@friggframework/devtools 2.0.0--canary.428.2b9210c.1 → 2.0.0--canary.428.d54dca5.0

package/infrastructure/aws-discovery.test.js

@@ -9,7 +9,8 @@ const {
     DescribeSecurityGroupsCommand,
     DescribeRouteTablesCommand,
     DescribeNatGatewaysCommand,
-    DescribeAddressesCommand
+    DescribeAddressesCommand,
+    DescribeInternetGatewaysCommand,
 } = require('@aws-sdk/client-ec2');
 const {
     KMSClient,
@@ -77,6 +78,18 @@ describe('AWSDiscovery', () => {
             expect(vpc).toEqual(mockVpc);
         });
 
+        it('should retry without default filter when default VPC query returns empty', async () => {
+            const mockVpc = { VpcId: 'vpc-23456789', IsDefault: false };
+
+            ec2Mock
+                .on(DescribeVpcsCommand)
+                .resolvesOnce({ Vpcs: [] })
+                .resolves({ Vpcs: [mockVpc] });
+
+            const vpc = await discovery.findDefaultVpc();
+            expect(vpc).toEqual(mockVpc);
+        });
+
         it('should throw error when no VPCs found', async () => {
             ec2Mock.on(DescribeVpcsCommand).resolves({
                 Vpcs: []
@@ -127,6 +140,39 @@ describe('AWSDiscovery', () => {
             const isPrivate = await discovery.isSubnetPrivate(mockSubnetId, mockVpcId);
             expect(isPrivate).toBe(false);
         });
+
+        it('should default to private when no route table found', async () => {
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: [{ SubnetId: mockSubnetId, VpcId: mockVpcId }]
+            });
+
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({ RouteTables: [] });
+
+            const isPrivate = await discovery.isSubnetPrivate(mockSubnetId, mockVpcId);
+            expect(isPrivate).toBe(true);
+        });
+
+        it('should default to private when AWS throws describing subnet', async () => {
+            ec2Mock.on(DescribeSubnetsCommand).rejects(new Error('boom'));
+
+            const isPrivate = await discovery.isSubnetPrivate(mockSubnetId, mockVpcId);
+            expect(isPrivate).toBe(true);
+        });
+
+        it('should log warning when subnet cannot be found', async () => {
+            ec2Mock.on(DescribeSubnetsCommand).resolves({ Subnets: [] });
+            const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+            const isPrivate = await discovery.isSubnetPrivate(mockSubnetId);
+
+            expect(isPrivate).toBe(true);
+            expect(warnSpy).toHaveBeenCalledWith(
+                `Could not determine if subnet ${mockSubnetId} is private:`,
+                expect.any(Error)
+            );
+
+            warnSpy.mockRestore();
+        });
     });
 
     describe('findPrivateSubnets', () => {
@@ -159,6 +205,26 @@ describe('AWSDiscovery', () => {
             expect(subnets).toEqual(mockSubnets);
         });
 
+        it('should duplicate single private subnet when only one available', async () => {
+            const mockSubnets = [
+                { SubnetId: 'subnet-private-1', AvailabilityZone: 'us-east-1a' },
+                { SubnetId: 'subnet-public-1', AvailabilityZone: 'us-east-1b' }
+            ];
+
+            ec2Mock.on(DescribeSubnetsCommand).resolves({ Subnets: mockSubnets });
+
+            jest
+                .spyOn(discovery, 'isSubnetPrivate')
+                .mockResolvedValueOnce(true)
+                .mockResolvedValueOnce(false);
+
+            const subnets = await discovery.findPrivateSubnets(mockVpcId);
+            expect(subnets.map((s) => s.SubnetId)).toEqual([
+                'subnet-private-1',
+                'subnet-public-1'
+            ]);
+        });
+
         it('should throw error when no private subnets found and autoConvert is false', async () => {
             const mockSubnets = [
                 { SubnetId: 'subnet-public-1', AvailabilityZone: 'us-east-1a' },
@@ -215,6 +281,31 @@ describe('AWSDiscovery', () => {
             expect(subnets).toHaveLength(2);
             expect(subnets[0].SubnetId).toBe('subnet-public-1');
         });
+
+        it('should select converted subnets when autoConvert handles three public subnets', async () => {
+            const mockSubnets = [
+                { SubnetId: 'subnet-public-1' },
+                { SubnetId: 'subnet-public-2' },
+                { SubnetId: 'subnet-public-3' }
+            ];
+
+            ec2Mock.on(DescribeSubnetsCommand).resolves({ Subnets: mockSubnets });
+            jest.spyOn(discovery, 'isSubnetPrivate').mockResolvedValue(false);
+
+            const subnets = await discovery.findPrivateSubnets(mockVpcId, true);
+            expect(subnets.map((s) => s.SubnetId)).toEqual([
+                'subnet-public-2',
+                'subnet-public-3'
+            ]);
+        });
+
+        it('should throw when AWS returns no subnets', async () => {
+            ec2Mock.on(DescribeSubnetsCommand).resolves({ Subnets: [] });
+
+            await expect(discovery.findPrivateSubnets(mockVpcId)).rejects.toThrow(
+                `No subnets found in VPC ${mockVpcId}`
+            );
+        });
     });
 
     describe('findPublicSubnets', () => {
@@ -246,6 +337,21 @@ describe('AWSDiscovery', () => {
             await expect(discovery.findPublicSubnets(mockVpcId))
                 .rejects.toThrow('No subnets found in VPC');
         });
+
+        it('should return null when no public subnets identified', async () => {
+            const mockSubnet = { SubnetId: 'subnet-private-1' };
+            ec2Mock.on(DescribeSubnetsCommand).resolves({ Subnets: [mockSubnet] });
+
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [{
+                    Associations: [{ SubnetId: 'subnet-private-1' }],
+                    Routes: [{ GatewayId: 'local' }]
+                }]
+            });
+
+            const subnet = await discovery.findPublicSubnets(mockVpcId);
+            expect(subnet).toBeNull();
+        });
     });
 
     describe('findDefaultSecurityGroup', () => {
@@ -257,14 +363,29 @@ describe('AWSDiscovery', () => {
                 GroupName: 'default'
             };
 
-            ec2Mock.on(DescribeSecurityGroupsCommand).resolves({
-                SecurityGroups: [mockSecurityGroup]
-            });
+            ec2Mock
+                .on(DescribeSecurityGroupsCommand)
+                .resolvesOnce({ SecurityGroups: [] })
+                .resolves({ SecurityGroups: [mockSecurityGroup] });
 
             const sg = await discovery.findDefaultSecurityGroup(mockVpcId);
             expect(sg).toEqual(mockSecurityGroup);
         });
 
+        it('should prefer Frigg-managed security group when present', async () => {
+            const friggSg = {
+                GroupId: 'sg-frigg',
+                GroupName: 'frigg-lambda-sg',
+            };
+
+            ec2Mock
+                .on(DescribeSecurityGroupsCommand)
+                .resolves({ SecurityGroups: [friggSg] });
+
+            const sg = await discovery.findDefaultSecurityGroup(mockVpcId);
+            expect(sg).toEqual(friggSg);
+        });
+
         it('should throw error when no default security group found', async () => {
             ec2Mock.on(DescribeSecurityGroupsCommand).resolves({
                 SecurityGroups: []
@@ -309,6 +430,14 @@ describe('AWSDiscovery', () => {
             const rt = await discovery.findPrivateRouteTable(mockVpcId);
             expect(rt).toEqual(mockRouteTable);
         });
+
+        it('should throw error when no route tables found', async () => {
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({ RouteTables: [] });
+
+            await expect(
+                discovery.findPrivateRouteTable(mockVpcId)
+            ).rejects.toThrow(`No route tables found for VPC ${mockVpcId}`);
+        });
     });
 
     describe('findDefaultKmsKey', () => {
@@ -340,6 +469,69 @@ describe('AWSDiscovery', () => {
             const keyArn = await discovery.findDefaultKmsKey();
             expect(keyArn).toBeNull();
         });
+
+        it('should return null when only AWS-managed keys exist', async () => {
+            kmsMock.on(ListKeysCommand).resolves({
+                Keys: [{ KeyId: 'aws-key' }]
+            });
+
+            kmsMock.on(DescribeKeyCommand).resolves({
+                KeyMetadata: {
+                    Arn: 'arn:aws:kms:us-east-1:123456789012:key/aws-key',
+                    KeyManager: 'AWS',
+                    KeyState: 'Enabled'
+                }
+            });
+
+            const keyArn = await discovery.findDefaultKmsKey();
+            expect(keyArn).toBeNull();
+        });
+
+        it('should skip keys that fail to describe', async () => {
+            kmsMock.on(ListKeysCommand).resolves({ Keys: [{ KeyId: 'bad-key' }] });
+            kmsMock.on(DescribeKeyCommand).rejects(new Error('describe failure'));
+
+            const keyArn = await discovery.findDefaultKmsKey();
+            expect(keyArn).toBeNull();
+        });
+
+        it('should return null when ListKeys fails', async () => {
+            kmsMock.on(ListKeysCommand).rejects(new Error('list failure'));
+
+            const keyArn = await discovery.findDefaultKmsKey();
+            expect(keyArn).toBeNull();
+        });
+
+        it('should skip customer keys pending deletion', async () => {
+            const mockKeyId = 'pending-key';
+            kmsMock.on(ListKeysCommand).resolves({ Keys: [{ KeyId: mockKeyId }] });
+            kmsMock.on(DescribeKeyCommand).resolves({
+                KeyMetadata: {
+                    Arn: `arn:aws:kms:us-east-1:123456789012:key/${mockKeyId}`,
+                    KeyManager: 'CUSTOMER',
+                    KeyState: 'PendingDeletion',
+                    DeletionDate: '2024-01-01T00:00:00Z',
+                },
+            });
+
+            const keyArn = await discovery.findDefaultKmsKey();
+            expect(keyArn).toBeNull();
+        });
+
+        it('should return null when all customer keys are disabled', async () => {
+            const mockKeyId = 'disabled-key';
+            kmsMock.on(ListKeysCommand).resolves({ Keys: [{ KeyId: mockKeyId }] });
+            kmsMock.on(DescribeKeyCommand).resolves({
+                KeyMetadata: {
+                    Arn: `arn:aws:kms:us-east-1:123456789012:key/${mockKeyId}`,
+                    KeyManager: 'CUSTOMER',
+                    KeyState: 'Disabled',
+                },
+            });
+
+            const keyArn = await discovery.findDefaultKmsKey();
+            expect(keyArn).toBeNull();
+        });
     });
 
     describe('findAvailableElasticIP', () => {
@@ -365,6 +557,32 @@ describe('AWSDiscovery', () => {
             const eip = await discovery.findAvailableElasticIP();
             expect(eip).toBeNull();
         });
+
+        it('should return Frigg-tagged Elastic IP when present', async () => {
+            const friggAddress = {
+                AllocationId: 'eipalloc-frigg',
+                PublicIp: '52.0.0.1',
+                NetworkInterfaceId: 'eni-12345',
+                Tags: [{ Key: 'Name', Value: 'frigg-shared-ip' }]
+            };
+
+            ec2Mock.on(DescribeAddressesCommand).resolves({
+                Addresses: [
+                    { AllocationId: 'eipalloc-associated', AssociationId: 'assoc-1' },
+                    friggAddress,
+                ]
+            });
+
+            const eip = await discovery.findAvailableElasticIP();
+            expect(eip).toEqual(friggAddress);
+        });
+
+        it('should return null when DescribeAddresses fails', async () => {
+            ec2Mock.on(DescribeAddressesCommand).rejects(new Error('addr failure'));
+
+            const eip = await discovery.findAvailableElasticIP();
+            expect(eip).toBeNull();
+        });
     });
 
     describe('findExistingNatGateway', () => {
@@ -541,6 +759,197 @@ describe('AWSDiscovery', () => {
             const result = await discovery.findExistingNatGateway(mockVpcId);
             expect(result).toBeNull();
         });
+
+        it('should skip NAT Gateways that are not available', async () => {
+            const mockNatGateways = [
+                {
+                    NatGatewayId: 'nat-pending',
+                    SubnetId: 'subnet-public-1',
+                    State: 'pending',
+                    Tags: [],
+                },
+            ];
+
+            ec2Mock.on(DescribeNatGatewaysCommand).resolves({
+                NatGateways: mockNatGateways,
+            });
+
+            const result = await discovery.findExistingNatGateway(mockVpcId);
+            expect(result).toBeNull();
+        });
+
+        it('should return null when only non-Frigg NAT Gateways are in private subnets', async () => {
+            const mockNatGateways = [
+                {
+                    NatGatewayId: 'nat-private-only',
+                    SubnetId: 'subnet-private-1',
+                    State: 'available',
+                    Tags: [],
+                },
+            ];
+
+            ec2Mock.on(DescribeNatGatewaysCommand).resolves({
+                NatGateways: mockNatGateways,
+            });
+
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: [{ SubnetId: 'subnet-private-1', VpcId: mockVpcId }],
+            });
+
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [
+                    {
+                        Associations: [{ SubnetId: 'subnet-private-1' }],
+                        Routes: [{ GatewayId: 'local' }],
+                    },
+                ],
+            });
+
+            const result = await discovery.findExistingNatGateway(mockVpcId);
+            expect(result).toBeNull();
+        });
+
+        it('should return null when DescribeNatGateways fails', async () => {
+            ec2Mock.on(DescribeNatGatewaysCommand).rejects(new Error('nat failure'));
+
+            const result = await discovery.findExistingNatGateway(mockVpcId);
+            expect(result).toBeNull();
+        });
+    });
+
+    describe('findInternetGateway', () => {
+        const mockVpcId = 'vpc-12345678';
+
+        it('should return existing Internet Gateway', async () => {
+            const mockIgw = { InternetGatewayId: 'igw-12345' };
+
+            ec2Mock.on(DescribeInternetGatewaysCommand).resolves({
+                InternetGateways: [mockIgw]
+            });
+
+            const igw = await discovery.findInternetGateway(mockVpcId);
+            expect(igw).toEqual(mockIgw);
+        });
+
+        it('should return null when no Internet Gateway found', async () => {
+            ec2Mock.on(DescribeInternetGatewaysCommand).resolves({ InternetGateways: [] });
+
+            const igw = await discovery.findInternetGateway(mockVpcId);
+            expect(igw).toBeNull();
+        });
+
+        it('should return null when DescribeInternetGateways fails', async () => {
+            ec2Mock.on(DescribeInternetGatewaysCommand).rejects(new Error('igw failure'));
+
+            const igw = await discovery.findInternetGateway(mockVpcId);
+            expect(igw).toBeNull();
+        });
+    });
+
+    describe('findFriggManagedResources', () => {
+        it('should return tagged resources', async () => {
+            const mockNat = { NatGatewayId: 'nat-frigg', Tags: [{ Key: 'ManagedBy', Value: 'Frigg' }] };
+            const mockEip = { AllocationId: 'eip-frigg', Tags: [{ Key: 'ManagedBy', Value: 'Frigg' }] };
+            const mockRouteTable = { RouteTableId: 'rtb-frigg', Tags: [{ Key: 'ManagedBy', Value: 'Frigg' }] };
+            const mockSubnet = { SubnetId: 'subnet-frigg', Tags: [{ Key: 'ManagedBy', Value: 'Frigg' }] };
+            const mockSg = { GroupId: 'sg-frigg', Tags: [{ Key: 'ManagedBy', Value: 'Frigg' }] };
+
+            ec2Mock.on(DescribeNatGatewaysCommand).resolves({ NatGateways: [mockNat] });
+            ec2Mock.on(DescribeAddressesCommand).resolves({ Addresses: [mockEip] });
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({ RouteTables: [mockRouteTable] });
+            ec2Mock.on(DescribeSubnetsCommand).resolves({ Subnets: [mockSubnet] });
+            ec2Mock.on(DescribeSecurityGroupsCommand).resolves({ SecurityGroups: [mockSg] });
+
+            const result = await discovery.findFriggManagedResources('service', 'stage');
+            expect(result).toMatchObject({
+                natGateways: [mockNat],
+                elasticIps: [mockEip],
+                routeTables: [mockRouteTable],
+                subnets: [mockSubnet],
+                securityGroups: [mockSg],
+            });
+        });
+
+        it('should return empty arrays when calls fail', async () => {
+            ec2Mock.on(DescribeNatGatewaysCommand).rejects(new Error('error'));
+            ec2Mock.on(DescribeAddressesCommand).rejects(new Error('error'));
+            ec2Mock.on(DescribeRouteTablesCommand).rejects(new Error('error'));
+            ec2Mock.on(DescribeSubnetsCommand).rejects(new Error('error'));
+            ec2Mock.on(DescribeSecurityGroupsCommand).rejects(new Error('error'));
+
+            const result = await discovery.findFriggManagedResources('service', 'stage');
+            expect(result).toEqual({
+                natGateways: [],
+                elasticIps: [],
+                routeTables: [],
+                subnets: [],
+                securityGroups: [],
+            });
+        });
+    });
+
+    describe('detectMisconfiguredResources', () => {
+        const mockVpcId = 'vpc-12345678';
+
+        it('should capture misconfigured resources', async () => {
+            ec2Mock.on(DescribeNatGatewaysCommand).resolves({
+                NatGateways: [
+                    { NatGatewayId: 'nat-private', SubnetId: 'subnet-private', State: 'available' },
+                ],
+            });
+
+            ec2Mock.on(DescribeAddressesCommand).resolves({
+                Addresses: [
+                    {
+                        AllocationId: 'eip-123',
+                        PublicIp: '52.0.0.1',
+                        Tags: [{ Key: 'ManagedBy', Value: 'Frigg' }],
+                    },
+                ],
+            });
+
+            discovery.findPrivateSubnets = jest
+                .fn()
+                .mockResolvedValue([{ SubnetId: 'subnet-private', AvailabilityZone: 'us-east-1a' }]);
+            discovery.findRouteTables = jest.fn().mockResolvedValue([
+                {
+                    Associations: [],
+                    Routes: [],
+                },
+            ]);
+
+            jest.spyOn(discovery, 'isSubnetPrivate').mockResolvedValue(true);
+
+            const misconfigs = await discovery.detectMisconfiguredResources(mockVpcId);
+            expect(misconfigs.natGatewaysInPrivateSubnets).toHaveLength(1);
+            expect(misconfigs.orphanedElasticIps).toHaveLength(1);
+            expect(misconfigs.privateSubnetsWithoutNatRoute).toHaveLength(1);
+        });
+    });
+
+    describe('getHealingRecommendations', () => {
+        it('should produce ordered recommendations', () => {
+            const recs = discovery.getHealingRecommendations({
+                natGatewaysInPrivateSubnets: [{ natGatewayId: 'nat-1' }],
+                orphanedElasticIps: [{ allocationId: 'eip-1' }],
+                privateSubnetsWithoutNatRoute: [{ subnetId: 'subnet-1' }],
+            });
+
+            expect(recs[0].severity).toBe('critical');
+            expect(recs[0].issue).toContain('NAT Gateway');
+            expect(recs[1].severity).toBe('critical');
+            expect(recs[2].severity).toBe('warning');
+        });
+
+        it('should return empty array for no issues', () => {
+            const recs = discovery.getHealingRecommendations({
+                natGatewaysInPrivateSubnets: [],
+                orphanedElasticIps: [],
+                privateSubnetsWithoutNatRoute: [],
+            });
+
+            expect(recs).toEqual([]);
+        });
     });
 
     describe('discoverResources', () => {
@@ -664,6 +1073,36 @@ describe('AWSDiscovery', () => {
             });
         });
 
+        it('should reuse available Elastic IP when no NAT Gateway exists and no public subnet is found', async () => {
+            const mockVpc = { VpcId: 'vpc-12345678' };
+            const mockSubnets = [
+                { SubnetId: 'subnet-a' },
+                { SubnetId: 'subnet-b' }
+            ];
+            const mockSecurityGroup = { GroupId: 'sg-12345678' };
+            const mockRouteTable = { RouteTableId: 'rtb-12345678' };
+            const mockElasticIp = { AllocationId: 'eipalloc-available' };
+
+            jest.spyOn(discovery, 'findDefaultVpc').mockResolvedValue(mockVpc);
+            jest.spyOn(discovery, 'findPrivateSubnets').mockResolvedValue(mockSubnets);
+            jest.spyOn(discovery, 'findPublicSubnets').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findDefaultSecurityGroup').mockResolvedValue(mockSecurityGroup);
+            jest.spyOn(discovery, 'findPrivateRouteTable').mockResolvedValue(mockRouteTable);
+            jest.spyOn(discovery, 'findDefaultKmsKey').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findExistingNatGateway').mockResolvedValue(null);
+            const findAvailableElasticIPSpy = jest
+                .spyOn(discovery, 'findAvailableElasticIP')
+                .mockResolvedValue(mockElasticIp);
+            jest.spyOn(discovery, 'isSubnetPrivate').mockResolvedValue(true);
+
+            const result = await discovery.discoverResources();
+
+            expect(result.publicSubnetId).toBeNull();
+            expect(result.existingNatGatewayId).toBeNull();
+            expect(result.existingElasticIpAllocationId).toBe('eipalloc-available');
+            expect(findAvailableElasticIPSpy).toHaveBeenCalled();
+        });
+
         it('should detect NAT Gateway in private subnet in discoverResources', async () => {
             const mockVpc = { VpcId: 'vpc-12345678' };
             const mockSubnets = [
@@ -740,4 +1179,4 @@ describe('AWSDiscovery', () => {
             expect(customDiscovery.region).toBe('us-west-2');
         });
     });
-});
+});

package/infrastructure/iam-generator.js

@@ -76,6 +76,18 @@ function generateIAMCloudFormation(appDefinition, options = {}) {
                 Description:
                     'Enable SSM Parameter Store permissions for Frigg applications',
             },
+            DeploymentKmsAliasName: {
+                Type: 'String',
+                Default: 'alias/frigg-deployment',
+                Description:
+                    'Alias name to create or manage for the deployment KMS key',
+            },
+            DeploymentKmsTargetKeyArn: {
+                Type: 'String',
+                Default: '',
+                Description:
+                    'Optional existing KMS key ARN that the deployment alias should reference',
+            },
         },
 
         Conditions: {
@@ -88,6 +100,23 @@ function generateIAMCloudFormation(appDefinition, options = {}) {
             CreateSSMPermissions: {
                 'Fn::Equals': [{ Ref: 'EnableSSMSupport' }, 'true'],
             },
+            CreateKMSAlias: {
+                'Fn::And': [
+                    {
+                        'Fn::Equals': [{ Ref: 'EnableKMSSupport' }, 'true'],
+                    },
+                    {
+                        'Fn::Not': [
+                            {
+                                'Fn::Equals': [
+                                    { Ref: 'DeploymentKmsTargetKeyArn' },
+                                    '',
+                                ],
+                            },
+                        ],
+                    },
+                ],
+            },
         },
 
         Resources: {},
@@ -556,6 +585,7 @@ function generateIAMCloudFormation(appDefinition, options = {}) {
                                 'ec2:DescribeRouteTables',
                                 'ec2:CreateRoute',
                                 'ec2:DeleteRoute',
+                                'ec2:ReplaceRoute',
                                 'ec2:AssociateRouteTable',
                                 'ec2:DisassociateRouteTable',
                                 'ec2:CreateSecurityGroup',
@@ -615,6 +645,11 @@ function generateIAMCloudFormation(appDefinition, options = {}) {
                                 'kms:TagResource',
                                 'kms:UntagResource',
                                 'kms:ListResourceTags',
+                                'kms:CreateAlias',
+                                'kms:UpdateAlias',
+                                'kms:DeleteAlias',
+                                'kms:ListAliases',
+                                'kms:DescribeKey',
                             ],
                             Resource: '*',
                         },
@@ -624,6 +659,17 @@ function generateIAMCloudFormation(appDefinition, options = {}) {
         };
     }
 
+    template.Resources.FriggKMSKeyAlias = {
+        Type: 'AWS::KMS::Alias',
+        Condition: 'CreateKMSAlias',
+        DeletionPolicy: 'Retain',
+        UpdateReplacePolicy: 'Retain',
+        Properties: {
+            AliasName: { Ref: 'DeploymentKmsAliasName' },
+            TargetKeyId: { Ref: 'DeploymentKmsTargetKeyArn' },
+        },
+    };
+
     if (features.ssm) {
         template.Resources.FriggSSMPolicy = {
             Type: 'AWS::IAM::ManagedPolicy',

package/infrastructure/iam-generator.test.js

@@ -71,6 +71,7 @@ describe('IAM Generator', () => {
             expect(yaml).toContain('FriggVPCPolicy');
             expect(yaml).toContain('CreateVPCPermissions');
             expect(yaml).toContain('EnableVPCSupport');
+            expect(yaml).toContain('ec2:ReplaceRoute');
         });
 
         it('should include KMS policy when encryption is enabled', () => {
@@ -85,6 +86,8 @@ describe('IAM Generator', () => {
             expect(yaml).toContain('FriggKMSPolicy');
             expect(yaml).toContain('CreateKMSPermissions');
             expect(yaml).toContain('EnableKMSSupport');
+            expect(yaml).toContain('FriggKMSKeyAlias');
+            expect(yaml).toContain('kms:CreateAlias');
         });
 
         it('should include SSM policy when SSM is enabled', () => {
@@ -113,9 +116,9 @@ describe('IAM Generator', () => {
             const yaml = generateIAMCloudFormation(appDefinition);
 
             // Check parameter defaults match the enabled features
-            expect(yaml).toContain('Default: true'); // VPC enabled
-            expect(yaml).toContain('Default: false'); // KMS disabled  
-            // SSM should be true
+            expect(yaml).toContain("Default: 'true'"); // VPC enabled
+            expect(yaml).toContain("Default: 'false'"); // KMS disabled
+            expect(yaml).toContain('alias/frigg-deployment');
         });
 
         it('should include all core permissions', () => {
@@ -166,4 +169,4 @@ describe('IAM Generator', () => {
             expect(yaml).toContain('CredentialsSecretArn:');
         });
     });
-});
+});

package/infrastructure/serverless-template.test.js

@@ -55,6 +55,37 @@ describe('composeServerlessDefinition', () => {
         jest.restoreAllMocks();
         // Restore env
         delete process.env.AWS_REGION;
+        process.argv = ['node', 'test'];
+    });
+
+    describe('AWS discovery gating', () => {
+        it('should skip AWS discovery when no features require it', async () => {
+            AWSDiscovery.mockClear();
+
+            const appDefinition = {
+                integrations: [],
+                vpc: { enable: false },
+                encryption: { fieldLevelEncryptionMethod: 'aes' },
+                ssm: { enable: false },
+            };
+
+            await composeServerlessDefinition(appDefinition);
+
+            expect(AWSDiscovery).not.toHaveBeenCalled();
+        });
+
+        it('should run AWS discovery when VPC features are enabled', async () => {
+            AWSDiscovery.mockClear();
+
+            const appDefinition = {
+                integrations: [],
+                vpc: { enable: true },
+            };
+
+            await composeServerlessDefinition(appDefinition);
+
+            expect(AWSDiscovery).toHaveBeenCalledTimes(1);
+        });
     });
 
     describe('Basic Configuration', () => {
@@ -124,6 +155,38 @@ describe('composeServerlessDefinition', () => {
         });
     });
 
+    describe('Environment variables', () => {
+        it('should include only non-reserved environment flags', async () => {
+            const appDefinition = {
+                integrations: [],
+                environment: {
+                    CUSTOM_FLAG: true,
+                    AWS_REGION: true,
+                    OPTIONAL_DISABLED: false,
+                },
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.provider.environment.CUSTOM_FLAG).toBe("${env:CUSTOM_FLAG, ''}");
+            expect(result.provider.environment).not.toHaveProperty('AWS_REGION');
+            expect(result.provider.environment).not.toHaveProperty('OPTIONAL_DISABLED');
+        });
+
+        it('should ignore string-valued environment entries', async () => {
+            const appDefinition = {
+                integrations: [],
+                environment: {
+                    CUSTOM_FLAG: 'enabled',
+                },
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.provider.environment).not.toHaveProperty('CUSTOM_FLAG');
+        });
+    });
+
     describe('VPC Configuration', () => {
         it('should add VPC configuration when vpc.enable is true with discover mode', async () => {
             const appDefinition = {
@@ -261,6 +324,49 @@ describe('composeServerlessDefinition', () => {
             expect(result.provider.vpc.subnetIds).toEqual(['subnet-explicit1', 'subnet-explicit2']);
         });
 
+        it('should respect provided security group IDs when supplied', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    securityGroupIds: ['sg-custom-1', 'sg-custom-2'],
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.provider.vpc.securityGroupIds).toEqual([
+                'sg-custom-1',
+                'sg-custom-2',
+            ]);
+        });
+
+        it('should throw when discover mode finds no subnets and self-heal is disabled', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({
+                        privateSubnetId1: null,
+                        privateSubnetId2: null,
+                    })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    subnets: { management: 'discover' },
+                },
+                integrations: [],
+            };
+
+            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow(
+                'No subnets discovered and subnets.management is "discover". Either enable vpc.selfHeal, set subnets.management to "create", or provide subnet IDs.'
+            );
+        });
+
         it('should use Fn::Cidr for subnet CIDR blocks in new VPC to avoid conflicts', async () => {
             const appDefinition = {
                 vpc: {
@@ -357,6 +463,39 @@ describe('composeServerlessDefinition', () => {
             expect(result.resources.Resources.VPCEndpointS3.Properties.VpcId).toBe('vpc-123456');
         });
 
+        it('should skip creating VPC endpoints when disabled explicitly', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    enableVPCEndpoints: false,
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.VPCEndpointS3).toBeUndefined();
+            expect(result.resources.Resources.VPCEndpointKMS).toBeUndefined();
+            expect(result.resources.Resources.VPCEndpointSecretsManager).toBeUndefined();
+        });
+
+        it('should add Secrets Manager endpoint only when enabled', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                },
+                secretsManager: { enable: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.VPCEndpointSecretsManager).toBeDefined();
+        });
+
         it('should allow Lambda security group access for VPC endpoints when security group is discovered', async () => {
             const appDefinition = {
                 vpc: {
@@ -511,6 +650,114 @@ describe('composeServerlessDefinition', () => {
         });
     });
 
+    describe('NAT Gateway behaviour', () => {
+        it('should reuse discovered NAT gateway in discover mode without creating new resources', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({
+                        existingNatGatewayId: 'nat-existing123',
+                        natGatewayInPrivateSubnet: false,
+                    })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'discover' },
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggNATGateway).toBeUndefined();
+            expect(result.resources.Resources.FriggNATRoute).toBeDefined();
+        });
+
+        it('should reference provided NAT gateway when management set to useExisting', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({ existingNatGatewayId: null })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'useExisting', id: 'nat-custom-001' },
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggNATGateway).toBeUndefined();
+            expect(result.resources.Resources.FriggNATRoute.Properties.NatGatewayId).toBe('nat-custom-001');
+        });
+
+        it('should reuse existing elastic IP allocation when creating managed NAT', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({
+                        existingNatGatewayId: null,
+                        existingElasticIpAllocationId: 'eip-alloc-123',
+                    })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'createAndManage' },
+                    selfHeal: true,
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggNATGatewayEIP).toBeUndefined();
+            expect(result.resources.Resources.FriggNATGateway.Properties.AllocationId).toBe(
+                'eip-alloc-123'
+            );
+        });
+
+        it('should create a public subnet when discovery provides none', async () => {
+            const discoveryInstance = {
+                discoverResources: jest.fn().mockResolvedValue(
+                    createDiscoveryResponse({
+                        publicSubnetId: null,
+                        internetGatewayId: null,
+                        existingNatGatewayId: null,
+                    })
+                ),
+            };
+            AWSDiscovery.mockImplementation(() => discoveryInstance);
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'createAndManage' },
+                    selfHeal: true,
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggPublicSubnet).toBeDefined();
+            expect(result.resources.Resources.FriggPublicRouteTable).toBeDefined();
+        });
+    });
+
     describe('KMS Configuration', () => {
         it('should add KMS configuration when encryption is enabled and key is found', async () => {
             const appDefinition = {
@@ -913,6 +1160,27 @@ describe('composeServerlessDefinition', () => {
         });
     });
 
+    describe('Handler path adjustments', () => {
+        const fs = require('fs');
+        const path = require('path');
+
+        it('should rewrite handler paths in offline mode', async () => {
+            process.argv = ['node', 'test', 'offline'];
+            const existsSpy = jest.spyOn(fs, 'existsSync');
+            const fallbackNodeModules = path.resolve(process.cwd(), '..', 'node_modules');
+            existsSpy.mockImplementation((p) => p === fallbackNodeModules);
+
+            const appDefinition = { integrations: [] };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(existsSpy).toHaveBeenCalled();
+            expect(result.functions.auth.handler.startsWith('../node_modules/')).toBe(true);
+
+            existsSpy.mockRestore();
+        });
+    });
+
     describe('NAT Gateway Management', () => {
         it('should handle NAT Gateway with createAndManage mode', async () => {
             const appDefinition = {
@@ -932,6 +1200,24 @@ describe('composeServerlessDefinition', () => {
             expect(result.resources.Resources.FriggNATRoute).toBeDefined();
         });
 
+        it('should mark managed NAT Gateway resources for retention', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    natGateway: { management: 'createAndManage' },
+                    selfHeal: true,
+                },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.resources.Resources.FriggNATGateway).toBeDefined();
+            expect(result.resources.Resources.FriggNATGateway.DeletionPolicy).toBe('Retain');
+            expect(result.resources.Resources.FriggNATGateway.UpdateReplacePolicy).toBe('Retain');
+        });
+
         it('should handle NAT Gateway with discover mode', async () => {
             // Mock discovery to return existing NAT Gateway
             const { AWSDiscovery } = require('./aws-discovery');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.428.2b9210c.1",
+  "version": "2.0.0--canary.428.d54dca5.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.428.2b9210c.1",
-    "@friggframework/test": "2.0.0--canary.428.2b9210c.1",
+    "@friggframework/schemas": "2.0.0--canary.428.d54dca5.0",
+    "@friggframework/test": "2.0.0--canary.428.d54dca5.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,8 +32,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.428.2b9210c.1",
-    "@friggframework/prettier-config": "2.0.0--canary.428.2b9210c.1",
+    "@friggframework/eslint-config": "2.0.0--canary.428.d54dca5.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.d54dca5.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -68,5 +68,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "2b9210c7401ddd6baacac247aff11e3f73fcb315"
+  "gitHead": "d54dca5ba151e72370d6f82b4f841e2a8e5934c1"
 }