@fjall/components-infrastructure 39.0.5 → 39.0.6

package/dist/lib/patterns/aws/computeEcsTypes.d.ts

@@ -320,10 +320,13 @@ export interface EcsInitContainerMigrationsConfig {
  * deployment lifecycle hook (PRE_SCALE_UP). The service rollout BLOCKS until
  * the migration succeeds; one task per deploy.
  *
- * When `separateTaskDef` is present, `wireLifecycleHookMigrations` synthesises
- * a SEPARATE migration task definition (its own IAM role, log group, runtime
- * platform) instead of using `ContainerOverrides` on the service task def.
- * Required when migrations need permissions the service doesn't.
+ * The migration runs from a task definition of its own, which the service's
+ * task definition names in a tag. The hook reads that tag from the revision
+ * each deployment targets, so it always runs the migration that deployment's
+ * code was built against. With `separateTaskDef` that task definition has
+ * its own IAM roles, log group and size; without it, it runs as the
+ * service's. Use `separateTaskDef` when migrations need permissions or
+ * credentials the service doesn't.
  */
 export interface EcsLifecycleHookMigrationsConfig {
     /** Required for the lifecycle-hook variant. */
@@ -333,8 +336,7 @@ export interface EcsLifecycleHookMigrationsConfig {
     /** Override timeout in seconds. Defaults to 300 (5 min). Capped at 900s per Lambda invocation; longer migrations use the IN_PROGRESS callback chain. */
     timeoutSeconds?: number;
     /**
-     * Override image URI (string only). CDK `Repository` constructs cannot be
-     * JSON-serialised into the runner Lambda's `MIGRATE_CONFIG` env var; synth
+     * Override image URI (string only): the migration container's image. Synth
      * throws if a `Repository` is passed in lifecycle-hook mode.
      */
     image?: string;
@@ -344,7 +346,7 @@ export interface EcsLifecycleHookMigrationsConfig {
     secretsImport?: Record<string, SecretImport>;
     /** SSM Parameter Store secret keys. */
     secrets?: string[];
-    /** Synthetic container name. Defaults to `"migrate"`. */
+    /** The migration container's name. Defaults to `"migrate"`. */
     name?: string;
     /**
      * Container entrypoint. Defaults to inheriting from the image. Set to
@@ -353,14 +355,19 @@ export interface EcsLifecycleHookMigrationsConfig {
      */
     entryPoint?: string[];
     /**
-     * When present, synthesise a SEPARATE migration task definition (its own
-     * IAM role, log group, runtime platform) instead of using `ContainerOverrides`
-     * on the service task def. Required when migrations need permissions the
-     * service doesn't (e.g. `rds:CreateDBSnapshot`, cross-service Secrets Manager
-     * reads) — preserves least-privilege on the service task role.
+     * When present, the migration's task definition has its own IAM roles,
+     * log group and size, and with `egressTo` its own security group. Required
+     * when migrations need permissions the service doesn't (e.g.
+     * `rds:CreateDBSnapshot`, cross-service Secrets Manager reads), or a
+     * connected database's contributed credentials and policies, such as its
+     * schema administrator's — preserves least-privilege on the service task
+     * role.
      *
-     * When absent, the lifecycle-hook runner uses the service's task def via
-     * ContainerOverrides — existing behaviour, unchanged.
+     * When absent, the migration's task definition runs as the service's own
+     * roles, at its size, in its log group, from its image, with its primary
+     * container's environment, entry point and secrets beneath the
+     * migration's own. A connected database's contributed secrets and
+     * policies are not added: they would widen the service's roles.
      */
     separateTaskDef?: EcsLifecycleHookMigrationsSeparateTaskDef;
 }
@@ -394,7 +401,7 @@ export interface EcsPostDeployMigrationsConfig {
     secretsImport?: Record<string, SecretImport>;
     /** SSM Parameter Store secret keys. */
     secrets?: string[];
-    /** Synthetic container name. Defaults to `"migrate"`. */
+    /** The migration container's name. Defaults to `"migrate"`. */
     name?: string;
     /** Container entrypoint. Defaults to inheriting from the image. */
     entryPoint?: string[];
@@ -910,14 +917,28 @@ export interface EcsServiceConfig {
      * Names another service in the same cluster whose **lifecycle-hook** (or
      * post-deploy) migrations must finish before this service rolls out.
      *
-     * Implemented as a native CloudFormation `DependsOn`: CFN will not begin
-     * creating or updating this service until the named service's ECS deployment
-     * — including its PRE_SCALE_UP migrate hook — has completed. Use it for
-     * DB-connecting workers that must not start until the migrate-owning service
-     * has applied role / grant / schema migrations; without it, a worker can
-     * attempt RDS-IAM auth before the migrate task has run `GRANT rds_iam` (the
-     * race that aborts a migration-bearing deploy). Also enables a single-pass
-     * greenfield deploy (app migrates, then workers come up, in one `cdk deploy`).
+     * Implemented as the named service's rollout barrier: a custom resource
+     * that completes only once ECS reports the named service's deployment of
+     * its task definition finished, its migrate hook included, and fails once
+     * ECS rolled that deployment back. This service's CloudFormation
+     * `DependsOn` names the barrier, so CloudFormation does not begin creating
+     * or updating this service until the named service has rolled out. Use it
+     * for DB-connecting workers that must not start until the migrate-owning
+     * service has applied role / grant / schema migrations; without it, a
+     * worker can attempt RDS-IAM auth before the migrate task has run
+     * `GRANT rds_iam` (the race that aborts a migration-bearing deploy).
+     *
+     * A `DependsOn` on the named service itself would not order this:
+     * CloudFormation may start a service's dependants at its
+     * eventual-consistency check, long before its ECS deployment has finished
+     * (measured in us-east-1 from 2026-10-01).
+     *
+     * The barrier waits only when the named service's task definition changes,
+     * which a new image or schema version does, so a deploy that changes
+     * neither orders nothing. It holds only for deploys CloudFormation runs:
+     * Fjall's code-only deploy and its rollback register a task definition and
+     * update the service directly. It fails a rollout that takes longer than
+     * an hour, CloudFormation's limit for a custom resource.
      *
      * Works for EC2-capacity services — it is a resource-ordering edge, not a
      * worker-side lifecycle hook, so the FARGATE-only restriction on hook
@@ -928,8 +949,11 @@ export interface EcsServiceConfig {
      * single completion point to await. Validated at synth (target exists,
      * declares hook migrations, no self-reference, no cycle).
      *
-     * Escape hatch for orderings this field can't express: drop to the L2 API,
-     * `cluster.getService("x")?.node.addDependency(cluster.getService("y")!)`.
+     * Escape hatch for orderings this field can't express: depend on the
+     * service's rollout barrier,
+     * `compute.getService("x")?.node.addDependency(compute.getRolloutBarrier("y"))`.
+     * A `DependsOn` between the services themselves does not order their
+     * rollouts.
      *
      * @example
      * awaitMigrationsFrom: "app"

package/dist/lib/resources/aws/compute/ecs.d.ts

@@ -4,6 +4,7 @@ import { Construct } from "constructs";
 import type { StackBuilder } from "../base/awsStack.js";
 import { Grant, type IGrantable } from "aws-cdk-lib/aws-iam";
 import type { ApplicationListener, ApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { ILogGroup } from "aws-cdk-lib/aws-logs";
 import { StackEncryptionKey } from "../secrets/stackEncryptionKey.js";
 import { type EcsClusterProps } from "./ecsTypes.js";
 import { type EcsIngressProfile } from "./ingressProfile.js";
@@ -96,6 +97,8 @@ export default class EcsCluster extends Construct implements IConnectable {
     getService(name: string): FargateService | Ec2Service | undefined;
     /** Get all services in this cluster. */
     getServices(): Map<string, FargateService | Ec2Service>;
+    /** The log group every container of the named service writes to. */
+    getServiceLogGroup(serviceName: string): ILogGroup | undefined;
     /**
      * Get the task definition for a service or a registered scheduled task.
      * Used by Schedule / Subscription targets to construct the EcsTask adapter

package/dist/lib/resources/aws/compute/ecs.js

@@ -226,6 +226,10 @@ export default class EcsCluster extends Construct {
         }
         return result;
     }
+    /** The log group every container of the named service writes to. */
+    getServiceLogGroup(serviceName) {
+        return this.services.get(serviceName)?.logGroup;
+    }
     /**
      * Get the task definition for a service or a registered scheduled task.
      * Used by Schedule / Subscription targets to construct the EcsTask adapter

package/dist/lib/resources/aws/compute/ecsLifecycleHookMigration.d.ts

@@ -1,77 +1,38 @@
-import { type BaseService, DeploymentLifecycleStage } from "aws-cdk-lib/aws-ecs";
+import { type BaseService, type ContainerDefinition, DeploymentLifecycleStage, type TaskDefinition } from "aws-cdk-lib/aws-ecs";
 import { Construct } from "constructs";
 import { LambdaFunction } from "./lambda.js";
-/**
- * Awsvpc network configuration consumed by the runner's `RunTask` call.
- */
-export interface LifecycleHookNetworkConfiguration {
-    subnetIds: string[];
-    securityGroupIds: string[];
-    assignPublicIp: boolean;
-}
-/**
- * Optional nested block describing a separate migration task definition.
- *
- * Three lockstep fields enforced by the type system — present-as-a-group or
- * absent-as-a-group. This shape is the resources-layer mirror of
- * `EcsLifecycleHookMigrationsSeparateTaskDef` at the patterns layer.
- */
-export interface MigrationTaskDef {
-    /** ARN of the migration task definition (different from the service task def). */
-    definitionArn: string;
-    /** Family of the migration task definition — used to scope `ecs:RunTask`. */
-    family: string;
-    /** Task role ARN for the migration task. */
-    taskRoleArn: string;
-    /** Execution role ARN for the migration task. */
-    executionRoleArn: string;
-}
 export interface EcsLifecycleHookMigrationProps {
     /**
      * The ECS service this hook fires for.
      */
     service: BaseService;
+    /**
+     * The container whose definition carries the migration's label: the
+     * service's primary container. Defaults to the task definition's default
+     * container, its first essential one.
+     */
+    primaryContainer?: ContainerDefinition;
+    /** The service's physical name, as a literal. */
+    serviceName: string;
+    /** The physical name of the service's cluster, as a literal. */
+    clusterName: string;
     /** Cluster ARN — used for both `ecs:RunTask`'s cluster condition and ListTasks scoping. */
     clusterArn: string;
-    /** ARN of the task definition the migrate task launches from. */
-    taskDefinitionArn: string;
-    /** Family of the task definition — used in the `ecs:RunTask` resource ARN. */
-    taskDefinitionFamily: string;
-    /** Task execution role ARN (the role pulling the image, writing logs). */
-    taskExecutionRoleArn: string;
-    /** Task role ARN (the role the running container assumes). */
-    taskRoleArn: string;
-    /** Migration command, passed through to the runner. */
-    command: string[];
-    /** Synthetic container name used in `RunTask` overrides. */
-    containerName: string;
-    /** Optional image override (else the task definition's image is used). */
-    image?: string;
     /**
-     * Optional container entrypoint override (else inherited from the image).
-     * Lets the patterns layer carry `["/usr/bin/tini", "--"]` shapes through to
-     * the runner's `ContainerOverrides` block.
+     * The task definition the migration runs: its container carries the
+     * command, entry point and environment. The service's task definition
+     * names it in its `fjall:migration-task-definition` tag, which the hook
+     * reads from the revision each deployment targets, and in its primary
+     * container's docker label, which the hook reads when that revision
+     * carries no tag.
      */
-    entryPoint?: string[];
-    /** Optional environment override. */
-    environment?: Record<string, string>;
+    migrationTaskDefinition: TaskDefinition;
     /**
      * Lambda timeout in seconds. Defaults to 300, capped at 900 (Lambda max).
      * Should comfortably exceed the migration command's expected runtime
      * including a few re-invocation cycles.
      */
     timeoutSeconds?: number;
-    /** Awsvpc network configuration for the migrate task. */
-    networkConfiguration: LifecycleHookNetworkConfiguration;
-    /**
-     * Optional separate migration task definition. When present, `RunTask`
-     * targets THIS task def instead of the service's, and the Lambda's IAM
-     * policy expands to cover both task-def families + both role pairs.
-     *
-     * When absent, behaviour is unchanged — the migration runs in the service
-     * task def via `ContainerOverrides`.
-     */
-    migrationTaskDef?: MigrationTaskDef;
     /**
      * Which deployment lifecycle stage to fire at. Defaults to
      * `PRE_SCALE_UP` (migration runs BEFORE the new revision scales up;
@@ -84,11 +45,20 @@ export interface EcsLifecycleHookMigrationProps {
     lifecycleStage?: DeploymentLifecycleStage;
 }
 /**
- * ECS deployment lifecycle hook (PRE_SCALE_UP) that runs migrations as a
- * one-off `RunTask` before the new revision scales up. Self-wires:
- * synthesises the Lambda + IAM + LogGroup, then attaches the hook to the
- * service via the typed CDK API. CDK auto-generates the hook-invocation
- * role.
+ * ECS deployment lifecycle hook that runs a service's migration as a one-off
+ * `RunTask` of its migration task definition, before the new revision scales
+ * up (or after, for post-deploy work). Self-wires: synthesises the Lambda +
+ * IAM + LogGroup and the role ECS assumes to invoke the hook, stamps the
+ * service's task definition with the migration task definition it runs, and
+ * attaches the hook to the service via the typed CDK API.
+ *
+ * The hook reads everything it runs from the deployment it serves (FJL-901):
+ * the target revision's cluster, task definition and network, and the
+ * migration the task definition's tag names, or its primary container's
+ * docker label where a copy carries no tag. Its function has no
+ * environment, so it changes only when its code does, never on an image
+ * deploy, and its own update can never pair one release's migration with
+ * another's code.
  */
 export declare class EcsLifecycleHookMigration extends Construct {
     readonly lambda: LambdaFunction;

package/dist/lib/resources/aws/compute/ecsLifecycleHookMigration.js

@@ -1,10 +1,11 @@
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { Stack } from "aws-cdk-lib";
+import { MIGRATION_TASK_DEFINITION_LABEL_KEY, MIGRATION_TASK_DEFINITION_TAG_KEY } from "@fjall/util/migration";
+import { ArnFormat, Stack, Tags } from "aws-cdk-lib";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
-import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
+import { Effect, PolicyStatement, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { DeploymentLifecycleLambdaTarget, DeploymentLifecycleStage } from "aws-cdk-lib/aws-ecs";
 import { Construct } from "constructs";
 import { LambdaFunction } from "./lambda.js";
@@ -13,11 +14,20 @@ const LAMBDA_SOURCE_FILE = "lifecycleHookLambda.source.cjs";
 const LAMBDA_TIMEOUT_DEFAULT_SECONDS = 300;
 const LAMBDA_TIMEOUT_MAX_SECONDS = 900;
 /**
- * ECS deployment lifecycle hook (PRE_SCALE_UP) that runs migrations as a
- * one-off `RunTask` before the new revision scales up. Self-wires:
- * synthesises the Lambda + IAM + LogGroup, then attaches the hook to the
- * service via the typed CDK API. CDK auto-generates the hook-invocation
- * role.
+ * ECS deployment lifecycle hook that runs a service's migration as a one-off
+ * `RunTask` of its migration task definition, before the new revision scales
+ * up (or after, for post-deploy work). Self-wires: synthesises the Lambda +
+ * IAM + LogGroup and the role ECS assumes to invoke the hook, stamps the
+ * service's task definition with the migration task definition it runs, and
+ * attaches the hook to the service via the typed CDK API.
+ *
+ * The hook reads everything it runs from the deployment it serves (FJL-901):
+ * the target revision's cluster, task definition and network, and the
+ * migration the task definition's tag names, or its primary container's
+ * docker label where a copy carries no tag. Its function has no
+ * environment, so it changes only when its code does, never on an image
+ * deploy, and its own update can never pair one release's migration with
+ * another's code.
  */
 export class EcsLifecycleHookMigration extends Construct {
     lambda;
@@ -25,62 +35,81 @@ export class EcsLifecycleHookMigration extends Construct {
         super(scope, id);
         const stack = Stack.of(scope);
         const timeoutSeconds = Math.min(props.timeoutSeconds ?? LAMBDA_TIMEOUT_DEFAULT_SECONDS, LAMBDA_TIMEOUT_MAX_SECONDS);
-        const sourcePath = path.resolve(__dirname, LAMBDA_SOURCE_FILE);
-        const source = readFileSync(sourcePath, "utf-8");
-        const migrationTaskDef = props.migrationTaskDef;
-        const targetTaskDefinitionArn = migrationTaskDef?.definitionArn ?? props.taskDefinitionArn;
-        const runTaskResources = [
-            `arn:${stack.partition}:ecs:${stack.region}:${stack.account}:task-definition/${props.taskDefinitionFamily}:*`
-        ];
-        if (migrationTaskDef !== undefined) {
-            runTaskResources.push(`arn:${stack.partition}:ecs:${stack.region}:${stack.account}:task-definition/${migrationTaskDef.family}:*`);
+        const migration = props.migrationTaskDefinition;
+        const ecsArn = (resource, resourceName) => stack.formatArn({
+            service: "ecs",
+            resource,
+            resourceName,
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME
+        });
+        // Literal names, never the service's attributes: the service names this
+        // function as its hook target, so a policy that referenced the service
+        // would close a cycle.
+        const serviceKey = `${props.clusterName}/${props.serviceName}`;
+        const familyRevisions = (family) => `arn:${stack.partition}:ecs:${stack.region}:${stack.account}:task-definition/${family}:*`;
+        // The tag is a reference, so the service's task definition registers
+        // after the migration's. The hook reads the tag, and the label on a
+        // revision that carries no tag. A tag alone updates in place, on
+        // CloudFormation's own revision only, so a revision a restart or a
+        // code-only deploy copied from it would go on naming a migration task
+        // definition CloudFormation then deregisters. The label carries the same
+        // reference in the container definitions, which no revision can change:
+        // a change to the migration alone registers a new revision of the
+        // service's task definition, the deploy rolls the service onto it, and
+        // every lane that copies a revision copies the live one's label and tag.
+        Tags.of(props.service.taskDefinition).add(MIGRATION_TASK_DEFINITION_TAG_KEY, migration.taskDefinitionArn, { includeResourceTypes: ["AWS::ECS::TaskDefinition"] });
+        const primary = props.primaryContainer ?? props.service.taskDefinition.defaultContainer;
+        if (primary === undefined) {
+            throw new Error(`EcsLifecycleHookMigration: the task definition of service "${props.serviceName}" has no essential container to carry its migration's label`);
         }
-        const passRoleResources = [props.taskExecutionRoleArn, props.taskRoleArn];
-        if (migrationTaskDef !== undefined) {
-            passRoleResources.push(migrationTaskDef.taskRoleArn, migrationTaskDef.executionRoleArn);
+        primary.addDockerLabel(MIGRATION_TASK_DEFINITION_LABEL_KEY, migration.taskDefinitionArn);
+        const passRoleResources = [migration.taskRole.roleArn];
+        if (migration.executionRole !== undefined) {
+            passRoleResources.push(migration.executionRole.roleArn);
         }
-        // ECS RunTask awsvpcConfiguration uses subnets/securityGroups and
-        // assignPublicIp as "ENABLED"/"DISABLED" string, not boolean.
-        const awsvpcConfiguration = {
-            subnets: props.networkConfiguration.subnetIds,
-            securityGroups: props.networkConfiguration.securityGroupIds,
-            assignPublicIp: props.networkConfiguration.assignPublicIp
-                ? "ENABLED"
-                : "DISABLED"
-        };
         this.lambda = new LambdaFunction(this, `${id}Fn`, {
             runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
-            code: Code.fromInline(source),
+            code: Code.fromInline(readFileSync(path.resolve(__dirname, LAMBDA_SOURCE_FILE), "utf-8")),
             lambdaDescription: `${id} ECS deployment lifecycle hook for migration`,
             roleDescription: `Execution role for ${id} migration lifecycle-hook runner`,
             timeout: timeoutSeconds,
             memorySize: 256,
             logGroupRetention: RetentionDays.ONE_MONTH,
-            environment: {
-                MIGRATE_CONFIG: JSON.stringify({
-                    clusterArn: props.clusterArn,
-                    taskDefinitionArn: targetTaskDefinitionArn,
-                    name: props.containerName,
-                    command: props.command,
-                    ...(props.image !== undefined ? { image: props.image } : {}),
-                    ...(props.entryPoint !== undefined
-                        ? { entryPoint: props.entryPoint }
-                        : {}),
-                    ...(props.environment !== undefined
-                        ? { environment: props.environment }
-                        : {}),
-                    networkConfiguration: awsvpcConfiguration,
-                    ...(migrationTaskDef !== undefined
-                        ? { hasSeparateMigrationTaskDef: true }
-                        : {})
-                })
-            },
             inlinePolicy: [
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["ecs:DescribeServiceRevisions"],
+                    resources: [
+                        ecsArn("service", serviceKey),
+                        ecsArn("service-revision", `${serviceKey}/*`)
+                    ]
+                }),
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["ecs:ListTagsForResource"],
+                    resources: [
+                        familyRevisions(props.service.taskDefinition.family),
+                        familyRevisions(migration.family)
+                    ]
+                }),
+                // The label fallback reads a copied revision's container definitions.
+                // DescribeTaskDefinition takes no resource type (AWS service reference,
+                // ecs.json, read 2026-10-03), so it cannot be scoped to the family.
+                // The revision ECS hands the hook is in the stack's own Region, so the
+                // read is held to it.
+                new PolicyStatement({
+                    effect: Effect.ALLOW,
+                    actions: ["ecs:DescribeTaskDefinition"],
+                    resources: ["*"],
+                    conditions: {
+                        StringEquals: { "aws:RequestedRegion": stack.region }
+                    }
+                }),
                 new PolicyStatement({
                     effect: Effect.ALLOW,
                     actions: ["ecs:RunTask"],
-                    resources: runTaskResources,
+                    resources: [familyRevisions(migration.family)],
                     conditions: {
                         ArnEquals: { "ecs:cluster": props.clusterArn }
                     }
@@ -105,9 +134,26 @@ export class EcsLifecycleHookMigration extends Construct {
                 })
             ]
         });
+        // Without a role the target creates one while the service renders, after
+        // every aspect has run, so no tag and no removal marker ever reach it. The
+        // scope and id are the target's own, so the logical id does not move.
+        const hookRole = new Role(props.service, `${id}Role`, {
+            assumedBy: new ServicePrincipal("ecs.amazonaws.com")
+        });
+        this.lambda.grantInvoke(hookRole);
+        // The hook names the role, which orders the service after the role but
+        // not after the grant in the role's own policy, so a create could start
+        // the service's first deployment, and ECS invoke the hook, before the
+        // grant exists (FJL-1029).
+        const serviceResource = props.service.node.defaultChild;
+        if (serviceResource === undefined) {
+            throw new Error(`EcsLifecycleHookMigration: service "${props.serviceName}" has no CloudFormation resource to order after its hook role's grant`);
+        }
+        serviceResource.node.addDependency(hookRole);
         const lifecycleStage = props.lifecycleStage ?? DeploymentLifecycleStage.PRE_SCALE_UP;
         props.service.addLifecycleHook(new DeploymentLifecycleLambdaTarget(this.lambda, id, {
-            lifecycleStages: [lifecycleStage]
+            lifecycleStages: [lifecycleStage],
+            role: hookRole
         }));
     }
 }

package/dist/lib/resources/aws/compute/ecsRolloutBarrier.d.ts

@@ -0,0 +1,61 @@
+import { CustomResource } from "aws-cdk-lib";
+import type { BaseService } from "aws-cdk-lib/aws-ecs";
+import { Construct, type IDependable } from "constructs";
+/**
+ * The stack's one rollout-barrier provider: the `onEvent` and `isComplete`
+ * handlers, from one inline source, and the provider framework that asks
+ * `isComplete` every 15 s for at most an hour. Each barrier grants the
+ * `isComplete` role the reads of its own service only; the role also reads
+ * its own stack's status, to complete at once on a rollback.
+ *
+ * The framework's waiter state machine logs at FATAL, without execution
+ * data, to a group named under `/aws/vendedlogs/states/`
+ * (`waiterLogGroupName`). Being named, the group is destroyed with its stack
+ * whatever the stage: a group a rollback retained would collide with the one
+ * the next upgrade creates under the same name.
+ */
+export declare class EcsRolloutBarrierProvider extends Construct {
+    /** The stack's provider, made on first use. */
+    static of(scope: Construct): EcsRolloutBarrierProvider;
+    readonly serviceToken: string;
+    private readonly isCompleteHandler;
+    private readonly granted;
+    private constructor();
+    /**
+     * The reads `isComplete` makes of one service, scoped to it: its
+     * description, its deployments and their revisions (AWS service reference,
+     * ecs.json, 2026-10-01). Granted once a service.
+     *
+     * The ARNs are built from the literal cluster and service names, never from
+     * the service's attributes: the grant lands on the one role every barrier in
+     * the stack shares, so a reference to a service would make each barrier
+     * wait for every owner, and an owner that itself awaits another owner would
+     * close a cycle.
+     */
+    grantRolloutReads(clusterName: string, serviceName: string): void;
+}
+export interface EcsRolloutBarrierProps {
+    /** The service whose rollout the barrier waits for. */
+    readonly service: BaseService;
+    /** The service's physical name, as a literal. */
+    readonly serviceName: string;
+    /** The physical name of the service's cluster, as a literal. */
+    readonly clusterName: string;
+    /**
+     * The task definition the service deploys. It changes whenever the image
+     * or the expected schema version does, which is exactly when CloudFormation
+     * invokes the barrier.
+     */
+    readonly taskDefinitionArn: string;
+}
+/**
+ * A custom resource that completes only once ECS reports the service's
+ * deployment of its task definition finished, and fails once ECS rolled it
+ * back (FJL-901). Its dependants therefore wait for the rollout, PRE_SCALE_UP
+ * migrate hook included, whatever CloudFormation's own stabilisation of the
+ * service reports. Delete only acknowledges.
+ */
+export declare class EcsRolloutBarrier extends Construct implements IDependable {
+    readonly resource: CustomResource;
+    constructor(scope: Construct, id: string, props: EcsRolloutBarrierProps);
+}