@fjall/components-infrastructure 2.19.3 → 2.19.5

package/dist/lib/patterns/aws/organisation.js

@@ -5,6 +5,7 @@ import { ManagementEventsTrail } from "../../config/aws/cloudTrail.js";
 import { OrganisationTrail } from "../../config/aws/organisationTrail.js";
 import { ScpPreset } from "../../config/aws/scpPreset.js";
 import { OrganisationResource, OrganisationAccount, CostAllocationTagActivator } from "../../resources/aws/organisation/index.js";
+import { Schedule } from "../../resources/aws/messaging/schedule.js";
 import { stripAndCamelCase } from "../../utils/stripAndCamelCase.js";
 import { CDK_CONTEXT_KEYS, resolveAccountTrailState } from "../../utils/cdkContext.js";
 import { getConfig } from "../../utils/getConfig.js";
@@ -134,13 +135,26 @@ export class Organisation extends Account {
     }
     setupOrganisationFeatures(identityCenter, managementAccountId) {
         this.setupIdentityCenter(identityCenter, managementAccountId);
-        this.setupCostAllocationTagActivator();
+        // Home region only: Cost Explorer is a global service (single us-east-1
+        // endpoint), so an org-region cascade stack would otherwise synthesise a
+        // redundant daily activator Lambda per region against the same global
+        // endpoint — mirrors the OrganisationTrail home-region guard above.
+        if (!this.accountGlobalsConfigured) {
+            this.setupCostAllocationTagActivator();
+        }
     }
     setupCostAllocationTagActivator() {
         const activator = new CostAllocationTagActivator(this, "CostAllocationTagActivator");
-        App.getInstance().addSchedule("CostAllocationTagActivatorSchedule", {
+        // Construct the schedule in THIS (the Organisation) stack rather than via
+        // App.addSchedule(...), which places the EventBridge rule + invoke
+        // permission in the App messaging stack — a stack the org deploy never
+        // targets, so the trigger never deploys (the Lambda exists but is never
+        // invoked). Co-locating the rule here means one `cdk deploy Organisation`
+        // ships the activator and its daily trigger together.
+        new Schedule(this, "CostAllocationTagActivatorSchedule", {
             schedule: "rate(24 hours)",
-            target: activator
+            target: activator,
+            appName: App.getInstance().getName()
         });
     }
     setupIdentityCenter(identityCenter, managementAccountId) {

package/dist/lib/resources/aws/organisation/costAllocationTagActivator.d.ts

@@ -4,16 +4,24 @@ import { LambdaFunction } from "../compute/lambda.js";
 /**
  * Deploys a Lambda that auto-discovers and activates cost allocation tags.
  *
- * Runs daily in the management account. Any non-AWS tag applied to resources
- * (via app.addTags() or CDK aspects) is automatically activated in Cost
- * Explorer within 24 hours — no manual intervention required.
+ * Runs in the management account. Any non-AWS tag applied to resources (via
+ * app.addTags() or CDK aspects) is automatically activated in Cost Explorer —
+ * no manual intervention required. Cost Explorer is a global service, so the
+ * handler pins the us-east-1 endpoint and the caller synthesises this activator
+ * in the organisation's home region only.
  *
- * The schedule is NOT wired by this construct — callers wire the cadence via
- * `app.addSchedule(...)` so the EventBridge rule lives in the App's messaging
- * stack alongside every other Fjall schedule (D9). The activator implements
- * the structural `LambdaComputeShape` (duck-typed by `eventTargets.ts`), so it
- * can be passed directly as `target` to `app.addSchedule(...)` without a
- * `LambdaCompute` wrapper.
+ * Activation runs on two cadences:
+ * - A deploy-time one-shot (the `AwsCustomResource` below) invokes the Lambda
+ *   on org-stack create so tags already surfaced by AWS activate immediately,
+ *   without waiting for the first daily tick.
+ * - A daily schedule, wired by the caller (`organisation.ts`) as a `Schedule`
+ *   constructed in the Organisation stack — co-located with this Lambda so a
+ *   single `cdk deploy Organisation` deploys the EventBridge rule + invoke
+ *   permission. (A cross-stack `app.addSchedule(...)` placed that rule in the
+ *   App messaging stack, which the org deploy never targets, so the trigger
+ *   never materialised.) The activator implements the structural
+ *   `LambdaComputeShape` (duck-typed by `eventTargets.ts`), so it can be passed
+ *   directly as the `Schedule` target without a `LambdaCompute` wrapper.
  */
 export declare class CostAllocationTagActivator extends Construct {
     /** Marks this construct as a structural Lambda target for `eventTargets.ts`. */

package/dist/lib/resources/aws/organisation/costAllocationTagActivator.js

@@ -1,21 +1,31 @@
 import { Construct } from "constructs";
 import { PhysicalName } from "aws-cdk-lib";
+import { AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
 import { LambdaFunction } from "../compute/lambda.js";
+import { AwsCustomResource } from "../utilities/awsCustomResource.js";
 /**
  * Deploys a Lambda that auto-discovers and activates cost allocation tags.
  *
- * Runs daily in the management account. Any non-AWS tag applied to resources
- * (via app.addTags() or CDK aspects) is automatically activated in Cost
- * Explorer within 24 hours — no manual intervention required.
+ * Runs in the management account. Any non-AWS tag applied to resources (via
+ * app.addTags() or CDK aspects) is automatically activated in Cost Explorer —
+ * no manual intervention required. Cost Explorer is a global service, so the
+ * handler pins the us-east-1 endpoint and the caller synthesises this activator
+ * in the organisation's home region only.
  *
- * The schedule is NOT wired by this construct — callers wire the cadence via
- * `app.addSchedule(...)` so the EventBridge rule lives in the App's messaging
- * stack alongside every other Fjall schedule (D9). The activator implements
- * the structural `LambdaComputeShape` (duck-typed by `eventTargets.ts`), so it
- * can be passed directly as `target` to `app.addSchedule(...)` without a
- * `LambdaCompute` wrapper.
+ * Activation runs on two cadences:
+ * - A deploy-time one-shot (the `AwsCustomResource` below) invokes the Lambda
+ *   on org-stack create so tags already surfaced by AWS activate immediately,
+ *   without waiting for the first daily tick.
+ * - A daily schedule, wired by the caller (`organisation.ts`) as a `Schedule`
+ *   constructed in the Organisation stack — co-located with this Lambda so a
+ *   single `cdk deploy Organisation` deploys the EventBridge rule + invoke
+ *   permission. (A cross-stack `app.addSchedule(...)` placed that rule in the
+ *   App messaging stack, which the org deploy never targets, so the trigger
+ *   never materialised.) The activator implements the structural
+ *   `LambdaComputeShape` (duck-typed by `eventTargets.ts`), so it can be passed
+ *   directly as the `Schedule` target without a `LambdaCompute` wrapper.
  */
 export class CostAllocationTagActivator extends Construct {
     /** Marks this construct as a structural Lambda target for `eventTargets.ts`. */
@@ -43,6 +53,36 @@ export class CostAllocationTagActivator extends Construct {
                 })
             ]
         });
+        // Deploy-time one-shot: invoke the activator on org-stack create so tags
+        // already surfaced by AWS activate immediately rather than waiting for the
+        // first daily tick. Async (`Event`) and idempotent, so it never blocks or
+        // fails the deploy; the stable physicalResourceId means it fires on create
+        // (and only re-fires if the target function is replaced).
+        const activationParameters = {
+            FunctionName: this.lambda.functionName,
+            InvocationType: "Event"
+        };
+        new AwsCustomResource(this, "DeployTimeActivation", {
+            onCreate: {
+                service: "Lambda",
+                action: "invoke",
+                parameters: activationParameters,
+                physicalResourceId: PhysicalResourceId.of("cost-allocation-tag-activation")
+            },
+            onUpdate: {
+                service: "Lambda",
+                action: "invoke",
+                parameters: activationParameters,
+                physicalResourceId: PhysicalResourceId.of("cost-allocation-tag-activation")
+            },
+            policy: AwsCustomResourcePolicy.fromStatements([
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["lambda:InvokeFunction"],
+                    resources: [this.lambda.functionArn]
+                })
+            ])
+        });
     }
     /**
      * Structural `LambdaComputeShape` accessor — returns the activator's Lambda
@@ -56,7 +96,8 @@ const HANDLER_CODE = `
 const { CostExplorerClient, ListCostAllocationTagsCommand, UpdateCostAllocationTagsStatusCommand } = require("@aws-sdk/client-cost-explorer");
 
 exports.handler = async () => {
-  const client = new CostExplorerClient({});
+  // Cost Explorer is a global service reachable only via the us-east-1 endpoint.
+  const client = new CostExplorerClient({ region: "us-east-1" });
   const { CostAllocationTags = [] } = await client.send(new ListCostAllocationTagsCommand({ MaxResults: 1000 }));
 
   const inactive = CostAllocationTags.filter(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.19.3",
+  "version": "2.19.5",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -62,8 +62,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.19.3",
-    "@fjall/util": "^2.19.3",
+    "@fjall/generator": "^2.19.5",
+    "@fjall/util": "^2.19.5",
     "constructs": "^10.0.0"
   },
   "overrides": {
@@ -77,5 +77,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "622bf104895ff3f51147de46d5b70c5928aaaa86"
+  "gitHead": "8179898f55c1467404e6a715ead5404404e45be0"
 }