@deployfoundation/foundation-deploy 0.2.11 → 0.2.14

package/dist/bin/app.js

@@ -7,12 +7,12 @@ import {
   FoundationNetwork,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-sxvts8bf.js";
+} from "../chunk-83781ggk.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile
-} from "../chunk-n8qzcdq4.js";
+} from "../chunk-7qn00ny1.js";
 
 // bin/app.ts
 import { execFileSync } from "node:child_process";

package/dist/bin/foundation-deploy.js

@@ -29,7 +29,7 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-2kqazxx6.js";
+} from "../chunk-e9vs85ah.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -45,7 +45,7 @@ import {
   requiredSlackScopes,
   skillsKey,
   slackCommandPrefix
-} from "../chunk-n8qzcdq4.js";
+} from "../chunk-7qn00ny1.js";
 
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
@@ -1522,8 +1522,7 @@ function spansIngestionPolicy(account, region) {
     Version: "2012-10-17",
     Statement: [
       statement("SpansFromXray", "aws/spans"),
-      statement("ApplicationSignalsFromXray", "/aws/application-signals/data"),
-      statement("AgentCoreRuntimeSpansFromXray", "/aws/bedrock-agentcore/runtimes/*")
+      statement("ApplicationSignalsFromXray", "/aws/application-signals/data")
     ]
   });
 }
@@ -1538,7 +1537,7 @@ function hasSpansIngestionPolicy(describeOutput) {
     return false;
   return policies.some((p) => {
     const doc = String(p.policyDocument ?? "");
-    return doc.includes("aws/spans") && doc.includes("logs:CreateLogStream") && doc.includes("/aws/bedrock-agentcore/runtimes/");
+    return doc.includes("aws/spans") && doc.includes("logs:CreateLogStream");
   });
 }
 function parseDestination(text) {

package/dist/bin/release-account.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-2kqazxx6.js";
-import"../chunk-n8qzcdq4.js";
+} from "../chunk-e9vs85ah.js";
+import"../chunk-7qn00ny1.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-n8qzcdq4.js → chunk-7qn00ny1.js}

@@ -572,6 +572,14 @@ var RawProactive = z2.object({
   channels: z2.array(z2.string().regex(/^[CG][A-Z0-9]{8,}$/)).default([]),
   maxPerHour: z2.number().int().min(1).max(500).default(20)
 }).strict().default({ channels: [] });
+var RawRuntime = z2.object({
+  idleTimeoutMinutes: z2.number().int().min(5).max(480).default(15),
+  maxLifetimeHours: z2.number().int().min(1).max(8).default(8)
+}).strict().default({});
+var RawNetwork = z2.object({
+  natGateways: z2.union([z2.literal(1), z2.literal(2)]).default(1),
+  endpointAzs: z2.union([z2.literal(1), z2.literal(2)]).default(1)
+}).strict().default({});
 var RawNaming = z2.object({
   prefix: z2.string().min(1).max(32).regex(/^[A-Z][A-Za-z0-9]*$/),
   secretPrefix: z2.string().min(1).max(40).regex(/^[a-z][a-z0-9-]*$/),
@@ -711,6 +719,8 @@ var RawInstance = z2.object({
   license: RawLicense.optional(),
   config: z2.string().min(1),
   proactive: RawProactive,
+  runtime: RawRuntime,
+  network: RawNetwork,
   integrations: RawIntegrations,
   newsletter: RawNewsletter
 }).strict().superRefine((doc, ctx) => {

package/dist/{chunk-sxvts8bf.js → chunk-83781ggk.js}

@@ -19,12 +19,13 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-n8qzcdq4.js";
+} from "./chunk-7qn00ny1.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
 import * as ecr from "aws-cdk-lib/aws-ecr";
 import * as iam from "aws-cdk-lib/aws-iam";
+import * as logs from "aws-cdk-lib/aws-logs";
 class FoundationAgent extends cdk.Stack {
   repository;
   executionRole;
@@ -67,6 +68,7 @@ class FoundationAgent extends cdk.Stack {
     this.accessPoint = accessPoint;
     this.executionRole = this.buildExecutionRole(props);
     this.readOnlyRole = this.buildReadOnlyRole(props);
+    this.buildSpansIngestionPolicy();
     const gateway = this.buildToolGateway(display);
     this.webSearchUrl = gateway.getAtt("GatewayUrl").toString();
     this.executionRole.addToPolicy(new iam.PolicyStatement({
@@ -118,8 +120,8 @@ class FoundationAgent extends cdk.Stack {
           }
         ],
         LifecycleConfiguration: {
-          IdleRuntimeSessionTimeout: 3600,
-          MaxLifetime: 28800
+          IdleRuntimeSessionTimeout: props.instance.runtime.idleTimeoutMinutes * 60,
+          MaxLifetime: props.instance.runtime.maxLifetimeHours * 3600
         },
         RoleArn: this.executionRole.roleArn,
         EnvironmentVariables: {
@@ -318,6 +320,27 @@ class FoundationAgent extends cdk.Stack {
     }));
     return role;
   }
+  buildSpansIngestionPolicy() {
+    return new logs.ResourcePolicy(this, "AgentSpansIngestion", {
+      resourcePolicyName: `${this.stackName}-AgentSpansFromXray`,
+      policyStatements: [
+        new iam.PolicyStatement({
+          sid: "AgentSpansFromXray",
+          principals: [new iam.ServicePrincipal("xray.amazonaws.com")],
+          actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
+          resources: [
+            `arn:${this.partition}:logs:${this.region}:${this.account}:log-group:/aws/bedrock-agentcore/runtimes/${this.names.runtimeName}-*:*`
+          ],
+          conditions: {
+            StringEquals: { "aws:SourceAccount": this.account },
+            ArnLike: {
+              "aws:SourceArn": `arn:${this.partition}:xray:${this.region}:${this.account}:*`
+            }
+          }
+        })
+      ]
+    });
+  }
   buildExecutionRole(props) {
     const role = new iam.Role(this, "AgentExecutionRole", {
       assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),
@@ -2043,7 +2066,7 @@ class FoundationNetwork extends cdk5.Stack {
     } else {
       this.vpc = new ec2.Vpc(this, "FoundationVpc", {
         maxAzs: 2,
-        natGateways: 2,
+        natGateways: props.instance.network.natGateways,
         subnetConfiguration: [
           { name: "ingress", subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
           { name: "egress", subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
@@ -2088,7 +2111,12 @@ class FoundationNetwork extends cdk5.Stack {
     });
     endpointSg.addIngressRule(ec2.Peer.ipv4(this.vpc.vpcCidrBlock), ec2.Port.tcp(443), "HTTPS from VPC");
     this.endpointSecurityGroup = endpointSg;
-    const endpointSubnets = importedVpcId ? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS } : { subnetGroupName: "app" };
+    const endpointSubnets = importedVpcId ? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, onePerAz: true } : { subnetGroupName: "app", onePerAz: true };
+    if (props.instance.network.endpointAzs === 1) {
+      const zones = this.vpc.selectSubnets(endpointSubnets).availabilityZones;
+      if (zones.length > 1)
+        Object.assign(endpointSubnets, { availabilityZones: [zones[0]] });
+    }
     const gatewayEndpointSubnets = importedVpcId ? [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }] : [{ subnetGroupName: "app" }, { subnetGroupName: "egress" }];
     const sameAccountOnly = new iam6.PolicyStatement({
       effect: iam6.Effect.ALLOW,

package/dist/{chunk-2kqazxx6.js → chunk-e9vs85ah.js}

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-n8qzcdq4.js";
+} from "./chunk-7qn00ny1.js";
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";

package/dist/src/index.js

@@ -9,7 +9,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-sxvts8bf.js";
+} from "../chunk-83781ggk.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -42,7 +42,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-n8qzcdq4.js";
+} from "../chunk-7qn00ny1.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.11",
+  "version": "0.2.14",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/tracing.ts

@@ -82,11 +82,12 @@ export function spansIngestionPolicy(account: string, region: string): string {
     Statement: [
       statement("SpansFromXray", "aws/spans"),
       statement("ApplicationSignalsFromXray", "/aws/application-signals/data"),
-      // The agent names its OWN runtime log group in `x-aws-log-group`, and
-      // X-Ray delivers there too: without this, exports fail with "not
-      // authorized to perform logs:PutLogEvents on /aws/bedrock-agentcore/
-      // runtimes/<runtime>-live" (2026-09-07).
-      statement("AgentCoreRuntimeSpansFromXray", "/aws/bedrock-agentcore/runtimes/*"),
+      // NOT the runtime's own log group, which is where the agent's spans
+      // actually go (`x-aws-log-group`): that grant is per instance and ships
+      // with every deploy as the agent stack's `AgentSpansIngestion` policy.
+      // Owning it here made it a one-time `setup` side effect, and an instance
+      // that reached its account by `deploy` alone never got it — every export
+      // a 400 (Olivia, 2026-09-26).
     ],
   });
 }
@@ -102,11 +103,7 @@ export function hasSpansIngestionPolicy(describeOutput: string): boolean {
   if (!Array.isArray(policies)) return false;
   return policies.some((p) => {
     const doc = String((p as { policyDocument?: unknown }).policyDocument ?? "");
-    return (
-      doc.includes("aws/spans") &&
-      doc.includes("logs:CreateLogStream") &&
-      doc.includes("/aws/bedrock-agentcore/runtimes/")
-    );
+    return doc.includes("aws/spans") && doc.includes("logs:CreateLogStream");
   });
 }
 

package/src/stacks/agent-stack.ts

@@ -4,6 +4,7 @@ import type * as ec2 from "aws-cdk-lib/aws-ec2";
 import * as ecr from "aws-cdk-lib/aws-ecr";
 import * as iam from "aws-cdk-lib/aws-iam";
 import type * as kms from "aws-cdk-lib/aws-kms";
+import * as logs from "aws-cdk-lib/aws-logs";
 import type * as s3 from "aws-cdk-lib/aws-s3";
 import type * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import type { Construct } from "constructs";
@@ -147,6 +148,7 @@ export class FoundationAgent extends cdk.Stack {
     this.accessPoint = accessPoint;
     this.executionRole = this.buildExecutionRole(props);
     this.readOnlyRole = this.buildReadOnlyRole(props);
+    this.buildSpansIngestionPolicy();
 
     // The gateway is independent of the runtime: it can (and does) exist
     // during the phase-one bootstrap deploy.
@@ -227,9 +229,11 @@ export class FoundationAgent extends cdk.Stack {
             },
           },
         ],
+        // Idle sessions are billed for their memory: see `runtime` in the
+        // instance schema for why the default is 15 minutes, not 60.
         LifecycleConfiguration: {
-          IdleRuntimeSessionTimeout: 3600,
-          MaxLifetime: 28800,
+          IdleRuntimeSessionTimeout: props.instance.runtime.idleTimeoutMinutes * 60,
+          MaxLifetime: props.instance.runtime.maxLifetimeHours * 3600,
         },
         RoleArn: this.executionRole.roleArn,
         EnvironmentVariables: {
@@ -521,6 +525,48 @@ export class FoundationAgent extends cdk.Stack {
     return role;
   }
 
+  /**
+   * Let X-Ray write this runtime's spans into the runtime's own log group.
+   *
+   * The agent posts OTLP to the X-Ray endpoint with `x-aws-log-group` naming
+   * `/aws/bedrock-agentcore/runtimes/<runtime>-<endpoint>` (see
+   * `packages/agent/src/observability/otel.ts`). X-Ray, not the execution
+   * role, then calls `PutLogEvents` — as a role in an AWS service account —
+   * so the execution role's `AgentLogs` grant does not apply, and without a
+   * CloudWatch Logs RESOURCE policy every export is a 400 "not authorized to
+   * perform: logs:PutLogEvents" (Olivia, 2026-09-26). AWS: "If you set
+   * OTEL_EXPORTER_OTLP_TRACES_HEADERS to deliver spans to your own log group,
+   * you must also add an Amazon CloudWatch Logs resource policy … allow X-Ray
+   * (xray.amazonaws.com) to call logs:PutLogEvents on that log group"
+   * (bedrock-agentcore devguide, observability-configure).
+   *
+   * Logs resource policies are account-level (ten per Region), so the name is
+   * the stack's own and the grant covers only this runtime's endpoint groups,
+   * and only when X-Ray acts for this account. `CreateLogStream` rides along
+   * because X-Ray creates the `spans` stream on first delivery.
+   */
+  private buildSpansIngestionPolicy(): logs.ResourcePolicy {
+    return new logs.ResourcePolicy(this, "AgentSpansIngestion", {
+      resourcePolicyName: `${this.stackName}-AgentSpansFromXray`,
+      policyStatements: [
+        new iam.PolicyStatement({
+          sid: "AgentSpansFromXray",
+          principals: [new iam.ServicePrincipal("xray.amazonaws.com")],
+          actions: ["logs:PutLogEvents", "logs:CreateLogStream"],
+          resources: [
+            `arn:${this.partition}:logs:${this.region}:${this.account}:log-group:/aws/bedrock-agentcore/runtimes/${this.names.runtimeName}-*:*`,
+          ],
+          conditions: {
+            StringEquals: { "aws:SourceAccount": this.account },
+            ArnLike: {
+              "aws:SourceArn": `arn:${this.partition}:xray:${this.region}:${this.account}:*`,
+            },
+          },
+        }),
+      ],
+    });
+  }
+
   private buildExecutionRole(props: FoundationAgentProps): iam.Role {
     const role = new iam.Role(this, "AgentExecutionRole", {
       assumedBy: new iam.ServicePrincipal("bedrock-agentcore.amazonaws.com"),
@@ -572,9 +618,10 @@ export class FoundationAgent extends cdk.Stack {
         ],
       }),
     );
-    // Spans: the runtime SigV4-posts OTLP to the X-Ray endpoint, which routes
-    // them into the log group `AgentLogs` above already covers. None of these
-    // actions take a resource ARN — X-Ray scopes ingestion by account.
+    // Spans: the runtime SigV4-posts OTLP to the X-Ray endpoint. These actions
+    // only let it call X-Ray (none takes a resource ARN — X-Ray scopes
+    // ingestion by account); X-Ray's own write into the runtime log group is
+    // authorized by `AgentSpansIngestion`, not by `AgentLogs` above.
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "TraceIngest",

package/src/stacks/network-stack.ts

@@ -70,9 +70,9 @@ export class FoundationNetwork extends cdk.Stack {
     } else {
       this.vpc = new ec2.Vpc(this, "FoundationVpc", {
         maxAzs: 2,
-        // One NAT per AZ: the Slack ack / chat.update path must survive a
-        // single-AZ failure.
-        natGateways: 2,
+        // One NAT by default: a second (AZ-failure tolerance for egress) is
+        // about $33/month, opted into with `network.natGateways: 2`.
+        natGateways: props.instance.network.natGateways,
         subnetConfiguration: [
           { name: "ingress", subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
           { name: "egress", subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
@@ -82,7 +82,7 @@ export class FoundationNetwork extends cdk.Stack {
       this.egressSubnets = { subnetGroupName: "egress" };
       // The addresses everything in the VPC leaves through, so a third party
       // (an Atlas IP allowlist, say) can name this instance and no other.
-      // One per AZ, matching `natGateways: 2` above.
+      // One per NAT gateway (`network.natGateways`).
       new cdk.CfnOutput(this, "NatEgressIp", {
         value: cdk.Fn.join(
           ",",
@@ -191,9 +191,16 @@ export class FoundationNetwork extends cdk.Stack {
     // Interface endpoints sit in the isolated app tier when we created the
     // VPC; on an imported VPC they land in its private subnets. Private DNS
     // makes them authoritative for the whole VPC either way.
+    // One AZ by default (`network.endpointAzs`): the other AZ reaches the
+    // same endpoint through private DNS, for a little cross-AZ traffic
+    // instead of a second set of endpoint-hours.
     const endpointSubnets: ec2.SubnetSelection = importedVpcId
-      ? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }
-      : { subnetGroupName: "app" };
+      ? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, onePerAz: true }
+      : { subnetGroupName: "app", onePerAz: true };
+    if (props.instance.network.endpointAzs === 1) {
+      const zones = this.vpc.selectSubnets(endpointSubnets).availabilityZones;
+      if (zones.length > 1) Object.assign(endpointSubnets, { availabilityZones: [zones[0]] });
+    }
     // Gateway endpoints attach to every private route table (app + egress) so
     // S3/DynamoDB traffic from the NAT tier also stays on AWS's network.
     const gatewayEndpointSubnets: ec2.SubnetSelection[] = importedVpcId