@deployfoundation/foundation-deploy 0.2.1 → 0.2.2

package/dist/bin/app.js

@@ -7,7 +7,7 @@ import {
   FoundationNetwork,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-paf33z2h.js";
+} from "../chunk-q9sxg76n.js";
 import {
   adminsFor,
   instanceNames,

package/dist/{chunk-paf33z2h.js → chunk-q9sxg76n.js}

@@ -1138,6 +1138,11 @@ class FoundationApi extends cdk2.Stack {
         actions: ["dynamodb:Query"],
         resources: [crmTable.tableArn, `${crmTable.tableArn}/index/RecordsIndex`]
       }));
+      crmProxyRole.addToPolicy(new iam2.PolicyStatement({
+        sid: "CrmTableKey",
+        actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+        resources: [(crmTable.encryptionKey ?? props.dataKey).keyArn]
+      }));
       this.crmProxyFunction = new lambda.Function(this, "CrmProxyFunction", {
         functionName: names.crmProxyFunctionName,
         runtime: lambda.Runtime.NODEJS_22_X,

package/dist/src/index.js

@@ -9,7 +9,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-paf33z2h.js";
+} from "../chunk-q9sxg76n.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/stacks/api-stack.ts

@@ -852,6 +852,16 @@ export class FoundationApi extends cdk.Stack {
           resources: [crmTable.tableArn, `${crmTable.tableArn}/index/RecordsIndex`],
         }),
       );
+      // The table is encrypted with the instance's data key, so every read and
+      // write needs it. Without this grant each call failed as `proxy_error`
+      // (KMS AccessDenied) the first time a deployment actually used its CRM.
+      crmProxyRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "CrmTableKey",
+          actions: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey"],
+          resources: [(crmTable.encryptionKey ?? props.dataKey).keyArn],
+        }),
+      );
       this.crmProxyFunction = new lambda.Function(this, "CrmProxyFunction", {
         functionName: names.crmProxyFunctionName,
         runtime: lambda.Runtime.NODEJS_22_X,