@fjall/components-infrastructure 32.0.0 → 33.1.0

package/dist/lib/resources/aws/compute/ecs.d.ts

@@ -3,6 +3,7 @@ import { Connections, type IConnectable } from "aws-cdk-lib/aws-ec2";
 import { Construct } from "constructs";
 import type { StackBuilder } from "../base/awsStack.js";
 import type { ApplicationListener, ApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { type EcsClusterProps } from "./ecsTypes.js";
 import { type EcsIngressProfile } from "./ingressProfile.js";
 export * from "./ecsTypes.js";
@@ -65,6 +66,16 @@ export default class EcsCluster extends Construct implements IConnectable {
     private outputName;
     private loadBalancerDisabled;
     private directAccessEnabled;
+    private readonly containerInsightsEnabled;
+    /**
+     * The stack's shared key when the app backup tier encrypts (resolved once,
+     * here); undefined otherwise. Read by the patterns layer for the log
+     * groups it creates beside the cluster's own, so the tier is consulted in
+     * one place.
+     */
+    readonly encryptionKey: StackEncryptionKey | undefined;
+    private readonly loadBalancerDeletionProtection;
+    private readonly loadBalancerAccessLogs;
     private priorityState;
     constructor(scope: Construct, id: string, props: EcsClusterProps);
     private get ctx();

package/dist/lib/resources/aws/compute/ecs.js

@@ -3,6 +3,9 @@ import { Connections, Port } from "aws-cdk-lib/aws-ec2";
 import { Construct } from "constructs";
 import { CfnOutput, Aspects } from "aws-cdk-lib";
 import { processConnections } from "../../../utils/connections.js";
+import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { envAwareRemovalPolicyDefault } from "../../../utils/removalPolicy.js";
+import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
 import { stackScopedExportName } from "../../../utils/exportNaming.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
@@ -84,6 +87,16 @@ export default class EcsCluster extends Construct {
     outputName;
     loadBalancerDisabled;
     directAccessEnabled;
+    containerInsightsEnabled;
+    /**
+     * The stack's shared key when the app backup tier encrypts (resolved once,
+     * here); undefined otherwise. Read by the patterns layer for the log
+     * groups it creates beside the cluster's own, so the tier is consulted in
+     * one place.
+     */
+    encryptionKey;
+    loadBalancerDeletionProtection;
+    loadBalancerAccessLogs;
     // ALB priority management
     priorityState = {
         nextPriority: 100,
@@ -98,6 +111,21 @@ export default class EcsCluster extends Construct {
         this.directAccessEnabled = props.cluster?.directAccess === true;
         this.loadBalancerDisabled =
             props.cluster?.loadBalancer === false || this.directAccessEnabled;
+        // Tier-owned defaults resolve exactly once, here; every helper reads the
+        // resolved value from ctx. An explicit prop is the override.
+        const tier = props.appBackupTier;
+        this.containerInsightsEnabled =
+            props.containerInsights ?? tierDefault(tier, "containerInsights");
+        this.encryptionKey = tierDefault(tier, "customerManagedKeys")
+            ? StackEncryptionKey.of(this)
+            : undefined;
+        this.loadBalancerDeletionProtection =
+            props.cluster?.loadBalancerDeletionProtection ??
+                (tierDefault(tier, "deletionProtection") &&
+                    envAwareRemovalPolicyDefault() === "RETAIN");
+        this.loadBalancerAccessLogs =
+            props.cluster?.loadBalancerAccessLogs ??
+                tierDefault(tier, "albAccessLogs");
         validateEcsClusterProps(props, this);
         this.cluster = this.addCluster(props);
         for (const serviceProps of props.services) {
@@ -161,7 +189,10 @@ export default class EcsCluster extends Construct {
             cluster: this.cluster,
             outputName: this.outputName,
             loadBalancerDisabled: this.loadBalancerDisabled,
-            directAccessEnabled: this.directAccessEnabled
+            directAccessEnabled: this.directAccessEnabled,
+            encryptionKey: this.encryptionKey,
+            loadBalancerDeletionProtection: this.loadBalancerDeletionProtection,
+            loadBalancerAccessLogs: this.loadBalancerAccessLogs
         };
     }
     /** Get the cluster's load balancer. Undefined if disabled. */
@@ -317,7 +348,7 @@ export default class EcsCluster extends Construct {
                 config: typeof serviceProps.alarms === "object" ? serviceProps.alarms : {},
                 alarmTopic: this.props.alertsTopic,
                 applicationId: this.props.applicationId,
-                containerInsightsEnabled: this.props.containerInsights === true
+                containerInsightsEnabled: this.containerInsightsEnabled
             });
             if (serviceProps.logAlarms && serviceProps.logAlarms.length > 0) {
                 createLogPatternAlarms({
@@ -385,18 +416,32 @@ export default class EcsCluster extends Construct {
         const needsFargate = this.anyServiceUsesFargate();
         // Every service enables execute command; without an OVERRIDE here the
         // exec session output interleaves into the container app log groups
-        // (DEFAULT mode). No kmsKey — session encryption is tier-gated.
-        const execAuditLogGroup = new LogGroup(this, `${props.clusterName}ExecAuditLogGroup`, { retention: DEFAULT_FRAMEWORK_LOG_RETENTION });
+        // (DEFAULT mode). Session encryption follows the tier: the shared stack
+        // key encrypts the session AND its audit log group (ECS requires the
+        // audit group to be CMK-encrypted before it will encrypt the session).
+        const encryptionKey = this.encryptionKey;
+        const execAuditLogGroup = new LogGroup(this, `${props.clusterName}ExecAuditLogGroup`, {
+            retention: DEFAULT_FRAMEWORK_LOG_RETENTION,
+            ...(encryptionKey !== undefined && {
+                encryptionKey: encryptionKey.forLogGroups()
+            })
+        });
         const cluster = new CdkCluster(this, `${props.clusterName}Cluster`, {
             vpc: props.vpc,
             clusterName: props.clusterName,
-            containerInsightsV2: props.containerInsights === true
+            containerInsightsV2: this.containerInsightsEnabled
                 ? ContainerInsights.ENABLED
                 : ContainerInsights.DISABLED,
             enableFargateCapacityProviders: needsFargate,
             executeCommandConfiguration: {
+                ...(encryptionKey !== undefined && { kmsKey: encryptionKey.key }),
                 logging: ExecuteCommandLogging.OVERRIDE,
-                logConfiguration: { cloudWatchLogGroup: execAuditLogGroup }
+                logConfiguration: {
+                    cloudWatchLogGroup: execAuditLogGroup,
+                    ...(encryptionKey !== undefined && {
+                        cloudWatchEncryptionEnabled: true
+                    })
+                }
             }
         });
         new CfnOutput(this, `${this.outputName}DeployableCluster`, {

package/dist/lib/resources/aws/compute/ecsContext.d.ts

@@ -1,7 +1,12 @@
 import type { Construct } from "constructs";
 import type { Cluster as CdkCluster } from "aws-cdk-lib/aws-ecs";
+import type { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import type { EcsClusterProps } from "./ecsTypes.js";
-/** Shared state passed from EcsCluster to extracted helper functions. */
+/**
+ * Shared state passed from EcsCluster to extracted helper functions. The
+ * tier-owned knobs are resolved once in the constructor and read here as
+ * plain values — helpers never consult the tier themselves.
+ */
 export interface EcsConstructContext {
     scope: Construct;
     props: EcsClusterProps;
@@ -9,4 +14,8 @@ export interface EcsConstructContext {
     outputName: string;
     loadBalancerDisabled: boolean;
     directAccessEnabled: boolean;
+    /** The stack's shared key when the tier encrypts; undefined otherwise. */
+    encryptionKey: StackEncryptionKey | undefined;
+    loadBalancerDeletionProtection: boolean;
+    loadBalancerAccessLogs: boolean;
 }

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -44,7 +44,9 @@ export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
         loadBalancerName: truncatedLoadBalancerName,
         ...(loadBalancerSecurityGroup && {
             securityGroup: loadBalancerSecurityGroup
-        })
+        }),
+        deletionProtection: ctx.loadBalancerDeletionProtection,
+        accessLogs: ctx.loadBalancerAccessLogs
     });
     new CfnOutput(ctx.scope, `${ctx.outputName}LoadBalancerDnsName`, {
         key: `${ctx.outputName}LoadBalancerDnsName`,

package/dist/lib/resources/aws/compute/ecsTaskDefinition.js

@@ -148,7 +148,10 @@ export function addContainersToTask(ctx, serviceName, serviceProps, taskDefiniti
     // Removal: env-aware wrapper default (D17) — production RETAIN keeps
     // fail-closed rollback evidence; non-production DESTROY avoids orphans.
     const logGroup = new LogGroup(ctx.scope, `${ctx.props.clusterName}${serviceName}LogGroup`, {
-        retention: DEFAULT_LOG_RETENTION
+        retention: DEFAULT_LOG_RETENTION,
+        ...(ctx.encryptionKey !== undefined && {
+            encryptionKey: ctx.encryptionKey.forLogGroups()
+        })
     });
     for (const containerConfig of serviceProps.containers) {
         const image = getContainerImage(ctx, serviceName, containerConfig, serviceProps);

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -16,6 +16,7 @@ import { type Role } from "aws-cdk-lib/aws-iam";
 import { type HostedZone as FjallHostedZone } from "../networking/hostedZone.js";
 import { type Certificate } from "aws-cdk-lib/aws-certificatemanager";
 import { type ConnectionSpec } from "../../../utils/connector.js";
+import type { BackupTier } from "../../../utils/backupTierMapping.js";
 import { type RemoteConnectionSpec } from "./ecsRemoteConnections.js";
 import { type SecretImport } from "../secrets/index.js";
 import type { ManagedDomainBinding, ManagedDomainExports } from "../../../utils/domainTypes.js";
@@ -472,6 +473,20 @@ export interface EcsClusterClusterConfig {
      * by the patterns layer (AC26 — `EcsClusterConfig.securityGroup`).
      */
     securityGroup?: ISecurityGroup;
+    /**
+     * Deletion protection on the shared load balancer. Default: the app backup
+     * tier's `deletionProtection` column, applied only when the stack's
+     * environment resolves to production — a dev or staging stack is torn
+     * down by design. The destroy pre-flight switches it off before a
+     * consented destroy.
+     */
+    loadBalancerDeletionProtection?: boolean;
+    /**
+     * Access logs from the shared load balancer, delivered to the stack's
+     * lifecycle-expired access-log bucket under `alb/<load balancer id>/`.
+     * Default: the app backup tier's `albAccessLogs` column.
+     */
+    loadBalancerAccessLogs?: boolean;
 }
 /**
  * Routing configuration for path/host-based routing on the ALB.
@@ -749,15 +764,23 @@ export interface EcsClusterProps {
      */
     taskStopWatchdog?: false;
     /**
-     * CloudWatch Container Insights (default off). Enabling it bills
-     * ~$0.30/metric-month of custom `ECS/ContainerInsights` metrics per cluster
-     * plus performance-log ingestion. The per-service running-tasks alarm is
-     * the one construct consumer of that namespace (`RunningTaskCount` exists
-     * nowhere else) and is skipped when insights are off; every other alarm
-     * sits on `AWS/ECS` and `Fjall/ECS`. Explicit opt-in for clusters whose
-     * operators want the running-tasks alarm or the per-task console breakdown.
+     * CloudWatch Container Insights. Default: the app backup tier's
+     * `containerInsights` column (on at enterprise, off below). Enabling it
+     * bills ~$0.30/metric-month of custom `ECS/ContainerInsights` metrics per
+     * cluster plus performance-log ingestion. The per-service running-tasks
+     * alarm is the one construct consumer of that namespace (`RunningTaskCount`
+     * exists nowhere else) and is skipped when insights are off; every other
+     * alarm sits on `AWS/ECS` and `Fjall/ECS`. `false` is an explicit,
+     * auditable opt-out at enterprise.
+     */
+    containerInsights?: boolean;
+    /**
+     * The owning app's backup tier, which the tier-owned defaults (Container
+     * Insights, exec-session and log-group encryption, load-balancer deletion
+     * protection and access logs) follow. `ComputeFactory` fills it from the
+     * App; pass it only for direct `new EcsCluster(...)` construction.
      */
-    containerInsights?: true;
+    appBackupTier?: BackupTier;
 }
 /**
  * Data tracked for each service in the cluster.

package/dist/lib/resources/aws/compute/lambda.d.ts

@@ -3,6 +3,7 @@ import { type Bucket } from "aws-cdk-lib/aws-s3";
 import { PolicyStatement, type IRole } from "aws-cdk-lib/aws-iam";
 import { type IVpc } from "aws-cdk-lib/aws-ec2";
 import type { RetentionDays } from "aws-cdk-lib/aws-logs";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import { type IQueue } from "aws-cdk-lib/aws-sqs";
 import { type ITable } from "aws-cdk-lib/aws-dynamodb";
 import { type Construct } from "constructs";
@@ -92,8 +93,24 @@ export interface LambdaFunctionProps {
     alarms?: LambdaAlarmThresholds | false;
     /** Application ID for alarm tagging. */
     applicationId?: string;
+    /**
+     * Active X-Ray tracing. Default: the app backup tier's `lambdaTracing`
+     * column (on at enterprise).
+     */
+    tracing?: boolean;
+    /**
+     * The owning app's backup tier, which the tier-owned defaults (tracing,
+     * environment-variable and log-group encryption) follow. `ComputeFactory`
+     * fills it from the App; pass it only for direct `new LambdaFunction(...)`
+     * construction.
+     */
+    appBackupTier?: BackupTier;
 }
-export interface SingletonFunctionProps extends LambdaFunctionProps {
+/**
+ * Framework custom-resource handlers are tier-agnostic: the tier-owned
+ * knobs are excluded at the type rather than silently ignored.
+ */
+export interface SingletonFunctionProps extends Omit<LambdaFunctionProps, "tracing" | "appBackupTier"> {
     uuid?: string;
     ephemeralStorageSize?: number;
 }

package/dist/lib/resources/aws/compute/lambda.js

@@ -1,5 +1,5 @@
 import { Annotations, CfnOutput, Duration, Stack, Size } from "aws-cdk-lib";
-import { SingletonFunction as singletonFunction, Function, Code, Architecture, FunctionUrlAuthType, StartingPosition, LayerVersion } from "aws-cdk-lib/aws-lambda";
+import { SingletonFunction as singletonFunction, Function, Code, Architecture, FunctionUrlAuthType, StartingPosition, LayerVersion, Tracing } from "aws-cdk-lib/aws-lambda";
 import { FactName } from "aws-cdk-lib/region-info";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -8,6 +8,8 @@ import { SqsEventSource, DynamoEventSource, S3EventSource } from "aws-cdk-lib/aw
 import { EventType } from "aws-cdk-lib/aws-s3";
 import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
 import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
+import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { Queue, QueueEncryption } from "aws-cdk-lib/aws-sqs";
 import { SQS_LIMITS } from "../messaging/sqs.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -167,12 +169,25 @@ export class LambdaFunction extends Function {
     asyncFailureQueueWired;
     constructor(scope, id, props) {
         validateRuntimeNotDeprecated(props.runtime, id);
+        // Both are Fjall props, not CDK ones: `tracing` collides with the CDK
+        // enum of the same name and `appBackupTier` is unknown to CDK.
+        const { tracing, appBackupTier, ...cdkProps } = props;
         const vpcSubnets = props.vpc
             ? { subnetType: resolvePrivateSubnetType(props.vpc) }
             : undefined;
+        const tracingEnabled = tracing ?? tierDefault(appBackupTier, "lambdaTracing");
+        // Grant-based: Lambda encrypts the environment through a KMS grant the
+        // deploying role creates, so the execution role needs no key policy.
+        const encryptionKey = tierDefault(appBackupTier, "customerManagedKeys")
+            ? StackEncryptionKey.of(scope)
+            : undefined;
         super(scope, id, {
-            ...props,
+            ...cdkProps,
             vpcSubnets,
+            ...(tracingEnabled && { tracing: Tracing.ACTIVE }),
+            ...(encryptionKey !== undefined && {
+                environmentEncryption: encryptionKey.key
+            }),
             timeout: Duration.seconds(props.timeout ?? LAMBDA_DEFAULT_TIMEOUT_SECONDS),
             memorySize: props.memorySize ?? 128,
             ephemeralStorageSize: props.ephemeralStorageSize
@@ -181,7 +196,10 @@ export class LambdaFunction extends Function {
             description: props.lambdaDescription ?? `${id} Lambda`,
             environment: props.environment,
             logGroup: new LogGroup(scope, `${id}LogGroup`, {
-                retention: props.logGroupRetention ?? DEFAULT_FRAMEWORK_LOG_RETENTION
+                retention: props.logGroupRetention ?? DEFAULT_FRAMEWORK_LOG_RETENTION,
+                ...(encryptionKey !== undefined && {
+                    encryptionKey: encryptionKey.forLogGroups()
+                })
             })
         });
         this.asyncFailureQueueProp = props.asyncFailureQueue;

package/dist/lib/resources/aws/database/clickhouseConstants.d.ts

@@ -155,7 +155,7 @@ export declare const CLICKHOUSE_NATIVE_PORT = 9000;
 export declare const CLICKHOUSE_PROMETHEUS_PORT = 9363;
 /** TLS-mode ClickHouse ports.
  *  HTTPS replaces 8123; secure native protocol replaces 9000.
- *  See aiDocs/patterns/clickhouse-tls-pattern.md § "The contract". */
+ *  See the ClickHouse TLS pattern, § "The contract". */
 export declare const CLICKHOUSE_HTTPS_PORT = 8443;
 export declare const CLICKHOUSE_TCP_SECURE_PORT = 9440;
 /** Mount path inside the ClickHouse container for the materialised TLS cert
@@ -188,8 +188,8 @@ export declare function clickHouseUserSecretName(userName: string): string;
  *  Canonical source is `@fjall/util/migration § userPasswordEnvName` — re-exported
  *  here so the construct-side import chain stays unchanged while the runner
  *  (`webapp/scripts/migration-runner.mjs`) and any future consumer share a single
- *  declaration. Coupled values per `.claude/rules/code-quality.md § "Coupled values:
- *  shared source at 2 occurrences"`. */
+ *  declaration. Coupled values (the shared-source-at-two-occurrences
+ *  rule). */
 export { userPasswordEnvName } from "@fjall/util/migration";
 /** Env var name carrying the SHA-256 of a user's plaintext password.
  *  The container entrypoint wrapper derives this name from the
@@ -305,8 +305,8 @@ export declare const BACKUP_RETENTION_DAYS = 14;
  *  wrote can be read back. Dropped on the way in and on the way out; never
  *  queried by the application. Canonical source is `@fjall/util/migration`
  *  because `@fjall/clickhouse` grants `fjall_maintenance` DROP on exactly
- *  this database — coupled values per `.claude/rules/code-quality.md §
- *  "Coupled values: shared source at 2 occurrences"`. */
+ *  this database — coupled values (the shared-source-at-two-occurrences
+ *  rule). */
 export { CLICKHOUSE_BACKUP_SCRATCH_DATABASE } from "@fjall/util/migration";
 /** The two scheduled maintenance jobs that authenticate as
  *  `fjall_maintenance`. Drives the per-job log-group → metric-filter wiring

package/dist/lib/resources/aws/database/clickhouseConstants.js

@@ -175,7 +175,7 @@ export const CLICKHOUSE_NATIVE_PORT = 9000;
 export const CLICKHOUSE_PROMETHEUS_PORT = 9363;
 /** TLS-mode ClickHouse ports.
  *  HTTPS replaces 8123; secure native protocol replaces 9000.
- *  See aiDocs/patterns/clickhouse-tls-pattern.md § "The contract". */
+ *  See the ClickHouse TLS pattern, § "The contract". */
 export const CLICKHOUSE_HTTPS_PORT = 8443;
 export const CLICKHOUSE_TCP_SECURE_PORT = 9440;
 /** Mount path inside the ClickHouse container for the materialised TLS cert
@@ -210,8 +210,8 @@ export function clickHouseUserSecretName(userName) {
  *  Canonical source is `@fjall/util/migration § userPasswordEnvName` — re-exported
  *  here so the construct-side import chain stays unchanged while the runner
  *  (`webapp/scripts/migration-runner.mjs`) and any future consumer share a single
- *  declaration. Coupled values per `.claude/rules/code-quality.md § "Coupled values:
- *  shared source at 2 occurrences"`. */
+ *  declaration. Coupled values (the shared-source-at-two-occurrences
+ *  rule). */
 export { userPasswordEnvName } from "@fjall/util/migration";
 /** Env var name carrying the SHA-256 of a user's plaintext password.
  *  The container entrypoint wrapper derives this name from the
@@ -347,8 +347,8 @@ export const BACKUP_RETENTION_DAYS = 14;
  *  wrote can be read back. Dropped on the way in and on the way out; never
  *  queried by the application. Canonical source is `@fjall/util/migration`
  *  because `@fjall/clickhouse` grants `fjall_maintenance` DROP on exactly
- *  this database — coupled values per `.claude/rules/code-quality.md §
- *  "Coupled values: shared source at 2 occurrences"`. */
+ *  this database — coupled values (the shared-source-at-two-occurrences
+ *  rule). */
 export { CLICKHOUSE_BACKUP_SCRATCH_DATABASE } from "@fjall/util/migration";
 /** The two scheduled maintenance jobs that authenticate as
  *  `fjall_maintenance`. Drives the per-job log-group → metric-filter wiring

package/dist/lib/resources/aws/database/dynamodb.d.ts

@@ -1,4 +1,5 @@
 import { Construct } from "constructs";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import { type ITable } from "aws-cdk-lib/aws-dynamodb";
 import { type IGrantable, type Grant } from "aws-cdk-lib/aws-iam";
 export type DynamoDBAttributeType = "S" | "N" | "B";
@@ -24,9 +25,27 @@ export interface DynamoDBTableProps {
     timeToLiveAttribute?: string;
     stream?: "NEW_IMAGE" | "OLD_IMAGE" | "NEW_AND_OLD_IMAGES" | "KEYS_ONLY";
     pointInTimeRecovery?: boolean;
+    /**
+     * Encryption at rest. Default: the app backup tier's `customerManagedKeys`
+     * column — `CUSTOMER_MANAGED` at enterprise, `AWS_MANAGED` otherwise.
+     * `CUSTOMER_MANAGED` always encrypts with the stack's shared
+     * [[StackEncryptionKey]]; switching a live table's key is an in-place
+     * update.
+     */
     encryption?: "AWS_OWNED" | "AWS_MANAGED" | "CUSTOMER_MANAGED";
+    /**
+     * DynamoDB `DeletionProtectionEnabled`. Default: the app backup tier's
+     * `deletionProtection` column (on at resilient and enterprise). The
+     * destroy pre-flight switches it off before a consented destroy.
+     */
     deletionProtection?: boolean;
     removalPolicy?: "DESTROY" | "RETAIN" | "SNAPSHOT";
+    /**
+     * The owning app's backup tier, which the tier-owned defaults (encryption,
+     * deletion protection) follow. `DatabaseFactory` fills it from the App;
+     * pass it only for direct `new DynamoDBTable(...)` construction.
+     */
+    appBackupTier?: BackupTier;
 }
 export declare class DynamoDBTable extends Construct {
     readonly id: string;

package/dist/lib/resources/aws/database/dynamodb.js

@@ -1,6 +1,8 @@
 import { Construct } from "constructs";
 import { CfnOutput } from "aws-cdk-lib";
+import { tierDefault } from "../../../utils/backupTierMapping.js";
 import { toRemovalPolicy } from "../../../utils/removalPolicy.js";
+import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { Table, AttributeType, BillingMode, StreamViewType, ProjectionType, TableEncryption } from "aws-cdk-lib/aws-dynamodb";
 function toAttributeType(type) {
     switch (type) {
@@ -64,6 +66,12 @@ export class DynamoDBTable extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.id = id;
+        const encryption = props.encryption ??
+            (tierDefault(props.appBackupTier, "customerManagedKeys")
+                ? "CUSTOMER_MANAGED"
+                : "AWS_MANAGED");
+        const deletionProtection = props.deletionProtection ??
+            tierDefault(props.appBackupTier, "deletionProtection");
         this.table = new Table(this, `${id}Table`, {
             tableName: props.tableName,
             partitionKey: {
@@ -83,8 +91,11 @@ export class DynamoDBTable extends Construct {
             pointInTimeRecoverySpecification: {
                 pointInTimeRecoveryEnabled: props.pointInTimeRecovery ?? true
             },
-            encryption: toTableEncryption(props.encryption),
-            deletionProtection: props.deletionProtection ?? false,
+            encryption: toTableEncryption(encryption),
+            ...(encryption === "CUSTOMER_MANAGED" && {
+                encryptionKey: StackEncryptionKey.of(this).key
+            }),
+            deletionProtection,
             removalPolicy: toRemovalPolicy(props.removalPolicy),
             timeToLiveAttribute: props.timeToLiveAttribute
         });

package/dist/lib/resources/aws/database/rdsAurora.d.ts

@@ -3,6 +3,7 @@ import { Connections, type IConnectable, type IVpc } from "aws-cdk-lib/aws-ec2";
 import { DatabaseCluster, type CfnDBCluster, type IClusterEngine } from "aws-cdk-lib/aws-rds";
 import { Construct } from "constructs";
 import { Secret } from "../secrets/index.js";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type RdsAlarmThresholds } from "../monitoring/index.js";
 import { type EngineConfig, type ProxyConfig, type CredentialsConfig, type AuroraEncryptionConfig, type AuroraWriterConfig, type AuroraReadersConfig, type DatabaseInsightsConfig, type SnapshotTarget } from "../../../utils/databaseTypes.js";
@@ -40,7 +41,17 @@ interface RdsProps {
     proxy?: ProxyConfig | false;
     credentials?: CredentialsConfig;
     encryption?: AuroraEncryptionConfig;
+    /**
+     * Automated backup retention in days. Defaults to the app backup tier's
+     * column (`tierDefault(appBackupTier, "rdsBackupRetentionDays")`).
+     */
     backupRetention?: number;
+    /**
+     * The owning app's backup tier (`App.getApp({ backup: { tier } })`), which
+     * the retention default follows. `DatabaseFactory` fills it from the App;
+     * pass it only for direct `new RdsAurora(...)` construction.
+     */
+    appBackupTier?: BackupTier;
     monitoringInterval?: Duration;
     preferredMaintenanceWindow?: string;
     port?: number;

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -6,8 +6,9 @@ import { Construct } from "constructs";
 import { SecurityGroup } from "../networking/securityGroup.js";
 import { Secret } from "../secrets/index.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
+import { tierDefault } from "../../../utils/backupTierMapping.js";
 import { addProxyCfnOutput } from "./rdsProxyOutput.js";
-import { getDatabaseInsightsRetention } from "./index.js";
+import { getCdkDatabaseInsightsMode, getDatabaseInsightsRetention } from "./index.js";
 import { RDS_DEFAULTS, SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS, SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS, MIN_AUTO_PAUSE_POSTGRES_VERSION } from "./rdsDefaults.js";
 import { createRdsAlarms } from "../monitoring/index.js";
 import { DEFAULT_POSTGRES_ENGINE_CONFIG, resolveDatabaseInsights, resolveStorageEncryptionKey, resolvePerformanceInsightsKey, addMultiUserSecretRotation, warnIfSnapshotUsernameAssumed } from "./rdsHelpers.js";
@@ -138,8 +139,26 @@ export class RdsAurora extends Construct {
         const writerConfig = props.writer ?? {};
         const writerPI = writerConfig.enableDatabaseInsights ?? piEnabled;
         const writerSuffix = writerConfig.identifierSuffix;
-        const diMode = piConfig?.mode ?? "standard";
+        // The tier owns the Database Insights mode; an explicit `mode` wins.
+        const diMode = piConfig?.mode ??
+            tierDefault(props.appBackupTier, "databaseInsightsMode");
         const performanceInsightsRetention = getDatabaseInsightsRetention(diMode);
+        // Advanced mode is a cluster-level setting that CDK validates against
+        // every instance: the cluster must carry Performance Insights with the
+        // same 15-month retention and key the instances do, or synth throws a
+        // retention mismatch. Emitted only when it applies, so a standard
+        // template stays byte-identical.
+        const advancedInsights = piEnabled && diMode === "advanced";
+        const clusterInsightsProps = advancedInsights
+            ? {
+                enablePerformanceInsights: true,
+                performanceInsightRetention: performanceInsightsRetention,
+                ...(performanceInsightsKey && {
+                    performanceInsightEncryptionKey: performanceInsightsKey
+                }),
+                databaseInsightsMode: getCdkDatabaseInsightsMode(diMode)
+            }
+            : {};
         const writer = ClusterInstance.serverlessV2(`${this.databaseNameValue}Writer`, {
             enablePerformanceInsights: writerPI,
             performanceInsightEncryptionKey: writerPI
@@ -170,7 +189,8 @@ export class RdsAurora extends Construct {
             ? { subnetType: SubnetType.PUBLIC }
             : { subnetType: SubnetType.PRIVATE_WITH_EGRESS };
         this.backupRetentionDaysValue =
-            props.backupRetention ?? RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS;
+            props.backupRetention ??
+                tierDefault(props.appBackupTier, "rdsBackupRetentionDays");
         // Common props shared across all cluster creation paths
         const baseClusterProps = {
             vpc: props.vpc,
@@ -194,6 +214,7 @@ export class RdsAurora extends Construct {
             removalPolicy: props.removalPolicy ?? RemovalPolicy.SNAPSHOT,
             deletionProtection: props.deletionProtection ?? true,
             iamAuthentication: true,
+            ...clusterInsightsProps,
             ...(props.serverlessV2MinCapacity !== undefined && {
                 serverlessV2MinCapacity: props.serverlessV2MinCapacity
             }),

package/dist/lib/resources/aws/database/rdsAuroraGlobal.d.ts

@@ -6,6 +6,7 @@ import { type ITopic } from "aws-cdk-lib/aws-sns";
 import { type Secret } from "../secrets/index.js";
 import { type RdsAlarmThresholds } from "../monitoring/index.js";
 import { type EngineConfig, type ProxyConfig, type CredentialsConfig, type AuroraEncryptionConfig, type AuroraWriterConfig, type AuroraReadersConfig, type DatabaseInsightsConfig, type SnapshotTarget } from "../../../utils/databaseTypes.js";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 interface RdsAuroraGlobalProps {
     vpc: IVpc;
     databaseName: string;
@@ -37,8 +38,17 @@ interface RdsAuroraGlobalProps {
     credentials?: CredentialsConfig;
     /** Encryption configuration */
     encryption?: AuroraEncryptionConfig;
-    /** Backup retention in days. Default: 14 */
+    /**
+     * Backup retention in days. Defaults to the app backup tier's column
+     * (`tierDefault(appBackupTier, "rdsBackupRetentionDays")`) on every
+     * regional cluster.
+     */
     backupRetention?: number;
+    /**
+     * The owning app's backup tier, forwarded to each regional `RdsAurora`.
+     * `DatabaseFactory` fills it from the App.
+     */
+    appBackupTier?: BackupTier;
     /** CloudWatch monitoring interval. Default: 1 minute */
     monitoringInterval?: Duration;
     /** Preferred maintenance window. Default: "Sat:12:30-Sat:20:30" */

package/dist/lib/resources/aws/database/rdsAuroraGlobal.js

@@ -83,6 +83,7 @@ export class RdsAuroraGlobal extends Construct {
             encryption: this.props.encryption,
             // Operational configuration
             backupRetention: this.props.backupRetention,
+            appBackupTier: this.props.appBackupTier,
             monitoringInterval: this.props.monitoringInterval,
             preferredMaintenanceWindow: this.props.preferredMaintenanceWindow,
             port: this.props.port,

package/dist/lib/resources/aws/database/rdsDefaults.d.ts

@@ -4,8 +4,6 @@ export declare const RDS_DEFAULTS: Readonly<{
     readonly PREFERRED_MAINTENANCE_WINDOW: "Sat:12:30-Sat:20:30";
     /** 1 minute — balances monitoring granularity against CloudWatch costs */
     readonly MONITORING_INTERVAL: Duration;
-    /** Default backup retention in days — applied uniformly across Aurora and RDS Instance */
-    readonly BACKUP_RETENTION_DEFAULT_DAYS: 14;
     /** Default instance type — primary and read-replica must stay in lockstep */
     readonly DEFAULT_INSTANCE_TYPE: "t4g.large";
     /** Default storage autoscaling ceiling (GiB) — applied to primary and replica */

package/dist/lib/resources/aws/database/rdsDefaults.js

@@ -4,8 +4,6 @@ export const RDS_DEFAULTS = Object.freeze({
     PREFERRED_MAINTENANCE_WINDOW: "Sat:12:30-Sat:20:30",
     /** 1 minute — balances monitoring granularity against CloudWatch costs */
     MONITORING_INTERVAL: Duration.minutes(1),
-    /** Default backup retention in days — applied uniformly across Aurora and RDS Instance */
-    BACKUP_RETENTION_DEFAULT_DAYS: 14,
     /** Default instance type — primary and read-replica must stay in lockstep */
     DEFAULT_INSTANCE_TYPE: "t4g.large",
     /** Default storage autoscaling ceiling (GiB) — applied to primary and replica */

package/dist/lib/resources/aws/database/rdsInstance.d.ts

@@ -7,6 +7,7 @@ import { SecurityGroup } from "../networking/securityGroup.js";
 import { Secret } from "../secrets/index.js";
 import { type StackBuilder } from "../base/awsStack.js";
 import { type EngineConfig, type ProxyConfig, type ReadReplicaConfig, type CredentialsConfig, type EncryptionConfig, type DatabaseInsightsConfig, type SnapshotTarget } from "../../../utils/databaseTypes.js";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type RdsAlarmThresholds } from "../monitoring/index.js";
 interface RdsProps {
@@ -17,7 +18,17 @@ interface RdsProps {
     instanceType?: string;
     maxAllocatedStorage?: number;
     allocatedStorage?: number;
+    /**
+     * Automated backup retention. Defaults to the app backup tier's column
+     * (`tierDefault(appBackupTier, "rdsBackupRetentionDays")`).
+     */
     backupRetention?: Duration;
+    /**
+     * The owning app's backup tier (`App.getApp({ backup: { tier } })`), which
+     * the retention default follows. `DatabaseFactory` fills it from the App;
+     * pass it only for direct `new RdsInstance(...)` construction.
+     */
+    appBackupTier?: BackupTier;
     preferredBackupWindow?: string;
     clusterIdentifier?: string;
     monitoringInterval?: Duration;