1import * as appconfig from "@distilled.cloud/aws/appconfig";
2import * as Output from "../../Output.ts";
3import type { Application } from "./Application.ts";
4import { makeAppConfigHttpBinding } from "./BindingHttp.ts";
5import type { ConfigurationProfile } from "./ConfigurationProfile.ts";
6import { ValidateConfiguration } from "./ValidateConfiguration.ts";
7
8/**
9 * HTTP implementation of the {@link ValidateConfiguration} binding. Calls
10 * `appconfig:ValidateConfiguration` with the Lambda's IAM role, scoped to
11 * the bound configuration profile.
12 */
13export const ValidateConfigurationHttp = makeAppConfigHttpBinding(
14 ValidateConfiguration,
15 {
16 operation: appconfig.validateConfiguration,
17 spec: (
18 application: Application,
19 configurationProfile: ConfigurationProfile,
20 ) => ({
21 identifiers: {
22 ApplicationId: application.applicationId,
23 ConfigurationProfileId: configurationProfile.configurationProfileId,
24 },
25 // The service authorization reference lists configurationprofile +
26 // hostedconfigurationversion, but the LIVE authorizer evaluates the
27 // APPLICATION ARN (CloudTrail: "not authorized to perform:
28 // appconfig:ValidateConfiguration on resource: ...:application/{id}").
29 // Grant all three.
30 iam: ({ region, accountId }) => ({
31 actions: ["appconfig:ValidateConfiguration"],
32 resources: [
33 Output.interpolate`arn:aws:appconfig:${region}:${accountId}:application/${application.applicationId}`,
34 Output.interpolate`arn:aws:appconfig:${region}:${accountId}:application/${application.applicationId}/configurationprofile/${configurationProfile.configurationProfileId}`,
35 Output.interpolate`arn:aws:appconfig:${region}:${accountId}:application/${application.applicationId}/configurationprofile/${configurationProfile.configurationProfileId}/hostedconfigurationversion/*`,
36 ],
37 }),
38 }),
39 },
40);