@aws-mdaa/devops 1.2.0

package/bin/devops.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/*!
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/bin/devops.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+"use strict";
+/*!
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const devops_1 = require("../lib/devops");
+new devops_1.MdaaDevopsCDKApp().generateStack();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGV2b3BzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiZGV2b3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQ0E7OztHQUdHOztBQUVILDBDQUFpRDtBQUNqRCxJQUFJLHlCQUFnQixFQUFFLENBQUMsYUFBYSxFQUFFLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIjIS91c3IvYmluL2VudiBub2RlXG4vKiFcbiAqIENvcHlyaWdodCBBbWF6b24uY29tLCBJbmMuIG9yIGl0cyBhZmZpbGlhdGVzLiBBbGwgUmlnaHRzIFJlc2VydmVkLlxuICogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcbiAqL1xuXG5pbXBvcnQgeyBNZGFhRGV2b3BzQ0RLQXBwIH0gZnJvbSAnLi4vbGliL2Rldm9wcyc7XG5uZXcgTWRhYURldm9wc0NES0FwcCgpLmdlbmVyYXRlU3RhY2soKTtcbiJdfQ==

package/cdk.json

@@ -0,0 +1,7 @@
+{
+  "app": "npx ts-node --prefer-ts-exts bin/devops.ts",
+  "context": {
+    "aws-cdk:enableDiffNoFail": true,
+    "@aws-cdk/core:enablePartitionLiterals": true
+  }
+}

package/lib/config-schema.json

@@ -0,0 +1,431 @@
+{
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "additionalProperties": false,
+    "definitions": {
+        "CfnParameterProps": {
+            "additionalProperties": false,
+            "properties": {
+                "allowedPattern": {
+                    "default": "- No constraints on patterns allowed for parameter.",
+                    "description": "A regular expression that represents the patterns to allow for String types.",
+                    "type": "string"
+                },
+                "allowedValues": {
+                    "default": "- No constraints on values allowed for parameter.",
+                    "description": "An array containing the list of values allowed for the parameter.",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "constraintDescription": {
+                    "default": "- No description with customized error message when user specifies invalid values.",
+                    "description": "A string that explains a constraint when the constraint is violated.\nFor example, without a constraint description, a parameter that has an allowed\npattern of [A-Za-z0-9]+ displays the following error message when the user specifies\nan invalid value:",
+                    "type": "string"
+                },
+                "default": {
+                    "default": "- No default value for parameter.",
+                    "description": "A value of the appropriate type for the template to use if no value is specified\nwhen a stack is created. If you define constraints for the parameter, you must specify\na value that adheres to those constraints."
+                },
+                "description": {
+                    "default": "- No description for the parameter.",
+                    "description": "A string of up to 4000 characters that describes the parameter.",
+                    "type": "string"
+                },
+                "maxLength": {
+                    "default": "- None.",
+                    "description": "An integer value that determines the largest number of characters you want to allow for String types.",
+                    "type": "number"
+                },
+                "maxValue": {
+                    "default": "- None.",
+                    "description": "A numeric value that determines the largest numeric value you want to allow for Number types.",
+                    "type": "number"
+                },
+                "minLength": {
+                    "default": "- None.",
+                    "description": "An integer value that determines the smallest number of characters you want to allow for String types.",
+                    "type": "number"
+                },
+                "minValue": {
+                    "default": "- None.",
+                    "description": "A numeric value that determines the smallest numeric value you want to allow for Number types.",
+                    "type": "number"
+                },
+                "noEcho": {
+                    "default": "- Parameter values are not masked.",
+                    "description": "Whether to mask the parameter value when anyone makes a call that describes the stack.\nIf you set the value to ``true``, the parameter value is masked with asterisks (``*****``).",
+                    "type": "boolean"
+                },
+                "type": {
+                    "default": "String",
+                    "description": "The data type for the parameter (DataType).",
+                    "type": "string"
+                }
+            },
+            "type": "object"
+        },
+        "MdaaNagSuppressionByPath": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nConfiguration interface for suppressing specific CDK Nag security rules on individual CloudFormation resources identified by their resource path. Provides targeted rule suppression with mandatory justification for audit and compliance tracking.\n\nUse cases: Individual resource security exceptions; False positive rule suppressions; Documented compliance deviations\n\nAWS: Suppresses specific CDK Nag security rules for individual CloudFormation resources during deployment validation\n\nValidation: path must be valid CloudFormation resource path; suppressions array must contain valid rule IDs and justifications",
+            "properties": {
+                "path": {
+                    "description": "Q-ENHANCED-PROPERTY\nCloudFormation resource path identifying the specific resource for which CDK Nag rules should be suppressed. Uses CDK construct tree path format to precisely target individual resources within the deployment stack.\n\nUse cases: Specific resource targeting; Individual resource exceptions; Precise suppression scope control\n\nAWS: CloudFormation resource path for targeted CDK Nag rule suppression during validation\n\nValidation: Must be valid CDK construct tree path format (e.g., /StackName/ConstructName/ResourceName)",
+                    "type": "string"
+                },
+                "suppressions": {
+                    "description": "Q-ENHANCED-PROPERTY\nArray of specific CDK Nag rule suppressions with rule IDs and mandatory justifications for audit compliance. Each suppression must include the rule identifier and business justification for the security exception.\n\nUse cases: Multiple rule suppressions per resource; Documented security exceptions; Audit trail maintenance\n\nAWS: CDK Nag rule ID suppression with justification tracking for compliance auditing\n\nValidation: Each suppression must have valid CDK Nag rule ID and non-empty reason string\n  *",
+                    "items": {
+                        "additionalProperties": false,
+                        "properties": {
+                            "id": {
+                                "type": "string"
+                            },
+                            "reason": {
+                                "type": "string"
+                            }
+                        },
+                        "required": [
+                            "id",
+                            "reason"
+                        ],
+                        "type": "object"
+                    },
+                    "type": "array"
+                }
+            },
+            "required": [
+                "path",
+                "suppressions"
+            ],
+            "type": "object"
+        },
+        "MdaaNagSuppressionConfigs": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nConfiguration interface for CDK Nag rule suppressions organized by CloudFormation resource paths. Enables selective suppression of security compliance rules for specific resources while maintaining overall compliance posture and audit trail.\n\nUse cases: False positive suppression; Approved security exceptions; Legacy resource compliance exemptions\n\nAWS: Suppresses CDK Nag security rule violations for specific CloudFormation resources during deployment validation\n\nValidation: by_path array must contain valid suppression configurations with resource paths and justifications",
+            "properties": {
+                "by_path": {
+                    "description": "Q-ENHANCED-PROPERTY\nArray of CDK Nag suppressions organized by CloudFormation resource path, enabling targeted suppression of specific security rules for individual resources. Each suppression requires justification and maps to specific CloudFormation resource paths.\n\nUse cases: Resource-specific security exceptions; False positive rule suppressions; Approved compliance deviations\n\nAWS: CDK Nag rule suppression targeting specific CloudFormation resources during security validation\n\nValidation: Must be array of valid MdaaNagSuppressionByPath objects with valid resource paths and suppression details\n  *",
+                    "items": {
+                        "$ref": "#/definitions/MdaaNagSuppressionByPath"
+                    },
+                    "type": "array"
+                }
+            },
+            "required": [
+                "by_path"
+            ],
+            "type": "object"
+        },
+        "MdaaServiceCatalogConstraintConfig": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nConfiguration interface for AWS Service Catalog constraints that group multiple validation rules with descriptive information. Enables parameter validation and business rule enforcement for Service Catalog products.\n\nUse cases: Product parameter validation; Business rule grouping; Service Catalog compliance enforcement\n\nAWS: Configures AWS Service Catalog constraints with multiple validation rules for product provisioning\n\nValidation: description must be non-empty; rules must be object with valid constraint rule configurations",
+            "properties": {
+                "description": {
+                    "description": "Q-ENHANCED-PROPERTY\nHuman-readable description explaining the purpose and scope of the Service Catalog constraint. Provides clear documentation about the validation rules and business requirements enforced by the constraint.\n\nUse cases: Constraint documentation; User guidance; Business rule explanation\n\nAWS: AWS Service Catalog constraint description for user understanding\n\nValidation: Must be non-empty descriptive text explaining the constraint purpose and scope",
+                    "type": "string"
+                },
+                "rules": {
+                    "additionalProperties": {
+                        "$ref": "#/definitions/MdaaServiceCatalogConstraintRuleConfig"
+                    },
+                    "description": "Q-ENHANCED-PROPERTY\nObject containing named constraint rules that define the validation logic for Service Catalog product parameters. Each rule can contain conditions and assertions for parameter validation.\n\nUse cases: Named validation rules; Organized constraint logic; Multiple validation scenarios\n\nAWS: AWS Service Catalog constraint rules for structured parameter validation\n\nValidation: Must be object with string keys and valid MdaaServiceCatalogConstraintRuleConfig values\n  *",
+                    "type": "object"
+                }
+            },
+            "required": [
+                "description",
+                "rules"
+            ],
+            "type": "object"
+        },
+        "MdaaServiceCatalogConstraintRuleAssertionConfig": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nConfiguration interface for AWS Service Catalog constraint rule assertions that define validation logic for Service Catalog product parameters. Enables parameter validation and business rule enforcement during Service Catalog product provisioning.\n\nUse cases: Parameter validation rules; Business logic enforcement; Service Catalog product compliance\n\nAWS: Configures AWS Service Catalog constraint rules for product parameter validation during provisioning\n\nValidation: assert must be valid constraint assertion expression; description must be non-empty explanatory text",
+            "properties": {
+                "assert": {
+                    "description": "Q-ENHANCED-PROPERTY\nConstraint assertion expression that defines the validation logic for Service Catalog product parameters. Uses CloudFormation intrinsic functions and conditions to validate parameter values during product provisioning.\n\nUse cases: Parameter range validation; Cross-parameter dependency checks; Business rule enforcement\n\nAWS: AWS Service Catalog constraint rule assertion for parameter validation\n\nValidation: Must be valid CloudFormation condition expression using intrinsic functions",
+                    "type": "string"
+                },
+                "description": {
+                    "description": "Q-ENHANCED-PROPERTY\nHuman-readable description explaining the purpose and requirements of the constraint assertion. Provides clear guidance to users about parameter validation requirements and business rules.\n\nUse cases: User guidance for parameter validation; Error message context; Business rule documentation\n\nAWS: AWS Service Catalog constraint rule description for user guidance\n\nValidation: Must be non-empty descriptive text explaining the constraint purpose",
+                    "type": "string"
+                }
+            },
+            "required": [
+                "assert",
+                "description"
+            ],
+            "type": "object"
+        },
+        "MdaaServiceCatalogConstraintRuleCondititionConfig": {
+            "additionalProperties": false,
+            "type": "object"
+        },
+        "MdaaServiceCatalogConstraintRuleConfig": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nConfiguration interface for AWS Service Catalog constraint rules that combine conditions and assertions for parameter validation. Enables complex validation logic with conditional assertions based on parameter values.\n\nUse cases: Complex parameter validation; Conditional business rules; Multi-parameter validation logic\n\nAWS: Configures AWS Service Catalog constraint rules with conditions and assertions for product parameter validation\n\nValidation: condition must be valid condition config; assertions must be array of valid assertion configs",
+            "properties": {
+                "assertions": {
+                    "description": "Q-ENHANCED-PROPERTY\nArray of constraint assertions that define the validation logic to be applied when the condition is met. Each assertion validates specific aspects of the Service Catalog product parameters.\n\nUse cases: Multiple validation checks; parameter validation; Business rule enforcement\n\nAWS: AWS Service Catalog constraint rule assertions for parameter validation\n\nValidation: Must be array of valid MdaaServiceCatalogConstraintRuleAssertionConfig objects",
+                    "items": {
+                        "$ref": "#/definitions/MdaaServiceCatalogConstraintRuleAssertionConfig"
+                    },
+                    "type": "array"
+                },
+                "condition": {
+                    "$ref": "#/definitions/MdaaServiceCatalogConstraintRuleCondititionConfig",
+                    "description": "Q-ENHANCED-PROPERTY\nCondition configuration that determines when the constraint rule assertions should be evaluated. Enables conditional validation logic based on parameter values and deployment context.\n\nUse cases: Conditional validation logic; Context-dependent rules; Parameter-dependent constraints\n\nAWS: AWS Service Catalog constraint rule condition for conditional validation\n\nValidation: Must be valid MdaaServiceCatalogConstraintRuleCondititionConfig object"
+                }
+            },
+            "required": [
+                "assertions",
+                "condition"
+            ],
+            "type": "object"
+        },
+        "MdaaServiceCatalogParameterConfig": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nConfiguration interface for AWS Service Catalog product parameters that combines CloudFormation parameter properties with optional constraint validation. Enables parameterized Service Catalog products with validation rules.\n\nUse cases: Service Catalog product parameterization; Parameter validation; User input constraints\n\nAWS: Configures AWS Service Catalog product parameters with CloudFormation properties and validation constraints\n\nValidation: props must be valid CfnParameterProps; constraints must be valid constraint configuration if provided",
+            "properties": {
+                "constraints": {
+                    "$ref": "#/definitions/MdaaServiceCatalogConstraintConfig",
+                    "description": "Q-ENHANCED-PROPERTY\nOptional constraint configuration that defines additional validation rules for the Service Catalog product parameter. Enables business rule enforcement and complex parameter validation beyond basic CloudFormation constraints.\n\nUse cases: Advanced parameter validation; Business rule enforcement; Cross-parameter validation\n\nAWS: AWS Service Catalog parameter constraints for enhanced validation during provisioning\n\nValidation: Must be valid MdaaServiceCatalogConstraintConfig object if provided"
+                },
+                "props": {
+                    "$ref": "#/definitions/CfnParameterProps",
+                    "description": "Q-ENHANCED-PROPERTY\nCloudFormation parameter properties that define the parameter characteristics including type, default value, and allowed values. Provides the foundational parameter definition for Service Catalog products.\n\nUse cases: Parameter type definition; Default value specification; Allowed value constraints\n\nAWS: AWS CloudFormation parameter properties for Service Catalog product parameters\n\nValidation: Must be valid CfnParameterProps object with required CloudFormation parameter properties"
+                }
+            },
+            "required": [
+                "props"
+            ],
+            "type": "object"
+        },
+        "MdaaServiceCatalogProductConfig": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nConfiguration interface for AWS Service Catalog product deployment that specifies portfolio association, ownership, and parameterization. Enables MDAA modules to be deployed as self-service Service Catalog products with controlled access and validation.\n\nUse cases: Self-service infrastructure deployment; Controlled resource provisioning; Parameterized product offerings\n\nAWS: Configures AWS Service Catalog products for self-service deployment of MDAA modules with portfolio management\n\nValidation: portfolio_arn must be valid Service Catalog portfolio ARN; owner and name must be non-empty strings",
+            "properties": {
+                "launch_role_name": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional IAM role name that will be used to launch the Service Catalog product. Enables controlled permissions for product provisioning and resource creation with specific IAM role constraints.\n\nUse cases: Controlled provisioning permissions; IAM role-based access; Security constraint enforcement\n\nAWS: AWS Service Catalog launch role for controlled product provisioning permissions\n\nValidation: Must be valid IAM role name if provided",
+                    "type": "string"
+                },
+                "name": {
+                    "description": "Q-ENHANCED-PROPERTY\nDisplay name for the Service Catalog product that will be visible to end users in the Service Catalog console. Should be descriptive and user-friendly to facilitate product discovery and selection.\n\nUse cases: Product identification; User-friendly naming; Service Catalog console display\n\nAWS: AWS Service Catalog product name for user interface display\n\nValidation: Must be non-empty string suitable for Service Catalog product naming",
+                    "type": "string"
+                },
+                "owner": {
+                    "description": "Q-ENHANCED-PROPERTY\nOwner identifier for the Service Catalog product, typically representing the team or organization responsible for the product. Provides accountability and contact information for product management.\n\nUse cases: Product ownership identification; Contact information; Responsibility assignment\n\nAWS: AWS Service Catalog product owner for accountability and management\n\nValidation: Must be non-empty string identifying the product owner",
+                    "type": "string"
+                },
+                "parameters": {
+                    "additionalProperties": {
+                        "$ref": "#/definitions/MdaaServiceCatalogParameterConfig"
+                    },
+                    "description": "Q-ENHANCED-PROPERTY\nOptional object containing named parameter configurations for the Service Catalog product. Enables parameterized product deployment with validation rules and user input constraints.\n\nUse cases: Product parameterization; User input collection; Deployment customization\n\nAWS: AWS Service Catalog product parameters for user-configurable deployment options\n\nValidation: Must be object with string keys and valid MdaaServiceCatalogParameterConfig values if provided\n  *",
+                    "type": "object"
+                },
+                "portfolio_arn": {
+                    "description": "Q-ENHANCED-PROPERTY\nARN of the AWS Service Catalog portfolio where the product will be associated. Determines access control and organizational structure for the Service Catalog product deployment.\n\nUse cases: Portfolio organization; Access control; Product categorization\n\nAWS: AWS Service Catalog portfolio ARN for product association and access management\n\nValidation: Must be valid AWS Service Catalog portfolio ARN format",
+                    "type": "string"
+                }
+            },
+            "required": [
+                "name",
+                "owner",
+                "portfolio_arn"
+            ],
+            "type": "object"
+        },
+        "PipelineConfig": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nIndividual pipeline configuration interface for environment-specific MDAA deployment pipelines with domain, environment, and module filtering capabilities. Defines pipeline-specific deployment parameters including target filters for selective deployment, custom command execution, and pipeline-level deployment lifecycle management for targeted infrastructure deployment within multi-domain data architectures.\nUse cases: Environment-specific pipelines; Selective module deployment; Domain-filtered deployments; Pipeline customization; Targeted infrastructure updates\nAWS: AWS CodePipeline configuration with domain/environment/module filtering for selective MDAA deployment targeting specific infrastructure components\nValidation: domainFilter, envFilter, and moduleFilter must reference valid MDAA domains, environments, and modules; pipeline must inherit valid Commands configuration",
+            "properties": {
+                "deploy": {
+                    "$ref": "#/definitions/StageCommands",
+                    "description": "Q-ENHANCED-INTERFACE\nDeployment stage command configuration interface for CodeBuild projects that execute custom scripts during MDAA deployment pipeline stages. Defines install dependencies, pre-deployment preparation commands, and post-deployment cleanup commands that run in CodeBuild environments to customize deployment behavior and perform environment-specific operations.\n\nUse cases: Environment preparation; Custom deployment scripts; Post-deployment cleanup; Infrastructure customization; Environment-specific configuration\n\nAWS: AWS CodeBuild project commands with install, pre-execution, and post-execution hooks for deployment stage customization\n\nValidation: install commands must be valid package manager commands; pre/post commands must be executable shell scripts; commands execute in CodeBuild Linux environment"
+                },
+                "domainFilter": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of domain names for pipeline deployment filtering enabling selective domain-specific deployments. Restricts pipeline execution to only the specified MDAA domains, allowing for targeted deployment strategies and domain isolation in multi-domain data architectures.\n\nUse cases: Domain-specific deployments; Multi-domain filtering; Selective domain updates; Domain isolation strategies\n\nAWS: AWS CodePipeline domain filtering for selective MDAA domain deployment and targeted infrastructure updates\n\nValidation: Must be array of valid MDAA domain names if provided; domains must exist in MDAA configuration; optional for domain filtering",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "envFilter": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of environment names for pipeline deployment filtering enabling selective environment-specific deployments. Restricts pipeline execution to only the specified MDAA environments, allowing for targeted deployment strategies and environment isolation across development, staging, and production environments.\n\nUse cases: Environment-specific deployments; Multi-environment filtering; Selective environment updates; Environment isolation strategies\n\nAWS: AWS CodePipeline environment filtering for selective MDAA environment deployment and targeted infrastructure updates\n\nValidation: Must be array of valid MDAA environment names if provided; environments must exist in MDAA configuration; optional for environment filtering",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "install": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of package installation commands for CodeBuild environment setup enabling dependency management and tool installation. Defines commands that will be executed during the install phase to install required packages, dependencies, and tools needed for deployment operations.\n\nUse cases: Dependency installation; Tool setup; Package management; Environment preparation; Build tool installation\n\nAWS: AWS CodeBuild install phase commands for dependency installation and environment setup\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for install phase",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "moduleFilter": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of module names for pipeline deployment filtering enabling selective module-specific deployments. Restricts pipeline execution to only the specified MDAA modules, allowing for targeted deployment strategies and module isolation for specific infrastructure components or services.\n\nUse cases: Module-specific deployments; Multi-module filtering; Selective module updates; Component isolation strategies\n\nAWS: AWS CodePipeline module filtering for selective MDAA module deployment and targeted infrastructure component updates\n\nValidation: Must be array of valid MDAA module names if provided; modules must exist in MDAA configuration; optional for module filtering",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "post": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of post-execution commands for deployment stage cleanup and finalization enabling custom cleanup and post-deployment operations. Defines commands that will be executed after the main deployment stage to perform cleanup, notification, validation, and finalization tasks.\n\nUse cases: Post-deployment cleanup; Notification sending; Validation checks; Resource cleanup; Finalization tasks\n\nAWS: AWS CodeBuild post-execution commands for deployment stage cleanup and finalization\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for post-execution phase",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "postDeployValidate": {
+                    "$ref": "#/definitions/ValidateStageCommands",
+                    "description": "Q-ENHANCED-INTERFACE\nValidation stage command configuration interface for CodeBuild validation projects that execute infrastructure testing and compliance verification during MDAA deployment pipelines. Defines install dependencies and validation commands that run in CodeBuild environments to verify deployed infrastructure meets requirements before pipeline progression.\n\nUse cases: Infrastructure smoke testing; Compliance verification; Deployment validation; Quality gate enforcement; Post-deployment verification\n\nAWS: AWS CodeBuild validation project commands with install dependencies and validation script execution for pipeline quality gates\n\nValidation: install commands must be valid package manager commands; commands must be executable shell scripts that return appropriate exit codes for pipeline success/failure"
+                },
+                "pre": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of pre-execution commands for deployment stage preparation enabling custom setup and validation before main deployment operations. Defines commands that will be executed before the main deployment stage to perform environment preparation, validation, and custom setup tasks.\n\nUse cases: Environment preparation; Pre-deployment validation; Custom setup; Configuration verification; Prerequisite checks\n\nAWS: AWS CodeBuild pre-execution commands for deployment stage preparation and validation\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for pre-execution phase",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "preDeploy": {
+                    "$ref": "#/definitions/StageCommands",
+                    "description": "Q-ENHANCED-INTERFACE\nDeployment stage command configuration interface for CodeBuild projects that execute custom scripts during MDAA deployment pipeline stages. Defines install dependencies, pre-deployment preparation commands, and post-deployment cleanup commands that run in CodeBuild environments to customize deployment behavior and perform environment-specific operations.\n\nUse cases: Environment preparation; Custom deployment scripts; Post-deployment cleanup; Infrastructure customization; Environment-specific configuration\n\nAWS: AWS CodeBuild project commands with install, pre-execution, and post-execution hooks for deployment stage customization\n\nValidation: install commands must be valid package manager commands; pre/post commands must be executable shell scripts; commands execute in CodeBuild Linux environment"
+                },
+                "preDeployValidate": {
+                    "$ref": "#/definitions/ValidateStageCommands",
+                    "description": "Q-ENHANCED-INTERFACE\nValidation stage command configuration interface for CodeBuild validation projects that execute infrastructure testing and compliance verification during MDAA deployment pipelines. Defines install dependencies and validation commands that run in CodeBuild environments to verify deployed infrastructure meets requirements before pipeline progression.\n\nUse cases: Infrastructure smoke testing; Compliance verification; Deployment validation; Quality gate enforcement; Post-deployment verification\n\nAWS: AWS CodeBuild validation project commands with install dependencies and validation script execution for pipeline quality gates\n\nValidation: install commands must be valid package manager commands; commands must be executable shell scripts that return appropriate exit codes for pipeline success/failure"
+                }
+            },
+            "type": "object"
+        },
+        "StageCommands": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nDeployment stage command configuration interface for CodeBuild projects that execute custom scripts during MDAA deployment pipeline stages. Defines install dependencies, pre-deployment preparation commands, and post-deployment cleanup commands that run in CodeBuild environments to customize deployment behavior and perform environment-specific operations.\n\nUse cases: Environment preparation; Custom deployment scripts; Post-deployment cleanup; Infrastructure customization; Environment-specific configuration\n\nAWS: AWS CodeBuild project commands with install, pre-execution, and post-execution hooks for deployment stage customization\n\nValidation: install commands must be valid package manager commands; pre/post commands must be executable shell scripts; commands execute in CodeBuild Linux environment",
+            "properties": {
+                "install": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of package installation commands for CodeBuild environment setup enabling dependency management and tool installation. Defines commands that will be executed during the install phase to install required packages, dependencies, and tools needed for deployment operations.\n\nUse cases: Dependency installation; Tool setup; Package management; Environment preparation; Build tool installation\n\nAWS: AWS CodeBuild install phase commands for dependency installation and environment setup\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for install phase",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "post": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of post-execution commands for deployment stage cleanup and finalization enabling custom cleanup and post-deployment operations. Defines commands that will be executed after the main deployment stage to perform cleanup, notification, validation, and finalization tasks.\n\nUse cases: Post-deployment cleanup; Notification sending; Validation checks; Resource cleanup; Finalization tasks\n\nAWS: AWS CodeBuild post-execution commands for deployment stage cleanup and finalization\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for post-execution phase",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "pre": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of pre-execution commands for deployment stage preparation enabling custom setup and validation before main deployment operations. Defines commands that will be executed before the main deployment stage to perform environment preparation, validation, and custom setup tasks.\n\nUse cases: Environment preparation; Pre-deployment validation; Custom setup; Configuration verification; Prerequisite checks\n\nAWS: AWS CodeBuild pre-execution commands for deployment stage preparation and validation\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for pre-execution phase",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                }
+            },
+            "type": "object"
+        },
+        "ValidateStageCommands": {
+            "additionalProperties": false,
+            "description": "Q-ENHANCED-INTERFACE\nValidation stage command configuration interface for CodeBuild validation projects that execute infrastructure testing and compliance verification during MDAA deployment pipelines. Defines install dependencies and validation commands that run in CodeBuild environments to verify deployed infrastructure meets requirements before pipeline progression.\n\nUse cases: Infrastructure smoke testing; Compliance verification; Deployment validation; Quality gate enforcement; Post-deployment verification\n\nAWS: AWS CodeBuild validation project commands with install dependencies and validation script execution for pipeline quality gates\n\nValidation: install commands must be valid package manager commands; commands must be executable shell scripts that return appropriate exit codes for pipeline success/failure",
+            "properties": {
+                "commands": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of validation commands for infrastructure testing and compliance verification enabling quality gate enforcement. Defines commands that will be executed to validate deployed infrastructure, perform smoke tests, and verify compliance requirements before pipeline progression.\n\nUse cases: Infrastructure smoke testing; Compliance verification; Quality gate enforcement; Post-deployment validation; Infrastructure testing\n\nAWS: AWS CodeBuild validation commands for infrastructure testing and compliance verification with quality gate enforcement\n\nValidation: Must be array of valid shell commands if provided; commands must return appropriate exit codes for pipeline success/failure; optional for validation execution",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                },
+                "install": {
+                    "description": "Q-ENHANCED-PROPERTY\nOptional array of package installation commands for CodeBuild validation environment setup enabling testing tool installation and dependency management. Defines commands that will be executed during the install phase to install required testing frameworks, validation tools, and dependencies needed for infrastructure validation operations.\n\nUse cases: Testing tool installation; Validation dependency setup; Testing framework installation; Environment preparation; Validation tool setup\n\nAWS: AWS CodeBuild validation install phase commands for testing tool installation and validation environment setup\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for validation install phase",
+                    "items": {
+                        "type": "string"
+                    },
+                    "type": "array"
+                }
+            },
+            "type": "object"
+        }
+    },
+    "description": "Q-ENHANCED-INTERFACE\nMDAA DevOps configuration interface for CI/CD pipeline orchestration with CodeCommit repository integration and multi-environment deployment management. Defines the complete DevOps infrastructure including source repositories, deployment pipelines, and CDK bootstrap configuration for automated MDAA infrastructure deployment across multiple environments with approval gates and validation stages.\n\nUse cases: Multi-environment CI/CD pipelines; Automated MDAA deployments; Configuration repository management; Infrastructure change management; DevOps automation\n\nAWS: AWS CodePipeline with CodeCommit source repositories, CodeBuild projects for MDAA CLI execution, and CDK bootstrap integration for infrastructure deployment\n\nValidation: mdaaCodeCommitRepo and configsCodeCommitRepo must be valid CodeCommit repository names; pipelines must contain valid PipelineConfig objects; cdkBootstrapContext must be valid CDK qualifier",
+    "properties": {
+        "cdkBootstrapContext": {
+            "description": "Q-ENHANCED-PROPERTY\nCDK bootstrap context qualifier for identifying CDK bootstrap resources in the target environment. Defines the CDK bootstrap qualifier used to locate CDK deployment roles, buckets, and other bootstrap resources for MDAA infrastructure deployment through CI/CD pipelines.\n\nUse cases: CDK bootstrap resource identification; Multi-environment CDK deployment; Bootstrap resource isolation; CDK role management\n\nAWS: AWS CDK bootstrap resources including deployment roles and asset buckets\n\nValidation: Must be valid CDK bootstrap qualifier string; defaults to standard CDK qualifier if not specified; optional string",
+            "type": "string"
+        },
+        "configsBranch": {
+            "type": "string"
+        },
+        "configsCodeCommitRepo": {
+            "type": "string"
+        },
+        "deploy": {
+            "$ref": "#/definitions/StageCommands",
+            "description": "Q-ENHANCED-INTERFACE\nDeployment stage command configuration interface for CodeBuild projects that execute custom scripts during MDAA deployment pipeline stages. Defines install dependencies, pre-deployment preparation commands, and post-deployment cleanup commands that run in CodeBuild environments to customize deployment behavior and perform environment-specific operations.\n\nUse cases: Environment preparation; Custom deployment scripts; Post-deployment cleanup; Infrastructure customization; Environment-specific configuration\n\nAWS: AWS CodeBuild project commands with install, pre-execution, and post-execution hooks for deployment stage customization\n\nValidation: install commands must be valid package manager commands; pre/post commands must be executable shell scripts; commands execute in CodeBuild Linux environment"
+        },
+        "install": {
+            "description": "Q-ENHANCED-PROPERTY\nOptional array of package installation commands for CodeBuild environment setup enabling dependency management and tool installation. Defines commands that will be executed during the install phase to install required packages, dependencies, and tools needed for deployment operations.\n\nUse cases: Dependency installation; Tool setup; Package management; Environment preparation; Build tool installation\n\nAWS: AWS CodeBuild install phase commands for dependency installation and environment setup\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for install phase",
+            "items": {
+                "type": "string"
+            },
+            "type": "array"
+        },
+        "mdaaBranch": {
+            "type": "string"
+        },
+        "mdaaCodeCommitRepo": {
+            "type": "string"
+        },
+        "nag_suppressions": {
+            "$ref": "#/definitions/MdaaNagSuppressionConfigs",
+            "description": "Q-ENHANCED-PROPERTY\nOptional CDK Nag suppression configurations for compliance rule management enabling controlled security rule exceptions and compliance documentation. Provides structured approach to managing security rule suppressions with proper justification and documentation for compliance auditing.\n\nUse cases: Compliance management; Security rule exceptions; Audit documentation; Controlled suppressions\n\nAWS: CDK Nag suppressions for compliance rule management and security exception documentation\n\nValidation: Must be valid MdaaNagSuppressionConfigs if provided; enables structured compliance rule management"
+        },
+        "pipelines": {
+            "additionalProperties": {
+                "$ref": "#/definitions/PipelineConfig"
+            },
+            "type": "object"
+        },
+        "post": {
+            "description": "Q-ENHANCED-PROPERTY\nOptional array of post-execution commands for deployment stage cleanup and finalization enabling custom cleanup and post-deployment operations. Defines commands that will be executed after the main deployment stage to perform cleanup, notification, validation, and finalization tasks.\n\nUse cases: Post-deployment cleanup; Notification sending; Validation checks; Resource cleanup; Finalization tasks\n\nAWS: AWS CodeBuild post-execution commands for deployment stage cleanup and finalization\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for post-execution phase",
+            "items": {
+                "type": "string"
+            },
+            "type": "array"
+        },
+        "postDeployValidate": {
+            "$ref": "#/definitions/ValidateStageCommands",
+            "description": "Q-ENHANCED-INTERFACE\nValidation stage command configuration interface for CodeBuild validation projects that execute infrastructure testing and compliance verification during MDAA deployment pipelines. Defines install dependencies and validation commands that run in CodeBuild environments to verify deployed infrastructure meets requirements before pipeline progression.\n\nUse cases: Infrastructure smoke testing; Compliance verification; Deployment validation; Quality gate enforcement; Post-deployment verification\n\nAWS: AWS CodeBuild validation project commands with install dependencies and validation script execution for pipeline quality gates\n\nValidation: install commands must be valid package manager commands; commands must be executable shell scripts that return appropriate exit codes for pipeline success/failure"
+        },
+        "pre": {
+            "description": "Q-ENHANCED-PROPERTY\nOptional array of pre-execution commands for deployment stage preparation enabling custom setup and validation before main deployment operations. Defines commands that will be executed before the main deployment stage to perform environment preparation, validation, and custom setup tasks.\n\nUse cases: Environment preparation; Pre-deployment validation; Custom setup; Configuration verification; Prerequisite checks\n\nAWS: AWS CodeBuild pre-execution commands for deployment stage preparation and validation\n\nValidation: Must be array of valid shell commands if provided; commands execute in CodeBuild Linux environment; optional for pre-execution phase",
+            "items": {
+                "type": "string"
+            },
+            "type": "array"
+        },
+        "preDeploy": {
+            "$ref": "#/definitions/StageCommands",
+            "description": "Q-ENHANCED-INTERFACE\nDeployment stage command configuration interface for CodeBuild projects that execute custom scripts during MDAA deployment pipeline stages. Defines install dependencies, pre-deployment preparation commands, and post-deployment cleanup commands that run in CodeBuild environments to customize deployment behavior and perform environment-specific operations.\n\nUse cases: Environment preparation; Custom deployment scripts; Post-deployment cleanup; Infrastructure customization; Environment-specific configuration\n\nAWS: AWS CodeBuild project commands with install, pre-execution, and post-execution hooks for deployment stage customization\n\nValidation: install commands must be valid package manager commands; pre/post commands must be executable shell scripts; commands execute in CodeBuild Linux environment"
+        },
+        "preDeployValidate": {
+            "$ref": "#/definitions/ValidateStageCommands",
+            "description": "Q-ENHANCED-INTERFACE\nValidation stage command configuration interface for CodeBuild validation projects that execute infrastructure testing and compliance verification during MDAA deployment pipelines. Defines install dependencies and validation commands that run in CodeBuild environments to verify deployed infrastructure meets requirements before pipeline progression.\n\nUse cases: Infrastructure smoke testing; Compliance verification; Deployment validation; Quality gate enforcement; Post-deployment verification\n\nAWS: AWS CodeBuild validation project commands with install dependencies and validation script execution for pipeline quality gates\n\nValidation: install commands must be valid package manager commands; commands must be executable shell scripts that return appropriate exit codes for pipeline success/failure"
+        },
+        "service_catalog_product_config": {
+            "$ref": "#/definitions/MdaaServiceCatalogProductConfig",
+            "description": "Q-ENHANCED-PROPERTY\nOptional Service Catalog product configuration for governed self-service deployment enabling controlled infrastructure provisioning and governance. When specified, deploys the module as a Service Catalog product instead of direct deployment for governed access and compliance.\n\nUse cases: Governed deployment; Self-service provisioning; Service Catalog integration; Controlled access\n\nAWS: Service Catalog product configuration for governed infrastructure deployment and self-service provisioning\n\nValidation: Must be valid MdaaServiceCatalogProductConfig if provided; enables Service Catalog deployment mode"
+        }
+    },
+    "required": [
+        "configsCodeCommitRepo",
+        "mdaaCodeCommitRepo"
+    ],
+    "type": "object"
+}
+