hecks 2.6.0 → 2.7.0

data/lib/hecks/ports/persistence/postgres_dump.rb

@@ -0,0 +1,125 @@
+require "open3"
+require "securerandom"
+require_relative "postgres_dump/connection"
+
+module Hecks
+  module Ports
+    module Persistence
+      # Dumps one schema of a Postgres database and proves the dump restores.
+      #
+      # ## What the proof is
+      #
+      # A dump nobody has restored is a hope. After `pg_dump` writes the file,
+      # the dump is restored into a scratch database (on the source server, or on a
+      # separate `verify_url` server such as the one the dump will be loaded
+      # into) and every table's row count is compared with the source. That shows
+      # the dump is complete and loadable. It does not re-derive current state
+      # from an event journal, so a caller who needs that proves it separately.
+      #
+      # ## Credentials
+      #
+      # URLs are split by `Connection`: the password travels in the child
+      # process's environment, never in `argv`.
+      #
+      # ## Requirements
+      #
+      # The `pg` gem, and `pg_dump` and `pg_restore` on `PATH` at a version no older
+      # than the server's. Neither the gem nor the tools are a dependency of
+      # hecks; nothing here loads until a dump is asked for.
+      class PostgresDump
+        # Raised for a refusal or a failed tool.
+        class Error < StandardError; end
+
+        # What a verified dump holds.
+        #
+        # @!attribute [r] tables
+        #   @return [Hash{String => Integer}] row count of every table in the schema, by name
+        Result = Struct.new(:tables, keyword_init: true)
+
+        # @param url [String] the source database's `postgres://` URL
+        # @param schema [String] the schema to dump, a plain identifier
+        # @param verify_url [String, nil] the server to restore into for the proof; the source
+        #   server when nil
+        # @raise [Error] if `schema` is not a plain identifier or a URL is not a Postgres URL
+        def initialize(url:, schema:, verify_url: nil)
+          raise Error, "schema #{schema.inspect} is not a plain identifier" unless schema.to_s.match?(/\A[a-z_][a-z0-9_]*\z/i)
+
+          @schema = schema
+          @source = Connection.new(url)
+          @verify = Connection.new(verify_url || url)
+        end
+
+        # Writes a custom-format dump of the schema and proves it restores.
+        #
+        # @param dest [String] the file to write
+        # @return [Result] the verified row counts
+        # @raise [Error] if the schema has no tables, a tool fails, the database refuses, or
+        #   the restored counts differ from the source's
+        def call(dest)
+          require "pg"
+          raise Error, "schema #{@schema} has no tables in #{@source.database}" if counting(@source) { |db| counts(db) }.empty?
+
+          run("pg_dump", @source, "--format=custom", "--no-owner", "--no-privileges", "--schema=#{@schema}", "--file=#{dest}")
+          expected = counting(@source) { |db| counts(db) }
+          verify_restore(dest, expected)
+          Result.new(tables: expected)
+        rescue PG::Error => e
+          raise Error, "database error (#{e.class}): #{e.message.lines.first.to_s.strip}"
+        end
+
+        private
+
+        def verify_restore(dump, expected)
+          scratch = "dump_verify_#{Process.pid}_#{SecureRandom.hex(3)}"
+          counting(@verify) do |admin|
+            admin.exec("CREATE DATABASE #{admin.quote_ident(scratch)}")
+            begin
+              target = @verify.with_database(scratch)
+              run("pg_restore", target, "--no-owner", "--no-privileges", "--exit-on-error", "--dbname=#{scratch}", dump)
+              actual = counting(target) { |db| counts(db) }
+              raise Error, mismatch(expected, actual) unless actual == expected
+            ensure
+              drop(admin, scratch)
+            end
+          end
+        end
+
+        def counting(connection)
+          db = connection.connect
+          yield db
+        ensure
+          db&.close
+        end
+
+        def counts(db)
+          names = db.exec_params("SELECT table_name FROM information_schema.tables " \
+                                 "WHERE table_schema = $1 AND table_type = 'BASE TABLE' ORDER BY 1", [@schema])
+                    .map { |row| row["table_name"] }
+          names.to_h do |name|
+            [name, db.exec("SELECT count(*) FROM #{db.quote_ident(@schema)}.#{db.quote_ident(name)}").getvalue(0, 0).to_i]
+          end
+        end
+
+        def mismatch(expected, actual)
+          differing = (expected.keys | actual.keys).reject { |name| expected[name] == actual[name] }
+          detail = differing.map { |name| "#{name} (source #{expected[name].inspect}, restored #{actual[name].inspect})" }
+          "the restored dump disagrees with the source for #{detail.join(', ')}; " \
+            "if the database took writes during the dump, dump it again"
+        end
+
+        def drop(admin, scratch)
+          admin.exec("DROP DATABASE IF EXISTS #{admin.quote_ident(scratch)} WITH (FORCE)")
+        rescue PG::Error => e
+          warn "could not drop scratch database #{scratch} (#{e.class}); drop it by hand"
+        end
+
+        def run(tool, connection, *)
+          _out, err, status = Open3.capture3(connection.env, tool, *)
+          raise Error, "#{tool} failed: #{err.lines.first(3).join.strip}" unless status.success?
+        rescue Errno::ENOENT
+          raise Error, "#{tool} is not on PATH"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/ports/persistence/repository_factory.rb

@@ -30,8 +30,8 @@ module Hecks
         #   lacks `append`, `project` or `entries`
         def build(registry, domain, aggregate, bind, recover: true, settings_verb: VERB)
           registry.check_verb(bind)
-          settings = (registry.world(domain)&.for_binding(settings_verb, bind.adapter) || {})
-                     .reject { |key, _| key.to_sym == :role }
+          settings = registry.binding_settings(domain, settings_verb, bind.adapter)
+                             .reject { |key, _| key.to_sym == :role }
           registry.check_settings(bind, settings)
           # The domain, the resolved era, and (for an old checkout) the era
           # that superseded it ride along after the declared-settings

data/lib/hecks/ports/persistence.rb

@@ -17,6 +17,10 @@ require_relative "persistence/remote_runtime"
 require_relative "persistence/null_saga_store"
 require_relative "persistence/state_codec"
 
+# Loaded on first mention: nothing about a domain's own boot needs the dump
+# tooling, and it wants the optional `pg` gem.
+Hecks::Ports::Persistence.autoload(:PostgresDump, File.join(__dir__, "persistence/postgres_dump"))
+
 module Hecks
   module Ports
     # Reopened once `BindingPolicy`/`RepositoryFactory` (required above) are

data/lib/hecks/projections/deploy/fargate/assembly.rb

@@ -0,0 +1,193 @@
+require_relative "yaml"
+require_relative "settings"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        # Fills the optional sections of a rendered Fargate template.
+        #
+        # The template text carries `# TMPL:<name>` marker lines where an
+        # optional section belongs. `apply` replaces each with what the stack's
+        # `Settings::Plan` calls for, and with nothing when the plan sets
+        # nothing there, so a world that uses none of the optional settings
+        # renders the template it always did.
+        module Assembly
+          module_function
+
+          # Replaces every optional-section marker in a rendered template.
+          #
+          # @param template [String] the rendered template holding `# TMPL:` marker lines
+          # @param plan [Settings::Plan] the stack's checked optional settings
+          # @param context [Hash{Symbol => Object}] `:stack_name`, `:vpc_ref`, `:listener_id`,
+          #   `:alb_id`, `:distribution_id` and `:db_secret_ref`
+          # @return [String] the template with the markers replaced
+          # @raise [ArgumentError] if `domain_env` removes a variable the generator does not set, or
+          #   the finished template declares one logical id or parameter twice
+          def apply(template, plan, context)
+            text = override_domain_env(template, plan.domain_env)
+            sections(plan, context).each { |marker, block| text = Yaml.splice(text, marker, block) }
+            check_duplicates!(text)
+            text
+          end
+
+          def sections(plan, context)
+            {
+              "domain_essential"          => domain_essential_yaml(plan.layout.domain),
+              "session_secret_properties" => session_secret_yaml(plan.extras[:session_secret]),
+              "execution_database_grant"  => execution_grant_yaml(plan, context),
+              "extra_execution_policies"  => Extras.policies_yaml(plan.extras[:execution_policies]),
+              "extra_task_policies"       => task_policies_yaml(plan),
+              "domain_env"                => domain_env_yaml(plan.domain_env),
+              "extra_containers"          => lines(Containers.definitions_yaml(plan.layout, plan.ids[:log_group])),
+              "target_group_attributes"   => Containers.target_group_attributes_yaml(plan.deregistration_delay),
+              "extra_target_groups"       => target_groups_yaml(plan, context),
+              "service_tuning"            => service_tuning_yaml(plan),
+              "extra_load_balancers"      => Containers.load_balancers_yaml(plan.layout),
+              "distribution"              => distribution_yaml(plan, context),
+              "extra_resources"           => extra_resources_yaml(plan, context),
+              "extra_outputs"             => outputs_yaml(plan)
+            }
+          end
+          private_class_method :sections
+
+          # Removes each default environment entry the world overrides, with the comments above it.
+          def override_domain_env(template, domain_env)
+            domain_env.keys.reduce(template) do |text, name|
+              entry = /(?:^[ \t]*#.*\n)*^[ \t]*- Name: #{Regexp.escape(name)}\n[ \t]+Value: .*\n/
+              if text.match?(entry)
+                text.sub(entry, "")
+              elsif domain_env[name].nil?
+                raise ArgumentError,
+                      "domain_env #{name} is nil, which removes a default variable, but the generator sets no #{name}"
+              else
+                text
+              end
+            end
+          end
+          private_class_method :override_domain_env
+
+          def execution_grant_yaml(plan, context)
+            return "" unless plan.execution_database_grant
+
+            <<~GRANT
+              - PolicyName: DbSecretRead
+                PolicyDocument:
+                  Version: '2012-10-17'
+                  Statement:
+                    - Effect: Allow
+                      Action: secretsmanager:GetSecretValue
+                      Resource: !Sub "${#{context[:db_secret_ref]}}"
+            GRANT
+          end
+          private_class_method :execution_grant_yaml
+
+          def domain_essential_yaml(domain)
+            domain.essential.nil? ? "" : "Essential: #{domain.essential}\n"
+          end
+          private_class_method :domain_essential_yaml
+
+          def domain_env_yaml(domain_env)
+            domain_env.compact.map do |name, value|
+              "- Name: #{name}\n  Value: #{Yaml.string(value)}\n"
+            end.join
+          end
+          private_class_method :domain_env_yaml
+
+          def session_secret_yaml(given)
+            [("Name: #{given[:name]}\n" if given[:name]),
+             ("Description: #{Yaml.string(given[:description])}\n" if given[:description])].compact.join
+          end
+          private_class_method :session_secret_yaml
+
+          def task_policies_yaml(plan)
+            Extras.policies_yaml(plan.extras[:task_policies]) + (plan.execute_command ? Extras.execute_command_policy_yaml : "")
+          end
+          private_class_method :task_policies_yaml
+
+          def service_tuning_yaml(plan)
+            lines = []
+            lines << "EnableExecuteCommand: true" if plan.execute_command
+            lines << "HealthCheckGracePeriodSeconds: #{plan.health_check_grace_period}" if plan.health_check_grace_period
+            lines.empty? ? "" : "#{lines.join("\n")}\n"
+          end
+          private_class_method :service_tuning_yaml
+
+          def target_groups_yaml(plan, context)
+            blocks(
+              [
+                Containers.target_groups_yaml(plan.layout, context[:vpc_ref], plan.deregistration_delay),
+                Containers.listener_rules_yaml(plan.layout, context[:listener_id])
+              ].reject(&:empty?).join("\n\n")
+            )
+          end
+          private_class_method :target_groups_yaml
+
+          def distribution_yaml(plan, context)
+            ids = { distribution_id: context[:distribution_id], alb_id: context[:alb_id] }
+            plan.cdn ? Cdn.yaml(plan.cdn, **ids) : Cdn.default_yaml(**ids)
+          end
+          private_class_method :distribution_yaml
+
+          def monitoring_context(plan, context, groups)
+            { ids: plan.ids, stack_name: context[:stack_name], alb_id: context[:alb_id],
+              distribution_id: context[:distribution_id], target_groups: groups }
+          end
+          private_class_method :monitoring_context
+
+          def extra_resources_yaml(plan, context)
+            alerts = plan.alerts
+            groups = plan.layout.balanced.to_h { |container| [container.name, container.target_group_id] }
+            monitoring = alerts ? Monitoring.yaml(alerts, monitoring_context(plan, context, groups)) : ""
+            blocks([Containers.repositories_yaml(plan.layout), Extras.resources_yaml(plan.extras),
+                    monitoring.rstrip].reject(&:empty?).join("\n\n"))
+          end
+          private_class_method :extra_resources_yaml
+
+          # Adds one output per added container's repository, plus the cluster and service names a
+          # deploy script needs to find the running service.
+          def outputs_yaml(plan)
+            listed = plan.layout.multi? ? container_outputs(plan) : ""
+            alerts = plan.alerts ? "AlertsTopicArn:\n  Value: !Ref #{plan.ids[:alerts_topic]}\n" : ""
+            listed + alerts + Extras.outputs_yaml(plan.extras[:outputs])
+          end
+          private_class_method :outputs_yaml
+
+          def container_outputs(plan)
+            repositories = plan.layout.all.map do |container|
+              "#{Yaml.camel(container.name)}RepositoryUri:\n  Value: !GetAtt #{container.repository_id}.RepositoryUri\n"
+            end
+            cluster = "ClusterName:\n  Value: !Ref #{plan.ids[:cluster]}\n"
+            service = "ServiceName:\n  Value: !GetAtt #{plan.ids[:service]}.Name\n"
+            cluster + service + repositories.join
+          end
+          private_class_method :container_outputs
+
+          # Joins resource blocks so the section ends in the blank line the template expects before
+          # the next resource, and is empty when there is nothing to add.
+          def blocks(text)
+            text.empty? ? "" : "#{text}\n\n"
+          end
+          private_class_method :blocks
+
+          # Ends a block in one newline, and leaves an empty block empty.
+          def lines(text)
+            text.empty? ? "" : "#{text}\n"
+          end
+          private_class_method :lines
+
+          def check_duplicates!(template)
+            resources = template[/^Resources:\n(.*?)^Outputs:/m, 1].to_s
+            parameters = template[/^Parameters:\n(.*?)^Resources:/m, 1].to_s
+            repeated = Yaml.duplicate_keys(resources) + Yaml.duplicate_keys(parameters)
+            unless repeated.empty?
+              raise ArgumentError, "logical id or parameter #{repeated.uniq.join(', ')} is declared more than once; " \
+                                   "check logical_ids, containers and parameters for clashes"
+            end
+          end
+          private_class_method :check_duplicates!
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/cdn.rb

@@ -0,0 +1,318 @@
+require_relative "check"
+require_relative "yaml"
+require_relative "cdn_default"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        # The CloudFront distribution in front of the load balancer.
+        #
+        # With no `cdn` setting the stack gets `default_yaml`: the default
+        # certificate, one origin, and one behavior that caches nothing. A
+        # `cdn` setting replaces that with a distribution described by the
+        # world.
+        #
+        # ## Settings
+        #
+        # `cdn` is a hash with these optional keys:
+        #
+        # - `aliases`: hostnames the distribution answers to. Needs `certificate_arn`.
+        # - `certificate_arn`: an `ACM` certificate in us-east-1, or an intrinsic such as
+        #   `"!Ref CertArn"`.
+        # - `minimum_protocol`: the TLS policy for the certificate; `TLSv1.2_2021` by default.
+        # - `origin_id`: the id of the load-balancer origin; `<AlbId>Origin` by default.
+        # - `origin_ssl_protocols`: the TLS versions CloudFront may use to reach the origin, such
+        #   as `["TLSv1.2"]`.
+        # - `explicit_origin_ports`: false leaves `HTTPPort` and `HTTPSPort` unset; true by
+        #   default.
+        # - `origin_secret`: `{header:, parameter:}` sends a secret header to the origin, filled
+        #   from a `NoEcho` template parameter the stack declares under that name.
+        # - `extra_origins`: S3 origins, each `{id:, domain_name:, origin_access_control_id:}`.
+        # - `default_behavior`: `{origin:, viewer_protocol:, methods:, compress:, cache_policy:,
+        #   origin_request_policy:}`.
+        # - `behaviors`: entries of the same shape with a required `path`; the first match wins,
+        #   so order matters.
+        # - `retain`: true keeps the distribution when the stack is deleted or replaces it.
+        #
+        # A cache or origin-request policy is a managed policy's name (`caching_disabled`,
+        # `caching_optimized`, `all_viewer`, `all_viewer_except_host`, or `none` to omit an origin
+        # request policy) or the id of a policy in the account. `methods` is `all`, `read` or
+        # `get_head`.
+        module Cdn
+          module_function
+
+          MANAGED_POLICIES = {
+            "caching_disabled"       => ["4135ea2d-6df8-44a3-9df3-4b5a84be39ad", "Managed-CachingDisabled"],
+            "caching_optimized"      => ["658327ea-f89d-4fab-a63d-7e88639e58f6", "Managed-CachingOptimized"],
+            "all_viewer"             => ["216adef6-5c7f-47e4-b989-5492eafa07d3", "Managed-AllViewer"],
+            "all_viewer_except_host" => ["b689b0a8-53d0-40ab-baf2-68738e2966ac", "Managed-AllViewerExceptHostHeader"]
+          }.freeze
+          METHODS = {
+            "all"      => %w[GET HEAD OPTIONS PUT POST PATCH DELETE],
+            "read"     => %w[GET HEAD OPTIONS],
+            "get_head" => %w[GET HEAD]
+          }.freeze
+          PROTOCOLS = %w[allow-all https-only redirect-to-https].freeze
+          KEYS = [
+            :aliases, :certificate_arn, :minimum_protocol, :origin_id, :origin_ssl_protocols, :explicit_origin_ports,
+            :origin_secret, :extra_origins, :default_behavior, :behaviors, :retain
+          ].freeze
+          BEHAVIOR_KEYS = [:origin, :viewer_protocol, :methods, :compress, :cache_policy, :origin_request_policy].freeze
+          UUID = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/
+          ACM_ARN = %r{\Aarn:aws:acm:us-east-1:\d{12}:certificate/[A-Za-z0-9-]+\z}
+          HOSTNAME = /\A(\*\.)?([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?\.)+[A-Za-z]{2,}\z/
+
+          # Reads and checks the `cdn` setting.
+          #
+          # @param setting [Hash, nil] the world's `cdn` value, or nil when it sets none
+          # @param default_origin_id [String] the load-balancer origin's id when `origin_id` is not
+          #   set
+          # @return [Hash{Symbol => Object}, nil] the checked options with defaults applied, or nil
+          #   for none
+          # @raise [ArgumentError] if an option is unknown, malformed, or names an origin that does
+          #   not exist
+          def normalize(setting, default_origin_id:)
+            return nil if setting.nil?
+
+            given = Check.hash!(setting, "cdn", allowed: KEYS)
+            options = base_options(given, default_origin_id)
+            options[:extra_origins] = extra_origins(given.fetch(:extra_origins, []))
+            origins = [options[:origin_id], *options[:extra_origins].map { |origin| origin[:id] }]
+            check_unique!(origins, "cdn origin ids")
+            options[:default_behavior] =
+              behavior(given.fetch(:default_behavior, {}), "cdn default_behavior", options, origins, path: false)
+            options[:behaviors] = behaviors(given.fetch(:behaviors, []), options, origins)
+            options
+          end
+
+          # Lists the template parameters the options need.
+          #
+          # @param options [Hash, nil] the checked options from `normalize`
+          # @return [String] flush-left parameter text, or empty
+          def parameters_yaml(options)
+            secret = options && options[:origin_secret]
+            return "" unless secret
+
+            <<~PARAMETER
+              #{secret[:parameter]}:
+                Type: String
+                NoEcho: true
+                Description: Secret header value CloudFront sends to the origin, so the origin can tell its own traffic.
+            PARAMETER
+          end
+
+          # Renders the distribution for a set of checked options.
+          #
+          # @param options [Hash] the checked options from `normalize`
+          # @param distribution_id [String] the logical id the distribution is given
+          # @param alb_id [String] the logical id of the load balancer the origin points at
+          # @return [String] the flush-left resource text ending in a newline
+          def yaml(options, distribution_id:, alb_id:)
+            lines = ["#{distribution_id}:", "  Type: AWS::CloudFront::Distribution"]
+            lines.push("  DeletionPolicy: Retain", "  UpdateReplacePolicy: Retain") if options[:retain]
+            lines.push("  Properties:", "    DistributionConfig:", "      Enabled: true", "      HttpVersion: http2")
+            lines.concat(alias_lines(options), certificate_lines(options), origin_lines(options, alb_id))
+            lines.concat(behavior_lines("DefaultCacheBehavior", options[:default_behavior], "      "))
+            lines << "      CacheBehaviors:" unless options[:behaviors].empty?
+            options[:behaviors].each { |entry| lines.concat(behavior_lines(nil, entry, "        ")) }
+            "#{lines.join("\n")}\n"
+          end
+
+          def behaviors(entries, options, origins)
+            Check.hashes!(entries, "cdn behaviors", allowed: BEHAVIOR_KEYS + [:path], required: [:path]).map do |entry|
+              behavior(entry, "cdn behaviors[#{entry[:path]}]", options, origins, path: true)
+            end
+          end
+          private_class_method :behaviors
+
+          def base_options(given, default_origin_id)
+            aliases = Check.strings!(given.fetch(:aliases, []), "cdn aliases")
+            bad = aliases.grep_v(HOSTNAME)
+            raise ArgumentError, "cdn aliases must be hostnames, got #{bad.join(', ')}" unless bad.empty?
+
+            certificate = given[:certificate_arn]&.to_s
+            if !aliases.empty? && certificate.nil?
+              raise ArgumentError,
+                    "cdn aliases need a certificate_arn, since CloudFront serves an alias only over a certificate"
+            end
+
+            {
+              aliases: aliases, certificate_arn: certificate_arn(certificate),
+              minimum_protocol: given.fetch(:minimum_protocol, "TLSv1.2_2021").to_s,
+              origin_id: Check.logical_id!(given.fetch(:origin_id, default_origin_id), "cdn origin_id"),
+              origin_ssl_protocols: Check.strings!(given.fetch(:origin_ssl_protocols, []), "cdn origin_ssl_protocols"),
+              explicit_origin_ports: Check.boolean!(given.fetch(:explicit_origin_ports, true), "cdn explicit_origin_ports"),
+              origin_secret: origin_secret(given[:origin_secret]),
+              retain: Check.boolean!(given.fetch(:retain, false), "cdn retain")
+            }
+          end
+          private_class_method :base_options
+
+          def certificate_arn(value)
+            return nil if value.nil?
+            return value if value.start_with?("!") || ACM_ARN.match?(value)
+
+            raise ArgumentError,
+                  "cdn certificate_arn must be an ACM certificate ARN in us-east-1 (CloudFront reads no other region) " \
+                  "or an intrinsic, got #{value.inspect}"
+          end
+          private_class_method :certificate_arn
+
+          def origin_secret(value)
+            return nil if value.nil?
+
+            secret = Check.hash!(value, "cdn origin_secret", allowed: [:header, :parameter], required: [:header, :parameter])
+            unless secret[:header].to_s.match?(/\A[A-Za-z0-9-]+\z/)
+              raise ArgumentError,
+                    "cdn origin_secret header must be an HTTP header name, got #{secret[:header].inspect}"
+            end
+
+            { header: secret[:header].to_s, parameter: Check.logical_id!(secret[:parameter], "cdn origin_secret parameter") }
+          end
+          private_class_method :origin_secret
+
+          def extra_origins(entries)
+            Check.hashes!(entries, "cdn extra_origins", allowed:  [:id, :domain_name, :origin_access_control_id],
+                                                        required: [:id, :domain_name]).map do |entry|
+              { id: Check.logical_id!(entry[:id], "cdn extra_origins id"), domain_name: entry[:domain_name].to_s,
+                origin_access_control_id: entry[:origin_access_control_id]&.to_s }
+            end
+          end
+          private_class_method :extra_origins
+
+          def check_unique!(values, what)
+            repeated = values.tally.select { |_value, count| count > 1 }.keys
+            raise ArgumentError, "#{what} must be unique; repeated: #{repeated.join(', ')}" unless repeated.empty?
+          end
+          private_class_method :check_unique!
+
+          def behavior(entry, where, options, origins, path:)
+            given = Check.hash!(entry, where, allowed: BEHAVIOR_KEYS + (path ? [:path] : []))
+            origin = given.fetch(:origin, options[:origin_id]).to_s
+            unless origins.include?(origin)
+              raise ArgumentError,
+                    "#{where} origin #{origin.inspect} is not one of #{origins.join(', ')}"
+            end
+
+            balanced = origin == options[:origin_id]
+            result = {
+              origin: origin, methods: allowed_methods(given.fetch(:methods, path ? "read" : "all"), where),
+              viewer_protocol: Check.one_of!(given.fetch(:viewer_protocol, "redirect-to-https"), "#{where} viewer_protocol",
+                                             PROTOCOLS),
+              cache_policy: policy(given.fetch(:cache_policy, "caching_disabled"), "#{where} cache_policy"),
+              origin_request_policy: policy(given.fetch(:origin_request_policy, balanced ? "all_viewer" : "none"),
+                                            "#{where} origin_request_policy", none: true)
+            }
+            result[:compress] = Check.boolean!(given[:compress], "#{where} compress") if given.key?(:compress)
+            result[:compress] = true if !path && !given.key?(:compress)
+            result[:path] = path_pattern(given[:path], where) if path
+            result
+          end
+          private_class_method :behavior
+
+          def path_pattern(value, where)
+            text = value.to_s
+            raise ArgumentError, "#{where} path must start with / or *, got #{text.inspect}" unless text.start_with?("/", "*")
+
+            text
+          end
+          private_class_method :path_pattern
+
+          def allowed_methods(value, where)
+            return Check.strings!(value, "#{where} methods", min: 1) if value.is_a?(Array)
+            return METHODS.fetch(value.to_s) if METHODS.key?(value.to_s)
+
+            raise ArgumentError,
+                  "#{where} methods must be #{METHODS.keys.join(', ')} or a list of HTTP methods, got #{value.inspect}"
+          end
+          private_class_method :allowed_methods
+
+          def policy(value, where, none: false)
+            text = value.to_s
+            return nil if none && text == "none"
+            return MANAGED_POLICIES.fetch(text) if MANAGED_POLICIES.key?(text)
+            return [text, nil] if UUID.match?(text)
+
+            raise ArgumentError,
+                  "#{where} must be #{MANAGED_POLICIES.keys.join(', ')}#{', none' if none}, or a policy id, got #{value.inspect}"
+          end
+          private_class_method :policy
+
+          def alias_lines(options)
+            return [] if options[:aliases].empty?
+
+            ["      Aliases:"] + options[:aliases].map { |name| "        - #{name}" }
+          end
+          private_class_method :alias_lines
+
+          def certificate_lines(options)
+            return ["      ViewerCertificate:", "        CloudFrontDefaultCertificate: true"] unless options[:certificate_arn]
+
+            ["      ViewerCertificate:", "        AcmCertificateArn: #{options[:certificate_arn]}",
+             "        SslSupportMethod: sni-only", "        MinimumProtocolVersion: #{options[:minimum_protocol]}"]
+          end
+          private_class_method :certificate_lines
+
+          def origin_lines(options, alb_id)
+            ["      Origins:"] + alb_origin_lines(options, alb_id) + options[:extra_origins].flat_map do |origin|
+              s3_origin_lines(origin)
+            end
+          end
+          private_class_method :origin_lines
+
+          def alb_origin_lines(options, alb_id)
+            lines = ["        - Id: #{options[:origin_id]}", "          DomainName: !GetAtt #{alb_id}.DNSName"]
+            secret = options[:origin_secret]
+            if secret
+              lines.push("          OriginCustomHeaders:", "            - HeaderName: #{secret[:header]}",
+                         "              HeaderValue: !Ref #{secret[:parameter]}")
+            end
+            lines << "          CustomOriginConfig:"
+            lines << "            OriginProtocolPolicy: http-only"
+            lines.push("            HTTPPort: 80", "            HTTPSPort: 443") if options[:explicit_origin_ports]
+            unless options[:origin_ssl_protocols].empty?
+              lines << "            OriginSSLProtocols: #{Yaml.flow_list(options[:origin_ssl_protocols])}"
+            end
+            lines
+          end
+          private_class_method :alb_origin_lines
+
+          def s3_origin_lines(origin)
+            lines = ["        - Id: #{origin[:id]}", "          DomainName: #{Yaml.string(origin[:domain_name])}"]
+            if origin[:origin_access_control_id]
+              lines << "          OriginAccessControlId: #{Yaml.string(origin[:origin_access_control_id])}"
+            end
+            lines << "          S3OriginConfig: { OriginAccessIdentity: \"\" }"
+            lines
+          end
+          private_class_method :s3_origin_lines
+
+          def behavior_lines(key, entry, base)
+            pad = "#{base}  "
+            head = key ? "#{base}#{key}:" : "#{base}- PathPattern: #{Yaml.string(entry[:path])}"
+            [head, "#{pad}TargetOriginId: #{entry[:origin]}", *behavior_property_lines(entry, pad)]
+          end
+          private_class_method :behavior_lines
+
+          def behavior_property_lines(entry, pad)
+            lines = ["#{pad}ViewerProtocolPolicy: #{entry[:viewer_protocol]}",
+                     "#{pad}AllowedMethods: #{Yaml.flow_list(entry[:methods])}",
+                     "#{pad}CachedMethods: [GET, HEAD]"]
+            lines << "#{pad}Compress: #{entry[:compress]}" if entry.key?(:compress)
+            lines << policy_line(pad, "CachePolicyId", entry[:cache_policy])
+            lines << policy_line(pad, "OriginRequestPolicyId", entry[:origin_request_policy]) if entry[:origin_request_policy]
+            lines
+          end
+          private_class_method :behavior_property_lines
+
+          def policy_line(pad, key, policy)
+            id, label = policy
+            label ? "#{pad}#{key}: #{id} # #{label}" : "#{pad}#{key}: #{id}"
+          end
+          private_class_method :policy_line
+        end
+      end
+    end
+  end
+end