@fjall/components-infrastructure 2.23.1 → 2.25.0

package/dist/lib/patterns/aws/organisation.d.ts

@@ -1,7 +1,7 @@
 import { type Environment } from "aws-cdk-lib";
 import { type Construct } from "constructs";
 import { Account, type AccountProps } from "./account.js";
-import { type CustomPermissionSets } from "../../config/aws/identityCenter.js";
+import { type IdentityCentreConfig } from "../../config/aws/identityCentreConfig.js";
 import { ScpPreset } from "../../config/aws/scpPreset.js";
 import type { ScpPresetProps } from "../../config/aws/scpPreset.js";
 import { OrganisationResource } from "../../resources/aws/organisation/index.js";
@@ -13,7 +13,13 @@ export interface OrganisationProps extends AccountProps {
     accounts: AccountsConfig;
     orgEmail: string;
     accountIds?: Record<string, string>;
-    identityCenter?: boolean;
+    /**
+     * Identity Centre configuration: groups, permission sets, memberships and
+     * (source permitting) users, all declared in code. `false` disables the
+     * Identity Centre entirely; omitted = the three built-in permission sets
+     * with no members (inert defaults).
+     */
+    identityCentre?: IdentityCentreConfig | false;
     allowedRegions?: string[];
     env?: Required<Pick<Environment, "region" | "account">> & Partial<Omit<Environment, "region" | "account">>;
 }
@@ -59,9 +65,7 @@ export declare class Organisation extends Account {
     private createAccountReferences;
     private setupOrganisationFeatures;
     private setupCostAllocationTagActivator;
-    private setupIdentityCenter;
-    declarePermissionSets(customs: CustomPermissionSets): void;
-    assignGroupMembers(members: Record<string, string[]>): void;
+    private setupIdentityCentre;
     getOrganisation(): OrganisationResource;
     getAccounts(): Record<string, string>;
     enableScps(props: ScpPresetProps): ScpPreset;

package/dist/lib/patterns/aws/organisation.js

@@ -28,6 +28,12 @@ export class Organisation extends Account {
     accountsConfig;
     identityCenter;
     constructor(scope, id, props) {
+        // Customer synth runs infrastructure.ts through tsx, which never
+        // typechecks — a removed prop is silently ignored, so the legacy key
+        // (e.g. `identityCenter: false`) would re-enable the Identity Centre.
+        if ("identityCenter" in props) {
+            throw new Error("OrganisationProps.identityCenter has been replaced by identityCentre (IdentityCentreConfig | false). Rename the key — identityCentre: false disables the Identity Centre; omitting it keeps the built-in permission sets.");
+        }
         const config = getConfig();
         const accountId = props.accountId ?? props.env?.account ?? config.accountId;
         if (!accountId) {
@@ -88,7 +94,7 @@ export class Organisation extends Account {
             }
         }
         this.createAccountReferences(props);
-        this.setupOrganisationFeatures(props.identityCenter ?? true, managementAccountId);
+        this.setupOrganisationFeatures(props.identityCentre, managementAccountId);
     }
     /**
      * The organisation root's OIDC deploy connector is owned by the customer-run
@@ -133,8 +139,8 @@ export class Organisation extends Account {
             this.accountRefs.push(ref);
         }
     }
-    setupOrganisationFeatures(identityCenter, managementAccountId) {
-        this.setupIdentityCenter(identityCenter, managementAccountId);
+    setupOrganisationFeatures(identityCentre, managementAccountId) {
+        this.setupIdentityCentre(identityCentre, managementAccountId);
         // Home region only: Cost Explorer is a global service (single us-east-1
         // endpoint), so an org-region cascade stack would otherwise synthesise a
         // redundant daily activator Lambda per region against the same global
@@ -157,32 +163,23 @@ export class Organisation extends Account {
             appName: App.getInstance().getName()
         });
     }
-    setupIdentityCenter(identityCenter, managementAccountId) {
-        if (identityCenter) {
-            // Exclude the management account from SSO assignments — only root
-            // IAM users should have direct access to the organisation account.
-            const ssoAccounts = {};
-            for (const [name, id] of Object.entries(this.accountMap)) {
-                if (id !== managementAccountId) {
-                    ssoAccounts[name] = id;
-                }
-            }
-            this.identityCenter = new IdentityCenter(this, "IdentityCenter", {
-                accounts: ssoAccounts
-            });
-        }
-    }
-    declarePermissionSets(customs) {
-        if (this.identityCenter === undefined) {
-            throw new Error("Identity Center is not enabled. Pass identityCenter: true to OrganisationFactory.");
+    setupIdentityCentre(identityCentre, managementAccountId) {
+        if (identityCentre === false) {
+            return;
         }
-        this.identityCenter.declarePermissionSets(customs);
-    }
-    assignGroupMembers(members) {
-        if (this.identityCenter === undefined) {
-            throw new Error("Identity Center is not enabled. Pass identityCenter: true to OrganisationFactory.");
+        // Exclude the management account from default SSO assignments — a
+        // permission set reaches it only via includeManagementAccount: true.
+        const ssoAccounts = {};
+        for (const [name, id] of Object.entries(this.accountMap)) {
+            if (id !== managementAccountId) {
+                ssoAccounts[name] = id;
+            }
         }
-        this.identityCenter.assignGroupMembers(members);
+        this.identityCenter = new IdentityCenter(this, "IdentityCenter", {
+            accounts: ssoAccounts,
+            managementAccountId,
+            ...(identityCentre !== undefined && { config: identityCentre })
+        });
     }
     getOrganisation() {
         return this.org;

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -427,7 +427,7 @@ export interface EcsServiceProps {
     ssmSecretsPath?: string;
     /**
      * Dockerfile build configuration for this service. When `target` is set,
-     * the image tag suffix becomes `<service>-<target>-latest`.
+     * the content-hash image tag becomes `<service>-<target>-sha-<12 hex>`.
      * Mutually exclusive with `image` (pre-built URI).
      */
     docker?: DockerBuild;

package/dist/lib/resources/aws/database/rdsAurora.d.ts

@@ -56,6 +56,7 @@ export declare class RdsAurora extends Construct implements IConnectable {
     connections: Connections;
     private readonly constructId;
     private port;
+    private clientPort;
     private engineConfig;
     private databaseCluster;
     private databaseProxy?;

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -1,4 +1,5 @@
-import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import { Annotations, Duration, RemovalPolicy } from "aws-cdk-lib";
+import { ENGINE_DEFAULT_DATABASE_PORTS } from "@fjall/generator";
 import { Connections, Peer, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { AuroraPostgresEngineVersion, CaCertificate, ClusterInstance, Credentials, DatabaseCluster, DatabaseClusterFromSnapshot, DatabaseClusterEngine, DatabaseProxy, ParameterGroup, ProxyTarget, SnapshotCredentials } from "aws-cdk-lib/aws-rds";
 import { Construct } from "constructs";
@@ -14,6 +15,7 @@ export class RdsAurora extends Construct {
     connections;
     constructId;
     port;
+    clientPort;
     engineConfig;
     databaseCluster;
     databaseProxy;
@@ -23,10 +25,16 @@ export class RdsAurora extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.constructId = id;
-        this.port = props.port ?? RDS_DEFAULTS.DEFAULT_PORT;
         this.databaseNameValue = props.databaseName ?? id;
         // PostgreSQL fallback for direct usage - ensure engine and engineConfig match
         this.engineConfig = props.engineConfig ?? DEFAULT_POSTGRES_ENGINE_CONFIG;
+        const engineDefaultPort = ENGINE_DEFAULT_DATABASE_PORTS[this.engineConfig.family];
+        this.port = props.port ?? engineDefaultPort;
+        // RDS Proxy listens exclusively on the engine-default port (CreateDBProxy
+        // has no port parameter), so the client-facing surface must advertise it
+        // whenever a proxy fronts the cluster.
+        const proxyEnabled = props.proxy !== undefined && props.proxy !== false;
+        this.clientPort = proxyEnabled ? engineDefaultPort : this.port;
         const { piEnabled, piConfig } = resolveDatabaseInsights(props.databaseInsights);
         // Username priority: snapshotUsername > credentials.username > engine default
         const username = props.snapshotIdentifier && props.snapshotUsername
@@ -158,7 +166,6 @@ export class RdsAurora extends Construct {
             this.cfnCluster.masterUserPassword = undefined;
             this.cfnCluster.databaseName = undefined;
         }
-        const proxyEnabled = props.proxy !== undefined && props.proxy !== false;
         if (proxyEnabled) {
             this.addProxy(props, clusterSecurityGroup);
         }
@@ -214,18 +221,26 @@ export class RdsAurora extends Construct {
             });
         });
     }
-    addProxy(props, securityGroup) {
+    addProxy(props, clusterSecurityGroup) {
         if (!props.proxy)
             return;
         const proxyConfig = props.proxy;
         const vpcSubnets = proxyConfig.vpcSubnets ?? {
             subnetType: SubnetType.PRIVATE_WITH_EGRESS
         };
+        const proxySecurityGroup = new SecurityGroup(this, `${this.databaseNameValue}ProxySecurityGroup`, {
+            vpc: props.vpc,
+            description: `Security group for RDS Proxy ${this.databaseNameValue}`
+        });
+        clusterSecurityGroup.addIngressRule(proxySecurityGroup, Port.tcp(this.port), "Allow RDS Proxy to connect to Aurora cluster");
+        if (props.allowVpcAccess) {
+            proxySecurityGroup.addIngressRule(Peer.ipv4(props.vpc.vpcCidrBlock), Port.tcp(this.clientPort), "Allow access from VPC CIDR");
+        }
         this.databaseProxy = new DatabaseProxy(this, `${this.databaseNameValue}DatabaseProxy`, {
             dbProxyName: ResourceNaming.proxyName(this.constructId),
             proxyTarget: ProxyTarget.fromCluster(this.databaseCluster),
             secrets: [this.databaseCredentials.secret],
-            securityGroups: [securityGroup],
+            securityGroups: [proxySecurityGroup],
             vpc: props.vpc,
             vpcSubnets,
             requireTLS: proxyConfig.requireTLS ?? true,
@@ -235,6 +250,19 @@ export class RdsAurora extends Construct {
             maxConnectionsPercent: proxyConfig.maxConnections,
             maxIdleConnectionsPercent: proxyConfig.maxIdleConnections
         });
+        // The proxy is now the client-facing surface: grantConnect /
+        // allowDefaultPortFrom must open the PROXY security group on the proxy's
+        // fixed engine-default listener port, not the cluster SG on the DB port.
+        this.connections = new Connections({
+            securityGroups: [proxySecurityGroup],
+            defaultPort: Port.tcp(this.clientPort)
+        });
+        if (this.port !== this.clientPort) {
+            Annotations.of(this).addWarning(`Database '${this.databaseNameValue}' listens on port ${this.port}, but its ` +
+                `RDS Proxy accepts client connections only on ${this.clientPort} (the engine ` +
+                `default — AWS does not allow configuring the proxy listener port). Fjall ` +
+                `advertises ${this.clientPort}; direct-to-database access uses ${this.port}.`);
+        }
         addProxyCfnOutput(this, this.constructId, this.databaseNameValue, this.databaseProxy);
     }
     addSecretRotation(props) {
@@ -257,7 +285,7 @@ export class RdsAurora extends Construct {
         return this.databaseCluster.clusterEndpoint.hostname;
     }
     getHostPort() {
-        return String(this.port);
+        return String(this.clientPort);
     }
     getCredentials() {
         return this.databaseCredentials;

package/dist/lib/resources/aws/database/rdsAuroraGlobal.d.ts

@@ -43,7 +43,7 @@ interface RdsAuroraGlobalProps {
     monitoringInterval?: Duration;
     /** Preferred maintenance window. Default: "Sat:12:30-Sat:20:30" */
     preferredMaintenanceWindow?: string;
-    /** Database port. Default: RDS_DEFAULTS.DEFAULT_PORT */
+    /** Database port. Default: engine default (5432 postgresql / 3306 mysql) */
     port?: number;
     databaseInsights?: DatabaseInsightsConfig | false;
     deletionProtection?: boolean;

package/dist/lib/resources/aws/database/rdsDefaults.d.ts

@@ -1,7 +1,5 @@
 import { Duration } from "aws-cdk-lib";
 export declare const RDS_DEFAULTS: Readonly<{
-    /** Default database port: FJALL on phone keypad */
-    readonly DEFAULT_PORT: 35255;
     /** Saturday window in UTC — minimises weekday impact for scheduled maintenance */
     readonly PREFERRED_MAINTENANCE_WINDOW: "Sat:12:30-Sat:20:30";
     /** 1 minute — balances monitoring granularity against CloudWatch costs */

package/dist/lib/resources/aws/database/rdsDefaults.js

@@ -1,7 +1,5 @@
 import { Duration } from "aws-cdk-lib";
 export const RDS_DEFAULTS = Object.freeze({
-    /** Default database port: FJALL on phone keypad */
-    DEFAULT_PORT: 35255,
     /** Saturday window in UTC — minimises weekday impact for scheduled maintenance */
     PREFERRED_MAINTENANCE_WINDOW: "Sat:12:30-Sat:20:30",
     /** 1 minute — balances monitoring granularity against CloudWatch costs */

package/dist/lib/resources/aws/database/rdsInstance.d.ts

@@ -57,6 +57,7 @@ export declare class RdsInstance extends Construct implements IConnectable {
     databaseSecurityGroup: SecurityGroup;
     vpc: IVpc;
     private port;
+    private clientPort;
     private engineConfig;
     private databaseCredentials;
     private database;

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -1,4 +1,5 @@
-import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import { Annotations, Duration, RemovalPolicy } from "aws-cdk-lib";
+import { ENGINE_DEFAULT_DATABASE_PORTS } from "@fjall/generator";
 import { Connections, InstanceType, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { CaCertificate, Credentials, DatabaseInstance, DatabaseInstanceFromSnapshot, DatabaseInstanceEngine, DatabaseInstanceReadReplica, DatabaseProxy, ParameterGroup, PostgresEngineVersion, ProxyTarget, SnapshotCredentials, StorageType } from "aws-cdk-lib/aws-rds";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
@@ -19,6 +20,7 @@ export class RdsInstance extends Construct {
     databaseSecurityGroup;
     vpc;
     port;
+    clientPort;
     engineConfig;
     databaseCredentials;
     database;
@@ -31,11 +33,17 @@ export class RdsInstance extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.constructId = id;
-        this.port = props.port ?? RDS_DEFAULTS.DEFAULT_PORT;
         this.vpc = props.vpc;
         this.databaseNameValue = props.databaseName ?? id.replace("Rds", "");
         // PostgreSQL fallback for direct usage - ensure engine and engineConfig match
         this.engineConfig = props.engineConfig ?? DEFAULT_POSTGRES_ENGINE_CONFIG;
+        const engineDefaultPort = ENGINE_DEFAULT_DATABASE_PORTS[this.engineConfig.family];
+        this.port = props.port ?? engineDefaultPort;
+        // RDS Proxy listens exclusively on the engine-default port (CreateDBProxy
+        // has no port parameter), so the client-facing surface must advertise it
+        // whenever a proxy fronts the database.
+        const proxyEnabled = props.proxy !== undefined && props.proxy !== false;
+        this.clientPort = proxyEnabled ? engineDefaultPort : this.port;
         this.addDatabase(props);
         // Secret rotation enabled by default (opt-out with secretRotation: false)
         const secretRotationDisabled = props.credentials?.secretRotation === false;
@@ -196,6 +204,19 @@ export class RdsInstance extends Construct {
             maxConnectionsPercent: proxyConfig.maxConnections,
             maxIdleConnectionsPercent: proxyConfig.maxIdleConnections
         });
+        // The proxy is now the client-facing surface: grantConnect /
+        // allowDefaultPortFrom must open the PROXY security group on the proxy's
+        // fixed engine-default listener port, not the database SG on the DB port.
+        this.connections = new Connections({
+            securityGroups: [this.databaseProxySecurityGroup],
+            defaultPort: Port.tcp(this.clientPort)
+        });
+        if (this.port !== this.clientPort) {
+            Annotations.of(this).addWarning(`Database '${this.databaseNameValue}' listens on port ${this.port}, but its ` +
+                `RDS Proxy accepts client connections only on ${this.clientPort} (the engine ` +
+                `default — AWS does not allow configuring the proxy listener port). Fjall ` +
+                `advertises ${this.clientPort}; direct-to-database access uses ${this.port}.`);
+        }
         addProxyCfnOutput(this, this.constructId, this.databaseNameValue, this.databaseProxy);
     }
     addReadReplica(props) {
@@ -312,7 +333,7 @@ exports.handler = async (event) => {
         }
     }
     getHostPort() {
-        return String(this.port);
+        return String(this.clientPort);
     }
     getCredentials() {
         return this.databaseCredentials;

package/dist/lib/resources/aws/iam/identityCenter/index.d.ts

@@ -2,3 +2,4 @@ export * from "./assignment.js";
 export * from "./group.js";
 export * from "./groupMembership.js";
 export * from "./permissionSet.js";
+export * from "./user.js";

package/dist/lib/resources/aws/iam/identityCenter/index.js

@@ -2,3 +2,4 @@ export * from "./assignment.js";
 export * from "./group.js";
 export * from "./groupMembership.js";
 export * from "./permissionSet.js";
+export * from "./user.js";

package/dist/lib/resources/aws/iam/identityCenter/permissionSet.d.ts

@@ -1,5 +1,6 @@
 import { Construct } from "constructs";
 import { type KeyValue } from "../../../../types.js";
+import type { CustomerManagedPolicyRef, PermissionsBoundarySpec } from "../../../../config/aws/identityCentreConfig.js";
 export declare class PermissionSet extends Construct {
     private cfnPermissionSet;
     constructor(scope: Construct, id: string, props: {
@@ -7,6 +8,9 @@ export declare class PermissionSet extends Construct {
         instanceArn: string;
         description?: string;
         managedPolicies?: string[];
+        inlinePolicy?: Record<string, unknown>;
+        customerManagedPolicies?: CustomerManagedPolicyRef[];
+        permissionsBoundary?: PermissionsBoundarySpec;
         sessionDuration?: string;
         tags?: KeyValue[];
     });

package/dist/lib/resources/aws/iam/identityCenter/permissionSet.js

@@ -9,6 +9,18 @@ export class PermissionSet extends Construct {
             instanceArn: props.instanceArn,
             description: props.description,
             managedPolicies: props.managedPolicies,
+            inlinePolicy: props.inlinePolicy,
+            customerManagedPolicyReferences: props.customerManagedPolicies?.map((ref) => ({ name: ref.name, path: ref.path })),
+            permissionsBoundary: props.permissionsBoundary !== undefined
+                ? "managedPolicyArn" in props.permissionsBoundary
+                    ? { managedPolicyArn: props.permissionsBoundary.managedPolicyArn }
+                    : {
+                        customerManagedPolicyReference: {
+                            name: props.permissionsBoundary.customerManagedPolicy.name,
+                            path: props.permissionsBoundary.customerManagedPolicy.path
+                        }
+                    }
+                : undefined,
             sessionDuration: props.sessionDuration,
             tags: props.tags?.map((t) => ({ key: t.key, value: t.value }))
         });

package/dist/lib/resources/aws/iam/identityCenter/user.d.ts

@@ -0,0 +1,35 @@
+import { Construct } from "constructs";
+/** Identity-store user ARNs carry no region or account segment. */
+export declare function identityStoreUserArnPattern(partition: string): string;
+export interface IdentityStoreUserProviderProps {
+    identityStoreId: string;
+}
+/**
+ * Shared Provider-framework backend for Custom::FjallIdentityStoreUser —
+ * one handler + provider pair serves every declared user in the stack. A
+ * plain AwsCustomResource cannot express the create-or-adopt branching the
+ * handler implements (aiDocs/designs/2026-07-04-org-user-management-design.md § 2).
+ */
+export declare class IdentityStoreUserProvider extends Construct {
+    readonly serviceToken: string;
+    constructor(scope: Construct, id: string, props: IdentityStoreUserProviderProps);
+}
+export interface IdentityStoreUserProps {
+    serviceToken: string;
+    identityStoreId: string;
+    email: string;
+    givenName: string;
+    familyName: string;
+    displayName?: string;
+}
+/**
+ * A declared identity-store user (fjall-managed / external-manual sources).
+ * Pre-existing users are adopted, never overwritten-by-recreate, and adopted
+ * users are never deleted on stack removal. `userId` is the CR's UserId
+ * attribute — wiring memberships to it gives them an implicit dependency on
+ * the user, so CloudFormation deletes memberships first.
+ */
+export declare class IdentityStoreUser extends Construct {
+    readonly userId: string;
+    constructor(scope: Construct, id: string, props: IdentityStoreUserProps);
+}

package/dist/lib/resources/aws/iam/identityCenter/user.js

@@ -0,0 +1,85 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CustomResource, Stack } from "aws-cdk-lib";
+import { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
+import { Provider } from "aws-cdk-lib/custom-resources";
+import { Construct } from "constructs";
+import { SingletonFunction } from "../../compute/lambda.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/**
+ * Resolves relative to the compiled location too — the build step copies the
+ * asset directory into dist/lib/lambda-assets/identity-store-user/asset/,
+ * mirroring the source tree, so the same relative walk works post-build.
+ */
+const LAMBDA_ASSET_DIR = join(__dirname, "../../../../lambda-assets/identity-store-user/asset");
+const HANDLER_TIMEOUT_SECONDS = 120;
+/** Identity-store user ARNs carry no region or account segment. */
+export function identityStoreUserArnPattern(partition) {
+    return `arn:${partition}:identitystore:::user/*`;
+}
+/**
+ * Shared Provider-framework backend for Custom::FjallIdentityStoreUser —
+ * one handler + provider pair serves every declared user in the stack. A
+ * plain AwsCustomResource cannot express the create-or-adopt branching the
+ * handler implements (aiDocs/designs/2026-07-04-org-user-management-design.md § 2).
+ */
+export class IdentityStoreUserProvider extends Construct {
+    serviceToken;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const stack = Stack.of(this);
+        const identityStoreArn = `arn:${stack.partition}:identitystore::${stack.account}:identitystore/${props.identityStoreId}`;
+        const userArnPattern = identityStoreUserArnPattern(stack.partition);
+        const handler = new SingletonFunction(this, "Handler", {
+            runtime: Runtime.NODEJS_22_X,
+            code: Code.fromAsset(LAMBDA_ASSET_DIR),
+            handler: "index.handler",
+            timeout: HANDLER_TIMEOUT_SECONDS,
+            lambdaDescription: "Fjall Identity Centre user custom-resource handler",
+            roleDescription: "Execution role for the Fjall identity-store user handler (scoped identitystore user CRUD)",
+            inlinePolicy: [
+                new PolicyStatement({
+                    actions: [
+                        "identitystore:CreateUser",
+                        "identitystore:UpdateUser",
+                        "identitystore:DeleteUser",
+                        "identitystore:GetUserId"
+                    ],
+                    resources: [identityStoreArn, userArnPattern]
+                })
+            ]
+        });
+        const provider = new Provider(this, "Provider", {
+            onEventHandler: handler
+        });
+        this.serviceToken = provider.serviceToken;
+    }
+}
+/**
+ * A declared identity-store user (fjall-managed / external-manual sources).
+ * Pre-existing users are adopted, never overwritten-by-recreate, and adopted
+ * users are never deleted on stack removal. `userId` is the CR's UserId
+ * attribute — wiring memberships to it gives them an implicit dependency on
+ * the user, so CloudFormation deletes memberships first.
+ */
+export class IdentityStoreUser extends Construct {
+    userId;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const resource = new CustomResource(this, "User", {
+            serviceToken: props.serviceToken,
+            resourceType: "Custom::FjallIdentityStoreUser",
+            properties: {
+                IdentityStoreId: props.identityStoreId,
+                Email: props.email,
+                GivenName: props.givenName,
+                FamilyName: props.familyName,
+                DisplayName: props.displayName !== undefined && props.displayName.trim() !== ""
+                    ? props.displayName
+                    : `${props.givenName} ${props.familyName}`
+            }
+        });
+        this.userId = resource.getAttString("UserId");
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.23.1",
+  "version": "2.25.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -34,7 +34,7 @@
     "clean": "rm -rf ./dist",
     "clean:node": "rm -rf ./node_modules",
     "build:cert-gen-lambda": "node lib/lambda-assets/cert-generator/src/build.mjs",
-    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs",
+    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs",
     "watch": "tsc -w",
     "watch:only": "tsc -w",
     "test": "vitest run",
@@ -50,6 +50,7 @@
   },
   "devDependencies": {
     "@aws-sdk/client-elastic-load-balancing-v2": "^3.1045.0",
+    "@aws-sdk/client-identitystore": "^3.1038.0",
     "@peculiar/x509": "2.0.0",
     "@types/aws-lambda": "^8.10.161",
     "@types/node": "^26.0.0",
@@ -63,8 +64,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.23.1",
-    "@fjall/util": "^2.23.1",
+    "@fjall/generator": "^2.25.0",
+    "@fjall/util": "^2.25.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -78,5 +79,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "749133c6c5cfe24a09a401869f2193c7d177a324"
+  "gitHead": "7c1a329184064aefa557c2c09de0965c4f8cd4fb"
 }