@composurecdk/logs 0.9.3 → 0.9.5

package/README.md

@@ -50,3 +50,15 @@ CloudWatch Logs encrypts all log data at rest using AWS-managed keys. For additi
 ```ts
 const logGroup = createLogGroupBuilder().encryptionKey(myKmsKey).build(stack, "EncryptedLogs");
 ```
+
+`.encryptionKey(...)` accepts a concrete key or a `Resolvable`, so a key built by [`@composurecdk/kms`](../kms/README.md) can be a component of the same system:
+
+```ts
+compose(
+  {
+    logKey: createKeyBuilder().description("Encrypts the audit log group."),
+    audit: createLogGroupBuilder().encryptionKey(ref<KeyBuilderResult>("logKey").get("key")),
+  },
+  { logKey: [], audit: ["logKey"] },
+);
+```

package/dist/commonjs/log-group-builder.d.ts

@@ -1,8 +1,34 @@
 import { LogGroup, type LogGroupProps } from "aws-cdk-lib/aws-logs";
 import { type IConstruct } from "constructs";
-import { type Lifecycle } from "@composurecdk/core";
+import { type Lifecycle, type Resolvable } from "@composurecdk/core";
 import { type ITaggedBuilder } from "@composurecdk/cloudformation";
-export type LogGroupBuilderProps = LogGroupProps;
+/**
+ * Configuration properties for the CloudWatch log group builder.
+ *
+ * The CDK {@link LogGroupProps} surface, with `encryptionKey` widened so the
+ * key can come from a composed component.
+ */
+export interface LogGroupBuilderProps extends Omit<LogGroupProps, "encryptionKey"> {
+    /**
+     * The customer-managed KMS key used to encrypt the log group.
+     *
+     * Accepts a concrete key or a {@link Resolvable} — typically a {@link Ref}
+     * to a composed `@composurecdk/kms` key builder, so the key is a component
+     * of the system rather than a construct built outside it.
+     *
+     * CloudWatch Logs encrypts every log group with a service-managed key by
+     * default, so this prop opts into a customer-managed one. The key policy
+     * must allow the `logs.<region>.amazonaws.com` service principal — CDK adds
+     * that statement for a key it can see.
+     *
+     * The inner type is read from CDK's own prop rather than named as `IKey`, so
+     * it tracks the `kms.IKey` → `kms.IKeyRef` migration in either direction —
+     * see the table in `@composurecdk/kms`'s README.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html
+     */
+    encryptionKey?: Resolvable<NonNullable<LogGroupProps["encryptionKey"]>>;
+}
 /**
  * The build output of a {@link ILogGroupBuilder}. Contains the CDK constructs
  * created during {@link Lifecycle.build}, keyed by role.
@@ -32,7 +58,7 @@ export interface LogGroupBuilderResult {
 export type ILogGroupBuilder = ITaggedBuilder<LogGroupBuilderProps, LogGroupBuilder>;
 declare class LogGroupBuilder implements Lifecycle<LogGroupBuilderResult> {
     props: Partial<LogGroupBuilderProps>;
-    build(scope: IConstruct, id: string): LogGroupBuilderResult;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): LogGroupBuilderResult;
 }
 /**
  * Creates a new {@link ILogGroupBuilder} for configuring a CloudWatch log group.

package/dist/commonjs/log-group-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log-group-builder.d.ts","sourceRoot":"","sources":["../../src/log-group-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAGlF,MAAM,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AAErF,cAAM,eAAgB,YAAW,SAAS,CAAC,qBAAqB,CAAC;IAC/D,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAM;IAE1C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,qBAAqB;CAS5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,IAAI,gBAAgB,CAExD"}
+{"version":3,"file":"log-group-builder.d.ts","sourceRoot":"","sources":["../../src/log-group-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAGlF;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC;IAChF;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CACzE;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AAErF,cAAM,eAAgB,YAAW,SAAS,CAAC,qBAAqB,CAAC;IAC/D,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAM;IAE1C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,qBAAqB;CAa9F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,IAAI,gBAAgB,CAExD"}

package/dist/commonjs/log-group-builder.js

@@ -2,14 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createLogGroupBuilder = createLogGroupBuilder;
 const aws_logs_1 = require("aws-cdk-lib/aws-logs");
+const core_1 = require("@composurecdk/core");
 const cloudformation_1 = require("@composurecdk/cloudformation");
 const defaults_js_1 = require("./defaults.js");
 class LogGroupBuilder {
     props = {};
-    build(scope, id) {
+    build(scope, id, context) {
+        const { encryptionKey, ...logGroupProps } = this.props;
         const mergedProps = {
             ...defaults_js_1.LOG_GROUP_DEFAULTS,
-            ...this.props,
+            ...logGroupProps,
+            ...(encryptionKey !== undefined ? { encryptionKey: (0, core_1.resolve)(encryptionKey, context) } : {}),
         };
         return {
             logGroup: new aws_logs_1.LogGroup(scope, id, mergedProps),

package/dist/commonjs/log-group-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"log-group-builder.js","sourceRoot":"","sources":["../../src/log-group-builder.ts"],"names":[],"mappings":";;AA2EA,sDAEC;AA7ED,mDAAoE;AAGpE,iEAAkF;AAClF,+CAAmD;AAiCnD,MAAM,eAAe;IACnB,KAAK,GAAkC,EAAE,CAAC;IAE1C,KAAK,CAAC,KAAiB,EAAE,EAAU;QACjC,MAAM,WAAW,GAAG;YAClB,GAAG,gCAAkB;YACrB,GAAG,IAAI,CAAC,KAAK;SACd,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,IAAI,mBAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,qBAAqB;IACnC,OAAO,IAAA,8BAAa,EAAwC,eAAe,CAAC,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"log-group-builder.js","sourceRoot":"","sources":["../../src/log-group-builder.ts"],"names":[],"mappings":";;AAyGA,sDAEC;AA3GD,mDAAoE;AAEpE,6CAA8E;AAC9E,iEAAkF;AAClF,+CAAmD;AA2DnD,MAAM,eAAe;IACnB,KAAK,GAAkC,EAAE,CAAC;IAE1C,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAEvD,MAAM,WAAW,GAAG;YAClB,GAAG,gCAAkB;YACrB,GAAG,aAAa;YAChB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAA,cAAO,EAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,IAAI,mBAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,qBAAqB;IACnC,OAAO,IAAA,8BAAa,EAAwC,eAAe,CAAC,CAAC;AAC/E,CAAC"}

package/dist/esm/log-group-builder.d.ts

@@ -1,8 +1,34 @@
 import { LogGroup, type LogGroupProps } from "aws-cdk-lib/aws-logs";
 import { type IConstruct } from "constructs";
-import { type Lifecycle } from "@composurecdk/core";
+import { type Lifecycle, type Resolvable } from "@composurecdk/core";
 import { type ITaggedBuilder } from "@composurecdk/cloudformation";
-export type LogGroupBuilderProps = LogGroupProps;
+/**
+ * Configuration properties for the CloudWatch log group builder.
+ *
+ * The CDK {@link LogGroupProps} surface, with `encryptionKey` widened so the
+ * key can come from a composed component.
+ */
+export interface LogGroupBuilderProps extends Omit<LogGroupProps, "encryptionKey"> {
+    /**
+     * The customer-managed KMS key used to encrypt the log group.
+     *
+     * Accepts a concrete key or a {@link Resolvable} — typically a {@link Ref}
+     * to a composed `@composurecdk/kms` key builder, so the key is a component
+     * of the system rather than a construct built outside it.
+     *
+     * CloudWatch Logs encrypts every log group with a service-managed key by
+     * default, so this prop opts into a customer-managed one. The key policy
+     * must allow the `logs.<region>.amazonaws.com` service principal — CDK adds
+     * that statement for a key it can see.
+     *
+     * The inner type is read from CDK's own prop rather than named as `IKey`, so
+     * it tracks the `kms.IKey` → `kms.IKeyRef` migration in either direction —
+     * see the table in `@composurecdk/kms`'s README.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html
+     */
+    encryptionKey?: Resolvable<NonNullable<LogGroupProps["encryptionKey"]>>;
+}
 /**
  * The build output of a {@link ILogGroupBuilder}. Contains the CDK constructs
  * created during {@link Lifecycle.build}, keyed by role.
@@ -32,7 +58,7 @@ export interface LogGroupBuilderResult {
 export type ILogGroupBuilder = ITaggedBuilder<LogGroupBuilderProps, LogGroupBuilder>;
 declare class LogGroupBuilder implements Lifecycle<LogGroupBuilderResult> {
     props: Partial<LogGroupBuilderProps>;
-    build(scope: IConstruct, id: string): LogGroupBuilderResult;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): LogGroupBuilderResult;
 }
 /**
  * Creates a new {@link ILogGroupBuilder} for configuring a CloudWatch log group.

package/dist/esm/log-group-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log-group-builder.d.ts","sourceRoot":"","sources":["../../src/log-group-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAGlF,MAAM,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AAErF,cAAM,eAAgB,YAAW,SAAS,CAAC,qBAAqB,CAAC;IAC/D,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAM;IAE1C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,qBAAqB;CAS5D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,IAAI,gBAAgB,CAExD"}
+{"version":3,"file":"log-group-builder.d.ts","sourceRoot":"","sources":["../../src/log-group-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAGlF;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC;IAChF;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CACzE;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AAErF,cAAM,eAAgB,YAAW,SAAS,CAAC,qBAAqB,CAAC;IAC/D,KAAK,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAM;IAE1C,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,qBAAqB;CAa9F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,IAAI,gBAAgB,CAExD"}

package/dist/esm/log-group-builder.js

@@ -1,12 +1,15 @@
 import { LogGroup } from "aws-cdk-lib/aws-logs";
+import { resolve } from "@composurecdk/core";
 import { taggedBuilder } from "@composurecdk/cloudformation";
 import { LOG_GROUP_DEFAULTS } from "./defaults.js";
 class LogGroupBuilder {
     props = {};
-    build(scope, id) {
+    build(scope, id, context) {
+        const { encryptionKey, ...logGroupProps } = this.props;
         const mergedProps = {
             ...LOG_GROUP_DEFAULTS,
-            ...this.props,
+            ...logGroupProps,
+            ...(encryptionKey !== undefined ? { encryptionKey: resolve(encryptionKey, context) } : {}),
         };
         return {
             logGroup: new LogGroup(scope, id, mergedProps),

package/dist/esm/log-group-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"log-group-builder.js","sourceRoot":"","sources":["../../src/log-group-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAsB,MAAM,sBAAsB,CAAC;AAGpE,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAiCnD,MAAM,eAAe;IACnB,KAAK,GAAkC,EAAE,CAAC;IAE1C,KAAK,CAAC,KAAiB,EAAE,EAAU;QACjC,MAAM,WAAW,GAAG;YAClB,GAAG,kBAAkB;YACrB,GAAG,IAAI,CAAC,KAAK;SACd,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,aAAa,CAAwC,eAAe,CAAC,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"log-group-builder.js","sourceRoot":"","sources":["../../src/log-group-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAsB,MAAM,sBAAsB,CAAC;AAEpE,OAAO,EAAkB,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AA2DnD,MAAM,eAAe;IACnB,KAAK,GAAkC,EAAE,CAAC;IAE1C,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAEvD,MAAM,WAAW,GAAG;YAClB,GAAG,kBAAkB;YACrB,GAAG,aAAa;YAChB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,aAAa,CAAwC,eAAe,CAAC,CAAC;AAC/E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@composurecdk/logs",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "Composable CloudWatch log group builder with secure defaults",
   "repository": {
     "type": "git",
@@ -56,7 +56,7 @@
   },
   "devDependencies": {
     "@types/node": "^25.9.3",
-    "aws-cdk-lib": "^2.263.0",
+    "aws-cdk-lib": "^2.264.0",
     "constructs": "^10.6.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.8"