hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/fargate/monitoring.rb

@@ -1,5 +1,10 @@
 require_relative "check"
 require_relative "yaml"
+require_relative "monitoring/reading"
+require_relative "monitoring/topic"
+require_relative "monitoring/alarms"
+require_relative "monitoring/warmer_roles"
+require_relative "monitoring/warmer"
 
 module Hecks
   module Projections
@@ -8,8 +13,6 @@ module Hecks
         # Alerting for a Fargate stack: an `SNS` topic, CloudWatch alarms, and an
         # optional synthetic check.
         module Monitoring
-          module_function
-
           KEYS = [:topic, :email, :alarms, :warmer].freeze
           KINDS = %w[alb_5xx target_unhealthy cloudfront_5xx].freeze
           ALARM_KEYS = [:kind, :container, :threshold, :period, :evaluation_periods, :datapoints_to_alarm, :description].freeze
@@ -29,6 +32,14 @@ module Hecks
             synthetic:        "The synthetic check found a non-200 response on a real path, or stopped reporting."
           }.freeze
 
+          extend Reading
+          extend Topic
+          extend Alarms
+          extend WarmerRoles
+          extend Warmer
+
+          module_function
+
           def normalize(setting, containers:)
             return nil if setting.nil?
 
@@ -47,356 +58,11 @@ module Hecks
           end
 
           def yaml(alerts, context)
-            blocks = [topic_yaml(alerts, context[:ids])]
-            blocks << subscription_yaml(alerts, context[:ids]) if alerts[:email]
-            blocks << monitoring_subscription_yaml(context) if cloudfront_metrics?(alerts)
+            blocks = topic_blocks(alerts, context)
             blocks.concat(alerts[:alarms].flat_map { |alarm| alarm_blocks(alarm, context) })
             blocks.concat(warmer_blocks(alerts, context)) if alerts[:warmer]
             "#{blocks.join("\n\n")}\n\n"
           end
-
-          def alarms(entries, containers)
-            raise ArgumentError, "alerts alarms must be a list, got #{entries.inspect}" unless entries.is_a?(Array)
-
-            entries.flat_map do |entry|
-              given = if entry.is_a?(Hash)
-                        Check.hash!(entry, "alerts alarms", allowed:  ALARM_KEYS,
-                                                            required: [:kind])
-                      else
-                        { kind: entry }
-                      end
-              kind = Check.one_of!(given[:kind], "alerts alarms kind", KINDS)
-              kind == "target_unhealthy" ? unhealthy_alarms(given, containers) : [alarm(kind, given, nil)]
-            end
-          end
-          private_class_method :alarms
-
-          def unhealthy_alarms(given, containers)
-            named = given[:container]&.to_s
-            if named && !containers.include?(named)
-              raise ArgumentError,
-                    "alerts alarms container #{named.inspect} has no target group; have #{containers.join(', ')}"
-            end
-
-            (named ? [named] : containers).map { |container| alarm("target_unhealthy", given, container) }
-          end
-          private_class_method :unhealthy_alarms
-
-          def alarm(kind, given, container)
-            values = DEFAULTS.fetch(kind).merge(given.slice(:threshold, :period, :evaluation_periods, :datapoints_to_alarm))
-            values.each { |key, value| Check.integer!(value, "alerts alarms #{key}", range: 1..86_400) }
-            values.merge(kind: kind, container: container,
-                         description: description!(given[:description], "alerts alarms description"))
-          end
-          private_class_method :alarm
-
-          def warmer(value)
-            return nil if value.nil?
-
-            given = Check.hash!(value, "alerts warmer", allowed: WARMER_KEYS, required: [:paths])
-            paths = Check.strings!(given[:paths], "alerts warmer paths", min: 1)
-            unless paths.all? { |path| path.start_with?("/") }
-              raise ArgumentError, "alerts warmer paths must start with /, got #{paths.reject do |p|
-                p.start_with?('/')
-              end.join(', ')}"
-            end
-
-            rate = given.fetch(:rate, "rate(1 minute)").to_s
-            unless rate.match?(/\A(rate|cron)\(.+\)\z/)
-              raise ArgumentError,
-                    "alerts warmer rate must be a schedule expression such as rate(1 minute), got #{rate.inspect}"
-            end
-
-            { paths: paths, namespace: given[:namespace]&.to_s, rate: rate, code: given[:code]&.to_s,
-              schedule_description: description!(given[:schedule_description], "alerts warmer schedule_description"),
-              alarm_description: description!(given[:alarm_description], "alerts warmer alarm_description") }
-          end
-          private_class_method :warmer
-
-          def description!(value, where)
-            return nil if value.nil?
-
-            text = value.to_s
-            unless (1..1023).cover?(text.length)
-              raise ArgumentError,
-                    "#{where} must be 1 to 1023 characters, got #{value.inspect}"
-            end
-
-            text
-          end
-          private_class_method :description!
-
-          def topic_yaml(alerts, ids)
-            <<~TOPIC.rstrip
-              #{ids[:alerts_topic]}:
-                Type: AWS::SNS::Topic
-                Properties:
-                  TopicName: #{alerts[:topic]}
-            TOPIC
-          end
-          private_class_method :topic_yaml
-
-          def subscription_yaml(alerts, ids)
-            <<~SUBSCRIPTION.rstrip
-              # SNS holds an email subscription as pending until the recipient follows the
-              # confirmation link SNS mails on stack creation; no alert is delivered before then.
-              #{ids[:alerts_subscription]}:
-                Type: AWS::SNS::Subscription
-                Properties:
-                  TopicArn: !Ref #{ids[:alerts_topic]}
-                  Protocol: email
-                  Endpoint: #{alerts[:email]}
-            SUBSCRIPTION
-          end
-          private_class_method :subscription_yaml
-
-          def monitoring_subscription_yaml(context)
-            ids = context[:ids]
-            <<~MONITORING.rstrip
-              # CloudFront publishes per-minute metrics only for a distribution that opts in.
-              #{ids[:cloudfront_monitoring]}:
-                Type: AWS::CloudFront::MonitoringSubscription
-                Properties:
-                  DistributionId: !Ref #{context[:distribution_id]}
-                  MonitoringSubscription:
-                    RealtimeMetricsSubscriptionConfig:
-                      RealtimeMetricsSubscriptionStatus: Enabled
-            MONITORING
-          end
-          private_class_method :monitoring_subscription_yaml
-
-          def alarm_blocks(alarm, context)
-            case alarm[:kind]
-            when "alb_5xx" then [alb_alarm_yaml(alarm, context)]
-            when "target_unhealthy" then [unhealthy_alarm_yaml(alarm, context)]
-            else [cloudfront_alarm_yaml(alarm, context)]
-            end
-          end
-          private_class_method :alarm_blocks
-
-          def alarm_description(given, default)
-            "    AlarmDescription: #{Yaml.string(given || default)}"
-          end
-          private_class_method :alarm_description
-
-          def alarm_settings(alarm, ids, missing: "notBreaching", period: true)
-            lines = []
-            lines << "Period: #{alarm[:period]}" if period
-            lines << "EvaluationPeriods: #{alarm[:evaluation_periods]}"
-            lines << "DatapointsToAlarm: #{alarm[:datapoints_to_alarm]}" if alarm[:datapoints_to_alarm]
-            lines.push("Threshold: #{alarm[:threshold]}", "ComparisonOperator: GreaterThanOrEqualToThreshold",
-                       "TreatMissingData: #{missing}", "AlarmActions: [!Ref #{ids[:alerts_topic]}]",
-                       "OKActions: [!Ref #{ids[:alerts_topic]}]")
-          end
-          private_class_method :alarm_settings
-
-          def alb_alarm_yaml(alarm, context)
-            ids = context[:ids]
-            lines = [
-              "#{ids[:alb_5xx_alarm]}:", "  Type: AWS::CloudWatch::Alarm", "  Properties:",
-              "    AlarmName: #{context[:stack_name]}-alb-5xx",
-              alarm_description(alarm[:description], DESCRIPTIONS[:alb_5xx]),
-              "    Namespace: AWS/ApplicationELB", "    MetricName: HTTPCode_Target_5XX_Count",
-              "    Dimensions:", "      - Name: LoadBalancer", "        Value: !GetAtt #{context[:alb_id]}.LoadBalancerFullName",
-              "    Statistic: Sum"
-            ]
-            (lines + alarm_settings(alarm, ids).map { |line| "    #{line}" }).join("\n")
-          end
-          private_class_method :alb_alarm_yaml
-
-          def unhealthy_alarm_yaml(alarm, context)
-            ids = context[:ids]
-            container = alarm[:container]
-            group = context[:target_groups].fetch(container)
-            lines = [
-              "#{Yaml.camel(container)}TargetUnhealthyAlarm:", "  Type: AWS::CloudWatch::Alarm", "  Properties:",
-              "    AlarmName: #{context[:stack_name]}-#{container}-unhealthy",
-              alarm_description(alarm[:description], format(DESCRIPTIONS[:target_unhealthy], container: container)),
-              "    Namespace: AWS/ApplicationELB", "    MetricName: UnHealthyHostCount",
-              "    Dimensions:", "      - Name: LoadBalancer", "        Value: !GetAtt #{context[:alb_id]}.LoadBalancerFullName",
-              "      - Name: TargetGroup", "        Value: !GetAtt #{group}.TargetGroupFullName",
-              "    Statistic: Maximum"
-            ]
-            (lines + alarm_settings(alarm, ids).map { |line| "    #{line}" }).join("\n")
-          end
-          private_class_method :unhealthy_alarm_yaml
-
-          def cloudfront_alarm_yaml(alarm, context)
-            ids = context[:ids]
-            distribution = context[:distribution_id]
-            lines = [
-              "#{ids[:cloudfront_5xx_alarm]}:", "  Type: AWS::CloudWatch::Alarm", "  DependsOn: #{ids[:cloudfront_monitoring]}",
-              "  Properties:", "    AlarmName: #{context[:stack_name]}-cloudfront-5xx",
-              alarm_description(alarm[:description], DESCRIPTIONS[:cloudfront_5xx]),
-              "    Metrics:",
-              *edge_metric_lines(distribution)
-            ]
-            (lines + alarm_settings(alarm, ids, period: false).map { |line| "    #{line}" }).join("\n")
-          end
-          private_class_method :cloudfront_alarm_yaml
-
-          # A count rather than the raw percentage: at low traffic one failed request reads as a
-          # large rate, so the count is the rate applied to that minute's requests.
-          def edge_metric_lines(distribution)
-            [
-              "      - Id: errors", "        Label: CloudFront 5xx responses", "        Expression: rate * requests / 100",
-              "        ReturnData: true",
-              *metric_stat_lines("rate", "Average", "5xxErrorRate", distribution),
-              *metric_stat_lines("requests", "Sum", "Requests", distribution)
-            ]
-          end
-          private_class_method :edge_metric_lines
-
-          def metric_stat_lines(id, stat, metric, distribution)
-            [
-              "      - Id: #{id}", "        ReturnData: false", "        MetricStat:", "          Stat: #{stat}",
-              "          Period: 60", "          Metric:", "            Namespace: AWS/CloudFront",
-              "            MetricName: #{metric}",
-              "            Dimensions:", "              - Name: DistributionId", "                Value: !Ref #{distribution}",
-              "              - Name: Region", "                Value: Global"
-            ]
-          end
-          private_class_method :metric_stat_lines
-
-          def warmer_blocks(alerts, context)
-            namespace = alerts[:warmer][:namespace] || "#{context[:stack_name]}/Synthetic"
-            warmer = alerts[:warmer]
-            [warmer_role_yaml(context[:ids]), warmer_function_yaml(warmer, namespace, context),
-             synthetic_alarm_yaml(warmer, namespace, context), scheduler_role_yaml(context[:ids]),
-             schedule_yaml(warmer, context[:ids])]
-          end
-          private_class_method :warmer_blocks
-
-          def warmer_role_yaml(ids)
-            <<~ROLE.rstrip
-              #{ids[:warmer_role]}:
-                Type: AWS::IAM::Role
-                Properties:
-                  AssumeRolePolicyDocument:
-                    Version: '2012-10-17'
-                    Statement:
-                      - Effect: Allow
-                        Principal: { Service: lambda.amazonaws.com }
-                        Action: sts:AssumeRole
-                  ManagedPolicyArns:
-                    - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
-                  Policies:
-                    - PolicyName: PutMetric
-                      PolicyDocument:
-                        Version: '2012-10-17'
-                        Statement:
-                          # PutMetricData accepts no resource-level permission, so "*" is the only form.
-                          - Effect: Allow
-                            Action: cloudwatch:PutMetricData
-                            Resource: "*"
-            ROLE
-          end
-          private_class_method :warmer_role_yaml
-
-          def warmer_function_yaml(warmer, namespace, context)
-            ids = context[:ids]
-            head = <<~FUNCTION.rstrip
-              # Requests each real path through the CDN and reports how many failed. It always reports a
-              # data point, even zero, so the alarm below treats silence as a finding.
-              #{ids[:warmer_function]}:
-                Type: AWS::Lambda::Function
-                Properties:
-                  FunctionName: #{context[:stack_name]}-warmer
-                  Runtime: nodejs22.x
-                  Architectures: [arm64]
-                  Handler: index.handler
-                  MemorySize: 128
-                  Timeout: 20
-                  Role: !GetAtt #{ids[:warmer_role]}.Arn
-                  Environment:
-                    Variables:
-                      CLOUDFRONT_DOMAIN: !GetAtt #{context[:distribution_id]}.DomainName
-                  Code:
-                    ZipFile: |
-            FUNCTION
-            "#{head}\n#{Yaml.indent(warmer[:code] || warmer_code(warmer, namespace), '        ')}".rstrip
-          end
-          private_class_method :warmer_function_yaml
-
-          def warmer_code(warmer, namespace)
-            <<~CODE
-              const { CloudWatchClient, PutMetricDataCommand } = require("@aws-sdk/client-cloudwatch");
-              const cw = new CloudWatchClient({});
-              const PATHS = #{warmer[:paths].to_json};
-              exports.handler = async () => {
-                const host = process.env.CLOUDFRONT_DOMAIN;
-                let failures = 0;
-                const results = await Promise.all(PATHS.map(async (path) => {
-                  try {
-                    const res = await fetch(`https://${host}${path}`);
-                    if (res.status !== 200) failures++;
-                    return `${path}: ${res.status} (x-cache: ${res.headers.get("x-cache")})`;
-                  } catch (err) {
-                    failures++;
-                    return `${path}: FAILED ${err}`;
-                  }
-                }));
-                console.log(results.join("\\n"));
-                await cw.send(new PutMetricDataCommand({
-                  Namespace: #{namespace.to_json},
-                  MetricData: [{ MetricName: "SyntheticCheckFailures", Value: failures, Unit: "Count" }],
-                }));
-              };
-            CODE
-          end
-          private_class_method :warmer_code
-
-          def synthetic_alarm_yaml(warmer, namespace, context)
-            ids = context[:ids]
-            alarm = { period: 60, evaluation_periods: 1, threshold: 1 }
-            lines = [
-              "#{ids[:synthetic_alarm]}:", "  Type: AWS::CloudWatch::Alarm", "  Properties:",
-              "    AlarmName: #{context[:stack_name]}-synthetic-check",
-              alarm_description(warmer[:alarm_description], DESCRIPTIONS[:synthetic]),
-              "    Namespace: #{namespace}", "    MetricName: SyntheticCheckFailures", "    Statistic: Maximum"
-            ]
-            (lines + alarm_settings(alarm, ids, missing: "breaching").map { |line| "    #{line}" }).join("\n")
-          end
-          private_class_method :synthetic_alarm_yaml
-
-          def scheduler_role_yaml(ids)
-            <<~ROLE.rstrip
-              #{ids[:scheduler_role]}:
-                Type: AWS::IAM::Role
-                Properties:
-                  AssumeRolePolicyDocument:
-                    Version: '2012-10-17'
-                    Statement:
-                      - Effect: Allow
-                        Principal: { Service: scheduler.amazonaws.com }
-                        Action: sts:AssumeRole
-                  Policies:
-                    - PolicyName: InvokeWarmer
-                      PolicyDocument:
-                        Version: '2012-10-17'
-                        Statement:
-                          - Effect: Allow
-                            Action: lambda:InvokeFunction
-                            Resource: !GetAtt #{ids[:warmer_function]}.Arn
-            ROLE
-          end
-          private_class_method :scheduler_role_yaml
-
-          def schedule_yaml(warmer, ids)
-            <<~SCHEDULE.rstrip
-              #{ids[:warmer_schedule]}:
-                Type: AWS::Scheduler::Schedule
-                Properties:
-                  Name: !Sub "${AWS::StackName}-warmer"
-                  Description: #{Yaml.string(warmer[:schedule_description] || 'Runs the synthetic check against the CDN.')}
-                  ScheduleExpression: #{warmer[:rate].to_json}
-                  FlexibleTimeWindow: { Mode: "OFF" }
-                  Target:
-                    Arn: !GetAtt #{ids[:warmer_function]}.Arn
-                    RoleArn: !GetAtt #{ids[:scheduler_role]}.Arn
-            SCHEDULE
-          end
-          private_class_method :schedule_yaml
         end
       end
     end

data/lib/hecks/projections/deploy/fargate/sections.rb

@@ -0,0 +1,115 @@
+require_relative "yaml"
+require_relative "settings"
+require_relative "task_sections"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        # The text of each optional `# TMPL:<name>` section of a Fargate template, as the plan
+        # calls for it: empty when a world uses none of it.
+        module Sections
+          extend TaskSections
+
+          module_function
+
+          # @param plan [Settings::Plan] the resolved settings
+          # @param context [Hash{Symbol => String}] the ids the template's own resources go by
+          # @return [Hash{String => String}] each marker's name and the text that replaces it
+          def build(plan, context)
+            task_sections(plan, context).merge(resource_sections(plan, context))
+          end
+
+          def task_sections(plan, context)
+            {
+              "domain_essential"          => domain_essential_yaml(plan.layout.domain),
+              "session_secret_properties" => session_secret_yaml(plan.extras[:session_secret]),
+              "execution_database_grant"  => execution_grant_yaml(plan, context),
+              "extra_execution_policies"  => Extras.policies_yaml(plan.extras[:execution_policies]),
+              "extra_task_policies"       => task_policies_yaml(plan),
+              "domain_env"                => domain_env_yaml(plan.domain_env)
+            }
+          end
+          private_class_method :task_sections
+
+          def resource_sections(plan, context)
+            {
+              "extra_containers"        => lines(Containers.definitions_yaml(plan.layout, plan.ids[:log_group])),
+              "target_group_attributes" => Containers.target_group_attributes_yaml(plan.deregistration_delay),
+              "extra_target_groups"     => target_groups_yaml(plan, context),
+              "service_tuning"          => service_tuning_yaml(plan),
+              "extra_load_balancers"    => Containers.load_balancers_yaml(plan.layout),
+              "distribution"            => distribution_yaml(plan, context),
+              "extra_resources"         => extra_resources_yaml(plan, context),
+              "extra_outputs"           => outputs_yaml(plan)
+            }
+          end
+          private_class_method :resource_sections
+
+          def target_groups_yaml(plan, context)
+            blocks(
+              [
+                Containers.target_groups_yaml(plan.layout, context[:vpc_ref], plan.deregistration_delay),
+                Containers.listener_rules_yaml(plan.layout, context[:listener_id])
+              ].reject(&:empty?).join("\n\n")
+            )
+          end
+          private_class_method :target_groups_yaml
+
+          def distribution_yaml(plan, context)
+            ids = { distribution_id: context[:distribution_id], alb_id: context[:alb_id] }
+            plan.cdn ? Cdn.yaml(plan.cdn, **ids) : Cdn.default_yaml(**ids)
+          end
+          private_class_method :distribution_yaml
+
+          def monitoring_context(plan, context, groups)
+            { ids: plan.ids, stack_name: context[:stack_name], alb_id: context[:alb_id],
+              distribution_id: context[:distribution_id], target_groups: groups }
+          end
+          private_class_method :monitoring_context
+
+          def extra_resources_yaml(plan, context)
+            alerts = plan.alerts
+            groups = plan.layout.balanced.to_h { |container| [container.name, container.target_group_id] }
+            monitoring = alerts ? Monitoring.yaml(alerts, monitoring_context(plan, context, groups)) : ""
+            blocks([Containers.repositories_yaml(plan.layout), Extras.resources_yaml(plan.extras),
+                    monitoring.rstrip].reject(&:empty?).join("\n\n"))
+          end
+          private_class_method :extra_resources_yaml
+
+          # Adds one output per added container's repository, plus the cluster and service names a
+          # deploy script needs to find the running service.
+          def outputs_yaml(plan)
+            listed = plan.layout.multi? ? container_outputs(plan) : ""
+            alerts = plan.alerts ? "AlertsTopicArn:\n  Value: !Ref #{plan.ids[:alerts_topic]}\n" : ""
+            listed + alerts + Extras.outputs_yaml(plan.extras[:outputs])
+          end
+          private_class_method :outputs_yaml
+
+          def container_outputs(plan)
+            repositories = plan.layout.all.map do |container|
+              "#{Yaml.camel(container.name)}RepositoryUri:\n  Value: !GetAtt #{container.repository_id}.RepositoryUri\n"
+            end
+            cluster = "ClusterName:\n  Value: !Ref #{plan.ids[:cluster]}\n"
+            service = "ServiceName:\n  Value: !GetAtt #{plan.ids[:service]}.Name\n"
+            cluster + service + repositories.join
+          end
+          private_class_method :container_outputs
+
+          # Joins resource blocks so the section ends in the blank line the template expects before
+          # the next resource, and is empty when there is nothing to add.
+          def blocks(text)
+            text.empty? ? "" : "#{text}\n\n"
+          end
+          private_class_method :blocks
+
+          # Ends a block in one newline, and leaves an empty block empty.
+          def lines(text)
+            text.empty? ? "" : "#{text}\n"
+          end
+          private_class_method :lines
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/settings/ids.rb

@@ -0,0 +1,55 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Settings
+          # The logical ids and the AWS names of a stack's resources, derived from the stack and
+          # overridable by the world. Extended onto `Settings`, which supplies the role lists.
+          module Ids
+            private
+
+            def logical_ids(overrides, base)
+              given = overrides ? Check.hash!(overrides, "logical_ids", allowed: id_keys) : {}
+              derived = derived_ids(base)
+              given.each { |role, id| derived[role] = Check.logical_id!(id, "logical_ids #{role}") }
+              derived.freeze
+            end
+
+            def derived_ids(base)
+              derived = ID_ROLES.to_h { |role, suffix| [role, suffix ? "#{base[:logical_id]}#{suffix}" : base[:logical_id]] }
+              derived.merge!(FIXED_IDS)
+              derived[:database_prefix] = base[:db_id]
+              derived[:compute_prefix] = base[:logical_id]
+              derived
+            end
+
+            def id_keys
+              ID_ROLES.keys + FIXED_IDS.keys + [:database_prefix, :compute_prefix]
+            end
+
+            def names(overrides, base)
+              given = overrides ? Check.hash!(overrides, "names", allowed: NAME_ROLES) : {}
+              stack = base[:stack_name]
+              derived = {
+                cluster: stack, log_group: "/ecs/#{stack}", service: stack, alb: "#{stack}-alb",
+                family: base[:infra_name], db_secret_policy: "DbSecretRead"
+              }
+              given.each { |role, name| derived[role] = named(role, name) }
+              derived.freeze
+            end
+
+            def named(role, value)
+              return Check.resource_name!(value, "names #{role}") unless role == :alb_security_group_description
+
+              text = value.to_s
+              return text if text.match?(/\A[\x20-\x7e]{1,255}\z/)
+
+              raise ArgumentError,
+                    "names #{role} must be 1 to 255 printable ASCII characters (EC2 rejects anything else), got #{value.inspect}"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/settings/tuning.rb

@@ -0,0 +1,77 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Settings
+          # The optional service and build settings written onto a plan. Extended onto `Settings`,
+          # which supplies the defaults.
+          module Tuning
+            private
+
+            def check_alerts!(alerts, cdn)
+              return unless alerts && Monitoring.cloudfront_metrics?(alerts) && cdn.nil?
+
+              raise ArgumentError, "alerts cloudfront_5xx needs cdn options to be set, " \
+                                   "so its metric subscription is declared with the distribution"
+            end
+
+            def tuning(plan, settings, base)
+              tune_service(plan, settings, base)
+              tune_build(plan, settings)
+            end
+
+            def tune_service(plan, settings, base)
+              plan.execute_command = Check.boolean!(settings.fetch(:execute_command, false), "execute_command")
+              plan.health_check_grace_period = optional_integer(settings, :health_check_grace_period, 0..2_147_483_647)
+              plan.deregistration_delay = optional_integer(settings, :deregistration_delay, 0..3600)
+              plan.desired_count_parameter = optional_id(settings, :desired_count_parameter)
+              plan.db_name_parameter = optional_id(settings, :db_name_parameter)
+              return unless plan.db_name_parameter && !base[:shared]
+
+              raise ArgumentError, "db_name_parameter applies only to database \"Shared\""
+            end
+
+            def tune_build(plan, settings)
+              plan.execution_database_grant = Check.boolean!(settings.fetch(:execution_role_database_grant, true),
+                                                             "execution_role_database_grant")
+              check_execution_grant!(plan)
+              plan.domain_env = Check.map!(settings.fetch(:domain_env, {}), "domain_env", nil_ok: true)
+              plan.install_dir = install_dir(settings.fetch(:install_dir, DEFAULT_INSTALL_DIR))
+              plan.build_context_dir = build_context_dir(settings.fetch(:build_context_dir, ""))
+            end
+
+            def check_execution_grant!(plan)
+              return if plan.execution_database_grant || !plan.extras[:execution_policies].empty?
+
+              raise ArgumentError, "execution_role_database_grant false leaves the execution role without a policy; " \
+                                   "add one to execution_policies"
+            end
+
+            def optional_integer(settings, key, range)
+              settings.key?(key) ? Check.integer!(settings[key], key.to_s, range: range) : nil
+            end
+
+            def optional_id(settings, key)
+              settings.key?(key) ? Check.logical_id!(settings[key], key.to_s) : nil
+            end
+
+            def install_dir(value)
+              text = value.to_s
+              return text if text.match?(%r{\A/[A-Za-z0-9_./-]*[A-Za-z0-9_.-]\z})
+
+              raise ArgumentError, "install_dir must be an absolute path without a trailing slash, got #{value.inspect}"
+            end
+
+            def build_context_dir(value)
+              text = value.to_s
+              return text if text.empty? || text.match?(%r{\A[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*/\z})
+
+              raise ArgumentError,
+                    "build_context_dir must be a relative directory ending in /, such as \"build/\", got #{value.inspect}"
+            end
+          end
+        end
+      end
+    end
+  end
+end