@fjall/components-infrastructure 17.0.0 → 18.0.0

package/dist/lib/config/aws/scpPreset.js

@@ -15,6 +15,108 @@ const EXEMPT_ROLE_PATTERNS = [
 const SCP_BYTE_LIMIT = 5120;
 const IAM_POLICY_VERSION = "2012-10-17";
 const SCP_POLICY_TYPE = "SERVICE_CONTROL_POLICY";
+// Region-deny exemptions: global and us-east-1-locked services evaluate
+// aws:RequestedRegion as us-east-1, so a region deny without these blocks
+// their consoles outright for orgs whose allowedRegions exclude us-east-1.
+// Mirrors the NotAction list of AWS Control Tower's Region deny control
+// (GRREGIONDENY) so future re-syncs are a mechanical diff:
+// https://docs.aws.amazon.com/controltower/latest/controlreference/primary-region-deny-policy.html
+// Deliberate deltas from that list:
+// - "support-console:*" — Support Center console auth moves to this prefix
+//   on 2026-11-16 (support:* remains the API prefix); predates the CT list.
+// - "purchase-orders:*" — the one aws-portal-successor billing prefix the CT
+//   list is missing.
+// - "tag:*" — grandfathered superset of CT's "tag:GetResources"; narrowing
+//   a deployed deny would be a breaking tightening.
+const GLOBAL_SERVICE_EXEMPTIONS = [
+    "a4b:*",
+    "access-analyzer:*",
+    "account:*",
+    "acm:*",
+    "activate:*",
+    "artifact:*",
+    "aws-marketplace-management:*",
+    "aws-marketplace:*",
+    "aws-portal:*",
+    "billing:*",
+    "billingconductor:*",
+    "budgets:*",
+    "ce:*",
+    "chatbot:*",
+    "chime:*",
+    "cloudfront:*",
+    "cloudtrail:LookupEvents",
+    "compute-optimizer:*",
+    "config:*",
+    "consoleapp:*",
+    "consolidatedbilling:*",
+    "cur:*",
+    "datapipeline:GetAccountLimits",
+    "devicefarm:*",
+    "directconnect:*",
+    "ec2:DescribeRegions",
+    "ec2:DescribeTransitGateways",
+    "ec2:DescribeVpnGateways",
+    "ecr-public:*",
+    "fms:*",
+    "freetier:*",
+    "globalaccelerator:*",
+    "health:*",
+    "iam:*",
+    "importexport:*",
+    "invoicing:*",
+    "iq:*",
+    "kms:*",
+    "license-manager:ListReceivedLicenses",
+    "lightsail:Get*",
+    "mobileanalytics:*",
+    "networkmanager:*",
+    "notifications-contacts:*",
+    "notifications:*",
+    "organizations:*",
+    "payments:*",
+    "pricing:*",
+    "purchase-orders:*",
+    "quicksight:DescribeAccountSubscription",
+    "resource-explorer-2:*",
+    "route53-recovery-cluster:*",
+    "route53-recovery-control-config:*",
+    "route53-recovery-readiness:*",
+    "route53:*",
+    "route53domains:*",
+    "s3:CreateMultiRegionAccessPoint",
+    "s3:DeleteMultiRegionAccessPoint",
+    "s3:DescribeMultiRegionAccessPointOperation",
+    "s3:GetAccountPublicAccessBlock",
+    "s3:GetBucketLocation",
+    "s3:GetBucketPolicyStatus",
+    "s3:GetBucketPublicAccessBlock",
+    "s3:GetMultiRegionAccessPoint",
+    "s3:GetMultiRegionAccessPointPolicy",
+    "s3:GetMultiRegionAccessPointPolicyStatus",
+    "s3:GetStorageLensConfiguration",
+    "s3:GetStorageLensDashboard",
+    "s3:ListAllMyBuckets",
+    "s3:ListMultiRegionAccessPoints",
+    "s3:ListStorageLensConfigurations",
+    "s3:PutAccountPublicAccessBlock",
+    "s3:PutMultiRegionAccessPointPolicy",
+    "savingsplans:*",
+    "shield:*",
+    "sso:*",
+    "sts:*",
+    "support-console:*",
+    "support:*",
+    "supportapp:*",
+    "supportplans:*",
+    "sustainability:*",
+    "tag:*",
+    "trustedadvisor:*",
+    "vendor-insights:ListEntitledSecurityProfiles",
+    "waf-regional:*",
+    "waf:*",
+    "wafv2:*"
+];
 function automationExemption() {
     return {
         ArnNotLike: {
@@ -62,23 +164,7 @@ function buildFoundationGuardrails(allowedRegions) {
             {
                 Sid: "DenyOutsideAllowedRegions",
                 Effect: "Deny",
-                NotAction: [
-                    "iam:*",
-                    "sts:*",
-                    "cloudfront:*",
-                    "route53:*",
-                    "organizations:*",
-                    "support:*",
-                    "budgets:*",
-                    "ce:*",
-                    "waf:*",
-                    "wafv2:*",
-                    "globalaccelerator:*",
-                    "health:*",
-                    "account:*",
-                    "tag:*",
-                    "trustedadvisor:*"
-                ],
+                NotAction: [...GLOBAL_SERVICE_EXEMPTIONS],
                 Resource: "*",
                 Condition: {
                     StringNotEquals: {

package/dist/lib/patterns/aws/interfaces/domain.d.ts

@@ -22,6 +22,7 @@ export type FjallTarget = {
     readonly appName: string;
 } | {
     readonly kind: "bucket";
+    readonly appName: string;
     readonly bucketName: string;
 } | {
     readonly kind: "custom";

package/dist/lib/patterns/aws/storage.d.ts

@@ -49,6 +49,14 @@ export interface S3Props {
     readonly removalPolicy?: "DESTROY" | "RETAIN";
     /** Declarative bucket-policy statements appended to the bucket's resource policy. */
     readonly resourcePolicyStatements?: ResourcePolicyStatement[];
+    /**
+     * The owning Fjall app's name, required by website-hosting buckets — their
+     * exports are keyed on (app, bucket) so sibling apps' identically-named
+     * buckets stay deployable side by side. `StorageFactory` fills it from the
+     * App (as `CdnFactory` does); pass it only for direct `new Storage(...)`
+     * construction.
+     */
+    readonly appName?: string;
 }
 export interface StorageBuildProps extends S3Props {
     readonly stackPlacement?: "storage" | "cdn" | "compute";

package/dist/lib/patterns/aws/storage.js

@@ -74,8 +74,9 @@ export class Storage extends Construct {
         this.bucket = new S3Bucket(this, `${id}Bucket`, {
             bucketName: props.bucketName,
             // The bucket nests one level below, so its own id is `${id}Bucket` — the
-            // author's handle for `fjallBucket(<name>)` is THIS construct's id.
+            // author's handle for `fjallBucket(<app>, <name>)` is THIS construct's id.
             aliasTargetName: props.bucketName ?? id,
+            appName: props.appName,
             versioned: props.versioned,
             encryption: toBucketEncryption(props.encryption),
             encryptionKey,
@@ -175,9 +176,15 @@ export class Storage extends Construct {
 export class StorageFactory {
     static build(id, props = {}) {
         const { stackPlacement, ...s3Props } = props;
-        const fn = (_app, scope) => {
+        const fn = (app, scope) => {
             validateStorageProps(s3Props);
-            return new Storage(scope, id, s3Props);
+            // The App is the only place the app name is known here; website-hosting
+            // buckets need it for their (app, bucket)-keyed exports — the same fill
+            // CdnFactory performs for Cdn.
+            return new Storage(scope, id, {
+                ...s3Props,
+                appName: s3Props.appName ?? app.getName()
+            });
         };
         if (stackPlacement) {
             fn.stackPlacement = stackPlacement;

package/dist/lib/patterns/aws/targets/fjallTargets.d.ts

@@ -32,12 +32,14 @@ export declare function fjallCdn(appName: string): FjallAliasTarget;
 /**
  * Target helper for a Fjall S3 static-site bucket.
  *
- * Requires the bucket stack to publish exports `${safeBucket}WebsiteEndpoint`
- * and `${safeBucket}WebsiteHostedZoneId` — emitted by website-enabled `S3`
- * storage. Naming a bucket with no such exports fails at CloudFormation
- * execution, exactly as `fjallApp` documents.
+ * `appName` names the app that owns the bucket — the first segment of every
+ * target helper's key, exactly as `fjallApp`/`fjallCdn` take it. Requires that
+ * app's stack to publish exports `${safeApp}-${safeBucket}-WebsiteEndpoint`
+ * and `${safeApp}-${safeBucket}-WebsiteHostedZoneId` — emitted by
+ * website-enabled `S3` storage. Naming a pair with no such exports fails at
+ * CloudFormation execution, exactly as `fjallApp` documents.
  */
-export declare function fjallBucket(bucketName: string): FjallAliasTarget;
+export declare function fjallBucket(appName: string, bucketName: string): FjallAliasTarget;
 /**
  * Target helper for an arbitrary `(dnsName, hostedZoneId)` pair. Accepts
  * literal strings or CDK tokens (e.g. a `CfnOutput.value`). No

package/dist/lib/patterns/aws/targets/fjallTargets.js

@@ -43,15 +43,18 @@ export function fjallCdn(appName) {
 /**
  * Target helper for a Fjall S3 static-site bucket.
  *
- * Requires the bucket stack to publish exports `${safeBucket}WebsiteEndpoint`
- * and `${safeBucket}WebsiteHostedZoneId` — emitted by website-enabled `S3`
- * storage. Naming a bucket with no such exports fails at CloudFormation
- * execution, exactly as `fjallApp` documents.
+ * `appName` names the app that owns the bucket — the first segment of every
+ * target helper's key, exactly as `fjallApp`/`fjallCdn` take it. Requires that
+ * app's stack to publish exports `${safeApp}-${safeBucket}-WebsiteEndpoint`
+ * and `${safeApp}-${safeBucket}-WebsiteHostedZoneId` — emitted by
+ * website-enabled `S3` storage. Naming a pair with no such exports fails at
+ * CloudFormation execution, exactly as `fjallApp` documents.
  */
-export function fjallBucket(bucketName) {
-    const resolved = resolveBucketTarget(bucketName);
+export function fjallBucket(appName, bucketName) {
+    const resolved = resolveBucketTarget(appName, bucketName);
     return {
         kind: "bucket",
+        appName,
         bucketName,
         bind(record, zone) {
             return resolved.bind(record, zone);

package/dist/lib/patterns/aws/targets/targetResolution.d.ts

@@ -15,8 +15,8 @@ import type { FjallTarget } from "../interfaces/domain.js";
  * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbDnsName`            |
  * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbHostedZoneId`       |
  * | `cloudFront.ts` CDN stack           | `resolveCdnTarget`    | `<App>CdnDistributionDomainName`        |
- * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteEndpoint`               |
- * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteHostedZoneId`           |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<App>-<Bucket>-WebsiteEndpoint`        |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<App>-<Bucket>-WebsiteHostedZoneId`    |
  *
  * Both sides derive the name from `@fjall/util`'s `…ExportName` helpers, which
  * take the RAW app or bucket name and sanitise internally. Compose these
@@ -50,10 +50,13 @@ export declare function resolveCdnTarget(appName: string): IAliasRecordTarget;
 /**
  * Resolve a Fjall S3 static-site bucket to an `IAliasRecordTarget`.
  *
- * `bucketName` is the bucket's name as written, dots and all — the helper
- * strips what CloudFormation will not hold, and the producer strips the same.
+ * `appName` names the app whose stack exports the pair — required because the
+ * export is keyed on (app, bucket), never on the bucket alone (sibling apps'
+ * identically-named buckets must stay deployable side by side). `bucketName`
+ * is the bucket's name as written, dots and all — the helper strips what
+ * CloudFormation will not hold, and the producer strips the same.
  */
-export declare function resolveBucketTarget(bucketName: string): IAliasRecordTarget;
+export declare function resolveBucketTarget(appName: string, bucketName: string): IAliasRecordTarget;
 /**
  * Pure passthrough — accepts concrete DNS name + hosted-zone id (or CDK
  * tokens) and forwards them unchanged. No `Fn.importValue` wrapping.

package/dist/lib/patterns/aws/targets/targetResolution.js

@@ -15,8 +15,8 @@ import { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucke
  * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbDnsName`            |
  * | `ecsNetworking.ts` app stack        | `resolveEcsTarget`    | `<App>-<Compute>-AlbHostedZoneId`       |
  * | `cloudFront.ts` CDN stack           | `resolveCdnTarget`    | `<App>CdnDistributionDomainName`        |
- * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteEndpoint`               |
- * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<Bucket>WebsiteHostedZoneId`           |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<App>-<Bucket>-WebsiteEndpoint`        |
+ * | `s3.ts` bucket stack                | `resolveBucketTarget` | `<App>-<Bucket>-WebsiteHostedZoneId`    |
  *
  * Both sides derive the name from `@fjall/util`'s `…ExportName` helpers, which
  * take the RAW app or bucket name and sanitise internally. Compose these
@@ -69,12 +69,15 @@ export function resolveCdnTarget(appName) {
 /**
  * Resolve a Fjall S3 static-site bucket to an `IAliasRecordTarget`.
  *
- * `bucketName` is the bucket's name as written, dots and all — the helper
- * strips what CloudFormation will not hold, and the producer strips the same.
+ * `appName` names the app whose stack exports the pair — required because the
+ * export is keyed on (app, bucket), never on the bucket alone (sibling apps'
+ * identically-named buckets must stay deployable side by side). `bucketName`
+ * is the bucket's name as written, dots and all — the helper strips what
+ * CloudFormation will not hold, and the producer strips the same.
  */
-export function resolveBucketTarget(bucketName) {
-    const dnsName = Fn.importValue(bucketWebsiteEndpointExportName(bucketName));
-    const hostedZoneId = Fn.importValue(bucketWebsiteHostedZoneIdExportName(bucketName));
+export function resolveBucketTarget(appName, bucketName) {
+    const dnsName = Fn.importValue(bucketWebsiteEndpointExportName(appName, bucketName));
+    const hostedZoneId = Fn.importValue(bucketWebsiteHostedZoneIdExportName(appName, bucketName));
     return buildAliasTarget(dnsName, hostedZoneId);
 }
 /**
@@ -98,7 +101,7 @@ export function resolveTargetToDnsName(target) {
         case "cdn":
             return Fn.importValue(cdnDomainExportName(target.appName));
         case "bucket":
-            return Fn.importValue(bucketWebsiteEndpointExportName(target.bucketName));
+            return Fn.importValue(bucketWebsiteEndpointExportName(target.appName, target.bucketName));
         case "custom":
             return target.dnsName;
         default: {

package/dist/lib/resources/aws/database/clickhouseUserData.d.ts

@@ -63,7 +63,16 @@ export interface BuildClickHouseUserDataOptions {
         serverSecretArn: string;
     };
 }
-export declare function generateServerConfigXml(options: BuildClickHouseUserDataOptions): string;
+/**
+ * The subset of the user-data options that config.xml generation actually
+ * reads. `dataVolumeSizeGb` is deliberately absent: it shapes the boot
+ * SCRIPT (the launch-template refresh trigger), not the rendered server
+ * config — demanding it here forced the XML parity tests to invent a value
+ * the render never consumes. `tls` is read for presence only (it toggles
+ * the secure-listener block); the ARNs inside it are boot-script concerns.
+ */
+export type ServerConfigXmlOptions = Pick<BuildClickHouseUserDataOptions, "backupBucketName" | "backupBucketRegion" | "instanceType" | "coldTier" | "tls">;
+export declare function generateServerConfigXml(options: ServerConfigXmlOptions): string;
 export interface GenerateUsersConfigXmlOptions {
     schemaAdmin: ClickHouseSchemaAdmin;
     profiles: Record<string, ProfileSpec>;

package/dist/lib/resources/aws/storage/s3.d.ts

@@ -37,15 +37,27 @@ export interface S3BucketProps extends BucketProps {
     publicReadAccess?: boolean;
     websiteHosting?: WebsiteHostingConfig;
     /**
-     * Name a `fjallBucket(<name>)` alias target uses to import this bucket's
-     * website exports. Defaults to `bucketName ?? id`, which is right for a
-     * direct `new S3Bucket(scope, "Assets", …)` — `id` is then the author's own
-     * handle. A wrapper that nests the bucket under a derived id MUST pass this:
-     * `Storage` builds its bucket at `${id}Bucket`, so without it a
-     * `fjallBucket("assets")` record would import `AssetsWebsiteEndpoint`
-     * against an exported `AssetsBucketWebsiteEndpoint`.
+     * Name a `fjallBucket(<app>, <name>)` alias target uses to import this
+     * bucket's website exports. Defaults to `bucketName ?? id`, which is right
+     * for a direct `new S3Bucket(scope, "Assets", …)` — `id` is then the
+     * author's own handle. A wrapper that nests the bucket under a derived id
+     * MUST pass this: `Storage` builds its bucket at `${id}Bucket`, so without
+     * it a `fjallBucket(app, "assets")` record would import
+     * `…-Assets-WebsiteEndpoint` against an exported
+     * `…-AssetsBucket-WebsiteEndpoint`.
      */
     aliasTargetName?: string;
+    /**
+     * The owning Fjall app's name — the other half of the website-export key
+     * (`bucketWebsiteEndpointExportName(appName, bucket)`). REQUIRED whenever
+     * `websiteHosting` is set: export names are account+region-global and every
+     * scaffolded app names its website bucket identically, so an unqualified
+     * export makes two website-bearing apps mutually undeployable. The
+     * `StorageFactory` path fills this from the App automatically (as
+     * `CdnFactory` does for `Cdn`); only direct `new S3Bucket`/`new Storage`
+     * construction needs to pass it.
+     */
+    appName?: string;
     /**
      * Declarative bucket-policy statements, each appended via
      * `addToResourcePolicy`. The TLS-only `enforceSSL` deny is always applied

package/dist/lib/resources/aws/storage/s3.js

@@ -18,7 +18,7 @@ function toResourcePolicyPrincipal(identifier) {
 export class S3Bucket extends Bucket {
     backupVaultTier;
     constructor(scope, id, props = {}) {
-        const { websiteHosting, backupVaultTier, resourcePolicyStatements, aliasTargetName, ...cdkProps } = props;
+        const { websiteHosting, backupVaultTier, resourcePolicyStatements, aliasTargetName, appName, ...cdkProps } = props;
         const isPublic = props.publicReadAccess === true || websiteHosting !== undefined;
         const versioned = props.versioned ?? shouldAutoVersion(backupVaultTier);
         const removalPolicy = props.removalPolicy ?? toRemovalPolicy(envAwareRemovalPolicyDefault());
@@ -74,6 +74,18 @@ export class S3Bucket extends Bucket {
             Tags.of(this).add(SDK_PRE_EMPTY_TAG_KEY, "true");
         }
         if (websiteHosting) {
+            if (appName === undefined) {
+                // Refusing beats falling back to a bucket-only export name: the
+                // consumer (`resolveBucketTarget`) always imports the app-qualified
+                // pair, so an unqualified export could never be resolved — it would
+                // only surface at CloudFormation execution as "No export named …",
+                // or worse, collide with a sibling app's identically-named bucket.
+                throw new Error(`S3 bucket '${id}': websiteHosting requires 'appName' — the ` +
+                    "website exports are keyed on (app, bucket) so two apps' " +
+                    "identically-named buckets stay deployable side by side. " +
+                    "App-managed paths (StorageFactory/CdnFactory) fill it " +
+                    "automatically; pass appName explicitly for direct construction.");
+            }
             const targetBucketName = aliasTargetName ?? props.bucketName ?? id;
             // Only the export name routes through the contract helper. `safeBucket`
             // stays local so the CfnOutput logical ids are unchanged — unifying the
@@ -81,7 +93,7 @@ export class S3Bucket extends Bucket {
             const safeBucket = toPascalCase(targetBucketName.replace(/[^A-Za-z0-9-]/g, ""));
             new CfnOutput(this, `${safeBucket}WebsiteEndpoint`, {
                 key: `${safeBucket}WebsiteEndpoint`,
-                exportName: bucketWebsiteEndpointExportName(targetBucketName),
+                exportName: bucketWebsiteEndpointExportName(appName, targetBucketName),
                 value: this.bucketWebsiteDomainName,
                 description: `S3 website endpoint for ${id} (consumed by Domain alias targets)`
             });
@@ -93,7 +105,7 @@ export class S3Bucket extends Bucket {
             }
             new CfnOutput(this, `${safeBucket}WebsiteHostedZoneId`, {
                 key: `${safeBucket}WebsiteHostedZoneId`,
-                exportName: bucketWebsiteHostedZoneIdExportName(targetBucketName),
+                exportName: bucketWebsiteHostedZoneIdExportName(appName, targetBucketName),
                 value: websiteHostedZoneId,
                 description: `Route 53 hosted zone id for the S3 website endpoint of ${id}`
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "17.0.0",
+  "version": "18.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -80,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^17.0.0",
-    "@fjall/util": "^17.0.0",
+    "@fjall/generator": "^18.0.0",
+    "@fjall/util": "^18.0.0",
     "constructs": "^10.7.2"
   },
   "overrides": {