@fjall/components-infrastructure 3.6.0 → 3.7.0

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -361,6 +361,7 @@ export class ClickHouseDatabase extends Construct {
             clickHouseContainerSecrets[userPasswordEnvName(name)] =
                 userSecret.getImport("password");
         }
+        const resolvedAlertsTopic = resolveAlertsTopic(this, "AlertsTopic", props.alertsTopic);
         const ecsCompute = new EcsCompute(this, "Compute", {
             type: "ecs",
             vpc,
@@ -393,7 +394,10 @@ export class ClickHouseDatabase extends Construct {
                             deviceName: CLICKHOUSE_EBS_DEVICE_NAME,
                             availabilityZone: dataAz,
                             iops: CLICKHOUSE_EBS_IOPS,
-                            throughputMbps: CLICKHOUSE_EBS_THROUGHPUT_MBPS
+                            throughputMbps: CLICKHOUSE_EBS_THROUGHPUT_MBPS,
+                            ...(resolvedAlertsTopic !== undefined && {
+                                alarmTopic: resolvedAlertsTopic
+                            })
                         },
                         userData,
                         desiredCapacity: 1,
@@ -492,7 +496,6 @@ export class ClickHouseDatabase extends Construct {
         // asgName is the CloudWatch dimension the host metrics key off, so without
         // it the alarms cannot be built; no topic is the default, so skip silently
         // rather than throw.
-        const resolvedAlertsTopic = resolveAlertsTopic(this, "AlertsTopic", props.alertsTopic);
         const asgName = ecsCompute.getAutoScalingGroupName();
         if (resolvedAlertsTopic !== undefined && asgName !== undefined) {
             createClickHouseAlarms({

package/dist/lib/patterns/aws/devSubstrate.js

@@ -5,6 +5,7 @@ import { Repository } from "aws-cdk-lib/aws-ecr";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { PublicHostedZone } from "aws-cdk-lib/aws-route53";
+import { LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { SqsDestination } from "aws-cdk-lib/aws-s3-notifications";
 import { Construct } from "constructs";
 import { readFileSync } from "node:fs";
@@ -20,6 +21,7 @@ import { createLambdaTargetGroup } from "../../resources/aws/compute/lambdaAlbTa
 import { LambdaFunction } from "../../resources/aws/compute/lambda.js";
 import { Ecr } from "../../resources/aws/storage/ecr.js";
 import { SecurityGroup } from "../../resources/aws/networking/securityGroup.js";
+import { AliasRecord } from "../../resources/aws/networking/dnsRecord/aliasRecord.js";
 import { HostedZone } from "../../resources/aws/networking/hostedZone.js";
 import { CrossAccountDelegationRecord } from "../../resources/aws/networking/crossAccountDelegationRecord.js";
 import { DomainCertificate } from "../../resources/aws/networking/domainCertificate.js";
@@ -56,6 +58,7 @@ const DEV_SUBSTRATE_PARENT_ROLE_ID = "DevSubstrateParentDelegationRole";
 /** Construct ids for the substrate's wildcard cert + :443 HTTPS listener (A6). */
 const DEV_SUBSTRATE_CERT_ID = "DevSubstrateCertificate";
 const DEV_SUBSTRATE_HTTPS_LISTENER_ID = "DevSubstrateHttpsListener";
+const DEV_SUBSTRATE_WILDCARD_ALIAS_ID = "DevSubstrateWildcardAlias";
 // Default deploy phase when `phase` is omitted — the cert + :443 listener
 // build. Shared with the delegated `Domain` topology via
 // `DOMAIN_DEPLOY_DEFAULT_PHASE` (utils/domainTypes.ts): the R2 two-step guard
@@ -68,13 +71,6 @@ const DEV_SUBSTRATE_HTTPS_LISTENER_ID = "DevSubstrateHttpsListener";
  * `point-at-existing` (GAP-7) is deferred, so this is a fixed value for now.
  */
 const DEV_SUBSTRATE_DATABASE_MODE = "aurora";
-/**
- * The container port slots serve HTTP on. Fjall owns the slot image, so this is a
- * fixed contract: the ALB → slot-SG ingress opens exactly this port and the
- * host-header rules a slot registers (§5.4) forward to it. The public :80 ALB
- * front listener is separate.
- */
-const DEV_SUBSTRATE_SLOT_PORT = 8080;
 /**
  * Physical-name prefix pinning every substrate resource inside the `fjall-dev-*`
  * fence. Load-bearing: the dev-tier IAM grants (`@fjall/generator devRolePolicies`)
@@ -210,17 +206,24 @@ export class DevSubstrate extends Construct {
         // explicitly. Path + name pin the role inside the /fjall/dev/ fence: the dev
         // deploy role's only iam:PassRole grant is on role/fjall/dev/*, so the CDK
         // defaults (path "/", CFN-generated name) would AccessDeny slot task-def
-        // registration.
+        // registration. ssmSecretsPath grants the slot parameter tree — the worker
+        // writes DATABASE_URL + FJALL_* under /fjall/dev/<app>/<slot>/ and slot
+        // task-defs inject them via this role; without it the task dies at
+        // ResourceInitializationError on ssm:GetParameters.
         const slotExecutionRole = createBaseExecutionRole(this, DEV_SUBSTRATE_SLOT_EXEC_ROLE_ID, {
+            ssmSecretsPath: `/fjall/dev/${props.appKebab}`,
             path: "/fjall/dev/",
             roleName: `${devFenceName(props.appKebab)}-slot-exec`
         });
         const { partition, region, account } = Stack.of(this);
+        // Whole app dev-fence subtree, not /slots/* — the worker names each slot's
+        // log group /fjall/dev/<app>/<slot> (the slot base path), so a /slots/*
+        // scope would deny CreateLogStream at task start.
         slotExecutionRole.addToPolicy(new PolicyStatement({
             effect: Effect.ALLOW,
             actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
             resources: [
-                `arn:${partition}:logs:${region}:${account}:log-group:/fjall/dev/${props.appKebab}/slots/*:*`
+                `arn:${partition}:logs:${region}:${account}:log-group:/fjall/dev/${props.appKebab}/*:*`
             ]
         }));
         // Slot-SG → Aurora ingress. Dormant in Data-API mode (Data API reaches the
@@ -258,7 +261,11 @@ export class DevSubstrate extends Construct {
         // fence-pinned name — the reaper finds it by the subtree fence tags. A pinned
         // name would only reintroduce the 32-char ALB-name truncation dance.
         const loadBalancer = createApplicationLoadBalancer(this, DEV_SUBSTRATE_ALB_ID, { vpc, internetFacing: true, securityGroup: albSecurityGroup });
-        slotSecurityGroup.connections.allowFrom(albSecurityGroup, Port.tcp(DEV_SUBSTRATE_SLOT_PORT), 
+        // All-TCP, not a pinned port: the worker registers each slot's target group
+        // on the per-slot `buildSpec.containerPort` (default 3000, `--port`
+        // overridable), chosen at provision time — synth cannot know it. Scope stays
+        // tight because the source is the substrate's own ALB SG.
+        slotSecurityGroup.connections.allowFrom(albSecurityGroup, Port.allTcp(), 
         // EC2 SG-rule descriptions reject non-ASCII (allowed set is
         // `a-zA-Z0-9. _-:/()#,@[]+=&;{}!$*` — no arrow, em-dash, or even `>`).
         "Dev substrate ALB to slot tasks");
@@ -376,6 +383,17 @@ export class DevSubstrate extends Construct {
         // Unconditional 404 as on :80 (per-slot rules attach out of band, §5.4). open
         // (CDK default) adds the :443 ingress to the ALB SG.
         const httpsListener = addRoutingListener(loadBalancer, DEV_SUBSTRATE_HTTPS_LISTENER_ID, { port: 443, certificate: certificate.certificate, default404: true });
+        // GAP-4: one wildcard ALIAS resolves every slot host to the ALB — routing
+        // happens per-slot via host-header rules, so no per-slot DNS write is ever
+        // needed. Phase-gated with the cert (the record is useless before :443
+        // exists) and created in adopt mode too: the adopted zone predates the
+        // substrate, but the record targets the substrate's own ALB.
+        new AliasRecord(this, DEV_SUBSTRATE_WILDCARD_ALIAS_ID, {
+            zone: childZone,
+            zoneName: childZoneName,
+            recordName: "*",
+            target: new LoadBalancerTarget(loadBalancer)
+        });
         return { devDomain: childZoneName, httpsListener };
     }
     /**

package/dist/lib/resources/aws/compute/ecs.js

@@ -9,7 +9,7 @@ import { createEcsServiceAlarms, createLogPatternAlarms } from "../monitoring/in
 import { CapacityProviderDependencyAspect } from "./ecsCapacityProviderAspect.js";
 import { validateEcsClusterProps } from "./ecsValidation.js";
 import { createExecutionRole, createTaskRole, createTaskDefinition, addContainersToTask, isServiceFargate, isServiceEc2 } from "./ecsTaskDefinition.js";
-import { addLoadBalancer, addLoadBalancerListener, addHostedZone, addDirectAccessOutputs, registerServiceWithALB } from "./ecsNetworking.js";
+import { addLoadBalancer, addLoadBalancerListener, addHostedZone, addDirectAccessOutputs, addRedirectHostRules, registerServiceWithALB } from "./ecsNetworking.js";
 import { createService, addServiceScaling, getOrCreateAsgCapacityProvider } from "./ecsServiceFactory.js";
 // Re-export all types/enums/constants so existing consumers are not broken
 export * from "./ecsTypes.js";
@@ -101,11 +101,15 @@ export default class EcsCluster extends Construct {
         if (!this.loadBalancerDisabled) {
             const lbResult = addLoadBalancer(this.ctx, this.anyServiceUsesEc2(), this.asgState.asgSecurityGroup);
             this.loadBalancer = lbResult.loadBalancer;
+            let hzResult;
             if (props.cluster?.domain || props.cluster?.domainConfig) {
-                const hzResult = addHostedZone(this.ctx, this.loadBalancer);
+                hzResult = addHostedZone(this.ctx, this.loadBalancer);
                 this.certificate = hzResult.certificate;
             }
-            this.loadBalancerListener = addLoadBalancerListener(this.ctx, this.loadBalancer, this.certificate);
+            this.loadBalancerListener = addLoadBalancerListener(this.ctx, this.loadBalancer, this.certificate, hzResult?.additionalListenerCertificates);
+            if (hzResult?.redirectRules !== undefined) {
+                addRedirectHostRules(this.ctx, this.loadBalancerListener, hzResult.redirectRules, this.priorityState);
+            }
         }
         else if (this.directAccessEnabled) {
             addDirectAccessOutputs(this.ctx, this.asgState.autoScalingGroup);

package/dist/lib/resources/aws/compute/ecsNetworking.d.ts

@@ -1,4 +1,4 @@
-import { type ApplicationListener, type ApplicationLoadBalancer, type IApplicationTargetGroup } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { type ApplicationListener, type ApplicationLoadBalancer, type IApplicationTargetGroup, type IListenerCertificate } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
 import { type ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 import { type ARecord, type IHostedZone } from "aws-cdk-lib/aws-route53";
@@ -13,11 +13,33 @@ export declare function addLoadBalancer(ctx: EcsConstructContext, anyServiceUses
     loadBalancer: ApplicationLoadBalancer;
     loadBalancerSecurityGroup?: SecurityGroup;
 };
-export declare function addLoadBalancerListener(ctx: EcsConstructContext, loadBalancer: ApplicationLoadBalancer, certificate?: ICertificate): ApplicationListener;
+export declare function addLoadBalancerListener(ctx: EcsConstructContext, loadBalancer: ApplicationLoadBalancer, certificate?: ICertificate, additionalCertificates?: IListenerCertificate[]): ApplicationListener;
+/**
+ * Redirect-hosts configuration resolved by `addHostedZone` for the listener
+ * step — the alias records are created during zone handling, but the 301
+ * rules can only attach once the listener exists.
+ */
+export interface EcsRedirectRuleConfig {
+    /** Redirect host FQDNs, validated within the cluster's zone. */
+    hostFqdns: string[];
+    /** Redirect target — the cluster's `domainName`. */
+    targetHost: string;
+}
+/**
+ * Permanent-redirect listener rules for `domainConfig.redirectHosts`: one
+ * host-header-matched rule per host, 301 to `https://<targetHost>` preserving
+ * the original path and query (RedirectConfig omits Path/Query, so ELB
+ * retains them). Priorities come from the deterministic host-hash band shared
+ * with slot rules — stable across synths, disjoint from the service-rule
+ * auto-increment counter.
+ */
+export declare function addRedirectHostRules(ctx: EcsConstructContext, listener: ApplicationListener, redirect: EcsRedirectRuleConfig, priorityState: PriorityState): void;
 export declare function addHostedZone(ctx: EcsConstructContext, loadBalancer?: ApplicationLoadBalancer): {
     hostedZone?: IHostedZone;
     certificate?: ICertificate;
     aRecord?: ARecord;
+    additionalListenerCertificates?: IListenerCertificate[];
+    redirectRules?: EcsRedirectRuleConfig;
 };
 export declare function addDirectAccessOutputs(ctx: EcsConstructContext, autoScalingGroup?: AutoScalingGroup): void;
 export declare function registerServiceWithALB(ctx: EcsConstructContext, listener: ApplicationListener, serviceName: string, serviceProps: EcsServiceProps, service: FargateService | Ec2Service, primaryContainer: ContainerDefinition, priorityState: PriorityState): IApplicationTargetGroup;

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -1,6 +1,6 @@
-import { ApplicationProtocol, ListenerAction } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { ApplicationProtocol, ListenerAction, ListenerCertificate, ListenerCondition } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { Port } from "aws-cdk-lib/aws-ec2";
-import { CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
+import { CfnOutput, Duration, Fn, Stack, Token } from "aws-cdk-lib";
 import { createHash } from "node:crypto";
 import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
 import { HostedZone as AWSHostedZone } from "aws-cdk-lib/aws-route53";
@@ -15,7 +15,7 @@ import { FjallLogger } from "../../../utils/validationLogger.js";
 import { isServiceEc2 } from "./ecsTaskDefinition.js";
 import { createApplicationLoadBalancer } from "./applicationLoadBalancer.js";
 import { addRoutingListener } from "./listenerRouting.js";
-import { buildRoutingConditions, getNextPriority } from "./hostHeaderListenerRule.js";
+import { buildRoutingConditions, deterministicHostPriority, getNextPriority } from "./hostHeaderListenerRule.js";
 export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
     const props = ctx.props;
     const defaultLoadBalancerName = `${props.clusterName}LoadBalancer`;
@@ -83,7 +83,7 @@ export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
     });
     return { loadBalancer, loadBalancerSecurityGroup };
 }
-export function addLoadBalancerListener(ctx, loadBalancer, certificate) {
+export function addLoadBalancerListener(ctx, loadBalancer, certificate, additionalCertificates) {
     const port = certificate ? 443 : 80;
     const servicesWithPorts = ctx.props.services.filter((s) => s.containers.some((c) => c.port !== undefined));
     const willHaveMultipleRoutes = servicesWithPorts.length > 1 ||
@@ -100,9 +100,34 @@ export function addLoadBalancerListener(ctx, loadBalancer, certificate) {
     return addRoutingListener(loadBalancer, `${ctx.props.clusterName}Listener`, {
         port,
         ...(certificate && { certificate }),
+        ...(additionalCertificates !== undefined &&
+            additionalCertificates.length > 0 && { additionalCertificates }),
         default404: willHaveMultipleRoutes || noServicePorts
     });
 }
+/**
+ * Permanent-redirect listener rules for `domainConfig.redirectHosts`: one
+ * host-header-matched rule per host, 301 to `https://<targetHost>` preserving
+ * the original path and query (RedirectConfig omits Path/Query, so ELB
+ * retains them). Priorities come from the deterministic host-hash band shared
+ * with slot rules — stable across synths, disjoint from the service-rule
+ * auto-increment counter.
+ */
+export function addRedirectHostRules(ctx, listener, redirect, priorityState) {
+    for (const host of redirect.hostFqdns) {
+        const safeHost = toPascalCase(getSafeZoneName(host));
+        listener.addAction(`Redirect${safeHost}`, {
+            conditions: [ListenerCondition.hostHeaders([host])],
+            priority: deterministicHostPriority(host, priorityState),
+            action: ListenerAction.redirect({
+                host: redirect.targetHost,
+                protocol: "HTTPS",
+                port: "443",
+                permanent: true
+            })
+        });
+    }
+}
 /**
  * Reproduce the CloudFormation logical ID CDK allocated for the pre-wrapper
  * raw `ARecord` at `<scope>/<id>` — i.e. for its `CfnRecordSet` default child
@@ -239,16 +264,40 @@ export function addHostedZone(ctx, loadBalancer) {
                 routedHosts.push(rule.host);
         }
     }
-    const subjectAlternativeNames = routedHosts.filter((h) => h !== domainName);
+    // Redirect hosts get the same completeness treatment as routed hosts (H7):
+    // an alias record, a SAN on a cluster-minted certificate, and — once the
+    // listener exists — a 301 rule (attached by the caller via
+    // addRedirectHostRules, since the listener is created after this step).
+    const redirectHosts = domainConfig?.redirectHosts ?? [];
+    for (const host of redirectHosts) {
+        if (!isWithinZone(host, zoneName)) {
+            throw new Error(`Cluster '${props.clusterName}': redirectHosts entry '${host}' is outside ` +
+                `hosted zone '${zoneName}' (got '${host}'). Its alias record cannot be ` +
+                `created here. Use a host under '${zoneName}', or redirect it from its ` +
+                "own Domain stack.");
+        }
+        if (host === domainName) {
+            throw new Error(`Cluster '${props.clusterName}': redirectHosts entry '${host}' equals the ` +
+                "cluster domain — it would redirect to itself. Remove it; the apex is " +
+                "already served by the cluster.");
+        }
+        if (routedHosts.includes(host)) {
+            throw new Error(`Cluster '${props.clusterName}': host '${host}' is both a service ` +
+                "routing.host and a redirectHosts entry. A host either serves traffic " +
+                "or redirects — remove it from one of the two.");
+        }
+    }
+    const subjectAlternativeNames = [...routedHosts, ...redirectHosts].filter((h) => h !== domainName);
     if (domainConfig?.certificate) {
         certificate = domainConfig.certificate;
     }
     if (certificate !== undefined) {
         if (subjectAlternativeNames.length > 0) {
-            FjallLogger.warn(`Cluster '${props.clusterName}': host-routed services rely on the supplied ` +
-                `certificate covering ${subjectAlternativeNames.join(", ")} — Fjall cannot ` +
-                "add SANs to an imported certificate. Ensure it carries these names or a " +
-                "matching wildcard, or TLS fails for those hosts.");
+            FjallLogger.warn(`Cluster '${props.clusterName}': host-routed services and redirect hosts ` +
+                `rely on the supplied certificate (or additionalCertificates) covering ` +
+                `${subjectAlternativeNames.join(", ")} — Fjall cannot add SANs to an ` +
+                "imported certificate. Ensure these names or a matching wildcard are " +
+                "covered, or TLS fails for those hosts.");
         }
     }
     else {
@@ -269,6 +318,7 @@ export function addHostedZone(ctx, loadBalancer) {
             exportCertificateArn: false
         }).certificate;
     }
+    const additionalListenerCertificates = resolveAdditionalListenerCertificates(ctx.scope, props.clusterName, domainConfig?.additionalCertificates, managed);
     let aRecord;
     if (loadBalancer) {
         const routingPolicy = domainConfig?.routingPolicy;
@@ -336,8 +386,84 @@ export function addHostedZone(ctx, loadBalancer) {
                 ...routingProps
             });
         }
+        for (const host of redirectHosts) {
+            const safeHost = toPascalCase(getSafeZoneName(host));
+            new AliasRecord(ctx.scope, `${props.clusterName}${safeHost}RedirectAliasRecord`, {
+                zone: hostedZone,
+                zoneName,
+                recordName: recordLabelWithin(host, zoneName),
+                target: new LoadBalancerTarget(loadBalancer, {
+                    evaluateTargetHealth: hasRoutingPolicy
+                }),
+                // Redirect records inherit the cluster's routing policy for the
+                // same reason host records do.
+                ...routingProps
+            });
+        }
+    }
+    return {
+        hostedZone,
+        certificate,
+        aRecord,
+        ...(additionalListenerCertificates.length > 0 && {
+            additionalListenerCertificates
+        }),
+        ...(redirectHosts.length > 0 && {
+            redirectRules: { hostFqdns: redirectHosts, targetHost: domainName }
+        })
+    };
+}
+const US_EAST_1 = "us-east-1";
+/**
+ * Resolve `domainConfig.additionalCertificates` to listener certificates.
+ * The `managedDomainCertificate: "usEast1"` selector consumes the D2-injected
+ * binding's literal `usEast1CertificateArn`. ACM certificates are regional,
+ * so the selector is valid only when the stack itself deploys to us-east-1 —
+ * anything else fails at synth rather than as CloudFormation's opaque
+ * deploy-time rejection.
+ */
+function resolveAdditionalListenerCertificates(scope, clusterName, sources, managed) {
+    if (sources === undefined || sources.length === 0)
+        return [];
+    const certificates = [];
+    for (const source of sources) {
+        if ("certificateArn" in source) {
+            certificates.push(ListenerCertificate.fromArn(source.certificateArn));
+            continue;
+        }
+        if (managed === undefined ||
+            !isManagedDomainBinding(managed) ||
+            managed.usEast1CertificateArn === undefined) {
+            throw new Error(`Cluster '${clusterName}': additionalCertificates requests the managed ` +
+                "domain's us-east-1 certificate, but no managed domain binding " +
+                "carrying usEast1CertificateArn is available. Deploy through the " +
+                "Fjall CLI with a domain stack that declares a cloudFront certificate " +
+                "for this zone, or supply certificateArn directly.");
+        }
+        const arn = managed.usEast1CertificateArn;
+        // Binding values are literals by contract (D2), so the ARN's region
+        // component is inspectable at synth.
+        const arnRegion = Token.isUnresolved(arn) ? undefined : arn.split(":")[3];
+        if (arnRegion !== US_EAST_1) {
+            throw new Error(`Cluster '${clusterName}': the managed domain binding's ` +
+                `usEast1CertificateArn must be a literal us-east-1 ACM ARN (got '${arn}'). ` +
+                "Redeploy the domain stack so its CloudFront certificate is " +
+                "provisioned in us-east-1, or correct the injected binding.");
+        }
+        const stackRegion = Stack.of(scope).region;
+        const resolvedRegion = Token.isUnresolved(stackRegion)
+            ? undefined
+            : stackRegion;
+        if (resolvedRegion !== US_EAST_1) {
+            throw new Error(`Cluster '${clusterName}': the managed domain's us-east-1 certificate ` +
+                "can only be attached to a listener in us-east-1 (stack region: " +
+                `'${resolvedRegion ?? "unresolved"}'). ACM certificates are regional — ` +
+                "declare a certificate in the cluster's own region on the domain " +
+                "stack, or supply certificateArn for a same-region certificate.");
+        }
+        certificates.push(ListenerCertificate.fromArn(arn));
     }
-    return { hostedZone, certificate, aRecord };
+    return certificates;
 }
 export function addDirectAccessOutputs(ctx, autoScalingGroup) {
     if (!ctx.directAccessEnabled || !autoScalingGroup)

package/dist/lib/resources/aws/compute/ecsServiceFactory.js

@@ -143,7 +143,13 @@ export function getOrCreateAsgCapacityProvider(ctx, serviceProps, state) {
         }),
         ...(resolvedWarmPool !== undefined && { warmPool: resolvedWarmPool }),
         ...(ec2Config.persistentDataVolume !== undefined && {
-            persistentDataVolume: ec2Config.persistentDataVolume
+            persistentDataVolume: {
+                ...ec2Config.persistentDataVolume,
+                ...(ec2Config.persistentDataVolume.alarmTopic === undefined &&
+                    ctx.props.alertsTopic !== undefined && {
+                    alarmTopic: ctx.props.alertsTopic
+                })
+            }
         }),
         ...(ec2Config.tags !== undefined && { tags: ec2Config.tags })
     });

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -178,6 +178,22 @@ export interface EcsLatencyRoutingPolicy {
     setIdentifier?: string;
 }
 export type EcsDomainRoutingPolicy = EcsLatencyRoutingPolicy;
+/**
+ * Source for an additional SNI certificate on the cluster's HTTPS listener.
+ *
+ * - `{ managedDomainCertificate: "usEast1" }` — the managed domain stack's
+ *   us-east-1 certificate, resolved from the CLI-injected
+ *   `ManagedDomainBinding.usEast1CertificateArn` (design D2/D3). Valid only
+ *   when the cluster's stack itself deploys to us-east-1 — ACM certificates
+ *   are regional, and an ALB accepts certificates from its own region only.
+ * - `{ certificateArn }` — an explicit ACM certificate ARN (BYO path; also
+ *   accepts a token from a certificate construct in the same app).
+ */
+export type EcsAdditionalListenerCertificate = {
+    managedDomainCertificate: "usEast1";
+} | {
+    certificateArn: string;
+};
 /**
  * Domain configuration for HTTPS and DNS.
  *
@@ -210,6 +226,27 @@ export interface DomainBaseConfig {
      * Omit for a plain alias record.
      */
     routingPolicy?: EcsDomainRoutingPolicy;
+    /**
+     * Hostnames (FQDNs within the zone, e.g. `"www.example.com"`) that
+     * permanently redirect to `domainName` at the ALB. Each host gets an alias
+     * A record targeting the ALB — inheriting the cluster's routing policy,
+     * exactly like host-routed service records — plus an HTTPS listener rule
+     * matching the host header and issuing a 301 to `https://<domainName>`,
+     * preserving the original path and query.
+     *
+     * TLS coverage: a cluster-minted certificate gains each host as a SAN
+     * automatically; an imported or managed certificate must already cover the
+     * host, or attach one via `additionalCertificates`.
+     */
+    redirectHosts?: string[];
+    /**
+     * Additional SNI certificates attached to the cluster's HTTPS listener
+     * (`AWS::ElasticLoadBalancingV2::ListenerCertificate`). Use when the
+     * primary certificate does not cover every served or redirected host —
+     * e.g. the managed domain's us-east-1 www/wildcard certificate for a
+     * `redirectHosts` entry.
+     */
+    additionalCertificates?: EcsAdditionalListenerCertificate[];
     /**
      * @deprecated Removed (design H8). `region` silently converted the record
      * to a latency routing policy with an auto-derived `setIdentifier`. Declare

package/dist/lib/resources/aws/compute/ecsValidation.js

@@ -29,6 +29,20 @@ export function validateEcsClusterProps(props) {
     validateEcsDomainConfig(props.cluster?.domainConfig, props.clusterName);
     const loadBalancerDisabled = props.cluster?.loadBalancer === false ||
         props.cluster?.directAccess === true;
+    if (loadBalancerDisabled) {
+        const domainConfig = props.cluster?.domainConfig;
+        const listenerFeature = (domainConfig?.redirectHosts?.length ?? 0) > 0
+            ? "redirectHosts"
+            : (domainConfig?.additionalCertificates?.length ?? 0) > 0
+                ? "additionalCertificates"
+                : undefined;
+        if (listenerFeature !== undefined) {
+            throw new Error(`Cluster '${props.clusterName}': domainConfig.${listenerFeature} requires the ` +
+                "cluster's load balancer, but it is disabled (loadBalancer: false or " +
+                "directAccess: true). Redirect rules and SNI certificates live on the ALB " +
+                "HTTPS listener — enable the load balancer or drop the setting.");
+        }
+    }
     // Validate services array
     if (!props.services || props.services.length === 0) {
         throw new Error("At least one service must be specified.");
@@ -223,6 +237,37 @@ export function validateEcsDomainConfig(domainConfig, clusterName) {
                 "set carries exactly one routing policy. Remove one of them.");
         }
     }
+    const redirectHosts = domainConfig.redirectHosts;
+    if (redirectHosts !== undefined) {
+        for (const host of redirectHosts) {
+            if (typeof host !== "string" || host.trim() === "") {
+                throw new Error(`${context}: redirectHosts entries must be non-empty host names ` +
+                    `(got ${JSON.stringify(host)}).`);
+            }
+        }
+        const duplicates = redirectHosts.filter((host, index) => redirectHosts.indexOf(host) !== index);
+        if (duplicates.length > 0) {
+            throw new Error(`${context}: duplicate redirectHosts: ${[...new Set(duplicates)].join(", ")}. ` +
+                "Each host can redirect once.");
+        }
+    }
+    const additionalCertificates = domainConfig.additionalCertificates;
+    if (additionalCertificates !== undefined) {
+        for (const entry of additionalCertificates) {
+            // Shape guard for JavaScript callers — the union is `never`-safe in TS
+            // but casts and untyped configs can still pass anything.
+            const isManagedSelector = "managedDomainCertificate" in entry &&
+                entry.managedDomainCertificate === "usEast1";
+            const isLiteralArn = "certificateArn" in entry &&
+                typeof entry.certificateArn === "string" &&
+                entry.certificateArn.trim() !== "";
+            if (!isManagedSelector && !isLiteralArn) {
+                throw new Error(`${context}: additionalCertificates entries must be ` +
+                    `{ managedDomainCertificate: "usEast1" } or { certificateArn: "<ACM ARN>" } ` +
+                    `(got ${JSON.stringify(entry)}).`);
+            }
+        }
+    }
 }
 /**
  * Validates an SSM path component for correctness.

package/dist/lib/resources/aws/compute/listenerRouting.d.ts

@@ -1,8 +1,17 @@
-import { type ApplicationListener, type ApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { type ApplicationListener, type ApplicationLoadBalancer, type IListenerCertificate } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import type { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 export interface RoutingListenerOptions {
     readonly port: number;
     readonly certificate?: ICertificate;
+    /**
+     * Additional SNI certificates. CDK keeps the first `certificates` entry on
+     * the listener resource itself and emits the rest as
+     * `AWS::ElasticLoadBalancingV2::ListenerCertificate` resources, so the
+     * primary certificate's CloudFormation shape is unchanged. Requires
+     * `certificate` — CloudFormation rejects certificates on an HTTP listener
+     * at deploy time, far too late.
+     */
+    readonly additionalCertificates?: IListenerCertificate[];
     /**
      * Attach a fixed 404 default action. The ECS path passes this conditionally
      * (only when ≥2 routes exist or no service has a port — CDK rejects a listener

package/dist/lib/resources/aws/compute/listenerRouting.js

@@ -6,6 +6,13 @@ import { ListenerAction } from "aws-cdk-lib/aws-elasticloadbalancingv2";
  * caller's target groups become the listener's default).
  */
 export function addRoutingListener(loadBalancer, id, options) {
+    if (options.certificate === undefined &&
+        options.additionalCertificates !== undefined &&
+        options.additionalCertificates.length > 0) {
+        throw new Error(`Listener '${id}': additionalCertificates require an HTTPS listener ` +
+            "(no primary certificate resolved, so this listener is HTTP). " +
+            "CloudFormation would reject the ListenerCertificate at deploy time.");
+    }
     const defaultAction = options.default404
         ? ListenerAction.fixedResponse(404, {
             contentType: "text/plain",
@@ -14,7 +21,12 @@ export function addRoutingListener(loadBalancer, id, options) {
         : undefined;
     return loadBalancer.addListener(id, {
         port: options.port,
-        ...(options.certificate && { certificates: [options.certificate] }),
+        ...(options.certificate && {
+            certificates: [
+                options.certificate,
+                ...(options.additionalCertificates ?? [])
+            ]
+        }),
         ...(defaultAction !== undefined && { defaultAction })
     });
 }

package/dist/lib/resources/aws/compute/persistentDataVolume.d.ts

@@ -1,6 +1,7 @@
 import { type AutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
 import { Alarm } from "aws-cdk-lib/aws-cloudwatch";
 import { EbsDeviceVolumeType, Volume } from "aws-cdk-lib/aws-ec2";
+import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { Construct } from "constructs";
 import { LambdaFunction } from "./lambda.js";
 import { SQSQueue } from "../messaging/sqs.js";
@@ -35,6 +36,12 @@ export interface PersistentDataVolumeProps {
     iops?: number;
     /** Throughput in MiB/s (gp3 only). */
     throughputMbps?: number;
+    /**
+     * SNS topic `attachFailureAlarm` notifies. Omitted, the alarm still exists
+     * but fires no action — pass the stack's alerts topic or the failure is
+     * only visible to someone watching the CloudWatch console.
+     */
+    alarmTopic?: ITopic;
 }
 /**
  * Standalone EBS data volume + ASG `EC2_INSTANCE_LAUNCHING` hook that

package/dist/lib/resources/aws/compute/persistentDataVolume.js

@@ -4,6 +4,7 @@ import { fileURLToPath } from "node:url";
 import { Aws, Duration, RemovalPolicy, Size, Stack, Tags } from "aws-cdk-lib";
 import { DefaultResult, LifecycleTransition } from "aws-cdk-lib/aws-autoscaling";
 import { Alarm, ComparisonOperator, Metric, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
 import { EbsDeviceVolumeType, Volume } from "aws-cdk-lib/aws-ec2";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
@@ -220,6 +221,11 @@ export class PersistentDataVolume extends Construct {
             comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
             treatMissingData: TreatMissingData.NOT_BREACHING
         });
+        if (props.alarmTopic !== undefined) {
+            const snsAction = new SnsAction(props.alarmTopic);
+            this.attachFailureAlarm.addAlarmAction(snsAction);
+            this.attachFailureAlarm.addOkAction(snsAction);
+        }
     }
 }
 function validatePersistentDataVolumeProps(props) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^3.6.0",
-    "@fjall/util": "^3.6.0",
+    "@fjall/generator": "^3.7.0",
+    "@fjall/util": "^3.7.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "10366db602d7e80669e22825a52071a47e05c3b7"
+  "gitHead": "2ee5e51bc6aa45e34ec70160b36ddf976371ccd5"
 }