sst 2.8.7 → 2.8.9

package/constructs/Bucket.d.ts

@@ -149,9 +149,8 @@ export interface BucketProps {
     name?: string;
     /**
      * The CORS configuration of this bucket.
-     *
+     * @default true
      * @example
-     *
      * ```js
      * new Bucket(stack, "Bucket", {
      *   cors: true,
@@ -170,6 +169,17 @@ export interface BucketProps {
      * ```
      */
     cors?: boolean | BucketCorsRule[];
+    /**
+     * Block public access to this bucket.
+     * @default false
+     * @example
+     * ```js
+     * new Bucket(stack, "Bucket", {
+     *   blockPublicAccess: true,
+     * });
+     * ```
+     */
+    blockPublicAccess?: boolean;
     /**
      * The default function props to be applied to all the Lambda functions in the API. The `environment`, `permissions` and `layers` properties will be merged with per route definitions if they are defined.
      *
@@ -347,5 +357,6 @@ export declare class Bucket extends Construct implements SSTConstruct {
     private addTopicNotification;
     private addFunctionNotification;
     private buildCorsConfig;
+    private buildBlockPublicAccessConfig;
 }
 export {};

package/constructs/Bucket.js

@@ -4,7 +4,7 @@ import { Topic } from "./Topic.js";
 import { getFunctionRef, isCDKConstruct } from "./Construct.js";
 import { Function as Fn, } from "./Function.js";
 import { toCdkDuration } from "./util/duration.js";
-import { Bucket as CDKBucket, EventType, HttpMethods, } from "aws-cdk-lib/aws-s3";
+import { Bucket as CDKBucket, BlockPublicAccess, EventType, HttpMethods, } from "aws-cdk-lib/aws-s3";
 import { LambdaDestination, SnsDestination, SqsDestination, } from "aws-cdk-lib/aws-s3-notifications";
 /////////////////////
 // Construct
@@ -171,7 +171,7 @@ export class Bucket extends Construct {
         };
     }
     createBucket() {
-        const { name, cors, cdk } = this.props;
+        const { name, cors, blockPublicAccess, cdk } = this.props;
         if (isCDKConstruct(cdk?.bucket)) {
             if (cors !== undefined) {
                 throw new Error(`Cannot configure the "cors" when "cdk.bucket" is a construct`);
@@ -182,6 +182,7 @@ export class Bucket extends Construct {
             this.cdk.bucket = new CDKBucket(this, "Bucket", {
                 bucketName: name,
                 cors: this.buildCorsConfig(cors),
+                blockPublicAccess: this.buildBlockPublicAccessConfig(blockPublicAccess),
                 ...cdk?.bucket,
             });
         }
@@ -281,10 +282,10 @@ export class Bucket extends Construct {
         fn.bind(this.bindingForAllNotifications);
     }
     buildCorsConfig(cors) {
-        if (cors === undefined || cors === false) {
+        if (cors === false) {
             return;
         }
-        if (cors === true) {
+        if (cors === undefined || cors === true) {
             return [
                 {
                     allowedHeaders: ["*"],
@@ -308,4 +309,14 @@ export class Bucket extends Construct {
             maxAge: e.maxAge && toCdkDuration(e.maxAge).toSeconds(),
         }));
     }
+    buildBlockPublicAccessConfig(config) {
+        return config === true
+            ? BlockPublicAccess.BLOCK_ALL
+            : new BlockPublicAccess({
+                blockPublicAcls: false,
+                blockPublicPolicy: false,
+                ignorePublicAcls: false,
+                restrictPublicBuckets: false,
+            });
+    }
 }

package/constructs/Cognito.d.ts

@@ -2,7 +2,7 @@ import { Construct } from "constructs";
 import { SSTConstruct } from "./Construct.js";
 import { Function as Fn, FunctionProps, FunctionDefinition } from "./Function.js";
 import { Permissions } from "./util/permission.js";
-import { CfnIdentityPool, CfnIdentityPoolProps, IUserPool, IUserPoolClient, UserPoolClientOptions, UserPoolProps } from "aws-cdk-lib/aws-cognito";
+import { CfnIdentityPool, CfnIdentityPoolProps, CfnIdentityPoolRoleAttachment, IUserPool, IUserPoolClient, UserPoolClientOptions, UserPoolProps } from "aws-cdk-lib/aws-cognito";
 import { Role } from "aws-cdk-lib/aws-iam";
 export interface CognitoUserPoolTriggers {
     createAuthChallenge?: FunctionDefinition;
@@ -136,6 +136,7 @@ export declare class Cognito extends Construct implements SSTConstruct {
         userPool: IUserPool;
         userPoolClient: IUserPoolClient;
         cfnIdentityPool?: CfnIdentityPool;
+        cfnIdentityPoolRoleAttachment?: CfnIdentityPoolRoleAttachment;
         authRole: Role;
         unauthRole: Role;
     };

package/constructs/Cognito.js

@@ -275,7 +275,7 @@ export class Cognito extends Construct {
         this.cdk.authRole = this.createAuthRole(this.cdk.cfnIdentityPool);
         this.cdk.unauthRole = this.createUnauthRole(this.cdk.cfnIdentityPool);
         // Attach roles to Identity Pool
-        new CfnIdentityPoolRoleAttachment(this, "IdentityPoolRoleAttachment", {
+        this.cdk.cfnIdentityPoolRoleAttachment = new CfnIdentityPoolRoleAttachment(this, "IdentityPoolRoleAttachment", {
             identityPoolId: this.cdk.cfnIdentityPool.ref,
             roles: {
                 authenticated: this.cdk.authRole.roleArn,

package/constructs/SsrSite.js

@@ -8,7 +8,7 @@ import { execSync } from "child_process";
 import { Construct } from "constructs";
 import { Fn, Token, Duration as CdkDuration, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import { BlockPublicAccess, Bucket, } from "aws-cdk-lib/aws-s3";
-import { Role, Effect, Policy, PolicyStatement, AccountPrincipal, } from "aws-cdk-lib/aws-iam";
+import { Role, Effect, Policy, PolicyStatement, AccountPrincipal, ServicePrincipal, CompositePrincipal, } from "aws-cdk-lib/aws-iam";
 import { Function as CdkFunction, Code, Runtime, FunctionUrlAuthType, } from "aws-cdk-lib/aws-lambda";
 import { HostedZone, ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
 import { Asset } from "aws-cdk-lib/aws-s3-assets";
@@ -432,7 +432,7 @@ export class SsrSite extends Construct {
         const { runtime, timeout, memorySize, permissions, environment, bind } = this.props;
         const app = this.node.root;
         const role = new Role(this, "ServerFunctionRole", {
-            assumedBy: new AccountPrincipal(app.account),
+            assumedBy: new CompositePrincipal(new AccountPrincipal(app.account), new ServicePrincipal("lambda.amazonaws.com")),
             maxSessionDuration: CdkDuration.hours(12),
         });
         const ssrFn = new SsrFunction(this, `ServerFunction`, {

package/constructs/StaticSite.d.ts

@@ -2,7 +2,7 @@ import { Construct } from "constructs";
 import { Bucket, BucketProps, IBucket } from "aws-cdk-lib/aws-s3";
 import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 import { IHostedZone } from "aws-cdk-lib/aws-route53";
-import { Distribution } from "aws-cdk-lib/aws-cloudfront";
+import { Distribution, IDistribution } from "aws-cdk-lib/aws-cloudfront";
 import { BaseSiteDomainProps, BaseSiteReplaceProps, BaseSiteCdkDistributionProps } from "./BaseSite.js";
 import { SSTConstruct } from "./Construct.js";
 import { FunctionBindingProps } from "./util/functionBinding.js";
@@ -242,7 +242,7 @@ export interface StaticSiteProps {
          */
         bucket?: BucketProps | IBucket;
         /**
-         * Configure the internally created CDK `Distribution` instance.
+         * Configure the internally created CDK `Distribution` instance or provide an existing distribution
          *
          * @example
          * ```js
@@ -256,7 +256,7 @@ export interface StaticSiteProps {
          * });
          * ```
          */
-        distribution?: StaticSiteCdkDistributionProps;
+        distribution?: IDistribution | StaticSiteCdkDistributionProps;
     };
 }
 export interface StaticSiteDomainProps extends BaseSiteDomainProps {
@@ -322,7 +322,6 @@ export declare class StaticSite extends Construct implements SSTConstruct {
     private bundleFilenamesAsset;
     private createS3Bucket;
     private createS3Deployment;
-    private validateCloudFrontDistributionSettings;
     private createCfDistribution;
     private createCloudFrontInvalidation;
     protected buildDistributionDomainNames(): string[];

package/constructs/StaticSite.js

@@ -86,7 +86,6 @@ export class StaticSite extends Construct {
         // Create S3 Deployment
         const s3deployCR = this.createS3Deployment(cliLayer, assets, filenamesAsset);
         // Create CloudFront
-        this.validateCloudFrontDistributionSettings();
         this.distribution = this.createCfDistribution();
         this.distribution.node.addDependency(s3deployCR);
         // Invalidate CloudFront
@@ -372,8 +371,16 @@ interface ImportMeta {
     /////////////////////
     // CloudFront Distribution
     /////////////////////
-    validateCloudFrontDistributionSettings() {
+    createCfDistribution() {
         const { cdk, errorPage } = this.props;
+        const isImportedCloudFrontDistribution = (distribution) => {
+            return distribution !== undefined && isCDKConstruct(distribution);
+        };
+        // cdk.distribution is an imported construct
+        if (isImportedCloudFrontDistribution(cdk?.distribution)) {
+            return cdk?.distribution;
+        }
+        // Validate input
         if (cdk?.distribution?.certificate) {
             throw new Error(`Do not configure the "cfDistribution.certificate". Use the "customDomain" to configure the domain certificate.`);
         }
@@ -383,11 +390,8 @@ interface ImportMeta {
         if (errorPage && cdk?.distribution?.errorResponses) {
             throw new Error(`Cannot configure the "cfDistribution.errorResponses" when "errorPage" is passed in. Use one or the other to configure the behavior for error pages.`);
         }
-    }
-    createCfDistribution() {
-        const { cdk, errorPage } = this.props;
-        const indexPage = this.props.indexPage || "index.html";
         // Create CloudFront distribution
+        const indexPage = this.props.indexPage || "index.html";
         return new Distribution(this, "Distribution", {
             // these values can be overwritten by cfDistributionProps
             defaultRootObject: indexPage,

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.8.7",
+  "version": "2.8.9",
   "bin": {
     "sst": "cli/sst.js"
   },