@fjall/components-infrastructure 7.2.0 → 7.3.0

package/dist/lib/patterns/aws/database.js

@@ -6,6 +6,7 @@ import { DynamoDBTable } from "../../resources/aws/database/dynamodb.js";
 import { ClickHouseDatabase } from "./clickhouseDatabase.js";
 import { FjallLogger, warnIfPropertiesIgnored } from "../../utils/validationLogger.js";
 import { toPascalCase } from "../../utils/capitaliseString.js";
+import { ResourceNaming } from "../../utils/resourceNaming.js";
 import { resolveAlertsTopic as resolveAlertsTopicShared } from "../../utils/resolveAlertsTopic.js";
 import { Port } from "aws-cdk-lib/aws-ec2";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
@@ -364,7 +365,7 @@ export class RelationalDatabase extends Construct {
             FjallLogger.warn(`Aurora database '${props.databaseName}' is configured with public accessibility. ` +
                 "This is a security risk and should only be used for development.");
         }
-        this.database = new RdsAurora(this, `${props.databaseName}Rds`, {
+        this.database = new RdsAurora(this, ResourceNaming.rdsChildConstructId(props.databaseName), {
             vpc: props.vpc,
             databaseName: props.databaseName,
             engine: resolvedEngine,
@@ -406,7 +407,7 @@ export class RelationalDatabase extends Construct {
         const resolvedDatabaseEngine = props.databaseEngine ?? "postgresql";
         const resolvedEngine = props.engine ?? getAuroraClusterEngine(resolvedDatabaseEngine);
         const engineConfig = getEngineConfig(resolvedDatabaseEngine);
-        this.database = new RdsAuroraGlobal(this, `${props.databaseName}RdsGlobal`, {
+        this.database = new RdsAuroraGlobal(this, ResourceNaming.globalRdsChildConstructId(props.databaseName), {
             vpc: props.vpc,
             databaseName: props.databaseName,
             primaryRegion: props.primaryRegion,
@@ -439,7 +440,7 @@ export class RelationalDatabase extends Construct {
         const resolvedDatabaseEngine = props.databaseEngine ?? "postgresql";
         const resolvedEngine = props.engine ?? getInstanceEngine(resolvedDatabaseEngine);
         const engineConfig = getEngineConfig(resolvedDatabaseEngine);
-        this.database = new RdsInstance(this, `${props.databaseName}Rds`, {
+        this.database = new RdsInstance(this, ResourceNaming.rdsChildConstructId(props.databaseName), {
             vpc: props.vpc,
             databaseName: props.databaseName,
             instanceType: props.instanceType,

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -10,6 +10,7 @@ import { AliasRecord } from "../networking/dnsRecord/aliasRecord.js";
 import { SecurityGroup } from "../networking/securityGroup.js";
 import { DNS_APEX, isManagedDomainBinding, isWithinZone } from "../../../utils/domainTypes.js";
 import { readInjectedManagedDomainBinding } from "../../../utils/managedDomainContext.js";
+import { ResourceNaming } from "../../../utils/resourceNaming.js";
 import { getSafeZoneName, toPascalCase } from "../../../utils/capitaliseString.js";
 import { FjallLogger } from "../../../utils/validationLogger.js";
 import { isServiceEc2 } from "./ecsTaskDefinition.js";
@@ -18,12 +19,7 @@ import { addRoutingListener } from "./listenerRouting.js";
 import { buildRoutingConditions, deterministicHostPriority, getNextPriority } from "./hostHeaderListenerRule.js";
 export function addLoadBalancer(ctx, anyServiceUsesEc2, asgSecurityGroup) {
     const props = ctx.props;
-    const defaultLoadBalancerName = `${props.clusterName}LoadBalancer`;
-    const supportedNameLength = 32;
-    let truncatedLoadBalancerName = defaultLoadBalancerName.length > supportedNameLength
-        ? defaultLoadBalancerName.substring(0, supportedNameLength)
-        : defaultLoadBalancerName;
-    truncatedLoadBalancerName = truncatedLoadBalancerName.replace(/-+$/, "");
+    const truncatedLoadBalancerName = ResourceNaming.loadBalancerName(props.clusterName);
     const isInternal = props.cluster?.loadBalancer === "internal";
     let loadBalancerSecurityGroup;
     if (anyServiceUsesEc2) {

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -83,7 +83,7 @@ export class RdsAurora extends Construct {
             : (props.credentials?.username ?? this.engineConfig.defaultUsername);
         // Global secondary clusters import replicated secret instead of creating new
         if (props.isGlobalSecondary) {
-            this.databaseCredentials = new Secret(this, `${this.databaseNameValue}Credentials`, {
+            this.databaseCredentials = new Secret(this, ResourceNaming.credentialsSecretConstructId(this.databaseNameValue), {
                 secretName: props.credentialsSecretName ??
                     ResourceNaming.credentialsSecretName(id),
                 importExisting: true
@@ -97,7 +97,7 @@ export class RdsAurora extends Construct {
                 snapshotUsername: props.snapshotUsername,
                 assumedUsername: username
             });
-            this.databaseCredentials = new Secret(this, `${this.databaseNameValue}Credentials`, {
+            this.databaseCredentials = new Secret(this, ResourceNaming.credentialsSecretConstructId(this.databaseNameValue), {
                 secretName: props.credentialsSecretName ??
                     ResourceNaming.credentialsSecretName(id),
                 aliasName: props.credentialsKmsAliasName,

package/dist/lib/resources/aws/database/rdsAuroraGlobal.js

@@ -95,7 +95,7 @@ export class RdsAuroraGlobal extends Construct {
         };
         if (this.props.primaryRegion === this.currentRegion) {
             // primary
-            this.primaryCluster = new RdsAurora(this, `${this.props.databaseName}Primary`, {
+            this.primaryCluster = new RdsAurora(this, ResourceNaming.globalPrimaryConstructId(this.props.databaseName), {
                 vpc: this.props.vpc,
                 databaseName: this.props.databaseName,
                 clusterIdentifier: this.getPrimaryClusterIdentifier(),

package/dist/lib/resources/aws/database/rdsHelpers.js

@@ -32,7 +32,7 @@ const MULTI_USER_ROTATION_APPLICATIONS = {
  */
 export function resolveStorageEncryptionKey(scope, databaseName, storageKey) {
     if (isCMKRequested(storageKey)) {
-        return new CustomerManagedKey(scope, `${databaseName}ClusterEncryptionKey`, { aliasName: `cmk/rds/${databaseName}/encryptionKey` }).key;
+        return new CustomerManagedKey(scope, `${databaseName}ClusterEncryptionKey`, { aliasName: ResourceNaming.storageEncryptionKeyAlias(databaseName) }).key;
     }
     if (isAwsManagedKey(storageKey) || storageKey === undefined) {
         return undefined;
@@ -45,7 +45,7 @@ export function resolveStorageEncryptionKey(scope, databaseName, storageKey) {
  */
 export function resolvePerformanceInsightsKey(scope, databaseName, piEnabled, encryptionKey) {
     if (piEnabled && isCMKRequested(encryptionKey)) {
-        return new CustomerManagedKey(scope, `${databaseName}PerformanceInsightsKey`, { aliasName: `cmk/rds/${databaseName}/InsightsKey` }).key;
+        return new CustomerManagedKey(scope, `${databaseName}PerformanceInsightsKey`, { aliasName: ResourceNaming.insightsKeyAlias(databaseName) }).key;
     }
     return undefined;
 }

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -80,7 +80,7 @@ export class RdsInstance extends Construct {
             snapshotUsername: props.snapshotUsername,
             assumedUsername: username
         });
-        this.databaseCredentials = new Secret(this, `${this.databaseNameValue}Credentials`, {
+        this.databaseCredentials = new Secret(this, ResourceNaming.credentialsSecretConstructId(this.databaseNameValue), {
             secretName: ResourceNaming.credentialsSecretName(this.constructId),
             generateSecretString: {
                 secretStringTemplate: JSON.stringify({
@@ -237,7 +237,7 @@ export class RdsInstance extends Construct {
         const { piEnabled, piConfig } = resolveDatabaseInsights(props.databaseInsights);
         const readReplicaPerformanceInsightsKey = piEnabled && isCMKRequested(piConfig?.encryptionKey)
             ? new CustomerManagedKey(this, `${this.databaseNameValue}ReadReplicaReaderInsightsKey`, {
-                aliasName: `cmk/rds/${this.databaseNameValue}/ReadReplicaInsightsKey`
+                aliasName: ResourceNaming.readReplicaInsightsKeyAlias(this.databaseNameValue)
             }).key
             : undefined;
         this.readReplicaSecurityGroup = new SecurityGroup(this, `${this.databaseNameValue}ReadReplicaSecurityGroup`, {

package/dist/lib/resources/aws/networking/vpc.js

@@ -3,6 +3,7 @@ import * as ec2 from "aws-cdk-lib/aws-ec2";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import { LogGroup } from "../logging/logGroup.js";
 import { S3Bucket } from "../storage/index.js";
+import { ResourceNaming } from "../../../utils/resourceNaming.js";
 export const FLOW_LOG_TRAFFIC_TYPES = ["ALL", "ACCEPT", "REJECT"];
 // Read at two sites (resources-layer constructor default + patterns-layer natGateways guard) that must agree.
 export const DEFAULT_MAX_AZS = 3;
@@ -171,7 +172,7 @@ export class Vpc extends ec2.Vpc {
         const trafficType = Vpc.resolveTrafficType(config.trafficType);
         if (config.destination === "s3") {
             const bucket = new S3Bucket(scope, `${id}FlowLogBucket`, {
-                bucketName: `vpc-flowlogs-${id.toLowerCase()}-${Stack.of(scope).account}`,
+                bucketName: ResourceNaming.vpcFlowLogBucketName(id, Stack.of(scope).account),
                 encryption: s3.BucketEncryption.S3_MANAGED,
                 lifecycleRules: config.retentionDays
                     ? [{ expiration: Duration.days(config.retentionDays), enabled: true }]

package/dist/lib/resources/aws/secrets/kms.js

@@ -2,6 +2,7 @@ import { CfnOutput, Duration, RemovalPolicy } from "aws-cdk-lib";
 import { Alias, Key } from "aws-cdk-lib/aws-kms";
 import { Construct } from "constructs";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
+import { ResourceNaming } from "../../../utils/resourceNaming.js";
 export class CustomerManagedKey extends Construct {
     key;
     alias;
@@ -22,7 +23,7 @@ export class CustomerManagedKey extends Construct {
             exportName: `${outputName}KeyArn`
         });
         this.alias = new Alias(this, `${id}KeyAlias`, {
-            aliasName: props.aliasName || `cmk/${id}`,
+            aliasName: props.aliasName || ResourceNaming.defaultKeyAlias(id),
             targetKey: this.key
         });
         new CfnOutput(this, `${outputName}KeyAliasArn`, {

package/dist/lib/resources/aws/secrets/secret.js

@@ -2,6 +2,7 @@ import { SecretValue } from "aws-cdk-lib";
 import { Secret as CdkSecret } from "aws-cdk-lib/aws-secretsmanager";
 import { Construct } from "constructs";
 import { CustomerManagedKey } from "./kms.js";
+import { ResourceNaming } from "../../../utils/resourceNaming.js";
 /**
  * Context key carrying the deploy-time `secretName -> completeArn` map. Written by
  * @fjall/deploy-core (`CdkArgumentBuilder.buildContextArgs` emits
@@ -71,7 +72,7 @@ export class Secret extends Construct {
         }
         // Create KMS key for new secrets only
         const customerManagedKey = new CustomerManagedKey(this, `${id}CustomerManagedKey`, {
-            aliasName: props.aliasName ?? `cmk/${id}`
+            aliasName: props.aliasName ?? ResourceNaming.defaultKeyAlias(id)
         });
         this.secretsCustomerManagedKey = customerManagedKey;
         /**

package/dist/lib/utils/resourceNaming.d.ts

@@ -41,4 +41,54 @@ export declare class ResourceNaming {
     static proxySecurityGroupDescription(name: string): string;
     /** Security group description for read replica. */
     static readReplicaSecurityGroupDescription(name: string): string;
+    /**
+     * KMS alias for a database's storage encryption key. `name` is the logical
+     * database name, and the casing is load-bearing — KMS aliases are
+     * case-sensitive and these are live on deployed keys.
+     *
+     * The three alias helpers return the value handed to `CustomerManagedKey`,
+     * which is what CDK prefixes with `alias/`; `kms list-aliases` reports the
+     * prefixed form.
+     */
+    static storageEncryptionKeyAlias(name: string): string;
+    /** KMS alias for a database's Database Insights encryption key. */
+    static insightsKeyAlias(name: string): string;
+    /** KMS alias for a read replica's Database Insights encryption key. */
+    static readReplicaInsightsKeyAlias(name: string): string;
+    /**
+     * Construct id of the RDS child the Database pattern creates for an
+     * `Instance` or `Aurora` plan. The instance, cluster, proxy and secret
+     * helpers are all fed this id, NOT the Database construct's own id, so
+     * anything predicting a deployed name from a resource plan starts here.
+     */
+    static rdsChildConstructId(databaseName: string): string;
+    /** Construct id of the RdsAuroraGlobal child, which names the cluster. */
+    static globalRdsChildConstructId(databaseName: string): string;
+    /**
+     * Construct id of the RdsAurora primary inside RdsAuroraGlobal, which names
+     * its instances, proxy and credentials secret.
+     */
+    static globalPrimaryConstructId(databaseName: string): string;
+    /** Construct id of a database's credentials Secret. */
+    static credentialsSecretConstructId(databaseName: string): string;
+    /**
+     * Alias a Secret or CustomerManagedKey takes when the caller supplies none.
+     * CDK prefixes it with `alias/`, which is the form `kms list-aliases`
+     * reports.
+     */
+    static defaultKeyAlias(constructId: string): string;
+    /**
+     * S3 bucket holding a VPC's flow logs. `id` is the Network construct id —
+     * the network name for an additional VPC, `${stackPrefix}Vpc` for the
+     * primary. Lowercased rather than kebabed: S3 forbids uppercase and this
+     * name is already live on deployed buckets, so the transform cannot change.
+     */
+    static vpcFlowLogBucketName(id: string, accountId: string): string;
+    /**
+     * ALB physical name for an ECS cluster. ELBv2 caps names at 32 characters
+     * and rejects a trailing hyphen, so a long cluster name is truncated and
+     * then stripped — which means the name is NOT simply
+     * `${clusterName}LoadBalancer` and must not be re-derived as if it were.
+     */
+    static loadBalancerName(clusterName: string): string;
 }

package/dist/lib/utils/resourceNaming.js

@@ -1,4 +1,6 @@
 import { toKebab } from "./capitaliseString.js";
+/** ELBv2's hard limit on an Application Load Balancer's name. */
+const LOAD_BALANCER_NAME_MAX_LENGTH = 32;
 /**
  * Centralised resource naming for infrastructure.
  * Ensures consistent, predictable names across constructs and tests.
@@ -73,4 +75,76 @@ export class ResourceNaming {
     static readReplicaSecurityGroupDescription(name) {
         return `Security group for RDS Read Replica ${name}`;
     }
+    /**
+     * KMS alias for a database's storage encryption key. `name` is the logical
+     * database name, and the casing is load-bearing — KMS aliases are
+     * case-sensitive and these are live on deployed keys.
+     *
+     * The three alias helpers return the value handed to `CustomerManagedKey`,
+     * which is what CDK prefixes with `alias/`; `kms list-aliases` reports the
+     * prefixed form.
+     */
+    static storageEncryptionKeyAlias(name) {
+        return `cmk/rds/${name}/encryptionKey`;
+    }
+    /** KMS alias for a database's Database Insights encryption key. */
+    static insightsKeyAlias(name) {
+        return `cmk/rds/${name}/InsightsKey`;
+    }
+    /** KMS alias for a read replica's Database Insights encryption key. */
+    static readReplicaInsightsKeyAlias(name) {
+        return `cmk/rds/${name}/ReadReplicaInsightsKey`;
+    }
+    /**
+     * Construct id of the RDS child the Database pattern creates for an
+     * `Instance` or `Aurora` plan. The instance, cluster, proxy and secret
+     * helpers are all fed this id, NOT the Database construct's own id, so
+     * anything predicting a deployed name from a resource plan starts here.
+     */
+    static rdsChildConstructId(databaseName) {
+        return `${databaseName}Rds`;
+    }
+    /** Construct id of the RdsAuroraGlobal child, which names the cluster. */
+    static globalRdsChildConstructId(databaseName) {
+        return `${databaseName}RdsGlobal`;
+    }
+    /**
+     * Construct id of the RdsAurora primary inside RdsAuroraGlobal, which names
+     * its instances, proxy and credentials secret.
+     */
+    static globalPrimaryConstructId(databaseName) {
+        return `${databaseName}Primary`;
+    }
+    /** Construct id of a database's credentials Secret. */
+    static credentialsSecretConstructId(databaseName) {
+        return `${databaseName}Credentials`;
+    }
+    /**
+     * Alias a Secret or CustomerManagedKey takes when the caller supplies none.
+     * CDK prefixes it with `alias/`, which is the form `kms list-aliases`
+     * reports.
+     */
+    static defaultKeyAlias(constructId) {
+        return `cmk/${constructId}`;
+    }
+    /**
+     * S3 bucket holding a VPC's flow logs. `id` is the Network construct id —
+     * the network name for an additional VPC, `${stackPrefix}Vpc` for the
+     * primary. Lowercased rather than kebabed: S3 forbids uppercase and this
+     * name is already live on deployed buckets, so the transform cannot change.
+     */
+    static vpcFlowLogBucketName(id, accountId) {
+        return `vpc-flowlogs-${id.toLowerCase()}-${accountId}`;
+    }
+    /**
+     * ALB physical name for an ECS cluster. ELBv2 caps names at 32 characters
+     * and rejects a trailing hyphen, so a long cluster name is truncated and
+     * then stripped — which means the name is NOT simply
+     * `${clusterName}LoadBalancer` and must not be re-derived as if it were.
+     */
+    static loadBalancerName(clusterName) {
+        return `${clusterName}LoadBalancer`
+            .slice(0, LOAD_BALANCER_NAME_MAX_LENGTH)
+            .replace(/-+$/, "");
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "7.2.0",
+  "version": "7.3.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -51,6 +51,10 @@
     "typecheck:tests": "tsc --noEmit -p tsconfig.test.json",
     "check:scripts": "tsc --project tsconfig.scripts.json",
     "deploy-test": "tsx deploy-tests/run.mts",
+    "deploy-test:ops": "tsx deploy-tests/ops.mts",
+    "deploy-test:select": "tsx deploy-tests/select.mts",
+    "deploy-test:pipeline": "tsx deploy-tests/pipeline/renderPipelineSteps.mts",
+    "deploy-test:pipeline:check": "tsx deploy-tests/pipeline/renderPipelineSteps.mts --check",
     "lint": "eslint lib --no-warn-ignored",
     "lint:fix": "eslint lib --fix --no-warn-ignored",
     "format": "prettier --write \"lib/**/*.{ts,tsx,js,jsx,json}\" \"scripts/**/*.mts\" \"deploy-tests/**/*.mts\"",
@@ -74,8 +78,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^7.2.0",
-    "@fjall/util": "^7.2.0",
+    "@fjall/generator": "^7.3.0",
+    "@fjall/util": "^7.3.0",
     "constructs": "^10.7.2"
   },
   "overrides": {