@fjall/components-infrastructure 33.1.0 → 35.0.0

package/dist/lib/app.js

@@ -12,6 +12,7 @@ import { ServiceDiscoveryNamespace } from "./resources/aws/networking/serviceDis
 import { BuildkiteFactory } from "./patterns/aws/buildkite.js";
 import { DevSubstrate } from "./patterns/aws/devSubstrate.js";
 import { StandardTagsAspect } from "./utils/standardTagsAspect.js";
+import { DeployTimeWriterMarkerAspect } from "./utils/deployTimeWriterMarkerAspect.js";
 import { emitAppLevelAlbAliasExports } from "./utils/albAliasTargetRegistry.js";
 import { emitAppLevelCdnAliasExports } from "./utils/cdnAliasTargetRegistry.js";
 import { ensureFunctionLogGroups } from "./resources/aws/logging/logGroupHygiene.js";
@@ -61,6 +62,7 @@ export class App extends CdkApp {
             context: { [RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS]: true }
         });
         App.instance = this;
+        Aspects.of(this).add(new DeployTimeWriterMarkerAspect());
         this.name = name ?? "FjallApp";
         this.stackPrefix = toPascalCase(this.name);
         // Initialise manifest collector for build-time service discovery

package/dist/lib/config/aws/deployBoundarySingleton.d.ts

@@ -102,6 +102,12 @@ export declare const SECURITY_TIER_DIGESTS: {
  * Five is IAM's per-policy version ceiling: at five, the oldest non-default
  * version is dropped before the new default is published.
  * `GetPolicyVersion` returns the document URL-encoded, hence the decode.
+ *
+ * TODO 2026-09-05, owner: paul — tag on adopt (a `TagPolicy` after the live
+ * read when the marker is absent, so an ADOPTED policy carries the marker the
+ * create path applies via `Tags: props.PolicyTags`); blocked on the
+ * inline-code budget, tracked in the deploy-boundary raises decisions design
+ * note (2026-09-05, § 6 "Train 8").
  */
 export declare const DEPLOY_BOUNDARY_HANDLER_CORE: string;
 /**

package/dist/lib/config/aws/deployBoundarySingleton.js

@@ -1,4 +1,4 @@
-import { SECURITY_TIER_TO_BOUNDARY, deployBoundaryName } from "@fjall/generator";
+import { SECURITY_TIER_TO_BOUNDARY, deployBoundaryName, deployBoundaryPolicyArn } from "@fjall/generator";
 import { Aws, Duration } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
@@ -147,6 +147,12 @@ const ALLOWED_DIGEST_LITERALS = Object.values(SECURITY_TIER_DIGESTS)
  * Five is IAM's per-policy version ceiling: at five, the oldest non-default
  * version is dropped before the new default is published.
  * `GetPolicyVersion` returns the document URL-encoded, hence the decode.
+ *
+ * TODO 2026-09-05, owner: paul — tag on adopt (a `TagPolicy` after the live
+ * read when the marker is absent, so an ADOPTED policy carries the marker the
+ * create path applies via `Tags: props.PolicyTags`); blocked on the
+ * inline-code budget, tracked in the deploy-boundary raises decisions design
+ * note (2026-09-05, § 6 "Train 8").
  */
 export const DEPLOY_BOUNDARY_HANDLER_CORE = `const { IAMClient, GetPolicyCommand, GetPolicyVersionCommand, CreatePolicyCommand, CreatePolicyVersionCommand, ListPolicyVersionsCommand, DeletePolicyVersionCommand } = require('@aws-sdk/client-iam');
 const { createHash } = require('crypto');
@@ -225,7 +231,9 @@ export class DeployBoundarySingleton extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.policyName = deployBoundaryName(props.fjallOrgId);
-        const policyArn = `arn:${Aws.PARTITION}:iam::${Aws.ACCOUNT_ID}:policy/${this.policyName}`;
+        // Same SSoT builder the seam-2 probe and the destroy sweep address the
+        // policy with — three renderers, one derivation.
+        const policyArn = deployBoundaryPolicyArn(Aws.PARTITION, Aws.ACCOUNT_ID, props.fjallOrgId);
         const writer = new CustomResource(this, "Policy", {
             runtime: Runtime.NODEJS_24_X,
             timeout: Duration.seconds(DEPLOY_BOUNDARY_WRITER_TIMEOUT_SECONDS),

package/dist/lib/config/aws/identityCenter.js

@@ -5,6 +5,7 @@ import { Annotations, CfnOutput, NestedStack } from "aws-cdk-lib";
 import { AwsCustomResource } from "../../resources/aws/utilities/awsCustomResource.js";
 import { Group, GroupMembership, PermissionSet, Assignment, IdentityStoreUser, IdentityStoreUserProvider, identityStoreUserArnPattern } from "../../resources/aws/iam/identityCenter/index.js";
 import { ManagedPolicy, Role } from "../../resources/aws/iam/index.js";
+import { markDeployTimeWriter } from "../../utils/resourceTypeTags.js";
 import { allGroupNames, assignmentConstructId, boundGroupsForSet, effectivePermissionSets, implicitGroupNames, resolveTargetAccountNames, validateIdentityCentreConfig } from "./identityCentreConfig.js";
 // CreateAccountAssignment has a 15-outstanding-async limit. Batching at 8
 // keeps headroom for CFN's internal retries within the same backoff window.
@@ -74,6 +75,7 @@ export class IdentityCenter extends NestedStack {
                 })
             }
         });
+        markDeployTimeWriter(this.listInstancesRole);
     }
     listIdentityCenterInstance() {
         const listInstancesCall = {

package/dist/lib/config/aws/scpPreset.js

@@ -346,9 +346,19 @@ function buildCostControls() {
                     "rds:ModifyDBCluster"
                 ],
                 Resource: "*",
+                // A negated operator over an ABSENT key evaluates true, so without
+                // the Null guard this statement denies every RDS request that names
+                // no instance class: a class-less ModifyDBInstance (the destroy
+                // pre-flight's DeletionProtection flip, a retention or parameter-group
+                // change), and Aurora's CreateDBCluster/ModifyDBCluster, where the
+                // class lives on the instances. The guard limits the deny to requests
+                // that carry a class; the instances still gate Aurora, whose Fjall
+                // construct is Serverless v2 only (`db.serverless`).
+                // https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html
                 Condition: {
+                    Null: { "rds:DatabaseClass": "false" },
                     StringNotLike: {
-                        "rds:DatabaseClass": ["db.t3.*", "db.t4g.*"]
+                        "rds:DatabaseClass": ["db.t3.*", "db.t4g.*", "db.serverless"]
                     }
                 }
             }

package/dist/lib/patterns/aws/bastionFactory.js

@@ -11,7 +11,8 @@ export function createBastion(networkStack, appName, stackPrefix, vpc, config) {
         serviceName: `${stackPrefix}Bastion`,
         instanceType,
         vpc,
-        enableSSH: false,
+        // Session Manager only: no sshAccess, so no key pair, no port-22 ingress
+        // and private subnets.
         minCapacity: 1,
         maxCapacity: 1
     });

package/dist/lib/patterns/aws/cdn.d.ts

@@ -87,7 +87,10 @@ interface BaseCdnProps {
      * `cloudFrontLogging` column — enterprise logs to the stack's shared,
      * lifecycle-expired access-log bucket under `cloudfront/<id>/`. Set either
      * knob to take over: `enableLogging: false` opts out at any tier,
-     * `logBucket` delivers to a bucket of your own.
+     * `logBucket` delivers to a bucket of your own. Standard logging cannot
+     * deliver into an opt-in region, so a tier- or explicitly-enabled CDN whose
+     * delivery region is opt-in is refused at synth with those two cures — see
+     * {@link CloudFrontDistributionProps.enableLogging}.
      */
     enableLogging?: boolean;
     logBucket?: IBucket;

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -16,7 +16,6 @@ import { S3Bucket } from "../../resources/aws/storage/s3.js";
 import { Secret } from "../../resources/aws/secrets/secret.js";
 import { LogGroup } from "../../resources/aws/logging/logGroup.js";
 import { StackEncryptionKey } from "../../resources/aws/secrets/stackEncryptionKey.js";
-import { tierDefault } from "../../utils/backupTierMapping.js";
 import { createClickHouseSecurityGroup } from "../../resources/aws/database/clickhouseSecurityGroup.js";
 import { buildMaintenancePreamble, maintenanceOkMarker, maintenanceRun } from "../../resources/aws/database/clickhouseMaintenanceScript.js";
 import { buildClickHouseEntrypointWrapper, buildClickHouseUserData, generateUsersConfigXml } from "../../resources/aws/database/clickhouseUserData.js";
@@ -393,9 +392,8 @@ export class ClickHouseDatabase extends Construct {
         // The maintenance-task log groups sit beside the compute's own container
         // and exec-audit groups and follow the same tier: the stack's shared key
         // at enterprise, nothing otherwise.
-        const taskLogGroupEncryption = tierDefault(props.appBackupTier, "customerManagedKeys")
-            ? { encryptionKey: StackEncryptionKey.of(this).forLogGroups() }
-            : {};
+        const stackKey = StackEncryptionKey.forTier(this, props.appBackupTier);
+        const taskLogGroupEncryption = stackKey === undefined ? {} : { encryptionKey: stackKey.forLogGroups() };
         const backupTaskLogGroup = backupEnabled
             ? new LogGroup(this, "ClickHouseBackupTaskLogGroup", {
                 retention: RetentionDays.TWO_WEEKS,

package/dist/lib/patterns/aws/compute.d.ts

@@ -5,8 +5,8 @@ import { type ComputeType, type IEcsCompute, type ILambdaCompute, type IEc2Compu
 import type App from "../../app.js";
 import { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, type ContainerDependency, type EcsMigrationsConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig } from "./computeEcs.js";
 import { LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "./computeLambda.js";
-import { Ec2Compute, type Ec2ComputeProps, type SshConfig } from "./computeEc2.js";
-export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps, type SshConfig };
+import { Ec2Compute, type Ec2ComputeProps } from "./computeEc2.js";
+export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps };
 export type { ComputeType } from "./interfaces/compute.js";
 /**
  * Configuration defaults for each compute type.

package/dist/lib/patterns/aws/computeEc2.d.ts

@@ -3,31 +3,18 @@ import { type IAutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
 import { Construct } from "constructs";
 import { type IEc2Compute } from "./interfaces/compute.js";
 import { Ec2Instance } from "../../resources/aws/compute/ec2.js";
-/**
- * SSH access configuration for EC2 instances.
- * - Omit: disabled (default)
- * - `{}`: enabled with auto-generated key
- * - `{ keyName: "my-key" }`: enabled with existing key
- * - `false`: explicitly disabled
- */
-export interface SshConfig {
-    /** SSH key pair name */
-    keyName?: string;
-    /** Allowed CIDR blocks for SSH access */
-    allowedCidrs?: string[];
-}
+import { type Ec2SshAccessProps } from "../../resources/aws/compute/ec2SshAccess.js";
 export interface Ec2ComputeProps {
     type: "ec2";
     vpc?: IVpc;
     /** EC2 instance type. Default: "t4g.micro" */
     instanceType?: string;
     /**
-     * SSH access configuration.
-     * - Omit: disabled (default)
-     * - `{}`: enabled with defaults
-     * - `false`: explicitly disabled
+     * SSH access: who may reach port 22 (`allowedIpCidrs`), which key pair
+     * (`keyName`, or omit to mint one) and whether the instances are public
+     * (`public`). Omit for Session Manager-only access, the default.
      */
-    ssh?: SshConfig | false;
+    sshAccess?: Ec2SshAccessProps;
     /** User data script */
     userData?: UserData;
     /** Machine image (AMI) */

package/dist/lib/patterns/aws/computeEc2.js

@@ -1,5 +1,7 @@
 import { Construct } from "constructs";
+import { ec2ServiceName } from "@fjall/util";
 import { Ec2Instance } from "../../resources/aws/compute/ec2.js";
+import { checkRetiredSshProp } from "../../resources/aws/compute/ec2SshAccess.js";
 import { COMPUTE_DEFAULTS } from "./compute.js";
 /**
  * EC2 compute wrapper implementing IEc2Compute.
@@ -11,11 +13,15 @@ export class Ec2Compute extends Construct {
     ec2Instance;
     constructor(scope, id, props) {
         super(scope, id);
-        const enableSSH = props.ssh !== undefined && props.ssh !== false;
+        // The retired `ssh` prop read only its own presence (`keyName` and
+        // `allowedCidrs` were declared and never forwarded); a caller still
+        // passing it gets the translation, or a warning when it asked for the
+        // default.
+        checkRetiredSshProp(this, "Ec2Compute", props);
         const ec2Props = {
-            serviceName: `${id}Service`,
+            serviceName: ec2ServiceName(id),
             instanceType: props.instanceType || COMPUTE_DEFAULTS.EC2.INSTANCE_TYPE,
-            enableSSH,
+            ...(props.sshAccess !== undefined && { sshAccess: props.sshAccess }),
             userData: props.userData,
             machineImage: props.machineImage,
             minCapacity: props.minCapacity || COMPUTE_DEFAULTS.EC2.MIN_CAPACITY,

package/dist/lib/patterns/aws/computeEcs.d.ts

@@ -1,6 +1,6 @@
 import { type ICluster, type IBaseService, type TaskDefinition, type FargateTaskDefinition } from "aws-cdk-lib/aws-ecs";
 import { type Connections, type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
-import { type IGrantable, type IRole, Grant } from "aws-cdk-lib/aws-iam";
+import { type Grant, type IGrantable, type IRole } from "aws-cdk-lib/aws-iam";
 import { type IApplicationLoadBalancer, type ApplicationListener } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { Construct } from "constructs";
 import { type IEcsCompute } from "./interfaces/compute.js";
@@ -264,9 +264,9 @@ export declare class EcsCompute extends Construct implements IEcsCompute {
      */
     getEcsCluster(): EcsCluster;
     /**
-     * Grants ecs:ExecuteCommand permission for ECS services.
-     * Uses wildcard resource because ecs:ExecuteCommand targets task ARNs
-     * which are not known until runtime (tasks are ephemeral).
+     * Grant what an ECS Exec caller needs: `ecs:ExecuteCommand` on this
+     * cluster's tasks and, at a tier that encrypts the session, the
+     * `kms:GenerateDataKey` on the stack key the caller must hold.
      */
     grantExecuteCommand(grantee: IGrantable): Grant;
     /**

package/dist/lib/patterns/aws/computeEcs.js

@@ -1,6 +1,6 @@
 import { AwsLogDriver, ContainerImage, DeploymentLifecycleStage, Secret as EcsSecret } from "aws-cdk-lib/aws-ecs";
 import { Peer, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
-import { Effect, Grant, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { Annotations, Aws, Stack, Token } from "aws-cdk-lib";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { StringParameter } from "aws-cdk-lib/aws-ssm";
@@ -1688,16 +1688,12 @@ export class EcsCompute extends Construct {
         return this.ecsCluster;
     }
     /**
-     * Grants ecs:ExecuteCommand permission for ECS services.
-     * Uses wildcard resource because ecs:ExecuteCommand targets task ARNs
-     * which are not known until runtime (tasks are ephemeral).
+     * Grant what an ECS Exec caller needs: `ecs:ExecuteCommand` on this
+     * cluster's tasks and, at a tier that encrypts the session, the
+     * `kms:GenerateDataKey` on the stack key the caller must hold.
      */
     grantExecuteCommand(grantee) {
-        return Grant.addToPrincipal({
-            grantee,
-            actions: ["ecs:ExecuteCommand"],
-            resourceArns: ["*"]
-        });
+        return this.ecsCluster.grantExecuteCommand(grantee);
     }
     /**
      * Get the EC2 instance role for the cluster's underlying ASG. EC2-mode

package/dist/lib/patterns/aws/computePropApplicability.js

@@ -42,7 +42,7 @@ const COMPUTE_PROP_APPLICABILITY = {
     cmd: ["lambda"],
     workingDirectory: ["lambda"],
     instanceType: ["ec2"],
-    ssh: ["ec2"],
+    sshAccess: ["ec2"],
     userData: ["ec2"],
     machineImage: ["ec2"],
     minCapacity: ["ec2"],

package/dist/lib/patterns/aws/fivetranProxy.d.ts

@@ -3,15 +3,20 @@ import { type Construct } from "constructs";
 import { type KeyValue } from "../../types.js";
 import { type Connections } from "aws-cdk-lib/aws-ec2";
 import { type IVpc } from "aws-cdk-lib/aws-ec2";
-interface ProxyAgentProps extends StackProps {
+export interface FivetranProxyProps extends StackProps {
     accountId?: string;
     vpc?: IVpc;
     publicKey: string;
     instanceType: string;
+    /**
+     * Source ranges Fivetran connects from, one port-22 ingress rule each.
+     * Fivetran publishes its addresses per region; the proxy ships no
+     * world-open default.
+     */
+    allowedIpCidrs: string[];
     databaseConnection?: Connections;
     tags?: KeyValue;
 }
 export declare class FivetranProxy extends Stack {
-    constructor(scope: Construct, id: string, props: ProxyAgentProps);
+    constructor(scope: Construct, id: string, props: FivetranProxyProps);
 }
-export {};

package/dist/lib/patterns/aws/fivetranProxy.js

@@ -4,6 +4,10 @@ import { UserData } from "aws-cdk-lib/aws-ec2";
 export class FivetranProxy extends Stack {
     constructor(scope, id, props) {
         super(scope, id, props);
+        if (!Array.isArray(props.allowedIpCidrs) ||
+            props.allowedIpCidrs.length === 0) {
+            throw new Error("FivetranProxy.allowedIpCidrs must list at least one IPv4 CIDR: the ranges Fivetran connects from for your region. The proxy ships no world-open default.");
+        }
         const userData = UserData.forLinux();
         userData.addCommands("groupadd fivetran", "useradd -m -g fivetran fivetran", "mkdir -p /home/fivetran/.ssh", "chown fivetran:fivetran /home/fivetran/.ssh", "chmod 700 /home/fivetran/.ssh", `echo "${props.publicKey}" > /home/fivetran/.ssh/authorized_keys`, "chown fivetran:fivetran /home/fivetran/.ssh/authorized_keys", "chmod 600 /home/fivetran/.ssh/authorized_keys");
         new Ec2Instance(this, "FivetranProxy", {
@@ -11,12 +15,11 @@ export class FivetranProxy extends Stack {
             serviceName: "fivetranProxy",
             vpc: props.vpc,
             instanceType: props.instanceType || "t2.micro",
-            // Not a caller's choice. This proxy exists so Fivetran can reach a
-            // private database over SSH — it provisions the `fivetran` user and its
-            // authorized_keys above — so the instance must be publicly reachable on
-            // port 22. The prop that used to sit here was `props.enableSSH || true`,
-            // which accepted a `false` it could never honour.
-            enableSSH: true,
+            // This proxy exists so Fivetran can reach a private database over SSH
+            // (it provisions the `fivetran` user and its authorized_keys above), so
+            // the instance must be publicly reachable on port 22. `public` is
+            // therefore not the caller's choice; the source range is.
+            sshAccess: { allowedIpCidrs: props.allowedIpCidrs, public: true },
             env: {
                 account: props.env?.account,
                 region: props.env?.region

package/dist/lib/patterns/aws/interfaces/compute.d.ts

@@ -73,6 +73,14 @@ export interface IEcsCompute extends ICompute, IConnectable {
      * that front this compute. Undefined when there is no load balancer.
      */
     getIngressProfile(): EcsIngressProfile | undefined;
+    /**
+     * Grant an operator principal what an `aws ecs execute-command` session
+     * needs against this cluster: `ecs:ExecuteCommand` scoped to the cluster
+     * and its tasks, plus `kms:GenerateDataKey` on the stack key when the
+     * session channel is key-encrypted (backup tier `enterprise`).
+     * @param grantee The operator principal
+     */
+    grantExecuteCommand(grantee: IGrantable): Grant;
 }
 /**
  * Lambda compute interface.

package/dist/lib/resources/aws/cdn/cloudFront.d.ts

@@ -58,7 +58,23 @@ export interface CloudFrontDistributionProps {
     domainNames?: string[];
     certificate?: ICertificate;
     comment?: string;
+    /**
+     * Standard (legacy) S3 access logging. It cannot deliver to a bucket in an
+     * opt-in region (`af-south-1`, `ap-east-1`, …): CloudFormation rejects the
+     * distribution at deploy, so a concrete opt-in delivery region is refused
+     * at synth instead — cure with `enableLogging: false`, or a `logBucket`
+     * whose region CDK knows to be default-enabled (see `logBucket`).
+     */
     enableLogging?: boolean;
+    /**
+     * Delivery bucket for standard logs; without it CDK creates one in the
+     * distribution's own stack (and region). Its `env.region` is the delivery
+     * region the opt-in refusal on `enableLogging` checks, so an imported
+     * bucket must declare it: `Bucket.fromBucketAttributes(…, { region })`, or
+     * a `Bucket` in a stack pinned to its region. `fromBucketName` and
+     * `fromBucketArn` inherit this stack's region, and a token bucket region
+     * falls back to it.
+     */
     logBucket?: IBucket;
     /** Key prefix for standard logs delivered to `logBucket`. */
     logFilePrefix?: string;

package/dist/lib/resources/aws/cdn/cloudFront.js

@@ -1,8 +1,8 @@
 import { Construct } from "constructs";
-import { CfnOutput, Names, Stack } from "aws-cdk-lib";
+import { CfnOutput, Names, Stack, Token } from "aws-cdk-lib";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { registerCdnAliasTarget } from "../../../utils/cdnAliasTargetRegistry.js";
-import { cdnDomainExportName } from "@fjall/util";
+import { cdnDomainExportName, getRegionInfo, OPT_IN_REGION_CODES } from "@fjall/util";
 import { Distribution, PriceClass, ViewerProtocolPolicy, CachePolicy, OriginRequestPolicy, AllowedMethods, OriginProtocolPolicy, Function as CloudFrontFunction, FunctionCode, FunctionRuntime, FunctionEventType, OriginAccessIdentity, S3OriginAccessControl } from "aws-cdk-lib/aws-cloudfront";
 import { S3BucketOrigin, LoadBalancerV2Origin, HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 /**
@@ -42,6 +42,55 @@ const URI_REWRITE_FRAGMENTS = {
         " else { var seg = uri.substring(uri.lastIndexOf('/') + 1);" +
         " if (seg.indexOf('.') === -1) { request.uri = uri + '/index.html'; } } }"
 };
+/**
+ * CloudFront standard (legacy) logging cannot deliver to an S3 bucket in an
+ * opt-in region: CDK's `renderLogging` performs no region check and
+ * CloudFormation rejects the distribution at deploy, after the rest of the
+ * stack has been created. The delivery region is known at synth whenever the
+ * bucket's stack is env-pinned, so the refusal lives here — the seam every
+ * distribution crosses, whether built directly or through the `Cdn`
+ * pattern — and names both cures.
+ *
+ * Logging is on exactly when `renderLogging` emits a Logging block:
+ * `enableLogging: true`, or a `logBucket` without an explicit
+ * `enableLogging: false` (that pair is CDK's own contradiction error and is
+ * left to it). The delivery region is the bucket's `env.region` when it is
+ * concrete, else the distribution stack's — the bucket CDK would create.
+ * A token delivery region (an unpinned stack, and no region on the bucket)
+ * cannot be checked and passes. A concrete region `AWS_REGIONS_METADATA`
+ * does not list is refused too — every region launched since 2019 is opt-in,
+ * so an unlisted one cannot be assumed default-enabled — naming the metadata
+ * as the cure. The guard fires whenever the delivery region is concrete and
+ * known to the metadata.
+ */
+function validateStandardLoggingRegion(scope, id, props) {
+    const loggingOn = props.enableLogging === true ||
+        (props.enableLogging === undefined && props.logBucket !== undefined);
+    if (!loggingOn)
+        return;
+    const bucketRegion = props.logBucket?.env.region;
+    const region = bucketRegion !== undefined && !Token.isUnresolved(bucketRegion)
+        ? bucketRegion
+        : Stack.of(scope).region;
+    if (Token.isUnresolved(region))
+        return;
+    if (getRegionInfo(region) === undefined) {
+        throw new Error(`CloudFront distribution '${id}': region ${region} is not in ` +
+            "@fjall/util's AWS_REGIONS_METADATA, so its opt-in status cannot be " +
+            "checked — update the metadata, or set enableLogging: false on this " +
+            "CDN.");
+    }
+    if (!OPT_IN_REGION_CODES.has(region))
+        return;
+    throw new Error(`CloudFront distribution '${id}': standard (legacy) logging cannot ` +
+        `deliver to an S3 bucket in opt-in region ${region} — logging was ` +
+        "enabled explicitly or by the app backup tier's cloudFrontLogging " +
+        "default. Set enableLogging: false on this CDN, or pass a logBucket " +
+        "whose region CDK knows to be default-enabled: " +
+        "Bucket.fromBucketAttributes(…, { region }), or a bucket in a stack " +
+        "pinned to that region (fromBucketName and fromBucketArn inherit this " +
+        "stack's region).");
+}
 export class CloudFrontDistribution extends Construct {
     id;
     distribution;
@@ -53,6 +102,7 @@ export class CloudFrontDistribution extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.id = id;
+        validateStandardLoggingRegion(this, id, props);
         // Sanitise id for CloudFormation output keys (must be alphanumeric)
         const outputName = toPascalCase(id);
         const defaultOrigin = this.createOrigin(props.defaultOrigin);

package/dist/lib/resources/aws/compute/ec2.d.ts

@@ -1,5 +1,6 @@
 import { type BlockDevice, type IMachineImage, type IVpc, type UserData, type ISecurityGroup, type IConnectable, Connections, type SubnetConfiguration, type SubnetSelection } from "aws-cdk-lib/aws-ec2";
 import { Construct } from "constructs";
+import { type Ec2SshAccessProps } from "./ec2SshAccess.js";
 import { Duration, Stack, type StackProps } from "aws-cdk-lib";
 import { type Role } from "aws-cdk-lib/aws-iam";
 import { AutoScalingGroup, Monitoring, type WarmPoolOptions } from "aws-cdk-lib/aws-autoscaling";
@@ -42,6 +43,7 @@ export type Ec2InstanceUpdatePolicyConfig = {
 } | {
     type: "none";
 };
+export { type Ec2SshAccessProps } from "./ec2SshAccess.js";
 export interface Ec2InstanceProps extends StackProps {
     spotCapacityPercentage?: number;
     blockDevices?: BlockDevice[];
@@ -57,7 +59,13 @@ export interface Ec2InstanceProps extends StackProps {
     machineImage?: IMachineImage;
     userData?: UserData;
     role?: Role;
-    enableSSH?: boolean;
+    /**
+     * SSH access: who may reach port 22, which key pair, and whether the
+     * instances are public. Omit for Session Manager-only access. Rejected
+     * alongside a caller-supplied `securityGroup` — the construct adds ingress
+     * only to a security group it owns.
+     */
+    sshAccess?: Ec2SshAccessProps;
     defaultPort?: number;
     /**
      * Caller-supplied EC2 instance monitoring resolution. Routes through the
@@ -79,8 +87,10 @@ export interface Ec2InstanceProps extends StackProps {
     securityGroup?: ISecurityGroup;
     /**
      * CDK `AutoScalingGroupProps.vpcSubnets`. Overrides the default
-     * `enableSSH ? PUBLIC : resolvePrivateSubnetType(vpc)` inference. Use when
-     * the caller needs a precise subnet selection (e.g. AZ pinning).
+     * `sshAccess.public ? PUBLIC : resolvePrivateSubnetType(vpc)` inference.
+     * Use when the caller needs a precise subnet selection (e.g. AZ pinning).
+     * With `sshAccess.public: true` the selection may pin availability zones
+     * but not choose a non-public subnet type, group or list.
      */
     vpcSubnets?: SubnetSelection;
     /** CDK `AutoScalingGroupProps.capacityRebalance`. Absent → CDK default. */
@@ -92,9 +102,9 @@ export interface Ec2InstanceProps extends StackProps {
      */
     warmPool?: WarmPoolOptions;
     /**
-     * CDK `LaunchTemplateProps.associatePublicIpAddress`. When defined,
-     * overrides the `!!keyPair` auto-derivation; otherwise the existing
-     * keyPair-driven default applies.
+     * CDK `LaunchTemplateProps.associatePublicIpAddress`. Absent → `true` only
+     * when `sshAccess.public` is `true`. An explicit `false` alongside
+     * `sshAccess.public: true` is rejected rather than silently overridden.
      */
     associatePublicIpAddress?: boolean;
     /**
@@ -162,11 +172,28 @@ export declare class Ec2Instance extends Construct implements IConnectable {
     private autoScalingGroup;
     private keyPair;
     private persistentDataVolume?;
+    private readonly vpcSubnets;
+    private readonly associatePublicIpAddress;
     readonly connections: Connections;
     constructor(scope: Construct, id: string, props: Ec2InstanceProps);
     private addVpc;
     private addKeyPair;
+    /**
+     * One ingress rule per source range. A world-open range still lands (the
+     * caller asked for it) but warns; the wording reads the placement the group
+     * actually resolved to, not `sshAccess.public` alone, because a caller who
+     * owns the placement through public `vpcSubnets` and
+     * `associatePublicIpAddress` exposes it just the same.
+     */
+    private addSshIngress;
     private addLaunchTemplate;
+    /**
+     * `sshAccess.public` decides the subnet type; an explicit `vpcSubnets` keeps
+     * its other selectors (AZ pinning) — `validateEc2InstanceProps` has already
+     * rejected a selection that contradicts `public: true`, so filling in
+     * `PUBLIC` here only completes an AZ-only pin.
+     */
+    private resolveVpcSubnets;
     private addAutoScalingGroup;
     /**
      * Apply `props.tags` to the underlying ASG with