@fjall/components-infrastructure 37.0.0 → 39.0.0

package/dist/lib/resources/aws/cdn/cloudFrontLogDelivery.d.ts

@@ -0,0 +1,90 @@
+import { type IDistribution } from "aws-cdk-lib/aws-cloudfront";
+import { CfnDelivery, CfnDeliveryDestination, CfnDeliverySource } from "aws-cdk-lib/aws-logs";
+import { type IBucket } from "aws-cdk-lib/aws-s3";
+import { Construct } from "constructs";
+/**
+ * Output formats CloudWatch Logs writes a CloudFront access-log delivery in.
+ * `json` is the default; `parquet` adds CloudWatch's conversion charge on top
+ * of delivery. Fixed at creation — a change replaces the destination.
+ */
+export declare const CLOUDFRONT_LOG_FORMATS: readonly ["json", "parquet", "plain", "w3c", "raw"];
+export type CloudFrontLogFormat = (typeof CLOUDFRONT_LOG_FORMATS)[number];
+export declare const DEFAULT_CLOUDFRONT_LOG_FORMAT: CloudFrontLogFormat;
+/**
+ * CloudWatch Logs mints every CloudFront delivery source, destination and
+ * delivery in us-east-1 whatever region the bucket is in — the delivery ARNs
+ * read `arn:aws:logs:us-east-1:…` and the API refuses other regions.
+ */
+export declare const CLOUDFRONT_LOG_DELIVERY_REGION = "us-east-1";
+/** The service principal that writes vended logs into the bucket. */
+export declare const CLOUDFRONT_LOG_DELIVERY_PRINCIPAL = "delivery.logs.amazonaws.com";
+/** Objects land at `<prefix>/<yyyy>/<MM>/<dd>/<HH>/…`. Changeable in place. */
+export declare const CLOUDFRONT_LOG_S3_SUFFIX_PATH = "{yyyy}/{MM}/{dd}/{HH}";
+/**
+ * Every delivery source and destination is named under this prefix —
+ * `fjall-cf-<distributionId>` for the source, `fjall-cf-<distributionId>-<digest>`
+ * for the destination. The deploy-test residue scan attributes delivery
+ * resources by the prefix and the digest width and restates both; a change
+ * here is a change to what the scan can see.
+ */
+export declare const CLOUDFRONT_LOG_DELIVERY_NAME_PREFIX = "fjall-cf-";
+/** Hex characters of the sha256 the destination name carries. */
+export declare const CLOUDFRONT_LOG_DELIVERY_DIGEST_LENGTH = 8;
+export interface CloudFrontLogDeliveryProps {
+    /**
+     * The distribution whose access logs are delivered. CloudWatch Logs allows
+     * one delivery source per distribution account-wide, so the source is
+     * named by the distribution id and nothing else.
+     */
+    readonly distribution: IDistribution;
+    /** The bucket the logs land in; same account as the distribution. */
+    readonly bucket: IBucket;
+    /** Key prefix the objects land under — see `normaliseCloudFrontLogPrefix`. */
+    readonly prefix: string;
+    readonly format: CloudFrontLogFormat;
+}
+/**
+ * The prefix is part of the destination ARN (`arn:aws:s3:::<bucket>/<prefix>`),
+ * a create-only property, and it keys the destination's name, so it must be
+ * a literal at synth. Leading and trailing slashes are dropped (CloudWatch
+ * joins the suffix path with its own separator); an empty prefix is refused
+ * rather than silently selecting the bucket-root `AWSLogs/…` layout.
+ */
+export declare function normaliseCloudFrontLogPrefix(context: string, prefix: string): string;
+/**
+ * CloudFront standard logging (v2): the CloudWatch Logs delivery source
+ * (the distribution), delivery destination (the bucket and prefix) and the
+ * delivery joining them, plus the bucket-policy statement the delivery
+ * principal writes through. The names — `fjall-cf-<distributionId>` and
+ * `fjall-cf-<distributionId>-<digest>` — carry no construct path, but
+ * CloudFormation replaces on the LOGICAL id and creates the replacement
+ * before deleting the original, and CloudWatch refuses a second source for
+ * the same distribution. So the three logical ids are load-bearing once a
+ * delivery is live: a re-layout of this construct or its owner strands the
+ * update in rollback, and is a breaking change with a migration (delete
+ * the live delivery first) rather than a refactor. The delivery test pins
+ * the ids in both layouts.
+ *
+ * The scope MUST be a us-east-1 stack (asserted at synth). When the
+ * distribution and bucket live in another region's stack, their ARNs reach
+ * this stack through CDK cross-region references; both are stable under an
+ * unchanged logical id, which the export writer requires.
+ */
+export declare class CloudFrontLogDelivery extends Construct {
+    readonly sourceName: string;
+    readonly destinationName: string;
+    readonly source: CfnDeliverySource;
+    readonly destination: CfnDeliveryDestination;
+    readonly delivery: CfnDelivery;
+    constructor(scope: Construct, id: string, props: CloudFrontLogDeliveryProps);
+    /**
+     * The bucket-policy statement the delivery principal writes through, and
+     * the key-policy statement when the bucket is KMS-encrypted. Both carry the
+     * confused-deputy conditions; the bucket statement additionally requires
+     * `bucket-owner-full-control`, the one ACL a BucketOwnerEnforced bucket
+     * accepts. Imported buckets and keys are not managed here — a synth
+     * warning names the statement the owner must add, because a missing grant
+     * fails delivery silently rather than at deploy.
+     */
+    private grantDeliveryWrite;
+}

package/dist/lib/resources/aws/cdn/cloudFrontLogDelivery.js

@@ -0,0 +1,213 @@
+import { createHash } from "node:crypto";
+import { Annotations, Stack, Token } from "aws-cdk-lib";
+import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { CfnDelivery, CfnDeliveryDestination, CfnDeliverySource } from "aws-cdk-lib/aws-logs";
+import { Construct } from "constructs";
+/**
+ * Output formats CloudWatch Logs writes a CloudFront access-log delivery in.
+ * `json` is the default; `parquet` adds CloudWatch's conversion charge on top
+ * of delivery. Fixed at creation — a change replaces the destination.
+ */
+export const CLOUDFRONT_LOG_FORMATS = [
+    "json",
+    "parquet",
+    "plain",
+    "w3c",
+    "raw"
+];
+export const DEFAULT_CLOUDFRONT_LOG_FORMAT = "json";
+/**
+ * CloudWatch Logs mints every CloudFront delivery source, destination and
+ * delivery in us-east-1 whatever region the bucket is in — the delivery ARNs
+ * read `arn:aws:logs:us-east-1:…` and the API refuses other regions.
+ */
+export const CLOUDFRONT_LOG_DELIVERY_REGION = "us-east-1";
+/** The service principal that writes vended logs into the bucket. */
+export const CLOUDFRONT_LOG_DELIVERY_PRINCIPAL = "delivery.logs.amazonaws.com";
+/** Objects land at `<prefix>/<yyyy>/<MM>/<dd>/<HH>/…`. Changeable in place. */
+export const CLOUDFRONT_LOG_S3_SUFFIX_PATH = "{yyyy}/{MM}/{dd}/{HH}";
+/**
+ * Every delivery source and destination is named under this prefix —
+ * `fjall-cf-<distributionId>` for the source, `fjall-cf-<distributionId>-<digest>`
+ * for the destination. The deploy-test residue scan attributes delivery
+ * resources by the prefix and the digest width and restates both; a change
+ * here is a change to what the scan can see.
+ */
+export const CLOUDFRONT_LOG_DELIVERY_NAME_PREFIX = "fjall-cf-";
+/** Hex characters of the sha256 the destination name carries. */
+export const CLOUDFRONT_LOG_DELIVERY_DIGEST_LENGTH = 8;
+/**
+ * The prefix is part of the destination ARN (`arn:aws:s3:::<bucket>/<prefix>`),
+ * a create-only property, and it keys the destination's name, so it must be
+ * a literal at synth. Leading and trailing slashes are dropped (CloudWatch
+ * joins the suffix path with its own separator); an empty prefix is refused
+ * rather than silently selecting the bucket-root `AWSLogs/…` layout.
+ */
+export function normaliseCloudFrontLogPrefix(context, prefix) {
+    if (Token.isUnresolved(prefix)) {
+        throw new Error(`${context}: the log prefix must be a literal string at synth — it ` +
+            "keys the delivery destination's name — but a token was given.");
+    }
+    const normalised = prefix.replace(/^\/+/, "").replace(/\/+$/, "");
+    if (normalised === "") {
+        throw new Error(`${context}: the log prefix is empty after dropping slashes. Give a ` +
+            "key prefix such as 'cloudfront/<id>', or omit it for the default.");
+    }
+    return normalised;
+}
+function assertDeliveryRegion(context, stack) {
+    const region = stack.region;
+    if (Token.isUnresolved(region)) {
+        throw new Error(`${context}: the delivery stack's region is unresolved at synth (a ` +
+            `region token). CloudWatch Logs accepts these resources in ` +
+            `${CLOUDFRONT_LOG_DELIVERY_REGION} only, so the stack must be ` +
+            "env-pinned — deploy through the Fjall CLI, or export " +
+            "CDK_DEFAULT_ACCOUNT and CDK_DEFAULT_REGION before synthesising.");
+    }
+    if (region !== CLOUDFRONT_LOG_DELIVERY_REGION) {
+        throw new Error(`${context}: CloudWatch Logs accepts CloudFront delivery resources in ` +
+            `${CLOUDFRONT_LOG_DELIVERY_REGION} only, but the scope's stack ` +
+            `'${stack.stackName}' is in ${region}. Create the delivery in the ` +
+            "app's us-east-1 logging stack (App.getUsEast1CdnLoggingStack()) — " +
+            "the Cdn pattern places it there itself.");
+    }
+}
+/**
+ * Everything create-only on the destination — the bucket, the prefix and
+ * the format — folds into its name, so a change replaces the destination
+ * under a NEW name: CloudFormation creates the replacement before deleting
+ * the original, and an identical name would collide. An imported bucket
+ * contributes its literal name; a bucket built here contributes its
+ * construct path (its physical name is a token), which is stable under an
+ * unchanged logical id — the one residual is a same-id bucket replacement,
+ * which keeps the name. Nothing tokenised is hashed: token spellings vary
+ * between synths.
+ */
+function destinationDigest(bucket, prefix, format) {
+    const bucketKey = Token.isUnresolved(bucket.bucketName)
+        ? bucket.node.path
+        : bucket.bucketName;
+    return createHash("sha256")
+        .update(`${bucketKey}|${prefix}|${format}`)
+        .digest("hex")
+        .slice(0, CLOUDFRONT_LOG_DELIVERY_DIGEST_LENGTH);
+}
+/**
+ * CloudFront standard logging (v2): the CloudWatch Logs delivery source
+ * (the distribution), delivery destination (the bucket and prefix) and the
+ * delivery joining them, plus the bucket-policy statement the delivery
+ * principal writes through. The names — `fjall-cf-<distributionId>` and
+ * `fjall-cf-<distributionId>-<digest>` — carry no construct path, but
+ * CloudFormation replaces on the LOGICAL id and creates the replacement
+ * before deleting the original, and CloudWatch refuses a second source for
+ * the same distribution. So the three logical ids are load-bearing once a
+ * delivery is live: a re-layout of this construct or its owner strands the
+ * update in rollback, and is a breaking change with a migration (delete
+ * the live delivery first) rather than a refactor. The delivery test pins
+ * the ids in both layouts.
+ *
+ * The scope MUST be a us-east-1 stack (asserted at synth). When the
+ * distribution and bucket live in another region's stack, their ARNs reach
+ * this stack through CDK cross-region references; both are stable under an
+ * unchanged logical id, which the export writer requires.
+ */
+export class CloudFrontLogDelivery extends Construct {
+    sourceName;
+    destinationName;
+    source;
+    destination;
+    delivery;
+    constructor(scope, id, props) {
+        super(scope, id);
+        const context = `CloudFront log delivery '${id}'`;
+        const stack = Stack.of(this);
+        assertDeliveryRegion(context, stack);
+        const { distribution, bucket, format } = props;
+        const prefix = normaliseCloudFrontLogPrefix(context, props.prefix);
+        this.sourceName = `${CLOUDFRONT_LOG_DELIVERY_NAME_PREFIX}${distribution.distributionId}`;
+        this.destinationName = `${this.sourceName}-${destinationDigest(bucket, prefix, format)}`;
+        this.source = new CfnDeliverySource(this, "Source", {
+            name: this.sourceName,
+            resourceArn: distribution.distributionArn,
+            logType: "ACCESS_LOGS"
+        });
+        this.destination = new CfnDeliveryDestination(this, "Destination", {
+            name: this.destinationName,
+            deliveryDestinationType: "S3",
+            destinationResourceArn: `${bucket.bucketArn}/${prefix}`,
+            outputFormat: format
+        });
+        this.delivery = new CfnDelivery(this, "Delivery", {
+            deliverySourceName: this.sourceName,
+            deliveryDestinationArn: this.destination.attrArn,
+            s3SuffixPath: CLOUDFRONT_LOG_S3_SUFFIX_PATH,
+            s3EnableHiveCompatiblePath: false
+        });
+        // `deliverySourceName` is a plain string: CloudFormation sees no edge to
+        // the source and would happily create the delivery first.
+        this.delivery.addDependency(this.source);
+        this.grantDeliveryWrite(context, bucket, prefix, stack);
+    }
+    /**
+     * The bucket-policy statement the delivery principal writes through, and
+     * the key-policy statement when the bucket is KMS-encrypted. Both carry the
+     * confused-deputy conditions; the bucket statement additionally requires
+     * `bucket-owner-full-control`, the one ACL a BucketOwnerEnforced bucket
+     * accepts. Imported buckets and keys are not managed here — a synth
+     * warning names the statement the owner must add, because a missing grant
+     * fails delivery silently rather than at deploy.
+     */
+    grantDeliveryWrite(context, bucket, prefix, deliveryStack) {
+        const bucketStack = Stack.of(bucket);
+        const principal = new ServicePrincipal(CLOUDFRONT_LOG_DELIVERY_PRINCIPAL);
+        const sourceArnPattern = `arn:${bucketStack.partition}:logs:${CLOUDFRONT_LOG_DELIVERY_REGION}:` +
+            `${bucketStack.account}:delivery-source:*`;
+        // The partition is a token in every stack; the account may be too.
+        const sourceArnForHumans = `arn:<partition>:logs:${CLOUDFRONT_LOG_DELIVERY_REGION}:` +
+            "<account-id>:delivery-source:*";
+        const deputyConditions = {
+            StringEquals: { "aws:SourceAccount": bucketStack.account },
+            ArnLike: { "aws:SourceArn": sourceArnPattern }
+        };
+        const bucketGrant = bucket.addToResourcePolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            principals: [principal],
+            actions: ["s3:PutObject"],
+            resources: [bucket.arnForObjects(`${prefix}/*`)],
+            conditions: {
+                StringEquals: {
+                    "s3:x-amz-acl": "bucket-owner-full-control",
+                    ...deputyConditions.StringEquals
+                },
+                ArnLike: deputyConditions.ArnLike
+            }
+        }));
+        if (!bucketGrant.statementAdded) {
+            Annotations.of(this).addWarningV2("fjall:cloudfront:log-delivery-bucket-policy", `${context}: bucket '${bucket.node.path}' is imported, so its policy ` +
+                "is not managed here. Allow s3:PutObject on " +
+                `'${prefix}/*' to ${CLOUDFRONT_LOG_DELIVERY_PRINCIPAL} with ` +
+                "s3:x-amz-acl=bucket-owner-full-control, aws:SourceAccount and " +
+                `aws:SourceArn=${sourceArnForHumans} conditions yourself — ` +
+                "without it delivery fails silently.");
+        }
+        else if (bucket.policy !== undefined && bucketStack === deliveryStack) {
+            this.delivery.node.addDependency(bucket.policy);
+        }
+        if (bucket.encryptionKey === undefined)
+            return;
+        const keyGrant = bucket.encryptionKey.addToResourcePolicy(new PolicyStatement({
+            effect: Effect.ALLOW,
+            principals: [principal],
+            actions: ["kms:GenerateDataKey*", "kms:Decrypt"],
+            resources: ["*"],
+            conditions: deputyConditions
+        }), true);
+        if (!keyGrant.statementAdded) {
+            Annotations.of(this).addWarningV2("fjall:cloudfront:log-delivery-key-policy", `${context}: the bucket's KMS key '${bucket.encryptionKey.node.path}' ` +
+                "is imported, so its key policy is not managed here. Allow " +
+                `kms:GenerateDataKey* and kms:Decrypt to ${CLOUDFRONT_LOG_DELIVERY_PRINCIPAL} ` +
+                `with aws:SourceAccount and aws:SourceArn=${sourceArnForHumans} ` +
+                "conditions yourself — without it delivery fails silently.");
+        }
+    }
+}

package/dist/lib/resources/aws/cdn/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./cloudFront.js";
+export * from "./cloudFrontLogDelivery.js";
 export * from "./responseHeadersPolicy.js";

package/dist/lib/resources/aws/cdn/index.js

@@ -1,2 +1,3 @@
 export * from "./cloudFront.js";
+export * from "./cloudFrontLogDelivery.js";
 export * from "./responseHeadersPolicy.js";

package/dist/lib/resources/aws/compute/ecs.d.ts

@@ -152,11 +152,14 @@ export default class EcsCluster extends Construct implements IConnectable {
     private addServiceToCluster;
     private setupConnections;
     /**
-     * Create DeployableService outputs for deployment automation.
-     * Each service gets a DeployableService output so the deployment service
-     * can find and deploy all services in the cluster.
+     * The outputs the deploy engine's `EcsServiceResolver` reads to find this
+     * cluster's services: the cluster's `DeployableCluster` and `ClusterArn`,
+     * then one `DeployableService` per service. Export names come from
+     * `@fjall/util`'s `stackExportNames` builders — the same functions the
+     * resolver rebuilds them with — and the output keys keep the PascalCase
+     * form a logical id needs.
      */
-    private addDeployableServiceOutputs;
+    private addDeployableOutputs;
     /** Checks if any service in the cluster uses a Fargate capacity provider. */
     private anyServiceUsesFargate;
     /** Checks if any service in the cluster uses an EC2 capacity provider. */

package/dist/lib/resources/aws/compute/ecs.js

@@ -8,7 +8,7 @@ import { tierDefault } from "../../../utils/backupTierMapping.js";
 import { envAwareRemovalPolicyDefault } from "../../../utils/removalPolicy.js";
 import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
-import { stackScopedExportName } from "../../../utils/exportNaming.js";
+import { clusterArnExportName, deployableClusterExportName, deployableServiceExportName } from "@fjall/util";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { createEcsServiceAlarms, createEcsTaskStopWatchdog, createLogPatternAlarms } from "../monitoring/index.js";
 // Extracted modules
@@ -177,7 +177,9 @@ export default class EcsCluster extends Construct {
                 applicationId: props.applicationId
             });
         }
-        this.addDeployableServiceOutputs(props);
+        if (props.deployableServices !== false) {
+            this.addDeployableOutputs(props);
+        }
         this.connections = this.setupConnections(props);
         Aspects.of(this).add(new CapacityProviderDependencyAspect(this.cluster));
     }
@@ -412,16 +414,31 @@ export default class EcsCluster extends Construct {
         });
     }
     /**
-     * Create DeployableService outputs for deployment automation.
-     * Each service gets a DeployableService output so the deployment service
-     * can find and deploy all services in the cluster.
+     * The outputs the deploy engine's `EcsServiceResolver` reads to find this
+     * cluster's services: the cluster's `DeployableCluster` and `ClusterArn`,
+     * then one `DeployableService` per service. Export names come from
+     * `@fjall/util`'s `stackExportNames` builders — the same functions the
+     * resolver rebuilds them with — and the output keys keep the PascalCase
+     * form a logical id needs.
      */
-    addDeployableServiceOutputs(props) {
+    addDeployableOutputs(props) {
+        const stackName = Stack.of(this).stackName;
+        new CfnOutput(this, `${this.outputName}DeployableCluster`, {
+            key: `${this.outputName}DeployableCluster`,
+            exportName: deployableClusterExportName(stackName, props.clusterName),
+            value: this.cluster.clusterArn
+        });
+        new CfnOutput(this, `${this.outputName}ClusterArn`, {
+            key: `${this.outputName}ClusterArn`,
+            exportName: clusterArnExportName(stackName, props.clusterName),
+            value: this.cluster.clusterArn,
+            description: `ECS Cluster ARN for ${props.clusterName}`
+        });
         for (const [serviceName, serviceData] of this.services) {
-            const safeServiceName = toPascalCase(serviceName);
-            new CfnOutput(this, `${this.outputName}${safeServiceName}DeployableService`, {
-                key: `${this.outputName}${safeServiceName}DeployableService`,
-                exportName: stackScopedExportName(this, `${props.clusterName}${serviceName}DeployableService`),
+            const outputKey = `${this.outputName}${toPascalCase(serviceName)}DeployableService`;
+            new CfnOutput(this, outputKey, {
+                key: outputKey,
+                exportName: deployableServiceExportName(stackName, props.clusterName, serviceName),
                 value: serviceData.service.serviceArn,
                 description: `Deployable ECS Service ARN for ${serviceName} in ${props.clusterName}`
             });
@@ -467,17 +484,6 @@ export default class EcsCluster extends Construct {
                 }
             }
         });
-        new CfnOutput(this, `${this.outputName}DeployableCluster`, {
-            key: `${this.outputName}DeployableCluster`,
-            exportName: stackScopedExportName(this, `${props.clusterName}DeployableCluster`),
-            value: cluster.clusterArn
-        });
-        new CfnOutput(this, `${this.outputName}ClusterArn`, {
-            key: `${this.outputName}ClusterArn`,
-            exportName: stackScopedExportName(this, `${props.clusterName}ClusterArn`),
-            value: cluster.clusterArn,
-            description: `ECS Cluster ARN for ${props.clusterName}`
-        });
         return cluster;
     }
     static build(id, props) {

package/dist/lib/resources/aws/compute/ecsServiceFactory.js

@@ -195,6 +195,9 @@ export function getOrCreateAsgCapacityProvider(ctx, serviceProps, state) {
                 ...(ec2Config.persistentDataVolume.alarmTopic === undefined &&
                     ctx.props.alertsTopic !== undefined && {
                     alarmTopic: ctx.props.alertsTopic
+                }),
+                ...(ctx.props.appBackupTier !== undefined && {
+                    appBackupTier: ctx.props.appBackupTier
                 })
             },
             // Pinned slots reproduce the deployed fjall:OwnerLogicalId verbatim —

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -763,6 +763,17 @@ export interface EcsClusterProps {
      * auditable opt-out for cost-sensitive clusters.
      */
     taskStopWatchdog?: false;
+    /**
+     * Deployable-service exports (default on): one `DeployableService` output
+     * per service plus the cluster's `DeployableCluster` and `ClusterArn`
+     * outputs, named by `@fjall/util`'s `stackExportNames` builders. The
+     * deploy engine's `EcsServiceResolver` reads the app's Compute stack
+     * outputs to find the ECS services that `fjall services`, `fjall rollout`,
+     * `fjall restart`, a code-only deploy and a rollback act on. `false` opts
+     * out a cluster hosting an infrastructure service, so the resolver never
+     * binds it as an app service.
+     */
+    deployableServices?: false;
     /**
      * CloudWatch Container Insights. Default: the app backup tier's
      * `containerInsights` column (on at enterprise, off below). Enabling it

package/dist/lib/resources/aws/compute/ecsValidation.d.ts

@@ -26,6 +26,14 @@ import type { DomainConfig, EcsCapacityProvider, EcsClusterProps } from "./ecsTy
  * a field on `EcsServiceProps`, so a direct `new EcsCluster(...)` consumer
  * cannot pass it and there is no resources-layer code path to validate.
  *
+ * Same applies to `cluster.scheduledTasks`: the whole array is a patterns-
+ * layer field on `EcsClusterConfig`, materialised into `Ec2TaskDefinition`s
+ * and `app.addSchedule(...)` calls by `materialiseScheduledTasks` in
+ * `computeEcs.ts`. Its two per-entry refusals (`networkMode: AWS_VPC`, and
+ * `logGroup` together with `logRetention`) therefore run in `validateEcsProps`
+ * only. `EcsClusterProps` carries no `scheduledTasks` field, so a mirror here
+ * would be unreachable.
+ *
  * @param props - The cluster props to validate
  * @param annotationsScope - When provided (the `EcsCluster` constructor passes
  *   `this`), non-fatal findings from {@link validateEc2TaskMemoryFit} are

package/dist/lib/resources/aws/compute/ecsValidation.js

@@ -32,6 +32,14 @@ import { validateSharedEc2CapacityConfig } from "./ecsCapacityConfig.js";
  * a field on `EcsServiceProps`, so a direct `new EcsCluster(...)` consumer
  * cannot pass it and there is no resources-layer code path to validate.
  *
+ * Same applies to `cluster.scheduledTasks`: the whole array is a patterns-
+ * layer field on `EcsClusterConfig`, materialised into `Ec2TaskDefinition`s
+ * and `app.addSchedule(...)` calls by `materialiseScheduledTasks` in
+ * `computeEcs.ts`. Its two per-entry refusals (`networkMode: AWS_VPC`, and
+ * `logGroup` together with `logRetention`) therefore run in `validateEcsProps`
+ * only. `EcsClusterProps` carries no `scheduledTasks` field, so a mirror here
+ * would be unreachable.
+ *
  * @param props - The cluster props to validate
  * @param annotationsScope - When provided (the `EcsCluster` constructor passes
  *   `this`), non-fatal findings from {@link validateEc2TaskMemoryFit} are

package/dist/lib/resources/aws/compute/persistentDataVolume.d.ts

@@ -3,6 +3,7 @@ import { Alarm } from "aws-cdk-lib/aws-cloudwatch";
 import { EbsDeviceVolumeType, Volume } from "aws-cdk-lib/aws-ec2";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { Construct } from "constructs";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import { LambdaFunction } from "./lambda.js";
 import { SQSQueue } from "../messaging/sqs.js";
 /**
@@ -53,6 +54,13 @@ export interface PersistentDataVolumeProps {
      * re-attach queue's DLQ-depth alarm (created only when the topic is set).
      */
     alarmTopic?: ITopic;
+    /**
+     * The application's backup tier. Enrols the volume in the matching AWS
+     * Backup plan via the disaster-recovery tier tag. Independent of the
+     * volume's `SNAPSHOT` removal policy, which only covers a clean destroy:
+     * the plan's recovery points are the copies that reach the DR region.
+     */
+    appBackupTier?: BackupTier;
 }
 /**
  * Standalone EBS data volume + ASG `EC2_INSTANCE_LAUNCHING` hook that

package/dist/lib/resources/aws/compute/persistentDataVolume.js

@@ -10,6 +10,7 @@ import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { Construct } from "constructs";
+import { tagBackupTier } from "../../../utils/backupTierMapping.js";
 import { attachInlineAsgLifecycleHook } from "./asgInlineLifecycleHook.js";
 import { LambdaFunction } from "./lambda.js";
 import { SQSQueue } from "../messaging/sqs.js";
@@ -104,6 +105,7 @@ export class PersistentDataVolume extends Construct {
         Tags.of(this.volume).add(PERSISTENT_DATA_VOLUME_TAG_LIFECYCLE, PERSISTENT_DATA_VOLUME_TAG_LIFECYCLE_VALUE);
         Tags.of(this.volume).add(PERSISTENT_DATA_VOLUME_TAG_OWNER_LOGICAL_ID, this.ownerLogicalId);
         Tags.of(this.volume).add(PERSISTENT_DATA_VOLUME_TAG_STACK_ID, Aws.STACK_ID);
+        tagBackupTier(this.volume, props.appBackupTier);
         this.queue = new SQSQueue(this, `${id}Queue`, {
             visibilityTimeout: QUEUE_VISIBILITY_TIMEOUT_SECONDS,
             deadLetterQueue: { enabled: true, maxReceiveCount: 5 },

package/dist/lib/resources/aws/database/dynamodb.js

@@ -1,6 +1,6 @@
 import { Construct } from "constructs";
 import { CfnOutput } from "aws-cdk-lib";
-import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { tagBackupTier, tierDefault } from "../../../utils/backupTierMapping.js";
 import { toRemovalPolicy } from "../../../utils/removalPolicy.js";
 import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { Table, AttributeType, BillingMode, StreamViewType, ProjectionType, TableEncryption } from "aws-cdk-lib/aws-dynamodb";
@@ -98,6 +98,7 @@ export class DynamoDBTable extends Construct {
             removalPolicy: toRemovalPolicy(props.removalPolicy),
             timeToLiveAttribute: props.timeToLiveAttribute
         });
+        tagBackupTier(this.table, props.appBackupTier);
         if (props.globalSecondaryIndexes) {
             for (const gsi of props.globalSecondaryIndexes) {
                 const gsiProps = {

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -6,7 +6,7 @@ import { Construct } from "constructs";
 import { SecurityGroup } from "../networking/securityGroup.js";
 import { Secret } from "../secrets/index.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
-import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { tagBackupTier, tierDefault } from "../../../utils/backupTierMapping.js";
 import { addProxyCfnOutput } from "./rdsProxyOutput.js";
 import { getCdkDatabaseInsightsMode, getDatabaseInsightsRetention } from "./index.js";
 import { RDS_DEFAULTS, SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS, SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS, MIN_AUTO_PAUSE_POSTGRES_VERSION } from "./rdsDefaults.js";
@@ -255,6 +255,11 @@ export class RdsAurora extends Construct {
             this.databaseCluster = new DatabaseCluster(this, `${id}Database`, clusterProps);
         }
         this.cfnCluster = this.databaseCluster.node.defaultChild;
+        // The L1, not the L2: AWS Backup protects the Aurora cluster, and a tag on
+        // the DatabaseCluster construct would propagate to every member instance,
+        // each of which would then be selected as an RDS instance it cannot back
+        // up.
+        tagBackupTier(this.cfnCluster, props.appBackupTier);
         // Global secondary clusters can't specify these properties
         if (props.isGlobalSecondary && this.cfnCluster) {
             this.cfnCluster.masterUsername = undefined;

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -13,7 +13,7 @@ import { RDS_DEFAULTS } from "./rdsDefaults.js";
 import { DEFAULT_POSTGRES_ENGINE_CONFIG, resolveDatabaseInsights, resolveStorageEncryptionKey, resolvePerformanceInsightsKey, addMultiUserSecretRotation, warnIfSnapshotUsernameAssumed } from "./rdsHelpers.js";
 import { resolveSecretRotation, isCMKRequested } from "../../../utils/databaseTypes.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
-import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { tagBackupTier, tierDefault } from "../../../utils/backupTierMapping.js";
 import { addProxyCfnOutput } from "./rdsProxyOutput.js";
 import { createRdsAlarms } from "../monitoring/index.js";
 export class RdsInstance extends Construct {
@@ -189,6 +189,11 @@ export class RdsInstance extends Construct {
                 credentials: Credentials.fromSecret(this.databaseCredentials.secret)
             });
         }
+        // The L1, not the L2: a tag on the DatabaseInstance construct propagates
+        // to the subnet group it creates. The read replica added below is
+        // deliberately left untagged — AWS Backup would protect it as a second
+        // full copy of storage the primary's own recovery points already hold.
+        tagBackupTier(this.database.node.defaultChild, props.appBackupTier);
     }
     rotateSecret(rotationConfig) {
         this.masterSecret = addMultiUserSecretRotation({

package/dist/lib/resources/aws/logging/accessLogBucket.d.ts

@@ -9,16 +9,23 @@ export declare const ACCESS_LOG_RETENTION_DAYS = 90;
 /**
  * The one bucket an enterprise-tier stack delivers its access logs to —
  * application load balancer access logs (`alb/<name>/`) and CloudFront
- * standard logs (`cloudfront/<id>/`) share it under distinct prefixes.
+ * standard logs v2 (`cloudfront/<id>/`) share it under distinct prefixes.
  *
  * Its shape is dictated by the two delivery services and deliberately NOT
  * tier-aware: ELB log delivery requires SSE-S3 (it cannot write to a
- * KMS-encrypted bucket), CloudFront standard logging requires ACLs enabled
- * (`OBJECT_WRITER` ownership, the CDK's own logging-bucket shape), and
- * versioning would only multiply expired log objects — the `access-logs`
- * exemption marker tells posture so, landing `S3_VERSIONING_DISABLED`
- * `mitigated` rather than `open`. The bucket takes the env-aware removal
- * policy like every other bucket: production RETAINs its audit evidence,
- * non-production DESTROYs.
+ * KMS-encrypted bucket); both deliveries are bucket-policy grants, so
+ * ownership is `BUCKET_OWNER_ENFORCED` (ACLs off — the S3 default, and the
+ * posture every other Fjall bucket carries); and versioning would only
+ * multiply expired log objects — the `access-logs` exemption marker tells
+ * posture so, landing `S3_VERSIONING_DISABLED` `mitigated` rather than
+ * `open`. The bucket takes the env-aware removal policy like every other
+ * bucket: production RETAINs its audit evidence, non-production DESTROYs.
+ *
+ * Migration from 33.0.0–37.x: CloudFront standard (legacy) logging granted
+ * its `awslogsdelivery` canonical user FULL_CONTROL on the bucket ACL and
+ * never removes it, so on a bucket legacy logging wrote to the ownership
+ * flip fails with `InvalidBucketAclWithObjectOwnership`. Cure once, then
+ * redeploy: `aws s3api put-bucket-acl --bucket <name> --acl private`. The
+ * objects already delivered stay readable under the old prefix.
  */
 export declare function stackAccessLogBucket(scope: Construct): S3Bucket;