@fjall/components-infrastructure 3.8.1 → 3.9.0

package/dist/lib/config/aws/identityCenter.js

@@ -155,7 +155,10 @@ export class IdentityCenter extends NestedStack {
                 continue;
             }
             if (this.managementAccountId === undefined) {
-                throw new Error(`permissionSets["${name}"] sets includeManagementAccount but no managementAccountId was provided to IdentityCenter`);
+                const builtInHint = spec.isDefault
+                    ? " (a built-in default — pass managementAccountId, or suppress the defaults with defaultPermissionSets: false)"
+                    : "";
+                throw new Error(`permissionSets["${name}"] sets includeManagementAccount but no managementAccountId was provided to IdentityCenter${builtInHint}`);
             }
             targets.push([accountName, this.managementAccountId]);
         }

package/dist/lib/config/aws/identityCentreConfig.d.ts

@@ -74,7 +74,7 @@ interface IdentityCentreBase {
      * Default 1.
      */
     resolutionVersion?: number;
-    /** false suppresses the three built-in permission sets. Default true. */
+    /** false suppresses the built-in permission sets (DEFAULT_PERMISSION_SETS). Default true. */
     defaultPermissionSets?: boolean;
 }
 export type IdentityCentreConfig = (IdentityCentreBase & {
@@ -90,6 +90,12 @@ export type IdentityCentreConfig = (IdentityCentreBase & {
 export interface DefaultPermissionSetDefinition {
     managedPolicyArn: string;
     description: string;
+    /** Workload-account scoping for the default. Omitted = every workload account. */
+    accounts?: string[];
+    /** Management-account opt-in for the default. Default false. */
+    includeManagementAccount?: boolean;
+    /** ISO-8601 session duration for the default. Omitted = AWS default (PT1H). */
+    sessionDuration?: string;
 }
 export declare const DEFAULT_PERMISSION_SETS: Record<DefaultPermissionSetName, DefaultPermissionSetDefinition>;
 export interface ResolvedPermissionSet extends PermissionSetSpec {

package/dist/lib/config/aws/identityCentreConfig.js

@@ -24,6 +24,16 @@ export const DEFAULT_PERMISSION_SETS = {
     Billing: {
         managedPolicyArn: "arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess",
         description: "Permission set for associated Billing policy"
+    },
+    // Deliberately management-only (never a rider on AdministratorAccess) and
+    // memberless by default — grants nothing until someone joins the implicit
+    // ManagementAccountAccess group.
+    ManagementAccountAccess: {
+        managedPolicyArn: "arn:aws:iam::aws:policy/AdministratorAccess",
+        description: "Break-glass administrative access to the management account only",
+        accounts: [],
+        includeManagementAccount: true,
+        sessionDuration: "PT2H"
     }
 };
 /**
@@ -38,6 +48,13 @@ export function effectivePermissionSets(config) {
             result[name] = {
                 managedPolicies: [def.managedPolicyArn],
                 description: def.description,
+                ...(def.accounts !== undefined && { accounts: def.accounts }),
+                ...(def.includeManagementAccount !== undefined && {
+                    includeManagementAccount: def.includeManagementAccount
+                }),
+                ...(def.sessionDuration !== undefined && {
+                    sessionDuration: def.sessionDuration
+                }),
                 isDefault: true
             };
         }

package/dist/lib/patterns/aws/organisation.d.ts

@@ -16,8 +16,9 @@ export interface OrganisationProps extends AccountProps {
     /**
      * Identity Centre configuration: groups, permission sets, memberships and
      * (source permitting) users, all declared in code. `false` disables the
-     * Identity Centre entirely; omitted = the three built-in permission sets
-     * with no members (inert defaults).
+     * Identity Centre entirely; omitted = the built-in permission sets with no
+     * members (inert defaults, including the management-only break-glass set
+     * ManagementAccountAccess).
      */
     identityCentre?: IdentityCentreConfig | false;
     allowedRegions?: string[];

package/dist/lib/resources/aws/messaging/sns.d.ts

@@ -13,6 +13,14 @@ export interface SNSTopicProps {
      * only for a topic that must survive stack deletion.
      */
     removalPolicy?: RemovalPolicyString;
+    /**
+     * SNS message signature version. Defaults to "2" (SHA-256) — the AWS
+     * account-level default is "1" (SHA-1, deprecated), which signature-verifying
+     * HTTPS consumers (including the Fjall webapp alarm ingest) reject, leaving
+     * their subscriptions stuck in PendingConfirmation. Pass "1" only for a
+     * legacy consumer that cannot verify SHA-256.
+     */
+    signatureVersion?: "1" | "2";
 }
 export declare class SNSTopic extends Construct {
     readonly id: string;

package/dist/lib/resources/aws/messaging/sns.js

@@ -20,7 +20,8 @@ export class SNSTopic extends Construct {
             fifo: isFifo,
             contentBasedDeduplication: isFifo
                 ? (props.contentBasedDeduplication ?? true)
-                : undefined
+                : undefined,
+            signatureVersion: props.signatureVersion ?? "2"
         });
         // An SNS topic is a transient fan-out medium: it holds no durable state
         // (subscriptions are re-created by the next deploy), so the wrapper defaults

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "3.8.1",
+  "version": "3.9.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^3.8.1",
-    "@fjall/util": "^3.8.1",
+    "@fjall/generator": "^3.9.0",
+    "@fjall/util": "^3.9.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "c15e42f3d2047acbbe086518450c77ae68839e1d"
+  "gitHead": "7cef1c5c3c09bb333888e65ede3d92b2d88c3c63"
 }