@aws-blocks/bb-app-setting 0.2.0 → 0.2.1

package/dist/index.cdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAwC,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;gBAKJ,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAyJzE"}
+{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,EAAwC,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;gBAKJ,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAyJzE"}

package/dist/index.cdk.js

@@ -4,6 +4,7 @@ import * as cdk from 'aws-cdk-lib';
 import * as ssm from 'aws-cdk-lib/aws-ssm';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
+import { LogGroup } from 'aws-cdk-lib/aws-logs';
 import * as cr from 'aws-cdk-lib/custom-resources';
 import { Scope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
 import { AppSettingErrors } from './errors.js';
@@ -112,7 +113,7 @@ export class AppSetting extends Scope {
             // then fail tagging it (AddTagsToResource needs ssm:GetParameters).
             // We only need runtime read access, granted below.
             if (!external) {
-                registerSecret(cdk.Stack.of(this), parameterName, options.kmsKeyArn);
+                registerSecret(cdk.Stack.of(this), parameterName, this.defaults.logRetention, options.kmsKeyArn);
             }
             // Grant the handler KMS access. External secrets are read-only (Decrypt
             // only); stack-managed secrets also need Encrypt so the app can write the
@@ -171,7 +172,7 @@ const SECRET_BULK_KEY = Symbol.for('BLOCKS_SECRET_BULK_INIT');
  * All subsequent calls just append to the parameter list (resolved lazily at
  * synth time).
  */
-function registerSecret(stack, parameterName, keyId) {
+function registerSecret(stack, parameterName, logRetention, keyId) {
     let state = stack[SECRET_BULK_KEY];
     if (state) {
         state.params.push({ name: parameterName, keyId });
@@ -183,6 +184,12 @@ function registerSecret(stack, parameterName, keyId) {
     const secretInitFn = new lambda.Function(stack, 'BlocksSecretInitFn', {
         runtime: DEFAULT_NODE_RUNTIME,
         handler: 'index.handler',
+        // Own the log group so its retention follows the stack-wide default
+        // instead of AWS's infinite retention.
+        logGroup: new LogGroup(stack, 'BlocksSecretInitLogs', {
+            retention: logRetention,
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+        }),
         code: lambda.Code.fromInline(`
 				const { SSMClient, GetParameterCommand, PutParameterCommand, DeleteParameterCommand, AddTagsToResourceCommand } = require('@aws-sdk/client-ssm');
 				const crypto = require('crypto');

package/dist/index.cdk.test.js

@@ -10,12 +10,13 @@ import { test } from 'node:test';
 import assert from 'node:assert';
 import * as cdk from 'aws-cdk-lib';
 import { Template, Match } from 'aws-cdk-lib/assertions';
-import { Scope, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import { Scope, DEFAULT_NODE_RUNTIME, BlocksPresets } from '@aws-blocks/core/cdk';
 import { AppSetting } from './index.cdk.js';
 class StubBlocksStack extends cdk.Stack {
     handler;
     executionRole;
     id;
+    defaults = BlocksPresets.production;
     constructor(scope, id) {
         super(scope, id);
         this.id = id;
@@ -31,12 +32,21 @@ class StubBlocksStack extends cdk.Stack {
         });
     }
 }
-function setup() {
+function setup(defaults = BlocksPresets.production, stackId = 'TestStack') {
     const app = new cdk.App();
-    const stack = new StubBlocksStack(app, 'TestStack');
+    const stack = new StubBlocksStack(app, stackId);
+    stack.defaults = defaults;
     const parent = new Scope('app');
     return { stack, parent };
 }
+test('CDK: the secret-init Lambda log group adopts defaults.logRetention', () => {
+    const { stack, parent } = setup(BlocksPresets.sandbox, 'SecretRetentionStack');
+    new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });
+    const template = Template.fromStack(stack);
+    // The secret-init Lambda now owns an explicit log group whose retention
+    // follows the stack-wide default (sandbox → one week) instead of infinite.
+    template.hasResourceProperties('AWS::Logs::LogGroup', { RetentionInDays: 7 });
+});
 test('CDK: secret AppSetting SSM policy is scoped to specific parameter ARN (not wildcard)', () => {
     const { stack, parent } = setup();
     new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const BB_NAME = "AppSetting";
-export declare const BB_VERSION = "0.2.0";
+export declare const BB_VERSION = "0.2.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'AppSetting';
-export const BB_VERSION = '0.2.0';
+export const BB_VERSION = '0.2.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-blocks/bb-app-setting",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
@@ -39,8 +39,8 @@
     "test": "node --test --test-concurrency=1 dist/**/*.test.js"
   },
   "dependencies": {
-    "@aws-blocks/core": "^0.3.0",
-    "@aws-blocks/bb-logger": "^0.1.5",
+    "@aws-blocks/core": "^0.4.0",
+    "@aws-blocks/bb-logger": "^0.1.6",
     "@aws-sdk/client-ssm": "^3.0.0",
     "@standard-schema/spec": "^1.1.0"
   },

package/src/index.cdk.test.ts

@@ -12,13 +12,14 @@ import assert from 'node:assert';
 import * as cdk from 'aws-cdk-lib';
 import type { Construct } from 'constructs';
 import { Template, Match } from 'aws-cdk-lib/assertions';
-import { Scope, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import { Scope, DEFAULT_NODE_RUNTIME, BlocksPresets, type BlocksDefaults } from '@aws-blocks/core/cdk';
 import { AppSetting } from './index.cdk.js';
 
 class StubBlocksStack extends cdk.Stack {
 	public readonly handler: cdk.aws_lambda.Function;
 	public readonly executionRole: cdk.aws_iam.IRole;
 	public readonly id: string;
+	public defaults: BlocksDefaults = BlocksPresets.production;
 	constructor(scope: Construct, id: string) {
 		super(scope, id);
 		this.id = id;
@@ -35,13 +36,23 @@ class StubBlocksStack extends cdk.Stack {
 	}
 }
 
-function setup(): { stack: StubBlocksStack; parent: Scope } {
+function setup(defaults: BlocksDefaults = BlocksPresets.production, stackId = 'TestStack'): { stack: StubBlocksStack; parent: Scope } {
 	const app = new cdk.App();
-	const stack = new StubBlocksStack(app, 'TestStack');
+	const stack = new StubBlocksStack(app, stackId);
+	stack.defaults = defaults;
 	const parent = new Scope('app');
 	return { stack, parent };
 }
 
+test('CDK: the secret-init Lambda log group adopts defaults.logRetention', () => {
+	const { stack, parent } = setup(BlocksPresets.sandbox, 'SecretRetentionStack');
+	new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });
+	const template = Template.fromStack(stack);
+	// The secret-init Lambda now owns an explicit log group whose retention
+	// follows the stack-wide default (sandbox → one week) instead of infinite.
+	template.hasResourceProperties('AWS::Logs::LogGroup', { RetentionInDays: 7 });
+});
+
 test('CDK: secret AppSetting SSM policy is scoped to specific parameter ARN (not wildcard)', () => {
 	const { stack, parent } = setup();
 	new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });

package/src/index.cdk.ts

@@ -5,6 +5,7 @@ import * as cdk from 'aws-cdk-lib';
 import * as ssm from 'aws-cdk-lib/aws-ssm';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
+import { LogGroup, type RetentionDays } from 'aws-cdk-lib/aws-logs';
 import * as cr from 'aws-cdk-lib/custom-resources';
 import { Scope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
 import type { ScopeParent } from '@aws-blocks/core';
@@ -151,7 +152,7 @@ export class AppSetting<T = string> extends Scope {
 			// then fail tagging it (AddTagsToResource needs ssm:GetParameters).
 			// We only need runtime read access, granted below.
 			if (!external) {
-				registerSecret(cdk.Stack.of(this), parameterName, options.kmsKeyArn);
+				registerSecret(cdk.Stack.of(this), parameterName, this.defaults.logRetention, options.kmsKeyArn);
 			}
 
 			// Grant the handler KMS access. External secrets are read-only (Decrypt
@@ -223,7 +224,7 @@ interface SecretBulkState {
  * All subsequent calls just append to the parameter list (resolved lazily at
  * synth time).
  */
-function registerSecret(stack: cdk.Stack, parameterName: string, keyId?: string): void {
+function registerSecret(stack: cdk.Stack, parameterName: string, logRetention: RetentionDays, keyId?: string): void {
 	let state = (stack as any)[SECRET_BULK_KEY] as SecretBulkState | undefined;
 	if (state) {
 		state.params.push({ name: parameterName, keyId });
@@ -237,6 +238,12 @@ function registerSecret(stack: cdk.Stack, parameterName: string, keyId?: string)
 	const secretInitFn = new lambda.Function(stack, 'BlocksSecretInitFn', {
 		runtime: DEFAULT_NODE_RUNTIME,
 		handler: 'index.handler',
+		// Own the log group so its retention follows the stack-wide default
+		// instead of AWS's infinite retention.
+		logGroup: new LogGroup(stack, 'BlocksSecretInitLogs', {
+			retention: logRetention,
+			removalPolicy: cdk.RemovalPolicy.DESTROY,
+		}),
 		code: lambda.Code.fromInline(`
 				const { SSMClient, GetParameterCommand, PutParameterCommand, DeleteParameterCommand, AddTagsToResourceCommand } = require('@aws-sdk/client-ssm');
 				const crypto = require('crypto');

package/src/version.ts

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'AppSetting';
-export const BB_VERSION = '0.2.0';
+export const BB_VERSION = '0.2.1';