@fjall/components-infrastructure 2.25.0 → 2.27.0

package/dist/lib/app.js

@@ -1,5 +1,6 @@
 import { App as CdkApp, Aspects, Tags } from "aws-cdk-lib";
 import { maskSensitiveOutput } from "@fjall/util";
+import { RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS } from "aws-cdk-lib/cx-api";
 import { Vpc } from "./resources/aws/networking/vpc.js";
 import { createBastion } from "./patterns/aws/bastionFactory.js";
 import { AwsStack } from "./resources/index.js";
@@ -44,7 +45,12 @@ export class App extends CdkApp {
     resourceInventory;
     manifestCollector;
     constructor(name, options) {
-        super();
+        // Without this flag DatabaseClusterFromSnapshot renders a second, orphaned
+        // credentials secret alongside snapshotCredentials. Constructor context has
+        // the lowest precedence, so an app's cdk.json can still override it.
+        super({
+            context: { [RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS]: true }
+        });
         App.instance = this;
         this.name = name ?? "FjallApp";
         this.stackPrefix = toPascalCase(this.name);
@@ -118,6 +124,10 @@ export class App extends CdkApp {
                 App.instance.stackPrefix = toPascalCase(name);
                 // Reinitialise standard tags with the new name
                 App.instance.initialiseStandardTags();
+                // Rename the collector in place, or the manifest's top-level appName
+                // keeps the constructor-time name ("FjallApp" when getConfig() ran
+                // before getApp()). In-place rename preserves collected services.
+                App.instance.manifestCollector.setAppName(name);
             }
             // If options provided but network not yet initialised, initialise it now
             if (options?.network === false) {

package/dist/lib/config/aws/accountMonitoringRole.js

@@ -39,6 +39,7 @@ export class AccountMonitoringRole extends Construct {
             actions: [
                 "ecs:DescribeServices",
                 "ecs:DescribeTasks",
+                "ecs:DescribeTaskDefinition",
                 "ecs:ListTasks",
                 "ecs:DescribeClusters",
                 "ecs:ListServices"

package/dist/lib/config/aws/oidcConnector.d.ts

@@ -10,6 +10,15 @@ export interface OidcConnectorProps {
      * Absent ⇒ no boundary (today's behaviour — backward-compatible).
      */
     securityTier?: GovernancePreset;
+    /**
+     * Workload STAGE of the connected account (the wire `environment` value —
+     * never the account TIER axis). When `"development"`, the connector
+     * additionally provisions the dev-tier surface (fast-dev-environments plan
+     * §4.2 G3): the `FjallDevDeploy`/`FjallDevProvisioner`/`FjallDevSyncWriter`
+     * roles and the `FjallDevBoundary` permissions boundary. Absent or any
+     * other stage ⇒ deploy role only.
+     */
+    accountStage?: string;
 }
 export declare class OidcConnector extends Construct {
     readonly deployRoleArn: string;

package/dist/lib/config/aws/oidcConnector.js

@@ -1,5 +1,5 @@
-import { SECURITY_TIER_TO_BOUNDARY, deployBoundaryName } from "@fjall/generator";
-import { CfnOutput, Duration } from "aws-cdk-lib";
+import { DEV_BOUNDARY_POLICY_NAME, DEV_DEPLOY_POLICY_NAME, DEV_PROVISIONER_POLICY_NAME, DEV_SYNC_WRITER_POLICY_NAME, SECURITY_TIER_TO_BOUNDARY, buildDevBoundaryStatements, buildDevDeployPolicyStatements, buildDevDeployTrustStatements, buildDevProvisionerPolicyStatements, buildDevProvisionerTrustStatements, buildDevSyncWriterPolicyStatements, buildDevSyncWriterTrustStatements, buildNarrowedDeployTrustStatements, deployBoundaryName, devDeployRoleName, devProvisionerRoleName, devSyncWriterRoleName } from "@fjall/generator";
+import { CfnOutput, Duration, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { Construct } from "constructs";
@@ -52,6 +52,21 @@ exports.handler = async (event) => {
   }
   return { PhysicalResourceId: arn, Data: { ProviderArn: arn } };
 };`;
+/**
+ * Renders an SSoT trust document verbatim onto a role via the L1 escape
+ * hatch. An L2 `FederatedPrincipal` can express only ONE trust statement, but
+ * the G4 narrowed trust is a condition SPLIT (each condition class its own
+ * Allow statement — conditions inside one statement AND together), and the
+ * three-rendering parity fixture compares the rendered document against the
+ * `@fjall/generator` SSoT byte-for-byte.
+ */
+function applyTrustDocument(role, statements) {
+    const cfnRole = role.node.defaultChild;
+    cfnRole.assumeRolePolicyDocument = {
+        Version: "2012-10-17",
+        Statement: statements
+    };
+}
 export class OidcConnector extends Construct {
     deployRoleArn;
     constructor(scope, id, props) {
@@ -92,16 +107,18 @@ export class OidcConnector extends Construct {
                 statements: SECURITY_TIER_TO_BOUNDARY[props.securityTier].map((statement) => iam.PolicyStatement.fromJson(statement))
             })
             : undefined;
+        const trustParams = {
+            fjallOrgId: props.fjallOrgId,
+            providerArn,
+            issuerDomain
+        };
         const deployRole = new Role(this, "DeployRole", {
             roleName: `FjallDeploy${props.fjallOrgId}`,
             path: "/fjall/",
             maxSessionDuration: Duration.hours(1),
-            assumedBy: new iam.FederatedPrincipal(providerArn, {
-                StringEquals: { [`${issuerDomain}:aud`]: "sts.amazonaws.com" },
-                StringLike: {
-                    [`${issuerDomain}:sub`]: `org:${props.fjallOrgId}:*`
-                }
-            }, "sts:AssumeRoleWithWebIdentity"),
+            // Placeholder — applyTrustDocument below replaces the whole rendered
+            // AssumeRolePolicyDocument with the SSoT's G4 condition split.
+            assumedBy: new iam.FederatedPrincipal(providerArn, {}, "sts:AssumeRoleWithWebIdentity"),
             managedPolicies: [
                 iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess")
             ],
@@ -109,7 +126,53 @@ export class OidcConnector extends Construct {
                 permissionsBoundary: deployBoundary
             })
         });
+        applyTrustDocument(deployRole, buildNarrowedDeployTrustStatements(trustParams));
         this.deployRoleArn = deployRole.roleArn;
+        // G3 dev-tier surface — development-STAGE accounts only. Every document
+        // comes verbatim from the @fjall/generator SSoT (three-rendering parity
+        // with the Quick-Create yaml's IsDevelopmentStage-conditional resources
+        // and the webapp dev-gate-remediate pass).
+        if (props.accountStage === "development") {
+            const accountId = Stack.of(this).account;
+            new ManagedPolicy(this, "DevBoundary", {
+                managedPolicyName: DEV_BOUNDARY_POLICY_NAME,
+                description: "Fjall dev-tier permissions boundary — ceiling for the per-slot task roles the dev provisioner creates",
+                statements: buildDevBoundaryStatements({ accountId }).map((statement) => iam.PolicyStatement.fromJson(statement))
+            });
+            const devDeployRole = new Role(this, "DevDeployRole", {
+                roleName: devDeployRoleName(props.fjallOrgId),
+                assumedBy: new iam.FederatedPrincipal(providerArn, {}, "sts:AssumeRoleWithWebIdentity"),
+                inlinePolicies: {
+                    [DEV_DEPLOY_POLICY_NAME]: iam.PolicyDocument.fromJson({
+                        Version: "2012-10-17",
+                        Statement: buildDevDeployPolicyStatements({ accountId })
+                    })
+                }
+            });
+            applyTrustDocument(devDeployRole, buildDevDeployTrustStatements({ ...trustParams, accountId }));
+            const devProvisionerRole = new Role(this, "DevProvisionerRole", {
+                roleName: devProvisionerRoleName(props.fjallOrgId),
+                assumedBy: new iam.FederatedPrincipal(providerArn, {}, "sts:AssumeRoleWithWebIdentity"),
+                inlinePolicies: {
+                    [DEV_PROVISIONER_POLICY_NAME]: iam.PolicyDocument.fromJson({
+                        Version: "2012-10-17",
+                        Statement: buildDevProvisionerPolicyStatements({ accountId })
+                    })
+                }
+            });
+            applyTrustDocument(devProvisionerRole, buildDevProvisionerTrustStatements(trustParams));
+            const devSyncWriterRole = new Role(this, "DevSyncWriterRole", {
+                roleName: devSyncWriterRoleName(props.fjallOrgId),
+                assumedBy: new iam.FederatedPrincipal(providerArn, {}, "sts:AssumeRoleWithWebIdentity"),
+                inlinePolicies: {
+                    [DEV_SYNC_WRITER_POLICY_NAME]: iam.PolicyDocument.fromJson({
+                        Version: "2012-10-17",
+                        Statement: buildDevSyncWriterPolicyStatements({ accountId })
+                    })
+                }
+            });
+            applyTrustDocument(devSyncWriterRole, buildDevSyncWriterTrustStatements(trustParams));
+        }
         new CfnOutput(this, "OidcDeployRoleArn", {
             key: "OidcDeployRoleArn",
             value: deployRole.roleArn,

package/dist/lib/config/aws/scpPreset.d.ts

@@ -19,3 +19,17 @@ export declare class ScpPreset extends Construct {
     private createRootScps;
     private createHardenedScps;
 }
+export interface DevIsolationScpProps {
+    developmentOuId: string;
+}
+/**
+ * The dev-gate SCP backstop (fast dev-environments G6): denies organisation
+ * management and cross-account role assumption from every account in the
+ * development OU, independent of the ScpPreset security level — foundation
+ * orgs get it too. Attached automatically by the Organisation pattern when
+ * the deploy engine threads the development OU id via CDK context
+ * (CDK_CONTEXT_KEYS.DEV_OU_ID); never instantiated from customer templates.
+ */
+export declare class DevIsolationScp extends Construct {
+    constructor(scope: Construct, id: string, props: DevIsolationScpProps);
+}

package/dist/lib/config/aws/scpPreset.js

@@ -268,6 +268,59 @@ function buildCostControls() {
         ]
     };
 }
+function buildDevIsolationGuardrails() {
+    return {
+        Version: IAM_POLICY_VERSION,
+        Statement: [
+            {
+                Sid: "DenyOrganisationsManagement",
+                Effect: "Deny",
+                // Every mutating organizations: verb; Describe*/List* stay allowed so
+                // read-only org probes (e.g. DescribeOrganization from in-account
+                // tooling) keep working.
+                Action: [
+                    "organizations:Accept*",
+                    "organizations:Attach*",
+                    "organizations:Cancel*",
+                    "organizations:Close*",
+                    "organizations:Create*",
+                    "organizations:Decline*",
+                    "organizations:Delete*",
+                    "organizations:Deregister*",
+                    "organizations:Detach*",
+                    "organizations:Disable*",
+                    "organizations:Enable*",
+                    "organizations:Invite*",
+                    "organizations:Leave*",
+                    "organizations:Move*",
+                    "organizations:Put*",
+                    "organizations:Register*",
+                    "organizations:Remove*",
+                    "organizations:Tag*",
+                    "organizations:Untag*",
+                    "organizations:Update*"
+                ],
+                Resource: "*",
+                Condition: automationExemption()
+            },
+            {
+                Sid: "DenyCrossAccountAssumeRole",
+                Effect: "Deny",
+                Action: ["sts:AssumeRole", "sts:AssumeRoot"],
+                Resource: "*",
+                Condition: {
+                    StringNotEquals: {
+                        // IAM policy variable, substituted per-request by AWS — the
+                        // resource-perimeter pattern: deny assumption of any role whose
+                        // account differs from the calling principal's own.
+                        "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                    },
+                    ...automationExemption()
+                }
+            }
+        ]
+    };
+}
 function validateByteLimit(name, policy) {
     const json = JSON.stringify(policy);
     const byteLength = Buffer.byteLength(json, "utf-8");
@@ -335,3 +388,25 @@ export class ScpPreset extends Construct {
         }
     }
 }
+/**
+ * The dev-gate SCP backstop (fast dev-environments G6): denies organisation
+ * management and cross-account role assumption from every account in the
+ * development OU, independent of the ScpPreset security level — foundation
+ * orgs get it too. Attached automatically by the Organisation pattern when
+ * the deploy engine threads the development OU id via CDK context
+ * (CDK_CONTEXT_KEYS.DEV_OU_ID); never instantiated from customer templates.
+ */
+export class DevIsolationScp extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const policy = buildDevIsolationGuardrails();
+        validateByteLimit("DevIsolation", policy);
+        new OrganisationPolicy(this, "DevIsolation", {
+            name: "fjall-dev-isolation",
+            policyType: SCP_POLICY_TYPE,
+            content: policy,
+            description: "Denies organisation management and cross-account role assumption from development accounts",
+            targetIds: [props.developmentOuId]
+        });
+    }
+}

package/dist/lib/patterns/aws/account.js

@@ -61,12 +61,14 @@ export class Account extends Stack {
         // collide across regions, so they are created only in the home region.
         const accountGlobalsConfigured = this.node.tryGetContext("fjallAccountGlobalsConfigured") === "true";
         this.accountGlobalsConfigured = accountGlobalsConfigured;
+        const environment = config.environment ?? "unknown";
         if (this.receivesDeployRole() &&
             fjallOrgId &&
             !oidcAlreadyConfigured &&
             !accountGlobalsConfigured) {
             new OidcConnector(this, "OidcConnector", {
                 fjallOrgId,
+                accountStage: environment,
                 ...(props.securityTier !== undefined && {
                     securityTier: props.securityTier
                 })
@@ -78,7 +80,6 @@ export class Account extends Stack {
         if (fjallOrgId && !accountGlobalsConfigured) {
             new AccountAuditRole(this, "AuditRole", { fjallOrgId });
         }
-        const environment = config.environment ?? "unknown";
         // The trail is multi-region, so a non-home-region cascade stack creating
         // its own copy records every management event a second time — CloudTrail
         // bills additional copies at $2.00/100k events. Home region only, like

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -292,10 +292,10 @@ export class ClickHouseDatabase extends Construct {
         const dataAz = Stack.of(this).availabilityZones[0];
         const clickHouseHost = this.getHostEndpoint();
         const backupDestUrl = `https://${backupBucket.bucketName}.s3.${Stack.of(this).region}.amazonaws.com/backup/`;
-        const optimiseQuery = [
+        const optimiseStatements = [
             ...REPLACING_MERGE_TREE_TABLES.map((table) => `OPTIMIZE TABLE ${CLICKHOUSE_DATABASE_NAME}.${table} FINAL`),
             ...OPTIMISE_MV_TABLES.map((table) => `OPTIMIZE TABLE ${CLICKHOUSE_DATABASE_NAME}.${table}`)
-        ].join("; ");
+        ];
         const adminSecret = expectDefined(userSecrets.get(schemaAdmin.name), `schemaAdmin '${schemaAdmin.name}' secret not minted.`);
         const sidecarTlsPreamble = tlsActive
             ? `set -eu && printf '%s\\n' "$CLICKHOUSE_CA_CERT" > /tmp/ca.crt && printf '%s' '<?xml version="1.0"?><config><openSSL><client><caConfig>/tmp/ca.crt</caConfig><verificationMode>strict</verificationMode><loadDefaultCAFile>false</loadDefaultCAFile><invalidCertificateHandler><name>RejectCertificateHandler</name></invalidCertificateHandler></client></openSSL></config>' > /tmp/clickhouse-client.xml && `
@@ -306,6 +306,17 @@ export class ClickHouseDatabase extends Construct {
         const sidecarTlsSecrets = tlsActive && tlsCaSecret !== undefined
             ? { CLICKHOUSE_CA_CERT: EcsSecret.fromSecretsManager(tlsCaSecret) }
             : {};
+        // One clickhouse-client invocation per statement: a single multi-statement
+        // --query aborts on the first failure, so one missing table (a migration
+        // deploy-order window, or a dropped table lingering in the constants)
+        // would permanently skip every optimise after it. Failures are logged and
+        // the task still exits non-zero so they stay visible in the task history.
+        const optimiseClient = `clickhouse-client --host ${clickHouseHost} --port ${nativePort} --user ${schemaAdmin.name}${sidecarTlsClientArgs}`;
+        const optimiseScript = [
+            "FAILED=0",
+            ...optimiseStatements.map((stmt) => `${optimiseClient} --query "${stmt}" || { echo "optimise failed: ${stmt}"; FAILED=1; }`),
+            'exit "$FAILED"'
+        ].join("; ");
         const scheduledTasks = [];
         if (optimiseEnabled) {
             scheduledTasks.push({
@@ -314,11 +325,7 @@ export class ClickHouseDatabase extends Construct {
                 image: ContainerImage.fromRegistry(CLICKHOUSE_IMAGE),
                 cpu: OPTIMISE_TASK_CPU_UNITS,
                 memoryLimitMiB: OPTIMISE_TASK_MEMORY_MIB,
-                command: [
-                    "sh",
-                    "-c",
-                    `${sidecarTlsPreamble}clickhouse-client --host ${clickHouseHost} --port ${nativePort} --user ${schemaAdmin.name}${sidecarTlsClientArgs} --query "${optimiseQuery};"`
-                ],
+                command: ["sh", "-c", `${sidecarTlsPreamble}${optimiseScript}`],
                 secrets: {
                     CLICKHOUSE_PASSWORD: EcsSecret.fromSecretsManager(adminSecret.secret, "password"),
                     ...sidecarTlsSecrets

package/dist/lib/patterns/aws/organisation.d.ts

@@ -41,6 +41,15 @@ export declare class Organisation extends Account {
     private accountsConfig;
     private identityCenter?;
     constructor(scope: Construct, id: string, props: OrganisationProps);
+    /**
+     * Dev-gate SCP backstop (G6): attached whenever the deploy engine resolves a
+     * development OU and threads its id via context — independent of enableScps,
+     * so foundation-security orgs are covered too. Context absent (no dev OU, or
+     * a pre-G6 engine) synthesises nothing; a later synth without the context
+     * removes a previously attached policy, which is consistent — no dev OU
+     * means no development accounts left to isolate.
+     */
+    private setupDevIsolationScp;
     /**
      * The organisation root's OIDC deploy connector is owned by the customer-run
      * Quick-Create CloudFormation stack, never the inherited Account connector.

package/dist/lib/patterns/aws/organisation.js

@@ -3,7 +3,7 @@ import { Account } from "./account.js";
 import { IdentityCenter } from "../../config/aws/identityCenter.js";
 import { ManagementEventsTrail } from "../../config/aws/cloudTrail.js";
 import { OrganisationTrail } from "../../config/aws/organisationTrail.js";
-import { ScpPreset } from "../../config/aws/scpPreset.js";
+import { DevIsolationScp, ScpPreset } from "../../config/aws/scpPreset.js";
 import { OrganisationResource, OrganisationAccount, CostAllocationTagActivator } from "../../resources/aws/organisation/index.js";
 import { Schedule } from "../../resources/aws/messaging/schedule.js";
 import { stripAndCamelCase } from "../../utils/stripAndCamelCase.js";
@@ -95,6 +95,26 @@ export class Organisation extends Account {
         }
         this.createAccountReferences(props);
         this.setupOrganisationFeatures(props.identityCentre, managementAccountId);
+        this.setupDevIsolationScp();
+    }
+    /**
+     * Dev-gate SCP backstop (G6): attached whenever the deploy engine resolves a
+     * development OU and threads its id via context — independent of enableScps,
+     * so foundation-security orgs are covered too. Context absent (no dev OU, or
+     * a pre-G6 engine) synthesises nothing; a later synth without the context
+     * removes a previously attached policy, which is consistent — no dev OU
+     * means no development accounts left to isolate.
+     */
+    setupDevIsolationScp() {
+        const devOuIdCtx = this.node.tryGetContext(CDK_CONTEXT_KEYS.DEV_OU_ID);
+        const devOuId = typeof devOuIdCtx === "string" && devOuIdCtx !== ""
+            ? devOuIdCtx
+            : undefined;
+        if (devOuId !== undefined) {
+            new DevIsolationScp(this, "DevIsolationScp", {
+                developmentOuId: devOuId
+            });
+        }
     }
     /**
      * The organisation root's OIDC deploy connector is owned by the customer-run

package/dist/lib/resources/aws/compute/ecsRoles.js

@@ -24,16 +24,12 @@ export function createExecutionRole(ctx, serviceName) {
         resources: ["*"]
     }));
     const { partition, region, account } = Stack.of(ctx.scope);
-    const logGroupArn = `arn:${partition}:logs:${region}:${account}:log-group:/ecs/${ctx.props.clusterName}*`;
-    executionRole.addToPolicy(new PolicyStatement({
-        effect: Effect.ALLOW,
-        actions: [
-            "logs:CreateLogStream",
-            "logs:PutLogEvents",
-            "logs:CreateLogGroup"
-        ],
-        resources: [logGroupArn, `${logGroupArn}:*`]
-    }));
+    // Gotcha: no manual logs grant here. The task definition's AwsLogDriver
+    // binds an explicit LogGroup construct (CFN auto-named — there is NO
+    // `/ecs/{cluster}/...` group; that shape is only the stream prefix), and
+    // `AwsLogDriver.bind()` auto-grants CreateLogStream/PutLogEvents on the
+    // real group's ARN. A hand-rolled `/ecs/{cluster}*` statement grants
+    // access to log groups that do not exist.
     // Gotcha: do NOT add a manual `secretsImport` grant here. `addContainer({ secrets })`
     // auto-grants `secret.grantRead(executionRole)` on the resolved complete ARN (exact, no
     // wildcard). A manual bare/`-*` statement is the 2026-06-04 outage shape and is dead.

package/dist/lib/resources/aws/database/clickhouseConstants.d.ts

@@ -150,7 +150,7 @@ export declare const OPTIMISE_FINAL_SCHEDULE = "rate(6 hours)";
 /** Tables requiring periodic OPTIMIZE FINAL (ReplacingMergeTree only).
  *  Keep in sync with REPLACING_MERGE_TREE_TABLES in
  *  webapp/app/.server/lib/clickhouse/tenantQuery/tableConstants.ts (auto-FINAL). */
-export declare const REPLACING_MERGE_TREE_TABLES: readonly ["application_metrics", "cost_records", "log_fingerprints", "insights", "asset_inventory"];
+export declare const REPLACING_MERGE_TREE_TABLES: readonly ["application_metrics", "cost_records", "log_events", "log_fingerprints", "insights", "asset_inventory"];
 /** Subdirectory on the EBS volume for server config files (must match CDK volume mount). */
 export declare const CLICKHOUSE_CONFIG_SUBDIR = "server-config.d";
 /** Subdirectory on the EBS volume for users config files (must match CDK volume mount). */
@@ -166,8 +166,12 @@ export declare const CLICKHOUSE_CLOUDMAP_SERVICE_NAME = "clickhouse";
 export declare const CLICKHOUSE_SERVER_CONTAINER_NAME = "clickhouse";
 /** Materialised views that benefit from periodic OPTIMIZE to reduce part count at read time.
  *  These are not ReplacingMergeTree (no dedup needed) but un-merged parts force
- *  read-time aggregation which degrades query performance. */
-export declare const OPTIMISE_MV_TABLES: readonly ["metrics_hourly_mv", "metrics_daily_mv", "response_time_quantiles_hourly_mv", "deployment_duration_quantiles_daily_mv", "log_severity_hourly_mv", "compliance_score_daily_mv", "ai_usage_daily_mv", "finding_daily_aggregate", "insight_pattern_dismissals"];
+ *  read-time aggregation which degrades query performance.
+ *
+ *  Coupled with webapp/clickhouse-init: every name here must exist in the live
+ *  schema. A migration that DROPs a table must remove it here in the same
+ *  change (log_severity_hourly_mv was dropped by 012-log-events-dedup.sql). */
+export declare const OPTIMISE_MV_TABLES: readonly ["metrics_hourly_mv", "metrics_daily_mv", "response_time_quantiles_hourly_mv", "deployment_duration_quantiles_daily_mv", "compliance_score_daily_mv", "ai_usage_daily_mv", "finding_daily_aggregate", "insight_pattern_dismissals"];
 /** Resource allocation for the lightweight optimise task. */
 export declare const OPTIMISE_TASK_MEMORY_MIB = 256;
 export declare const OPTIMISE_TASK_CPU_UNITS = 256;

package/dist/lib/resources/aws/database/clickhouseConstants.js

@@ -159,6 +159,7 @@ export const OPTIMISE_FINAL_SCHEDULE = "rate(6 hours)";
 export const REPLACING_MERGE_TREE_TABLES = [
     "application_metrics",
     "cost_records",
+    "log_events",
     "log_fingerprints",
     "insights",
     "asset_inventory"
@@ -178,13 +179,16 @@ export const CLICKHOUSE_CLOUDMAP_SERVICE_NAME = "clickhouse";
 export const CLICKHOUSE_SERVER_CONTAINER_NAME = "clickhouse";
 /** Materialised views that benefit from periodic OPTIMIZE to reduce part count at read time.
  *  These are not ReplacingMergeTree (no dedup needed) but un-merged parts force
- *  read-time aggregation which degrades query performance. */
+ *  read-time aggregation which degrades query performance.
+ *
+ *  Coupled with webapp/clickhouse-init: every name here must exist in the live
+ *  schema. A migration that DROPs a table must remove it here in the same
+ *  change (log_severity_hourly_mv was dropped by 012-log-events-dedup.sql). */
 export const OPTIMISE_MV_TABLES = [
     "metrics_hourly_mv",
     "metrics_daily_mv",
     "response_time_quantiles_hourly_mv",
     "deployment_duration_quantiles_daily_mv",
-    "log_severity_hourly_mv",
     "compliance_score_daily_mv",
     "ai_usage_daily_mv",
     "finding_daily_aggregate",

package/dist/lib/resources/aws/database/rdsAurora.d.ts

@@ -28,7 +28,12 @@ interface RdsProps {
     deletionProtection?: boolean;
     /** ARN or identifier of DB cluster snapshot to restore from */
     snapshotIdentifier?: string;
-    /** Username from the snapshot (required when restoring from snapshot to reset password) */
+    /**
+     * Master username of the snapshot being restored. Must match the snapshot's
+     * actual master user — the post-restore password reset applies to that user
+     * and the new credentials secret bakes this name in. When omitted, falls
+     * back to credentials.username or the engine default and synth warns.
+     */
     snapshotUsername?: string;
     /** Allow access from VPC CIDR (avoids cross-stack cyclic dependencies with Lambda) */
     allowVpcAccess?: boolean;

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -10,7 +10,8 @@ import { addProxyCfnOutput } from "./rdsProxyOutput.js";
 import { getDatabaseInsightsRetention } from "./index.js";
 import { RDS_DEFAULTS } from "./rdsDefaults.js";
 import { createRdsAlarms } from "../monitoring/index.js";
-import { DEFAULT_POSTGRES_ENGINE_CONFIG, resolveDatabaseInsights, resolveStorageEncryptionKey, resolvePerformanceInsightsKey, addMultiUserSecretRotation } from "./rdsHelpers.js";
+import { DEFAULT_POSTGRES_ENGINE_CONFIG, resolveDatabaseInsights, resolveStorageEncryptionKey, resolvePerformanceInsightsKey, addMultiUserSecretRotation, warnIfSnapshotUsernameAssumed } from "./rdsHelpers.js";
+import { resolveSecretRotation } from "../../../utils/databaseTypes.js";
 export class RdsAurora extends Construct {
     connections;
     constructId;
@@ -48,6 +49,13 @@ export class RdsAurora extends Construct {
             });
         }
         else {
+            warnIfSnapshotUsernameAssumed({
+                scope: this,
+                databaseName: this.databaseNameValue,
+                snapshotIdentifier: props.snapshotIdentifier,
+                snapshotUsername: props.snapshotUsername,
+                assumedUsername: username
+            });
             this.databaseCredentials = new Secret(this, `${this.databaseNameValue}Credentials`, {
                 secretName: ResourceNaming.credentialsSecretName(id),
                 generateSecretString: {
@@ -169,12 +177,11 @@ export class RdsAurora extends Construct {
         if (proxyEnabled) {
             this.addProxy(props, clusterSecurityGroup);
         }
-        // Secret rotation enabled by default (opt-out with secretRotation: false)
-        if (!props.isGlobalSecondary) {
-            const secretRotationDisabled = props.credentials?.secretRotation === false;
-            if (!secretRotationDisabled) {
-                this.addSecretRotation(props);
-            }
+        // The wired multi-user rotation cannot complete until the master secret is
+        // populated with valid superuser credentials — see addMultiUserSecretRotation.
+        const rotationConfig = resolveSecretRotation(props.credentials);
+        if (!props.isGlobalSecondary && rotationConfig !== undefined) {
+            this.addSecretRotation(rotationConfig);
         }
         if (props.alertsTopic && props.alarms !== false) {
             createRdsAlarms({
@@ -265,13 +272,13 @@ export class RdsAurora extends Construct {
         }
         addProxyCfnOutput(this, this.constructId, this.databaseNameValue, this.databaseProxy);
     }
-    addSecretRotation(props) {
+    addSecretRotation(rotationConfig) {
         addMultiUserSecretRotation({
             scope: this,
             databaseName: this.databaseNameValue,
             constructId: this.constructId,
             engineConfig: this.engineConfig,
-            credentialsConfig: props.credentials,
+            rotationConfig,
             databaseSecret: this.databaseCredentials.secret,
             target: this.databaseCluster,
             vpc: this.databaseCluster.vpc

package/dist/lib/resources/aws/database/rdsHelpers.d.ts

@@ -3,7 +3,7 @@ import { type IVpc, type IConnectable } from "aws-cdk-lib/aws-ec2";
 import { type ISecret } from "aws-cdk-lib/aws-secretsmanager";
 import type { Construct } from "constructs";
 import { Secret } from "../secrets/index.js";
-import { type DatabaseInsightsConfig, type EngineConfig, type EncryptionKeySpec, type CredentialsConfig } from "../../../utils/databaseTypes.js";
+import { type DatabaseInsightsConfig, type EngineConfig, type EncryptionKeySpec, type SecretRotationConfig } from "../../../utils/databaseTypes.js";
 /** Default PostgreSQL engine configuration used by both Aurora and Instance constructs. */
 export declare const DEFAULT_POSTGRES_ENGINE_CONFIG: EngineConfig;
 /**
@@ -23,16 +23,37 @@ export declare function resolveDatabaseInsights(databaseInsights: DatabaseInsigh
     piEnabled: boolean;
     piConfig: DatabaseInsightsConfig | undefined;
 };
+/**
+ * Warn when a snapshot restore bakes an assumed username into the new
+ * credentials secret. The post-restore password reset applies to the
+ * snapshot's ACTUAL master user, so if that user differs from the assumed
+ * username the secret pairs a valid password with the wrong user — synth and
+ * deploy stay green while every consumer fails at connect time.
+ * Shared between RdsAurora and RdsInstance.
+ */
+export declare function warnIfSnapshotUsernameAssumed(params: {
+    scope: Construct;
+    databaseName: string;
+    snapshotIdentifier: string | undefined;
+    snapshotUsername: string | undefined;
+    assumedUsername: string;
+}): void;
 /**
  * Add multi-user secret rotation to a database construct.
  * Shared between RdsAurora and RdsInstance.
+ *
+ * The master secret is created empty (a generated string bound to no database
+ * user), so rotation attempts fail at the master-secret read until it is
+ * populated with valid superuser credentials as JSON
+ * (`{"username": ..., "password": ...}` plus connection keys). A synth-time
+ * warning surfaces this to anyone opting in.
  */
 export declare function addMultiUserSecretRotation(params: {
     scope: Construct;
     databaseName: string;
     constructId: string;
     engineConfig: EngineConfig;
-    credentialsConfig: CredentialsConfig | undefined;
+    rotationConfig: SecretRotationConfig;
     databaseSecret: ISecret;
     target: IConnectable;
     vpc: IVpc;

package/dist/lib/resources/aws/database/rdsHelpers.js

@@ -1,4 +1,4 @@
-import { Duration } from "aws-cdk-lib";
+import { Annotations, Duration } from "aws-cdk-lib";
 import { SecretRotation, SecretRotationApplication } from "aws-cdk-lib/aws-secretsmanager";
 import { CustomerManagedKey, Secret } from "../secrets/index.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
@@ -57,18 +57,36 @@ export function resolveDatabaseInsights(databaseInsights) {
         : undefined;
     return { piEnabled, piConfig };
 }
+/**
+ * Warn when a snapshot restore bakes an assumed username into the new
+ * credentials secret. The post-restore password reset applies to the
+ * snapshot's ACTUAL master user, so if that user differs from the assumed
+ * username the secret pairs a valid password with the wrong user — synth and
+ * deploy stay green while every consumer fails at connect time.
+ * Shared between RdsAurora and RdsInstance.
+ */
+export function warnIfSnapshotUsernameAssumed(params) {
+    if (!params.snapshotIdentifier || params.snapshotUsername) {
+        return;
+    }
+    Annotations.of(params.scope).addWarningV2("@fjall/components-infrastructure:rdsSnapshotUsernameAssumed", `Restoring '${params.databaseName}' from snapshot without snapshotUsername — the credentials secret assumes username '${params.assumedUsername}'. The post-restore password reset targets the snapshot's actual master user; if that is not '${params.assumedUsername}', applications reading the secret will fail to authenticate. Set snapshotUsername to the snapshot's master username.`);
+}
 /**
  * Add multi-user secret rotation to a database construct.
  * Shared between RdsAurora and RdsInstance.
+ *
+ * The master secret is created empty (a generated string bound to no database
+ * user), so rotation attempts fail at the master-secret read until it is
+ * populated with valid superuser credentials as JSON
+ * (`{"username": ..., "password": ...}` plus connection keys). A synth-time
+ * warning surfaces this to anyone opting in.
  */
 export function addMultiUserSecretRotation(params) {
-    const rotationConfig = params.credentialsConfig?.secretRotation;
-    const rotationPeriod = (typeof rotationConfig === "object" &&
-        rotationConfig?.automaticallyAfter) ||
-        Duration.days(30);
+    const rotationPeriod = params.rotationConfig.automaticallyAfter ?? Duration.days(30);
     const masterSecret = new Secret(params.scope, `${params.databaseName}MasterSecret`, {
         secretName: ResourceNaming.masterSecretName(params.constructId)
     });
+    Annotations.of(params.scope).addWarningV2("@fjall/components-infrastructure:rdsRotationMasterSecretUnpopulated", `Secret rotation for '${params.databaseName}' cannot complete until the master secret '${ResourceNaming.masterSecretName(params.constructId)}' is populated with valid superuser credentials as JSON — until then every rotation attempt fails and the database password stays unchanged.`);
     new SecretRotation(params.scope, `${params.databaseName}SecretRotation`, {
         application: MULTI_USER_ROTATION_APPLICATIONS[params.engineConfig.family],
         secret: params.databaseSecret,

package/dist/lib/resources/aws/database/rdsInstance.d.ts

@@ -43,7 +43,12 @@ interface RdsProps {
     iamAuthentication?: boolean;
     /** ARN or identifier of DB instance snapshot to restore from */
     snapshotIdentifier?: string;
-    /** Username from the snapshot (required when restoring from snapshot to reset password) */
+    /**
+     * Master username of the snapshot being restored. Must match the snapshot's
+     * actual master user — the post-restore password reset applies to that user
+     * and the new credentials secret bakes this name in. When omitted, falls
+     * back to credentials.username or the engine default and synth warns.
+     */
     snapshotUsername?: string;
     /** SNS topic for alarm notifications. Required for alarm creation. */
     alertsTopic?: ITopic;

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -10,8 +10,8 @@ import { CustomerManagedKey, Secret } from "../secrets/index.js";
 import { CustomResource } from "../utilities/customResource.js";
 import { getDatabaseInsightsRetention } from "./index.js";
 import { RDS_DEFAULTS } from "./rdsDefaults.js";
-import { DEFAULT_POSTGRES_ENGINE_CONFIG, resolveDatabaseInsights, resolveStorageEncryptionKey, resolvePerformanceInsightsKey, addMultiUserSecretRotation } from "./rdsHelpers.js";
-import { isCMKRequested } from "../../../utils/databaseTypes.js";
+import { DEFAULT_POSTGRES_ENGINE_CONFIG, resolveDatabaseInsights, resolveStorageEncryptionKey, resolvePerformanceInsightsKey, addMultiUserSecretRotation, warnIfSnapshotUsernameAssumed } from "./rdsHelpers.js";
+import { resolveSecretRotation, isCMKRequested } from "../../../utils/databaseTypes.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
 import { addProxyCfnOutput } from "./rdsProxyOutput.js";
 import { createRdsAlarms } from "../monitoring/index.js";
@@ -45,10 +45,11 @@ export class RdsInstance extends Construct {
         const proxyEnabled = props.proxy !== undefined && props.proxy !== false;
         this.clientPort = proxyEnabled ? engineDefaultPort : this.port;
         this.addDatabase(props);
-        // Secret rotation enabled by default (opt-out with secretRotation: false)
-        const secretRotationDisabled = props.credentials?.secretRotation === false;
-        if (!secretRotationDisabled) {
-            this.rotateSecret(props);
+        // The wired multi-user rotation cannot complete until the master secret is
+        // populated with valid superuser credentials — see addMultiUserSecretRotation.
+        const rotationConfig = resolveSecretRotation(props.credentials);
+        if (rotationConfig !== undefined) {
+            this.rotateSecret(rotationConfig);
         }
         if (props.proxy !== undefined && props.proxy !== false) {
             this.addProxy(props);
@@ -72,6 +73,13 @@ export class RdsInstance extends Construct {
         const username = props.snapshotIdentifier && props.snapshotUsername
             ? props.snapshotUsername
             : (props.credentials?.username ?? this.engineConfig.defaultUsername);
+        warnIfSnapshotUsernameAssumed({
+            scope: this,
+            databaseName: this.databaseNameValue,
+            snapshotIdentifier: props.snapshotIdentifier,
+            snapshotUsername: props.snapshotUsername,
+            assumedUsername: username
+        });
         this.databaseCredentials = new Secret(this, `${this.databaseNameValue}Credentials`, {
             secretName: ResourceNaming.credentialsSecretName(this.constructId),
             generateSecretString: {
@@ -165,13 +173,13 @@ export class RdsInstance extends Construct {
             });
         }
     }
-    rotateSecret(props) {
+    rotateSecret(rotationConfig) {
         this.masterSecret = addMultiUserSecretRotation({
             scope: this,
             databaseName: this.databaseNameValue,
             constructId: this.constructId,
             engineConfig: this.engineConfig,
-            credentialsConfig: props.credentials,
+            rotationConfig,
             databaseSecret: this.databaseCredentials.secret,
             target: this.database,
             vpc: this.vpc

package/dist/lib/utils/cdkContext.d.ts

@@ -6,6 +6,7 @@ export declare const CDK_CONTEXT_KEYS: {
     readonly MANAGEMENT_ACCOUNT_ID: "managementAccountId";
     readonly ORG_CONFIG: "orgConfig";
     readonly ACCOUNT_TRAIL_STATE: "fjallAccountTrailState";
+    readonly DEV_OU_ID: "fjallDevOuId";
 };
 export { ACCOUNT_TRAIL_STATES, type AccountTrailState };
 /**

package/dist/lib/utils/cdkContext.js

@@ -4,7 +4,8 @@ export const CDK_CONTEXT_KEYS = {
     ROOT_ID: "rootId",
     MANAGEMENT_ACCOUNT_ID: "managementAccountId",
     ORG_CONFIG: "orgConfig",
-    ACCOUNT_TRAIL_STATE: "fjallAccountTrailState"
+    ACCOUNT_TRAIL_STATE: "fjallAccountTrailState",
+    DEV_OU_ID: "fjallDevOuId"
 };
 export { ACCOUNT_TRAIL_STATES };
 /**

package/dist/lib/utils/databaseTypes.d.ts

@@ -33,11 +33,25 @@ export interface ReadReplicaConfig {
 }
 export interface CredentialsConfig {
     username?: string;
+    /**
+     * Opt-in multi-user secret rotation. Rotation resources are created only
+     * when a configuration object is passed (`{}` accepts the 30-day default);
+     * omitting the property leaves rotation off. Rotation cannot complete until
+     * the generated master secret is populated with working superuser
+     * credentials — a synth-time warning is emitted when enabled. `false` is
+     * accepted for backwards compatibility and behaves like omission.
+     */
     secretRotation?: SecretRotationConfig | false;
 }
 export interface SecretRotationConfig {
     automaticallyAfter?: Duration;
 }
+/**
+ * Resolve the opt-in rotation gate once at the construct boundary. Returns
+ * the rotation config only when the caller passed a configuration object;
+ * `false` and omission both resolve to `undefined` (rotation off).
+ */
+export declare function resolveSecretRotation(credentials: CredentialsConfig | undefined): SecretRotationConfig | undefined;
 export interface EncryptionConfig {
     storageKey?: EncryptionKeySpec;
 }

package/dist/lib/utils/databaseTypes.js

@@ -1,3 +1,13 @@
+/**
+ * Resolve the opt-in rotation gate once at the construct boundary. Returns
+ * the rotation config only when the caller passed a configuration object;
+ * `false` and omission both resolve to `undefined` (rotation off).
+ */
+export function resolveSecretRotation(credentials) {
+    return typeof credentials?.secretRotation === "object"
+        ? credentials.secretRotation
+        : undefined;
+}
 // Type guard to check if the encryption key spec is AWS managed.
 export function isAwsManagedKey(spec) {
     return (spec !== undefined &&

package/dist/lib/utils/manifestWriter.d.ts

@@ -74,6 +74,13 @@ export declare class ManifestCollector {
      * Get the application name.
      */
     getAppName(): string;
+    /**
+     * Rename in place after a late `App.getApp(name)`. `getConfig()` before
+     * `getApp()` constructs the App singleton nameless ("FjallApp"); re-keying
+     * via `getManifestCollector(newName)` instead would discard any services
+     * already collected under the old name.
+     */
+    setAppName(appName: string): void;
 }
 /**
  * Write the manifest file to cdk.out.

package/dist/lib/utils/manifestWriter.js

@@ -105,6 +105,15 @@ export class ManifestCollector {
     getAppName() {
         return this.appName;
     }
+    /**
+     * Rename in place after a late `App.getApp(name)`. `getConfig()` before
+     * `getApp()` constructs the App singleton nameless ("FjallApp"); re-keying
+     * via `getManifestCollector(newName)` instead would discard any services
+     * already collected under the old name.
+     */
+    setAppName(appName) {
+        this.appName = appName;
+    }
 }
 /**
  * Compute SHA-256 hash of a CloudFormation template file.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.25.0",
+  "version": "2.27.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -50,6 +50,7 @@
   },
   "devDependencies": {
     "@aws-sdk/client-elastic-load-balancing-v2": "^3.1045.0",
+    "@aws-sdk/client-iam": "^3.1038.0",
     "@aws-sdk/client-identitystore": "^3.1038.0",
     "@peculiar/x509": "2.0.0",
     "@types/aws-lambda": "^8.10.161",
@@ -64,8 +65,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.25.0",
-    "@fjall/util": "^2.25.0",
+    "@fjall/generator": "^2.27.0",
+    "@fjall/util": "^2.27.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -79,5 +80,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "7c1a329184064aefa557c2c09de0965c4f8cd4fb"
+  "gitHead": "921ecd4f65f52c17037a8a24834d7e4c196b9347"
 }