@composurecdk/sqs 0.9.3 → 0.9.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -111,9 +111,25 @@ Every role applies the following defaults. Each can be overridden via the builde
111
111
  | Property | Default | Rationale |
112
112
  | ------------------------ | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
113
113
  | `enforceSSL` | `true` | Denies any request that doesn't use TLS (resource policy `Deny` on `aws:SecureTransport: false`). Mirrors the SNS topic default. ([SNS/SQS security best practices](https://docs.aws.amazon.com/AmazonSQS/latest/SQSDeveloperGuide/sqs-security-best-practices.html)) |
114
- | `encryption` | `QueueEncryption.SQS_MANAGED` | Encrypts at rest with the SQS-managed key (SSE-SQS). KMS encryption is opt-in via `.encryption(QueueEncryption.KMS)` + `.encryptionMasterKey(key)`. ([SQS data protection](https://docs.aws.amazon.com/AmazonSQS/latest/SQSDeveloperGuide/sqs-data-protection.html)) |
114
+ | `encryption` | `QueueEncryption.SQS_MANAGED` | Encrypts at rest with the SQS-managed key (SSE-SQS). Yields to SSE-KMS when `.encryptionMasterKey(key)` is set — see below. ([SQS data protection](https://docs.aws.amazon.com/AmazonSQS/latest/SQSDeveloperGuide/sqs-data-protection.html)) |
115
115
  | `receiveMessageWaitTime` | `Duration.seconds(20)` | Enables [long polling](https://docs.aws.amazon.com/AmazonSQS/latest/SQSDeveloperGuide/sqs-short-and-long-polling.html#sqs-long-polling) — fewer empty receives, lower cost, lower latency. 20s is the SQS maximum. |
116
116
 
117
+ ### Customer-managed encryption keys
118
+
119
+ `.encryptionMasterKey(...)` accepts a concrete `IKey` or a `Resolvable`, so a key built by [`@composurecdk/kms`](../kms/README.md) can be a component of the same system:
120
+
121
+ ```ts
122
+ compose(
123
+ {
124
+ queueKey: createKeyBuilder().description("Encrypts the orders queue at rest."),
125
+ orders: createQueueBuilder().encryptionMasterKey(ref<KeyBuilderResult>("queueKey").get("key")),
126
+ },
127
+ { queueKey: [], orders: ["queueKey"] },
128
+ );
129
+ ```
130
+
131
+ Supplying a key switches `encryption` from the `SQS_MANAGED` default to `QueueEncryption.KMS` — the two are mutually exclusive, so the default yields rather than making you set both ([ADR-0009](../../docs/adr/0009-defaults-yield-to-mutually-exclusive-siblings.md)).
132
+
117
133
  `visibilityTimeout` is intentionally not defaulted — it must match the longest consumer processing time, which is workload-specific. `retentionPeriod` is left at CDK's default of 4 days on the primary roles (the dead-letter roles raise it to 14 days, see above).
118
134
 
119
135
  The defaults are exported as `QUEUE_DEFAULTS` (shared) and `DLQ_QUEUE_DEFAULTS` (the dead-letter layer) for visibility and testing:
@@ -35,7 +35,7 @@ export interface QueueBuilderResult {
35
35
  * this type exists so one `QueueBuilder` implementation can back every
36
36
  * role.
37
37
  */
38
- interface InternalQueueBuilderProps extends QueueProps, QueueBuilderExtensionProps {
38
+ interface InternalQueueBuilderProps extends Omit<QueueProps, "encryptionMasterKey">, QueueBuilderExtensionProps {
39
39
  /**
40
40
  * The queue's role, set by `createQueueBuilder(role)`. Stored as a
41
41
  * prop (not a private field) so it is data: `.copy()` preserves it
@@ -82,7 +82,7 @@ declare class QueueBuilder implements Lifecycle<QueueBuilderResult> {
82
82
  addAlarm(key: string, configure: (alarm: AlarmDefinitionBuilder<IQueue>) => AlarmDefinitionBuilder<IQueue>): this;
83
83
  /** @internal — see ADR-0005. */
84
84
  [COPY_STATE](target: QueueBuilder): void;
85
- build(scope: IConstruct, id: string): QueueBuilderResult;
85
+ build(scope: IConstruct, id: string, context?: Record<string, object>): QueueBuilderResult;
86
86
  }
87
87
  /**
88
88
  * Creates a new {@link IQueueBuilder} for configuring an AWS SQS queue
@@ -1 +1 @@
1
- {"version":3,"file":"queue-builder.d.ts","sourceRoot":"","sources":["../../src/queue-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAOxE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,KAAK,CAAC;IAEb;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,UAAU,yBAA0B,SAAQ,UAAU,EAAE,0BAA0B;IAChF;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,UAAU,IAAI,cAAc,CAC1E,uBAAuB,CAAC,CAAC,CAAC,EAC1B,YAAY,CACb,CAAC;AAEF,cAAM,YAAa,YAAW,SAAS,CAAC,kBAAkB,CAAC;;IACzD,KAAK,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAM;IAG/C,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,GACnF,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIxC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,kBAAkB;CA+BzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,CAAC;AACpD,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC"}
1
+ {"version":3,"file":"queue-builder.d.ts","sourceRoot":"","sources":["../../src/queue-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,EAAmB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAA4B,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAOxE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,KAAK,CAAC;IAEb;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,UAAU,yBACR,SAAQ,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAAE,0BAA0B;IAC3E;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,UAAU,IAAI,cAAc,CAC1E,uBAAuB,CAAC,CAAC,CAAC,EAC1B,YAAY,CACb,CAAC;AAEF,cAAM,YAAa,YAAW,SAAS,CAAC,kBAAkB,CAAC;;IACzD,KAAK,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAM;IAG/C,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,GACnF,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIxC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,kBAAkB;CAgC3F;AAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,CAAC;AACpD,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC"}
@@ -22,14 +22,15 @@ class QueueBuilder {
22
22
  [core_1.COPY_STATE](target) {
23
23
  target.#customAlarms.push(...this.#customAlarms);
24
24
  }
25
- build(scope, id) {
26
- const { queueRole: role = "standard", ...configured } = this.props;
25
+ build(scope, id, context) {
26
+ const { queueRole: role = "standard", encryptionMasterKey, ...configured } = this.props;
27
27
  const fifo = (0, queue_role_js_1.isFifoRole)(role);
28
28
  const dlq = (0, queue_role_js_1.isDlqRole)(role);
29
29
  const mergedProps = {
30
30
  ...defaults_js_1.QUEUE_DEFAULTS,
31
31
  ...(dlq ? dlq_defaults_js_1.DLQ_QUEUE_DEFAULTS : {}),
32
32
  ...configured,
33
+ ...encryptionMasterKeyProps(encryptionMasterKey, configured.encryption, context),
33
34
  ...(fifo ? { fifo: true } : {}),
34
35
  };
35
36
  (0, queue_validation_js_1.validateQueueProps)(scope, id, role, mergedProps);
@@ -42,6 +43,24 @@ class QueueBuilder {
42
43
  return { queue, alarms };
43
44
  }
44
45
  }
46
+ /**
47
+ * Resolves a {@link Resolvable} master key and infers the encryption mode it
48
+ * implies.
49
+ *
50
+ * The `QueueEncryption.SQS_MANAGED` default is mutually exclusive with a
51
+ * customer-managed key — CDK rejects the pair — and supplying a key is an
52
+ * unambiguous request for SSE-KMS, so the default yields rather than forcing
53
+ * the user to set both (ADR-0009). An explicit `encryption` still wins, and an
54
+ * incompatible explicit pairing is left for CDK to reject.
55
+ */
56
+ function encryptionMasterKeyProps(encryptionMasterKey, userEncryption, context) {
57
+ if (encryptionMasterKey === undefined)
58
+ return {};
59
+ return {
60
+ encryptionMasterKey: (0, core_1.resolve)(encryptionMasterKey, context),
61
+ ...(userEncryption === undefined ? { encryption: aws_sqs_1.QueueEncryption.KMS } : {}),
62
+ };
63
+ }
45
64
  // Callers only ever see the overloads above, which return the exact
46
65
  // per-role `IQueueBuilder<R>`. The `unknown` here types the implementation
47
66
  // body alone (the internal builder carries the full prop surface, not the
@@ -1 +1 @@
1
- {"version":3,"file":"queue-builder.js","sourceRoot":"","sources":["../../src/queue-builder.ts"],"names":[],"mappings":";;AA0LA,gDAIC;AA7LD,iDAA0E;AAE1E,6CAAgE;AAChE,iEAAkF;AAClF,yDAAkE;AAElE,mDAAwE;AACxE,+CAA+C;AAC/C,uDAAuD;AACvD,uEAAmF;AACnF,uDAAsD;AACtD,+DAA2D;AA+E3D,MAAM,YAAY;IAChB,KAAK,GAAuC,EAAE,CAAC;IACtC,aAAa,GAAqC,EAAE,CAAC;IAE9D,QAAQ,CACN,GAAW,EACX,SAAoF;QAEpF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,mCAAsB,CAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,iBAAU,CAAC,CAAC,MAAoB;QAC/B,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU;QACjC,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACnE,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,WAAW,GAAG;YAClB,GAAG,4BAAc;YACjB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,oCAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,GAAG,UAAU;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;QAEF,IAAA,wCAAkB,EAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjD,MAAM,EAAE,iBAAiB,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,eAAK,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,GAAG;YACjB,CAAC,CAAC,IAAA,yCAAe,EAAC,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC;YACrD,CAAC,CAAC,+CAAqB,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAA,mCAAiB,EAC9B,KAAK,EACL,EAAE,EACF,KAAK,EACL,iBAAiB,EACjB,IAAI,CAAC,aAAa,EAClB,OAAO,CACR,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;CACF;AA0CD,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AACxD,SAAgB,kBAAkB,CAAC,OAAkB,UAAU;IAC7D,MAAM,OAAO,GAAG,IAAA,8BAAa,EAA0C,YAAY,CAAC,CAAC;IACpF,OAA8D,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC;AACjB,CAAC"}
1
+ {"version":3,"file":"queue-builder.js","sourceRoot":"","sources":["../../src/queue-builder.ts"],"names":[],"mappings":";;AAoNA,gDAIC;AAtND,iDAA2F;AAE3F,6CAA0F;AAC1F,iEAAkF;AAClF,yDAAkE;AAElE,mDAAwE;AACxE,+CAA+C;AAC/C,uDAAuD;AACvD,uEAAmF;AACnF,uDAAsD;AACtD,+DAA2D;AAgF3D,MAAM,YAAY;IAChB,KAAK,GAAuC,EAAE,CAAC;IACtC,aAAa,GAAqC,EAAE,CAAC;IAE9D,QAAQ,CACN,GAAW,EACX,SAAoF;QAEpF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,mCAAsB,CAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,iBAAU,CAAC,CAAC,MAAoB;QAC/B,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,UAAU,EAAE,mBAAmB,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACxF,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,WAAW,GAAG;YAClB,GAAG,4BAAc;YACjB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,oCAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,GAAG,UAAU;YACb,GAAG,wBAAwB,CAAC,mBAAmB,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;QAEF,IAAA,wCAAkB,EAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjD,MAAM,EAAE,iBAAiB,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,eAAK,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,GAAG;YACjB,CAAC,CAAC,IAAA,yCAAe,EAAC,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC;YACrD,CAAC,CAAC,+CAAqB,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAA,mCAAiB,EAC9B,KAAK,EACL,EAAE,EACF,KAAK,EACL,iBAAiB,EACjB,IAAI,CAAC,aAAa,EAClB,OAAO,CACR,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,SAAS,wBAAwB,CAC/B,mBAAiD,EACjD,cAA2C,EAC3C,OAA2C;IAE3C,IAAI,mBAAmB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEjD,OAAO;QACL,mBAAmB,EAAE,IAAA,cAAO,EAAC,mBAAmB,EAAE,OAAO,CAAC;QAC1D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,yBAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AA0CD,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AACxD,SAAgB,kBAAkB,CAAC,OAAkB,UAAU;IAC7D,MAAM,OAAO,GAAG,IAAA,8BAAa,EAA0C,YAAY,CAAC,CAAC;IACpF,OAA8D,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC;AACjB,CAAC"}
@@ -1,4 +1,6 @@
1
+ import type { IKey } from "aws-cdk-lib/aws-kms";
1
2
  import type { QueueProps } from "aws-cdk-lib/aws-sqs";
3
+ import type { Resolvable } from "@composurecdk/core";
2
4
  import type { QueueAlarmConfig } from "./queue-alarm-config.js";
3
5
  /**
4
6
  * A queue name for a FIFO queue. AWS requires the name of a FIFO queue to
@@ -20,12 +22,27 @@ export declare const FIFO_ONLY_PROP_KEYS: readonly ["fifo", "contentBasedDedupli
20
22
  /** Union of the FIFO-only {@link QueueProps} keys. */
21
23
  export type FifoOnlyPropKey = (typeof FIFO_ONLY_PROP_KEYS)[number];
22
24
  /**
23
- * Builder-only props every queue builder in this package layers on top
24
- * of the CDK {@link QueueProps}. Defined once so the builders and the
25
- * shared build core agree on what must be stripped before the props
26
- * reach the `Queue` construct.
25
+ * The props every queue builder in this package layers on top of the CDK
26
+ * {@link QueueProps} — both builder-only additions and CDK props widened
27
+ * to accept a {@link Resolvable}. Defined once so the builders and the
28
+ * shared build core agree on what must be stripped from the merged props
29
+ * (and, for a widened prop, resolved and re-added) before they reach the
30
+ * `Queue` construct.
27
31
  */
28
32
  export interface QueueBuilderExtensionProps {
33
+ /**
34
+ * The customer-managed KMS key used for server-side encryption (SSE-KMS).
35
+ *
36
+ * Accepts a concrete {@link IKey} or a {@link Resolvable} — typically a
37
+ * {@link Ref} to a composed `@composurecdk/kms` key builder, so the key is a
38
+ * component of the system rather than a construct built outside it.
39
+ *
40
+ * Supplying a key implies `QueueEncryption.KMS`: the `SQS_MANAGED` default
41
+ * is mutually exclusive with a customer key, so `build()` drops it rather
42
+ * than making you set both (ADR-0009). Setting `encryption` explicitly
43
+ * still wins.
44
+ */
45
+ encryptionMasterKey?: Resolvable<IKey>;
29
46
  /**
30
47
  * Configuration for AWS-recommended CloudWatch alarms.
31
48
  *
@@ -49,7 +66,7 @@ export interface QueueBuilderExtensionProps {
49
66
  * queue with FIFO behaviour is an explicit role choice
50
67
  * (`createQueueBuilder("fifo")`), not a prop.
51
68
  */
52
- export interface QueueBuilderProps extends Omit<QueueProps, FifoOnlyPropKey>, QueueBuilderExtensionProps {
69
+ export interface QueueBuilderProps extends Omit<QueueProps, FifoOnlyPropKey | "encryptionMasterKey">, QueueBuilderExtensionProps {
53
70
  }
54
71
  /**
55
72
  * Prop surface of `createQueueBuilder("fifo")`. `fifo` itself is not
@@ -57,7 +74,7 @@ export interface QueueBuilderProps extends Omit<QueueProps, FifoOnlyPropKey>, Qu
57
74
  * {@link FifoQueueName}, so a name missing the AWS-required `.fifo`
58
75
  * suffix is a compile error rather than a synth failure.
59
76
  */
60
- export interface FifoQueueBuilderProps extends Omit<QueueProps, "fifo" | "queueName">, QueueBuilderExtensionProps {
77
+ export interface FifoQueueBuilderProps extends Omit<QueueProps, "fifo" | "queueName" | "encryptionMasterKey">, QueueBuilderExtensionProps {
61
78
  /**
62
79
  * Physical name of the FIFO queue. Must end in `.fifo` (AWS
63
80
  * requirement, enforced by the type and validated at build for
@@ -1 +1 @@
1
- {"version":3,"file":"queue-props.d.ts","sourceRoot":"","sources":["../../src/queue-props.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,GAAG,MAAM,OAAO,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,6FAKkB,CAAC;AAEnD,sDAAsD;AACtD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;CAC9C;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,0BAA0B;CAAG;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,qBACf,SAAQ,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,EAAE,0BAA0B;IAC1E;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,GAAG,EAAE,oBAAoB,CAAC;IAC1B,UAAU,EAAE,wBAAwB,CAAC;CACtC"}
1
+ {"version":3,"file":"queue-props.d.ts","sourceRoot":"","sources":["../../src/queue-props.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,GAAG,MAAM,OAAO,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,6FAKkB,CAAC;AAEnD,sDAAsD;AACtD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAEvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;CAC9C;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,IAAI,CAAC,UAAU,EAAE,eAAe,GAAG,qBAAqB,CAAC,EAAE,0BAA0B;CAAG;AAElG;;;;;GAKG;AACH,MAAM,WAAW,qBACf,SACE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,qBAAqB,CAAC,EAC9D,0BAA0B;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,GAAG,EAAE,oBAAoB,CAAC;IAC1B,UAAU,EAAE,wBAAwB,CAAC;CACtC"}
@@ -1 +1 @@
1
- {"version":3,"file":"queue-props.js","sourceRoot":"","sources":["../../src/queue-props.ts"],"names":[],"mappings":";;;AAcA;;;;;GAKG;AACU,QAAA,mBAAmB,GAAG;IACjC,MAAM;IACN,2BAA2B;IAC3B,oBAAoB;IACpB,qBAAqB;CAC2B,CAAC"}
1
+ {"version":3,"file":"queue-props.js","sourceRoot":"","sources":["../../src/queue-props.ts"],"names":[],"mappings":";;;AAgBA;;;;;GAKG;AACU,QAAA,mBAAmB,GAAG;IACjC,MAAM;IACN,2BAA2B;IAC3B,oBAAoB;IACpB,qBAAqB;CAC2B,CAAC"}
@@ -35,7 +35,7 @@ export interface QueueBuilderResult {
35
35
  * this type exists so one `QueueBuilder` implementation can back every
36
36
  * role.
37
37
  */
38
- interface InternalQueueBuilderProps extends QueueProps, QueueBuilderExtensionProps {
38
+ interface InternalQueueBuilderProps extends Omit<QueueProps, "encryptionMasterKey">, QueueBuilderExtensionProps {
39
39
  /**
40
40
  * The queue's role, set by `createQueueBuilder(role)`. Stored as a
41
41
  * prop (not a private field) so it is data: `.copy()` preserves it
@@ -82,7 +82,7 @@ declare class QueueBuilder implements Lifecycle<QueueBuilderResult> {
82
82
  addAlarm(key: string, configure: (alarm: AlarmDefinitionBuilder<IQueue>) => AlarmDefinitionBuilder<IQueue>): this;
83
83
  /** @internal — see ADR-0005. */
84
84
  [COPY_STATE](target: QueueBuilder): void;
85
- build(scope: IConstruct, id: string): QueueBuilderResult;
85
+ build(scope: IConstruct, id: string, context?: Record<string, object>): QueueBuilderResult;
86
86
  }
87
87
  /**
88
88
  * Creates a new {@link IQueueBuilder} for configuring an AWS SQS queue
@@ -1 +1 @@
1
- {"version":3,"file":"queue-builder.d.ts","sourceRoot":"","sources":["../../src/queue-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAOxE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,KAAK,CAAC;IAEb;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,UAAU,yBAA0B,SAAQ,UAAU,EAAE,0BAA0B;IAChF;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,UAAU,IAAI,cAAc,CAC1E,uBAAuB,CAAC,CAAC,CAAC,EAC1B,YAAY,CACb,CAAC;AAEF,cAAM,YAAa,YAAW,SAAS,CAAC,kBAAkB,CAAC;;IACzD,KAAK,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAM;IAG/C,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,GACnF,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIxC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,kBAAkB;CA+BzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,CAAC;AACpD,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC"}
1
+ {"version":3,"file":"queue-builder.d.ts","sourceRoot":"","sources":["../../src/queue-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,EAAmB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAA4B,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAOxE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,KAAK,CAAC;IAEb;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,UAAU,yBACR,SAAQ,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,EAAE,0BAA0B;IAC3E;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,UAAU,IAAI,cAAc,CAC1E,uBAAuB,CAAC,CAAC,CAAC,EAC1B,YAAY,CACb,CAAC;AAEF,cAAM,YAAa,YAAW,SAAS,CAAC,kBAAkB,CAAC;;IACzD,KAAK,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAM;IAG/C,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,GACnF,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIxC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,kBAAkB;CAgC3F;AAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,kBAAkB,IAAI,aAAa,CAAC;AACpD,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC"}
@@ -1,5 +1,5 @@
1
- import { Queue } from "aws-cdk-lib/aws-sqs";
2
- import { COPY_STATE } from "@composurecdk/core";
1
+ import { Queue, QueueEncryption } from "aws-cdk-lib/aws-sqs";
2
+ import { COPY_STATE, resolve } from "@composurecdk/core";
3
3
  import { taggedBuilder } from "@composurecdk/cloudformation";
4
4
  import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
5
5
  import { isDlqRole, isFifoRole } from "./queue-role.js";
@@ -19,14 +19,15 @@ class QueueBuilder {
19
19
  [COPY_STATE](target) {
20
20
  target.#customAlarms.push(...this.#customAlarms);
21
21
  }
22
- build(scope, id) {
23
- const { queueRole: role = "standard", ...configured } = this.props;
22
+ build(scope, id, context) {
23
+ const { queueRole: role = "standard", encryptionMasterKey, ...configured } = this.props;
24
24
  const fifo = isFifoRole(role);
25
25
  const dlq = isDlqRole(role);
26
26
  const mergedProps = {
27
27
  ...QUEUE_DEFAULTS,
28
28
  ...(dlq ? DLQ_QUEUE_DEFAULTS : {}),
29
29
  ...configured,
30
+ ...encryptionMasterKeyProps(encryptionMasterKey, configured.encryption, context),
30
31
  ...(fifo ? { fifo: true } : {}),
31
32
  };
32
33
  validateQueueProps(scope, id, role, mergedProps);
@@ -39,6 +40,24 @@ class QueueBuilder {
39
40
  return { queue, alarms };
40
41
  }
41
42
  }
43
+ /**
44
+ * Resolves a {@link Resolvable} master key and infers the encryption mode it
45
+ * implies.
46
+ *
47
+ * The `QueueEncryption.SQS_MANAGED` default is mutually exclusive with a
48
+ * customer-managed key — CDK rejects the pair — and supplying a key is an
49
+ * unambiguous request for SSE-KMS, so the default yields rather than forcing
50
+ * the user to set both (ADR-0009). An explicit `encryption` still wins, and an
51
+ * incompatible explicit pairing is left for CDK to reject.
52
+ */
53
+ function encryptionMasterKeyProps(encryptionMasterKey, userEncryption, context) {
54
+ if (encryptionMasterKey === undefined)
55
+ return {};
56
+ return {
57
+ encryptionMasterKey: resolve(encryptionMasterKey, context),
58
+ ...(userEncryption === undefined ? { encryption: QueueEncryption.KMS } : {}),
59
+ };
60
+ }
42
61
  // Callers only ever see the overloads above, which return the exact
43
62
  // per-role `IQueueBuilder<R>`. The `unknown` here types the implementation
44
63
  // body alone (the internal builder carries the full prop surface, not the
@@ -1 +1 @@
1
- {"version":3,"file":"queue-builder.js","sourceRoot":"","sources":["../../src/queue-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,EAAmB,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAkB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AA+E3D,MAAM,YAAY;IAChB,KAAK,GAAuC,EAAE,CAAC;IACtC,aAAa,GAAqC,EAAE,CAAC;IAE9D,QAAQ,CACN,GAAW,EACX,SAAoF;QAEpF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAoB;QAC/B,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU;QACjC,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACnE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,WAAW,GAAG;YAClB,GAAG,cAAc;YACjB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,GAAG,UAAU;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;QAEF,kBAAkB,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjD,MAAM,EAAE,iBAAiB,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,GAAG;YACjB,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC;YACrD,CAAC,CAAC,qBAAqB,CAAC;QAC1B,MAAM,MAAM,GAAG,iBAAiB,CAC9B,KAAK,EACL,EAAE,EACF,KAAK,EACL,iBAAiB,EACjB,IAAI,CAAC,aAAa,EAClB,OAAO,CACR,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;CACF;AA0CD,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AACxD,MAAM,UAAU,kBAAkB,CAAC,OAAkB,UAAU;IAC7D,MAAM,OAAO,GAAG,aAAa,CAA0C,YAAY,CAAC,CAAC;IACpF,OAA8D,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC;AACjB,CAAC"}
1
+ {"version":3,"file":"queue-builder.js","sourceRoot":"","sources":["../../src/queue-builder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AAE3F,OAAO,EAAE,UAAU,EAAkB,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAkB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAgF3D,MAAM,YAAY;IAChB,KAAK,GAAuC,EAAE,CAAC;IACtC,aAAa,GAAqC,EAAE,CAAC;IAE9D,QAAQ,CACN,GAAW,EACX,SAAoF;QAEpF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAoB;QAC/B,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,UAAU,EAAE,mBAAmB,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACxF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,WAAW,GAAG;YAClB,GAAG,cAAc;YACjB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,GAAG,UAAU;YACb,GAAG,wBAAwB,CAAC,mBAAmB,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;QAEF,kBAAkB,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjD,MAAM,EAAE,iBAAiB,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,GAAG;YACjB,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC;YACrD,CAAC,CAAC,qBAAqB,CAAC;QAC1B,MAAM,MAAM,GAAG,iBAAiB,CAC9B,KAAK,EACL,EAAE,EACF,KAAK,EACL,iBAAiB,EACjB,IAAI,CAAC,aAAa,EAClB,OAAO,CACR,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,SAAS,wBAAwB,CAC/B,mBAAiD,EACjD,cAA2C,EAC3C,OAA2C;IAE3C,IAAI,mBAAmB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEjD,OAAO;QACL,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC;QAC1D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AA0CD,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AACxD,MAAM,UAAU,kBAAkB,CAAC,OAAkB,UAAU;IAC7D,MAAM,OAAO,GAAG,aAAa,CAA0C,YAAY,CAAC,CAAC;IACpF,OAA8D,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC;AACjB,CAAC"}
@@ -1,4 +1,6 @@
1
+ import type { IKey } from "aws-cdk-lib/aws-kms";
1
2
  import type { QueueProps } from "aws-cdk-lib/aws-sqs";
3
+ import type { Resolvable } from "@composurecdk/core";
2
4
  import type { QueueAlarmConfig } from "./queue-alarm-config.js";
3
5
  /**
4
6
  * A queue name for a FIFO queue. AWS requires the name of a FIFO queue to
@@ -20,12 +22,27 @@ export declare const FIFO_ONLY_PROP_KEYS: readonly ["fifo", "contentBasedDedupli
20
22
  /** Union of the FIFO-only {@link QueueProps} keys. */
21
23
  export type FifoOnlyPropKey = (typeof FIFO_ONLY_PROP_KEYS)[number];
22
24
  /**
23
- * Builder-only props every queue builder in this package layers on top
24
- * of the CDK {@link QueueProps}. Defined once so the builders and the
25
- * shared build core agree on what must be stripped before the props
26
- * reach the `Queue` construct.
25
+ * The props every queue builder in this package layers on top of the CDK
26
+ * {@link QueueProps} — both builder-only additions and CDK props widened
27
+ * to accept a {@link Resolvable}. Defined once so the builders and the
28
+ * shared build core agree on what must be stripped from the merged props
29
+ * (and, for a widened prop, resolved and re-added) before they reach the
30
+ * `Queue` construct.
27
31
  */
28
32
  export interface QueueBuilderExtensionProps {
33
+ /**
34
+ * The customer-managed KMS key used for server-side encryption (SSE-KMS).
35
+ *
36
+ * Accepts a concrete {@link IKey} or a {@link Resolvable} — typically a
37
+ * {@link Ref} to a composed `@composurecdk/kms` key builder, so the key is a
38
+ * component of the system rather than a construct built outside it.
39
+ *
40
+ * Supplying a key implies `QueueEncryption.KMS`: the `SQS_MANAGED` default
41
+ * is mutually exclusive with a customer key, so `build()` drops it rather
42
+ * than making you set both (ADR-0009). Setting `encryption` explicitly
43
+ * still wins.
44
+ */
45
+ encryptionMasterKey?: Resolvable<IKey>;
29
46
  /**
30
47
  * Configuration for AWS-recommended CloudWatch alarms.
31
48
  *
@@ -49,7 +66,7 @@ export interface QueueBuilderExtensionProps {
49
66
  * queue with FIFO behaviour is an explicit role choice
50
67
  * (`createQueueBuilder("fifo")`), not a prop.
51
68
  */
52
- export interface QueueBuilderProps extends Omit<QueueProps, FifoOnlyPropKey>, QueueBuilderExtensionProps {
69
+ export interface QueueBuilderProps extends Omit<QueueProps, FifoOnlyPropKey | "encryptionMasterKey">, QueueBuilderExtensionProps {
53
70
  }
54
71
  /**
55
72
  * Prop surface of `createQueueBuilder("fifo")`. `fifo` itself is not
@@ -57,7 +74,7 @@ export interface QueueBuilderProps extends Omit<QueueProps, FifoOnlyPropKey>, Qu
57
74
  * {@link FifoQueueName}, so a name missing the AWS-required `.fifo`
58
75
  * suffix is a compile error rather than a synth failure.
59
76
  */
60
- export interface FifoQueueBuilderProps extends Omit<QueueProps, "fifo" | "queueName">, QueueBuilderExtensionProps {
77
+ export interface FifoQueueBuilderProps extends Omit<QueueProps, "fifo" | "queueName" | "encryptionMasterKey">, QueueBuilderExtensionProps {
61
78
  /**
62
79
  * Physical name of the FIFO queue. Must end in `.fifo` (AWS
63
80
  * requirement, enforced by the type and validated at build for
@@ -1 +1 @@
1
- {"version":3,"file":"queue-props.d.ts","sourceRoot":"","sources":["../../src/queue-props.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,GAAG,MAAM,OAAO,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,6FAKkB,CAAC;AAEnD,sDAAsD;AACtD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;CAC9C;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,0BAA0B;CAAG;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,qBACf,SAAQ,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,EAAE,0BAA0B;IAC1E;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,GAAG,EAAE,oBAAoB,CAAC;IAC1B,UAAU,EAAE,wBAAwB,CAAC;CACtC"}
1
+ {"version":3,"file":"queue-props.d.ts","sourceRoot":"","sources":["../../src/queue-props.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,GAAG,MAAM,OAAO,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,6FAKkB,CAAC;AAEnD,sDAAsD;AACtD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAEvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;CAC9C;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBACf,SAAQ,IAAI,CAAC,UAAU,EAAE,eAAe,GAAG,qBAAqB,CAAC,EAAE,0BAA0B;CAAG;AAElG;;;;;GAKG;AACH,MAAM,WAAW,qBACf,SACE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,qBAAqB,CAAC,EAC9D,0BAA0B;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,GAAG,EAAE,oBAAoB,CAAC;IAC1B,UAAU,EAAE,wBAAwB,CAAC;CACtC"}
@@ -1 +1 @@
1
- {"version":3,"file":"queue-props.js","sourceRoot":"","sources":["../../src/queue-props.ts"],"names":[],"mappings":"AAcA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM;IACN,2BAA2B;IAC3B,oBAAoB;IACpB,qBAAqB;CAC2B,CAAC"}
1
+ {"version":3,"file":"queue-props.js","sourceRoot":"","sources":["../../src/queue-props.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM;IACN,2BAA2B;IAC3B,oBAAoB;IACpB,qBAAqB;CAC2B,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@composurecdk/sqs",
3
- "version": "0.9.3",
3
+ "version": "0.9.5",
4
4
  "description": "Composable SQS queue builder with well-architected defaults",
5
5
  "repository": {
6
6
  "type": "git",
@@ -57,7 +57,7 @@
57
57
  },
58
58
  "devDependencies": {
59
59
  "@types/node": "^25.9.3",
60
- "aws-cdk-lib": "^2.263.0",
60
+ "aws-cdk-lib": "^2.264.0",
61
61
  "constructs": "^10.6.0",
62
62
  "typescript": "^6.0.3",
63
63
  "vitest": "^4.1.8"