@fjall/components-infrastructure 38.0.0 → 39.0.0

package/dist/lib/patterns/aws/messaging.js

@@ -1,3 +1,4 @@
+import { Key } from "aws-cdk-lib/aws-kms";
 import { EventBus as CdkEventBus } from "aws-cdk-lib/aws-events";
 import { SQSQueue, SQS_LIMITS } from "../../resources/aws/messaging/sqs.js";
 import { SNSTopic } from "../../resources/aws/messaging/sns.js";
@@ -49,11 +50,10 @@ function validateSQSProps(props) {
                 "This setting will be ignored for standard queues.");
         }
     }
-    // Validate KMS encryption
-    if (props.kmsKeyArn && props.encryption !== "SSE_KMS") {
-        FjallLogger.warn("'kmsKeyArn' provided but 'encryption' is not SSE_KMS. " +
-            "The KMS key will be ignored.");
-    }
+    // `kmsKeyArn` beside a non-KMS encryption used to warn here and then be
+    // ignored. `SQSQueue` refuses it instead — a warning that the queue is
+    // about to discard the key it was handed is not a gate, and the refusal
+    // states both cures.
 }
 /**
  * Validates SNS Topic props.
@@ -85,7 +85,11 @@ export class QueueMessaging extends SQSQueue {
             deliveryDelay: props.deliveryDelay,
             deadLetterQueue: props.deadLetterQueue,
             encryption: props.encryption,
-            kmsKeyArn: props.kmsKeyArn,
+            // Resolved in the parent scope for the same reason `alertsTopic` is:
+            // `this` does not exist before super().
+            masterKey: props.kmsKeyArn === undefined
+                ? undefined
+                : Key.fromKeyArn(scope, `${id}KmsKey`, props.kmsKeyArn),
             contentBasedDeduplication: props.contentBasedDeduplication,
             fifoThroughputLimit: props.fifoThroughputLimit,
             deduplicationScope: props.deduplicationScope,

package/dist/lib/patterns/aws/storage.d.ts

@@ -47,7 +47,35 @@ export interface S3Props {
      * that versions after all is not stamped.
      */
     readonly versioningExemption?: S3VersioningExemption;
+    /**
+     * `"AES256"` is SSE-S3: AWS's own key, free, and real encryption at rest.
+     * `"KMS"` is SSE-KMS with a key of YOUR OWN, so it requires `kmsKeyArn` —
+     * it is refused without one rather than falling back.
+     *
+     * The fallback is what this refuses. Asking CloudFormation for KMS
+     * encryption with no key makes CDK mint an `AWS::KMS::Key` of its own,
+     * `DeletionPolicy: Retain`, with no alias and no tags — an orphan every
+     * Fjall teardown sweep is blind to, because a sweep finds keys by the
+     * alias tag `CustomerManagedKey` stamps and that key carries none.
+     *
+     * Nor does the bucket quietly join the stack's shared key, the way an
+     * `"SSE_KMS"` queue does. A queue holds messages for at most fourteen
+     * days; a bucket holds objects forever, and an object is readable only
+     * with the key it was written under — so moving a live bucket's key
+     * revokes read access to everything already in it, at the same deploy
+     * that rewrites the reader's `kms:Decrypt` grant onto the new key. The
+     * choice of key for a bucket is the operator's, always.
+     */
     readonly encryption?: "AES256" | "KMS";
+    /**
+     * The customer managed key this bucket's objects are encrypted with.
+     * Implies `encryption: "KMS"` when no encryption is stated, and is refused
+     * beside `"AES256"` rather than silently ignored.
+     *
+     * An ARN rather than an `IKey` because this is the plan vocabulary the
+     * scaffold and the codemod write; a key you hold in `infrastructure.ts`
+     * passes as `key.keyArn`.
+     */
     readonly kmsKeyArn?: string;
     /**
      * S3 Bucket Keys for KMS-encrypted buckets — defaults to true when
@@ -94,6 +122,19 @@ export interface StorageBuildProps extends S3Props {
 export type StorageFactoryFn = ((app: App, scope: Construct) => Storage) & {
     stackPlacement?: "storage" | "cdn" | "compute";
 };
+/**
+ * Refuse the two `encryption`/`kmsKeyArn` pairings a bucket cannot honour.
+ *
+ * Both were warnings until 38.x, and both warnings said something untrue.
+ * `"KMS"` with no key did not fall back to "the default AWS managed key": it
+ * made CDK mint a retained, alias-less, tag-less key of its own beside a
+ * bucket that may be DESTROY — the orphan class this refusal exists for. And
+ * a key beside `"AES256"` was not "ignored": CDK refuses that pair itself,
+ * one frame later, in construct vocabulary the operator did not type.
+ *
+ * A key with NO stated encryption is neither, and is deliberately allowed —
+ * CDK infers KMS from the key, which is what the caller asked for.
+ */
 export declare function validateStorageProps(props: S3Props): void;
 export declare class Storage extends Construct implements IStorage, IStorageConnector {
     readonly connectorType: "storage";

package/dist/lib/patterns/aws/storage.js

@@ -4,7 +4,6 @@ import { Source, CacheControl } from "aws-cdk-lib/aws-s3-deployment";
 import { Key } from "aws-cdk-lib/aws-kms";
 import { CfnOutput, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
 import { BucketDeployment, S3Bucket } from "../../resources/aws/storage/index.js";
-import { FjallLogger } from "../../utils/validationLogger.js";
 export { isStorage } from "./interfaces/storage.js";
 function toBucketEncryption(encryption) {
     if (!encryption)
@@ -50,14 +49,30 @@ function resolveStorageRemovalPolicy(props) {
     }
     return props.retain ? RemovalPolicy.RETAIN : undefined;
 }
+/**
+ * Refuse the two `encryption`/`kmsKeyArn` pairings a bucket cannot honour.
+ *
+ * Both were warnings until 38.x, and both warnings said something untrue.
+ * `"KMS"` with no key did not fall back to "the default AWS managed key": it
+ * made CDK mint a retained, alias-less, tag-less key of its own beside a
+ * bucket that may be DESTROY — the orphan class this refusal exists for. And
+ * a key beside `"AES256"` was not "ignored": CDK refuses that pair itself,
+ * one frame later, in construct vocabulary the operator did not type.
+ *
+ * A key with NO stated encryption is neither, and is deliberately allowed —
+ * CDK infers KMS from the key, which is what the caller asked for.
+ */
 export function validateStorageProps(props) {
-    if (props.encryption === "KMS" && !props.kmsKeyArn) {
-        FjallLogger.warn("'encryption' is set to 'KMS' but 'kmsKeyArn' is not provided. " +
-            "The bucket will use the default AWS managed key.");
-    }
-    if (props.kmsKeyArn && props.encryption !== "KMS") {
-        FjallLogger.warn("'kmsKeyArn' is provided but 'encryption' is not set to 'KMS'. " +
-            "The KMS key will be ignored. Set encryption: 'KMS' to use the key.");
+    if (props.encryption === "KMS" && props.kmsKeyArn === undefined) {
+        throw new Error(`encryption: "KMS" needs the ARN of the key to encrypt with. Pass ` +
+            `'kmsKeyArn', or use encryption: "AES256" for S3-managed encryption ` +
+            `at rest, which costs nothing and needs no key.`);
+    }
+    if (props.kmsKeyArn !== undefined && props.encryption === "AES256") {
+        throw new Error(`'kmsKeyArn' encrypts with a key of your own and encryption: "AES256" ` +
+            `encrypts with S3's, so the pair has no meaning. Set ` +
+            `encryption: "KMS" to use the key, or drop 'kmsKeyArn' to keep ` +
+            `"AES256".`);
     }
 }
 export class Storage extends Construct {

package/dist/lib/resources/aws/backup/backupVault.d.ts

@@ -29,6 +29,16 @@ export declare class BackupVault extends Construct {
     readonly vault: Vault;
     readonly vaultArn: CfnOutput;
     readonly vaultName: CfnOutput;
+    /** The key the vault encrypts recovery points with. */
+    readonly encryptionKey: IKey;
+    /**
+     * Whether this stack created the key. A re-owned vault names a live key the
+     * stack does not manage, and `addToResourcePolicy` on an imported key is a
+     * no-op — so a caller that needs a statement on the key policy (a
+     * cross-account copy destination does) must check this and say so when it
+     * cannot apply one.
+     */
+    readonly ownsEncryptionKey: boolean;
     constructor(scope: Construct, id: string, props: BackupVaultProps);
     static build(id: string, props: BackupVaultProps): (scope: Construct) => BackupVault;
 }

package/dist/lib/resources/aws/backup/backupVault.js

@@ -18,6 +18,16 @@ export class BackupVault extends Construct {
     vault;
     vaultArn;
     vaultName;
+    /** The key the vault encrypts recovery points with. */
+    encryptionKey;
+    /**
+     * Whether this stack created the key. A re-owned vault names a live key the
+     * stack does not manage, and `addToResourcePolicy` on an imported key is a
+     * no-op — so a caller that needs a statement on the key policy (a
+     * cross-account copy destination does) must check this and say so when it
+     * cannot apply one.
+     */
+    ownsEncryptionKey;
     constructor(scope, id, props) {
         super(scope, id);
         // RETAIN default: a DESTROY-policy vault is silently deleted with the stack.
@@ -41,6 +51,8 @@ export class BackupVault extends Construct {
                 removalPolicy
             }).key;
         }
+        this.encryptionKey = encryptionKey;
+        this.ownsEncryptionKey = props.encryptionKey === undefined;
         this.vault = new Vault(this, `${props.vaultName}Vault`, {
             backupVaultName: props.vaultName,
             encryptionKey,

package/dist/lib/resources/aws/compute/ecs.d.ts

@@ -152,11 +152,14 @@ export default class EcsCluster extends Construct implements IConnectable {
     private addServiceToCluster;
     private setupConnections;
     /**
-     * Create DeployableService outputs for deployment automation.
-     * Each service gets a DeployableService output so the deployment service
-     * can find and deploy all services in the cluster.
+     * The outputs the deploy engine's `EcsServiceResolver` reads to find this
+     * cluster's services: the cluster's `DeployableCluster` and `ClusterArn`,
+     * then one `DeployableService` per service. Export names come from
+     * `@fjall/util`'s `stackExportNames` builders — the same functions the
+     * resolver rebuilds them with — and the output keys keep the PascalCase
+     * form a logical id needs.
      */
-    private addDeployableServiceOutputs;
+    private addDeployableOutputs;
     /** Checks if any service in the cluster uses a Fargate capacity provider. */
     private anyServiceUsesFargate;
     /** Checks if any service in the cluster uses an EC2 capacity provider. */

package/dist/lib/resources/aws/compute/ecs.js

@@ -8,7 +8,7 @@ import { tierDefault } from "../../../utils/backupTierMapping.js";
 import { envAwareRemovalPolicyDefault } from "../../../utils/removalPolicy.js";
 import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
-import { stackScopedExportName } from "../../../utils/exportNaming.js";
+import { clusterArnExportName, deployableClusterExportName, deployableServiceExportName } from "@fjall/util";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { createEcsServiceAlarms, createEcsTaskStopWatchdog, createLogPatternAlarms } from "../monitoring/index.js";
 // Extracted modules
@@ -177,7 +177,9 @@ export default class EcsCluster extends Construct {
                 applicationId: props.applicationId
             });
         }
-        this.addDeployableServiceOutputs(props);
+        if (props.deployableServices !== false) {
+            this.addDeployableOutputs(props);
+        }
         this.connections = this.setupConnections(props);
         Aspects.of(this).add(new CapacityProviderDependencyAspect(this.cluster));
     }
@@ -412,16 +414,31 @@ export default class EcsCluster extends Construct {
         });
     }
     /**
-     * Create DeployableService outputs for deployment automation.
-     * Each service gets a DeployableService output so the deployment service
-     * can find and deploy all services in the cluster.
+     * The outputs the deploy engine's `EcsServiceResolver` reads to find this
+     * cluster's services: the cluster's `DeployableCluster` and `ClusterArn`,
+     * then one `DeployableService` per service. Export names come from
+     * `@fjall/util`'s `stackExportNames` builders — the same functions the
+     * resolver rebuilds them with — and the output keys keep the PascalCase
+     * form a logical id needs.
      */
-    addDeployableServiceOutputs(props) {
+    addDeployableOutputs(props) {
+        const stackName = Stack.of(this).stackName;
+        new CfnOutput(this, `${this.outputName}DeployableCluster`, {
+            key: `${this.outputName}DeployableCluster`,
+            exportName: deployableClusterExportName(stackName, props.clusterName),
+            value: this.cluster.clusterArn
+        });
+        new CfnOutput(this, `${this.outputName}ClusterArn`, {
+            key: `${this.outputName}ClusterArn`,
+            exportName: clusterArnExportName(stackName, props.clusterName),
+            value: this.cluster.clusterArn,
+            description: `ECS Cluster ARN for ${props.clusterName}`
+        });
         for (const [serviceName, serviceData] of this.services) {
-            const safeServiceName = toPascalCase(serviceName);
-            new CfnOutput(this, `${this.outputName}${safeServiceName}DeployableService`, {
-                key: `${this.outputName}${safeServiceName}DeployableService`,
-                exportName: stackScopedExportName(this, `${props.clusterName}${serviceName}DeployableService`),
+            const outputKey = `${this.outputName}${toPascalCase(serviceName)}DeployableService`;
+            new CfnOutput(this, outputKey, {
+                key: outputKey,
+                exportName: deployableServiceExportName(stackName, props.clusterName, serviceName),
                 value: serviceData.service.serviceArn,
                 description: `Deployable ECS Service ARN for ${serviceName} in ${props.clusterName}`
             });
@@ -467,17 +484,6 @@ export default class EcsCluster extends Construct {
                 }
             }
         });
-        new CfnOutput(this, `${this.outputName}DeployableCluster`, {
-            key: `${this.outputName}DeployableCluster`,
-            exportName: stackScopedExportName(this, `${props.clusterName}DeployableCluster`),
-            value: cluster.clusterArn
-        });
-        new CfnOutput(this, `${this.outputName}ClusterArn`, {
-            key: `${this.outputName}ClusterArn`,
-            exportName: stackScopedExportName(this, `${props.clusterName}ClusterArn`),
-            value: cluster.clusterArn,
-            description: `ECS Cluster ARN for ${props.clusterName}`
-        });
         return cluster;
     }
     static build(id, props) {

package/dist/lib/resources/aws/compute/ecsServiceFactory.js

@@ -195,6 +195,9 @@ export function getOrCreateAsgCapacityProvider(ctx, serviceProps, state) {
                 ...(ec2Config.persistentDataVolume.alarmTopic === undefined &&
                     ctx.props.alertsTopic !== undefined && {
                     alarmTopic: ctx.props.alertsTopic
+                }),
+                ...(ctx.props.appBackupTier !== undefined && {
+                    appBackupTier: ctx.props.appBackupTier
                 })
             },
             // Pinned slots reproduce the deployed fjall:OwnerLogicalId verbatim —

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -763,6 +763,17 @@ export interface EcsClusterProps {
      * auditable opt-out for cost-sensitive clusters.
      */
     taskStopWatchdog?: false;
+    /**
+     * Deployable-service exports (default on): one `DeployableService` output
+     * per service plus the cluster's `DeployableCluster` and `ClusterArn`
+     * outputs, named by `@fjall/util`'s `stackExportNames` builders. The
+     * deploy engine's `EcsServiceResolver` reads the app's Compute stack
+     * outputs to find the ECS services that `fjall services`, `fjall rollout`,
+     * `fjall restart`, a code-only deploy and a rollback act on. `false` opts
+     * out a cluster hosting an infrastructure service, so the resolver never
+     * binds it as an app service.
+     */
+    deployableServices?: false;
     /**
      * CloudWatch Container Insights. Default: the app backup tier's
      * `containerInsights` column (on at enterprise, off below). Enabling it

package/dist/lib/resources/aws/compute/ecsValidation.d.ts

@@ -26,6 +26,14 @@ import type { DomainConfig, EcsCapacityProvider, EcsClusterProps } from "./ecsTy
  * a field on `EcsServiceProps`, so a direct `new EcsCluster(...)` consumer
  * cannot pass it and there is no resources-layer code path to validate.
  *
+ * Same applies to `cluster.scheduledTasks`: the whole array is a patterns-
+ * layer field on `EcsClusterConfig`, materialised into `Ec2TaskDefinition`s
+ * and `app.addSchedule(...)` calls by `materialiseScheduledTasks` in
+ * `computeEcs.ts`. Its two per-entry refusals (`networkMode: AWS_VPC`, and
+ * `logGroup` together with `logRetention`) therefore run in `validateEcsProps`
+ * only. `EcsClusterProps` carries no `scheduledTasks` field, so a mirror here
+ * would be unreachable.
+ *
  * @param props - The cluster props to validate
  * @param annotationsScope - When provided (the `EcsCluster` constructor passes
  *   `this`), non-fatal findings from {@link validateEc2TaskMemoryFit} are

package/dist/lib/resources/aws/compute/ecsValidation.js

@@ -32,6 +32,14 @@ import { validateSharedEc2CapacityConfig } from "./ecsCapacityConfig.js";
  * a field on `EcsServiceProps`, so a direct `new EcsCluster(...)` consumer
  * cannot pass it and there is no resources-layer code path to validate.
  *
+ * Same applies to `cluster.scheduledTasks`: the whole array is a patterns-
+ * layer field on `EcsClusterConfig`, materialised into `Ec2TaskDefinition`s
+ * and `app.addSchedule(...)` calls by `materialiseScheduledTasks` in
+ * `computeEcs.ts`. Its two per-entry refusals (`networkMode: AWS_VPC`, and
+ * `logGroup` together with `logRetention`) therefore run in `validateEcsProps`
+ * only. `EcsClusterProps` carries no `scheduledTasks` field, so a mirror here
+ * would be unreachable.
+ *
  * @param props - The cluster props to validate
  * @param annotationsScope - When provided (the `EcsCluster` constructor passes
  *   `this`), non-fatal findings from {@link validateEc2TaskMemoryFit} are

package/dist/lib/resources/aws/compute/persistentDataVolume.d.ts

@@ -3,6 +3,7 @@ import { Alarm } from "aws-cdk-lib/aws-cloudwatch";
 import { EbsDeviceVolumeType, Volume } from "aws-cdk-lib/aws-ec2";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { Construct } from "constructs";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import { LambdaFunction } from "./lambda.js";
 import { SQSQueue } from "../messaging/sqs.js";
 /**
@@ -53,6 +54,13 @@ export interface PersistentDataVolumeProps {
      * re-attach queue's DLQ-depth alarm (created only when the topic is set).
      */
     alarmTopic?: ITopic;
+    /**
+     * The application's backup tier. Enrols the volume in the matching AWS
+     * Backup plan via the disaster-recovery tier tag. Independent of the
+     * volume's `SNAPSHOT` removal policy, which only covers a clean destroy:
+     * the plan's recovery points are the copies that reach the DR region.
+     */
+    appBackupTier?: BackupTier;
 }
 /**
  * Standalone EBS data volume + ASG `EC2_INSTANCE_LAUNCHING` hook that

package/dist/lib/resources/aws/compute/persistentDataVolume.js

@@ -10,6 +10,7 @@ import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { Construct } from "constructs";
+import { tagBackupTier } from "../../../utils/backupTierMapping.js";
 import { attachInlineAsgLifecycleHook } from "./asgInlineLifecycleHook.js";
 import { LambdaFunction } from "./lambda.js";
 import { SQSQueue } from "../messaging/sqs.js";
@@ -104,6 +105,7 @@ export class PersistentDataVolume extends Construct {
         Tags.of(this.volume).add(PERSISTENT_DATA_VOLUME_TAG_LIFECYCLE, PERSISTENT_DATA_VOLUME_TAG_LIFECYCLE_VALUE);
         Tags.of(this.volume).add(PERSISTENT_DATA_VOLUME_TAG_OWNER_LOGICAL_ID, this.ownerLogicalId);
         Tags.of(this.volume).add(PERSISTENT_DATA_VOLUME_TAG_STACK_ID, Aws.STACK_ID);
+        tagBackupTier(this.volume, props.appBackupTier);
         this.queue = new SQSQueue(this, `${id}Queue`, {
             visibilityTimeout: QUEUE_VISIBILITY_TIMEOUT_SECONDS,
             deadLetterQueue: { enabled: true, maxReceiveCount: 5 },

package/dist/lib/resources/aws/database/dynamodb.js

@@ -1,6 +1,6 @@
 import { Construct } from "constructs";
 import { CfnOutput } from "aws-cdk-lib";
-import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { tagBackupTier, tierDefault } from "../../../utils/backupTierMapping.js";
 import { toRemovalPolicy } from "../../../utils/removalPolicy.js";
 import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { Table, AttributeType, BillingMode, StreamViewType, ProjectionType, TableEncryption } from "aws-cdk-lib/aws-dynamodb";
@@ -98,6 +98,7 @@ export class DynamoDBTable extends Construct {
             removalPolicy: toRemovalPolicy(props.removalPolicy),
             timeToLiveAttribute: props.timeToLiveAttribute
         });
+        tagBackupTier(this.table, props.appBackupTier);
         if (props.globalSecondaryIndexes) {
             for (const gsi of props.globalSecondaryIndexes) {
                 const gsiProps = {

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -6,7 +6,7 @@ import { Construct } from "constructs";
 import { SecurityGroup } from "../networking/securityGroup.js";
 import { Secret } from "../secrets/index.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
-import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { tagBackupTier, tierDefault } from "../../../utils/backupTierMapping.js";
 import { addProxyCfnOutput } from "./rdsProxyOutput.js";
 import { getCdkDatabaseInsightsMode, getDatabaseInsightsRetention } from "./index.js";
 import { RDS_DEFAULTS, SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS, SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS, MIN_AUTO_PAUSE_POSTGRES_VERSION } from "./rdsDefaults.js";
@@ -255,6 +255,11 @@ export class RdsAurora extends Construct {
             this.databaseCluster = new DatabaseCluster(this, `${id}Database`, clusterProps);
         }
         this.cfnCluster = this.databaseCluster.node.defaultChild;
+        // The L1, not the L2: AWS Backup protects the Aurora cluster, and a tag on
+        // the DatabaseCluster construct would propagate to every member instance,
+        // each of which would then be selected as an RDS instance it cannot back
+        // up.
+        tagBackupTier(this.cfnCluster, props.appBackupTier);
         // Global secondary clusters can't specify these properties
         if (props.isGlobalSecondary && this.cfnCluster) {
             this.cfnCluster.masterUsername = undefined;

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -13,7 +13,7 @@ import { RDS_DEFAULTS } from "./rdsDefaults.js";
 import { DEFAULT_POSTGRES_ENGINE_CONFIG, resolveDatabaseInsights, resolveStorageEncryptionKey, resolvePerformanceInsightsKey, addMultiUserSecretRotation, warnIfSnapshotUsernameAssumed } from "./rdsHelpers.js";
 import { resolveSecretRotation, isCMKRequested } from "../../../utils/databaseTypes.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
-import { tierDefault } from "../../../utils/backupTierMapping.js";
+import { tagBackupTier, tierDefault } from "../../../utils/backupTierMapping.js";
 import { addProxyCfnOutput } from "./rdsProxyOutput.js";
 import { createRdsAlarms } from "../monitoring/index.js";
 export class RdsInstance extends Construct {
@@ -189,6 +189,11 @@ export class RdsInstance extends Construct {
                 credentials: Credentials.fromSecret(this.databaseCredentials.secret)
             });
         }
+        // The L1, not the L2: a tag on the DatabaseInstance construct propagates
+        // to the subnet group it creates. The read replica added below is
+        // deliberately left untagged — AWS Backup would protect it as a second
+        // full copy of storage the primary's own recovery points already hold.
+        tagBackupTier(this.database.node.defaultChild, props.appBackupTier);
     }
     rotateSecret(rotationConfig) {
         this.masterSecret = addMultiUserSecretRotation({

package/dist/lib/resources/aws/logging/accessLogBucket.d.ts

@@ -21,7 +21,7 @@ export declare const ACCESS_LOG_RETENTION_DAYS = 90;
  * `open`. The bucket takes the env-aware removal policy like every other
  * bucket: production RETAINs its audit evidence, non-production DESTROYs.
  *
- * Migration from 33.0.0–36.x: CloudFront standard (legacy) logging granted
+ * Migration from 33.0.0–37.x: CloudFront standard (legacy) logging granted
  * its `awslogsdelivery` canonical user FULL_CONTROL on the bucket ACL and
  * never removes it, so on a bucket legacy logging wrote to the ownership
  * flip fails with `InvalidBucketAclWithObjectOwnership`. Cure once, then

package/dist/lib/resources/aws/logging/accessLogBucket.js

@@ -23,7 +23,7 @@ export const ACCESS_LOG_RETENTION_DAYS = 90;
  * `open`. The bucket takes the env-aware removal policy like every other
  * bucket: production RETAINs its audit evidence, non-production DESTROYs.
  *
- * Migration from 33.0.0–36.x: CloudFront standard (legacy) logging granted
+ * Migration from 33.0.0–37.x: CloudFront standard (legacy) logging granted
  * its `awslogsdelivery` canonical user FULL_CONTROL on the bucket ACL and
  * never removes it, so on a bucket legacy logging wrote to the ownership
  * flip fails with `InvalidBucketAclWithObjectOwnership`. Cure once, then

package/dist/lib/resources/aws/logging/cloudTrail.js

@@ -42,6 +42,9 @@ export class Trail extends Construct {
             encryptionKey: this.encryptionKey.key,
             versioned: true,
             removalPolicy: storagePolicy,
+            // CloudTrail delivers here continuously under the 365-day rule below;
+            // the audit record is the trail, not a restorable application state.
+            backupExemption: "log-delivery",
             // Custom lifecycleRules bypass S3Bucket's automatic
             // noncurrentVersionExpiration pairing — carried explicitly, or
             // noncurrent versions accumulate forever.

package/dist/lib/resources/aws/messaging/eventBridgeQueueGrants.d.ts

@@ -1,5 +1,7 @@
 import { type IRuleRef } from "aws-cdk-lib/aws-events";
 import type { IQueue } from "aws-cdk-lib/aws-sqs";
+/** EventBridge's service principal — the sender every grant in this module admits. */
+export declare const EVENTBRIDGE_SERVICE_PRINCIPAL = "events.amazonaws.com";
 /**
  * Let `rule` deliver to `queue`. Not for a queue encrypted with a customer
  * managed key: naming the rule there closes a dependency cycle through the

package/dist/lib/resources/aws/messaging/eventBridgeQueueGrants.js

@@ -2,7 +2,8 @@ import { Construct } from "constructs";
 import { Annotations, Lazy, Names, Token, TokenComparison } from "aws-cdk-lib";
 import { CfnRule } from "aws-cdk-lib/aws-events";
 import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
-const EVENTBRIDGE_SERVICE_PRINCIPAL = "events.amazonaws.com";
+/** EventBridge's service principal — the sender every grant in this module admits. */
+export const EVENTBRIDGE_SERVICE_PRINCIPAL = "events.amazonaws.com";
 /** The actions `IQueue.grantSendMessages` grants — what CDK's SQS rule target allows. */
 const RULE_TARGET_ACTIONS = [
     "sqs:SendMessage",

package/dist/lib/resources/aws/messaging/eventBridgeRule.js

@@ -1,9 +1,10 @@
 import { Construct } from "constructs";
-import { Duration } from "aws-cdk-lib";
+import { Annotations, Duration } from "aws-cdk-lib";
 import { Rule } from "aws-cdk-lib/aws-events";
-import { ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { SQSQueue, SQS_LIMITS } from "./sqs.js";
 import { resolveTarget } from "./eventTargets.js";
+import { EVENTBRIDGE_SERVICE_PRINCIPAL } from "./eventBridgeQueueGrants.js";
 import { createScheduleAlarms } from "../monitoring/scheduleAlarms.js";
 import { createSqsDlqAlarms } from "../monitoring/sqsAlarms.js";
 /**
@@ -36,7 +37,7 @@ export class EventBridgeRule extends Construct {
         const dlq = dlqResolution?.queue;
         if (dlq !== undefined)
             this.deadLetterQueue = dlq;
-        grantKmsDecryptToEventBridge(dlq);
+        grantKmsDecryptToEventBridge(this, dlq);
         const retryPolicy = resolveRetryPolicy(props.kind, props.retryPolicy);
         const targetAdapter = resolveTarget(props.target, {
             retryPolicy,
@@ -84,13 +85,43 @@ export class EventBridgeRule extends Construct {
         return this.#rule.ruleArn;
     }
 }
-function grantKmsDecryptToEventBridge(dlq) {
+/**
+ * Actions EventBridge needs on a dead-letter queue's key to encrypt the
+ * event it is dropping there.
+ */
+const EVENTBRIDGE_DLQ_KEY_ACTIONS = ["kms:Decrypt", "kms:GenerateDataKey"];
+/**
+ * Admit EventBridge to a CMK-encrypted dead-letter queue's key.
+ *
+ * Written as an `addToResourcePolicy` rather than `IKey.grant` because only
+ * the former reports whether the statement landed. A key imported by ARN —
+ * what `kmsKeyArn` on the patterns layer produces — carries no policy
+ * document CDK can write, and `grant` returns a Grant whose `success` is
+ * `true` regardless, so the admission would be lost in silence. It is the
+ * worst place to lose one: SQS DROPS a send its key refuses instead of
+ * returning an error, so the failure surfaces only as a dead letter that
+ * never arrives, long after the deploy that caused it.
+ *
+ * The warning therefore names the statement the key's owner must add. Fjall
+ * cannot add it: the key is theirs, and it may not even be in this account.
+ */
+function grantKmsDecryptToEventBridge(scope, dlq) {
     if (dlq === undefined)
         return;
     const key = dlq.getQueue().encryptionMasterKey;
     if (key === undefined)
         return;
-    key.grant(new ServicePrincipal("events.amazonaws.com"), "kms:Decrypt", "kms:GenerateDataKey");
+    const admitted = key.addToResourcePolicy(new PolicyStatement({
+        principals: [new ServicePrincipal(EVENTBRIDGE_SERVICE_PRINCIPAL)],
+        actions: EVENTBRIDGE_DLQ_KEY_ACTIONS,
+        resources: ["*"]
+    })).statementAdded;
+    if (admitted)
+        return;
+    Annotations.of(scope).addWarningV2("@fjall/components-infrastructure:eventBridgeDeadLetterKeyNotAdmitted", `The dead-letter queue's KMS key is imported, so this stack cannot add ` +
+        `to its key policy. Add ${EVENTBRIDGE_DLQ_KEY_ACTIONS.join(" + ")} for ` +
+        `${EVENTBRIDGE_SERVICE_PRINCIPAL} to the key yourself, or SQS will ` +
+        `silently drop every event EventBridge dead-letters to this queue.`);
 }
 function resolveRetryPolicy(kind, override) {
     if (override !== undefined)

package/dist/lib/resources/aws/messaging/sqs.d.ts

@@ -1,6 +1,7 @@
 import { Construct } from "constructs";
 import { type IQueue } from "aws-cdk-lib/aws-sqs";
 import { type IGrantable, type Grant } from "aws-cdk-lib/aws-iam";
+import { type IKey } from "aws-cdk-lib/aws-kms";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type RemovalPolicyString } from "./utils.js";
 import { type SqsAlarmThresholds } from "../monitoring/index.js";
@@ -57,8 +58,42 @@ export interface SQSQueueProps {
         maxReceiveCount?: number;
         queue?: IQueue;
     };
+    /**
+     * Server-side encryption at rest. Defaults to `"SSE_SQS"` — the SQS-owned
+     * managed key, which is free, needs no key policy and satisfies
+     * `sqs-queue-not-encrypted`.
+     *
+     * `"SSE_KMS"` encrypts with a customer-managed key: `masterKey` when you
+     * bring one, else the stack's shared {@link StackEncryptionKey} with the
+     * SQS senders admitted to it. It deliberately does NOT fall through to
+     * what CDK would do unaided — mint an implicit `AWS::KMS::Key` that is
+     * `DeletionPolicy: Retain` with no alias and no tags, admitting only the
+     * account root. Such a key is invisible to every Fjall teardown sweep
+     * (they find keys by the alias tag `CustomerManagedKey` stamps), so it
+     * outlives the stack as a charge nothing can attribute — and because its
+     * policy admits no service principal, no EventBridge rule, S3 notification
+     * or SNS subscription could send to the queue either.
+     *
+     * Unlike SNS, this does not follow the app's backup tier. `"SSE_SQS"` is
+     * real encryption at rest at every tier and costs nothing, and the tier's
+     * `customerManagedKeys` column enumerates the resources it owns (DynamoDB
+     * tables, SNS topics, Lambda environment, ECS Exec, log groups) — queues
+     * are not among them, so the opt-in here is the caller's.
+     */
     encryption?: "SSE_SQS" | "SSE_KMS" | "NONE";
-    kmsKeyArn?: string;
+    /**
+     * Bring your own KMS key. Implies `encryption: "SSE_KMS"` when no
+     * encryption is stated, and is REFUSED beside `"SSE_SQS"` or `"NONE"`
+     * rather than silently ignored.
+     *
+     * Every AWS service principal that sends to the queue needs `kms:Decrypt`
+     * + `kms:GenerateDataKey*` on this key's RESOURCE policy or its sends are
+     * dropped without an error — the key policy is the only place a service
+     * principal can be admitted. The stack key's own admission
+     * ({@link StackEncryptionKey.forSqsServicePublishers}) is not applied to a
+     * key you brought: it is yours to scope.
+     */
+    masterKey?: IKey;
     contentBasedDeduplication?: boolean;
     fifoThroughputLimit?: "perQueue" | "perMessageGroupId";
     deduplicationScope?: "queue" | "messageGroup";