sst 2.23.11 → 2.23.12

package/cli/commands/bind.js

@@ -90,25 +90,21 @@ export const bind = (program) => program
     function isInSsrSite() {
         const cwd = process.cwd();
         return useSsrSites().all.find(({ props }) => {
-            console.log(path.resolve(project.paths.root, props.path));
             return path.resolve(project.paths.root, props.path) === cwd;
         });
     }
     function isInStaticSite() {
         const cwd = process.cwd();
         return (useStaticSites().all.find(({ props }) => {
-            console.log(path.resolve(project.paths.root, props.path));
             return path.resolve(project.paths.root, props.path) === cwd;
         }) ||
             useSlsNextjsSites().all.find(({ props }) => {
-                console.log(path.resolve(project.paths.root, props.path));
                 return path.resolve(project.paths.root, props.path) === cwd;
             }));
     }
     function isInService() {
         const cwd = process.cwd();
         return useServices().all.find(({ props }) => {
-            console.log(path.resolve(project.paths.root, props.path));
             return path.resolve(project.paths.root, props.path) === cwd;
         });
     }

package/constructs/EdgeFunction.d.ts

@@ -22,15 +22,14 @@ export declare class EdgeFunction extends Construct {
     role: Role;
     functionArn: string;
     function: CdkIFunction;
+    currentVersion: IVersion;
     private functionCR;
     private assetReplacer;
     private assetReplacerPolicy;
     private scope;
-    private versionId;
     private bindingEnvs;
     private props;
     constructor(scope: Construct, id: string, props: EdgeFunctionProps);
-    get currentVersion(): IVersion;
     build(): Promise<void>;
     attachPermissions(permissions: Permissions): void;
     addEnvironment(key: string, value: string): void;

package/constructs/EdgeFunction.js

@@ -24,11 +24,11 @@ export class EdgeFunction extends Construct {
     role;
     functionArn;
     function;
+    currentVersion;
     functionCR;
     assetReplacer;
     assetReplacerPolicy;
     scope;
-    versionId;
     bindingEnvs;
     props;
     constructor(scope, id, props) {
@@ -64,13 +64,10 @@ export class EdgeFunction extends Construct {
         });
         this.functionCR = fn;
         this.functionArn = fnArn;
-        this.versionId = versionId;
+        this.currentVersion = Version.fromVersionArn(this, `${id}FunctionVersion`, `${fnArn}:${versionId}`);
         this.assetReplacer = assetReplacer;
         this.assetReplacerPolicy = assetReplacerPolicy;
     }
-    get currentVersion() {
-        return Version.fromVersionArn(this, `${this.node.id}FunctionVersion`, `${this.functionArn}:${this.versionId}`);
-    }
     async build() {
         const { bundle, handler } = this.props;
         const { asset, handlerFilename } = bundle

package/constructs/NextjsSite.js

@@ -4,7 +4,7 @@ import { Fn, Duration as CdkDuration, RemovalPolicy, CustomResource, } from "aws
 import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { Code, Runtime, Architecture, Function as CdkFunction, FunctionUrlAuthType, } from "aws-cdk-lib/aws-lambda";
-import { ViewerProtocolPolicy, AllowedMethods, CachedMethods, } from "aws-cdk-lib/aws-cloudfront";
+import { ViewerProtocolPolicy, AllowedMethods, CachedMethods, LambdaEdgeEventType, } from "aws-cdk-lib/aws-cloudfront";
 import { HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 import { Rule, Schedule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
@@ -314,10 +314,12 @@ export class NextjsSite extends SsrSite {
         ]);
     }
     buildImageBehavior(cachePolicy) {
-        const { cdk } = this.props;
+        const { cdk, regional } = this.props;
         const imageFn = this.createImageOptimizationFunction();
         const imageFnUrl = imageFn.addFunctionUrl({
-            authType: FunctionUrlAuthType.NONE,
+            authType: regional?.enableServerUrlIamAuth
+                ? FunctionUrlAuthType.AWS_IAM
+                : FunctionUrlAuthType.NONE,
         });
         return {
             viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
@@ -327,6 +329,24 @@ export class NextjsSite extends SsrSite {
             compress: true,
             cachePolicy,
             responseHeadersPolicy: cdk?.responseHeadersPolicy,
+            edgeLambdas: regional?.enableServerUrlIamAuth
+                ? [
+                    (() => {
+                        const fn = this.useServerUrlSigningFunction();
+                        fn.attachPermissions([
+                            new PolicyStatement({
+                                actions: ["lambda:InvokeFunctionUrl"],
+                                resources: [imageFn.functionArn],
+                            }),
+                        ]);
+                        return {
+                            includeBody: true,
+                            eventType: LambdaEdgeEventType.ORIGIN_REQUEST,
+                            functionVersion: fn.currentVersion,
+                        };
+                    })(),
+                ]
+                : [],
         };
     }
     generateBuildId() {

package/constructs/SsrSite.d.ts

@@ -1,6 +1,6 @@
 import { Construct } from "constructs";
 import { Bucket, BucketProps, IBucket } from "aws-cdk-lib/aws-s3";
-import { IFunction as ICdkFunction, FunctionProps } from "aws-cdk-lib/aws-lambda";
+import { FunctionProps } from "aws-cdk-lib/aws-lambda";
 import { ICachePolicy, IResponseHeadersPolicy, BehaviorOptions, CachePolicy, Function as CfFunction, FunctionEventType as CfFunctionEventType } from "aws-cdk-lib/aws-cloudfront";
 import { Distribution, DistributionDomainProps } from "./Distribution.js";
 import { SSTConstruct } from "./Construct.js";
@@ -136,6 +136,13 @@ export interface SsrSiteProps {
      * ```
      */
     environment?: Record<string, string>;
+    regional?: {
+        /**
+         * Secure the server function URL using AWS IAM authentication. By default, the server function URL is publicly accessible. When this flag is enabled, the server function URL will require IAM authorization, and a Lambda@Edge function will sign the requests. Be aware that this introduces added latency to the requests.
+         * @default false
+         */
+        enableServerUrlIamAuth?: boolean;
+    };
     dev?: {
         /**
          * When running `sst dev, site is not deployed. This is to ensure `sst dev` can start up quickly.
@@ -275,6 +282,7 @@ export declare abstract class SsrSite extends Construct implements SSTConstruct
     protected serverLambdaForEdge?: EdgeFunction;
     protected serverLambdaForRegional?: SsrFunction;
     private serverLambdaForDev?;
+    private serverUrlSigningFunction?;
     protected bucket: Bucket;
     private cfFunction;
     private s3Origin;
@@ -293,7 +301,7 @@ export declare abstract class SsrSite extends Construct implements SSTConstruct
      * The internally created CDK resources.
      */
     get cdk(): {
-        function: ICdkFunction | undefined;
+        function: import("aws-cdk-lib/aws-lambda").IFunction | undefined;
         bucket: Bucket;
         distribution: import("aws-cdk-lib/aws-cloudfront").IDistribution;
         hostedZone: import("aws-cdk-lib/aws-route53").IHostedZone | undefined;
@@ -343,6 +351,7 @@ export declare abstract class SsrSite extends Construct implements SSTConstruct
     protected createCloudFrontDistributionForRegional(): Distribution;
     protected createCloudFrontDistributionForEdge(): Distribution;
     protected buildDefaultBehaviorForRegional(cachePolicy: ICachePolicy): BehaviorOptions;
+    protected useServerUrlSigningFunction(): EdgeFunction;
     protected buildDefaultBehaviorForEdge(cachePolicy: ICachePolicy): BehaviorOptions;
     protected buildBehaviorFunctionAssociations(): {
         eventType: CfFunctionEventType;

package/constructs/SsrSite.js

@@ -21,6 +21,7 @@ import { createAppContext } from "./context.js";
 import { isCDKConstruct } from "./Construct.js";
 import { Secret } from "./Secret.js";
 import { SsrFunction } from "./SsrFunction.js";
+import { EdgeFunction } from "./EdgeFunction.js";
 import { getBuildCmdEnvironment, } from "./BaseSite.js";
 import { useDeferredTasks } from "./deferred_task.js";
 import { toCdkDuration } from "./util/duration.js";
@@ -48,6 +49,7 @@ export class SsrSite extends Construct {
     serverLambdaForEdge;
     serverLambdaForRegional;
     serverLambdaForDev;
+    serverUrlSigningFunction;
     bucket;
     cfFunction;
     s3Origin;
@@ -101,6 +103,7 @@ export class SsrSite extends Construct {
             // Build server functions
             await this.serverLambdaForEdge?.build();
             await this.serverLambdaForRegional?.build();
+            await this.serverUrlSigningFunction?.build();
             // Create S3 Deployment
             const cliLayer = new AwsCliLayer(this, "AwsCliLayer");
             const assets = this.createS3Assets();
@@ -539,10 +542,12 @@ function handler(event) {
         });
     }
     buildDefaultBehaviorForRegional(cachePolicy) {
-        const { timeout, cdk } = this.props;
+        const { timeout, regional, cdk } = this.props;
         const cfDistributionProps = cdk?.distribution || {};
         const fnUrl = this.serverLambdaForRegional.addFunctionUrl({
-            authType: FunctionUrlAuthType.NONE,
+            authType: regional?.enableServerUrlIamAuth
+                ? FunctionUrlAuthType.AWS_IAM
+                : FunctionUrlAuthType.NONE,
             invokeMode: this.supportsStreaming()
                 ? InvokeMode.RESPONSE_STREAM
                 : undefined,
@@ -565,8 +570,38 @@ function handler(event) {
                 ...this.buildBehaviorFunctionAssociations(),
                 ...(cfDistributionProps.defaultBehavior?.functionAssociations || []),
             ],
+            edgeLambdas: [
+                ...(regional?.enableServerUrlIamAuth
+                    ? [
+                        {
+                            includeBody: true,
+                            eventType: LambdaEdgeEventType.ORIGIN_REQUEST,
+                            functionVersion: this.useServerUrlSigningFunction().currentVersion,
+                        },
+                    ]
+                    : []),
+                ...(cfDistributionProps.defaultBehavior?.edgeLambdas || []),
+            ],
         };
     }
+    useServerUrlSigningFunction() {
+        this.serverUrlSigningFunction =
+            this.serverUrlSigningFunction ??
+                new EdgeFunction(this, "ServerUrlSigningFunction", {
+                    bundle: path.join(__dirname, "../support/signing-function"),
+                    runtime: "nodejs18.x",
+                    handler: "index.handler",
+                    timeout: 10,
+                    memorySize: 128,
+                    permissions: [
+                        new PolicyStatement({
+                            actions: ["lambda:InvokeFunctionUrl"],
+                            resources: [this.serverLambdaForRegional?.functionArn],
+                        }),
+                    ],
+                });
+        return this.serverUrlSigningFunction;
+    }
     buildDefaultBehaviorForEdge(cachePolicy) {
         const { cdk } = this.props;
         const cfDistributionProps = cdk?.distribution || {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.23.11",
+  "version": "2.23.12",
   "bin": {
     "sst": "cli/sst.js"
   },
@@ -31,6 +31,7 @@
     "@aws-cdk/cloud-assembly-schema": "2.84.0",
     "@aws-cdk/cloudformation-diff": "2.84.0",
     "@aws-cdk/cx-api": "2.84.0",
+    "@aws-crypto/sha256-js": "^5.0.0",
     "@aws-sdk/client-cloudformation": "^3.279.0",
     "@aws-sdk/client-ecs": "^3.279.0",
     "@aws-sdk/client-eventbridge": "^3.342.0",
@@ -51,6 +52,7 @@
     "@babel/core": "^7.0.0-0",
     "@babel/generator": "^7.20.5",
     "@babel/plugin-syntax-typescript": "^7.21.4",
+    "@smithy/signature-v4": "^2.0.1",
     "@trpc/server": "9.16.0",
     "adm-zip": "^0.5.10",
     "aws-cdk-lib": "2.84.0",

package/support/custom-resources/index.mjs

@@ -113935,7 +113935,7 @@ var require_dist_cjs109 = __commonJS({
   "../../node_modules/.pnpm/@aws-sdk+types@3.208.0/node_modules/@aws-sdk/types/dist-cjs/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    var tslib_1 = (init_tslib_es6(), __toCommonJS(tslib_es6_exports));
+    var tslib_1 = (init_tslib_es62(), __toCommonJS(tslib_es6_exports2));
     tslib_1.__exportStar(require_abort2(), exports);
     tslib_1.__exportStar(require_auth3(), exports);
     tslib_1.__exportStar(require_client4(), exports);