@friggframework/devtools 2.0.0--canary.428.4968614.0 → 2.0.0--canary.428.2b9210c.0

package/infrastructure/serverless-template.js

@@ -670,7 +670,7 @@ const createVPCInfrastructure = (AppDefinition) => {
         vpcResources.FriggVPCEndpointSecurityGroup = {
             Type: 'AWS::EC2::SecurityGroup',
             Properties: {
-                GroupDescription: 'Security group for Frigg VPC Endpoints',
+                GroupDescription: 'Security group for Frigg VPC Endpoints - allows HTTPS from Lambda functions',
                 VpcId: { Ref: 'FriggVPC' },
                 SecurityGroupIngress: [
                     {
@@ -680,7 +680,15 @@ const createVPCInfrastructure = (AppDefinition) => {
                         SourceSecurityGroupId: {
                             Ref: 'FriggLambdaSecurityGroup',
                         },
-                        Description: 'HTTPS from Lambda',
+                        Description: 'HTTPS from Lambda security group',
+                    },
+                    {
+                        // Also allow from VPC CIDR as fallback
+                        IpProtocol: 'tcp',
+                        FromPort: 443,
+                        ToPort: 443,
+                        CidrIp: AppDefinition.vpc.cidrBlock || '10.0.0.0/16',
+                        Description: 'HTTPS from VPC CIDR (fallback)',
                     },
                 ],
                 Tags: [
@@ -704,6 +712,10 @@ const createVPCInfrastructure = (AppDefinition) => {
                         Key: 'Type',
                         Value: 'VPCEndpoint',
                     },
+                    {
+                        Key: 'Purpose',
+                        Value: 'Allow Lambda functions to access VPC endpoints',
+                    },
                 ],
             },
         };
@@ -1668,6 +1680,8 @@ const composeServerlessDefinition = async (AppDefinition) => {
                     if (!useExistingEip) {
                         definition.resources.Resources.FriggNATGatewayEIP = {
                             Type: 'AWS::EC2::EIP',
+                            DeletionPolicy: 'Retain', // Prevent accidental deletion
+                            UpdateReplacePolicy: 'Retain', // Prevent replacement during updates
                             Properties: {
                                 Domain: 'vpc',
                                 Tags: [
@@ -1796,6 +1810,8 @@ const composeServerlessDefinition = async (AppDefinition) => {
                         // Create NAT Gateway only if not reusing existing one
                         definition.resources.Resources.FriggNATGateway = {
                             Type: 'AWS::EC2::NatGateway',
+                            DeletionPolicy: 'Retain', // Prevent accidental deletion
+                            UpdateReplacePolicy: 'Retain', // Prevent replacement during updates
                             Properties: {
                                 AllocationId: useExistingEip ?
                                     discoveredResources.existingElasticIpAllocationId :
@@ -1892,11 +1908,15 @@ const composeServerlessDefinition = async (AppDefinition) => {
                     }
                 }
 
-                // Always add route table and routes (referencing the NAT, whether new or existing)
-                // IMPORTANT: Create a new route table to ensure clean routing configuration
-                // This avoids issues with stale routes pointing to deleted NAT Gateways
+                // ALWAYS create the route table resource in CloudFormation for consistency
+                // Use DeletionPolicy: Retain to prevent deletion when removed from template
+                // This ensures CloudFormation maintains consistent state management
+                console.log('Setting up route table for Lambda subnets');
+
                 definition.resources.Resources.FriggLambdaRouteTable = {
                     Type: 'AWS::EC2::RouteTable',
+                    DeletionPolicy: 'Retain', // Critical: Prevents deletion when resource is removed
+                    UpdateReplacePolicy: 'Retain', // Prevents replacement during stack updates
                     Properties: {
                         VpcId: discoveredResources.defaultVpcId || {
                             Ref: 'FriggVPC',
@@ -1910,10 +1930,21 @@ const composeServerlessDefinition = async (AppDefinition) => {
                                 Key: 'ManagedBy',
                                 Value: 'Frigg',
                             },
+                            {
+                                Key: 'Environment',
+                                Value: '${self:provider.stage}',
+                            },
+                            {
+                                Key: 'Service',
+                                Value: '${self:service}',
+                            },
                         ],
                     },
                 };
 
+                // Always use CloudFormation reference for consistency
+                const routeTableId = { Ref: 'FriggLambdaRouteTable' };
+
                 // Determine which NAT Gateway ID to use for routing
                 let natGatewayIdForRoute;
 
@@ -1944,13 +1975,15 @@ const composeServerlessDefinition = async (AppDefinition) => {
                     );
                 }
 
-                // Only create NAT route if we have a NAT Gateway
+                // ALWAYS create/update NAT route if we have a NAT Gateway
+                // This ensures routes are always correct even if NAT Gateway changes
                 if (natGatewayIdForRoute) {
-                    console.log(`Creating NAT route: 0.0.0.0/0 → ${natGatewayIdForRoute}`);
+                    console.log(`Configuring NAT route: 0.0.0.0/0 → ${natGatewayIdForRoute}`);
                     definition.resources.Resources.FriggNATRoute = {
                         Type: 'AWS::EC2::Route',
+                        DependsOn: 'FriggLambdaRouteTable',
                         Properties: {
-                            RouteTableId: { Ref: 'FriggLambdaRouteTable' },
+                            RouteTableId: routeTableId,
                             DestinationCidrBlock: '0.0.0.0/0',
                             NatGatewayId: natGatewayIdForRoute,
                         },
@@ -1967,13 +2000,15 @@ const composeServerlessDefinition = async (AppDefinition) => {
                     // CloudFormation will automatically disassociate from old route table first
                 }
 
+                // ALWAYS create subnet associations to ensure correct routing
+                // CloudFormation will handle existing associations gracefully
                 // Only create associations for discovered subnets (not for Refs)
                 if (typeof vpcConfig.subnetIds[0] === 'string') {
                     definition.resources.Resources.FriggSubnet1RouteAssociation = {
                         Type: 'AWS::EC2::SubnetRouteTableAssociation',
                         Properties: {
                             SubnetId: vpcConfig.subnetIds[0],
-                            RouteTableId: { Ref: 'FriggLambdaRouteTable' },
+                            RouteTableId: routeTableId,
                         },
                         DependsOn: 'FriggLambdaRouteTable',
                     };
@@ -1984,7 +2019,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
                         Type: 'AWS::EC2::SubnetRouteTableAssociation',
                         Properties: {
                             SubnetId: vpcConfig.subnetIds[1],
-                            RouteTableId: { Ref: 'FriggLambdaRouteTable' },
+                            RouteTableId: routeTableId,
                         },
                         DependsOn: 'FriggLambdaRouteTable',
                     };
@@ -1996,7 +2031,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
                         Type: 'AWS::EC2::SubnetRouteTableAssociation',
                         Properties: {
                             SubnetId: vpcConfig.subnetIds[0],
-                            RouteTableId: { Ref: 'FriggLambdaRouteTable' },
+                            RouteTableId: routeTableId,
                         },
                         DependsOn: ['FriggLambdaRouteTable', vpcConfig.subnetIds[0].Ref],
                     };
@@ -2007,13 +2042,14 @@ const composeServerlessDefinition = async (AppDefinition) => {
                         Type: 'AWS::EC2::SubnetRouteTableAssociation',
                         Properties: {
                             SubnetId: vpcConfig.subnetIds[1],
-                            RouteTableId: { Ref: 'FriggLambdaRouteTable' },
+                            RouteTableId: routeTableId,
                         },
                         DependsOn: ['FriggLambdaRouteTable', vpcConfig.subnetIds[1].Ref],
                     };
                 }
 
-                // Add VPC endpoints for AWS service optimization (optional but recommended)
+                // Add VPC endpoints for AWS service optimization
+                // ALWAYS create these to ensure Lambda functions have optimized access to AWS services
                 if (AppDefinition.vpc.enableVPCEndpoints !== false) {
                     definition.resources.Resources.VPCEndpointS3 = {
                         Type: 'AWS::EC2::VPCEndpoint',
@@ -2022,7 +2058,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
                             ServiceName:
                                 'com.amazonaws.${self:provider.region}.s3',
                             VpcEndpointType: 'Gateway',
-                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }],
+                            RouteTableIds: [routeTableId],
                         },
                     };
 
@@ -2033,15 +2069,15 @@ const composeServerlessDefinition = async (AppDefinition) => {
                             ServiceName:
                                 'com.amazonaws.${self:provider.region}.dynamodb',
                             VpcEndpointType: 'Gateway',
-                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }],
+                            RouteTableIds: [routeTableId],
                         },
                     };
+                }
 
-                    // Add KMS VPC endpoint if using KMS encryption
-                    if (
-                        AppDefinition.encryption?.fieldLevelEncryptionMethod ===
-                        'kms'
-                    ) {
+                // Add KMS VPC endpoint if using KMS encryption
+                if (
+                    AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms'
+                ) {
                         // Validate we have VPC CIDR for security group configuration
                         if (!discoveredResources.vpcCidr) {
                             console.warn(
@@ -2054,28 +2090,80 @@ const composeServerlessDefinition = async (AppDefinition) => {
                             !definition.resources.Resources
                                 .VPCEndpointSecurityGroup
                         ) {
+                            // Build ingress rules based on what we have
+                            const vpcEndpointIngressRules = [];
+
+                            // CRITICAL: Allow from Lambda's security group (preferred method)
+                            if (vpcConfig.securityGroupIds && vpcConfig.securityGroupIds.length > 0) {
+                                // If we have the Lambda security group, reference it directly
+                                const lambdaSgId = vpcConfig.securityGroupIds[0];
+                                if (typeof lambdaSgId === 'string') {
+                                    // It's a discovered security group ID
+                                    vpcEndpointIngressRules.push({
+                                        IpProtocol: 'tcp',
+                                        FromPort: 443,
+                                        ToPort: 443,
+                                        SourceSecurityGroupId: lambdaSgId,
+                                        Description: 'HTTPS from Lambda security group',
+                                    });
+                                } else if (lambdaSgId && lambdaSgId.Ref) {
+                                    // It's a CloudFormation reference
+                                    vpcEndpointIngressRules.push({
+                                        IpProtocol: 'tcp',
+                                        FromPort: 443,
+                                        ToPort: 443,
+                                        SourceSecurityGroupId: lambdaSgId,
+                                        Description: 'HTTPS from Lambda security group',
+                                    });
+                                }
+                            }
+
+                            // Fallback: If we don't have Lambda SG, use VPC CIDR
+                            if (vpcEndpointIngressRules.length === 0 && discoveredResources.vpcCidr) {
+                                vpcEndpointIngressRules.push({
+                                    IpProtocol: 'tcp',
+                                    FromPort: 443,
+                                    ToPort: 443,
+                                    CidrIp: discoveredResources.vpcCidr,
+                                    Description: 'HTTPS from VPC CIDR (fallback)',
+                                });
+                            }
+
+                            // Last resort: Allow from common private IP ranges
+                            if (vpcEndpointIngressRules.length === 0) {
+                                console.warn(
+                                    '⚠️  WARNING: No Lambda security group or VPC CIDR found. Using default private IP ranges.'
+                                );
+                                vpcEndpointIngressRules.push({
+                                    IpProtocol: 'tcp',
+                                    FromPort: 443,
+                                    ToPort: 443,
+                                    CidrIp: '172.31.0.0/16', // Default VPC CIDR
+                                    Description: 'HTTPS from default VPC range',
+                                });
+                            }
+
                             definition.resources.Resources.VPCEndpointSecurityGroup =
                             {
                                 Type: 'AWS::EC2::SecurityGroup',
                                 Properties: {
                                     GroupDescription:
-                                        'Security group for VPC endpoints',
+                                        'Security group for VPC endpoints - allows HTTPS from Lambda functions',
                                     VpcId: discoveredResources.defaultVpcId,
-                                    SecurityGroupIngress: discoveredResources.vpcCidr
-                                        ? [
-                                              {
-                                                  IpProtocol: 'tcp',
-                                                  FromPort: 443,
-                                                  ToPort: 443,
-                                                  CidrIp: discoveredResources.vpcCidr, // Use discovered VPC CIDR
-                                              },
-                                          ]
-                                        : [], // Empty array if no VPC CIDR discovered
+                                    SecurityGroupIngress: vpcEndpointIngressRules,
                                     Tags: [
                                         {
                                             Key: 'Name',
                                             Value: '${self:service}-${self:provider.stage}-vpc-endpoints-sg',
                                         },
+                                        {
+                                            Key: 'ManagedBy',
+                                            Value: 'Frigg',
+                                        },
+                                        {
+                                            Key: 'Purpose',
+                                            Value: 'Allow Lambda functions to access VPC endpoints',
+                                        },
                                     ],
                                 },
                             };
@@ -2117,7 +2205,6 @@ const composeServerlessDefinition = async (AppDefinition) => {
                     }
                 }
             }
-        }
 
     // SSM Parameter Store Configuration based on App Definition
     if (AppDefinition.ssm?.enable === true) {

package/infrastructure/serverless-template.test.js

@@ -1,30 +1,43 @@
 const { composeServerlessDefinition } = require('./serverless-template');
 
+// Helper to build discovery responses with overridable fields
+const createDiscoveryResponse = (overrides = {}) => ({
+    defaultVpcId: 'vpc-123456',
+    vpcCidr: '172.31.0.0/16', // Provide VPC CIDR so security group fallbacks can be tested
+    defaultSecurityGroupId: 'sg-123456',
+    privateSubnetId1: 'subnet-123456',
+    privateSubnetId2: 'subnet-789012',
+    publicSubnetId: 'subnet-public',
+    defaultRouteTableId: 'rtb-123456',
+    defaultKmsKeyId:
+        'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012',
+    existingNatGatewayId: 'nat-default123',
+    ...overrides,
+});
+
 // Mock AWS Discovery to prevent actual AWS calls
 jest.mock('./aws-discovery', () => {
     return {
-        AWSDiscovery: jest.fn().mockImplementation(() => {
-            return {
-                discoverResources: jest.fn().mockResolvedValue({
-                    defaultVpcId: 'vpc-123456',
-                    vpcCidr: '172.31.0.0/16', // Add VPC CIDR for security group configuration
-                    defaultSecurityGroupId: 'sg-123456',
-                    privateSubnetId1: 'subnet-123456',
-                    privateSubnetId2: 'subnet-789012',
-                    publicSubnetId: 'subnet-public',
-                    defaultRouteTableId: 'rtb-123456',
-                    defaultKmsKeyId: 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012',
-                    existingNatGatewayId: 'nat-default123' // Add default NAT Gateway for discover mode
-                })
-            };
-        })
+        AWSDiscovery: jest.fn().mockImplementation(() => ({
+            discoverResources: jest
+                .fn()
+                .mockResolvedValue(createDiscoveryResponse()),
+        })),
     };
 });
 
+const { AWSDiscovery } = require('./aws-discovery');
+
 describe('composeServerlessDefinition', () => {
     let mockIntegration;
 
     beforeEach(() => {
+        AWSDiscovery.mockImplementation(() => ({
+            discoverResources: jest
+                .fn()
+                .mockResolvedValue(createDiscoveryResponse()),
+        }));
+
         mockIntegration = {
             Definition: {
                 name: 'testIntegration'
@@ -344,6 +357,137 @@ describe('composeServerlessDefinition', () => {
             expect(result.resources.Resources.VPCEndpointS3.Properties.VpcId).toBe('vpc-123456');
         });
 
+        it('should allow Lambda security group access for VPC endpoints when security group is discovered', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover'
+                },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                integrations: []
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+            const endpointSg = result.resources.Resources.VPCEndpointSecurityGroup;
+
+            expect(endpointSg).toBeDefined();
+            expect(endpointSg.Properties.SecurityGroupIngress).toEqual([
+                {
+                    IpProtocol: 'tcp',
+                    FromPort: 443,
+                    ToPort: 443,
+                    SourceSecurityGroupId: 'sg-123456',
+                    Description: 'HTTPS from Lambda security group'
+                }
+            ]);
+        });
+
+        it('should fall back to VPC CIDR when Lambda security group identifier cannot be resolved', async () => {
+            AWSDiscovery.mockImplementation(() => ({
+                discoverResources: jest
+                    .fn()
+                    .mockResolvedValue(createDiscoveryResponse()),
+            }));
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    securityGroupIds: [
+                        {
+                            'Fn::ImportValue': 'shared-lambda-security-group',
+                        },
+                    ],
+                },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+            const endpointSg = result.resources.Resources.VPCEndpointSecurityGroup;
+
+            expect(endpointSg).toBeDefined();
+            expect(endpointSg.Properties.SecurityGroupIngress).toEqual([
+                {
+                    IpProtocol: 'tcp',
+                    FromPort: 443,
+                    ToPort: 443,
+                    CidrIp: '172.31.0.0/16',
+                    Description: 'HTTPS from VPC CIDR (fallback)',
+                },
+            ]);
+        });
+
+        it('should fall back to default private ranges when neither Lambda security group nor VPC CIDR is available', async () => {
+            AWSDiscovery.mockImplementation(() => ({
+                discoverResources: jest
+                    .fn()
+                    .mockResolvedValue(
+                        createDiscoveryResponse({ vpcCidr: null })
+                    ),
+            }));
+
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'discover',
+                    securityGroupIds: [
+                        {
+                            'Fn::ImportValue': 'shared-lambda-security-group',
+                        },
+                    ],
+                },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                integrations: [],
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+            const endpointSg = result.resources.Resources.VPCEndpointSecurityGroup;
+
+            expect(endpointSg).toBeDefined();
+            expect(endpointSg.Properties.SecurityGroupIngress).toEqual([
+                {
+                    IpProtocol: 'tcp',
+                    FromPort: 443,
+                    ToPort: 443,
+                    CidrIp: '172.31.0.0/16',
+                    Description: 'HTTPS from default VPC range',
+                },
+            ]);
+        });
+
+        it('should reference the Lambda security group when creating a new VPC', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'create-new'
+                },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                integrations: []
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+            const endpointSg = result.resources.Resources.FriggVPCEndpointSecurityGroup;
+
+            expect(endpointSg).toBeDefined();
+            expect(endpointSg.Properties.SecurityGroupIngress).toEqual([
+                {
+                    IpProtocol: 'tcp',
+                    FromPort: 443,
+                    ToPort: 443,
+                    SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' },
+                    Description: 'HTTPS from Lambda security group'
+                },
+                {
+                    IpProtocol: 'tcp',
+                    FromPort: 443,
+                    ToPort: 443,
+                    CidrIp: '10.0.0.0/16',
+                    Description: 'HTTPS from VPC CIDR (fallback)'
+                }
+            ]);
+        });
+
         it('should not add VPC configuration when vpc.enable is false', async () => {
             const appDefinition = {
                 vpc: { enable: false },
@@ -1326,4 +1470,4 @@ describe('composeServerlessDefinition', () => {
             await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow('Invalid integration: missing Definition or name');
         });
     });
-});
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.428.4968614.0",
+  "version": "2.0.0--canary.428.2b9210c.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.428.4968614.0",
-    "@friggframework/test": "2.0.0--canary.428.4968614.0",
+    "@friggframework/schemas": "2.0.0--canary.428.2b9210c.0",
+    "@friggframework/test": "2.0.0--canary.428.2b9210c.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,8 +32,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.428.4968614.0",
-    "@friggframework/prettier-config": "2.0.0--canary.428.4968614.0",
+    "@friggframework/eslint-config": "2.0.0--canary.428.2b9210c.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.2b9210c.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -68,5 +68,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "49686143bbd8303507c1824ef167465d1efeaa1e"
+  "gitHead": "2b9210c7401ddd6baacac247aff11e3f73fcb315"
 }