@fjall/components-infrastructure 0.88.3 → 0.89.2

package/dist/lib/patterns/aws/computeEc2.d.ts

@@ -0,0 +1,67 @@
+import { type Connections, type IVpc, type UserData, type IMachineImage, type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
+import { type IAutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
+import { Construct } from "constructs";
+import { type IEc2Compute } from "./interfaces/compute.js";
+import { Ec2Instance } from "../../resources/aws/compute/ec2";
+/**
+ * SSH access configuration for EC2 instances.
+ * - Omit: disabled (default)
+ * - `{}`: enabled with auto-generated key
+ * - `{ keyName: "my-key" }`: enabled with existing key
+ * - `false`: explicitly disabled
+ */
+export interface SshConfig {
+    /** SSH key pair name */
+    keyName?: string;
+    /** Allowed CIDR blocks for SSH access */
+    allowedCidrs?: string[];
+}
+export interface Ec2ComputeProps {
+    type: "ec2";
+    vpc?: IVpc;
+    /** EC2 instance type. Default: "t4g.micro" */
+    instanceType?: string;
+    /**
+     * SSH access configuration.
+     * - Omit: disabled (default)
+     * - `{}`: enabled with defaults
+     * - `false`: explicitly disabled
+     */
+    ssh?: SshConfig | false;
+    /** User data script */
+    userData?: UserData;
+    /** Machine image (AMI) */
+    machineImage?: IMachineImage;
+    /** Minimum number of instances. Default: 1 */
+    minCapacity?: number;
+    /** Maximum number of instances. Default: 1 */
+    maxCapacity?: number;
+    /**
+     * Percentage of capacity to run on Spot instances (0-100).
+     * - Omit or 0: All On-Demand instances (default)
+     * - 100: All Spot instances
+     * - 50: Half Spot, half On-Demand
+     *
+     * Spot instances can reduce costs by up to 90% but may be interrupted.
+     * Use for fault-tolerant workloads.
+     */
+    spotCapacityPercentage?: number;
+}
+/**
+ * EC2 compute wrapper implementing IEc2Compute.
+ * Provides type-safe access to EC2-specific resources.
+ */
+export declare class Ec2Compute extends Construct implements IEc2Compute {
+    readonly computeType: "ec2";
+    readonly connections: Connections;
+    private readonly ec2Instance;
+    constructor(scope: Construct, id: string, props: Ec2ComputeProps);
+    /** Get the Auto Scaling Group. */
+    getAutoScalingGroup(): IAutoScalingGroup;
+    /** Get the security group. */
+    getSecurityGroup(): ISecurityGroup;
+    /**
+     * Get the underlying EC2 instance construct.
+     */
+    getEc2Instance(): Ec2Instance;
+}

package/dist/lib/patterns/aws/computeEc2.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Ec2Compute = void 0;
+const constructs_1 = require("constructs");
+const ec2_1 = require("../../resources/aws/compute/ec2");
+const compute_js_1 = require("./compute.js");
+/**
+ * EC2 compute wrapper implementing IEc2Compute.
+ * Provides type-safe access to EC2-specific resources.
+ */
+class Ec2Compute extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.computeType = "ec2";
+        const enableSSH = props.ssh !== undefined && props.ssh !== false;
+        const ec2Props = {
+            serviceName: `${id}Service`,
+            instanceType: props.instanceType || compute_js_1.COMPUTE_DEFAULTS.EC2.INSTANCE_TYPE,
+            enableSSH,
+            userData: props.userData,
+            machineImage: props.machineImage,
+            minCapacity: props.minCapacity || compute_js_1.COMPUTE_DEFAULTS.EC2.MIN_CAPACITY,
+            maxCapacity: props.maxCapacity || compute_js_1.COMPUTE_DEFAULTS.EC2.MAX_CAPACITY,
+            vpc: props.vpc,
+            spotCapacityPercentage: props.spotCapacityPercentage
+        };
+        this.ec2Instance = new ec2_1.Ec2Instance(scope, `${id}Ec2`, ec2Props);
+        this.connections = this.ec2Instance.connections;
+    }
+    /** Get the Auto Scaling Group. */
+    getAutoScalingGroup() {
+        return this.ec2Instance.getAutoScalingGroup();
+    }
+    /** Get the security group. */
+    getSecurityGroup() {
+        return this.ec2Instance.asgSecurityGroup;
+    }
+    /**
+     * Get the underlying EC2 instance construct.
+     */
+    getEc2Instance() {
+        return this.ec2Instance;
+    }
+}
+exports.Ec2Compute = Ec2Compute;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tcHV0ZUVjMi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL2xpYi9wYXR0ZXJucy9hd3MvY29tcHV0ZUVjMi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFTQSwyQ0FBdUM7QUFJdkMseURBQThEO0FBRTlELDZDQUFnRDtBQWtEaEQ7OztHQUdHO0FBQ0gsTUFBYSxVQUFXLFNBQVEsc0JBQVM7SUFNdkMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFzQjtRQUM5RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBTkgsZ0JBQVcsR0FBRyxLQUFjLENBQUM7UUFRM0MsTUFBTSxTQUFTLEdBQUcsS0FBSyxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSyxLQUFLLENBQUM7UUFFakUsTUFBTSxRQUFRLEdBQUc7WUFDZixXQUFXLEVBQUUsR0FBRyxFQUFFLFNBQVM7WUFDM0IsWUFBWSxFQUFFLEtBQUssQ0FBQyxZQUFZLElBQUksNkJBQWdCLENBQUMsR0FBRyxDQUFDLGFBQWE7WUFDdEUsU0FBUztZQUNULFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixZQUFZLEVBQUUsS0FBSyxDQUFDLFlBQVk7WUFDaEMsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXLElBQUksNkJBQWdCLENBQUMsR0FBRyxDQUFDLFlBQVk7WUFDbkUsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXLElBQUksNkJBQWdCLENBQUMsR0FBRyxDQUFDLFlBQVk7WUFDbkUsR0FBRyxFQUFFLEtBQUssQ0FBQyxHQUFHO1lBQ2Qsc0JBQXNCLEVBQUUsS0FBSyxDQUFDLHNCQUFzQjtTQUNyRCxDQUFDO1FBRUYsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLGlCQUFXLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDaEUsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQztJQUNsRCxDQUFDO0lBRUQsa0NBQWtDO0lBQ2xDLG1CQUFtQjtRQUNqQixPQUFPLElBQUksQ0FBQyxXQUFXLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztJQUNoRCxDQUFDO0lBRUQsOEJBQThCO0lBQzlCLGdCQUFnQjtRQUNkLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQyxnQkFBZ0IsQ0FBQztJQUMzQyxDQUFDO0lBRUQ7O09BRUc7SUFDSCxjQUFjO1FBQ1osT0FBTyxJQUFJLENBQUMsV0FBVyxDQUFDO0lBQzFCLENBQUM7Q0FDRjtBQTNDRCxnQ0EyQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQge1xuICB0eXBlIENvbm5lY3Rpb25zLFxuICB0eXBlIElWcGMsXG4gIHR5cGUgVXNlckRhdGEsXG4gIHR5cGUgSU1hY2hpbmVJbWFnZSxcbiAgdHlwZSBJU2VjdXJpdHlHcm91cFxufSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLWVjMlwiO1xuaW1wb3J0IHsgdHlwZSBJQXV0b1NjYWxpbmdHcm91cCB9IGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtYXV0b3NjYWxpbmdcIjtcblxuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcblxuaW1wb3J0IHsgdHlwZSBJRWMyQ29tcHV0ZSB9IGZyb20gXCIuL2ludGVyZmFjZXMvY29tcHV0ZS5qc1wiO1xuXG5pbXBvcnQgeyBFYzJJbnN0YW5jZSB9IGZyb20gXCIuLi8uLi9yZXNvdXJjZXMvYXdzL2NvbXB1dGUvZWMyXCI7XG5cbmltcG9ydCB7IENPTVBVVEVfREVGQVVMVFMgfSBmcm9tIFwiLi9jb21wdXRlLmpzXCI7XG5cbi8qKlxuICogU1NIIGFjY2VzcyBjb25maWd1cmF0aW9uIGZvciBFQzIgaW5zdGFuY2VzLlxuICogLSBPbWl0OiBkaXNhYmxlZCAoZGVmYXVsdClcbiAqIC0gYHt9YDogZW5hYmxlZCB3aXRoIGF1dG8tZ2VuZXJhdGVkIGtleVxuICogLSBgeyBrZXlOYW1lOiBcIm15LWtleVwiIH1gOiBlbmFibGVkIHdpdGggZXhpc3Rpbmcga2V5XG4gKiAtIGBmYWxzZWA6IGV4cGxpY2l0bHkgZGlzYWJsZWRcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTc2hDb25maWcge1xuICAvKiogU1NIIGtleSBwYWlyIG5hbWUgKi9cbiAga2V5TmFtZT86IHN0cmluZztcbiAgLyoqIEFsbG93ZWQgQ0lEUiBibG9ja3MgZm9yIFNTSCBhY2Nlc3MgKi9cbiAgYWxsb3dlZENpZHJzPzogc3RyaW5nW107XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgRWMyQ29tcHV0ZVByb3BzIHtcbiAgdHlwZTogXCJlYzJcIjtcbiAgdnBjPzogSVZwYztcblxuICAvKiogRUMyIGluc3RhbmNlIHR5cGUuIERlZmF1bHQ6IFwidDRnLm1pY3JvXCIgKi9cbiAgaW5zdGFuY2VUeXBlPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBTU0ggYWNjZXNzIGNvbmZpZ3VyYXRpb24uXG4gICAqIC0gT21pdDogZGlzYWJsZWQgKGRlZmF1bHQpXG4gICAqIC0gYHt9YDogZW5hYmxlZCB3aXRoIGRlZmF1bHRzXG4gICAqIC0gYGZhbHNlYDogZXhwbGljaXRseSBkaXNhYmxlZFxuICAgKi9cbiAgc3NoPzogU3NoQ29uZmlnIHwgZmFsc2U7XG4gIC8qKiBVc2VyIGRhdGEgc2NyaXB0ICovXG4gIHVzZXJEYXRhPzogVXNlckRhdGE7XG4gIC8qKiBNYWNoaW5lIGltYWdlIChBTUkpICovXG4gIG1hY2hpbmVJbWFnZT86IElNYWNoaW5lSW1hZ2U7XG4gIC8qKiBNaW5pbXVtIG51bWJlciBvZiBpbnN0YW5jZXMuIERlZmF1bHQ6IDEgKi9cbiAgbWluQ2FwYWNpdHk/OiBudW1iZXI7XG4gIC8qKiBNYXhpbXVtIG51bWJlciBvZiBpbnN0YW5jZXMuIERlZmF1bHQ6IDEgKi9cbiAgbWF4Q2FwYWNpdHk/OiBudW1iZXI7XG4gIC8qKlxuICAgKiBQZXJjZW50YWdlIG9mIGNhcGFjaXR5IHRvIHJ1biBvbiBTcG90IGluc3RhbmNlcyAoMC0xMDApLlxuICAgKiAtIE9taXQgb3IgMDogQWxsIE9uLURlbWFuZCBpbnN0YW5jZXMgKGRlZmF1bHQpXG4gICAqIC0gMTAwOiBBbGwgU3BvdCBpbnN0YW5jZXNcbiAgICogLSA1MDogSGFsZiBTcG90LCBoYWxmIE9uLURlbWFuZFxuICAgKlxuICAgKiBTcG90IGluc3RhbmNlcyBjYW4gcmVkdWNlIGNvc3RzIGJ5IHVwIHRvIDkwJSBidXQgbWF5IGJlIGludGVycnVwdGVkLlxuICAgKiBVc2UgZm9yIGZhdWx0LXRvbGVyYW50IHdvcmtsb2Fkcy5cbiAgICovXG4gIHNwb3RDYXBhY2l0eVBlcmNlbnRhZ2U/OiBudW1iZXI7XG59XG5cbi8qKlxuICogRUMyIGNvbXB1dGUgd3JhcHBlciBpbXBsZW1lbnRpbmcgSUVjMkNvbXB1dGUuXG4gKiBQcm92aWRlcyB0eXBlLXNhZmUgYWNjZXNzIHRvIEVDMi1zcGVjaWZpYyByZXNvdXJjZXMuXG4gKi9cbmV4cG9ydCBjbGFzcyBFYzJDb21wdXRlIGV4dGVuZHMgQ29uc3RydWN0IGltcGxlbWVudHMgSUVjMkNvbXB1dGUge1xuICBwdWJsaWMgcmVhZG9ubHkgY29tcHV0ZVR5cGUgPSBcImVjMlwiIGFzIGNvbnN0O1xuICBwdWJsaWMgcmVhZG9ubHkgY29ubmVjdGlvbnM6IENvbm5lY3Rpb25zO1xuXG4gIHByaXZhdGUgcmVhZG9ubHkgZWMySW5zdGFuY2U6IEVjMkluc3RhbmNlO1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBFYzJDb21wdXRlUHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuXG4gICAgY29uc3QgZW5hYmxlU1NIID0gcHJvcHMuc3NoICE9PSB1bmRlZmluZWQgJiYgcHJvcHMuc3NoICE9PSBmYWxzZTtcblxuICAgIGNvbnN0IGVjMlByb3BzID0ge1xuICAgICAgc2VydmljZU5hbWU6IGAke2lkfVNlcnZpY2VgLFxuICAgICAgaW5zdGFuY2VUeXBlOiBwcm9wcy5pbnN0YW5jZVR5cGUgfHwgQ09NUFVURV9ERUZBVUxUUy5FQzIuSU5TVEFOQ0VfVFlQRSxcbiAgICAgIGVuYWJsZVNTSCxcbiAgICAgIHVzZXJEYXRhOiBwcm9wcy51c2VyRGF0YSxcbiAgICAgIG1hY2hpbmVJbWFnZTogcHJvcHMubWFjaGluZUltYWdlLFxuICAgICAgbWluQ2FwYWNpdHk6IHByb3BzLm1pbkNhcGFjaXR5IHx8IENPTVBVVEVfREVGQVVMVFMuRUMyLk1JTl9DQVBBQ0lUWSxcbiAgICAgIG1heENhcGFjaXR5OiBwcm9wcy5tYXhDYXBhY2l0eSB8fCBDT01QVVRFX0RFRkFVTFRTLkVDMi5NQVhfQ0FQQUNJVFksXG4gICAgICB2cGM6IHByb3BzLnZwYyxcbiAgICAgIHNwb3RDYXBhY2l0eVBlcmNlbnRhZ2U6IHByb3BzLnNwb3RDYXBhY2l0eVBlcmNlbnRhZ2VcbiAgICB9O1xuXG4gICAgdGhpcy5lYzJJbnN0YW5jZSA9IG5ldyBFYzJJbnN0YW5jZShzY29wZSwgYCR7aWR9RWMyYCwgZWMyUHJvcHMpO1xuICAgIHRoaXMuY29ubmVjdGlvbnMgPSB0aGlzLmVjMkluc3RhbmNlLmNvbm5lY3Rpb25zO1xuICB9XG5cbiAgLyoqIEdldCB0aGUgQXV0byBTY2FsaW5nIEdyb3VwLiAqL1xuICBnZXRBdXRvU2NhbGluZ0dyb3VwKCk6IElBdXRvU2NhbGluZ0dyb3VwIHtcbiAgICByZXR1cm4gdGhpcy5lYzJJbnN0YW5jZS5nZXRBdXRvU2NhbGluZ0dyb3VwKCk7XG4gIH1cblxuICAvKiogR2V0IHRoZSBzZWN1cml0eSBncm91cC4gKi9cbiAgZ2V0U2VjdXJpdHlHcm91cCgpOiBJU2VjdXJpdHlHcm91cCB7XG4gICAgcmV0dXJuIHRoaXMuZWMySW5zdGFuY2UuYXNnU2VjdXJpdHlHcm91cDtcbiAgfVxuXG4gIC8qKlxuICAgKiBHZXQgdGhlIHVuZGVybHlpbmcgRUMyIGluc3RhbmNlIGNvbnN0cnVjdC5cbiAgICovXG4gIGdldEVjMkluc3RhbmNlKCk6IEVjMkluc3RhbmNlIHtcbiAgICByZXR1cm4gdGhpcy5lYzJJbnN0YW5jZTtcbiAgfVxufVxuIl19

package/dist/lib/patterns/aws/computeEcs.d.ts

@@ -0,0 +1,446 @@
+import { type RepositoryImage, type ICluster, type IBaseService } from "aws-cdk-lib/aws-ecs";
+import { type Repository } from "aws-cdk-lib/aws-ecr";
+import { type Connections, type IVpc, type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
+import { type PolicyDocument, type IManagedPolicy, type IGrantable, Grant } from "aws-cdk-lib/aws-iam";
+import { type IApplicationLoadBalancer, type ApplicationListener } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { Construct } from "constructs";
+import { type IEcsCompute } from "./interfaces/compute.js";
+import { type ConnectionSpec } from "./interfaces/connector.js";
+import EcsCluster, { type EcsClusterProps, ScalingType, type DomainConfig, type EcsCapacityProvider, type Ec2CapacityConfig } from "../../resources/aws/compute/ecs";
+import { type SecretImport } from "../../resources/aws/secrets";
+export { ScalingType };
+export type { EcsCapacityProvider, Ec2CapacityConfig };
+/**
+ * Configuration for ECS capacity providers.
+ */
+export interface EcsCapacityProviderConfig {
+    /** Whether this uses Spot pricing */
+    usesSpot: boolean;
+    /** Whether this runs on EC2 instances (vs serverless Fargate) */
+    usesEc2Instances: boolean;
+}
+export declare const ECS_CAPACITY_PROVIDER_CONFIG: Record<EcsCapacityProvider, EcsCapacityProviderConfig>;
+export declare function getEcsCapacityProviderConfig(provider: EcsCapacityProvider): EcsCapacityProviderConfig;
+/**
+ * Configuration for a container in an ECS task.
+ *
+ * For single-container services, `name` is optional and defaults to `${serviceName}Container`.
+ * For multi-container tasks, the first container with a `port` is the **primary container**
+ * that receives load balancer traffic.
+ *
+ * @example
+ * // Single container (name auto-generated)
+ * containers: [{ port: 3000 }]
+ *
+ * @example
+ * // Multi-container with sidecars
+ * containers: [
+ *   { name: "app", port: 3000 },                    // Primary - receives ALB traffic
+ *   { name: "datadog", image: "datadog/agent" }     // Sidecar - monitoring
+ * ]
+ */
+export interface EcsContainerConfig {
+    /** Container name. Optional for single-container services. */
+    name?: string;
+    /**
+     * Container image. Options:
+     * - Omit: Uses app's default ECR repository (primary container only)
+     * - string: ECR repository name or public image URL
+     * - Repository: CDK ECR Repository construct
+     */
+    image?: string | Repository;
+    /**
+     * Port the container listens on.
+     * The first container with a port becomes the **primary container**
+     * and is registered with the load balancer.
+     */
+    port?: number;
+    /** Environment variables */
+    environment?: Record<string, string>;
+    /**
+     * Secrets from AWS SSM Parameter Store.
+     * Array of secret names that will be fetched from the service's SSM namespace.
+     * The namespace path is auto-determined from app/cluster/service names.
+     *
+     * @example
+     * // Secrets at /myapp/api-cluster/users/API_KEY and /myapp/api-cluster/users/DB_PASSWORD
+     * secrets: ["API_KEY", "DB_PASSWORD"]
+     */
+    secrets?: string[];
+    /** Secrets imported from other CDK resources (AWS Secrets Manager) */
+    secretsImport?: Record<string, SecretImport>;
+    /** Command to run in the container */
+    command?: string[];
+    /** Entry point for the container */
+    entryPoint?: string[];
+    /**
+     * Whether this container is essential.
+     * If an essential container stops, all containers in the task stop.
+     * Default: true
+     */
+    essential?: boolean;
+    /**
+     * Health check configuration.
+     * Default: For primary container with port, uses curl health check.
+     */
+    healthCheck?: {
+        command: string[];
+        interval?: number;
+        timeout?: number;
+        retries?: number;
+        startPeriod?: number;
+    };
+}
+/**
+ * ECS scaling configuration.
+ * - Omit: enabled with defaults
+ * - `{}`: enabled with defaults
+ * - `{ minCapacity: 2, maxCapacity: 10 }`: custom scaling
+ * - `false`: explicitly disabled
+ */
+export interface EcsScalingConfig {
+    minCapacity?: number;
+    maxCapacity?: number;
+    scalingType?: ScalingType;
+}
+/**
+ * Cluster-level configuration.
+ * Controls the shared ALB for all services in this cluster.
+ */
+export interface EcsClusterConfig {
+    /**
+     * Domain for HTTPS access.
+     * - Omit: ALB created with default DNS (*.elb.amazonaws.com)
+     * - Specified: Creates ACM certificate + Route53 DNS A record
+     */
+    domain?: string;
+    /**
+     * Load balancer configuration.
+     * - Omit or "public": Internet-facing ALB (default)
+     * - "internal": VPC-only ALB
+     * - false: No ALB (for workers/background processors)
+     */
+    loadBalancer?: false | "public" | "internal";
+    /**
+     * Enable direct EC2 access without ALB.
+     * Uses host network mode for predictable ports.
+     * Access via EC2 public IP at container port.
+     */
+    directAccess?: boolean;
+    /**
+     * Advanced domain configuration for routing policies (latency, weighted, geo).
+     * Only used when domain is specified.
+     * Allows for multi-region deployments with advanced DNS routing.
+     */
+    domainConfig?: DomainConfig;
+}
+/**
+ * Routing configuration for path/host-based routing on the ALB.
+ * Required when cluster has multiple services with ports.
+ * Optional for single service (gets all traffic automatically).
+ */
+export interface EcsRoutingConfig {
+    /**
+     * Path pattern for routing (e.g., "/api/*", "/users/*").
+     * Uses ALB path-based routing.
+     */
+    path?: string;
+    /**
+     * Host header for routing (e.g., "api.example.com").
+     * Uses ALB host-based routing.
+     */
+    host?: string;
+    /**
+     * Priority for this routing rule (1-50000).
+     * Lower number = higher priority.
+     * Auto-assigned if omitted.
+     */
+    priority?: number;
+    /**
+     * Health check path for this service's target group.
+     * Default: "/"
+     */
+    healthCheckPath?: string;
+}
+/**
+ * Configuration for a service in an ECS cluster.
+ * Each service gets its own task definition, scaling config, and target group.
+ *
+ * @example
+ * // Simple service
+ * { name: "api", containers: [{ port: 3000 }] }
+ *
+ * @example
+ * // Service with routing (for multi-service clusters)
+ * { name: "users", containers: [{ port: 3000 }], routing: { path: "/users/*", priority: 100 } }
+ *
+ * @example
+ * // Service with multiple routing rules (same target group)
+ * { name: "web", containers: [{ port: 3000 }], routing: [
+ *   { path: "/api/v2/*", priority: 50 },
+ *   { path: "/*", priority: 200 },
+ * ]}
+ *
+ * @example
+ * // Service with sidecars
+ * {
+ *   name: "api",
+ *   containers: [
+ *     { name: "app", port: 3000 },
+ *     { name: "datadog", image: "datadog/agent" }
+ *   ]
+ * }
+ */
+export interface EcsServiceConfig {
+    /** Service name (unique within cluster) */
+    name: string;
+    /**
+     * Container image for this service (applies to first container without explicit image).
+     * - Omit: Uses app's default ECR repository
+     * - string: ECR repository name or public image URL
+     * - Repository: CDK ECR Repository construct
+     */
+    image?: string | Repository;
+    /**
+     * Container configuration(s) for this service.
+     * For single-container services, container name is optional and auto-generated.
+     * For multi-container services, the first container with a port is the primary container.
+     */
+    containers?: EcsContainerConfig[];
+    /**
+     * Routing rules for this service on the cluster's ALB.
+     * Required when cluster has multiple services with ports.
+     * Optional for single service (gets /* automatically).
+     * Can be a single rule or an array of rules pointing to the same target group.
+     *
+     * @example
+     * // Multiple routes for the same service
+     * routing: [
+     *   { path: "/api/v2/*", priority: 50 },
+     *   { path: "/*", priority: 200 },
+     * ]
+     */
+    routing?: EcsRoutingConfig | EcsRoutingConfig[];
+    /** CPU units for this service's tasks (256-4096) */
+    cpu?: number;
+    /** Memory in MiB for this service's tasks (512-30720) */
+    memoryLimitMiB?: number;
+    /** Desired number of tasks. Default: 2 */
+    desiredCount?: number;
+    /**
+     * Scaling configuration.
+     * - Omit: enabled with defaults
+     * - false: disabled
+     */
+    scaling?: EcsScalingConfig | false;
+    /**
+     * Path to Dockerfile for building this service's image.
+     * Metadata for CLI build process, not used during CDK synthesis.
+     */
+    dockerfilePath?: string;
+    /**
+     * Docker build target stage for multi-stage Dockerfiles.
+     * When specified, the CLI builds with `--target <dockerTarget>`.
+     * The image tag suffix is also updated: `<service>-<target>-latest`.
+     *
+     * @example
+     * // Dockerfile: FROM node AS base ... FROM base AS api ... FROM base AS worker
+     * { name: "api", dockerTarget: "api" }   // builds: myapp-api-api-latest
+     * { name: "worker", dockerTarget: "worker" }  // builds: myapp-worker-worker-latest
+     */
+    dockerTarget?: string;
+    /**
+     * Additional inline policies for this service's task role.
+     * Added on top of the default ECS Exec permissions.
+     * Use for service-specific AWS permissions (S3, DynamoDB, SQS, etc.).
+     */
+    taskRoleInlinePolicies?: Record<string, PolicyDocument>;
+    /**
+     * Additional managed policies for this service's task role.
+     * Added on top of the default ECS Exec permissions.
+     */
+    taskRoleManagedPolicies?: IManagedPolicy[];
+    /**
+     * Resources this service needs to connect to (e.g., databases, S3 buckets, SQS queues).
+     * Creates security group rules for IConnectable resources and IAM grants for IAM resources.
+     * Follows least-privilege - only this service gets access, not all services in the cluster.
+     *
+     * Supports:
+     * - IConnectable: Security group resources (RDS, ECS, etc.)
+     * - IStorageConnector: S3 buckets (IAM grants)
+     * - IDynamoDBConnector: DynamoDB tables (IAM grants)
+     * - IQueueConnector: SQS queues (IAM grants)
+     * - ConnectionConfig: Explicit access level configuration
+     *
+     * @example
+     * // Simple connections (default permissions)
+     * connections: [database, bucket, cache, queue]
+     *
+     * @example
+     * // Explicit access levels
+     * connections: [
+     *   database,                              // Security group (RDS)
+     *   { resource: cache, access: "read" },   // Read-only DynamoDB
+     *   { resource: bucket, access: "write" }, // Write-only S3
+     *   { resource: queue, access: "consume" } // Consume-only SQS
+     * ]
+     */
+    connections?: ConnectionSpec[];
+    /**
+     * Capacity provider for this service. REQUIRED.
+     * Each service specifies its own capacity provider.
+     *
+     * @example
+     * // Mixed FARGATE and EC2 services in same cluster
+     * {
+     *   services: [
+     *     { name: "api", capacityProvider: "FARGATE" },
+     *     { name: "worker", capacityProvider: "EC2", ec2Config: { instanceType: "t4g.micro" } }
+     *   ]
+     * }
+     */
+    capacityProvider: EcsCapacityProvider;
+    /**
+     * EC2 capacity configuration for this service.
+     * Only used when service capacityProvider is "EC2".
+     * Services with matching ec2Config share an ASG for efficiency.
+     */
+    ec2Config?: Ec2CapacityConfig;
+    /**
+     * SSM Parameter Store path for secrets.
+     * If not specified, secrets are fetched from /<app>/<cluster>/<service>.
+     * Use this to override the default convention.
+     *
+     * @example
+     * // Override default path
+     * ssmSecretsPath: "/custom/path/to/secrets"
+     */
+    ssmSecretsPath?: string;
+}
+/**
+ * ECS compute configuration.
+ * Creates an ECS cluster with one or more services sharing a load balancer.
+ *
+ * @example
+ * // Single service
+ * app.addCompute(ComputeFactory.build("WebApp", {
+ *   type: "ecs",
+ *   cluster: { domain: "app.example.com" },
+ *   services: [{ name: "web", containers: [{ port: 3000 }] }]
+ * }));
+ *
+ * @example
+ * // Multi-service cluster with routing
+ * app.addCompute(ComputeFactory.build("ApiCluster", {
+ *   type: "ecs",
+ *   cluster: { domain: "api.example.com" },
+ *   services: [
+ *     { name: "users", containers: [{ port: 3000 }], routing: { path: "/users/*" } },
+ *     { name: "orders", containers: [{ port: 3001 }], routing: { path: "/orders/*" } }
+ *   ]
+ * }));
+ *
+ * @example
+ * // Internal workers (no ALB)
+ * app.addCompute(ComputeFactory.build("Workers", {
+ *   type: "ecs",
+ *   cluster: { loadBalancer: false },
+ *   services: [{ name: "processor" }, { name: "emailer" }]
+ * }));
+ */
+export interface EcsComputeProps {
+    type: "ecs";
+    vpc?: IVpc;
+    /**
+     * Application name for SSM secrets namespace.
+     * When containers use secrets, the path is derived as: /<appName>/<clusterName>/<serviceName>
+     * Auto-derived from App.getName() if not specified.
+     */
+    appName?: string;
+    /**
+     * Cluster configuration.
+     * Controls the shared ALB for all services in this cluster.
+     * - Omit: ALB created with default settings
+     * - `{ domain: "..." }`: ALB with HTTPS + DNS
+     * - `{ loadBalancer: false }`: No ALB (internal workers)
+     */
+    cluster?: EcsClusterConfig;
+    /**
+     * Services in this cluster.
+     * Each service gets its own task definition, scaling, and target group.
+     * Each service MUST specify its own capacityProvider.
+     * All services share the cluster's ALB (unless disabled).
+     */
+    services: EcsServiceConfig[];
+    /**
+     * ECR repository for all services (default image).
+     * Individual services can override with their own `image` property.
+     */
+    ecrRepository?: Repository | RepositoryImage;
+    /**
+     * Path to Dockerfile for building custom image.
+     * Note: This is metadata for the CLI build process,
+     * not used during CDK synthesis.
+     */
+    dockerfilePath?: string;
+}
+/**
+ * Validates ECS-specific props.
+ * Extracted for clarity and detail parity with database/network patterns.
+ */
+export declare function validateEcsProps(props: EcsComputeProps): void;
+/**
+ * Build container configurations for an ECS service.
+ * Converts user-facing EcsContainerConfig to internal EcsClusterProps format.
+ * @internal Exported for testing only
+ */
+export declare function buildContainerConfigs(service: EcsServiceConfig): EcsClusterProps["services"][number]["containers"];
+/**
+ * Resolved scaling configuration for an ECS service.
+ * @internal Exported for testing only
+ */
+export interface ResolvedScalingConfig {
+    scalingType: ScalingType | undefined;
+    minCapacity: number | undefined;
+    maxCapacity: number | undefined;
+}
+/**
+ * Resolve scaling configuration from service props.
+ * Handles the three cases: explicit config, disabled (false), or default (undefined).
+ * @internal Exported for testing only
+ */
+export declare function resolveScalingConfig(scaling: EcsScalingConfig | false | undefined): ResolvedScalingConfig;
+/**
+ * ECS compute wrapper implementing IEcsCompute.
+ * Provides type-safe access to ECS-specific resources.
+ */
+export declare class EcsCompute extends Construct implements IEcsCompute {
+    readonly computeType: "ecs";
+    readonly connections: Connections;
+    private readonly ecsCluster;
+    constructor(scope: Construct, id: string, props: EcsComputeProps);
+    /** Get the ECS cluster. */
+    getCluster(): ICluster;
+    /** Get the Application Load Balancer if one was created. */
+    getLoadBalancer(): IApplicationLoadBalancer | undefined;
+    /** Get a specific service by name. */
+    getService(name: string): IBaseService | undefined;
+    /** Get all services in the cluster. */
+    getAllServices(): IBaseService[];
+    /** Get the security group for the cluster. */
+    getSecurityGroup(): ISecurityGroup;
+    /**
+     * Get the ALB listener if this is an ECS compute with ALB.
+     */
+    getListener(): ApplicationListener | undefined;
+    /**
+     * Get the underlying ECS cluster construct.
+     */
+    getEcsCluster(): EcsCluster;
+    /**
+     * Grants ecs:ExecuteCommand permission for ECS services.
+     * Uses wildcard resource because ecs:ExecuteCommand targets task ARNs
+     * which are not known until runtime (tasks are ephemeral).
+     */
+    grantExecuteCommand(grantee: IGrantable): Grant;
+}