| 1 | import * as SSM from "@distilled.cloud/aws/ssm"; |
| 2 | import * as Layer from "effect/Layer"; |
| 3 | import * as Output from "../../Output.ts"; |
| 4 | import { makeParameterHttpBinding } from "./BindingHttp.ts"; |
| 5 | import { GetParametersByPath } from "./GetParametersByPath.ts"; |
| 6 | |
| 7 | export const GetParametersByPathHttp = Layer.effect( |
| 8 | GetParametersByPath, |
| 9 | makeParameterHttpBinding({ |
| 10 | tag: "AWS.SSM.GetParametersByPath", |
| 11 | operation: SSM.getParametersByPath, |
| 12 | actions: ["ssm:GetParametersByPath"], |
| 13 | requestKey: "Path", |
| 14 | // The by-path read authorizes against the subtree under the bound |
| 15 | // parameter's name, so grant on the parameter ARN plus its `/*` children. |
| 16 | resources: (parameter) => [ |
| 17 | parameter.parameterArn, |
| 18 | Output.interpolate`${parameter.parameterArn}/*`, |
| 19 | ], |
| 20 | // kms:Decrypt so `WithDecryption: true` works for SecureString children |
| 21 | // encrypted with the bound parameter's key. |
| 22 | kmsActions: ["kms:Decrypt"], |
| 23 | }), |
| 24 | ); |