@fjall/components-infrastructure 2.23.0 → 2.24.0

package/dist/lib/patterns/aws/organisation.d.ts

@@ -1,7 +1,7 @@
 import { type Environment } from "aws-cdk-lib";
 import { type Construct } from "constructs";
 import { Account, type AccountProps } from "./account.js";
-import { type CustomPermissionSets } from "../../config/aws/identityCenter.js";
+import { type IdentityCentreConfig } from "../../config/aws/identityCentreConfig.js";
 import { ScpPreset } from "../../config/aws/scpPreset.js";
 import type { ScpPresetProps } from "../../config/aws/scpPreset.js";
 import { OrganisationResource } from "../../resources/aws/organisation/index.js";
@@ -13,7 +13,13 @@ export interface OrganisationProps extends AccountProps {
     accounts: AccountsConfig;
     orgEmail: string;
     accountIds?: Record<string, string>;
-    identityCenter?: boolean;
+    /**
+     * Identity Centre configuration: groups, permission sets, memberships and
+     * (source permitting) users, all declared in code. `false` disables the
+     * Identity Centre entirely; omitted = the three built-in permission sets
+     * with no members (inert defaults).
+     */
+    identityCentre?: IdentityCentreConfig | false;
     allowedRegions?: string[];
     env?: Required<Pick<Environment, "region" | "account">> & Partial<Omit<Environment, "region" | "account">>;
 }
@@ -59,9 +65,7 @@ export declare class Organisation extends Account {
     private createAccountReferences;
     private setupOrganisationFeatures;
     private setupCostAllocationTagActivator;
-    private setupIdentityCenter;
-    declarePermissionSets(customs: CustomPermissionSets): void;
-    assignGroupMembers(members: Record<string, string[]>): void;
+    private setupIdentityCentre;
     getOrganisation(): OrganisationResource;
     getAccounts(): Record<string, string>;
     enableScps(props: ScpPresetProps): ScpPreset;

package/dist/lib/patterns/aws/organisation.js

@@ -28,6 +28,12 @@ export class Organisation extends Account {
     accountsConfig;
     identityCenter;
     constructor(scope, id, props) {
+        // Customer synth runs infrastructure.ts through tsx, which never
+        // typechecks — a removed prop is silently ignored, so the legacy key
+        // (e.g. `identityCenter: false`) would re-enable the Identity Centre.
+        if ("identityCenter" in props) {
+            throw new Error("OrganisationProps.identityCenter has been replaced by identityCentre (IdentityCentreConfig | false). Rename the key — identityCentre: false disables the Identity Centre; omitting it keeps the built-in permission sets.");
+        }
         const config = getConfig();
         const accountId = props.accountId ?? props.env?.account ?? config.accountId;
         if (!accountId) {
@@ -88,7 +94,7 @@ export class Organisation extends Account {
             }
         }
         this.createAccountReferences(props);
-        this.setupOrganisationFeatures(props.identityCenter ?? true, managementAccountId);
+        this.setupOrganisationFeatures(props.identityCentre, managementAccountId);
     }
     /**
      * The organisation root's OIDC deploy connector is owned by the customer-run
@@ -133,8 +139,8 @@ export class Organisation extends Account {
             this.accountRefs.push(ref);
         }
     }
-    setupOrganisationFeatures(identityCenter, managementAccountId) {
-        this.setupIdentityCenter(identityCenter, managementAccountId);
+    setupOrganisationFeatures(identityCentre, managementAccountId) {
+        this.setupIdentityCentre(identityCentre, managementAccountId);
         // Home region only: Cost Explorer is a global service (single us-east-1
         // endpoint), so an org-region cascade stack would otherwise synthesise a
         // redundant daily activator Lambda per region against the same global
@@ -157,32 +163,23 @@ export class Organisation extends Account {
             appName: App.getInstance().getName()
         });
     }
-    setupIdentityCenter(identityCenter, managementAccountId) {
-        if (identityCenter) {
-            // Exclude the management account from SSO assignments — only root
-            // IAM users should have direct access to the organisation account.
-            const ssoAccounts = {};
-            for (const [name, id] of Object.entries(this.accountMap)) {
-                if (id !== managementAccountId) {
-                    ssoAccounts[name] = id;
-                }
-            }
-            this.identityCenter = new IdentityCenter(this, "IdentityCenter", {
-                accounts: ssoAccounts
-            });
-        }
-    }
-    declarePermissionSets(customs) {
-        if (this.identityCenter === undefined) {
-            throw new Error("Identity Center is not enabled. Pass identityCenter: true to OrganisationFactory.");
+    setupIdentityCentre(identityCentre, managementAccountId) {
+        if (identityCentre === false) {
+            return;
         }
-        this.identityCenter.declarePermissionSets(customs);
-    }
-    assignGroupMembers(members) {
-        if (this.identityCenter === undefined) {
-            throw new Error("Identity Center is not enabled. Pass identityCenter: true to OrganisationFactory.");
+        // Exclude the management account from default SSO assignments — a
+        // permission set reaches it only via includeManagementAccount: true.
+        const ssoAccounts = {};
+        for (const [name, id] of Object.entries(this.accountMap)) {
+            if (id !== managementAccountId) {
+                ssoAccounts[name] = id;
+            }
         }
-        this.identityCenter.assignGroupMembers(members);
+        this.identityCenter = new IdentityCenter(this, "IdentityCenter", {
+            accounts: ssoAccounts,
+            managementAccountId,
+            ...(identityCentre !== undefined && { config: identityCentre })
+        });
     }
     getOrganisation() {
         return this.org;

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -427,7 +427,7 @@ export interface EcsServiceProps {
     ssmSecretsPath?: string;
     /**
      * Dockerfile build configuration for this service. When `target` is set,
-     * the image tag suffix becomes `<service>-<target>-latest`.
+     * the content-hash image tag becomes `<service>-<target>-sha-<12 hex>`.
      * Mutually exclusive with `image` (pre-built URI).
      */
     docker?: DockerBuild;

package/dist/lib/resources/aws/iam/identityCenter/index.d.ts

@@ -2,3 +2,4 @@ export * from "./assignment.js";
 export * from "./group.js";
 export * from "./groupMembership.js";
 export * from "./permissionSet.js";
+export * from "./user.js";

package/dist/lib/resources/aws/iam/identityCenter/index.js

@@ -2,3 +2,4 @@ export * from "./assignment.js";
 export * from "./group.js";
 export * from "./groupMembership.js";
 export * from "./permissionSet.js";
+export * from "./user.js";

package/dist/lib/resources/aws/iam/identityCenter/permissionSet.d.ts

@@ -1,5 +1,6 @@
 import { Construct } from "constructs";
 import { type KeyValue } from "../../../../types.js";
+import type { CustomerManagedPolicyRef, PermissionsBoundarySpec } from "../../../../config/aws/identityCentreConfig.js";
 export declare class PermissionSet extends Construct {
     private cfnPermissionSet;
     constructor(scope: Construct, id: string, props: {
@@ -7,6 +8,9 @@ export declare class PermissionSet extends Construct {
         instanceArn: string;
         description?: string;
         managedPolicies?: string[];
+        inlinePolicy?: Record<string, unknown>;
+        customerManagedPolicies?: CustomerManagedPolicyRef[];
+        permissionsBoundary?: PermissionsBoundarySpec;
         sessionDuration?: string;
         tags?: KeyValue[];
     });

package/dist/lib/resources/aws/iam/identityCenter/permissionSet.js

@@ -9,6 +9,18 @@ export class PermissionSet extends Construct {
             instanceArn: props.instanceArn,
             description: props.description,
             managedPolicies: props.managedPolicies,
+            inlinePolicy: props.inlinePolicy,
+            customerManagedPolicyReferences: props.customerManagedPolicies?.map((ref) => ({ name: ref.name, path: ref.path })),
+            permissionsBoundary: props.permissionsBoundary !== undefined
+                ? "managedPolicyArn" in props.permissionsBoundary
+                    ? { managedPolicyArn: props.permissionsBoundary.managedPolicyArn }
+                    : {
+                        customerManagedPolicyReference: {
+                            name: props.permissionsBoundary.customerManagedPolicy.name,
+                            path: props.permissionsBoundary.customerManagedPolicy.path
+                        }
+                    }
+                : undefined,
             sessionDuration: props.sessionDuration,
             tags: props.tags?.map((t) => ({ key: t.key, value: t.value }))
         });

package/dist/lib/resources/aws/iam/identityCenter/user.d.ts

@@ -0,0 +1,35 @@
+import { Construct } from "constructs";
+/** Identity-store user ARNs carry no region or account segment. */
+export declare function identityStoreUserArnPattern(partition: string): string;
+export interface IdentityStoreUserProviderProps {
+    identityStoreId: string;
+}
+/**
+ * Shared Provider-framework backend for Custom::FjallIdentityStoreUser —
+ * one handler + provider pair serves every declared user in the stack. A
+ * plain AwsCustomResource cannot express the create-or-adopt branching the
+ * handler implements (aiDocs/designs/2026-07-04-org-user-management-design.md § 2).
+ */
+export declare class IdentityStoreUserProvider extends Construct {
+    readonly serviceToken: string;
+    constructor(scope: Construct, id: string, props: IdentityStoreUserProviderProps);
+}
+export interface IdentityStoreUserProps {
+    serviceToken: string;
+    identityStoreId: string;
+    email: string;
+    givenName: string;
+    familyName: string;
+    displayName?: string;
+}
+/**
+ * A declared identity-store user (fjall-managed / external-manual sources).
+ * Pre-existing users are adopted, never overwritten-by-recreate, and adopted
+ * users are never deleted on stack removal. `userId` is the CR's UserId
+ * attribute — wiring memberships to it gives them an implicit dependency on
+ * the user, so CloudFormation deletes memberships first.
+ */
+export declare class IdentityStoreUser extends Construct {
+    readonly userId: string;
+    constructor(scope: Construct, id: string, props: IdentityStoreUserProps);
+}

package/dist/lib/resources/aws/iam/identityCenter/user.js

@@ -0,0 +1,85 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CustomResource, Stack } from "aws-cdk-lib";
+import { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Provider } from "aws-cdk-lib/custom-resources";
+import { Construct } from "constructs";
+import { SingletonFunction } from "../../compute/lambda.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/**
+ * Resolves relative to the compiled location too — the build step copies the
+ * asset directory into dist/lib/lambda-assets/identity-store-user/asset/,
+ * mirroring the source tree, so the same relative walk works post-build.
+ */
+const LAMBDA_ASSET_DIR = join(__dirname, "../../../../lambda-assets/identity-store-user/asset");
+const HANDLER_TIMEOUT_SECONDS = 120;
+/** Identity-store user ARNs carry no region or account segment. */
+export function identityStoreUserArnPattern(partition) {
+    return `arn:${partition}:identitystore:::user/*`;
+}
+/**
+ * Shared Provider-framework backend for Custom::FjallIdentityStoreUser —
+ * one handler + provider pair serves every declared user in the stack. A
+ * plain AwsCustomResource cannot express the create-or-adopt branching the
+ * handler implements (aiDocs/designs/2026-07-04-org-user-management-design.md § 2).
+ */
+export class IdentityStoreUserProvider extends Construct {
+    serviceToken;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const stack = Stack.of(this);
+        const identityStoreArn = `arn:${stack.partition}:identitystore::${stack.account}:identitystore/${props.identityStoreId}`;
+        const userArnPattern = identityStoreUserArnPattern(stack.partition);
+        const handler = new SingletonFunction(this, "Handler", {
+            runtime: Runtime.NODEJS_22_X,
+            code: Code.fromAsset(LAMBDA_ASSET_DIR),
+            handler: "index.handler",
+            timeout: HANDLER_TIMEOUT_SECONDS,
+            lambdaDescription: "Fjall Identity Centre user custom-resource handler",
+            roleDescription: "Execution role for the Fjall identity-store user handler (scoped identitystore user CRUD)",
+            inlinePolicy: [
+                new PolicyStatement({
+                    actions: [
+                        "identitystore:CreateUser",
+                        "identitystore:UpdateUser",
+                        "identitystore:DeleteUser",
+                        "identitystore:GetUserId"
+                    ],
+                    resources: [identityStoreArn, userArnPattern]
+                })
+            ]
+        });
+        const provider = new Provider(this, "Provider", {
+            onEventHandler: handler
+        });
+        this.serviceToken = provider.serviceToken;
+    }
+}
+/**
+ * A declared identity-store user (fjall-managed / external-manual sources).
+ * Pre-existing users are adopted, never overwritten-by-recreate, and adopted
+ * users are never deleted on stack removal. `userId` is the CR's UserId
+ * attribute — wiring memberships to it gives them an implicit dependency on
+ * the user, so CloudFormation deletes memberships first.
+ */
+export class IdentityStoreUser extends Construct {
+    userId;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const resource = new CustomResource(this, "User", {
+            serviceToken: props.serviceToken,
+            resourceType: "Custom::FjallIdentityStoreUser",
+            properties: {
+                IdentityStoreId: props.identityStoreId,
+                Email: props.email,
+                GivenName: props.givenName,
+                FamilyName: props.familyName,
+                DisplayName: props.displayName !== undefined && props.displayName.trim() !== ""
+                    ? props.displayName
+                    : `${props.givenName} ${props.familyName}`
+            }
+        });
+        this.userId = resource.getAttString("UserId");
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.23.0",
+  "version": "2.24.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -34,7 +34,7 @@
     "clean": "rm -rf ./dist",
     "clean:node": "rm -rf ./node_modules",
     "build:cert-gen-lambda": "node lib/lambda-assets/cert-generator/src/build.mjs",
-    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs",
+    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs",
     "watch": "tsc -w",
     "watch:only": "tsc -w",
     "test": "vitest run",
@@ -50,6 +50,7 @@
   },
   "devDependencies": {
     "@aws-sdk/client-elastic-load-balancing-v2": "^3.1045.0",
+    "@aws-sdk/client-identitystore": "^3.1038.0",
     "@peculiar/x509": "2.0.0",
     "@types/aws-lambda": "^8.10.161",
     "@types/node": "^26.0.0",
@@ -63,8 +64,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.23.0",
-    "@fjall/util": "^2.23.0",
+    "@fjall/generator": "^2.24.0",
+    "@fjall/util": "^2.24.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -78,5 +79,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "dadd84e6118f03252877974eec755e812cb5b42f"
+  "gitHead": "616d7af846f0eebfa3409f5f47c98fbee836bad9"
 }