@fjall/components-infrastructure 20.0.0 → 21.1.0

package/dist/lib/resources/aws/database/clickhouseMaintenanceScript.js

@@ -0,0 +1,131 @@
+/**
+ * Shell fragments shared by the two maintenance sidecars (OPTIMIZE FINAL and
+ * BACKUP), which both authenticate as `fjall_maintenance` under a
+ * `max_concurrent_queries_for_user = 1` cap.
+ *
+ * Two things the cap forces on every statement the sidecars issue:
+ *
+ * 1. **The migrate ↔ maintenance mutex.** A migration holds the DDL slot for
+ *    minutes; a maintenance job that started underneath it would either
+ *    contend for parts the migration is rewriting or — worse — make the
+ *    migration's own probes lose the slot. So each job opens with an activity
+ *    pre-flight (`buildControlPlaneActivityQuery` against the schema admin)
+ *    and exits `deferred` (0, a metric but no page) when a migration is under
+ *    way. The runner asks the mirror question about `fjall_maintenance`.
+ *
+ * 2. **`Code: 202` is a wait, not a failure.** With a cap of one, the second
+ *    query from the same identity is refused with TOO_MANY_SIMULTANEOUS_
+ *    QUERIES. That is the sibling sidecar (or this job's own previous
+ *    statement still winding down), so the statement runner sleeps with
+ *    bounded backoff and retries until `MAINTENANCE_BUSY_BUDGET_SECONDS` is
+ *    spent — only then is it a failure, and it says `reason=busy` so the
+ *    responder knows to look for the holder rather than the statement.
+ *
+ * Every marker goes to stderr. The backup script captures several statement
+ * results with `$(…)`, and a marker on stdout would land in the captured
+ * value; ECS awslogs carries both streams to the same log group, which is
+ * where the metric filters read them.
+ *
+ * `sh` only (the ClickHouse image's `/bin/sh` is dash): no `$RANDOM`, no
+ * arrays, no `pipefail`. Jitter comes from the nanosecond clock instead —
+ * `%s%N` rather than `%N`, because a bare `%N` is zero-padded and a leading
+ * zero makes dash read the number as octal.
+ *
+ * The TLS preamble these fragments follow sets `set -eu` ONLY when TLS is
+ * active, so nothing here relies on `-e`: every failure path is an explicit
+ * `||` / `if` branch and the function bodies use `… && return 0` shapes that
+ * behave identically with or without it.
+ */
+import { buildControlPlaneActivityQuery } from "@fjall/util/migration";
+import { MAINTENANCE_BUSY_BUDGET_SECONDS, MAINTENANCE_STATUS, maintenanceStatusMarker } from "./clickhouseConstants.js";
+/** Backoff between `Code: 202` retries: 5s doubling to a 60s cap, plus up to
+ *  `jitterSeconds` so two sidecars refused together do not retry together. */
+const BUSY_BACKOFF = {
+    baseSeconds: 5,
+    capSeconds: 60,
+    jitterSeconds: 5
+};
+/** ClickHouse TOO_MANY_SIMULTANEOUS_QUERIES as it appears on the client's
+ *  stderr. Matched as a substring of the captured stderr. */
+const BUSY_ERROR_TOKEN = "Code: 202";
+const STDERR_CAPTURE_FILE = "/tmp/fjall-ch-err";
+/** Runs a statement; on failure emits `status=failed reason=<label>` (or
+ *  `reason=busy label=<label>` when the busy budget ran out) and returns 1.
+ *  For statements whose failure the job treats as fatal. */
+export const MAINTENANCE_RUN_FN = "fjall_ch_run";
+/** Runs a statement with the same `Code: 202` retry loop but emits NO
+ *  failed-status marker on a non-busy failure — the caller owns that branch
+ *  (a tolerated read, or a statement with its own marker such as the backup
+ *  restore). The busy-exhausted marker is still emitted: a statement that
+ *  never got a slot is always a job failure. */
+export const MAINTENANCE_TRY_FN = "fjall_ch_try";
+const LABEL_PATTERN = /^[a-z][a-z0-9_]*$/;
+function markerLine(status, detail) {
+    return `echo "${maintenanceStatusMarker(status)} ${detail}" >&2`;
+}
+function assertLabel(label) {
+    if (!LABEL_PATTERN.test(label)) {
+        throw new Error(`ClickHouse maintenance statement label must match ${LABEL_PATTERN}, got '${label}'`);
+    }
+}
+/**
+ * Newline-joined preamble: sets `FJALL_JOB`, defines the two statement
+ * runners, then runs the activity pre-flight. Exits the script itself on
+ * `deferred` (0) or a probe failure (1), so the job body that follows only
+ * ever runs when no migration is active.
+ */
+export function buildMaintenancePreamble(params) {
+    const { client, job, schemaAdminName } = params;
+    const activityQuery = buildControlPlaneActivityQuery({
+        users: [schemaAdminName]
+    }).replace(/\s+/g, " ");
+    const tryFn = [
+        `${MAINTENANCE_TRY_FN}() {`,
+        `  _label="$1"; _sql="$2"; _pre=""; [ -n "\${3:-}" ] && _pre="timeout $3"`,
+        `  _deadline=$(( $(date +%s) + ${MAINTENANCE_BUSY_BUDGET_SECONDS} )); _delay=${BUSY_BACKOFF.baseSeconds}`,
+        `  while :; do`,
+        `    $_pre ${client} --query "$_sql" 2>"${STDERR_CAPTURE_FILE}" && return 0`,
+        `    _rc=$?`,
+        `    if ! grep -q "${BUSY_ERROR_TOKEN}" "${STDERR_CAPTURE_FILE}"; then cat "${STDERR_CAPTURE_FILE}" >&2; return "$_rc"; fi`,
+        `    if [ "$(date +%s)" -ge "$_deadline" ]; then cat "${STDERR_CAPTURE_FILE}" >&2; FJALL_CH_BUSY=1; ${markerLine(MAINTENANCE_STATUS.failed, "reason=busy label=$_label job=$FJALL_JOB")}; return 1; fi`,
+        `    echo "fjall:maintenance:busy label=$_label retry_in=\${_delay}s job=$FJALL_JOB" >&2`,
+        `    sleep $(( _delay + $(date +%s%N) % ${BUSY_BACKOFF.jitterSeconds} ))`,
+        `    _delay=$(( _delay * 2 )); [ "$_delay" -gt ${BUSY_BACKOFF.capSeconds} ] && _delay=${BUSY_BACKOFF.capSeconds}`,
+        `  done`,
+        `}`
+    ];
+    const runFn = [
+        `${MAINTENANCE_RUN_FN}() {`,
+        `  FJALL_CH_BUSY=0`,
+        `  ${MAINTENANCE_TRY_FN} "$@" && return 0`,
+        `  [ "$FJALL_CH_BUSY" = 1 ] || ${markerLine(MAINTENANCE_STATUS.failed, "reason=$1 job=$FJALL_JOB")}`,
+        `  return 1`,
+        `}`
+    ];
+    const probeFailed = markerLine(MAINTENANCE_STATUS.failed, "reason=probe_error job=$FJALL_JOB");
+    const deferred = markerLine(MAINTENANCE_STATUS.deferred, "reason=migration_active job=$FJALL_JOB");
+    return [
+        `FJALL_JOB=${job}`,
+        `FJALL_CH_BUSY=0`,
+        ...tryFn,
+        ...runFn,
+        `FJALL_ACTIVE=$(${MAINTENANCE_TRY_FN} activity_probe "${activityQuery}") || { ${probeFailed}; exit 1; }`,
+        `case "$FJALL_ACTIVE" in 0) ;; 1) ${deferred}; exit 0 ;; *) ${probeFailed}; exit 1 ;; esac`
+    ].join("\n");
+}
+/** `fjall_ch_run <label> "<sql>" [timeoutSeconds]` — see `MAINTENANCE_RUN_FN`. */
+export function maintenanceRun(label, sql, timeoutSeconds) {
+    assertLabel(label);
+    const timeout = timeoutSeconds !== undefined ? ` ${timeoutSeconds}` : "";
+    return `${MAINTENANCE_RUN_FN} ${label} "${sql}"${timeout}`;
+}
+/** `fjall_ch_try <label> "<sql>" [timeoutSeconds]` — see `MAINTENANCE_TRY_FN`. */
+export function maintenanceTry(label, sql, timeoutSeconds) {
+    assertLabel(label);
+    const timeout = timeoutSeconds !== undefined ? ` ${timeoutSeconds}` : "";
+    return `${MAINTENANCE_TRY_FN} ${label} "${sql}"${timeout}`;
+}
+/** The job's terminal success line. */
+export function maintenanceOkMarker(job) {
+    return markerLine(MAINTENANCE_STATUS.ok, `job=${job}`);
+}

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -175,6 +175,9 @@ export class RdsAurora extends Construct {
             },
             storageEncrypted: true,
             ...(storageEncryptionKey && { storageEncryptionKey }),
+            // Without this the RDS API default (false) leaves every automated and
+            // manual snapshot untagged — untagged-asset posture findings fleet-wide.
+            copyTagsToSnapshot: true,
             clusterIdentifier: props.clusterIdentifier?.toLowerCase() || ResourceNaming.clusterId(id),
             monitoringInterval: props.monitoringInterval ?? RDS_DEFAULTS.MONITORING_INTERVAL,
             preferredMaintenanceWindow: props.preferredMaintenanceWindow ??

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -139,6 +139,9 @@ export class RdsInstance extends Construct {
             caCertificate: CaCertificate.RDS_CA_RSA4096_G1,
             removalPolicy: RemovalPolicy.SNAPSHOT,
             deleteAutomatedBackups: false,
+            // Without this the RDS API default (false) leaves every automated and
+            // manual snapshot untagged — untagged-asset posture findings fleet-wide.
+            copyTagsToSnapshot: true,
             enablePerformanceInsights: piEnabled,
             performanceInsightEncryptionKey: performanceInsightsEncryptionKey,
             performanceInsightRetention: performanceInsightsRetention,
@@ -314,6 +317,7 @@ exports.handler = async (event) => {
             caCertificate: CaCertificate.RDS_CA_RSA4096_G1,
             removalPolicy: RemovalPolicy.DESTROY,
             deleteAutomatedBackups: false,
+            copyTagsToSnapshot: true,
             enablePerformanceInsights: piEnabled,
             performanceInsightEncryptionKey: readReplicaPerformanceInsightsKey,
             performanceInsightRetention: piEnabled

package/dist/lib/resources/aws/monitoring/clickhouseAlarms.d.ts

@@ -3,6 +3,7 @@ import type { IRole } from "aws-cdk-lib/aws-iam";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import type { ILogGroup } from "aws-cdk-lib/aws-logs";
 import type { Construct } from "constructs";
+import { type ClickHouseMaintenanceJob } from "../database/clickhouseConstants.js";
 /**
  * The single alarm-tuning knob on `ClickHouseDatabaseProps.alarms`. The
  * ClickHouseDatabase pattern fans it out across three mechanisms: host-level
@@ -135,6 +136,17 @@ export interface ClickHouseAlarmsProps {
      * alarm and the success heartbeat stay: they monitor the backup itself.
      */
     backupVerifyEnabled?: boolean;
+    /**
+     * Log group per scheduled maintenance job (OPTIMIZE FINAL, BACKUP), each
+     * running as `fjall_maintenance`. Every group gets a metric filter for the
+     * `fjall:maintenance:status=failed` marker (one shared alarm) and one for
+     * `status=deferred` (metric only — a job that stood aside for a migration
+     * is the mutex working, not a page). Empty when both jobs are disabled.
+     */
+    maintenanceLogGroups?: ReadonlyArray<{
+        job: ClickHouseMaintenanceJob;
+        logGroup: ILogGroup;
+    }>;
     config?: ClickHouseHostAlarmThresholds;
     /**
      * Critical free-space floor in GiB, ALREADY RESOLVED. Not read off `config`

package/dist/lib/resources/aws/monitoring/clickhouseAlarms.js

@@ -5,7 +5,8 @@ import { Metric } from "aws-cdk-lib/aws-cloudwatch";
 import { FilterPattern, MetricFilter } from "aws-cdk-lib/aws-logs";
 import { ALARM_DEFAULTS, registerAlarm, tagAlarmsWithApplicationId, buildAlarmDescription } from "./alarmDefaults.js";
 import { METRIC_NAMESPACE, stackScopedMetricNamespace } from "./metricNamespaces.js";
-import { CLICKHOUSE_BACKUP_VERIFY_FAILED_MARKER, CLICKHOUSE_BACKUP_VERIFY_SKIPPED_MARKER, CLICKHOUSE_HOST_METRICS } from "../database/clickhouseConstants.js";
+import { CLICKHOUSE_BACKUP_VERIFY_FAILED_MARKER, CLICKHOUSE_BACKUP_VERIFY_SKIPPED_MARKER, CLICKHOUSE_HOST_METRICS, MAINTENANCE_STATUS, maintenanceStatusMarker } from "../database/clickhouseConstants.js";
+import { toPascalCase } from "../../../utils/capitaliseString.js";
 export const BACKUP_HEARTBEAT_DEFAULT_WINDOW_HOURS = 26;
 /**
  * Ceiling derivation — an ORDERING bound, not CloudWatch expressibility.
@@ -81,10 +82,11 @@ export function validateClickHouseAlarmThresholds(config) {
  * see (the EC2 host and the backup task).
  */
 export function createClickHouseAlarms(props) {
-    const { scope, instanceRole, asgName, alarmTopic, backupTaskLogGroup, backupVerifyEnabled = true, config = {}, diskFreeCriticalGib, applicationId } = props;
+    const { scope, instanceRole, asgName, alarmTopic, backupTaskLogGroup, backupVerifyEnabled = true, maintenanceLogGroups = [], config = {}, diskFreeCriticalGib, applicationId } = props;
     validateClickHouseAlarmThresholds(config);
     const alarms = [];
     const snsAction = new SnsAction(alarmTopic);
+    const clickHouseNamespace = stackScopedMetricNamespace(METRIC_NAMESPACE.CLICKHOUSE);
     const cpuAlarm = new Alarm(scope, "ClickHouseCpuAlarm", {
         alarmDescription: buildAlarmDescription("ClickHouse host CPU utilisation exceeds threshold", applicationId),
         metric: new Metric({
@@ -145,7 +147,7 @@ export function createClickHouseAlarms(props) {
     registerAlarm(diskCriticalAlarm, snsAction, alarms);
     if (backupTaskLogGroup !== undefined) {
         const backupFailureMetricName = "ClickHouseBackupFailureCount";
-        const backupFailureNamespace = stackScopedMetricNamespace(METRIC_NAMESPACE.CLICKHOUSE);
+        const backupFailureNamespace = clickHouseNamespace;
         new MetricFilter(scope, "ClickHouseBackupFailureMetricFilter", {
             logGroup: backupTaskLogGroup,
             metricNamespace: backupFailureNamespace,
@@ -189,9 +191,83 @@ export function createClickHouseAlarms(props) {
             alarms
         });
     }
+    if (maintenanceLogGroups.length > 0) {
+        createMaintenanceStatusAlarms({
+            scope,
+            maintenanceLogGroups,
+            namespace: clickHouseNamespace,
+            snsAction,
+            applicationId,
+            alarms
+        });
+    }
     tagAlarmsWithApplicationId(alarms, applicationId);
     return alarms;
 }
+/**
+ * Maintenance-job status alarms — the sidecars' own verdict on each run.
+ *
+ * Both scheduled jobs authenticate as `fjall_maintenance` under a
+ * one-query-per-user cap and open with a migrate ↔ maintenance activity
+ * pre-flight, so each run ends in exactly one of three markers
+ * (`clickhouseMaintenanceScript`):
+ *
+ * - **failed** (`fjall:maintenance:status=failed`, Sum >= 1 per hour, one
+ *   alarm fed by every job's log group) — a statement raised, the busy
+ *   budget ran out waiting for the sibling job (`reason=busy`), or the
+ *   activity probe itself could not be answered (`reason=probe_error`).
+ *   The `reason=` / `label=` fields on the line name the statement.
+ * - **deferred** (`status=deferred`) — metric filter only, no alarm. The job
+ *   stood aside because a migration was active; that is the mutex doing its
+ *   job. The metric exists so a job that defers on EVERY run (a wedged
+ *   migration holder) is visible on a dashboard, and can be alarmed on later
+ *   without touching the scripts.
+ * - **ok** — nothing to count; the backup heartbeat already covers absence.
+ *
+ * The backup job's verify markers (`BACKUP_VERIFY_*`) keep their own alarms
+ * above; the maintenance runners deliberately emit no failed-status marker
+ * on the statements those branches already report, so one bad restore does
+ * not page twice.
+ */
+function createMaintenanceStatusAlarms(props) {
+    const { scope, maintenanceLogGroups, namespace, snsAction, applicationId, alarms } = props;
+    const failedMetricName = "ClickHouseMaintenanceFailedCount";
+    const deferredMetricName = "ClickHouseMaintenanceDeferredCount";
+    for (const { job, logGroup } of maintenanceLogGroups) {
+        const jobId = toPascalCase(job);
+        new MetricFilter(scope, `ClickHouseMaintenance${jobId}FailedMetricFilter`, {
+            logGroup,
+            metricNamespace: namespace,
+            metricName: failedMetricName,
+            filterPattern: FilterPattern.allTerms(maintenanceStatusMarker(MAINTENANCE_STATUS.failed)),
+            metricValue: "1",
+            defaultValue: 0
+        });
+        new MetricFilter(scope, `ClickHouseMaintenance${jobId}DeferredMetricFilter`, {
+            logGroup,
+            metricNamespace: namespace,
+            metricName: deferredMetricName,
+            filterPattern: FilterPattern.allTerms(maintenanceStatusMarker(MAINTENANCE_STATUS.deferred)),
+            metricValue: "1",
+            defaultValue: 0
+        });
+    }
+    const failedAlarm = new Alarm(scope, "ClickHouseMaintenanceFailedAlarm", {
+        alarmDescription: buildAlarmDescription("ClickHouse maintenance job (OPTIMIZE FINAL or BACKUP) reported status=failed — read the reason= field on the marker line; reason=busy means the sibling job or a stuck query is holding the fjall_maintenance slot", applicationId),
+        metric: new Metric({
+            namespace,
+            metricName: failedMetricName,
+            period: Duration.hours(1),
+            statistic: "Sum"
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1,
+        comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: TreatMissingData.NOT_BREACHING
+    });
+    registerAlarm(failedAlarm, snsAction, alarms);
+}
 /**
  * Restore-verify alarms — the half of the backup story `BACKUP_CREATED`
  * cannot tell.

package/dist/lib/resources/aws/monitoring/ecsAlarms.d.ts

@@ -11,7 +11,11 @@ export interface EcsServiceAlarmThresholds {
     cpuThreshold?: number | false;
     /** Memory utilisation % threshold. `false` disables the memory alarm. */
     memoryThreshold?: number | false;
-    /** Minimum running tasks; `0` disables the running-tasks alarm. */
+    /** Minimum running tasks; `0` disables the running-tasks alarm. The metric
+     *  (`RunningTaskCount`) exists only in the `ECS/ContainerInsights`
+     *  namespace, so the alarm is also skipped entirely when Container
+     *  Insights is not enabled on the cluster — an alarm with no possible
+     *  witness would sit in INSUFFICIENT_DATA forever. */
     runningTasksMinimum?: number;
     /** 5xx error-rate % threshold (ALB services only). `false` disables the
      *  5xx alarm; the p99 response-time alarm is unaffected. */
@@ -30,5 +34,10 @@ export interface EcsServiceAlarmsProps {
     config: EcsServiceAlarmThresholds;
     alarmTopic: ITopic;
     applicationId?: string;
+    /** Whether Container Insights is enabled on the service's cluster. The
+     *  running-tasks alarm consumes `ECS/ContainerInsights RunningTaskCount`,
+     *  which does not exist without insights — absent/false skips that alarm
+     *  rather than synthesising one that can never observe its metric. */
+    containerInsightsEnabled?: boolean;
 }
 export declare function createEcsServiceAlarms(props: EcsServiceAlarmsProps): Alarm[];

package/dist/lib/resources/aws/monitoring/ecsAlarms.js

@@ -1,10 +1,10 @@
 import { Duration } from "aws-cdk-lib";
-import { Alarm, ComparisonOperator, MathExpression, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+import { Alarm, ComparisonOperator, MathExpression, Metric, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
 import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
 import { HttpCodeTarget } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { ALARM_DEFAULTS, registerAlarm, tagAlarmsWithApplicationId, buildAlarmDescription } from "./alarmDefaults.js";
 export function createEcsServiceAlarms(props) {
-    const { scope, serviceName, service, targetGroup, config, alarmTopic, applicationId } = props;
+    const { scope, serviceName, service, targetGroup, config, alarmTopic, applicationId, containerInsightsEnabled = false } = props;
     const alarms = [];
     const snsAction = new SnsAction(alarmTopic);
     if (config.cpuThreshold !== false) {
@@ -36,10 +36,20 @@ export function createEcsServiceAlarms(props) {
         registerAlarm(memoryAlarm, snsAction, alarms);
     }
     const runningMin = config.runningTasksMinimum ?? ALARM_DEFAULTS.ECS.RUNNING_TASKS_MIN;
-    if (runningMin > 0) {
+    // Skipped without Container Insights: `RunningTaskCount` exists only in the
+    // `ECS/ContainerInsights` namespace (BaseService.metric() pins `AWS/ECS`,
+    // where it never publishes), so an alarm on it would sit in
+    // INSUFFICIENT_DATA forever — a silent dead alarm is worse than no alarm.
+    if (runningMin > 0 && containerInsightsEnabled) {
         const runningTasksAlarm = new Alarm(scope, `${serviceName}RunningTasksAlarm`, {
             alarmDescription: buildAlarmDescription(`ECS service ${serviceName} running tasks below minimum`, applicationId),
-            metric: service.metric("RunningTaskCount", {
+            metric: new Metric({
+                namespace: "ECS/ContainerInsights",
+                metricName: "RunningTaskCount",
+                dimensionsMap: {
+                    ClusterName: service.cluster.clusterName,
+                    ServiceName: service.serviceName
+                },
                 period: Duration.minutes(1),
                 statistic: "Average"
             }),

package/dist/lib/resources/aws/networking/vpc.js

@@ -7,6 +7,9 @@ import { ResourceNaming } from "../../../utils/resourceNaming.js";
 export const FLOW_LOG_TRAFFIC_TYPES = ["ALL", "ACCEPT", "REJECT"];
 // Read at two sites (resources-layer constructor default + patterns-layer natGateways guard) that must agree.
 export const DEFAULT_MAX_AZS = 3;
+// Shared by the default-path and explicit-config CloudWatch flow-log groups —
+// drift would give the two paths different retention for the same log stream.
+const DEFAULT_FLOW_LOG_RETENTION_DAYS = 14;
 export class Vpc extends ec2.Vpc {
     gatewayEndpoints = [];
     interfaceEndpoints = [];
@@ -168,7 +171,8 @@ export class Vpc extends ec2.Vpc {
                 [`${id}VpcFlowLogs`]: {
                     destination: ec2.FlowLogDestination.toCloudWatchLogs(new LogGroup(scope, `${id}FlowLogGroup`, {
                         logGroupName: `/vpc/flowlogs/vpc-${id}/`,
-                        removalPolicy: RemovalPolicy.DESTROY
+                        removalPolicy: RemovalPolicy.DESTROY,
+                        retention: Vpc.daysToRetention(DEFAULT_FLOW_LOG_RETENTION_DAYS)
                     }))
                 }
             };
@@ -190,7 +194,7 @@ export class Vpc extends ec2.Vpc {
                 }
             };
         }
-        const retentionDays = config.retentionDays ?? 14;
+        const retentionDays = config.retentionDays ?? DEFAULT_FLOW_LOG_RETENTION_DAYS;
         return {
             [`${id}VpcFlowLogs`]: {
                 destination: ec2.FlowLogDestination.toCloudWatchLogs(new LogGroup(scope, `${id}FlowLogGroup`, {

package/dist/lib/resources/aws/storage/s3.js

@@ -44,9 +44,19 @@ export class S3Bucket extends Bucket {
                 websiteErrorDocument: websiteHosting.errorDocument ?? "error.html"
             }),
             versioned,
-            lifecycleRules: versioned && !props.lifecycleRules
-                ? [{ noncurrentVersionExpiration: Duration.days(30), enabled: true }]
-                : props.lifecycleRules
+            lifecycleRules: [
+                // Unconditional multipart hygiene: without it, abandoned multipart
+                // uploads accrue invisible storage cost forever (CDK bootstrap does
+                // the same at 1 day).
+                {
+                    id: "AbortIncompleteMultipartUploads",
+                    abortIncompleteMultipartUploadAfter: Duration.days(7),
+                    enabled: true
+                },
+                ...(versioned && !props.lifecycleRules
+                    ? [{ noncurrentVersionExpiration: Duration.days(30), enabled: true }]
+                    : (props.lifecycleRules ?? []))
+            ]
         });
         this.backupVaultTier = backupVaultTier;
         for (const statement of resourcePolicyStatements ?? []) {

package/dist/lib/utils/validationLogger.js

@@ -4,20 +4,29 @@
  * Also writes to JSONL file for debugging and support.
  */
 import { appendFileSync, existsSync, mkdirSync } from "fs";
-import { homedir } from "os";
 import { join } from "path";
-const ENV_LOG_DIR = process.env.FJALL_LOG_DIR;
-const LOG_DIR = ENV_LOG_DIR !== undefined && ENV_LOG_DIR !== ""
-    ? ENV_LOG_DIR
-    : join(homedir(), ".fjall", "logs");
-const LOG_FILE = join(LOG_DIR, "infrastructure.jsonl");
+import { fjallLogDir } from "@fjall/util";
+import { FileRotator, LOG_ROTATION_DEFAULTS } from "@fjall/util/logRotation";
+const LOG_FILENAME = "infrastructure.jsonl";
+/**
+ * Shared with the CLI's own logs, so this file cannot outgrow the budget
+ * the rest of Fjall's logging keeps to. Without it this log had no bound of
+ * any kind: it is appended to on every CDK synth, and one developer machine
+ * reached 267MB of it inside a single release cycle.
+ */
+const rotator = new FileRotator({
+    maxFiles: LOG_ROTATION_DEFAULTS.MAX_FILES
+});
 /**
  * Write a log entry to the infrastructure JSONL file
  */
 function writeToLog(level, message) {
     try {
-        if (!existsSync(LOG_DIR)) {
-            mkdirSync(LOG_DIR, { recursive: true });
+        // Resolved per write, not at module load: the log dir is an env var and
+        // CDK imports this module long before a command has read its environment.
+        const logDir = fjallLogDir();
+        if (!existsSync(logDir)) {
+            mkdirSync(logDir, { recursive: true });
         }
         const entry = JSON.stringify({
             timestamp: new Date().toISOString(),
@@ -26,7 +35,9 @@ function writeToLog(level, message) {
             message,
             source: "cdk-subprocess"
         });
-        appendFileSync(LOG_FILE, entry + "\n");
+        const logPath = join(logDir, LOG_FILENAME);
+        rotator.rotateIfNeeded(logPath, LOG_ROTATION_DEFAULTS.MAX_FILE_SIZE);
+        appendFileSync(logPath, entry + "\n");
     }
     catch (err) {
         console.debug("[Fjall] writeToLog failed:", err instanceof Error ? err.message : String(err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "20.0.0",
+  "version": "21.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -80,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^20.0.0",
-    "@fjall/util": "^20.0.0",
+    "@fjall/generator": "^21.1.0",
+    "@fjall/util": "^21.1.0",
     "constructs": "^10.7.2"
   },
   "overrides": {