sst 2.30.4 → 2.31.0

package/constructs/BaseSite.d.ts

@@ -1,20 +1,9 @@
 import { ErrorResponse, DistributionProps, BehaviorOptions, IOrigin } from "aws-cdk-lib/aws-cloudfront";
-export interface BaseSiteFileOptionsFilter {
-    include?: string;
-    exclude?: string;
-}
 export interface BaseSiteFileOptions {
-    filters: BaseSiteFileOptionsFilter[];
-    cacheControl?: string;
-    contentType?: string;
-    contentEncoding?: string;
-}
-export interface BaseSiteFileOptionsDeprecated {
-    include?: string | string[];
-    exclude?: string | string[];
+    files: string | string[];
+    ignore?: string | string[];
     cacheControl?: string;
     contentType?: string;
-    contentEncoding?: string;
 }
 export interface BaseSiteEnvironmentOutputsInfo {
     path: string;

package/constructs/NextjsSite.d.ts

@@ -27,7 +27,7 @@ export interface NextjsSiteProps extends Omit<SsrSiteProps, "nodejs"> {
      * logging: "per-route",
      * ```
      */
-    _logging?: "combined" | "per-route";
+    logging?: "combined" | "per-route";
     imageOptimization?: {
         /**
          * The amount of memory in MB allocated for image optimization function.

package/constructs/NextjsSite.js

@@ -13,7 +13,7 @@ import { toCdkSize } from "./util/size.js";
 import { Effect, Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { VisibleError } from "../error.js";
-const LAYER_VERSION = "9";
+const LAYER_VERSION = "2";
 const DEFAULT_OPEN_NEXT_VERSION = "2.2.4";
 const DEFAULT_CACHE_POLICY_ALLOWED_HEADERS = [
     "accept",
@@ -305,7 +305,7 @@ export class NextjsSite extends SsrSite {
         };
     }
     wrapServerFunction(config) {
-        const { path: sitePath, experimental } = this.props;
+        const { path: sitePath, experimental, cdk } = this.props;
         const stack = Stack.of(this);
         const wrapperName = "nextjssite-index";
         const serverPath = path.join(sitePath, ".open-next", "server-function");
@@ -341,7 +341,9 @@ export class NextjsSite extends SsrSite {
             ...config,
             layers: this.isPerRouteLoggingEnabled()
                 ? [
-                    LayerVersion.fromLayerVersionArn(this, "SSTExtension", `arn:aws:lambda:${stack.region}:226609089145:layer:sst-extension:${LAYER_VERSION}`),
+                    LayerVersion.fromLayerVersionArn(this, "SSTExtension", cdk?.server?.architecture?.name === Architecture.X86_64.name
+                        ? `arn:aws:lambda:${stack.region}:226609089145:layer:sst-extension-amd64:${LAYER_VERSION}`
+                        : `arn:aws:lambda:${stack.region}:226609089145:layer:sst-extension-arm64:${LAYER_VERSION}`),
                 ]
                 : undefined,
             handler: `${wrapperName}.handler`,
@@ -397,9 +399,11 @@ export class NextjsSite extends SsrSite {
     isPerRouteLoggingEnabled() {
         return (!this.doNotDeploy &&
             !this.props.edge &&
-            this.props._logging === "per-route");
+            this.props.logging === "per-route");
     }
     disableDefaultLogging() {
+        // Note: keep default logs enabled
+        return;
         const stack = Stack.of(this);
         const server = this.serverFunction;
         const policy = new Policy(this, "DisableLoggingPolicy", {

package/constructs/RDS.js

@@ -1,5 +1,5 @@
 import path from "path";
-import glob from "glob";
+import { globSync } from "glob";
 import fs from "fs";
 import url from "url";
 import * as crypto from "crypto";
@@ -347,7 +347,7 @@ export class RDS extends Construct {
     }
     generateMigrationsHash(migrations) {
         // Get all files inside the migrations folder
-        const files = glob.sync("**", {
+        const files = globSync("**", {
             dot: true,
             nodir: true,
             follow: true,

package/constructs/SsrSite.d.ts

@@ -8,7 +8,7 @@ import { SSTConstruct } from "./Construct.js";
 import { NodeJSProps, FunctionProps } from "./Function.js";
 import { SsrFunction, SsrFunctionProps } from "./SsrFunction.js";
 import { EdgeFunction, EdgeFunctionProps } from "./EdgeFunction.js";
-import { BaseSiteFileOptions, BaseSiteFileOptionsFilter, BaseSiteFileOptionsDeprecated, BaseSiteReplaceProps, BaseSiteCdkDistributionProps } from "./BaseSite.js";
+import { BaseSiteFileOptions, BaseSiteReplaceProps, BaseSiteCdkDistributionProps } from "./BaseSite.js";
 import { Size } from "./util/size.js";
 import { Duration } from "./util/duration.js";
 import { Permissions } from "./util/permission.js";
@@ -52,12 +52,7 @@ export interface SsrSiteNodeJSProps extends NodeJSProps {
 }
 export interface SsrDomainProps extends DistributionDomainProps {
 }
-export interface SsrSiteFileOptionsFilter extends BaseSiteFileOptionsFilter {
-}
 export interface SsrSiteFileOptions extends BaseSiteFileOptions {
-    filters: SsrSiteFileOptionsFilter[];
-}
-export interface SsrSiteFileOptionsDeprecated extends BaseSiteFileOptionsDeprecated {
 }
 export interface SsrSiteReplaceProps extends BaseSiteReplaceProps {
 }
@@ -207,18 +202,18 @@ export interface SsrSiteProps {
          */
         url?: string;
     };
-    cache?: {
+    assets?: {
         /**
-         * Character encoding for text based assets stored in the S3 cache (ex: html, css, js, etc.). If "none" is specified, no charset will be returned in header.
+         * Character encoding for text based assets uploaded to S3 (ex: html, css, js, etc.). If "none" is specified, no charset will be returned in header.
          * @default utf-8
          * @example
          * ```js
-         * cache: {
-         *  textEncoding: "iso-8859-1"
+         * assets: {
+         *   textEncoding: "iso-8859-1"
          * }
          * ```
          */
-        textEncoding?: "UTF-8" | "ISO-8859-1" | "Windows-1252" | "ASCII" | "none";
+        textEncoding?: "utf-8" | "iso-8859-1" | "windows-1252" | "ascii" | "none";
         /**
          * The strategy to use for invalidating the CDN cache. By default, the CDN cache will invalidate on changes any cached file, but this could become slow on very large projects.
          * - "never" - No invalidation will be performed.
@@ -228,7 +223,7 @@ export interface SsrSiteProps {
          * @default all
          * @example
          * ```js
-         * cache: {
+         * assets: {
          *   cdnInvalidationStrategy: "versioned"
          * }
          * ```
@@ -239,8 +234,8 @@ export interface SsrSiteProps {
          * @default 1 year
          * @example
          * ```js
-         * cache: {
-         *  versionedFilesTTL: "30 days"
+         * assets: {
+         *   versionedFilesTTL: "30 days"
          * }
          * ```
          */
@@ -250,7 +245,7 @@ export interface SsrSiteProps {
          * @default public,max-age=31536000,immutable
          * @example
          * ```js
-         * cache: {
+         * assets: {
          *   versionedFilesCacheHeader: "public,max-age=31536000,immutable"
          * }
          * ```
@@ -261,8 +256,8 @@ export interface SsrSiteProps {
          * @default 1 day
          * @example
          * ```js
-         * cache: {
-         *  nonVersionedFilesTTL: "4 hours"
+         * assets: {
+         *   nonVersionedFilesTTL: "4 hours"
          * }
          * ```
          */
@@ -272,7 +267,7 @@ export interface SsrSiteProps {
          * @default public,max-age=0,s-maxage=86400,stale-while-revalidate=8640
          * @example
          * ```js
-         * cache: {
+         * assets: {
          *   nonVersionedFilesCacheHeader: "public,max-age=0,no-cache"
          * }
          * ```
@@ -282,10 +277,10 @@ export interface SsrSiteProps {
          * List of file options to specify cache control and content type for cached files. These file options are appended to the default file options so it's possible to override the default file options by specifying an overlapping file pattern.
          * @example
          * ```js
-         * cache: {
+         * assets: {
          *   fileOptions: [
          *     {
-         *       filters: [ { exclude: "*" }, { include: "*.zip" } ],
+         *       files: "**\/*.zip",
          *       cacheControl: "private,no-cache,no-store,must-revalidate",
          *       contentType: "application/zip",
          *     },
@@ -294,6 +289,10 @@ export interface SsrSiteProps {
          * ```
          */
         fileOptions?: SsrSiteFileOptions[];
+        /**
+         * @internal
+         */
+        _uploadConcurrency?: number;
     };
     /**
      * While deploying, SST waits for the CloudFront cache invalidation process to finish. This ensures that the new content will be served once the deploy command finishes. However, this process can sometimes take more than 5 mins. For non-prod environments it might make sense to pass in `false`. That'll skip waiting for the cache to invalidate and speed up the deploy process.
@@ -343,59 +342,6 @@ export interface SsrSiteProps {
         responseHeadersPolicy?: IResponseHeadersPolicy;
         server?: Pick<CdkFunctionProps, "layers" | "vpc" | "vpcSubnets" | "securityGroups" | "allowAllOutbound" | "allowPublicSubnet" | "architecture" | "logRetention"> & Pick<FunctionProps, "copyFiles">;
     };
-    /**
-     * Pass in a list of file options to customize cache control and content type specific files. Specifying file options will bypass all default file options and only use the ones specified. Most configurations within the `cache` prop will be ignored.
-     * @deprecated Use `cache.fileOptions` instead. Note that the `cache.fileOptions` are appended to default file options, not a replacement as this prop was.
-     * @default
-     * Versioned files cached for 1 year at the CDN and browser level.
-     * Nonversioned files cached for 1 day at the CDN level, but not at the browser level.
-     * ```js
-     * fileOptions: [
-     *   {
-     *     exclude: "*",
-     *     include: "{versioned_directory}/*",
-     *     cacheControl: "public,max-age=31536000,immutable",
-     *   },
-     *   {
-     *     exclude: "*",
-     *     include: "[{non_versioned_file1}, {non_versioned_file2}, ...]",
-     *     cacheControl: "public,max-age=0,s-maxage=31536000,must-revalidate",
-     *   },
-     *   {
-     *     exclude: "*",
-     *     include: "[{non_versioned_dir_1}/*, {non_versioned_dir_2}/*, ...]",
-     *     cacheControl: "public,max-age=0,s-maxage=31536000,must-revalidate",
-     *   },
-     * ]
-     * ```
-     *
-     * @example
-     * ```js
-     * fileOptions: [
-     *   {
-     *     exclude: "*",
-     *     include: "{versioned_directory}/*.css",
-     *     cacheControl: "public,max-age=31536000,immutable",
-     *     contentType: "text/css; charset=UTF-8",
-     *   },
-     *   {
-     *     exclude: "*",
-     *     include: "{versioned_directory}/*.js",
-     *     cacheControl: "public,max-age=31536000,immutable",
-     *   },
-     *   {
-     *     exclude: "*",
-     *     include: "[{non_versioned_file1}, {non_versioned_file2}, ...]",
-     *     cacheControl: "public,max-age=0,s-maxage=31536000,must-revalidate",
-     *   },
-     *   {
-     *     exclude: "*",
-     *     include: "[{non_versioned_dir_1}/*, {non_versioned_dir_2}/*, ...]",
-     *     cacheControl: "public,max-age=0,s-maxage=31536000,must-revalidate",
-     *   },
-     * ]
-     */
-    fileOptions?: SsrSiteFileOptionsDeprecated[];
 }
 export type SsrSiteNormalizedProps = SsrSiteProps & {
     path: Exclude<SsrSiteProps["path"], undefined>;

package/constructs/SsrSite.js

@@ -1,7 +1,7 @@
 import path from "path";
 import url from "url";
 import fs from "fs";
-import glob from "glob";
+import { globSync } from "glob";
 import crypto from "crypto";
 import spawn from "cross-spawn";
 import { execSync } from "child_process";
@@ -12,7 +12,6 @@ import { Effect, Role, Policy, PolicyStatement, AccountPrincipal, ServicePrincip
 import { Function as CdkFunction, Code, Runtime, FunctionUrlAuthType, InvokeMode, } from "aws-cdk-lib/aws-lambda";
 import { Asset } from "aws-cdk-lib/aws-s3-assets";
 import { ViewerProtocolPolicy, AllowedMethods, CachedMethods, LambdaEdgeEventType, CachePolicy, CacheQueryStringBehavior, CacheHeaderBehavior, CacheCookieBehavior, OriginRequestPolicy, Function as CfFunction, FunctionCode as CfFunctionCode, FunctionEventType as CfFunctionEventType, } from "aws-cdk-lib/aws-cloudfront";
-import { AwsCliLayer } from "aws-cdk-lib/lambda-layer-awscli";
 import { S3Origin, HttpOrigin, OriginGroup, } from "aws-cdk-lib/aws-cloudfront-origins";
 import { Rule, Schedule } from "aws-cdk-lib/aws-events";
 import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
@@ -67,10 +66,11 @@ export class SsrSite extends Construct {
         const app = scope.node.root;
         const stack = Stack.of(this);
         const self = this;
-        const { path: sitePath, typesPath, buildCommand, runtime, timeout, memorySize, edge, regional, dev, cache, nodejs, permissions, environment, bind, customDomain, waitForInvalidation, fileOptions, warm, cdk, } = props;
+        const { path: sitePath, typesPath, buildCommand, runtime, timeout, memorySize, edge, regional, dev, assets, nodejs, permissions, environment, bind, customDomain, waitForInvalidation, warm, cdk, } = props;
         this.doNotDeploy = !stack.isActive || (app.mode === "dev" && !dev?.deploy);
         validateSiteExists();
         validateTimeout();
+        validateDeprecatedFileOptions();
         writeTypesFile(typesPath);
         useSites().add(stack.stackName, id, this.constructor.name, props);
         if (this.doNotDeploy) {
@@ -82,7 +82,6 @@ export class SsrSite extends Construct {
         }
         let s3DeployCRs = [];
         let ssrFunctions = [];
-        let singletonAwsCliLayer;
         let singletonUrlSigner;
         let singletonCachePolicy;
         let singletonOriginRequestPolicy;
@@ -110,7 +109,7 @@ export class SsrSite extends Construct {
         app.registerTypes(this);
         function validateSiteExists() {
             if (!fs.existsSync(sitePath)) {
-                throw new Error(`No site found at "${path.resolve(sitePath)}"`);
+                throw new VisibleError(`No site found at "${path.resolve(sitePath)}"`);
             }
         }
         function validateTimeout() {
@@ -119,9 +118,15 @@ export class SsrSite extends Construct {
                 : toCdkDuration(timeout).toSeconds();
             const limit = edge ? 30 : 180;
             if (num > limit) {
-                throw new Error(edge
-                    ? `Timeout must be less than or equal to 30 seconds when the "edge" flag is enabled.`
-                    : `Timeout must be less than or equal to 180 seconds.`);
+                throw new VisibleError(edge
+                    ? `In the "${id}" construct, timeout must be less than or equal to 30 seconds when the "edge" flag is enabled.`
+                    : `In the "${id}" construct, timeout must be less than or equal to 180 seconds.`);
+            }
+        }
+        function validateDeprecatedFileOptions() {
+            // @ts-expect-error
+            if (props.fileOptions) {
+                throw new VisibleError(`In the "${id}" construct, the "fileOptions" property has been replaced by "assets.fileOptions". More details on upgrading - https://docs.sst.dev/upgrade-guide#upgrade-to-v2310`);
             }
         }
         function writeTypesFile(typesPath) {
@@ -411,8 +416,7 @@ function handler(event) {
                 originPath: "/" + (props.originPath ?? ""),
             });
             const assets = createS3OriginAssets(props.copy);
-            const assetFileOptions = fileOptions || createS3OriginAssetFileOptions(props.copy, cache);
-            const s3deployCR = createS3OriginDeployment(assets, assetFileOptions);
+            const s3deployCR = createS3OriginDeployment(props.copy, assets);
             s3DeployCRs.push(s3deployCR);
             return s3Origin;
         }
@@ -562,185 +566,44 @@ function handler(event) {
             }
             return assets;
         }
-        function createS3OriginAssetFileOptions(copy, cache) {
-            const fileOptions = [];
-            const textEncoding = cache?.textEncoding ?? "UTF-8";
-            const nonVersionedFilesTTL = typeof cache?.nonVersionedFilesTTL === "number"
-                ? cache.nonVersionedFilesTTL
-                : toCdkDuration(cache?.nonVersionedFilesTTL ?? "1 day").toSeconds();
-            const staleWhileRevalidateTTL = Math.max(Math.floor(nonVersionedFilesTTL / 10), 30);
-            const nonVersionedFilesCacheHeader = cache?.nonVersionedFilesCacheHeader ??
-                `public,max-age=0,s-maxage=${nonVersionedFilesTTL},stale-while-revalidate=${staleWhileRevalidateTTL}`;
-            const versionedFilesTTL = typeof cache?.versionedFilesTTL === "number"
-                ? cache.versionedFilesTTL
-                : toCdkDuration(cache?.versionedFilesTTL ?? "365 days").toSeconds();
-            const versionedFilesCacheHeader = cache?.versionedFilesCacheHeader ??
-                `public,max-age=${versionedFilesTTL},immutable`;
-            const commonWebFileExtensions = {
-                txt: { mime: "text/plain", isText: true },
-                htm: { mime: "text/html", isText: true },
-                html: { mime: "text/html", isText: true },
-                xhtml: { mime: "application/xhtml+xml", isText: true },
-                css: { mime: "text/css", isText: true },
-                js: { mime: "text/javascript", isText: true },
-                mjs: { mime: "text/javascript", isText: true },
-                apng: { mime: "image/apng", isText: false },
-                avif: { mime: "image/avif", isText: false },
-                gif: { mime: "image/gif", isText: false },
-                jpeg: { mime: "image/jpeg", isText: false },
-                jpg: { mime: "image/jpeg", isText: false },
-                png: { mime: "image/png", isText: false },
-                svg: { mime: "image/svg+xml", isText: true },
-                bmp: { mime: "image/bmp", isText: false },
-                tiff: { mime: "image/tiff", isText: false },
-                webp: { mime: "image/webp", isText: false },
-                ico: { mime: "image/vnd.microsoft.icon", isText: false },
-                eot: { mime: "application/vnd.ms-fontobject", isText: false },
-                ttf: { mime: "font/ttf", isText: false },
-                otf: { mime: "font/otf", isText: false },
-                woff: { mime: "font/woff", isText: false },
-                woff2: { mime: "font/woff2", isText: false },
-                json: { mime: "application/json", isText: true },
-                jsonld: { mime: "application/ld+json", isText: true },
-                xml: { mime: "application/xml", isText: true },
-                pdf: { mime: "application/pdf", isText: false },
-                zip: { mime: "application/zip", isText: false },
-            };
-            copy.forEach((files) => {
-                if (!files.cached)
-                    return;
-                for (const [extension, contentType] of Object.entries(commonWebFileExtensions)) {
-                    // Create a file option for: common extension + unversioned files
-                    fileOptions.push({
-                        filters: [
-                            { exclude: "*" },
-                            { include: `${path.posix.join(files.to, "*")}.${extension}` },
-                            ...(files.versionedSubDir
-                                ? [
-                                    {
-                                        exclude: path.posix.join(files.to, files.versionedSubDir, "*"),
-                                    },
-                                ]
-                                : []),
-                        ],
-                        cacheControl: nonVersionedFilesCacheHeader,
-                        contentType: `${contentType.mime}${contentType.isText && textEncoding !== "none"
-                            ? `;charset=${textEncoding}`
-                            : ""}`,
-                    });
-                    // Create a file option for: common extension + versioned files
-                    if (files.versionedSubDir) {
-                        fileOptions.push({
-                            filters: [
-                                { exclude: "*" },
-                                {
-                                    include: path.posix.join(files.to, files.versionedSubDir, `*.${extension}`),
-                                },
-                            ],
-                            cacheControl: versionedFilesCacheHeader,
-                            contentType: `${contentType.mime}${contentType.isText && textEncoding !== "none"
-                                ? `;charset=${textEncoding}`
-                                : ""}`,
-                        });
-                    }
-                }
-                // Create a file option for: other extensions + unversioned files
-                fileOptions.push({
-                    filters: [
-                        { include: "*" },
-                        ...(files.versionedSubDir
-                            ? [
-                                {
-                                    exclude: path.posix.join(files.to, files.versionedSubDir, "*"),
-                                },
-                            ]
-                            : []),
-                        ...Object.entries(commonWebFileExtensions).map(([ext]) => ({
-                            exclude: `*.${ext}`,
-                        })),
-                    ],
-                    cacheControl: nonVersionedFilesCacheHeader,
-                });
-                // Create a file option for: other extensions + versioned files
-                if (files.versionedSubDir) {
-                    fileOptions.push({
-                        filters: [
-                            {
-                                include: path.posix.join(files.to, files.versionedSubDir, "*"),
-                            },
-                            ...Object.entries(commonWebFileExtensions).map(([ext]) => ({
-                                exclude: `*.${ext}`,
-                            })),
-                        ],
-                        cacheControl: versionedFilesCacheHeader,
-                    });
-                }
-            });
-            if (cache?.fileOptions) {
-                fileOptions.push(...cache.fileOptions);
-            }
-            return fileOptions;
-        }
-        function createS3OriginDeployment(assets, fileOptions) {
-            // Create a Lambda function that will be doing the uploading
-            const uploader = new CdkFunction(self, "S3Uploader", {
-                code: Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-                layers: [useAwsCliLayer()],
-                runtime: Runtime.PYTHON_3_11,
-                handler: "s3-upload.handler",
-                timeout: CdkDuration.minutes(15),
-                memorySize: 1024,
-            });
-            bucket.grantReadWrite(uploader);
-            assets.forEach((asset) => asset.grantRead(uploader));
-            // Create the custom resource function
-            const handler = new CdkFunction(self, "S3Handler", {
-                code: Code.fromAsset(path.join(__dirname, "../support/base-site-custom-resource")),
-                layers: [useAwsCliLayer()],
-                runtime: Runtime.PYTHON_3_11,
-                handler: "s3-handler.handler",
-                timeout: CdkDuration.minutes(15),
-                memorySize: 1024,
-                environment: {
-                    UPLOADER_FUNCTION_NAME: uploader.functionName,
-                },
+        function createS3OriginDeployment(copy, s3Assets) {
+            const policy = new Policy(self, "S3UploaderPolicy", {
+                statements: [
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
+                        actions: ["lambda:InvokeFunction"],
+                        resources: [stack.customResourceHandler.functionArn],
+                    }),
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
+                        actions: ["s3:ListBucket", "s3:PutObject", "s3:DeleteObject"],
+                        resources: [bucket.bucketArn, `${bucket.bucketArn}/*`],
+                    }),
+                    new PolicyStatement({
+                        effect: Effect.ALLOW,
+                        actions: ["s3:GetObject"],
+                        resources: [`${s3Assets[0].bucket.bucketArn}/*`],
+                    }),
+                ],
             });
-            bucket.grantReadWrite(handler);
-            uploader.grantInvoke(handler);
-            // Create custom resource
-            return new CustomResource(self, "S3Deployment", {
-                serviceToken: handler.functionArn,
-                resourceType: "Custom::SSTBucketDeployment",
+            stack.customResourceHandler.role?.attachInlinePolicy(policy);
+            const resource = new CustomResource(self, "S3Uploader", {
+                serviceToken: stack.customResourceHandler.functionArn,
+                resourceType: "Custom::S3Uploader",
                 properties: {
-                    Sources: assets.map((asset) => ({
-                        BucketName: asset.s3BucketName,
-                        ObjectKey: asset.s3ObjectKey,
+                    sources: s3Assets.map((s3Asset) => ({
+                        bucketName: s3Asset.s3BucketName,
+                        objectKey: s3Asset.s3ObjectKey,
                     })),
-                    DestinationBucketName: bucket.bucketName,
-                    FileOptions: (fileOptions || []).map((o) => {
-                        const { filters, cacheControl, contentType, contentEncoding } = o;
-                        const { include, exclude } = o;
-                        return [
-                            ...(typeof exclude === "string" ? [exclude] : exclude ?? [])
-                                .map((entry) => ["--exclude", entry])
-                                .flat(2),
-                            ...(typeof include === "string" ? [include] : include ?? [])
-                                .map((entry) => ["--include", entry])
-                                .flat(2),
-                            ...(filters || [])
-                                .map((filter) => Object.entries(filter).map(([key, value]) => [
-                                `--${key}`,
-                                value,
-                            ]))
-                                .flat(2),
-                            cacheControl ? ["--cache-control", cacheControl] : [],
-                            contentType ? ["--content-type", contentType] : [],
-                            contentEncoding ? ["--content-encoding", contentEncoding] : [],
-                        ].flat();
-                    }),
-                    ReplaceValues: getS3ContentReplaceValues(),
+                    destinationBucketName: bucket.bucketName,
+                    concurrency: assets?._uploadConcurrency,
+                    textEncoding: assets?.textEncoding ?? "utf-8",
+                    fileOptions: getS3FileOptions(copy),
+                    replaceValues: getS3ContentReplaceValues(),
                 },
             });
+            resource.node.addDependency(policy);
+            return resource;
         }
         function useFunctionUrlSigningFunction() {
             singletonUrlSigner =
@@ -768,10 +631,40 @@ function handler(event) {
                     OriginRequestPolicy.fromOriginRequestPolicyId(self, "ServerOriginRequestPolicy", "b689b0a8-53d0-40ab-baf2-68738e2966ac");
             return singletonOriginRequestPolicy;
         }
-        function useAwsCliLayer() {
-            singletonAwsCliLayer =
-                singletonAwsCliLayer ?? new AwsCliLayer(self, "AwsCliLayer");
-            return singletonAwsCliLayer;
+        function getS3FileOptions(copy) {
+            const fileOptions = [];
+            const nonVersionedFilesTTL = typeof assets?.nonVersionedFilesTTL === "number"
+                ? assets.nonVersionedFilesTTL
+                : toCdkDuration(assets?.nonVersionedFilesTTL ?? "1 day").toSeconds();
+            const staleWhileRevalidateTTL = Math.max(Math.floor(nonVersionedFilesTTL / 10), 30);
+            const versionedFilesTTL = typeof assets?.versionedFilesTTL === "number"
+                ? assets.versionedFilesTTL
+                : toCdkDuration(assets?.versionedFilesTTL ?? "365 days").toSeconds();
+            copy.forEach(({ cached, to, versionedSubDir }) => {
+                if (!cached)
+                    return;
+                // Create a default file option for: unversioned files
+                fileOptions.push({
+                    files: "**",
+                    ignore: versionedSubDir
+                        ? path.posix.join(to, versionedSubDir, "**")
+                        : undefined,
+                    cacheControl: assets?.nonVersionedFilesCacheHeader ??
+                        `public,max-age=0,s-maxage=${nonVersionedFilesTTL},stale-while-revalidate=${staleWhileRevalidateTTL}`,
+                });
+                // Create a default file option for: versioned files
+                if (versionedSubDir) {
+                    fileOptions.push({
+                        files: path.posix.join(to, versionedSubDir, "**"),
+                        cacheControl: assets?.versionedFilesCacheHeader ??
+                            `public,max-age=${versionedFilesTTL},immutable`,
+                    });
+                }
+            });
+            if (assets?.fileOptions) {
+                fileOptions.push(...assets.fileOptions);
+            }
+            return fileOptions;
         }
         function getS3ContentReplaceValues() {
             const replaceValues = [];
@@ -796,7 +689,7 @@ function handler(event) {
             return replaceValues;
         }
         function createDistributionInvalidation() {
-            const cdnInvalidationStrategy = cache?.cdnInvalidationStrategy ?? "all";
+            const cdnInvalidationStrategy = assets?.cdnInvalidationStrategy ?? "all";
             if (cdnInvalidationStrategy === "never")
                 return;
             if (plan.buildId) {
@@ -833,31 +726,26 @@ function handler(event) {
                 // The below options are needed to support following symlinks when building zip files:
                 // - nodir: This will prevent symlinks themselves from being copied into the zip.
                 // - follow: This will follow symlinks and copy the files within.
-                const globOptions = {
-                    dot: true,
-                    nodir: true,
-                    follow: true,
-                    cwd: path.resolve(sitePath, item.from),
-                };
                 // For versioned files, use file path for digest since file version in name should change on content change
                 if (item.versionedSubDir) {
-                    glob
-                        .sync("**", {
-                        ...globOptions,
+                    globSync("**", {
+                        dot: true,
+                        nodir: true,
+                        follow: true,
                         cwd: path.resolve(sitePath, item.from, item.versionedSubDir),
-                    })
-                        .forEach((filePath) => hash.update(filePath));
+                    }).forEach((filePath) => hash.update(filePath));
                 }
                 // For non-versioned files, use file content for digest
                 if (cdnInvalidationStrategy === "all") {
-                    glob
-                        .sync("**", {
-                        ...globOptions,
+                    globSync("**", {
                         ignore: item.versionedSubDir
                             ? [path.posix.join(item.versionedSubDir, "**")]
                             : undefined,
-                    })
-                        .forEach((filePath) => hash.update(fs.readFileSync(path.resolve(sitePath, item.from, filePath))));
+                        dot: true,
+                        nodir: true,
+                        follow: true,
+                        cwd: path.resolve(sitePath, item.from),
+                    }).forEach((filePath) => hash.update(fs.readFileSync(path.resolve(sitePath, item.from, filePath))));
                 }
             });
             const buildId = hash.digest("hex");