@fjall/components-infrastructure 37.0.0 → 39.0.0

package/dist/lib/app.d.ts

@@ -54,10 +54,15 @@ export interface IAppOptions {
     };
     /**
      * Backup configuration for automatic AWS Backup enrolment.
-     * - Object with tier: Tags all resources with `fjall:disasterRecovery:tier`
-     *   and sets the app backup tier that resource defaults derive from — S3
-     *   buckets version by default at `resilient`/`enterprise`; a per-bucket
-     *   `backupVaultTier` overrides the tier for that bucket.
+     * - Object with tier: stamps `fjall:disasterRecovery:tier` on the resource
+     *   types AWS Backup can protect — DynamoDB tables, RDS clusters and
+     *   instances, the EBS volumes Fjall keeps state on, and versioned S3
+     *   buckets — and sets the app backup tier that resource defaults derive
+     *   from. The backup selection built from that tag carries no resource-type
+     *   filter, so the tag IS the selection: it is applied by the constructs
+     *   that own those resources, not across the app. S3 buckets version by
+     *   default at `resilient`/`enterprise`; a per-bucket `backupVaultTier`
+     *   overrides the tier for that bucket.
      * - false: Explicitly disabled (no backup tag, no tier-derived defaults)
      */
     backup?: {
@@ -148,14 +153,16 @@ export declare class App extends CdkApp {
      */
     getStack(key: string, dependencies?: AwsStack | AwsStack[], props?: AwsStackProps): AwsStack;
     /**
-     * Retrieve default compute stack - named as `${this.name}Compute`
+     * Retrieve default compute stack, named by
+     * `getApplicationStackName(name, "Compute")`.
      *
      * Only depends on Network. Database dependency is added automatically
      * by CDK when compute resources reference database resources.
      */
     getDefaultComputeStack(): AwsStack;
     /**
-     * Retrieve default network stack - named as `${this.name}Network`
+     * Retrieve default network stack, named by
+     * `getApplicationStackName(name, "Network")`.
      */
     getDefaultNetworkStack(): AwsStack;
     /**
@@ -171,15 +178,18 @@ export declare class App extends CdkApp {
      */
     private networkDependency;
     /**
-     * Retrieve default database stack - named as `${this.name}Database`
+     * Retrieve default database stack, named by
+     * `getApplicationStackName(name, "Database")`.
      */
     getDefaultDatabaseStack(): AwsStack;
     /**
-     * Retrieve default storage stack - named as `${this.name}Storage`
+     * Retrieve default storage stack, named by
+     * `getApplicationStackName(name, "Storage")`.
      */
     getDefaultStorageStack(): AwsStack;
     /**
-     * Retrieve default CDN stack - named as `${this.name}Cdn`
+     * Retrieve default CDN stack, named by
+     * `getApplicationStackName(name, "Cdn")`.
      *
      * Depends on Network when networking is enabled. Compute/Storage dependencies
      * are added automatically by CDK when CDN resources reference ALB or S3 bucket
@@ -189,7 +199,8 @@ export declare class App extends CdkApp {
      */
     getDefaultCdnStack(): AwsStack;
     /**
-     * Retrieve default messaging stack - named as `${this.name}Messaging`
+     * Retrieve default messaging stack, named by
+     * `getApplicationStackName(name, "Messaging")`.
      *
      * Used for SQS queues, SNS topics, and EventBridge event buses.
      * Depends on Network only. These are regional services that don't
@@ -197,8 +208,9 @@ export declare class App extends CdkApp {
      */
     getDefaultMessagingStack(): AwsStack;
     /**
-     * Retrieve the app-owned us-east-1 certificate stack — named
-     * `${this.name}UsEast1Certificates` (domain gold-plating D3, BYO path).
+     * Retrieve the app-owned us-east-1 certificate stack, named by
+     * `getApplicationStackName(name, "UsEast1Certificates")` (domain
+     * gold-plating D3, BYO path).
      *
      * CloudFront accepts viewer certificates from us-east-1 only, so
      * CloudFront-consuming patterns (staticsite, payload) whose app deploys to
@@ -211,6 +223,34 @@ export declare class App extends CdkApp {
      * Custom::CrossRegionExportWriter/Reader pair is pinned by template test.
      */
     getUsEast1CertificateStack(): AwsStack;
+    /**
+     * Retrieve the app-owned us-east-1 CloudFront logging stack — named
+     * `${this.name}UsEast1CdnLogging`.
+     *
+     * CloudWatch Logs accepts CloudFront standard-logging (v2) delivery
+     * sources, destinations and deliveries in us-east-1 only, so a logging
+     * CDN whose app deploys to another region creates them here; the
+     * distribution ARN and the log bucket ARN reach this stack through CDK
+     * cross-region references, which makes it a CONSUMER of the Cdn stack —
+     * it deploys after the Cdn stack and is destroyed before it, the mirror
+     * of the certificate stack. A CDN in a us-east-1 app never creates it.
+     *
+     * Everything crossing the boundary is a value the export writer requires
+     * stable under an unchanged logical id: the distribution ARN and the
+     * bucket ARN both are. Never route a per-synth value (a timestamp, an
+     * asset hash) through this stack's references.
+     */
+    getUsEast1CdnLoggingStack(): AwsStack;
+    /**
+     * The two us-east-1 stacks share a shape: no stack dependencies of their
+     * own (the CDK cross-region reference adds the consumer→producer edge),
+     * env-pinned to the deploying account (cross-region references resolve
+     * only between env-pinned stacks) and `crossRegionReferences: true` — the
+     * flag must be on BOTH the producing and the consuming stack, and the
+     * emitted Custom::CrossRegionExportWriter/Reader pair is pinned by
+     * template test.
+     */
+    private getUsEast1Stack;
     /**
      * Get a VPC by name. If no name is provided, returns the default VPC.
      *

package/dist/lib/app.js

@@ -1,5 +1,5 @@
 import { App as CdkApp, Aspects, Tags } from "aws-cdk-lib";
-import { maskSensitiveOutput } from "@fjall/util";
+import { APPLICATION_STACKS, defaultVpcConstructId, getApplicationStackName, maskSensitiveOutput } from "@fjall/util";
 import { RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS } from "aws-cdk-lib/cx-api";
 import { Vpc } from "./resources/aws/networking/vpc.js";
 import { createBastion } from "./patterns/aws/bastionFactory.js";
@@ -16,7 +16,6 @@ import { DeployTimeWriterMarkerAspect } from "./utils/deployTimeWriterMarkerAspe
 import { emitAppLevelAlbAliasExports } from "./utils/albAliasTargetRegistry.js";
 import { emitAppLevelCdnAliasExports } from "./utils/cdnAliasTargetRegistry.js";
 import { ensureFunctionLogGroups } from "./resources/aws/logging/logGroupHygiene.js";
-import { BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP } from "./utils/backupTierMapping.js";
 import { randomBytes } from "crypto";
 import { getConfig } from "./utils/getConfig.js";
 import AuditRoleFactory from "./resources/aws/audit/auditRole.js";
@@ -90,12 +89,12 @@ export class App extends CdkApp {
     applyBackupTier(tier) {
         if (this.backupTierObserved) {
             throw new Error(`Backup tier "${tier}" applied after a resource already resolved the app's tier: ` +
-                `that resource would carry the tier's disaster-recovery tag without its versioning default. ` +
+                `that resource is already built at the tier it read — its versioning default, ` +
+                `its backup enrolment and every other tier-owned default are synthesised. ` +
                 `Pass \`backup\` on the first App.getApp("${this.name}") call, before addStorage(), ` +
                 `addBuildkite() or a Payload pattern.`);
         }
         this.backupTier = tier;
-        this.globalTags[BACKUP_TIER_TAG_KEY] = BACKUP_TIER_TAG_MAP[tier];
     }
     initialiseTunnel(config) {
         if (this.networkDisabled || !this.vpc) {
@@ -113,7 +112,7 @@ export class App extends CdkApp {
         }
         else {
             const networkConfig = { ...config, vpcName: config.vpcName ?? this.name };
-            const network = NetworkFactory.build(`${this.stackPrefix}Vpc`, networkConfig)(this, networkStack.getStack());
+            const network = NetworkFactory.build(defaultVpcConstructId(this.name), networkConfig)(this, networkStack.getStack());
             this.vpc = network.getVpc();
         }
     }
@@ -146,7 +145,7 @@ export class App extends CdkApp {
                 // Warn if network already initialised - changing name after network exists creates a mismatch
                 if (App.instance.vpc) {
                     FjallLogger.warn(`App name changed from "${App.instance.name}" to "${name}" after network was initialised. ` +
-                        `VPC will have name "${App.instance.name}Vpc" but app name is "${name}". ` +
+                        `VPC construct id will be "${defaultVpcConstructId(App.instance.name)}" but app name is "${name}". ` +
                         `Ensure App.getApp() is called with the final name before initialising network.`);
                 }
                 App.instance.name = name;
@@ -230,19 +229,21 @@ export class App extends CdkApp {
         return this.stacks[key];
     }
     /**
-     * Retrieve default compute stack - named as `${this.name}Compute`
+     * Retrieve default compute stack, named by
+     * `getApplicationStackName(name, "Compute")`.
      *
      * Only depends on Network. Database dependency is added automatically
      * by CDK when compute resources reference database resources.
      */
     getDefaultComputeStack() {
-        return this.getStack(`${this.stackPrefix}Compute`, this.networkDependency());
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.COMPUTE), this.networkDependency());
     }
     /**
-     * Retrieve default network stack - named as `${this.name}Network`
+     * Retrieve default network stack, named by
+     * `getApplicationStackName(name, "Network")`.
      */
     getDefaultNetworkStack() {
-        return this.getStack(`${this.stackPrefix}Network`);
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.NETWORK));
     }
     /**
      * The Network stack as a dependency, or `undefined` when the app is
@@ -259,19 +260,22 @@ export class App extends CdkApp {
         return this.networkDisabled ? undefined : this.getDefaultNetworkStack();
     }
     /**
-     * Retrieve default database stack - named as `${this.name}Database`
+     * Retrieve default database stack, named by
+     * `getApplicationStackName(name, "Database")`.
      */
     getDefaultDatabaseStack() {
-        return this.getStack(`${this.stackPrefix}Database`, this.networkDependency());
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.DATABASE), this.networkDependency());
     }
     /**
-     * Retrieve default storage stack - named as `${this.name}Storage`
+     * Retrieve default storage stack, named by
+     * `getApplicationStackName(name, "Storage")`.
      */
     getDefaultStorageStack() {
-        return this.getStack(`${this.stackPrefix}Storage`, this.networkDependency());
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.STORAGE), this.networkDependency());
     }
     /**
-     * Retrieve default CDN stack - named as `${this.name}Cdn`
+     * Retrieve default CDN stack, named by
+     * `getApplicationStackName(name, "Cdn")`.
      *
      * Depends on Network when networking is enabled. Compute/Storage dependencies
      * are added automatically by CDK when CDN resources reference ALB or S3 bucket
@@ -283,23 +287,23 @@ export class App extends CdkApp {
         // crossRegionReferences is enabled at creation so the Cdn stack can
         // consume a us-east-1 certificate (domain gold-plating D3, BYO path).
         // The flag is inert unless a cross-region reference is synthesised.
-        return this.getStack(`${this.stackPrefix}Cdn`, this.networkDependency(), {
-            crossRegionReferences: true
-        });
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.CDN), this.networkDependency(), { crossRegionReferences: true });
     }
     /**
-     * Retrieve default messaging stack - named as `${this.name}Messaging`
+     * Retrieve default messaging stack, named by
+     * `getApplicationStackName(name, "Messaging")`.
      *
      * Used for SQS queues, SNS topics, and EventBridge event buses.
      * Depends on Network only. These are regional services that don't
      * require VPC, but we maintain consistent stack dependency patterns.
      */
     getDefaultMessagingStack() {
-        return this.getStack(`${this.stackPrefix}Messaging`, this.networkDependency());
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.MESSAGING), this.networkDependency());
     }
     /**
-     * Retrieve the app-owned us-east-1 certificate stack — named
-     * `${this.name}UsEast1Certificates` (domain gold-plating D3, BYO path).
+     * Retrieve the app-owned us-east-1 certificate stack, named by
+     * `getApplicationStackName(name, "UsEast1Certificates")` (domain
+     * gold-plating D3, BYO path).
      *
      * CloudFront accepts viewer certificates from us-east-1 only, so
      * CloudFront-consuming patterns (staticsite, payload) whose app deploys to
@@ -312,11 +316,43 @@ export class App extends CdkApp {
      * Custom::CrossRegionExportWriter/Reader pair is pinned by template test.
      */
     getUsEast1CertificateStack() {
-        const key = `${this.stackPrefix}UsEast1Certificates`;
+        return this.getUsEast1Stack(APPLICATION_STACKS.US_EAST_1_CERTIFICATES, "certificate");
+    }
+    /**
+     * Retrieve the app-owned us-east-1 CloudFront logging stack — named
+     * `${this.name}UsEast1CdnLogging`.
+     *
+     * CloudWatch Logs accepts CloudFront standard-logging (v2) delivery
+     * sources, destinations and deliveries in us-east-1 only, so a logging
+     * CDN whose app deploys to another region creates them here; the
+     * distribution ARN and the log bucket ARN reach this stack through CDK
+     * cross-region references, which makes it a CONSUMER of the Cdn stack —
+     * it deploys after the Cdn stack and is destroyed before it, the mirror
+     * of the certificate stack. A CDN in a us-east-1 app never creates it.
+     *
+     * Everything crossing the boundary is a value the export writer requires
+     * stable under an unchanged logical id: the distribution ARN and the
+     * bucket ARN both are. Never route a per-synth value (a timestamp, an
+     * asset hash) through this stack's references.
+     */
+    getUsEast1CdnLoggingStack() {
+        return this.getUsEast1Stack(APPLICATION_STACKS.US_EAST_1_CDN_LOGGING, "CloudFront logging");
+    }
+    /**
+     * The two us-east-1 stacks share a shape: no stack dependencies of their
+     * own (the CDK cross-region reference adds the consumer→producer edge),
+     * env-pinned to the deploying account (cross-region references resolve
+     * only between env-pinned stacks) and `crossRegionReferences: true` — the
+     * flag must be on BOTH the producing and the consuming stack, and the
+     * emitted Custom::CrossRegionExportWriter/Reader pair is pinned by
+     * template test.
+     */
+    getUsEast1Stack(stack, purpose) {
+        const key = getApplicationStackName(this.name, stack);
         if (!this.stacks[key]) {
             const account = process.env.CDK_DEFAULT_ACCOUNT;
             if (!account) {
-                throw new Error(`App '${this.name}': the us-east-1 certificate stack needs a ` +
+                throw new Error(`App '${this.name}': the us-east-1 ${purpose} stack needs a ` +
                     "concrete account (got CDK_DEFAULT_ACCOUNT undefined). " +
                     "Cross-region references resolve only between env-pinned stacks " +
                     "— deploy through the Fjall CLI, or export CDK_DEFAULT_ACCOUNT " +

package/dist/lib/config/aws/configRecorder.js

@@ -25,6 +25,9 @@ export class ConfigRecorder extends Construct {
             blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
             versioned: true,
             removalPolicy: RemovalPolicy.RETAIN,
+            // AWS Config delivers configuration snapshots here on its own schedule
+            // and the 90-day rule below is the retention; nothing restores from it.
+            backupExemption: "log-delivery",
             lifecycleRules: [
                 {
                     expiration: Duration.days(90),

package/dist/lib/config/aws/disasterRecovery.d.ts

@@ -12,8 +12,7 @@ export interface DisasterRecoveryProps {
     customBackupPlans?: CustomBackupPlanConfig[];
 }
 export declare class DisasterRecovery extends Construct {
-    readonly backupVault?: BackupVault;
-    private readonly vaultRef;
+    readonly backupVault: BackupVault;
     readonly backupPlans: {
         standard: BackupPlan;
         resilient: BackupPlan;

package/dist/lib/config/aws/disasterRecovery.js

@@ -1,20 +1,23 @@
-import { CfnOutput, Duration, RemovalPolicy } from "aws-cdk-lib";
+import { Annotations, CfnOutput, Duration, RemovalPolicy } from "aws-cdk-lib";
 import { Construct } from "constructs";
 import { BackupVault, BackupPlan } from "../../resources/aws/backup/index.js";
 import { BackupPlanRule, BackupVault as Vault } from "aws-cdk-lib/aws-backup";
-import { cronSchedule } from "../../resources/aws/messaging/index.js";
 import { AccountPrincipal, Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { Key } from "aws-cdk-lib/aws-kms";
+import { cronSchedule } from "../../resources/aws/messaging/index.js";
 import { getConfig } from "../../utils/getConfig.js";
 import { toPascalCase } from "../../utils/capitaliseString.js";
-import { BACKUP_VAULT_NAME } from "@fjall/util";
+import { readBackupVaultVerdict } from "../../utils/cdkContext.js";
+import { BACKUP_VAULT_NAME, isReownedBackupVault } from "@fjall/util";
 // Backup retention constants (in days)
 const RETENTION_PERIODS = {
     STANDARD: 90,
-    RESILIENT: 365,
-    ENTERPRISE_CONTINUOUS: 35, // AWS max for continuous backup
+    // AWS caps a continuous-backup window at 35 days, so the resilient and the
+    // enterprise continuous rules both sit at the cap: it is AWS's limit, not a
+    // tier's choice, which is why one constant serves both.
+    CONTINUOUS_MAX: 35,
     ENTERPRISE_COMPLIANCE: 2555, // 7 years
-    COLD_STORAGE_MINIMUM: 90, // AWS minimum
-    COLD_STORAGE_ONE_YEAR: 365
+    COLD_STORAGE_MINIMUM: 90 // AWS's minimum before a cold point may be deleted
 };
 // Backup window constants
 const BACKUP_WINDOWS = {
@@ -28,11 +31,13 @@ const VAULT_LOCK = {
     MAX_RETENTION: Duration.days(36500),
     GRACE_PERIOD: Duration.days(3)
 };
+function liveLockMode(lock) {
+    if (lock === null)
+        return "none";
+    return lock.lockDate !== undefined ? "compliance" : "governance";
+}
 export class DisasterRecovery extends Construct {
-    // Set in create-mode only; in adopt-mode the existing vault is referenced, not created.
     backupVault;
-    // Vault the plans write to: created vault (create-mode) or imported handle (adopt-mode).
-    vaultRef;
     backupPlans;
     customBackupPlans;
     constructor(scope, id, props) {
@@ -41,9 +46,10 @@ export class DisasterRecovery extends Construct {
         const providerAccounts = config.providerAccounts;
         const account = providerAccounts.find((pa) => pa.id === props.accountId);
         const isComplianceAccount = account?.environment === "compliance";
-        // Set by the deploy orchestration after probing DescribeBackupVault: adopt the
-        // retained fixed-name vault by reference rather than re-CREATE it (which collides).
-        const adoptExistingVault = this.node.tryGetContext("fjallAdoptBackupVault") === "true";
+        // Injected by the deploy engine after probing the live vault and the account
+        // stack; unset (a bare synth) is the create template.
+        const verdict = readBackupVaultVerdict(this.node);
+        const reOwned = isReownedBackupVault(verdict);
         const disasterRecoveryRegion = config.disasterRecoveryRegion;
         // Look up compliance account for cross-account replication
         // Skip if the compliance account (prevent self-replication)
@@ -58,9 +64,11 @@ export class DisasterRecovery extends Construct {
         // permanently-immutable compliance lock. See
         // decisions/2026-06-03-backup-vault-lock-mode-by-intent.md.
         const vaultLock = account?.vaultLock ?? (isComplianceAccount ? "governance" : "none");
-        // Adopt-mode references an already-locked vault and applies no lock config,
-        // so it is exempt from the acknowledgement gate.
-        if (!adoptExistingVault &&
+        // Fjall never issues a lock call against a vault it did not create: a
+        // re-owned vault declares no lock and the intent only warns when it
+        // differs, so the acknowledgement gate guards only a lock this template
+        // creates.
+        if (!reOwned &&
             vaultLock === "compliance" &&
             account?.acknowledgeImmutableVaultLock !== true) {
             throw new Error(`Account "${account?.name ?? props.accountId}" requests vaultLock: ` +
@@ -69,7 +77,7 @@ export class DisasterRecovery extends Construct {
                 `compliance lock cannot be removed by anyone, including AWS or the ` +
                 `root user. Set the acknowledgement explicitly to proceed.`);
         }
-        const lockConfiguration = vaultLock === "compliance"
+        const intendedLockConfiguration = vaultLock === "compliance"
             ? {
                 minRetention: VAULT_LOCK.MIN_RETENTION,
                 maxRetention: VAULT_LOCK.MAX_RETENTION,
@@ -81,20 +89,33 @@ export class DisasterRecovery extends Construct {
                     maxRetention: VAULT_LOCK.MAX_RETENTION
                 }
                 : undefined;
-        if (adoptExistingVault) {
-            this.vaultRef = Vault.fromBackupVaultName(this, "BackupVault", BACKUP_VAULT_NAME);
-        }
-        else {
-            this.backupVault = new BackupVault(this, "BackupVault", {
-                vaultName: BACKUP_VAULT_NAME,
-                removalPolicy: RemovalPolicy.RETAIN,
-                lockConfiguration: lockConfiguration
-            });
-            this.vaultRef = this.backupVault.vault;
+        const lockConfiguration = reOwned ? undefined : intendedLockConfiguration;
+        const liveLocked = verdict.state !== "absent" && verdict.lock !== null;
+        if (verdict.state !== "absent" && reOwned) {
+            const liveMode = liveLockMode(verdict.lock);
+            if (liveMode !== vaultLock) {
+                Annotations.of(this).addWarningV2("fjall:backupVault:lockIntentNotApplied", `Backup vault "${BACKUP_VAULT_NAME}" is re-owned: Fjall does not ` +
+                    `manage the lock of a vault it did not create. Its live lock ` +
+                    `(${liveMode}) stays as it is and the configured vaultLock ` +
+                    `(${vaultLock}) is not applied — align the configured vaultLock ` +
+                    `with the live lock, or change the live lock with the AWS Backup ` +
+                    `API where it is still changeable.`);
+            }
         }
-        // Cross-account access policy — create-mode only. addToAccessPolicy is unavailable
-        // on an imported vault, and a live (locked) vault retains the grant written at creation.
-        if (this.backupVault && isComplianceAccount) {
+        this.backupVault = new BackupVault(this, "BackupVault", {
+            vaultName: BACKUP_VAULT_NAME,
+            removalPolicy: RemovalPolicy.RETAIN,
+            lockConfiguration,
+            ...(verdict.state !== "absent" &&
+                reOwned && {
+                encryptionKey: Key.fromKeyArn(this, "BackupVaultLiveKey", verdict.keyArn)
+            }),
+            importIdentityOnly: verdict.state === "unowned"
+        });
+        const vault = this.backupVault.vault;
+        // Cross-account copy grant. Declared in every mode; the wrapper strips it
+        // from the import pass, and the converge deploy applies it.
+        if (isComplianceAccount) {
             const allAccounts = providerAccounts;
             const productionAccounts = allAccounts.filter((acc) => acc.environment === "production");
             if (productionAccounts.length > 0) {
@@ -104,7 +125,52 @@ export class DisasterRecovery extends Construct {
                     actions: ["backup:CopyIntoBackupVault"],
                     resources: ["*"]
                 });
-                this.backupVault.vault.addToAccessPolicy(copyStatement);
+                vault.addToAccessPolicy(copyStatement);
+                // The access policy admits the copy; the KEY has to admit it too. A
+                // copy job into an encrypted vault in another account is executed by
+                // the SOURCE account, so without these the job fails at the
+                // destination with an access-denied nothing in the source account
+                // surfaces. The enterprise tier's seven-year record is this copy, so
+                // the grant is load-bearing, not hardening.
+                const sourcePrincipals = productionAccounts.map((acc) => new AccountPrincipal(acc.id));
+                if (this.backupVault.ownsEncryptionKey) {
+                    this.backupVault.encryptionKey.addToResourcePolicy(new PolicyStatement({
+                        sid: "FjallAllowCrossAccountBackupCopyKeyUse",
+                        effect: Effect.ALLOW,
+                        principals: sourcePrincipals,
+                        actions: [
+                            "kms:Decrypt",
+                            "kms:DescribeKey",
+                            "kms:Encrypt",
+                            "kms:GenerateDataKey",
+                            "kms:GenerateDataKeyWithoutPlaintext",
+                            "kms:ReEncryptFrom",
+                            "kms:ReEncryptTo"
+                        ],
+                        resources: ["*"]
+                    }));
+                    this.backupVault.encryptionKey.addToResourcePolicy(new PolicyStatement({
+                        sid: "FjallAllowCrossAccountBackupCopyGrant",
+                        effect: Effect.ALLOW,
+                        principals: sourcePrincipals,
+                        actions: ["kms:CreateGrant"],
+                        resources: ["*"],
+                        conditions: {
+                            Bool: { "kms:GrantIsForAWSResource": "true" }
+                        }
+                    }));
+                }
+                else {
+                    Annotations.of(this).addWarningV2("fjall:backupVault:crossAccountKeyGrantNotApplied", `Fjall does not manage the encryption key of backup vault ` +
+                        `"${BACKUP_VAULT_NAME}" — the vault was re-owned, so the key is ` +
+                        `yours — and cannot grant the source accounts use of it. ` +
+                        `Cross-account copies into this vault fail at the copy job ` +
+                        `until the key policy admits them: add ` +
+                        `kms:Decrypt, kms:Encrypt, kms:GenerateDataKey*, kms:ReEncrypt* ` +
+                        `and a kms:CreateGrant statement conditioned on ` +
+                        `kms:GrantIsForAWSResource for the production accounts, from a ` +
+                        `principal in the compliance account.`);
+                }
             }
         }
         // Construct cross-region replication vault ARN (same account, DR region)
@@ -118,19 +184,19 @@ export class DisasterRecovery extends Construct {
                 planName: "standard",
                 rules: this.createStandardBackupRules("standard"),
                 tagValue: "default",
-                backupVault: this.vaultRef
+                backupVault: vault
             }),
             resilient: new BackupPlan(this, "ResilientBackupPlan", {
                 planName: "resilient",
                 rules: this.createResilientBackupRules("resilient", replicationVaultArn),
                 tagValue: "resilient",
-                backupVault: this.vaultRef
+                backupVault: vault
             }),
             enterprise: new BackupPlan(this, "EnterpriseBackupPlan", {
                 planName: "enterprise",
                 rules: this.createEnterpriseBackupRules("enterprise", replicationVaultArn, disasterRecoveryVaultArn),
                 tagValue: "enterprise",
-                backupVault: this.vaultRef
+                backupVault: vault
             })
         };
         // Create custom backup plans if provided
@@ -140,7 +206,7 @@ export class DisasterRecovery extends Construct {
                     planName: config.planName,
                     rules: config.rules,
                     tagValue: config.tagValue,
-                    backupVault: this.vaultRef
+                    backupVault: vault
                 });
             });
         }
@@ -157,7 +223,7 @@ export class DisasterRecovery extends Construct {
                 exportName: `${id}ReplicationRegion`
             });
         }
-        if (vaultLock !== "none") {
+        if (reOwned ? liveLocked : lockConfiguration !== undefined) {
             new CfnOutput(this, "VaultLockEnabled", {
                 key: "VaultLockEnabled",
                 value: "true",
@@ -177,12 +243,12 @@ export class DisasterRecovery extends Construct {
         ];
     }
     createResilientBackupRules(planName, replicationVaultArn) {
-        const copyActions = this.createCopyActions(planName, replicationVaultArn, undefined, Duration.days(RETENTION_PERIODS.ENTERPRISE_CONTINUOUS), undefined);
+        const copyActions = this.createCopyActions(planName, replicationVaultArn, undefined, Duration.days(RETENTION_PERIODS.CONTINUOUS_MAX), undefined);
         return [
             new BackupPlanRule({
                 ruleName: `${planName}Daily`,
                 scheduleExpression: cronSchedule({ hour: "2", minute: "0" }), // 2 AM daily
-                deleteAfter: Duration.days(RETENTION_PERIODS.ENTERPRISE_CONTINUOUS),
+                deleteAfter: Duration.days(RETENTION_PERIODS.CONTINUOUS_MAX),
                 enableContinuousBackup: true,
                 startWindow: BACKUP_WINDOWS.START,
                 completionWindow: BACKUP_WINDOWS.COMPLETION,
@@ -191,25 +257,81 @@ export class DisasterRecovery extends Construct {
         ];
     }
     createEnterpriseBackupRules(planName, replicationVaultArn, disasterRecoveryVaultArn) {
-        const continuousCopyActions = this.createCopyActions(`${planName}Continuous`, replicationVaultArn, disasterRecoveryVaultArn, Duration.days(RETENTION_PERIODS.ENTERPRISE_CONTINUOUS), undefined);
-        const complianceCopyActions = this.createCopyActions(`${planName}Compliance`, replicationVaultArn, disasterRecoveryVaultArn, Duration.days(RETENTION_PERIODS.ENTERPRISE_COMPLIANCE), Duration.days(RETENTION_PERIODS.COLD_STORAGE_ONE_YEAR));
+        // One destination per rule, by role. The continuous window is the
+        // regional-outage answer and goes to the DR region in this account; the
+        // seven-year record goes to the compliance account and nowhere else.
+        // Sending both rules to both vaults doubled the copy volume to buy a
+        // second copy of the same thing.
+        //
+        // Each rule falls back to the other's destination when its own role has
+        // none, because the two ARNs go absent for independent reasons: the
+        // cross-account one whenever the organisation has no compliance account,
+        // and inside the compliance account itself where the self-replication
+        // guard clears it; the DR-region one whenever the configured
+        // disasterRecoveryRegion IS this account's region. A rule with no
+        // destination keeps every recovery point it takes in one vault in one
+        // region, which is the failure the tier exists to answer, so one copy in
+        // the less appropriate place beats none. Still one destination per rule:
+        // each fallback is passed only when that rule's own destination is absent.
+        const continuousCopyActions = this.createCopyActions(`${planName}Continuous`, replicationVaultArn, replicationVaultArn === undefined ? disasterRecoveryVaultArn : undefined, Duration.days(RETENTION_PERIODS.CONTINUOUS_MAX), undefined);
+        const complianceCopyActions = this.createCopyActions(`${planName}Compliance`, disasterRecoveryVaultArn === undefined ? replicationVaultArn : undefined, disasterRecoveryVaultArn, Duration.days(RETENTION_PERIODS.ENTERPRISE_COMPLIANCE), Duration.days(RETENTION_PERIODS.COLD_STORAGE_MINIMUM));
+        // Both candidate ARNs name `disasterRecoveryRegion`, so an absent
+        // `replicationVaultArn` means that region IS this account's own and
+        // nothing either rule can reach crosses a region — whatever destination
+        // the fallbacks above found. The account stack builds this construct only
+        // when a DR region is configured, so this is a misconfiguration rather
+        // than an opt-out, and the tier's whole promise rests on the copy.
+        //
+        // Warn on the plan, not on one rule. Asking only whether the compliance
+        // record had a destination was silent for the configuration where a
+        // compliance account exists and the DR region is the account's own: the
+        // record copies cross-account, the continuous window copies nowhere, and
+        // the condition that fires the warning never holds.
+        if (replicationVaultArn === undefined) {
+            if (continuousCopyActions === undefined) {
+                Annotations.of(this).addWarningV2("fjall:backupPlan:recoveryPointsNotCopied", `Neither enterprise rule has a copy destination, so every recovery ` +
+                    `point the plan takes — the ` +
+                    `${RETENTION_PERIODS.CONTINUOUS_MAX}-day continuous window and ` +
+                    `the ${RETENTION_PERIODS.ENTERPRISE_COMPLIANCE}-day compliance ` +
+                    `record alike — lives in one vault in one region. The configured ` +
+                    `disasterRecoveryRegion is this account's own region and the ` +
+                    `organisation has no compliance account — set a ` +
+                    `disasterRecoveryRegion that differs from the account's region, ` +
+                    `or add a compliance account for the plan to copy to.`);
+            }
+            else {
+                Annotations.of(this).addWarningV2("fjall:backupPlan:noCrossRegionCopy", `The enterprise plan copies to the compliance account, but nothing ` +
+                    `it copies crosses a region: the configured ` +
+                    `disasterRecoveryRegion is this account's own region, so both ` +
+                    `rules' recovery points stay where the originals are. Losing the ` +
+                    `region is the failure this tier exists to answer — set a ` +
+                    `disasterRecoveryRegion that differs from the account's region.`);
+            }
+        }
         return [
             // Continuous backup (35-day max PITR window)
             new BackupPlanRule({
                 ruleName: `${planName}Continuous`,
                 scheduleExpression: cronSchedule({ hour: "2", minute: "0" }), // Daily for continuous backup
-                deleteAfter: Duration.days(RETENTION_PERIODS.ENTERPRISE_CONTINUOUS),
+                deleteAfter: Duration.days(RETENTION_PERIODS.CONTINUOUS_MAX),
                 enableContinuousBackup: true,
                 startWindow: BACKUP_WINDOWS.START,
                 completionWindow: BACKUP_WINDOWS.COMPLETION,
                 copyActions: continuousCopyActions
             }),
-            // Hourly snapshots for long-term compliance (7 years)
+            // Monthly snapshot for the long-term compliance record (7 years),
+            // cold from day 90. Monthly, not hourly: inside the 35-day window the
+            // continuous rule above already gives second-level recovery, so an
+            // hourly snapshot bought granularity nobody asks for beyond 35 days at
+            // 720× the job count — and 24 RDS recovery points a day would exhaust
+            // the account's manual-snapshot headroom in under four days. Cold
+            // storage cannot ride the continuous rule: aws-cdk-lib refuses
+            // `moveToColdStorageAfter` with `enableContinuousBackup`.
             new BackupPlanRule({
-                ruleName: `${planName}HourlyCompliance`,
-                scheduleExpression: cronSchedule({ minute: "0" }), // Every hour
+                ruleName: `${planName}MonthlyCompliance`,
+                scheduleExpression: cronSchedule({ day: "1", hour: "2", minute: "0" }),
                 deleteAfter: Duration.days(RETENTION_PERIODS.ENTERPRISE_COMPLIANCE),
-                moveToColdStorageAfter: Duration.days(RETENTION_PERIODS.COLD_STORAGE_ONE_YEAR),
+                moveToColdStorageAfter: Duration.days(RETENTION_PERIODS.COLD_STORAGE_MINIMUM),
                 startWindow: BACKUP_WINDOWS.START,
                 completionWindow: BACKUP_WINDOWS.COMPLETION_SHORT,
                 copyActions: complianceCopyActions