@aws-blocks/bb-app-setting 0.1.4 → 0.2.1

package/dist/index.mock.d.ts

@@ -36,6 +36,7 @@ export declare class AppSetting<T = string> extends Scope {
     static fromExisting<T = string>(scope: ScopeParent, id: string, options: {
         name: string;
         secret?: boolean;
+        kmsKeyArn?: string;
     }): AppSetting<T>;
     private parameterName;
     private initialValue;

package/dist/index.mock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAsCpD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACzC,UAAU,CAAC,CAAC,CAAC;IAKhB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAyBzE;;;;;;;;;;;OAWG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IAWvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}
+{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAsCpD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;IAKhB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAyBzE;;;;;;;;;;;OAWG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IAWvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/types.d.ts

@@ -23,8 +23,24 @@ export interface AppSettingOptions<T = string> {
     value?: T;
     /** Runtime validation schema. Accepts any StandardSchemaV1 implementation (Zod, Valibot, ArkType). When provided, T is inferred from the schema. */
     schema?: StandardSchemaV1<T>;
-    /** When true, creates an SSM SecureString parameter encrypted with the default aws/ssm KMS key. */
+    /** When true, creates an SSM SecureString parameter. Encrypted with the default `aws/ssm` KMS key unless `kmsKeyArn` is set. */
     secret?: boolean;
+    /**
+     * ARN of a **customer-managed KMS key** used to encrypt this secret's
+     * SecureString value. When omitted, SSM uses the default `aws/ssm`
+     * AWS-managed key. Use a CMK when you need to control the decrypt/grant scope
+     * (e.g. cross-account access, key rotation, or a dedicated key policy).
+     *
+     * Only valid together with `secret: true`. The CDK layer grants the shared
+     * handler `kms:Decrypt` (plus `kms:Encrypt` for stack-managed secrets it
+     * writes) on this key, and the runtime `put()` passes the key so an overwrite
+     * does not silently fall back to the default key. Changing this on an existing
+     * secret re-encrypts its current value under the new key at deploy time.
+     *
+     * @example
+     * new AppSetting(scope, 'apiKey', { secret: true, kmsKeyArn: myKey.keyArn });
+     */
+    kmsKeyArn?: string;
     /** Optional logger for internal operations. When omitted, a default Logger at error level is created. */
     logger?: ChildLogger;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,MAAM;IAC5C;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iLAAiL;IACjL,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC7B,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yGAAyG;IACzG,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,iBAAiB,CAAC,CAAC,CAAC;IAClF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,MAAM;IAC5C;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iLAAiL;IACjL,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,oJAAoJ;IACpJ,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC7B,gIAAgI;IAChI,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yGAAyG;IACzG,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,iBAAiB,CAAC,CAAC,CAAC;IAClF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB"}

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const BB_NAME = "AppSetting";
-export declare const BB_VERSION = "0.1.4";
+export declare const BB_VERSION = "0.2.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'AppSetting';
-export const BB_VERSION = '0.1.4';
+export const BB_VERSION = '0.2.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-blocks/bb-app-setting",
-  "version": "0.1.4",
+  "version": "0.2.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
@@ -39,8 +39,8 @@
     "test": "node --test --test-concurrency=1 dist/**/*.test.js"
   },
   "dependencies": {
-    "@aws-blocks/core": "^0.2.0",
-    "@aws-blocks/bb-logger": "^0.1.4",
+    "@aws-blocks/core": "^0.4.0",
+    "@aws-blocks/bb-logger": "^0.1.6",
     "@aws-sdk/client-ssm": "^3.0.0",
     "@standard-schema/spec": "^1.1.0"
   },

package/src/index.aws.test.ts

@@ -0,0 +1,59 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import assert from 'node:assert';
+import { describe, test, mock } from 'node:test';
+import { SSMClient } from '@aws-sdk/client-ssm';
+import { Scope } from '@aws-blocks/core';
+import { AppSetting } from './index.aws.js';
+
+const TEST_CMK = 'arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-1234567890ab';
+
+/** Capture the input of the next PutParameterCommand sent by the runtime. */
+function captureSend() {
+	const inputs: any[] = [];
+	const m = mock.method(SSMClient.prototype, 'send', async (cmd: any) => {
+		inputs.push(cmd.input);
+		return {};
+	});
+	return { inputs, restore: () => m.mock.restore() };
+}
+
+describe('AWS runtime put() KMS key', () => {
+	test('passes the CMK as KeyId when a secret is backed by kmsKeyArn', async () => {
+		const { inputs, restore } = captureSend();
+		try {
+			const setting = new AppSetting(new Scope('app'), 'cmk', { secret: true, kmsKeyArn: TEST_CMK });
+			await setting.put('rotated-value');
+			assert.strictEqual(inputs.length, 1);
+			assert.strictEqual(inputs[0].Type, 'SecureString');
+			assert.strictEqual(inputs[0].KeyId, TEST_CMK, 'overwrite must re-specify the CMK, not fall back to aws/ssm');
+		} finally {
+			restore();
+		}
+	});
+
+	test('omits KeyId for a default-key secret', async () => {
+		const { inputs, restore } = captureSend();
+		try {
+			const setting = new AppSetting(new Scope('app'), 'plain', { secret: true });
+			await setting.put('v');
+			assert.strictEqual(inputs[0].Type, 'SecureString');
+			assert.strictEqual(inputs[0].KeyId, undefined);
+		} finally {
+			restore();
+		}
+	});
+
+	test('omits KeyId for a non-secret String parameter', async () => {
+		const { inputs, restore } = captureSend();
+		try {
+			const setting = new AppSetting<string>(new Scope('app'), 'cfg', { value: 'init' });
+			await setting.put('next');
+			assert.strictEqual(inputs[0].Type, 'String');
+			assert.strictEqual(inputs[0].KeyId, undefined);
+		} finally {
+			restore();
+		}
+	});
+});

package/src/index.aws.ts

@@ -67,7 +67,7 @@ export class AppSetting<T = string> extends Scope {
 	static fromExisting<T = string>(
 		scope: ScopeParent,
 		id: string,
-		options: { name: string; secret?: boolean },
+		options: { name: string; secret?: boolean; kmsKeyArn?: string },
 	): AppSetting<T> {
 		const opts: InternalAppSettingOptions<T> = { ...options, external: true };
 		return new AppSetting<T>(scope, id, opts);
@@ -76,6 +76,7 @@ export class AppSetting<T = string> extends Scope {
 	readonly bbName = BB_NAME;
 	private schema?: StandardSchemaV1<T>;
 	private isSecret: boolean;
+	private kmsKeyArn?: string;
 	private client: SSMClient;
 
 	/** @internal Logger for internal operations. Defaults to error-level when not provided. */
@@ -88,6 +89,7 @@ export class AppSetting<T = string> extends Scope {
 		const parameterName = options.name ?? `/${this.fullId}`;
 		this.schema = options.schema;
 		this.isSecret = options.secret ?? false;
+		this.kmsKeyArn = options.kmsKeyArn;
 		this.client = new SSMClient({
 			customUserAgent: this.buildUserAgentChain(),
 		});
@@ -160,6 +162,9 @@ export class AppSetting<T = string> extends Scope {
 			Value: serialized,
 			Type: this.isSecret ? 'SecureString' : 'String',
 			Overwrite: true,
+			// Re-specify the CMK on overwrite: SSM falls back to the default aws/ssm
+			// key when KeyId is omitted, which would silently downgrade encryption.
+			...(this.isSecret && this.kmsKeyArn ? { KeyId: this.kmsKeyArn } : {}),
 		}));
 	}
 }

package/src/index.cdk.test.ts

@@ -12,31 +12,47 @@ import assert from 'node:assert';
 import * as cdk from 'aws-cdk-lib';
 import type { Construct } from 'constructs';
 import { Template, Match } from 'aws-cdk-lib/assertions';
-import { Scope, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import { Scope, DEFAULT_NODE_RUNTIME, BlocksPresets, type BlocksDefaults } from '@aws-blocks/core/cdk';
 import { AppSetting } from './index.cdk.js';
 
 class StubBlocksStack extends cdk.Stack {
 	public readonly handler: cdk.aws_lambda.Function;
+	public readonly executionRole: cdk.aws_iam.IRole;
 	public readonly id: string;
+	public defaults: BlocksDefaults = BlocksPresets.production;
 	constructor(scope: Construct, id: string) {
 		super(scope, id);
 		this.id = id;
 		(globalThis as any).CURRENT_BLOCKS_STACK = this;
+		this.executionRole = new cdk.aws_iam.Role(this, 'BlocksRole', {
+			assumedBy: new cdk.aws_iam.ServicePrincipal('lambda.amazonaws.com'),
+		});
 		this.handler = new cdk.aws_lambda.Function(this, 'StubHandler', {
 			runtime: DEFAULT_NODE_RUNTIME,
 			handler: 'index.handler',
 			code: cdk.aws_lambda.Code.fromInline('exports.handler = async () => {};'),
+			role: this.executionRole,
 		});
 	}
 }
 
-function setup(): { stack: StubBlocksStack; parent: Scope } {
+function setup(defaults: BlocksDefaults = BlocksPresets.production, stackId = 'TestStack'): { stack: StubBlocksStack; parent: Scope } {
 	const app = new cdk.App();
-	const stack = new StubBlocksStack(app, 'TestStack');
+	const stack = new StubBlocksStack(app, stackId);
+	stack.defaults = defaults;
 	const parent = new Scope('app');
 	return { stack, parent };
 }
 
+test('CDK: the secret-init Lambda log group adopts defaults.logRetention', () => {
+	const { stack, parent } = setup(BlocksPresets.sandbox, 'SecretRetentionStack');
+	new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });
+	const template = Template.fromStack(stack);
+	// The secret-init Lambda now owns an explicit log group whose retention
+	// follows the stack-wide default (sandbox → one week) instead of infinite.
+	template.hasResourceProperties('AWS::Logs::LogGroup', { RetentionInDays: 7 });
+});
+
 test('CDK: secret AppSetting SSM policy is scoped to specific parameter ARN (not wildcard)', () => {
 	const { stack, parent } = setup();
 	new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });
@@ -225,3 +241,120 @@ test('CDK: fromExisting still registers the runtime config key (BLOCKS_SSM_PARAM
 	);
 	assert.equal(registry.entries.get('BLOCKS_SSM_PARAM_DB_URL'), '/blocks/sandbox/db-abc-connection-string');
 });
+
+const TEST_CMK = 'arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-1234567890ab';
+
+test('CDK: secret with kmsKeyArn grants handler KMS on the specific CMK ARN (not a ViaService wildcard)', () => {
+	const { stack, parent } = setup();
+	new AppSetting(parent, 'cmk-secret', { secret: true, name: '/app/cmk-secret', kmsKeyArn: TEST_CMK });
+	const template = Template.fromStack(stack);
+	const policies = template.findResources('AWS::IAM::Policy');
+
+	let found = false;
+	for (const logicalId of Object.keys(policies)) {
+		const statements = policies[logicalId]?.Properties?.PolicyDocument?.Statement;
+		if (!Array.isArray(statements)) continue;
+		for (const stmt of statements) {
+			const actions = Array.isArray(stmt.Action) ? stmt.Action : [stmt.Action];
+			if (!actions.includes('kms:Decrypt')) continue;
+			// The CMK grant scopes to the exact key ARN and carries no ViaService condition.
+			const resStr = JSON.stringify(stmt.Resource);
+			if (resStr.includes(TEST_CMK)) {
+				found = true;
+				assert.ok(actions.includes('kms:Encrypt'), 'stack-managed CMK secret should grant kms:Encrypt');
+				// Standard-tier SecureStrings only use Encrypt/Decrypt — no GenerateDataKey.
+				assert.ok(
+					!actions.some((a: string) => a.startsWith('kms:GenerateDataKey')),
+					'CMK grant should not include kms:GenerateDataKey* (advanced-tier only)',
+				);
+				assert.strictEqual(stmt.Condition, undefined, 'CMK grant should not use a ViaService wildcard condition');
+			}
+		}
+	}
+	assert.ok(found, `Expected a handler KMS grant scoped to the CMK ARN ${TEST_CMK}`);
+});
+
+test('CDK: secret with kmsKeyArn passes the KeyId to the bulk secret custom resource', () => {
+	const { stack, parent } = setup();
+	new AppSetting(parent, 'cmk-secret', { secret: true, name: '/app/cmk-secret', kmsKeyArn: TEST_CMK });
+	const template = Template.fromStack(stack);
+
+	const crs = template.findResources('AWS::CloudFormation::CustomResource');
+	const bulk = Object.values(crs).find((r) => Array.isArray(r?.Properties?.Parameters));
+	assert.ok(bulk, 'Expected a bulk-secrets custom resource with a Parameters list');
+	const params = bulk.Properties.Parameters as Array<{ name: string; keyId?: string }>;
+	const entry = params.find((p) => p.name === '/app/cmk-secret');
+	assert.ok(entry, 'the secret should appear in the bulk Parameters');
+	assert.strictEqual(entry?.keyId, TEST_CMK, 'the CMK ARN must be passed through as keyId');
+});
+
+test('CDK: a default-key secret carries no keyId in the bulk Parameters', () => {
+	const { stack, parent } = setup();
+	new AppSetting(parent, 'plain-secret', { secret: true, name: '/app/plain-secret' });
+	const template = Template.fromStack(stack);
+	const crs = template.findResources('AWS::CloudFormation::CustomResource');
+	const bulk = Object.values(crs).find((r) => Array.isArray(r?.Properties?.Parameters));
+	const params = bulk?.Properties?.Parameters as Array<{ name: string; keyId?: string }>;
+	const entry = params.find((p) => p.name === '/app/plain-secret');
+	assert.ok(entry, 'the secret should appear in the bulk Parameters');
+	assert.strictEqual(entry?.keyId, undefined, 'a default-key secret must not set keyId');
+});
+
+test('CDK: kmsKeyArn without secret throws ValidationFailed', () => {
+	const { parent } = setup();
+	assert.throws(
+		() => new AppSetting(parent, 'bad', { value: 'x', name: '/app/bad', kmsKeyArn: TEST_CMK }),
+		/only valid with 'secret: true'/,
+	);
+});
+
+test('CDK: fromExisting with kmsKeyArn grants read-only KMS scoped to the CMK ARN (Decrypt, no Encrypt)', () => {
+	const { stack, parent } = setup();
+	AppSetting.fromExisting(parent, 'ext-cmk', { name: '/ext/cmk-secret', secret: true, kmsKeyArn: TEST_CMK });
+	const template = Template.fromStack(stack);
+	const policies = template.findResources('AWS::IAM::Policy');
+
+	let found = false;
+	for (const logicalId of Object.keys(policies)) {
+		const statements = policies[logicalId]?.Properties?.PolicyDocument?.Statement;
+		if (!Array.isArray(statements)) continue;
+		for (const stmt of statements) {
+			const actions = Array.isArray(stmt.Action) ? stmt.Action : [stmt.Action];
+			if (JSON.stringify(stmt.Resource).includes(TEST_CMK) && actions.includes('kms:Decrypt')) {
+				found = true;
+				assert.ok(!actions.includes('kms:Encrypt'), 'external (read-only) CMK secret must not grant kms:Encrypt');
+			}
+		}
+	}
+	assert.ok(found, 'external CMK secret should grant kms:Decrypt scoped to the CMK ARN');
+});
+
+test('CDK: bulk-init role can read + re-key secrets (ssm:GetParameter + kms:Encrypt/Decrypt), no GenerateDataKey', () => {
+	// The re-encrypt-on-key-change path reads the current value (GetParameter +
+	// Decrypt) and rewrites it under the new key (Encrypt). The bulk-init statement
+	// is uniquely identified by ssm:AddTagsToResource.
+	const { stack, parent } = setup();
+	new AppSetting(parent, 'cmk-secret', { secret: true, name: '/app/cmk-secret', kmsKeyArn: TEST_CMK });
+	const template = Template.fromStack(stack);
+	const policies = template.findResources('AWS::IAM::Policy');
+
+	let bulkSsm: string[] | undefined;
+	let bulkKms: string[] | undefined;
+	for (const logicalId of Object.keys(policies)) {
+		const statements = policies[logicalId]?.Properties?.PolicyDocument?.Statement;
+		if (!Array.isArray(statements)) continue;
+		for (const stmt of statements) {
+			const actions: string[] = Array.isArray(stmt.Action) ? stmt.Action : [stmt.Action];
+			if (actions.includes('ssm:AddTagsToResource')) bulkSsm = actions;
+			if (actions.includes('kms:Encrypt') && stmt.Condition?.StringEquals?.['kms:ViaService']) bulkKms = actions;
+		}
+	}
+	assert.ok(bulkSsm, 'expected the bulk-init ssm statement (identified by AddTagsToResource)');
+	assert.ok(bulkSsm?.includes('ssm:GetParameter'), 'bulk-init needs ssm:GetParameter to read a value when re-keying');
+	assert.ok(bulkKms, 'expected the bulk-init KMS statement (ViaService-scoped)');
+	assert.ok(bulkKms?.includes('kms:Decrypt'), 'bulk-init needs kms:Decrypt to read the current value when re-keying');
+	assert.ok(
+		!bulkKms?.some((a) => a.startsWith('kms:GenerateDataKey')),
+		'no GenerateDataKey* — standard-tier SecureStrings do not use it',
+	);
+});