@aws-blocks/bb-app-setting 0.2.0 → 0.3.0

package/dist/index.aws.d.ts

@@ -4,6 +4,7 @@ import type { AppSettingOptions } from './types.js';
 import type { ChildLogger } from '@aws-blocks/bb-logger';
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 /**
  * A single application configuration value backed by SSM Parameter Store.
  *

package/dist/index.aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.aws.d.ts","sourceRoot":"","sources":["../src/index.aws.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAA6C,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAG/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAqBpD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;OAMG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;IAKhB,QAAQ,CAAC,MAAM,gBAAW;IAC1B,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAC1B,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAY;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAczE;;;;;;;;;;;;;OAaG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IA2BvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}
+{"version":3,"file":"index.aws.d.ts","sourceRoot":"","sources":["../src/index.aws.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAA6C,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAG/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAqB9D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;OAMG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;IAKhB,QAAQ,CAAC,MAAM,gBAAW;IAC1B,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAC1B,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAY;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAczE;;;;;;;;;;;;;OAaG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IA2BvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/index.aws.js

@@ -7,6 +7,7 @@ import { BB_NAME, BB_VERSION } from './version.js';
 import { Logger } from '@aws-blocks/bb-logger';
 // Re-export public types from types module (canonical source)
 export { AppSettingErrors } from './errors.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 // ── Helpers ─────────────────────────────────────────────────────────────────
 function blocksError(name, message) {
     const err = new Error(`${name}: ${message}`);

package/dist/index.browser.d.ts

@@ -1,3 +1,4 @@
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 export declare class AppSetting {
     static fromExisting(...args: any[]): any;
     constructor(...args: any[]);

package/dist/index.browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAIA,qBAAa,UAAU;IACtB,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG;gBAG5B,GAAG,IAAI,EAAE,GAAG,EAAE;CAC1B"}
+{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,qBAAa,UAAU;IACtB,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG;gBAG5B,GAAG,IAAI,EAAE,GAAG,EAAE;CAC1B"}

package/dist/index.browser.js

@@ -1,6 +1,7 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 // Browser stub - AppSetting runs server-side only
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 export class AppSetting {
     static fromExisting(...args) {
         return new AppSetting();

package/dist/index.cdk.d.ts

@@ -1,8 +1,9 @@
-import { Scope } from '@aws-blocks/core/cdk';
+import { BuildingBlockScope } from '@aws-blocks/core/cdk';
 import type { ScopeParent } from '@aws-blocks/core';
 import type { AppSettingOptions } from './types.js';
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 /**
  * CDK construct for AppSetting. Creates a single SSM parameter (String or
  * SecureString) and grants the shared Lambda handler read/write permissions.
@@ -14,7 +15,7 @@ export type { AppSettingOptions } from './types.js';
  *   or with a customer-managed key when `kmsKeyArn` is provided (the handler is
  *   then granted `kms:Decrypt`/`Encrypt` on that specific key ARN).
  */
-export declare class AppSetting<T = string> extends Scope {
+export declare class AppSetting<T = string> extends BuildingBlockScope {
     /**
      * Reference an SSM parameter that is created and owned **outside this stack**
      * (e.g. a connection string seeded by `ensureSecrets` before deploy). The

package/dist/index.cdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAwC,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;gBAKJ,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAyJzE"}
+{"version":3,"file":"index.cdk.d.ts","sourceRoot":"","sources":["../src/index.cdk.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,kBAAkB,EAAwC,MAAM,sBAAsB,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAI9D;;;;;;;;;;GAUG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,kBAAkB;IAC7D;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;gBAKJ,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAyJzE"}

package/dist/index.cdk.js

@@ -4,10 +4,14 @@ import * as cdk from 'aws-cdk-lib';
 import * as ssm from 'aws-cdk-lib/aws-ssm';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
+import { LogGroup } from 'aws-cdk-lib/aws-logs';
 import * as cr from 'aws-cdk-lib/custom-resources';
-import { Scope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import { BuildingBlockScope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
 import { AppSettingErrors } from './errors.js';
 export { AppSettingErrors } from './errors.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
+import { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 /**
  * CDK construct for AppSetting. Creates a single SSM parameter (String or
  * SecureString) and grants the shared Lambda handler read/write permissions.
@@ -19,7 +23,7 @@ export { AppSettingErrors } from './errors.js';
  *   or with a customer-managed key when `kmsKeyArn` is provided (the handler is
  *   then granted `kms:Decrypt`/`Encrypt` on that specific key ARN).
  */
-export class AppSetting extends Scope {
+export class AppSetting extends BuildingBlockScope {
     /**
      * Reference an SSM parameter that is created and owned **outside this stack**
      * (e.g. a connection string seeded by `ensureSecrets` before deploy). The
@@ -38,7 +42,7 @@ export class AppSetting extends Scope {
         return new AppSetting(scope, id, opts);
     }
     constructor(scope, id, options) {
-        super(id, { parent: scope });
+        super(id, { parent: scope, vpc: { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SSM] } });
         // `external` is package-internal (set only by fromExisting), not on the
         // public AppSettingOptions — read it via the internal options type.
         const external = options.external ?? false;
@@ -112,7 +116,7 @@ export class AppSetting extends Scope {
             // then fail tagging it (AddTagsToResource needs ssm:GetParameters).
             // We only need runtime read access, granted below.
             if (!external) {
-                registerSecret(cdk.Stack.of(this), parameterName, options.kmsKeyArn);
+                registerSecret(cdk.Stack.of(this), parameterName, this.defaults.logRetention, options.kmsKeyArn);
             }
             // Grant the handler KMS access. External secrets are read-only (Decrypt
             // only); stack-managed secrets also need Encrypt so the app can write the
@@ -171,7 +175,7 @@ const SECRET_BULK_KEY = Symbol.for('BLOCKS_SECRET_BULK_INIT');
  * All subsequent calls just append to the parameter list (resolved lazily at
  * synth time).
  */
-function registerSecret(stack, parameterName, keyId) {
+function registerSecret(stack, parameterName, logRetention, keyId) {
     let state = stack[SECRET_BULK_KEY];
     if (state) {
         state.params.push({ name: parameterName, keyId });
@@ -183,6 +187,12 @@ function registerSecret(stack, parameterName, keyId) {
     const secretInitFn = new lambda.Function(stack, 'BlocksSecretInitFn', {
         runtime: DEFAULT_NODE_RUNTIME,
         handler: 'index.handler',
+        // Own the log group so its retention follows the stack-wide default
+        // instead of AWS's infinite retention.
+        logGroup: new LogGroup(stack, 'BlocksSecretInitLogs', {
+            retention: logRetention,
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+        }),
         code: lambda.Code.fromInline(`
 				const { SSMClient, GetParameterCommand, PutParameterCommand, DeleteParameterCommand, AddTagsToResourceCommand } = require('@aws-sdk/client-ssm');
 				const crypto = require('crypto');
@@ -280,7 +290,7 @@ function registerSecret(stack, parameterName, keyId) {
     const provider = new cr.Provider(stack, 'BlocksSecretProvider', {
         onEventHandler: secretInitFn,
     });
-    new cdk.CustomResource(stack, 'BlocksSecretsBulk', {
+    new cdk.CustomResource(stack, SECRETS_BULK_CONSTRUCT_ID, {
         serviceToken: provider.serviceToken,
         properties: {
             Parameters: cdk.Lazy.any({ produce: () => state.params }),

package/dist/index.cdk.test.js

@@ -10,12 +10,13 @@ import { test } from 'node:test';
 import assert from 'node:assert';
 import * as cdk from 'aws-cdk-lib';
 import { Template, Match } from 'aws-cdk-lib/assertions';
-import { Scope, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import { Scope, DEFAULT_NODE_RUNTIME, BlocksPresets } from '@aws-blocks/core/cdk';
 import { AppSetting } from './index.cdk.js';
 class StubBlocksStack extends cdk.Stack {
     handler;
     executionRole;
     id;
+    defaults = BlocksPresets.production;
     constructor(scope, id) {
         super(scope, id);
         this.id = id;
@@ -31,12 +32,21 @@ class StubBlocksStack extends cdk.Stack {
         });
     }
 }
-function setup() {
+function setup(defaults = BlocksPresets.production, stackId = 'TestStack') {
     const app = new cdk.App();
-    const stack = new StubBlocksStack(app, 'TestStack');
+    const stack = new StubBlocksStack(app, stackId);
+    stack.defaults = defaults;
     const parent = new Scope('app');
     return { stack, parent };
 }
+test('CDK: the secret-init Lambda log group adopts defaults.logRetention', () => {
+    const { stack, parent } = setup(BlocksPresets.sandbox, 'SecretRetentionStack');
+    new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });
+    const template = Template.fromStack(stack);
+    // The secret-init Lambda now owns an explicit log group whose retention
+    // follows the stack-wide default (sandbox → one week) instead of infinite.
+    template.hasResourceProperties('AWS::Logs::LogGroup', { RetentionInDays: 7 });
+});
 test('CDK: secret AppSetting SSM policy is scoped to specific parameter ARN (not wildcard)', () => {
     const { stack, parent } = setup();
     new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });

package/dist/index.mock.d.ts

@@ -4,6 +4,7 @@ import type { AppSettingOptions } from './types.js';
 import type { ChildLogger } from '@aws-blocks/bb-logger';
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 /**
  * A single application configuration value backed by SSM Parameter Store.
  *

package/dist/index.mock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAsCpD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;IAKhB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAyBzE;;;;;;;;;;;OAWG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IAWvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}
+{"version":3,"file":"index.mock.d.ts","sourceRoot":"","sources":["../src/index.mock.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,OAAO,KAAK,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAsC9D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,UAAU,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,KAAK;IAChD;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,EAC7B,KAAK,EAAE,WAAW,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,UAAU,CAAC,CAAC,CAAC;IAKhB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,MAAM,CAAC,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAU;IAE1B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;gBAEf,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAyBzE;;;;;;;;;;;OAWG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IAWvB;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/index.mock.js

@@ -10,6 +10,7 @@ import { Logger } from '@aws-blocks/bb-logger';
 import { BB_NAME, BB_VERSION } from './version.js';
 // Re-export public types
 export { AppSettingErrors } from './errors.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 // ── Helpers ─────────────────────────────────────────────────────────────────
 const MAX_VALUE_BYTES = 4096; // SSM standard-tier 4 KB limit
 function readSettings(scope) {

package/dist/secrets-bulk.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Construct id of the shared, per-stack custom resource that writes every
+ * `secret: true` `AppSetting`'s SecureString value at deploy time (created
+ * lazily by the first secret AppSetting; a direct child of the stack).
+ *
+ * Exported so sibling blocks that must order a resource *after* the secret
+ * values are written — e.g. `bb-auth-oidc`'s IdP-registration custom resource —
+ * can locate it via `Stack.of(x).node.tryFindChild(SECRETS_BULK_CONSTRUCT_ID)`
+ * without hard-coding the string. This is the single source of truth for the id:
+ * the CDK layer creates the construct with it, so a rename here moves both the
+ * producer and every consumer together and the cross-package coupling can't
+ * drift silently.
+ */
+export declare const SECRETS_BULK_CONSTRUCT_ID = "BlocksSecretsBulk";
+//# sourceMappingURL=secrets-bulk.d.ts.map

package/dist/secrets-bulk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-bulk.d.ts","sourceRoot":"","sources":["../src/secrets-bulk.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,sBAAsB,CAAC"}

package/dist/secrets-bulk.js

@@ -0,0 +1,16 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Construct id of the shared, per-stack custom resource that writes every
+ * `secret: true` `AppSetting`'s SecureString value at deploy time (created
+ * lazily by the first secret AppSetting; a direct child of the stack).
+ *
+ * Exported so sibling blocks that must order a resource *after* the secret
+ * values are written — e.g. `bb-auth-oidc`'s IdP-registration custom resource —
+ * can locate it via `Stack.of(x).node.tryFindChild(SECRETS_BULK_CONSTRUCT_ID)`
+ * without hard-coding the string. This is the single source of truth for the id:
+ * the CDK layer creates the construct with it, so a rename here moves both the
+ * producer and every consumer together and the cross-package coupling can't
+ * drift silently.
+ */
+export const SECRETS_BULK_CONSTRUCT_ID = 'BlocksSecretsBulk';

package/dist/version.d.ts

@@ -1,3 +1,3 @@
 export declare const BB_NAME = "AppSetting";
-export declare const BB_VERSION = "0.2.0";
+export declare const BB_VERSION = "0.3.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'AppSetting';
-export const BB_VERSION = '0.2.0';
+export const BB_VERSION = '0.3.0';

package/package.json

@@ -1,6 +1,13 @@
 {
   "name": "@aws-blocks/bb-app-setting",
-  "version": "0.2.0",
+  "version": "0.3.0",
+  "keywords": [
+    "aws-blocks",
+    "configuration",
+    "ssm",
+    "parameter-store",
+    "secrets"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/aws-devtools-labs/aws-blocks.git",
@@ -39,8 +46,8 @@
     "test": "node --test --test-concurrency=1 dist/**/*.test.js"
   },
   "dependencies": {
-    "@aws-blocks/core": "^0.3.0",
-    "@aws-blocks/bb-logger": "^0.1.5",
+    "@aws-blocks/core": "^0.5.0",
+    "@aws-blocks/bb-logger": "^0.2.0",
     "@aws-sdk/client-ssm": "^3.0.0",
     "@standard-schema/spec": "^1.1.0"
   },

package/src/index.aws.ts

@@ -18,6 +18,7 @@ import type { ChildLogger } from '@aws-blocks/bb-logger';
 // Re-export public types from types module (canonical source)
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 

package/src/index.browser.ts

@@ -2,6 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Browser stub - AppSetting runs server-side only
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
+
 export class AppSetting {
 	static fromExisting(...args: any[]): any {
 		return new AppSetting();

package/src/index.cdk.test.ts

@@ -12,13 +12,14 @@ import assert from 'node:assert';
 import * as cdk from 'aws-cdk-lib';
 import type { Construct } from 'constructs';
 import { Template, Match } from 'aws-cdk-lib/assertions';
-import { Scope, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import { Scope, DEFAULT_NODE_RUNTIME, BlocksPresets, type BlocksDefaults } from '@aws-blocks/core/cdk';
 import { AppSetting } from './index.cdk.js';
 
 class StubBlocksStack extends cdk.Stack {
 	public readonly handler: cdk.aws_lambda.Function;
 	public readonly executionRole: cdk.aws_iam.IRole;
 	public readonly id: string;
+	public defaults: BlocksDefaults = BlocksPresets.production;
 	constructor(scope: Construct, id: string) {
 		super(scope, id);
 		this.id = id;
@@ -35,13 +36,23 @@ class StubBlocksStack extends cdk.Stack {
 	}
 }
 
-function setup(): { stack: StubBlocksStack; parent: Scope } {
+function setup(defaults: BlocksDefaults = BlocksPresets.production, stackId = 'TestStack'): { stack: StubBlocksStack; parent: Scope } {
 	const app = new cdk.App();
-	const stack = new StubBlocksStack(app, 'TestStack');
+	const stack = new StubBlocksStack(app, stackId);
+	stack.defaults = defaults;
 	const parent = new Scope('app');
 	return { stack, parent };
 }
 
+test('CDK: the secret-init Lambda log group adopts defaults.logRetention', () => {
+	const { stack, parent } = setup(BlocksPresets.sandbox, 'SecretRetentionStack');
+	new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });
+	const template = Template.fromStack(stack);
+	// The secret-init Lambda now owns an explicit log group whose retention
+	// follows the stack-wide default (sandbox → one week) instead of infinite.
+	template.hasResourceProperties('AWS::Logs::LogGroup', { RetentionInDays: 7 });
+});
+
 test('CDK: secret AppSetting SSM policy is scoped to specific parameter ARN (not wildcard)', () => {
 	const { stack, parent } = setup();
 	new AppSetting(parent, 'my-secret', { secret: true, name: '/myapp/secret-key' });

package/src/index.cdk.ts

@@ -5,14 +5,19 @@ import * as cdk from 'aws-cdk-lib';
 import * as ssm from 'aws-cdk-lib/aws-ssm';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
+import { LogGroup, type RetentionDays } from 'aws-cdk-lib/aws-logs';
 import * as cr from 'aws-cdk-lib/custom-resources';
-import { Scope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import { BuildingBlockScope, registerConfig, DEFAULT_NODE_RUNTIME } from '@aws-blocks/core/cdk';
 import type { ScopeParent } from '@aws-blocks/core';
 import { AppSettingErrors } from './errors.js';
 import type { AppSettingOptions, InternalAppSettingOptions } from './types.js';
 
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
+
+import { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 
 /**
  * CDK construct for AppSetting. Creates a single SSM parameter (String or
@@ -25,7 +30,7 @@ export type { AppSettingOptions } from './types.js';
  *   or with a customer-managed key when `kmsKeyArn` is provided (the handler is
  *   then granted `kms:Decrypt`/`Encrypt` on that specific key ARN).
  */
-export class AppSetting<T = string> extends Scope {
+export class AppSetting<T = string> extends BuildingBlockScope {
 	/**
 	 * Reference an SSM parameter that is created and owned **outside this stack**
 	 * (e.g. a connection string seeded by `ensureSecrets` before deploy). The
@@ -49,7 +54,7 @@ export class AppSetting<T = string> extends Scope {
 	}
 
 	constructor(scope: ScopeParent, id: string, options: AppSettingOptions<T>) {
-		super(id, { parent: scope });
+		super(id, { parent: scope, vpc: { interfaceEndpoints: [ec2.InterfaceVpcEndpointAwsService.SSM] } });
 
 		// `external` is package-internal (set only by fromExisting), not on the
 		// public AppSettingOptions — read it via the internal options type.
@@ -151,7 +156,7 @@ export class AppSetting<T = string> extends Scope {
 			// then fail tagging it (AddTagsToResource needs ssm:GetParameters).
 			// We only need runtime read access, granted below.
 			if (!external) {
-				registerSecret(cdk.Stack.of(this), parameterName, options.kmsKeyArn);
+				registerSecret(cdk.Stack.of(this), parameterName, this.defaults.logRetention, options.kmsKeyArn);
 			}
 
 			// Grant the handler KMS access. External secrets are read-only (Decrypt
@@ -223,7 +228,7 @@ interface SecretBulkState {
  * All subsequent calls just append to the parameter list (resolved lazily at
  * synth time).
  */
-function registerSecret(stack: cdk.Stack, parameterName: string, keyId?: string): void {
+function registerSecret(stack: cdk.Stack, parameterName: string, logRetention: RetentionDays, keyId?: string): void {
 	let state = (stack as any)[SECRET_BULK_KEY] as SecretBulkState | undefined;
 	if (state) {
 		state.params.push({ name: parameterName, keyId });
@@ -237,6 +242,12 @@ function registerSecret(stack: cdk.Stack, parameterName: string, keyId?: string)
 	const secretInitFn = new lambda.Function(stack, 'BlocksSecretInitFn', {
 		runtime: DEFAULT_NODE_RUNTIME,
 		handler: 'index.handler',
+		// Own the log group so its retention follows the stack-wide default
+		// instead of AWS's infinite retention.
+		logGroup: new LogGroup(stack, 'BlocksSecretInitLogs', {
+			retention: logRetention,
+			removalPolicy: cdk.RemovalPolicy.DESTROY,
+		}),
 		code: lambda.Code.fromInline(`
 				const { SSMClient, GetParameterCommand, PutParameterCommand, DeleteParameterCommand, AddTagsToResourceCommand } = require('@aws-sdk/client-ssm');
 				const crypto = require('crypto');
@@ -340,7 +351,7 @@ function registerSecret(stack: cdk.Stack, parameterName: string, keyId?: string)
 		onEventHandler: secretInitFn,
 	});
 
-	new cdk.CustomResource(stack, 'BlocksSecretsBulk', {
+	new cdk.CustomResource(stack, SECRETS_BULK_CONSTRUCT_ID, {
 		serviceToken: provider.serviceToken,
 		properties: {
 			Parameters: cdk.Lazy.any({ produce: () => state!.params }),

package/src/index.mock.ts

@@ -17,6 +17,7 @@ import { BB_NAME, BB_VERSION } from './version.js';
 // Re-export public types
 export { AppSettingErrors } from './errors.js';
 export type { AppSettingOptions } from './types.js';
+export { SECRETS_BULK_CONSTRUCT_ID } from './secrets-bulk.js';
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 

package/src/secrets-bulk.ts

@@ -0,0 +1,17 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Construct id of the shared, per-stack custom resource that writes every
+ * `secret: true` `AppSetting`'s SecureString value at deploy time (created
+ * lazily by the first secret AppSetting; a direct child of the stack).
+ *
+ * Exported so sibling blocks that must order a resource *after* the secret
+ * values are written — e.g. `bb-auth-oidc`'s IdP-registration custom resource —
+ * can locate it via `Stack.of(x).node.tryFindChild(SECRETS_BULK_CONSTRUCT_ID)`
+ * without hard-coding the string. This is the single source of truth for the id:
+ * the CDK layer creates the construct with it, so a rename here moves both the
+ * producer and every consumer together and the cross-package coupling can't
+ * drift silently.
+ */
+export const SECRETS_BULK_CONSTRUCT_ID = 'BlocksSecretsBulk';

package/src/version.ts

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.mjs — do not edit manually
 export const BB_NAME = 'AppSetting';
-export const BB_VERSION = '0.2.0';
+export const BB_VERSION = '0.3.0';