sst 2.40.1 → 2.40.4

package/constructs/Function.js

@@ -6,9 +6,10 @@ import zlib from "zlib";
 import { Stack } from "./Stack.js";
 import { Job } from "./Job.js";
 import { Secret } from "./Config.js";
+import { isSSTConstruct } from "./Construct.js";
 import { toCdkSize } from "./util/size.js";
 import { toCdkDuration } from "./util/duration.js";
-import { bindEnvironment, bindPermissions, getReferencedSecrets, } from "./util/functionBinding.js";
+import { getBindingEnvironments, getBindingPermissions, getBindingReferencedSecrets, } from "./util/binding.js";
 import { attachPermissionsToRole } from "./util/permission.js";
 import * as functionUrlCors from "./util/functionUrlCors.js";
 import url from "url";
@@ -251,6 +252,15 @@ export class Function extends CDKFunction {
                         ...(props.container?.buildArgs
                             ? { buildArgs: props.container.buildArgs }
                             : {}),
+                        ...(props.container?.buildSsh
+                            ? { buildSsh: props.container.buildSsh }
+                            : {}),
+                        ...(props.container?.cacheFrom
+                            ? { cacheFrom: props.container.cacheFrom }
+                            : {}),
+                        ...(props.container?.cacheTo
+                            ? { cacheTo: props.container.cacheTo }
+                            : {}),
                         exclude: [".sst/dist", ".sst/artifacts"],
                         ignoreMode: IgnoreMode.GLOB,
                     });
@@ -341,20 +351,14 @@ export class Function extends CDKFunction {
     bind(constructs) {
         // Get referenced secrets
         const referencedSecrets = [];
-        constructs.forEach((c) => referencedSecrets.push(...getReferencedSecrets(c)));
-        [...constructs, ...referencedSecrets].forEach((c) => {
+        constructs.forEach((r) => referencedSecrets.push(...getBindingReferencedSecrets(r)));
+        [...constructs, ...referencedSecrets].forEach((r) => {
             // Bind environment
-            const env = bindEnvironment(c);
+            const env = getBindingEnvironments(r);
             Object.entries(env).forEach(([key, value]) => this.addEnvironment(key, value));
             // Bind permissions
-            const permissions = bindPermissions(c);
-            Object.entries(permissions).forEach(([action, resources]) => this.attachPermissions([
-                new PolicyStatement({
-                    actions: [action],
-                    effect: Effect.ALLOW,
-                    resources,
-                }),
-            ]));
+            const policyStatements = getBindingPermissions(r);
+            this.attachPermissions(policyStatements);
         });
         this.allBindings.push(...constructs, ...referencedSecrets);
     }
@@ -389,14 +393,15 @@ export class Function extends CDKFunction {
                 missingSourcemap: this.missingSourcemap === true ? true : undefined,
                 localId: this.node.addr,
                 secrets: this.allBindings
-                    .filter((c) => c instanceof Secret)
+                    .map((r) => (isSSTConstruct(r) ? r : r.resource))
+                    .filter((r) => r instanceof Secret)
                     .map((c) => c.name),
                 prefetchSecrets: this.props.prefetchSecrets,
             },
         };
     }
     /** @internal */
-    getFunctionBinding() {
+    getBindings() {
         return {
             clientPackage: "function",
             variables: {

package/constructs/Job.d.ts

@@ -1,4 +1,5 @@
 import { Construct } from "constructs";
+import { DockerCacheOption } from "aws-cdk-lib/core";
 import { Function as CdkFunction } from "aws-cdk-lib/aws-lambda";
 import { Project } from "aws-cdk-lib/aws-codebuild";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
@@ -6,11 +7,13 @@ import { SSTConstruct } from "./Construct.js";
 import { NodeJSProps, FunctionCopyFilesProps } from "./Function.js";
 import { Duration } from "./util/duration.js";
 import { Permissions } from "./util/permission.js";
-import { FunctionBindingProps } from "./util/functionBinding.js";
+import { BindingResource, BindingProps } from "./util/binding.js";
 import { ISecurityGroup, IVpc, SubnetSelection } from "aws-cdk-lib/aws-ec2";
 export type JobMemorySize = "3 GB" | "7 GB" | "15 GB" | "145 GB";
 export interface JobNodeJSProps extends NodeJSProps {
 }
+export interface JobContainerCacheProps extends DockerCacheOption {
+}
 export interface JobContainerProps {
     /**
      * Specify or override the CMD on the Docker image.
@@ -45,6 +48,42 @@ export interface JobContainerProps {
      * ```
      */
     buildArgs?: Record<string, string>;
+    /**
+     * SSH agent socket or keys to pass to the docker build command.
+     * Docker BuildKit must be enabled to use the ssh flag
+     * @default No --ssh flag is passed to the build command
+     * @example
+     * ```js
+     * container: {
+     *   buildSsh: "default"
+     * }
+     * ```
+     */
+    buildSsh?: string;
+    /**
+     * Cache from options to pass to the docker build command.
+     * [DockerCacheOption](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecr_assets.DockerCacheOption.html)[].
+     * @default No cache from options are passed to the build command
+     * @example
+     * ```js
+     * container: {
+     *   cacheFrom: [{ type: 'registry', params: { ref: 'ghcr.io/myorg/myimage:cache' }}],
+     * }
+     * ```
+     */
+    cacheFrom?: JobContainerCacheProps[];
+    /**
+     * Cache to options to pass to the docker build command.
+     * [DockerCacheOption](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecr_assets.DockerCacheOption.html)[].
+     * @default No cache to options are passed to the build command
+     * @example
+     * ```js
+     * container: {
+     *   cacheTo: { type: 'registry', params: { ref: 'ghcr.io/myorg/myimage:cache', mode: 'max', compression: 'zstd' }},
+     * }
+     * ```
+     */
+    cacheTo?: JobContainerCacheProps;
 }
 export interface JobProps {
     /**
@@ -180,7 +219,7 @@ export interface JobProps {
      * })
      * ```
      */
-    bind?: SSTConstruct[];
+    bind?: BindingResource[];
     /**
      * Attaches the given list of permissions to the job. Configuring this property is equivalent to calling `attachPermissions()` after the job is created.
      *
@@ -292,7 +331,7 @@ export declare class Job extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): FunctionBindingProps;
+    getBindings(): BindingProps;
     /**
      * Binds additional resources to job.
      *
@@ -301,7 +340,7 @@ export declare class Job extends Construct implements SSTConstruct {
      * job.bind([STRIPE_KEY, bucket]);
      * ```
      */
-    bind(constructs: SSTConstruct[]): void;
+    bind(constructs: BindingResource[]): void;
     /**
      * Attaches the given list of [permissions](Permissions.md) to the job. This allows the job to access other AWS resources.
      *

package/constructs/Job.js

@@ -2,7 +2,7 @@ import url from "url";
 import path from "path";
 import fs from "fs/promises";
 import { Construct } from "constructs";
-import { Duration as CdkDuration, IgnoreMode } from "aws-cdk-lib/core";
+import { Duration as CdkDuration, IgnoreMode, } from "aws-cdk-lib/core";
 import { Platform } from "aws-cdk-lib/aws-ecr-assets";
 import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
 import { AssetCode, Code, Runtime, Function as CdkFunction, } from "aws-cdk-lib/aws-lambda";
@@ -12,7 +12,7 @@ import { Stack } from "./Stack.js";
 import { Function, useFunctions, } from "./Function.js";
 import { toCdkDuration } from "./util/duration.js";
 import { attachPermissionsToRole } from "./util/permission.js";
-import { bindEnvironment, bindPermissions, getReferencedSecrets, } from "./util/functionBinding.js";
+import { getBindingEnvironments, getBindingPermissions, getBindingReferencedSecrets, } from "./util/binding.js";
 import { useDeferredTasks } from "./deferred_task.js";
 import { useProject } from "../project.js";
 import { useRuntimeHandlers } from "../runtime/handlers.js";
@@ -83,7 +83,7 @@ export class Job extends Construct {
         };
     }
     /** @internal */
-    getFunctionBinding() {
+    getBindings() {
         return {
             clientPackage: "job",
             variables: {
@@ -219,6 +219,9 @@ export class Job extends Construct {
                         : Platform.custom("linux/amd64"),
                     file: container?.file,
                     buildArgs: container?.buildArgs,
+                    buildSsh: container?.buildSsh,
+                    cacheFrom: container?.cacheFrom,
+                    cacheTo: container?.cacheTo,
                     exclude: [".sst/dist", ".sst/artifacts"],
                     ignoreMode: IgnoreMode.GLOB,
                 });
@@ -351,20 +354,14 @@ export class Job extends Construct {
     bindForCodeBuild(constructs) {
         // Get referenced secrets
         const referencedSecrets = [];
-        constructs.forEach((c) => referencedSecrets.push(...getReferencedSecrets(c)));
-        [...constructs, ...referencedSecrets].forEach((c) => {
+        constructs.forEach((r) => referencedSecrets.push(...getBindingReferencedSecrets(r)));
+        [...constructs, ...referencedSecrets].forEach((r) => {
             // Bind environment
-            const env = bindEnvironment(c);
+            const env = getBindingEnvironments(r);
             Object.entries(env).forEach(([key, value]) => this.addEnvironmentForCodeBuild(key, value));
             // Bind permissions
-            const permissions = bindPermissions(c);
-            Object.entries(permissions).forEach(([action, resources]) => this.attachPermissionsForCodeBuild([
-                new PolicyStatement({
-                    actions: [action],
-                    effect: Effect.ALLOW,
-                    resources,
-                }),
-            ]));
+            const policyStatements = getBindingPermissions(r);
+            this.attachPermissionsForCodeBuild(policyStatements);
         });
     }
     attachPermissionsForCodeBuild(permissions) {

package/constructs/KinesisStream.d.ts

@@ -3,7 +3,7 @@ import * as kinesis from "aws-cdk-lib/aws-kinesis";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn, FunctionProps, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
-import { FunctionBindingProps } from "./util/functionBinding.js";
+import { BindingResource, BindingProps } from "./util/binding.js";
 import { Permissions } from "./util/permission.js";
 /**
  * Used to define the function consumer for the stream
@@ -166,7 +166,7 @@ export declare class KinesisStream extends Construct implements SSTConstruct {
      * stream.bind([STRIPE_KEY, bucket]]);
      * ```
      */
-    bind(constructs: SSTConstruct[]): void;
+    bind(constructs: BindingResource[]): void;
     /**
      * Binds the given list of resources to a specific consumer.
      *
@@ -175,7 +175,7 @@ export declare class KinesisStream extends Construct implements SSTConstruct {
      * stream.bindToConsumer("consumer1", [STRIPE_KEY, bucket]);
      * ```
      */
-    bindToConsumer(consumerName: string, constructs: SSTConstruct[]): void;
+    bindToConsumer(consumerName: string, constructs: BindingResource[]): void;
     /**
      * Attaches the given list of permissions to all the consumers. This allows the functions to access other AWS resources.
      *
@@ -218,7 +218,7 @@ export declare class KinesisStream extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): FunctionBindingProps;
+    getBindings(): BindingProps;
     private createStream;
     private addConsumer;
 }

package/constructs/KinesisStream.js

@@ -149,7 +149,7 @@ export class KinesisStream extends Construct {
         };
     }
     /** @internal */
-    getFunctionBinding() {
+    getBindings() {
         return {
             clientPackage: "kinesis-stream",
             variables: {

package/constructs/Parameter.d.ts

@@ -1,6 +1,6 @@
 import { Construct } from "constructs";
 import { SSTConstruct } from "./Construct.js";
-import { FunctionBindingProps } from "./util/functionBinding.js";
+import { BindingProps } from "./util/binding.js";
 export interface ParameterProps {
     /**
      * Value of the parameter
@@ -32,6 +32,6 @@ export declare class Parameter extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): FunctionBindingProps;
+    getBindings(): BindingProps;
     static create<T extends Record<string, any>>(scope: Construct, parameters: T): { [key in keyof T]: Parameter; };
 }

package/constructs/Parameter.js

@@ -33,7 +33,7 @@ export class Parameter extends Construct {
         };
     }
     /** @internal */
-    getFunctionBinding() {
+    getBindings() {
         return {
             clientPackage: "config",
             variables: {

package/constructs/Queue.d.ts

@@ -4,7 +4,7 @@ import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
-import { FunctionBindingProps } from "./util/functionBinding.js";
+import { BindingResource, BindingProps } from "./util/binding.js";
 import { Permissions } from "./util/permission.js";
 /**
  * Used to define the consumer for the queue and invocation details
@@ -164,7 +164,7 @@ export declare class Queue extends Construct implements SSTConstruct {
      * queue.bind([STRIPE_KEY, bucket]);
      * ```
      */
-    bind(constructs: SSTConstruct[]): void;
+    bind(constructs: BindingResource[]): void;
     /**
      * Attaches additional permissions to the consumer function
      *
@@ -189,6 +189,6 @@ export declare class Queue extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): FunctionBindingProps;
+    getBindings(): BindingProps;
     private createQueue;
 }

package/constructs/Queue.js

@@ -158,7 +158,7 @@ export class Queue extends Construct {
         };
     }
     /** @internal */
-    getFunctionBinding() {
+    getBindings() {
         return {
             clientPackage: "queue",
             variables: {

package/constructs/RDS.d.ts

@@ -4,7 +4,7 @@ import { AuroraCapacityUnit, Endpoint, IServerlessCluster, ServerlessCluster, Se
 import { ISecret } from "aws-cdk-lib/aws-secretsmanager";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn } from "./Function.js";
-import { FunctionBindingProps } from "./util/functionBinding.js";
+import { BindingProps } from "./util/binding.js";
 export interface RDSTypes {
     path: string;
     camelCase?: boolean;
@@ -204,7 +204,7 @@ export declare class RDS extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): FunctionBindingProps;
+    getBindings(): BindingProps;
     private validateRequiredProps;
     private validateCDKPropWhenIsConstruct;
     private validateCDKPropWhenIsClusterProps;

package/constructs/RDS.js

@@ -116,7 +116,7 @@ export class RDS extends Construct {
         };
     }
     /** @internal */
-    getFunctionBinding() {
+    getBindings() {
         return {
             clientPackage: "rds",
             variables: {

package/constructs/Script.d.ts

@@ -2,6 +2,7 @@ import { Construct } from "constructs";
 import { Function as Fn, FunctionProps, FunctionDefinition } from "./Function.js";
 import { SSTConstruct } from "./Construct.js";
 import { Permissions } from "./util/permission.js";
+import { BindingResource } from "./util/binding.js";
 export interface ScriptProps {
     /**
      * An object of input parameters to be passed to the script. Made available in the `event` object of the function.
@@ -123,7 +124,7 @@ export declare class Script extends Construct implements SSTConstruct {
      * script.bind([STRIPE_KEY, bucket]);
      * ```
      */
-    bind(constructs: SSTConstruct[]): void;
+    bind(constructs: BindingResource[]): void;
     /**
      * Grants additional permissions to the script
      *
@@ -156,5 +157,5 @@ export declare class Script extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): undefined;
+    getBindings(): undefined;
 }

package/constructs/Script.js

@@ -6,7 +6,7 @@ import { PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Code, Runtime, Function as CdkFunction } from "aws-cdk-lib/aws-lambda";
 import { Stack } from "./Stack.js";
 import { Function as Fn, } from "./Function.js";
-import { getFunctionRef, } from "./Construct.js";
+import { getFunctionRef } from "./Construct.js";
 const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
 /////////////////////
 // Construct
@@ -175,7 +175,7 @@ export class Script extends Construct {
         };
     }
     /** @internal */
-    getFunctionBinding() {
+    getBindings() {
         return undefined;
     }
 }

package/constructs/Secret.d.ts

@@ -1,6 +1,6 @@
 import { Construct } from "constructs";
 import { SSTConstruct } from "./Construct.js";
-import { FunctionBindingProps } from "./util/functionBinding.js";
+import { BindingProps } from "./util/binding.js";
 /**
  * The `Secret` construct is a higher level CDK construct that makes it easy to manage app secrets.
  *
@@ -25,6 +25,6 @@ export declare class Secret extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): FunctionBindingProps;
+    getBindings(): BindingProps;
     static create<T extends string[]>(scope: Construct, ...parameters: T): { [key in T[number]]: Secret; };
 }

package/constructs/Secret.js

@@ -1,6 +1,6 @@
 import { Construct } from "constructs";
 import { Stack } from "./Stack.js";
-import { getParameterPath, getParameterFallbackPath, } from "./util/functionBinding.js";
+import { getParameterPath, getParameterFallbackPath, } from "./util/binding.js";
 /**
  * The `Secret` construct is a higher level CDK construct that makes it easy to manage app secrets.
  *
@@ -33,7 +33,7 @@ export class Secret extends Construct {
         };
     }
     /** @internal */
-    getFunctionBinding() {
+    getBindings() {
         const app = this.node.root;
         const partition = Stack.of(this).partition;
         return {

package/constructs/Service.d.ts

@@ -1,9 +1,10 @@
 import { Construct } from "constructs";
+import { DockerCacheOption } from "aws-cdk-lib/core";
 import { DistributionProps } from "aws-cdk-lib/aws-cloudfront";
 import { DistributionDomainProps } from "./Distribution.js";
 import { SSTConstruct } from "./Construct.js";
 import { Permissions } from "./util/permission.js";
-import { FunctionBindingProps } from "./util/functionBinding.js";
+import { BindingProps, BindingResource } from "./util/binding.js";
 import { IVpc } from "aws-cdk-lib/aws-ec2";
 import { Cluster, ContainerDefinitionOptions, CpuArchitecture, FargateService, FargateTaskDefinition, FargateServiceProps } from "aws-cdk-lib/aws-ecs";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
@@ -21,6 +22,8 @@ export interface ServiceDomainProps extends DistributionDomainProps {
 }
 export interface ServiceCdkDistributionProps extends Omit<DistributionProps, "defaultBehavior"> {
 }
+export interface ServiceContainerCacheProps extends DockerCacheOption {
+}
 export interface ServiceProps {
     /**
      * Path to the directory where the app is located.
@@ -167,7 +170,7 @@ export interface ServiceProps {
      * }
      * ```
      */
-    bind?: SSTConstruct[];
+    bind?: BindingResource[];
     /**
      * The customDomain for this service. SST supports domains that are hosted
      * either on [Route 53](https://aws.amazon.com/route53/) or externally.
@@ -255,6 +258,42 @@ export interface ServiceProps {
          * ```
          */
         buildArgs?: Record<string, string>;
+        /**
+         * SSH agent socket or keys to pass to the docker build command.
+         * Docker BuildKit must be enabled to use the ssh flag
+         * @default No --ssh flag is passed to the build command
+         * @example
+         * ```js
+         * container: {
+         *   buildSsh: "default"
+         * }
+         * ```
+         */
+        buildSsh?: string;
+        /**
+         * Cache from options to pass to the docker build command.
+         * [DockerCacheOption](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecr_assets.DockerCacheOption.html)[].
+         * @default No cache from options are passed to the build command
+         * @example
+         * ```js
+         * container: {
+         *   cacheFrom: [{ type: 'registry', params: { ref: 'ghcr.io/myorg/myimage:cache' }}],
+         * }
+         * ```
+         */
+        cacheFrom?: ServiceContainerCacheProps[];
+        /**
+         * Cache to options to pass to the docker build command.
+         * [DockerCacheOption](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecr_assets.DockerCacheOption.html)[].
+         * @default No cache to options are passed to the build command
+         * @example
+         * ```js
+         * container: {
+         *   cacheTo: { type: 'registry', params: { ref: 'ghcr.io/myorg/myimage:cache', mode: 'max', compression: 'zstd' }},
+         * }
+         * ```
+         */
+        cacheTo?: ServiceContainerCacheProps;
     };
     dev?: {
         /**
@@ -446,7 +485,7 @@ export declare class Service extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): FunctionBindingProps;
+    getBindings(): BindingProps;
     /**
      * Binds additional resources to service.
      *
@@ -455,7 +494,7 @@ export declare class Service extends Construct implements SSTConstruct {
      * service.bind([STRIPE_KEY, bucket]);
      * ```
      */
-    bind(constructs: SSTConstruct[]): void;
+    bind(constructs: BindingResource[]): void;
     /**
      * Attaches the given list of permissions to allow the service
      * to access other AWS resources.

package/constructs/Service.js

@@ -6,8 +6,8 @@ import { execAsync } from "../util/process.js";
 import { existsAsync } from "../util/fs.js";
 import { Colors } from "../cli/colors.js";
 import { Construct } from "constructs";
-import { Duration as CdkDuration, IgnoreMode } from "aws-cdk-lib/core";
-import { Role, Effect, PolicyStatement, AccountPrincipal, ServicePrincipal, CompositePrincipal, } from "aws-cdk-lib/aws-iam";
+import { Duration as CdkDuration, IgnoreMode, } from "aws-cdk-lib/core";
+import { Role, AccountPrincipal, ServicePrincipal, CompositePrincipal, } from "aws-cdk-lib/aws-iam";
 import { ViewerProtocolPolicy, AllowedMethods, CachedMethods, CachePolicy, CacheQueryStringBehavior, CacheHeaderBehavior, CacheCookieBehavior, OriginProtocolPolicy, OriginRequestPolicy, } from "aws-cdk-lib/aws-cloudfront";
 import { HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 import { Stack } from "./Stack.js";
@@ -16,7 +16,7 @@ import { Function } from "./Function.js";
 import { Secret } from "./Secret.js";
 import { useDeferredTasks } from "./deferred_task.js";
 import { attachPermissionsToRole } from "./util/permission.js";
-import { bindEnvironment, bindPermissions, getParameterPath, getReferencedSecrets, } from "./util/functionBinding.js";
+import { getParameterPath, getBindingEnvironments, getBindingPermissions, getBindingReferencedSecrets, } from "./util/binding.js";
 import { useProject } from "../project.js";
 import { Vpc } from "aws-cdk-lib/aws-ec2";
 import { AwsLogDriver, Cluster, ContainerImage, CpuArchitecture, FargateService, FargateTaskDefinition, } from "aws-cdk-lib/aws-ecs";
@@ -277,7 +277,7 @@ export class Service extends Construct {
         };
     }
     /** @internal */
-    getFunctionBinding() {
+    getBindings() {
         const app = this.node.root;
         return this.distribution
             ? {
@@ -557,20 +557,14 @@ export class Service extends Construct {
     bindForService(constructs) {
         // Get referenced secrets
         const referencedSecrets = [];
-        constructs.forEach((c) => referencedSecrets.push(...getReferencedSecrets(c)));
-        [...constructs, ...referencedSecrets].forEach((c) => {
+        constructs.forEach((r) => referencedSecrets.push(...getBindingReferencedSecrets(r)));
+        [...constructs, ...referencedSecrets].forEach((r) => {
             // Bind environment
-            const env = bindEnvironment(c);
+            const env = getBindingEnvironments(r);
             Object.entries(env).forEach(([key, value]) => this.addEnvironmentForService(key, value));
             // Bind permissions
-            const permissions = bindPermissions(c);
-            Object.entries(permissions).forEach(([action, resources]) => this.attachPermissionsForService([
-                new PolicyStatement({
-                    actions: [action],
-                    effect: Effect.ALLOW,
-                    resources,
-                }),
-            ]));
+            const policyStatements = getBindingPermissions(r);
+            this.attachPermissionsForService(policyStatements);
         });
     }
     addEnvironmentForService(name, value) {
@@ -639,6 +633,25 @@ export class Service extends Construct {
                 `--platform ${platform}`,
                 `-f ${path.join(servicePath, dockerfile)}`,
                 ...Object.entries(build?.buildArgs || {}).map(([k, v]) => `--build-arg ${k}=${v}`),
+                ...(build?.buildSsh ? [`--ssh ${build.buildSsh}`] : []),
+                ...(build?.cacheFrom || []).map((v) => "--cache-from=" +
+                    [
+                        `type=${v.type}`,
+                        ...(v.params
+                            ? Object.entries(v.params).map(([pk, pv]) => `${pk}=${pv}`)
+                            : []),
+                    ].join(",")),
+                ...(build?.cacheTo
+                    ? [
+                        "--cache-to " +
+                            [
+                                `type=${build?.cacheTo.type}`,
+                                ...(build?.cacheTo?.params
+                                    ? Object.entries(build?.cacheTo?.params).map(([pk, pv]) => `${pk}=${pv}`)
+                                    : []).join(","),
+                            ],
+                    ]
+                    : []),
                 this.props.path,
             ].join(" "), {
                 env: {
@@ -657,6 +670,9 @@ export class Service extends Construct {
             platform: architecture === "arm64" ? Platform.LINUX_ARM64 : Platform.LINUX_AMD64,
             file: dockerfile,
             buildArgs: build?.buildArgs,
+            buildSsh: build?.buildSsh,
+            cacheFrom: build?.cacheFrom,
+            cacheTo: build?.cacheTo,
             exclude: [".sst/dist", ".sst/artifacts"],
             ignoreMode: IgnoreMode.GLOB,
         });

package/constructs/SsrFunction.d.ts

@@ -4,6 +4,7 @@ import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { FunctionOptions, Function as CdkFunction, FunctionUrlOptions } from "aws-cdk-lib/aws-lambda";
 import { NodeJSProps, FunctionCopyFilesProps } from "./Function.js";
 import { SSTConstruct } from "./Construct.js";
+import { BindingResource } from "./util/binding.js";
 import { Permissions } from "./util/permission.js";
 import { Size } from "./util/size.js";
 import { Duration } from "./util/duration.js";
@@ -15,7 +16,7 @@ export interface SsrFunctionProps extends Omit<FunctionOptions, "memorySize" | "
     memorySize?: number | Size;
     permissions?: Permissions;
     environment?: Record<string, string>;
-    bind?: SSTConstruct[];
+    bind?: BindingResource[];
     nodejs?: NodeJSProps;
     copyFiles?: FunctionCopyFilesProps[];
     logRetention?: RetentionDays;
@@ -64,5 +65,5 @@ export declare class SsrFunction extends Construct implements SSTConstruct {
         };
     };
     /** @internal */
-    getFunctionBinding(): undefined;
+    getBindings(): undefined;
 }