@fjall/components-infrastructure 0.81.2 → 0.83.0

package/dist/lib/patterns/aws/storage.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.S3Storage = exports.StorageFactory = void 0;
 const constructs_1 = require("constructs");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
 const storage_1 = require("../../resources/aws/storage");
 class StorageFactory {
     static build(id, props) {
@@ -45,6 +46,7 @@ class S3Storage extends constructs_1.Construct {
             encryptionKey: props.kmsKeyArn ? undefined : undefined, // KMS key handling
             publicReadAccess: props.publicReadAccess
         });
+        this.addOutputs();
     }
     addWebsiteBucket(props) {
         this.bucket = new storage_1.S3WebsiteBucket(this, `${this.id}Bucket`, {
@@ -55,6 +57,7 @@ class S3Storage extends constructs_1.Construct {
             websiteErrorDocument: props.websiteErrorDocument,
             cors: props.cors
         });
+        this.addOutputs();
     }
     addPublicReadBucket(props) {
         this.bucket = new storage_1.S3PublicReadBucket(this, `${this.id}Bucket`, {
@@ -62,6 +65,25 @@ class S3Storage extends constructs_1.Construct {
             versioned: props.versioned,
             encryption: props.encryption
         });
+        this.addOutputs();
+    }
+    addOutputs() {
+        const stackName = aws_cdk_lib_1.Stack.of(this).stackName;
+        // Export bucket ARN for monitoring
+        // Use stack name prefix to ensure uniqueness across apps in same region
+        new aws_cdk_lib_1.CfnOutput(this, `${this.id}BucketArn`, {
+            key: `${stackName}${this.id}BucketArn`,
+            exportName: `${stackName}${this.id}BucketArn`,
+            value: this.bucket.bucketArn,
+            description: `S3 Bucket ARN for ${this.id}`
+        });
+        // Export bucket name for convenience
+        new aws_cdk_lib_1.CfnOutput(this, `${this.id}BucketName`, {
+            key: `${stackName}${this.id}BucketName`,
+            exportName: `${stackName}${this.id}BucketName`,
+            value: this.bucket.bucketName,
+            description: `S3 Bucket Name for ${this.id}`
+        });
     }
     getBucket() {
         return this.bucket;
@@ -77,4 +99,4 @@ class S3Storage extends constructs_1.Construct {
     }
 }
 exports.S3Storage = S3Storage;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmFnZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL2xpYi9wYXR0ZXJucy9hd3Mvc3RvcmFnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyQ0FBdUM7QUFJdkMseURBS3FDO0FBZ0NyQyxNQUFhLGNBQWM7SUFDekIsTUFBTSxDQUFDLEtBQUssQ0FBcUIsRUFBVSxFQUFFLEtBQVE7UUFDbkQsT0FBTyxDQUFDLEdBQVEsRUFBRSxLQUFnQixFQUFFLEVBQUU7WUFDcEMsT0FBTyxJQUFJLFNBQVMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3pDLENBQUMsQ0FBQztJQUNKLENBQUM7Q0FDRjtBQU5ELHdDQU1DO0FBRUQsTUFBYSxTQUFVLFNBQVEsc0JBQVM7SUFPdEMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFlO1FBQ3ZELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDakIsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLENBQUM7UUFDYixJQUFJLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNuQixJQUFJLENBQUMsVUFBVSxHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFFbkMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUMxQixDQUFDO0lBRUQsV0FBVyxDQUFDLEtBQWU7UUFDekIsUUFBUSxLQUFLLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDekIsS0FBSyxTQUFTO2dCQUNaLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDN0IsTUFBTTtZQUNSLEtBQUssU0FBUztnQkFDWixJQUFJLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQzdCLE1BQU07WUFDUixLQUFLLFlBQVk7Z0JBQ2YsSUFBSSxDQUFDLG1CQUFtQixDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNoQyxNQUFNO1lBQ1IsT0FBTyxDQUFDLENBQUMsQ0FBQztnQkFDUix1QkFBdUI7Z0JBQ3ZCLE1BQU0sV0FBVyxHQUFVLEtBQUssQ0FBQztnQkFDakMsTUFBTSxJQUFJLEtBQUssQ0FDYiw4QkFBK0IsS0FBYSxDQUFDLFVBQVUsRUFBRSxDQUMxRCxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRU8sZ0JBQWdCLENBQUMsS0FBcUI7UUFDNUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLGtCQUFRLENBQUMsSUFBSSxFQUFFLEdBQUcsSUFBSSxDQUFDLEVBQUUsUUFBUSxFQUFFO1lBQ25ELGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZTtZQUN0QyxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7WUFDMUIsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFpQjtZQUNuQyxhQUFhLEVBQUUsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLEVBQUUsbUJBQW1CO1lBQzNFLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0I7U0FDekMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLGdCQUFnQixDQUFDLEtBQXFCO1FBQzVDLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSx5QkFBZSxDQUFDLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRTtZQUMxRCxlQUFlLEVBQUUsS0FBSyxDQUFDLGVBQWU7WUFDdEMsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTO1lBQzFCLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBaUI7WUFDbkMsb0JBQW9CLEVBQUUsS0FBSyxDQUFDLG9CQUFvQjtZQUNoRCxvQkFBb0IsRUFBRSxLQUFLLENBQUMsb0JBQW9CO1lBQ2hELElBQUksRUFBRSxLQUFLLENBQUMsSUFBVztTQUN4QixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU8sbUJBQW1CLENBQUMsS0FBd0I7UUFDbEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLDRCQUFrQixDQUFDLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRTtZQUM3RCxlQUFlLEVBQUUsS0FBSyxDQUFDLGVBQWU7WUFDdEMsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTO1lBQzFCLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBaUI7U0FDcEMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELFNBQVM7UUFDUCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUM7SUFDckIsQ0FBQztJQUVELGFBQWE7UUFDWCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDO0lBQ2hDLENBQUM7SUFFRCxZQUFZO1FBQ1YsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQztJQUMvQixDQUFDO0lBRUQsYUFBYTtRQUNYLE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQztJQUN6QixDQUFDO0NBQ0Y7QUFqRkQsOEJBaUZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcbmltcG9ydCB7IHR5cGUgSUJ1Y2tldCB9IGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtczNcIjtcblxuaW1wb3J0IHR5cGUgQXBwIGZyb20gXCIuLi8uLi9hcHBcIjtcbmltcG9ydCB7XG4gIFMzQnVja2V0LFxuICBTM1dlYnNpdGVCdWNrZXQsXG4gIFMzUHVibGljUmVhZEJ1Y2tldCxcbiAgdHlwZSBCYWNrdXBWYXVsdFRpZXJcbn0gZnJvbSBcIi4uLy4uL3Jlc291cmNlcy9hd3Mvc3RvcmFnZVwiO1xuXG50eXBlIFMzQnVja2V0VHlwZSA9IFwicHJpdmF0ZVwiIHwgXCJ3ZWJzaXRlXCIgfCBcInB1YmxpY1JlYWRcIjtcblxudHlwZSBCYXNlUzNQcm9wcyA9IHtcbiAgYmFja3VwVmF1bHRUaWVyPzogQmFja3VwVmF1bHRUaWVyO1xuICB2ZXJzaW9uZWQ/OiBib29sZWFuO1xuICBlbmNyeXB0aW9uPzogXCJBRVMyNTZcIiB8IFwiS01TXCI7XG4gIGttc0tleUFybj86IHN0cmluZztcbn07XG5cbmV4cG9ydCBpbnRlcmZhY2UgUHJpdmF0ZVMzUHJvcHMgZXh0ZW5kcyBCYXNlUzNQcm9wcyB7XG4gIGJ1Y2tldFR5cGU6IFwicHJpdmF0ZVwiO1xuICBwdWJsaWNSZWFkQWNjZXNzPzogYm9vbGVhbjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBXZWJzaXRlUzNQcm9wcyBleHRlbmRzIEJhc2VTM1Byb3BzIHtcbiAgYnVja2V0VHlwZTogXCJ3ZWJzaXRlXCI7XG4gIHdlYnNpdGVJbmRleERvY3VtZW50Pzogc3RyaW5nO1xuICB3ZWJzaXRlRXJyb3JEb2N1bWVudD86IHN0cmluZztcbiAgY29ycz86IEFycmF5PHtcbiAgICBhbGxvd2VkT3JpZ2luczogc3RyaW5nW107XG4gICAgYWxsb3dlZE1ldGhvZHM6IHN0cmluZ1tdO1xuICB9Pjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBQdWJsaWNSZWFkUzNQcm9wcyBleHRlbmRzIEJhc2VTM1Byb3BzIHtcbiAgYnVja2V0VHlwZTogXCJwdWJsaWNSZWFkXCI7XG59XG5cbmV4cG9ydCB0eXBlIElTM1Byb3BzID0gUHJpdmF0ZVMzUHJvcHMgfCBXZWJzaXRlUzNQcm9wcyB8IFB1YmxpY1JlYWRTM1Byb3BzO1xuXG5leHBvcnQgY2xhc3MgU3RvcmFnZUZhY3Rvcnkge1xuICBzdGF0aWMgYnVpbGQ8VCBleHRlbmRzIElTM1Byb3BzPihpZDogc3RyaW5nLCBwcm9wczogVCkge1xuICAgIHJldHVybiAoYXBwOiBBcHAsIHNjb3BlOiBDb25zdHJ1Y3QpID0+IHtcbiAgICAgIHJldHVybiBuZXcgUzNTdG9yYWdlKHNjb3BlLCBpZCwgcHJvcHMpO1xuICAgIH07XG4gIH1cbn1cblxuZXhwb3J0IGNsYXNzIFMzU3RvcmFnZSBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHB1YmxpYyBpZDogc3RyaW5nO1xuICBwdWJsaWMgc2NvcGU6IENvbnN0cnVjdDtcblxuICBwcml2YXRlIGJ1Y2tldDogUzNCdWNrZXQgfCBTM1dlYnNpdGVCdWNrZXQgfCBTM1B1YmxpY1JlYWRCdWNrZXQ7XG4gIHByaXZhdGUgYnVja2V0VHlwZTogUzNCdWNrZXRUeXBlO1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBJUzNQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG4gICAgdGhpcy5pZCA9IGlkO1xuICAgIHRoaXMuc2NvcGUgPSBzY29wZTtcbiAgICB0aGlzLmJ1Y2tldFR5cGUgPSBwcm9wcy5idWNrZXRUeXBlO1xuXG4gICAgdGhpcy5hZGRTM0J1Y2tldChwcm9wcyk7XG4gIH1cblxuICBhZGRTM0J1Y2tldChwcm9wczogSVMzUHJvcHMpIHtcbiAgICBzd2l0Y2ggKHByb3BzLmJ1Y2tldFR5cGUpIHtcbiAgICAgIGNhc2UgXCJwcml2YXRlXCI6XG4gICAgICAgIHRoaXMuYWRkUHJpdmF0ZUJ1Y2tldChwcm9wcyk7XG4gICAgICAgIGJyZWFrO1xuICAgICAgY2FzZSBcIndlYnNpdGVcIjpcbiAgICAgICAgdGhpcy5hZGRXZWJzaXRlQnVja2V0KHByb3BzKTtcbiAgICAgICAgYnJlYWs7XG4gICAgICBjYXNlIFwicHVibGljUmVhZFwiOlxuICAgICAgICB0aGlzLmFkZFB1YmxpY1JlYWRCdWNrZXQocHJvcHMpO1xuICAgICAgICBicmVhaztcbiAgICAgIGRlZmF1bHQ6IHtcbiAgICAgICAgLy8gRXhoYXVzdGl2ZW5lc3MgY2hlY2tcbiAgICAgICAgY29uc3QgX2V4aGF1c3RpdmU6IG5ldmVyID0gcHJvcHM7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICBgVW5zdXBwb3J0ZWQgUzMgYnVja2V0IHR5cGUgJHsocHJvcHMgYXMgYW55KS5idWNrZXRUeXBlfWBcbiAgICAgICAgKTtcbiAgICAgIH1cbiAgICB9XG4gIH1cblxuICBwcml2YXRlIGFkZFByaXZhdGVCdWNrZXQocHJvcHM6IFByaXZhdGVTM1Byb3BzKSB7XG4gICAgdGhpcy5idWNrZXQgPSBuZXcgUzNCdWNrZXQodGhpcywgYCR7dGhpcy5pZH1CdWNrZXRgLCB7XG4gICAgICBiYWNrdXBWYXVsdFRpZXI6IHByb3BzLmJhY2t1cFZhdWx0VGllcixcbiAgICAgIHZlcnNpb25lZDogcHJvcHMudmVyc2lvbmVkLFxuICAgICAgZW5jcnlwdGlvbjogcHJvcHMuZW5jcnlwdGlvbiBhcyBhbnksXG4gICAgICBlbmNyeXB0aW9uS2V5OiBwcm9wcy5rbXNLZXlBcm4gPyB1bmRlZmluZWQgOiB1bmRlZmluZWQsIC8vIEtNUyBrZXkgaGFuZGxpbmdcbiAgICAgIHB1YmxpY1JlYWRBY2Nlc3M6IHByb3BzLnB1YmxpY1JlYWRBY2Nlc3NcbiAgICB9KTtcbiAgfVxuXG4gIHByaXZhdGUgYWRkV2Vic2l0ZUJ1Y2tldChwcm9wczogV2Vic2l0ZVMzUHJvcHMpIHtcbiAgICB0aGlzLmJ1Y2tldCA9IG5ldyBTM1dlYnNpdGVCdWNrZXQodGhpcywgYCR7dGhpcy5pZH1CdWNrZXRgLCB7XG4gICAgICBiYWNrdXBWYXVsdFRpZXI6IHByb3BzLmJhY2t1cFZhdWx0VGllcixcbiAgICAgIHZlcnNpb25lZDogcHJvcHMudmVyc2lvbmVkLFxuICAgICAgZW5jcnlwdGlvbjogcHJvcHMuZW5jcnlwdGlvbiBhcyBhbnksXG4gICAgICB3ZWJzaXRlSW5kZXhEb2N1bWVudDogcHJvcHMud2Vic2l0ZUluZGV4RG9jdW1lbnQsXG4gICAgICB3ZWJzaXRlRXJyb3JEb2N1bWVudDogcHJvcHMud2Vic2l0ZUVycm9yRG9jdW1lbnQsXG4gICAgICBjb3JzOiBwcm9wcy5jb3JzIGFzIGFueVxuICAgIH0pO1xuICB9XG5cbiAgcHJpdmF0ZSBhZGRQdWJsaWNSZWFkQnVja2V0KHByb3BzOiBQdWJsaWNSZWFkUzNQcm9wcykge1xuICAgIHRoaXMuYnVja2V0ID0gbmV3IFMzUHVibGljUmVhZEJ1Y2tldCh0aGlzLCBgJHt0aGlzLmlkfUJ1Y2tldGAsIHtcbiAgICAgIGJhY2t1cFZhdWx0VGllcjogcHJvcHMuYmFja3VwVmF1bHRUaWVyLFxuICAgICAgdmVyc2lvbmVkOiBwcm9wcy52ZXJzaW9uZWQsXG4gICAgICBlbmNyeXB0aW9uOiBwcm9wcy5lbmNyeXB0aW9uIGFzIGFueVxuICAgIH0pO1xuICB9XG5cbiAgZ2V0QnVja2V0KCk6IElCdWNrZXQge1xuICAgIHJldHVybiB0aGlzLmJ1Y2tldDtcbiAgfVxuXG4gIGdldEJ1Y2tldE5hbWUoKTogc3RyaW5nIHtcbiAgICByZXR1cm4gdGhpcy5idWNrZXQuYnVja2V0TmFtZTtcbiAgfVxuXG4gIGdldEJ1Y2tldEFybigpOiBzdHJpbmcge1xuICAgIHJldHVybiB0aGlzLmJ1Y2tldC5idWNrZXRBcm47XG4gIH1cblxuICBnZXRCdWNrZXRUeXBlKCk6IFMzQnVja2V0VHlwZSB7XG4gICAgcmV0dXJuIHRoaXMuYnVja2V0VHlwZTtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmFnZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL2xpYi9wYXR0ZXJucy9hd3Mvc3RvcmFnZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyQ0FBdUM7QUFFdkMsNkNBQStDO0FBRy9DLHlEQUtxQztBQWdDckMsTUFBYSxjQUFjO0lBQ3pCLE1BQU0sQ0FBQyxLQUFLLENBQXFCLEVBQVUsRUFBRSxLQUFRO1FBQ25ELE9BQU8sQ0FBQyxHQUFRLEVBQUUsS0FBZ0IsRUFBRSxFQUFFO1lBQ3BDLE9BQU8sSUFBSSxTQUFTLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUN6QyxDQUFDLENBQUM7SUFDSixDQUFDO0NBQ0Y7QUFORCx3Q0FNQztBQUVELE1BQWEsU0FBVSxTQUFRLHNCQUFTO0lBT3RDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBZTtRQUN2RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2pCLElBQUksQ0FBQyxFQUFFLEdBQUcsRUFBRSxDQUFDO1FBQ2IsSUFBSSxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUM7UUFDbkIsSUFBSSxDQUFDLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBRW5DLElBQUksQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDMUIsQ0FBQztJQUVELFdBQVcsQ0FBQyxLQUFlO1FBQ3pCLFFBQVEsS0FBSyxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3pCLEtBQUssU0FBUztnQkFDWixJQUFJLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQzdCLE1BQU07WUFDUixLQUFLLFNBQVM7Z0JBQ1osSUFBSSxDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUM3QixNQUFNO1lBQ1IsS0FBSyxZQUFZO2dCQUNmLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDaEMsTUFBTTtZQUNSLE9BQU8sQ0FBQyxDQUFDLENBQUM7Z0JBQ1IsdUJBQXVCO2dCQUN2QixNQUFNLFdBQVcsR0FBVSxLQUFLLENBQUM7Z0JBQ2pDLE1BQU0sSUFBSSxLQUFLLENBQ2IsOEJBQStCLEtBQWEsQ0FBQyxVQUFVLEVBQUUsQ0FDMUQsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVPLGdCQUFnQixDQUFDLEtBQXFCO1FBQzVDLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxrQkFBUSxDQUFDLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRTtZQUNuRCxlQUFlLEVBQUUsS0FBSyxDQUFDLGVBQWU7WUFDdEMsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTO1lBQzFCLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBaUI7WUFDbkMsYUFBYSxFQUFFLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxFQUFFLG1CQUFtQjtZQUMzRSxnQkFBZ0IsRUFBRSxLQUFLLENBQUMsZ0JBQWdCO1NBQ3pDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUNwQixDQUFDO0lBRU8sZ0JBQWdCLENBQUMsS0FBcUI7UUFDNUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLHlCQUFlLENBQUMsSUFBSSxFQUFFLEdBQUcsSUFBSSxDQUFDLEVBQUUsUUFBUSxFQUFFO1lBQzFELGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZTtZQUN0QyxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7WUFDMUIsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFpQjtZQUNuQyxvQkFBb0IsRUFBRSxLQUFLLENBQUMsb0JBQW9CO1lBQ2hELG9CQUFvQixFQUFFLEtBQUssQ0FBQyxvQkFBb0I7WUFDaEQsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFXO1NBQ3hCLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUNwQixDQUFDO0lBRU8sbUJBQW1CLENBQUMsS0FBd0I7UUFDbEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLDRCQUFrQixDQUFDLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQyxFQUFFLFFBQVEsRUFBRTtZQUM3RCxlQUFlLEVBQUUsS0FBSyxDQUFDLGVBQWU7WUFDdEMsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTO1lBQzFCLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBaUI7U0FDcEMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQ3BCLENBQUM7SUFFTyxVQUFVO1FBQ2hCLE1BQU0sU0FBUyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUUzQyxtQ0FBbUM7UUFDbkMsd0VBQXdFO1FBQ3hFLElBQUksdUJBQVMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxJQUFJLENBQUMsRUFBRSxXQUFXLEVBQUU7WUFDekMsR0FBRyxFQUFFLEdBQUcsU0FBUyxHQUFHLElBQUksQ0FBQyxFQUFFLFdBQVc7WUFDdEMsVUFBVSxFQUFFLEdBQUcsU0FBUyxHQUFHLElBQUksQ0FBQyxFQUFFLFdBQVc7WUFDN0MsS0FBSyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUztZQUM1QixXQUFXLEVBQUUscUJBQXFCLElBQUksQ0FBQyxFQUFFLEVBQUU7U0FDNUMsQ0FBQyxDQUFDO1FBRUgscUNBQXFDO1FBQ3JDLElBQUksdUJBQVMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxJQUFJLENBQUMsRUFBRSxZQUFZLEVBQUU7WUFDMUMsR0FBRyxFQUFFLEdBQUcsU0FBUyxHQUFHLElBQUksQ0FBQyxFQUFFLFlBQVk7WUFDdkMsVUFBVSxFQUFFLEdBQUcsU0FBUyxHQUFHLElBQUksQ0FBQyxFQUFFLFlBQVk7WUFDOUMsS0FBSyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVTtZQUM3QixXQUFXLEVBQUUsc0JBQXNCLElBQUksQ0FBQyxFQUFFLEVBQUU7U0FDN0MsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELFNBQVM7UUFDUCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUM7SUFDckIsQ0FBQztJQUVELGFBQWE7UUFDWCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDO0lBQ2hDLENBQUM7SUFFRCxZQUFZO1FBQ1YsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQztJQUMvQixDQUFDO0lBRUQsYUFBYTtRQUNYLE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQztJQUN6QixDQUFDO0NBQ0Y7QUF6R0QsOEJBeUdDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcbmltcG9ydCB7IHR5cGUgSUJ1Y2tldCB9IGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtczNcIjtcbmltcG9ydCB7IENmbk91dHB1dCwgU3RhY2sgfSBmcm9tIFwiYXdzLWNkay1saWJcIjtcblxuaW1wb3J0IHR5cGUgQXBwIGZyb20gXCIuLi8uLi9hcHBcIjtcbmltcG9ydCB7XG4gIFMzQnVja2V0LFxuICBTM1dlYnNpdGVCdWNrZXQsXG4gIFMzUHVibGljUmVhZEJ1Y2tldCxcbiAgdHlwZSBCYWNrdXBWYXVsdFRpZXJcbn0gZnJvbSBcIi4uLy4uL3Jlc291cmNlcy9hd3Mvc3RvcmFnZVwiO1xuXG50eXBlIFMzQnVja2V0VHlwZSA9IFwicHJpdmF0ZVwiIHwgXCJ3ZWJzaXRlXCIgfCBcInB1YmxpY1JlYWRcIjtcblxudHlwZSBCYXNlUzNQcm9wcyA9IHtcbiAgYmFja3VwVmF1bHRUaWVyPzogQmFja3VwVmF1bHRUaWVyO1xuICB2ZXJzaW9uZWQ/OiBib29sZWFuO1xuICBlbmNyeXB0aW9uPzogXCJBRVMyNTZcIiB8IFwiS01TXCI7XG4gIGttc0tleUFybj86IHN0cmluZztcbn07XG5cbmV4cG9ydCBpbnRlcmZhY2UgUHJpdmF0ZVMzUHJvcHMgZXh0ZW5kcyBCYXNlUzNQcm9wcyB7XG4gIGJ1Y2tldFR5cGU6IFwicHJpdmF0ZVwiO1xuICBwdWJsaWNSZWFkQWNjZXNzPzogYm9vbGVhbjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBXZWJzaXRlUzNQcm9wcyBleHRlbmRzIEJhc2VTM1Byb3BzIHtcbiAgYnVja2V0VHlwZTogXCJ3ZWJzaXRlXCI7XG4gIHdlYnNpdGVJbmRleERvY3VtZW50Pzogc3RyaW5nO1xuICB3ZWJzaXRlRXJyb3JEb2N1bWVudD86IHN0cmluZztcbiAgY29ycz86IEFycmF5PHtcbiAgICBhbGxvd2VkT3JpZ2luczogc3RyaW5nW107XG4gICAgYWxsb3dlZE1ldGhvZHM6IHN0cmluZ1tdO1xuICB9Pjtcbn1cblxuZXhwb3J0IGludGVyZmFjZSBQdWJsaWNSZWFkUzNQcm9wcyBleHRlbmRzIEJhc2VTM1Byb3BzIHtcbiAgYnVja2V0VHlwZTogXCJwdWJsaWNSZWFkXCI7XG59XG5cbmV4cG9ydCB0eXBlIElTM1Byb3BzID0gUHJpdmF0ZVMzUHJvcHMgfCBXZWJzaXRlUzNQcm9wcyB8IFB1YmxpY1JlYWRTM1Byb3BzO1xuXG5leHBvcnQgY2xhc3MgU3RvcmFnZUZhY3Rvcnkge1xuICBzdGF0aWMgYnVpbGQ8VCBleHRlbmRzIElTM1Byb3BzPihpZDogc3RyaW5nLCBwcm9wczogVCkge1xuICAgIHJldHVybiAoYXBwOiBBcHAsIHNjb3BlOiBDb25zdHJ1Y3QpID0+IHtcbiAgICAgIHJldHVybiBuZXcgUzNTdG9yYWdlKHNjb3BlLCBpZCwgcHJvcHMpO1xuICAgIH07XG4gIH1cbn1cblxuZXhwb3J0IGNsYXNzIFMzU3RvcmFnZSBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHB1YmxpYyBpZDogc3RyaW5nO1xuICBwdWJsaWMgc2NvcGU6IENvbnN0cnVjdDtcblxuICBwcml2YXRlIGJ1Y2tldDogUzNCdWNrZXQgfCBTM1dlYnNpdGVCdWNrZXQgfCBTM1B1YmxpY1JlYWRCdWNrZXQ7XG4gIHByaXZhdGUgYnVja2V0VHlwZTogUzNCdWNrZXRUeXBlO1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBJUzNQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG4gICAgdGhpcy5pZCA9IGlkO1xuICAgIHRoaXMuc2NvcGUgPSBzY29wZTtcbiAgICB0aGlzLmJ1Y2tldFR5cGUgPSBwcm9wcy5idWNrZXRUeXBlO1xuXG4gICAgdGhpcy5hZGRTM0J1Y2tldChwcm9wcyk7XG4gIH1cblxuICBhZGRTM0J1Y2tldChwcm9wczogSVMzUHJvcHMpIHtcbiAgICBzd2l0Y2ggKHByb3BzLmJ1Y2tldFR5cGUpIHtcbiAgICAgIGNhc2UgXCJwcml2YXRlXCI6XG4gICAgICAgIHRoaXMuYWRkUHJpdmF0ZUJ1Y2tldChwcm9wcyk7XG4gICAgICAgIGJyZWFrO1xuICAgICAgY2FzZSBcIndlYnNpdGVcIjpcbiAgICAgICAgdGhpcy5hZGRXZWJzaXRlQnVja2V0KHByb3BzKTtcbiAgICAgICAgYnJlYWs7XG4gICAgICBjYXNlIFwicHVibGljUmVhZFwiOlxuICAgICAgICB0aGlzLmFkZFB1YmxpY1JlYWRCdWNrZXQocHJvcHMpO1xuICAgICAgICBicmVhaztcbiAgICAgIGRlZmF1bHQ6IHtcbiAgICAgICAgLy8gRXhoYXVzdGl2ZW5lc3MgY2hlY2tcbiAgICAgICAgY29uc3QgX2V4aGF1c3RpdmU6IG5ldmVyID0gcHJvcHM7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICBgVW5zdXBwb3J0ZWQgUzMgYnVja2V0IHR5cGUgJHsocHJvcHMgYXMgYW55KS5idWNrZXRUeXBlfWBcbiAgICAgICAgKTtcbiAgICAgIH1cbiAgICB9XG4gIH1cblxuICBwcml2YXRlIGFkZFByaXZhdGVCdWNrZXQocHJvcHM6IFByaXZhdGVTM1Byb3BzKSB7XG4gICAgdGhpcy5idWNrZXQgPSBuZXcgUzNCdWNrZXQodGhpcywgYCR7dGhpcy5pZH1CdWNrZXRgLCB7XG4gICAgICBiYWNrdXBWYXVsdFRpZXI6IHByb3BzLmJhY2t1cFZhdWx0VGllcixcbiAgICAgIHZlcnNpb25lZDogcHJvcHMudmVyc2lvbmVkLFxuICAgICAgZW5jcnlwdGlvbjogcHJvcHMuZW5jcnlwdGlvbiBhcyBhbnksXG4gICAgICBlbmNyeXB0aW9uS2V5OiBwcm9wcy5rbXNLZXlBcm4gPyB1bmRlZmluZWQgOiB1bmRlZmluZWQsIC8vIEtNUyBrZXkgaGFuZGxpbmdcbiAgICAgIHB1YmxpY1JlYWRBY2Nlc3M6IHByb3BzLnB1YmxpY1JlYWRBY2Nlc3NcbiAgICB9KTtcbiAgICB0aGlzLmFkZE91dHB1dHMoKTtcbiAgfVxuXG4gIHByaXZhdGUgYWRkV2Vic2l0ZUJ1Y2tldChwcm9wczogV2Vic2l0ZVMzUHJvcHMpIHtcbiAgICB0aGlzLmJ1Y2tldCA9IG5ldyBTM1dlYnNpdGVCdWNrZXQodGhpcywgYCR7dGhpcy5pZH1CdWNrZXRgLCB7XG4gICAgICBiYWNrdXBWYXVsdFRpZXI6IHByb3BzLmJhY2t1cFZhdWx0VGllcixcbiAgICAgIHZlcnNpb25lZDogcHJvcHMudmVyc2lvbmVkLFxuICAgICAgZW5jcnlwdGlvbjogcHJvcHMuZW5jcnlwdGlvbiBhcyBhbnksXG4gICAgICB3ZWJzaXRlSW5kZXhEb2N1bWVudDogcHJvcHMud2Vic2l0ZUluZGV4RG9jdW1lbnQsXG4gICAgICB3ZWJzaXRlRXJyb3JEb2N1bWVudDogcHJvcHMud2Vic2l0ZUVycm9yRG9jdW1lbnQsXG4gICAgICBjb3JzOiBwcm9wcy5jb3JzIGFzIGFueVxuICAgIH0pO1xuICAgIHRoaXMuYWRkT3V0cHV0cygpO1xuICB9XG5cbiAgcHJpdmF0ZSBhZGRQdWJsaWNSZWFkQnVja2V0KHByb3BzOiBQdWJsaWNSZWFkUzNQcm9wcykge1xuICAgIHRoaXMuYnVja2V0ID0gbmV3IFMzUHVibGljUmVhZEJ1Y2tldCh0aGlzLCBgJHt0aGlzLmlkfUJ1Y2tldGAsIHtcbiAgICAgIGJhY2t1cFZhdWx0VGllcjogcHJvcHMuYmFja3VwVmF1bHRUaWVyLFxuICAgICAgdmVyc2lvbmVkOiBwcm9wcy52ZXJzaW9uZWQsXG4gICAgICBlbmNyeXB0aW9uOiBwcm9wcy5lbmNyeXB0aW9uIGFzIGFueVxuICAgIH0pO1xuICAgIHRoaXMuYWRkT3V0cHV0cygpO1xuICB9XG5cbiAgcHJpdmF0ZSBhZGRPdXRwdXRzKCkge1xuICAgIGNvbnN0IHN0YWNrTmFtZSA9IFN0YWNrLm9mKHRoaXMpLnN0YWNrTmFtZTtcblxuICAgIC8vIEV4cG9ydCBidWNrZXQgQVJOIGZvciBtb25pdG9yaW5nXG4gICAgLy8gVXNlIHN0YWNrIG5hbWUgcHJlZml4IHRvIGVuc3VyZSB1bmlxdWVuZXNzIGFjcm9zcyBhcHBzIGluIHNhbWUgcmVnaW9uXG4gICAgbmV3IENmbk91dHB1dCh0aGlzLCBgJHt0aGlzLmlkfUJ1Y2tldEFybmAsIHtcbiAgICAgIGtleTogYCR7c3RhY2tOYW1lfSR7dGhpcy5pZH1CdWNrZXRBcm5gLFxuICAgICAgZXhwb3J0TmFtZTogYCR7c3RhY2tOYW1lfSR7dGhpcy5pZH1CdWNrZXRBcm5gLFxuICAgICAgdmFsdWU6IHRoaXMuYnVja2V0LmJ1Y2tldEFybixcbiAgICAgIGRlc2NyaXB0aW9uOiBgUzMgQnVja2V0IEFSTiBmb3IgJHt0aGlzLmlkfWBcbiAgICB9KTtcblxuICAgIC8vIEV4cG9ydCBidWNrZXQgbmFtZSBmb3IgY29udmVuaWVuY2VcbiAgICBuZXcgQ2ZuT3V0cHV0KHRoaXMsIGAke3RoaXMuaWR9QnVja2V0TmFtZWAsIHtcbiAgICAgIGtleTogYCR7c3RhY2tOYW1lfSR7dGhpcy5pZH1CdWNrZXROYW1lYCxcbiAgICAgIGV4cG9ydE5hbWU6IGAke3N0YWNrTmFtZX0ke3RoaXMuaWR9QnVja2V0TmFtZWAsXG4gICAgICB2YWx1ZTogdGhpcy5idWNrZXQuYnVja2V0TmFtZSxcbiAgICAgIGRlc2NyaXB0aW9uOiBgUzMgQnVja2V0IE5hbWUgZm9yICR7dGhpcy5pZH1gXG4gICAgfSk7XG4gIH1cblxuICBnZXRCdWNrZXQoKTogSUJ1Y2tldCB7XG4gICAgcmV0dXJuIHRoaXMuYnVja2V0O1xuICB9XG5cbiAgZ2V0QnVja2V0TmFtZSgpOiBzdHJpbmcge1xuICAgIHJldHVybiB0aGlzLmJ1Y2tldC5idWNrZXROYW1lO1xuICB9XG5cbiAgZ2V0QnVja2V0QXJuKCk6IHN0cmluZyB7XG4gICAgcmV0dXJuIHRoaXMuYnVja2V0LmJ1Y2tldEFybjtcbiAgfVxuXG4gIGdldEJ1Y2tldFR5cGUoKTogUzNCdWNrZXRUeXBlIHtcbiAgICByZXR1cm4gdGhpcy5idWNrZXRUeXBlO1xuICB9XG59XG4iXX0=

package/dist/lib/resources/aws/cicd/cicdRole.d.ts

@@ -0,0 +1,65 @@
+import { Role, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { type Construct } from "constructs";
+/**
+ * Supported CI/CD providers
+ */
+export type CICDProvider = "github-actions" | "buildkite" | "gitlab-ci";
+/**
+ * Configuration for creating a CI/CD deploy role
+ */
+export interface CICDRoleConfig {
+    /**
+     * The CI/CD provider (github-actions, buildkite, gitlab-ci)
+     */
+    provider: CICDProvider;
+    /**
+     * The application name to scope the role's permissions to
+     */
+    appName: string;
+    /**
+     * For GitHub Actions: repository (org/repo)
+     * For Buildkite: organization slug
+     * For GitLab CI: project path (group/project)
+     */
+    repositoryOrOrg: string;
+    /**
+     * Optional role name. Defaults to "FjallDeploy-{provider}-{appName}"
+     */
+    roleName?: string;
+    /**
+     * Optional IAM path for the role. Defaults to "/"
+     */
+    rolePath?: string;
+    /**
+     * Optional custom permissions. If not provided, default deployment permissions will be used.
+     */
+    customPermissions?: PolicyStatement[];
+    /**
+     * Whether to use existing OIDC provider or create a new one
+     * If true, will look for existing provider by URL
+     */
+    useExistingProvider?: boolean;
+    /**
+     * Optional ARN of existing OIDC provider (skips creation)
+     */
+    existingProviderArn?: string;
+}
+/**
+ * Factory to build a CI/CD deploy IAM role with OIDC authentication.
+ * Creates both the OIDC provider (if needed) and the deploy role with appropriate permissions.
+ */
+export declare class CICDRoleFactory {
+    /**
+     * Build a CI/CD deploy role with OIDC authentication
+     */
+    static build(id: string, config: CICDRoleConfig): (app: Construct, scope: Construct) => Role;
+    /**
+     * Build trust policy conditions based on CI/CD provider
+     */
+    private static buildTrustConditions;
+    /**
+     * Add default deployment permissions to the role
+     */
+    private static addDefaultDeployPermissions;
+}
+export default CICDRoleFactory;

package/dist/lib/resources/aws/cicd/cicdRole.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CICDRoleFactory = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+/**
+ * OIDC provider configurations for different CI/CD systems
+ */
+const OIDC_CONFIGS = {
+    "github-actions": {
+        url: "https://token.actions.githubusercontent.com",
+        clientIds: ["sts.amazonaws.com"],
+        thumbprints: [
+            "6938fd4d98bab03faadb97b34396831e3780aea1",
+            "1c58a3a8518e8759bf075b76b750d4f2df264fcd"
+        ]
+    },
+    buildkite: {
+        url: "https://agent.buildkite.com",
+        clientIds: ["sts.amazonaws.com"],
+        thumbprints: ["9e99a48a9960b14926bb7f3b02e22da2b0ab7280"]
+    },
+    "gitlab-ci": {
+        url: "https://gitlab.com",
+        clientIds: ["https://gitlab.com"],
+        thumbprints: ["b3dd7606d2b5a8b4a13771dbecc9ee1cecafa38a"]
+    }
+};
+/**
+ * Factory to build a CI/CD deploy IAM role with OIDC authentication.
+ * Creates both the OIDC provider (if needed) and the deploy role with appropriate permissions.
+ */
+class CICDRoleFactory {
+    /**
+     * Build a CI/CD deploy role with OIDC authentication
+     */
+    static build(id, config) {
+        return (_app, scope) => {
+            const providerConfig = OIDC_CONFIGS[config.provider];
+            const roleName = config.roleName || `FjallDeploy-${config.provider}-${config.appName}`;
+            // Create or reference OIDC provider
+            let oidcProvider;
+            if (config.existingProviderArn) {
+                // Use existing provider by ARN
+                oidcProvider = aws_iam_1.OpenIdConnectProvider.fromOpenIdConnectProviderArn(scope, `${id}OidcProvider`, config.existingProviderArn);
+            }
+            else {
+                // Create new OIDC provider
+                oidcProvider = new aws_iam_1.OpenIdConnectProvider(scope, `${id}OidcProvider`, {
+                    url: providerConfig.url,
+                    clientIds: providerConfig.clientIds,
+                    thumbprints: providerConfig.thumbprints
+                });
+            }
+            // Build trust policy conditions based on provider
+            const conditions = this.buildTrustConditions(config.provider, config.repositoryOrOrg, oidcProvider.openIdConnectProviderIssuer);
+            // Create the role with OIDC web identity principal
+            const role = new aws_iam_1.Role(scope, id, {
+                roleName: roleName,
+                path: config.rolePath || "/",
+                assumedBy: new aws_iam_1.WebIdentityPrincipal(oidcProvider.openIdConnectProviderArn, conditions),
+                description: `CI/CD deploy role for ${config.provider} - ${config.appName}`
+            });
+            // Add permissions
+            if (config.customPermissions) {
+                config.customPermissions.forEach((statement) => {
+                    role.addToPolicy(statement);
+                });
+            }
+            else {
+                this.addDefaultDeployPermissions(role);
+            }
+            // Export the role ARN
+            new aws_cdk_lib_1.CfnOutput(scope, `${id}Arn`, {
+                value: role.roleArn,
+                description: `ARN of the CI/CD deploy role for ${config.appName}`,
+                exportName: `${config.appName}-CICDRoleArn`
+            });
+            // Export the OIDC provider ARN
+            new aws_cdk_lib_1.CfnOutput(scope, `${id}ProviderArn`, {
+                value: oidcProvider.openIdConnectProviderArn,
+                description: `ARN of the OIDC provider for ${config.provider}`,
+                exportName: `${config.appName}-CICDProviderArn`
+            });
+            return role;
+        };
+    }
+    /**
+     * Build trust policy conditions based on CI/CD provider
+     */
+    static buildTrustConditions(provider, repositoryOrOrg, issuer) {
+        const conditions = {
+            StringEquals: {
+                [`${issuer}:aud`]: OIDC_CONFIGS[provider].clientIds[0]
+            }
+        };
+        // Add provider-specific subject claim conditions
+        switch (provider) {
+            case "github-actions":
+                conditions.StringLike = {
+                    [`${issuer}:sub`]: `repo:${repositoryOrOrg}:*`
+                };
+                break;
+            case "buildkite":
+                conditions.StringLike = {
+                    [`${issuer}:sub`]: `organization:${repositoryOrOrg}:*`
+                };
+                break;
+            case "gitlab-ci":
+                conditions.StringLike = {
+                    [`${issuer}:sub`]: `project_path:${repositoryOrOrg}:*`
+                };
+                break;
+        }
+        return conditions;
+    }
+    /**
+     * Add default deployment permissions to the role
+     */
+    static addDefaultDeployPermissions(role) {
+        // CloudFormation permissions for CDK deployments
+        role.addToPolicy(new aws_iam_1.PolicyStatement({
+            effect: aws_iam_1.Effect.ALLOW,
+            actions: ["cloudformation:*"],
+            resources: ["*"]
+        }));
+        // S3 permissions for CDK assets
+        role.addToPolicy(new aws_iam_1.PolicyStatement({
+            effect: aws_iam_1.Effect.ALLOW,
+            actions: ["s3:*"],
+            resources: ["*"]
+        }));
+        // ECR permissions for container images
+        role.addToPolicy(new aws_iam_1.PolicyStatement({
+            effect: aws_iam_1.Effect.ALLOW,
+            actions: ["ecr:*"],
+            resources: ["*"]
+        }));
+        // ECS permissions for service deployments
+        role.addToPolicy(new aws_iam_1.PolicyStatement({
+            effect: aws_iam_1.Effect.ALLOW,
+            actions: ["ecs:*"],
+            resources: ["*"]
+        }));
+        // CloudWatch Logs permissions
+        role.addToPolicy(new aws_iam_1.PolicyStatement({
+            effect: aws_iam_1.Effect.ALLOW,
+            actions: ["logs:*"],
+            resources: ["*"]
+        }));
+        // IAM permissions for role management
+        role.addToPolicy(new aws_iam_1.PolicyStatement({
+            effect: aws_iam_1.Effect.ALLOW,
+            actions: [
+                "iam:PassRole",
+                "iam:GetRole",
+                "iam:CreateRole",
+                "iam:DeleteRole",
+                "iam:AttachRolePolicy",
+                "iam:DetachRolePolicy",
+                "iam:PutRolePolicy",
+                "iam:DeleteRolePolicy"
+            ],
+            resources: ["*"]
+        }));
+        // SSM and Secrets Manager for runtime configuration
+        role.addToPolicy(new aws_iam_1.PolicyStatement({
+            effect: aws_iam_1.Effect.ALLOW,
+            actions: [
+                "ssm:GetParameter",
+                "ssm:GetParameters",
+                "secretsmanager:GetSecretValue"
+            ],
+            resources: ["*"]
+        }));
+        // EC2 permissions for VPC/networking queries
+        role.addToPolicy(new aws_iam_1.PolicyStatement({
+            effect: aws_iam_1.Effect.ALLOW,
+            actions: [
+                "ec2:DescribeAvailabilityZones",
+                "ec2:DescribeVpcs",
+                "ec2:DescribeSubnets",
+                "ec2:DescribeSecurityGroups"
+            ],
+            resources: ["*"]
+        }));
+    }
+}
+exports.CICDRoleFactory = CICDRoleFactory;
+exports.default = CICDRoleFactory;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2ljZFJvbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9saWIvcmVzb3VyY2VzL2F3cy9jaWNkL2NpY2RSb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDZDQUF3QztBQUN4QyxpREFNNkI7QUFpRTdCOztHQUVHO0FBQ0gsTUFBTSxZQUFZLEdBQTZDO0lBQzdELGdCQUFnQixFQUFFO1FBQ2hCLEdBQUcsRUFBRSw2Q0FBNkM7UUFDbEQsU0FBUyxFQUFFLENBQUMsbUJBQW1CLENBQUM7UUFDaEMsV0FBVyxFQUFFO1lBQ1gsMENBQTBDO1lBQzFDLDBDQUEwQztTQUMzQztLQUNGO0lBQ0QsU0FBUyxFQUFFO1FBQ1QsR0FBRyxFQUFFLDZCQUE2QjtRQUNsQyxTQUFTLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQztRQUNoQyxXQUFXLEVBQUUsQ0FBQywwQ0FBMEMsQ0FBQztLQUMxRDtJQUNELFdBQVcsRUFBRTtRQUNYLEdBQUcsRUFBRSxvQkFBb0I7UUFDekIsU0FBUyxFQUFFLENBQUMsb0JBQW9CLENBQUM7UUFDakMsV0FBVyxFQUFFLENBQUMsMENBQTBDLENBQUM7S0FDMUQ7Q0FDRixDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBYSxlQUFlO0lBQzFCOztPQUVHO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FDakIsRUFBVSxFQUNWLE1BQXNCO1FBRXRCLE9BQU8sQ0FBQyxJQUFlLEVBQUUsS0FBZ0IsRUFBRSxFQUFFO1lBQzNDLE1BQU0sY0FBYyxHQUFHLFlBQVksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDckQsTUFBTSxRQUFRLEdBQ1osTUFBTSxDQUFDLFFBQVEsSUFBSSxlQUFlLE1BQU0sQ0FBQyxRQUFRLElBQUksTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBRXhFLG9DQUFvQztZQUNwQyxJQUFJLFlBQW1DLENBQUM7WUFFeEMsSUFBSSxNQUFNLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztnQkFDL0IsK0JBQStCO2dCQUMvQixZQUFZLEdBQUcsK0JBQXFCLENBQUMsNEJBQTRCLENBQy9ELEtBQUssRUFDTCxHQUFHLEVBQUUsY0FBYyxFQUNuQixNQUFNLENBQUMsbUJBQW1CLENBQzNCLENBQUM7WUFDSixDQUFDO2lCQUFNLENBQUM7Z0JBQ04sMkJBQTJCO2dCQUMzQixZQUFZLEdBQUcsSUFBSSwrQkFBcUIsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLGNBQWMsRUFBRTtvQkFDbkUsR0FBRyxFQUFFLGNBQWMsQ0FBQyxHQUFHO29CQUN2QixTQUFTLEVBQUUsY0FBYyxDQUFDLFNBQVM7b0JBQ25DLFdBQVcsRUFBRSxjQUFjLENBQUMsV0FBVztpQkFDeEMsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztZQUVELGtEQUFrRDtZQUNsRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsb0JBQW9CLENBQzFDLE1BQU0sQ0FBQyxRQUFRLEVBQ2YsTUFBTSxDQUFDLGVBQWUsRUFDdEIsWUFBWSxDQUFDLDJCQUEyQixDQUN6QyxDQUFDO1lBRUYsbURBQW1EO1lBQ25ELE1BQU0sSUFBSSxHQUFHLElBQUksY0FBSSxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7Z0JBQy9CLFFBQVEsRUFBRSxRQUFRO2dCQUNsQixJQUFJLEVBQUUsTUFBTSxDQUFDLFFBQVEsSUFBSSxHQUFHO2dCQUM1QixTQUFTLEVBQUUsSUFBSSw4QkFBb0IsQ0FDakMsWUFBWSxDQUFDLHdCQUF3QixFQUNyQyxVQUFVLENBQ1g7Z0JBQ0QsV0FBVyxFQUFFLHlCQUF5QixNQUFNLENBQUMsUUFBUSxNQUFNLE1BQU0sQ0FBQyxPQUFPLEVBQUU7YUFDNUUsQ0FBQyxDQUFDO1lBRUgsa0JBQWtCO1lBQ2xCLElBQUksTUFBTSxDQUFDLGlCQUFpQixFQUFFLENBQUM7Z0JBQzdCLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRTtvQkFDN0MsSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDOUIsQ0FBQyxDQUFDLENBQUM7WUFDTCxDQUFDO2lCQUFNLENBQUM7Z0JBQ04sSUFBSSxDQUFDLDJCQUEyQixDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3pDLENBQUM7WUFFRCxzQkFBc0I7WUFDdEIsSUFBSSx1QkFBUyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsS0FBSyxFQUFFO2dCQUMvQixLQUFLLEVBQUUsSUFBSSxDQUFDLE9BQU87Z0JBQ25CLFdBQVcsRUFBRSxvQ0FBb0MsTUFBTSxDQUFDLE9BQU8sRUFBRTtnQkFDakUsVUFBVSxFQUFFLEdBQUcsTUFBTSxDQUFDLE9BQU8sY0FBYzthQUM1QyxDQUFDLENBQUM7WUFFSCwrQkFBK0I7WUFDL0IsSUFBSSx1QkFBUyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsYUFBYSxFQUFFO2dCQUN2QyxLQUFLLEVBQUUsWUFBWSxDQUFDLHdCQUF3QjtnQkFDNUMsV0FBVyxFQUFFLGdDQUFnQyxNQUFNLENBQUMsUUFBUSxFQUFFO2dCQUM5RCxVQUFVLEVBQUUsR0FBRyxNQUFNLENBQUMsT0FBTyxrQkFBa0I7YUFDaEQsQ0FBQyxDQUFDO1lBRUgsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDLENBQUM7SUFDSixDQUFDO0lBRUQ7O09BRUc7SUFDSyxNQUFNLENBQUMsb0JBQW9CLENBQ2pDLFFBQXNCLEVBQ3RCLGVBQXVCLEVBQ3ZCLE1BQWM7UUFFZCxNQUFNLFVBQVUsR0FBNEI7WUFDMUMsWUFBWSxFQUFFO2dCQUNaLENBQUMsR0FBRyxNQUFNLE1BQU0sQ0FBQyxFQUFFLFlBQVksQ0FBQyxRQUFRLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO2FBQ3ZEO1NBQ0YsQ0FBQztRQUVGLGlEQUFpRDtRQUNqRCxRQUFRLFFBQVEsRUFBRSxDQUFDO1lBQ2pCLEtBQUssZ0JBQWdCO2dCQUNuQixVQUFVLENBQUMsVUFBVSxHQUFHO29CQUN0QixDQUFDLEdBQUcsTUFBTSxNQUFNLENBQUMsRUFBRSxRQUFRLGVBQWUsSUFBSTtpQkFDL0MsQ0FBQztnQkFDRixNQUFNO1lBRVIsS0FBSyxXQUFXO2dCQUNkLFVBQVUsQ0FBQyxVQUFVLEdBQUc7b0JBQ3RCLENBQUMsR0FBRyxNQUFNLE1BQU0sQ0FBQyxFQUFFLGdCQUFnQixlQUFlLElBQUk7aUJBQ3ZELENBQUM7Z0JBQ0YsTUFBTTtZQUVSLEtBQUssV0FBVztnQkFDZCxVQUFVLENBQUMsVUFBVSxHQUFHO29CQUN0QixDQUFDLEdBQUcsTUFBTSxNQUFNLENBQUMsRUFBRSxnQkFBZ0IsZUFBZSxJQUFJO2lCQUN2RCxDQUFDO2dCQUNGLE1BQU07UUFDVixDQUFDO1FBRUQsT0FBTyxVQUFVLENBQUM7SUFDcEIsQ0FBQztJQUVEOztPQUVHO0lBQ0ssTUFBTSxDQUFDLDJCQUEyQixDQUFDLElBQVU7UUFDbkQsaURBQWlEO1FBQ2pELElBQUksQ0FBQyxXQUFXLENBQ2QsSUFBSSx5QkFBZSxDQUFDO1lBQ2xCLE1BQU0sRUFBRSxnQkFBTSxDQUFDLEtBQUs7WUFDcEIsT0FBTyxFQUFFLENBQUMsa0JBQWtCLENBQUM7WUFDN0IsU0FBUyxFQUFFLENBQUMsR0FBRyxDQUFDO1NBQ2pCLENBQUMsQ0FDSCxDQUFDO1FBRUYsZ0NBQWdDO1FBQ2hDLElBQUksQ0FBQyxXQUFXLENBQ2QsSUFBSSx5QkFBZSxDQUFDO1lBQ2xCLE1BQU0sRUFBRSxnQkFBTSxDQUFDLEtBQUs7WUFDcEIsT0FBTyxFQUFFLENBQUMsTUFBTSxDQUFDO1lBQ2pCLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQztTQUNqQixDQUFDLENBQ0gsQ0FBQztRQUVGLHVDQUF1QztRQUN2QyxJQUFJLENBQUMsV0FBVyxDQUNkLElBQUkseUJBQWUsQ0FBQztZQUNsQixNQUFNLEVBQUUsZ0JBQU0sQ0FBQyxLQUFLO1lBQ3BCLE9BQU8sRUFBRSxDQUFDLE9BQU8sQ0FBQztZQUNsQixTQUFTLEVBQUUsQ0FBQyxHQUFHLENBQUM7U0FDakIsQ0FBQyxDQUNILENBQUM7UUFFRiwwQ0FBMEM7UUFDMUMsSUFBSSxDQUFDLFdBQVcsQ0FDZCxJQUFJLHlCQUFlLENBQUM7WUFDbEIsTUFBTSxFQUFFLGdCQUFNLENBQUMsS0FBSztZQUNwQixPQUFPLEVBQUUsQ0FBQyxPQUFPLENBQUM7WUFDbEIsU0FBUyxFQUFFLENBQUMsR0FBRyxDQUFDO1NBQ2pCLENBQUMsQ0FDSCxDQUFDO1FBRUYsOEJBQThCO1FBQzlCLElBQUksQ0FBQyxXQUFXLENBQ2QsSUFBSSx5QkFBZSxDQUFDO1lBQ2xCLE1BQU0sRUFBRSxnQkFBTSxDQUFDLEtBQUs7WUFDcEIsT0FBTyxFQUFFLENBQUMsUUFBUSxDQUFDO1lBQ25CLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQztTQUNqQixDQUFDLENBQ0gsQ0FBQztRQUVGLHNDQUFzQztRQUN0QyxJQUFJLENBQUMsV0FBVyxDQUNkLElBQUkseUJBQWUsQ0FBQztZQUNsQixNQUFNLEVBQUUsZ0JBQU0sQ0FBQyxLQUFLO1lBQ3BCLE9BQU8sRUFBRTtnQkFDUCxjQUFjO2dCQUNkLGFBQWE7Z0JBQ2IsZ0JBQWdCO2dCQUNoQixnQkFBZ0I7Z0JBQ2hCLHNCQUFzQjtnQkFDdEIsc0JBQXNCO2dCQUN0QixtQkFBbUI7Z0JBQ25CLHNCQUFzQjthQUN2QjtZQUNELFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQztTQUNqQixDQUFDLENBQ0gsQ0FBQztRQUVGLG9EQUFvRDtRQUNwRCxJQUFJLENBQUMsV0FBVyxDQUNkLElBQUkseUJBQWUsQ0FBQztZQUNsQixNQUFNLEVBQUUsZ0JBQU0sQ0FBQyxLQUFLO1lBQ3BCLE9BQU8sRUFBRTtnQkFDUCxrQkFBa0I7Z0JBQ2xCLG1CQUFtQjtnQkFDbkIsK0JBQStCO2FBQ2hDO1lBQ0QsU0FBUyxFQUFFLENBQUMsR0FBRyxDQUFDO1NBQ2pCLENBQUMsQ0FDSCxDQUFDO1FBRUYsNkNBQTZDO1FBQzdDLElBQUksQ0FBQyxXQUFXLENBQ2QsSUFBSSx5QkFBZSxDQUFDO1lBQ2xCLE1BQU0sRUFBRSxnQkFBTSxDQUFDLEtBQUs7WUFDcEIsT0FBTyxFQUFFO2dCQUNQLCtCQUErQjtnQkFDL0Isa0JBQWtCO2dCQUNsQixxQkFBcUI7Z0JBQ3JCLDRCQUE0QjthQUM3QjtZQUNELFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQztTQUNqQixDQUFDLENBQ0gsQ0FBQztJQUNKLENBQUM7Q0FDRjtBQWpORCwwQ0FpTkM7QUFFRCxrQkFBZSxlQUFlLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDZm5PdXRwdXQgfSBmcm9tIFwiYXdzLWNkay1saWJcIjtcbmltcG9ydCB7XG4gIFJvbGUsXG4gIFdlYklkZW50aXR5UHJpbmNpcGFsLFxuICBPcGVuSWRDb25uZWN0UHJvdmlkZXIsXG4gIFBvbGljeVN0YXRlbWVudCxcbiAgRWZmZWN0XG59IGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtaWFtXCI7XG5pbXBvcnQgeyB0eXBlIENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5cbi8qKlxuICogU3VwcG9ydGVkIENJL0NEIHByb3ZpZGVyc1xuICovXG5leHBvcnQgdHlwZSBDSUNEUHJvdmlkZXIgPSBcImdpdGh1Yi1hY3Rpb25zXCIgfCBcImJ1aWxka2l0ZVwiIHwgXCJnaXRsYWItY2lcIjtcblxuLyoqXG4gKiBPSURDIHByb3ZpZGVyIGNvbmZpZ3VyYXRpb25cbiAqL1xuaW50ZXJmYWNlIE9JRENQcm92aWRlckNvbmZpZyB7XG4gIHVybDogc3RyaW5nO1xuICBjbGllbnRJZHM6IHN0cmluZ1tdO1xuICB0aHVtYnByaW50czogc3RyaW5nW107XG59XG5cbi8qKlxuICogQ29uZmlndXJhdGlvbiBmb3IgY3JlYXRpbmcgYSBDSS9DRCBkZXBsb3kgcm9sZVxuICovXG5leHBvcnQgaW50ZXJmYWNlIENJQ0RSb2xlQ29uZmlnIHtcbiAgLyoqXG4gICAqIFRoZSBDSS9DRCBwcm92aWRlciAoZ2l0aHViLWFjdGlvbnMsIGJ1aWxka2l0ZSwgZ2l0bGFiLWNpKVxuICAgKi9cbiAgcHJvdmlkZXI6IENJQ0RQcm92aWRlcjtcblxuICAvKipcbiAgICogVGhlIGFwcGxpY2F0aW9uIG5hbWUgdG8gc2NvcGUgdGhlIHJvbGUncyBwZXJtaXNzaW9ucyB0b1xuICAgKi9cbiAgYXBwTmFtZTogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBGb3IgR2l0SHViIEFjdGlvbnM6IHJlcG9zaXRvcnkgKG9yZy9yZXBvKVxuICAgKiBGb3IgQnVpbGRraXRlOiBvcmdhbml6YXRpb24gc2x1Z1xuICAgKiBGb3IgR2l0TGFiIENJOiBwcm9qZWN0IHBhdGggKGdyb3VwL3Byb2plY3QpXG4gICAqL1xuICByZXBvc2l0b3J5T3JPcmc6IHN0cmluZztcblxuICAvKipcbiAgICogT3B0aW9uYWwgcm9sZSBuYW1lLiBEZWZhdWx0cyB0byBcIkZqYWxsRGVwbG95LXtwcm92aWRlcn0te2FwcE5hbWV9XCJcbiAgICovXG4gIHJvbGVOYW1lPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBJQU0gcGF0aCBmb3IgdGhlIHJvbGUuIERlZmF1bHRzIHRvIFwiL1wiXG4gICAqL1xuICByb2xlUGF0aD86IHN0cmluZztcblxuICAvKipcbiAgICogT3B0aW9uYWwgY3VzdG9tIHBlcm1pc3Npb25zLiBJZiBub3QgcHJvdmlkZWQsIGRlZmF1bHQgZGVwbG95bWVudCBwZXJtaXNzaW9ucyB3aWxsIGJlIHVzZWQuXG4gICAqL1xuICBjdXN0b21QZXJtaXNzaW9ucz86IFBvbGljeVN0YXRlbWVudFtdO1xuXG4gIC8qKlxuICAgKiBXaGV0aGVyIHRvIHVzZSBleGlzdGluZyBPSURDIHByb3ZpZGVyIG9yIGNyZWF0ZSBhIG5ldyBvbmVcbiAgICogSWYgdHJ1ZSwgd2lsbCBsb29rIGZvciBleGlzdGluZyBwcm92aWRlciBieSBVUkxcbiAgICovXG4gIHVzZUV4aXN0aW5nUHJvdmlkZXI/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBBUk4gb2YgZXhpc3RpbmcgT0lEQyBwcm92aWRlciAoc2tpcHMgY3JlYXRpb24pXG4gICAqL1xuICBleGlzdGluZ1Byb3ZpZGVyQXJuPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIE9JREMgcHJvdmlkZXIgY29uZmlndXJhdGlvbnMgZm9yIGRpZmZlcmVudCBDSS9DRCBzeXN0ZW1zXG4gKi9cbmNvbnN0IE9JRENfQ09ORklHUzogUmVjb3JkPENJQ0RQcm92aWRlciwgT0lEQ1Byb3ZpZGVyQ29uZmlnPiA9IHtcbiAgXCJnaXRodWItYWN0aW9uc1wiOiB7XG4gICAgdXJsOiBcImh0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb21cIixcbiAgICBjbGllbnRJZHM6IFtcInN0cy5hbWF6b25hd3MuY29tXCJdLFxuICAgIHRodW1icHJpbnRzOiBbXG4gICAgICBcIjY5MzhmZDRkOThiYWIwM2ZhYWRiOTdiMzQzOTY4MzFlMzc4MGFlYTFcIixcbiAgICAgIFwiMWM1OGEzYTg1MThlODc1OWJmMDc1Yjc2Yjc1MGQ0ZjJkZjI2NGZjZFwiXG4gICAgXVxuICB9LFxuICBidWlsZGtpdGU6IHtcbiAgICB1cmw6IFwiaHR0cHM6Ly9hZ2VudC5idWlsZGtpdGUuY29tXCIsXG4gICAgY2xpZW50SWRzOiBbXCJzdHMuYW1hem9uYXdzLmNvbVwiXSxcbiAgICB0aHVtYnByaW50czogW1wiOWU5OWE0OGE5OTYwYjE0OTI2YmI3ZjNiMDJlMjJkYTJiMGFiNzI4MFwiXVxuICB9LFxuICBcImdpdGxhYi1jaVwiOiB7XG4gICAgdXJsOiBcImh0dHBzOi8vZ2l0bGFiLmNvbVwiLFxuICAgIGNsaWVudElkczogW1wiaHR0cHM6Ly9naXRsYWIuY29tXCJdLFxuICAgIHRodW1icHJpbnRzOiBbXCJiM2RkNzYwNmQyYjVhOGI0YTEzNzcxZGJlY2M5ZWUxY2VjYWZhMzhhXCJdXG4gIH1cbn07XG5cbi8qKlxuICogRmFjdG9yeSB0byBidWlsZCBhIENJL0NEIGRlcGxveSBJQU0gcm9sZSB3aXRoIE9JREMgYXV0aGVudGljYXRpb24uXG4gKiBDcmVhdGVzIGJvdGggdGhlIE9JREMgcHJvdmlkZXIgKGlmIG5lZWRlZCkgYW5kIHRoZSBkZXBsb3kgcm9sZSB3aXRoIGFwcHJvcHJpYXRlIHBlcm1pc3Npb25zLlxuICovXG5leHBvcnQgY2xhc3MgQ0lDRFJvbGVGYWN0b3J5IHtcbiAgLyoqXG4gICAqIEJ1aWxkIGEgQ0kvQ0QgZGVwbG95IHJvbGUgd2l0aCBPSURDIGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGJ1aWxkKFxuICAgIGlkOiBzdHJpbmcsXG4gICAgY29uZmlnOiBDSUNEUm9sZUNvbmZpZ1xuICApOiAoYXBwOiBDb25zdHJ1Y3QsIHNjb3BlOiBDb25zdHJ1Y3QpID0+IFJvbGUge1xuICAgIHJldHVybiAoX2FwcDogQ29uc3RydWN0LCBzY29wZTogQ29uc3RydWN0KSA9PiB7XG4gICAgICBjb25zdCBwcm92aWRlckNvbmZpZyA9IE9JRENfQ09ORklHU1tjb25maWcucHJvdmlkZXJdO1xuICAgICAgY29uc3Qgcm9sZU5hbWUgPVxuICAgICAgICBjb25maWcucm9sZU5hbWUgfHwgYEZqYWxsRGVwbG95LSR7Y29uZmlnLnByb3ZpZGVyfS0ke2NvbmZpZy5hcHBOYW1lfWA7XG5cbiAgICAgIC8vIENyZWF0ZSBvciByZWZlcmVuY2UgT0lEQyBwcm92aWRlclxuICAgICAgbGV0IG9pZGNQcm92aWRlcjogT3BlbklkQ29ubmVjdFByb3ZpZGVyO1xuXG4gICAgICBpZiAoY29uZmlnLmV4aXN0aW5nUHJvdmlkZXJBcm4pIHtcbiAgICAgICAgLy8gVXNlIGV4aXN0aW5nIHByb3ZpZGVyIGJ5IEFSTlxuICAgICAgICBvaWRjUHJvdmlkZXIgPSBPcGVuSWRDb25uZWN0UHJvdmlkZXIuZnJvbU9wZW5JZENvbm5lY3RQcm92aWRlckFybihcbiAgICAgICAgICBzY29wZSxcbiAgICAgICAgICBgJHtpZH1PaWRjUHJvdmlkZXJgLFxuICAgICAgICAgIGNvbmZpZy5leGlzdGluZ1Byb3ZpZGVyQXJuXG4gICAgICAgICk7XG4gICAgICB9IGVsc2Uge1xuICAgICAgICAvLyBDcmVhdGUgbmV3IE9JREMgcHJvdmlkZXJcbiAgICAgICAgb2lkY1Byb3ZpZGVyID0gbmV3IE9wZW5JZENvbm5lY3RQcm92aWRlcihzY29wZSwgYCR7aWR9T2lkY1Byb3ZpZGVyYCwge1xuICAgICAgICAgIHVybDogcHJvdmlkZXJDb25maWcudXJsLFxuICAgICAgICAgIGNsaWVudElkczogcHJvdmlkZXJDb25maWcuY2xpZW50SWRzLFxuICAgICAgICAgIHRodW1icHJpbnRzOiBwcm92aWRlckNvbmZpZy50aHVtYnByaW50c1xuICAgICAgICB9KTtcbiAgICAgIH1cblxuICAgICAgLy8gQnVpbGQgdHJ1c3QgcG9saWN5IGNvbmRpdGlvbnMgYmFzZWQgb24gcHJvdmlkZXJcbiAgICAgIGNvbnN0IGNvbmRpdGlvbnMgPSB0aGlzLmJ1aWxkVHJ1c3RDb25kaXRpb25zKFxuICAgICAgICBjb25maWcucHJvdmlkZXIsXG4gICAgICAgIGNvbmZpZy5yZXBvc2l0b3J5T3JPcmcsXG4gICAgICAgIG9pZGNQcm92aWRlci5vcGVuSWRDb25uZWN0UHJvdmlkZXJJc3N1ZXJcbiAgICAgICk7XG5cbiAgICAgIC8vIENyZWF0ZSB0aGUgcm9sZSB3aXRoIE9JREMgd2ViIGlkZW50aXR5IHByaW5jaXBhbFxuICAgICAgY29uc3Qgcm9sZSA9IG5ldyBSb2xlKHNjb3BlLCBpZCwge1xuICAgICAgICByb2xlTmFtZTogcm9sZU5hbWUsXG4gICAgICAgIHBhdGg6IGNvbmZpZy5yb2xlUGF0aCB8fCBcIi9cIixcbiAgICAgICAgYXNzdW1lZEJ5OiBuZXcgV2ViSWRlbnRpdHlQcmluY2lwYWwoXG4gICAgICAgICAgb2lkY1Byb3ZpZGVyLm9wZW5JZENvbm5lY3RQcm92aWRlckFybixcbiAgICAgICAgICBjb25kaXRpb25zXG4gICAgICAgICksXG4gICAgICAgIGRlc2NyaXB0aW9uOiBgQ0kvQ0QgZGVwbG95IHJvbGUgZm9yICR7Y29uZmlnLnByb3ZpZGVyfSAtICR7Y29uZmlnLmFwcE5hbWV9YFxuICAgICAgfSk7XG5cbiAgICAgIC8vIEFkZCBwZXJtaXNzaW9uc1xuICAgICAgaWYgKGNvbmZpZy5jdXN0b21QZXJtaXNzaW9ucykge1xuICAgICAgICBjb25maWcuY3VzdG9tUGVybWlzc2lvbnMuZm9yRWFjaCgoc3RhdGVtZW50KSA9PiB7XG4gICAgICAgICAgcm9sZS5hZGRUb1BvbGljeShzdGF0ZW1lbnQpO1xuICAgICAgICB9KTtcbiAgICAgIH0gZWxzZSB7XG4gICAgICAgIHRoaXMuYWRkRGVmYXVsdERlcGxveVBlcm1pc3Npb25zKHJvbGUpO1xuICAgICAgfVxuXG4gICAgICAvLyBFeHBvcnQgdGhlIHJvbGUgQVJOXG4gICAgICBuZXcgQ2ZuT3V0cHV0KHNjb3BlLCBgJHtpZH1Bcm5gLCB7XG4gICAgICAgIHZhbHVlOiByb2xlLnJvbGVBcm4sXG4gICAgICAgIGRlc2NyaXB0aW9uOiBgQVJOIG9mIHRoZSBDSS9DRCBkZXBsb3kgcm9sZSBmb3IgJHtjb25maWcuYXBwTmFtZX1gLFxuICAgICAgICBleHBvcnROYW1lOiBgJHtjb25maWcuYXBwTmFtZX0tQ0lDRFJvbGVBcm5gXG4gICAgICB9KTtcblxuICAgICAgLy8gRXhwb3J0IHRoZSBPSURDIHByb3ZpZGVyIEFSTlxuICAgICAgbmV3IENmbk91dHB1dChzY29wZSwgYCR7aWR9UHJvdmlkZXJBcm5gLCB7XG4gICAgICAgIHZhbHVlOiBvaWRjUHJvdmlkZXIub3BlbklkQ29ubmVjdFByb3ZpZGVyQXJuLFxuICAgICAgICBkZXNjcmlwdGlvbjogYEFSTiBvZiB0aGUgT0lEQyBwcm92aWRlciBmb3IgJHtjb25maWcucHJvdmlkZXJ9YCxcbiAgICAgICAgZXhwb3J0TmFtZTogYCR7Y29uZmlnLmFwcE5hbWV9LUNJQ0RQcm92aWRlckFybmBcbiAgICAgIH0pO1xuXG4gICAgICByZXR1cm4gcm9sZTtcbiAgICB9O1xuICB9XG5cbiAgLyoqXG4gICAqIEJ1aWxkIHRydXN0IHBvbGljeSBjb25kaXRpb25zIGJhc2VkIG9uIENJL0NEIHByb3ZpZGVyXG4gICAqL1xuICBwcml2YXRlIHN0YXRpYyBidWlsZFRydXN0Q29uZGl0aW9ucyhcbiAgICBwcm92aWRlcjogQ0lDRFByb3ZpZGVyLFxuICAgIHJlcG9zaXRvcnlPck9yZzogc3RyaW5nLFxuICAgIGlzc3Vlcjogc3RyaW5nXG4gICk6IFJlY29yZDxzdHJpbmcsIHVua25vd24+IHtcbiAgICBjb25zdCBjb25kaXRpb25zOiBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPiA9IHtcbiAgICAgIFN0cmluZ0VxdWFsczoge1xuICAgICAgICBbYCR7aXNzdWVyfTphdWRgXTogT0lEQ19DT05GSUdTW3Byb3ZpZGVyXS5jbGllbnRJZHNbMF1cbiAgICAgIH1cbiAgICB9O1xuXG4gICAgLy8gQWRkIHByb3ZpZGVyLXNwZWNpZmljIHN1YmplY3QgY2xhaW0gY29uZGl0aW9uc1xuICAgIHN3aXRjaCAocHJvdmlkZXIpIHtcbiAgICAgIGNhc2UgXCJnaXRodWItYWN0aW9uc1wiOlxuICAgICAgICBjb25kaXRpb25zLlN0cmluZ0xpa2UgPSB7XG4gICAgICAgICAgW2Ake2lzc3Vlcn06c3ViYF06IGByZXBvOiR7cmVwb3NpdG9yeU9yT3JnfToqYFxuICAgICAgICB9O1xuICAgICAgICBicmVhaztcblxuICAgICAgY2FzZSBcImJ1aWxka2l0ZVwiOlxuICAgICAgICBjb25kaXRpb25zLlN0cmluZ0xpa2UgPSB7XG4gICAgICAgICAgW2Ake2lzc3Vlcn06c3ViYF06IGBvcmdhbml6YXRpb246JHtyZXBvc2l0b3J5T3JPcmd9OipgXG4gICAgICAgIH07XG4gICAgICAgIGJyZWFrO1xuXG4gICAgICBjYXNlIFwiZ2l0bGFiLWNpXCI6XG4gICAgICAgIGNvbmRpdGlvbnMuU3RyaW5nTGlrZSA9IHtcbiAgICAgICAgICBbYCR7aXNzdWVyfTpzdWJgXTogYHByb2plY3RfcGF0aDoke3JlcG9zaXRvcnlPck9yZ306KmBcbiAgICAgICAgfTtcbiAgICAgICAgYnJlYWs7XG4gICAgfVxuXG4gICAgcmV0dXJuIGNvbmRpdGlvbnM7XG4gIH1cblxuICAvKipcbiAgICogQWRkIGRlZmF1bHQgZGVwbG95bWVudCBwZXJtaXNzaW9ucyB0byB0aGUgcm9sZVxuICAgKi9cbiAgcHJpdmF0ZSBzdGF0aWMgYWRkRGVmYXVsdERlcGxveVBlcm1pc3Npb25zKHJvbGU6IFJvbGUpOiB2b2lkIHtcbiAgICAvLyBDbG91ZEZvcm1hdGlvbiBwZXJtaXNzaW9ucyBmb3IgQ0RLIGRlcGxveW1lbnRzXG4gICAgcm9sZS5hZGRUb1BvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgICAgYWN0aW9uczogW1wiY2xvdWRmb3JtYXRpb246KlwiXSxcbiAgICAgICAgcmVzb3VyY2VzOiBbXCIqXCJdXG4gICAgICB9KVxuICAgICk7XG5cbiAgICAvLyBTMyBwZXJtaXNzaW9ucyBmb3IgQ0RLIGFzc2V0c1xuICAgIHJvbGUuYWRkVG9Qb2xpY3koXG4gICAgICBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgZWZmZWN0OiBFZmZlY3QuQUxMT1csXG4gICAgICAgIGFjdGlvbnM6IFtcInMzOipcIl0sXG4gICAgICAgIHJlc291cmNlczogW1wiKlwiXVxuICAgICAgfSlcbiAgICApO1xuXG4gICAgLy8gRUNSIHBlcm1pc3Npb25zIGZvciBjb250YWluZXIgaW1hZ2VzXG4gICAgcm9sZS5hZGRUb1BvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgICAgYWN0aW9uczogW1wiZWNyOipcIl0sXG4gICAgICAgIHJlc291cmNlczogW1wiKlwiXVxuICAgICAgfSlcbiAgICApO1xuXG4gICAgLy8gRUNTIHBlcm1pc3Npb25zIGZvciBzZXJ2aWNlIGRlcGxveW1lbnRzXG4gICAgcm9sZS5hZGRUb1BvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgICAgYWN0aW9uczogW1wiZWNzOipcIl0sXG4gICAgICAgIHJlc291cmNlczogW1wiKlwiXVxuICAgICAgfSlcbiAgICApO1xuXG4gICAgLy8gQ2xvdWRXYXRjaCBMb2dzIHBlcm1pc3Npb25zXG4gICAgcm9sZS5hZGRUb1BvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgICAgYWN0aW9uczogW1wibG9nczoqXCJdLFxuICAgICAgICByZXNvdXJjZXM6IFtcIipcIl1cbiAgICAgIH0pXG4gICAgKTtcblxuICAgIC8vIElBTSBwZXJtaXNzaW9ucyBmb3Igcm9sZSBtYW5hZ2VtZW50XG4gICAgcm9sZS5hZGRUb1BvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgIFwiaWFtOlBhc3NSb2xlXCIsXG4gICAgICAgICAgXCJpYW06R2V0Um9sZVwiLFxuICAgICAgICAgIFwiaWFtOkNyZWF0ZVJvbGVcIixcbiAgICAgICAgICBcImlhbTpEZWxldGVSb2xlXCIsXG4gICAgICAgICAgXCJpYW06QXR0YWNoUm9sZVBvbGljeVwiLFxuICAgICAgICAgIFwiaWFtOkRldGFjaFJvbGVQb2xpY3lcIixcbiAgICAgICAgICBcImlhbTpQdXRSb2xlUG9saWN5XCIsXG4gICAgICAgICAgXCJpYW06RGVsZXRlUm9sZVBvbGljeVwiXG4gICAgICAgIF0sXG4gICAgICAgIHJlc291cmNlczogW1wiKlwiXVxuICAgICAgfSlcbiAgICApO1xuXG4gICAgLy8gU1NNIGFuZCBTZWNyZXRzIE1hbmFnZXIgZm9yIHJ1bnRpbWUgY29uZmlndXJhdGlvblxuICAgIHJvbGUuYWRkVG9Qb2xpY3koXG4gICAgICBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgZWZmZWN0OiBFZmZlY3QuQUxMT1csXG4gICAgICAgIGFjdGlvbnM6IFtcbiAgICAgICAgICBcInNzbTpHZXRQYXJhbWV0ZXJcIixcbiAgICAgICAgICBcInNzbTpHZXRQYXJhbWV0ZXJzXCIsXG4gICAgICAgICAgXCJzZWNyZXRzbWFuYWdlcjpHZXRTZWNyZXRWYWx1ZVwiXG4gICAgICAgIF0sXG4gICAgICAgIHJlc291cmNlczogW1wiKlwiXVxuICAgICAgfSlcbiAgICApO1xuXG4gICAgLy8gRUMyIHBlcm1pc3Npb25zIGZvciBWUEMvbmV0d29ya2luZyBxdWVyaWVzXG4gICAgcm9sZS5hZGRUb1BvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IEVmZmVjdC5BTExPVyxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgIFwiZWMyOkRlc2NyaWJlQXZhaWxhYmlsaXR5Wm9uZXNcIixcbiAgICAgICAgICBcImVjMjpEZXNjcmliZVZwY3NcIixcbiAgICAgICAgICBcImVjMjpEZXNjcmliZVN1Ym5ldHNcIixcbiAgICAgICAgICBcImVjMjpEZXNjcmliZVNlY3VyaXR5R3JvdXBzXCJcbiAgICAgICAgXSxcbiAgICAgICAgcmVzb3VyY2VzOiBbXCIqXCJdXG4gICAgICB9KVxuICAgICk7XG4gIH1cbn1cblxuZXhwb3J0IGRlZmF1bHQgQ0lDRFJvbGVGYWN0b3J5O1xuIl19

package/dist/lib/resources/aws/compute/ecs.d.ts

@@ -27,10 +27,12 @@ export interface Ec2CapacityConfig {
     instanceType?: string;
     /** AMI hardware type. Default: "ARM" (Graviton - better cost/performance) */
     amiHardwareType?: "ARM" | "STANDARD";
-    /** Minimum number of instances. Default: 2 */
+    /** Minimum number of instances. Default: 1 */
     minCapacity?: number;
     /** Maximum number of instances. Default: 3 */
     maxCapacity?: number;
+    /** Desired number of EC2 instances. Default: 2 (for availability) */
+    desiredCount?: number;
     /** Memory limit in MiB for the container. Default: 1024 */
     memoryLimitMiB?: number;
 }
@@ -87,10 +89,18 @@ export interface EcsClusterContainerConfig {
     port?: number;
     /** Environment variables */
     environment?: Record<string, string>;
-    /** Secrets imported from other resources */
+    /** Secrets imported from other resources (AWS Secrets Manager) */
     secretsImport?: {
         [key: string]: SecretImport;
     };
+    /**
+     * Secrets from AWS SSM Parameter Store.
+     * Array of secret names that will be fetched from the service's SSM namespace.
+     *
+     * @example
+     * ssmSecrets: ["API_KEY", "DB_PASSWORD"]
+     */
+    ssmSecrets?: string[];
     /** Command to run in the container */
     command?: string[];
     /** Entry point for the container */
@@ -221,6 +231,15 @@ export interface EcsServiceProps {
      * Services with matching ec2Config share an ASG for efficiency.
      */
     ec2Config?: Ec2CapacityConfig;
+    /**
+     * SSM Parameter Store path for secrets.
+     * If containers have ssmSecrets defined, this path is used as the base path.
+     * Format: /<app>/<cluster>/<service>
+     *
+     * @example
+     * ssmSecretsPath: "/myapp/api-cluster/users"
+     */
+    ssmSecretsPath?: string;
 }
 /**
  * Props for creating an ECS cluster with multiple services.
@@ -228,6 +247,12 @@ export interface EcsServiceProps {
 export type EcsClusterProps = {
     /** Cluster name */
     clusterName: string;
+    /**
+     * Application name for SSM secrets namespace.
+     * Required when any container uses ssmSecrets without explicit ssmSecretsPath.
+     * Used to build the path: /<appName>/<clusterName>/<serviceName>
+     */
+    appName?: string;
     /** VPC to deploy into */
     vpc?: IVpc;
     /** Default ECR repository or container image */
@@ -373,6 +398,29 @@ export default class EcsCluster extends Construct implements IConnectable {
      * Checks if a service uses an EC2 capacity provider.
      */
     private isServiceEc2;
+    /**
+     * Validates an SSM path component for correctness.
+     * SSM parameter paths have specific constraints that must be enforced.
+     *
+     * @param component - The path component to validate
+     * @param fieldName - Name of the field for error messages
+     * @throws Error if the component is invalid
+     */
+    private validateSsmPathComponent;
+    /**
+     * Derives the SSM secrets path for a service.
+     * Uses explicit path if provided, otherwise derives from app/cluster/service names.
+     *
+     * @param serviceName - The service name
+     * @param explicitPath - Optional explicit path override
+     * @returns The SSM secrets path (e.g., /myapp/ApiCluster/users)
+     */
+    /**
+     * Collects all Secrets Manager secret names from secretsImport across all services.
+     * Used to scope IAM permissions for least-privilege access.
+     */
+    private collectSecretsManagerSecretNames;
+    private deriveSsmSecretsPath;
     /**
      * Generates a unique key for EC2 config (for ASG deduplication).
      * Services with matching keys share an ASG.