@fjall/components-infrastructure 27.0.0 → 28.0.0

package/dist/lib/app.js

@@ -24,7 +24,7 @@ import { FjallLogger } from "./utils/validationLogger.js";
 import { getManifestCollector, writeManifest } from "./utils/manifestWriter.js";
 import { resetDnsRecordRegistry } from "./utils/dnsRecordRegistry.js";
 import { toPascalCase, toKebab } from "./utils/capitaliseString.js";
-import { COST_ALLOCATION_TAGS } from "./utils/costAllocationTags.js";
+import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_OWNER } from "./utils/costAllocationTags.js";
 import { DEFAULT_ORG_ID, resolveOrgId } from "./utils/cdkContext.js";
 /**
  * The basic corner-stone of all Fjall-hosted applications.
@@ -792,6 +792,13 @@ export class App extends CdkApp {
                     this.globalTags[COST_ALLOCATION_TAGS.OWNER] = orgId;
                 }
             }
+            // Last-resort owner: without it, apps built directly on the construct
+            // library (no generator addTags block, no orgId context) ship every
+            // resource owner-less → MISSING_REQUIRED_TAGS across the estate.
+            if (this.globalTags[COST_ALLOCATION_TAGS.OWNER] === undefined) {
+                this.globalTags[COST_ALLOCATION_TAGS.OWNER] =
+                    DEFAULT_COST_ALLOCATION_OWNER;
+            }
             // Apply standard tags using Tags.of(this).add()
             for (const [key, value] of Object.entries(this.globalTags)) {
                 Tags.of(this).add(key, value);

package/dist/lib/config/aws/alarmTopic.js

@@ -1,4 +1,4 @@
-import { CfnOutput } from "aws-cdk-lib";
+import { CfnOutput, Stack } from "aws-cdk-lib";
 import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { EmailSubscription, UrlSubscription } from "aws-cdk-lib/aws-sns-subscriptions";
 import { Construct } from "constructs";
@@ -38,6 +38,25 @@ export class SharedAlarmTopic extends Construct {
             ...(masterKey !== undefined && { masterKey })
         });
         this.topic = wrapped.getTopic();
+        // The wrapper's TLS-only TopicPolicy REPLACES the topic's implicit
+        // default policy, whose Allow was the SOLE authorisation for CloudWatch
+        // alarm-transition publishes — without this explicit Allow every alarm
+        // fires into a deny-only policy and pages nobody. Unlike the KMS path
+        // above, the topic-policy publish DOES carry the confused-deputy keys
+        // (the AWS-documented alarms-to-SNS shape), so scope to this account's
+        // alarms.
+        const stack = Stack.of(this);
+        this.topic.addToResourcePolicy(new PolicyStatement({
+            principals: [new ServicePrincipal("cloudwatch.amazonaws.com")],
+            actions: ["sns:Publish"],
+            resources: [wrapped.getTopicArn()],
+            conditions: {
+                StringEquals: { "aws:SourceAccount": stack.account },
+                ArnLike: {
+                    "aws:SourceArn": `arn:${stack.partition}:cloudwatch:${stack.region}:${stack.account}:alarm:*`
+                }
+            }
+        }));
         for (const email of props?.subscriptions?.emails ?? []) {
             this.topic.addSubscription(new EmailSubscription(email));
         }

package/dist/lib/config/aws/configRecorder.js

@@ -1,8 +1,9 @@
 import { Duration, RemovalPolicy } from "aws-cdk-lib";
 import { CfnConfigurationRecorder, CfnDeliveryChannel } from "aws-cdk-lib/aws-config";
 import { Role, ServicePrincipal, ManagedPolicy } from "aws-cdk-lib/aws-iam";
-import { Bucket, BucketEncryption, BlockPublicAccess } from "aws-cdk-lib/aws-s3";
+import { BucketEncryption, BlockPublicAccess } from "aws-cdk-lib/aws-s3";
 import { Construct } from "constructs";
+import { NONCURRENT_VERSION_EXPIRY_DAYS, S3Bucket } from "../../resources/aws/storage/index.js";
 /**
  * AWS Config recorder with S3 delivery channel.
  * Records configuration changes to all supported resources.
@@ -14,13 +15,23 @@ export class ConfigRecorder extends Construct {
         super(scope, id);
         const allResources = props?.allResources !== false;
         const includeGlobalResources = props?.includeGlobalResources !== false;
-        // Delivery bucket -- S3-managed encryption, 90-day lifecycle, no public access
-        const deliveryBucket = new Bucket(this, "DeliveryBucket", {
+        // S3Bucket keeps the raw Bucket's construct id, so the deployed bucket's
+        // logical ID is unchanged (a rename would replace the bucket on redeploy);
+        // the wrapper supplies enforceSSL + multipart hygiene. Custom
+        // lifecycleRules bypass its automatic noncurrentVersionExpiration
+        // pairing — carried explicitly, or noncurrent versions accumulate forever.
+        const deliveryBucket = new S3Bucket(this, "DeliveryBucket", {
             encryption: BucketEncryption.S3_MANAGED,
             blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-            enforceSSL: true,
+            versioned: true,
             removalPolicy: RemovalPolicy.RETAIN,
-            lifecycleRules: [{ expiration: Duration.days(90), enabled: true }]
+            lifecycleRules: [
+                {
+                    expiration: Duration.days(90),
+                    noncurrentVersionExpiration: Duration.days(NONCURRENT_VERSION_EXPIRY_DAYS),
+                    enabled: true
+                }
+            ]
         });
         this.deliveryBucketName = deliveryBucket.bucketName;
         // IAM role for Config service

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -201,7 +201,10 @@ export interface CodeLambdaProps extends BaseLambdaProps {
     code: Code;
     /** Handler function. Default: "index.handler" */
     handler?: string;
-    /** Lambda runtime. Default: NODEJS_24_X */
+    /**
+     * Lambda runtime. Default: NODEJS_24_X. A runtime AWS Lambda has
+     * deprecated fails synth.
+     */
     runtime?: Runtime;
 }
 /**

package/dist/lib/patterns/aws/computeLambda.js

@@ -3,7 +3,7 @@ import { Connections } from "aws-cdk-lib/aws-ec2";
 import { Repository } from "aws-cdk-lib/aws-ecr";
 import { Construct } from "constructs";
 import { processConnections } from "../../utils/connections.js";
-import { LambdaFunction } from "../../resources/aws/compute/lambda.js";
+import { LambdaFunction, validateRuntimeNotDeprecated } from "../../resources/aws/compute/lambda.js";
 import { getOrCreateImageTagParameter } from "../../resources/aws/compute/imageTagParameter.js";
 import { COMPUTE_DEFAULTS } from "./compute.js";
 import { LAMBDA_ARCHITECTURE_VALUES } from "@fjall/util/manifest/schemas";
@@ -114,6 +114,9 @@ export function resolveLambdaDeployment(scope, id, props) {
             runtime: Runtime.FROM_IMAGE
         };
     }
+    if (props.runtime !== undefined) {
+        validateRuntimeNotDeprecated(props.runtime, id);
+    }
     return {
         code: props.code,
         handler: props.handler || COMPUTE_DEFAULTS.LAMBDA.HANDLER,

package/dist/lib/patterns/aws/database.d.ts

@@ -117,7 +117,9 @@ export interface AuroraDatabaseProps extends BaseDatabaseProps {
     /**
      * IP address to allow access from when publiclyAccessible is true.
      * If not specified, access is restricted to VPC only even when public.
-     * Format: CIDR notation (e.g., "203.0.113.0/32" for single IP)
+     * Format: IPv4 CIDR notation (e.g., "203.0.113.0/32" for single IP).
+     * The world-open CIDR "0.0.0.0/0" raises a synth-time warning; a non-IPv4
+     * CIDR (e.g. "::/0") fails synth outright — the ingress peer is IPv4-only.
      */
     allowedIpCidr?: string;
 }
@@ -162,10 +164,11 @@ export interface InstanceDatabaseProps extends BaseDatabaseProps {
     encryption?: EncryptionConfig;
     publiclyAccessible?: boolean;
     /**
-     * Enable RDS IAM database authentication (opt-in; default off). Instance
-     * databases only. When true, IAM principals granted via
+     * RDS IAM database authentication (default ON; pass false to opt out).
+     * Instance databases only. IAM principals granted via
      * {@link RelationalDatabase.grantIamConnect} connect with short-lived
-     * `rds-db:connect` tokens instead of a stored password. See ADR
+     * `rds-db:connect` tokens instead of a stored password; password auth keeps
+     * working in parallel. See ADR
      * decisions/2026-06-17-rls-role-auth-and-launch-gating.md.
      */
     iamAuthentication?: boolean;
@@ -189,6 +192,7 @@ export interface DynamoDBDatabaseProps {
     stream?: "NEW_IMAGE" | "OLD_IMAGE" | "NEW_AND_OLD_IMAGES" | "KEYS_ONLY";
     pointInTimeRecovery?: boolean;
     encryption?: "AWS_OWNED" | "AWS_MANAGED" | "CUSTOMER_MANAGED";
+    deletionProtection?: boolean;
     removalPolicy?: "DESTROY" | "RETAIN" | "SNAPSHOT";
 }
 /**
@@ -323,8 +327,9 @@ export declare class RelationalDatabase extends Construct implements IRelational
     /**
      * Grant an IAM principal permission to connect as `dbUsername` via RDS IAM
      * database authentication. Instance databases only — Aurora uses a different
-     * mechanism, so this throws for non-Instance databases. Requires the instance
-     * to be created with `iamAuthentication: true`. The L2 `grantConnect` scopes
+     * mechanism, so this throws for non-Instance databases. IAM auth is on by
+     * default; this throws if the instance opted out with
+     * `iamAuthentication: false`. The L2 `grantConnect` scopes
      * `rds-db:connect` to the exact `dbuser:<resourceId>/<dbUsername>` ARN — never
      * a bare wildcard. See ADR
      * decisions/2026-06-17-rls-role-auth-and-launch-gating.md.

package/dist/lib/patterns/aws/database.js

@@ -12,7 +12,7 @@ import { Port } from "aws-cdk-lib/aws-ec2";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { MIGRATION_SNAPSHOT_NAME_PREFIX } from "./interfaces/database.js";
 import { pickLatestPrismaMigration } from "../../utils/migrationVersionResolvers.js";
-import { SCHEMA_GATE_DB_PASSWORD_ENV, SCHEMA_GATE_DB_URL_BASE_ENV, SCHEMA_GATE_DB_USER_ENV } from "@fjall/util/migration";
+import { MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV, SCHEMA_GATE_DB_PASSWORD_ENV, SCHEMA_GATE_DB_URL_BASE_ENV, SCHEMA_GATE_DB_USER_ENV } from "@fjall/util/migration";
 import { DatabaseClusterEngine, DatabaseInstanceEngine, AuroraPostgresEngineVersion, AuroraMysqlEngineVersion, PostgresEngineVersion, MysqlEngineVersion } from "aws-cdk-lib/aws-rds";
 import { Duration } from "aws-cdk-lib";
 export { isAwsManagedKey, isCMKRequested, AWS_MANAGED, USE_CMK } from "../../utils/databaseTypes.js";
@@ -222,6 +222,7 @@ export class DynamoDBDatabase extends Construct {
             stream: props.stream,
             pointInTimeRecovery: props.pointInTimeRecovery,
             encryption: props.encryption,
+            deletionProtection: props.deletionProtection,
             removalPolicy: props.removalPolicy
         };
         this.table = new DynamoDBTable(this, id, tableProps);
@@ -296,11 +297,13 @@ const SNAPSHOT_ACTION_TABLE = {
     instance: {
         createAction: "rds:CreateDBSnapshot",
         describeAction: "rds:DescribeDBSnapshots",
+        deleteAction: "rds:DeleteDBSnapshot",
         resourceArnSegment: "snapshot"
     },
     cluster: {
         createAction: "rds:CreateDBClusterSnapshot",
         describeAction: "rds:DescribeDBClusterSnapshots",
+        deleteAction: "rds:DeleteDBClusterSnapshot",
         resourceArnSegment: "cluster-snapshot"
     }
 };
@@ -540,6 +543,10 @@ export class RelationalDatabase extends Construct {
             actions: [
                 triple.createAction,
                 triple.describeAction,
+                // Delete is confined to fjall-premigrate-* by IAM: a Delete request's
+                // resource is always a snapshot ARN, which only the prefix glob below
+                // can match — never the instance/cluster ARN.
+                triple.deleteAction,
                 "rds:AddTagsToResource"
             ],
             resources: [
@@ -605,6 +612,7 @@ export class RelationalDatabase extends Construct {
             const target = this.getSnapshotTarget();
             environment.SNAPSHOT_TARGET_KIND = target.kind;
             environment.SNAPSHOT_TARGET_ARN = target.arn;
+            environment[MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV] = String(this.database.getBackupRetentionDays());
         }
         const credentials = this.getCredentials();
         const secretsImport = {
@@ -640,8 +648,9 @@ export class RelationalDatabase extends Construct {
     /**
      * Grant an IAM principal permission to connect as `dbUsername` via RDS IAM
      * database authentication. Instance databases only — Aurora uses a different
-     * mechanism, so this throws for non-Instance databases. Requires the instance
-     * to be created with `iamAuthentication: true`. The L2 `grantConnect` scopes
+     * mechanism, so this throws for non-Instance databases. IAM auth is on by
+     * default; this throws if the instance opted out with
+     * `iamAuthentication: false`. The L2 `grantConnect` scopes
      * `rds-db:connect` to the exact `dbuser:<resourceId>/<dbUsername>` ARN — never
      * a bare wildcard. See ADR
      * decisions/2026-06-17-rls-role-auth-and-launch-gating.md.

package/dist/lib/patterns/aws/interfaces/database.d.ts

@@ -127,9 +127,12 @@ export interface IRelationalDatabaseBase extends IDatabase, IConnectable, IMigra
     getSnapshotTarget(): SnapshotTarget;
     /**
      * Returns the IAM PolicyStatement granting the migration runner the rights
-     * needed to take and tag a pre-migration snapshot of this database. Action
-     * triple and resource ARN segment derive from `this.getSnapshotTarget().kind`.
-     * Snapshot name glob is bound to `MIGRATION_SNAPSHOT_NAME_PREFIX`.
+     * needed to take, tag, describe, and prune pre-migration snapshots of this
+     * database. Actions and resource ARN segment derive from
+     * `this.getSnapshotTarget().kind`. Snapshot name glob is bound to
+     * `MIGRATION_SNAPSHOT_NAME_PREFIX`; the delete action can only ever match
+     * that glob (a Delete request's resource is a snapshot ARN, never the
+     * database ARN), confining pruning to premigrate snapshots.
      */
     getMigrationSnapshotPolicy(): PolicyStatement;
     /**

package/dist/lib/patterns/aws/storage.d.ts

@@ -36,6 +36,12 @@ export interface S3Props {
     readonly versioned?: boolean;
     readonly encryption?: "AES256" | "KMS";
     readonly kmsKeyArn?: string;
+    /**
+     * S3 Bucket Keys for KMS-encrypted buckets — defaults to true when
+     * encryption resolves to KMS (cuts per-object KMS request charges); pass
+     * false to opt out. Ignored for non-KMS encryption.
+     */
+    readonly bucketKeyEnabled?: boolean;
     readonly backupVaultTier?: BackupTier;
     readonly cors?: CorsRule[];
     readonly deployment?: S3DeploymentConfig;

package/dist/lib/patterns/aws/storage.js

@@ -80,6 +80,9 @@ export class Storage extends Construct {
             versioned: props.versioned,
             encryption: toBucketEncryption(props.encryption),
             encryptionKey,
+            ...(props.bucketKeyEnabled !== undefined && {
+                bucketKeyEnabled: props.bucketKeyEnabled
+            }),
             backupVaultTier: props.backupVaultTier,
             publicReadAccess: props.publicReadAccess,
             websiteHosting: props.websiteHosting,

package/dist/lib/resources/aws/compute/applicationLoadBalancer.js

@@ -16,6 +16,9 @@ export function createApplicationLoadBalancer(scope, id, options) {
         // ALB-fronted containers receive it as FJALL_ALB_IDLE_TIMEOUT_SECONDS
         // (ecsTaskDefinition.ts) for keep-alive tuning — one constant, both sides.
         idleTimeout: Duration.seconds(DEFAULT_ALB_IDLE_TIMEOUT_SECONDS),
+        // ELB.4 — invalid HTTP headers are a request-smuggling surface; drop them
+        // at the ALB. Attribute-only, so existing LBs update in place.
+        dropInvalidHeaderFields: true,
         ...(options.securityGroup && { securityGroup: options.securityGroup }),
         ...(options.loadBalancerName && {
             loadBalancerName: options.loadBalancerName

package/dist/lib/resources/aws/compute/ecs.js

@@ -1,8 +1,9 @@
-import { Cluster as CdkCluster, ContainerInsights } from "aws-cdk-lib/aws-ecs";
+import { Cluster as CdkCluster, ContainerInsights, ExecuteCommandLogging } from "aws-cdk-lib/aws-ecs";
 import { Connections, Port } from "aws-cdk-lib/aws-ec2";
 import { Construct } from "constructs";
 import { CfnOutput, Aspects } from "aws-cdk-lib";
 import { processConnections } from "../../../utils/connections.js";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
 import { stackScopedExportName } from "../../../utils/exportNaming.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { createEcsServiceAlarms, createEcsTaskStopWatchdog, createLogPatternAlarms } from "../monitoring/index.js";
@@ -382,13 +383,21 @@ export default class EcsCluster extends Construct {
     }
     addCluster(props) {
         const needsFargate = this.anyServiceUsesFargate();
+        // Every service enables execute command; without an OVERRIDE here the
+        // exec session output interleaves into the container app log groups
+        // (DEFAULT mode). No kmsKey — session encryption is tier-gated.
+        const execAuditLogGroup = new LogGroup(this, `${props.clusterName}ExecAuditLogGroup`, { retention: DEFAULT_FRAMEWORK_LOG_RETENTION });
         const cluster = new CdkCluster(this, `${props.clusterName}Cluster`, {
             vpc: props.vpc,
             clusterName: props.clusterName,
             containerInsightsV2: props.containerInsights === true
                 ? ContainerInsights.ENABLED
                 : ContainerInsights.DISABLED,
-            enableFargateCapacityProviders: needsFargate
+            enableFargateCapacityProviders: needsFargate,
+            executeCommandConfiguration: {
+                logging: ExecuteCommandLogging.OVERRIDE,
+                logConfiguration: { cloudWatchLogGroup: execAuditLogGroup }
+            }
         });
         new CfnOutput(this, `${this.outputName}DeployableCluster`, {
             key: `${this.outputName}DeployableCluster`,

package/dist/lib/resources/aws/compute/lambda.d.ts

@@ -10,6 +10,23 @@ import { type KeyValue } from "../../../types.js";
 import { type SecretImport } from "../secrets/index.js";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type LambdaAlarmThresholds } from "../monitoring/index.js";
+/**
+ * Runtime names AWS Lambda has deprecated, mirrored from the `@deprecated`
+ * markers on `Runtime`'s static members in the vendored aws-cdk-lib
+ * (aws-lambda/lib/runtime.d.ts). The SDK exposes no runtime-readable
+ * deprecation flag on `Runtime` instances, so this set can drift when
+ * aws-cdk-lib is upgraded — lambda-deprecated-runtime.test.ts re-derives it
+ * from the vendored declaration file and fails on any mismatch.
+ */
+export declare const DEPRECATED_RUNTIME_NAMES: ReadonlySet<string>;
+/**
+ * Throw at synth time when a deprecated Lambda runtime is configured —
+ * shift-left of the posture scan's LAMBDA_DEPRECATED_RUNTIME finding, which
+ * previously let the deploy succeed and flagged it days later. A deprecated
+ * runtime receives no security patches and AWS eventually blocks function
+ * creation on it.
+ */
+export declare function validateRuntimeNotDeprecated(runtime: Runtime, functionId: string): void;
 export interface LambdaFunctionProps {
     code: Code;
     handler: string;
@@ -53,6 +70,16 @@ export interface LambdaFunctionProps {
     functionUrlCors?: FunctionUrlCorsOptions;
     /** Invoke mode for Function URL. Use RESPONSE_STREAM for Lambda streaming. */
     functionUrlInvokeMode?: InvokeMode;
+    /**
+     * Failure destination for asynchronous invocations. S3 event notifications
+     * invoke the function asynchronously, and a failed event is silently
+     * dropped after the default two retries. Unless set to `false`, the first
+     * `addS3EventSource` call lazily creates one SQS queue for the function
+     * (SSL-enforced, 14-day retention) and wires it as the async dead-letter
+     * queue; pass an existing queue to reuse it instead. Functions with no
+     * async event source get no queue.
+     */
+    asyncFailureQueue?: IQueue | false;
     environment?: KeyValue;
     secrets?: string[];
     ssmSecretsPath?: string;
@@ -79,6 +106,8 @@ export declare class SingletonFunction extends singletonFunction {
 }
 export declare class LambdaFunction extends Function {
     private functionUrlValue?;
+    private readonly asyncFailureQueueProp?;
+    private asyncFailureQueueWired?;
     constructor(scope: Construct, id: string, props: LambdaFunctionProps);
     /**
      * The Lambda's execution role (auto-generated by CDK)
@@ -114,6 +143,9 @@ export declare class LambdaFunction extends Function {
      * Add an S3 bucket as an event source for this Lambda function.
      * This will trigger the Lambda when objects are created, modified, or deleted.
      * Useful for ISR cache invalidation and file processing workflows.
+     *
+     * S3 invokes asynchronously, so the first call also wires the async
+     * failure queue (see `asyncFailureQueue`) unless it is set to `false`.
      */
     addS3EventSource(bucket: Bucket, options?: {
         events?: Array<"OBJECT_CREATED" | "OBJECT_REMOVED" | "OBJECT_CREATED_PUT" | "OBJECT_CREATED_POST" | "OBJECT_CREATED_COPY" | "OBJECT_REMOVED_DELETE">;
@@ -122,6 +154,20 @@ export declare class LambdaFunction extends Function {
             suffix?: string;
         }>;
     }): void;
+    /**
+     * Get the SQS queue wired as the async-invocation failure destination, if
+     * one has been created or supplied.
+     */
+    getAsyncFailureQueue(): IQueue | undefined;
+    /**
+     * Wire the async-invocation dead-letter queue on first use. Without one,
+     * an event that fails all retries is silently dropped. `Function`'s
+     * `deadLetterQueue` prop is constructor-only and the queue is only wanted
+     * once an async event source exists, so reach the L1 `CfnFunction` and
+     * mirror what the prop does: DeadLetterConfig plus an sqs:SendMessage
+     * grant to the execution role.
+     */
+    private ensureAsyncFailureQueue;
     /**
      * Add secrets support using AWS Parameters and Secrets Lambda Extension.
      *

package/dist/lib/resources/aws/compute/lambda.js

@@ -1,4 +1,4 @@
-import { CfnOutput, Duration, Stack, Size } from "aws-cdk-lib";
+import { Annotations, CfnOutput, Duration, Stack, Size } from "aws-cdk-lib";
 import { SingletonFunction as singletonFunction, Function, Code, Architecture, FunctionUrlAuthType, StartingPosition, LayerVersion } from "aws-cdk-lib/aws-lambda";
 import { FactName } from "aws-cdk-lib/region-info";
 import path from "node:path";
@@ -8,6 +8,8 @@ import { SqsEventSource, DynamoEventSource, S3EventSource } from "aws-cdk-lib/aw
 import { EventType } from "aws-cdk-lib/aws-s3";
 import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
 import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
+import { Queue, QueueEncryption } from "aws-cdk-lib/aws-sqs";
+import { SQS_LIMITS } from "../messaging/sqs.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 import { buildParameterPath } from "@fjall/util";
 import { resolveImportedSecret } from "../secrets/index.js";
@@ -66,6 +68,54 @@ const SECRETS_EXTENSION = {
  * mis-tune alarms relative to runtime behaviour.
  */
 const LAMBDA_DEFAULT_TIMEOUT_SECONDS = 300;
+/**
+ * Runtime names AWS Lambda has deprecated, mirrored from the `@deprecated`
+ * markers on `Runtime`'s static members in the vendored aws-cdk-lib
+ * (aws-lambda/lib/runtime.d.ts). The SDK exposes no runtime-readable
+ * deprecation flag on `Runtime` instances, so this set can drift when
+ * aws-cdk-lib is upgraded — lambda-deprecated-runtime.test.ts re-derives it
+ * from the vendored declaration file and fails on any mismatch.
+ */
+export const DEPRECATED_RUNTIME_NAMES = new Set([
+    "nodejs",
+    "nodejs4.3",
+    "nodejs6.10",
+    "nodejs8.10",
+    "nodejs10.x",
+    "nodejs12.x",
+    "nodejs14.x",
+    "nodejs16.x",
+    "nodejs18.x",
+    "python2.7",
+    "python3.6",
+    "python3.7",
+    "python3.8",
+    "python3.9",
+    "java8",
+    "dotnet6",
+    "dotnetcore1.0",
+    "dotnetcore2.0",
+    "dotnetcore2.1",
+    "dotnetcore3.1",
+    "go1.x",
+    "ruby2.5",
+    "ruby2.7",
+    "provided"
+]);
+/**
+ * Throw at synth time when a deprecated Lambda runtime is configured —
+ * shift-left of the posture scan's LAMBDA_DEPRECATED_RUNTIME finding, which
+ * previously let the deploy succeed and flagged it days later. A deprecated
+ * runtime receives no security patches and AWS eventually blocks function
+ * creation on it.
+ */
+export function validateRuntimeNotDeprecated(runtime, functionId) {
+    if (DEPRECATED_RUNTIME_NAMES.has(runtime.name)) {
+        throw new Error(`Lambda '${functionId}': runtime '${runtime.name}' is deprecated by ` +
+            `AWS Lambda. Migrate to a supported runtime — e.g. ` +
+            `Runtime.NODEJS_24_X for Node.js.`);
+    }
+}
 /**
  * Stable, deterministic uuid for a SingletonFunction so its logical ID
  * (`SingletonLambda${uuid-without-dashes}`) does not drift across synths. A
@@ -86,6 +136,7 @@ function deriveStableSingletonUuid(scope, id) {
 }
 export class SingletonFunction extends singletonFunction {
     constructor(scope, id, props) {
+        validateRuntimeNotDeprecated(props.runtime, id);
         super(scope, id, {
             ...props,
             uuid: props.uuid ?? deriveStableSingletonUuid(scope, id),
@@ -112,7 +163,10 @@ export class SingletonFunction extends singletonFunction {
 }
 export class LambdaFunction extends Function {
     functionUrlValue;
+    asyncFailureQueueProp;
+    asyncFailureQueueWired;
     constructor(scope, id, props) {
+        validateRuntimeNotDeprecated(props.runtime, id);
         const vpcSubnets = props.vpc
             ? { subnetType: resolvePrivateSubnetType(props.vpc) }
             : undefined;
@@ -130,6 +184,7 @@ export class LambdaFunction extends Function {
                 retention: props.logGroupRetention ?? DEFAULT_FRAMEWORK_LOG_RETENTION
             })
         });
+        this.asyncFailureQueueProp = props.asyncFailureQueue;
         addPoliciesToRole(this, props.inlinePolicy);
         applyRoleDescription(this, props.roleDescription);
         applyRolePathAndName(this, props.rolePath, props.roleName);
@@ -137,11 +192,19 @@ export class LambdaFunction extends Function {
         // Sanitise id for CloudFormation output keys (must be alphanumeric)
         const outputName = toPascalCase(id);
         if (props.enableFunctionUrl) {
+            const authType = props.functionUrlAuthType ?? FunctionUrlAuthType.AWS_IAM;
             const functionUrl = this.addFunctionUrl({
-                authType: props.functionUrlAuthType ?? FunctionUrlAuthType.AWS_IAM,
+                authType,
                 cors: props.functionUrlCors,
                 invokeMode: props.functionUrlInvokeMode
             });
+            if (authType === FunctionUrlAuthType.NONE &&
+                props.reservedConcurrentExecutions === undefined) {
+                Annotations.of(this).addWarning(`Lambda '${id}' exposes a public Function URL (authType NONE) ` +
+                    `without reservedConcurrentExecutions. An unauthenticated caller ` +
+                    `can drive unbounded invocations, taking spend and account-wide ` +
+                    `concurrency with it — set reservedConcurrentExecutions to cap it.`);
+            }
             this.functionUrlValue = functionUrl.url;
             new CfnOutput(this, `${outputName}FunctionUrl`, {
                 key: `${outputName}FunctionUrl`,
@@ -218,6 +281,9 @@ export class LambdaFunction extends Function {
      * Add an S3 bucket as an event source for this Lambda function.
      * This will trigger the Lambda when objects are created, modified, or deleted.
      * Useful for ISR cache invalidation and file processing workflows.
+     *
+     * S3 invokes asynchronously, so the first call also wires the async
+     * failure queue (see `asyncFailureQueue`) unless it is set to `false`.
      */
     addS3EventSource(bucket, options) {
         const eventTypes = (options?.events ?? ["OBJECT_CREATED"]).map((event) => {
@@ -246,6 +312,38 @@ export class LambdaFunction extends Function {
         };
         const eventSource = new S3EventSource(bucket, s3EventSourceProps);
         this.addEventSource(eventSource);
+        this.ensureAsyncFailureQueue();
+    }
+    /**
+     * Get the SQS queue wired as the async-invocation failure destination, if
+     * one has been created or supplied.
+     */
+    getAsyncFailureQueue() {
+        return this.asyncFailureQueueWired;
+    }
+    /**
+     * Wire the async-invocation dead-letter queue on first use. Without one,
+     * an event that fails all retries is silently dropped. `Function`'s
+     * `deadLetterQueue` prop is constructor-only and the queue is only wanted
+     * once an async event source exists, so reach the L1 `CfnFunction` and
+     * mirror what the prop does: DeadLetterConfig plus an sqs:SendMessage
+     * grant to the execution role.
+     */
+    ensureAsyncFailureQueue() {
+        if (this.asyncFailureQueueProp === false)
+            return;
+        if (this.asyncFailureQueueWired !== undefined)
+            return;
+        const queue = this.asyncFailureQueueProp ??
+            new Queue(this, "AsyncFailureQueue", {
+                enforceSSL: true,
+                encryption: QueueEncryption.SQS_MANAGED,
+                retentionPeriod: Duration.days(SQS_LIMITS.DEAD_LETTER_QUEUE.DEFAULT_RETENTION_DAYS)
+            });
+        this.asyncFailureQueueWired = queue;
+        const cfnFunction = this.node.defaultChild;
+        cfnFunction.deadLetterConfig = { targetArn: queue.queueArn };
+        queue.grantSendMessages(this);
     }
     /**
      * Add secrets support using AWS Parameters and Secrets Lambda Extension.

package/dist/lib/resources/aws/compute/listenerRouting.js

@@ -1,4 +1,4 @@
-import { ListenerAction } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { ListenerAction, SslPolicy } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 /**
  * Context-free ALB listener factory shared by the ECS cluster path and the dev
  * substrate. When `default404` is set, the listener's default action is a plain
@@ -25,7 +25,11 @@ export function addRoutingListener(loadBalancer, id, options) {
             certificates: [
                 options.certificate,
                 ...(options.additionalCertificates ?? [])
-            ]
+            ],
+            // TLS 1.3/1.2 only (ELBSecurityPolicy-TLS13-1-2-2021-06) — drops
+            // TLS 1.0/1.1 clients. HTTPS-only: CloudFormation rejects SslPolicy on
+            // a plain HTTP listener.
+            sslPolicy: SslPolicy.RECOMMENDED_TLS
         }),
         ...(defaultAction !== undefined && { defaultAction })
     });

package/dist/lib/resources/aws/database/dynamodb.d.ts

@@ -25,6 +25,7 @@ export interface DynamoDBTableProps {
     stream?: "NEW_IMAGE" | "OLD_IMAGE" | "NEW_AND_OLD_IMAGES" | "KEYS_ONLY";
     pointInTimeRecovery?: boolean;
     encryption?: "AWS_OWNED" | "AWS_MANAGED" | "CUSTOMER_MANAGED";
+    deletionProtection?: boolean;
     removalPolicy?: "DESTROY" | "RETAIN" | "SNAPSHOT";
 }
 export declare class DynamoDBTable extends Construct {

package/dist/lib/resources/aws/database/dynamodb.js

@@ -1,7 +1,7 @@
 import { Construct } from "constructs";
 import { CfnOutput } from "aws-cdk-lib";
 import { toRemovalPolicy } from "../../../utils/removalPolicy.js";
-import { Table, AttributeType, BillingMode, StreamViewType, ProjectionType } from "aws-cdk-lib/aws-dynamodb";
+import { Table, AttributeType, BillingMode, StreamViewType, ProjectionType, TableEncryption } from "aws-cdk-lib/aws-dynamodb";
 function toAttributeType(type) {
     switch (type) {
         case "S":
@@ -21,6 +21,17 @@ function toBillingMode(mode) {
             return BillingMode.PAY_PER_REQUEST;
     }
 }
+function toTableEncryption(encryption) {
+    switch (encryption) {
+        case "AWS_OWNED":
+            return TableEncryption.DEFAULT;
+        case "CUSTOMER_MANAGED":
+            return TableEncryption.CUSTOMER_MANAGED;
+        case "AWS_MANAGED":
+        default:
+            return TableEncryption.AWS_MANAGED;
+    }
+}
 function toStreamViewType(stream) {
     switch (stream) {
         case "NEW_IMAGE":
@@ -72,6 +83,8 @@ export class DynamoDBTable extends Construct {
             pointInTimeRecoverySpecification: {
                 pointInTimeRecoveryEnabled: props.pointInTimeRecovery ?? true
             },
+            encryption: toTableEncryption(props.encryption),
+            deletionProtection: props.deletionProtection ?? false,
             removalPolicy: toRemovalPolicy(props.removalPolicy),
             timeToLiveAttribute: props.timeToLiveAttribute
         });

package/dist/lib/resources/aws/database/rdsAurora.d.ts

@@ -97,6 +97,7 @@ export declare class RdsAurora extends Construct implements IConnectable {
     private databaseCredentials;
     private cfnCluster?;
     private databaseNameValue;
+    private backupRetentionDaysValue;
     constructor(scope: Construct, id: string, props: RdsProps);
     private buildReaders;
     private addProxy;
@@ -108,6 +109,13 @@ export declare class RdsAurora extends Construct implements IConnectable {
     getSnapshotTarget(): Extract<SnapshotTarget, {
         kind: "cluster";
     }>;
+    /**
+     * Effective automated-backup retention in whole days (the applied
+     * `backupRetention`, defaulted). Feeds `MIGRATION_SNAPSHOT_RETENTION_DAYS`
+     * so the migration runner prunes pre-migration snapshots against the same
+     * window the cluster's PITR actually covers.
+     */
+    getBackupRetentionDays(): number;
     getDatabaseName(): string;
     getConnectionString(): string;
     getCfnCluster(): CfnDBCluster | undefined;

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -62,6 +62,7 @@ export class RdsAurora extends Construct {
     databaseCredentials;
     cfnCluster;
     databaseNameValue;
+    backupRetentionDaysValue;
     constructor(scope, id, props) {
         super(scope, id);
         validateServerlessV2DevKnobs(props);
@@ -123,6 +124,11 @@ export class RdsAurora extends Construct {
         }
         // Allow external access when publicly accessible with allowed IP
         if (props.publiclyAccessible && props.allowedIpCidr) {
+            // "::/0" is deliberately not matched here: Peer.ipv4 below throws on any
+            // non-IPv4 CIDR before a warning could ever render.
+            if (props.allowedIpCidr === "0.0.0.0/0") {
+                Annotations.of(this).addWarningV2("@fjall/components-infrastructure:rdsWorldOpenIngress", `Database '${this.databaseNameValue}' is publicly accessible and allowedIpCidr '${props.allowedIpCidr}' opens its database port to the entire internet. Scope allowedIpCidr to the addresses that need access (e.g. "203.0.113.4/32").`);
+            }
             clusterSecurityGroup.addIngressRule(Peer.ipv4(props.allowedIpCidr), Port.tcp(this.port), "Allow external access from allowed IP");
         }
         this.connections = new Connections({
@@ -163,6 +169,8 @@ export class RdsAurora extends Construct {
         const vpcSubnets = props.publiclyAccessible
             ? { subnetType: SubnetType.PUBLIC }
             : { subnetType: SubnetType.PRIVATE_WITH_EGRESS };
+        this.backupRetentionDaysValue =
+            props.backupRetention ?? RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS;
         // Common props shared across all cluster creation paths
         const baseClusterProps = {
             vpc: props.vpc,
@@ -171,7 +179,7 @@ export class RdsAurora extends Construct {
             engine,
             parameterGroup,
             backup: {
-                retention: Duration.days(props.backupRetention ?? RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS)
+                retention: Duration.days(this.backupRetentionDaysValue)
             },
             storageEncrypted: true,
             ...(storageEncryptionKey && { storageEncryptionKey }),
@@ -361,6 +369,15 @@ export class RdsAurora extends Construct {
     getSnapshotTarget() {
         return { kind: "cluster", arn: this.databaseCluster.clusterArn };
     }
+    /**
+     * Effective automated-backup retention in whole days (the applied
+     * `backupRetention`, defaulted). Feeds `MIGRATION_SNAPSHOT_RETENTION_DAYS`
+     * so the migration runner prunes pre-migration snapshots against the same
+     * window the cluster's PITR actually covers.
+     */
+    getBackupRetentionDays() {
+        return this.backupRetentionDaysValue;
+    }
     getDatabaseName() {
         return this.databaseNameValue;
     }

package/dist/lib/resources/aws/database/rdsAuroraGlobal.d.ts

@@ -81,6 +81,13 @@ export declare class RdsAuroraGlobal extends Construct implements IConnectable {
         kind: "cluster";
     }>;
     getDatabaseName(): string;
+    /**
+     * Effective automated-backup retention in whole days, delegated to the
+     * regional cluster that actually applies the default. Feeds
+     * `MIGRATION_SNAPSHOT_RETENTION_DAYS` so the migration runner prunes
+     * pre-migration snapshots against the same window PITR actually covers.
+     */
+    getBackupRetentionDays(): number;
     getConnectionString(): string;
 }
 export {};

package/dist/lib/resources/aws/database/rdsAuroraGlobal.js

@@ -182,6 +182,21 @@ export class RdsAuroraGlobal extends Construct {
             return this.regionalCluster.getDatabaseName();
         throw new Error("No Aurora cluster available to return database name from");
     }
+    /**
+     * Effective automated-backup retention in whole days, delegated to the
+     * regional cluster that actually applies the default. Feeds
+     * `MIGRATION_SNAPSHOT_RETENTION_DAYS` so the migration runner prunes
+     * pre-migration snapshots against the same window PITR actually covers.
+     */
+    getBackupRetentionDays() {
+        if (this.primaryCluster) {
+            return this.primaryCluster.getBackupRetentionDays();
+        }
+        if (this.regionalCluster) {
+            return this.regionalCluster.getBackupRetentionDays();
+        }
+        throw new Error("No Aurora cluster available to return backup retention from");
+    }
     getConnectionString() {
         if (this.primaryCluster)
             return this.primaryCluster.getConnectionString();

package/dist/lib/resources/aws/database/rdsInstance.d.ts

@@ -33,11 +33,11 @@ interface RdsProps {
     publiclyAccessible?: boolean;
     deletionProtection?: boolean;
     /**
-     * Enable RDS IAM database authentication on the instance. Opt-in; defaults to
-     * off (undefined → CDK omits the property, leaving existing consumers' synth
-     * unchanged). When true, IAM principals granted via {@link grantIamConnect}
-     * connect with short-lived `rds-db:connect` tokens instead of a stored
-     * password — password auth keeps working in parallel. See ADR
+     * RDS IAM database authentication on the instance (and its read replica).
+     * Defaults to ON — free, and it grants nothing until {@link grantIamConnect};
+     * password auth keeps working in parallel. Pass false to opt out. For stacks
+     * deployed under the old opt-in default the false→true flip is a
+     * No-interruption CFN modify, so redeploying is safe. See ADR
      * decisions/2026-06-17-rls-role-auth-and-launch-gating.md.
      */
     iamAuthentication?: boolean;
@@ -71,6 +71,7 @@ export declare class RdsInstance extends Construct implements IConnectable {
     private databaseProxySecurityGroup?;
     private readReplicaSecurityGroup?;
     private databaseNameValue;
+    private backupRetentionDaysValue;
     private readonly constructId;
     constructor(scope: Construct, id: string, props: RdsProps);
     private addDatabase;
@@ -84,12 +85,19 @@ export declare class RdsInstance extends Construct implements IConnectable {
     getSnapshotTarget(): Extract<SnapshotTarget, {
         kind: "instance";
     }>;
+    /**
+     * Effective automated-backup retention in whole days (the applied
+     * `backupRetention`, defaulted). Feeds `MIGRATION_SNAPSHOT_RETENTION_DAYS`
+     * so the migration runner prunes pre-migration snapshots against the same
+     * window the instance's PITR actually covers.
+     */
+    getBackupRetentionDays(): number;
     getDatabaseName(): string;
     getConnectionString(): string;
     /**
      * Grant an IAM principal permission to connect as `dbUsername` via RDS IAM
-     * database authentication. Requires the instance to be created with
-     * `iamAuthentication: true`. Delegates to the L2 `grantConnect`, which scopes
+     * database authentication. Enabled by default; throws if the instance opted
+     * out with `iamAuthentication: false`. Delegates to the L2 `grantConnect`, which scopes
      * `rds-db:connect` to the exact `dbuser:<dbiResourceId>/<dbUsername>` ARN —
      * never a bare wildcard. See ADR
      * decisions/2026-06-17-rls-role-auth-and-launch-gating.md.

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -29,6 +29,7 @@ export class RdsInstance extends Construct {
     databaseProxySecurityGroup;
     readReplicaSecurityGroup;
     databaseNameValue;
+    backupRetentionDaysValue;
     constructId;
     constructor(scope, id, props) {
         super(scope, id);
@@ -121,6 +122,11 @@ export class RdsInstance extends Construct {
         const subnetType = props.publiclyAccessible
             ? SubnetType.PUBLIC
             : SubnetType.PRIVATE_WITH_EGRESS;
+        const backupRetention = props.backupRetention ??
+            Duration.days(RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS);
+        // toDays() throws on a fractional Duration — same whole-days contract the
+        // L2 DatabaseInstance enforces, surfaced at synth either way.
+        this.backupRetentionDaysValue = backupRetention.toDays();
         const commonInstanceProps = {
             vpc: this.vpc,
             vpcSubnets: {
@@ -130,8 +136,7 @@ export class RdsInstance extends Construct {
             engine,
             parameterGroup,
             allocatedStorage: props.allocatedStorage,
-            backupRetention: props.backupRetention ??
-                Duration.days(RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS),
+            backupRetention,
             preferredBackupWindow: props.preferredBackupWindow ?? "02:00-03:00",
             storageEncrypted: true,
             storageEncryptionKey,
@@ -156,7 +161,7 @@ export class RdsInstance extends Construct {
             preferredMaintenanceWindow: props.preferredMaintenanceWindow ??
                 RDS_DEFAULTS.PREFERRED_MAINTENANCE_WINDOW,
             publiclyAccessible: props.publiclyAccessible ?? false,
-            iamAuthentication: props.iamAuthentication
+            iamAuthentication: props.iamAuthentication ?? true
         };
         if (props.snapshotIdentifier) {
             // Create from snapshot
@@ -333,7 +338,8 @@ exports.handler = async (event) => {
             port: this.port,
             deletionProtection: props.deletionProtection ?? true,
             preferredMaintenanceWindow: props.preferredMaintenanceWindow ??
-                RDS_DEFAULTS.PREFERRED_MAINTENANCE_WINDOW
+                RDS_DEFAULTS.PREFERRED_MAINTENANCE_WINDOW,
+            iamAuthentication: props.iamAuthentication ?? true
         });
         readReplica.node.addDependency(deletionWaiter.resource);
     }
@@ -357,6 +363,15 @@ exports.handler = async (event) => {
     getSnapshotTarget() {
         return { kind: "instance", arn: this.database.instanceArn };
     }
+    /**
+     * Effective automated-backup retention in whole days (the applied
+     * `backupRetention`, defaulted). Feeds `MIGRATION_SNAPSHOT_RETENTION_DAYS`
+     * so the migration runner prunes pre-migration snapshots against the same
+     * window the instance's PITR actually covers.
+     */
+    getBackupRetentionDays() {
+        return this.backupRetentionDaysValue;
+    }
     getDatabaseName() {
         return this.databaseNameValue;
     }
@@ -365,8 +380,8 @@ exports.handler = async (event) => {
     }
     /**
      * Grant an IAM principal permission to connect as `dbUsername` via RDS IAM
-     * database authentication. Requires the instance to be created with
-     * `iamAuthentication: true`. Delegates to the L2 `grantConnect`, which scopes
+     * database authentication. Enabled by default; throws if the instance opted
+     * out with `iamAuthentication: false`. Delegates to the L2 `grantConnect`, which scopes
      * `rds-db:connect` to the exact `dbuser:<dbiResourceId>/<dbUsername>` ARN —
      * never a bare wildcard. See ADR
      * decisions/2026-06-17-rls-role-auth-and-launch-gating.md.

package/dist/lib/resources/aws/logging/cloudTrail.js

@@ -2,7 +2,7 @@ import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
 import * as CloudTrail from "aws-cdk-lib/aws-cloudtrail";
 import { Construct } from "constructs";
 import { CustomerManagedKey } from "../secrets/index.js";
-import { S3Bucket } from "../storage/index.js";
+import { NONCURRENT_VERSION_EXPIRY_DAYS, S3Bucket } from "../storage/index.js";
 import { BucketEncryption } from "aws-cdk-lib/aws-s3";
 import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 export function validateTrailProps(props) {
@@ -40,9 +40,18 @@ export class Trail extends Construct {
             bucketKeyEnabled: true,
             encryption: BucketEncryption.KMS,
             encryptionKey: this.encryptionKey.key,
-            versioned: false,
+            versioned: true,
             removalPolicy: storagePolicy,
-            lifecycleRules: [{ expiration: Duration.days(365), enabled: true }]
+            // Custom lifecycleRules bypass S3Bucket's automatic
+            // noncurrentVersionExpiration pairing — carried explicitly, or
+            // noncurrent versions accumulate forever.
+            lifecycleRules: [
+                {
+                    expiration: Duration.days(365),
+                    noncurrentVersionExpiration: Duration.days(NONCURRENT_VERSION_EXPIRY_DAYS),
+                    enabled: true
+                }
+            ]
         });
         const effectiveTrailName = props.trailName || `${id}Trail`;
         if (props.isOrganizationTrail === true) {

package/dist/lib/resources/aws/messaging/eventBridgeRule.js

@@ -2,7 +2,7 @@ import { Construct } from "constructs";
 import { Duration } from "aws-cdk-lib";
 import { Rule } from "aws-cdk-lib/aws-events";
 import { ServicePrincipal } from "aws-cdk-lib/aws-iam";
-import { SQSQueue } from "./sqs.js";
+import { SQSQueue, SQS_LIMITS } from "./sqs.js";
 import { resolveTarget } from "./eventTargets.js";
 import { createScheduleAlarms } from "../monitoring/scheduleAlarms.js";
 import { createSqsDlqAlarms } from "../monitoring/sqsAlarms.js";
@@ -69,7 +69,10 @@ export class EventBridgeRule extends Construct {
         }
         return {
             queue: new SQSQueue(this, `${id}Dlq`, {
-                queueType: "standard"
+                queueType: "standard",
+                // Same 14-day window as the SQS wrapper's auto-DLQ — without it the
+                // provisioned DLQ falls back to the 4-day CloudFormation default.
+                messageRetentionPeriod: Duration.days(SQS_LIMITS.DEAD_LETTER_QUEUE.DEFAULT_RETENTION_DAYS).toSeconds()
             }),
             provisioned: true
         };

package/dist/lib/resources/aws/messaging/sns.js

@@ -22,6 +22,13 @@ export class SNSTopic extends Construct {
                 ? (props.contentBasedDeduplication ?? true)
                 : undefined,
             signatureVersion: props.signatureVersion ?? "2",
+            // The TLS-only deny synthesises an AWS::SNS::TopicPolicy, and that
+            // resource REPLACES the topic's implicit default policy — so any AWS
+            // service principal that published under the default Allow needs an
+            // explicit Allow merged in via getTopic().addToResourcePolicy(...)
+            // (SharedAlarmTopic carries the cloudwatch.amazonaws.com one).
+            // Same-account IAM publishers are unaffected: identity policies suffice.
+            enforceSSL: true,
             masterKey: props.masterKey
         });
         // An SNS topic is a transient fan-out medium: it holds no durable state

package/dist/lib/resources/aws/messaging/sqs.js

@@ -118,6 +118,7 @@ export class SQSQueue extends Construct {
                     queueName: dlqName,
                     fifo: isFifo,
                     encryption: toEncryption(props.encryption),
+                    enforceSSL: true,
                     retentionPeriod: Duration.days(SQS_LIMITS.DEAD_LETTER_QUEUE.DEFAULT_RETENTION_DAYS),
                     removalPolicy: resolvedRemovalPolicy
                 });
@@ -156,6 +157,7 @@ export class SQSQueue extends Construct {
                 : undefined,
             deadLetterQueue,
             encryption: toEncryption(props.encryption),
+            enforceSSL: true,
             contentBasedDeduplication: isFifo
                 ? (props.contentBasedDeduplication ?? true)
                 : undefined,

package/dist/lib/resources/aws/networking/vpc.js

@@ -2,7 +2,7 @@ import { CfnOutput, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
 import * as ec2 from "aws-cdk-lib/aws-ec2";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import { LogGroup } from "../logging/logGroup.js";
-import { S3Bucket } from "../storage/index.js";
+import { NONCURRENT_VERSION_EXPIRY_DAYS, S3Bucket } from "../storage/index.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
 export const FLOW_LOG_TRAFFIC_TYPES = ["ALL", "ACCEPT", "REJECT"];
 // Read at two sites (resources-layer constructor default + patterns-layer natGateways guard) that must agree.
@@ -183,8 +183,19 @@ export class Vpc extends ec2.Vpc {
             const bucket = new S3Bucket(scope, `${id}FlowLogBucket`, {
                 bucketName: ResourceNaming.vpcFlowLogBucketName(id, Stack.of(scope).account),
                 encryption: s3.BucketEncryption.S3_MANAGED,
+                versioned: true,
+                // Custom lifecycleRules bypass S3Bucket's automatic
+                // noncurrentVersionExpiration pairing — carried explicitly, or
+                // noncurrent versions accumulate forever. The no-retentionDays branch
+                // passes undefined, so the wrapper's own pairing applies there.
                 lifecycleRules: config.retentionDays
-                    ? [{ expiration: Duration.days(config.retentionDays), enabled: true }]
+                    ? [
+                        {
+                            expiration: Duration.days(config.retentionDays),
+                            noncurrentVersionExpiration: Duration.days(NONCURRENT_VERSION_EXPIRY_DAYS),
+                            enabled: true
+                        }
+                    ]
                     : undefined
             });
             return {

package/dist/lib/resources/aws/secrets/parameter.js

@@ -1,4 +1,4 @@
-import { aws_ssm as ssm, Stack } from "aws-cdk-lib";
+import { Annotations, aws_ssm as ssm, Stack } from "aws-cdk-lib";
 import { PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
 import { Construct } from "constructs";
@@ -20,6 +20,12 @@ export class SecureStringParameter extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.name = props.name;
+        // Matches the || fall-through below: an empty-string value or env var
+        // also lands on the placeholder.
+        const resolvedValue = props.value || process.env[`CDK_SECURE_STRING_${id}`];
+        if (!resolvedValue) {
+            Annotations.of(this).addWarningV2("@fjall/components-infrastructure:secrets:secureStringPlaceholderValue", `SecureStringParameter '${props.name}' has no value source — the well-known literal 'placeholderValue' will be written to the SecureString on create and update, and consumers will silently read it. Supply a real value via the 'value' prop or the CDK_SECURE_STRING_${id} environment variable at synth time.`);
+        }
         if (props.cmk) {
             this.cmk = props.cmk;
         }
@@ -39,9 +45,7 @@ export class SecureStringParameter extends Construct {
                 parameters: {
                     Name: props.name,
                     Description: props.description || `${id} secure parameter`,
-                    Value: props.value ||
-                        process.env[`CDK_SECURE_STRING_${id}`] ||
-                        "placeholderValue",
+                    Value: resolvedValue || "placeholderValue",
                     Type: "SecureString",
                     KeyId: this.cmk.alias.keyId
                     // TODO: Add tags to the parameter
@@ -54,9 +58,7 @@ export class SecureStringParameter extends Construct {
                 parameters: {
                     Name: props.name,
                     Description: props.description || `${id} secure parameter`,
-                    Value: props.value ||
-                        process.env[`CDK_SECURE_STRING_${id}`] ||
-                        "placeholderValue",
+                    Value: resolvedValue || "placeholderValue",
                     Overwrite: props.overwrite,
                     Type: "SecureString",
                     KeyId: this.cmk.alias.keyId

package/dist/lib/resources/aws/secrets/secret.js

@@ -1,4 +1,4 @@
-import { SecretValue } from "aws-cdk-lib";
+import { Annotations, SecretValue } from "aws-cdk-lib";
 import { Secret as CdkSecret } from "aws-cdk-lib/aws-secretsmanager";
 import { Construct } from "constructs";
 import { CustomerManagedKey } from "./kms.js";
@@ -81,6 +81,10 @@ export class Secret extends Construct {
         /**
          * If a secretStringValue is provided, use it to create the secret.
          */
+        if (props.secretStringValue) {
+            // Gotcha: never interpolate the secret value into this message.
+            Annotations.of(this).addWarningV2("@fjall/components-infrastructure:secrets:plainTextSecretValue", `Secret '${id}' uses secretStringValue — the plain-text value is embedded verbatim in the synthesised CloudFormation template and every synth artefact (SecretValue.unsafePlainText). Prefer generateSecretString (server-generated, never leaves AWS) or secretObjectValue with SecretValue references (e.g. SecretValue.ssmSecure).`);
+        }
         const secretStringValue = props.secretStringValue
             ? {
                 secretStringValue: SecretValue.unsafePlainText(props.secretStringValue)

package/dist/lib/resources/aws/storage/s3.d.ts

@@ -2,6 +2,14 @@ import { Bucket, type BucketProps } from "aws-cdk-lib/aws-s3";
 import { type Construct } from "constructs";
 import { type BackupTier } from "../../../utils/backupTierMapping.js";
 export { SDK_PRE_EMPTY_TAG_KEY } from "@fjall/util/aws";
+/**
+ * Days a noncurrent object version is retained before lifecycle expiry.
+ * The wrapper pairs this automatically when it enables versioning; constructs
+ * passing custom `lifecycleRules` (cloudTrail, configRecorder, vpc flow logs)
+ * bypass that pairing and must carry the same value explicitly — coupled at
+ * every site so the retention window cannot drift.
+ */
+export declare const NONCURRENT_VERSION_EXPIRY_DAYS = 30;
 export interface WebsiteHostingConfig {
     readonly indexDocument: string;
     readonly errorDocument?: string;
@@ -31,6 +39,11 @@ export interface ResourcePolicyStatement {
  * `autoDeleteObjects` is accepted for source compatibility but always
  * overridden to `false` (ADR D4.3) — passing `true` raises a synth-time
  * warning rather than a compile error so older scaffolds keep building.
+ *
+ * Non-public buckets assert `BlockPublicAccess.BLOCK_ALL` in the template
+ * (caller `blockPublicAccess` wins); public/website buckets keep the two
+ * policy halves open but block the ACL halves. KMS-encrypted buckets default
+ * `bucketKeyEnabled: true` (pass `false` to opt out).
  */
 export interface S3BucketProps extends BucketProps {
     backupVaultTier?: BackupTier;

package/dist/lib/resources/aws/storage/s3.js

@@ -1,12 +1,20 @@
 import { SDK_PRE_EMPTY_TAG_KEY } from "@fjall/util/aws";
 import { Annotations, CfnOutput, Duration, RemovalPolicy, Tags } from "aws-cdk-lib";
-import { BlockPublicAccess, Bucket } from "aws-cdk-lib/aws-s3";
+import { BlockPublicAccess, Bucket, BucketEncryption } from "aws-cdk-lib/aws-s3";
 import { ArnPrincipal, Effect, PolicyStatement, StarPrincipal } from "aws-cdk-lib/aws-iam";
 import { RegionInfo } from "aws-cdk-lib/region-info";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "@fjall/util";
 import { envAwareRemovalPolicyDefault, toRemovalPolicy } from "../../../utils/removalPolicy.js";
 export { SDK_PRE_EMPTY_TAG_KEY } from "@fjall/util/aws";
+/**
+ * Days a noncurrent object version is retained before lifecycle expiry.
+ * The wrapper pairs this automatically when it enables versioning; constructs
+ * passing custom `lifecycleRules` (cloudTrail, configRecorder, vpc flow logs)
+ * bypass that pairing and must carry the same value explicitly — coupled at
+ * every site so the retention window cannot drift.
+ */
+export const NONCURRENT_VERSION_EXPIRY_DAYS = 30;
 function shouldAutoVersion(tier) {
     return tier === "resilient" || tier === "enterprise";
 }
@@ -22,6 +30,12 @@ export class S3Bucket extends Bucket {
         const isPublic = props.publicReadAccess === true || websiteHosting !== undefined;
         const versioned = props.versioned ?? shouldAutoVersion(backupVaultTier);
         const removalPolicy = props.removalPolicy ?? toRemovalPolicy(envAwareRemovalPolicyDefault());
+        // Mirrors the CDK Bucket's own resolution: an encryptionKey with no
+        // explicit encryption infers KMS. DSSE is excluded deliberately — S3
+        // Bucket Keys are not supported for dual-layer SSE-KMS.
+        const kmsEncryption = props.encryption === BucketEncryption.KMS ||
+            props.encryption === BucketEncryption.KMS_MANAGED ||
+            (props.encryption === undefined && props.encryptionKey !== undefined);
         super(scope, id, {
             ...cdkProps,
             enforceSSL: true,
@@ -31,14 +45,22 @@ export class S3Bucket extends Bucket {
             autoDeleteObjects: false,
             removalPolicy,
             publicReadAccess: isPublic,
-            ...(isPublic && {
-                blockPublicAccess: new BlockPublicAccess({
-                    blockPublicAcls: false,
+            // Public access here is bucket-policy-based, so only the policy halves
+            // stay open (grantPublicAccess validates against blockPublicPolicy
+            // alone); the ACL halves close — ACLs are disabled on modern buckets.
+            // Non-public buckets assert BLOCK_ALL in the template rather than
+            // relying on the creation-time account default, so a manually loosened
+            // bucket is healed on the next deploy.
+            blockPublicAccess: isPublic
+                ? new BlockPublicAccess({
+                    blockPublicAcls: true,
                     blockPublicPolicy: false,
-                    ignorePublicAcls: false,
+                    ignorePublicAcls: true,
                     restrictPublicBuckets: false
                 })
-            }),
+                : (props.blockPublicAccess ?? BlockPublicAccess.BLOCK_ALL),
+            ...(props.bucketKeyEnabled === undefined &&
+                kmsEncryption && { bucketKeyEnabled: true }),
             ...(websiteHosting && {
                 websiteIndexDocument: websiteHosting.indexDocument,
                 websiteErrorDocument: websiteHosting.errorDocument ?? "error.html"
@@ -54,7 +76,12 @@ export class S3Bucket extends Bucket {
                     enabled: true
                 },
                 ...(versioned && !props.lifecycleRules
-                    ? [{ noncurrentVersionExpiration: Duration.days(30), enabled: true }]
+                    ? [
+                        {
+                            noncurrentVersionExpiration: Duration.days(NONCURRENT_VERSION_EXPIRY_DAYS),
+                            enabled: true
+                        }
+                    ]
                     : (props.lifecycleRules ?? []))
             ]
         });

package/dist/lib/resources/aws/utilities/codeBuild.js

@@ -1,13 +1,24 @@
 import { Stack } from "aws-cdk-lib";
 import { Project } from "aws-cdk-lib/aws-codebuild";
 import { Construct } from "constructs";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
 export class CodeBuildProject extends Construct {
     project;
     constructor(scope, id, props) {
         super(scope, id);
         this.project = new Project(this, id, {
             ...props,
-            description: props.description || `Code build project for ${id}`
+            description: props.description || `Code build project for ${id}`,
+            // Without a logging prop CodeBuild auto-creates a never-expiring
+            // runtime log group outside CloudFormation; default to a framework
+            // group so retention and removal policy are governed.
+            logging: props.logging ?? {
+                cloudWatch: {
+                    logGroup: new LogGroup(this, `${id}LogGroup`, {
+                        retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+                    })
+                }
+            }
         });
     }
 }

package/dist/lib/utils/costAllocationTags.d.ts

@@ -1,6 +1,6 @@
-import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "@fjall/util/aws";
+import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER } from "@fjall/util/aws";
 import type { IConstruct } from "constructs";
-export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT };
+export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER };
 export interface CostAllocationTagsArgs {
     readonly service: string;
     readonly domain: string;

package/dist/lib/utils/costAllocationTags.js

@@ -1,9 +1,9 @@
-import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "@fjall/util/aws";
+import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER } from "@fjall/util/aws";
 import { Tags } from "aws-cdk-lib";
 // Canonical home: @fjall/util (`util/src/aws/costAllocationTags.ts`) — shared
 // with deploy-core's `cdk bootstrap --tags` stamping. Re-exported here so
 // construct-package consumers keep their existing import path.
-export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT };
+export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER };
 export function applyCostAllocationTags(scope, args) {
     if (args.environment !== undefined) {
         Tags.of(scope).add(COST_ALLOCATION_TAGS.ENVIRONMENT, args.environment);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "27.0.0",
+  "version": "28.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -78,8 +78,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^27.0.0",
-    "@fjall/util": "^27.0.0",
+    "@fjall/generator": "^28.0.0",
+    "@fjall/util": "^28.0.0",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },