodeBuildProjectCode();
         }
+        this.createLogRetention();
         this.attachPermissions(props.permissions || []);
         this.bind(props.bind || []);
         Object.entries(props.environment || {}).forEach(([key, value]) => {
             this.addEnvironment(key, value);
         });
+        useFunctions().add(this.node.addr, {
+            ...props,
+            runtime: this.convertJobRuntimeToFunctionRuntime(),
+        });
     }
     getConstructMetadata() {
         return {
@@ -87,11 +86,11 @@ export class Job extends Construct {
             variables: {
                 functionName: {
                     type: "plain",
-                    value: this._jobInvoker.functionName,
+                    value: this._jobManager.functionName,
                 },
             },
             permissions: {
-                "lambda:*": [this._jobInvoker.functionArn],
+                "lambda:*": [this._jobManager.functionArn],
             },
         };
     }
@@ -104,7 +103,7 @@ export class Job extends Construct {
      * ```
      */
     bind(constructs) {
-        this._jobInvoker.bind(constructs);
+        this.liveDevJob?.bind(constructs);
         this.bindForCodeBuild(constructs);
     }
     /**
@@ -116,7 +115,7 @@ export class Job extends Construct {
      * ```
      */
     attachPermissions(permissions) {
-        this._jobInvoker.attachPermissions(permissions);
+        this.liveDevJob?.attachPermissions(permissions);
         this.attachPermissionsForCodeBuild(permissions);
     }
     /**
@@ -130,22 +129,15 @@ export class Job extends Construct {
      * ```
      */
     addEnvironment(name, value) {
-        this._jobInvoker.addEnvironment(name, value);
+        this.liveDevJob?.addEnvironment(name, value);
         this.addEnvironmentForCodeBuild(name, value);
     }
-    createCodeBuildProject() {
-        const { cdk, memorySize, timeout } = this.props;
+    createCodeBuildJob() {
+        const { cdk, runtime, handler, memorySize, timeout, container } = this.props;
         const app = this.node.root;
         return new Project(this, "JobProject", {
             projectName: app.logicalPrefixedName(this.node.id),
             environment: {
-                // CodeBuild offers different build images. The newer ones have much quicker
-                // boot time. The latest build image is STANDARD_6_0, which support Node.js 16.
-                // But while testing, I found STANDARD_6_0 took 100s to boot. So for the
-                // purpose of this demo, I use STANDARD_5_0. It takes 30s to boot.
-                //buildImage: codebuild.LinuxBuildImage.STANDARD_6_0,
-                //buildImage: codebuild.LinuxBuildImage.STANDARD_5_0,
-                buildImage: LinuxBuildImage.fromDockerRegistry("amazon/aws-lambda-nodejs:16"),
                 computeType: this.normalizeMemorySize(memorySize || "3 GB"),
             },
             environmentVariables: {
@@ -169,6 +161,23 @@ export class Job extends Construct {
             subnetSelection: cdk?.vpcSubnets,
         });
     }
+    createLiveDevJob() {
+        // Note: make the invoker function the same ID as the Job
+        //       construct so users can identify the invoker function
+        //       in the Console.
+        const fn = new Function(this, this.node.id, {
+            ...this.props,
+            runtime: this.convertJobRuntimeToFunctionRuntime(),
+            memorySize: 1024,
+            timeout: "10 seconds",
+            environment: {
+                ...this.props.environment,
+                SST_DEBUG_JOB: "true",
+            },
+        });
+        fn._doNotAllowOthersToBind = true;
+        return fn;
+    }
     createLogRetention() {
         const { logRetention } = this.props;
         if (!logRetention)
@@ -182,17 +191,44 @@ export class Job extends Construct {
         });
     }
     buildCodeBuildProjectCode() {
-        const app = this.node.root;
+        const { handler, runtime, container } = this.props;
         useDeferredTasks().add(async () => {
             // Build function
             const result = await useRuntimeHandlers().build(this.node.addr, "deploy");
-            // create wrapper that calls the handler
             if (result.type === "error") {
-                throw new Error([
-                    `Failed to build job "${this.props.handler}"`,
-                    ...result.errors,
-                ].join("\n"));
+                throw new Error([`Failed to build job "${handler}"`, ...result.errors].join("\n"));
+            }
+            // No need to update code for container runtime
+            // Note: we could set the commands in `createCodeBuildJob` but
+            //       in `sst dev`, we want to avoid changing the CodeBuild resources
+            //       when `cmd` changes.
+            if (runtime === "container") {
+                const image = LinuxBuildImage.fromAsset(this, "ContainerImage", {
+                    directory: handler,
+                    platform: Platform.custom("linux/amd64"),
+                });
+                image.repository?.grantPull(this.job.role);
+                const project = this.job.node.defaultChild;
+                project.environment = {
+                    ...project.environment,
+                    image: image.imageId,
+                    imagePullCredentialsType: "SERVICE_ROLE",
+                };
+                project.source = {
+                    type: "NO_SOURCE",
+                    buildSpec: [
+                        "version: 0.2",
+                        "phases:",
+                        "  build:",
+                        "    commands:",
+                        `      - ${container.cmd
+                            .map((arg) => (arg.includes(" ") ? `"${arg}"` : arg))
+                            .join(" ")}`,
+                    ].join("\n"),
+                };
+                return;
             }
+            // Create wrapper that calls the handler
             const parsed = path.parse(result.handler);
             const importName = parsed.ext.substring(1);
             const importPath = `./${path
@@ -219,76 +255,65 @@ export class Job extends Construct {
                 `console.log("")`,
                 `process.exit(0)`,
             ].join("\n"));
+            // Update job's commands
             const code = AssetCode.fromAsset(result.out);
-            this.updateCodeBuildProjectCode(code, "handler-wrapper.mjs");
-            // This should always be true b/c runtime is always Node.js
-        });
-    }
-    updateCodeBuildProjectCode(code, script) {
-        // Update job's commands
-        const codeConfig = code.bind(this);
-        const project = this.job.node.defaultChild;
-        project.source = {
-            type: "S3",
-            location: `${codeConfig.s3Location?.bucketName}/${codeConfig.s3Location?.objectKey}`,
-            buildSpec: [
-                "version: 0.2",
-                "phases:",
-                "  build:",
-                "    commands:",
-                `      - node ${script}`,
-            ].join("\n"),
-        };
-        this.attachPermissions([
-            new PolicyStatement({
-                actions: ["s3:*"],
-                effect: Effect.ALLOW,
-                resources: [
-                    `arn:${Stack.of(this).partition}:s3:::${codeConfig.s3Location?.bucketName}/${codeConfig.s3Location?.objectKey}`,
-                ],
-            }),
-        ]);
-    }
-    createLocalInvoker() {
-        // Note: make the invoker function the same ID as the Job
-        //       construct so users can identify the invoker function
-        //       in the Console.
-        const fn = new Function(this, this.node.id, {
-            runtime: "nodejs16.x",
-            memorySize: 1024,
-            environment: {
-                ...this.props.environment,
-                SST_DEBUG_TYPE: "job",
-            },
-            ...this.props,
-            timeout: "15 minutes",
+            const codeConfig = code.bind(this);
+            const project = this.job.node.defaultChild;
+            const image = LinuxBuildImage.fromDockerRegistry("amazon/aws-lambda-nodejs:16");
+            project.environment = {
+                ...project.environment,
+                image: image.imageId,
+            };
+            image.repository?.grantPull(this.job.role);
+            project.source = {
+                type: "S3",
+                location: `${codeConfig.s3Location?.bucketName}/${codeConfig.s3Location?.objectKey}`,
+                buildSpec: [
+                    "version: 0.2",
+                    "phases:",
+                    "  build:",
+                    "    commands:",
+                    `      - node handler-wrapper.mjs`,
+                ].join("\n"),
+            };
+            this.attachPermissions([
+                new PolicyStatement({
+                    actions: ["s3:*"],
+                    effect: Effect.ALLOW,
+                    resources: [
+                        `arn:${Stack.of(this).partition}:s3:::${codeConfig.s3Location?.bucketName}/${codeConfig.s3Location?.objectKey}`,
+                    ],
+                }),
+            ]);
         });
-        fn._doNotAllowOthersToBind = true;
-        return fn;
     }
-    createCodeBuildInvoker() {
-        const fn = new Function(this, this.node.id, {
-            handler: path.join(__dirname, "../support/job-invoker/index.main"),
-            runtime: "nodejs18.x",
-            timeout: 10,
+    createJobManager() {
+        return new CdkFunction(this, "Manager", {
+            code: Code.fromAsset(path.join(__dirname, "../support/job-manager/")),
+            handler: "index.handler",
+            runtime: Runtime.NODEJS_16_X,
+            timeout: CdkDuration.seconds(10),
             memorySize: 1024,
             environment: {
-                PROJECT_NAME: this.job.projectName,
+                SST_JOB_PROVIDER: this.liveDevJob ? "lambda" : "codebuild",
+                SST_JOB_RUNNER: this.liveDevJob
+                    ? this.liveDevJob.functionArn
+                    : this.job.projectName,
             },
-            permissions: [
-                new PolicyStatement({
-                    effect: Effect.ALLOW,
-                    actions: ["codebuild:StartBuild"],
-                    resources: [this.job.projectArn],
-                }),
+            initialPolicy: [
+                this.liveDevJob
+                    ? new PolicyStatement({
+                        effect: Effect.ALLOW,
+                        actions: ["lambda:InvokeFunction"],
+                        resources: [this.liveDevJob.functionArn],
+                    })
+                    : new PolicyStatement({
+                        effect: Effect.ALLOW,
+                        actions: ["codebuild:StartBuild", "codebuild:StopBuild"],
+                        resources: [this.job.projectArn],
+                    }),
             ],
-            nodejs: {
-                format: "esm",
-            },
-            enableLiveDev: false,
         });
-        fn._doNotAllowOthersToBind = true;
-        return fn;
     }
     bindForCodeBuild(constructs) {
         // Get referenced secrets
@@ -318,6 +343,14 @@ export class Job extends Construct {
         const envVars = env.environmentVariables;
         envVars.push({ name, value });
     }
+    validateContainerProps() {
+        const { runtime, container } = this.props;
+        if (runtime === "container") {
+            if (!container) {
+                throw new Error(`No commands defined for the ${this.node.id} Job.`);
+            }
+        }
+    }
     normalizeMemorySize(memorySize) {
         if (memorySize === "3 GB") {
             return ComputeType.SMALL;
@@ -340,4 +373,8 @@ export class Job extends Construct {
         }
         return value;
     }
+    convertJobRuntimeToFunctionRuntime() {
+        const { runtime } = this.props;
+        return runtime === "container" ? "container" : "nodejs16.x";
+    }
 }

package/constructs/util/permission.js

@@ -143,7 +143,7 @@ function permissionsToStatementsAndGrants(permissions) {
             statements.push(buildPolicyStatement("lambda:*", [permission.functionArn]));
         }
         else if (permission instanceof Job) {
-            statements.push(buildPolicyStatement("lambda:*", [permission._jobInvoker.functionArn]));
+            statements.push(buildPolicyStatement("lambda:*", [permission._jobManager.functionArn]));
         }
         ////////////////////////////////////
         // Case: CDK constructs

package/node/job/index.d.ts

@@ -10,7 +10,10 @@ export type JobType = {
 };
 export declare const Job: JobType;
 declare function JobControl<Name extends keyof JobResources>(name: Name, vars: Record<string, string>): {
-    run(props: JobRunProps<Name>): Promise<void>;
+    run(props: JobRunProps<Name>): Promise<{
+        jobId: string;
+    }>;
+    cancel(jobId: string): Promise<void>;
 };
 /**
  * Create a new job handler.

package/node/job/index.js

@@ -11,19 +11,30 @@ export const Job = /* @__PURE__ */ (() => {
     return result;
 })();
 function JobControl(name, vars) {
+    const functionName = vars.functionName;
     return {
         async run(props) {
-            // Handle job permission not granted
-            const functionName = vars.functionName;
             // Invoke the Lambda function
             const ret = await lambda.send(new InvokeCommand({
                 FunctionName: functionName,
-                Payload: props?.payload === undefined
-                    ? undefined
-                    : Buffer.from(JSON.stringify(props?.payload)),
+                Payload: Buffer.from(JSON.stringify({ action: "run", payload: props?.payload })),
             }));
             if (ret.FunctionError) {
-                throw new Error(`Failed to invoke the ${name} Job. Error: ${ret.FunctionError}`);
+                throw new Error(`Failed to invoke the "${name}" job. Error: ${ret.FunctionError}`);
+            }
+            const resp = JSON.parse(Buffer.from(ret.Payload).toString());
+            return {
+                jobId: resp.jobId,
+            };
+        },
+        async cancel(jobId) {
+            // Invoke the Lambda function
+            const ret = await lambda.send(new InvokeCommand({
+                FunctionName: functionName,
+                Payload: Buffer.from(JSON.stringify({ action: "cancel", jobId })),
+            }));
+            if (ret.FunctionError) {
+                throw new Error(`Failed to cancel the "${name}" job id ${jobId}. Error: ${ret.FunctionError}`);
             }
         },
     };

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.20.1",
+  "version": "2.21.1",
   "bin": {
     "sst": "cli/sst.js"
   },