@fjall/components-infrastructure 16.0.1 → 18.0.0

package/dist/lib/config/aws/scpPreset.js

@@ -15,6 +15,108 @@ const EXEMPT_ROLE_PATTERNS = [
 const SCP_BYTE_LIMIT = 5120;
 const IAM_POLICY_VERSION = "2012-10-17";
 const SCP_POLICY_TYPE = "SERVICE_CONTROL_POLICY";
+// Region-deny exemptions: global and us-east-1-locked services evaluate
+// aws:RequestedRegion as us-east-1, so a region deny without these blocks
+// their consoles outright for orgs whose allowedRegions exclude us-east-1.
+// Mirrors the NotAction list of AWS Control Tower's Region deny control
+// (GRREGIONDENY) so future re-syncs are a mechanical diff:
+// https://docs.aws.amazon.com/controltower/latest/controlreference/primary-region-deny-policy.html
+// Deliberate deltas from that list:
+// - "support-console:*" — Support Center console auth moves to this prefix
+//   on 2026-11-16 (support:* remains the API prefix); predates the CT list.
+// - "purchase-orders:*" — the one aws-portal-successor billing prefix the CT
+//   list is missing.
+// - "tag:*" — grandfathered superset of CT's "tag:GetResources"; narrowing
+//   a deployed deny would be a breaking tightening.
+const GLOBAL_SERVICE_EXEMPTIONS = [
+    "a4b:*",
+    "access-analyzer:*",
+    "account:*",
+    "acm:*",
+    "activate:*",
+    "artifact:*",
+    "aws-marketplace-management:*",
+    "aws-marketplace:*",
+    "aws-portal:*",
+    "billing:*",
+    "billingconductor:*",
+    "budgets:*",
+    "ce:*",
+    "chatbot:*",
+    "chime:*",
+    "cloudfront:*",
+    "cloudtrail:LookupEvents",
+    "compute-optimizer:*",
+    "config:*",
+    "consoleapp:*",
+    "consolidatedbilling:*",
+    "cur:*",
+    "datapipeline:GetAccountLimits",
+    "devicefarm:*",
+    "directconnect:*",
+    "ec2:DescribeRegions",
+    "ec2:DescribeTransitGateways",
+    "ec2:DescribeVpnGateways",
+    "ecr-public:*",
+    "fms:*",
+    "freetier:*",
+    "globalaccelerator:*",
+    "health:*",
+    "iam:*",
+    "importexport:*",
+    "invoicing:*",
+    "iq:*",
+    "kms:*",
+    "license-manager:ListReceivedLicenses",
+    "lightsail:Get*",
+    "mobileanalytics:*",
+    "networkmanager:*",
+    "notifications-contacts:*",
+    "notifications:*",
+    "organizations:*",
+    "payments:*",
+    "pricing:*",
+    "purchase-orders:*",
+    "quicksight:DescribeAccountSubscription",
+    "resource-explorer-2:*",
+    "route53-recovery-cluster:*",
+    "route53-recovery-control-config:*",
+    "route53-recovery-readiness:*",
+    "route53:*",
+    "route53domains:*",
+    "s3:CreateMultiRegionAccessPoint",
+    "s3:DeleteMultiRegionAccessPoint",
+    "s3:DescribeMultiRegionAccessPointOperation",
+    "s3:GetAccountPublicAccessBlock",
+    "s3:GetBucketLocation",
+    "s3:GetBucketPolicyStatus",
+    "s3:GetBucketPublicAccessBlock",
+    "s3:GetMultiRegionAccessPoint",
+    "s3:GetMultiRegionAccessPointPolicy",
+    "s3:GetMultiRegionAccessPointPolicyStatus",
+    "s3:GetStorageLensConfiguration",
+    "s3:GetStorageLensDashboard",
+    "s3:ListAllMyBuckets",
+    "s3:ListMultiRegionAccessPoints",
+    "s3:ListStorageLensConfigurations",
+    "s3:PutAccountPublicAccessBlock",
+    "s3:PutMultiRegionAccessPointPolicy",
+    "savingsplans:*",
+    "shield:*",
+    "sso:*",
+    "sts:*",
+    "support-console:*",
+    "support:*",
+    "supportapp:*",
+    "supportplans:*",
+    "sustainability:*",
+    "tag:*",
+    "trustedadvisor:*",
+    "vendor-insights:ListEntitledSecurityProfiles",
+    "waf-regional:*",
+    "waf:*",
+    "wafv2:*"
+];
 function automationExemption() {
     return {
         ArnNotLike: {
@@ -62,23 +164,7 @@ function buildFoundationGuardrails(allowedRegions) {
             {
                 Sid: "DenyOutsideAllowedRegions",
                 Effect: "Deny",
-                NotAction: [
-                    "iam:*",
-                    "sts:*",
-                    "cloudfront:*",
-                    "route53:*",
-                    "organizations:*",
-                    "support:*",
-                    "budgets:*",
-                    "ce:*",
-                    "waf:*",
-                    "wafv2:*",
-                    "globalaccelerator:*",
-                    "health:*",
-                    "account:*",
-                    "tag:*",
-                    "trustedadvisor:*"
-                ],
+                NotAction: [...GLOBAL_SERVICE_EXEMPTIONS],
                 Resource: "*",
                 Condition: {
                     StringNotEquals: {

package/dist/lib/patterns/aws/clickhouseDatabase.d.ts

@@ -29,15 +29,82 @@ export interface ClickHouseDatabaseProps {
      *  taking a new type live needs a launch-template refresh + instance
      *  refresh + ClickHouse restart, not a config reload.
      *
-     *  WARNING — changing this on a DEPLOYED stack REPLACES the persistent
-     *  data volume, not just the instance. The instance type is embedded in
-     *  the compute construct's logical-ID key (`getEc2ConfigKey`), so the
-     *  `AWS::EC2::Volume` beneath it gets a new logical ID: CloudFormation
-     *  snapshots-then-deletes the old volume (`RemovalPolicy.SNAPSHOT`) and
-     *  creates an EMPTY one, and the volume's `ownerLogicalId` re-attach tag
-     *  chain resets. Plan a snapshot-restore migration for live data — this
-     *  is NOT a config-only change on a stack with data. */
+     *  Changing this on a DEPLOYED stack keeps the data. The volume's logical
+     *  ID and its `fjall:OwnerLogicalId` re-attach tag both derive from the
+     *  capacity ANCHOR (`resolveCapacityAnchor`, `${Aws.STACK_NAME}/${anchor}/
+     *  PersistentDataVolume`), not from the instance type, so neither moves
+     *  when the type does and the re-attach chain holds. Config-keyed identity
+     *  was the pre-6.0 derivation — `getEc2ConfigKey` survives only to emit
+     *  the manifest's legacy alias.
+     *
+     *  It is still not free: the type lives in the launch template and in
+     *  user-data-baked server tuning, so it takes an instance refresh, and on
+     *  this single-node cluster that refresh is a restart. The ASG terminates
+     *  the instance (TERMINATING hook detaches the volume), launches a
+     *  replacement, and the LAUNCHING hook re-attaches — ClickHouse is
+     *  unavailable across that window. Size the change into a quiet period;
+     *  do not plan a snapshot-restore migration for it. */
     instanceType?: string;
+    /**
+     * EBS data-volume size in GiB. Default `CLICKHOUSE_EBS_VOLUME_SIZE_GB`
+     * (400). Integer, between `CLICKHOUSE_MIN_STORAGE_GB` and the gp3 ceiling;
+     * validated against `alarms.diskFreeCriticalGib` as a pair, because a
+     * volume smaller than five times that floor would deploy a critical alarm
+     * that can never leave ALARM.
+     *
+     * GROWTH ONLY, and the growth is not instantaneous. EBS `ModifyVolume`
+     * refuses to shrink a volume, so a decrease fails mid-update and rolls the
+     * stack back; it also permits one modification per volume per 6 hours, so
+     * a second bump inside that window fails until the cooldown elapses.
+     *
+     * Resizing the block device is half the job — the ext4 filesystem on it
+     * does not follow until `resize2fs` runs, which is a step in
+     * `buildClickHouseUserData` and therefore runs at BOOT. The declared size
+     * is embedded in that user data, so changing this prop versions the launch
+     * template and triggers the ASG instance refresh whose boot grows the
+     * filesystem — the increase applies in the same deploy, by the same
+     * mechanism an `instanceType` change rides. On this single-node cluster
+     * that relaunch is a restart (the TERMINATING hook detaches the volume,
+     * LAUNCHING re-attaches it): the data survives; the cluster is unavailable
+     * across the window. Size increases into a quiet period, exactly as with
+     * `instanceType`.
+     */
+    storageGb?: number;
+    /**
+     * Provisioned IOPS on the gp3 data volume. Default `CLICKHOUSE_EBS_IOPS`
+     * (3000, the baseline the volume price includes). Integer, between
+     * `CLICKHOUSE_MIN_IOPS` and `CLICKHOUSE_MAX_IOPS`, and at most
+     * `CLICKHOUSE_MAX_IOPS_PER_GB` × `storageGb` — EBS rejects more IOPS than
+     * the volume is large enough to carry. Validated with `throughputMbps` as
+     * a pair, because throughput needs IOPS to ride on (below).
+     *
+     * The same knob RDS exposes as provisioned IOPS on gp3 storage. Applied by
+     * EBS `ModifyVolume` in place: no launch-template change, no instance
+     * relaunch, no restart — the cluster stays up. It shares the
+     * one-modification-per-volume-per-6-hours cooldown with `storageGb` and
+     * `throughputMbps`; a change to any of the three inside that window fails
+     * until it elapses, so move them together.
+     *
+     * Worth raising only once the host can use it: a volume's provisioned
+     * figure is a ceiling the instance's own EBS bandwidth may sit under, so
+     * pair a large value with an `instanceType` whose EBS bandwidth reaches it.
+     */
+    iops?: number;
+    /**
+     * Provisioned throughput on the gp3 data volume, in MiB/s. Default
+     * `CLICKHOUSE_EBS_THROUGHPUT_MBPS` (125, the baseline the volume price
+     * includes). Integer, between `CLICKHOUSE_MIN_THROUGHPUT_MBPS` and
+     * `CLICKHOUSE_MAX_THROUGHPUT_MBPS`, and needing
+     * `CLICKHOUSE_IOPS_PER_THROUGHPUT_MBPS` (4) IOPS per MiB/s — 1000 MiB/s
+     * needs `iops: 4000` or more, and the synth error names the figure.
+     *
+     * The same knob RDS exposes as storage throughput on gp3. Applied in place
+     * by `ModifyVolume` like `iops`, under the same shared 6-hour cooldown, and
+     * likewise bounded by the instance's EBS bandwidth. The restore-verify
+     * timeout is derived from the baseline rather than this value on purpose
+     * (see `clickHouseBackupVerifyTimeoutSeconds`).
+     */
+    throughputMbps?: number;
     /**
      * ECS service desired task count. Defaults to 1 (single-node, single-task
      * by design). Override to 0 via the `clickhouseDesiredCount` CDK context
@@ -57,6 +124,12 @@ export interface ClickHouseDatabaseProps {
      * - omitted/undefined: cold tier ENABLED (S3 bucket provisioned).
      * - `false`: cold tier DISABLED (single-tier hot storage on EBS only).
      * - `{ mode: "s3" }`: cold tier ENABLED (explicit).
+     *
+     * Interacts with the backup restore-verify: the verify restores onto the
+     * EBS volume, so a cold-heavy database can outgrow the free-space gate
+     * long before the hot tier fills — from that day the verify skips (and its
+     * alarm pages daily) with no cure but a larger `storageGb`. When that
+     * trade is deliberate, `backupVerify: false` is the sanctioned off-switch.
      */
     coldTier?: false | {
         mode: "s3";
@@ -85,10 +158,32 @@ export interface ClickHouseDatabaseProps {
      * schedules sparser than ~5.8 days must disable the heartbeat.
      */
     backupSchedule?: string | false;
+    /**
+     * Restore-verify on each scheduled backup. Omitted (the default): after
+     * `BACKUP DATABASE … TO S3` returns, the task restores what it just wrote
+     * into a scratch database, compares the table set, and emits a verdict
+     * marker the verify alarms read — the only signal that the backups are
+     * actually restorable. `false` disables the verify (the backup itself
+     * still runs and the backup-failure alarm + success heartbeat remain);
+     * the verify alarms are withheld with it, so disabling never reads as a
+     * silent green. Reach for it when the restore cost is structurally
+     * unaffordable on-box — a cold-heavy dataset (see `coldTier`), or a
+     * volume deliberately sized tight — and accept that `BACKUP_CREATED`
+     * becomes the only evidence a backup exists.
+     */
+    backupVerify?: false;
     /**
      * Backup-bucket lifecycle expiration in days for both current and noncurrent
      * versions. Default: `BACKUP_RETENTION_DAYS` from `clickhouseConstants.ts`.
      * Ignored when `backupBucket` is supplied (caller-owned lifecycle).
+     * Must exceed the `backupSchedule` interval — a retention shorter than the
+     * gap between runs expires each backup before its successor exists, which
+     * is a window with no backup at all rather than a short history.
+     *
+     * An integer between `CLICKHOUSE_MIN_BACKUP_RETENTION_DAYS` and
+     * `CLICKHOUSE_MAX_BACKUP_RETENTION_DAYS`. This is an S3 object lifetime and
+     * deliberately does NOT share the RDS 35-day ceiling, which bounds a
+     * different mechanism (`backupRetention` on the relational types).
      */
     backupRetentionDays?: number;
     /**

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -23,7 +23,10 @@ import { createClickHouseAlarms, validateClickHouseAlarmThresholds, BACKUP_HEART
 import { ClickHouseSchemaAdminSchema, ManagedPasswordNameSchema, ProfileSpecSchema, PROFILE_NAME_PATTERN } from "../../resources/aws/database/clickhouseSchemas.js";
 import { deriveClickHouseDefaultProfiles } from "../../resources/aws/database/clickhouseTuning.js";
 import { inferAmiHardwareType } from "../../resources/aws/compute/ecsConstants.js";
-import { CLICKHOUSE_DATABASE_NAME, DEFAULT_CLICKHOUSE_INSTANCE_TYPE, CLICKHOUSE_IMAGE, CLICKHOUSE_EBS_VOLUME_SIZE_GB, CLICKHOUSE_EBS_IOPS, CLICKHOUSE_EBS_THROUGHPUT_MBPS, clickHouseTaskMemoryMiB, CLICKHOUSE_HTTP_PORT, CLICKHOUSE_HTTPS_PORT, CLICKHOUSE_NATIVE_PORT, CLICKHOUSE_TCP_SECURE_PORT, CLICKHOUSE_TLS_CERT_MOUNT_PATH, CLICKHOUSE_PROMETHEUS_PORT, CLICKHOUSE_DATA_MOUNT_PATH, CLICKHOUSE_SECRET_OPTIONS, CLICKHOUSE_SERVER_ROLE_TAG, CLICKHOUSE_HOST_METRICS, clickHouseUserSecretName, CLICKHOUSE_HEALTH_CHECK, CLICKHOUSE_STOP_TIMEOUT_SECONDS, CLICKHOUSE_EBS_DEVICE_NAME, CLICKHOUSE_CONFIG_SUBDIR, CLICKHOUSE_USERS_SUBDIR, userPasswordEnvName, OPTIMISE_FINAL_SCHEDULE, REPLACING_MERGE_TREE_TABLES, OPTIMISE_MV_TABLES, CLICKHOUSE_CLOUDMAP_SERVICE_NAME, CLICKHOUSE_SERVER_CONTAINER_NAME, CLICKHOUSE_SERVICE_NAME, OPTIMISE_TASK_MEMORY_MIB, OPTIMISE_TASK_CPU_UNITS, BACKUP_SCHEDULE, BACKUP_TASK_MEMORY_MIB, BACKUP_TASK_CPU_UNITS, BACKUP_RETENTION_DAYS } from "../../resources/aws/database/clickhouseConstants.js";
+import { CLICKHOUSE_DATABASE_NAME, DEFAULT_CLICKHOUSE_INSTANCE_TYPE, CLICKHOUSE_IMAGE, clickHouseTaskMemoryMiB, CLICKHOUSE_HTTP_PORT, CLICKHOUSE_HTTPS_PORT, CLICKHOUSE_NATIVE_PORT, CLICKHOUSE_TCP_SECURE_PORT, CLICKHOUSE_TLS_CERT_MOUNT_PATH, CLICKHOUSE_PROMETHEUS_PORT, CLICKHOUSE_DATA_MOUNT_PATH, CLICKHOUSE_SECRET_OPTIONS, CLICKHOUSE_SERVER_ROLE_TAG, CLICKHOUSE_HOST_METRICS, clickHouseUserSecretName, CLICKHOUSE_HEALTH_CHECK, CLICKHOUSE_STOP_TIMEOUT_SECONDS, CLICKHOUSE_EBS_DEVICE_NAME, CLICKHOUSE_CONFIG_SUBDIR, CLICKHOUSE_USERS_SUBDIR, userPasswordEnvName, OPTIMISE_FINAL_SCHEDULE, REPLACING_MERGE_TREE_TABLES, OPTIMISE_MV_TABLES, CLICKHOUSE_CLOUDMAP_SERVICE_NAME, CLICKHOUSE_SERVER_CONTAINER_NAME, CLICKHOUSE_SERVICE_NAME, OPTIMISE_TASK_MEMORY_MIB, OPTIMISE_TASK_CPU_UNITS, BACKUP_SCHEDULE, BACKUP_TASK_MEMORY_MIB, BACKUP_TASK_CPU_UNITS, BACKUP_RETENTION_DAYS } from "../../resources/aws/database/clickhouseConstants.js";
+import { CLICKHOUSE_MAX_BACKUP_RETENTION_DAYS, CLICKHOUSE_MIN_BACKUP_RETENTION_DAYS } from "@fjall/util/clickhouse";
+import { resolveClickHouseStorage, resolveClickHouseVolumePerformance } from "../../resources/aws/database/clickhouseStorage.js";
+import { buildClickHouseBackupScript } from "../../resources/aws/database/clickhouseBackupScript.js";
 import { TlsCertGenerator } from "../../resources/aws/utilities/tlsCertGenerator.js";
 import { EcsCompute } from "./computeEcs.js";
 /**
@@ -263,6 +266,7 @@ export class ClickHouseDatabase extends Construct {
         const desiredCount = resolveClickHouseDesiredCount(this.node.tryGetContext("clickhouseDesiredCount"), props.desiredCount);
         const optimiseEnabled = props.optimiseSchedule !== false;
         const backupEnabled = props.backupSchedule !== false;
+        const backupVerifyEnabled = props.backupVerify !== false;
         const optimiseSchedule = typeof props.optimiseSchedule === "string"
             ? props.optimiseSchedule
             : OPTIMISE_FINAL_SCHEDULE;
@@ -270,9 +274,15 @@ export class ClickHouseDatabase extends Construct {
             ? props.backupSchedule
             : BACKUP_SCHEDULE;
         const backupRetentionDays = props.backupRetentionDays ?? BACKUP_RETENTION_DAYS;
-        if (props.backupRetentionDays !== undefined &&
-            (props.backupRetentionDays < 1 || props.backupRetentionDays > 3650)) {
-            throw new Error(`ClickHouseDatabase: backupRetentionDays must be between 1 and 3650; got ${props.backupRetentionDays}.`);
+        // Checked after defaulting, so the default is held to the same bound as a
+        // caller's value. Integer-ness is part of the bound rather than a separate
+        // nicety: the value becomes `Duration.days()` on an S3 lifecycle rule,
+        // which rejects a fraction far downstream with no mention of the knob that
+        // supplied it.
+        if (!Number.isInteger(backupRetentionDays) ||
+            backupRetentionDays < CLICKHOUSE_MIN_BACKUP_RETENTION_DAYS ||
+            backupRetentionDays > CLICKHOUSE_MAX_BACKUP_RETENTION_DAYS) {
+            throw new Error(`ClickHouseDatabase: backupRetentionDays must be an integer between ${CLICKHOUSE_MIN_BACKUP_RETENTION_DAYS} and ${CLICKHOUSE_MAX_BACKUP_RETENTION_DAYS} days; got ${backupRetentionDays}.`);
         }
         const tlsOptions = props.tls ?? {
             mode: "self-signed"
@@ -348,10 +358,29 @@ export class ClickHouseDatabase extends Construct {
                 retention: RetentionDays.TWO_WEEKS
             })
             : undefined;
+        // Resolved BEFORE the user data is built: the declared volume size is
+        // embedded into the script so a storageGb change versions the launch
+        // template (see `dataVolumeSizeGb` on BuildClickHouseUserDataOptions).
+        // The restore-verify gate is bounded by the same free-space floor the
+        // disk alarm pages on — the check that protects the data must not be
+        // able to fill the volume it is protecting. Volume size and floor are
+        // only checkable against each other, and the floor lives on the alarms
+        // knob.
+        const alarmThresholds = typeof props.alarms === "object" ? props.alarms : {};
+        validateClickHouseAlarmThresholds(alarmThresholds);
+        const { storageGb, diskFreeCriticalGib } = resolveClickHouseStorage(props.storageGb, alarmThresholds.diskFreeCriticalGib);
+        // IOPS and throughput are bounded by each other and by the size just
+        // resolved, so they resolve second, against the validated storageGb.
+        const { iops, throughputMbps } = resolveClickHouseVolumePerformance({
+            storageGb,
+            iops: props.iops,
+            throughputMbps: props.throughputMbps
+        });
         const userData = UserData.custom(buildClickHouseUserData({
             backupBucketName: backupBucket.bucketName,
             backupBucketRegion: Stack.of(this).region,
             instanceType,
+            dataVolumeSizeGb: storageGb,
             ...(coldTierBucket !== undefined && {
                 coldTier: {
                     bucketName: coldTierBucket.bucketName,
@@ -405,12 +434,15 @@ export class ClickHouseDatabase extends Construct {
         // deploy-order window, or a dropped table lingering in the constants)
         // would permanently skip every optimise after it. Failures are logged and
         // the task still exits non-zero so they stay visible in the task history.
-        const optimiseClient = `clickhouse-client --host ${clickHouseHost} --port ${nativePort} --user ${schemaAdmin.name}${sidecarTlsClientArgs}`;
+        // Both scheduled tasks authenticate identically; the password arrives via
+        // CLICKHOUSE_PASSWORD rather than argv.
+        const clickHouseClient = `clickhouse-client --host ${clickHouseHost} --port ${nativePort} --user ${schemaAdmin.name}${sidecarTlsClientArgs}`;
         const optimiseScript = [
             "FAILED=0",
-            ...optimiseStatements.map((stmt) => `${optimiseClient} --query "${stmt}" || { echo "optimise failed: ${stmt}"; FAILED=1; }`),
+            ...optimiseStatements.map((stmt) => `${clickHouseClient} --query "${stmt}" || { echo "optimise failed: ${stmt}"; FAILED=1; }`),
             'exit "$FAILED"'
         ].join("; ");
+        // Resolved before the scheduled tasks because the backup task's
         const scheduledTasks = [];
         if (optimiseEnabled) {
             scheduledTasks.push({
@@ -439,7 +471,14 @@ export class ClickHouseDatabase extends Construct {
                     "sh",
                     "-c",
                     // Password via CLICKHOUSE_PASSWORD env, not --password on argv (argv → /proc/<pid>/cmdline).
-                    `${sidecarTlsPreamble}STAMP=$(date +%Y%m%d-%H%M%S) && clickhouse-client --host ${clickHouseHost} --port ${nativePort} --user ${schemaAdmin.name}${sidecarTlsClientArgs} --query "BACKUP DATABASE ${CLICKHOUSE_DATABASE_NAME} TO S3('${backupDestUrl}weekly-$STAMP/')"`
+                    `${sidecarTlsPreamble}${buildClickHouseBackupScript({
+                        client: clickHouseClient,
+                        databaseName: CLICKHOUSE_DATABASE_NAME,
+                        backupDestUrl,
+                        diskFreeCriticalGib,
+                        storageGb,
+                        verify: backupVerifyEnabled
+                    })}`
                 ],
                 secrets: {
                     CLICKHOUSE_PASSWORD: EcsSecret.fromSecretsManager(adminSecret.secret, "password"),
@@ -459,8 +498,6 @@ export class ClickHouseDatabase extends Construct {
         const alarmsDisabled = props.alarms === false;
         const applicationId = props.applicationId ??
             (App.hasInstance() ? App.getInstance().getName() : undefined);
-        const alarmThresholds = typeof props.alarms === "object" ? props.alarms : {};
-        validateClickHouseAlarmThresholds(alarmThresholds);
         const serviceLogAlarms = alarmsDisabled
             ? undefined
             : buildClickHouseLogAlarmSpecs(alarmThresholds, coldTierEnabled);
@@ -520,11 +557,11 @@ export class ClickHouseDatabase extends Construct {
                         instanceMonitoring: Monitoring.BASIC,
                         availabilityZones: [dataAz],
                         persistentDataVolume: {
-                            sizeGb: CLICKHOUSE_EBS_VOLUME_SIZE_GB,
+                            sizeGb: storageGb,
                             deviceName: CLICKHOUSE_EBS_DEVICE_NAME,
                             availabilityZone: dataAz,
-                            iops: CLICKHOUSE_EBS_IOPS,
-                            throughputMbps: CLICKHOUSE_EBS_THROUGHPUT_MBPS,
+                            iops,
+                            throughputMbps,
                             ...(resolvedAlertsTopic !== undefined && {
                                 alarmTopic: resolvedAlertsTopic
                             })
@@ -658,6 +695,8 @@ export class ClickHouseDatabase extends Construct {
                 asgName,
                 alarmTopic: resolvedAlertsTopic,
                 config: alarmThresholds,
+                diskFreeCriticalGib,
+                backupVerifyEnabled,
                 ...(applicationId !== undefined && { applicationId }),
                 ...(backupTaskLogGroup !== undefined && { backupTaskLogGroup })
             });

package/dist/lib/patterns/aws/database.d.ts

@@ -332,7 +332,7 @@ export declare class RelationalDatabase extends Construct implements IRelational
     grantIamConnect(grantee: IGrantable, dbUsername: string): Grant;
 }
 export { ClickHouseDatabase, type ClickHouseDatabaseProps, type ClickHouseAlarmThresholds };
-export { ClickHouseDefaultProfiles, ClickHouseSchemaAdminSchema, ManagedPasswordNameSchema, ProfileSpecSchema, type ClickHouseSchemaAdmin, type ManagedPasswordName, type ProfileSpec } from "../../resources/aws/database/clickhouseSchemas.js";
+export { ClickHouseDefaultProfiles, ClickHouseSchemaAdminSchema, ManagedPasswordNameSchema, ProfileSpecSchema, SettingConstraintSchema, type ClickHouseSchemaAdmin, type FrozenProfileSpec, type ManagedPasswordName, type ProfileSpec, type SettingConstraint } from "../../resources/aws/database/clickhouseSchemas.js";
 export { renderUsersXml } from "../../resources/aws/database/clickhouseXmlRenderer.js";
 export type { RenderUsersXmlOptions } from "../../resources/aws/database/clickhouseXmlRenderer.js";
 export type { DynamoDBKeySchema, DynamoDBGlobalSecondaryIndex, DynamoDBTableProps } from "../../resources/aws/database/dynamodb.js";

package/dist/lib/patterns/aws/database.js

@@ -655,6 +655,6 @@ export class RelationalDatabase extends Construct {
     }
 }
 export { ClickHouseDatabase };
-export { ClickHouseDefaultProfiles, ClickHouseSchemaAdminSchema, ManagedPasswordNameSchema, ProfileSpecSchema } from "../../resources/aws/database/clickhouseSchemas.js";
+export { ClickHouseDefaultProfiles, ClickHouseSchemaAdminSchema, ManagedPasswordNameSchema, ProfileSpecSchema, SettingConstraintSchema } from "../../resources/aws/database/clickhouseSchemas.js";
 export { renderUsersXml } from "../../resources/aws/database/clickhouseXmlRenderer.js";
 export { isRelationalDatabase, isDynamoDBDatabase, isClickHouseDatabase, isAuroraDatabase, isInstanceDatabase, isGlobalAuroraDatabase } from "./interfaces/database.js";

package/dist/lib/patterns/aws/interfaces/domain.d.ts

@@ -22,6 +22,7 @@ export type FjallTarget = {
     readonly appName: string;
 } | {
     readonly kind: "bucket";
+    readonly appName: string;
     readonly bucketName: string;
 } | {
     readonly kind: "custom";

package/dist/lib/patterns/aws/storage.d.ts

@@ -49,6 +49,14 @@ export interface S3Props {
     readonly removalPolicy?: "DESTROY" | "RETAIN";
     /** Declarative bucket-policy statements appended to the bucket's resource policy. */
     readonly resourcePolicyStatements?: ResourcePolicyStatement[];
+    /**
+     * The owning Fjall app's name, required by website-hosting buckets — their
+     * exports are keyed on (app, bucket) so sibling apps' identically-named
+     * buckets stay deployable side by side. `StorageFactory` fills it from the
+     * App (as `CdnFactory` does); pass it only for direct `new Storage(...)`
+     * construction.
+     */
+    readonly appName?: string;
 }
 export interface StorageBuildProps extends S3Props {
     readonly stackPlacement?: "storage" | "cdn" | "compute";

package/dist/lib/patterns/aws/storage.js

@@ -74,8 +74,9 @@ export class Storage extends Construct {
         this.bucket = new S3Bucket(this, `${id}Bucket`, {
             bucketName: props.bucketName,
             // The bucket nests one level below, so its own id is `${id}Bucket` — the
-            // author's handle for `fjallBucket(<name>)` is THIS construct's id.
+            // author's handle for `fjallBucket(<app>, <name>)` is THIS construct's id.
             aliasTargetName: props.bucketName ?? id,
+            appName: props.appName,
             versioned: props.versioned,
             encryption: toBucketEncryption(props.encryption),
             encryptionKey,
@@ -175,9 +176,15 @@ export class Storage extends Construct {
 export class StorageFactory {
     static build(id, props = {}) {
         const { stackPlacement, ...s3Props } = props;
-        const fn = (_app, scope) => {
+        const fn = (app, scope) => {
             validateStorageProps(s3Props);
-            return new Storage(scope, id, s3Props);
+            // The App is the only place the app name is known here; website-hosting
+            // buckets need it for their (app, bucket)-keyed exports — the same fill
+            // CdnFactory performs for Cdn.
+            return new Storage(scope, id, {
+                ...s3Props,
+                appName: s3Props.appName ?? app.getName()
+            });
         };
         if (stackPlacement) {
             fn.stackPlacement = stackPlacement;

package/dist/lib/patterns/aws/targets/fjallTargets.d.ts

@@ -32,12 +32,14 @@ export declare function fjallCdn(appName: string): FjallAliasTarget;
 /**
  * Target helper for a Fjall S3 static-site bucket.
  *
- * Requires the bucket stack to publish exports `${safeBucket}WebsiteEndpoint`
- * and `${safeBucket}WebsiteHostedZoneId` — emitted by website-enabled `S3`
- * storage. Naming a bucket with no such exports fails at CloudFormation
- * execution, exactly as `fjallApp` documents.
+ * `appName` names the app that owns the bucket — the first segment of every
+ * target helper's key, exactly as `fjallApp`/`fjallCdn` take it. Requires that
+ * app's stack to publish exports `${safeApp}-${safeBucket}-WebsiteEndpoint`
+ * and `${safeApp}-${safeBucket}-WebsiteHostedZoneId` — emitted by
+ * website-enabled `S3` storage. Naming a pair with no such exports fails at
+ * CloudFormation execution, exactly as `fjallApp` documents.
  */
-export declare function fjallBucket(bucketName: string): FjallAliasTarget;
+export declare function fjallBucket(appName: string, bucketName: string): FjallAliasTarget;
 /**
  * Target helper for an arbitrary `(dnsName, hostedZoneId)` pair. Accepts
  * literal strings or CDK tokens (e.g. a `CfnOutput.value`). No

package/dist/lib/patterns/aws/targets/fjallTargets.js

@@ -43,15 +43,18 @@ export function fjallCdn(appName) {
 /**
  * Target helper for a Fjall S3 static-site bucket.
  *
- * Requires the bucket stack to publish exports `${safeBucket}WebsiteEndpoint`
- * and `${safeBucket}WebsiteHostedZoneId` — emitted by website-enabled `S3`
- * storage. Naming a bucket with no such exports fails at CloudFormation
- * execution, exactly as `fjallApp` documents.
+ * `appName` names the app that owns the bucket — the first segment of every
+ * target helper's key, exactly as `fjallApp`/`fjallCdn` take it. Requires that
+ * app's stack to publish exports `${safeApp}-${safeBucket}-WebsiteEndpoint`
+ * and `${safeApp}-${safeBucket}-WebsiteHostedZoneId` — emitted by
+ * website-enabled `S3` storage. Naming a pair with no such exports fails at
+ * CloudFormation execution, exactly as `fjallApp` documents.
  */
-export function fjallBucket(bucketName) {
-    const resolved = resolveBucketTarget(bucketName);
+export function fjallBucket(appName, bucketName) {
+    const resolved = resolveBucketTarget(appName, bucketName);
     return {
         kind: "bucket",
+        appName,
         bucketName,
         bind(record, zone) {
             return resolved.bind(record, zone);

package/dist/lib/patterns/aws/targets/targetResolution.d.ts

@@ -15,8 +15,8 @@ import type { FjallTarget } from "../interfaces/domain.js";
  * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbDnsName`            |
  * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbHostedZoneId`       |
  * | `cloudFront.ts` CDN stack           | `resolveCdnTarget`    | `<App>CdnDistributionDomainName`        |
- * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteEndpoint`               |
- * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteHostedZoneId`           |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<App>-<Bucket>-WebsiteEndpoint`        |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<App>-<Bucket>-WebsiteHostedZoneId`    |
  *
  * Both sides derive the name from `@fjall/util`'s `…ExportName` helpers, which
  * take the RAW app or bucket name and sanitise internally. Compose these
@@ -50,10 +50,13 @@ export declare function resolveCdnTarget(appName: string): IAliasRecordTarget;
 /**
  * Resolve a Fjall S3 static-site bucket to an `IAliasRecordTarget`.
  *
- * `bucketName` is the bucket's name as written, dots and all — the helper
- * strips what CloudFormation will not hold, and the producer strips the same.
+ * `appName` names the app whose stack exports the pair — required because the
+ * export is keyed on (app, bucket), never on the bucket alone (sibling apps'
+ * identically-named buckets must stay deployable side by side). `bucketName`
+ * is the bucket's name as written, dots and all — the helper strips what
+ * CloudFormation will not hold, and the producer strips the same.
  */
-export declare function resolveBucketTarget(bucketName: string): IAliasRecordTarget;
+export declare function resolveBucketTarget(appName: string, bucketName: string): IAliasRecordTarget;
 /**
  * Pure passthrough — accepts concrete DNS name + hosted-zone id (or CDK
  * tokens) and forwards them unchanged. No `Fn.importValue` wrapping.

package/dist/lib/patterns/aws/targets/targetResolution.js

@@ -15,8 +15,8 @@ import { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucke
  * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbDnsName`            |
  * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbHostedZoneId`       |
  * | `cloudFront.ts` CDN stack           | `resolveCdnTarget`    | `<App>CdnDistributionDomainName`        |
- * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteEndpoint`               |
- * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteHostedZoneId`           |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<App>-<Bucket>-WebsiteEndpoint`        |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<App>-<Bucket>-WebsiteHostedZoneId`    |
  *
  * Both sides derive the name from `@fjall/util`'s `…ExportName` helpers, which
  * take the RAW app or bucket name and sanitise internally. Compose these
@@ -69,12 +69,15 @@ export function resolveCdnTarget(appName) {
 /**
  * Resolve a Fjall S3 static-site bucket to an `IAliasRecordTarget`.
  *
- * `bucketName` is the bucket's name as written, dots and all — the helper
- * strips what CloudFormation will not hold, and the producer strips the same.
+ * `appName` names the app whose stack exports the pair — required because the
+ * export is keyed on (app, bucket), never on the bucket alone (sibling apps'
+ * identically-named buckets must stay deployable side by side). `bucketName`
+ * is the bucket's name as written, dots and all — the helper strips what
+ * CloudFormation will not hold, and the producer strips the same.
  */
-export function resolveBucketTarget(bucketName) {
-    const dnsName = Fn.importValue(bucketWebsiteEndpointExportName(bucketName));
-    const hostedZoneId = Fn.importValue(bucketWebsiteHostedZoneIdExportName(bucketName));
+export function resolveBucketTarget(appName, bucketName) {
+    const dnsName = Fn.importValue(bucketWebsiteEndpointExportName(appName, bucketName));
+    const hostedZoneId = Fn.importValue(bucketWebsiteHostedZoneIdExportName(appName, bucketName));
     return buildAliasTarget(dnsName, hostedZoneId);
 }
 /**
@@ -98,7 +101,7 @@ export function resolveTargetToDnsName(target) {
         case "cdn":
             return Fn.importValue(cdnDomainExportName(target.appName));
         case "bucket":
-            return Fn.importValue(bucketWebsiteEndpointExportName(target.bucketName));
+            return Fn.importValue(bucketWebsiteEndpointExportName(target.appName, target.bucketName));
         case "custom":
             return target.dnsName;
         default: {