py-serverless-kit 0.1.0__py3-none-any.whl

py_serverless_kit/providers/aws.py

@@ -0,0 +1,508 @@
+"""AWS: Lambda + API Gateway HTTP API + EventBridge Scheduler + SQS + S3 + SNS + Step Functions."""
+
+from __future__ import annotations
+
+import json
+from typing import Any, Dict, List, Optional, Tuple
+
+from ..config.schema import FunctionConfig, ServiceConfig
+from ..runtime.adapters.base import envelope
+from ..workflows import definition_dict
+from ..workflows.asl import compile_asl
+from . import schedule as sched
+from .base import ALL_CAPABILITIES, Issue, Provider, RenderContext
+from .terraform_doc import TerraformDoc, escape, ref, tf_id
+
+LAMBDA = "aws_lambda_function"
+BASIC_EXEC = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+SQS_EXEC = "arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole"
+
+
+def _assume(service: str) -> str:
+    return json.dumps(
+        {
+            "Version": "2012-10-17",
+            "Statement": [{"Effect": "Allow", "Principal": {"Service": service}, "Action": "sts:AssumeRole"}],
+        }
+    )
+
+
+def _policy(statements: List[Dict[str, Any]]) -> str:
+    return json.dumps({"Version": "2012-10-17", "Statement": statements})
+
+
+class AwsProvider(Provider):
+    name = "aws"
+    display_name = "AWS Lambda"
+    tier = "stable"
+    terraform_source = "hashicorp/aws"
+    terraform_version = ">= 5.40"
+    default_region = "us-east-1"
+    capabilities = frozenset(ALL_CAPABILITIES)
+    max_name_length = 64
+    name_pattern = r"[^a-z0-9_-]"
+    runtimes = {f"python3.{v}": f"python3.{v}" for v in (9, 10, 11, 12, 13)}
+    vendor_dependencies = True
+    max_timeout = 900
+    notes = "HTTP via API Gateway HTTP API; schedules via EventBridge Scheduler; workflows via Step Functions."
+
+    # ------------------------------------------------------------------ bundle
+    def shim_files(self, config: ServiceConfig) -> Dict[str, str]:
+        return {
+            "pskit_entry.py": (
+                "# Generated by py-serverless-kit. Lambda handler: pskit_entry.handler\n"
+                "from py_serverless_kit.runtime.adapters.aws import handler  # noqa: F401\n"
+            )
+        }
+
+    def provider_block(self, ctx: RenderContext) -> Dict[str, Any]:
+        block: Dict[str, Any] = {"region": ctx.region, "default_tags": {"tags": ctx.tags()}}
+        for key in ("profile", "allowed_account_ids"):
+            if ctx.opt(key):
+                block[key] = ctx.opt(key)
+        if ctx.opt("assume_role_arn"):
+            block["assume_role"] = {"role_arn": ctx.opt("assume_role_arn")}
+        return block
+
+    def extra_validation(self, config: ServiceConfig) -> List[Issue]:
+        issues = []
+        for name, fn in config.functions.items():
+            for ev in fn.events_of("http"):
+                if ev.auth == "key":
+                    issues.append(
+                        Issue(
+                            "error",
+                            "API keys are not available on API Gateway HTTP APIs; use jwt or iam",
+                            f"functions.{name}",
+                        )
+                    )
+                if ev.auth == "jwt" and not {"issuer", "audience"} <= set(ev.authorizer):
+                    issues.append(
+                        Issue("error", "jwt auth needs authorizer.issuer and authorizer.audience", f"functions.{name}")
+                    )
+        return issues
+
+    # ------------------------------------------------------------------ render
+    def render_resources(self, doc: TerraformDoc, ctx: RenderContext) -> None:
+        cfg = ctx.config
+        has = {e.type for fn in cfg.functions.values() for e in fn.events}
+        shared_role = self._role(doc, ctx, "lambda", cfg.provider.iam.statements, "queue" in has, cfg.provider.iam.role)
+
+        fn_out: Dict[str, Dict[str, Any]] = {}
+        arns: Dict[str, str] = {}
+        api_id: Optional[str] = None
+        s3_notifications: Dict[str, List[Tuple[str, Any]]] = {}
+
+        for name, fn in ctx.function_items():
+            role = shared_role
+            if fn.iam.statements or fn.iam.role:
+                role = self._role(
+                    doc,
+                    ctx,
+                    f"fn-{name}",
+                    cfg.provider.iam.statements + fn.iam.statements,
+                    bool(fn.events_of("queue")),
+                    fn.iam.role,
+                )
+            lam = self._function(doc, ctx, name, fn, role)
+            arns[name] = ref(lam, "arn")
+            out: Dict[str, Any] = {
+                "id": ref(lam, "function_name"),
+                "arn": ref(lam, "arn"),
+                "console": f"https://{ctx.region}.console.aws.amazon.com/lambda/home?region={ctx.region}#/functions/{ctx.physical_name(name)}",
+            }
+            http_events = fn.events_of("http")
+            if http_events:
+                api_id = api_id or self._api(doc, ctx)
+                self._http(doc, ctx, api_id, name, lam, http_events)
+                out["base_url"] = ref(api_id, "api_endpoint")
+            for i, ev in enumerate(fn.events_of("schedule")):
+                self._schedule(doc, ctx, name, lam, i, ev)
+            for ev in fn.events_of("queue"):
+                self._queue(doc, ctx, name, lam, ev)
+            for ev in fn.events_of("storage"):
+                s3_notifications.setdefault(ev.bucket, []).append((name, ev))
+            for ev in fn.events_of("topic"):
+                self._topic(doc, ctx, name, lam, ev)
+            fn_out[name] = out
+
+        for bucket, subs in sorted(s3_notifications.items()):
+            self._bucket_notifications(doc, ctx, bucket, subs, arns)
+
+        wf_out = self._workflows(doc, ctx, arns)
+        doc.output(
+            "pskit",
+            {
+                "functions": fn_out,
+                "workflows": wf_out,
+                "endpoint": ref(api_id, "api_endpoint") if api_id else None,
+            },
+            description="py-serverless-kit deployment summary",
+        )
+
+    # ------------------------------------------------------------------ pieces
+    def _role(
+        self,
+        doc: TerraformDoc,
+        ctx: RenderContext,
+        label: str,
+        statements: List[Any],
+        sqs: bool,
+        existing: Optional[str],
+    ) -> str:
+        """Return a Terraform expression for the role ARN."""
+        if existing:
+            return existing
+        role = doc.resource(
+            "aws_iam_role",
+            label,
+            {"name": ctx.physical_name(label)[:64], "assume_role_policy": _assume("lambda.amazonaws.com")},
+        )
+        doc.resource(
+            "aws_iam_role_policy_attachment", f"{label}-basic", {"role": ref(role, "name"), "policy_arn": BASIC_EXEC}
+        )
+        if sqs:
+            doc.resource(
+                "aws_iam_role_policy_attachment", f"{label}-sqs", {"role": ref(role, "name"), "policy_arn": SQS_EXEC}
+            )
+        if statements:
+            doc.resource(
+                "aws_iam_role_policy",
+                f"{label}-custom",
+                {
+                    "name": "pskit-custom",
+                    "role": ref(role, "id"),
+                    "policy": escape(
+                        _policy(
+                            [{"Effect": s.effect, "Action": s.actions, "Resource": s.resources} for s in statements]
+                        )
+                    ),
+                },
+            )
+        return ref(role, "arn")
+
+    def _function(self, doc: TerraformDoc, ctx: RenderContext, name: str, fn: FunctionConfig, role_arn: str) -> str:
+        cfg = ctx.config
+        phys = ctx.physical_name(name)
+        depends: List[str] = []
+        if cfg.provider.log_retention_days:
+            lg = doc.resource(
+                "aws_cloudwatch_log_group",
+                f"logs-{name}",
+                {"name": f"/aws/lambda/{phys}", "retention_in_days": cfg.provider.log_retention_days},
+            )
+            depends.append(lg)
+        body: Dict[str, Any] = {
+            "function_name": phys,
+            "description": fn.description[:256],
+            "role": role_arn,
+            "handler": "pskit_entry.handler",
+            "runtime": self.runtime_id(cfg.runtime_of(fn)),
+            "filename": "${path.module}/artifact.zip",
+            "source_code_hash": ctx.artifact.sha256_b64,
+            "memory_size": cfg.memory_of(fn),
+            "timeout": cfg.timeout_of(fn),
+            "architectures": [cfg.architecture_of(fn)],
+            "environment": {"variables": {k: escape(v) for k, v in ctx.environment(name, fn).items()}},
+            "tags": ctx.tags(fn),
+        }
+        if fn.concurrency is not None:
+            body["reserved_concurrent_executions"] = fn.concurrency
+        if depends:
+            body["depends_on"] = depends
+        body.update(fn.options)  # escape hatch: vpc_config, layers, tracing_config, ...
+        return doc.resource(LAMBDA, name, body)
+
+    def _api(self, doc: TerraformDoc, ctx: RenderContext) -> str:
+        cors_cfgs = [
+            ev.cors_config
+            for fn in ctx.config.functions.values()
+            for ev in fn.events_of("http")
+            if ev.cors_config is not None
+        ]
+        body: Dict[str, Any] = {"name": ctx.prefix, "protocol_type": "HTTP", "tags": ctx.tags()}
+        if cors_cfgs:
+            origins = sorted({o for c in cors_cfgs for o in c.origins})
+            methods = sorted({m for c in cors_cfgs for m in (c.methods or ["*"])})
+            headers = sorted({h for c in cors_cfgs for h in (c.headers or ["*"])})
+            body["cors_configuration"] = {
+                "allow_origins": origins,
+                "allow_methods": methods,
+                "allow_headers": headers,
+                "expose_headers": sorted({h for c in cors_cfgs for h in c.expose_headers}),
+                "allow_credentials": any(c.allow_credentials for c in cors_cfgs),
+                "max_age": max(c.max_age for c in cors_cfgs),
+            }
+        api = doc.resource("aws_apigatewayv2_api", "http", body)
+        doc.resource(
+            "aws_apigatewayv2_stage",
+            "default",
+            {"api_id": ref(api, "id"), "name": "$default", "auto_deploy": True, "tags": ctx.tags()},
+        )
+        return api
+
+    def _http(self, doc: TerraformDoc, ctx: RenderContext, api: str, name: str, lam: str, events: List[Any]) -> None:
+        integ = doc.resource(
+            "aws_apigatewayv2_integration",
+            name,
+            {
+                "api_id": ref(api, "id"),
+                "integration_type": "AWS_PROXY",
+                "integration_uri": ref(lam, "invoke_arn"),
+                "payload_format_version": "2.0",
+                "timeout_milliseconds": min(30000, ctx.config.timeout_of(ctx.config.functions[name]) * 1000),
+            },
+        )
+        for i, ev in enumerate(events):
+            route: Dict[str, Any] = {
+                "api_id": ref(api, "id"),
+                "route_key": f"{ev.method} {ev.path}",
+                "target": "integrations/" + ref(integ, "id"),
+            }
+            if ev.auth == "iam":
+                route["authorization_type"] = "AWS_IAM"
+            elif ev.auth == "jwt":
+                authz = doc.resource(
+                    "aws_apigatewayv2_authorizer",
+                    f"{name}-jwt-{i}",
+                    {
+                        "api_id": ref(api, "id"),
+                        "authorizer_type": "JWT",
+                        "name": f"{name}-jwt-{i}",
+                        "identity_sources": [ev.authorizer.get("identity_source", "$request.header.Authorization")],
+                        "jwt_configuration": {
+                            "issuer": ev.authorizer["issuer"],
+                            "audience": list(ev.authorizer["audience"])
+                            if isinstance(ev.authorizer["audience"], list)
+                            else [ev.authorizer["audience"]],
+                        },
+                    },
+                )
+                route["authorization_type"] = "JWT"
+                route["authorizer_id"] = ref(authz, "id")
+                if ev.authorizer.get("scopes"):
+                    route["authorization_scopes"] = list(ev.authorizer["scopes"])
+            doc.resource("aws_apigatewayv2_route", f"{name}-{i}", route)
+        doc.resource(
+            "aws_lambda_permission",
+            f"{name}-apigw",
+            {
+                "statement_id": "AllowAPIGatewayInvoke",
+                "action": "lambda:InvokeFunction",
+                "function_name": ref(lam, "function_name"),
+                "principal": "apigateway.amazonaws.com",
+                "source_arn": ref(api, "execution_arn") + "/*/*",
+            },
+        )
+
+    def _scheduler_role(self, doc: TerraformDoc, ctx: RenderContext) -> str:
+        if not doc.has_resource("aws_iam_role", "scheduler"):
+            role = doc.resource(
+                "aws_iam_role",
+                "scheduler",
+                {"name": ctx.physical_name("scheduler")[:64], "assume_role_policy": _assume("scheduler.amazonaws.com")},
+            )
+            doc.resource(
+                "aws_iam_role_policy",
+                "scheduler-invoke",
+                {
+                    "name": "invoke-lambda",
+                    "role": ref(role, "id"),
+                    "policy": _policy([{"Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "*"}]),
+                },
+            )
+        return ref("aws_iam_role", "scheduler", "arn")
+
+    def _schedule(self, doc: TerraformDoc, ctx: RenderContext, name: str, lam: str, i: int, ev: Any) -> None:
+        role = self._scheduler_role(doc, ctx)
+        doc.resource(
+            "aws_scheduler_schedule",
+            f"{name}-{i}",
+            {
+                "name": ctx.physical_name(f"{name}-{ev.name or i}")[:64],
+                "group_name": "default",
+                "schedule_expression": sched.aws_expression(ev),
+                "schedule_expression_timezone": ev.timezone,
+                "state": "ENABLED" if ev.enabled else "DISABLED",
+                "flexible_time_window": {"mode": "OFF"},
+                "target": {
+                    "arn": ref(lam, "arn"),
+                    "role_arn": role,
+                    "input": escape(json.dumps(envelope("schedule", ev.input, source="aws.scheduler"))),
+                    "retry_policy": {"maximum_retry_attempts": 2},
+                },
+            },
+        )
+
+    def _queue_ref(self, doc: TerraformDoc, ctx: RenderContext, ev: Any, timeout: int) -> str:
+        qname = ev.name + (".fifo" if ev.fifo and not ev.name.endswith(".fifo") else "")
+        label = f"q-{qname}"
+        if ev.existing:
+            return doc.data("aws_sqs_queue", label, {"name": qname}) + ""
+        if not doc.has_resource("aws_sqs_queue", label):
+            body: Dict[str, Any] = {
+                "name": qname,
+                "visibility_timeout_seconds": ev.visibility_timeout or max(30, timeout * 6),
+                "message_retention_seconds": 1209600,
+                "tags": ctx.tags(),
+            }
+            if ev.fifo:
+                body["fifo_queue"] = True
+                body["content_based_deduplication"] = True
+            if ev.dead_letter:
+                dlq_name = ev.dead_letter + (".fifo" if ev.fifo and not ev.dead_letter.endswith(".fifo") else "")
+                dlq_label = f"q-{dlq_name}"
+                if not doc.has_resource("aws_sqs_queue", dlq_label):
+                    dlq_body: Dict[str, Any] = {
+                        "name": dlq_name,
+                        "message_retention_seconds": 1209600,
+                        "tags": ctx.tags(),
+                    }
+                    if ev.fifo:
+                        dlq_body["fifo_queue"] = True
+                    doc.resource("aws_sqs_queue", dlq_label, dlq_body)
+                body["redrive_policy"] = (
+                    '{"deadLetterTargetArn":"'
+                    + ref("aws_sqs_queue", tf_id(dlq_label), "arn")
+                    + '","maxReceiveCount":'
+                    + str(ev.max_receive)
+                    + "}"
+                )
+            doc.resource("aws_sqs_queue", label, body)
+        return f"aws_sqs_queue.{tf_id(label)}"
+
+    def _queue(self, doc: TerraformDoc, ctx: RenderContext, name: str, lam: str, ev: Any) -> None:
+        q = self._queue_ref(doc, ctx, ev, ctx.config.timeout_of(ctx.config.functions[name]))
+        body: Dict[str, Any] = {
+            "event_source_arn": ref(q, "arn"),
+            "function_name": ref(lam, "arn"),
+            "batch_size": ev.batch_size,
+            "function_response_types": ["ReportBatchItemFailures"],
+        }
+        if ev.batch_window:
+            body["maximum_batching_window_in_seconds"] = ev.batch_window
+        doc.resource("aws_lambda_event_source_mapping", f"{name}-{ev.name}", body)
+
+    def _bucket_notifications(
+        self, doc: TerraformDoc, ctx: RenderContext, bucket: str, subs: List[Tuple[str, Any]], arns: Dict[str, str]
+    ) -> None:
+        label = f"b-{bucket}"
+        if any(not ev.existing for _, ev in subs):
+            if not doc.has_resource("aws_s3_bucket", label):
+                b = doc.resource("aws_s3_bucket", label, {"bucket": bucket, "tags": ctx.tags()})
+                doc.resource(
+                    "aws_s3_bucket_public_access_block",
+                    label,
+                    {
+                        "bucket": ref(b, "id"),
+                        "block_public_acls": True,
+                        "block_public_policy": True,
+                        "ignore_public_acls": True,
+                        "restrict_public_buckets": True,
+                    },
+                )
+            bucket_ref = f"aws_s3_bucket.{tf_id(label)}"
+        else:
+            bucket_ref = doc.data("aws_s3_bucket", label, {"bucket": bucket})
+        perms = []
+        configs = []
+        for fname, ev in subs:
+            perm = doc.resource(
+                "aws_lambda_permission",
+                f"{fname}-s3-{bucket}",
+                {
+                    "statement_id": f"AllowS3-{tf_id(bucket)}",
+                    "action": "lambda:InvokeFunction",
+                    "function_name": arns[fname],
+                    "principal": "s3.amazonaws.com",
+                    "source_arn": ref(bucket_ref, "arn"),
+                },
+            )
+            perms.append(perm)
+            events = [{"created": "s3:ObjectCreated:*", "deleted": "s3:ObjectRemoved:*"}[e] for e in ev.events]
+            entry: Dict[str, Any] = {"lambda_function_arn": arns[fname], "events": events}
+            if ev.prefix:
+                entry["filter_prefix"] = ev.prefix
+            if ev.suffix:
+                entry["filter_suffix"] = ev.suffix
+            configs.append(entry)
+        doc.resource(
+            "aws_s3_bucket_notification",
+            label,
+            {"bucket": ref(bucket_ref, "id"), "lambda_function": configs, "depends_on": perms},
+        )
+
+    def _topic(self, doc: TerraformDoc, ctx: RenderContext, name: str, lam: str, ev: Any) -> None:
+        label = f"t-{ev.name}"
+        if ev.existing:
+            topic = doc.data("aws_sns_topic", label, {"name": ev.name})
+        else:
+            if not doc.has_resource("aws_sns_topic", label):
+                doc.resource("aws_sns_topic", label, {"name": ev.name, "tags": ctx.tags()})
+            topic = f"aws_sns_topic.{tf_id(label)}"
+        sub: Dict[str, Any] = {"topic_arn": ref(topic, "arn"), "protocol": "lambda", "endpoint": ref(lam, "arn")}
+        if ev.filter:
+            sub["filter_policy"] = escape(json.dumps(ev.filter))
+        doc.resource("aws_sns_topic_subscription", f"{name}-{ev.name}", sub)
+        doc.resource(
+            "aws_lambda_permission",
+            f"{name}-sns-{ev.name}",
+            {
+                "statement_id": f"AllowSNS-{tf_id(ev.name)}",
+                "action": "lambda:InvokeFunction",
+                "function_name": ref(lam, "function_name"),
+                "principal": "sns.amazonaws.com",
+                "source_arn": ref(topic, "arn"),
+            },
+        )
+
+    def _workflows(self, doc: TerraformDoc, ctx: RenderContext, arns: Dict[str, str]) -> Dict[str, Any]:
+        out: Dict[str, Any] = {}
+        native = {n: wf for n, wf in ctx.config.workflows.items() if ctx.workflow_engines.get(n) == "native"}
+        if not native:
+            for n in ctx.config.workflows:
+                out[n] = {"id": ref(LAMBDA, tf_id(f"{n}-orchestrator"), "function_name")}
+            return out
+        role = doc.resource(
+            "aws_iam_role",
+            "states",
+            {"name": ctx.physical_name("states")[:64], "assume_role_policy": _assume("states.amazonaws.com")},
+        )
+        used = sorted({fn for wf in native.values() for fn in wf.task_functions()})
+        doc.resource(
+            "aws_iam_role_policy",
+            "states-invoke",
+            {
+                "name": "invoke-tasks",
+                "role": ref(role, "id"),
+                "policy": '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"lambda:InvokeFunction","Resource":['
+                + ",".join(f'"{arns[f]}","{arns[f]}:*"' for f in used)
+                + "]}]}",
+            },
+        )
+        for name, wf in sorted(ctx.config.workflows.items()):
+            if name not in native:
+                out[name] = {"id": ref(LAMBDA, tf_id(f"{name}-orchestrator"), "function_name")}
+                continue
+            placeholders = {f: f"__PSKIT_ARN_{i}__" for i, f in enumerate(sorted(arns))}
+            asl = compile_asl(definition_dict(wf), placeholders.__getitem__, wf.description, wf.timeout or 0)
+            text = escape(json.dumps(asl, indent=2))
+            for f, token in placeholders.items():
+                text = text.replace(token, arns[f])
+            sm = doc.resource(
+                "aws_sfn_state_machine",
+                f"wf-{name}",
+                {
+                    "name": ctx.physical_name(name)[:80],
+                    "role_arn": ref(role, "arn"),
+                    "type": str(wf.options.get("type", "STANDARD")).upper(),
+                    "definition": text,
+                    "tags": ctx.tags(),
+                },
+            )
+            out[name] = {
+                "id": ref(sm, "arn"),
+                "console": f"https://{ctx.region}.console.aws.amazon.com/states/home?region={ctx.region}#/statemachines/view/"
+                + ref(sm, "arn"),
+            }
+        return out