@fjall/components-infrastructure 3.5.2 → 3.6.1

package/dist/lib/patterns/aws/domainValidation.js

@@ -86,29 +86,69 @@ function validateRecords(scope, props, effectiveZone) {
 }
 function validateCertificates(props, effectiveZone) {
     const certificates = props.certificates ?? [];
+    let cloudFrontCount = 0;
     for (const cert of certificates) {
         const resolved = normaliseCertificate(cert);
         assertWithinZone(resolved.domainName, effectiveZone);
         for (const san of resolved.subjectAlternativeNames ?? []) {
             assertWithinZone(san, effectiveZone);
         }
+        // D3 CloudFront designation consistency. TS already narrows the prop to
+        // boolean; the runtime check catches JS callers and stale generated code.
+        if (resolved.cloudFront !== undefined &&
+            typeof resolved.cloudFront !== "boolean") {
+            throw new Error(`Domain: certificate '${resolved.domainName}' has a non-boolean ` +
+                `'cloudFront' (received: ${JSON.stringify(resolved.cloudFront)}). ` +
+                `Cure: set cloudFront: true for a CloudFront viewer certificate, ` +
+                `or drop the prop.`);
+        }
+        if (resolved.cloudFront === true) {
+            cloudFrontCount += 1;
+            if (props.registrar === "external-records") {
+                throw new Error(`Domain: certificate '${resolved.domainName}' sets cloudFront: ` +
+                    `true, which registrar 'external-records' does not support — ` +
+                    `there is no Fjall-managed hosted zone to DNS-validate the ` +
+                    `us-east-1 certificate against. Cure: manage the zone with ` +
+                    `registrar 'route53' or 'external-delegated', or drop ` +
+                    `cloudFront and provision an app-owned us-east-1 certificate.`);
+            }
+        }
+    }
+    if (cloudFrontCount > 1) {
+        throw new Error(`Domain: at most one certificate may set cloudFront: true (received ` +
+            `${cloudFrontCount}) — the zone-level ` +
+            `'<zone>-us-east-1-certificate-arn' export is singular. Cure: keep ` +
+            `one CloudFront certificate and move the other names into its ` +
+            `subjectAlternativeNames.`);
     }
 }
 /**
  * D8 delegation-consistency checks for the child-writes shape.
  *
- * `parentDelegationRoleArn` and `phase` belong to the delegated topology
- * (`external-delegated`) only; on any other registrar their presence is a
- * hard error rather than a silent no-op. On the delegated topology the role
- * ARN must be a LITERAL string (VD2-a): an unresolved token means the caller
- * reached for `Fn.importValue`, which resolves same-account only and is
- * exactly the trap that sank the legacy `DomainDelegation` pattern.
+ * `parentDelegationRoleArn`, `phase` and `adoptedNameServers` belong to the
+ * delegated topology (`external-delegated`) only; on any other registrar
+ * their presence is a hard error rather than a silent no-op. On the
+ * delegated topology the role ARN must be a LITERAL string (VD2-a): an
+ * unresolved token means the caller reached for `Fn.importValue`, which
+ * resolves same-account only and is exactly the trap that sank the legacy
+ * `DomainDelegation` pattern. Adoption (`hostedZoneId` +
+ * `adoptedNameServers`) is both-or-neither: an imported zone exposes no
+ * NS attribute, so a one-sided declaration either cannot delegate or
+ * cannot name the zone it delegates to.
  */
 function validateDelegationConfig(props) {
     const arn = props
         .parentDelegationRoleArn;
     const phase = props.phase;
     if (props.registrar !== "external-delegated") {
+        const adoptedNameServers = props
+            .adoptedNameServers;
+        if (adoptedNameServers !== undefined) {
+            throw new Error(`Domain: 'adoptedNameServers' is only supported with registrar: ` +
+                `'external-delegated' (received registrar: '${props.registrar}'). ` +
+                `Cure: adoption of an existing child zone is declared on the ` +
+                `delegated child Domain — move the prop there, or drop it.`);
+        }
         if (arn !== undefined) {
             throw new Error(`Domain: 'parentDelegationRoleArn' is only supported with registrar: ` +
                 `'external-delegated' (received registrar: '${props.registrar}'). ` +
@@ -129,6 +169,7 @@ function validateDelegationConfig(props) {
             `received: '${String(phase)}'. Cure: use 'zone' for step 1 of the ` +
             `two-step delegated deploy, 'full' (or omit) for the complete build.`);
     }
+    validateAdoptionConfig(props);
     if (arn === undefined) {
         return;
     }
@@ -151,13 +192,60 @@ function validateDelegationConfig(props) {
             `output (arn:<partition>:iam::<account>:role/<name>).`);
     }
 }
+/**
+ * Child-zone ADOPTION consistency (external-delegated only). `hostedZoneId`
+ * and `adoptedNameServers` are both-or-neither, and the name servers must be
+ * a non-empty array of literal hostnames: an imported zone exposes no
+ * `hostedZoneNameServers` attribute, so these literals are the ONLY source
+ * the `Custom::CrossAccountZoneDelegation` UPSERT has for the parent NS row
+ * — a token or empty set would delegate the zone to nowhere.
+ */
+function validateAdoptionConfig(props) {
+    const hostedZoneId = props.hostedZoneId;
+    const adoptedNameServers = props
+        .adoptedNameServers;
+    if (hostedZoneId === undefined && adoptedNameServers === undefined) {
+        return;
+    }
+    if (adoptedNameServers === undefined) {
+        throw new Error(`Domain: adopting an existing child zone requires 'adoptedNameServers' ` +
+            `alongside 'hostedZoneId' (both-or-neither). An imported zone ` +
+            `exposes no name-server attribute at synth, so the parent NS UPSERT ` +
+            `needs the live values. Cure: read them once ` +
+            `(aws route53 get-hosted-zone --id ${String(hostedZoneId)}) and ` +
+            `paste the DelegationSet.NameServers literals.`);
+    }
+    if (hostedZoneId === undefined) {
+        throw new Error(`Domain: 'adoptedNameServers' requires 'hostedZoneId' (both-or-neither) ` +
+            `— the literals describe an EXISTING zone to adopt. Cure: set the ` +
+            `adopted zone's hostedZoneId, or drop 'adoptedNameServers' to create ` +
+            `a fresh child zone.`);
+    }
+    if (typeof hostedZoneId !== "string" || hostedZoneId.length === 0) {
+        throw new Error(`Domain: 'hostedZoneId' must be a non-empty string; received: ` +
+            `${JSON.stringify(hostedZoneId)}.`);
+    }
+    if (!Array.isArray(adoptedNameServers) || adoptedNameServers.length === 0) {
+        throw new Error(`Domain: 'adoptedNameServers' must be a non-empty array of NS ` +
+            `hostnames; received: ${JSON.stringify(adoptedNameServers)}. Cure: ` +
+            `paste the adopted zone's DelegationSet.NameServers.`);
+    }
+    for (const ns of adoptedNameServers) {
+        if (typeof ns !== "string" || ns.length === 0 || Token.isUnresolved(ns)) {
+            throw new Error(`Domain: every 'adoptedNameServers' entry must be a literal NS ` +
+                `hostname (no CDK tokens) — the delegation UPSERT writes them ` +
+                `verbatim into the parent zone. Received: ${JSON.stringify(ns)}.`);
+        }
+    }
+}
 function normaliseCertificate(cert) {
     if (typeof cert === "string") {
         return { domainName: cert };
     }
     return {
         domainName: cert.domainName,
-        subjectAlternativeNames: cert.subjectAlternativeNames
+        subjectAlternativeNames: cert.subjectAlternativeNames,
+        cloudFront: cert.cloudFront
     };
 }
 function assertWithinZone(candidate, zoneName) {

package/dist/lib/patterns/aws/interfaces/domain.d.ts

@@ -39,6 +39,22 @@ export type Certificate = string | {
     readonly domainName: string;
     readonly subjectAlternativeNames?: string[];
     readonly transparencyLogging?: boolean;
+    /**
+     * D3 — CloudFront viewer certificate. CloudFront accepts certificates
+     * from us-east-1 only, so a `cloudFront: true` entry mints its
+     * `DomainCertificate` there — in-stack when the domain stack itself
+     * resolves to us-east-1, otherwise in a domain-paired
+     * `<StackName>UsEast1Certificates` stack — and publishes the
+     * zone-level `<zone>-us-east-1-certificate-arn` export in place of
+     * the per-domain regional export. The ARN reaches CloudFront
+     * consumers as a LITERAL through
+     * `ManagedDomainBinding.usEast1CertificateArn` (D2 DescribeStacks),
+     * never via CDK cross-region references. At most one certificate per
+     * Domain may set it (the zone-level export is singular — put extra
+     * names in `subjectAlternativeNames`); unsupported on registrar
+     * `"external-records"`, which has no hosted zone to validate against.
+     */
+    readonly cloudFront?: boolean;
 };
 export interface DomainCommonProps {
     readonly zoneName: string;
@@ -55,6 +71,23 @@ export interface Route53ApexProps extends DomainCommonProps {
 export interface ExternalDelegatedProps extends DomainCommonProps {
     readonly registrar: "external-delegated";
     readonly delegatedSubdomain: string;
+    /**
+     * Child-zone ADOPTION: hosted zone id of an EXISTING zone for
+     * `{delegatedSubdomain}.{zoneName}`. When present the pattern IMPORTS the
+     * zone instead of creating one. Requires `adoptedNameServers`
+     * (both-or-neither — validated): an imported zone exposes no
+     * `hostedZoneNameServers` attribute at synth, so the parent NS UPSERT
+     * needs the live values as literals.
+     */
+    readonly hostedZoneId?: string;
+    /**
+     * Literal NS hostnames of the adopted zone (from a live
+     * `get-hosted-zone` read). Carried verbatim into the
+     * `Custom::CrossAccountZoneDelegation` UPSERT — the delegation record in
+     * the parent zone must keep pointing at the adopted zone's real name
+     * servers. Only valid together with `hostedZoneId`.
+     */
+    readonly adoptedNameServers?: string[];
     /**
      * D8 — child-writes delegation. LITERAL ARN of the parent zone's
      * DelegationRole (VD2-a: never `Fn.importValue`, which resolves

package/dist/lib/resources/aws/compute/ecs.js

@@ -9,7 +9,7 @@ import { createEcsServiceAlarms, createLogPatternAlarms } from "../monitoring/in
 import { CapacityProviderDependencyAspect } from "./ecsCapacityProviderAspect.js";
 import { validateEcsClusterProps } from "./ecsValidation.js";
 import { createExecutionRole, createTaskRole, createTaskDefinition, addContainersToTask, isServiceFargate, isServiceEc2 } from "./ecsTaskDefinition.js";
-import { addLoadBalancer, addLoadBalancerListener, addHostedZone, addDirectAccessOutputs, registerServiceWithALB } from "./ecsNetworking.js";
+import { addLoadBalancer, addLoadBalancerListener, addHostedZone, addDirectAccessOutputs, addRedirectHostRules, registerServiceWithALB } from "./ecsNetworking.js";
 import { createService, addServiceScaling, getOrCreateAsgCapacityProvider } from "./ecsServiceFactory.js";
 // Re-export all types/enums/constants so existing consumers are not broken
 export * from "./ecsTypes.js";
@@ -101,11 +101,15 @@ export default class EcsCluster extends Construct {
         if (!this.loadBalancerDisabled) {
             const lbResult = addLoadBalancer(this.ctx, this.anyServiceUsesEc2(), this.asgState.asgSecurityGroup);
             this.loadBalancer = lbResult.loadBalancer;
+            let hzResult;
             if (props.cluster?.domain || props.cluster?.domainConfig) {
-                const hzResult = addHostedZone(this.ctx, this.loadBalancer);
+                hzResult = addHostedZone(this.ctx, this.loadBalancer);
                 this.certificate = hzResult.certificate;
             }
-            this.loadBalancerListener = addLoadBalancerListener(this.ctx, this.loadBalancer, this.certificate);
+            this.loadBalancerListener = addLoadBalancerListener(this.ctx, this.loadBalancer, this.certificate, hzResult?.additionalListenerCertificates);
+            if (hzResult?.redirectRules !== undefined) {
+                addRedirectHostRules(this.ctx, this.loadBalancerListener, hzResult.redirectRules, this.priorityState);
+            }
         }
         else if (this.directAccessEnabled) {
             addDirectAccessOutputs(this.ctx, this.asgState.autoScalingGroup);

package/dist/lib/resources/aws/compute/ecsNetworking.d.ts

@@ -1,4 +1,4 @@
-import { type ApplicationListener, type ApplicationLoadBalancer, type IApplicationTargetGroup } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { type ApplicationListener, type ApplicationLoadBalancer, type IApplicationTargetGroup, type IListenerCertificate } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
 import { type ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 import { type ARecord, type IHostedZone } from "aws-cdk-lib/aws-route53";
@@ -13,11 +13,33 @@ export declare function addLoadBalancer(ctx: EcsConstructContext, anyServiceUses
     loadBalancer: ApplicationLoadBalancer;
     loadBalancerSecurityGroup?: SecurityGroup;
 };
-export declare function addLoadBalancerListener(ctx: EcsConstructContext, loadBalancer: ApplicationLoadBalancer, certificate?: ICertificate): ApplicationListener;
+export declare function addLoadBalancerListener(ctx: EcsConstructContext, loadBalancer: ApplicationLoadBalancer, certificate?: ICertificate, additionalCertificates?: IListenerCertificate[]): ApplicationListener;
+/**
+ * Redirect-hosts configuration resolved by `addHostedZone` for the listener
+ * step — the alias records are created during zone handling, but the 301
+ * rules can only attach once the listener exists.
+ */
+export interface EcsRedirectRuleConfig {
+    /** Redirect host FQDNs, validated within the cluster's zone. */
+    hostFqdns: string[];
+    /** Redirect target — the cluster's `domainName`. */
+    targetHost: string;
+}
+/**
+ * Permanent-redirect listener rules for `domainConfig.redirectHosts`: one
+ * host-header-matched rule per host, 301 to `https://<targetHost>` preserving
+ * the original path and query (RedirectConfig omits Path/Query, so ELB
+ * retains them). Priorities come from the deterministic host-hash band shared
+ * with slot rules — stable across synths, disjoint from the service-rule
+ * auto-increment counter.
+ */
+export declare function addRedirectHostRules(ctx: EcsConstructContext, listener: ApplicationListener, redirect: EcsRedirectRuleConfig, priorityState: PriorityState): void;
 export declare function addHostedZone(ctx: EcsConstructContext, loadBalancer?: ApplicationLoadBalancer): {
     hostedZone?: IHostedZone;
     certificate?: ICertificate;
     aRecord?: ARecord;
+    additionalListenerCertificates?: IListenerCertificate[];
+    redirectRules?: EcsRedirectRuleConfig;
 };
 export declare function addDirectAccessOutputs(ctx: EcsConstructContext, autoScalingGroup?: AutoScalingGroup): void;
 export declare function registerServiceWithALB(ctx: EcsConstructContext, listener: ApplicationListener, serviceName: string, serviceProps: EcsServiceProps, service: FargateService | Ec2Service, primaryContainer: ContainerDefinition, priorityState: PriorityState): IApplicationTargetGroup;

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -1,6 +1,6 @@
-import { ApplicationProtocol, ListenerAction } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { ApplicationProtocol, ListenerAction, ListenerCertificate, ListenerCondition } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { Port } from "aws-cdk-lib/aws-ec2";
-import { CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
+import { CfnOutput, Duration, Fn, Stack, Token } from "aws-cdk-lib";
 import { createHash } from "node:crypto";
 import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
 import { HostedZone as AWSHostedZone } from "aws-cdk-lib/aws-route53";
@@ -15,7 +15,7 @@ import { FjallLogger } from "../../../utils/validationLogger.js";
 import { isServiceEc2 } from "./ecsTaskDefinition.js";
 import { createApplicationLoadBalancer } from "./applicationLoadBalancer.js";
 import { addRoutingListener } from "./listenerRouting.js";
-import { buildRoutingConditions, getNextPriority } from "./hostHeaderListenerRule.js";
+import { buildRoutingConditions, deterministicHostPriority, getNextPriority } from "./hostHeaderListenerRule.js";
 export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
     const props = ctx.props;
     const defaultLoadBalancerName = `${props.clusterName}LoadBalancer`;
@@ -83,7 +83,7 @@ export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
     });
     return { loadBalancer, loadBalancerSecurityGroup };
 }
-export function addLoadBalancerListener(ctx, loadBalancer, certificate) {
+export function addLoadBalancerListener(ctx, loadBalancer, certificate, additionalCertificates) {
     const port = certificate ? 443 : 80;
     const servicesWithPorts = ctx.props.services.filter((s) => s.containers.some((c) => c.port !== undefined));
     const willHaveMultipleRoutes = servicesWithPorts.length > 1 ||
@@ -100,9 +100,34 @@ export function addLoadBalancerListener(ctx, loadBalancer, certificate) {
     return addRoutingListener(loadBalancer, `${ctx.props.clusterName}Listener`, {
         port,
         ...(certificate && { certificate }),
+        ...(additionalCertificates !== undefined &&
+            additionalCertificates.length > 0 && { additionalCertificates }),
         default404: willHaveMultipleRoutes || noServicePorts
     });
 }
+/**
+ * Permanent-redirect listener rules for `domainConfig.redirectHosts`: one
+ * host-header-matched rule per host, 301 to `https://<targetHost>` preserving
+ * the original path and query (RedirectConfig omits Path/Query, so ELB
+ * retains them). Priorities come from the deterministic host-hash band shared
+ * with slot rules — stable across synths, disjoint from the service-rule
+ * auto-increment counter.
+ */
+export function addRedirectHostRules(ctx, listener, redirect, priorityState) {
+    for (const host of redirect.hostFqdns) {
+        const safeHost = toPascalCase(getSafeZoneName(host));
+        listener.addAction(`Redirect${safeHost}`, {
+            conditions: [ListenerCondition.hostHeaders([host])],
+            priority: deterministicHostPriority(host, priorityState),
+            action: ListenerAction.redirect({
+                host: redirect.targetHost,
+                protocol: "HTTPS",
+                port: "443",
+                permanent: true
+            })
+        });
+    }
+}
 /**
  * Reproduce the CloudFormation logical ID CDK allocated for the pre-wrapper
  * raw `ARecord` at `<scope>/<id>` — i.e. for its `CfnRecordSet` default child
@@ -239,16 +264,40 @@ export function addHostedZone(ctx, loadBalancer) {
                 routedHosts.push(rule.host);
         }
     }
-    const subjectAlternativeNames = routedHosts.filter((h) => h !== domainName);
+    // Redirect hosts get the same completeness treatment as routed hosts (H7):
+    // an alias record, a SAN on a cluster-minted certificate, and — once the
+    // listener exists — a 301 rule (attached by the caller via
+    // addRedirectHostRules, since the listener is created after this step).
+    const redirectHosts = domainConfig?.redirectHosts ?? [];
+    for (const host of redirectHosts) {
+        if (!isWithinZone(host, zoneName)) {
+            throw new Error(`Cluster '${props.clusterName}': redirectHosts entry '${host}' is outside ` +
+                `hosted zone '${zoneName}' (got '${host}'). Its alias record cannot be ` +
+                `created here. Use a host under '${zoneName}', or redirect it from its ` +
+                "own Domain stack.");
+        }
+        if (host === domainName) {
+            throw new Error(`Cluster '${props.clusterName}': redirectHosts entry '${host}' equals the ` +
+                "cluster domain — it would redirect to itself. Remove it; the apex is " +
+                "already served by the cluster.");
+        }
+        if (routedHosts.includes(host)) {
+            throw new Error(`Cluster '${props.clusterName}': host '${host}' is both a service ` +
+                "routing.host and a redirectHosts entry. A host either serves traffic " +
+                "or redirects — remove it from one of the two.");
+        }
+    }
+    const subjectAlternativeNames = [...routedHosts, ...redirectHosts].filter((h) => h !== domainName);
     if (domainConfig?.certificate) {
         certificate = domainConfig.certificate;
     }
     if (certificate !== undefined) {
         if (subjectAlternativeNames.length > 0) {
-            FjallLogger.warn(`Cluster '${props.clusterName}': host-routed services rely on the supplied ` +
-                `certificate covering ${subjectAlternativeNames.join(", ")} — Fjall cannot ` +
-                "add SANs to an imported certificate. Ensure it carries these names or a " +
-                "matching wildcard, or TLS fails for those hosts.");
+            FjallLogger.warn(`Cluster '${props.clusterName}': host-routed services and redirect hosts ` +
+                `rely on the supplied certificate (or additionalCertificates) covering ` +
+                `${subjectAlternativeNames.join(", ")} — Fjall cannot add SANs to an ` +
+                "imported certificate. Ensure these names or a matching wildcard are " +
+                "covered, or TLS fails for those hosts.");
         }
     }
     else {
@@ -269,6 +318,7 @@ export function addHostedZone(ctx, loadBalancer) {
             exportCertificateArn: false
         }).certificate;
     }
+    const additionalListenerCertificates = resolveAdditionalListenerCertificates(ctx.scope, props.clusterName, domainConfig?.additionalCertificates, managed);
     let aRecord;
     if (loadBalancer) {
         const routingPolicy = domainConfig?.routingPolicy;
@@ -336,8 +386,84 @@ export function addHostedZone(ctx, loadBalancer) {
                 ...routingProps
             });
         }
+        for (const host of redirectHosts) {
+            const safeHost = toPascalCase(getSafeZoneName(host));
+            new AliasRecord(ctx.scope, `${props.clusterName}${safeHost}RedirectAliasRecord`, {
+                zone: hostedZone,
+                zoneName,
+                recordName: recordLabelWithin(host, zoneName),
+                target: new LoadBalancerTarget(loadBalancer, {
+                    evaluateTargetHealth: hasRoutingPolicy
+                }),
+                // Redirect records inherit the cluster's routing policy for the
+                // same reason host records do.
+                ...routingProps
+            });
+        }
+    }
+    return {
+        hostedZone,
+        certificate,
+        aRecord,
+        ...(additionalListenerCertificates.length > 0 && {
+            additionalListenerCertificates
+        }),
+        ...(redirectHosts.length > 0 && {
+            redirectRules: { hostFqdns: redirectHosts, targetHost: domainName }
+        })
+    };
+}
+const US_EAST_1 = "us-east-1";
+/**
+ * Resolve `domainConfig.additionalCertificates` to listener certificates.
+ * The `managedDomainCertificate: "usEast1"` selector consumes the D2-injected
+ * binding's literal `usEast1CertificateArn`. ACM certificates are regional,
+ * so the selector is valid only when the stack itself deploys to us-east-1 —
+ * anything else fails at synth rather than as CloudFormation's opaque
+ * deploy-time rejection.
+ */
+function resolveAdditionalListenerCertificates(scope, clusterName, sources, managed) {
+    if (sources === undefined || sources.length === 0)
+        return [];
+    const certificates = [];
+    for (const source of sources) {
+        if ("certificateArn" in source) {
+            certificates.push(ListenerCertificate.fromArn(source.certificateArn));
+            continue;
+        }
+        if (managed === undefined ||
+            !isManagedDomainBinding(managed) ||
+            managed.usEast1CertificateArn === undefined) {
+            throw new Error(`Cluster '${clusterName}': additionalCertificates requests the managed ` +
+                "domain's us-east-1 certificate, but no managed domain binding " +
+                "carrying usEast1CertificateArn is available. Deploy through the " +
+                "Fjall CLI with a domain stack that declares a cloudFront certificate " +
+                "for this zone, or supply certificateArn directly.");
+        }
+        const arn = managed.usEast1CertificateArn;
+        // Binding values are literals by contract (D2), so the ARN's region
+        // component is inspectable at synth.
+        const arnRegion = Token.isUnresolved(arn) ? undefined : arn.split(":")[3];
+        if (arnRegion !== US_EAST_1) {
+            throw new Error(`Cluster '${clusterName}': the managed domain binding's ` +
+                `usEast1CertificateArn must be a literal us-east-1 ACM ARN (got '${arn}'). ` +
+                "Redeploy the domain stack so its CloudFront certificate is " +
+                "provisioned in us-east-1, or correct the injected binding.");
+        }
+        const stackRegion = Stack.of(scope).region;
+        const resolvedRegion = Token.isUnresolved(stackRegion)
+            ? undefined
+            : stackRegion;
+        if (resolvedRegion !== US_EAST_1) {
+            throw new Error(`Cluster '${clusterName}': the managed domain's us-east-1 certificate ` +
+                "can only be attached to a listener in us-east-1 (stack region: " +
+                `'${resolvedRegion ?? "unresolved"}'). ACM certificates are regional — ` +
+                "declare a certificate in the cluster's own region on the domain " +
+                "stack, or supply certificateArn for a same-region certificate.");
+        }
+        certificates.push(ListenerCertificate.fromArn(arn));
     }
-    return { hostedZone, certificate, aRecord };
+    return certificates;
 }
 export function addDirectAccessOutputs(ctx, autoScalingGroup) {
     if (!ctx.directAccessEnabled || !autoScalingGroup)

package/dist/lib/resources/aws/compute/ecsServiceFactory.js

@@ -143,7 +143,13 @@ export function getOrCreateAsgCapacityProvider(ctx, serviceProps, state) {
         }),
         ...(resolvedWarmPool !== undefined && { warmPool: resolvedWarmPool }),
         ...(ec2Config.persistentDataVolume !== undefined && {
-            persistentDataVolume: ec2Config.persistentDataVolume
+            persistentDataVolume: {
+                ...ec2Config.persistentDataVolume,
+                ...(ec2Config.persistentDataVolume.alarmTopic === undefined &&
+                    ctx.props.alertsTopic !== undefined && {
+                    alarmTopic: ctx.props.alertsTopic
+                })
+            }
         }),
         ...(ec2Config.tags !== undefined && { tags: ec2Config.tags })
     });

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -178,6 +178,22 @@ export interface EcsLatencyRoutingPolicy {
     setIdentifier?: string;
 }
 export type EcsDomainRoutingPolicy = EcsLatencyRoutingPolicy;
+/**
+ * Source for an additional SNI certificate on the cluster's HTTPS listener.
+ *
+ * - `{ managedDomainCertificate: "usEast1" }` — the managed domain stack's
+ *   us-east-1 certificate, resolved from the CLI-injected
+ *   `ManagedDomainBinding.usEast1CertificateArn` (design D2/D3). Valid only
+ *   when the cluster's stack itself deploys to us-east-1 — ACM certificates
+ *   are regional, and an ALB accepts certificates from its own region only.
+ * - `{ certificateArn }` — an explicit ACM certificate ARN (BYO path; also
+ *   accepts a token from a certificate construct in the same app).
+ */
+export type EcsAdditionalListenerCertificate = {
+    managedDomainCertificate: "usEast1";
+} | {
+    certificateArn: string;
+};
 /**
  * Domain configuration for HTTPS and DNS.
  *
@@ -210,6 +226,27 @@ export interface DomainBaseConfig {
      * Omit for a plain alias record.
      */
     routingPolicy?: EcsDomainRoutingPolicy;
+    /**
+     * Hostnames (FQDNs within the zone, e.g. `"www.example.com"`) that
+     * permanently redirect to `domainName` at the ALB. Each host gets an alias
+     * A record targeting the ALB — inheriting the cluster's routing policy,
+     * exactly like host-routed service records — plus an HTTPS listener rule
+     * matching the host header and issuing a 301 to `https://<domainName>`,
+     * preserving the original path and query.
+     *
+     * TLS coverage: a cluster-minted certificate gains each host as a SAN
+     * automatically; an imported or managed certificate must already cover the
+     * host, or attach one via `additionalCertificates`.
+     */
+    redirectHosts?: string[];
+    /**
+     * Additional SNI certificates attached to the cluster's HTTPS listener
+     * (`AWS::ElasticLoadBalancingV2::ListenerCertificate`). Use when the
+     * primary certificate does not cover every served or redirected host —
+     * e.g. the managed domain's us-east-1 www/wildcard certificate for a
+     * `redirectHosts` entry.
+     */
+    additionalCertificates?: EcsAdditionalListenerCertificate[];
     /**
      * @deprecated Removed (design H8). `region` silently converted the record
      * to a latency routing policy with an auto-derived `setIdentifier`. Declare

package/dist/lib/resources/aws/compute/ecsValidation.js

@@ -29,6 +29,20 @@ export function validateEcsClusterProps(props) {
     validateEcsDomainConfig(props.cluster?.domainConfig, props.clusterName);
     const loadBalancerDisabled = props.cluster?.loadBalancer === false ||
         props.cluster?.directAccess === true;
+    if (loadBalancerDisabled) {
+        const domainConfig = props.cluster?.domainConfig;
+        const listenerFeature = (domainConfig?.redirectHosts?.length ?? 0) > 0
+            ? "redirectHosts"
+            : (domainConfig?.additionalCertificates?.length ?? 0) > 0
+                ? "additionalCertificates"
+                : undefined;
+        if (listenerFeature !== undefined) {
+            throw new Error(`Cluster '${props.clusterName}': domainConfig.${listenerFeature} requires the ` +
+                "cluster's load balancer, but it is disabled (loadBalancer: false or " +
+                "directAccess: true). Redirect rules and SNI certificates live on the ALB " +
+                "HTTPS listener — enable the load balancer or drop the setting.");
+        }
+    }
     // Validate services array
     if (!props.services || props.services.length === 0) {
         throw new Error("At least one service must be specified.");
@@ -223,6 +237,37 @@ export function validateEcsDomainConfig(domainConfig, clusterName) {
                 "set carries exactly one routing policy. Remove one of them.");
         }
     }
+    const redirectHosts = domainConfig.redirectHosts;
+    if (redirectHosts !== undefined) {
+        for (const host of redirectHosts) {
+            if (typeof host !== "string" || host.trim() === "") {
+                throw new Error(`${context}: redirectHosts entries must be non-empty host names ` +
+                    `(got ${JSON.stringify(host)}).`);
+            }
+        }
+        const duplicates = redirectHosts.filter((host, index) => redirectHosts.indexOf(host) !== index);
+        if (duplicates.length > 0) {
+            throw new Error(`${context}: duplicate redirectHosts: ${[...new Set(duplicates)].join(", ")}. ` +
+                "Each host can redirect once.");
+        }
+    }
+    const additionalCertificates = domainConfig.additionalCertificates;
+    if (additionalCertificates !== undefined) {
+        for (const entry of additionalCertificates) {
+            // Shape guard for JavaScript callers — the union is `never`-safe in TS
+            // but casts and untyped configs can still pass anything.
+            const isManagedSelector = "managedDomainCertificate" in entry &&
+                entry.managedDomainCertificate === "usEast1";
+            const isLiteralArn = "certificateArn" in entry &&
+                typeof entry.certificateArn === "string" &&
+                entry.certificateArn.trim() !== "";
+            if (!isManagedSelector && !isLiteralArn) {
+                throw new Error(`${context}: additionalCertificates entries must be ` +
+                    `{ managedDomainCertificate: "usEast1" } or { certificateArn: "<ACM ARN>" } ` +
+                    `(got ${JSON.stringify(entry)}).`);
+            }
+        }
+    }
 }
 /**
  * Validates an SSM path component for correctness.

package/dist/lib/resources/aws/compute/listenerRouting.d.ts

@@ -1,8 +1,17 @@
-import { type ApplicationListener, type ApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { type ApplicationListener, type ApplicationLoadBalancer, type IListenerCertificate } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import type { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 export interface RoutingListenerOptions {
     readonly port: number;
     readonly certificate?: ICertificate;
+    /**
+     * Additional SNI certificates. CDK keeps the first `certificates` entry on
+     * the listener resource itself and emits the rest as
+     * `AWS::ElasticLoadBalancingV2::ListenerCertificate` resources, so the
+     * primary certificate's CloudFormation shape is unchanged. Requires
+     * `certificate` — CloudFormation rejects certificates on an HTTP listener
+     * at deploy time, far too late.
+     */
+    readonly additionalCertificates?: IListenerCertificate[];
     /**
      * Attach a fixed 404 default action. The ECS path passes this conditionally
      * (only when ≥2 routes exist or no service has a port — CDK rejects a listener

package/dist/lib/resources/aws/compute/listenerRouting.js

@@ -6,6 +6,13 @@ import { ListenerAction } from "aws-cdk-lib/aws-elasticloadbalancingv2";
  * caller's target groups become the listener's default).
  */
 export function addRoutingListener(loadBalancer, id, options) {
+    if (options.certificate === undefined &&
+        options.additionalCertificates !== undefined &&
+        options.additionalCertificates.length > 0) {
+        throw new Error(`Listener '${id}': additionalCertificates require an HTTPS listener ` +
+            "(no primary certificate resolved, so this listener is HTTP). " +
+            "CloudFormation would reject the ListenerCertificate at deploy time.");
+    }
     const defaultAction = options.default404
         ? ListenerAction.fixedResponse(404, {
             contentType: "text/plain",
@@ -14,7 +21,12 @@ export function addRoutingListener(loadBalancer, id, options) {
         : undefined;
     return loadBalancer.addListener(id, {
         port: options.port,
-        ...(options.certificate && { certificates: [options.certificate] }),
+        ...(options.certificate && {
+            certificates: [
+                options.certificate,
+                ...(options.additionalCertificates ?? [])
+            ]
+        }),
         ...(defaultAction !== undefined && { defaultAction })
     });
 }