@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/slice/built-in-plan-data-export-infrastructure-files.js

@@ -7,7 +7,6 @@ function renderStandardSliceDataExportInfrastructureFiles(name, pascalName) {
         'infra/data-export.ts': `export interface StandardDataExportStoreOptions {
   bucketName?: string;
   keyAliasName?: string;
-  workloadRoleArn?: string;
 }
 
 /**
@@ -19,46 +18,21 @@ function renderStandardSliceDataExportInfrastructureFiles(name, pascalName) {
 export function createStandardDataExportStore(
   options: StandardDataExportStoreOptions,
 ) {
-  const retain = { retainOnDelete: true };
+  // Development and staging are disposable and must support a complete
+  // remove -> redeploy cycle. Production data remains deliberately retained
+  // even if the surrounding stack is removed.
+  const retain = { retainOnDelete: $app.stage === 'production' };
   const tags = {
     'ebk:classification': 'confidential',
     'ebk:management': 'standard-data-export',
     'ebk:slice': '${name}',
     'sst:stage': $app.stage,
   };
-  const account = aws.getCallerIdentityOutput({});
-  const partition = aws.getPartitionOutput({});
-  const rootArn = $interpolate\`arn:\${partition.partition}:iam::\${account.accountId}:root\`;
-  const keyStatements: any[] = [
-    {
-      actions: ['kms:*'],
-      principals: [{ identifiers: [rootArn], type: 'AWS' }],
-      resources: ['*'],
-      sid: 'AccountKeyAdministration',
-    },
-  ];
-  if (options.workloadRoleArn) {
-    keyStatements.push({
-      actions: [
-        'kms:Decrypt',
-        'kms:Encrypt',
-        'kms:GenerateDataKey',
-      ],
-      principals: [
-        { identifiers: [options.workloadRoleArn], type: 'AWS' },
-      ],
-      resources: ['*'],
-      sid: 'ExactDataRightsWorkloadCryptographicUse',
-    });
-  }
   const encryptionKey = new aws.kms.Key('${pascalName}DataExportKey', {
     deletionWindowInDays: 30,
     description:
       'Slice-owned key for bounded ${name} confidential subject exports.',
     enableKeyRotation: true,
-    policy: aws.iam.getPolicyDocumentOutput({
-      statements: keyStatements,
-    }).json,
     tags,
   }, retain);
   const encryptionAlias = new aws.kms.Alias(
@@ -73,7 +47,7 @@ export function createStandardDataExportStore(
   );
   const bucket = new aws.s3.Bucket('${pascalName}DataExportBucket', {
     ...(options.bucketName ? { bucket: options.bucketName } : {}),
-    forceDestroy: false,
+    forceDestroy: $app.stage !== 'production',
     tags,
   }, retain);
   const ownership = new aws.s3.BucketOwnershipControls(

package/src/generators/slice/built-in-plan-data-files.d.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export declare function renderProductDataFiles(name: string, pascalName: string): Readonly<Record<string, string>>;
+export declare function renderProductDataFiles(name: string, pascalName: string, protectedRuntimeStages?: readonly ('development' | 'production' | 'staging')[], sql?: boolean): Readonly<Record<string, string>>;