Skip to content
This repository was archived by the owner on Oct 10, 2025. It is now read-only.

Commit f0fabbb

Browse files
tabdunabitabdunabi
authored
updates to release v1.0.3
- Library upgrades to address security vulnerabilities. - Fix an issue with sample workflow configurations where textract workflow was missing before any entity based detection workflow. - Upgrade AWS Lambda runtimes to Python 3.12, Nodejs 20, and Java 21. - Update AWS SDK and AWS CDK versions.
2 parents 5b79e32 + d0d2b49 commit f0fabbb

File tree

67 files changed

+13615
-10007
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+13615
-10007
lines changed

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
66
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
77

8+
## [1.0.3] - 2023-12-07
9+
10+
### Updated
11+
12+
- Library upgrades to address security vulnerabilities.
13+
- Fix an issue with sample workflow configurations where `textract` workflow was missing before any `entity` based detection workflow.
14+
- Upgrade AWS Lambda runtimes to Python 3.12, Nodejs 20, and Java 21.
15+
- Update AWS SDK and AWS CDK versions.
16+
817
## [1.0.2] - 2023-11-09
918

1019
### Updated

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,9 @@ There are two options for deployment into your AWS account:
6262

6363
Following are pre-requisites to build and deploy locally:
6464

65-
- [Nodejs 18.x](https://nodejs.org/en)
66-
- [CDK v2.36.0](https://github.com/aws/aws-cdk)
67-
- [Python 3.11](https://www.python.org/)
65+
- [Nodejs 20.x](https://nodejs.org/en)
66+
- [CDK v2.113.0](https://github.com/aws/aws-cdk)
67+
- [Python 3.12](https://www.python.org/)
6868
- _Note: normal python installations should include support for `ensurepip` and `pip`; however, if running in an environment without these packages you will need to manually install them (e.g. a minimal docker image). See [pip's installation guide](https://pip.pypa.io/en/stable/installation/) for details._
6969
- [Java 17](https://aws.amazon.com/corretto/)
7070
- [Maven](https://maven.apache.org/)

‎deployment/build-s3-dist.sh‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,4 +188,13 @@ echo "--------------------------------------------------------------------------
188188

189189
echo "---------------------------------------"
190190
echo "Executing Build Complete"
191-
echo "---------------------------------------"
191+
echo "---------------------------------------"
192+
echo "---------------------------------------"
193+
echo "Printing cdk-nag reports"
194+
echo "---------------------------------------"
195+
cd $source_dir/infrastructure/cdk.out
196+
for csv in `find . -name "*.csv"`; do
197+
echo -e "File: $csv"
198+
echo "---------------------------------------"
199+
cat $csv | perl -pe 's/((?<=,)|(?<=^)),/ ,/g;' | column -t -s, | less -S
200+
done

‎source/infrastructure/cdk.json‎

Lines changed: 45 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
{
22
"app": "../pre-build-jars.sh && npx ts-node --prefer-ts-exts bin/dus.ts",
33
"watch": {
4-
"include": ["**"],
4+
"include": [
5+
"**"
6+
],
57
"exclude": [
68
"README.md",
79
"cdk*.json",
@@ -15,23 +17,55 @@
1517
]
1618
},
1719
"context": {
18-
"@aws-cdk/aws-apigateway:usagePlanKeyOrderInsensitiveId": true,
19-
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
20-
"@aws-cdk/core:stackRelativeExports": true,
21-
"@aws-cdk/aws-rds:lowercaseDbIdentifier": true,
22-
"@aws-cdk/aws-lambda:recognizeVersionProps": true,
23-
"@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021": true,
20+
"@aws-cdk/aws-lambda:recognizeLayerVersion": true,
21+
"@aws-cdk/core:checkSecretUsage": true,
22+
"@aws-cdk/core:target-partitions": [
23+
"aws",
24+
"aws-cn"
25+
],
2426
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
2527
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
26-
"@aws-cdk/core:checkSecretUsage": true,
28+
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
2729
"@aws-cdk/aws-iam:minimizePolicies": true,
28-
"@aws-cdk/core:target-partitions": ["aws", "aws-cn", "aws-us-gov"],
30+
"@aws-cdk/core:validateSnapshotRemovalPolicy": true,
31+
"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
32+
"@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
33+
"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
34+
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
35+
"@aws-cdk/core:enablePartitionLiterals": true,
36+
"@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
37+
"@aws-cdk/aws-iam:standardizedServicePrincipals": true,
38+
"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
39+
"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
40+
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
41+
"@aws-cdk/aws-route53-patters:useCertificate": true,
42+
"@aws-cdk/customresources:installLatestAwsSdkDefault": false,
43+
"@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
44+
"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
45+
"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
46+
"@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
47+
"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
48+
"@aws-cdk/aws-redshift:columnId": true,
49+
"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true,
50+
"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
51+
"@aws-cdk/aws-apigateway:requestValidatorUniqueId": true,
52+
"@aws-cdk/aws-kms:aliasNameRef": true,
53+
"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true,
54+
"@aws-cdk/core:includePrefixInUniqueNameGeneration": true,
55+
"@aws-cdk/aws-efs:denyAnonymousAccess": true,
56+
"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby": true,
57+
"@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion": true,
58+
"@aws-cdk/aws-efs:mountTargetOrderInsensitiveLogicalId": true,
59+
"@aws-cdk/aws-rds:auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters": true,
60+
"@aws-cdk/aws-appsync:useArnForSourceApiAssociationIdentifier": true,
61+
"@aws-cdk/aws-rds:preventRenderingDeprecatedCredentials": true,
62+
"@aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForCodeCommitSource": true,
2963
"solution_id": "SO0281",
3064
"solution_name": "enhanced-document-understanding-on-aws",
31-
"solution_version": "v1.0.1",
65+
"solution_version": "v1.0.3",
3266
"app_namespace": "app.idp",
3367
"app_registry_name": "enhanced-document-understanding",
3468
"application_type": "AWS-Solutions",
3569
"application_trademark_name": "Enhanced Document Understanding on AWS"
3670
}
37-
}
71+
}

‎source/infrastructure/lib/layers/node-user-agent.ts‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,17 @@ import { Construct } from 'constructs';
1717
import * as path from 'path';
1818
import { getCommandsForNodejsDockerBuild } from '../utils/asset-bundling';
1919
import { getNodejsLayerLocalBundling, LayerProps } from '../utils/common-utils';
20-
import { COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME } from '../utils/constants';
20+
import { COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME, GOV_CLOUD_REGION_LAMBDA_NODE_RUNTIME } from '../utils/constants';
2121

2222
/**
2323
* A class the defines the user-agent layer Construct for Node runtimes
2424
*/
2525
export class NodeUserAgentLayer extends lambda.LayerVersion {
2626
constructor(scope: Construct, id: string, props: LayerProps) {
27-
const compatibleRuntimes = props.compatibleRuntimes ?? [lambda.Runtime.NODEJS_18_X];
27+
const compatibleRuntimes = props.compatibleRuntimes ?? [
28+
GOV_CLOUD_REGION_LAMBDA_NODE_RUNTIME,
29+
COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME
30+
];
2831

2932
for (const runtime of compatibleRuntimes) {
3033
if (runtime && runtime.family !== lambda.RuntimeFamily.NODEJS) {

‎source/infrastructure/lib/s3web/static-site.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ export class StaticWebsite extends Construct {
107107
defaultRootObject: 'login.html'
108108
}
109109
});
110+
cloudfrontToS3.cloudFrontLoggingBucket?.node.addDependency(bucketPolicyUpdateCustomResource);
110111

111112
const cloudfrontFunction = cloudfrontToS3.node
112113
.tryFindChild('SetHttpSecurityHeaders')

‎source/infrastructure/lib/utils/constants.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -110,12 +110,12 @@ export const DEFAULT_WORKFLOW_CONFIG_NAME = 'default';
110110

111111
export const SFN_TASK_TIMEOUT_MINS = 120;
112112
export const LAMBDA_TIMEOUT_MINS = 15;
113-
export const COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME: lambda.Runtime = lambda.Runtime.NODEJS_18_X;
113+
export const COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME: lambda.Runtime = lambda.Runtime.NODEJS_20_X;
114114
export const GOV_CLOUD_REGION_LAMBDA_NODE_RUNTIME: lambda.Runtime = lambda.Runtime.NODEJS_18_X;
115-
export const COMMERCIAL_REGION_LAMBDA_PYTHON_RUNTIME: lambda.Runtime = lambda.Runtime.PYTHON_3_11;
116-
export const GOV_CLOUD_REGION_LAMBDA_PYTHON_RUNTIME: lambda.Runtime = lambda.Runtime.PYTHON_3_9;
117-
export const COMMERCIAL_REGION_LAMBDA_JAVA_RUNTIME: lambda.Runtime = lambda.Runtime.JAVA_17;
118-
export const GOV_CLOUD_REGION_LAMBDA_JAVA_RUNTIME: lambda.Runtime = lambda.Runtime.JAVA_11;
115+
export const COMMERCIAL_REGION_LAMBDA_PYTHON_RUNTIME: lambda.Runtime = lambda.Runtime.PYTHON_3_12;
116+
export const GOV_CLOUD_REGION_LAMBDA_PYTHON_RUNTIME: lambda.Runtime = lambda.Runtime.PYTHON_3_10;
117+
export const COMMERCIAL_REGION_LAMBDA_JAVA_RUNTIME: lambda.Runtime = lambda.Runtime.JAVA_21;
118+
export const GOV_CLOUD_REGION_LAMBDA_JAVA_RUNTIME: lambda.Runtime = lambda.Runtime.JAVA_17;
119119

120120
export const S3_UPLOAD_PREFIX = 'initial';
121121
export const S3_REDACTED_PREFIX = 'redacted';

‎source/infrastructure/lib/utils/lambda-aspect.ts‎

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,15 @@ import { NodeUserAgentLayer } from '../layers/node-user-agent';
2222
import { PythonUserAgentLayer } from '../layers/python-user-agent';
2323
import { AwsNodeSdkLibLayer, Boto3SdkLibLayer } from '../layers/runtime-libs';
2424
import { NodejsSharedLibLayer } from '../layers/shared-lib';
25-
import { CloudwatchNamespace } from '../utils/constants';
25+
import {
26+
COMMERCIAL_REGION_LAMBDA_JAVA_RUNTIME,
27+
COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME,
28+
COMMERCIAL_REGION_LAMBDA_PYTHON_RUNTIME,
29+
CloudwatchNamespace,
30+
GOV_CLOUD_REGION_LAMBDA_JAVA_RUNTIME,
31+
GOV_CLOUD_REGION_LAMBDA_NODE_RUNTIME,
32+
GOV_CLOUD_REGION_LAMBDA_PYTHON_RUNTIME
33+
} from '../utils/constants';
2634

2735
export interface LambdaAspectProps {
2836
/**
@@ -147,7 +155,7 @@ export class LambdaAspects extends Construct implements cdk.IAspect {
147155
this.nodejsUserAgentLayer = new NodeUserAgentLayer(this, 'NodeUserAgentLayer', {
148156
entry: '../lambda/layers/aws-node-user-agent-config',
149157
description: 'This layer configures AWS Node SDK initialization to send user-agent information',
150-
compatibleRuntimes: [lambda.Runtime.NODEJS_18_X]
158+
compatibleRuntimes: [GOV_CLOUD_REGION_LAMBDA_NODE_RUNTIME, COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME]
151159
});
152160
}
153161

@@ -164,12 +172,7 @@ export class LambdaAspects extends Construct implements cdk.IAspect {
164172
this.pythonUserAgentLayer = new PythonUserAgentLayer(this, 'PythonUserAgentLayer', {
165173
entry: '../lambda/layers/custom_boto3_init',
166174
description: 'This layer configures AWS Python SDK initialization to send user-agent information',
167-
compatibleRuntimes: [
168-
lambda.Runtime.PYTHON_3_8,
169-
lambda.Runtime.PYTHON_3_9,
170-
lambda.Runtime.PYTHON_3_10,
171-
lambda.Runtime.PYTHON_3_11
172-
]
175+
compatibleRuntimes: [GOV_CLOUD_REGION_LAMBDA_PYTHON_RUNTIME, COMMERCIAL_REGION_LAMBDA_PYTHON_RUNTIME]
173176
});
174177
}
175178

@@ -186,7 +189,7 @@ export class LambdaAspects extends Construct implements cdk.IAspect {
186189
this.javaUserAgentLayer = new JavaUserAgentLayer(this, 'JavaUserAgentLayer', {
187190
entry: '../lambda/layers/custom-java-sdk-config',
188191
description: 'This layer configures AWS Java SDK initialization to send user-agent information',
189-
compatibleRuntimes: [lambda.Runtime.JAVA_11, lambda.Runtime.JAVA_17]
192+
compatibleRuntimes: [GOV_CLOUD_REGION_LAMBDA_JAVA_RUNTIME, COMMERCIAL_REGION_LAMBDA_JAVA_RUNTIME]
190193
});
191194
}
192195

@@ -204,7 +207,7 @@ export class LambdaAspects extends Construct implements cdk.IAspect {
204207
entry: '../lambda/layers/common-node-lib',
205208
description:
206209
'This layer contains shared libraries and functions across all lambda functions to be bundled with the lambda function',
207-
compatibleRuntimes: [lambda.Runtime.NODEJS_18_X]
210+
compatibleRuntimes: [GOV_CLOUD_REGION_LAMBDA_NODE_RUNTIME, COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME]
208211
});
209212
}
210213

@@ -221,7 +224,7 @@ export class LambdaAspects extends Construct implements cdk.IAspect {
221224
this.awsNodeSdkLibLayer = new AwsNodeSdkLibLayer(this, 'AwsNodeSdkLayer', {
222225
entry: '../lambda/layers/aws-sdk-lib',
223226
description: 'AWS Node SDK to be bundled with lambda functions',
224-
compatibleRuntimes: [lambda.Runtime.NODEJS_18_X]
227+
compatibleRuntimes: [GOV_CLOUD_REGION_LAMBDA_NODE_RUNTIME, COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME]
225228
});
226229
}
227230

@@ -238,12 +241,7 @@ export class LambdaAspects extends Construct implements cdk.IAspect {
238241
this.boto3SdkLibLayer = new Boto3SdkLibLayer(this, 'Boto3Layer', {
239242
entry: '../lambda/layers/aws_boto3',
240243
description: 'Boto3 layer to be bundled with python lambda functions',
241-
compatibleRuntimes: [
242-
lambda.Runtime.PYTHON_3_8,
243-
lambda.Runtime.PYTHON_3_9,
244-
lambda.Runtime.PYTHON_3_10,
245-
lambda.Runtime.PYTHON_3_11
246-
]
244+
compatibleRuntimes: [GOV_CLOUD_REGION_LAMBDA_PYTHON_RUNTIME, COMMERCIAL_REGION_LAMBDA_PYTHON_RUNTIME]
247245
});
248246
}
249247

‎source/infrastructure/lib/utils/lambda-runtimes.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ export abstract class LambdaRuntimeCommand {
4545
export class PythonRuntimeCommand extends LambdaRuntimeCommand {
4646
public getLambdaRuntime(): string {
4747
let runtime: string;
48-
if (GOV_CLOUD_REGION_LAMBDA_PYTHON_RUNTIME === COMMERCIAL_REGION_LAMBDA_PYTHON_RUNTIME) {
48+
if (GOV_CLOUD_REGION_LAMBDA_PYTHON_RUNTIME.name === COMMERCIAL_REGION_LAMBDA_PYTHON_RUNTIME.name) {
4949
runtime = COMMERCIAL_REGION_LAMBDA_PYTHON_RUNTIME.name;
5050
} else {
5151
runtime = cdk.Fn.conditionIf(
@@ -64,7 +64,7 @@ export class PythonRuntimeCommand extends LambdaRuntimeCommand {
6464
export class NodejsRuntimeCommand extends LambdaRuntimeCommand {
6565
public getLambdaRuntime(): string {
6666
let runtime: string;
67-
if (GOV_CLOUD_REGION_LAMBDA_NODE_RUNTIME === COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME) {
67+
if (GOV_CLOUD_REGION_LAMBDA_NODE_RUNTIME.name === COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME.name) {
6868
runtime = COMMERCIAL_REGION_LAMBDA_NODE_RUNTIME.name;
6969
} else {
7070
runtime = cdk.Fn.conditionIf(
@@ -84,7 +84,7 @@ export class NodejsRuntimeCommand extends LambdaRuntimeCommand {
8484
export class JavaRuntimeCommand extends LambdaRuntimeCommand {
8585
public getLambdaRuntime(): string {
8686
let runtime: string;
87-
if (GOV_CLOUD_REGION_LAMBDA_JAVA_RUNTIME === COMMERCIAL_REGION_LAMBDA_JAVA_RUNTIME) {
87+
if (GOV_CLOUD_REGION_LAMBDA_JAVA_RUNTIME.name === COMMERCIAL_REGION_LAMBDA_JAVA_RUNTIME.name) {
8888
runtime = COMMERCIAL_REGION_LAMBDA_JAVA_RUNTIME.name;
8989
} else {
9090
runtime = cdk.Fn.conditionIf(

0 commit comments

Comments
 (0)