@fjall/components-infrastructure 2.29.0 → 2.30.3

package/dist/lib/config/aws/organisation.d.ts

@@ -0,0 +1,30 @@
+import { CfnOutput, type StackProps } from "aws-cdk-lib";
+import { Construct } from "constructs";
+import { type Account as ExistingAccounts } from "@aws-sdk/client-organizations";
+import { type KeyValue } from "../../types";
+interface OrganisationProps extends StackProps {
+    organisationName: string;
+    accounts: AccountsConfig;
+    orgEmail: string;
+    existingAccounts?: ExistingAccounts[];
+}
+type AccountsConfig = {
+    readonly [key: string]: readonly string[] | string;
+};
+/**
+ * A construct for creating multi environment organisations with a production, staging and development account.
+ */
+export default class Organisation extends Construct {
+    accountId: CfnOutput;
+    private existingAccounts?;
+    private accounts;
+    private organisation;
+    private organisationalUnits;
+    constructor(scope: Construct, id: string, props: OrganisationProps);
+    private addOrganisation;
+    private addOrganisationUnitsAndAccounts;
+    private addOrganisationalUnit;
+    private addAccount;
+    getAccounts(): KeyValue;
+}
+export {};

package/dist/lib/config/aws/organisation.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const constructs_1 = require("constructs");
+const stripAndCamelCase_1 = require("../../utils/stripAndCamelCase");
+const cdk_organizations_1 = require("@pepperize/cdk-organizations");
+const addSuffixToEmail_1 = require("../../utils/addSuffixToEmail");
+/**
+ * A construct for creating multi environment organisations with a production, staging and development account.
+ */
+class Organisation extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.accounts = {};
+        this.organisationalUnits = [];
+        this.existingAccounts = props.existingAccounts;
+        this.addOrganisation(props.organisationName);
+        this.addOrganisationUnitsAndAccounts(props.accounts, props.orgEmail);
+    }
+    addOrganisation(organisationName) {
+        this.organisation = new cdk_organizations_1.Organization(this, organisationName, {
+            featureSet: cdk_organizations_1.FeatureSet.ALL
+        });
+        // TODO: Validate this enables trusted access
+        this.organisation.enableAwsServiceAccess("account.amazonaws.com");
+        const enforcedPolicyTypes = [
+            cdk_organizations_1.PolicyType.SERVICE_CONTROL_POLICY,
+            cdk_organizations_1.PolicyType.TAG_POLICY,
+            cdk_organizations_1.PolicyType.BACKUP_POLICY,
+            cdk_organizations_1.PolicyType.AISERVICES_OPT_OUT_POLICY
+        ];
+        for (const policyType of enforcedPolicyTypes) {
+            this.organisation.enablePolicyType(policyType);
+        }
+    }
+    addOrganisationUnitsAndAccounts(accounts, orgEmail) {
+        for (const [environmentType, accountList] of Object.entries(accounts)) {
+            // Create OU for each environment type
+            const ouName = environmentType.charAt(0).toUpperCase() + environmentType.slice(1);
+            const orgUnit = this.addOrganisationalUnit(`${ouName}OrganizationalUnit`, ouName);
+            // Convert single account to array for uniform processing
+            const accountsArray = Array.isArray(accountList)
+                ? accountList
+                : [accountList];
+            // Add accounts to this OU
+            for (const accountName of accountsArray) {
+                const accountNameId = (0, stripAndCamelCase_1.stripAndCamelCase)(accountName);
+                const importedAccount = this.existingAccounts?.find((account) => account.Name === accountName);
+                const accountEmail = importedAccount
+                    ? importedAccount.Email
+                    : (0, addSuffixToEmail_1.default)(orgEmail, accountNameId.toLowerCase());
+                if (accountEmail) {
+                    this.addAccount(`${accountNameId}Account`, accountName, accountEmail, { env: environmentType }, orgUnit);
+                }
+            }
+        }
+    }
+    addOrganisationalUnit(id, name) {
+        const ou = new cdk_organizations_1.OrganizationalUnit(this, id, {
+            organizationalUnitName: name,
+            parent: this.organisation.root,
+            importOnDuplicate: true
+        });
+        this.organisationalUnits.push(ou);
+        return ou;
+    }
+    addAccount(id, name, email, tags, organisationalUnit) {
+        const acc = new cdk_organizations_1.Account(this, id, {
+            accountName: name,
+            email: email,
+            parent: organisationalUnit,
+            importOnDuplicate: true
+        });
+        for (const tag in tags) {
+            aws_cdk_lib_1.Tags.of(acc).add(tag, tags[tag]);
+        }
+        this.accounts[name] = acc.accountId;
+        new aws_cdk_lib_1.CfnOutput(this, `${id}Id`, {
+            key: `${id}Id`,
+            value: acc.accountId,
+            exportName: `${id}Id`
+        });
+        new aws_cdk_lib_1.CfnOutput(this, `${id}Arn`, {
+            key: `${id}Arn`,
+            value: acc.accountArn,
+            exportName: `${id}Arn`
+        });
+        return acc;
+    }
+    getAccounts() {
+        return this.accounts;
+    }
+}
+exports.default = Organisation;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3JnYW5pc2F0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vbGliL2NvbmZpZy9hd3Mvb3JnYW5pc2F0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsNkNBQStEO0FBQy9ELDJDQUF1QztBQUN2QyxxRUFBa0U7QUFFbEUsb0VBTXNDO0FBQ3RDLG1FQUE0RDtBQWM1RDs7R0FFRztBQUVILE1BQXFCLFlBQWEsU0FBUSxzQkFBUztJQVFqRCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQXdCO1FBQ2hFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFMWCxhQUFRLEdBQWEsRUFBRSxDQUFDO1FBRXhCLHdCQUFtQixHQUF5QixFQUFFLENBQUM7UUFLckQsSUFBSSxDQUFDLGdCQUFnQixHQUFHLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztRQUMvQyxJQUFJLENBQUMsZUFBZSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQzdDLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBRU8sZUFBZSxDQUFDLGdCQUF3QjtRQUM5QyxJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksZ0NBQVksQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUU7WUFDM0QsVUFBVSxFQUFFLDhCQUFVLENBQUMsR0FBRztTQUMzQixDQUFDLENBQUM7UUFFSCw2Q0FBNkM7UUFDN0MsSUFBSSxDQUFDLFlBQVksQ0FBQyxzQkFBc0IsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO1FBRWxFLE1BQU0sbUJBQW1CLEdBQWlCO1lBQ3hDLDhCQUFVLENBQUMsc0JBQXNCO1lBQ2pDLDhCQUFVLENBQUMsVUFBVTtZQUNyQiw4QkFBVSxDQUFDLGFBQWE7WUFDeEIsOEJBQVUsQ0FBQyx5QkFBeUI7U0FDckMsQ0FBQztRQUVGLEtBQUssTUFBTSxVQUFVLElBQUksbUJBQW1CLEVBQUUsQ0FBQztZQUM3QyxJQUFJLENBQUMsWUFBWSxDQUFDLGdCQUFnQixDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2pELENBQUM7SUFDSCxDQUFDO0lBRU8sK0JBQStCLENBQ3JDLFFBQXdCLEVBQ3hCLFFBQWdCO1FBRWhCLEtBQUssTUFBTSxDQUFDLGVBQWUsRUFBRSxXQUFXLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDdEUsc0NBQXNDO1lBQ3RDLE1BQU0sTUFBTSxHQUNWLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLEdBQUcsZUFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNyRSxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMscUJBQXFCLENBQ3hDLEdBQUcsTUFBTSxvQkFBb0IsRUFDN0IsTUFBTSxDQUNQLENBQUM7WUFFRix5REFBeUQ7WUFDekQsTUFBTSxhQUFhLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7Z0JBQzlDLENBQUMsQ0FBQyxXQUFXO2dCQUNiLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBRWxCLDBCQUEwQjtZQUMxQixLQUFLLE1BQU0sV0FBVyxJQUFJLGFBQWEsRUFBRSxDQUFDO2dCQUN4QyxNQUFNLGFBQWEsR0FBRyxJQUFBLHFDQUFpQixFQUFDLFdBQVcsQ0FBQyxDQUFDO2dCQUVyRCxNQUFNLGVBQWUsR0FBRyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsSUFBSSxDQUNqRCxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksS0FBSyxXQUFXLENBQzFDLENBQUM7Z0JBQ0YsTUFBTSxZQUFZLEdBQUcsZUFBZTtvQkFDbEMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxLQUFLO29CQUN2QixDQUFDLENBQUMsSUFBQSwwQkFBZ0IsRUFBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7Z0JBRTVELElBQUksWUFBWSxFQUFFLENBQUM7b0JBQ2pCLElBQUksQ0FBQyxVQUFVLENBQ2IsR0FBRyxhQUFhLFNBQVMsRUFDekIsV0FBVyxFQUNYLFlBQVksRUFDWixFQUFFLEdBQUcsRUFBRSxlQUFlLEVBQUUsRUFDeEIsT0FBTyxDQUNSLENBQUM7Z0JBQ0osQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVPLHFCQUFxQixDQUFDLEVBQVUsRUFBRSxJQUFZO1FBQ3BELE1BQU0sRUFBRSxHQUFHLElBQUksc0NBQWtCLENBQUMsSUFBSSxFQUFFLEVBQUUsRUFBRTtZQUMxQyxzQkFBc0IsRUFBRSxJQUFJO1lBQzVCLE1BQU0sRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUk7WUFDOUIsaUJBQWlCLEVBQUUsSUFBSTtTQUN4QixDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ2xDLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUVPLFVBQVUsQ0FDaEIsRUFBVSxFQUNWLElBQVksRUFDWixLQUFhLEVBQ2IsSUFBK0IsRUFDL0Isa0JBQXNDO1FBRXRDLE1BQU0sR0FBRyxHQUFHLElBQUksMkJBQU8sQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFO1lBQ2hDLFdBQVcsRUFBRSxJQUFJO1lBQ2pCLEtBQUssRUFBRSxLQUFLO1lBQ1osTUFBTSxFQUFFLGtCQUFrQjtZQUMxQixpQkFBaUIsRUFBRSxJQUFJO1NBQ3hCLENBQUMsQ0FBQztRQUVILEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7WUFDdkIsa0JBQUksQ0FBQyxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNuQyxDQUFDO1FBRUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxHQUFHLENBQUMsU0FBUyxDQUFDO1FBRXBDLElBQUksdUJBQVMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRTtZQUM3QixHQUFHLEVBQUUsR0FBRyxFQUFFLElBQUk7WUFDZCxLQUFLLEVBQUUsR0FBRyxDQUFDLFNBQVM7WUFDcEIsVUFBVSxFQUFFLEdBQUcsRUFBRSxJQUFJO1NBQ3RCLENBQUMsQ0FBQztRQUNILElBQUksdUJBQVMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRTtZQUM5QixHQUFHLEVBQUUsR0FBRyxFQUFFLEtBQUs7WUFDZixLQUFLLEVBQUUsR0FBRyxDQUFDLFVBQVU7WUFDckIsVUFBVSxFQUFFLEdBQUcsRUFBRSxLQUFLO1NBQ3ZCLENBQUMsQ0FBQztRQUVILE9BQU8sR0FBRyxDQUFDO0lBQ2IsQ0FBQztJQUVNLFdBQVc7UUFDaEIsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDO0lBQ3ZCLENBQUM7Q0FDRjtBQTlIRCwrQkE4SEMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDZm5PdXRwdXQsIFRhZ3MsIHR5cGUgU3RhY2tQcm9wcyB9IGZyb20gXCJhd3MtY2RrLWxpYlwiO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcbmltcG9ydCB7IHN0cmlwQW5kQ2FtZWxDYXNlIH0gZnJvbSBcIi4uLy4uL3V0aWxzL3N0cmlwQW5kQ2FtZWxDYXNlXCI7XG5pbXBvcnQgeyB0eXBlIEFjY291bnQgYXMgRXhpc3RpbmdBY2NvdW50cyB9IGZyb20gXCJAYXdzLXNkay9jbGllbnQtb3JnYW5pemF0aW9uc1wiO1xuaW1wb3J0IHtcbiAgQWNjb3VudCxcbiAgRmVhdHVyZVNldCxcbiAgT3JnYW5pemF0aW9uLFxuICBPcmdhbml6YXRpb25hbFVuaXQsXG4gIFBvbGljeVR5cGVcbn0gZnJvbSBcIkBwZXBwZXJpemUvY2RrLW9yZ2FuaXphdGlvbnNcIjtcbmltcG9ydCBhZGRTdWZmaXhUb0VtYWlsIGZyb20gXCIuLi8uLi91dGlscy9hZGRTdWZmaXhUb0VtYWlsXCI7XG5pbXBvcnQgeyB0eXBlIEtleVZhbHVlIH0gZnJvbSBcIi4uLy4uL3R5cGVzXCI7XG5cbmludGVyZmFjZSBPcmdhbmlzYXRpb25Qcm9wcyBleHRlbmRzIFN0YWNrUHJvcHMge1xuICBvcmdhbmlzYXRpb25OYW1lOiBzdHJpbmc7XG4gIGFjY291bnRzOiBBY2NvdW50c0NvbmZpZztcbiAgb3JnRW1haWw6IHN0cmluZztcbiAgZXhpc3RpbmdBY2NvdW50cz86IEV4aXN0aW5nQWNjb3VudHNbXTtcbn1cblxudHlwZSBBY2NvdW50c0NvbmZpZyA9IHtcbiAgcmVhZG9ubHkgW2tleTogc3RyaW5nXTogcmVhZG9ubHkgc3RyaW5nW10gfCBzdHJpbmc7XG59O1xuXG4vKipcbiAqIEEgY29uc3RydWN0IGZvciBjcmVhdGluZyBtdWx0aSBlbnZpcm9ubWVudCBvcmdhbmlzYXRpb25zIHdpdGggYSBwcm9kdWN0aW9uLCBzdGFnaW5nIGFuZCBkZXZlbG9wbWVudCBhY2NvdW50LlxuICovXG5cbmV4cG9ydCBkZWZhdWx0IGNsYXNzIE9yZ2FuaXNhdGlvbiBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHB1YmxpYyBhY2NvdW50SWQ6IENmbk91dHB1dDtcblxuICBwcml2YXRlIGV4aXN0aW5nQWNjb3VudHM/OiBFeGlzdGluZ0FjY291bnRzW107XG4gIHByaXZhdGUgYWNjb3VudHM6IEtleVZhbHVlID0ge307XG4gIHByaXZhdGUgb3JnYW5pc2F0aW9uOiBPcmdhbml6YXRpb247XG4gIHByaXZhdGUgb3JnYW5pc2F0aW9uYWxVbml0czogT3JnYW5pemF0aW9uYWxVbml0W10gPSBbXTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogT3JnYW5pc2F0aW9uUHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuXG4gICAgdGhpcy5leGlzdGluZ0FjY291bnRzID0gcHJvcHMuZXhpc3RpbmdBY2NvdW50cztcbiAgICB0aGlzLmFkZE9yZ2FuaXNhdGlvbihwcm9wcy5vcmdhbmlzYXRpb25OYW1lKTtcbiAgICB0aGlzLmFkZE9yZ2FuaXNhdGlvblVuaXRzQW5kQWNjb3VudHMocHJvcHMuYWNjb3VudHMsIHByb3BzLm9yZ0VtYWlsKTtcbiAgfVxuXG4gIHByaXZhdGUgYWRkT3JnYW5pc2F0aW9uKG9yZ2FuaXNhdGlvbk5hbWU6IHN0cmluZykge1xuICAgIHRoaXMub3JnYW5pc2F0aW9uID0gbmV3IE9yZ2FuaXphdGlvbih0aGlzLCBvcmdhbmlzYXRpb25OYW1lLCB7XG4gICAgICBmZWF0dXJlU2V0OiBGZWF0dXJlU2V0LkFMTFxuICAgIH0pO1xuXG4gICAgLy8gVE9ETzogVmFsaWRhdGUgdGhpcyBlbmFibGVzIHRydXN0ZWQgYWNjZXNzXG4gICAgdGhpcy5vcmdhbmlzYXRpb24uZW5hYmxlQXdzU2VydmljZUFjY2VzcyhcImFjY291bnQuYW1hem9uYXdzLmNvbVwiKTtcblxuICAgIGNvbnN0IGVuZm9yY2VkUG9saWN5VHlwZXM6IFBvbGljeVR5cGVbXSA9IFtcbiAgICAgIFBvbGljeVR5cGUuU0VSVklDRV9DT05UUk9MX1BPTElDWSxcbiAgICAgIFBvbGljeVR5cGUuVEFHX1BPTElDWSxcbiAgICAgIFBvbGljeVR5cGUuQkFDS1VQX1BPTElDWSxcbiAgICAgIFBvbGljeVR5cGUuQUlTRVJWSUNFU19PUFRfT1VUX1BPTElDWVxuICAgIF07XG5cbiAgICBmb3IgKGNvbnN0IHBvbGljeVR5cGUgb2YgZW5mb3JjZWRQb2xpY3lUeXBlcykge1xuICAgICAgdGhpcy5vcmdhbmlzYXRpb24uZW5hYmxlUG9saWN5VHlwZShwb2xpY3lUeXBlKTtcbiAgICB9XG4gIH1cblxuICBwcml2YXRlIGFkZE9yZ2FuaXNhdGlvblVuaXRzQW5kQWNjb3VudHMoXG4gICAgYWNjb3VudHM6IEFjY291bnRzQ29uZmlnLFxuICAgIG9yZ0VtYWlsOiBzdHJpbmdcbiAgKSB7XG4gICAgZm9yIChjb25zdCBbZW52aXJvbm1lbnRUeXBlLCBhY2NvdW50TGlzdF0gb2YgT2JqZWN0LmVudHJpZXMoYWNjb3VudHMpKSB7XG4gICAgICAvLyBDcmVhdGUgT1UgZm9yIGVhY2ggZW52aXJvbm1lbnQgdHlwZVxuICAgICAgY29uc3Qgb3VOYW1lID1cbiAgICAgICAgZW52aXJvbm1lbnRUeXBlLmNoYXJBdCgwKS50b1VwcGVyQ2FzZSgpICsgZW52aXJvbm1lbnRUeXBlLnNsaWNlKDEpO1xuICAgICAgY29uc3Qgb3JnVW5pdCA9IHRoaXMuYWRkT3JnYW5pc2F0aW9uYWxVbml0KFxuICAgICAgICBgJHtvdU5hbWV9T3JnYW5pemF0aW9uYWxVbml0YCxcbiAgICAgICAgb3VOYW1lXG4gICAgICApO1xuXG4gICAgICAvLyBDb252ZXJ0IHNpbmdsZSBhY2NvdW50IHRvIGFycmF5IGZvciB1bmlmb3JtIHByb2Nlc3NpbmdcbiAgICAgIGNvbnN0IGFjY291bnRzQXJyYXkgPSBBcnJheS5pc0FycmF5KGFjY291bnRMaXN0KVxuICAgICAgICA/IGFjY291bnRMaXN0XG4gICAgICAgIDogW2FjY291bnRMaXN0XTtcblxuICAgICAgLy8gQWRkIGFjY291bnRzIHRvIHRoaXMgT1VcbiAgICAgIGZvciAoY29uc3QgYWNjb3VudE5hbWUgb2YgYWNjb3VudHNBcnJheSkge1xuICAgICAgICBjb25zdCBhY2NvdW50TmFtZUlkID0gc3RyaXBBbmRDYW1lbENhc2UoYWNjb3VudE5hbWUpO1xuXG4gICAgICAgIGNvbnN0IGltcG9ydGVkQWNjb3VudCA9IHRoaXMuZXhpc3RpbmdBY2NvdW50cz8uZmluZChcbiAgICAgICAgICAoYWNjb3VudCkgPT4gYWNjb3VudC5OYW1lID09PSBhY2NvdW50TmFtZVxuICAgICAgICApO1xuICAgICAgICBjb25zdCBhY2NvdW50RW1haWwgPSBpbXBvcnRlZEFjY291bnRcbiAgICAgICAgICA/IGltcG9ydGVkQWNjb3VudC5FbWFpbFxuICAgICAgICAgIDogYWRkU3VmZml4VG9FbWFpbChvcmdFbWFpbCwgYWNjb3VudE5hbWVJZC50b0xvd2VyQ2FzZSgpKTtcblxuICAgICAgICBpZiAoYWNjb3VudEVtYWlsKSB7XG4gICAgICAgICAgdGhpcy5hZGRBY2NvdW50KFxuICAgICAgICAgICAgYCR7YWNjb3VudE5hbWVJZH1BY2NvdW50YCxcbiAgICAgICAgICAgIGFjY291bnROYW1lLFxuICAgICAgICAgICAgYWNjb3VudEVtYWlsLFxuICAgICAgICAgICAgeyBlbnY6IGVudmlyb25tZW50VHlwZSB9LFxuICAgICAgICAgICAgb3JnVW5pdFxuICAgICAgICAgICk7XG4gICAgICAgIH1cbiAgICAgIH1cbiAgICB9XG4gIH1cblxuICBwcml2YXRlIGFkZE9yZ2FuaXNhdGlvbmFsVW5pdChpZDogc3RyaW5nLCBuYW1lOiBzdHJpbmcpOiBPcmdhbml6YXRpb25hbFVuaXQge1xuICAgIGNvbnN0IG91ID0gbmV3IE9yZ2FuaXphdGlvbmFsVW5pdCh0aGlzLCBpZCwge1xuICAgICAgb3JnYW5pemF0aW9uYWxVbml0TmFtZTogbmFtZSxcbiAgICAgIHBhcmVudDogdGhpcy5vcmdhbmlzYXRpb24ucm9vdCxcbiAgICAgIGltcG9ydE9uRHVwbGljYXRlOiB0cnVlXG4gICAgfSk7XG5cbiAgICB0aGlzLm9yZ2FuaXNhdGlvbmFsVW5pdHMucHVzaChvdSk7XG4gICAgcmV0dXJuIG91O1xuICB9XG5cbiAgcHJpdmF0ZSBhZGRBY2NvdW50KFxuICAgIGlkOiBzdHJpbmcsXG4gICAgbmFtZTogc3RyaW5nLFxuICAgIGVtYWlsOiBzdHJpbmcsXG4gICAgdGFnczogeyBba2V5OiBzdHJpbmddOiBzdHJpbmcgfSxcbiAgICBvcmdhbmlzYXRpb25hbFVuaXQ6IE9yZ2FuaXphdGlvbmFsVW5pdFxuICApOiBBY2NvdW50IHtcbiAgICBjb25zdCBhY2MgPSBuZXcgQWNjb3VudCh0aGlzLCBpZCwge1xuICAgICAgYWNjb3VudE5hbWU6IG5hbWUsXG4gICAgICBlbWFpbDogZW1haWwsXG4gICAgICBwYXJlbnQ6IG9yZ2FuaXNhdGlvbmFsVW5pdCxcbiAgICAgIGltcG9ydE9uRHVwbGljYXRlOiB0cnVlXG4gICAgfSk7XG5cbiAgICBmb3IgKGNvbnN0IHRhZyBpbiB0YWdzKSB7XG4gICAgICBUYWdzLm9mKGFjYykuYWRkKHRhZywgdGFnc1t0YWddKTtcbiAgICB9XG5cbiAgICB0aGlzLmFjY291bnRzW25hbWVdID0gYWNjLmFjY291bnRJZDtcblxuICAgIG5ldyBDZm5PdXRwdXQodGhpcywgYCR7aWR9SWRgLCB7XG4gICAgICBrZXk6IGAke2lkfUlkYCxcbiAgICAgIHZhbHVlOiBhY2MuYWNjb3VudElkLFxuICAgICAgZXhwb3J0TmFtZTogYCR7aWR9SWRgXG4gICAgfSk7XG4gICAgbmV3IENmbk91dHB1dCh0aGlzLCBgJHtpZH1Bcm5gLCB7XG4gICAgICBrZXk6IGAke2lkfUFybmAsXG4gICAgICB2YWx1ZTogYWNjLmFjY291bnRBcm4sXG4gICAgICBleHBvcnROYW1lOiBgJHtpZH1Bcm5gXG4gICAgfSk7XG5cbiAgICByZXR1cm4gYWNjO1xuICB9XG5cbiAgcHVibGljIGdldEFjY291bnRzKCkge1xuICAgIHJldHVybiB0aGlzLmFjY291bnRzO1xuICB9XG59XG4iXX0=

package/dist/lib/config/aws/organisationId.d.ts

@@ -0,0 +1,7 @@
+import { CfnOutput } from "aws-cdk-lib";
+import { Construct } from "constructs";
+export declare class OrganisationId extends Construct {
+    readonly organisationId: CfnOutput;
+    readonly organisationAccountArn: CfnOutput;
+    constructor(scope: Construct, id: string);
+}

package/dist/lib/config/aws/organisationId.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrganisationId = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const customResources = require("aws-cdk-lib/custom-resources");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const constructs_1 = require("constructs");
+const awsCustomResource_1 = require("../../resources/aws/utilities/awsCustomResource");
+class OrganisationId extends constructs_1.Construct {
+    constructor(scope, id) {
+        super(scope, id);
+        const organisation = new awsCustomResource_1.AwsCustomResource(this, "OrganisationResource", {
+            functionName: "organisationId",
+            onCreate: {
+                service: "organizations",
+                action: "DescribeOrganizationCommand", // https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Organizations.html#describeOrganization-property
+                physicalResourceId: customResources.PhysicalResourceId.of("organisationId")
+            },
+            onUpdate: {
+                service: "organizations",
+                action: "DescribeOrganizationCommand", // https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Organizations.html#describeOrganization-property
+                physicalResourceId: customResources.PhysicalResourceId.of("organisationId")
+            },
+            resourceType: "Custom::DescribeOrganisation",
+            policy: customResources.AwsCustomResourcePolicy.fromStatements([
+                new aws_iam_1.PolicyStatement({
+                    actions: ["organizations:DescribeOrganization"],
+                    resources: ["*"],
+                    effect: aws_iam_1.Effect.ALLOW
+                })
+            ])
+        });
+        this.organisationId = new aws_cdk_lib_1.CfnOutput(this, "OrganisationIdOutput", {
+            key: "OrganisationId",
+            value: organisation.getResponseField("Organization.Id"),
+            exportName: "OrganisationId"
+        });
+        this.organisationAccountArn = new aws_cdk_lib_1.CfnOutput(this, "OrganisationAccountArnOutput", {
+            key: "OrganisationAccountArn",
+            value: organisation.getResponseField("Organization.MasterAccountArn"),
+            exportName: "OrganisationAccountArn"
+        });
+    }
+}
+exports.OrganisationId = OrganisationId;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3JnYW5pc2F0aW9uSWQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9saWIvY29uZmlnL2F3cy9vcmdhbmlzYXRpb25JZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSw2Q0FBd0M7QUFDeEMsZ0VBQWdFO0FBQ2hFLGlEQUE4RDtBQUM5RCwyQ0FBdUM7QUFFdkMsdUZBQW9GO0FBRXBGLE1BQWEsY0FBZSxTQUFRLHNCQUFTO0lBSTNDLFlBQVksS0FBZ0IsRUFBRSxFQUFVO1FBQ3RDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsTUFBTSxZQUFZLEdBQUcsSUFBSSxxQ0FBaUIsQ0FBQyxJQUFJLEVBQUUsc0JBQXNCLEVBQUU7WUFDdkUsWUFBWSxFQUFFLGdCQUFnQjtZQUM5QixRQUFRLEVBQUU7Z0JBQ1IsT0FBTyxFQUFFLGVBQWU7Z0JBQ3hCLE1BQU0sRUFBRSw2QkFBNkIsRUFBRSwyR0FBMkc7Z0JBQ2xKLGtCQUFrQixFQUNoQixlQUFlLENBQUMsa0JBQWtCLENBQUMsRUFBRSxDQUFDLGdCQUFnQixDQUFDO2FBQzFEO1lBQ0QsUUFBUSxFQUFFO2dCQUNSLE9BQU8sRUFBRSxlQUFlO2dCQUN4QixNQUFNLEVBQUUsNkJBQTZCLEVBQUUsMkdBQTJHO2dCQUNsSixrQkFBa0IsRUFDaEIsZUFBZSxDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQzthQUMxRDtZQUNELFlBQVksRUFBRSw4QkFBOEI7WUFDNUMsTUFBTSxFQUFFLGVBQWUsQ0FBQyx1QkFBdUIsQ0FBQyxjQUFjLENBQUM7Z0JBQzdELElBQUkseUJBQWUsQ0FBQztvQkFDbEIsT0FBTyxFQUFFLENBQUMsb0NBQW9DLENBQUM7b0JBQy9DLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQztvQkFDaEIsTUFBTSxFQUFFLGdCQUFNLENBQUMsS0FBSztpQkFDckIsQ0FBQzthQUNILENBQUM7U0FDSCxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsY0FBYyxHQUFHLElBQUksdUJBQVMsQ0FBQyxJQUFJLEVBQUUsc0JBQXNCLEVBQUU7WUFDaEUsR0FBRyxFQUFFLGdCQUFnQjtZQUNyQixLQUFLLEVBQUUsWUFBWSxDQUFDLGdCQUFnQixDQUFDLGlCQUFpQixDQUFDO1lBQ3ZELFVBQVUsRUFBRSxnQkFBZ0I7U0FDN0IsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLHNCQUFzQixHQUFHLElBQUksdUJBQVMsQ0FDekMsSUFBSSxFQUNKLDhCQUE4QixFQUM5QjtZQUNFLEdBQUcsRUFBRSx3QkFBd0I7WUFDN0IsS0FBSyxFQUFFLFlBQVksQ0FBQyxnQkFBZ0IsQ0FBQywrQkFBK0IsQ0FBQztZQUNyRSxVQUFVLEVBQUUsd0JBQXdCO1NBQ3JDLENBQ0YsQ0FBQztJQUNKLENBQUM7Q0FDRjtBQS9DRCx3Q0ErQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDZm5PdXRwdXQgfSBmcm9tIFwiYXdzLWNkay1saWJcIjtcbmltcG9ydCAqIGFzIGN1c3RvbVJlc291cmNlcyBmcm9tIFwiYXdzLWNkay1saWIvY3VzdG9tLXJlc291cmNlc1wiO1xuaW1wb3J0IHsgRWZmZWN0LCBQb2xpY3lTdGF0ZW1lbnQgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLWlhbVwiO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIjtcblxuaW1wb3J0IHsgQXdzQ3VzdG9tUmVzb3VyY2UgfSBmcm9tIFwiLi4vLi4vcmVzb3VyY2VzL2F3cy91dGlsaXRpZXMvYXdzQ3VzdG9tUmVzb3VyY2VcIjtcblxuZXhwb3J0IGNsYXNzIE9yZ2FuaXNhdGlvbklkIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgcHVibGljIHJlYWRvbmx5IG9yZ2FuaXNhdGlvbklkOiBDZm5PdXRwdXQ7XG4gIHB1YmxpYyByZWFkb25seSBvcmdhbmlzYXRpb25BY2NvdW50QXJuOiBDZm5PdXRwdXQ7XG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBjb25zdCBvcmdhbmlzYXRpb24gPSBuZXcgQXdzQ3VzdG9tUmVzb3VyY2UodGhpcywgXCJPcmdhbmlzYXRpb25SZXNvdXJjZVwiLCB7XG4gICAgICBmdW5jdGlvbk5hbWU6IFwib3JnYW5pc2F0aW9uSWRcIixcbiAgICAgIG9uQ3JlYXRlOiB7XG4gICAgICAgIHNlcnZpY2U6IFwib3JnYW5pemF0aW9uc1wiLFxuICAgICAgICBhY3Rpb246IFwiRGVzY3JpYmVPcmdhbml6YXRpb25Db21tYW5kXCIsIC8vIGh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9BV1NKYXZhU2NyaXB0U0RLL2xhdGVzdC9BV1MvT3JnYW5pemF0aW9ucy5odG1sI2Rlc2NyaWJlT3JnYW5pemF0aW9uLXByb3BlcnR5XG4gICAgICAgIHBoeXNpY2FsUmVzb3VyY2VJZDpcbiAgICAgICAgICBjdXN0b21SZXNvdXJjZXMuUGh5c2ljYWxSZXNvdXJjZUlkLm9mKFwib3JnYW5pc2F0aW9uSWRcIilcbiAgICAgIH0sXG4gICAgICBvblVwZGF0ZToge1xuICAgICAgICBzZXJ2aWNlOiBcIm9yZ2FuaXphdGlvbnNcIixcbiAgICAgICAgYWN0aW9uOiBcIkRlc2NyaWJlT3JnYW5pemF0aW9uQ29tbWFuZFwiLCAvLyBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vQVdTSmF2YVNjcmlwdFNESy9sYXRlc3QvQVdTL09yZ2FuaXphdGlvbnMuaHRtbCNkZXNjcmliZU9yZ2FuaXphdGlvbi1wcm9wZXJ0eVxuICAgICAgICBwaHlzaWNhbFJlc291cmNlSWQ6XG4gICAgICAgICAgY3VzdG9tUmVzb3VyY2VzLlBoeXNpY2FsUmVzb3VyY2VJZC5vZihcIm9yZ2FuaXNhdGlvbklkXCIpXG4gICAgICB9LFxuICAgICAgcmVzb3VyY2VUeXBlOiBcIkN1c3RvbTo6RGVzY3JpYmVPcmdhbmlzYXRpb25cIixcbiAgICAgIHBvbGljeTogY3VzdG9tUmVzb3VyY2VzLkF3c0N1c3RvbVJlc291cmNlUG9saWN5LmZyb21TdGF0ZW1lbnRzKFtcbiAgICAgICAgbmV3IFBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgICAgYWN0aW9uczogW1wib3JnYW5pemF0aW9uczpEZXNjcmliZU9yZ2FuaXphdGlvblwiXSxcbiAgICAgICAgICByZXNvdXJjZXM6IFtcIipcIl0sXG4gICAgICAgICAgZWZmZWN0OiBFZmZlY3QuQUxMT1dcbiAgICAgICAgfSlcbiAgICAgIF0pXG4gICAgfSk7XG5cbiAgICB0aGlzLm9yZ2FuaXNhdGlvbklkID0gbmV3IENmbk91dHB1dCh0aGlzLCBcIk9yZ2FuaXNhdGlvbklkT3V0cHV0XCIsIHtcbiAgICAgIGtleTogXCJPcmdhbmlzYXRpb25JZFwiLFxuICAgICAgdmFsdWU6IG9yZ2FuaXNhdGlvbi5nZXRSZXNwb25zZUZpZWxkKFwiT3JnYW5pemF0aW9uLklkXCIpLFxuICAgICAgZXhwb3J0TmFtZTogXCJPcmdhbmlzYXRpb25JZFwiXG4gICAgfSk7XG5cbiAgICB0aGlzLm9yZ2FuaXNhdGlvbkFjY291bnRBcm4gPSBuZXcgQ2ZuT3V0cHV0KFxuICAgICAgdGhpcyxcbiAgICAgIFwiT3JnYW5pc2F0aW9uQWNjb3VudEFybk91dHB1dFwiLFxuICAgICAge1xuICAgICAgICBrZXk6IFwiT3JnYW5pc2F0aW9uQWNjb3VudEFyblwiLFxuICAgICAgICB2YWx1ZTogb3JnYW5pc2F0aW9uLmdldFJlc3BvbnNlRmllbGQoXCJPcmdhbml6YXRpb24uTWFzdGVyQWNjb3VudEFyblwiKSxcbiAgICAgICAgZXhwb3J0TmFtZTogXCJPcmdhbmlzYXRpb25BY2NvdW50QXJuXCJcbiAgICAgIH1cbiAgICApO1xuICB9XG59XG4iXX0=

package/dist/lib/config/aws/organisationsAccess.d.ts

@@ -0,0 +1,10 @@
+import { Construct } from "constructs";
+import { type StackProps } from "aws-cdk-lib";
+interface ActivateOrganisationsAccessProps extends StackProps {
+    account: string;
+    region: string;
+}
+export declare class ActivateOrganisationsAccess extends Construct {
+    constructor(scope: Construct, id: string, props: ActivateOrganisationsAccessProps);
+}
+export {};

package/dist/lib/config/aws/organisationsAccess.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActivateOrganisationsAccess = void 0;
+const customResources = require("aws-cdk-lib/custom-resources");
+const constructs_1 = require("constructs");
+const awsCustomResource_1 = require("../../resources/aws/utilities/awsCustomResource");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+class ActivateOrganisationsAccess extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        new awsCustomResource_1.AwsCustomResource(this, "activateOrganisationsAccess", {
+            functionName: "activateOrganisationsAccess",
+            onCreate: {
+                service: "cloudformation",
+                action: "ActivateOrganizationsAccessCommand", // https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cloudformation/command/ActivateOrganizationsAccessCommand/
+                parameters: {},
+                physicalResourceId: customResources.PhysicalResourceId.of("activateOrganisationsAccess")
+            },
+            resourceType: "Custom::ActivateOrganisationsAccess",
+            policy: customResources.AwsCustomResourcePolicy.fromStatements([
+                new aws_iam_1.PolicyStatement({
+                    actions: [
+                        "cloudformation:ActivateOrganizationsAccess",
+                        "cloudformation:DescribeOrganizationsAccess",
+                        "organizations:EnableAWSServiceAccess",
+                        "organizations:DescribeOrganization",
+                        "organizations:ListRoots",
+                        "organizations:ListAWSServiceAccessForOrganization",
+                        "organizations:DisableAWSServiceAccess",
+                        "iam:CreateServiceLinkedRole",
+                        "iam:GetRole"
+                    ],
+                    resources: [
+                        "*" // TODO: Figure out what access is required here
+                    ],
+                    effect: aws_iam_1.Effect.ALLOW
+                }),
+                new aws_iam_1.PolicyStatement({
+                    actions: ["cloudformation:ActivateOrganizationsAccess"],
+                    resources: [
+                        `arn:aws:cloudformation:${props.region}:${props.account}:stackset/*`
+                    ],
+                    effect: aws_iam_1.Effect.ALLOW
+                })
+            ])
+        });
+    }
+}
+exports.ActivateOrganisationsAccess = ActivateOrganisationsAccess;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3JnYW5pc2F0aW9uc0FjY2Vzcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL2xpYi9jb25maWcvYXdzL29yZ2FuaXNhdGlvbnNBY2Nlc3MudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsZ0VBQWdFO0FBQ2hFLDJDQUF1QztBQUV2Qyx1RkFBb0Y7QUFDcEYsaURBQThEO0FBUTlELE1BQWEsMkJBQTRCLFNBQVEsc0JBQVM7SUFDeEQsWUFDRSxLQUFnQixFQUNoQixFQUFVLEVBQ1YsS0FBdUM7UUFFdkMsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUVqQixJQUFJLHFDQUFpQixDQUFDLElBQUksRUFBRSw2QkFBNkIsRUFBRTtZQUN6RCxZQUFZLEVBQUUsNkJBQTZCO1lBQzNDLFFBQVEsRUFBRTtnQkFDUixPQUFPLEVBQUUsZ0JBQWdCO2dCQUN6QixNQUFNLEVBQUUsb0NBQW9DLEVBQUUsMkhBQTJIO2dCQUN6SyxVQUFVLEVBQUUsRUFBRTtnQkFDZCxrQkFBa0IsRUFBRSxlQUFlLENBQUMsa0JBQWtCLENBQUMsRUFBRSxDQUN2RCw2QkFBNkIsQ0FDOUI7YUFDRjtZQUNELFlBQVksRUFBRSxxQ0FBcUM7WUFDbkQsTUFBTSxFQUFFLGVBQWUsQ0FBQyx1QkFBdUIsQ0FBQyxjQUFjLENBQUM7Z0JBQzdELElBQUkseUJBQWUsQ0FBQztvQkFDbEIsT0FBTyxFQUFFO3dCQUNQLDRDQUE0Qzt3QkFDNUMsNENBQTRDO3dCQUM1QyxzQ0FBc0M7d0JBQ3RDLG9DQUFvQzt3QkFDcEMseUJBQXlCO3dCQUN6QixtREFBbUQ7d0JBQ25ELHVDQUF1Qzt3QkFDdkMsNkJBQTZCO3dCQUM3QixhQUFhO3FCQUNkO29CQUNELFNBQVMsRUFBRTt3QkFDVCxHQUFHLENBQUMsZ0RBQWdEO3FCQUNyRDtvQkFDRCxNQUFNLEVBQUUsZ0JBQU0sQ0FBQyxLQUFLO2lCQUNyQixDQUFDO2dCQUNGLElBQUkseUJBQWUsQ0FBQztvQkFDbEIsT0FBTyxFQUFFLENBQUMsNENBQTRDLENBQUM7b0JBQ3ZELFNBQVMsRUFBRTt3QkFDVCwwQkFBMEIsS0FBSyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsT0FBTyxhQUFhO3FCQUNyRTtvQkFDRCxNQUFNLEVBQUUsZ0JBQU0sQ0FBQyxLQUFLO2lCQUNyQixDQUFDO2FBQ0gsQ0FBQztTQUNILENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQS9DRCxrRUErQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBjdXN0b21SZXNvdXJjZXMgZnJvbSBcImF3cy1jZGstbGliL2N1c3RvbS1yZXNvdXJjZXNcIjtcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5cbmltcG9ydCB7IEF3c0N1c3RvbVJlc291cmNlIH0gZnJvbSBcIi4uLy4uL3Jlc291cmNlcy9hd3MvdXRpbGl0aWVzL2F3c0N1c3RvbVJlc291cmNlXCI7XG5pbXBvcnQgeyBFZmZlY3QsIFBvbGljeVN0YXRlbWVudCB9IGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtaWFtXCI7XG5pbXBvcnQgeyB0eXBlIFN0YWNrUHJvcHMgfSBmcm9tIFwiYXdzLWNkay1saWJcIjtcblxuaW50ZXJmYWNlIEFjdGl2YXRlT3JnYW5pc2F0aW9uc0FjY2Vzc1Byb3BzIGV4dGVuZHMgU3RhY2tQcm9wcyB7XG4gIGFjY291bnQ6IHN0cmluZztcbiAgcmVnaW9uOiBzdHJpbmc7XG59XG5cbmV4cG9ydCBjbGFzcyBBY3RpdmF0ZU9yZ2FuaXNhdGlvbnNBY2Nlc3MgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBjb25zdHJ1Y3RvcihcbiAgICBzY29wZTogQ29uc3RydWN0LFxuICAgIGlkOiBzdHJpbmcsXG4gICAgcHJvcHM6IEFjdGl2YXRlT3JnYW5pc2F0aW9uc0FjY2Vzc1Byb3BzXG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBuZXcgQXdzQ3VzdG9tUmVzb3VyY2UodGhpcywgXCJhY3RpdmF0ZU9yZ2FuaXNhdGlvbnNBY2Nlc3NcIiwge1xuICAgICAgZnVuY3Rpb25OYW1lOiBcImFjdGl2YXRlT3JnYW5pc2F0aW9uc0FjY2Vzc1wiLFxuICAgICAgb25DcmVhdGU6IHtcbiAgICAgICAgc2VydmljZTogXCJjbG91ZGZvcm1hdGlvblwiLFxuICAgICAgICBhY3Rpb246IFwiQWN0aXZhdGVPcmdhbml6YXRpb25zQWNjZXNzQ29tbWFuZFwiLCAvLyBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vQVdTSmF2YVNjcmlwdFNESy92My9sYXRlc3QvY2xpZW50L2Nsb3VkZm9ybWF0aW9uL2NvbW1hbmQvQWN0aXZhdGVPcmdhbml6YXRpb25zQWNjZXNzQ29tbWFuZC9cbiAgICAgICAgcGFyYW1ldGVyczoge30sXG4gICAgICAgIHBoeXNpY2FsUmVzb3VyY2VJZDogY3VzdG9tUmVzb3VyY2VzLlBoeXNpY2FsUmVzb3VyY2VJZC5vZihcbiAgICAgICAgICBcImFjdGl2YXRlT3JnYW5pc2F0aW9uc0FjY2Vzc1wiXG4gICAgICAgIClcbiAgICAgIH0sXG4gICAgICByZXNvdXJjZVR5cGU6IFwiQ3VzdG9tOjpBY3RpdmF0ZU9yZ2FuaXNhdGlvbnNBY2Nlc3NcIixcbiAgICAgIHBvbGljeTogY3VzdG9tUmVzb3VyY2VzLkF3c0N1c3RvbVJlc291cmNlUG9saWN5LmZyb21TdGF0ZW1lbnRzKFtcbiAgICAgICAgbmV3IFBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICAgXCJjbG91ZGZvcm1hdGlvbjpBY3RpdmF0ZU9yZ2FuaXphdGlvbnNBY2Nlc3NcIixcbiAgICAgICAgICAgIFwiY2xvdWRmb3JtYXRpb246RGVzY3JpYmVPcmdhbml6YXRpb25zQWNjZXNzXCIsXG4gICAgICAgICAgICBcIm9yZ2FuaXphdGlvbnM6RW5hYmxlQVdTU2VydmljZUFjY2Vzc1wiLFxuICAgICAgICAgICAgXCJvcmdhbml6YXRpb25zOkRlc2NyaWJlT3JnYW5pemF0aW9uXCIsXG4gICAgICAgICAgICBcIm9yZ2FuaXphdGlvbnM6TGlzdFJvb3RzXCIsXG4gICAgICAgICAgICBcIm9yZ2FuaXphdGlvbnM6TGlzdEFXU1NlcnZpY2VBY2Nlc3NGb3JPcmdhbml6YXRpb25cIixcbiAgICAgICAgICAgIFwib3JnYW5pemF0aW9uczpEaXNhYmxlQVdTU2VydmljZUFjY2Vzc1wiLFxuICAgICAgICAgICAgXCJpYW06Q3JlYXRlU2VydmljZUxpbmtlZFJvbGVcIixcbiAgICAgICAgICAgIFwiaWFtOkdldFJvbGVcIlxuICAgICAgICAgIF0sXG4gICAgICAgICAgcmVzb3VyY2VzOiBbXG4gICAgICAgICAgICBcIipcIiAvLyBUT0RPOiBGaWd1cmUgb3V0IHdoYXQgYWNjZXNzIGlzIHJlcXVpcmVkIGhlcmVcbiAgICAgICAgICBdLFxuICAgICAgICAgIGVmZmVjdDogRWZmZWN0LkFMTE9XXG4gICAgICAgIH0pLFxuICAgICAgICBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgICBhY3Rpb25zOiBbXCJjbG91ZGZvcm1hdGlvbjpBY3RpdmF0ZU9yZ2FuaXphdGlvbnNBY2Nlc3NcIl0sXG4gICAgICAgICAgcmVzb3VyY2VzOiBbXG4gICAgICAgICAgICBgYXJuOmF3czpjbG91ZGZvcm1hdGlvbjoke3Byb3BzLnJlZ2lvbn06JHtwcm9wcy5hY2NvdW50fTpzdGFja3NldC8qYFxuICAgICAgICAgIF0sXG4gICAgICAgICAgZWZmZWN0OiBFZmZlY3QuQUxMT1dcbiAgICAgICAgfSlcbiAgICAgIF0pXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/dist/lib/config/aws/ramSharing.d.ts

@@ -0,0 +1,4 @@
+import { Construct } from "constructs";
+export declare class RamSharing extends Construct {
+    constructor(scope: Construct, id: string);
+}

package/dist/lib/config/aws/ramSharing.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RamSharing = void 0;
+const customResources = require("aws-cdk-lib/custom-resources");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const constructs_1 = require("constructs");
+const awsCustomResource_1 = require("../../resources/aws/utilities/awsCustomResource");
+class RamSharing extends constructs_1.Construct {
+    constructor(scope, id) {
+        super(scope, id);
+        new awsCustomResource_1.AwsCustomResource(this, "enableRamSharing", {
+            functionName: "enableRamSharing",
+            onCreate: {
+                service: "RAM",
+                action: "enableSharingWithAwsOrganization", // https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/RAM.html#enableSharingWithAwsOrganization-property
+                parameters: {},
+                physicalResourceId: customResources.PhysicalResourceId.of("enableRamSharing")
+            },
+            resourceType: "Custom::ram",
+            policy: customResources.AwsCustomResourcePolicy.fromStatements([
+                new aws_iam_1.PolicyStatement({
+                    actions: [
+                        "ram:EnableSharingWithAwsOrganization",
+                        "iam:CreateServiceLinkedRole",
+                        "organizations:enableAWSServiceAccess",
+                        "organizations:DescribeOrganization"
+                    ],
+                    resources: ["*"] // TODO: Find out the exact pricipal for this
+                })
+            ])
+        });
+    }
+}
+exports.RamSharing = RamSharing;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmFtU2hhcmluZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL2xpYi9jb25maWcvYXdzL3JhbVNoYXJpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsZ0VBQWdFO0FBQ2hFLGlEQUFzRDtBQUN0RCwyQ0FBdUM7QUFFdkMsdUZBQW9GO0FBRXBGLE1BQWEsVUFBVyxTQUFRLHNCQUFTO0lBQ3ZDLFlBQVksS0FBZ0IsRUFBRSxFQUFVO1FBQ3RDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsSUFBSSxxQ0FBaUIsQ0FBQyxJQUFJLEVBQUUsa0JBQWtCLEVBQUU7WUFDOUMsWUFBWSxFQUFFLGtCQUFrQjtZQUNoQyxRQUFRLEVBQUU7Z0JBQ1IsT0FBTyxFQUFFLEtBQUs7Z0JBQ2QsTUFBTSxFQUFFLGtDQUFrQyxFQUFFLDZHQUE2RztnQkFDekosVUFBVSxFQUFFLEVBQUU7Z0JBQ2Qsa0JBQWtCLEVBQ2hCLGVBQWUsQ0FBQyxrQkFBa0IsQ0FBQyxFQUFFLENBQUMsa0JBQWtCLENBQUM7YUFDNUQ7WUFDRCxZQUFZLEVBQUUsYUFBYTtZQUMzQixNQUFNLEVBQUUsZUFBZSxDQUFDLHVCQUF1QixDQUFDLGNBQWMsQ0FBQztnQkFDN0QsSUFBSSx5QkFBZSxDQUFDO29CQUNsQixPQUFPLEVBQUU7d0JBQ1Asc0NBQXNDO3dCQUN0Qyw2QkFBNkI7d0JBQzdCLHNDQUFzQzt3QkFDdEMsb0NBQW9DO3FCQUNyQztvQkFDRCxTQUFTLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyw2Q0FBNkM7aUJBQy9ELENBQUM7YUFDSCxDQUFDO1NBQ0gsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBM0JELGdDQTJCQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGN1c3RvbVJlc291cmNlcyBmcm9tIFwiYXdzLWNkay1saWIvY3VzdG9tLXJlc291cmNlc1wiO1xuaW1wb3J0IHsgUG9saWN5U3RhdGVtZW50IH0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1pYW1cIjtcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCI7XG5cbmltcG9ydCB7IEF3c0N1c3RvbVJlc291cmNlIH0gZnJvbSBcIi4uLy4uL3Jlc291cmNlcy9hd3MvdXRpbGl0aWVzL2F3c0N1c3RvbVJlc291cmNlXCI7XG5cbmV4cG9ydCBjbGFzcyBSYW1TaGFyaW5nIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBuZXcgQXdzQ3VzdG9tUmVzb3VyY2UodGhpcywgXCJlbmFibGVSYW1TaGFyaW5nXCIsIHtcbiAgICAgIGZ1bmN0aW9uTmFtZTogXCJlbmFibGVSYW1TaGFyaW5nXCIsXG4gICAgICBvbkNyZWF0ZToge1xuICAgICAgICBzZXJ2aWNlOiBcIlJBTVwiLFxuICAgICAgICBhY3Rpb246IFwiZW5hYmxlU2hhcmluZ1dpdGhBd3NPcmdhbml6YXRpb25cIiwgLy8gaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL0FXU0phdmFTY3JpcHRTREsvbGF0ZXN0L0FXUy9SQU0uaHRtbCNlbmFibGVTaGFyaW5nV2l0aEF3c09yZ2FuaXphdGlvbi1wcm9wZXJ0eVxuICAgICAgICBwYXJhbWV0ZXJzOiB7fSxcbiAgICAgICAgcGh5c2ljYWxSZXNvdXJjZUlkOlxuICAgICAgICAgIGN1c3RvbVJlc291cmNlcy5QaHlzaWNhbFJlc291cmNlSWQub2YoXCJlbmFibGVSYW1TaGFyaW5nXCIpXG4gICAgICB9LFxuICAgICAgcmVzb3VyY2VUeXBlOiBcIkN1c3RvbTo6cmFtXCIsXG4gICAgICBwb2xpY3k6IGN1c3RvbVJlc291cmNlcy5Bd3NDdXN0b21SZXNvdXJjZVBvbGljeS5mcm9tU3RhdGVtZW50cyhbXG4gICAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICAgIGFjdGlvbnM6IFtcbiAgICAgICAgICAgIFwicmFtOkVuYWJsZVNoYXJpbmdXaXRoQXdzT3JnYW5pemF0aW9uXCIsXG4gICAgICAgICAgICBcImlhbTpDcmVhdGVTZXJ2aWNlTGlua2VkUm9sZVwiLFxuICAgICAgICAgICAgXCJvcmdhbml6YXRpb25zOmVuYWJsZUFXU1NlcnZpY2VBY2Nlc3NcIixcbiAgICAgICAgICAgIFwib3JnYW5pemF0aW9uczpEZXNjcmliZU9yZ2FuaXphdGlvblwiXG4gICAgICAgICAgXSxcbiAgICAgICAgICByZXNvdXJjZXM6IFtcIipcIl0gLy8gVE9ETzogRmluZCBvdXQgdGhlIGV4YWN0IHByaWNpcGFsIGZvciB0aGlzXG4gICAgICAgIH0pXG4gICAgICBdKVxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/dist/lib/config/monitoring.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Monitoring configuration for cross-account access
+ */
+export declare const FJALL_MONITORING_CONFIG: {
+    /**
+     * Fjall webapp AWS account ID
+     * This account will be granted permission to assume monitoring roles
+     */
+    readonly webappAwsAccountId: "985539798308";
+    /**
+     * IAM role naming convention
+     */
+    readonly roleNamePrefix: "FjallMonitoring";
+    /**
+     * IAM role path (for organizational structure)
+     */
+    readonly rolePath: "/";
+};

package/dist/lib/config/monitoring.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FJALL_MONITORING_CONFIG = void 0;
+/**
+ * Monitoring configuration for cross-account access
+ */
+exports.FJALL_MONITORING_CONFIG = {
+    /**
+     * Fjall webapp AWS account ID
+     * This account will be granted permission to assume monitoring roles
+     */
+    webappAwsAccountId: "985539798308", // Fjall platform account
+    /**
+     * IAM role naming convention
+     */
+    roleNamePrefix: "FjallMonitoring",
+    /**
+     * IAM role path (for organizational structure)
+     */
+    rolePath: "/"
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibW9uaXRvcmluZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL2xpYi9jb25maWcvbW9uaXRvcmluZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQTs7R0FFRztBQUNVLFFBQUEsdUJBQXVCLEdBQUc7SUFDckM7OztPQUdHO0lBQ0gsa0JBQWtCLEVBQUUsY0FBYyxFQUFFLHlCQUF5QjtJQUU3RDs7T0FFRztJQUNILGNBQWMsRUFBRSxpQkFBaUI7SUFFakM7O09BRUc7SUFDSCxRQUFRLEVBQUUsR0FBRztDQUNMLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIE1vbml0b3JpbmcgY29uZmlndXJhdGlvbiBmb3IgY3Jvc3MtYWNjb3VudCBhY2Nlc3NcbiAqL1xuZXhwb3J0IGNvbnN0IEZKQUxMX01PTklUT1JJTkdfQ09ORklHID0ge1xuICAvKipcbiAgICogRmphbGwgd2ViYXBwIEFXUyBhY2NvdW50IElEXG4gICAqIFRoaXMgYWNjb3VudCB3aWxsIGJlIGdyYW50ZWQgcGVybWlzc2lvbiB0byBhc3N1bWUgbW9uaXRvcmluZyByb2xlc1xuICAgKi9cbiAgd2ViYXBwQXdzQWNjb3VudElkOiBcIjk4NTUzOTc5ODMwOFwiLCAvLyBGamFsbCBwbGF0Zm9ybSBhY2NvdW50XG5cbiAgLyoqXG4gICAqIElBTSByb2xlIG5hbWluZyBjb252ZW50aW9uXG4gICAqL1xuICByb2xlTmFtZVByZWZpeDogXCJGamFsbE1vbml0b3JpbmdcIixcblxuICAvKipcbiAgICogSUFNIHJvbGUgcGF0aCAoZm9yIG9yZ2FuaXphdGlvbmFsIHN0cnVjdHVyZSlcbiAgICovXG4gIHJvbGVQYXRoOiBcIi9cIlxufSBhcyBjb25zdDtcbiJdfQ==

package/dist/lib/lambda-assets/static-site-forms/asset/index.js

@@ -0,0 +1,175 @@
+/**
+ * Static-site contact-form handler (Lambda Function URL → SES).
+ *
+ * Authored directly under asset/ as CJS — the only dependency,
+ * @aws-sdk/client-sesv2, ships in the Lambda Node 22 runtime, so there is no
+ * build step. asset/package.json pins CJS resolution.
+ *
+ * Security posture (Function URL authType NONE — see staticSite.ts). The
+ * endpoint is public and unauthenticated. Be precise about what each control
+ * actually buys, because it is easy to mistake this for authentication:
+ * - The Origin/Referer check stops a browser on another site from POSTing here
+ *   (it cannot forge those headers). It does NOT stop a non-browser client,
+ *   which sets them freely. It is a nuisance filter, not an auth gate.
+ * - A populated honeypot field (_gotcha) marks a bot → silent 200, no send.
+ * - What actually bounds abuse: the function's reserved concurrency (capped in
+ *   staticSite.ts, so a flood cannot drain account-wide Lambda concurrency),
+ *   SES account send limits, and the fact that both sender and recipient are
+ *   fixed at deploy time — whatever a caller sends, the mail can only ever go
+ *   from noreply@<domain> to the site owner.
+ *
+ * Logging discipline: status + requestId + SES error NAME only — never the
+ * parsed body or the recipient address (both are submitter PII).
+ */
+"use strict";
+
+const { SESv2Client, SendEmailCommand } = require("@aws-sdk/client-sesv2");
+
+const client = new SESv2Client({});
+
+const CONTACT_TO = process.env.CONTACT_TO;
+const CONTACT_FROM = process.env.CONTACT_FROM;
+const ALLOWED_ORIGIN = process.env.ALLOWED_ORIGIN;
+
+const MAX_NAME = 200;
+const MAX_EMAIL = 320;
+const MAX_MESSAGE = 5000;
+
+exports.handler = async (event) => {
+  const requestId = event?.requestContext?.requestId ?? "unknown";
+  const method = event?.requestContext?.http?.method ?? "";
+
+  if (method !== "POST") {
+    return respond(405, { error: "Method not allowed" });
+  }
+
+  const headers = normaliseHeaders(event?.headers);
+  if (!originAllowed(headers)) {
+    log("warn", "origin rejected", requestId);
+    return respond(403, { error: "Forbidden" });
+  }
+
+  let fields;
+  try {
+    fields = parseBody(event);
+  } catch {
+    log("warn", "invalid body", requestId);
+    return respond(400, { error: "Invalid request body" });
+  }
+
+  // Populated honeypot ⇒ bot: pretend success so it does not probe further.
+  if (typeof fields._gotcha === "string" && fields._gotcha.trim() !== "") {
+    return respond(200, { ok: true });
+  }
+
+  const name = String(fields.name ?? "").slice(0, MAX_NAME);
+  const email = String(fields.email ?? "").slice(0, MAX_EMAIL);
+  const message = String(fields.message ?? "").slice(0, MAX_MESSAGE);
+
+  if (message.trim() === "") {
+    return respond(400, { error: "Message is required" });
+  }
+
+  try {
+    await client.send(
+      new SendEmailCommand({
+        FromEmailAddress: CONTACT_FROM,
+        Destination: { ToAddresses: [CONTACT_TO] },
+        ...(isValidEmail(email) && { ReplyToAddresses: [email] }),
+        Content: {
+          Simple: {
+            Subject: {
+              Data: `Contact form: ${name || "(no name)"}`.slice(0, MAX_NAME)
+            },
+            Body: { Text: { Data: buildBody(name, email, message) } }
+          }
+        }
+      })
+    );
+    log("info", "sent", requestId);
+    return respond(200, { ok: true });
+  } catch (err) {
+    log("error", "ses send failed", requestId, err?.name);
+    return respond(502, { error: "Failed to send message" });
+  }
+};
+
+function normaliseHeaders(headers) {
+  const out = {};
+  if (headers && typeof headers === "object") {
+    for (const [key, value] of Object.entries(headers)) {
+      out[key.toLowerCase()] = value;
+    }
+  }
+  return out;
+}
+
+function originAllowed(headers) {
+  if (!ALLOWED_ORIGIN) return false;
+  const origin = headers.origin;
+  if (origin) return origin === ALLOWED_ORIGIN;
+  // Some clients omit Origin on same-site POSTs — fall back to the Referer's
+  // origin. Compare whole origins: a prefix test would accept a Referer of
+  // https://example.com.attacker.test/ for ALLOWED_ORIGIN https://example.com.
+  const referer = headers.referer;
+  if (referer) return originOf(referer) === ALLOWED_ORIGIN;
+  return false;
+}
+
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return undefined;
+  }
+}
+
+function parseBody(event) {
+  const raw =
+    event?.isBase64Encoded && typeof event.body === "string"
+      ? Buffer.from(event.body, "base64").toString("utf8")
+      : (event?.body ?? "");
+  const trimmed = raw.trim();
+  if (trimmed.startsWith("{")) {
+    return JSON.parse(trimmed);
+  }
+  // application/x-www-form-urlencoded fallback
+  const params = new URLSearchParams(trimmed);
+  const fields = {};
+  for (const [key, value] of params.entries()) {
+    fields[key] = value;
+  }
+  return fields;
+}
+
+function isValidEmail(value) {
+  return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value);
+}
+
+function buildBody(name, email, message) {
+  return [
+    `Name: ${name || "(not provided)"}`,
+    `Email: ${email || "(not provided)"}`,
+    "",
+    message
+  ].join("\n");
+}
+
+function respond(statusCode, body) {
+  return {
+    statusCode,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  };
+}
+
+function log(level, msg, requestId, errorName) {
+  console.log(
+    JSON.stringify({
+      level,
+      msg,
+      requestId,
+      ...(errorName && { error: errorName })
+    })
+  );
+}

package/dist/lib/lambda-assets/static-site-forms/asset/package.json

@@ -0,0 +1,4 @@
+{
+  "type": "commonjs",
+  "private": true
+}

package/dist/lib/patterns/aws/cdn.d.ts

@@ -2,10 +2,11 @@ import { type Construct } from "constructs";
 import { type IBucket } from "aws-cdk-lib/aws-s3";
 import { type IApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { type ICertificate } from "aws-cdk-lib/aws-certificatemanager";
-import { type ICachePolicy } from "aws-cdk-lib/aws-cloudfront";
+import { type ICachePolicy, type IResponseHeadersPolicy } from "aws-cdk-lib/aws-cloudfront";
 import type App from "../../app.js";
 import { CloudFrontDistribution, type CachePolicyPreset, type AccessGateConfig } from "../../resources/aws/cdn/index.js";
 import { type ICdn } from "./interfaces/cdn.js";
+import type { StaticSiteRouting } from "@fjall/util";
 import { type Storage } from "./storage.js";
 import { type AnyCompute } from "./compute.js";
 /**
@@ -32,7 +33,24 @@ export interface S3CdnProps extends BaseCdnProps {
     originType: "s3";
     bucket: IBucket | Storage;
     originPath?: string;
+    /** OAI (default) or OAC (single-stack only — see cloudFront.ts). */
+    originAccess?: "oai" | "oac";
+    /** Object served for `/` (static sites: "index.html"). */
+    defaultRootObject?: string;
+    /** "multipage" → clean-URL `.html` rewriting; "spa" → 403/404 fallback to index. */
+    routing?: StaticSiteRouting;
+    /** Security-headers policy (built by the caller, e.g. SecurityHeadersPolicy). */
+    responseHeadersPolicy?: IResponseHeadersPolicy;
+    /**
+     * Origin-request policy for the default behaviour. Defaults to forwarding
+     * viewer headers, as every distribution has since before the static-site
+     * pattern. `none` suits an origin that ignores them — S3 serves objects by
+     * key — but it is opt-in: flipping the default would strip
+     * `OriginRequestPolicyId` from live distributions on their next deploy.
+     */
+    originRequestPolicy?: "all-viewer-except-host" | "none";
 }
+export type { StaticSiteRouting };
 /**
  * ALB origin CDN props - use with Application Load Balancer
  */
@@ -135,4 +153,3 @@ export declare class CdnFactory {
      */
     static build(id: string, props: ICdnProps): (_app: App, scope: Construct) => Cdn;
 }
-export {};

package/dist/lib/patterns/aws/cdn.js

@@ -71,6 +71,15 @@ export class Cdn extends CloudFrontDistribution {
             (props.certificateArn
                 ? Certificate.fromCertificateArn(scope, `${id}Certificate`, props.certificateArn)
                 : undefined);
+        const s3Routing = props.originType === "s3"
+            ? {
+                defaultRootObject: props.defaultRootObject,
+                cleanUrls: props.routing === "multipage",
+                spaFallback: props.routing === "spa",
+                responseHeadersPolicy: props.responseHeadersPolicy,
+                originRequestPolicy: props.originRequestPolicy
+            }
+            : {};
         return {
             defaultOrigin,
             defaultCachePolicy: props.cachePolicy,
@@ -83,7 +92,8 @@ export class Cdn extends CloudFrontDistribution {
             logBucket: props.logBucket,
             priceClass: props.priceClass,
             forwardHostHeader: props.forwardHostHeader,
-            accessGate: props.accessGate
+            accessGate: props.accessGate,
+            ...s3Routing
         };
     }
     /**
@@ -112,7 +122,8 @@ export class Cdn extends CloudFrontDistribution {
                 return {
                     type: "s3",
                     bucket,
-                    originPath: props.originPath
+                    originPath: props.originPath,
+                    originAccess: props.originAccess
                 };
             }
             case "alb": {