1import * as appconfig from "@distilled.cloud/aws/appconfig";
2import * as Output from "../../Output.ts";
3import type { Application } from "./Application.ts";
4import { makeAppConfigHttpBinding } from "./BindingHttp.ts";
5import type { Environment } from "./Environment.ts";
6import { StopDeployment } from "./StopDeployment.ts";
7
8/**
9 * HTTP implementation of the {@link StopDeployment} binding. Calls
10 * `appconfig:StopDeployment` with the Lambda's IAM role, scoped to the bound
11 * environment's deployments.
12 */
13export const StopDeploymentHttp = makeAppConfigHttpBinding(StopDeployment, {
14 operation: appconfig.stopDeployment,
15 spec: (application: Application, environment: Environment) => ({
16 identifiers: {
17 ApplicationId: application.applicationId,
18 EnvironmentId: environment.environmentId,
19 },
20 // The live authorizer evaluates the parent container ARNs (application,
21 // environment) in addition to the deployment — observed via CloudTrail.
22 iam: ({ region, accountId }) => ({
23 actions: ["appconfig:StopDeployment"],
24 resources: [
25 Output.interpolate`arn:aws:appconfig:${region}:${accountId}:application/${application.applicationId}`,
26 Output.interpolate`arn:aws:appconfig:${region}:${accountId}:application/${application.applicationId}/environment/${environment.environmentId}`,
27 Output.interpolate`arn:aws:appconfig:${region}:${accountId}:application/${application.applicationId}/environment/${environment.environmentId}/deployment/*`,
28 ],
29 }),
30 }),
31});