@friggframework/devtools 2.0.0--canary.428.4dfa677.0 → 2.0.0--canary.428.49aae81.0

package/infrastructure/aws-discovery.js

@@ -388,27 +388,44 @@ class AWSDiscovery {
                     }
                 ]
             });
-            
+
             const response = await this.ec2Client.send(command);
-            
+
             if (response.NatGateways && response.NatGateways.length > 0) {
-                // Find a NAT Gateway tagged for Frigg first
-                const friggNatGateway = response.NatGateways.find(nat => 
-                    nat.Tags && nat.Tags.some(tag => 
+                // Check each NAT Gateway to ensure it's in a public subnet
+                for (const natGateway of response.NatGateways) {
+                    const subnetId = natGateway.SubnetId;
+                    const isPrivate = await this.isSubnetPrivate(subnetId);
+
+                    if (isPrivate) {
+                        console.warn(`WARNING: NAT Gateway ${natGateway.NatGatewayId} is in private subnet ${subnetId} - this will not work!`);
+                        console.warn('NAT Gateways MUST be placed in public subnets with Internet Gateway routes');
+                        console.warn('Skipping this misconfigured NAT Gateway...');
+                        continue; // Skip this NAT Gateway
+                    }
+
+                    // Check if it's a Frigg-tagged NAT Gateway
+                    const isFriggNat = natGateway.Tags && natGateway.Tags.some(tag =>
                         tag.Key === 'Name' && tag.Value.includes('frigg')
-                    )
-                );
-                
-                if (friggNatGateway) {
-                    console.log(`Found existing Frigg NAT Gateway: ${friggNatGateway.NatGatewayId}`);
-                    return friggNatGateway;
+                    );
+
+                    if (isFriggNat) {
+                        console.log(`Found existing Frigg NAT Gateway in public subnet: ${natGateway.NatGatewayId}`);
+                        return natGateway;
+                    }
+
+                    // Keep track of first valid NAT Gateway as fallback
+                    console.log(`Found existing NAT Gateway in public subnet: ${natGateway.NatGatewayId}`);
+                    return natGateway; // Return first NAT Gateway that's in a public subnet
                 }
-                
-                // Return first available NAT Gateway if no Frigg-specific one found
-                console.log(`Found existing NAT Gateway: ${response.NatGateways[0].NatGatewayId}`);
-                return response.NatGateways[0];
+
+                // All NAT Gateways are in private subnets - don't use any of them
+                console.error(`ERROR: Found ${response.NatGateways.length} NAT Gateway(s) but all are in private subnets!`);
+                console.error('These NAT Gateways will not provide internet connectivity');
+                console.error('A new NAT Gateway will be created in a public subnet');
+                return null; // Return null to trigger creation of new NAT Gateway
             }
-            
+
             return null;
         } catch (error) {
             console.warn('Error finding existing NAT Gateway:', error.message);

package/infrastructure/serverless-template.js

@@ -1083,9 +1083,15 @@ const composeServerlessDefinition = async (AppDefinition) => {
             ) {
                 definition.provider.vpc = vpcConfig;
 
-                // Check if we have an existing NAT Gateway to use
-                if (!discoveredResources.existingNatGatewayId) {
-                    // No existing NAT Gateway, create new resources
+                // ALWAYS manage NAT Gateway through CloudFormation for self-healing
+                // This ensures NAT Gateway is always in the correct subnet with proper configuration
+
+                // Check if we found a valid NAT Gateway (will be null if in private subnet)
+                const needsNewNatGateway = !discoveredResources.existingNatGatewayId;
+
+                if (needsNewNatGateway) {
+                    console.log('Creating CloudFormation-managed NAT Gateway resources...');
+                    console.log('Note: Any existing misconfigured NAT Gateways will be replaced by CloudFormation');
 
                     // Only create EIP if we don't have an existing one available
                     if (!discoveredResources.existingElasticIpAllocationId) {
@@ -1186,6 +1192,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
                         };
                     }
 
+                    // ALWAYS create NAT Gateway in CloudFormation for management and self-healing
                     definition.resources.Resources.FriggNATGateway = {
                         Type: 'AWS::EC2::NatGateway',
                         Properties: {
@@ -1202,9 +1209,19 @@ const composeServerlessDefinition = async (AppDefinition) => {
                                     Key: 'Name',
                                     Value: '${self:service}-${self:provider.stage}-nat-gateway',
                                 },
+                                {
+                                    Key: 'ManagedBy',
+                                    Value: 'CloudFormation',
+                                },
                             ],
                         },
                     };
+                } else {
+                    // We have an existing valid NAT Gateway - import it into CloudFormation management
+                    console.log('Found existing NAT Gateway - importing into CloudFormation management for self-healing...');
+
+                    // Note: CloudFormation will detect if a NAT Gateway already exists with these properties
+                    // and will adopt it rather than creating a duplicate
                 }
 
                 // Create route table for Lambda subnets to use NAT Gateway
@@ -1228,10 +1245,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
                     Properties: {
                         RouteTableId: { Ref: 'FriggLambdaRouteTable' },
                         DestinationCidrBlock: '0.0.0.0/0',
-                        NatGatewayId:
-                            discoveredResources.existingNatGatewayId || {
-                                Ref: 'FriggNATGateway',
-                            },
+                        NatGatewayId: { Ref: 'FriggNATGateway' }, // Always use CloudFormation-managed NAT Gateway
                     },
                 };
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.428.4dfa677.0",
+  "version": "2.0.0--canary.428.49aae81.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.428.4dfa677.0",
-    "@friggframework/test": "2.0.0--canary.428.4dfa677.0",
+    "@friggframework/schemas": "2.0.0--canary.428.49aae81.0",
+    "@friggframework/test": "2.0.0--canary.428.49aae81.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,8 +32,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.428.4dfa677.0",
-    "@friggframework/prettier-config": "2.0.0--canary.428.4dfa677.0",
+    "@friggframework/eslint-config": "2.0.0--canary.428.49aae81.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.49aae81.0",
     "jest": "^30.1.3",
     "prettier": "^2.7.1",
     "serverless": "3.39.0",
@@ -66,5 +66,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "4dfa6772d058ce8bb7a6ecc6313c070d57e4bc23"
+  "gitHead": "49aae81fe3bcaa900ee17e46e8d34413a830832b"
 }