@deployfoundation/foundation-deploy 0.1.0

package/src/stacks/ci-stack.ts

@@ -0,0 +1,96 @@
+import * as cdk from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import type * as kms from "aws-cdk-lib/aws-kms";
+import type * as s3 from "aws-cdk-lib/aws-s3";
+import type { Construct } from "constructs";
+import { deployStatements } from "../deploy-permissions.ts";
+import { type Instance, namesFor } from "../names.ts";
+
+export interface FoundationCiProps extends cdk.StackProps {
+  /** The deployment this stack belongs to; every name below comes from it. */
+  instance: Instance;
+  /** The data stack's bucket — config and skills are synced into it by the deploy. */
+  bucket: s3.IBucket;
+  /** The CMK that bucket is encrypted with. */
+  dataKey: kms.IKey;
+  /** `owner/repo` allowed to assume the deploy role. */
+  repository?: string;
+  /**
+   * GitHub's numeric owner and repository ids. GitHub now issues the
+   * rename-proof subject `repo:<owner>@<ownerId>/<repo>@<repoId>:ref:…` by
+   * default; without these the trust policy never matches.
+   */
+  repositoryIds?: { owner: number; repo: number };
+}
+
+/**
+ * FoundationCi — the GitHub OIDC trust for the deploy job in the instance
+ * repository's own workflow. One per instance: each has its own repo, its own
+ * account and its own deploy role.
+ *
+ * No long-lived AWS keys live in GitHub: Actions presents its short-lived
+ * OIDC token and assumes the instance's deploy role, whose trust policy pins both the
+ * audience and the exact `sub` — `repo:<owner>/<repo>:ref:refs/heads/main`.
+ * Pull requests carry a different `sub` (`…:pull_request`) and so cannot
+ * assume it; that is what keeps a fork's PR from deploying.
+ *
+ * The permissions live in `deploy-permissions.ts`, shared with the CodeBuild
+ * role in `pipeline-stack.ts`: both run the same deploy scripts, and two
+ * copies of that policy would drift. They are admin-equivalent in this account
+ * by design (`sts:AssumeRole` on the CDK bootstrap roles), which is why the
+ * trust policy above, not the permission policy, is the security boundary.
+ * Keep `main` protected.
+ */
+export class FoundationCi extends cdk.Stack {
+  public readonly deployRole: iam.Role;
+
+  constructor(scope: Construct, id: string, props: FoundationCiProps) {
+    super(scope, id, props);
+    const names = namesFor(props.instance);
+
+    const repository = props.repository ?? props.instance.github.repo;
+    const ids = props.repositoryIds ?? props.instance.github.repoIds;
+    const [owner, repo] = repository.split("/");
+    // Both subject shapes GitHub can issue for a push to main: the plain
+    // `owner/repo` form and the immutable-id form seen in CloudTrail
+    // (`repo:<owner>@<ownerId>/<repo>@<repoId>:ref:refs/heads/main`).
+    const mainSubjects = [
+      `repo:${repository}:ref:refs/heads/main`,
+      `repo:${owner}@${ids.owner}/${repo}@${ids.repo}:ref:refs/heads/main`,
+    ];
+
+    // The provider is account-wide and already exists (an account can hold
+    // only one per url), so it is imported, never created: CDK would fail on
+    // the duplicate and a `cdk destroy` here would take it from every other
+    // repo that trusts it.
+    const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
+      this,
+      "GitHubOidc",
+      `arn:${this.partition}:iam::${this.account}:oidc-provider/token.actions.githubusercontent.com`,
+    );
+
+    this.deployRole = new iam.Role(this, "FoundationDeployRole", {
+      roleName: names.deployRole,
+      description: `GitHub Actions deploy role for ${repository} (main only)`,
+      maxSessionDuration: cdk.Duration.hours(1),
+      assumedBy: new iam.WebIdentityPrincipal(provider.openIdConnectProviderArn, {
+        StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
+        StringLike: {
+          "token.actions.githubusercontent.com:sub": mainSubjects,
+        },
+      }),
+      inlinePolicies: {
+        FoundationDeploy: new iam.PolicyDocument({
+          statements: deployStatements(
+            this,
+            names,
+            { bucket: props.bucket, dataKey: props.dataKey },
+            props.instance,
+          ),
+        }),
+      },
+    });
+
+    new cdk.CfnOutput(this, "DeployRoleArn", { value: this.deployRole.roleArn });
+  }
+}

package/src/stacks/data-stack.ts

@@ -0,0 +1,446 @@
+import * as cdk from "aws-cdk-lib";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as kms from "aws-cdk-lib/aws-kms";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import type { Construct } from "constructs";
+import { type Instance, namesFor, provisionsIntegration } from "../names.ts";
+
+export interface FoundationDataProps extends cdk.StackProps {
+  /** The deployment this stack belongs to; every name below comes from it. */
+  instance: Instance;
+}
+
+/**
+ * FoundationData — the durable layer: one CMK, two S3 buckets (config +
+ * skills, and channel documents), two always-present DynamoDB tables, an
+ * optional CRM table, an optional proxy-only Upwork approval table, an optional
+ * retained Upwork OAuth secret, and the Secrets Manager entries.
+ * The two always-present DynamoDB tables use
+ * different access patterns: `FoundationTable` is `pk` (S) only:
+ * dedupe rows, the Codex credential lease and the thread→session index, every
+ * one of them a single-item get/put under a prefixed key
+ * (`dedupe#…`, `lease#…`, `thread#…`) — matching `DynamoLeaseBackend` and
+ * `ts/gateway/src/lambda.ts` from Plan 2. `FoundationItems` is `pk` + `sk`, for the
+ * collections the agent reads back whole: a channel's todos, a channel's
+ * routines. Those need a Query over a partition, which a table without a sort
+ * key cannot answer.
+ *
+ * Secrets: the signing, app and GitHub App entries already exist in the
+ * account (created out of band before the first deploy), so they are
+ * *imported* by name and never managed here — CDK would otherwise try to
+ * create and then own them. The remaining managed entries are created as
+ * empty shells (the generateSecretString placeholder trick) and filled in by
+ * `scripts/setup.ts`. Durable data and credential shells use RETAIN: a
+ * `cdk destroy` must never take the credentials or the table with
+ * it.
+ */
+export class FoundationData extends cdk.Stack {
+  public readonly dataKey: kms.Key;
+  public readonly bucket: s3.Bucket;
+  /** Dedicated encrypted, versioned store for durable per-channel documents. */
+  public readonly documentBucket: s3.Bucket;
+  /** S3 Files file system over the bucket's `fs/` prefix — the persistent mount. */
+  public readonly fileSystem: cdk.CfnResource;
+  /** Its single access point (POSIX 10001:10001 = the container's `sky` user). */
+  public readonly table: dynamodb.Table;
+  /** `pk` + `sk`: the agent's queryable collections (todos, routines). */
+  public readonly itemsTable: dynamodb.Table;
+  /** Dedicated profile/activity table for an enabled self-hosted CRM integration. */
+  public readonly crmTable?: dynamodb.Table;
+  /** Ephemeral proposal drafts; accessible only to the credential-isolated Upwork proxy. */
+  public readonly upworkApprovalTable?: dynamodb.Table;
+  public readonly secrets: {
+    signing: secretsmanager.ISecret;
+    slackApp: secretsmanager.ISecret;
+    githubApp: secretsmanager.ISecret;
+    codex: secretsmanager.ISecret;
+    googleAiStudio: secretsmanager.ISecret;
+    googleDrive: secretsmanager.ISecret;
+    googleCalendar: secretsmanager.ISecret;
+    googleOauth: secretsmanager.ISecret;
+    googleEmail: secretsmanager.ISecret;
+    mongodbReadonly: secretsmanager.ISecret;
+    otterApi?: secretsmanager.ISecret;
+    /** Dynamic public Knock OAuth client; no client secret is stored. */
+    knockOauthClient?: secretsmanager.ISecret;
+    /** Connected Knock OAuth credential, readable only by its fixed proxy. */
+    knockCredential?: secretsmanager.ISecret;
+    /** Combined Upwork OAuth client and token secret, provisioned only when opted in. */
+    upwork?: secretsmanager.ISecret;
+    runtime: secretsmanager.ISecret;
+  };
+
+  constructor(scope: Construct, id: string, props: FoundationDataProps) {
+    super(scope, id, props);
+    const names = namesFor(props.instance);
+    const display = props.instance.displayName;
+    // `crmStorage` is the one integration switch that is deliberately NOT the
+    // registry's `crm` flag: storage outlives the proxy so pausing the tools
+    // cannot orphan a retained table CloudFormation could not re-adopt.
+    const crmStorage = props.instance.integrations.crmStorage;
+
+    this.dataKey = new kms.Key(this, "FoundationDataKey", {
+      description: `${display} CMK for the S3 buckets, DynamoDB table and SQS queues`,
+      enableKeyRotation: true,
+      alias: names.keyAlias,
+    });
+
+    this.bucket = new s3.Bucket(this, "FoundationBucket", {
+      versioned: true,
+      encryption: s3.BucketEncryption.KMS,
+      encryptionKey: this.dataKey,
+      bucketKeyEnabled: true,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      enforceSSL: true,
+      removalPolicy: cdk.RemovalPolicy.RETAIN,
+    });
+
+    this.documentBucket = new s3.Bucket(this, "DocumentsBucket", {
+      versioned: true,
+      encryption: s3.BucketEncryption.KMS,
+      encryptionKey: this.dataKey,
+      bucketKeyEnabled: true,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      enforceSSL: true,
+      removalPolicy: cdk.RemovalPolicy.RETAIN,
+    });
+
+    this.table = new dynamodb.Table(this, "FoundationTable", {
+      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+      timeToLiveAttribute: "ttl",
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: this.dataKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      removalPolicy: cdk.RemovalPolicy.RETAIN,
+    });
+
+    this.itemsTable = new dynamodb.Table(this, "FoundationItems", {
+      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+      sortKey: { name: "sk", type: dynamodb.AttributeType.STRING },
+      timeToLiveAttribute: "ttl",
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: this.dataKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      removalPolicy: cdk.RemovalPolicy.RETAIN,
+    });
+
+    this.crmTable = crmStorage
+      ? new dynamodb.Table(this, "CrmTable", {
+          partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+          sortKey: { name: "sk", type: dynamodb.AttributeType.STRING },
+          timeToLiveAttribute: "ttl",
+          billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+          encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+          encryptionKey: this.dataKey,
+          pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+          removalPolicy: cdk.RemovalPolicy.RETAIN,
+        })
+      : undefined;
+    this.crmTable?.addGlobalSecondaryIndex({
+      indexName: "RecordsIndex",
+      partitionKey: { name: "gsi1pk", type: dynamodb.AttributeType.STRING },
+      sortKey: { name: "gsi1sk", type: dynamodb.AttributeType.STRING },
+      projectionType: dynamodb.ProjectionType.INCLUDE,
+      nonKeyAttributes: ["recordType", "recordId"],
+    });
+    this.upworkApprovalTable = provisionsIntegration(props.instance, "upwork")
+      ? new dynamodb.Table(this, "UpworkApprovalTable", {
+          partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+          timeToLiveAttribute: "ttl",
+          billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+          encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+          encryptionKey: this.dataKey,
+          pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+          removalPolicy: cdk.RemovalPolicy.DESTROY,
+        })
+      : undefined;
+
+    // An empty shell CDK is willing to synth without a real value; the real
+    // value is written out of band and survives every later deploy because
+    // CDK only manages the resource, not its current version.
+    const secretShell = (constructId: string, name: string, description: string) =>
+      new secretsmanager.Secret(this, constructId, {
+        secretName: name,
+        description,
+        removalPolicy: cdk.RemovalPolicy.RETAIN,
+        generateSecretString: {
+          secretStringTemplate: "{}",
+          generateStringKey: "placeholder",
+        },
+      });
+    // Unlike long-lived auth stores, this integration credential is destroyed
+    // with the opt-in resources. That avoids stranding a retained fixed-name
+    // secret which CloudFormation could not adopt if the integration is later
+    // re-enabled. Operators must repopulate the key after a disable/re-enable.
+    const otterApi = provisionsIntegration(props.instance, "otter")
+      ? new secretsmanager.Secret(this, "OtterApiSecret", {
+          secretName: names.secretOtterApi,
+          description: `Otter Enterprise Public API key for ${display} ({ api_key })`,
+          removalPolicy: cdk.RemovalPolicy.DESTROY,
+          generateSecretString: {
+            secretStringTemplate: "{}",
+            generateStringKey: "placeholder",
+          },
+        })
+      : undefined;
+    // Knock's public-client registration and connected credential are distinct:
+    // the deployer writes only the former, while the callback writes only the
+    // latter. Both are destroyed with the opt-in integration so a later
+    // re-enable must deliberately reconnect a tenant.
+    const knockOauthClient = provisionsIntegration(props.instance, "knock")
+      ? new secretsmanager.Secret(this, "KnockOauthClientSecret", {
+          secretName: names.secretKnockOauthClient,
+          description: `Knock public OAuth client for ${display} ({ client_id, redirect_uri })`,
+          removalPolicy: cdk.RemovalPolicy.DESTROY,
+          generateSecretString: {
+            secretStringTemplate: "{}",
+            generateStringKey: "placeholder",
+          },
+        })
+      : undefined;
+    const knockCredential = provisionsIntegration(props.instance, "knock")
+      ? new secretsmanager.Secret(this, "KnockCredentialSecret", {
+          secretName: names.secretKnockCredential,
+          description: `Knock OAuth credential for ${display}; callback writes and proxy alone reads`,
+          removalPolicy: cdk.RemovalPolicy.DESTROY,
+          generateSecretString: {
+            secretStringTemplate: "{}",
+            generateStringKey: "placeholder",
+          },
+        })
+      : undefined;
+
+    // Unlike the disposable Otter API key, the Upwork OAuth secret carries
+    // client credentials plus refresh state. Retaining it makes a deploy safe
+    // and leaves manually entered client credentials intact.
+    const upwork = provisionsIntegration(props.instance, "upwork")
+      ? secretShell(
+          "UpworkSecret",
+          names.secretUpwork,
+          `Upwork OAuth client and token store for ${display} ({ client_id, client_secret, access_token?, refresh_token?, expires_at?, tenant_id? })`,
+        )
+      : undefined;
+
+    this.secrets = {
+      // Already created out of band — import, never manage.
+      signing: secretsmanager.Secret.fromSecretNameV2(
+        this,
+        "SlackSigningSecret",
+        names.secretSlackSigning,
+      ),
+      slackApp: secretsmanager.Secret.fromSecretNameV2(
+        this,
+        "SlackAppSecret",
+        names.secretSlackApp,
+      ),
+      githubApp: secretsmanager.Secret.fromSecretNameV2(
+        this,
+        "GithubAppSecret",
+        names.secretGithubApp,
+      ),
+      codex: secretShell(
+        "CodexSecret",
+        names.secretCodex,
+        "OpenAI Codex credential store (rotated tokens are written back here)",
+      ),
+      // The image-generation key. A placeholder is fine: the container reads
+      // it lazily, so `generate_image` reports "not configured" until the
+      // real value is written out of band.
+      googleAiStudio: new secretsmanager.Secret(this, "GoogleAiStudioSecret", {
+        secretName: names.secretGoogleAiStudio,
+        encryptionKey: this.dataKey,
+        description: "Google AI Studio API key for image generation ({ api_key })",
+        removalPolicy: cdk.RemovalPolicy.RETAIN,
+        generateSecretString: {
+          secretStringTemplate: "{}",
+          generateStringKey: "placeholder",
+        },
+      }),
+      googleDrive: new secretsmanager.Secret(this, "GoogleDriveSecret", {
+        secretName: names.secretGoogleDrive,
+        encryptionKey: this.dataKey,
+        description: `Google Drive service identity: the company-owned Drive account ${display} reads as. JSON { client_email, private_key, token_uri? }, optionally nested under identities.default. Access is granted by sharing files/folders with client_email; scope is read-only.`,
+        removalPolicy: cdk.RemovalPolicy.RETAIN,
+        generateSecretString: {
+          secretStringTemplate: "{}",
+          generateStringKey: "placeholder",
+        },
+      }),
+      // The Google Calendar OAuth *client* — never a person's refresh token,
+      // which lives per-user in `FoundationItems`. A placeholder is fine: both the
+      // agent and the gateway treat an unparseable value as "capability not
+      // configured" rather than a boot failure.
+      googleCalendar: secretShell(
+        "GoogleCalendarSecret",
+        names.secretGoogleCalendar,
+        `Google Calendar OAuth client for ${display}'s per-person calendar connections`,
+      ),
+      // The connected mailbox. Written by the gateway's OAuth callback and
+      // read by the EMAIL PROXY LAMBDA'S ROLE ALONE — the agent execution role
+      // carries an explicit Deny on it, which is what makes it true that no
+      // credential able to send mail exists inside the container.
+      googleEmail: secretShell(
+        "GoogleEmailSecret",
+        names.secretGoogleEmail,
+        `Gmail identity for ${display}, connected from Slack — written by the gateway, read only by the email proxy`,
+      ),
+      // The read-only Atlas connection string, `{ uri, databases? }`. A
+      // placeholder is fine and is what ships: the agent reads it on first
+      // tool use, so an unfilled secret means "no MongoDB", not a boot error.
+      mongodbReadonly: new secretsmanager.Secret(this, "MongodbReadonlySecret", {
+        secretName: names.secretMongodbReadonly,
+        encryptionKey: this.dataKey,
+        description: `Read-only MongoDB Atlas credential for ${display}. JSON { uri, databases? } where uri authenticates an Atlas user provisioned with the \`read\` role, and databases (optional) narrows which databases the agent may name.`,
+        removalPolicy: cdk.RemovalPolicy.RETAIN,
+        generateSecretString: {
+          secretStringTemplate: "{}",
+          generateStringKey: "placeholder",
+        },
+      }),
+      ...(otterApi === undefined ? {} : { otterApi }),
+      ...(knockOauthClient === undefined ? {} : { knockOauthClient }),
+      ...(knockCredential === undefined ? {} : { knockCredential }),
+      ...(upwork === undefined ? {} : { upwork }),
+      // The OAuth client every Google capability shares: Calendar builds a
+      // per-person consent link with it, Drive connects the company identity
+      // with it. Never a refresh token. A placeholder is fine — an unparseable
+      // value reads as "not configured", not as a boot failure.
+      googleOauth: secretShell(
+        "GoogleOauthSecret",
+        names.secretGoogleOauth,
+        `Google OAuth client shared by ${display}'s Google capabilities ({ client_id, client_secret, redirect_uri })`,
+      ),
+      runtime: secretShell(
+        "RuntimeSecret",
+        names.secretRuntime,
+        "Agent runtime env map, written by scripts/setup.ts after deploy",
+      ),
+    };
+
+    this.fileSystem = this.buildFileSystem(display);
+
+    new cdk.CfnOutput(this, "FoundationFileSystemId", {
+      value: this.fileSystem.getAtt("FileSystemId").toString(),
+    });
+    new cdk.CfnOutput(this, "BucketName", { value: this.bucket.bucketName });
+    new cdk.CfnOutput(this, "DocumentsBucketName", { value: this.documentBucket.bucketName });
+    new cdk.CfnOutput(this, "TableName", { value: this.table.tableName });
+    new cdk.CfnOutput(this, "ItemsTableName", { value: this.itemsTable.tableName });
+  }
+
+  /**
+   * The S3 Files file system that backs `/mnt/sky` in the agent container.
+   *
+   * It is a *view* of this bucket under the `fs/` prefix, so learned skills
+   * and caches are ordinary S3 objects an operator can list and read — that
+   * visibility is the whole reason S3 Files was chosen over EFS. The service
+   * reaches the bucket as its own role, not as the caller's, hence the
+   * service role below; `AcceptBucketWarning` is the acknowledgement that
+   * other writers to the same prefix could confuse the file-system view
+   * (nothing else writes under `fs/`).
+   */
+  private buildFileSystem(display: string): cdk.CfnResource {
+    const role = new iam.Role(this, "S3FilesServiceRole", {
+      description: `S3 Files service role for the ${display} persistent mount`,
+      // S3 Files runs on the EFS control plane: the documented trust principal is
+      // elasticfilesystem.amazonaws.com, scoped to this account's s3files file systems
+      // (docs: AmazonS3/latest/userguide/s3-files-prereq-policies.html).
+      assumedBy: new iam.ServicePrincipal("elasticfilesystem.amazonaws.com", {
+        conditions: {
+          StringEquals: { "aws:SourceAccount": this.account },
+          ArnLike: {
+            "aws:SourceArn": `arn:${this.partition}:s3files:${this.region}:${this.account}:file-system/*`,
+          },
+        },
+      }),
+    });
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "MountObjects",
+        actions: [
+          "s3:AbortMultipartUpload",
+          "s3:DeleteObject*",
+          "s3:GetObject*",
+          "s3:List*",
+          "s3:PutObject*",
+        ],
+        resources: [this.bucket.arnForObjects("fs/*")],
+      }),
+    );
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "MountBucket",
+        actions: [
+          "s3:ListBucket",
+          "s3:ListBucketVersions",
+          "s3:GetBucketLocation",
+          "s3:ListBucketMultipartUploads",
+        ],
+        resources: [this.bucket.bucketArn],
+      }),
+    );
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "MountKeyUsage",
+        actions: [
+          "kms:Decrypt",
+          "kms:Encrypt",
+          "kms:GenerateDataKey*",
+          "kms:ReEncryptFrom",
+          "kms:ReEncryptTo",
+          "kms:DescribeKey",
+        ],
+        resources: [this.dataKey.keyArn],
+      }),
+    );
+    // S3 Files manages EventBridge rules for bucket→file-system synchronization.
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "EventBridgeManage",
+        actions: [
+          "events:DeleteRule",
+          "events:DisableRule",
+          "events:EnableRule",
+          "events:PutRule",
+          "events:PutTargets",
+          "events:RemoveTargets",
+        ],
+        resources: [`arn:${this.partition}:events:*:*:rule/DO-NOT-DELETE-S3-Files*`],
+        conditions: { StringEquals: { "events:ManagedBy": "elasticfilesystem.amazonaws.com" } },
+      }),
+    );
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "EventBridgeRead",
+        actions: [
+          "events:DescribeRule",
+          "events:ListRuleNamesByTarget",
+          "events:ListRules",
+          "events:ListTargetsByRule",
+        ],
+        resources: [`arn:${this.partition}:events:*:*:rule/*`],
+      }),
+    );
+
+    const fileSystem = new cdk.CfnResource(this, "FoundationFileSystem", {
+      type: "AWS::S3Files::FileSystem",
+      properties: {
+        Bucket: this.bucket.bucketArn,
+        Prefix: "fs/",
+        KmsKeyId: this.dataKey.keyArn,
+        RoleArn: role.roleArn,
+        AcceptBucketWarning: true,
+      },
+    });
+    fileSystem.node.addDependency(role);
+    // Same reasoning as the bucket: a `cdk destroy` must not take the
+    // learned skills with it. The objects survive regardless, but the
+    // file-system view is what makes them a mount.
+    fileSystem.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);
+    return fileSystem;
+  }
+}