@fjall/components-infrastructure 37.0.0 → 39.0.0

package/dist/lib/resources/aws/logging/accessLogBucket.js

@@ -11,17 +11,24 @@ export const ACCESS_LOG_RETENTION_DAYS = 90;
 /**
  * The one bucket an enterprise-tier stack delivers its access logs to —
  * application load balancer access logs (`alb/<name>/`) and CloudFront
- * standard logs (`cloudfront/<id>/`) share it under distinct prefixes.
+ * standard logs v2 (`cloudfront/<id>/`) share it under distinct prefixes.
  *
  * Its shape is dictated by the two delivery services and deliberately NOT
  * tier-aware: ELB log delivery requires SSE-S3 (it cannot write to a
- * KMS-encrypted bucket), CloudFront standard logging requires ACLs enabled
- * (`OBJECT_WRITER` ownership, the CDK's own logging-bucket shape), and
- * versioning would only multiply expired log objects — the `access-logs`
- * exemption marker tells posture so, landing `S3_VERSIONING_DISABLED`
- * `mitigated` rather than `open`. The bucket takes the env-aware removal
- * policy like every other bucket: production RETAINs its audit evidence,
- * non-production DESTROYs.
+ * KMS-encrypted bucket); both deliveries are bucket-policy grants, so
+ * ownership is `BUCKET_OWNER_ENFORCED` (ACLs off — the S3 default, and the
+ * posture every other Fjall bucket carries); and versioning would only
+ * multiply expired log objects — the `access-logs` exemption marker tells
+ * posture so, landing `S3_VERSIONING_DISABLED` `mitigated` rather than
+ * `open`. The bucket takes the env-aware removal policy like every other
+ * bucket: production RETAINs its audit evidence, non-production DESTROYs.
+ *
+ * Migration from 33.0.0–37.x: CloudFront standard (legacy) logging granted
+ * its `awslogsdelivery` canonical user FULL_CONTROL on the bucket ACL and
+ * never removes it, so on a bucket legacy logging wrote to the ownership
+ * flip fails with `InvalidBucketAclWithObjectOwnership`. Cure once, then
+ * redeploy: `aws s3api put-bucket-acl --bucket <name> --acl private`. The
+ * objects already delivered stay readable under the old prefix.
  */
 export function stackAccessLogBucket(scope) {
     const stack = Stack.of(scope);
@@ -30,7 +37,7 @@ export function stackAccessLogBucket(scope) {
         return existing;
     return new S3Bucket(stack, STACK_ACCESS_LOG_BUCKET_ID, {
         encryption: BucketEncryption.S3_MANAGED,
-        objectOwnership: ObjectOwnership.OBJECT_WRITER,
+        objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
         versioned: false,
         versioningExemption: "access-logs",
         lifecycleRules: [

package/dist/lib/resources/aws/logging/cloudTrail.js

@@ -42,6 +42,9 @@ export class Trail extends Construct {
             encryptionKey: this.encryptionKey.key,
             versioned: true,
             removalPolicy: storagePolicy,
+            // CloudTrail delivers here continuously under the 365-day rule below;
+            // the audit record is the trail, not a restorable application state.
+            backupExemption: "log-delivery",
             // Custom lifecycleRules bypass S3Bucket's automatic
             // noncurrentVersionExpiration pairing — carried explicitly, or
             // noncurrent versions accumulate forever.

package/dist/lib/resources/aws/messaging/eventBridgeQueueGrants.d.ts

@@ -0,0 +1,16 @@
+import { type IRuleRef } from "aws-cdk-lib/aws-events";
+import type { IQueue } from "aws-cdk-lib/aws-sqs";
+/** EventBridge's service principal — the sender every grant in this module admits. */
+export declare const EVENTBRIDGE_SERVICE_PRINCIPAL = "events.amazonaws.com";
+/**
+ * Let `rule` deliver to `queue`. Not for a queue encrypted with a customer
+ * managed key: naming the rule there closes a dependency cycle through the
+ * key policy, which is why CDK's target grants those by account instead.
+ */
+export declare function grantRuleTargetDelivery(queue: IQueue, rule: IRuleRef): void;
+/**
+ * Let `rule` dead-letter into `queue`, on the terms of CDK's
+ * `addToDeadLetterQueueResourcePolicy`: a queue in another region is refused,
+ * and a queue in another account is left to its owner with the same warning.
+ */
+export declare function grantRuleDeadLetterDelivery(queue: IQueue, rule: IRuleRef): void;

package/dist/lib/resources/aws/messaging/eventBridgeQueueGrants.js

@@ -0,0 +1,91 @@
+import { Construct } from "constructs";
+import { Annotations, Lazy, Names, Token, TokenComparison } from "aws-cdk-lib";
+import { CfnRule } from "aws-cdk-lib/aws-events";
+import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+/** EventBridge's service principal — the sender every grant in this module admits. */
+export const EVENTBRIDGE_SERVICE_PRINCIPAL = "events.amazonaws.com";
+/** The actions `IQueue.grantSendMessages` grants — what CDK's SQS rule target allows. */
+const RULE_TARGET_ACTIONS = [
+    "sqs:SendMessage",
+    "sqs:GetQueueAttributes",
+    "sqs:GetQueueUrl"
+];
+const RULE_DEAD_LETTER_ACTIONS = ["sqs:SendMessage"];
+/**
+ * One queue-policy statement letting EventBridge deliver from every rule
+ * registered against the queue, each named in the statement's
+ * `aws:SourceArn` condition.
+ *
+ * A rule cannot reach SQS through an IAM role: the queue's resource policy is
+ * the only grant. CDK's `SqsQueue` target and `addToDeadLetterQueueResourcePolicy`
+ * add one statement per rule, and SQS refuses a queue policy past 8,192
+ * bytes, so a queue shared by about eighteen rules stops deploying. Listing
+ * the rules in one statement costs one ARN per rule instead of a statement.
+ *
+ * The statement's `Sid` is the grant's construct id. `@aws-cdk/aws-iam:minimizePolicies`
+ * merges statements without a `Sid` whose conditions serialise alike, and every
+ * lazy value serialises alike, so a queue's delivery and dead-letter grants
+ * would merge and one grant's rules would lose access.
+ */
+class RuleSourceArnGrant extends Construct {
+    #ruleArns = [];
+    static of(queue, id, actions) {
+        const existing = queue.node.tryFindChild(id);
+        if (existing instanceof RuleSourceArnGrant)
+            return existing;
+        return new RuleSourceArnGrant(queue, id, actions);
+    }
+    constructor(queue, id, actions) {
+        super(queue, id);
+        queue.addToResourcePolicy(new PolicyStatement({
+            sid: id,
+            principals: [new ServicePrincipal(EVENTBRIDGE_SERVICE_PRINCIPAL)],
+            actions: [...actions],
+            resources: [queue.queueArn],
+            conditions: {
+                ArnEquals: {
+                    "aws:SourceArn": Lazy.any({
+                        produce: () => this.#ruleArns.length === 1
+                            ? this.#ruleArns[0]
+                            : [...this.#ruleArns]
+                    })
+                }
+            }
+        }));
+    }
+    addRule(rule) {
+        const ruleArn = CfnRule.arnForRule(rule);
+        if (!this.#ruleArns.includes(ruleArn))
+            this.#ruleArns.push(ruleArn);
+    }
+}
+/**
+ * Let `rule` deliver to `queue`. Not for a queue encrypted with a customer
+ * managed key: naming the rule there closes a dependency cycle through the
+ * key policy, which is why CDK's target grants those by account instead.
+ */
+export function grantRuleTargetDelivery(queue, rule) {
+    RuleSourceArnGrant.of(queue, "EventBridgeRuleTargetGrant", RULE_TARGET_ACTIONS).addRule(rule);
+}
+/**
+ * Let `rule` dead-letter into `queue`, on the terms of CDK's
+ * `addToDeadLetterQueueResourcePolicy`: a queue in another region is refused,
+ * and a queue in another account is left to its owner with the same warning.
+ */
+export function grantRuleDeadLetterDelivery(queue, rule) {
+    if (!sameEnvDimension(rule.env.region, queue.env.region)) {
+        throw new Error(`Cannot assign Dead Letter Queue in region ${queue.env.region} to the rule ${Names.nodeUniqueId(rule.node)} in region ${rule.env.region}. Both the queue and the rule must be in the same region.`);
+    }
+    if (!sameEnvDimension(rule.env.account, queue.env.account)) {
+        Annotations.of(rule).addWarningV2("@aws-cdk/aws-events-targets:manuallyAddDLQResourcePolicy", `Cannot add a resource policy to your dead letter queue associated with rule ${CfnRule.arnForRule(rule)} because the queue is in a different account. You must add the resource policy manually to the dead letter queue in account ${queue.env.account}.`);
+        return;
+    }
+    RuleSourceArnGrant.of(queue, "EventBridgeRuleDeadLetterGrant", RULE_DEAD_LETTER_ACTIONS).addRule(rule);
+}
+function sameEnvDimension(left, right) {
+    return [
+        TokenComparison.SAME,
+        TokenComparison.ONE_UNRESOLVED,
+        TokenComparison.BOTH_UNRESOLVED
+    ].includes(Token.compareStrings(left, right));
+}

package/dist/lib/resources/aws/messaging/eventBridgeRule.js

@@ -1,9 +1,10 @@
 import { Construct } from "constructs";
-import { Duration } from "aws-cdk-lib";
+import { Annotations, Duration } from "aws-cdk-lib";
 import { Rule } from "aws-cdk-lib/aws-events";
-import { ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { SQSQueue, SQS_LIMITS } from "./sqs.js";
 import { resolveTarget } from "./eventTargets.js";
+import { EVENTBRIDGE_SERVICE_PRINCIPAL } from "./eventBridgeQueueGrants.js";
 import { createScheduleAlarms } from "../monitoring/scheduleAlarms.js";
 import { createSqsDlqAlarms } from "../monitoring/sqsAlarms.js";
 /**
@@ -36,7 +37,7 @@ export class EventBridgeRule extends Construct {
         const dlq = dlqResolution?.queue;
         if (dlq !== undefined)
             this.deadLetterQueue = dlq;
-        grantKmsDecryptToEventBridge(dlq);
+        grantKmsDecryptToEventBridge(this, dlq);
         const retryPolicy = resolveRetryPolicy(props.kind, props.retryPolicy);
         const targetAdapter = resolveTarget(props.target, {
             retryPolicy,
@@ -84,13 +85,43 @@ export class EventBridgeRule extends Construct {
         return this.#rule.ruleArn;
     }
 }
-function grantKmsDecryptToEventBridge(dlq) {
+/**
+ * Actions EventBridge needs on a dead-letter queue's key to encrypt the
+ * event it is dropping there.
+ */
+const EVENTBRIDGE_DLQ_KEY_ACTIONS = ["kms:Decrypt", "kms:GenerateDataKey"];
+/**
+ * Admit EventBridge to a CMK-encrypted dead-letter queue's key.
+ *
+ * Written as an `addToResourcePolicy` rather than `IKey.grant` because only
+ * the former reports whether the statement landed. A key imported by ARN —
+ * what `kmsKeyArn` on the patterns layer produces — carries no policy
+ * document CDK can write, and `grant` returns a Grant whose `success` is
+ * `true` regardless, so the admission would be lost in silence. It is the
+ * worst place to lose one: SQS DROPS a send its key refuses instead of
+ * returning an error, so the failure surfaces only as a dead letter that
+ * never arrives, long after the deploy that caused it.
+ *
+ * The warning therefore names the statement the key's owner must add. Fjall
+ * cannot add it: the key is theirs, and it may not even be in this account.
+ */
+function grantKmsDecryptToEventBridge(scope, dlq) {
     if (dlq === undefined)
         return;
     const key = dlq.getQueue().encryptionMasterKey;
     if (key === undefined)
         return;
-    key.grant(new ServicePrincipal("events.amazonaws.com"), "kms:Decrypt", "kms:GenerateDataKey");
+    const admitted = key.addToResourcePolicy(new PolicyStatement({
+        principals: [new ServicePrincipal(EVENTBRIDGE_SERVICE_PRINCIPAL)],
+        actions: EVENTBRIDGE_DLQ_KEY_ACTIONS,
+        resources: ["*"]
+    })).statementAdded;
+    if (admitted)
+        return;
+    Annotations.of(scope).addWarningV2("@fjall/components-infrastructure:eventBridgeDeadLetterKeyNotAdmitted", `The dead-letter queue's KMS key is imported, so this stack cannot add ` +
+        `to its key policy. Add ${EVENTBRIDGE_DLQ_KEY_ACTIONS.join(" + ")} for ` +
+        `${EVENTBRIDGE_SERVICE_PRINCIPAL} to the key yourself, or SQS will ` +
+        `silently drop every event EventBridge dead-letters to this queue.`);
 }
 function resolveRetryPolicy(kind, override) {
     if (override !== undefined)

package/dist/lib/resources/aws/messaging/eventTargets.d.ts

@@ -61,9 +61,10 @@ export interface ResolveTargetOptions {
     /**
      * Optional JSON payload for the target adapter (D5 — typed as
      * `Record<string, unknown>` at the EventBridge boundary). Translates to
-     * `message` (SQS), `event` (Lambda / EventBus / CodeBuild), or `input`
-     * (ECS task) on the underlying adapter via `RuleTargetInput.fromObject(...)`.
-     * Values may be `EventField.*` tokens for payload-template substitution.
+     * `message` (SQS) or `event` (Lambda / CodeBuild) on the underlying adapter
+     * via `RuleTargetInput.fromObject(...)`. ECS, event-bus and log-group targets
+     * refuse it. Values may be `EventField.*` tokens for payload-template
+     * substitution.
      * For schedule-kind rules, `scheduledAt: EventField.time` is auto-injected
      * unless the caller already provided a `scheduledAt` key.
      */

package/dist/lib/resources/aws/messaging/eventTargets.js

@@ -1,8 +1,9 @@
 import { EventField, RuleTargetInput } from "aws-cdk-lib/aws-events";
 import { ArnFormat, Stack } from "aws-cdk-lib";
 import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
-import { SqsQueue as SqsTarget, LambdaFunction as LambdaTarget, EventBus as EventBusTarget, CodeBuildProject as CodeBuildTarget, EcsTask as EcsTaskTarget, addToDeadLetterQueueResourcePolicy, bindBaseTargetConfig } from "aws-cdk-lib/aws-events-targets";
+import { SqsQueue as SqsTarget, LambdaFunction as LambdaTarget, EventBus as EventBusTarget, CodeBuildProject as CodeBuildTarget, EcsTask as EcsTaskTarget, bindBaseTargetConfig } from "aws-cdk-lib/aws-events-targets";
 import { SQSQueue } from "./sqs.js";
+import { grantRuleDeadLetterDelivery, grantRuleTargetDelivery } from "./eventBridgeQueueGrants.js";
 import { EventBridgeBus } from "./eventbridge.js";
 import { LogGroup } from "../logging/logGroup.js";
 import { CodeBuildProject } from "../utilities/codeBuild.js";
@@ -49,10 +50,30 @@ function buildTargetInput(payload, kind) {
  * entry per D3.
  */
 export function resolveTarget(target, options) {
+    const adapter = resolveAdapter(target, options);
+    return options.deadLetterQueue === undefined
+        ? adapter
+        : withDeadLetterQueue(adapter, options.deadLetterQueue);
+}
+/**
+ * The DLQ is bound here, never on the adapter: CDK's adapters each add one
+ * `AllowEventRule<id>` statement per rule to the DLQ's policy, so a DLQ shared
+ * by many rules outgrows the SQS policy quota exactly as a shared target
+ * queue did.
+ */
+function withDeadLetterQueue(adapter, deadLetterQueue) {
+    return {
+        bind: (rule, id) => {
+            const config = adapter.bind(rule, id);
+            grantRuleDeadLetterDelivery(deadLetterQueue, rule);
+            return { ...config, deadLetterConfig: { arn: deadLetterQueue.queueArn } };
+        }
+    };
+}
+function resolveAdapter(target, options) {
     const baseProps = {
         retryAttempts: options.retryPolicy?.retryAttempts,
-        maxEventAge: options.retryPolicy?.maxEventAge,
-        deadLetterQueue: options.deadLetterQueue
+        maxEventAge: options.retryPolicy?.maxEventAge
     };
     const targetInput = options.payload !== undefined
         ? buildTargetInput(options.payload, options.kind)
@@ -61,7 +82,7 @@ export function resolveTarget(target, options) {
         return resolveQueueTarget(target, options.messageGroupId, baseProps, targetInput);
     }
     if (target instanceof EventBridgeBus) {
-        return resolveEventBusTarget(target, options.messageGroupId, baseProps, targetInput);
+        return resolveEventBusTarget(target, options.messageGroupId, targetInput);
     }
     if (target instanceof CodeBuildProject) {
         return resolveCodeBuildTarget(target, options.messageGroupId, baseProps, targetInput);
@@ -86,11 +107,28 @@ function resolveQueueTarget(target, messageGroupId, baseProps, targetInput) {
     if (!isFifo && messageGroupId !== undefined) {
         throw new Error("messageGroupId only applies to FIFO queue targets");
     }
-    return new SqsTarget(queue, {
-        ...baseProps,
-        messageGroupId,
-        ...(targetInput !== undefined && { message: targetInput })
-    });
+    // CDK's adapter grants a customer-managed-key queue by account, one
+    // statement however many rules share it; naming each rule there would close
+    // a dependency cycle through the key policy.
+    if (queue.encryptionMasterKey !== undefined) {
+        return new SqsTarget(queue, {
+            ...baseProps,
+            messageGroupId,
+            ...(targetInput !== undefined && { message: targetInput })
+        });
+    }
+    return {
+        bind: (rule) => {
+            grantRuleTargetDelivery(queue, rule);
+            return {
+                ...bindBaseTargetConfig(baseProps),
+                arn: queue.queueArn,
+                input: targetInput,
+                targetResource: queue,
+                sqsParameters: messageGroupId !== undefined ? { messageGroupId } : undefined
+            };
+        }
+    };
 }
 function resolveLambdaTarget(target, messageGroupId, baseProps, targetInput) {
     rejectMessageGroupIdOnNonQueue("lambda", messageGroupId);
@@ -127,12 +165,19 @@ function resolveEcsTarget(target, messageGroupId, baseProps, targetInput) {
         taskCount: target.taskCount
     });
 }
-function resolveEventBusTarget(target, messageGroupId, baseProps, targetInput) {
+/**
+ * `payload` is rejected: CDK's `EventBus` adapter carries no input, so the rule
+ * forwards the matched event to the bus unchanged and a payload would be
+ * dropped without a word.
+ */
+function resolveEventBusTarget(target, messageGroupId, targetInput) {
     rejectMessageGroupIdOnNonQueue("eventBus", messageGroupId);
-    return new EventBusTarget(target.getEventBus(), {
-        ...baseProps,
-        ...(targetInput !== undefined && { event: targetInput })
-    });
+    if (targetInput !== undefined) {
+        throw new Error("payload is not supported on event-bus targets — the rule forwards the " +
+            "matched event to the bus unchanged, so a payload would be dropped. " +
+            "Target the consumer directly to send it a payload.");
+    }
+    return new EventBusTarget(target.getEventBus());
 }
 function resolveCodeBuildTarget(target, messageGroupId, baseProps, targetInput) {
     rejectMessageGroupIdOnNonQueue("codeBuild", messageGroupId);
@@ -169,23 +214,18 @@ function resolveLogGroupTarget(target, messageGroupId, baseProps, targetInput) {
         principals: [new ServicePrincipal("events.amazonaws.com")]
     }));
     return {
-        bind: (rule) => {
-            if (baseProps.deadLetterQueue !== undefined) {
-                addToDeadLetterQueueResourcePolicy(rule, baseProps.deadLetterQueue);
-            }
-            return {
-                ...bindBaseTargetConfig(baseProps),
-                // EventBridge expects the log-group ARN WITHOUT the `:*` suffix that
-                // `logGroupArn` carries.
-                arn: Stack.of(target).formatArn({
-                    service: "logs",
-                    resource: "log-group",
-                    arnFormat: ArnFormat.COLON_RESOURCE_NAME,
-                    resourceName: target.logGroupName
-                }),
-                targetResource: target
-            };
-        }
+        bind: () => ({
+            ...bindBaseTargetConfig(baseProps),
+            // EventBridge expects the log-group ARN WITHOUT the `:*` suffix that
+            // `logGroupArn` carries.
+            arn: Stack.of(target).formatArn({
+                service: "logs",
+                resource: "log-group",
+                arnFormat: ArnFormat.COLON_RESOURCE_NAME,
+                resourceName: target.logGroupName
+            }),
+            targetResource: target
+        })
     };
 }
 function rejectMessageGroupIdOnNonQueue(kind, messageGroupId) {

package/dist/lib/resources/aws/messaging/queuePolicyQuota.d.ts

@@ -0,0 +1,25 @@
+import { type IQueue } from "aws-cdk-lib/aws-sqs";
+/**
+ * SQS's queue-policy quotas.
+ * @see https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-policies.html
+ */
+export declare const QUEUE_POLICY_LIMITS: {
+    readonly MAX_BYTES: 8192;
+    readonly MAX_STATEMENTS: 20;
+};
+/**
+ * Refuse, at synthesis, a queue policy SQS would refuse at deploy.
+ *
+ * Every grant to a queue — an EventBridge rule, an SNS subscription, an S3
+ * notification — lands in the queue's one policy, and SQS rejects the whole
+ * policy past its byte or statement quota. CloudFormation only finds out
+ * mid-deploy and rolls the stack back, so the check runs where the growth is
+ * authored.
+ *
+ * The byte count is an upper bound: an ARN CloudFormation has not minted yet
+ * is sized at the longest its partition, region, account and name can be, so
+ * the refusal can arrive a few grants before SQS's would. A reference whose
+ * shape is not known here takes CDK's ARN estimate, tunable through the
+ * `@aws-cdk/aws-iam.arnSizeEstimate` context key.
+ */
+export declare function validateQueuePolicyQuota(queue: IQueue): string[];

package/dist/lib/resources/aws/messaging/queuePolicyQuota.js

@@ -0,0 +1,190 @@
+import { CfnResource, Stack } from "aws-cdk-lib";
+import { CfnEventBus, CfnRule } from "aws-cdk-lib/aws-events";
+import { CfnQueue, QueuePolicy } from "aws-cdk-lib/aws-sqs";
+/**
+ * SQS's queue-policy quotas.
+ * @see https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-policies.html
+ */
+export const QUEUE_POLICY_LIMITS = {
+    MAX_BYTES: 8192,
+    MAX_STATEMENTS: 20
+};
+/** CDK's own ARN estimate, and the context key that tunes it, for a reference this module cannot size. */
+const ARN_SIZE_ESTIMATE_CONTEXT_KEY = "@aws-cdk/aws-iam.arnSizeEstimate";
+const DEFAULT_ARN_SIZE_ESTIMATE = 150;
+const PSEUDO_PARAMETER_MAX_LENGTH = {
+    "AWS::AccountId": 12,
+    "AWS::Partition": 10,
+    "AWS::Region": 16,
+    "AWS::StackName": 128,
+    "AWS::URLSuffix": 16
+};
+const RULE_NAME_MAX_LENGTH = 64;
+const QUEUE_NAME_MAX_LENGTH = 80;
+const EVENT_BUS_NAME_MAX_LENGTH = 256;
+/** `arn:<partition>:<service>:<region>:<account>:` at its longest, without the service. */
+const ARN_PREFIX_MAX_LENGTH = "arn:::::".length +
+    PSEUDO_PARAMETER_MAX_LENGTH["AWS::Partition"] +
+    PSEUDO_PARAMETER_MAX_LENGTH["AWS::Region"] +
+    PSEUDO_PARAMETER_MAX_LENGTH["AWS::AccountId"];
+/**
+ * Refuse, at synthesis, a queue policy SQS would refuse at deploy.
+ *
+ * Every grant to a queue — an EventBridge rule, an SNS subscription, an S3
+ * notification — lands in the queue's one policy, and SQS rejects the whole
+ * policy past its byte or statement quota. CloudFormation only finds out
+ * mid-deploy and rolls the stack back, so the check runs where the growth is
+ * authored.
+ *
+ * The byte count is an upper bound: an ARN CloudFormation has not minted yet
+ * is sized at the longest its partition, region, account and name can be, so
+ * the refusal can arrive a few grants before SQS's would. A reference whose
+ * shape is not known here takes CDK's ARN estimate, tunable through the
+ * `@aws-cdk/aws-iam.arnSizeEstimate` context key.
+ */
+export function validateQueuePolicyQuota(queue) {
+    const policy = queue.node.children.find((child) => child instanceof QueuePolicy);
+    if (policy === undefined)
+        return [];
+    const stack = Stack.of(queue);
+    const document = stack.resolve(policy.document);
+    const statements = isRecord(document) ? document.Statement : undefined;
+    const statementCount = Array.isArray(statements) ? statements.length : 0;
+    const estimator = new PolicySizeEstimator(stack);
+    const bytes = estimator.jsonLength(document);
+    const errors = [];
+    if (statementCount > QUEUE_POLICY_LIMITS.MAX_STATEMENTS) {
+        errors.push(`The resource policy on queue ${queue.node.path} has ${statementCount} statements; SQS allows at most ${QUEUE_POLICY_LIMITS.MAX_STATEMENTS}. Split the grants across queues.`);
+    }
+    if (bytes > QUEUE_POLICY_LIMITS.MAX_BYTES) {
+        const unsized = estimator.unsizedReferences === 0
+            ? ""
+            : ` ${estimator.unsizedReferences} reference(s) this check cannot size are counted at ${estimator.unsizedReferenceBytes} bytes each; if those ARNs are shorter, lower the "${ARN_SIZE_ESTIMATE_CONTEXT_KEY}" context.`;
+        errors.push(`The resource policy on queue ${queue.node.path} may reach ${bytes} bytes; SQS refuses a policy over ${QUEUE_POLICY_LIMITS.MAX_BYTES}. Every EventBridge rule, SNS topic or other source granted this queue adds to the one policy — split them across queues.${unsized}`);
+    }
+    return errors;
+}
+class PolicySizeEstimator {
+    #stack;
+    #resources;
+    #unsizedReferences = 0;
+    constructor(stack) {
+        this.#stack = stack;
+    }
+    /** How many references this estimator has counted at the ARN estimate. */
+    get unsizedReferences() {
+        return this.#unsizedReferences;
+    }
+    get unsizedReferenceBytes() {
+        const configured = this.#stack.node.tryGetContext(ARN_SIZE_ESTIMATE_CONTEXT_KEY);
+        return typeof configured === "number" && configured > 0
+            ? configured
+            : DEFAULT_ARN_SIZE_ESTIMATE;
+    }
+    /** Bytes of `value` serialised as compact JSON, with each intrinsic sized as the string it deploys as. */
+    jsonLength(value) {
+        if (Array.isArray(value)) {
+            return (2 +
+                Math.max(value.length - 1, 0) +
+                value.reduce((sum, item) => sum + this.jsonLength(item), 0));
+        }
+        if (isRecord(value)) {
+            const intrinsic = this.#intrinsicLength(value);
+            if (intrinsic !== undefined)
+                return intrinsic + 2;
+            const entries = Object.entries(value);
+            return (2 +
+                Math.max(entries.length - 1, 0) +
+                entries.reduce((sum, [key, item]) => sum + utf8Length(JSON.stringify(key)) + 1 + this.jsonLength(item), 0));
+        }
+        return utf8Length(JSON.stringify(value) ?? "null");
+    }
+    #intrinsicLength(value) {
+        const keys = Object.keys(value);
+        if (keys.length !== 1)
+            return undefined;
+        const [name] = keys;
+        const argument = value[name];
+        if (name === "Ref" && typeof argument === "string") {
+            return Object.hasOwn(PSEUDO_PARAMETER_MAX_LENGTH, argument)
+                ? PSEUDO_PARAMETER_MAX_LENGTH[argument]
+                : this.#refLength(argument);
+        }
+        if (name === "Fn::Join" && Array.isArray(argument)) {
+            const [separator, parts] = argument;
+            if (typeof separator === "string" && Array.isArray(parts)) {
+                return (separator.length * Math.max(parts.length - 1, 0) +
+                    parts.reduce((sum, part) => sum + this.#stringLength(part), 0));
+            }
+        }
+        if (name === "Fn::GetAtt" && Array.isArray(argument)) {
+            const [logicalId, attribute] = argument;
+            if (typeof logicalId === "string" && attribute === "Arn") {
+                return this.#arnLength(logicalId);
+            }
+        }
+        return name.startsWith("Fn::") ? this.#unknownLength() : undefined;
+    }
+    #stringLength(value) {
+        if (typeof value === "string")
+            return utf8Length(value);
+        const intrinsic = isRecord(value)
+            ? this.#intrinsicLength(value)
+            : undefined;
+        return intrinsic ?? this.#unknownLength();
+    }
+    #arnLength(logicalId) {
+        const resource = this.#resourceByLogicalId(logicalId);
+        if (resource instanceof CfnRule) {
+            const busName = resource.eventBusName;
+            const bus = busName === undefined
+                ? 0
+                : this.#stringLength(this.#stack.resolve(busName)) + 1;
+            return (ARN_PREFIX_MAX_LENGTH +
+                "events".length +
+                "rule/".length +
+                bus +
+                this.#nameLength(resource.name, RULE_NAME_MAX_LENGTH));
+        }
+        if (resource instanceof CfnQueue) {
+            return (ARN_PREFIX_MAX_LENGTH +
+                "sqs".length +
+                this.#nameLength(resource.queueName, QUEUE_NAME_MAX_LENGTH));
+        }
+        return this.#unknownLength();
+    }
+    /** `Ref` on an event bus returns its name; any other resource's `Ref` is not sized here. */
+    #refLength(logicalId) {
+        const resource = this.#resourceByLogicalId(logicalId);
+        return resource instanceof CfnEventBus
+            ? this.#nameLength(resource.name, EVENT_BUS_NAME_MAX_LENGTH)
+            : this.#unknownLength();
+    }
+    /** A name as deployed, or `bound` when CloudFormation will generate it or it resolves to an intrinsic. */
+    #nameLength(value, bound) {
+        if (value === undefined)
+            return bound;
+        const resolved = this.#stack.resolve(value);
+        return typeof resolved === "string" ? utf8Length(resolved) : bound;
+    }
+    #resourceByLogicalId(logicalId) {
+        if (this.#resources === undefined) {
+            const stack = this.#stack;
+            this.#resources = new Map(stack.node
+                .findAll()
+                .filter((construct) => construct instanceof CfnResource && Stack.of(construct) === stack)
+                .map((resource) => [stack.resolve(resource.logicalId), resource]));
+        }
+        return this.#resources.get(logicalId);
+    }
+    #unknownLength() {
+        this.#unsizedReferences++;
+        return this.unsizedReferenceBytes;
+    }
+}
+function utf8Length(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/lib/resources/aws/messaging/schedule.d.ts

@@ -31,14 +31,14 @@ export interface ScheduleProps {
     /**
      * JSON payload sent to the target on every tick (D5 — typed as
      * `Record<string, unknown>`). Translates to `message` (SQS) or `event`
-     * (Lambda / EventBus) on the underlying adapter. Values may be
-     * `EventField.*` tokens for payload-template substitution.
-     * `scheduledAt: EventField.time` is auto-injected unless the caller
-     * already provides a `scheduledAt` key.
+     * (Lambda) on the underlying adapter. Values may be `EventField.*` tokens
+     * for payload-template substitution. `scheduledAt: EventField.time` is
+     * auto-injected unless the caller already provides a `scheduledAt` key.
      *
      * Not supported on ECS targets — CDK's `EcsTask` adapter ignores arbitrary
      * input; use container command/environment overrides on the task definition
-     * instead. Passing `payload` against an ECS target throws.
+     * instead. Nor on event-bus targets, which forward the scheduled event
+     * unchanged. Passing `payload` against either throws.
      *
      * @example
      * app.addSchedule("MetricsCollection", {