@fjall/components-infrastructure 28.2.0 → 28.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -3,6 +3,13 @@ import { Alias, Key } from "aws-cdk-lib/aws-kms";
|
|
|
3
3
|
import { Construct } from "constructs";
|
|
4
4
|
export declare const KEY_PROTECTION_SCOPES: readonly ["stack-scoped", "outlives-stack"];
|
|
5
5
|
export type KeyProtectionScope = (typeof KEY_PROTECTION_SCOPES)[number];
|
|
6
|
+
/**
|
|
7
|
+
* Stamped on a key whose resolved removal policy RETAINs it, valued with the
|
|
8
|
+
* `protects` scope that justified the retention. Tags outlive the stack, so
|
|
9
|
+
* a posture scan can tell a key retained on purpose from one that was
|
|
10
|
+
* forgotten (tier-aware alert policy design §8 K4, `KMS_KEY_ORPHAN`).
|
|
11
|
+
*/
|
|
12
|
+
export { KMS_RETENTION_TAG_KEY } from "@fjall/util/aws";
|
|
6
13
|
interface CustomerManagedKeyProps {
|
|
7
14
|
description?: string;
|
|
8
15
|
aliasName?: string;
|
|
@@ -40,4 +47,3 @@ export declare class CustomerManagedKey extends Construct {
|
|
|
40
47
|
readonly alias: Alias;
|
|
41
48
|
constructor(scope: Construct, id: string, props: CustomerManagedKeyProps);
|
|
42
49
|
}
|
|
43
|
-
export {};
|
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { KMS_RETENTION_TAG_KEY } from "@fjall/util/aws";
|
|
2
|
+
import { CfnOutput, Duration, RemovalPolicy, Tags } from "aws-cdk-lib";
|
|
2
3
|
import { Alias, Key } from "aws-cdk-lib/aws-kms";
|
|
3
4
|
import { Construct } from "constructs";
|
|
4
5
|
import { toPascalCase } from "../../../utils/capitaliseString.js";
|
|
@@ -9,6 +10,13 @@ export const KEY_PROTECTION_SCOPES = [
|
|
|
9
10
|
"stack-scoped",
|
|
10
11
|
"outlives-stack"
|
|
11
12
|
];
|
|
13
|
+
/**
|
|
14
|
+
* Stamped on a key whose resolved removal policy RETAINs it, valued with the
|
|
15
|
+
* `protects` scope that justified the retention. Tags outlive the stack, so
|
|
16
|
+
* a posture scan can tell a key retained on purpose from one that was
|
|
17
|
+
* forgotten (tier-aware alert policy design §8 K4, `KMS_KEY_ORPHAN`).
|
|
18
|
+
*/
|
|
19
|
+
export { KMS_RETENTION_TAG_KEY } from "@fjall/util/aws";
|
|
12
20
|
/**
|
|
13
21
|
* How long a scheduled-for-deletion key stays recoverable.
|
|
14
22
|
*
|
|
@@ -44,6 +52,9 @@ export class CustomerManagedKey extends Construct {
|
|
|
44
52
|
? PENDING_DELETION_WINDOW
|
|
45
53
|
: undefined
|
|
46
54
|
});
|
|
55
|
+
if (removalPolicy === RemovalPolicy.RETAIN) {
|
|
56
|
+
Tags.of(this.key).add(KMS_RETENTION_TAG_KEY, props.protects);
|
|
57
|
+
}
|
|
47
58
|
new CfnOutput(this, `${outputName}KeyArn`, {
|
|
48
59
|
key: `${outputName}Arn`,
|
|
49
60
|
value: this.key.keyArn,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@fjall/components-infrastructure",
|
|
3
|
-
"version": "28.
|
|
3
|
+
"version": "28.4.0",
|
|
4
4
|
"repository": {
|
|
5
5
|
"type": "git",
|
|
6
6
|
"url": "git+https://github.com/fjall-tech/fjall.git",
|
|
@@ -78,8 +78,8 @@
|
|
|
78
78
|
},
|
|
79
79
|
"dependencies": {
|
|
80
80
|
"@aws-sdk/client-organizations": "^3.1098.0",
|
|
81
|
-
"@fjall/generator": "^28.
|
|
82
|
-
"@fjall/util": "^28.
|
|
81
|
+
"@fjall/generator": "^28.4.0",
|
|
82
|
+
"@fjall/util": "^28.4.0",
|
|
83
83
|
"constructs": "^10.7.2",
|
|
84
84
|
"zod": "^4.4.3"
|
|
85
85
|
},
|