hecks 3.5.0 → 3.6.0

data/lib/hecks/projections/deploy/templates/preview/db_init_script.sh.tmpl

@@ -0,0 +1,23 @@
+set -eu
+case "$TARGET_DB" in
+  ""|*[!a-z0-9_]*) echo "refusing TARGET_DB '$TARGET_DB': lowercase letters, digits and underscores only" >&2; exit 1 ;;
+esac
+[ "${#TARGET_DB}" -le 63 ] || { echo "refusing TARGET_DB '$TARGET_DB': longer than 63 characters" >&2; exit 1; }
+for protected in $PROTECTED_DATABASES; do
+  [ "$TARGET_DB" != "$protected" ] || { echo "refusing to manage the protected database '$protected'" >&2; exit 1; }
+done
+export PGSSLMODE=require PGCONNECT_TIMEOUT=10
+found=$(psql -h "$DB_HOST" -U "$PGUSER" -d postgres -Atc "SELECT 1 FROM pg_database WHERE datname = '$TARGET_DB'")
+if [ "${ACTION:-create}" = "drop" ]; then
+  if [ "$found" = "1" ]; then
+    psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -U "$PGUSER" -d postgres -c "DROP DATABASE \"$TARGET_DB\" WITH (FORCE)"
+    echo "dropped database $TARGET_DB"
+  else
+    echo "database $TARGET_DB does not exist"
+  fi
+elif [ "$found" = "1" ]; then
+  echo "database $TARGET_DB already exists"
+else
+  psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -U "$PGUSER" -d postgres -c "CREATE DATABASE \"$TARGET_DB\""
+  echo "created database $TARGET_DB"
+fi

data/lib/hecks/projections/deploy/templates/preview/db_init_secrets.tmpl

@@ -0,0 +1,5 @@
+Secrets:
+  - Name: PGUSER
+    ValueFrom: !Sub "${OwningDatabaseSecretArn}:username::"
+  - Name: PGPASSWORD
+    ValueFrom: !Sub "${OwningDatabaseSecretArn}:password::"

data/lib/hecks/projections/deploy/templates/preview/db_init_task.tmpl

@@ -0,0 +1,39 @@
+# Run by preview.sh (`aws ecs run-task`) after the images are pushed and before the
+# service scales up: the database instance is reachable only from inside the VPC, so
+# this is the one place a laptop-driven deploy can run CREATE DATABASE. Idempotent.
+DbInitTaskDefinition:
+  Type: AWS::ECS::TaskDefinition
+  Properties:
+    Family: !Sub "@@prefix@@-${EnvName}-dbinit"
+    RequiresCompatibilities: [FARGATE]
+    NetworkMode: awsvpc
+    Cpu: "256"
+    Memory: "512"
+    RuntimePlatform:
+      CpuArchitecture: ARM64
+      OperatingSystemFamily: LINUX
+    ExecutionRoleArn: !GetAtt ExecutionRole.Arn
+    TaskRoleArn: !GetAtt TaskRole.Arn
+    ContainerDefinitions:
+      - Name: dbinit
+        Image: @@image@@
+        Essential: true
+        Command:
+          - sh
+          - -c
+          - |
+@@script@@
+        LogConfiguration:
+          LogDriver: awslogs
+          Options:
+            awslogs-group: !Ref LogGroup
+            awslogs-region: !Ref AWS::Region
+            awslogs-stream-prefix: dbinit
+        Environment:
+          - Name: DB_HOST
+            Value: !Ref OwningDatabaseEndpoint
+          - Name: TARGET_DB
+            Value: !Ref DbName
+          - Name: PROTECTED_DATABASES
+            Value: @@protected@@
+@@secrets@@

data/lib/hecks/projections/deploy/templates/preview/desired_count.tmpl

@@ -0,0 +1,5 @@
+# The repositories are created by this stack, so the first create has no image to
+# point at. preview.sh creates the stack at 0, pushes, then scales up.
+DesiredCount:
+  Type: Number
+  Default: 0

data/lib/hecks/projections/deploy/templates/preview/distribution.tmpl

@@ -0,0 +1,24 @@
+# One behavior, nothing cached: a preview is for looking at a change, so no cache means
+# no stale page after a redeploy and no session response served to the wrong visitor.
+# AllViewer forwards the viewer's Host so a same-origin check sees the real hostname.
+PreviewDistribution:
+  Type: AWS::CloudFront::Distribution
+  Properties:
+    DistributionConfig:
+      Enabled: true
+      HttpVersion: http2
+      Comment: !Sub "preview ${EnvName}"
+      Origins:
+        - Id: PreviewAlbOrigin
+          DomainName: !GetAtt Alb.DNSName
+          CustomOriginConfig:
+            OriginProtocolPolicy: http-only
+            OriginSSLProtocols: [TLSv1.2]
+      DefaultCacheBehavior:
+        TargetOriginId: PreviewAlbOrigin
+        ViewerProtocolPolicy: redirect-to-https
+        AllowedMethods: [GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE]
+        CachedMethods: [GET, HEAD]
+        Compress: true
+        CachePolicyId: @@caching_disabled@@
+        OriginRequestPolicyId: @@all_viewer@@

data/lib/hecks/projections/deploy/templates/preview/execution_role.tmpl

@@ -0,0 +1,16 @@
+# The execution role reads the database secret only so the one-shot task can be given
+# its credentials as container secrets.
+ExecutionRole:
+  Type: AWS::IAM::Role
+  Properties:
+@@assume@@
+    ManagedPolicyArns:
+      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
+    Policies:
+      - PolicyName: SharedDatabaseSecretRead
+        PolicyDocument:
+          Version: '2012-10-17'
+          Statement:
+            - Effect: Allow
+              Action: secretsmanager:GetSecretValue
+              Resource: !Ref OwningDatabaseSecretArn

data/lib/hecks/projections/deploy/templates/preview/header.tmpl

@@ -0,0 +1,16 @@
+# GENERATED by hecks deploy project - re-run it to refresh this file rather than
+# hand-editing. Source: the `preview` block of the domain's deployed_to("AwsFargate").
+#
+# One stack per git branch, driven by preview.sh. A separate template from the main
+# one on purpose, so a preview can never appear in a change set against the live
+# stack. It shares the task shape and nothing else.
+#
+# Per branch: ECS cluster, service and task, an ALB, one ECR repository per
+# container, secrets, a log group, a CloudFront distribution (default hostname,
+# nothing cached) and its own database on the shared instance.
+# Borrowed from @@owner_stack@@: VPC, subnets and the compute security group.
+# Left out on purpose: alarms, notifications, warmers and custom domains.
+AWSTemplateFormatVersion: '2010-09-09'
+Description: >
+  @@infra_name@@ preview - one feature branch, behind its own ALB and
+  CloudFront, on its own database.

data/lib/hecks/projections/deploy/templates/preview/ingress.tmpl

@@ -0,0 +1,8 @@
+ComputeIngressFromAlb@@logical@@:
+  Type: AWS::EC2::SecurityGroupIngress
+  Properties:
+    GroupId: !Ref OwningSecurityGroupId
+    IpProtocol: tcp
+    FromPort: @@port@@
+    ToPort: @@port@@
+    SourceSecurityGroupId: !Ref AlbSecurityGroup

data/lib/hecks/projections/deploy/templates/preview/listener.tmpl

@@ -0,0 +1,9 @@
+Listener:
+  Type: AWS::ElasticLoadBalancingV2::Listener
+  Properties:
+    LoadBalancerArn: !Ref Alb
+    Port: 80
+    Protocol: HTTP
+    DefaultActions:
+      - Type: forward
+        TargetGroupArn: !Ref @@default_logical@@TargetGroup

data/lib/hecks/projections/deploy/templates/preview/listener_rule.tmpl

@@ -0,0 +1,11 @@
+@@id@@:
+  Type: AWS::ElasticLoadBalancingV2::ListenerRule
+  Properties:
+    ListenerArn: !Ref Listener
+    Priority: @@priority@@
+    Conditions:
+      - Field: path-pattern
+        Values: [@@paths@@]
+    Actions:
+      - Type: forward
+        TargetGroupArn: !Ref @@logical@@TargetGroup

data/lib/hecks/projections/deploy/templates/preview/log_group.tmpl

@@ -0,0 +1,5 @@
+LogGroup:
+  Type: AWS::Logs::LogGroup
+  Properties:
+    LogGroupName: !Sub "/ecs/@@prefix@@-${EnvName}"
+    RetentionInDays: @@retention_days@@

data/lib/hecks/projections/deploy/templates/preview/log_options.tmpl

@@ -0,0 +1,5 @@
+LogDriver: awslogs
+Options:
+  awslogs-group: !Ref LogGroup
+  awslogs-region: !Ref AWS::Region
+  awslogs-stream-prefix: @@container@@

data/lib/hecks/projections/deploy/templates/preview/outputs.tmpl

@@ -0,0 +1,14 @@
+Outputs:
+  PreviewUrl:
+    Value: !Sub "https://${PreviewDistribution.DomainName}"
+  ClusterName:
+    Value: !Ref Cluster
+  ServiceName:
+    Value: !GetAtt Service.Name
+  DbInitTaskDefinition:
+    Value: !Ref DbInitTaskDefinition
+  # The ARN only, so preview.sh can fetch the secret to mint signup and session tokens.
+  SessionSecretArn:
+    Value: !Ref SessionSecret
+  DatabaseName:
+    Value: !Ref DbName

data/lib/hecks/projections/deploy/templates/preview/service.tmpl

@@ -0,0 +1,17 @@
+Service:
+  Type: AWS::ECS::Service
+  DependsOn: [@@depends_on@@]
+  Properties:
+    ServiceName: !Sub "@@prefix@@-${EnvName}"
+    Cluster: !Ref Cluster
+    TaskDefinition: !Ref TaskDefinition
+    DesiredCount: !Ref DesiredCount
+    LaunchType: FARGATE
+    EnableExecuteCommand: true
+    NetworkConfiguration:
+      AwsvpcConfiguration:
+        AssignPublicIp: DISABLED
+        Subnets: [!Ref OwningSubnetAId, !Ref OwningSubnetBId]
+        SecurityGroups: [!Ref OwningSecurityGroupId]
+    LoadBalancers:
+@@load_balancers@@

data/lib/hecks/projections/deploy/templates/preview/session_secret.tmpl

@@ -0,0 +1,11 @@
+# No explicit Name: Secrets Manager keeps a deleted secret through its recovery window,
+# and a fixed name would make destroy followed by deploy on one branch fail.
+SessionSecret:
+  Type: AWS::SecretsManager::Secret
+  Properties:
+    Description: !Sub "Session secret of the ${EnvName} preview."
+    GenerateSecretString:
+      SecretStringTemplate: '{}'
+      GenerateStringKey: session_secret
+      PasswordLength: 64
+      ExcludePunctuation: true

data/lib/hecks/projections/deploy/templates/preview/target_group.tmpl

@@ -0,0 +1,9 @@
+@@logical@@TargetGroup:
+  Type: AWS::ElasticLoadBalancingV2::TargetGroup
+  Properties:
+    TargetType: ip
+    Port: @@port@@
+    Protocol: HTTP
+    VpcId: !Ref OwningVpcId
+    HealthCheckPath: @@health_check_path@@
+    HealthCheckPort: "@@port@@"

data/lib/hecks/projections/deploy/templates/preview/task_definition.tmpl

@@ -0,0 +1,15 @@
+TaskDefinition:
+  Type: AWS::ECS::TaskDefinition
+  Properties:
+    Family: !Sub "@@prefix@@-${EnvName}"
+    RequiresCompatibilities: [FARGATE]
+    NetworkMode: awsvpc
+    Cpu: "@@cpu@@"
+    Memory: "@@memory@@"
+    RuntimePlatform:
+      CpuArchitecture: ARM64
+      OperatingSystemFamily: LINUX
+    ExecutionRoleArn: !GetAtt ExecutionRole.Arn
+    TaskRoleArn: !GetAtt TaskRole.Arn
+    ContainerDefinitions:
+@@containers@@

data/lib/hecks/projections/deploy/templates/preview/task_role.tmpl

@@ -0,0 +1,22 @@
+# Reads the shared database secret (it connects with it and creates its database) and
+# this preview's own secrets; nothing owned by the main stack.
+TaskRole:
+  Type: AWS::IAM::Role
+  Properties:
+@@assume@@
+    Policies:
+      - PolicyName: SharedDatabaseSecretRead
+        PolicyDocument:
+          Version: '2012-10-17'
+          Statement:
+            - Effect: Allow
+              Action: secretsmanager:GetSecretValue
+              Resource: !Ref OwningDatabaseSecretArn
+      - PolicyName: PreviewSecretRead
+        PolicyDocument:
+          Version: '2012-10-17'
+          Statement:
+            - Effect: Allow
+              Action: secretsmanager:GetSecretValue
+              Resource:
+@@readable@@

data/lib/hecks/projections/deploy/templates/shared/aurora_db.tmpl

@@ -0,0 +1,52 @@
+# Aurora Serverless v2, Postgres-compatible -- the split
+# shape Aurora needs (a DBCluster carrying the managed
+# password/endpoint/subnet-group/security-group, plus at
+# least one DBInstance inside it) is the only thing
+# different from the plain-RDS path below;
+# Adapters::PostgresEra/tokio_postgres speak the identical
+# wire protocol against either endpoint.
+# Self-managed, not ManageMasterUserPassword: true --
+# CloudFormation's `{{resolve:secretsmanager:...}}` only
+# resolves an auto-rotating managed secret fresh at the
+# compute resource's own creation, and RDS's managed-
+# password feature rotates the password itself shortly
+# after standing up the cluster -- every subsequent
+# invocation would keep authenticating with the now-stale
+# original value. A self-managed secret (generated once,
+# here, never auto-rotated) has nothing to go stale.
+@@db_id@@Secret:
+  Type: AWS::SecretsManager::Secret
+  Properties:
+    GenerateSecretString:
+      SecretStringTemplate: '{"username":"postgres"}'
+      GenerateStringKey: password
+      PasswordLength: 32
+      ExcludeCharacters: '"@/'
+
+@@db_id@@Cluster:
+  Type: AWS::RDS::DBCluster
+  DeletionPolicy: Snapshot
+  UpdateReplacePolicy: Snapshot
+  DependsOn: @@db_id@@Secret
+  Properties:
+    Engine: aurora-postgresql
+    EngineVersion: "16.14"
+    DatabaseName: @@db_name@@
+    MasterUsername: postgres
+    MasterUserPassword: !Sub "{{resolve:secretsmanager:${@@db_id@@Secret}:SecretString:password}}"
+    StorageEncrypted: true
+    DBSubnetGroupName: !Ref @@db_id@@SubnetGroup
+    VpcSecurityGroupIds: [!Ref @@db_id@@SecurityGroup]
+    ServerlessV2ScalingConfiguration:
+      MinCapacity: 0.5
+      MaxCapacity: 1
+
+@@db_id@@Instance:
+  Type: AWS::RDS::DBInstance
+  DeletionPolicy: Snapshot
+  UpdateReplacePolicy: Snapshot
+  Properties:
+    Engine: aurora-postgresql
+    DBInstanceClass: db.serverless
+    DBClusterIdentifier: !Ref @@db_id@@Cluster
+    PubliclyAccessible: false

data/lib/hecks/projections/deploy/templates/shared/bastion.tmpl

@@ -0,0 +1,74 @@
+# GENERATED by hecks deploy project @@domain@@ — re-run it to refresh
+# this file rather than hand-editing. Deployed and destroyed by
+# `make mint-era` (this directory's own Makefile) — never left
+# running: it exists only long enough for one Ruby boot to reach
+# @@infra_name@@'s private RDS instance and mint era 1.
+AWSTemplateFormatVersion: '2010-09-09'
+Description: >
+  TEMPORARY — @@infra_name@@'s era-minting bastion. Deployed and torn
+  down by `make mint-era`; not meant to run continuously.
+
+# bastion_parameters (Shared.bastion_parameters) — the other end of
+# the contract the main template's own Outputs comment describes;
+# the Makefile's --parameter-overrides line fills these from the
+# same table.
+Parameters:
+  @@parameters@@
+
+Resources:
+  @@public_subnet@@
+  # Zero Ingress rules — SSM Session Manager is outbound-only from
+  # the instance's side (it dials out to AWS's SSM service), so
+  # nothing needs to reach this instance over the network at all,
+  # despite it sitting in a public subnet with a public IP.
+  BastionSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      VpcId: !Ref VpcId
+      # A plain hyphen, not an em-dash - EC2's GroupDescription
+      # field rejects any non-ASCII character outright.
+      GroupDescription: "TEMPORARY era-minting bastion - SSM only, no inbound rules"
+
+  BastionToRds:
+    Type: AWS::EC2::SecurityGroupIngress
+    Properties:
+      GroupId: !Ref RdsSecurityGroupId
+      IpProtocol: tcp
+      FromPort: 5432
+      ToPort: 5432
+      SourceSecurityGroupId: !Ref BastionSecurityGroup
+
+  BastionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal: { Service: ec2.amazonaws.com }
+            Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
+
+  BastionInstanceProfile:
+    Type: AWS::IAM::InstanceProfile
+    Properties:
+      Roles: [!Ref BastionRole]
+
+  BastionInstance:
+    Type: AWS::EC2::Instance
+    Properties:
+      # Amazon Linux 2023's own SSM parameter — always the current
+      # AL2023 AMI for whatever region this deploys into, never a
+      # hand-copied, region-specific, staleness-prone AMI id.
+      ImageId: "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}"
+      InstanceType: t3.micro
+      SubnetId: !Ref @@subnet_id@@
+      SecurityGroupIds: [!Ref BastionSecurityGroup]
+      IamInstanceProfile: !Ref BastionInstanceProfile
+      Tags:
+        - { Key: Name, Value: @@stack_name@@-bastion }
+
+Outputs:
+  InstanceId:
+    Value: !Ref BastionInstance

data/lib/hecks/projections/deploy/templates/shared/bastion_own_public.tmpl

@@ -0,0 +1,41 @@
+# A new public subnet, not the RDS's own private ones --
+# those have no internet route at all, and the SSM agent
+# needs to reach AWS's own SSM endpoints over HTTPS.
+# 10.0.99.0/24 is picked to sit outside the main template's
+# own 10.0.1.0/24 and 10.0.2.0/24 ranges inside the same /16 VPC.
+BastionSubnet:
+  Type: AWS::EC2::Subnet
+  Properties:
+    VpcId: !Ref VpcId
+    CidrBlock: 10.0.99.0/24
+    AvailabilityZone: !Select [1, !GetAZs '']
+    MapPublicIpOnLaunch: true
+
+BastionInternetGateway:
+  Type: AWS::EC2::InternetGateway
+
+BastionVpcGatewayAttachment:
+  Type: AWS::EC2::VPCGatewayAttachment
+  Properties:
+    VpcId: !Ref VpcId
+    InternetGatewayId: !Ref BastionInternetGateway
+
+BastionRouteTable:
+  Type: AWS::EC2::RouteTable
+  Properties:
+    VpcId: !Ref VpcId
+
+BastionInternetRoute:
+  Type: AWS::EC2::Route
+  DependsOn: BastionVpcGatewayAttachment
+  Properties:
+    RouteTableId: !Ref BastionRouteTable
+    DestinationCidrBlock: 0.0.0.0/0
+    GatewayId: !Ref BastionInternetGateway
+
+BastionSubnetRouteTableAssociation:
+  Type: AWS::EC2::SubnetRouteTableAssociation
+  Properties:
+    SubnetId: !Ref BastionSubnet
+    RouteTableId: !Ref BastionRouteTable
+

data/lib/hecks/projections/deploy/templates/shared/bastion_reuse_public.tmpl

@@ -0,0 +1,10 @@
+# BastionSubnetId, not a subnet minted here — the main
+# template's own @@db_id@@BastionPublicSubnet (and the
+# Internet Gateway it shares with @@db_id@@PublicSubnet)
+# already exist once google_oauth_present is true, and a VPC
+# accepts only one attached Internet Gateway: this stack's
+# own BastionInternetGateway (below, the no-oauth branch)
+# would collide with it. Its own subnet, not PublicSubnetId
+# directly, despite sharing that subnet's route table --
+# PublicSubnetId's AZ can't launch EC2 instances at all on
+# this account.

data/lib/hecks/projections/deploy/templates/shared/nat_gateway.tmpl

@@ -0,0 +1,102 @@
+# Real Google OAuth token exchange needs real internet access --
+# see the enclosing template's own "NO NAT GATEWAY" comment for
+# why this is opt-in. One NAT Gateway, one public subnet, wired
+# only when google_oauth_present -- nothing else in this stack
+# pays for it.
+@@db_id@@PublicSubnet:
+  Type: AWS::EC2::Subnet
+  Properties:
+    VpcId: !Ref @@db_id@@Vpc
+    CidrBlock: 10.0.3.0/24
+    AvailabilityZone: !Select [0, !GetAZs '']
+    MapPublicIpOnLaunch: true
+
+@@db_id@@InternetGateway:
+  Type: AWS::EC2::InternetGateway
+
+@@db_id@@InternetGatewayAttachment:
+  Type: AWS::EC2::VPCGatewayAttachment
+  Properties:
+    VpcId: !Ref @@db_id@@Vpc
+    InternetGatewayId: !Ref @@db_id@@InternetGateway
+
+@@db_id@@PublicRouteTable:
+  Type: AWS::EC2::RouteTable
+  Properties:
+    VpcId: !Ref @@db_id@@Vpc
+
+@@db_id@@PublicRoute:
+  Type: AWS::EC2::Route
+  DependsOn: @@db_id@@InternetGatewayAttachment
+  Properties:
+    RouteTableId: !Ref @@db_id@@PublicRouteTable
+    DestinationCidrBlock: 0.0.0.0/0
+    GatewayId: !Ref @@db_id@@InternetGateway
+
+@@db_id@@PublicSubnetRouteTableAssociation:
+  Type: AWS::EC2::SubnetRouteTableAssociation
+  Properties:
+    SubnetId: !Ref @@db_id@@PublicSubnet
+    RouteTableId: !Ref @@db_id@@PublicRouteTable
+
+# A second public subnet, AZ index 1 -- not where NatGateway
+# lives (that's still @@db_id@@PublicSubnet, AZ index 0). Only
+# for bastion.yaml's own BastionInstance, a real EC2 instance
+# that a real, live CREATE_FAILED proved this account can't
+# launch in AZ index 0 at all. Same shared
+# @@db_id@@PublicRouteTable/@@db_id@@InternetGateway as
+# @@db_id@@PublicSubnet, not a second IGW -- a VPC accepts only one.
+@@db_id@@BastionPublicSubnet:
+  Type: AWS::EC2::Subnet
+  Properties:
+    VpcId: !Ref @@db_id@@Vpc
+    CidrBlock: 10.0.4.0/24
+    AvailabilityZone: !Select [1, !GetAZs '']
+    MapPublicIpOnLaunch: true
+
+@@db_id@@BastionPublicSubnetRouteTableAssociation:
+  Type: AWS::EC2::SubnetRouteTableAssociation
+  Properties:
+    SubnetId: !Ref @@db_id@@BastionPublicSubnet
+    RouteTableId: !Ref @@db_id@@PublicRouteTable
+
+@@db_id@@NatEip:
+  Type: AWS::EC2::EIP
+  Properties:
+    Domain: vpc
+
+@@db_id@@NatGateway:
+  Type: AWS::EC2::NatGateway
+  Properties:
+    SubnetId: !Ref @@db_id@@PublicSubnet
+    AllocationId: !GetAtt @@db_id@@NatEip.AllocationId
+
+# @@db_id@@SubnetA/B (private -- the compute and RDS live here)
+# have no route to the internet at all without this: routes
+# outbound through @@db_id@@NatGateway instead of an Internet
+# Gateway directly -- the whole reason a NAT (not just an IGW)
+# exists: outbound-only, no inbound path back into these subnets.
+@@db_id@@PrivateRouteTable:
+  Type: AWS::EC2::RouteTable
+  Properties:
+    VpcId: !Ref @@db_id@@Vpc
+
+@@db_id@@PrivateRoute:
+  Type: AWS::EC2::Route
+  Properties:
+    RouteTableId: !Ref @@db_id@@PrivateRouteTable
+    DestinationCidrBlock: 0.0.0.0/0
+    NatGatewayId: !Ref @@db_id@@NatGateway
+
+@@db_id@@SubnetARouteTableAssociation:
+  Type: AWS::EC2::SubnetRouteTableAssociation
+  Properties:
+    SubnetId: !Ref @@db_id@@SubnetA
+    RouteTableId: !Ref @@db_id@@PrivateRouteTable
+
+@@db_id@@SubnetBRouteTableAssociation:
+  Type: AWS::EC2::SubnetRouteTableAssociation
+  Properties:
+    SubnetId: !Ref @@db_id@@SubnetB
+    RouteTableId: !Ref @@db_id@@PrivateRouteTable
+

data/lib/hecks/projections/deploy/templates/shared/oauth_egress.tmpl

@@ -0,0 +1,17 @@
+# A standalone AWS::EC2::SecurityGroupEgress resource for a
+# group replaces that group's own default allow-all-outbound
+# rule with only what's explicitly declared here --
+# @@compute_id@@EgressToDb's own existence already means
+# @@compute_id@@SecurityGroup has no other egress at
+# all. 443 to 0.0.0.0/0, not a narrower destination -- Google
+# publishes no fixed IP range for oauth2.googleapis.com an AWS
+# security group could reference instead.
+@@compute_id@@EgressToInternet:
+  Type: AWS::EC2::SecurityGroupEgress
+  Properties:
+    GroupId: !Ref @@compute_id@@SecurityGroup
+    IpProtocol: tcp
+    FromPort: 443
+    ToPort: 443
+    CidrIp: 0.0.0.0/0
+

data/lib/hecks/projections/deploy/templates/shared/plain_db.tmpl

@@ -0,0 +1,16 @@
+@@db_id@@:
+  Type: AWS::RDS::DBInstance
+  DeletionPolicy: Snapshot
+  UpdateReplacePolicy: Snapshot
+  Properties:
+    Engine: postgres
+    EngineVersion: "16.14"
+    DBInstanceClass: db.t4g.micro
+    AllocatedStorage: "20"
+    StorageEncrypted: true
+    DBName: @@db_name@@
+    MasterUsername: postgres
+    ManageMasterUserPassword: true
+    PubliclyAccessible: false
+    DBSubnetGroupName: !Ref @@db_id@@SubnetGroup
+    VPCSecurityGroups: [!Ref @@db_id@@SecurityGroup]

data/lib/hecks/projections/deploy/templates/shared/vpc_and_database.tmpl

@@ -0,0 +1,67 @@
+@@db_id@@Vpc:
+  Type: AWS::EC2::VPC
+  Properties:
+    CidrBlock: 10.0.0.0/16
+    EnableDnsSupport: true
+    EnableDnsHostnames: true
+
+@@db_id@@SubnetA:
+  Type: AWS::EC2::Subnet
+  Properties:
+    VpcId: !Ref @@db_id@@Vpc
+    CidrBlock: 10.0.1.0/24
+    AvailabilityZone: !Select [0, !GetAZs '']
+
+@@db_id@@SubnetB:
+  Type: AWS::EC2::Subnet
+  Properties:
+    VpcId: !Ref @@db_id@@Vpc
+    CidrBlock: 10.0.2.0/24
+    AvailabilityZone: !Select [1, !GetAZs '']
+
+@@nat_gateway@@
+@@db_id@@SubnetGroup:
+  Type: AWS::RDS::DBSubnetGroup
+  Properties:
+    DBSubnetGroupDescription: !Sub "${AWS::StackName} - private subnets for @@infra_name@@'s own RDS instance"
+    SubnetIds: [!Ref @@db_id@@SubnetA, !Ref @@db_id@@SubnetB]
+
+# No inline SecurityGroupEgress/Ingress on either group -- each
+# would need to reference the other's id from inside its own
+# Properties, a genuine circular create-order dependency
+# CloudFormation refuses outright (cfn-lint E3004). Standard
+# fix: create both groups empty, then wire the cross-reference
+# through two standalone rule resources below, each of which
+# can legitimately depend on both groups already existing.
+@@compute_id@@SecurityGroup:
+  Type: AWS::EC2::SecurityGroup
+  Properties:
+    VpcId: !Ref @@db_id@@Vpc
+    GroupDescription: @@compute_description@@
+
+@@db_id@@SecurityGroup:
+  Type: AWS::EC2::SecurityGroup
+  Properties:
+    VpcId: !Ref @@db_id@@Vpc
+    GroupDescription: @@db_id@@ - ingress rule attached separately below, from @@compute_id@@ only
+
+@@compute_id@@EgressToDb:
+  Type: AWS::EC2::SecurityGroupEgress
+  Properties:
+    GroupId: !Ref @@compute_id@@SecurityGroup
+    IpProtocol: tcp
+    FromPort: 5432
+    ToPort: 5432
+    DestinationSecurityGroupId: !Ref @@db_id@@SecurityGroup
+
+@@oauth_egress@@
+@@db_id@@IngressFromFunction:
+  Type: AWS::EC2::SecurityGroupIngress
+  Properties:
+    GroupId: !Ref @@db_id@@SecurityGroup
+    IpProtocol: tcp
+    FromPort: 5432
+    ToPort: 5432
+    SourceSecurityGroupId: !Ref @@compute_id@@SecurityGroup
+
+@@database@@