@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/generators/slice/built-in-plan-infrastructure-files.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductInfrastructureFiles = renderProductInfrastructureFiles;
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 /** @internal */
-function renderProductInfrastructureFiles(name, pascalName, workspace) {
+function renderProductInfrastructureFiles(name, pascalName, workspace, protectedRuntimeStages = ['staging', 'production']) {
     const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
     const recordExportWorkflowName = (0, built_in_plan_shared_js_1.stableGeneratedName)(40, name);
     return {
@@ -434,22 +434,79 @@ export function removeFinderMetadataFromBuiltFunction(rootPath: string): number
   }
   return removedFinderMetadata;
 }
+`,
+        'infra/deployment-receipt.ts': `export interface SuccessfulDeploymentReceiptExpectation {
+  account: string;
+  project: string;
+  region: string;
+  sourceCommit: string;
+  stage: 'development' | 'staging' | 'production';
+}
+
+export function validateSuccessfulDeploymentReceipt(
+  value: unknown,
+  expected: SuccessfulDeploymentReceiptExpectation,
+) {
+  const receipt = value as {
+    account?: unknown;
+    authority?: unknown;
+    children?: Array<{
+      outcome?: unknown;
+      project?: unknown;
+      target?: unknown;
+    }>;
+    kind?: unknown;
+    migrations?: Record<string, unknown>;
+    outcome?: unknown;
+    profile?: unknown;
+    region?: unknown;
+    schemaVersion?: unknown;
+    smoke?: Record<string, unknown>;
+    source?: { clean?: unknown; commit?: unknown };
+    stage?: unknown;
+  };
+  const deploymentChildren = Array.isArray(receipt?.children)
+    ? receipt.children.filter(
+        ({ outcome, project, target }) =>
+          outcome === 'succeeded' &&
+          project === expected.project &&
+          target === 'deploy',
+      )
+    : [];
+  if (
+    receipt?.kind !== 'ebk-deployment-receipt' ||
+    receipt.schemaVersion !== 1 ||
+    receipt.outcome !== 'succeeded' ||
+    !['local', 'github'].includes(String(receipt.authority)) ||
+    !['starter', 'production-isolated', 'fully-isolated'].includes(
+      String(receipt.profile),
+    ) ||
+    receipt.account !== expected.account ||
+    receipt.region !== expected.region ||
+    receipt.stage !== expected.stage ||
+    receipt.source?.clean !== true ||
+    receipt.source.commit !== expected.sourceCommit ||
+    !Array.isArray(receipt.children) ||
+    receipt.children.some(({ outcome }) => outcome !== 'succeeded') ||
+    deploymentChildren.length !== 1 ||
+    receipt.migrations?.[expected.project] !== 'completed-by-deploy-target' ||
+    receipt.smoke?.[expected.project] !== 'passed'
+  ) {
+    throw new Error(
+      'Protected performance load requires one successful exact-source native deployment receipt.',
+    );
+  }
+  return Object.freeze(receipt);
+}
 `,
         'infra/product.ts': `import {
   createManagedLogGroupContract,
   createRouterOriginProofInjection,
   provisionDatabaseBindings,
 } from '@empire-builder-kit/nx/foundation';
-import { validateReleaseManifest } from '@empire-builder-kit/nx/release';
 import * as random from '@pulumi/random';
 import { createHash } from 'node:crypto';
-import {
-  lstatSync,
-  readFileSync,
-  readdirSync,
-  realpathSync,
-} from 'node:fs';
-import { fileURLToPath } from 'node:url';
+import { readFileSync } from 'node:fs';
 import {
   ${identifierPrefix}CleanupRecordExport,
   ${identifierPrefix}DatabaseHealth,
@@ -488,11 +545,12 @@ import {
 } from './foundation.js';
 import { createVpcRouteFunctionMaterializer } from './route-function-materialization.js';
 import { removeFinderMetadataFromBuiltFunction } from './next-build-authority.js';
+import {
+  createStandardSliceNativeRuntimeAuthority,
+} from './native-runtime-authority/index.js';
 import {
   standardSliceDatabaseTaskFamily,
-  standardSliceResourceNames,
-} from './workload-roles/effective-intent.js';
-import type { StandardSliceWorkloadRolePreflight } from './workload-roles/preflight.js';
+} from './native-runtime-authority/effective-intent.js';
 import { createStandardSliceSecretLinks } from './personal-secrets.js';
 import { create${pascalName}PerformanceCostControls } from './performance-cost-controls.js';
 import {
@@ -506,6 +564,7 @@ import { resolveStandardContainerImage } from './container-images.js';
 import {
   defineEventConsumerAlarms,
 } from '@empire-builder-kit/runtime/observability';
+import { validateSuccessfulDeploymentReceipt } from './deployment-receipt.js';
 // <ebk:composition-imports:start>
 // <ebk:composition-imports:end>
 
@@ -520,11 +579,12 @@ function protectedPerformanceDeploymentAuthority(input: {
     );
   }
   if (input.enabled === 'false') return undefined;
-  if (input.stage !== 'staging' && input.stage !== 'production') {
+  if (!${JSON.stringify(protectedRuntimeStages)}.includes(input.stage)) {
     throw new Error(
-      'Protected performance load can be deployed only to staging or production.',
+      'Protected performance load requires one active rehearsal or production stage.',
     );
   }
+  const stage = input.stage as 'development' | 'production' | 'staging';
   const accountId = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
   const region = process.env.AWS_REGION?.trim() ?? '';
   if (
@@ -560,60 +620,38 @@ function protectedPerformanceDeploymentAuthority(input: {
       'Protected performance load requires the exact deployed release candidate.',
     );
   }
-  const releaseManifestDirectory = new URL(
-    '../.ebk/evidence/release-manifests/',
-    import.meta.url,
-  );
-  const releaseManifestNames = readdirSync(releaseManifestDirectory).filter(
-    (entry) => /^release-[a-f0-9]{24}[.]json$/.test(entry),
-  );
-  if (releaseManifestNames.length !== 1) {
-    throw new Error(
-      'Protected performance load requires one exact deployed release manifest.',
-    );
-  }
-  const releaseManifestUrl = new URL(
-    releaseManifestNames[0]!,
-    releaseManifestDirectory,
+  const deploymentReceiptBytes = readFileSync(
+    new URL(
+      '../../../.ebk/evidence/deployment/latest.json',
+      import.meta.url,
+    ),
   );
-  const releaseManifestPath = fileURLToPath(releaseManifestUrl);
-  const releaseManifestMetadata = lstatSync(releaseManifestPath);
-  if (
-    !releaseManifestMetadata.isFile() ||
-    releaseManifestMetadata.isSymbolicLink() ||
-    releaseManifestMetadata.size <= 0 ||
-    releaseManifestMetadata.size > 10 * 1024 * 1024 ||
-    realpathSync(releaseManifestPath) !== releaseManifestPath
-  ) {
-    throw new Error(
-      'Protected performance load release manifest is not one bounded canonical file.',
-    );
-  }
-  const releaseManifest = validateReleaseManifest(
-    JSON.parse(readFileSync(releaseManifestPath, 'utf8')),
+  validateSuccessfulDeploymentReceipt(
+    JSON.parse(deploymentReceiptBytes.toString('utf8')),
     {
-      requireSupplyChain: true,
+      account: accountId,
+      project: '${name}',
+      region,
       sourceCommit: input.releaseSourceCommit,
+      stage,
     },
   );
-  if (releaseManifestNames[0] !== releaseManifest.releaseId + '.json') {
-    throw new Error(
-      'Protected performance load release manifest path differs from its identity.',
-    );
-  }
+  const deploymentReceiptDigest = createHash('sha256')
+    .update(deploymentReceiptBytes)
+    .digest('hex');
   return Object.freeze({
     candidateDigest: createHash('sha256')
       .update(candidateBytes)
       .digest('hex'),
-    releaseId: releaseManifest.releaseId,
-    releaseMaterialDigest: releaseManifest.materialDigest,
+    releaseId: 'release-' + deploymentReceiptDigest.slice(0, 24),
+    releaseMaterialDigest: deploymentReceiptDigest,
     target: Object.freeze({
       accountFingerprint:
         'sha256:' +
         createHash('sha256').update(accountId, 'utf8').digest('hex'),
       region,
       slice: '${name}',
-      stage: input.stage as 'production' | 'staging',
+      stage,
     }),
   });
 }
@@ -724,19 +762,11 @@ function lambdaLogging(logGroupName: any, functionName?: any) {
   };
 }
 
-export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
-  if (!$dev && !workloadRoles) {
-    throw new Error(
-      'Protected workload-role preflight must complete before infrastructure construction.',
-    );
-  }
-  const workloadRoleBindings = workloadRoles?.bindings;
+export function product() {
   const asyncAdaptersConfigured = assertAsyncAdapterDeploymentReady();
-  const secretLinks = createStandardSliceSecretLinks({
-    protectedAccess: workloadRoles?.secretAccess,
-  });
+  const secretLinks = createStandardSliceSecretLinks();
   const performanceHmacLogicalName =
-    '${pascalName}PerformanceLoadHmacKeys';
+    'GeneratedPerformanceLoadHmacKeys';
   const secretLinksFor = (
     resource: string,
     excludeLogicalNames: readonly string[] = [],
@@ -749,21 +779,6 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   ];
   // Workload generators compose multi-role secret bindings through this seam.
   void secretLinksForWorkloads;
-  const workloadRoleResourceNames = workloadRoles
-    ? standardSliceResourceNames(workloadRoles.intentContext)
-    : undefined;
-  if (workloadRoleResourceNames) {
-    $transform(aws.dynamodb.Table, (args: any, _opts: any, logicalName: string) => {
-      if (logicalName === '${pascalName}WebRevalidationTable') {
-        args.name = workloadRoleResourceNames.webRevalidationTable;
-      }
-    });
-    $transform(aws.sqs.Queue, (args: any, _opts: any, logicalName: string) => {
-      if (logicalName === '${pascalName}WebRevalidationEventsQueue') {
-        args.name = workloadRoleResourceNames.webRevalidationQueue;
-      }
-    });
-  }
   const devPortInput = $dev ? (process.env.EBK_DEV_PORT ?? '3000') : '3000';
   if (!/^\\d+$/.test(devPortInput)) {
     throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
@@ -772,8 +787,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   if (!Number.isSafeInteger(devPort) || devPort < 1024 || devPort > 65535) {
     throw new Error('EBK_DEV_PORT must be an integer from 1024 through 65535.');
   }
-  const protectedStage =
-    $app.stage === 'staging' || $app.stage === 'production';
+  const protectedStage = ${JSON.stringify(protectedRuntimeStages)}.includes(
+    $app.stage,
+  );
   const sourceCommit =
     process.env.EBK_SOURCE_COMMIT ?? (protectedStage ? '' : 'unresolved');
   const releaseSourceCommit =
@@ -850,6 +866,24 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       })
     : undefined;
   const foundation = getFoundationInfrastructure();
+  const nativeAuthority = createStandardSliceNativeRuntimeAuthority({
+    clusterId: foundation.discovery.clusterId,
+    clusterResourceId: foundation.database.clusterResourceId,
+    eventBusArn: foundation.discovery.eventBusArn,
+    identityUserPoolArn: foundation.discovery.identityUserPoolArn,
+    masterSecretArn: foundation.database.masterSecretArn,
+  });
+  const runtimeResourceNames = nativeAuthority.resourceNames;
+  $transform(aws.dynamodb.Table, (args: any, _opts: any, logicalName: string) => {
+    if (logicalName === '${pascalName}WebRevalidationTable') {
+      args.name = runtimeResourceNames.webRevalidationTable;
+    }
+  });
+  $transform(aws.sqs.Queue, (args: any, _opts: any, logicalName: string) => {
+    if (logicalName === '${pascalName}WebRevalidationEventsQueue') {
+      args.name = runtimeResourceNames.webRevalidationQueue;
+    }
+  });
   const performanceCostControls = create${pascalName}PerformanceCostControls({
     accountCostPolicyDigest: foundation.discovery.accountCostPolicyDigest,
     accountMonthlyMaximumUsd:
@@ -882,16 +916,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const machineClientProvisioner = new sst.aws.Function(
     '${pascalName}MachineClientProvisioner',
     {
-      ...(workloadRoleBindings?.authorization.provisioner ?? {}),
-      ...(workloadRoles
-        ? {}
-        : {
-            permissions:
-              standardSliceMachineClientProvisionerPermissions({
-                userPoolArn:
-                  foundation.discovery.identityUserPoolArn,
-              }),
-          }),
+      permissions: standardSliceMachineClientProvisionerPermissions({
+        userPoolArn: foundation.discovery.identityUserPoolArn,
+      }),
       environment: {
         EBK_SLICE: '${name}',
         EBK_STAGE: $app.stage,
@@ -915,9 +942,8 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     userPoolId: foundation.userPool.id,
   });
   const dataExportStore = createStandardDataExportStore({
-    bucketName: workloadRoleResourceNames?.dataExportBucket,
-    keyAliasName: workloadRoleResourceNames?.dataExportKeyAlias,
-    workloadRoleArn: workloadRoleBindings?.api.dataRights.role,
+    bucketName: runtimeResourceNames.dataExportBucket,
+    keyAliasName: runtimeResourceNames.dataExportKeyAlias,
   });
 
   const apiHealthLogs = managedLogGroup(
@@ -1097,7 +1123,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         }
       : undefined;
   api.route(${identifierPrefix}Health.method + ' ' + ${identifierPrefix}Health.path, {
-    ...(workloadRoleBindings?.api.health ?? {}),
+    permissions: nativeAuthority.permissions('api-health'),
     environment: {
       EBK_SOURCE_COMMIT: releaseSourceCommit,
       EBK_STAGE: $app.stage,
@@ -1111,7 +1137,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       ' ' +
       ${identifierPrefix}MachineAuthorizationProof.path,
     {
-      ...(workloadRoleBindings?.api.machineAuthorizationProof ?? {}),
+      permissions: nativeAuthority.permissions('api-machine-authorization-proof'),
       environment: {
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1143,7 +1169,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     },
   ]) {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.delegations ?? {}),
+      permissions: nativeAuthority.permissions('api-delegations'),
       environment: {
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1196,10 +1222,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     },
   ]) {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.dataRights ?? {}),
-      ...(workloadRoles
-        ? {}
-        : { permissions: dataExportStore.dataRightsPermissions }),
+      permissions: nativeAuthority.permissions('api-data-rights'),
       environment: {
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1231,7 +1254,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     },
   ]) {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.databaseRecords ?? {}),
+      permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1250,7 +1273,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       ' ' +
       ${identifierPrefix}ProtectedExample.path,
     {
-    ...(workloadRoleBindings?.api.protected ?? {}),
+    permissions: nativeAuthority.permissions('api-protected'),
     environment: {
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1269,7 +1292,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       ' ' +
       ${identifierPrefix}DatabaseHealth.path,
     {
-    ...(workloadRoleBindings?.api.databaseHealth ?? {}),
+    permissions: nativeAuthority.permissions('api-database-health'),
     environment: {
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1298,7 +1321,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     },
   ]) {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.databaseRecords ?? {}),
+      permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1328,7 +1351,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     },
   ]) {
     routeInVpc(route.operation.method + ' ' + route.operation.path, {
-      ...(workloadRoleBindings?.api.databaseRecords ?? {}),
+      permissions: nativeAuthority.permissions('api-database-records'),
       environment: {
         AUTH_CLIENT_ID: authClient.id,
         AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1347,7 +1370,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       ' ' +
       ${identifierPrefix}PublishCreated.path,
     {
-    ...(workloadRoleBindings?.api.publishCreated ?? {}),
+    permissions: nativeAuthority.permissions('api-publish-created'),
     environment: {
       AUTH_CLIENT_ID: authClient.id,
       AUTH_MACHINE_ACCEPTED_CLIENT_IDS:
@@ -1369,10 +1392,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const machineAuthorizationProof = new sst.aws.Function(
     '${pascalName}MachineAuthorizationProof',
     {
-      ...(workloadRoleBindings?.authorization.proof ?? {}),
-      ...(workloadRoles
-        ? {}
-        : { permissions: machineAuthorization.proof.permissions }),
+      permissions: machineAuthorization.proof.permissions,
       environment: {
         ...machineAuthorization.proof.environment,
         AUTH_MACHINE_PROBE_URL:
@@ -1387,10 +1407,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const dataExportCleanup = new sst.aws.Function(
     '${pascalName}DataExportCleanup',
     {
-      ...(workloadRoleBindings?.dataExport.cleanup ?? {}),
-      ...(workloadRoles
-        ? {}
-        : { permissions: dataExportStore.cleanupPermissions }),
+      permissions: dataExportStore.cleanupPermissions,
       environment: {
         DATA_EXPORT_BUCKET_NAME: dataExportStore.bucket.bucket,
         DATA_EXPORT_KMS_KEY_ARN: dataExportStore.encryptionKey.arn,
@@ -1410,9 +1427,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const dataExportCleanupRule = new aws.cloudwatch.EventRule(
     '${pascalName}DataExportCleanupSchedule',
     {
-      ...(workloadRoleResourceNames
-        ? { name: workloadRoleResourceNames.dataExportCleanupRule }
-        : {}),
+      name: runtimeResourceNames.dataExportCleanupRule,
       description:
         'Hourly authoritative cleanup of expired confidential export versions.',
       scheduleExpression: 'rate(1 hour)',
@@ -1461,9 +1476,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const eventDlq = new sst.aws.Queue('${pascalName}EventDlq', {
     transform: {
       queue: {
-        ...(workloadRoleResourceNames
-          ? { name: workloadRoleResourceNames.eventDlq }
-          : {}),
+        name: runtimeResourceNames.eventDlq,
         messageRetentionSeconds: 14 * 24 * 60 * 60,
       },
     },
@@ -1472,9 +1485,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     dlq: { queue: eventDlq.arn, retry: 5 },
     transform: {
       queue: {
-        ...(workloadRoleResourceNames
-          ? { name: workloadRoleResourceNames.eventQueue }
-          : {}),
+        name: runtimeResourceNames.eventQueue,
         messageRetentionSeconds: 4 * 24 * 60 * 60,
         visibilityTimeoutSeconds: 120,
       },
@@ -1486,9 +1497,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       attributes: [{ name: 'report_digest', type: 'S' }],
       billingMode: 'PAY_PER_REQUEST',
       hashKey: 'report_digest',
-      ...(workloadRoleResourceNames
-        ? { name: workloadRoleResourceNames.asyncRecoveryLedger }
-        : {}),
+      name: runtimeResourceNames.asyncRecoveryLedger,
       pointInTimeRecovery: { enabled: true },
       tags: {
         'ebk:async-recovery-ledger': 'true',
@@ -1508,14 +1517,12 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     },
     handler: 'api/event-consumer.handler',
     link: [database, ...secretLinksFor('event-consumer')],
+    permissions: nativeAuthority.permissions('event-consumer'),
     ...lambdaLogging(eventConsumerLogs.logGroup.name),
     timeout: '1 minute',
     vpc: foundation.vpc,
   }, {
     batch: { partialResponses: true },
-    transform: {
-      function: workloadRoleBindings?.queue.eventConsumer,
-    },
   });
   foundation.eventBus.subscribeQueue(
     '${pascalName}CreatedEventRule',
@@ -1573,9 +1580,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     {
       transform: {
         queue: {
-          ...(workloadRoleResourceNames
-            ? { name: workloadRoleResourceNames.asyncTargetDlq }
-            : {}),
+          name: runtimeResourceNames.asyncTargetDlq,
           messageRetentionSeconds: 14 * 24 * 60 * 60,
           tags: {
             'ebk:async-recovery-source': 'async-target-dlq',
@@ -1589,9 +1594,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const providerDlq = new sst.aws.Queue('${pascalName}ProviderDlq', {
     transform: {
       queue: {
-        ...(workloadRoleResourceNames
-          ? { name: workloadRoleResourceNames.providerDlq }
-          : {}),
+        name: runtimeResourceNames.providerDlq,
         messageRetentionSeconds: 14 * 24 * 60 * 60,
         tags: {
           'ebk:async-recovery-source': 'provider-dlq',
@@ -1605,9 +1608,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     dlq: { queue: providerDlq.arn, retry: 5 },
     transform: {
       queue: {
-        ...(workloadRoleResourceNames
-          ? { name: workloadRoleResourceNames.providerQueue }
-          : {}),
+        name: runtimeResourceNames.providerQueue,
         messageRetentionSeconds: 4 * 24 * 60 * 60,
         tags: {
           'ebk:async-recovery-destination': 'provider-queue',
@@ -1672,6 +1673,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   );
   const runtimeConfiguration = protectedStage && !$dev
     ? (() => {
+        const monitorRole = nativeAuthority.createAppConfigMonitorRole(
+          '${pascalName}ConfigurationMonitorRole',
+        );
         const application = new aws.appconfig.Application(
           '${pascalName}ConfigurationApplication',
           {
@@ -1697,8 +1701,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
               reliability.providerDeadline,
             ].map((alarm) => ({
               alarmArn: alarm.arn,
-              alarmRoleArn:
-                workloadRoleBindings!.configuration.monitor.roleArn,
+              alarmRoleArn: monitorRole.arn,
             })),
             name: $app.stage,
             tags: {
@@ -1850,22 +1853,20 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
           providerQueue,
           ...secretLinksFor('async-provider-worker'),
         ],
+        permissions: nativeAuthority.permissions('async-provider-worker'),
         ...lambdaLogging(asyncProviderWorkerLogs.logGroup.name),
         timeout: '1 minute',
         vpc: foundation.vpc,
       },
       {
         batch: { partialResponses: true },
-        transform: {
-          function: workloadRoleBindings?.async.providerWorker,
-        },
       },
       configurationDeployment
         ? { dependsOn: [configurationDeployment] }
         : {},
     );
     api.route('POST /${name}/webhooks/provider', {
-      ...(workloadRoleBindings?.async.webhookIngress ?? {}),
+      permissions: nativeAuthority.permissions('async-webhook-ingress'),
       environment: {
         EBK_ASYNC_LEDGER_TABLE: asyncRecoveryLedger.name,
         EBK_STAGE: $app.stage,
@@ -1884,7 +1885,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const asyncOutboxRelay = new sst.aws.Function(
     '${pascalName}AsyncOutboxRelay',
     {
-      ...(workloadRoleBindings?.async.outboxRelay ?? {}),
+      permissions: nativeAuthority.permissions('async-outbox-relay'),
       environment: {
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-outbox-relay',
@@ -1905,7 +1906,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const asyncInboxCleanup = new sst.aws.Function(
     '${pascalName}AsyncInboxCleanup',
     {
-      ...(workloadRoleBindings?.async.inboxCleanup ?? {}),
+      permissions: nativeAuthority.permissions('async-inbox-cleanup'),
       environment: {
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-inbox-cleanup',
@@ -1924,7 +1925,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const asyncScheduleTarget = new sst.aws.Function(
     '${pascalName}AsyncScheduleTarget',
     {
-      ...(workloadRoleBindings?.async.scheduleTarget ?? {}),
+      permissions: nativeAuthority.permissions('async-schedule-target'),
       environment: {
         EBK_STAGE: $app.stage,
         EBK_WORKLOAD_IDENTITY: '${name}:async-schedule-target',
@@ -1939,7 +1940,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   const asyncWorkflowTask = new sst.aws.Function(
     '${pascalName}AsyncWorkflowTask',
     {
-      ...(workloadRoleBindings?.async.workflowTask ?? {}),
+      permissions: nativeAuthority.permissions('async-workflow-task'),
       environment: {
         EBK_ASYNC_LEDGER_TABLE: asyncRecoveryLedger.name,
         EBK_STAGE: $app.stage,
@@ -1950,7 +1951,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       link: secretLinksFor('async-workflow-task'),
       ...lambdaLogging(
         asyncWorkflowTaskLogs.logGroup.name,
-        workloadRoleResourceNames?.workflowTaskFunction,
+        runtimeResourceNames.workflowTaskFunction,
       ),
       timeout: '15 minutes',
     },
@@ -2097,6 +2098,10 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
   );
   let recordExportWorkflow: any;
   if (!$dev && asyncAdaptersConfigured) {
+    const recordExportWorkflowRole = nativeAuthority.createStepFunctionsRole(
+      '${pascalName}RecordExportWorkflowRole',
+      'async-workflow-orchestration',
+    );
     recordExportWorkflow = new aws.sfn.StateMachine(
       '${pascalName}RecordExportWorkflow',
       {
@@ -2240,8 +2245,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
           'ebk-${recordExportWorkflowName}-' +
           $app.stage +
           '-record-export-v1',
-        roleArn:
-          workloadRoleBindings!.async.workflowOrchestration.roleArn,
+        roleArn: recordExportWorkflowRole.arn,
         tags: {
           'ebk:slice': '${name}',
           'ebk:stage': $app.stage,
@@ -2291,17 +2295,15 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     path: 'web',
     router: { instance: foundation.router, path: '/${name}' },
     transform: {
-      assets: workloadRoleResourceNames
-        ? {
-            transform: {
-              bucket: {
-                bucket: workloadRoleResourceNames.webAssetsBucket,
-              },
-            },
-          }
-        : undefined,
+      assets: {
+        transform: {
+          bucket: {
+            bucket: runtimeResourceNames.webAssetsBucket,
+          },
+        },
+      },
       imageOptimizer: {
-        ...(workloadRoleBindings?.next.imageOptimizer ?? {}),
+        permissions: nativeAuthority.permissions('web-image-optimizer'),
         hook: {
           async postbuild(directory: string) {
             removeFinderMetadataFromBuiltFunction(directory);
@@ -2311,17 +2313,17 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         ...lambdaLogging(nextImageOptimizerLogs.logGroup.name),
       },
       revalidationEventsSubscriber: {
-        ...(workloadRoleBindings?.next.revalidationSubscriber ?? {}),
+        permissions: nativeAuthority.permissions('web-revalidation-subscriber'),
         link: secretLinksFor('web-revalidation-subscriber'),
         ...lambdaLogging(nextRevalidationSubscriberLogs.logGroup.name),
       },
       revalidationSeeder: {
-        ...(workloadRoleBindings?.next.revalidationSeeder ?? {}),
+        permissions: nativeAuthority.permissions('web-revalidation-seeder'),
         link: secretLinksFor('web-revalidation-seeder'),
         ...lambdaLogging(nextRevalidationSeederLogs.logGroup.name),
       },
       server: {
-        ...(workloadRoleBindings?.next.server ?? {}),
+        permissions: nativeAuthority.permissions('web-server'),
         hook: {
           async postbuild(directory: string) {
             removeFinderMetadataFromBuiltFunction(directory);
@@ -2426,18 +2428,23 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       logicalName: string,
       definition: unknown,
       logGroup: any,
-      roleArn: string,
-    ) =>
-      new aws.sfn.StateMachine(logicalName, {
+      roleResource: string,
+    ) => {
+      const role = nativeAuthority.createStepFunctionsRole(
+        logicalName + 'Role',
+        roleResource,
+      );
+      return new aws.sfn.StateMachine(logicalName, {
         definition: $jsonStringify(definition),
         loggingConfiguration: {
           includeExecutionData: false,
           level: 'ERROR',
           logDestination: $interpolate\`\${logGroup.arn}:*\`,
         },
-        roleArn,
+        roleArn: role.arn,
         type: 'STANDARD',
       });
+    };
 
     if (!databaseProvision.readwriteSecretArn) {
       throw new Error(
@@ -2446,7 +2453,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     }
     const retentionTaskLogs = managedLogContract('job-data-retention');
     const retentionTask = new sst.aws.Task('${pascalName}DataRetentionTask', {
-      ...workloadRoleBindings!.dataRetention.task,
+      permissions: nativeAuthority.permissions('data-retention-job-task'),
       cluster: foundation.cluster,
       environment: {
         ...dataRetentionContainer.environment,
@@ -2475,7 +2482,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
           tags: retentionTaskLogs.tags,
         },
         taskDefinition: {
-          family: workloadRoleResourceNames!.dataRetentionTaskFamily,
+          family: runtimeResourceNames.dataRetentionTaskFamily,
         },
       },
     });
@@ -2558,7 +2565,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         },
       },
       retentionWorkflowLogs.logGroup,
-      workloadRoleBindings!.dataRetention.orchestration.roleArn,
+      'data-retention-job-orchestration',
     );
     const retentionFailureAlarm = new aws.cloudwatch.MetricAlarm(
       '${pascalName}DataRetentionFailure',
@@ -2617,7 +2624,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     const retentionMaintenanceTask = new sst.aws.Task(
       '${pascalName}DataRetentionMaintenanceTask',
       {
-        ...workloadRoleBindings!.dataRetention.maintenance.task,
+        permissions: nativeAuthority.permissions(
+          'data-retention-maintenance-job-task',
+        ),
         cluster: foundation.cluster,
         environment: {
           ...dataRetentionContainer.environment,
@@ -2649,9 +2658,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
             tags: retentionMaintenanceTaskLogs.tags,
           },
           taskDefinition: {
-            family:
-              workloadRoleResourceNames!
-                .dataRetentionMaintenanceTaskFamily,
+            family: runtimeResourceNames.dataRetentionMaintenanceTaskFamily,
           },
         },
       },
@@ -2683,7 +2690,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     const retentionMaintenanceLauncher = new sst.aws.Function(
       '${pascalName}DataRetentionMaintenanceLauncher',
       {
-        ...workloadRoleBindings!.dataRetention.maintenance.launcher,
+        permissions: nativeAuthority.permissions(
+          'data-retention-maintenance-launcher',
+        ),
         environment: {
           EBK_MAINTENANCE_ASSIGN_PUBLIC_IP:
             retentionMaintenanceTask.assignPublicIp.apply(
@@ -2714,8 +2723,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
     const retentionMaintenanceRule = new aws.cloudwatch.EventRule(
       '${pascalName}DataRetentionMaintenanceSchedule',
       {
-        name:
-          workloadRoleResourceNames!.dataRetentionMaintenanceRule,
+        name: runtimeResourceNames.dataRetentionMaintenanceRule,
         scheduleExpression: 'rate(1 day)',
       },
     );
@@ -2769,12 +2777,12 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
         'database-retirement',
         databaseIdentifier,
       );
-      const databaseRoleBindings =
-        workloadRoleBindings!.database(databaseIdentifier);
       const bootstrapTask = new sst.aws.Task(
         target.resourceName + 'BootstrapTask',
         {
-          ...databaseRoleBindings.bootstrap,
+          permissions: nativeAuthority.permissions(
+            'database-' + databaseIdentifier + '-bootstrap-task',
+          ),
           cluster: foundation.cluster,
           command: ['node', 'jobs/bootstrap-database.mjs'],
           environment: {
@@ -2831,7 +2839,9 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       const migrationTask = new sst.aws.Task(
         target.resourceName + 'MigrationTask',
         {
-          ...databaseRoleBindings.migration,
+          permissions: nativeAuthority.permissions(
+            'database-' + databaseIdentifier + '-migration-task',
+          ),
           cluster: foundation.cluster,
           environment: {
             ...databaseMigrationContainer.environment,
@@ -2918,7 +2928,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
           },
         },
         migrationWorkflowLogs.logGroup,
-        databaseRoleBindings.migrationOrchestration.roleArn,
+        'database-' + databaseIdentifier + '-migration-orchestration',
       );
       const registration = registerProductMigration(
         target.resourceName + 'MigrationRegistration',
@@ -2927,10 +2937,11 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
       );
       const retirementTask =
         $app.stage === 'development' &&
-        databaseIdentifier === 'retirement_rehearsal' &&
-        databaseRoleBindings.retirement
+        databaseIdentifier === 'retirement_rehearsal'
           ? new sst.aws.Task(target.resourceName + 'RetirementTask', {
-              ...databaseRoleBindings.retirement.task,
+              permissions: nativeAuthority.permissions(
+                'database-' + databaseIdentifier + '-retirement-task',
+              ),
               cluster: foundation.cluster,
               command: ['node', 'jobs/retire-database.mjs'],
               environment: {
@@ -3044,7 +3055,7 @@ export function product(workloadRoles?: StandardSliceWorkloadRolePreflight) {
             },
           },
           retirementWorkflowLogs.logGroup,
-          databaseRoleBindings.retirement!.orchestration.roleArn,
+          'database-' + databaseIdentifier + '-retirement-orchestration',
         );
         retirementControl = {
           retirementWorkflowLogs,