@fjall/components-infrastructure 2.33.0 → 2.34.0

package/dist/lib/app.js

@@ -20,6 +20,7 @@ import { FjallLogger } from "./utils/validationLogger.js";
 import { getManifestCollector, writeManifest } from "./utils/manifestWriter.js";
 import { toPascalCase, toKebab } from "./utils/capitaliseString.js";
 import { COST_ALLOCATION_TAGS } from "./utils/costAllocationTags.js";
+import { DEFAULT_ORG_ID, resolveOrgId } from "./utils/cdkContext.js";
 /**
  * The basic corner-stone of all Fjall-hosted applications.
  *  This class is a singleton and should be used to create and manage
@@ -702,6 +703,15 @@ export class App extends CdkApp {
     }
     applyTagsAspect() {
         if (!this.aspectApplied && Object.keys(this.globalTags).length > 0) {
+            // Owner fallback resolves lazily HERE, not in initialiseStandardTags:
+            // at construction the orgId context may not be set yet, and an explicit
+            // addTags owner must win — by this point it is already in globalTags.
+            if (this.globalTags[COST_ALLOCATION_TAGS.OWNER] === undefined) {
+                const orgId = resolveOrgId(this.node);
+                if (orgId !== undefined && orgId !== DEFAULT_ORG_ID) {
+                    this.globalTags[COST_ALLOCATION_TAGS.OWNER] = orgId;
+                }
+            }
             // Apply standard tags using Tags.of(this).add()
             for (const [key, value] of Object.entries(this.globalTags)) {
                 Tags.of(this).add(key, value);
@@ -748,7 +758,11 @@ export class App extends CdkApp {
         return this.manifestCollector;
     }
     synth(options) {
-        // Call parent synth first
+        // Tagging is an invariant of synthesis, not of getStack(): governance
+        // stacks (Organisation/Account/Platform) and raw `extends Stack` classes
+        // attach directly to the App and never call getStack(), so without this
+        // they synthesise untagged. Idempotent via the aspectApplied guard.
+        this.applyTagsAspect();
         const assembly = super.synth(options);
         // After synthesis, write Fjall manifest to cdk.out
         try {

package/dist/lib/patterns/aws/account.js

@@ -1,4 +1,4 @@
-import { CfnOutput, Stack } from "aws-cdk-lib";
+import { CfnOutput, Stack, Tags } from "aws-cdk-lib";
 import { EcrDefaultImage, SharedAlarmTopic } from "../../config/aws/index.js";
 import { ManagementEventsTrail } from "../../config/aws/cloudTrail.js";
 import { OidcConnector } from "../../config/aws/oidcConnector.js";
@@ -6,6 +6,7 @@ import { AccountMonitoringRole } from "../../config/aws/accountMonitoringRole.js
 import { AccountAuditRole } from "../../config/aws/accountAuditRole.js";
 import { CDK_CONTEXT_KEYS, resolveAccountTrailState } from "../../utils/cdkContext.js";
 import { getConfig } from "../../utils/getConfig.js";
+import { COST_ALLOCATION_TAGS } from "../../utils/costAllocationTags.js";
 import { DisasterRecovery } from "../../config/aws/disasterRecovery.js";
 import { S3BlockPublicAccess } from "../../config/aws/s3BlockPublicAccess.js";
 import { EbsDefaultEncryption } from "../../config/aws/ebsDefaultEncryption.js";
@@ -28,6 +29,10 @@ export class Account extends Stack {
         }
         const env = props.env ?? { region, account: accountId };
         super(scope, id, { ...props, env });
+        // Governance apps never name the App, so the App-level service tag would
+        // read "FjallApp"; the stack-scope tag wins over App scope and names the
+        // governance tier instead ("Organisation"/"Account"/"Platform").
+        Tags.of(this).add(COST_ALLOCATION_TAGS.SERVICE, id);
         this.resolvedRegion = region ?? this.region;
         const orgId = this.node.tryGetContext(CDK_CONTEXT_KEYS.ORG_ID);
         if (orgId) {

package/dist/lib/patterns/aws/computeEcs.js

@@ -13,6 +13,7 @@ import { resolveImportedSecret } from "../../resources/aws/secrets/index.js";
 import App from "../../app.js";
 import EcsCluster from "../../resources/aws/compute/ecs.js";
 import { createScheduledTaskDefinition, createMigrationTaskDefinition } from "../../resources/aws/compute/ecsTaskDefinition.js";
+import { DEFAULT_LOG_RETENTION } from "../../resources/aws/compute/ecsConstants.js";
 import { EcsLifecycleHookMigration } from "../../resources/aws/compute/ecsLifecycleHookMigration.js";
 import { Role } from "../../resources/aws/iam/role.js";
 import { LogGroup } from "../../resources/aws/logging/logGroup.js";
@@ -924,13 +925,16 @@ export class EcsCompute extends Construct {
                 });
             }
         }
+        // `logRetention` must not reach the driver: AwsLogDriver.bind() creates
+        // a raw RETAIN LogGroup inside aws-cdk-lib, escaping the env-aware
+        // removal default (D17).
+        const logGroup = entry.logGroup ??
+            new LogGroup(this, `${id}${toPascalCase(entry.name)}LogGroup`, {
+                retention: entry.logRetention ?? DEFAULT_LOG_RETENTION
+            });
         const logging = new AwsLogDriver({
             streamPrefix: `/ecs-scheduled/${id}/${entry.name}`,
-            ...(entry.logGroup !== undefined && { logGroup: entry.logGroup }),
-            ...(entry.logGroup === undefined &&
-                entry.logRetention !== undefined && {
-                logRetention: entry.logRetention
-            })
+            logGroup
         });
         const container = taskDef.addContainer(`${id}${toPascalCase(entry.name)}Container`, {
             image: entry.image,

package/dist/lib/patterns/aws/computeEcsTypes.d.ts

@@ -501,7 +501,11 @@ export interface EcsScheduledTaskConfig {
     secrets?: Record<string, EcsSecret>;
     /** Pre-existing CDK log group. Mutually exclusive with `logRetention`. */
     logGroup?: ILogGroup;
-    /** When `logGroup` is omitted, the awsLogs driver creates one with this retention. */
+    /**
+     * When `logGroup` is omitted, an explicit framework log group is created
+     * with this retention (default: `DEFAULT_LOG_RETENTION`) and the env-aware
+     * removal default (D17).
+     */
     logRetention?: RetentionDays;
     securityGroups?: ISecurityGroup[];
     subnetSelection?: SubnetSelection;

package/dist/lib/resources/aws/compute/ecsTaskDefinition.js

@@ -1,5 +1,5 @@
 import { AwsLogDriver, ContainerDependencyCondition, FargateTaskDefinition, Ec2TaskDefinition, NetworkMode, CpuArchitecture, OperatingSystemFamily } from "aws-cdk-lib/aws-ecs";
-import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import { Duration } from "aws-cdk-lib";
 import { Secret as EcsSecret } from "aws-cdk-lib/aws-ecs";
 import { StringParameter } from "aws-cdk-lib/aws-ssm";
 import { buildParameterPath } from "@fjall/util";
@@ -143,10 +143,10 @@ export function addContainersToTask(ctx, serviceName, serviceProps, taskDefiniti
     // Explicit so the cluster can attach metric filters (createLogPatternAlarms).
     // No logGroupName: CDK auto-names from the logical ID so it cannot collide
     // with the orphaned-retained old group during the implicit→explicit replace.
-    // RETAIN (never DESTROY): preserves fail-closed evidence and supports rollback.
+    // Removal: env-aware wrapper default (D17) — production RETAIN keeps
+    // fail-closed rollback evidence; non-production DESTROY avoids orphans.
     const logGroup = new LogGroup(ctx.scope, `${ctx.props.clusterName}${serviceName}LogGroup`, {
-        retention: DEFAULT_LOG_RETENTION,
-        removalPolicy: RemovalPolicy.RETAIN
+        retention: DEFAULT_LOG_RETENTION
     });
     for (const containerConfig of serviceProps.containers) {
         const image = getContainerImage(ctx, serviceName, containerConfig, serviceProps);

package/dist/lib/resources/aws/logging/logGroup.d.ts

@@ -7,6 +7,12 @@ import { type Construct } from "constructs";
  * would silently give sibling framework lambdas different retention.
  */
 export declare const DEFAULT_FRAMEWORK_LOG_RETENTION = Logs.RetentionDays.ONE_WEEK;
+/**
+ * Framework log group with an env-aware removal-policy default (D17).
+ * When no `removalPolicy` is passed, the default resolves via
+ * `envAwareRemovalPolicyDefault()` — production → RETAIN, other recognised
+ * stages → DESTROY, unrecognised values fail synth. An explicit prop wins.
+ */
 export declare class LogGroup extends Logs.LogGroup {
     constructor(scope: Construct, id: string, props?: Logs.LogGroupProps);
 }

package/dist/lib/resources/aws/logging/logGroup.js

@@ -1,4 +1,5 @@
 import * as Logs from "aws-cdk-lib/aws-logs";
+import { envAwareRemovalPolicyDefault, toRemovalPolicy } from "../../../utils/removalPolicy.js";
 /**
  * Default retention for framework-owned lambda log groups. Coupled across
  * every framework lambda construct (LambdaFunction, SingletonFunction, the
@@ -6,8 +7,17 @@ import * as Logs from "aws-cdk-lib/aws-logs";
  * would silently give sibling framework lambdas different retention.
  */
 export const DEFAULT_FRAMEWORK_LOG_RETENTION = Logs.RetentionDays.ONE_WEEK;
+/**
+ * Framework log group with an env-aware removal-policy default (D17).
+ * When no `removalPolicy` is passed, the default resolves via
+ * `envAwareRemovalPolicyDefault()` — production → RETAIN, other recognised
+ * stages → DESTROY, unrecognised values fail synth. An explicit prop wins.
+ */
 export class LogGroup extends Logs.LogGroup {
     constructor(scope, id, props) {
-        super(scope, id, props);
+        super(scope, id, {
+            ...props,
+            removalPolicy: props?.removalPolicy ?? toRemovalPolicy(envAwareRemovalPolicyDefault())
+        });
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.33.0",
+  "version": "2.34.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.33.0",
-    "@fjall/util": "^2.33.0",
+    "@fjall/generator": "^2.34.0",
+    "@fjall/util": "^2.34.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "61c0d1917597c6d02e8e78b03420afdd194eaafc"
+  "gitHead": "8c553fca8f9737d445061ea75cf6c6c7db0d24c9"
 }