@friggframework/devtools 2.0.0--canary.425.2d58c19.0 → 2.0.0--canary.427.c8ff14b.0

package/frigg-cli/generate-command/__tests__/generate-command.test.js

@@ -54,7 +54,7 @@ describe('Generate Command', () => {
         // Mock app definition
         jest.doMock(mockAppDefinitionPath, () => ({
             vpc: { enable: true },
-            encryption: { fieldLevelEncryptionMethod: 'kms' },
+            encryption: { useDefaultKMSForFieldLevelEncryption: true },
             ssm: { enable: true },
             websockets: { enable: false }
         }), { virtual: true });

package/frigg-cli/generate-command/index.js

@@ -228,7 +228,7 @@ async function generateCommand(options = {}) {
 function analyzeAppFeatures(appDefinition) {
     const features = {
         vpc: appDefinition.vpc?.enable === true,
-        kms: appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms',
+        kms: appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption === true,
         ssm: appDefinition.ssm?.enable === true,
         websockets: appDefinition.websockets?.enable === true,
         // Add more feature detection as needed

package/frigg-cli/init-command/backend-first-handler.js

@@ -670,7 +670,7 @@ To integrate Frigg into your production application:
             const appDefinition = {
                 integrations: [], // Will be populated based on selected integrations
                 user: { password: true },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: true },
                 vpc: { enable: true },
                 security: {
                     cors: {

package/infrastructure/AWS-DISCOVERY-TROUBLESHOOTING.md

@@ -9,7 +9,7 @@ AWS Discovery automatically finds your default AWS resources (VPC, subnets, secu
 AWS Discovery runs automatically during `frigg build` and `frigg deploy` when your AppDefinition includes:
 
 - `vpc.enable: true` - VPC support
-- `encryption.fieldLevelEncryptionMethod: 'kms'` - KMS encryption
+- `encryption.useDefaultKMSForFieldLevelEncryption: true` - KMS encryption
 - `ssm.enable: true` - SSM Parameter Store
 
 ## Fail-Fast Behavior
@@ -222,7 +222,7 @@ If you're stuck, try this recovery process:
    // backend/index.js - temporarily disable problematic features
    const appDefinition = {
        vpc: { enable: false },
-       encryption: { fieldLevelEncryptionMethod: 'aes' },
+       encryption: { useDefaultKMSForFieldLevelEncryption: false },
        ssm: { enable: false }
    };
    ```

package/infrastructure/AWS-IAM-CREDENTIAL-NEEDS.md

@@ -354,7 +354,7 @@ Additional permissions needed when your app definition includes `vpc: { enable:
 
 ### KMS Support
 
-Additional permissions needed when your app definition includes `encryption: { fieldLevelEncryptionMethod: 'kms' }`:
+Additional permissions needed when your app definition includes `encryption: { useDefaultKMSForFieldLevelEncryption: true }`:
 
 ```json
 {

package/infrastructure/GENERATE-IAM-DOCS.md

@@ -58,7 +58,7 @@ The command analyzes your `backend/index.js` AppDefinition and generates IAM pol
 -   Route table and security group management
 -   Elastic IP allocation
 
-#### KMS Encryption (`encryption.fieldLevelEncryptionMethod: 'kms'`)
+#### KMS Encryption (`encryption.useDefaultKMSForFieldLevelEncryption: true`)
 
 -   KMS key usage for Lambda and S3
 -   Data encryption and decryption permissions
@@ -85,7 +85,7 @@ const appDefinition = {
         enable: true,
     },
     encryption: {
-        fieldLevelEncryptionMethod: 'kms',
+        useDefaultKMSForFieldLevelEncryption: true,
     },
     ssm: {
         enable: false,

package/infrastructure/README.md

@@ -155,8 +155,7 @@ const appDefinition = {
 
   // KMS encryption
   encryption: {
-    fieldLevelEncryptionMethod: 'kms',
-    createResourceIfNoneFound: true
+    useDefaultKMSForFieldLevelEncryption: true
   },
 
   // SSM Parameter Store
@@ -218,7 +217,7 @@ const serverlessConfig = await composeServerlessDefinition(appDefinition);
 const appDefinition = {
     name: 'secure-app',
     vpc: { enable: true },
-    encryption: { fieldLevelEncryptionMethod: 'kms' },
+    encryption: { useDefaultKMSForFieldLevelEncryption: true },
     ssm: { enable: true },
     integrations: [{ Definition: { name: 'salesforce' } }],
 };

package/infrastructure/__tests__/fixtures/mock-aws-resources.js

@@ -151,7 +151,7 @@ const mockAppDefinitions = {
     
     kmsOnly: {
         name: 'kms-test-app',
-        encryption: { fieldLevelEncryptionMethod: 'kms' },
+        encryption: { useDefaultKMSForFieldLevelEncryption: true },
         integrations: []
     },
     
@@ -164,7 +164,7 @@ const mockAppDefinitions = {
     allFeatures: {
         name: 'full-feature-app',
         vpc: { enable: true },
-        encryption: { fieldLevelEncryptionMethod: 'kms' },
+        encryption: { useDefaultKMSForFieldLevelEncryption: true },
         ssm: { enable: true },
         integrations: [{
             Definition: {
@@ -281,7 +281,7 @@ const mockEnvironmentVariables = {
     AWS_DISCOVERY_SUBNET_ID_1: mockSubnets[0].SubnetId,
     AWS_DISCOVERY_SUBNET_ID_2: mockSubnets[1].SubnetId,
     AWS_DISCOVERY_ROUTE_TABLE_ID: mockRouteTables[0].RouteTableId,
-    AWS_DISCOVERY_KMS_KEY_ID:mockKmsKeyMetadata.Arn
+    AWS_DISCOVERY_KMS_KEY_ID: mockKmsKeyMetadata.Arn
 };
 
 // Fallback environment variables for error scenarios
@@ -291,7 +291,7 @@ const mockFallbackEnvironmentVariables = {
     AWS_DISCOVERY_SUBNET_ID_1: 'subnet-fallback-1',
     AWS_DISCOVERY_SUBNET_ID_2: 'subnet-fallback-2',
     AWS_DISCOVERY_ROUTE_TABLE_ID: 'rtb-fallback',
-    AWS_DISCOVERY_KMS_KEY_ID:'arn:aws:kms:*:*:key/*'
+    AWS_DISCOVERY_KMS_KEY_ID: 'arn:aws:kms:*:*:key/*'
 };
 
 // Mock AWS SDK responses

package/infrastructure/__tests__/helpers/test-utils.js

@@ -115,7 +115,7 @@ function createMockAppDefinition(features = {}, integrations = []) {
     }
 
     if (features.kms) {
-        appDefinition.encryption = { fieldLevelEncryptionMethod: 'kms' };
+        appDefinition.encryption = { useDefaultKMSForFieldLevelEncryption: true };
     }
 
     if (features.ssm) {

package/infrastructure/aws-discovery.js

@@ -453,16 +453,18 @@ class AWSDiscovery {
 
     /**
      * Find the default KMS key for the account
-     * @returns {Promise<string|null>} KMS key ARN or null if no key found
+     * @returns {Promise<string>} KMS key ARN or wildcard pattern as fallback
      */
     async findDefaultKmsKey() {
         try {
+            // First try to find a key with alias/aws/lambda
             const command = new ListKeysCommand({});
             const response = await this.kmsClient.send(command);
             
             if (!response.Keys || response.Keys.length === 0) {
-                console.log('No KMS keys found in account');
-                return null;
+                // Return AWS managed key ARN pattern as fallback
+                const accountId = await this.getAccountId();
+                return `arn:aws:kms:${this.region}:${accountId}:key/*`;
             }
 
             // Look for customer managed keys first
@@ -474,21 +476,21 @@ class AWSDiscovery {
                     if (keyDetails.KeyMetadata && 
                         keyDetails.KeyMetadata.KeyManager === 'CUSTOMER' &&
                         keyDetails.KeyMetadata.KeyState === 'Enabled') {
-                        console.log(`Found customer managed KMS key: ${keyDetails.KeyMetadata.Arn}`);
                         return keyDetails.KeyMetadata.Arn;
                     }
                 } catch (error) {
                     // Continue to next key if we can't describe this one
-                    console.warn(`Could not describe key ${key.KeyId}:`, error.message);
                     continue;
                 }
             }
 
-            console.log('No customer managed KMS keys found');
-            return null;
+            // Fallback to wildcard pattern for AWS managed keys
+            const accountId = await this.getAccountId();
+            return `arn:aws:kms:${this.region}:${accountId}:key/*`;
         } catch (error) {
             console.error('Error finding default KMS key:', error);
-            return null;
+            // Return wildcard pattern as ultimate fallback
+            return '*';
         }
     }
 
@@ -501,7 +503,7 @@ class AWSDiscovery {
      * @returns {string} return.privateSubnetId2 - Second private subnet ID
      * @returns {string} return.publicSubnetId - Public subnet ID for NAT Gateway
      * @returns {string} return.privateRouteTableId - Private route table ID
-     * @returns {string|null} return.defaultKmsKeyId - Default KMS key ARN or null if not found
+     * @returns {string} return.defaultKmsKeyId - Default KMS key ARN
      * @throws {Error} If resource discovery fails
      */
     async discoverResources() {
@@ -524,11 +526,7 @@ class AWSDiscovery {
             console.log(`Found route table: ${routeTable.RouteTableId}`);
             
             const kmsKeyArn = await this.findDefaultKmsKey();
-            if (kmsKeyArn) {
-                console.log(`Found KMS key: ${kmsKeyArn}`);
-            } else {
-                console.log('No KMS key found');
-            }
+            console.log(`Found KMS key: ${kmsKeyArn}`);
             
             // Try to find existing NAT Gateway
             const existingNatGateway = await this.findExistingNatGateway(vpc.VpcId);

package/infrastructure/build-time-discovery.js

@@ -137,8 +137,8 @@ class BuildTimeDiscovery {
             console.log('Running pre-build AWS discovery hook...');
             
             // Only run discovery if VPC, KMS, or SSM features are enabled
-            const needsDiscovery = appDefinition.vpc?.enable ||
-                                 appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms' ||
+            const needsDiscovery = appDefinition.vpc?.enable || 
+                                 appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ||
                                  appDefinition.ssm?.enable;
             
             if (!needsDiscovery) {
@@ -159,7 +159,7 @@ class BuildTimeDiscovery {
                 AWS_DISCOVERY_SUBNET_ID_2: resources.privateSubnetId2,
                 AWS_DISCOVERY_PUBLIC_SUBNET_ID: resources.publicSubnetId,
                 AWS_DISCOVERY_ROUTE_TABLE_ID: resources.privateRouteTableId,
-                AWS_DISCOVERY_KMS_KEY_ID: resources.defaultKmsKeyId  // Keep consistent naming convention (even though it's an ARN)
+                AWS_DISCOVERY_KMS_KEY_ID: resources.defaultKmsKeyId
             };
             
             // Set environment variables for serverless to use

package/infrastructure/build-time-discovery.test.js

@@ -250,7 +250,7 @@ describe('BuildTimeDiscovery', () => {
 
         it('should run discovery when KMS is enabled', async () => {
             const appDefinition = {
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: true },
                 integrations: []
             };
 

package/infrastructure/iam-generator.js

@@ -35,7 +35,7 @@ function generateIAMCloudFormation(appDefinition, options = {}) {
             vpc: appDefinition.vpc?.enable === true,
             kms:
                 appDefinition.encryption
-                    ?.fieldLevelEncryptionMethod === 'kms',
+                    ?.useDefaultKMSForFieldLevelEncryption === true,
             ssm: appDefinition.ssm?.enable === true,
             websockets: appDefinition.websockets?.enable === true,
         };
@@ -605,19 +605,6 @@ function generateIAMCloudFormation(appDefinition, options = {}) {
                                 },
                             },
                         },
-                        {
-                            Sid: 'FriggKMSManagement',
-                            Effect: 'Allow',
-                            Action: [
-                                'kms:CreateKey',
-                                'kms:PutKeyPolicy',
-                                'kms:EnableKeyRotation',
-                                'kms:TagResource',
-                                'kms:UntagResource',
-                                'kms:ListResourceTags',
-                            ],
-                            Resource: '*',
-                        },
                     ],
                 },
             },
@@ -737,7 +724,8 @@ function getFeatureSummary(appDefinition) {
         core: true, // Always enabled
         vpc: appDefinition.vpc?.enable === true,
         kms:
-            appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms',
+            appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ===
+            true,
         ssm: appDefinition.ssm?.enable === true,
         websockets: appDefinition.websockets?.enable === true,
     };

package/infrastructure/iam-generator.test.js

@@ -7,7 +7,7 @@ describe('IAM Generator', () => {
                 name: 'test-app',
                 integrations: ['Integration1', 'Integration2'],
                 vpc: { enable: true },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: true },
                 ssm: { enable: true },
                 websockets: { enable: true }
             };
@@ -46,7 +46,7 @@ describe('IAM Generator', () => {
                 name: 'test-app',
                 integrations: [],
                 vpc: { enable: false },
-                encryption: { fieldLevelEncryptionMethod: 'aes' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: false },
                 ssm: { enable: false },
                 websockets: { enable: false }
             };
@@ -77,7 +77,7 @@ describe('IAM Generator', () => {
             const appDefinition = {
                 name: 'test-app',
                 integrations: [],
-                encryption: { fieldLevelEncryptionMethod: 'kms' }
+                encryption: { useDefaultKMSForFieldLevelEncryption: true }
             };
 
             const yaml = generateIAMCloudFormation(appDefinition);
@@ -106,7 +106,7 @@ describe('IAM Generator', () => {
                 name: 'test-app',
                 integrations: [],
                 vpc: { enable: true },
-                encryption: { fieldLevelEncryptionMethod: 'aes' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: false },
                 ssm: { enable: true }
             };
 

package/infrastructure/integration.test.js

@@ -49,7 +49,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             const appDefinition = {
                 name: 'test-frigg-app',
                 vpc: { enable: true },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: true },
                 ssm: { enable: true },
                 integrations: [{
                     Definition: {
@@ -67,7 +67,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             process.env.AWS_DISCOVERY_SUBNET_ID_1 = discoveredResources.privateSubnetId1;
             process.env.AWS_DISCOVERY_SUBNET_ID_2 = discoveredResources.privateSubnetId2;
             process.env.AWS_DISCOVERY_ROUTE_TABLE_ID = discoveredResources.privateRouteTableId;
-            process.env.AWS_DISCOVERY_KMS_KEY_ID =discoveredResources.defaultKmsKeyId;
+            process.env.AWS_DISCOVERY_KMS_KEY_ID = discoveredResources.defaultKmsKeyId;
 
             // Generate serverless configuration
             const serverlessConfig = composeServerlessDefinition(appDefinition);
@@ -173,11 +173,11 @@ describe('VPC/KMS/SSM Integration Tests', () => {
         it('should generate config with only KMS enabled', async () => {
             const appDefinition = {
                 name: 'kms-only-app',
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: true },
                 integrations: []
             };
 
-            process.env.AWS_DISCOVERY_KMS_KEY_ID =mockAWSResources.defaultKmsKeyId;
+            process.env.AWS_DISCOVERY_KMS_KEY_ID = mockAWSResources.defaultKmsKeyId;
 
             const serverlessConfig = composeServerlessDefinition(appDefinition);
 
@@ -231,7 +231,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             expect(mockBuildTimeDiscovery.preBuildHook).toHaveBeenCalledWith(
                 expect.objectContaining({
                     vpc: { enable: true },
-                    encryption: { fieldLevelEncryptionMethod: 'kms' }
+                    encryption: { useDefaultKMSForFieldLevelEncryption: true }
                 }),
                 'us-east-1'
             );
@@ -302,7 +302,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             process.env.AWS_DISCOVERY_SECURITY_GROUP_ID = mockAWSResources.defaultSecurityGroupId;
             process.env.AWS_DISCOVERY_SUBNET_ID_1 = mockAWSResources.privateSubnetId1;
             process.env.AWS_DISCOVERY_SUBNET_ID_2 = mockAWSResources.privateSubnetId2;
-            process.env.AWS_DISCOVERY_KMS_KEY_ID =mockAWSResources.defaultKmsKeyId;
+            process.env.AWS_DISCOVERY_KMS_KEY_ID = mockAWSResources.defaultKmsKeyId;
 
             // In a real deployment, serverless framework would resolve these environment variables
             // For testing, we can verify the placeholders are correctly formatted
@@ -353,7 +353,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
 
             const appDefinition = {
                 vpc: { enable: true },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: true },
                 integrations: []
             };
 

package/infrastructure/run-discovery.js

@@ -41,7 +41,7 @@ async function runDiscovery() {
 
         // Check if discovery is needed
         const needsDiscovery = appDefinition.vpc?.enable || 
-                              appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms' ||
+                              appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ||
                               appDefinition.ssm?.enable;
         
         if (!needsDiscovery) {
@@ -51,7 +51,7 @@ async function runDiscovery() {
 
         console.log('📋 App requires AWS discovery for:');
         if (appDefinition.vpc?.enable) console.log('   ✅ VPC support');
-        if (appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') console.log('   ✅ KMS encryption');
+        if (appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption) console.log('   ✅ KMS encryption');
         if (appDefinition.ssm?.enable) console.log('   ✅ SSM parameters');
 
         // Run discovery
@@ -82,7 +82,7 @@ async function runDiscovery() {
         } else {
             console.error('🚨 Discovery is required because your AppDefinition has these features enabled:');
             if (appDefinition.vpc?.enable) console.error('   ❌ VPC support (vpc.enable: true)');
-            if (appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') console.error('   ❌ KMS encryption (encryption.fieldLevelEncryptionMethod: \'kms\')');
+            if (appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption) console.error('   ❌ KMS encryption (encryption.useDefaultKMSForFieldLevelEncryption: true)');
             if (appDefinition.ssm?.enable) console.error('   ❌ SSM parameters (ssm.enable: true)');
             console.error('');
             console.error('💡 To fix this issue:');
@@ -95,7 +95,7 @@ async function runDiscovery() {
         
         console.error('🔧 Or disable features in backend/index.js:');
         console.error('   vpc: { enable: false }');
-        console.error('   encryption: { fieldLevelEncryptionMethod: \'aes\' }');
+        console.error('   encryption: { useDefaultKMSForFieldLevelEncryption: false }');
         console.error('   ssm: { enable: false }');
         
         process.exit(1);

package/infrastructure/serverless-template.js

@@ -10,7 +10,8 @@ const { AWSDiscovery } = require('./aws-discovery');
 const shouldRunDiscovery = (AppDefinition) => {
     return (
         AppDefinition.vpc?.enable === true ||
-        AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms' ||
+        AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ===
+            true ||
         AppDefinition.ssm?.enable === true
     );
 };
@@ -492,7 +493,10 @@ const createVPCInfrastructure = (AppDefinition) => {
         };
 
         // KMS Interface Endpoint (paid, but useful if using KMS)
-        if (AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
+        if (
+            AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ===
+            true
+        ) {
             vpcResources.FriggKMSVPCEndpoint = {
                 Type: 'AWS::EC2::VPCEndpoint',
                 Properties: {
@@ -887,7 +891,9 @@ const composeServerlessDefinition = async (AppDefinition) => {
     };
 
     // KMS Configuration based on App Definition
-    if (AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
+    if (
+        AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption === true
+    ) {
         // Check if a KMS key was discovered
         if (discoveredResources.defaultKmsKeyId) {
             // Use the existing discovered KMS key
@@ -901,112 +907,55 @@ const composeServerlessDefinition = async (AppDefinition) => {
                 Resource: [discoveredResources.defaultKmsKeyId],
             });
 
-            // KMS_KEY_ARN will be set later from custom.kmsGrants for consistency
+            definition.provider.environment.KMS_KEY_ARN =
+                discoveredResources.defaultKmsKeyId;
         } else {
-            // No existing key found - check if we should create one or error
-            if (AppDefinition.encryption?.createResourceIfNoneFound === true) {
-                // Create a new KMS key
-                console.log('No existing KMS key found, creating a new one...');
+            // No existing key found, provision a dedicated KMS key
+            console.log('No existing KMS key found, creating a new one...');
 
-                definition.resources.Resources.FriggKMSKey = {
-                    Type: 'AWS::KMS::Key',
-                    Properties: {
-                        EnableKeyRotation: true,
-                        Description: 'Frigg KMS key for field-level encryption',
-                        KeyPolicy: {
-                            Version: '2012-10-17',
-                            Statement: [
-                                {
-                                    Sid: 'AllowRootAccountAdmin',
-                                    Effect: 'Allow',
-                                    Principal: {
-                                        AWS: {
-                                            'Fn::Sub':
-                                                'arn:aws:iam::${AWS::AccountId}:root',
-                                        },
-                                    },
-                                    Action: 'kms:*',
-                                    Resource: '*',
-                                },
-                                {
-                                    Sid: 'AllowLambdaService',
-                                    Effect: 'Allow',
-                                    Principal: {
-                                        Service: 'lambda.amazonaws.com',
-                                    },
-                                    Action: [
-                                        'kms:GenerateDataKey',
-                                        'kms:Decrypt',
-                                        'kms:DescribeKey',
-                                    ],
-                                    Resource: '*',
-                                    Condition: {
-                                        StringEquals: {
-                                            'kms:ViaService': `lambda.${
-                                                process.env.AWS_REGION ||
-                                                'us-east-1'
-                                            }.amazonaws.com`,
-                                        },
+            definition.resources.Resources.FriggKMSKey = {
+                Type: 'AWS::KMS::Key',
+                Properties: {
+                    EnableKeyRotation: true,
+                    KeyPolicy: {
+                        Version: '2012-10-17',
+                        Statement: [
+                            {
+                                Sid: 'AllowRootAccountAdmin',
+                                Effect: 'Allow',
+                                Principal: {
+                                    AWS: {
+                                        'Fn::Sub':
+                                            'arn:aws:iam::${AWS::AccountId}:root',
                                     },
                                 },
-                            ],
-                        },
-                        Tags: [
-                            {
-                                Key: 'Name',
-                                Value: '${self:service}-${self:provider.stage}-frigg-kms-key',
-                            },
-                            {
-                                Key: 'Purpose',
-                                Value: 'Field-level encryption for Frigg application',
+                                Action: 'kms:*',
+                                Resource: '*',
                             },
                         ],
                     },
-                };
-
-                definition.provider.iamRoleStatements.push({
-                    Effect: 'Allow',
-                    Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
-                    Resource: [{ 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }],
-                });
+                },
+            };
 
-                definition.provider.environment.KMS_KEY_ARN = {
-                    'Fn::GetAtt': ['FriggKMSKey', 'Arn'],
-                };
+            definition.provider.iamRoleStatements.push({
+                Effect: 'Allow',
+                Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
+                Resource: [{ 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }],
+            });
 
-                // Configure KMS grants to reference the created key
-                definition.custom.kmsGrants = {
-                    kmsKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }
-                };
-            } else {
-                // No key found and createIfNoneFound is not enabled - error
-                throw new Error(
-                    'KMS field-level encryption is enabled but no KMS key was found. ' +
-                        'Either provide an existing KMS key or set encryption.createResourceIfNoneFound to true to create a new key.'
-                );
-            }
+            definition.provider.environment.KMS_KEY_ARN = {
+                'Fn::GetAtt': ['FriggKMSKey', 'Arn'],
+            };
         }
 
         definition.plugins.push('serverless-kms-grants');
 
-        // Configure KMS grants if not already set (when using existing key)
-        if (!definition.custom.kmsGrants) {
-            definition.custom.kmsGrants = {
-                kmsKeyId:
-                    discoveredResources.defaultKmsKeyId ||
-                    '${env:AWS_DISCOVERY_KMS_KEY_ID}',
-            };
-        }
-
-        // Always set KMS_KEY_ARN from custom.kmsGrants for consistency
-        // This translates AWS_DISCOVERY_KMS_KEY_ID to the runtime variable KMS_KEY_ARN
-        if (!definition.provider.environment.KMS_KEY_ARN) {
-            // Use the discovered value directly when available (from in-process discovery)
-            // Otherwise fall back to environment variable (from separate discovery process)
-            definition.provider.environment.KMS_KEY_ARN =
+        // Configure KMS grants with discovered default key or environment variable
+        definition.custom.kmsGrants = {
+            kmsKeyId:
                 discoveredResources.defaultKmsKeyId ||
-                '${env:AWS_DISCOVERY_KMS_KEY_ID}';
-        }
+                '${env:AWS_DISCOVERY_KMS_KEY_ID}',
+        };
     }
 
     // VPC Configuration based on App Definition
@@ -1303,6 +1252,62 @@ const composeServerlessDefinition = async (AppDefinition) => {
                 definition.custom[queueReference] = queueName;
             }
         }
+
+        // Discovery has already run successfully at this point if needed
+        // The discoveredResources object contains all the necessary AWS resources
+
+        // Add websocket function if enabled
+        if (AppDefinition.websockets?.enable === true) {
+            definition.functions.defaultWebsocket = {
+                handler:
+                    'node_modules/@friggframework/core/handlers/routers/websocket.handler',
+                events: [
+                    {
+                        websocket: {
+                            route: '$connect',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$default',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$disconnect',
+                        },
+                    },
+                ],
+            };
+        }
+
+        // Discovery has already run successfully at this point if needed
+        // The discoveredResources object contains all the necessary AWS resources
+
+        // Add websocket function if enabled
+        if (AppDefinition.websockets?.enable === true) {
+            definition.functions.defaultWebsocket = {
+                handler:
+                    'node_modules/@friggframework/core/handlers/routers/websocket.handler',
+                events: [
+                    {
+                        websocket: {
+                            route: '$connect',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$default',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$disconnect',
+                        },
+                    },
+                ],
+            };
+        }
     }
 
     // Discovery has already run successfully at this point if needed
@@ -1333,6 +1338,9 @@ const composeServerlessDefinition = async (AppDefinition) => {
         };
     }
 
+    // Discovery has already run successfully at this point if needed
+    // The discoveredResources object contains all the necessary AWS resources
+
     // Modify handler paths to point to the correct node_modules location
     definition.functions = modifyHandlerPaths(definition.functions);
 

package/infrastructure/serverless-template.test.js

@@ -118,9 +118,16 @@ describe('composeServerlessDefinition', () => {
 
             const result = await composeServerlessDefinition(appDefinition);
 
-            expect(result.provider.vpc).toBeDefined();
-            expect(result.provider.vpc.securityGroupIds).toEqual(['sg-123456']);
-            expect(result.provider.vpc.subnetIds).toEqual(['subnet-123456', 'subnet-789012']);
+            expect(result.provider.vpc).toBe('${self:custom.vpc.${self:provider.stage}}');
+            expect(result.custom.vpc).toEqual({
+                '${self:provider.stage}': {
+                    securityGroupIds: ['${env:AWS_DISCOVERY_SECURITY_GROUP_ID}'],
+                    subnetIds: [
+                        '${env:AWS_DISCOVERY_SUBNET_ID_1}',
+                        '${env:AWS_DISCOVERY_SUBNET_ID_2}'
+                    ]
+                }
+            });
         });
 
         it('should add VPC endpoint for S3 when VPC is enabled', async () => {
@@ -131,9 +138,15 @@ describe('composeServerlessDefinition', () => {
 
             const result = await composeServerlessDefinition(appDefinition);
 
-            expect(result.resources.Resources.VPCEndpointS3).toBeDefined();
-            expect(result.resources.Resources.VPCEndpointS3.Type).toBe('AWS::EC2::VPCEndpoint');
-            expect(result.resources.Resources.VPCEndpointS3.Properties.VpcId).toBe('vpc-123456');
+            expect(result.resources.Resources.VPCEndpointS3).toEqual({
+                Type: 'AWS::EC2::VPCEndpoint',
+                Properties: {
+                    VpcId: '${env:AWS_DISCOVERY_VPC_ID}',
+                    ServiceName: 'com.amazonaws.${self:provider.region}.s3',
+                    VpcEndpointType: 'Gateway',
+                    RouteTableIds: ['${env:AWS_DISCOVERY_ROUTE_TABLE_ID}']
+                }
+            });
         });
 
         it('should not add VPC configuration when vpc.enable is false', async () => {
@@ -145,6 +158,7 @@ describe('composeServerlessDefinition', () => {
             const result = await composeServerlessDefinition(appDefinition);
 
             expect(result.provider.vpc).toBeUndefined();
+            expect(result.custom.vpc).toBeUndefined();
             expect(result.resources.Resources.VPCEndpointS3).toBeUndefined();
         });
 
@@ -156,13 +170,14 @@ describe('composeServerlessDefinition', () => {
             const result = await composeServerlessDefinition(appDefinition);
 
             expect(result.provider.vpc).toBeUndefined();
+            expect(result.custom.vpc).toBeUndefined();
         });
     });
 
     describe('KMS Configuration', () => {
-        it('should add KMS configuration when encryption is enabled and key is found', async () => {
+        it('should add KMS configuration when encryption is enabled', async () => {
             const appDefinition = {
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: true },
                 integrations: []
             };
 
@@ -178,188 +193,24 @@ describe('composeServerlessDefinition', () => {
                     'kms:GenerateDataKey',
                     'kms:Decrypt'
                 ],
-                Resource: ['arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012']
+                Resource: ['${self:custom.kmsGrants.kmsKeyId}']
             });
 
             // Check environment variable
-            expect(result.provider.environment.KMS_KEY_ARN).toBe('arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012');
+            expect(result.provider.environment.KMS_KEY_ARN).toBe('${self:custom.kmsGrants.kmsKeyId}');
 
             // Check plugin
             expect(result.plugins).toContain('serverless-kms-grants');
 
             // Check custom configuration
             expect(result.custom.kmsGrants).toEqual({
-                kmsKeyId: 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012'
-            });
-        });
-
-        it('should create new KMS key when encryption is enabled, no key found, and createResourceIfNoneFound is true', async () => {
-            // Mock AWS discovery to return no KMS key
-            const { AWSDiscovery } = require('./aws-discovery');
-            const mockDiscoverResources = jest.fn().mockResolvedValue({
-                defaultVpcId: 'vpc-123456',
-                defaultSecurityGroupId: 'sg-123456',
-                privateSubnetId1: 'subnet-123456',
-                privateSubnetId2: 'subnet-789012',
-                publicSubnetId: 'subnet-public',
-                defaultRouteTableId: 'rtb-123456',
-                defaultKmsKeyId: null // No KMS key found
-            });
-            AWSDiscovery.mockImplementation(() => ({
-                discoverResources: mockDiscoverResources
-            }));
-
-            const appDefinition = {
-                encryption: {
-                    fieldLevelEncryptionMethod: 'kms',
-                    createResourceIfNoneFound: true
-                },
-                integrations: []
-            };
-
-            const result = await composeServerlessDefinition(appDefinition);
-
-            // Check that KMS key resource was created
-            expect(result.resources.Resources.FriggKMSKey).toEqual({
-                Type: 'AWS::KMS::Key',
-                Properties: {
-                    EnableKeyRotation: true,
-                    Description: 'Frigg KMS key for field-level encryption',
-                    KeyPolicy: {
-                        Version: '2012-10-17',
-                        Statement: [
-                            {
-                                Sid: 'AllowRootAccountAdmin',
-                                Effect: 'Allow',
-                                Principal: {
-                                    AWS: {
-                                        'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:root'
-                                    }
-                                },
-                                Action: 'kms:*',
-                                Resource: '*'
-                            },
-                            {
-                                Sid: 'AllowLambdaService',
-                                Effect: 'Allow',
-                                Principal: {
-                                    Service: 'lambda.amazonaws.com'
-                                },
-                                Action: [
-                                    'kms:GenerateDataKey',
-                                    'kms:Decrypt',
-                                    'kms:DescribeKey'
-                                ],
-                                Resource: '*',
-                                Condition: {
-                                    StringEquals: {
-                                        'kms:ViaService': 'lambda.us-east-1.amazonaws.com'
-                                    }
-                                }
-                            }
-                        ]
-                    },
-                    Tags: [
-                        {
-                            Key: 'Name',
-                            Value: '${self:service}-${self:provider.stage}-frigg-kms-key'
-                        },
-                        {
-                            Key: 'Purpose',
-                            Value: 'Field-level encryption for Frigg application'
-                        }
-                    ]
-                }
-            });
-
-            // Check IAM permissions for the new key
-            const kmsPermission = result.provider.iamRoleStatements.find(
-                statement => statement.Action.includes('kms:GenerateDataKey')
-            );
-            expect(kmsPermission).toEqual({
-                Effect: 'Allow',
-                Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
-                Resource: [{ 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }]
-            });
-
-            // Check environment variable
-            expect(result.provider.environment.KMS_KEY_ARN).toEqual({
-                'Fn::GetAtt': ['FriggKMSKey', 'Arn']
-            });
-
-            // Check plugin
-            expect(result.plugins).toContain('serverless-kms-grants');
-
-            // Check custom configuration
-            // When creating a new key, it should reference the CloudFormation resource
-            expect(result.custom.kmsGrants).toEqual({
-                kmsKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }
-            });
-        });
-
-        it('should throw error when encryption is enabled, no key found, and createResourceIfNoneFound is false', async () => {
-            // Mock AWS discovery to return no KMS key
-            const { AWSDiscovery } = require('./aws-discovery');
-            const mockDiscoverResources = jest.fn().mockResolvedValue({
-                defaultVpcId: 'vpc-123456',
-                defaultSecurityGroupId: 'sg-123456',
-                privateSubnetId1: 'subnet-123456',
-                privateSubnetId2: 'subnet-789012',
-                publicSubnetId: 'subnet-public',
-                defaultRouteTableId: 'rtb-123456',
-                defaultKmsKeyId: null // No KMS key found
-            });
-            AWSDiscovery.mockImplementation(() => ({
-                discoverResources: mockDiscoverResources
-            }));
-
-            const appDefinition = {
-                encryption: {
-                    fieldLevelEncryptionMethod: 'kms',
-                    createResourceIfNoneFound: false
-                },
-                integrations: []
-            };
-
-            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow(
-                'KMS field-level encryption is enabled but no KMS key was found. ' +
-                'Either provide an existing KMS key or set encryption.createResourceIfNoneFound to true to create a new key.'
-            );
-        });
-
-        it('should throw error when encryption is enabled, no key found, and createResourceIfNoneFound is not specified', async () => {
-            // Mock AWS discovery to return no KMS key
-            const { AWSDiscovery } = require('./aws-discovery');
-            const mockDiscoverResources = jest.fn().mockResolvedValue({
-                defaultVpcId: 'vpc-123456',
-                defaultSecurityGroupId: 'sg-123456',
-                privateSubnetId1: 'subnet-123456',
-                privateSubnetId2: 'subnet-789012',
-                publicSubnetId: 'subnet-public',
-                defaultRouteTableId: 'rtb-123456',
-                defaultKmsKeyId: null // No KMS key found
+                kmsKeyId: '${env:AWS_DISCOVERY_KMS_KEY_ID}'
             });
-            AWSDiscovery.mockImplementation(() => ({
-                discoverResources: mockDiscoverResources
-            }));
-
-            const appDefinition = {
-                encryption: {
-                    fieldLevelEncryptionMethod: 'kms'
-                    // createResourceIfNoneFound not specified, defaults to false
-                },
-                integrations: []
-            };
-
-            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow(
-                'KMS field-level encryption is enabled but no KMS key was found. ' +
-                'Either provide an existing KMS key or set encryption.createResourceIfNoneFound to true to create a new key.'
-            );
         });
 
         it('should not add KMS configuration when encryption is disabled', async () => {
             const appDefinition = {
-                encryption: { fieldLevelEncryptionMethod: 'aes' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: false },
                 integrations: []
             };
 
@@ -464,9 +315,10 @@ describe('composeServerlessDefinition', () => {
             expect(result.functions.testIntegration).toEqual({
                 handler: 'node_modules/@friggframework/core/handlers/routers/integration-defined-routers.handlers.testIntegration.handler',
                 events: [{
-                    httpApi: {
+                    http: {
                         path: '/api/testIntegration-integration/{proxy+}',
-                        method: 'ANY'
+                        method: 'ANY',
+                        cors: true
                     }
                 }]
             });
@@ -537,7 +389,7 @@ describe('composeServerlessDefinition', () => {
         it('should combine VPC, KMS, and SSM configurations', async () => {
             const appDefinition = {
                 vpc: { enable: true },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: true },
                 ssm: { enable: true },
                 integrations: [mockIntegration]
             };
@@ -546,7 +398,7 @@ describe('composeServerlessDefinition', () => {
 
             // VPC
             expect(result.provider.vpc).toBeDefined();
-            // custom.vpc doesn't exist in the serverless template
+            expect(result.custom.vpc).toBeDefined();
             expect(result.resources.Resources.VPCEndpointS3).toBeDefined();
 
             // KMS
@@ -576,7 +428,7 @@ describe('composeServerlessDefinition', () => {
         it('should handle partial configuration combinations', async () => {
             const appDefinition = {
                 vpc: { enable: true },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                encryption: { useDefaultKMSForFieldLevelEncryption: true },
                 integrations: []
             };
 
@@ -607,9 +459,9 @@ describe('composeServerlessDefinition', () => {
             expect(result.resources.Resources.ApiGatewayAlarm5xx).toBeDefined();
 
             // Check default functions
+            expect(result.functions.defaultWebsocket).toBeDefined();
             expect(result.functions.auth).toBeDefined();
             expect(result.functions.user).toBeDefined();
-            expect(result.functions.health).toBeDefined();
 
             // Check default plugins
             expect(result.plugins).toContain('serverless-jetpack');
@@ -644,64 +496,11 @@ describe('composeServerlessDefinition', () => {
 
             const result = await composeServerlessDefinition(appDefinition);
 
-            expect(result.provider.environment.STAGE).toBe('${opt:stage, "dev"}');
+            expect(result.provider.environment.STAGE).toBe('${opt:stage}');
             expect(result.provider.environment.AWS_NODEJS_CONNECTION_REUSE_ENABLED).toBe(1);
         });
     });
 
-    describe('WebSocket Configuration', () => {
-        it('should add websocket function when websockets.enable is true', async () => {
-            const appDefinition = {
-                websockets: { enable: true },
-                integrations: []
-            };
-
-            const result = await composeServerlessDefinition(appDefinition);
-
-            expect(result.functions.defaultWebsocket).toEqual({
-                handler: 'node_modules/@friggframework/core/handlers/routers/websocket.handler',
-                events: [
-                    {
-                        websocket: {
-                            route: '$connect',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$default',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$disconnect',
-                        },
-                    },
-                ],
-            });
-        });
-
-        it('should not add websocket function when websockets.enable is false', async () => {
-            const appDefinition = {
-                websockets: { enable: false },
-                integrations: []
-            };
-
-            const result = await composeServerlessDefinition(appDefinition);
-
-            expect(result.functions.defaultWebsocket).toBeUndefined();
-        });
-
-        it('should not add websocket function when websockets is not defined', async () => {
-            const appDefinition = {
-                integrations: []
-            };
-
-            const result = await composeServerlessDefinition(appDefinition);
-
-            expect(result.functions.defaultWebsocket).toBeUndefined();
-        });
-    });
-
     describe('Edge Cases', () => {
         it('should handle empty app definition', async () => {
             const appDefinition = {};
@@ -716,9 +515,7 @@ describe('composeServerlessDefinition', () => {
                 integrations: null
             };
 
-            // Should not throw, just ignore invalid integrations
-            const result = await composeServerlessDefinition(appDefinition);
-            expect(result).toBeDefined();
+            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow();
         });
 
         it('should handle integration with missing Definition', async () => {
@@ -727,7 +524,7 @@ describe('composeServerlessDefinition', () => {
                 integrations: [invalidIntegration]
             };
 
-            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow('Invalid integration: missing Definition or name');
+            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow();
         });
 
         it('should handle integration with missing name', async () => {
@@ -738,7 +535,7 @@ describe('composeServerlessDefinition', () => {
                 integrations: [invalidIntegration]
             };
 
-            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow('Invalid integration: missing Definition or name');
+            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow();
         });
     });
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.425.2d58c19.0",
+  "version": "2.0.0--canary.427.c8ff14b.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.425.2d58c19.0",
-    "@friggframework/test": "2.0.0--canary.425.2d58c19.0",
+    "@friggframework/schemas": "2.0.0--canary.427.c8ff14b.0",
+    "@friggframework/test": "2.0.0--canary.427.c8ff14b.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,9 +32,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.425.2d58c19.0",
-    "@friggframework/prettier-config": "2.0.0--canary.425.2d58c19.0",
-    "jest": "^30.1.3",
+    "@friggframework/eslint-config": "2.0.0--canary.427.c8ff14b.0",
+    "@friggframework/prettier-config": "2.0.0--canary.427.c8ff14b.0",
     "prettier": "^2.7.1",
     "serverless": "3.39.0",
     "serverless-dotenv-plugin": "^6.0.0",
@@ -66,5 +65,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "2d58c196b068fafce914e0fc631d72a30b745f31"
+  "gitHead": "c8ff14b4f6c1a21bd6c254ad12f1c9963b0374db"
 }