@fjall/components-infrastructure 38.0.0 → 39.0.1

package/dist/lib/app.d.ts

@@ -54,10 +54,15 @@ export interface IAppOptions {
     };
     /**
      * Backup configuration for automatic AWS Backup enrolment.
-     * - Object with tier: Tags all resources with `fjall:disasterRecovery:tier`
-     *   and sets the app backup tier that resource defaults derive from — S3
-     *   buckets version by default at `resilient`/`enterprise`; a per-bucket
-     *   `backupVaultTier` overrides the tier for that bucket.
+     * - Object with tier: stamps `fjall:disasterRecovery:tier` on the resource
+     *   types AWS Backup can protect — DynamoDB tables, RDS clusters and
+     *   instances, the EBS volumes Fjall keeps state on, and versioned S3
+     *   buckets — and sets the app backup tier that resource defaults derive
+     *   from. The backup selection built from that tag carries no resource-type
+     *   filter, so the tag IS the selection: it is applied by the constructs
+     *   that own those resources, not across the app. S3 buckets version by
+     *   default at `resilient`/`enterprise`; a per-bucket `backupVaultTier`
+     *   overrides the tier for that bucket.
      * - false: Explicitly disabled (no backup tag, no tier-derived defaults)
      */
     backup?: {
@@ -148,14 +153,16 @@ export declare class App extends CdkApp {
      */
     getStack(key: string, dependencies?: AwsStack | AwsStack[], props?: AwsStackProps): AwsStack;
     /**
-     * Retrieve default compute stack - named as `${this.name}Compute`
+     * Retrieve default compute stack, named by
+     * `getApplicationStackName(name, "Compute")`.
      *
      * Only depends on Network. Database dependency is added automatically
      * by CDK when compute resources reference database resources.
      */
     getDefaultComputeStack(): AwsStack;
     /**
-     * Retrieve default network stack - named as `${this.name}Network`
+     * Retrieve default network stack, named by
+     * `getApplicationStackName(name, "Network")`.
      */
     getDefaultNetworkStack(): AwsStack;
     /**
@@ -171,15 +178,18 @@ export declare class App extends CdkApp {
      */
     private networkDependency;
     /**
-     * Retrieve default database stack - named as `${this.name}Database`
+     * Retrieve default database stack, named by
+     * `getApplicationStackName(name, "Database")`.
      */
     getDefaultDatabaseStack(): AwsStack;
     /**
-     * Retrieve default storage stack - named as `${this.name}Storage`
+     * Retrieve default storage stack, named by
+     * `getApplicationStackName(name, "Storage")`.
      */
     getDefaultStorageStack(): AwsStack;
     /**
-     * Retrieve default CDN stack - named as `${this.name}Cdn`
+     * Retrieve default CDN stack, named by
+     * `getApplicationStackName(name, "Cdn")`.
      *
      * Depends on Network when networking is enabled. Compute/Storage dependencies
      * are added automatically by CDK when CDN resources reference ALB or S3 bucket
@@ -189,7 +199,8 @@ export declare class App extends CdkApp {
      */
     getDefaultCdnStack(): AwsStack;
     /**
-     * Retrieve default messaging stack - named as `${this.name}Messaging`
+     * Retrieve default messaging stack, named by
+     * `getApplicationStackName(name, "Messaging")`.
      *
      * Used for SQS queues, SNS topics, and EventBridge event buses.
      * Depends on Network only. These are regional services that don't
@@ -197,8 +208,9 @@ export declare class App extends CdkApp {
      */
     getDefaultMessagingStack(): AwsStack;
     /**
-     * Retrieve the app-owned us-east-1 certificate stack — named
-     * `${this.name}UsEast1Certificates` (domain gold-plating D3, BYO path).
+     * Retrieve the app-owned us-east-1 certificate stack, named by
+     * `getApplicationStackName(name, "UsEast1Certificates")` (domain
+     * gold-plating D3, BYO path).
      *
      * CloudFront accepts viewer certificates from us-east-1 only, so
      * CloudFront-consuming patterns (staticsite, payload) whose app deploys to

package/dist/lib/app.js

@@ -1,5 +1,5 @@
 import { App as CdkApp, Aspects, Tags } from "aws-cdk-lib";
-import { maskSensitiveOutput } from "@fjall/util";
+import { APPLICATION_STACKS, defaultVpcConstructId, getApplicationStackName, maskSensitiveOutput } from "@fjall/util";
 import { RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS } from "aws-cdk-lib/cx-api";
 import { Vpc } from "./resources/aws/networking/vpc.js";
 import { createBastion } from "./patterns/aws/bastionFactory.js";
@@ -16,7 +16,6 @@ import { DeployTimeWriterMarkerAspect } from "./utils/deployTimeWriterMarkerAspe
 import { emitAppLevelAlbAliasExports } from "./utils/albAliasTargetRegistry.js";
 import { emitAppLevelCdnAliasExports } from "./utils/cdnAliasTargetRegistry.js";
 import { ensureFunctionLogGroups } from "./resources/aws/logging/logGroupHygiene.js";
-import { BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP } from "./utils/backupTierMapping.js";
 import { randomBytes } from "crypto";
 import { getConfig } from "./utils/getConfig.js";
 import AuditRoleFactory from "./resources/aws/audit/auditRole.js";
@@ -90,12 +89,12 @@ export class App extends CdkApp {
     applyBackupTier(tier) {
         if (this.backupTierObserved) {
             throw new Error(`Backup tier "${tier}" applied after a resource already resolved the app's tier: ` +
-                `that resource would carry the tier's disaster-recovery tag without its versioning default. ` +
+                `that resource is already built at the tier it read — its versioning default, ` +
+                `its backup enrolment and every other tier-owned default are synthesised. ` +
                 `Pass \`backup\` on the first App.getApp("${this.name}") call, before addStorage(), ` +
                 `addBuildkite() or a Payload pattern.`);
         }
         this.backupTier = tier;
-        this.globalTags[BACKUP_TIER_TAG_KEY] = BACKUP_TIER_TAG_MAP[tier];
     }
     initialiseTunnel(config) {
         if (this.networkDisabled || !this.vpc) {
@@ -113,7 +112,7 @@ export class App extends CdkApp {
         }
         else {
             const networkConfig = { ...config, vpcName: config.vpcName ?? this.name };
-            const network = NetworkFactory.build(`${this.stackPrefix}Vpc`, networkConfig)(this, networkStack.getStack());
+            const network = NetworkFactory.build(defaultVpcConstructId(this.name), networkConfig)(this, networkStack.getStack());
             this.vpc = network.getVpc();
         }
     }
@@ -146,7 +145,7 @@ export class App extends CdkApp {
                 // Warn if network already initialised - changing name after network exists creates a mismatch
                 if (App.instance.vpc) {
                     FjallLogger.warn(`App name changed from "${App.instance.name}" to "${name}" after network was initialised. ` +
-                        `VPC will have name "${App.instance.name}Vpc" but app name is "${name}". ` +
+                        `VPC construct id will be "${defaultVpcConstructId(App.instance.name)}" but app name is "${name}". ` +
                         `Ensure App.getApp() is called with the final name before initialising network.`);
                 }
                 App.instance.name = name;
@@ -230,19 +229,21 @@ export class App extends CdkApp {
         return this.stacks[key];
     }
     /**
-     * Retrieve default compute stack - named as `${this.name}Compute`
+     * Retrieve default compute stack, named by
+     * `getApplicationStackName(name, "Compute")`.
      *
      * Only depends on Network. Database dependency is added automatically
      * by CDK when compute resources reference database resources.
      */
     getDefaultComputeStack() {
-        return this.getStack(`${this.stackPrefix}Compute`, this.networkDependency());
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.COMPUTE), this.networkDependency());
     }
     /**
-     * Retrieve default network stack - named as `${this.name}Network`
+     * Retrieve default network stack, named by
+     * `getApplicationStackName(name, "Network")`.
      */
     getDefaultNetworkStack() {
-        return this.getStack(`${this.stackPrefix}Network`);
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.NETWORK));
     }
     /**
      * The Network stack as a dependency, or `undefined` when the app is
@@ -259,19 +260,22 @@ export class App extends CdkApp {
         return this.networkDisabled ? undefined : this.getDefaultNetworkStack();
     }
     /**
-     * Retrieve default database stack - named as `${this.name}Database`
+     * Retrieve default database stack, named by
+     * `getApplicationStackName(name, "Database")`.
      */
     getDefaultDatabaseStack() {
-        return this.getStack(`${this.stackPrefix}Database`, this.networkDependency());
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.DATABASE), this.networkDependency());
     }
     /**
-     * Retrieve default storage stack - named as `${this.name}Storage`
+     * Retrieve default storage stack, named by
+     * `getApplicationStackName(name, "Storage")`.
      */
     getDefaultStorageStack() {
-        return this.getStack(`${this.stackPrefix}Storage`, this.networkDependency());
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.STORAGE), this.networkDependency());
     }
     /**
-     * Retrieve default CDN stack - named as `${this.name}Cdn`
+     * Retrieve default CDN stack, named by
+     * `getApplicationStackName(name, "Cdn")`.
      *
      * Depends on Network when networking is enabled. Compute/Storage dependencies
      * are added automatically by CDK when CDN resources reference ALB or S3 bucket
@@ -283,23 +287,23 @@ export class App extends CdkApp {
         // crossRegionReferences is enabled at creation so the Cdn stack can
         // consume a us-east-1 certificate (domain gold-plating D3, BYO path).
         // The flag is inert unless a cross-region reference is synthesised.
-        return this.getStack(`${this.stackPrefix}Cdn`, this.networkDependency(), {
-            crossRegionReferences: true
-        });
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.CDN), this.networkDependency(), { crossRegionReferences: true });
     }
     /**
-     * Retrieve default messaging stack - named as `${this.name}Messaging`
+     * Retrieve default messaging stack, named by
+     * `getApplicationStackName(name, "Messaging")`.
      *
      * Used for SQS queues, SNS topics, and EventBridge event buses.
      * Depends on Network only. These are regional services that don't
      * require VPC, but we maintain consistent stack dependency patterns.
      */
     getDefaultMessagingStack() {
-        return this.getStack(`${this.stackPrefix}Messaging`, this.networkDependency());
+        return this.getStack(getApplicationStackName(this.name, APPLICATION_STACKS.MESSAGING), this.networkDependency());
     }
     /**
-     * Retrieve the app-owned us-east-1 certificate stack — named
-     * `${this.name}UsEast1Certificates` (domain gold-plating D3, BYO path).
+     * Retrieve the app-owned us-east-1 certificate stack, named by
+     * `getApplicationStackName(name, "UsEast1Certificates")` (domain
+     * gold-plating D3, BYO path).
      *
      * CloudFront accepts viewer certificates from us-east-1 only, so
      * CloudFront-consuming patterns (staticsite, payload) whose app deploys to
@@ -312,7 +316,7 @@ export class App extends CdkApp {
      * Custom::CrossRegionExportWriter/Reader pair is pinned by template test.
      */
     getUsEast1CertificateStack() {
-        return this.getUsEast1Stack("UsEast1Certificates", "certificate");
+        return this.getUsEast1Stack(APPLICATION_STACKS.US_EAST_1_CERTIFICATES, "certificate");
     }
     /**
      * Retrieve the app-owned us-east-1 CloudFront logging stack — named
@@ -332,7 +336,7 @@ export class App extends CdkApp {
      * asset hash) through this stack's references.
      */
     getUsEast1CdnLoggingStack() {
-        return this.getUsEast1Stack("UsEast1CdnLogging", "CloudFront logging");
+        return this.getUsEast1Stack(APPLICATION_STACKS.US_EAST_1_CDN_LOGGING, "CloudFront logging");
     }
     /**
      * The two us-east-1 stacks share a shape: no stack dependencies of their
@@ -343,8 +347,8 @@ export class App extends CdkApp {
      * emitted Custom::CrossRegionExportWriter/Reader pair is pinned by
      * template test.
      */
-    getUsEast1Stack(suffix, purpose) {
-        const key = `${this.stackPrefix}${suffix}`;
+    getUsEast1Stack(stack, purpose) {
+        const key = getApplicationStackName(this.name, stack);
         if (!this.stacks[key]) {
             const account = process.env.CDK_DEFAULT_ACCOUNT;
             if (!account) {

package/dist/lib/config/aws/configRecorder.js

@@ -25,6 +25,9 @@ export class ConfigRecorder extends Construct {
             blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
             versioned: true,
             removalPolicy: RemovalPolicy.RETAIN,
+            // AWS Config delivers configuration snapshots here on its own schedule
+            // and the 90-day rule below is the retention; nothing restores from it.
+            backupExemption: "log-delivery",
             lifecycleRules: [
                 {
                     expiration: Duration.days(90),

package/dist/lib/config/aws/disasterRecovery.js

@@ -12,11 +12,12 @@ import { BACKUP_VAULT_NAME, isReownedBackupVault } from "@fjall/util";
 // Backup retention constants (in days)
 const RETENTION_PERIODS = {
     STANDARD: 90,
-    RESILIENT: 365,
-    ENTERPRISE_CONTINUOUS: 35, // AWS max for continuous backup
+    // AWS caps a continuous-backup window at 35 days, so the resilient and the
+    // enterprise continuous rules both sit at the cap: it is AWS's limit, not a
+    // tier's choice, which is why one constant serves both.
+    CONTINUOUS_MAX: 35,
     ENTERPRISE_COMPLIANCE: 2555, // 7 years
-    COLD_STORAGE_MINIMUM: 90, // AWS minimum
-    COLD_STORAGE_ONE_YEAR: 365
+    COLD_STORAGE_MINIMUM: 90 // AWS's minimum before a cold point may be deleted
 };
 // Backup window constants
 const BACKUP_WINDOWS = {
@@ -125,6 +126,51 @@ export class DisasterRecovery extends Construct {
                     resources: ["*"]
                 });
                 vault.addToAccessPolicy(copyStatement);
+                // The access policy admits the copy; the KEY has to admit it too. A
+                // copy job into an encrypted vault in another account is executed by
+                // the SOURCE account, so without these the job fails at the
+                // destination with an access-denied nothing in the source account
+                // surfaces. The enterprise tier's seven-year record is this copy, so
+                // the grant is load-bearing, not hardening.
+                const sourcePrincipals = productionAccounts.map((acc) => new AccountPrincipal(acc.id));
+                if (this.backupVault.ownsEncryptionKey) {
+                    this.backupVault.encryptionKey.addToResourcePolicy(new PolicyStatement({
+                        sid: "FjallAllowCrossAccountBackupCopyKeyUse",
+                        effect: Effect.ALLOW,
+                        principals: sourcePrincipals,
+                        actions: [
+                            "kms:Decrypt",
+                            "kms:DescribeKey",
+                            "kms:Encrypt",
+                            "kms:GenerateDataKey",
+                            "kms:GenerateDataKeyWithoutPlaintext",
+                            "kms:ReEncryptFrom",
+                            "kms:ReEncryptTo"
+                        ],
+                        resources: ["*"]
+                    }));
+                    this.backupVault.encryptionKey.addToResourcePolicy(new PolicyStatement({
+                        sid: "FjallAllowCrossAccountBackupCopyGrant",
+                        effect: Effect.ALLOW,
+                        principals: sourcePrincipals,
+                        actions: ["kms:CreateGrant"],
+                        resources: ["*"],
+                        conditions: {
+                            Bool: { "kms:GrantIsForAWSResource": "true" }
+                        }
+                    }));
+                }
+                else {
+                    Annotations.of(this).addWarningV2("fjall:backupVault:crossAccountKeyGrantNotApplied", `Fjall does not manage the encryption key of backup vault ` +
+                        `"${BACKUP_VAULT_NAME}" — the vault was re-owned, so the key is ` +
+                        `yours — and cannot grant the source accounts use of it. ` +
+                        `Cross-account copies into this vault fail at the copy job ` +
+                        `until the key policy admits them: add ` +
+                        `kms:Decrypt, kms:Encrypt, kms:GenerateDataKey*, kms:ReEncrypt* ` +
+                        `and a kms:CreateGrant statement conditioned on ` +
+                        `kms:GrantIsForAWSResource for the production accounts, from a ` +
+                        `principal in the compliance account.`);
+                }
             }
         }
         // Construct cross-region replication vault ARN (same account, DR region)
@@ -197,12 +243,12 @@ export class DisasterRecovery extends Construct {
         ];
     }
     createResilientBackupRules(planName, replicationVaultArn) {
-        const copyActions = this.createCopyActions(planName, replicationVaultArn, undefined, Duration.days(RETENTION_PERIODS.ENTERPRISE_CONTINUOUS), undefined);
+        const copyActions = this.createCopyActions(planName, replicationVaultArn, undefined, Duration.days(RETENTION_PERIODS.CONTINUOUS_MAX), undefined);
         return [
             new BackupPlanRule({
                 ruleName: `${planName}Daily`,
                 scheduleExpression: cronSchedule({ hour: "2", minute: "0" }), // 2 AM daily
-                deleteAfter: Duration.days(RETENTION_PERIODS.ENTERPRISE_CONTINUOUS),
+                deleteAfter: Duration.days(RETENTION_PERIODS.CONTINUOUS_MAX),
                 enableContinuousBackup: true,
                 startWindow: BACKUP_WINDOWS.START,
                 completionWindow: BACKUP_WINDOWS.COMPLETION,
@@ -211,25 +257,81 @@ export class DisasterRecovery extends Construct {
         ];
     }
     createEnterpriseBackupRules(planName, replicationVaultArn, disasterRecoveryVaultArn) {
-        const continuousCopyActions = this.createCopyActions(`${planName}Continuous`, replicationVaultArn, disasterRecoveryVaultArn, Duration.days(RETENTION_PERIODS.ENTERPRISE_CONTINUOUS), undefined);
-        const complianceCopyActions = this.createCopyActions(`${planName}Compliance`, replicationVaultArn, disasterRecoveryVaultArn, Duration.days(RETENTION_PERIODS.ENTERPRISE_COMPLIANCE), Duration.days(RETENTION_PERIODS.COLD_STORAGE_ONE_YEAR));
+        // One destination per rule, by role. The continuous window is the
+        // regional-outage answer and goes to the DR region in this account; the
+        // seven-year record goes to the compliance account and nowhere else.
+        // Sending both rules to both vaults doubled the copy volume to buy a
+        // second copy of the same thing.
+        //
+        // Each rule falls back to the other's destination when its own role has
+        // none, because the two ARNs go absent for independent reasons: the
+        // cross-account one whenever the organisation has no compliance account,
+        // and inside the compliance account itself where the self-replication
+        // guard clears it; the DR-region one whenever the configured
+        // disasterRecoveryRegion IS this account's region. A rule with no
+        // destination keeps every recovery point it takes in one vault in one
+        // region, which is the failure the tier exists to answer, so one copy in
+        // the less appropriate place beats none. Still one destination per rule:
+        // each fallback is passed only when that rule's own destination is absent.
+        const continuousCopyActions = this.createCopyActions(`${planName}Continuous`, replicationVaultArn, replicationVaultArn === undefined ? disasterRecoveryVaultArn : undefined, Duration.days(RETENTION_PERIODS.CONTINUOUS_MAX), undefined);
+        const complianceCopyActions = this.createCopyActions(`${planName}Compliance`, disasterRecoveryVaultArn === undefined ? replicationVaultArn : undefined, disasterRecoveryVaultArn, Duration.days(RETENTION_PERIODS.ENTERPRISE_COMPLIANCE), Duration.days(RETENTION_PERIODS.COLD_STORAGE_MINIMUM));
+        // Both candidate ARNs name `disasterRecoveryRegion`, so an absent
+        // `replicationVaultArn` means that region IS this account's own and
+        // nothing either rule can reach crosses a region — whatever destination
+        // the fallbacks above found. The account stack builds this construct only
+        // when a DR region is configured, so this is a misconfiguration rather
+        // than an opt-out, and the tier's whole promise rests on the copy.
+        //
+        // Warn on the plan, not on one rule. Asking only whether the compliance
+        // record had a destination was silent for the configuration where a
+        // compliance account exists and the DR region is the account's own: the
+        // record copies cross-account, the continuous window copies nowhere, and
+        // the condition that fires the warning never holds.
+        if (replicationVaultArn === undefined) {
+            if (continuousCopyActions === undefined) {
+                Annotations.of(this).addWarningV2("fjall:backupPlan:recoveryPointsNotCopied", `Neither enterprise rule has a copy destination, so every recovery ` +
+                    `point the plan takes — the ` +
+                    `${RETENTION_PERIODS.CONTINUOUS_MAX}-day continuous window and ` +
+                    `the ${RETENTION_PERIODS.ENTERPRISE_COMPLIANCE}-day compliance ` +
+                    `record alike — lives in one vault in one region. The configured ` +
+                    `disasterRecoveryRegion is this account's own region and the ` +
+                    `organisation has no compliance account — set a ` +
+                    `disasterRecoveryRegion that differs from the account's region, ` +
+                    `or add a compliance account for the plan to copy to.`);
+            }
+            else {
+                Annotations.of(this).addWarningV2("fjall:backupPlan:noCrossRegionCopy", `The enterprise plan copies to the compliance account, but nothing ` +
+                    `it copies crosses a region: the configured ` +
+                    `disasterRecoveryRegion is this account's own region, so both ` +
+                    `rules' recovery points stay where the originals are. Losing the ` +
+                    `region is the failure this tier exists to answer — set a ` +
+                    `disasterRecoveryRegion that differs from the account's region.`);
+            }
+        }
         return [
             // Continuous backup (35-day max PITR window)
             new BackupPlanRule({
                 ruleName: `${planName}Continuous`,
                 scheduleExpression: cronSchedule({ hour: "2", minute: "0" }), // Daily for continuous backup
-                deleteAfter: Duration.days(RETENTION_PERIODS.ENTERPRISE_CONTINUOUS),
+                deleteAfter: Duration.days(RETENTION_PERIODS.CONTINUOUS_MAX),
                 enableContinuousBackup: true,
                 startWindow: BACKUP_WINDOWS.START,
                 completionWindow: BACKUP_WINDOWS.COMPLETION,
                 copyActions: continuousCopyActions
             }),
-            // Hourly snapshots for long-term compliance (7 years)
+            // Monthly snapshot for the long-term compliance record (7 years),
+            // cold from day 90. Monthly, not hourly: inside the 35-day window the
+            // continuous rule above already gives second-level recovery, so an
+            // hourly snapshot bought granularity nobody asks for beyond 35 days at
+            // 720× the job count — and 24 RDS recovery points a day would exhaust
+            // the account's manual-snapshot headroom in under four days. Cold
+            // storage cannot ride the continuous rule: aws-cdk-lib refuses
+            // `moveToColdStorageAfter` with `enableContinuousBackup`.
             new BackupPlanRule({
-                ruleName: `${planName}HourlyCompliance`,
-                scheduleExpression: cronSchedule({ minute: "0" }), // Every hour
+                ruleName: `${planName}MonthlyCompliance`,
+                scheduleExpression: cronSchedule({ day: "1", hour: "2", minute: "0" }),
                 deleteAfter: Duration.days(RETENTION_PERIODS.ENTERPRISE_COMPLIANCE),
-                moveToColdStorageAfter: Duration.days(RETENTION_PERIODS.COLD_STORAGE_ONE_YEAR),
+                moveToColdStorageAfter: Duration.days(RETENTION_PERIODS.COLD_STORAGE_MINIMUM),
                 startWindow: BACKUP_WINDOWS.START,
                 completionWindow: BACKUP_WINDOWS.COMPLETION_SHORT,
                 copyActions: complianceCopyActions

package/dist/lib/patterns/aws/buildkite/buildkite.js

@@ -95,8 +95,13 @@ export class Buildkite extends Construct {
             appBackupTier
         });
         // Secrets (SSH deploy keys, git credentials) must survive stack teardown
-        // and accidental overwrite.
-        const managedSecretsBucket = new S3Bucket(this, `${id}ManagedSecretsBucket`, { versioned: true, removalPolicy: RemovalPolicy.RETAIN });
+        // and accidental overwrite — which is exactly what a backup plan is for,
+        // so the bucket takes the app's tier like the artefact bucket above.
+        const managedSecretsBucket = new S3Bucket(this, `${id}ManagedSecretsBucket`, {
+            versioned: true,
+            removalPolicy: RemovalPolicy.RETAIN,
+            appBackupTier
+        });
         if (fjallApiKeyParameterName !== undefined ||
             pipelineSecretsPrefix !== undefined) {
             this.addAgentSecretsEnvHook(id, managedSecretsBucket, {

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -367,6 +367,9 @@ export class ClickHouseDatabase extends Construct {
         const backupBucket = props.backupBucket ??
             new S3Bucket(this, "ClickHouseBackupBucket", {
                 versioned: true,
+                ...(props.appBackupTier !== undefined && {
+                    appBackupTier: props.appBackupTier
+                }),
                 lifecycleRules: [
                     {
                         enabled: true,
@@ -525,8 +528,7 @@ export class ClickHouseDatabase extends Construct {
                     `${sidecarTlsPreamble}${optimisePreamble}\n${optimiseScript}`
                 ],
                 secrets: maintenanceSecrets,
-                logGroup: optimiseTaskLogGroup,
-                securityGroups: [securityGroup]
+                logGroup: optimiseTaskLogGroup
             });
             maintenanceLogGroups.push({
                 job: "optimise",
@@ -555,8 +557,7 @@ export class ClickHouseDatabase extends Construct {
                     })}`
                 ],
                 secrets: maintenanceSecrets,
-                logGroup: backupTaskLogGroup,
-                securityGroups: [securityGroup]
+                logGroup: backupTaskLogGroup
             });
             maintenanceLogGroups.push({
                 job: "backup",
@@ -590,6 +591,9 @@ export class ClickHouseDatabase extends Construct {
             ...(props.appBackupTier !== undefined && {
                 appBackupTier: props.appBackupTier
             }),
+            // ClickHouse is infrastructure: the deploy engine must never roll it
+            // out, restart it or rebind it as one of the app's own services.
+            deployableServices: false,
             cluster: {
                 loadBalancer: false,
                 securityGroup,

package/dist/lib/patterns/aws/computeEcs.js

@@ -1,4 +1,4 @@
-import { AwsLogDriver, ContainerImage, DeploymentLifecycleStage, Secret as EcsSecret } from "aws-cdk-lib/aws-ecs";
+import { AwsLogDriver, ContainerImage, DeploymentLifecycleStage, NetworkMode, Secret as EcsSecret } from "aws-cdk-lib/aws-ecs";
 import { Peer, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { Annotations, Aws, Stack, Token } from "aws-cdk-lib";
@@ -269,6 +269,21 @@ export function validateEcsProps(props) {
                 "does not own. Either omit cluster.securityGroup (a Fjall-owned SG will be created) or set directAccess: false.");
         }
     }
+    for (const entry of props.cluster?.scheduledTasks ?? []) {
+        if (entry.networkMode === NetworkMode.AWS_VPC) {
+            throw new Error(`Scheduled task '${entry.name}': networkMode AWS_VPC is not supported for scheduled tasks — ` +
+                "a scheduled task's connections are wired to the cluster's EC2 capacity security groups " +
+                "(EcsCluster.getEc2CapacityConnectable), which an awsvpc task's own ENI does not wear, so every " +
+                "connection grant would be unreachable at runtime with nothing failing at synth. Remove networkMode " +
+                "to run on the instance ENI, or set NetworkMode.HOST. Govern the task's reachability with the " +
+                "cluster-level securityGroup on EcsClusterConfig.");
+        }
+        if (entry.logGroup !== undefined && entry.logRetention !== undefined) {
+            throw new Error(`Scheduled task '${entry.name}': "logGroup" and "logRetention" are mutually exclusive on ` +
+                "EcsScheduledTaskConfig — the supplied logGroup owns its own retention, so logRetention " +
+                `(${entry.logRetention}) would be silently discarded. Supply one or the other, not both.`);
+        }
+    }
 }
 const DEFAULT_MIGRATE_CONTAINER_NAME = "migrate";
 /**
@@ -976,6 +991,7 @@ export class EcsCompute extends Construct {
             applicationId: props.applicationId ??
                 (App.hasInstance() ? App.getInstance().getName() : undefined),
             ...(props.taskStopWatchdog === false && { taskStopWatchdog: false }),
+            ...(props.deployableServices === false && { deployableServices: false }),
             ...(props.containerInsights !== undefined && {
                 containerInsights: props.containerInsights
             }),

package/dist/lib/patterns/aws/computeEcsTypes.d.ts

@@ -1,6 +1,6 @@
 import { type Repository } from "aws-cdk-lib/aws-ecr";
 import { type RepositoryImage, type ContainerImage, type PortMapping, type Secret as EcsSecret, type NetworkMode } from "aws-cdk-lib/aws-ecs";
-import { type IPeer, type ISecurityGroup, type IVpc, type Port, type SubnetSelection } from "aws-cdk-lib/aws-ec2";
+import { type IPeer, type ISecurityGroup, type IVpc, type Port } from "aws-cdk-lib/aws-ec2";
 import { type ILogGroup, type RetentionDays } from "aws-cdk-lib/aws-logs";
 import { type PolicyDocument, type IManagedPolicy, type PolicyStatement } from "aws-cdk-lib/aws-iam";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
@@ -554,7 +554,8 @@ export interface EcsScheduledTaskConfig {
      * Connections to data resources — the same connector interface services
      * use. Produces IAM grants on the task role, security-group wiring (via the
      * cluster's EC2 capacity security group — scheduled tasks run on the
-     * cluster's instances), and schema-version gate env injection when a
+     * cluster's instances, which is why `networkMode: AWS_VPC` is refused
+     * here), and schema-version gate env injection when a
      * connected database declares `migrations:`. Scheduled tasks never
      * materialise a `fjall-schema-gate` container; only the env is injected —
      * the task's own entrypoint decides whether to gate on it.
@@ -576,8 +577,18 @@ export interface EcsScheduledTaskConfig {
      * removal default (D17).
      */
     logRetention?: RetentionDays;
-    securityGroups?: ISecurityGroup[];
-    subnetSelection?: SubnetSelection;
+    /**
+     * Task network mode. Omit for the `Ec2TaskDefinition` default (BRIDGE, as
+     * measured on aws-cdk-lib 2.265.0 — the caret range can move it); `HOST` is
+     * permitted.
+     *
+     * `AWS_VPC` is REFUSED at synth. A scheduled task's `connections` are wired
+     * onto the cluster's EC2 capacity security groups
+     * (`EcsCluster.getEc2CapacityConnectable`), which an awsvpc task's own ENI
+     * does not wear — every grant would land and every network path would not,
+     * with nothing failing at synth. Govern reachability with the cluster-level
+     * `securityGroup` on `EcsClusterConfig` instead.
+     */
     networkMode?: NetworkMode;
     /** Host-bind volumes mounted into the task's container. */
     volumes?: ContainerVolume[];
@@ -641,6 +652,10 @@ export interface EcsClusterConfig {
      * Scheduled tasks materialised into `Ec2TaskDefinition`s and registered via
      * `app.addSchedule(...)` against the existing `EcsScheduleTarget` shape
      * ({ ecs, serviceName, taskCount }). See AC34.
+     *
+     * These run on the cluster's own EC2 instances and share their network
+     * interface, so `networkMode: AWS_VPC` is refused per entry — see
+     * {@link EcsScheduledTaskConfig.networkMode}.
      */
     scheduledTasks?: EcsScheduledTaskConfig[];
 }
@@ -1081,6 +1096,17 @@ export interface EcsComputeProps {
      * opt-out for cost-sensitive clusters.
      */
     taskStopWatchdog?: false;
+    /**
+     * Deployable-service exports (default on): one `DeployableService` output
+     * per service plus the cluster's `DeployableCluster` and `ClusterArn`
+     * outputs, named by `@fjall/util`'s `stackExportNames` builders. The
+     * deploy engine's `EcsServiceResolver` reads the app's Compute stack
+     * outputs to find the ECS services that `fjall services`, `fjall rollout`,
+     * `fjall restart`, a code-only deploy and a rollback act on. `false` opts
+     * out a cluster hosting an infrastructure service, so the resolver never
+     * binds it as an app service.
+     */
+    deployableServices?: false;
     /**
      * CloudWatch Container Insights (default off). Enabling it bills
      * ~$0.30/metric-month of custom `ECS/ContainerInsights` metrics per cluster

package/dist/lib/patterns/aws/computePropApplicability.js

@@ -19,6 +19,7 @@ const COMPUTE_PROP_APPLICABILITY = {
     alertsTopic: ["ecs"],
     applicationId: ["ecs"],
     taskStopWatchdog: ["ecs"],
+    deployableServices: ["ecs"],
     containerInsights: ["ecs"],
     deployment: ["lambda"],
     functionUrl: ["lambda"],

package/dist/lib/patterns/aws/messaging.d.ts

@@ -28,6 +28,16 @@ export interface IQueueProps {
         maxReceiveCount?: number;
     };
     encryption?: "SSE_SQS" | "SSE_KMS" | "NONE";
+    /**
+     * ARN of a customer-managed KMS key to encrypt the queue (and its
+     * auto-created DLQ) with. Requires `encryption: "SSE_KMS"` — the resource
+     * layer refuses the pair rather than ignoring the key. Absent with
+     * `"SSE_KMS"`, the queue takes the stack's shared key.
+     *
+     * An ARN rather than an `IKey` because this is the plan vocabulary the
+     * scaffold and the codemod write, the same as `S3Props.kmsKeyArn`; a key
+     * you hold in `infrastructure.ts` passes as `key.keyArn`.
+     */
     kmsKeyArn?: string;
     contentBasedDeduplication?: boolean;
     fifoThroughputLimit?: "perQueue" | "perMessageGroupId";