@fjall/components-infrastructure 2.23.0 → 2.24.0

package/dist/lib/config/aws/identityCentreConfig.js

@@ -0,0 +1,338 @@
+import { IDENTITY_CENTRE_SOURCES, VALIDATION_PATTERNS } from "@fjall/generator";
+import { stripAndCamelCase } from "../../utils/stripAndCamelCase.js";
+/**
+ * Customer-facing `identityCentre` configuration for the Organisation
+ * construct. The discriminated union on `source` mirrors AWS ground truth:
+ * the identity source of an Identity Center instance is neither readable nor
+ * settable via any supported API, so the mode is user-declared and
+ * authoritative. Design: aiDocs/designs/2026-07-04-org-user-management-design.md
+ *
+ * The source vocabulary is canonical in @fjall/generator
+ * (organisationSchemas.ts) — re-exported here so existing consumers keep
+ * their import path.
+ */
+export { IDENTITY_CENTRE_SOURCES } from "@fjall/generator";
+export const DEFAULT_PERMISSION_SETS = {
+    AdministratorAccess: {
+        managedPolicyArn: "arn:aws:iam::aws:policy/AdministratorAccess",
+        description: "Permission set for associated AdministratorAccess policy"
+    },
+    ReadOnlyAccess: {
+        managedPolicyArn: "arn:aws:iam::aws:policy/ReadOnlyAccess",
+        description: "Permission set for associated ReadOnlyAccess policy"
+    },
+    Billing: {
+        managedPolicyArn: "arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess",
+        description: "Permission set for associated Billing policy"
+    }
+};
+/**
+ * Defaults (unless suppressed) with same-named config entries merged over
+ * them, plus the remaining custom sets. Consumed by both the validator and
+ * the IdentityCenter construct — the two MUST agree on this derivation.
+ */
+export function effectivePermissionSets(config) {
+    const result = {};
+    if (config?.defaultPermissionSets !== false) {
+        for (const [name, def] of Object.entries(DEFAULT_PERMISSION_SETS)) {
+            result[name] = {
+                managedPolicies: [def.managedPolicyArn],
+                description: def.description,
+                isDefault: true
+            };
+        }
+    }
+    for (const [name, spec] of Object.entries(config?.permissionSets ?? {})) {
+        const base = result[name];
+        result[name] =
+            base !== undefined
+                ? { ...base, ...spec, isDefault: true }
+                : { ...spec, isDefault: false };
+    }
+    return result;
+}
+/**
+ * Canonical names of the accounts a permission set is assigned to, in
+ * declaration order: explicit `accounts` entries resolve case-insensitively
+ * to the workload ACCOUNTS names (unknown entries drop out — Rule 4 reports
+ * them), otherwise every workload account; the management opt-in appends the
+ * "management" pseudo-account. Duplicate entries are preserved so the
+ * validator's duplicate-declaration detection still fires. Consumed by both
+ * the validator (Rule 8 collision detection) and the IdentityCenter
+ * construct — the two MUST agree on this derivation.
+ */
+export function resolveTargetAccountNames(spec, workloadAccountNames) {
+    let targets;
+    if (Array.isArray(spec.accounts)) {
+        const canonicalByLower = new Map(workloadAccountNames.map((name) => [name.toLowerCase(), name]));
+        targets = spec.accounts
+            .map((accountName) => canonicalByLower.get(accountName.toLowerCase()))
+            .filter((resolved) => resolved !== undefined);
+    }
+    else {
+        targets = [...workloadAccountNames];
+    }
+    if (spec.includeManagementAccount === true) {
+        targets.push("management");
+    }
+    return targets;
+}
+/** Groups bound to a set: explicit list, else the implicit same-named group. */
+export function boundGroupsForSet(name, spec) {
+    return spec.groups !== undefined && spec.groups.length > 0
+        ? spec.groups
+        : [name];
+}
+export function implicitGroupNames(sets) {
+    return Object.entries(sets)
+        .filter(([, spec]) => spec.groups === undefined || spec.groups.length === 0)
+        .map(([name]) => name);
+}
+/**
+ * Assignment construct-id derivation shared by the validator (collision
+ * detection) and the IdentityCenter construct — the two MUST agree. The
+ * implicit same-named group omits the group segment to keep the legacy id
+ * shape, so existing deployments do not replace their assignments.
+ */
+export function assignmentConstructId(accountName, setName, groupName) {
+    return groupName === setName
+        ? `${stripAndCamelCase(accountName)}${setName}Assignment`
+        : `${stripAndCamelCase(accountName)}${setName}${groupName}Assignment`;
+}
+/** Every group the config will create: implicit per-set groups + custom groups. */
+export function allGroupNames(config) {
+    const names = new Set(implicitGroupNames(effectivePermissionSets(config)));
+    for (const name of Object.keys(config?.groups ?? {})) {
+        names.add(name);
+    }
+    return [...names];
+}
+const SESSION_DURATION_PATTERN = /^PT(?:(\d+)H)?(?:(\d+)M)?$/;
+// AWS Identity Center permission-set session bounds (1–12 hours).
+const SESSION_DURATION_MIN_MINUTES = 60;
+const SESSION_DURATION_MAX_MINUTES = 720;
+// Intersection of the CFN PermissionSet Name pattern ([\w+=,.@-]{1,32}) and
+// the CfnOutput export-name charset — underscore is excluded because group
+// export names (`${name}GroupId`) forbid it.
+const RESOURCE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]*$/;
+const PERMISSION_SET_NAME_MAX_LENGTH = 32;
+const GROUP_NAME_MAX_LENGTH = 64;
+const NAME_SHAPE_REQUIREMENT = "must start with a letter and contain only letters, digits and hyphens";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isBlank(value) {
+    return value === undefined || value.trim() === "";
+}
+function groupsHoldingUser(config, email) {
+    const lower = email.toLowerCase();
+    return Object.entries(config.memberships ?? {})
+        .filter(([, emails]) => emails.some((e) => e.toLowerCase() === lower))
+        .map(([groupName]) => groupName);
+}
+/**
+ * Synth-time validation — every rule fires before any CloudFormation call so
+ * a typo never surfaces as a mid-deploy custom-resource failure. Collects
+ * every violation and throws once; warnings/infos are returned for the
+ * construct to surface via CDK Annotations.
+ */
+export function validateIdentityCentreConfig(config, context) {
+    const errors = [];
+    const warnings = [];
+    const infos = [];
+    // Rule 7 — the union enforced for plain-JS callers.
+    const sources = IDENTITY_CENTRE_SOURCES;
+    if (!sources.includes(config.source)) {
+        errors.push(`identityCentre.source must be one of ${IDENTITY_CENTRE_SOURCES.join(" | ")}, got "${String(config.source)}"`);
+    }
+    if ("users" in config &&
+        config.users !== undefined &&
+        !isRecord(config.users)) {
+        errors.push("identityCentre.users must be an object mapping email addresses to user specs");
+    }
+    const users = "users" in config && isRecord(config.users) ? config.users : {};
+    if (config.source === "external" && Object.keys(users).length > 0) {
+        errors.push('identityCentre.users cannot be declared when source is "external" — the IdP (Google/Okta/Entra) owns user objects there. Manage group memberships only, or switch to "external-manual" for the SAML-without-SCIM pre-provisioning pattern.');
+    }
+    if (config.source === "fjall-managed" && !("users" in config)) {
+        errors.push('identityCentre.users is required when source is "fjall-managed" (an empty object is valid).');
+    }
+    // Rule 5 — user entries: email keys and name fields. Identity-store emails
+    // are case-insensitive, so case-variant keys are duplicates.
+    const userKeyByLower = new Map();
+    for (const email of Object.keys(users)) {
+        const existing = userKeyByLower.get(email.toLowerCase());
+        if (existing !== undefined) {
+            errors.push(`users declares "${existing}" and "${email}", which differ only by letter case — identity-store emails are case-insensitive; keep one`);
+        }
+        else {
+            userKeyByLower.set(email.toLowerCase(), email);
+        }
+    }
+    for (const [email, spec] of Object.entries(users)) {
+        if (!VALIDATION_PATTERNS.EMAIL.test(email)) {
+            errors.push(`users key "${email}" is not a valid email address`);
+        }
+        if (isBlank(spec.givenName) || isBlank(spec.familyName)) {
+            errors.push(`users["${email}"] must declare non-empty givenName and familyName`);
+        }
+        if (spec.displayName !== undefined && spec.displayName.trim() === "") {
+            errors.push(`users["${email}"].displayName must not be blank — omit it to default to "givenName familyName"`);
+        }
+        if (spec.expires !== undefined) {
+            const parsed = Date.parse(spec.expires);
+            if (Number.isNaN(parsed)) {
+                errors.push(`users["${email}"].expires "${spec.expires}" is not a parseable ISO date (expected e.g. "2026-09-30")`);
+            }
+            else if (parsed < (context.now ?? new Date()).getTime()) {
+                // Rule 6 — error, not warning: the exposure is live until detached.
+                const holding = groupsHoldingUser(config, email);
+                if (holding.length > 0) {
+                    errors.push(`users["${email}"] expired on ${spec.expires} but still holds memberships in: ${holding.join(", ")}. Remove the memberships (fjall user remove ${email}) or extend expires.`);
+                }
+            }
+        }
+    }
+    const sets = effectivePermissionSets(config);
+    const groupUniverse = new Set(allGroupNames(config));
+    const workloadNames = new Set(context.workloadAccountNames.map((name) => name.toLowerCase()));
+    for (const [name, spec] of Object.entries(sets)) {
+        if (!RESOURCE_NAME_PATTERN.test(name) ||
+            name.length > PERMISSION_SET_NAME_MAX_LENGTH) {
+            errors.push(`permissionSets key "${name}" ${NAME_SHAPE_REQUIREMENT}, at most ${PERMISSION_SET_NAME_MAX_LENGTH} characters (CloudFormation permission-set name and export-name constraints)`);
+        }
+        if ((spec.managedPolicies === undefined ||
+            spec.managedPolicies.length === 0) &&
+            spec.inlinePolicy === undefined &&
+            (spec.customerManagedPolicies === undefined ||
+                spec.customerManagedPolicies.length === 0)) {
+            errors.push(`permissionSets["${name}"] declares no managedPolicies, inlinePolicy, or customerManagedPolicies — it would grant nothing`);
+        }
+        // Rule 3 — explicit group bindings must resolve to a group that will exist.
+        for (const groupName of spec.groups ?? []) {
+            if (!groupUniverse.has(groupName)) {
+                errors.push(`permissionSets["${name}"].groups references "${groupName}", which is neither a declared group nor another set's implicit group. Declare it under identityCentre.groups.`);
+            }
+        }
+        // Rule 4 — account scoping against the workload ACCOUNTS names.
+        if (Array.isArray(spec.accounts)) {
+            for (const accountName of spec.accounts) {
+                if (!workloadNames.has(accountName.toLowerCase())) {
+                    errors.push(`permissionSets["${name}"].accounts references unknown account "${accountName}". Workload accounts: ${context.workloadAccountNames.join(", ")}. The management account is reachable only via includeManagementAccount: true.`);
+                }
+            }
+            if (spec.accounts.length === 0 &&
+                spec.includeManagementAccount !== true) {
+                warnings.push({
+                    code: "unassigned-permission-set",
+                    message: `permissionSets["${name}"] has accounts: [] and no management opt-in — it is assigned nowhere`
+                });
+            }
+        }
+        if (spec.sessionDuration !== undefined) {
+            const match = SESSION_DURATION_PATTERN.exec(spec.sessionDuration);
+            if (match === null ||
+                (match[1] === undefined && match[2] === undefined)) {
+                errors.push(`permissionSets["${name}"].sessionDuration "${spec.sessionDuration}" is not an ISO-8601 duration like "PT12H"`);
+            }
+            else {
+                const totalMinutes = Number(match[1] ?? 0) * 60 + Number(match[2] ?? 0);
+                if (totalMinutes < SESSION_DURATION_MIN_MINUTES ||
+                    totalMinutes > SESSION_DURATION_MAX_MINUTES) {
+                    errors.push(`permissionSets["${name}"].sessionDuration "${spec.sessionDuration}" is outside the AWS Identity Center range PT1H to PT12H`);
+                }
+            }
+        }
+    }
+    // Rule 8 — construct-id collisions from name concatenation (a set
+    // "DataEngOps" and a set "DataEng" bound to group "Ops" produce the same
+    // assignment id on one account). Shares the construct's target derivation.
+    const assignmentIdOwners = new Map();
+    for (const [name, spec] of Object.entries(sets)) {
+        const targets = resolveTargetAccountNames(spec, context.workloadAccountNames);
+        for (const accountName of targets) {
+            for (const groupName of boundGroupsForSet(name, spec)) {
+                const id = assignmentConstructId(accountName, name, groupName);
+                const claim = `permissionSets["${name}"] on account "${accountName}" via group "${groupName}"`;
+                const owner = assignmentIdOwners.get(id);
+                if (owner === undefined) {
+                    assignmentIdOwners.set(id, claim);
+                }
+                else if (owner === claim) {
+                    errors.push(`${claim} is declared more than once — remove the duplicate accounts or groups entry`);
+                }
+                else {
+                    errors.push(`assignment construct ids collide on "${id}": ${owner} vs ${claim}. Rename one of the clashing sets or groups.`);
+                }
+            }
+        }
+    }
+    for (const [groupName, emails] of Object.entries(config.memberships ?? {})) {
+        // Rule 1 — membership group names must resolve.
+        if (!groupUniverse.has(groupName)) {
+            errors.push(`memberships references undeclared group "${groupName}". Groups that will exist: ${[...groupUniverse].join(", ")}`);
+        }
+        const seenByLower = new Map();
+        for (const email of emails) {
+            if (!VALIDATION_PATTERNS.EMAIL.test(email)) {
+                errors.push(`memberships["${groupName}"] entry "${email}" is not a valid email address`);
+            }
+            const first = seenByLower.get(email.toLowerCase());
+            if (first !== undefined) {
+                errors.push(first === email
+                    ? `memberships["${groupName}"] lists "${email}" twice`
+                    : `memberships["${groupName}"] lists "${first}" and "${email}", which differ only by letter case — identity-store emails are case-insensitive`);
+            }
+            else {
+                seenByLower.set(email.toLowerCase(), email);
+            }
+            // Rule 2 — fjall-managed memberships must reference declared users.
+            if (config.source === "fjall-managed" && users[email] === undefined) {
+                const caseVariant = userKeyByLower.get(email.toLowerCase());
+                errors.push(caseVariant !== undefined
+                    ? `memberships["${groupName}"] references "${email}", which differs only by letter case from declared user "${caseVariant}" — use identical casing`
+                    : `memberships["${groupName}"] references "${email}", which is not declared under users — in fjall-managed mode every member must be a users entry`);
+            }
+            if (config.source === "external-manual" && users[email] === undefined) {
+                const caseVariant = userKeyByLower.get(email.toLowerCase());
+                if (caseVariant !== undefined) {
+                    errors.push(`memberships["${groupName}"] references "${email}", which differs only by letter case from pre-provisioned user "${caseVariant}" — use identical casing`);
+                }
+                else {
+                    infos.push({
+                        code: "external-lookup-fallback",
+                        message: `memberships["${groupName}"] member "${email}" is not pre-provisioned under users — it will resolve by identity-store lookup at deploy time`
+                    });
+                }
+            }
+        }
+    }
+    const boundGroups = new Set();
+    for (const [name, spec] of Object.entries(sets)) {
+        for (const groupName of boundGroupsForSet(name, spec)) {
+            boundGroups.add(groupName);
+        }
+    }
+    for (const groupName of Object.keys(config.groups ?? {})) {
+        if (!RESOURCE_NAME_PATTERN.test(groupName) ||
+            groupName.length > GROUP_NAME_MAX_LENGTH) {
+            errors.push(`groups key "${groupName}" ${NAME_SHAPE_REQUIREMENT}, at most ${GROUP_NAME_MAX_LENGTH} characters (group export-name constraints)`);
+        }
+        const hasMembers = (config.memberships?.[groupName]?.length ?? 0) > 0;
+        if (!boundGroups.has(groupName) && !hasMembers) {
+            warnings.push({
+                code: "decorative-group",
+                message: `groups["${groupName}"] is bound to no permission set and has no members — it grants nothing. Bind it via permissionSets[].groups or add memberships.`
+            });
+        }
+    }
+    if (config.resolutionVersion !== undefined &&
+        (!Number.isInteger(config.resolutionVersion) ||
+            config.resolutionVersion < 1)) {
+        errors.push(`identityCentre.resolutionVersion must be a positive integer, got ${String(config.resolutionVersion)}`);
+    }
+    if (errors.length > 0) {
+        throw new Error(`identityCentre configuration invalid:\n- ${errors.join("\n- ")}`);
+    }
+    return { warnings, infos };
+}

package/dist/lib/config/aws/index.d.ts

@@ -1,5 +1,5 @@
 export * from "./identityCenter.js";
-export * from "./identityCenterMembership.js";
+export * from "./identityCentreConfig.js";
 export * from "./ipam.js";
 export * from "./ecrDefaultImage.js";
 export * from "./oidcConnector.js";

package/dist/lib/config/aws/index.js

@@ -1,5 +1,5 @@
 export * from "./identityCenter.js";
-export * from "./identityCenterMembership.js";
+export * from "./identityCentreConfig.js";
 export * from "./ipam.js";
 export * from "./ecrDefaultImage.js";
 export * from "./oidcConnector.js";

package/dist/lib/config/aws/oidcConnector.d.ts

@@ -1,6 +1,15 @@
+import { type GovernancePreset } from "@fjall/generator";
 import { Construct } from "constructs";
 export interface OidcConnectorProps {
     fjallOrgId: string;
+    /**
+     * Governance tier selecting the deploy-role permissions-boundary CONTENT.
+     * When set, a `FjallDeployBoundary${fjallOrgId}` customer-managed policy is
+     * created and attached to the deploy role as its permissions boundary — the
+     * hard cap that survives CDK's assume-role hand-off (unlike a session policy).
+     * Absent ⇒ no boundary (today's behaviour — backward-compatible).
+     */
+    securityTier?: GovernancePreset;
 }
 export declare class OidcConnector extends Construct {
     readonly deployRoleArn: string;

package/dist/lib/config/aws/oidcConnector.js

@@ -1,7 +1,9 @@
+import { SECURITY_TIER_TO_BOUNDARY, deployBoundaryName } from "@fjall/generator";
 import { CfnOutput, Duration } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { Construct } from "constructs";
+import { ManagedPolicy } from "../../resources/aws/iam/managedPolicy.js";
 import { Role } from "../../resources/aws/iam/role.js";
 import { CustomResource } from "../../resources/aws/utilities/customResource.js";
 /**
@@ -79,6 +81,17 @@ export class OidcConnector extends Construct {
         const providerArn = providerResource.resource
             .getAtt("ProviderArn")
             .toString();
+        // Permissions boundary (hard cap). Created here — in the account-connection
+        // stack that runs BEFORE any bootstrap/deploy — because
+        // `cdk bootstrap --custom-permissions-boundary <name>` LOOKS THE POLICY UP
+        // by name; it never creates it. So the policy must exist by name first.
+        const deployBoundary = props.securityTier !== undefined
+            ? new ManagedPolicy(this, "DeployBoundary", {
+                managedPolicyName: deployBoundaryName(props.fjallOrgId),
+                description: "Fjall deploy-role permissions boundary — hard cap on the OIDC deploy role and the CDK cfn-exec-role",
+                statements: SECURITY_TIER_TO_BOUNDARY[props.securityTier].map((statement) => iam.PolicyStatement.fromJson(statement))
+            })
+            : undefined;
         const deployRole = new Role(this, "DeployRole", {
             roleName: `FjallDeploy${props.fjallOrgId}`,
             path: "/fjall/",
@@ -91,7 +104,10 @@ export class OidcConnector extends Construct {
             }, "sts:AssumeRoleWithWebIdentity"),
             managedPolicies: [
                 iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
-            ]
+            ],
+            ...(deployBoundary !== undefined && {
+                permissionsBoundary: deployBoundary
+            })
         });
         this.deployRoleArn = deployRole.roleArn;
         new CfnOutput(this, "OidcDeployRoleArn", {

package/dist/lib/lambda-assets/identity-store-user/asset/index.js

@@ -0,0 +1,198 @@
+/**
+ * Custom::FjallIdentityStoreUser handler (CDK Provider framework onEvent).
+ *
+ * Authored directly under asset/ — unlike cert-generator there is no build
+ * step because the only dependency, @aws-sdk/client-identitystore, ships in
+ * the Lambda Node 22 runtime. asset/package.json pins CJS resolution.
+ *
+ * Lifecycle:
+ * - Create: CreateUser(userName = email). On ConflictException the user
+ *   already exists (console, SCIM, legacy CLI) → GetUserId by emails.value
+ *   and ADOPT it: converge declared attributes, mark the physical id
+ *   `adopted#<UserId>`. A ResourceNotFoundException immediately after the
+ *   conflict means the exception was thrown for a concurrent create that
+ *   has since vanished — retry the create exactly once.
+ * - Update: email (= userName) change returns a NEW physical id, which
+ *   CloudFormation treats as replacement (Delete arrives for the old id) —
+ *   unless the new email resolves to the SAME user, in which case the prior
+ *   physical id is preserved so the cleanup Delete never fires.
+ *   Otherwise attributes converge in place via UpdateUser.
+ * - Delete: skipped for adopted users — Fjall never destroys a user it did
+ *   not create. ResourceNotFoundException is tolerated (already gone).
+ *   Rollback after a create can strand a just-created user as adopted on the
+ *   re-adopt path; deliberate leak-safe bias — never delete when uncertain.
+ *
+ * The adopted flag lives in the PhysicalResourceId (`adopted#`/`created#`
+ * prefix) because Delete events carry the physical id but not prior Data.
+ * Data.UserId always carries the bare UserId for membership wiring.
+ *
+ * Logging discipline: request type + logical id only — no attribute values.
+ */
+"use strict";
+
+const {
+  IdentitystoreClient,
+  CreateUserCommand,
+  UpdateUserCommand,
+  DeleteUserCommand,
+  GetUserIdCommand
+} = require("@aws-sdk/client-identitystore");
+
+const ADOPTED_PREFIX = "adopted#";
+const CREATED_PREFIX = "created#";
+
+const client = new IdentitystoreClient({});
+
+function parsePhysicalId(physicalId) {
+  if (physicalId.startsWith(ADOPTED_PREFIX)) {
+    return { userId: physicalId.slice(ADOPTED_PREFIX.length), adopted: true };
+  }
+  if (physicalId.startsWith(CREATED_PREFIX)) {
+    return { userId: physicalId.slice(CREATED_PREFIX.length), adopted: false };
+  }
+  // Unknown shape: fail safe — treat as adopted so Delete never fires.
+  return { userId: physicalId, adopted: true };
+}
+
+async function getUserIdByEmail(identityStoreId, email) {
+  const response = await client.send(
+    new GetUserIdCommand({
+      IdentityStoreId: identityStoreId,
+      AlternateIdentifier: {
+        UniqueAttribute: {
+          AttributePath: "emails.value",
+          AttributeValue: email
+        }
+      }
+    })
+  );
+  return response.UserId;
+}
+
+async function convergeAttributes(props, userId) {
+  await client.send(
+    new UpdateUserCommand({
+      IdentityStoreId: props.IdentityStoreId,
+      UserId: userId,
+      Operations: [
+        { AttributePath: "displayName", AttributeValue: props.DisplayName },
+        { AttributePath: "name.givenName", AttributeValue: props.GivenName },
+        { AttributePath: "name.familyName", AttributeValue: props.FamilyName }
+      ]
+    })
+  );
+}
+
+function result(prefix, userId) {
+  return {
+    PhysicalResourceId: prefix + userId,
+    Data: {
+      UserId: userId,
+      Adopted: prefix === ADOPTED_PREFIX ? "true" : "false"
+    }
+  };
+}
+
+async function createOrAdopt(props, attempt) {
+  try {
+    const created = await client.send(
+      new CreateUserCommand({
+        IdentityStoreId: props.IdentityStoreId,
+        UserName: props.Email,
+        DisplayName: props.DisplayName,
+        Name: { GivenName: props.GivenName, FamilyName: props.FamilyName },
+        Emails: [{ Value: props.Email, Primary: true, Type: "work" }]
+      })
+    );
+    return result(CREATED_PREFIX, created.UserId);
+  } catch (err) {
+    if (err.name !== "ConflictException") {
+      throw err;
+    }
+    let userId;
+    try {
+      userId = await getUserIdByEmail(props.IdentityStoreId, props.Email);
+    } catch (lookupErr) {
+      if (lookupErr.name === "ResourceNotFoundException") {
+        if (attempt === 0) {
+          return createOrAdopt(props, 1);
+        }
+        throw new Error(
+          `Cannot adopt existing user ${props.Email}: CreateUser reports a conflict but no user resolves by emails.value. A user whose userName is ${props.Email} with a different email attribute likely exists — align that user's email in the identity store (or remove the user), then redeploy.`
+        );
+      }
+      throw lookupErr;
+    }
+    try {
+      await convergeAttributes(props, userId);
+    } catch (updateErr) {
+      if (updateErr.name === "ConflictException") {
+        throw new Error(
+          `Cannot adopt existing user ${props.Email}: converging its attributes hit a uniqueness conflict (${updateErr.message}). Resolve the clashing user in the identity store, then redeploy.`
+        );
+      }
+      throw updateErr;
+    }
+    return result(ADOPTED_PREFIX, userId);
+  }
+}
+
+async function onUpdate(event) {
+  const props = event.ResourceProperties;
+  const oldProps = event.OldResourceProperties || {};
+  const prior = parsePhysicalId(event.PhysicalResourceId);
+  if (props.Email !== oldProps.Email) {
+    const next = await createOrAdopt(props, 0);
+    const nextParsed = parsePhysicalId(next.PhysicalResourceId);
+    if (nextParsed.userId === prior.userId) {
+      // Same underlying user (email changed out-of-band): a new physical id
+      // would make CloudFormation cleanup-Delete the old id — destroying the
+      // live user. Keep the prior id and flag.
+      return result(
+        prior.adopted ? ADOPTED_PREFIX : CREATED_PREFIX,
+        prior.userId
+      );
+    }
+    return next;
+  }
+  await convergeAttributes(props, prior.userId);
+  return result(prior.adopted ? ADOPTED_PREFIX : CREATED_PREFIX, prior.userId);
+}
+
+async function onDelete(event) {
+  const { userId, adopted } = parsePhysicalId(event.PhysicalResourceId);
+  if (adopted) {
+    console.log(`Skipping delete of adopted user ${userId}`);
+    return { PhysicalResourceId: event.PhysicalResourceId };
+  }
+  try {
+    await client.send(
+      new DeleteUserCommand({
+        IdentityStoreId: event.ResourceProperties.IdentityStoreId,
+        UserId: userId
+      })
+    );
+  } catch (err) {
+    if (err.name !== "ResourceNotFoundException") {
+      throw err;
+    }
+    console.log(`User ${userId} already deleted`);
+  }
+  return { PhysicalResourceId: event.PhysicalResourceId };
+}
+
+exports.handler = async (event) => {
+  console.log(
+    `FjallIdentityStoreUser ${event.RequestType} ${event.LogicalResourceId}`
+  );
+  switch (event.RequestType) {
+    case "Create":
+      return createOrAdopt(event.ResourceProperties, 0);
+    case "Update":
+      return onUpdate(event);
+    case "Delete":
+      return onDelete(event);
+    default:
+      throw new Error(`Unsupported request type: ${event.RequestType}`);
+  }
+};

package/dist/lib/lambda-assets/identity-store-user/asset/package.json

@@ -0,0 +1,4 @@
+{
+  "type": "commonjs",
+  "private": true
+}

package/dist/lib/patterns/aws/account.d.ts

@@ -11,9 +11,20 @@ import type { SecurityHubHubProps } from "../../config/aws/securityHubHub.js";
 import type { ConfigRecorderProps } from "../../config/aws/configRecorder.js";
 import type { ConfigRulePresetProps } from "../../config/aws/configRulePreset.js";
 import type { OrganisationType } from "./interfaces/organisation.js";
+import { type GovernancePreset } from "@fjall/generator";
 export interface AccountProps extends StackProps {
     accountId?: string;
     region?: string;
+    /**
+     * Governance tier selecting the deploy-role permissions-boundary CONTENT
+     * (Phase E, seam 1). Forwarded to the account's `OidcConnector`, which
+     * creates `FjallDeployBoundary${fjallOrgId}` from
+     * `SECURITY_TIER_TO_BOUNDARY[securityTier]`. Undefined ⇒ no boundary
+     * (backward-compatible). Sourced from the generated `account/infrastructure.ts`
+     * (the `--security` dial baked in at generation time — the tier is not
+     * persisted anywhere the deploy flow could read it).
+     */
+    securityTier?: GovernancePreset;
 }
 export declare class Account extends Stack {
     readonly organisationType: OrganisationType;

package/dist/lib/patterns/aws/account.js

@@ -65,7 +65,12 @@ export class Account extends Stack {
             fjallOrgId &&
             !oidcAlreadyConfigured &&
             !accountGlobalsConfigured) {
-            new OidcConnector(this, "OidcConnector", { fjallOrgId });
+            new OidcConnector(this, "OidcConnector", {
+                fjallOrgId,
+                ...(props.securityTier !== undefined && {
+                    securityTier: props.securityTier
+                })
+            });
         }
         if (!accountGlobalsConfigured) {
             new AccountMonitoringRole(this, "MonitoringRole", fjallOrgId ? { fjallOrgId } : undefined);

package/dist/lib/patterns/aws/computeEcsTypes.d.ts

@@ -630,8 +630,9 @@ export interface EcsServiceConfig {
      * (absolute or relative), an optional build `context` for monorepo
      * layouts, and an optional multi-stage `target`.
      *
-     * Tagged image suffix when `target` is set: `<service>-<target>-latest`.
-     * Mutually exclusive with `image` (pre-built URI).
+     * Content-hash image tag when `target` is set:
+     * `<service>-<target>-sha-<12 hex>`. Mutually exclusive with `image`
+     * (pre-built URI).
      */
     docker?: DockerBuild;
     /**