{"version":3,"sources":["jsdelivr-header.js","/npm/@aws-solutions-constructs/aws-kinesisfirehose-s3@2.100.1/lib/index.ts"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,+JCOA,gBAAA,QAAA,mCACA,aAAA,QAAA,cAEA,SAAA,QAAA,kCACA,IAAA,QAAA,uBACA,OAAA,QAAA,kCAEA,IAAA,QAAA,eACA,IAAA,QAAA,uBAmDA,MAAa,4BAA4B,aAAA,UAgBvC,WAAA,CAAY,EAAkB,EAAY,GACxC,MAAM,EAAO,GAIb,KAAK,KAAK,WAAW,mDAAmD,GAExE,SAAS,aAAa,GACtB,SAAS,+BAA+B,KAAM,EAAM,sBAEpD,MAAM,EAAa,kBAEnB,IAAI,EAGJ,GAAK,EAAM,kBAoBT,EAAS,EAAM,sBApBa,CAC5B,IAAI,EAAc,EAAM,aAAe,GACvC,EAAc,EAAM,0BAClB,EAAA,OAAA,eAAc,EAAa,CAAE,uBAAwB,EAAM,2BAC3D,EAGF,MAAM,EAAwB,SAAS,cAAc,KAAM,CACzD,cACA,mBAAoB,EAAM,mBAC1B,gBAAiB,EAAM,kBAEzB,KAAK,SAAW,EAAsB,OAItC,KAAK,gBAAkB,EAAM,8BAA2B,EAAY,EAAsB,cAE1F,EAAS,KAAK,QAChB,CAIA,KAAK,kBAAoB,EAGzB,KAAK,wBAA0B,SAAS,cACtC,KACA,qBACA,EAAM,eAER,MAAM,EAA8B,KAAK,wBAAwB,UAC/D,uBAIF,KAAK,oBAAsB,IAAI,IAAI,KAAK,KAAM,sBAAuB,CACnE,UAAW,IAAI,IAAI,iBAAiB,4BAEtC,SAAS,yBAAyB,KAAK,oBAAqB,CAAC,+BAGtC,IAAI,IAAI,OAAO,KAAM,wBAAyB,CACnE,WAAY,CACV,IAAI,IAAI,gBAAgB,CACtB,QAAS,CACP,0BACA,uBACA,eACA,gBACA,gCACA,gBAEF,UAAW,CAAC,GAAG,EAAO,YAAa,GAAG,EAAO,iBAE/C,IAAI,IAAI,gBAAgB,CACtB,QAAS,CAAC,qBACV,UAAW,CACT,OAAO,IAAI,IAAI,kBAAkB,IAAI,IAAI,UAAU,IAAI,IAAI,wBAAwB,KAAK,wBAAwB,2BAA2B,EAAY,sBAOhJ,aAAa,KAAK,qBAEjC,MAAM,EAA0B,IAAI,MAAM,cACxC,EACA,GAAG,mBACH,gBAMI,EAAqB,SAAS,aAAa,KAAM,GAGvD,IAAI,EAAsE,SAAS,8BACjF,EAAO,UACP,KAAK,oBAAoB,QACzB,KAAK,wBAAwB,aAC7B,EAAY,cACZ,EACA,GAIG,EAAM,sBACR,EAAM,qBAAqB,oBACsB,0BAAlD,EAAM,qBAAqB,qBAE3B,EAA8B,SAAS,cACrC,EACA,CACE,2CAA4C,CAC1C,QAAS,oBAMjB,MAAM,GAAuB,EAAA,OAAA,kBAAiB,EAA6B,EAAM,sBAEjF,KAAK,gBAAkB,IAAI,gBAAgB,kBACzC,KACA,EACA,GAGF,SAAS,yBAAyB,KAAK,gBAAiB,CACtD,4EACA,2EAEJ,EAlJF,QAAA,wC","file":"/npm/@aws-solutions-constructs/aws-kinesisfirehose-s3@2.100.1/lib/index.js","sourceRoot":"","sourcesContent":["/**\n * Minified by jsDelivr using Terser v5.39.0.\n * Original file: /npm/@aws-solutions-constructs/aws-kinesisfirehose-s3@2.100.1/lib/index.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","/**\n *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n *\n *  Licensed under the Apache License, Version 2.0 (the \"License\"). You may not use this file except in compliance\n *  with the License. A copy of the License is located at\n *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES\n *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions\n *  and limitations under the License.\n */\n\nimport * as kinesisfirehose from \"aws-cdk-lib/aws-kinesisfirehose\";\nimport { Construct } from \"constructs\";\nimport * as s3 from \"aws-cdk-lib/aws-s3\";\nimport * as defaults from \"@aws-solutions-constructs/core\";\nimport * as iam from \"aws-cdk-lib/aws-iam\";\nimport { overrideProps, consolidateProps } from \"@aws-solutions-constructs/core\";\nimport * as logs from \"aws-cdk-lib/aws-logs\";\nimport * as cdk from \"aws-cdk-lib\";\nimport * as kms from \"aws-cdk-lib/aws-kms\";\n\n/**\n * The properties for the KinesisFirehoseToS3 class.\n */\nexport interface KinesisFirehoseToS3Props {\n  /**\n   * Optional user provided props to override the default props for the S3 Bucket, providing both this and `existingBucketObj` will cause an error.\n   *\n   * @default - Default props are used\n   */\n  readonly bucketProps?: s3.BucketProps;\n  /**\n   * Optional - existing instance of S3 Bucket. If this is provided, then also providing bucketProps causes an error.\n   *\n   * @default - None\n   */\n  readonly existingBucketObj?: s3.IBucket;\n  /**\n   * Optional existing instance of logging S3 Bucket for the S3 Bucket created by the pattern.\n   *\n   * @default - None\n   */\n  readonly existingLoggingBucketObj?: s3.IBucket;\n  /**\n   * Optional user provided props to override the default props\n   *\n   * @default - Default props are used\n   */\n  readonly kinesisFirehoseProps?: kinesisfirehose.CfnDeliveryStreamProps | any;\n  /**\n   * Optional user provided props to override the default props for the CloudWatchLogs LogGroup.\n   *\n   * @default - Default props are used\n   */\n  readonly logGroupProps?: logs.LogGroupProps;\n  /**\n   * Optional user provided props to override the default props for the S3 Logging Bucket.\n   *\n   * @default - Default props are used\n   */\n  readonly loggingBucketProps?: s3.BucketProps;\n  /**\n   * Whether to turn on Access Logs for the S3 bucket with the associated storage costs.\n   * Enabling Access Logging is a best practice.\n   *\n   * @default - true\n   */\n  readonly logS3AccessLogs?: boolean;\n}\n\nexport class KinesisFirehoseToS3 extends Construct {\n  public readonly kinesisFirehose: kinesisfirehose.CfnDeliveryStream;\n  public readonly kinesisFirehoseLogGroup: logs.LogGroup;\n  public readonly kinesisFirehoseRole: iam.Role;\n  public readonly s3Bucket?: s3.Bucket;\n  public readonly s3LoggingBucket?: s3.Bucket;\n  public readonly s3BucketInterface: s3.IBucket;\n\n  /**\n   * Constructs a new instance of the KinesisFirehoseToS3 class.\n   * @param {cdk.App} scope - represents the scope for all the resources.\n   * @param {string} id - this is a a scope-unique id.\n   * @param {KinesisFirehoseToS3Props} props - user provided props for the construct.\n   * @since 0.8.0-beta\n   * @access public\n   */\n  constructor(scope: Construct, id: string, props: KinesisFirehoseToS3Props) {\n    super(scope, id);\n\n    // All our tests are based upon this behavior being on, so we're setting\n    // context here rather than assuming the client will set it\n    this.node.setContext(\"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy\", true);\n\n    defaults.CheckS3Props(props);\n    defaults.ValidateCfnDeliveryStreamProps(this, props.kinesisFirehoseProps);\n\n    const firehoseId = 'KinesisFirehose';\n\n    let bucket: s3.IBucket;\n\n    // Setup S3 Bucket\n    if (!props.existingBucketObj) {\n      let bucketProps = props.bucketProps ?? {};\n      bucketProps = props.existingLoggingBucketObj ?\n        overrideProps(bucketProps, { serverAccessLogsBucket: props.existingLoggingBucketObj }) :\n        bucketProps;\n\n      // Setup logging S3 Bucket\n      const buildS3BucketResponse = defaults.buildS3Bucket(this, {\n        bucketProps,\n        loggingBucketProps: props.loggingBucketProps,\n        logS3AccessLogs: props.logS3AccessLogs,\n      });\n      this.s3Bucket = buildS3BucketResponse.bucket;\n      // Commit fd5a4f1fe5bd4fb85265b895eec4c36349a8bf64 fixed the core routine,\n      // but changed this behavior. Forcing undefined to pass existing test, but we\n      // should clarify behavior for construct properties when existing values are passed in.\n      this.s3LoggingBucket = props.existingLoggingBucketObj ? undefined : buildS3BucketResponse.loggingBucket;\n\n      bucket = this.s3Bucket;\n    } else {\n      bucket = props.existingBucketObj;\n    }\n\n    this.s3BucketInterface = bucket;\n\n    // Setup Cloudwatch Log group & stream for Kinesis Firehose\n    this.kinesisFirehoseLogGroup = defaults.buildLogGroup(\n      this,\n      \"firehose-log-group\",\n      props.logGroupProps\n    );\n    const cwLogStream: logs.LogStream = this.kinesisFirehoseLogGroup.addStream(\n      \"firehose-log-stream\"\n    );\n\n    // Setup the IAM Role for Kinesis Firehose\n    this.kinesisFirehoseRole = new iam.Role(this, \"KinesisFirehoseRole\", {\n      assumedBy: new iam.ServicePrincipal(\"firehose.amazonaws.com\"),\n    });\n    defaults.addCfnGuardSuppressRules(this.kinesisFirehoseRole, [\"IAM_NO_INLINE_POLICY_CHECK\"]);\n\n    // Setup the IAM policy for Kinesis Firehose\n    const firehosePolicy = new iam.Policy(this, \"KinesisFirehosePolicy\", {\n      statements: [\n        new iam.PolicyStatement({\n          actions: [\n            \"s3:AbortMultipartUpload\",\n            \"s3:GetBucketLocation\",\n            \"s3:GetObject\",\n            \"s3:ListBucket\",\n            \"s3:ListBucketMultipartUploads\",\n            \"s3:PutObject\",\n          ],\n          resources: [`${bucket.bucketArn}`, `${bucket.bucketArn}/*`],\n        }),\n        new iam.PolicyStatement({\n          actions: [\"logs:PutLogEvents\"],\n          resources: [\n            `arn:${cdk.Aws.PARTITION}:logs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:log-group:${this.kinesisFirehoseLogGroup.logGroupName}:log-stream:${cwLogStream.logStreamName}`,\n          ],\n        }),\n      ],\n    });\n\n    // Attach policy to role\n    firehosePolicy.attachToRole(this.kinesisFirehoseRole);\n\n    const awsManagedKey: kms.IKey = kms.Alias.fromAliasName(\n      scope,\n      `${id}aws-managed-key`,\n      \"alias/aws/s3\"\n    );\n\n    // We need a stream name to set an environment variable, as this is an L1 construct\n    // accessing the name as a token doesn't work for environment variable contents, so\n    // we take explicit control of the stream name (but will be overridden by a client provided name)\n    const deliveryStreamName = defaults.generateName(this, firehoseId);\n\n    // Setup the default Kinesis Firehose props\n    let defaultKinesisFirehoseProps: kinesisfirehose.CfnDeliveryStreamProps = defaults.DefaultCfnDeliveryStreamProps(\n      bucket.bucketArn,\n      this.kinesisFirehoseRole.roleArn,\n      this.kinesisFirehoseLogGroup.logGroupName,\n      cwLogStream.logStreamName,\n      awsManagedKey,\n      deliveryStreamName\n    );\n\n    // if the client didn't explicitly say it was a Kinesis client, then turn on encryption\n    if (!props.kinesisFirehoseProps ||\n      !props.kinesisFirehoseProps.deliveryStreamType ||\n      props.kinesisFirehoseProps.deliveryStreamType !== 'KinesisStreamAsSource'\n    ) {\n      defaultKinesisFirehoseProps = defaults.overrideProps(\n        defaultKinesisFirehoseProps,\n        {\n          deliveryStreamEncryptionConfigurationInput: {\n            keyType: \"AWS_OWNED_CMK\",\n          },\n        }\n      );\n    }\n\n    const kinesisFirehoseProps = consolidateProps(defaultKinesisFirehoseProps, props.kinesisFirehoseProps);\n\n    this.kinesisFirehose = new kinesisfirehose.CfnDeliveryStream(\n      this,\n      firehoseId,\n      kinesisFirehoseProps\n    );\n\n    defaults.addCfnGuardSuppressRules(this.kinesisFirehose, [\n      \"KINESIS_FIREHOSE_REDSHIFT_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD\",\n      \"KINESIS_FIREHOSE_SPLUNK_DESTINATION_CONFIGURATION_NO_PLAINTEXT_PASSWORD\"\n    ]);\n  }\n}\n"]}