sst 2.24.17 → 2.24.19

package/config.js

@@ -5,11 +5,24 @@ import { useProject } from "./project.js";
 import { useAWSClient } from "./credentials.js";
 import { useIOT } from "./iot.js";
 import { Stacks } from "./stacks/index.js";
+const ssm = useAWSClient(SSMClient);
+const FALLBACK_STAGE = ".fallback";
+const SECRET_UPDATED_AT_ENV = "SST_ADMIN_SECRET_UPDATED_AT";
+const PREFIX = {
+    get STAGE() {
+        const project = useProject();
+        return project.config.ssmPrefix;
+    },
+    get FALLBACK() {
+        const project = useProject();
+        return `/sst/${project.config.name}/${FALLBACK_STAGE}/`;
+    },
+};
 export var Config;
 (function (Config) {
     async function parameters() {
         const result = [];
-        for await (const p of scan(PREFIX.FALLBACK)) {
+        for await (const p of scanParameters(PREFIX.FALLBACK)) {
             const parsed = parse(p.Name, PREFIX.FALLBACK);
             if (parsed.type === "secrets")
                 continue;
@@ -18,7 +31,7 @@ export var Config;
                 value: p.Value,
             });
         }
-        for await (const p of scan(PREFIX.STAGE)) {
+        for await (const p of scanParameters(PREFIX.STAGE)) {
             const parsed = parse(p.Name, PREFIX.STAGE);
             if (parsed.type === "secrets")
                 continue;
@@ -44,13 +57,13 @@ export var Config;
     Config.normalizeID = normalizeID;
     async function secrets() {
         const result = {};
-        for await (const p of scan(PREFIX.STAGE + "Secret")) {
+        for await (const p of scanParameters(PREFIX.STAGE + "Secret")) {
             const parsed = parse(p.Name, PREFIX.STAGE);
             if (!result[parsed.id])
                 result[parsed.id] = {};
             result[parsed.id].value = p.Value;
         }
-        for await (const p of scan(PREFIX.FALLBACK + "Secret")) {
+        for await (const p of scanParameters(PREFIX.FALLBACK + "Secret")) {
             const parsed = parse(p.Name, PREFIX.FALLBACK);
             if (!result[parsed.id])
                 result[parsed.id] = {};
@@ -71,18 +84,24 @@ export var Config;
     }
     Config.env = env;
     async function setSecret(input) {
-        const ssm = useAWSClient(SSMClient);
-        await ssm.send(new PutParameterCommand({
-            Name: pathFor({
-                id: input.key,
-                type: "Secret",
-                prop: "value",
-                fallback: input.fallback,
-            }),
-            Value: input.value,
-            Type: "SecureString",
-            Overwrite: true,
-        }));
+        const paramName = pathFor({
+            id: input.key,
+            type: "Secret",
+            prop: "value",
+            fallback: input.fallback,
+        });
+        try {
+            await putParameter(paramName, input.value);
+        }
+        catch (e) {
+            // If the parameter was previously ADVANCED, re-create it in STANDARD tier.
+            const wasAdvanced = e.name === "ValidationException" &&
+                e.message.startsWith("This parameter uses the advanced-parameter tier. You can't downgrade a parameter from the advanced-parameter tier to the standard-parameter tier.");
+            if (!wasAdvanced)
+                throw e;
+            await deleteParameter(paramName);
+            await putParameter(paramName, input.value);
+        }
         // Publish event
         const iot = await useIOT();
         const topic = `${iot.prefix}/events`;
@@ -90,28 +109,21 @@ export var Config;
     }
     Config.setSecret = setSecret;
     async function getSecret(input) {
-        const ssm = useAWSClient(SSMClient);
-        const result = await ssm.send(new GetParameterCommand({
-            Name: pathFor({
-                id: input.key,
-                prop: "value",
-                type: "Secret",
-                fallback: input.fallback,
-            }),
-            WithDecryption: true,
+        const result = await getParameter(pathFor({
+            id: input.key,
+            prop: "value",
+            type: "Secret",
+            fallback: input.fallback,
         }));
         return result.Parameter?.Value;
     }
     Config.getSecret = getSecret;
     async function removeSecret(input) {
-        const ssm = useAWSClient(SSMClient);
-        await ssm.send(new DeleteParameterCommand({
-            Name: pathFor({
-                id: input.key,
-                type: "Secret",
-                prop: "value",
-                fallback: input.fallback,
-            }),
+        await deleteParameter(pathFor({
+            id: input.key,
+            type: "Secret",
+            prop: "value",
+            fallback: input.fallback,
         }));
     }
     Config.removeSecret = removeSecret;
@@ -158,8 +170,7 @@ export var Config;
     }
     Config.restart = restart;
 })(Config || (Config = {}));
-async function* scan(prefix) {
-    const ssm = useAWSClient(SSMClient);
+async function* scanParameters(prefix) {
     let token;
     while (true) {
         const results = await ssm.send(new GetParametersByPathCommand({
@@ -174,18 +185,26 @@ async function* scan(prefix) {
         token = results.NextToken;
     }
 }
-const FALLBACK_STAGE = ".fallback";
-const SECRET_UPDATED_AT_ENV = "SST_ADMIN_SECRET_UPDATED_AT";
-const PREFIX = {
-    get STAGE() {
-        const project = useProject();
-        return project.config.ssmPrefix;
-    },
-    get FALLBACK() {
-        const project = useProject();
-        return `/sst/${project.config.name}/${FALLBACK_STAGE}/`;
-    },
-};
+function getParameter(name) {
+    return ssm.send(new GetParameterCommand({
+        Name: name,
+        WithDecryption: true,
+    }));
+}
+function putParameter(name, value) {
+    return ssm.send(new PutParameterCommand({
+        Name: name,
+        Value: value,
+        Type: "SecureString",
+        Overwrite: true,
+        Tier: value.length > 4096 ? "Advanced" : "Standard",
+    }));
+}
+function deleteParameter(name) {
+    return ssm.send(new DeleteParameterCommand({
+        Name: name,
+    }));
+}
 function parse(ssmName, prefix) {
     const parts = ssmName.substring(prefix.length).split("/");
     return {

package/constructs/Service.js

@@ -491,7 +491,7 @@ export class Service extends Construct {
             assumedBy: new CompositePrincipal(new AccountPrincipal(app.account), new ServicePrincipal("lambda.amazonaws.com")),
             maxSessionDuration: CdkDuration.hours(12),
         });
-        return new Function(this, `ServerFunction`, {
+        const fn = new Function(this, `ServerFunction`, {
             description: "Service dev function",
             handler: path.join(__dirname, "../support/service-dev-function", "index.handler"),
             runtime: "nodejs18.x",
@@ -502,6 +502,8 @@ export class Service extends Construct {
             environment,
             permissions,
         });
+        fn._doNotAllowOthersToBind = true;
+        return fn;
     }
     bindForService(constructs) {
         // Get referenced secrets

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.24.17",
+  "version": "2.24.19",
   "bin": {
     "sst": "cli/sst.js"
   },