1import * as backup from "@distilled.cloud/aws/backup";
2import * as Effect from "effect/Effect";
3import * as Layer from "effect/Layer";
4import * as Binding from "../../Binding.ts";
5import * as Output from "../../Output.ts";
6import type { Role } from "../IAM/Role.ts";
7import { isBindingHost } from "../Lambda/Function.ts";
8import type { BackupVault } from "./BackupVault.ts";
9import {
10 StartBackupJob,
11 type StartBackupJobRequest,
12} from "./StartBackupJob.ts";
13
14export const StartBackupJobHttp = Layer.effect(
15 StartBackupJob,
16 Effect.gen(function* () {
17 const startBackupJob = yield* backup.startBackupJob;
18
19 return Effect.fn(function* <R extends Role>(
20 vault: BackupVault,
21 backupRole: R,
22 ) {
23 const BackupVaultName = yield* vault.backupVaultName;
24 const RoleArn = yield* backupRole.roleArn;
25 if (!globalThis.__ALCHEMY_RUNTIME__) {
26 const host = yield* Binding.Host;
27 if (isBindingHost(host)) {
28 yield* host.bind`Allow(${host}, AWS.Backup.StartBackupJob(${vault}, ${backupRole}))`(
29 {
30 policyStatements: [
31 {
32 Effect: "Allow",
33 Action: ["backup:StartBackupJob"],
34 Resource: [Output.interpolate`${vault.backupVaultArn}`],
35 },
36 // CRITICAL: without iam:PassRole on the backup role,
37 // StartBackupJob fails only at runtime with an AccessDenied.
38 {
39 Effect: "Allow",
40 Action: ["iam:PassRole"],
41 Resource: [Output.interpolate`${backupRole.roleArn}`],
42 Condition: {
43 StringEquals: {
44 "iam:PassedToService": "backup.amazonaws.com",
45 },
46 },
47 },
48 ],
49 },
50 );
51 }
52 }
53 return Effect.fn(`AWS.Backup.StartBackupJob(${vault.LogicalId})`)(
54 function* (request: StartBackupJobRequest) {
55 return yield* startBackupJob({
56 ...request,
57 BackupVaultName: yield* BackupVaultName,
58 IamRoleArn: request.IamRoleArn ?? (yield* RoleArn),
59 });
60 },
61 );
62 });
63 }),
64);