@fjall/components-infrastructure 36.0.0 → 38.0.0

package/dist/lib/resources/aws/cdn/cloudFrontLogDelivery.js

@@ -0,0 +1,213 @@
+import { createHash } from "node:crypto";
+import { Annotations, Stack, Token } from "aws-cdk-lib";
+import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { CfnDelivery, CfnDeliveryDestination, CfnDeliverySource } from "aws-cdk-lib/aws-logs";
+import { Construct } from "constructs";
+/**
+ * Output formats CloudWatch Logs writes a CloudFront access-log delivery in.
+ * `json` is the default; `parquet` adds CloudWatch's conversion charge on top
+ * of delivery. Fixed at creation — a change replaces the destination.
+ */
+export const CLOUDFRONT_LOG_FORMATS = [
+    "json",
+    "parquet",
+    "plain",
+    "w3c",
+    "raw"
+];
+export const DEFAULT_CLOUDFRONT_LOG_FORMAT = "json";
+/**
+ * CloudWatch Logs mints every CloudFront delivery source, destination and
+ * delivery in us-east-1 whatever region the bucket is in — the delivery ARNs
+ * read `arn:aws:logs:us-east-1:…` and the API refuses other regions.
+ */
+export const CLOUDFRONT_LOG_DELIVERY_REGION = "us-east-1";
+/** The service principal that writes vended logs into the bucket. */
+export const CLOUDFRONT_LOG_DELIVERY_PRINCIPAL = "delivery.logs.amazonaws.com";
+/** Objects land at `<prefix>/<yyyy>/<MM>/<dd>/<HH>/…`. Changeable in place. */
+export const CLOUDFRONT_LOG_S3_SUFFIX_PATH = "{yyyy}/{MM}/{dd}/{HH}";
+/**
+ * Every delivery source and destination is named under this prefix —
+ * `fjall-cf-<distributionId>` for the source, `fjall-cf-<distributionId>-<digest>`
+ * for the destination. The deploy-test residue scan attributes delivery
+ * resources by the prefix and the digest width and restates both; a change
+ * here is a change to what the scan can see.
+ */
+export const CLOUDFRONT_LOG_DELIVERY_NAME_PREFIX = "fjall-cf-";
+/** Hex characters of the sha256 the destination name carries. */
+export const CLOUDFRONT_LOG_DELIVERY_DIGEST_LENGTH = 8;
+/**
+ * The prefix is part of the destination ARN (`arn:aws:s3:::<bucket>/<prefix>`),
+ * a create-only property, and it keys the destination's name, so it must be
+ * a literal at synth. Leading and trailing slashes are dropped (CloudWatch
+ * joins the suffix path with its own separator); an empty prefix is refused
+ * rather than silently selecting the bucket-root `AWSLogs/…` layout.
+ */
+export function normaliseCloudFrontLogPrefix(context, prefix) {
+    if (Token.isUnresolved(prefix)) {
+        throw new Error(`${context}: the log prefix must be a literal string at synth — it ` +
+            "keys the delivery destination's name — but a token was given.");
+    }
+    const normalised = prefix.replace(/^\/+/, "").replace(/\/+$/, "");
+    if (normalised === "") {
+        throw new Error(`${context}: the log prefix is empty after dropping slashes. Give a ` +
+            "key prefix such as 'cloudfront/<id>', or omit it for the default.");
+    }
+    return normalised;
+}
+function assertDeliveryRegion(context, stack) {
+    const region = stack.region;
+    if (Token.isUnresolved(region)) {
+        throw new Error(`${context}: the delivery stack's region is unresolved at synth (a ` +
+            `region token). CloudWatch Logs accepts these resources in ` +
+            `${CLOUDFRONT_LOG_DELIVERY_REGION} only, so the stack must be ` +
+            "env-pinned — deploy through the Fjall CLI, or export " +
+            "CDK_DEFAULT_ACCOUNT and CDK_DEFAULT_REGION before synthesising.");
+    }
+    if (region !== CLOUDFRONT_LOG_DELIVERY_REGION) {
+        throw new Error(`${context}: CloudWatch Logs accepts CloudFront delivery resources in ` +
+            `${CLOUDFRONT_LOG_DELIVERY_REGION} only, but the scope's stack ` +
+            `'${stack.stackName}' is in ${region}. Create the delivery in the ` +
+            "app's us-east-1 logging stack (App.getUsEast1CdnLoggingStack()) — " +
+            "the Cdn pattern places it there itself.");
+    }
+}
+/**
+ * Everything create-only on the destination — the bucket, the prefix and
+ * the format — folds into its name, so a change replaces the destination
+ * under a NEW name: CloudFormation creates the replacement before deleting
+ * the original, and an identical name would collide. An imported bucket
+ * contributes its literal name; a bucket built here contributes its
+ * construct path (its physical name is a token), which is stable under an
+ * unchanged logical id — the one residual is a same-id bucket replacement,
+ * which keeps the name. Nothing tokenised is hashed: token spellings vary
+ * between synths.
+ */
+function destinationDigest(bucket, prefix, format) {
+    const bucketKey = Token.isUnresolved(bucket.bucketName)
+        ? bucket.node.path
+        : bucket.bucketName;
+    return createHash("sha256")
+        .update(`${bucketKey}|${prefix}|${format}`)
+        .digest("hex")
+        .slice(0, CLOUDFRONT_LOG_DELIVERY_DIGEST_LENGTH);
+}
+/**
+ * CloudFront standard logging (v2): the CloudWatch Logs delivery source
+ * (the distribution), delivery destination (the bucket and prefix) and the
+ * delivery joining them, plus the bucket-policy statement the delivery
+ * principal writes through. The names — `fjall-cf-<distributionId>` and
+ * `fjall-cf-<distributionId>-<digest>` — carry no construct path, but
+ * CloudFormation replaces on the LOGICAL id and creates the replacement
+ * before deleting the original, and CloudWatch refuses a second source for
+ * the same distribution. So the three logical ids are load-bearing once a
+ * delivery is live: a re-layout of this construct or its owner strands the
+ * update in rollback, and is a breaking change with a migration (delete
+ * the live delivery first) rather than a refactor. The delivery test pins
+ * the ids in both layouts.
+ *
+ * The scope MUST be a us-east-1 stack (asserted at synth). When the
+ * distribution and bucket live in another region's stack, their ARNs reach
+ * this stack through CDK cross-region references; both are stable under an
+ * unchanged logical id, which the export writer requires.
+ */
+export class CloudFrontLogDelivery extends Construct {
+    sourceName;
+    destinationName;
+    source;
+    destination;
+    delivery;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const context = `CloudFront log delivery '${id}'`;
+        const stack = Stack.of(this);
+        assertDeliveryRegion(context, stack);
+        const { distribution, bucket, format } = props;
+        const prefix = normaliseCloudFrontLogPrefix(context, props.prefix);
+        this.sourceName = `${CLOUDFRONT_LOG_DELIVERY_NAME_PREFIX}${distribution.distributionId}`;
+        this.destinationName = `${this.sourceName}-${destinationDigest(bucket, prefix, format)}`;
+        this.source = new CfnDeliverySource(this, "Source", {
+            name: this.sourceName,
+            resourceArn: distribution.distributionArn,
+            logType: "ACCESS_LOGS"
+        });
+        this.destination = new CfnDeliveryDestination(this, "Destination", {
+            name: this.destinationName,
+            deliveryDestinationType: "S3",
+            destinationResourceArn: `${bucket.bucketArn}/${prefix}`,
+            outputFormat: format
+        });
+        this.delivery = new CfnDelivery(this, "Delivery", {
+            deliverySourceName: this.sourceName,
+            deliveryDestinationArn: this.destination.attrArn,
+            s3SuffixPath: CLOUDFRONT_LOG_S3_SUFFIX_PATH,
+            s3EnableHiveCompatiblePath: false
+        });
+        // `deliverySourceName` is a plain string: CloudFormation sees no edge to
+        // the source and would happily create the delivery first.
+        this.delivery.addDependency(this.source);
+        this.grantDeliveryWrite(context, bucket, prefix, stack);
+    }
+    /**
+     * The bucket-policy statement the delivery principal writes through, and
+     * the key-policy statement when the bucket is KMS-encrypted. Both carry the
+     * confused-deputy conditions; the bucket statement additionally requires
+     * `bucket-owner-full-control`, the one ACL a BucketOwnerEnforced bucket
+     * accepts. Imported buckets and keys are not managed here — a synth
+     * warning names the statement the owner must add, because a missing grant
+     * fails delivery silently rather than at deploy.
+     */
+    grantDeliveryWrite(context, bucket, prefix, deliveryStack) {
+        const bucketStack = Stack.of(bucket);
+        const principal = new ServicePrincipal(CLOUDFRONT_LOG_DELIVERY_PRINCIPAL);
+        const sourceArnPattern = `arn:${bucketStack.partition}:logs:${CLOUDFRONT_LOG_DELIVERY_REGION}:` +
+            `${bucketStack.account}:delivery-source:*`;
+        // The partition is a token in every stack; the account may be too.
+        const sourceArnForHumans = `arn:<partition>:logs:${CLOUDFRONT_LOG_DELIVERY_REGION}:` +
+            "<account-id>:delivery-source:*";
+        const deputyConditions = {
+            StringEquals: { "aws:SourceAccount": bucketStack.account },
+            ArnLike: { "aws:SourceArn": sourceArnPattern }
+        };
+        const bucketGrant = bucket.addToResourcePolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            principals: [principal],
+            actions: ["s3:PutObject"],
+            resources: [bucket.arnForObjects(`${prefix}/*`)],
+            conditions: {
+                StringEquals: {
+                    "s3:x-amz-acl": "bucket-owner-full-control",
+                    ...deputyConditions.StringEquals
+                },
+                ArnLike: deputyConditions.ArnLike
+            }
+        }));
+        if (!bucketGrant.statementAdded) {
+            Annotations.of(this).addWarningV2("fjall:cloudfront:log-delivery-bucket-policy", `${context}: bucket '${bucket.node.path}' is imported, so its policy ` +
+                "is not managed here. Allow s3:PutObject on " +
+                `'${prefix}/*' to ${CLOUDFRONT_LOG_DELIVERY_PRINCIPAL} with ` +
+                "s3:x-amz-acl=bucket-owner-full-control, aws:SourceAccount and " +
+                `aws:SourceArn=${sourceArnForHumans} conditions yourself — ` +
+                "without it delivery fails silently.");
+        }
+        else if (bucket.policy !== undefined && bucketStack === deliveryStack) {
+            this.delivery.node.addDependency(bucket.policy);
+        }
+        if (bucket.encryptionKey === undefined)
+            return;
+        const keyGrant = bucket.encryptionKey.addToResourcePolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            principals: [principal],
+            actions: ["kms:GenerateDataKey*", "kms:Decrypt"],
+            resources: ["*"],
+            conditions: deputyConditions
+        }), true);
+        if (!keyGrant.statementAdded) {
+            Annotations.of(this).addWarningV2("fjall:cloudfront:log-delivery-key-policy", `${context}: the bucket's KMS key '${bucket.encryptionKey.node.path}' ` +
+                "is imported, so its key policy is not managed here. Allow " +
+                `kms:GenerateDataKey* and kms:Decrypt to ${CLOUDFRONT_LOG_DELIVERY_PRINCIPAL} ` +
+                `with aws:SourceAccount and aws:SourceArn=${sourceArnForHumans} ` +
+                "conditions yourself — without it delivery fails silently.");
+        }
+    }
+}

package/dist/lib/resources/aws/cdn/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./cloudFront.js";
+export * from "./cloudFrontLogDelivery.js";
 export * from "./responseHeadersPolicy.js";

package/dist/lib/resources/aws/cdn/index.js

@@ -1,2 +1,3 @@
 export * from "./cloudFront.js";
+export * from "./cloudFrontLogDelivery.js";
 export * from "./responseHeadersPolicy.js";

package/dist/lib/resources/aws/logging/accessLogBucket.d.ts

@@ -9,16 +9,23 @@ export declare const ACCESS_LOG_RETENTION_DAYS = 90;
 /**
  * The one bucket an enterprise-tier stack delivers its access logs to —
  * application load balancer access logs (`alb/<name>/`) and CloudFront
- * standard logs (`cloudfront/<id>/`) share it under distinct prefixes.
+ * standard logs v2 (`cloudfront/<id>/`) share it under distinct prefixes.
  *
  * Its shape is dictated by the two delivery services and deliberately NOT
  * tier-aware: ELB log delivery requires SSE-S3 (it cannot write to a
- * KMS-encrypted bucket), CloudFront standard logging requires ACLs enabled
- * (`OBJECT_WRITER` ownership, the CDK's own logging-bucket shape), and
- * versioning would only multiply expired log objects — the `access-logs`
- * exemption marker tells posture so, landing `S3_VERSIONING_DISABLED`
- * `mitigated` rather than `open`. The bucket takes the env-aware removal
- * policy like every other bucket: production RETAINs its audit evidence,
- * non-production DESTROYs.
+ * KMS-encrypted bucket); both deliveries are bucket-policy grants, so
+ * ownership is `BUCKET_OWNER_ENFORCED` (ACLs off — the S3 default, and the
+ * posture every other Fjall bucket carries); and versioning would only
+ * multiply expired log objects — the `access-logs` exemption marker tells
+ * posture so, landing `S3_VERSIONING_DISABLED` `mitigated` rather than
+ * `open`. The bucket takes the env-aware removal policy like every other
+ * bucket: production RETAINs its audit evidence, non-production DESTROYs.
+ *
+ * Migration from 33.0.0–36.x: CloudFront standard (legacy) logging granted
+ * its `awslogsdelivery` canonical user FULL_CONTROL on the bucket ACL and
+ * never removes it, so on a bucket legacy logging wrote to the ownership
+ * flip fails with `InvalidBucketAclWithObjectOwnership`. Cure once, then
+ * redeploy: `aws s3api put-bucket-acl --bucket <name> --acl private`. The
+ * objects already delivered stay readable under the old prefix.
  */
 export declare function stackAccessLogBucket(scope: Construct): S3Bucket;

package/dist/lib/resources/aws/logging/accessLogBucket.js

@@ -11,17 +11,24 @@ export const ACCESS_LOG_RETENTION_DAYS = 90;
 /**
  * The one bucket an enterprise-tier stack delivers its access logs to —
  * application load balancer access logs (`alb/<name>/`) and CloudFront
- * standard logs (`cloudfront/<id>/`) share it under distinct prefixes.
+ * standard logs v2 (`cloudfront/<id>/`) share it under distinct prefixes.
  *
  * Its shape is dictated by the two delivery services and deliberately NOT
  * tier-aware: ELB log delivery requires SSE-S3 (it cannot write to a
- * KMS-encrypted bucket), CloudFront standard logging requires ACLs enabled
- * (`OBJECT_WRITER` ownership, the CDK's own logging-bucket shape), and
- * versioning would only multiply expired log objects — the `access-logs`
- * exemption marker tells posture so, landing `S3_VERSIONING_DISABLED`
- * `mitigated` rather than `open`. The bucket takes the env-aware removal
- * policy like every other bucket: production RETAINs its audit evidence,
- * non-production DESTROYs.
+ * KMS-encrypted bucket); both deliveries are bucket-policy grants, so
+ * ownership is `BUCKET_OWNER_ENFORCED` (ACLs off — the S3 default, and the
+ * posture every other Fjall bucket carries); and versioning would only
+ * multiply expired log objects — the `access-logs` exemption marker tells
+ * posture so, landing `S3_VERSIONING_DISABLED` `mitigated` rather than
+ * `open`. The bucket takes the env-aware removal policy like every other
+ * bucket: production RETAINs its audit evidence, non-production DESTROYs.
+ *
+ * Migration from 33.0.0–36.x: CloudFront standard (legacy) logging granted
+ * its `awslogsdelivery` canonical user FULL_CONTROL on the bucket ACL and
+ * never removes it, so on a bucket legacy logging wrote to the ownership
+ * flip fails with `InvalidBucketAclWithObjectOwnership`. Cure once, then
+ * redeploy: `aws s3api put-bucket-acl --bucket <name> --acl private`. The
+ * objects already delivered stay readable under the old prefix.
  */
 export function stackAccessLogBucket(scope) {
     const stack = Stack.of(scope);
@@ -30,7 +37,7 @@ export function stackAccessLogBucket(scope) {
         return existing;
     return new S3Bucket(stack, STACK_ACCESS_LOG_BUCKET_ID, {
         encryption: BucketEncryption.S3_MANAGED,
-        objectOwnership: ObjectOwnership.OBJECT_WRITER,
+        objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
         versioned: false,
         versioningExemption: "access-logs",
         lifecycleRules: [

package/dist/lib/resources/aws/messaging/eventBridgeQueueGrants.d.ts

@@ -0,0 +1,14 @@
+import { type IRuleRef } from "aws-cdk-lib/aws-events";
+import type { IQueue } from "aws-cdk-lib/aws-sqs";
+/**
+ * Let `rule` deliver to `queue`. Not for a queue encrypted with a customer
+ * managed key: naming the rule there closes a dependency cycle through the
+ * key policy, which is why CDK's target grants those by account instead.
+ */
+export declare function grantRuleTargetDelivery(queue: IQueue, rule: IRuleRef): void;
+/**
+ * Let `rule` dead-letter into `queue`, on the terms of CDK's
+ * `addToDeadLetterQueueResourcePolicy`: a queue in another region is refused,
+ * and a queue in another account is left to its owner with the same warning.
+ */
+export declare function grantRuleDeadLetterDelivery(queue: IQueue, rule: IRuleRef): void;

package/dist/lib/resources/aws/messaging/eventBridgeQueueGrants.js

@@ -0,0 +1,90 @@
+import { Construct } from "constructs";
+import { Annotations, Lazy, Names, Token, TokenComparison } from "aws-cdk-lib";
+import { CfnRule } from "aws-cdk-lib/aws-events";
+import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+const EVENTBRIDGE_SERVICE_PRINCIPAL = "events.amazonaws.com";
+/** The actions `IQueue.grantSendMessages` grants — what CDK's SQS rule target allows. */
+const RULE_TARGET_ACTIONS = [
+    "sqs:SendMessage",
+    "sqs:GetQueueAttributes",
+    "sqs:GetQueueUrl"
+];
+const RULE_DEAD_LETTER_ACTIONS = ["sqs:SendMessage"];
+/**
+ * One queue-policy statement letting EventBridge deliver from every rule
+ * registered against the queue, each named in the statement's
+ * `aws:SourceArn` condition.
+ *
+ * A rule cannot reach SQS through an IAM role: the queue's resource policy is
+ * the only grant. CDK's `SqsQueue` target and `addToDeadLetterQueueResourcePolicy`
+ * add one statement per rule, and SQS refuses a queue policy past 8,192
+ * bytes, so a queue shared by about eighteen rules stops deploying. Listing
+ * the rules in one statement costs one ARN per rule instead of a statement.
+ *
+ * The statement's `Sid` is the grant's construct id. `@aws-cdk/aws-iam:minimizePolicies`
+ * merges statements without a `Sid` whose conditions serialise alike, and every
+ * lazy value serialises alike, so a queue's delivery and dead-letter grants
+ * would merge and one grant's rules would lose access.
+ */
+class RuleSourceArnGrant extends Construct {
+    #ruleArns = [];
+    static of(queue, id, actions) {
+        const existing = queue.node.tryFindChild(id);
+        if (existing instanceof RuleSourceArnGrant)
+            return existing;
+        return new RuleSourceArnGrant(queue, id, actions);
+    }
+    constructor(queue, id, actions) {
+        super(queue, id);
+        queue.addToResourcePolicy(new PolicyStatement({
+            sid: id,
+            principals: [new ServicePrincipal(EVENTBRIDGE_SERVICE_PRINCIPAL)],
+            actions: [...actions],
+            resources: [queue.queueArn],
+            conditions: {
+                ArnEquals: {
+                    "aws:SourceArn": Lazy.any({
+                        produce: () => this.#ruleArns.length === 1
+                            ? this.#ruleArns[0]
+                            : [...this.#ruleArns]
+                    })
+                }
+            }
+        }));
+    }
+    addRule(rule) {
+        const ruleArn = CfnRule.arnForRule(rule);
+        if (!this.#ruleArns.includes(ruleArn))
+            this.#ruleArns.push(ruleArn);
+    }
+}
+/**
+ * Let `rule` deliver to `queue`. Not for a queue encrypted with a customer
+ * managed key: naming the rule there closes a dependency cycle through the
+ * key policy, which is why CDK's target grants those by account instead.
+ */
+export function grantRuleTargetDelivery(queue, rule) {
+    RuleSourceArnGrant.of(queue, "EventBridgeRuleTargetGrant", RULE_TARGET_ACTIONS).addRule(rule);
+}
+/**
+ * Let `rule` dead-letter into `queue`, on the terms of CDK's
+ * `addToDeadLetterQueueResourcePolicy`: a queue in another region is refused,
+ * and a queue in another account is left to its owner with the same warning.
+ */
+export function grantRuleDeadLetterDelivery(queue, rule) {
+    if (!sameEnvDimension(rule.env.region, queue.env.region)) {
+        throw new Error(`Cannot assign Dead Letter Queue in region ${queue.env.region} to the rule ${Names.nodeUniqueId(rule.node)} in region ${rule.env.region}. Both the queue and the rule must be in the same region.`);
+    }
+    if (!sameEnvDimension(rule.env.account, queue.env.account)) {
+        Annotations.of(rule).addWarningV2("@aws-cdk/aws-events-targets:manuallyAddDLQResourcePolicy", `Cannot add a resource policy to your dead letter queue associated with rule ${CfnRule.arnForRule(rule)} because the queue is in a different account. You must add the resource policy manually to the dead letter queue in account ${queue.env.account}.`);
+        return;
+    }
+    RuleSourceArnGrant.of(queue, "EventBridgeRuleDeadLetterGrant", RULE_DEAD_LETTER_ACTIONS).addRule(rule);
+}
+function sameEnvDimension(left, right) {
+    return [
+        TokenComparison.SAME,
+        TokenComparison.ONE_UNRESOLVED,
+        TokenComparison.BOTH_UNRESOLVED
+    ].includes(Token.compareStrings(left, right));
+}

package/dist/lib/resources/aws/messaging/eventTargets.d.ts

@@ -61,9 +61,10 @@ export interface ResolveTargetOptions {
     /**
      * Optional JSON payload for the target adapter (D5 — typed as
      * `Record<string, unknown>` at the EventBridge boundary). Translates to
-     * `message` (SQS), `event` (Lambda / EventBus / CodeBuild), or `input`
-     * (ECS task) on the underlying adapter via `RuleTargetInput.fromObject(...)`.
-     * Values may be `EventField.*` tokens for payload-template substitution.
+     * `message` (SQS) or `event` (Lambda / CodeBuild) on the underlying adapter
+     * via `RuleTargetInput.fromObject(...)`. ECS, event-bus and log-group targets
+     * refuse it. Values may be `EventField.*` tokens for payload-template
+     * substitution.
      * For schedule-kind rules, `scheduledAt: EventField.time` is auto-injected
      * unless the caller already provided a `scheduledAt` key.
      */

package/dist/lib/resources/aws/messaging/eventTargets.js

@@ -1,8 +1,9 @@
 import { EventField, RuleTargetInput } from "aws-cdk-lib/aws-events";
 import { ArnFormat, Stack } from "aws-cdk-lib";
 import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
-import { SqsQueue as SqsTarget, LambdaFunction as LambdaTarget, EventBus as EventBusTarget, CodeBuildProject as CodeBuildTarget, EcsTask as EcsTaskTarget, addToDeadLetterQueueResourcePolicy, bindBaseTargetConfig } from "aws-cdk-lib/aws-events-targets";
+import { SqsQueue as SqsTarget, LambdaFunction as LambdaTarget, EventBus as EventBusTarget, CodeBuildProject as CodeBuildTarget, EcsTask as EcsTaskTarget, bindBaseTargetConfig } from "aws-cdk-lib/aws-events-targets";
 import { SQSQueue } from "./sqs.js";
+import { grantRuleDeadLetterDelivery, grantRuleTargetDelivery } from "./eventBridgeQueueGrants.js";
 import { EventBridgeBus } from "./eventbridge.js";
 import { LogGroup } from "../logging/logGroup.js";
 import { CodeBuildProject } from "../utilities/codeBuild.js";
@@ -49,10 +50,30 @@ function buildTargetInput(payload, kind) {
  * entry per D3.
  */
 export function resolveTarget(target, options) {
+    const adapter = resolveAdapter(target, options);
+    return options.deadLetterQueue === undefined
+        ? adapter
+        : withDeadLetterQueue(adapter, options.deadLetterQueue);
+}
+/**
+ * The DLQ is bound here, never on the adapter: CDK's adapters each add one
+ * `AllowEventRule<id>` statement per rule to the DLQ's policy, so a DLQ shared
+ * by many rules outgrows the SQS policy quota exactly as a shared target
+ * queue did.
+ */
+function withDeadLetterQueue(adapter, deadLetterQueue) {
+    return {
+        bind: (rule, id) => {
+            const config = adapter.bind(rule, id);
+            grantRuleDeadLetterDelivery(deadLetterQueue, rule);
+            return { ...config, deadLetterConfig: { arn: deadLetterQueue.queueArn } };
+        }
+    };
+}
+function resolveAdapter(target, options) {
     const baseProps = {
         retryAttempts: options.retryPolicy?.retryAttempts,
-        maxEventAge: options.retryPolicy?.maxEventAge,
-        deadLetterQueue: options.deadLetterQueue
+        maxEventAge: options.retryPolicy?.maxEventAge
     };
     const targetInput = options.payload !== undefined
         ? buildTargetInput(options.payload, options.kind)
@@ -61,7 +82,7 @@ export function resolveTarget(target, options) {
         return resolveQueueTarget(target, options.messageGroupId, baseProps, targetInput);
     }
     if (target instanceof EventBridgeBus) {
-        return resolveEventBusTarget(target, options.messageGroupId, baseProps, targetInput);
+        return resolveEventBusTarget(target, options.messageGroupId, targetInput);
     }
     if (target instanceof CodeBuildProject) {
         return resolveCodeBuildTarget(target, options.messageGroupId, baseProps, targetInput);
@@ -86,11 +107,28 @@ function resolveQueueTarget(target, messageGroupId, baseProps, targetInput) {
     if (!isFifo && messageGroupId !== undefined) {
         throw new Error("messageGroupId only applies to FIFO queue targets");
     }
-    return new SqsTarget(queue, {
-        ...baseProps,
-        messageGroupId,
-        ...(targetInput !== undefined && { message: targetInput })
-    });
+    // CDK's adapter grants a customer-managed-key queue by account, one
+    // statement however many rules share it; naming each rule there would close
+    // a dependency cycle through the key policy.
+    if (queue.encryptionMasterKey !== undefined) {
+        return new SqsTarget(queue, {
+            ...baseProps,
+            messageGroupId,
+            ...(targetInput !== undefined && { message: targetInput })
+        });
+    }
+    return {
+        bind: (rule) => {
+            grantRuleTargetDelivery(queue, rule);
+            return {
+                ...bindBaseTargetConfig(baseProps),
+                arn: queue.queueArn,
+                input: targetInput,
+                targetResource: queue,
+                sqsParameters: messageGroupId !== undefined ? { messageGroupId } : undefined
+            };
+        }
+    };
 }
 function resolveLambdaTarget(target, messageGroupId, baseProps, targetInput) {
     rejectMessageGroupIdOnNonQueue("lambda", messageGroupId);
@@ -127,12 +165,19 @@ function resolveEcsTarget(target, messageGroupId, baseProps, targetInput) {
         taskCount: target.taskCount
     });
 }
-function resolveEventBusTarget(target, messageGroupId, baseProps, targetInput) {
+/**
+ * `payload` is rejected: CDK's `EventBus` adapter carries no input, so the rule
+ * forwards the matched event to the bus unchanged and a payload would be
+ * dropped without a word.
+ */
+function resolveEventBusTarget(target, messageGroupId, targetInput) {
     rejectMessageGroupIdOnNonQueue("eventBus", messageGroupId);
-    return new EventBusTarget(target.getEventBus(), {
-        ...baseProps,
-        ...(targetInput !== undefined && { event: targetInput })
-    });
+    if (targetInput !== undefined) {
+        throw new Error("payload is not supported on event-bus targets — the rule forwards the " +
+            "matched event to the bus unchanged, so a payload would be dropped. " +
+            "Target the consumer directly to send it a payload.");
+    }
+    return new EventBusTarget(target.getEventBus());
 }
 function resolveCodeBuildTarget(target, messageGroupId, baseProps, targetInput) {
     rejectMessageGroupIdOnNonQueue("codeBuild", messageGroupId);
@@ -169,23 +214,18 @@ function resolveLogGroupTarget(target, messageGroupId, baseProps, targetInput) {
         principals: [new ServicePrincipal("events.amazonaws.com")]
     }));
     return {
-        bind: (rule) => {
-            if (baseProps.deadLetterQueue !== undefined) {
-                addToDeadLetterQueueResourcePolicy(rule, baseProps.deadLetterQueue);
-            }
-            return {
-                ...bindBaseTargetConfig(baseProps),
-                // EventBridge expects the log-group ARN WITHOUT the `:*` suffix that
-                // `logGroupArn` carries.
-                arn: Stack.of(target).formatArn({
-                    service: "logs",
-                    resource: "log-group",
-                    arnFormat: ArnFormat.COLON_RESOURCE_NAME,
-                    resourceName: target.logGroupName
-                }),
-                targetResource: target
-            };
-        }
+        bind: () => ({
+            ...bindBaseTargetConfig(baseProps),
+            // EventBridge expects the log-group ARN WITHOUT the `:*` suffix that
+            // `logGroupArn` carries.
+            arn: Stack.of(target).formatArn({
+                service: "logs",
+                resource: "log-group",
+                arnFormat: ArnFormat.COLON_RESOURCE_NAME,
+                resourceName: target.logGroupName
+            }),
+            targetResource: target
+        })
     };
 }
 function rejectMessageGroupIdOnNonQueue(kind, messageGroupId) {

package/dist/lib/resources/aws/messaging/queuePolicyQuota.d.ts

@@ -0,0 +1,25 @@
+import { type IQueue } from "aws-cdk-lib/aws-sqs";
+/**
+ * SQS's queue-policy quotas.
+ * @see https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-policies.html
+ */
+export declare const QUEUE_POLICY_LIMITS: {
+    readonly MAX_BYTES: 8192;
+    readonly MAX_STATEMENTS: 20;
+};
+/**
+ * Refuse, at synthesis, a queue policy SQS would refuse at deploy.
+ *
+ * Every grant to a queue — an EventBridge rule, an SNS subscription, an S3
+ * notification — lands in the queue's one policy, and SQS rejects the whole
+ * policy past its byte or statement quota. CloudFormation only finds out
+ * mid-deploy and rolls the stack back, so the check runs where the growth is
+ * authored.
+ *
+ * The byte count is an upper bound: an ARN CloudFormation has not minted yet
+ * is sized at the longest its partition, region, account and name can be, so
+ * the refusal can arrive a few grants before SQS's would. A reference whose
+ * shape is not known here takes CDK's ARN estimate, tunable through the
+ * `@aws-cdk/aws-iam.arnSizeEstimate` context key.
+ */
+export declare function validateQueuePolicyQuota(queue: IQueue): string[];