Class AssetFreeCustomResource

java.lang.Object
com.cloudforgeci.api.core.customresource.AssetFreeCustomResource
public final class AssetFreeCustomResource extends Object
Shared plumbing for asset-free, Lambda-backed CloudFormation custom resources -- a raw CustomResource wired directly to a Code.fromInline Lambda's ARN, not AwsCustomResource/Provider (both of those pull in CDK's own bundled framework Lambda, staged to the deployer's private cdk-hnb659fds-assets bootstrap bucket -- unusable by an AWS Marketplace buyer launching a template directly in their own, unbootstrapped account).

Handles the three things that are easy to get wrong doing this by hand, each found by real review on the first custom resource rewritten this way (AlbFactory's ALB-logs-bucket SSM writer): the raw CloudFormation custom-resource response protocol (a rejected or non-2xx ResponseURL PUT must be treated as failure, not silently swallowed as success), the cloudformation.amazonaws.com invoke permission (implicit with AwsCustomResource/ Provider, not automatic on a raw CustomResource), and scoping that permission to this exact stack (otherwise any AWS account's CloudFormation could invoke the function by pointing their own custom resource's serviceToken at its ARN -- a confused-deputy path).

Callers supply only their own business logic (the AWS SDK call(s) to make) as a Node.js fragment defining exports.handler; this class supplies the shared response-protocol wrapper, Lambda/permission/CustomResource wiring, and IAM policy attachment.

  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    static final class 
    AssetFreeCustomResource.Result
    The Lambda function and the CustomResource wired to it, returned together so callers can add NagSuppressions, dependencies, or read response attributes via customResource.getAttString(...) as needed.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    METADATA_KEY
    Metadata key on each function this class creates; the compliance guards use it to skip them.
    static final String
    RESPONSE_PROTOCOL_JS
    The shared CloudFormation custom-resource response protocol, implementing the raw PUT-to- ResponseURL contract directly (not CDK's Provider framework, which pulls in a bundled, asset-staged Lambda).
    static final String
    SSM_PUT_PARAMETER_HANDLER_JS
    A complete, ready-to-use handler body (append to RESPONSE_PROTOCOL_JS, not on its own) for the single most common case: write one SSM parameter at deploy time.

  • Method Summary

    Modifier and Type
    Method
    Description
    static AssetFreeCustomResource.Result
    create(software.constructs.Construct scope, String idPrefix, String handlerBody, software.amazon.awscdk.Duration timeout, List<software.amazon.awscdk.services.iam.PolicyStatement> policyStatements, Map<String,Object> properties)
    Wires a complete asset-free custom resource: an inline Lambda running handlerBody (appended to RESPONSE_PROTOCOL_JS), a CloudFormation invoke permission scoped to this exact stack, the given IAM policy statements on the function's execution role, and a raw CustomResource pointed at it.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • METADATA_KEY

      public static final String METADATA_KEY
      Metadata key on each function this class creates; the compliance guards use it to skip them.
      See Also:

    • RESPONSE_PROTOCOL_JS

      public static final String RESPONSE_PROTOCOL_JS
      The shared CloudFormation custom-resource response protocol, implementing the raw PUT-to- ResponseURL contract directly (not CDK's Provider framework, which pulls in a bundled, asset-staged Lambda). Every caller's handler source is this snippet followed by their own exports.handler, which must call respond(event, 'SUCCESS'|'FAILED', reason, data) exactly once (data optional) instead of returning a value directly.
      See Also:

    • SSM_PUT_PARAMETER_HANDLER_JS

      public static final String SSM_PUT_PARAMETER_HANDLER_JS
      A complete, ready-to-use handler body (append to RESPONSE_PROTOCOL_JS, not on its own) for the single most common case: write one SSM parameter at deploy time. Takes ParameterName/ParameterValue/ParameterDescription/Region from ResourceProperties; does nothing on delete (the parameter is left in place, matching every caller's own reason for using SSM here -- tracking a resource across stack updates, not tying its lifecycle to one).
      See Also:

  • Method Details

    • create

      public static AssetFreeCustomResource.Result create(software.constructs.Construct scope, String idPrefix, String handlerBody, software.amazon.awscdk.Duration timeout, List<software.amazon.awscdk.services.iam.PolicyStatement> policyStatements, Map<String,Object> properties)
      Wires a complete asset-free custom resource: an inline Lambda running handlerBody (appended to RESPONSE_PROTOCOL_JS), a CloudFormation invoke permission scoped to this exact stack, the given IAM policy statements on the function's execution role, and a raw CustomResource pointed at it.
      Parameters:
      scope - construct scope (the calling factory)
      idPrefix - used to derive the Lambda's construct id (idPrefix + "Fn") and the CustomResource's own construct id (idPrefix)
      handlerBody - the Node.js source defining exports.handler, using respond from RESPONSE_PROTOCOL_JS instead of returning a value directly
      timeout - Lambda execution timeout
      policyStatements - granted to the function's execution role (IAM, not CFN invoke -- the invoke grant is always added automatically and always scoped to this stack)
      properties - passed through as the CustomResource's ResourceProperties