@fjall/components-infrastructure 36.0.0 → 37.0.0

package/dist/lib/resources/aws/secrets/kms.d.ts

@@ -10,6 +10,14 @@ export type KeyProtectionScope = (typeof KEY_PROTECTION_SCOPES)[number];
  * forgotten (tier-aware alert policy design §8 K4, `KMS_KEY_ORPHAN`).
  */
 export { KMS_RETENTION_TAG_KEY } from "@fjall/util/aws";
+/**
+ * Stamped beside the retention marker, valued with the alias name as `kms
+ * list-aliases` reports it. The alias resource goes with the stack and
+ * CloudFormation tags nothing on a KMS key, so after a stack delete this tag
+ * is the only thing that still says which stack's key a retained key was —
+ * the deploy-test teardown releases retained stack keys by it.
+ */
+export { KMS_ALIAS_TAG_KEY } from "@fjall/util/aws";
 interface CustomerManagedKeyProps {
     description?: string;
     aliasName?: string;

package/dist/lib/resources/aws/secrets/kms.js

@@ -1,4 +1,4 @@
-import { KMS_RETENTION_TAG_KEY } from "@fjall/util/aws";
+import { KMS_ALIAS_TAG_KEY, KMS_RETENTION_TAG_KEY } from "@fjall/util/aws";
 import { CfnOutput, Duration, RemovalPolicy, Tags } from "aws-cdk-lib";
 import { Alias, Key } from "aws-cdk-lib/aws-kms";
 import { Construct } from "constructs";
@@ -17,6 +17,14 @@ export const KEY_PROTECTION_SCOPES = [
  * forgotten (tier-aware alert policy design §8 K4, `KMS_KEY_ORPHAN`).
  */
 export { KMS_RETENTION_TAG_KEY } from "@fjall/util/aws";
+/**
+ * Stamped beside the retention marker, valued with the alias name as `kms
+ * list-aliases` reports it. The alias resource goes with the stack and
+ * CloudFormation tags nothing on a KMS key, so after a stack delete this tag
+ * is the only thing that still says which stack's key a retained key was —
+ * the deploy-test teardown releases retained stack keys by it.
+ */
+export { KMS_ALIAS_TAG_KEY } from "@fjall/util/aws";
 /**
  * How long a scheduled-for-deletion key stays recoverable.
  *
@@ -52,8 +60,10 @@ export class CustomerManagedKey extends Construct {
                 ? PENDING_DELETION_WINDOW
                 : undefined
         });
+        const aliasName = props.aliasName || ResourceNaming.defaultKeyAlias(id);
         if (removalPolicy === RemovalPolicy.RETAIN) {
             Tags.of(this.key).add(KMS_RETENTION_TAG_KEY, props.protects);
+            Tags.of(this.key).add(KMS_ALIAS_TAG_KEY, ResourceNaming.qualifiedKeyAlias(aliasName));
         }
         new CfnOutput(this, `${outputName}KeyArn`, {
             key: `${outputName}Arn`,
@@ -61,7 +71,7 @@ export class CustomerManagedKey extends Construct {
             exportName: stackScopedExportName(this, `${outputName}KeyArn`)
         });
         this.alias = new Alias(this, `${id}KeyAlias`, {
-            aliasName: props.aliasName || ResourceNaming.defaultKeyAlias(id),
+            aliasName,
             targetKey: this.key
         });
         new CfnOutput(this, `${outputName}KeyAliasArn`, {

package/dist/lib/resources/aws/secrets/stackEncryptionKey.js

@@ -1,8 +1,9 @@
 import { Stack } from "aws-cdk-lib";
 import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { ResourceNaming } from "../../../utils/resourceNaming.js";
 import { CustomerManagedKey } from "./kms.js";
-const STACK_ENCRYPTION_KEY_ID = "FjallStackEncryptionKey";
+const STACK_ENCRYPTION_KEY_ID = ResourceNaming.stackEncryptionKeyConstructId();
 /**
  * AWS services that publish to an application's SNS topics on the app's
  * behalf and therefore encrypt messages through the topic's key: EventBridge
@@ -48,9 +49,10 @@ export class StackEncryptionKey extends CustomerManagedKey {
     constructor(stack) {
         super(stack, STACK_ENCRYPTION_KEY_ID, {
             description: `Encrypts the enterprise-tier resources of ${stack.stackName} (DynamoDB tables, SNS topics, Lambda environment, ECS Exec sessions, log groups)`,
-            // KMS alias names are unique per account-region, so the stack name is
-            // the namespace — every stack in the account carries its own key.
-            aliasName: `cmk/${stack.stackName}/${STACK_ENCRYPTION_KEY_ID}`,
+            // Derived through ResourceNaming so the deploy-test teardown, which
+            // finds the retained key by this alias after the stack is gone, cannot
+            // spell it differently.
+            aliasName: ResourceNaming.stackEncryptionKeyAlias(stack.stackName),
             protects: "outlives-stack"
         });
     }

package/dist/lib/utils/backupTierMapping.d.ts

@@ -1,22 +1,17 @@
-import { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, type BackupTier, type BackupTierDefaults, tierDefault } from "@fjall/util";
-/** Tag key used by AWS Backup plan selection rules */
-export declare const BACKUP_TIER_TAG_KEY = "fjall:disasterRecovery:tier";
+import { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP, type BackupTier, type BackupTierDefaults, tierDefault } from "@fjall/util";
 /**
- * The application backup tier vocabulary and its defaults table are owned by
- * `@fjall/util` (`BACKUP_TIERS`, `BACKUP_TIER_DEFAULTS`, `tierDefault`) and
- * shared with the generator (`BACKUP_VAULT_TIERS`) and the CLI's synth
- * expectations, so every system derives from one declaration. Re-exported
- * here so construct code keeps one import path for tier concerns.
+ * The application backup tier vocabulary, its defaults table, the DR tag key
+ * and the tier → tag-value map are owned by `@fjall/util` (`BACKUP_TIERS`,
+ * `BACKUP_TIER_DEFAULTS`, `tierDefault`, `BACKUP_TIER_TAG_KEY`,
+ * `BACKUP_TIER_TAG_MAP`) and shared with the generator (`BACKUP_VAULT_TIERS`),
+ * the CLI's synth expectations and the webapp's posture rules (which read the
+ * tag back from discovered resources), so every system derives from one
+ * declaration. Re-exported here so construct code keeps one import path for
+ * tier concerns: `App.applyBackupTier()` (app-level tag), `StandardTagsAspect`
+ * (per-resource tag) and `BackupPlan` (selection key) all read the same pair.
  */
 export type { BackupTier, BackupTierDefaults };
-export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, tierDefault };
-/**
- * Shared mapping from application backup tier names to AWS Backup plan tag values.
- *
- * Used by both App.applyBackupTier() (app-level tag) and StandardTagsAspect
- * (per-resource tag) to ensure consistent tier → tag translation.
- */
-export declare const BACKUP_TIER_TAG_MAP: Readonly<Record<BackupTier, string>>;
+export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP, tierDefault };
 /**
  * The tier a resource actually runs under: its own override, else the
  * app-level tier `App.getApp({ backup: { tier } })` declared. The single

package/dist/lib/utils/backupTierMapping.js

@@ -1,18 +1,5 @@
-import { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, tierDefault } from "@fjall/util";
-/** Tag key used by AWS Backup plan selection rules */
-export const BACKUP_TIER_TAG_KEY = "fjall:disasterRecovery:tier";
-export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, tierDefault };
-/**
- * Shared mapping from application backup tier names to AWS Backup plan tag values.
- *
- * Used by both App.applyBackupTier() (app-level tag) and StandardTagsAspect
- * (per-resource tag) to ensure consistent tier → tag translation.
- */
-export const BACKUP_TIER_TAG_MAP = Object.freeze({
-    standard: "default",
-    resilient: "resilient",
-    enterprise: "enterprise"
-});
+import { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP, tierDefault } from "@fjall/util";
+export { BACKUP_TIERS, BACKUP_TIER_DEFAULTS, BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP, tierDefault };
 /**
  * The tier a resource actually runs under: its own override, else the
  * app-level tier `App.getApp({ backup: { tier } })` declared. The single

package/dist/lib/utils/resourceNaming.d.ts

@@ -77,6 +77,28 @@ export declare class ResourceNaming {
      * reports.
      */
     static defaultKeyAlias(constructId: string): string;
+    /**
+     * Construct id of the one `StackEncryptionKey` an enterprise-tier stack
+     * mints (lib/resources/aws/secrets/stackEncryptionKey.ts). It is also the
+     * alias suffix, so the two are spelled once.
+     */
+    static stackEncryptionKeyConstructId(): string;
+    /**
+     * Alias the stack encryption key is created under. KMS alias names are
+     * unique per account-region, so the stack name is the namespace. Unprefixed
+     * like the other alias helpers; the deploy tests that find the retained key
+     * after its stack is gone derive the reported form through
+     * [[qualifiedKeyAlias]], the same way the construct's alias tag does.
+     */
+    static stackEncryptionKeyAlias(stackName: string): string;
+    /**
+     * An alias name as KMS reports it. The CDK `Alias` prepends `alias/` to a
+     * resolved name that lacks it, and to a token only when the token's
+     * leading literal fragment lacks it — every Fjall alias starts with the
+     * literal `cmk/`, so the two rules agree. An already-qualified name is
+     * returned as it is.
+     */
+    static qualifiedKeyAlias(aliasName: string): string;
     /**
      * S3 bucket holding a VPC's flow logs. `id` is the Network construct id —
      * the network name for an additional VPC, `${stackPrefix}Vpc` for the

package/dist/lib/utils/resourceNaming.js

@@ -1,6 +1,8 @@
 import { toKebab } from "./capitaliseString.js";
 /** ELBv2's hard limit on an Application Load Balancer's name. */
 const LOAD_BALANCER_NAME_MAX_LENGTH = 32;
+/** What `kms list-aliases` prepends to every alias name. */
+const KMS_ALIAS_PREFIX = "alias/";
 /**
  * Centralised resource naming for infrastructure.
  * Ensures consistent, predictable names across constructs and tests.
@@ -127,6 +129,36 @@ export class ResourceNaming {
     static defaultKeyAlias(constructId) {
         return `cmk/${constructId}`;
     }
+    /**
+     * Construct id of the one `StackEncryptionKey` an enterprise-tier stack
+     * mints (lib/resources/aws/secrets/stackEncryptionKey.ts). It is also the
+     * alias suffix, so the two are spelled once.
+     */
+    static stackEncryptionKeyConstructId() {
+        return "FjallStackEncryptionKey";
+    }
+    /**
+     * Alias the stack encryption key is created under. KMS alias names are
+     * unique per account-region, so the stack name is the namespace. Unprefixed
+     * like the other alias helpers; the deploy tests that find the retained key
+     * after its stack is gone derive the reported form through
+     * [[qualifiedKeyAlias]], the same way the construct's alias tag does.
+     */
+    static stackEncryptionKeyAlias(stackName) {
+        return `cmk/${stackName}/${ResourceNaming.stackEncryptionKeyConstructId()}`;
+    }
+    /**
+     * An alias name as KMS reports it. The CDK `Alias` prepends `alias/` to a
+     * resolved name that lacks it, and to a token only when the token's
+     * leading literal fragment lacks it — every Fjall alias starts with the
+     * literal `cmk/`, so the two rules agree. An already-qualified name is
+     * returned as it is.
+     */
+    static qualifiedKeyAlias(aliasName) {
+        return aliasName.startsWith(KMS_ALIAS_PREFIX)
+            ? aliasName
+            : `${KMS_ALIAS_PREFIX}${aliasName}`;
+    }
     /**
      * S3 bucket holding a VPC's flow logs. `id` is the Network construct id —
      * the network name for an additional VPC, `${stackPrefix}Vpc` for the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "36.0.0",
+  "version": "37.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -80,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^36.0.0",
-    "@fjall/util": "^36.0.0",
+    "@fjall/generator": "^37.0.0",
+    "@fjall/util": "^37.0.0",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },