@fjall/components-infrastructure 2.27.0 → 2.29.0

package/dist/lib/config/aws/oidcConnector.js

@@ -1,4 +1,4 @@
-import { DEV_BOUNDARY_POLICY_NAME, DEV_DEPLOY_POLICY_NAME, DEV_PROVISIONER_POLICY_NAME, DEV_SYNC_WRITER_POLICY_NAME, SECURITY_TIER_TO_BOUNDARY, buildDevBoundaryStatements, buildDevDeployPolicyStatements, buildDevDeployTrustStatements, buildDevProvisionerPolicyStatements, buildDevProvisionerTrustStatements, buildDevSyncWriterPolicyStatements, buildDevSyncWriterTrustStatements, buildNarrowedDeployTrustStatements, deployBoundaryName, devDeployRoleName, devProvisionerRoleName, devSyncWriterRoleName } from "@fjall/generator";
+import { DEV_BOUNDARY_POLICY_NAME, DEV_DEPLOY_POLICY_NAME, DEV_PROVISIONER_POLICY_NAME, DEV_SYNC_WRITER_POLICY_NAME, FJALL_OIDC_AUDIENCE, FJALL_OIDC_ISSUER_DOMAIN, FJALL_OIDC_PLACEHOLDER_THUMBPRINT, SECURITY_TIER_TO_BOUNDARY, buildDevBoundaryStatements, buildDevDeployPolicyStatements, buildDevDeployTrustStatements, buildDevProvisionerPolicyStatements, buildDevProvisionerTrustStatements, buildDevSyncWriterPolicyStatements, buildDevSyncWriterTrustStatements, buildNarrowedDeployTrustStatements, deployBoundaryName, devDeployRoleName, devProvisionerRoleName, devSyncWriterRoleName } from "@fjall/generator";
 import { CfnOutput, Duration, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
@@ -19,8 +19,8 @@ import { CustomResource } from "../../resources/aws/utilities/customResource.js"
 const OIDC_PROVIDER_HANDLER = `
 const { IAMClient, ListOpenIDConnectProvidersCommand, GetOpenIDConnectProviderCommand, CreateOpenIDConnectProviderCommand, AddClientIDToOpenIDConnectProviderCommand } = require('@aws-sdk/client-iam');
 
-const AUDIENCE = 'sts.amazonaws.com';
-const THUMBPRINT = '0000000000000000000000000000000000000000';
+const AUDIENCE = '${FJALL_OIDC_AUDIENCE}';
+const THUMBPRINT = '${FJALL_OIDC_PLACEHOLDER_THUMBPRINT}';
 
 exports.handler = async (event) => {
   const physicalId = event.PhysicalResourceId || event.LogicalResourceId;
@@ -71,7 +71,7 @@ export class OidcConnector extends Construct {
     deployRoleArn;
     constructor(scope, id, props) {
         super(scope, id);
-        const issuerDomain = "fjall.io";
+        const issuerDomain = FJALL_OIDC_ISSUER_DOMAIN;
         const issuerUrl = `https://${issuerDomain}`;
         const providerResource = new CustomResource(this, "OidcProvider", {
             runtime: Runtime.NODEJS_22_X,

package/dist/lib/patterns/aws/account.js

@@ -62,6 +62,9 @@ export class Account extends Stack {
         const accountGlobalsConfigured = this.node.tryGetContext("fjallAccountGlobalsConfigured") === "true";
         this.accountGlobalsConfigured = accountGlobalsConfigured;
         const environment = config.environment ?? "unknown";
+        // Deploy-core mirrors this gate as synthCarriedOidcConnector
+        // (deploy-core/src/orchestration/contextHelpers.ts) to decide the
+        // post-deploy OIDC provider reconcile — keep the two in lockstep.
         if (this.receivesDeployRole() &&
             fjallOrgId &&
             !oidcAlreadyConfigured &&

package/dist/lib/resources/aws/database/rdsHelpers.js

@@ -82,7 +82,10 @@ export function warnIfSnapshotUsernameAssumed(params) {
  * warning surfaces this to anyone opting in.
  */
 export function addMultiUserSecretRotation(params) {
-    const rotationPeriod = params.rotationConfig.automaticallyAfter ?? Duration.days(30);
+    const rotationPeriod = params.rotationConfig.automaticallyAfter ??
+        (params.rotationConfig.automaticallyAfterDays !== undefined
+            ? Duration.days(params.rotationConfig.automaticallyAfterDays)
+            : Duration.days(30));
     const masterSecret = new Secret(params.scope, `${params.databaseName}MasterSecret`, {
         secretName: ResourceNaming.masterSecretName(params.constructId)
     });

package/dist/lib/utils/databaseTypes.d.ts

@@ -45,6 +45,12 @@ export interface CredentialsConfig {
 }
 export interface SecretRotationConfig {
     automaticallyAfter?: Duration;
+    /**
+     * Rotation period in whole days — the JSON-friendly form the generator
+     * scaffolds (`secretRotation: { automaticallyAfterDays: 30 }`). Ignored
+     * when `automaticallyAfter` is also set. Default: 30 days.
+     */
+    automaticallyAfterDays?: number;
 }
 /**
  * Resolve the opt-in rotation gate once at the construct boundary. Returns

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.27.0",
+  "version": "2.29.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -65,8 +65,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.27.0",
-    "@fjall/util": "^2.27.0",
+    "@fjall/generator": "^2.29.0",
+    "@fjall/util": "^2.29.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -80,5 +80,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "921ecd4f65f52c17037a8a24834d7e4c196b9347"
+  "gitHead": "c40ea0e1435400f3f42faaad5bcbf50e4400c1d4"
 }