@fjall/components-infrastructure 31.0.0 → 33.0.0

package/README.md

@@ -102,7 +102,7 @@ requires you explicitly configure your `AwsStack` with an `account` and `region.
 ```typescript
 const env = {
   region: "us-east-1",
-  account: "058430617814"
+  account: "123456789012"
 };
 
 const vpcStack = new AwsStack(`${id}Network`, { ...env }).addNetwork(

package/dist/lib/config/audit.js

@@ -1,3 +1,4 @@
+import { FJALL_PLATFORM_ACCOUNT_ID } from "./aws/platform.js";
 /**
  * Audit configuration for cross-account CloudQuery access
  */
@@ -6,7 +7,7 @@ export const FJALL_AUDIT_CONFIG = {
      * Fjall webapp AWS account ID
      * This account will be granted permission to assume audit roles for CloudQuery
      */
-    webappAwsAccountId: "985539798308", // Fjall platform account
+    webappAwsAccountId: FJALL_PLATFORM_ACCOUNT_ID,
     /**
      * IAM role naming convention
      */

package/dist/lib/patterns/aws/buildkite/pins.js

@@ -69,8 +69,7 @@ export function resolvePinnedAmiId(region, architecture) {
     if (!isSupportedRegion(region)) {
         throw new Error(`Buildkite: no pinned AMI for region '${region}'. Supported: ` +
             `${Object.keys(BUILDKITE_STACK_PINS.amiIdsByRegion).join(", ")}. ` +
-            `Add the region to BUILDKITE_STACK_PINS via the bump runbook ` +
-            `(aiDocs/runbooks/buildkite-stack-bump-runbook.md).`);
+            `Add the region to BUILDKITE_STACK_PINS.`);
     }
     return BUILDKITE_STACK_PINS.amiIdsByRegion[region][architecture];
 }

package/dist/lib/patterns/aws/cdn.d.ts

@@ -7,6 +7,7 @@ import type App from "../../app.js";
 import { CloudFrontDistribution, type CachePolicyPreset, type AccessGateConfig } from "../../resources/aws/cdn/index.js";
 import { type ICdn } from "./interfaces/cdn.js";
 import { type StaticSiteRouting, type CloudFrontPriceClass } from "@fjall/util";
+import { type BackupTier } from "../../utils/backupTierMapping.js";
 import { type ManagedDomainBinding, type ManagedDomainExports } from "../../utils/domainTypes.js";
 import { type Storage } from "./storage.js";
 import { type AnyCompute } from "./compute.js";
@@ -81,11 +82,24 @@ interface BaseCdnProps {
     certificate?: ICertificate;
     certificateArn?: string;
     comment?: string;
+    /**
+     * Standard (S3) access logging. Default: the app backup tier's
+     * `cloudFrontLogging` column — enterprise logs to the stack's shared,
+     * lifecycle-expired access-log bucket under `cloudfront/<id>/`. Set either
+     * knob to take over: `enableLogging: false` opts out at any tier,
+     * `logBucket` delivers to a bucket of your own.
+     */
     enableLogging?: boolean;
     logBucket?: IBucket;
     priceClass?: CloudFrontPriceClass;
     forwardHostHeader?: boolean;
     accessGate?: false | AccessGateConfig;
+    /**
+     * The owning app's backup tier, which the logging default follows.
+     * `CdnFactory.build` fills it from the `App`; only set by hand for a
+     * directly-instantiated `Cdn`.
+     */
+    appBackupTier?: BackupTier;
 }
 /**
  * S3 origin CDN props - use with S3 bucket

package/dist/lib/patterns/aws/cdn.js

@@ -3,12 +3,40 @@ import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
 import { CloudFrontTarget, LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { CloudFrontDistribution } from "../../resources/aws/cdn/index.js";
 import { AliasRecord } from "../../resources/aws/networking/index.js";
+import { tierDefault } from "../../utils/backupTierMapping.js";
+import { stackAccessLogBucket } from "../../resources/aws/logging/index.js";
 import { getSafeZoneName, toPascalCase } from "../../utils/capitaliseString.js";
 import { recordLabelWithin } from "../../utils/domainTypes.js";
 import { resolvePatternZone, resolvePatternCloudFrontCertificate } from "./patternDomain.js";
 import { isStorage } from "./storage.js";
 import { CdnEcsOriginResolver, cdnOriginRefusal, internalAlbMessage, normaliseDnsName } from "./cdnAppOrigin.js";
 import { isCompute, isEcsCompute, isLambdaCompute } from "./compute.js";
+/**
+ * An explicit `enableLogging` or `logBucket` is the override and passes
+ * through untouched; otherwise the tier decides, and a tier-enabled CDN logs
+ * to the stack's shared access-log bucket under its own prefix.
+ */
+function resolveCdnLogging(scope, id, props) {
+    if (props.enableLogging !== undefined || props.logBucket !== undefined) {
+        return {
+            enableLogging: props.enableLogging,
+            logBucket: props.logBucket,
+            logFilePrefix: undefined
+        };
+    }
+    if (!tierDefault(props.appBackupTier, "cloudFrontLogging")) {
+        return {
+            enableLogging: undefined,
+            logBucket: undefined,
+            logFilePrefix: undefined
+        };
+    }
+    return {
+        enableLogging: true,
+        logBucket: stackAccessLogBucket(scope),
+        logFilePrefix: `cloudfront/${id}/`
+    };
+}
 /**
  * The distribution's own alias names, normalised — consumed by the
  * origin-loop guard and by the ECS origin resolver (auto-resolution excludes
@@ -458,8 +486,7 @@ export class Cdn extends CloudFrontDistribution {
                 domainNames,
                 certificate,
                 comment: props.comment,
-                enableLogging: props.enableLogging,
-                logBucket: props.logBucket,
+                ...resolveCdnLogging(scope, id, props),
                 priceClass: props.priceClass,
                 forwardHostHeader: props.forwardHostHeader ?? impliedForwardHostHeader,
                 accessGate: props.accessGate,
@@ -676,7 +703,8 @@ export class CdnFactory {
             return new Cdn(scope, id, {
                 ...props,
                 appName: props.appName ?? app.getName(),
-                app: props.app ?? app
+                app: props.app ?? app,
+                appBackupTier: props.appBackupTier ?? app.getBackupTier()
             });
         };
     }

package/dist/lib/patterns/aws/clickhouseDatabase.d.ts

@@ -3,6 +3,7 @@ import { type TaskDefinition } from "aws-cdk-lib/aws-ecs";
 import { type IBucket } from "aws-cdk-lib/aws-s3";
 import { Construct } from "constructs";
 import { Secret, type SecretImport } from "../../resources/aws/secrets/secret.js";
+import { type BackupTier } from "../../utils/backupTierMapping.js";
 import { type ClickHouseAlarmThresholds } from "../../resources/aws/monitoring/index.js";
 import { type ClickHouseSchemaAdmin, type ProfileSpec } from "../../resources/aws/database/clickhouseSchemas.js";
 import { type ISecret } from "aws-cdk-lib/aws-secretsmanager";
@@ -283,6 +284,13 @@ export interface ClickHouseDatabaseProps {
      * RDS branch of `DatabaseFactory.build`.
      */
     applicationId?: string;
+    /**
+     * The owning app's backup tier, which the tier-owned defaults of the
+     * compute this pattern builds (Container Insights, exec-session and
+     * log-group encryption) follow. `DatabaseFactory` fills it from the App;
+     * pass it only for direct `new ClickHouseDatabase(...)` construction.
+     */
+    appBackupTier?: BackupTier;
 }
 /**
  * Public-facing re-export of the alarm knob so factory consumers can type

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -15,6 +15,8 @@ import App from "../../app.js";
 import { S3Bucket } from "../../resources/aws/storage/s3.js";
 import { Secret } from "../../resources/aws/secrets/secret.js";
 import { LogGroup } from "../../resources/aws/logging/logGroup.js";
+import { StackEncryptionKey } from "../../resources/aws/secrets/stackEncryptionKey.js";
+import { tierDefault } from "../../utils/backupTierMapping.js";
 import { createClickHouseSecurityGroup } from "../../resources/aws/database/clickhouseSecurityGroup.js";
 import { buildMaintenancePreamble, maintenanceOkMarker, maintenanceRun } from "../../resources/aws/database/clickhouseMaintenanceScript.js";
 import { buildClickHouseEntrypointWrapper, buildClickHouseUserData, generateUsersConfigXml } from "../../resources/aws/database/clickhouseUserData.js";
@@ -385,16 +387,24 @@ export class ClickHouseDatabase extends Construct {
         this.#backupBucket = backupBucket;
         this.#coldTierBucket = coldTierBucket;
         this.#migrationsConfig = props.migrations;
+        // The maintenance-task log groups sit beside the compute's own container
+        // and exec-audit groups and follow the same tier: the stack's shared key
+        // at enterprise, nothing otherwise.
+        const taskLogGroupEncryption = tierDefault(props.appBackupTier, "customerManagedKeys")
+            ? { encryptionKey: StackEncryptionKey.of(this).forLogGroups() }
+            : {};
         const backupTaskLogGroup = backupEnabled
             ? new LogGroup(this, "ClickHouseBackupTaskLogGroup", {
-                retention: RetentionDays.TWO_WEEKS
+                retention: RetentionDays.TWO_WEEKS,
+                ...taskLogGroupEncryption
             })
             : undefined;
         // Explicit rather than `logRetention` so the maintenance-status metric
         // filters can attach to it alongside the backup task's group.
         const optimiseTaskLogGroup = optimiseEnabled
             ? new LogGroup(this, "ClickHouseOptimiseTaskLogGroup", {
-                retention: RetentionDays.ONE_WEEK
+                retention: RetentionDays.ONE_WEEK,
+                ...taskLogGroupEncryption
             })
             : undefined;
         // Resolved BEFORE the user data is built: the declared volume size is
@@ -576,6 +586,9 @@ export class ClickHouseDatabase extends Construct {
                 containerInsights: true
             }),
             ...(applicationId !== undefined && { applicationId }),
+            ...(props.appBackupTier !== undefined && {
+                appBackupTier: props.appBackupTier
+            }),
             cluster: {
                 loadBalancer: false,
                 securityGroup,

package/dist/lib/patterns/aws/compute.js

@@ -164,7 +164,8 @@ export class ComputeFactory {
                 computeProps = {
                     ...computeProps,
                     appName: computeProps.appName ?? app.getName(),
-                    applicationId: computeProps.applicationId ?? app.getName()
+                    applicationId: computeProps.applicationId ?? app.getName(),
+                    appBackupTier: computeProps.appBackupTier ?? app.getBackupTier()
                 };
             }
             // Create specific compute class based on type discriminator
@@ -241,7 +242,8 @@ export class ComputeFactory {
                     // Add appName to props for Lambda (needed for secrets path derivation)
                     const lambdaComputeProps = {
                         ...computeProps,
-                        appName: app.getName()
+                        appName: app.getName(),
+                        appBackupTier: computeProps.appBackupTier ?? app.getBackupTier()
                     };
                     // `ecrRepository` is already defaulted to the app's shared default
                     // container registry above (line ~323) when omitted — the same

package/dist/lib/patterns/aws/computeEcs.d.ts

@@ -171,6 +171,13 @@ export declare class EcsCompute extends Construct implements IEcsCompute {
      * the version entry the app containers get.
      */
     private resolveSchemaGateMaterialisation;
+    /**
+     * Encryption for a log group this pattern creates beside the cluster's
+     * own (scheduled-task and migration-task logs): the stack's shared key
+     * when the app backup tier encrypts, nothing otherwise — the same key the
+     * cluster resolved for its service and exec-audit groups.
+     */
+    private tierLogGroupEncryption;
     private materialiseScheduledTasks;
     private buildScheduledTaskDefinition;
     /**

package/dist/lib/patterns/aws/computeEcs.js

@@ -955,6 +955,12 @@ export class EcsCompute extends Construct {
                 domainConfig: props.cluster.domainConfig,
                 ...(props.cluster.securityGroup !== undefined && {
                     securityGroup: props.cluster.securityGroup
+                }),
+                ...(props.cluster.loadBalancerDeletionProtection !== undefined && {
+                    loadBalancerDeletionProtection: props.cluster.loadBalancerDeletionProtection
+                }),
+                ...(props.cluster.loadBalancerAccessLogs !== undefined && {
+                    loadBalancerAccessLogs: props.cluster.loadBalancerAccessLogs
                 })
             }
             : undefined;
@@ -970,7 +976,12 @@ export class EcsCompute extends Construct {
             applicationId: props.applicationId ??
                 (App.hasInstance() ? App.getInstance().getName() : undefined),
             ...(props.taskStopWatchdog === false && { taskStopWatchdog: false }),
-            ...(props.containerInsights === true && { containerInsights: true })
+            ...(props.containerInsights !== undefined && {
+                containerInsights: props.containerInsights
+            }),
+            ...(props.appBackupTier !== undefined && {
+                appBackupTier: props.appBackupTier
+            })
         };
         this.ecsCluster = new EcsCluster(this, `${id}Ecs`, ecsProps);
         this.connections = this.ecsCluster.connections;
@@ -1155,6 +1166,16 @@ export class EcsCompute extends Construct {
             defaultImageTag: CONSTRUCTS_VERSION
         };
     }
+    /**
+     * Encryption for a log group this pattern creates beside the cluster's
+     * own (scheduled-task and migration-task logs): the stack's shared key
+     * when the app backup tier encrypts, nothing otherwise — the same key the
+     * cluster resolved for its service and exec-audit groups.
+     */
+    tierLogGroupEncryption() {
+        const key = this.ecsCluster.encryptionKey;
+        return key === undefined ? {} : { encryptionKey: key.forLogGroups() };
+    }
     materialiseScheduledTasks(id, props) {
         const scheduledTasks = props.cluster?.scheduledTasks;
         if (!scheduledTasks || scheduledTasks.length === 0)
@@ -1200,7 +1221,8 @@ export class EcsCompute extends Construct {
         // removal default (D17).
         const logGroup = entry.logGroup ??
             new LogGroup(this, `${id}${toPascalCase(entry.name)}LogGroup`, {
-                retention: entry.logRetention ?? DEFAULT_LOG_RETENTION
+                retention: entry.logRetention ?? DEFAULT_LOG_RETENTION,
+                ...this.tierLogGroupEncryption()
             });
         const logging = new AwsLogDriver({
             streamPrefix: `/ecs-scheduled/${id}/${entry.name}`,
@@ -1429,7 +1451,8 @@ export class EcsCompute extends Construct {
         const inheritedImage = service.taskDefinition.defaultContainer?.imageName;
         const image = resolveMigrationImage(svcConfig, migrations, inheritedImage);
         const logGroup = new LogGroup(this, `${idPrefix}LogGroup`, {
-            retention: RetentionDays.ONE_MONTH
+            retention: RetentionDays.ONE_MONTH,
+            ...this.tierLogGroupEncryption()
         });
         const executionRole = new Role(this, `${idPrefix}ExecutionRole`, {
             assumedBy: new ServicePrincipal("ecs-tasks.amazonaws.com")

package/dist/lib/patterns/aws/computeEcsTypes.d.ts

@@ -5,6 +5,7 @@ import { type ILogGroup, type RetentionDays } from "aws-cdk-lib/aws-logs";
 import { type PolicyDocument, type IManagedPolicy, type PolicyStatement } from "aws-cdk-lib/aws-iam";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type ConnectionSpec } from "./interfaces/connector.js";
+import type { BackupTier } from "../../utils/backupTierMapping.js";
 import { type RemoteConnectionSpec } from "../../resources/aws/compute/ecsRemoteConnections.js";
 import { type EcsRoutingConfig, type EcsContainerDependency } from "../../resources/aws/compute/ecsTypes.js";
 import { ScalingType, type DomainConfig, type EcsCapacityProvider, type Ec2CapacityConfig, type QueueScalingConfig } from "../../resources/aws/compute/ecs.js";
@@ -623,6 +624,19 @@ export interface EcsClusterConfig {
      * (e.g. ClickHouseDatabase) that own their security group lifecycle.
      */
     securityGroup?: ISecurityGroup;
+    /**
+     * Deletion protection on the shared load balancer. Default: the app backup
+     * tier's `deletionProtection` column, applied only when the stack's
+     * environment resolves to production. The destroy pre-flight switches it
+     * off before a consented destroy.
+     */
+    loadBalancerDeletionProtection?: boolean;
+    /**
+     * Access logs from the shared load balancer into the stack's
+     * lifecycle-expired access-log bucket. Default: the app backup tier's
+     * `albAccessLogs` column.
+     */
+    loadBalancerAccessLogs?: boolean;
     /**
      * Scheduled tasks materialised into `Ec2TaskDefinition`s and registered via
      * `app.addSchedule(...)` against the existing `EcsScheduleTarget` shape
@@ -1074,9 +1088,18 @@ export interface EcsComputeProps {
      * `RunningTaskCount` liveness alarms (`ecsAlarms.ts` gates them on this
      * flag because the metric only exists in `ECS/ContainerInsights`).
      * Scale-to-zero services should pair it with
-     * `alarms: { runningTasksMinimum: 0 }` or they idle in ALARM.
+     * `alarms: { runningTasksMinimum: 0 }` or they idle in ALARM. Default:
+     * the app backup tier's `containerInsights` column (on at enterprise);
+     * `false` is an explicit, auditable opt-out.
      */
-    containerInsights?: true;
+    containerInsights?: boolean;
     /** Application ID for alarm tagging (used by webhook to map alarms to applications). */
     applicationId?: string;
+    /**
+     * The owning app's backup tier. Auto-derived from the App by
+     * ComputeFactory; the tier-owned defaults (Container Insights, exec-session
+     * and log-group encryption, load-balancer deletion protection and access
+     * logs) follow it. Only specify for direct construction.
+     */
+    appBackupTier?: BackupTier;
 }

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -4,6 +4,7 @@ import { Connections, type IVpc, type ISecurityGroup } from "aws-cdk-lib/aws-ec2
 import { Repository } from "aws-cdk-lib/aws-ecr";
 import { type RepositoryImage } from "aws-cdk-lib/aws-ecs";
 import { Construct } from "constructs";
+import type { BackupTier } from "../../utils/backupTierMapping.js";
 import { type ILambdaCompute } from "./interfaces/compute.js";
 import { type ConnectionSpec } from "./interfaces/connector.js";
 import { LambdaFunction } from "../../resources/aws/compute/lambda.js";
@@ -95,6 +96,17 @@ interface BaseLambdaProps {
      * Only specify for advanced use cases.
      */
     appName?: string;
+    /**
+     * The owning app's backup tier. Auto-derived from the App by
+     * ComputeFactory; the tier-owned defaults (X-Ray tracing, environment and
+     * log-group encryption) follow it. Only specify for direct construction.
+     */
+    appBackupTier?: BackupTier;
+    /**
+     * Active X-Ray tracing. Default: the app backup tier's `lambdaTracing`
+     * column (on at enterprise).
+     */
+    tracing?: boolean;
     /**
      * Resources this Lambda needs to connect to (e.g., databases, S3 buckets, SQS queues).
      * Creates security group rules for IConnectable resources and IAM grants for IAM resources.

package/dist/lib/patterns/aws/computeLambda.js

@@ -167,6 +167,8 @@ export class LambdaCompute extends Construct {
             secretsImport: props.secretsImport,
             environment: props.environment,
             appName: props.appName,
+            appBackupTier: props.appBackupTier,
+            tracing: props.tracing,
             functionName: id
         };
         this.lambdaFunction = new LambdaFunction(scope, `${id}Lambda`, lambdaProps);

package/dist/lib/patterns/aws/computePropApplicability.js

@@ -10,6 +10,8 @@ const COMPUTE_PROP_APPLICABILITY = {
     type: "all",
     vpc: "all",
     appName: ["ecs", "lambda"],
+    appBackupTier: ["ecs", "lambda"],
+    tracing: ["lambda"],
     docker: ["ecs", "lambda"],
     ecrRepository: ["ecs", "lambda"],
     cluster: ["ecs"],

package/dist/lib/patterns/aws/database.d.ts

@@ -5,6 +5,7 @@ import type { RdsAlarmThresholds } from "../../resources/aws/monitoring/index.js
 import type App from "../../app.js";
 import { type DynamoDBKeySchema, type DynamoDBGlobalSecondaryIndex } from "../../resources/aws/database/dynamodb.js";
 import { ClickHouseDatabase, type ClickHouseDatabaseProps, type ClickHouseAlarmThresholds } from "./clickhouseDatabase.js";
+import { type BackupTier } from "../../utils/backupTierMapping.js";
 import { type Connections, type IConnectable, type IVpc } from "aws-cdk-lib/aws-ec2";
 import { type ITable } from "aws-cdk-lib/aws-dynamodb";
 import { type Secret, type SecretImport } from "../../resources/aws/secrets/index.js";
@@ -40,6 +41,13 @@ type BaseDatabaseProps = {
     databaseName: string;
     instanceType?: string;
     deletionProtection?: boolean;
+    /**
+     * The owning app's backup tier (`App.getApp({ backup: { tier } })`), which
+     * the tier-owned defaults (backup retention) follow. `DatabaseFactory`
+     * fills it from the App as it does `vpc` and `applicationId`; pass it only
+     * for direct `new RelationalDatabase(...)` construction.
+     */
+    appBackupTier?: BackupTier;
     /** SNS topic for alarm notifications. Accepts ITopic, ARN string, or "import:ExportName". */
     alertsTopic?: ITopic | string;
     /** Alarm thresholds. false to disable, undefined for defaults, object to override. */
@@ -194,6 +202,12 @@ export interface DynamoDBDatabaseProps {
     encryption?: "AWS_OWNED" | "AWS_MANAGED" | "CUSTOMER_MANAGED";
     deletionProtection?: boolean;
     removalPolicy?: "DESTROY" | "RETAIN" | "SNAPSHOT";
+    /**
+     * The owning app's backup tier, which the tier-owned defaults (encryption,
+     * deletion protection) follow. `DatabaseFactory` fills it from the App;
+     * pass it only for direct `new DynamoDBDatabase(...)` construction.
+     */
+    appBackupTier?: BackupTier;
 }
 /**
  * Relational database props union (Aurora, Instance, GlobalAurora).

package/dist/lib/patterns/aws/database.js

@@ -130,7 +130,7 @@ function validateRelationalDatabaseProps(props) {
     // Instance-only options on Aurora/GlobalAurora
     warnIfPropertiesIgnored(props, ["readReplica", "multiAz", "allocatedStorage", "iamAuthentication"], "Instance", "Instance database");
     // Aurora-only options on Instance
-    warnIfPropertiesIgnored(props, ["readers", "writer", "backupRetention"], ["Aurora", "GlobalAurora"], "Aurora database");
+    warnIfPropertiesIgnored(props, ["readers", "writer"], ["Aurora", "GlobalAurora"], "Aurora database");
     // GlobalAurora-only options on non-global databases
     warnIfPropertiesIgnored(props, ["primaryRegion", "secondaryRegions", "enableGlobalWriteForwarding"], "GlobalAurora", "GlobalAurora database");
 }
@@ -170,21 +170,27 @@ export class DatabaseFactory {
     static build(id, props) {
         return (app, scope) => {
             if (props.type === "DynamoDB") {
-                validateDatabaseProps(props);
-                return new DynamoDBDatabase(scope, id, props);
+                const dynamoProps = {
+                    ...props,
+                    appBackupTier: props.appBackupTier ?? app.getBackupTier()
+                };
+                validateDatabaseProps(dynamoProps);
+                return new DynamoDBDatabase(scope, id, dynamoProps);
             }
             if (props.type === "ClickHouse") {
                 const clickhouseProps = {
                     ...props,
                     vpc: props.vpc ?? app.getVpc(),
-                    applicationId: props.applicationId ?? app.getName()
+                    applicationId: props.applicationId ?? app.getName(),
+                    appBackupTier: props.appBackupTier ?? app.getBackupTier()
                 };
                 return new ClickHouseDatabase(scope, id, clickhouseProps);
             }
             const databaseProps = {
                 ...props,
                 vpc: props.vpc ?? app.getVpc(),
-                applicationId: props.applicationId ?? app.getName()
+                applicationId: props.applicationId ?? app.getName(),
+                appBackupTier: props.appBackupTier ?? app.getBackupTier()
             };
             validateDatabaseProps(databaseProps);
             return new RelationalDatabase(scope, id, databaseProps);
@@ -223,7 +229,8 @@ export class DynamoDBDatabase extends Construct {
             pointInTimeRecovery: props.pointInTimeRecovery,
             encryption: props.encryption,
             deletionProtection: props.deletionProtection,
-            removalPolicy: props.removalPolicy
+            removalPolicy: props.removalPolicy,
+            appBackupTier: props.appBackupTier
         };
         this.table = new DynamoDBTable(this, id, tableProps);
     }
@@ -390,6 +397,7 @@ export class RelationalDatabase extends Construct {
             credentials: props.credentials,
             encryption: props.encryption,
             backupRetention: props.backupRetention,
+            appBackupTier: props.appBackupTier,
             monitoringInterval: props.monitoringInterval,
             preferredMaintenanceWindow: props.preferredMaintenanceWindow,
             port: props.port,
@@ -429,6 +437,7 @@ export class RelationalDatabase extends Construct {
             credentials: props.credentials,
             encryption: props.encryption,
             backupRetention: props.backupRetention,
+            appBackupTier: props.appBackupTier,
             monitoringInterval: props.monitoringInterval,
             preferredMaintenanceWindow: props.preferredMaintenanceWindow,
             port: props.port,
@@ -459,6 +468,7 @@ export class RelationalDatabase extends Construct {
             backupRetention: props.backupRetention !== undefined
                 ? Duration.days(props.backupRetention)
                 : undefined,
+            appBackupTier: props.appBackupTier,
             databaseInsights: props.databaseInsights,
             proxy: props.proxy,
             readReplica: props.readReplica,

package/dist/lib/patterns/aws/fivetranProxy.d.ts

@@ -7,7 +7,6 @@ interface ProxyAgentProps extends StackProps {
     accountId?: string;
     vpc?: IVpc;
     publicKey: string;
-    enableSSH?: boolean;
     instanceType: string;
     databaseConnection?: Connections;
     tags?: KeyValue;

package/dist/lib/patterns/aws/fivetranProxy.js

@@ -11,7 +11,12 @@ export class FivetranProxy extends Stack {
             serviceName: "fivetranProxy",
             vpc: props.vpc,
             instanceType: props.instanceType || "t2.micro",
-            enableSSH: props.enableSSH || true,
+            // Not a caller's choice. This proxy exists so Fivetran can reach a
+            // private database over SSH — it provisions the `fivetran` user and its
+            // authorized_keys above — so the instance must be publicly reachable on
+            // port 22. The prop that used to sit here was `props.enableSSH || true`,
+            // which accepted a `false` it could never honour.
+            enableSSH: true,
             env: {
                 account: props.env?.account,
                 region: props.env?.region

package/dist/lib/patterns/aws/interfaces/pattern.d.ts

@@ -162,7 +162,7 @@ export interface PatternLambdaConfig {
     memorySize?: number;
     /** Timeout in seconds. Range: 1-900. */
     timeout?: number;
-    /** Ephemeral storage size in MB. Range: 512-10240. Default: 512. */
+    /** Ephemeral storage size in MiB. Range: 512-10240. Default: 512. */
     ephemeralStorageSize?: number;
 }
 /**
@@ -468,16 +468,16 @@ export interface StaticSiteCdnConfig {
  * optional contact-form endpoint (Lambda Function URL → SES, CloudFront-fronted).
  *
  * @example
- * app.addPattern(PatternFactory.build("LbexcSite", {
+ * app.addPattern(PatternFactory.build("StorefrontSite", {
  *   type: "staticsite",
- *   name: "lbexc",
- *   source: "../../lbexc-static-export",
+ *   name: "storefront",
+ *   source: "../../storefront-static-export",
  *   build: { command: "npm run build", outputDir: "out" },
  *   routing: "multipage",
  *   security: { headers: true },
- *   domain: "lbexc.com",
- *   zoneName: "lbexc.com", // or a CLI-injected `managedDomain` binding
- *   forms: { to: "hello@lbexc.com", corsOrigin: "https://lbexc.com" }
+ *   domain: "storefront.example",
+ *   zoneName: "storefront.example", // or a CLI-injected `managedDomain` binding
+ *   forms: { to: "hello@storefront.example", corsOrigin: "https://storefront.example" }
  * }));
  */
 export interface IStaticSiteProps {

package/dist/lib/patterns/aws/messaging.js

@@ -315,7 +315,10 @@ export class MessagingFactory {
                         applicationId: props.applicationId ?? app.getName()
                     });
                 case "topic":
-                    return new TopicMessaging(scope, id, props);
+                    return new TopicMessaging(scope, id, {
+                        ...props,
+                        appBackupTier: props.appBackupTier ?? app.getBackupTier()
+                    });
                 case "eventBus":
                     return new EventBusMessaging(scope, id, props);
                 default: {

package/dist/lib/patterns/aws/patternDomain.d.ts

@@ -7,7 +7,7 @@
  *
  * - Nothing here guesses a hosted zone. The old `extractRootDomain` label
  *   split resolved every multi-label public suffix wrongly (e.g.
- *   'littlebearearthworks.com.au' → zone 'com.au') and mis-placed delegated
+ *   'example.com.au' → zone 'com.au') and mis-placed delegated
  *   sub-zone records; it is deleted. Zone identity now arrives explicitly, in
  *   priority order: a CLI-injected {@link ManagedDomainBinding} (literal
  *   values — crosses accounts and regions), the legacy

package/dist/lib/patterns/aws/patternDomain.js

@@ -7,7 +7,7 @@
  *
  * - Nothing here guesses a hosted zone. The old `extractRootDomain` label
  *   split resolved every multi-label public suffix wrongly (e.g.
- *   'littlebearearthworks.com.au' → zone 'com.au') and mis-placed delegated
+ *   'example.com.au' → zone 'com.au') and mis-placed delegated
  *   sub-zone records; it is deleted. Zone identity now arrives explicitly, in
  *   priority order: a CLI-injected {@link ManagedDomainBinding} (literal
  *   values — crosses accounts and regions), the legacy

package/dist/lib/patterns/aws/payload.js

@@ -41,8 +41,6 @@ const PAYLOAD_DEFAULTS = {
     SOURCE: "../..",
     DATABASE: {
         TYPE: "Instance",
-        /** AWS default; 7 days covers most accidental data loss recovery scenarios */
-        BACKUP_RETENTION: 7,
         DELETION_PROTECTION: true
     },
     COMPUTE: {
@@ -172,7 +170,7 @@ export class Payload extends Construct {
         return {
             databaseName: dbConfig.databaseName ?? toValidDatabaseName(this.props.name),
             databaseEngine: dbConfig.databaseEngine ?? "postgresql",
-            backupRetention: dbConfig.backupRetention ?? PAYLOAD_DEFAULTS.DATABASE.BACKUP_RETENTION,
+            backupRetention: dbConfig.backupRetention,
             deletionProtection: dbConfig.deletionProtection ??
                 PAYLOAD_DEFAULTS.DATABASE.DELETION_PROTECTION,
             publiclyAccessible: dbConfig.publiclyAccessible,

package/dist/lib/patterns/aws/staticSite.d.ts

@@ -13,16 +13,16 @@
  * - Contact-form Lambda + Function URL (when `forms` is set)
  *
  * @example
- * const site = app.addPattern(PatternFactory.build("LbexcSite", {
+ * const site = app.addPattern(PatternFactory.build("StorefrontSite", {
  *   type: "staticsite",
- *   name: "lbexc",
- *   source: "../../lbexc-static-export",
+ *   name: "storefront",
+ *   source: "../../storefront-static-export",
  *   build: { command: "npm run build", outputDir: "out" },
  *   routing: "multipage",
  *   security: { headers: true },
- *   domain: "lbexc.com",
- *   zoneName: "lbexc.com", // or a CLI-injected `managedDomain` binding
- *   forms: { to: "hello@lbexc.com", corsOrigin: "https://lbexc.com" }
+ *   domain: "storefront.example",
+ *   zoneName: "storefront.example", // or a CLI-injected `managedDomain` binding
+ *   forms: { to: "hello@storefront.example", corsOrigin: "https://storefront.example" }
  * }));
  */
 import { Construct } from "constructs";