@friggframework/devtools 2.0.0--canary.428.887095f.0 → 2.0.0--canary.428.6b04c24.0

package/infrastructure/aws-discovery.js

@@ -96,10 +96,11 @@ class AWSDiscovery {
     /**
      * Find private subnets for the given VPC
      * @param {string} vpcId - The VPC ID to search within
+     * @param {boolean} autoConvert - If true, convert public subnets to private if needed
      * @returns {Promise<Array>} Array of subnet objects (at least 2 for high availability)
      * @throws {Error} If no subnets are found in the VPC
      */
-    async findPrivateSubnets(vpcId) {
+    async findPrivateSubnets(vpcId, autoConvert = false) {
         try {
             const command = new DescribeSubnetsCommand({
                 Filters: [
@@ -109,14 +110,16 @@ class AWSDiscovery {
                     }
                 ]
             });
-            
+
             const response = await this.ec2Client.send(command);
-            
+
             if (!response.Subnets || response.Subnets.length === 0) {
                 throw new Error(`No subnets found in VPC ${vpcId}`);
             }
 
-            // Prefer private subnets (no direct route to IGW)
+            console.log(`\n🔍 Analyzing ${response.Subnets.length} subnets in VPC ${vpcId}...`);
+
+            // Categorize subnets by their actual routing
             const privateSubnets = [];
             const publicSubnets = [];
 
@@ -125,17 +128,74 @@ class AWSDiscovery {
                 const isPrivate = await this.isSubnetPrivate(subnet.SubnetId);
                 if (isPrivate) {
                     privateSubnets.push(subnet);
+                    console.log(`  🔒 Private subnet: ${subnet.SubnetId} (AZ: ${subnet.AvailabilityZone})`);
                 } else {
                     publicSubnets.push(subnet);
+                    console.log(`  🌐 Public subnet: ${subnet.SubnetId} (AZ: ${subnet.AvailabilityZone})`);
+                }
+            }
+
+            console.log(`\n📊 Subnet Analysis Results:`);
+            console.log(`  - Private subnets: ${privateSubnets.length}`);
+            console.log(`  - Public subnets: ${publicSubnets.length}`);
+
+            // If we have at least 2 private subnets, use them
+            if (privateSubnets.length >= 2) {
+                console.log(`✅ Found ${privateSubnets.length} private subnets for Lambda deployment`);
+                return privateSubnets.slice(0, 2);
+            }
+
+            // If we have 1 private subnet, we need at least one more
+            if (privateSubnets.length === 1) {
+                console.warn(`⚠️  Only 1 private subnet found. Need at least 2 for high availability.`);
+                if (publicSubnets.length > 0 && autoConvert) {
+                    console.log(`🔄 Will convert 1 public subnet to private for high availability...`);
+                    // Note: The actual conversion happens in the serverless template
                 }
+                // Return what we have - mix of private and public if needed
+                return [...privateSubnets, ...publicSubnets].slice(0, 2);
             }
 
-            // Return at least 2 subnets for high availability
-            const selectedSubnets = privateSubnets.length >= 2 ? 
-                privateSubnets.slice(0, 2) : 
-                response.Subnets.slice(0, 2);
+            // No private subnets found at all - this is a problem!
+            if (privateSubnets.length === 0 && publicSubnets.length > 0) {
+                console.error(`❌ CRITICAL: No private subnets found, but ${publicSubnets.length} public subnets exist`);
+                console.error(`❌ Lambda functions should NOT be deployed in public subnets!`);
+
+                if (autoConvert && publicSubnets.length >= 3) {
+                    console.log(`\n🔧 AUTO-CONVERSION: Will configure subnets for proper isolation...`);
+                    console.log(`  - Keeping ${publicSubnets[0].SubnetId} as public (for NAT Gateway)`);
+                    console.log(`  - Converting ${publicSubnets[1].SubnetId} to private (for Lambda)`);
+                    if (publicSubnets[2]) {
+                        console.log(`  - Converting ${publicSubnets[2].SubnetId} to private (for Lambda)`);
+                    }
 
-            return selectedSubnets;
+                    // Return subnets that SHOULD be private (indexes 1 and 2)
+                    // The actual conversion happens in the serverless template
+                    return publicSubnets.slice(1, 3);
+                } else if (autoConvert && publicSubnets.length >= 2) {
+                    console.log(`\n🔧 AUTO-CONVERSION: Only ${publicSubnets.length} subnets available`);
+                    console.log(`  - Will need to create new subnets or reconfigure existing ones`);
+                    // Return what we have but flag for conversion
+                    return publicSubnets.slice(0, 2);
+                } else {
+                    console.error(`\n⚠️  CONFIGURATION ERROR:`);
+                    console.error(`  Found ${publicSubnets.length} public subnets but no private subnets.`);
+                    console.error(`  Lambda functions require private subnets for security.`);
+                    console.error(`\n  Options:`);
+                    console.error(`  1. Enable selfHeal: true in vpc configuration`);
+                    console.error(`  2. Create private subnets manually`);
+                    console.error(`  3. Set subnets.management: 'create' to create new private subnets`);
+
+                    throw new Error(
+                        `No private subnets found in VPC ${vpcId}. ` +
+                        `Found ${publicSubnets.length} public subnets. ` +
+                        `Lambda requires private subnets. Enable selfHeal or create private subnets.`
+                    );
+                }
+            }
+
+            // No subnets at all?
+            throw new Error(`No subnets found in VPC ${vpcId}`);
         } catch (error) {
             console.error('Error finding private subnets:', error);
             throw error;
@@ -450,6 +510,8 @@ class AWSDiscovery {
                             console.warn('This is a Frigg-managed NAT Gateway that may have been misconfigured by route table changes');
                             console.warn('Consider enabling selfHeal: true to fix this automatically');
                             // Return it anyway if it's Frigg-managed - we can fix the routes
+                            // Mark that it's in a private subnet
+                            natGateway._isInPrivateSubnet = true;
                             return natGateway;
                         } else {
                             console.warn('NAT Gateways MUST be placed in public subnets with Internet Gateway routes');
@@ -460,11 +522,13 @@ class AWSDiscovery {
 
                     if (isFriggNat) {
                         console.log(`Found existing Frigg-managed NAT Gateway: ${natGateway.NatGatewayId}`);
+                        natGateway._isInPrivateSubnet = false;
                         return natGateway;
                     }
 
                     // Return first valid NAT Gateway that's in a public subnet
                     console.log(`Found existing NAT Gateway in public subnet: ${natGateway.NatGatewayId}`);
+                    natGateway._isInPrivateSubnet = false;
                     return natGateway;
                 }
 
@@ -790,39 +854,51 @@ class AWSDiscovery {
      * @returns {string|null} return.defaultKmsKeyId - Default KMS key ARN or null if not found
      * @throws {Error} If resource discovery fails
      */
-    async discoverResources() {
+    async discoverResources(options = {}) {
         try {
-            console.log('Discovering AWS resources for Frigg deployment...');
-            
+            console.log('\n🚀 Discovering AWS resources for Frigg deployment...');
+            console.log('═'.repeat(60));
+
             const vpc = await this.findDefaultVpc();
-            console.log(`Found VPC: ${vpc.VpcId}`);
-            
-            const privateSubnets = await this.findPrivateSubnets(vpc.VpcId);
-            console.log(`Found ${privateSubnets.length} private subnets: ${privateSubnets.map(s => s.SubnetId).join(', ')}`);
-            
+            console.log(`\n✅ Found VPC: ${vpc.VpcId}`);
+
+            // Enable auto-convert if selfHeal is enabled
+            const autoConvert = options.selfHeal || false;
+
+            const privateSubnets = await this.findPrivateSubnets(vpc.VpcId, autoConvert);
+            console.log(`\n✅ Selected subnets for Lambda: ${privateSubnets.map(s => s.SubnetId).join(', ')}`);
+
             const publicSubnet = await this.findPublicSubnets(vpc.VpcId);
-            console.log(`Found public subnet for NAT Gateway: ${publicSubnet.SubnetId}`);
-            
+            if (publicSubnet) {
+                console.log(`\n✅ Found public subnet for NAT Gateway: ${publicSubnet.SubnetId}`);
+            } else {
+                console.log(`\n⚠️  No public subnet found - NAT Gateway creation may fail`);
+            }
+
             const securityGroup = await this.findDefaultSecurityGroup(vpc.VpcId);
-            console.log(`Found security group: ${securityGroup.GroupId}`);
-            
+            console.log(`\n✅ Found security group: ${securityGroup.GroupId}`);
+
             const routeTable = await this.findPrivateRouteTable(vpc.VpcId);
-            console.log(`Found route table: ${routeTable.RouteTableId}`);
-            
+            console.log(`✅ Found route table: ${routeTable.RouteTableId}`);
+
             const kmsKeyArn = await this.findDefaultKmsKey();
             if (kmsKeyArn) {
-                console.log(`Found KMS key: ${kmsKeyArn}`);
+                console.log(`✅ Found KMS key: ${kmsKeyArn}`);
             } else {
-                console.log('No KMS key found');
+                console.log('ℹ️  No KMS key found');
             }
             
             // Try to find existing NAT Gateway
             const existingNatGateway = await this.findExistingNatGateway(vpc.VpcId);
             let natGatewayId = null;
             let elasticIpAllocationId = null;
-            
+            let natGatewayInPrivateSubnet = false;
+
             if (existingNatGateway) {
                 natGatewayId = existingNatGateway.NatGatewayId;
+                // Check if NAT Gateway is in a private subnet (from our detection)
+                natGatewayInPrivateSubnet = existingNatGateway._isInPrivateSubnet || false;
+
                 // Get the EIP allocation ID from the NAT Gateway
                 if (existingNatGateway.NatGatewayAddresses && existingNatGateway.NatGatewayAddresses.length > 0) {
                     elasticIpAllocationId = existingNatGateway.NatGatewayAddresses[0].AllocationId;
@@ -835,6 +911,42 @@ class AWSDiscovery {
                 }
             }
 
+            // Check if the "private" subnets are actually public
+            const subnet1IsActuallyPrivate = privateSubnets[0] ?
+                await this.isSubnetPrivate(privateSubnets[0].SubnetId) : false;
+            const subnet2IsActuallyPrivate = privateSubnets[1] ?
+                await this.isSubnetPrivate(privateSubnets[1].SubnetId) :
+                subnet1IsActuallyPrivate;
+
+            const subnetStatus = {
+                requiresConversion: !subnet1IsActuallyPrivate || !subnet2IsActuallyPrivate,
+                subnet1NeedsConversion: !subnet1IsActuallyPrivate,
+                subnet2NeedsConversion: !subnet2IsActuallyPrivate
+            };
+
+            if (subnetStatus.requiresConversion) {
+                console.log(`\n⚠️  SUBNET CONFIGURATION WARNING:`);
+                if (subnetStatus.subnet1NeedsConversion && privateSubnets[0]) {
+                    console.log(`  - Subnet ${privateSubnets[0].SubnetId} is currently PUBLIC but will be used for Lambda`);
+                }
+                if (subnetStatus.subnet2NeedsConversion && privateSubnets[1]) {
+                    console.log(`  - Subnet ${privateSubnets[1].SubnetId} is currently PUBLIC but will be used for Lambda`);
+                }
+                console.log(`  💡 Enable selfHeal: true to automatically fix this`);
+            }
+
+            console.log(`\n${'═'.repeat(60)}`);
+            console.log('📋 Discovery Summary:');
+            console.log(`  VPC: ${vpc.VpcId}`);
+            console.log(`  Lambda Subnets: ${privateSubnets.map(s => s.SubnetId).join(', ')}`);
+            console.log(`  NAT Subnet: ${publicSubnet?.SubnetId || 'None (needs creation)'}`);
+            console.log(`  NAT Gateway: ${natGatewayId || 'None (will be created)'}`);
+            console.log(`  Elastic IP: ${elasticIpAllocationId || 'None (will be allocated)'}`);
+            if (subnetStatus.requiresConversion) {
+                console.log(`  ⚠️  Subnet Conversion Required: Yes`);
+            }
+            console.log(`${'═'.repeat(60)}\n`);
+
             return {
                 defaultVpcId: vpc.VpcId,
                 defaultSecurityGroupId: securityGroup.GroupId,
@@ -844,7 +956,19 @@ class AWSDiscovery {
                 privateRouteTableId: routeTable.RouteTableId,
                 defaultKmsKeyId: kmsKeyArn,
                 existingNatGatewayId: natGatewayId,
-                existingElasticIpAllocationId: elasticIpAllocationId
+                existingElasticIpAllocationId: elasticIpAllocationId,
+                natGatewayInPrivateSubnet: natGatewayInPrivateSubnet,
+                subnetConversionRequired: subnetStatus.requiresConversion,
+                privateSubnetsWithWrongRoutes: (() => {
+                    const wrongRoutes = [];
+                    if (subnetStatus.subnet1NeedsConversion && privateSubnets[0]) {
+                        wrongRoutes.push(privateSubnets[0].SubnetId);
+                    }
+                    if (subnetStatus.subnet2NeedsConversion && privateSubnets[1]) {
+                        wrongRoutes.push(privateSubnets[1].SubnetId);
+                    }
+                    return wrongRoutes;
+                })()
             };
         } catch (error) {
             console.error('Error discovering AWS resources:', error);

package/infrastructure/aws-discovery.test.js

@@ -1,298 +1,545 @@
-const AWS = require('aws-sdk');
+const { mockClient } = require('aws-sdk-client-mock');
 const { AWSDiscovery } = require('./aws-discovery');
 
-// Mock AWS SDK
-jest.mock('@aws-sdk/client-ec2');
-jest.mock('@aws-sdk/client-kms');
-jest.mock('@aws-sdk/client-sts');
-
-const { EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand } = require('@aws-sdk/client-ec2');
-const { KMSClient, ListKeysCommand, DescribeKeyCommand } = require('@aws-sdk/client-kms');
-const { STSClient, GetCallerIdentityCommand } = require('@aws-sdk/client-sts');
+// Import AWS SDK commands
+const {
+    EC2Client,
+    DescribeVpcsCommand,
+    DescribeSubnetsCommand,
+    DescribeSecurityGroupsCommand,
+    DescribeRouteTablesCommand,
+    DescribeNatGatewaysCommand,
+    DescribeAddressesCommand
+} = require('@aws-sdk/client-ec2');
+const {
+    KMSClient,
+    ListKeysCommand,
+    DescribeKeyCommand
+} = require('@aws-sdk/client-kms');
+const {
+    STSClient,
+    GetCallerIdentityCommand
+} = require('@aws-sdk/client-sts');
+
+// Create mock clients
+const ec2Mock = mockClient(EC2Client);
+const kmsMock = mockClient(KMSClient);
+const stsMock = mockClient(STSClient);
 
 describe('AWSDiscovery', () => {
     let discovery;
-    let mockEC2Send;
-    let mockKMSSend;
-    let mockSTSSend;
 
     beforeEach(() => {
+        // Reset all mocks before each test
+        ec2Mock.reset();
+        kmsMock.reset();
+        stsMock.reset();
+
         discovery = new AWSDiscovery('us-east-1');
-        
-        // Create mock send functions
-        mockEC2Send = jest.fn();
-        mockKMSSend = jest.fn();
-        mockSTSSend = jest.fn();
-        
-        // Mock the client constructors and send methods
-        EC2Client.mockImplementation(() => ({
-            send: mockEC2Send
-        }));
-        
-        KMSClient.mockImplementation(() => ({
-            send: mockKMSSend
-        }));
-        
-        STSClient.mockImplementation(() => ({
-            send: mockSTSSend
-        }));
-
-        // Reset mocks
-        jest.clearAllMocks();
     });
 
     describe('getAccountId', () => {
         it('should return AWS account ID', async () => {
             const mockAccountId = '123456789012';
-            mockSTSSend.mockResolvedValue({
+            stsMock.on(GetCallerIdentityCommand).resolves({
                 Account: mockAccountId
             });
 
-            const result = await discovery.getAccountId();
-
-            expect(result).toBe(mockAccountId);
-            expect(mockSTSSend).toHaveBeenCalledWith(expect.any(GetCallerIdentityCommand));
+            const accountId = await discovery.getAccountId();
+            expect(accountId).toBe(mockAccountId);
         });
 
         it('should throw error when STS call fails', async () => {
-            const error = new Error('STS Error');
-            mockSTSSend.mockRejectedValue(error);
+            stsMock.on(GetCallerIdentityCommand).rejects(new Error('STS error'));
 
-            await expect(discovery.getAccountId()).rejects.toThrow('STS Error');
+            await expect(discovery.getAccountId()).rejects.toThrow('STS error');
         });
     });
 
     describe('findDefaultVpc', () => {
-        it('should return default VPC when found', async () => {
-            const mockVpc = {
-                VpcId: 'vpc-12345678',
-                IsDefault: true,
-                State: 'available'
-            };
+        it('should return default VPC when available', async () => {
+            const mockVpc = { VpcId: 'vpc-12345678', IsDefault: true };
+            ec2Mock.on(DescribeVpcsCommand).resolves({
+                Vpcs: [mockVpc]
+            });
 
-            mockEC2Send.mockResolvedValue({
+            const vpc = await discovery.findDefaultVpc();
+            expect(vpc).toEqual(mockVpc);
+        });
+
+        it('should return first VPC when no default VPC exists', async () => {
+            const mockVpc = { VpcId: 'vpc-12345678', IsDefault: false };
+            ec2Mock.on(DescribeVpcsCommand).resolves({
                 Vpcs: [mockVpc]
             });
 
-            const result = await discovery.findDefaultVpc();
+            const vpc = await discovery.findDefaultVpc();
+            expect(vpc).toEqual(mockVpc);
+        });
 
-            expect(result).toEqual(mockVpc);
-            expect(mockEC2Send).toHaveBeenCalledWith(expect.objectContaining({
-                input: {
-                    Filters: [{
-                        Name: 'is-default',
-                        Values: ['true']
-                    }]
-                }
-            }));
+        it('should throw error when no VPCs found', async () => {
+            ec2Mock.on(DescribeVpcsCommand).resolves({
+                Vpcs: []
+            });
+
+            await expect(discovery.findDefaultVpc()).rejects.toThrow('No VPC found in the account');
         });
+    });
 
-        it('should return first available VPC when no default VPC exists', async () => {
-            const mockVpc = {
-                VpcId: 'vpc-87654321',
-                IsDefault: false,
-                State: 'available'
-            };
+    describe('isSubnetPrivate', () => {
+        const mockVpcId = 'vpc-12345678';
+        const mockSubnetId = 'subnet-12345678';
 
-            mockEC2Send
-                .mockResolvedValueOnce({ Vpcs: [] }) // No default VPC
-                .mockResolvedValueOnce({ Vpcs: [mockVpc] }); // All VPCs
+        it('should return true for private subnet', async () => {
+            // Mock subnet lookup first
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: [{ SubnetId: mockSubnetId, VpcId: mockVpcId }]
+            });
 
-            const result = await discovery.findDefaultVpc();
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [{
+                    Associations: [{ SubnetId: mockSubnetId }],
+                    Routes: [
+                        { GatewayId: 'local', DestinationCidrBlock: '10.0.0.0/16' }
+                    ]
+                }]
+            });
 
-            expect(result).toEqual(mockVpc);
-            expect(mockEC2Send).toHaveBeenCalledTimes(2);
+            const isPrivate = await discovery.isSubnetPrivate(mockSubnetId, mockVpcId);
+            expect(isPrivate).toBe(true);
         });
 
-        it('should throw error when no VPCs found', async () => {
-            mockEC2Send
-                .mockResolvedValueOnce({ Vpcs: [] }) // No default VPC
-                .mockResolvedValueOnce({ Vpcs: [] }); // No VPCs at all
+        it('should return false for public subnet', async () => {
+            // Mock subnet lookup first
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: [{ SubnetId: mockSubnetId, VpcId: mockVpcId }]
+            });
 
-            await expect(discovery.findDefaultVpc()).rejects.toThrow('No VPC found in the account');
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [{
+                    Associations: [{ SubnetId: mockSubnetId }],
+                    Routes: [
+                        { GatewayId: 'igw-12345', DestinationCidrBlock: '0.0.0.0/0' }
+                    ]
+                }]
+            });
+
+            const isPrivate = await discovery.isSubnetPrivate(mockSubnetId, mockVpcId);
+            expect(isPrivate).toBe(false);
         });
     });
 
     describe('findPrivateSubnets', () => {
         const mockVpcId = 'vpc-12345678';
 
-        it('should return private subnets when found', async () => {
+        it('should return private subnets', async () => {
             const mockSubnets = [
-                { SubnetId: 'subnet-private-1', VpcId: mockVpcId },
-                { SubnetId: 'subnet-private-2', VpcId: mockVpcId }
+                { SubnetId: 'subnet-private-1', AvailabilityZone: 'us-east-1a' },
+                { SubnetId: 'subnet-private-2', AvailabilityZone: 'us-east-1b' }
             ];
 
-            mockEC2Send
-                .mockResolvedValueOnce({ Subnets: mockSubnets }) // DescribeSubnets
-                .mockResolvedValue({ RouteTables: [] }); // DescribeRouteTables (private)
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: mockSubnets
+            });
 
-            const result = await discovery.findPrivateSubnets(mockVpcId);
+            // Mock route tables - no IGW routes (private)
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [{
+                    Associations: [
+                        { SubnetId: 'subnet-private-1' },
+                        { SubnetId: 'subnet-private-2' }
+                    ],
+                    Routes: [
+                        { GatewayId: 'local', DestinationCidrBlock: '10.0.0.0/16' }
+                    ]
+                }]
+            });
 
-            expect(result).toHaveLength(2);
-            expect(result[0].SubnetId).toBe('subnet-private-1');
-            expect(result[1].SubnetId).toBe('subnet-private-2');
+            const subnets = await discovery.findPrivateSubnets(mockVpcId);
+            expect(subnets).toEqual(mockSubnets);
         });
 
-        it('should return at least 2 subnets even if mixed private/public', async () => {
+        it('should throw error when no private subnets found and autoConvert is false', async () => {
             const mockSubnets = [
-                { SubnetId: 'subnet-1', VpcId: mockVpcId },
-                { SubnetId: 'subnet-2', VpcId: mockVpcId },
-                { SubnetId: 'subnet-3', VpcId: mockVpcId }
+                { SubnetId: 'subnet-public-1', AvailabilityZone: 'us-east-1a' },
+                { SubnetId: 'subnet-public-2', AvailabilityZone: 'us-east-1b' },
+                { SubnetId: 'subnet-public-3', AvailabilityZone: 'us-east-1c' }
             ];
 
-            mockEC2Send
-                .mockResolvedValueOnce({ Subnets: mockSubnets }) // DescribeSubnets
-                .mockResolvedValue({ // Only one private subnet
-                    RouteTables: [{
-                        Routes: [] // No IGW route = private
-                    }]
-                });
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: mockSubnets
+            });
 
-            const result = await discovery.findPrivateSubnets(mockVpcId);
+            // Mock route tables - has IGW routes (public)
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [{
+                    Associations: [
+                        { SubnetId: 'subnet-public-1' },
+                        { SubnetId: 'subnet-public-2' },
+                        { SubnetId: 'subnet-public-3' }
+                    ],
+                    Routes: [
+                        { GatewayId: 'igw-12345', DestinationCidrBlock: '0.0.0.0/0' }
+                    ]
+                }]
+            });
 
-            expect(result).toHaveLength(2);
+            await expect(discovery.findPrivateSubnets(mockVpcId, false))
+                .rejects.toThrow('No private subnets found in VPC');
         });
 
-        it('should throw error when no subnets found', async () => {
-            mockEC2Send.mockResolvedValue({ Subnets: [] });
-
-            await expect(discovery.findPrivateSubnets(mockVpcId)).rejects.toThrow(`No subnets found in VPC ${mockVpcId}`);
-        });
-    });
+        it('should return public subnets with warning when autoConvert is true', async () => {
+            const mockSubnets = [
+                { SubnetId: 'subnet-public-1', AvailabilityZone: 'us-east-1a' },
+                { SubnetId: 'subnet-public-2', AvailabilityZone: 'us-east-1b' }
+            ];
 
-    describe('isSubnetPrivate', () => {
-        const mockSubnetId = 'subnet-12345678';
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: mockSubnets
+            });
 
-        it('should return false for public subnet (has IGW route)', async () => {
-            mockEC2Send.mockResolvedValue({
+            // Mock route tables - has IGW routes (public)
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
                 RouteTables: [{
-                    Routes: [{
-                        GatewayId: 'igw-12345678',
-                        DestinationCidrBlock: '0.0.0.0/0'
-                    }]
+                    Associations: [
+                        { SubnetId: 'subnet-public-1' },
+                        { SubnetId: 'subnet-public-2' }
+                    ],
+                    Routes: [
+                        { GatewayId: 'igw-12345', DestinationCidrBlock: '0.0.0.0/0' }
+                    ]
                 }]
             });
 
-            const result = await discovery.isSubnetPrivate(mockSubnetId);
-
-            expect(result).toBe(false);
+            const subnets = await discovery.findPrivateSubnets(mockVpcId, true);
+            expect(subnets).toHaveLength(2);
+            expect(subnets[0].SubnetId).toBe('subnet-public-1');
         });
+    });
 
-        it('should return true for private subnet (no IGW route)', async () => {
-            mockEC2Send.mockResolvedValue({
+    describe('findPublicSubnets', () => {
+        const mockVpcId = 'vpc-12345678';
+
+        it('should return public subnet', async () => {
+            const mockSubnet = { SubnetId: 'subnet-public-1' };
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: [mockSubnet]
+            });
+
+            // Mock route table check to show it's public
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
                 RouteTables: [{
-                    Routes: [{
-                        GatewayId: 'local',
-                        DestinationCidrBlock: '10.0.0.0/16'
-                    }]
+                    Associations: [{ SubnetId: 'subnet-public-1' }],
+                    Routes: [{ GatewayId: 'igw-12345' }] // Has IGW = public
                 }]
             });
 
-            const result = await discovery.isSubnetPrivate(mockSubnetId);
+            const subnet = await discovery.findPublicSubnets(mockVpcId);
+            expect(subnet).toEqual(mockSubnet);
+        });
+
+        it('should throw error when no subnets found', async () => {
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: []
+            });
 
-            expect(result).toBe(true);
+            await expect(discovery.findPublicSubnets(mockVpcId))
+                .rejects.toThrow('No subnets found in VPC');
         });
+    });
 
-        it('should default to private on error', async () => {
-            mockEC2Send.mockRejectedValue(new Error('Route table error'));
+    describe('findDefaultSecurityGroup', () => {
+        const mockVpcId = 'vpc-12345678';
 
-            const result = await discovery.isSubnetPrivate(mockSubnetId);
+        it('should return default security group', async () => {
+            const mockSecurityGroup = {
+                GroupId: 'sg-12345678',
+                GroupName: 'default'
+            };
+
+            ec2Mock.on(DescribeSecurityGroupsCommand).resolves({
+                SecurityGroups: [mockSecurityGroup]
+            });
+
+            const sg = await discovery.findDefaultSecurityGroup(mockVpcId);
+            expect(sg).toEqual(mockSecurityGroup);
+        });
+
+        it('should throw error when no default security group found', async () => {
+            ec2Mock.on(DescribeSecurityGroupsCommand).resolves({
+                SecurityGroups: []
+            });
 
-            expect(result).toBe(true);
+            await expect(discovery.findDefaultSecurityGroup(mockVpcId))
+                .rejects.toThrow('No security group found for VPC');
         });
     });
 
-    describe('findDefaultSecurityGroup', () => {
+    describe('findPrivateRouteTable', () => {
         const mockVpcId = 'vpc-12345678';
 
-        it('should return Frigg security group when found', async () => {
-            const mockFriggSg = {
-                GroupId: 'sg-frigg-123',
-                GroupName: 'frigg-lambda-sg',
-                VpcId: mockVpcId
+        it('should return private route table', async () => {
+            const mockRouteTable = {
+                RouteTableId: 'rtb-12345678',
+                Routes: [
+                    { GatewayId: 'local', DestinationCidrBlock: '10.0.0.0/16' }
+                ]
             };
 
-            mockEC2Send.mockResolvedValue({
-                SecurityGroups: [mockFriggSg]
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [mockRouteTable]
             });
 
-            const result = await discovery.findDefaultSecurityGroup(mockVpcId);
+            const rt = await discovery.findPrivateRouteTable(mockVpcId);
+            expect(rt).toEqual(mockRouteTable);
+        });
 
-            expect(result).toEqual(mockFriggSg);
-            expect(mockEC2Send).toHaveBeenCalledWith(expect.objectContaining({
-                input: {
-                    Filters: [
-                        { Name: 'vpc-id', Values: [mockVpcId] },
-                        { Name: 'group-name', Values: ['frigg-lambda-sg'] }
-                    ]
+        it('should return first route table when no private route table found', async () => {
+            const mockRouteTable = {
+                RouteTableId: 'rtb-12345678',
+                Routes: [
+                    { GatewayId: 'igw-12345', DestinationCidrBlock: '0.0.0.0/0' }
+                ]
+            };
+
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [mockRouteTable]
+            });
+
+            const rt = await discovery.findPrivateRouteTable(mockVpcId);
+            expect(rt).toEqual(mockRouteTable);
+        });
+    });
+
+    describe('findDefaultKmsKey', () => {
+        it('should return default KMS key ARN', async () => {
+            const mockKeyId = '12345678-1234-1234-1234-123456789012';
+            const mockKeyArn = `arn:aws:kms:us-east-1:123456789012:key/${mockKeyId}`;
+
+            kmsMock.on(ListKeysCommand).resolves({
+                Keys: [{ KeyId: mockKeyId }]
+            });
+
+            kmsMock.on(DescribeKeyCommand).resolves({
+                KeyMetadata: {
+                    Arn: mockKeyArn,
+                    KeyManager: 'CUSTOMER',
+                    KeyState: 'Enabled'
                 }
-            }));
+            });
+
+            const keyArn = await discovery.findDefaultKmsKey();
+            expect(keyArn).toBe(mockKeyArn);
         });
 
-        it('should fallback to default security group', async () => {
-            const mockDefaultSg = {
-                GroupId: 'sg-default-123',
-                GroupName: 'default',
-                VpcId: mockVpcId
-            };
+        it('should return null when no AWS-managed keys found', async () => {
+            kmsMock.on(ListKeysCommand).resolves({
+                Keys: []
+            });
 
-            mockEC2Send
-                .mockResolvedValueOnce({ SecurityGroups: [] }) // No Frigg SG
-                .mockResolvedValueOnce({ SecurityGroups: [mockDefaultSg] }); // Default SG
+            const keyArn = await discovery.findDefaultKmsKey();
+            expect(keyArn).toBeNull();
+        });
+    });
 
-            const result = await discovery.findDefaultSecurityGroup(mockVpcId);
+    describe('findAvailableElasticIP', () => {
+        it('should return available Elastic IP', async () => {
+            const mockElasticIP = {
+                AllocationId: 'eipalloc-12345',
+                PublicIp: '52.1.2.3'
+            };
+
+            ec2Mock.on(DescribeAddressesCommand).resolves({
+                Addresses: [mockElasticIP]
+            });
 
-            expect(result).toEqual(mockDefaultSg);
-            expect(mockEC2Send).toHaveBeenCalledTimes(2);
+            const eip = await discovery.findAvailableElasticIP();
+            expect(eip).toEqual(mockElasticIP);
         });
 
-        it('should throw error when no security groups found', async () => {
-            mockEC2Send.mockResolvedValue({ SecurityGroups: [] });
+        it('should return null when no available Elastic IPs', async () => {
+            ec2Mock.on(DescribeAddressesCommand).resolves({
+                Addresses: []
+            });
 
-            await expect(discovery.findDefaultSecurityGroup(mockVpcId)).rejects.toThrow(`No security group found for VPC ${mockVpcId}`);
+            const eip = await discovery.findAvailableElasticIP();
+            expect(eip).toBeNull();
         });
     });
 
-    describe('findDefaultKmsKey', () => {
-        it('should return customer managed key when found', async () => {
-            const mockKeyId = 'key-12345678';
-            const mockKeyArn = 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012';
+    describe('findExistingNatGateway', () => {
+        const mockVpcId = 'vpc-12345678';
 
-            mockKMSSend
-                .mockResolvedValueOnce({ // ListKeys
-                    Keys: [{ KeyId: mockKeyId }]
+        beforeEach(() => {
+            // Create a fresh discovery instance for each test
+            discovery = new AWSDiscovery('us-east-1');
+        });
+
+        it('should return NAT Gateway in public subnet', async () => {
+            const mockNatGateway = {
+                NatGatewayId: 'nat-12345678',
+                SubnetId: 'subnet-public-1',
+                State: 'available',
+                NatGatewayAddresses: [{ AllocationId: 'eipalloc-12345' }],
+                Tags: []
+            };
+
+            ec2Mock.on(DescribeNatGatewaysCommand).resolves({
+                NatGateways: [mockNatGateway]
+            });
+
+            // Mock subnet lookup
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: [{ SubnetId: 'subnet-public-1', VpcId: mockVpcId }]
+            });
+
+            // Mock route table - has IGW (public)
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [{
+                    Associations: [{ SubnetId: 'subnet-public-1' }],
+                    Routes: [{ GatewayId: 'igw-12345' }]
+                }]
+            });
+
+            const result = await discovery.findExistingNatGateway(mockVpcId);
+
+            expect(result).toBeDefined();
+            expect(result.NatGatewayId).toBe('nat-12345678');
+            expect(result._isInPrivateSubnet).toBe(false);
+        });
+
+        it('should detect NAT Gateway in private subnet', async () => {
+            const mockNatGateway = {
+                NatGatewayId: 'nat-12345678',
+                SubnetId: 'subnet-private-1',
+                State: 'available',
+                NatGatewayAddresses: [{ AllocationId: 'eipalloc-12345' }],
+                Tags: [
+                    { Key: 'ManagedBy', Value: 'Frigg' }
+                ]
+            };
+
+            ec2Mock.on(DescribeNatGatewaysCommand).resolves({
+                NatGateways: [mockNatGateway]
+            });
+
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: [{ SubnetId: 'subnet-private-1', VpcId: mockVpcId }]
+            });
+
+            // Mock route table - no IGW (private)
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [{
+                    Associations: [{ SubnetId: 'subnet-private-1' }],
+                    Routes: [{ GatewayId: 'local' }]
+                }]
+            });
+
+            const result = await discovery.findExistingNatGateway(mockVpcId);
+
+            expect(result).toBeDefined();
+            expect(result.NatGatewayId).toBe('nat-12345678');
+            expect(result._isInPrivateSubnet).toBe(true);
+        });
+
+        it('should skip non-Frigg NAT Gateway in private subnet', async () => {
+            const mockNatGateways = [
+                {
+                    NatGatewayId: 'nat-other-12345',
+                    SubnetId: 'subnet-private-1',
+                    State: 'available',
+                    Tags: [] // No Frigg tags
+                },
+                {
+                    NatGatewayId: 'nat-good-12345',
+                    SubnetId: 'subnet-public-1',
+                    State: 'available',
+                    Tags: []
+                }
+            ];
+
+            ec2Mock.on(DescribeNatGatewaysCommand).resolves({
+                NatGateways: mockNatGateways
+            });
+
+            // First call for subnet-private-1
+            ec2Mock.on(DescribeSubnetsCommand)
+                .resolvesOnce({
+                    Subnets: [{ SubnetId: 'subnet-private-1', VpcId: mockVpcId }]
                 })
-                .mockResolvedValueOnce({ // DescribeKey
-                    KeyMetadata: {
-                        KeyId: mockKeyId,
-                        Arn: mockKeyArn,
-                        KeyManager: 'CUSTOMER',
-                        KeyState: 'Enabled'
-                    }
+                // Second call for subnet-public-1
+                .resolvesOnce({
+                    Subnets: [{ SubnetId: 'subnet-public-1', VpcId: mockVpcId }]
                 });
 
-            mockSTSSend.mockResolvedValue({ Account: '123456789012' });
+            // First call for private subnet route table
+            ec2Mock.on(DescribeRouteTablesCommand)
+                .resolvesOnce({
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-private-1' }],
+                        Routes: [{ GatewayId: 'local' }] // Private
+                    }]
+                })
+                // Second call for public subnet route table
+                .resolvesOnce({
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-public-1' }],
+                        Routes: [{ GatewayId: 'igw-12345' }] // Public
+                    }]
+                });
 
-            const result = await discovery.findDefaultKmsKey();
+            const result = await discovery.findExistingNatGateway(mockVpcId);
 
-            expect(result).toBe(mockKeyArn);
+            expect(result).toBeDefined();
+            expect(result.NatGatewayId).toBe('nat-good-12345');
+            expect(result._isInPrivateSubnet).toBe(false);
         });
 
-        it('should return wildcard pattern when no customer keys found', async () => {
-            mockKMSSend.mockResolvedValue({ Keys: [] });
-            mockSTSSend.mockResolvedValue({ Account: '123456789012' });
+        it('should prioritize Frigg-managed NAT Gateways', async () => {
+            const mockNatGateways = [
+                {
+                    NatGatewayId: 'nat-other-12345',
+                    SubnetId: 'subnet-public-1',
+                    State: 'available',
+                    Tags: []
+                },
+                {
+                    NatGatewayId: 'nat-frigg-12345',
+                    SubnetId: 'subnet-public-2',
+                    State: 'available',
+                    Tags: [{ Key: 'ManagedBy', Value: 'Frigg' }]
+                }
+            ];
 
-            const result = await discovery.findDefaultKmsKey();
+            ec2Mock.on(DescribeNatGatewaysCommand).resolves({
+                NatGateways: mockNatGateways
+            });
 
-            expect(result).toBe('arn:aws:kms:us-east-1:123456789012:key/*');
-        });
+            ec2Mock.on(DescribeSubnetsCommand).resolves({
+                Subnets: [{ SubnetId: 'subnet-public-2', VpcId: mockVpcId }]
+            });
 
-        it('should return fallback on error', async () => {
-            mockKMSSend.mockRejectedValue(new Error('KMS Error'));
+            ec2Mock.on(DescribeRouteTablesCommand).resolves({
+                RouteTables: [{
+                    Associations: [{ SubnetId: 'subnet-public-2' }],
+                    Routes: [{ GatewayId: 'igw-12345' }] // Public
+                }]
+            });
+
+            const result = await discovery.findExistingNatGateway(mockVpcId);
+
+            expect(result).toBeDefined();
+            expect(result.NatGatewayId).toBe('nat-frigg-12345');
+            expect(result._isInPrivateSubnet).toBe(false);
+        });
 
-            const result = await discovery.findDefaultKmsKey();
+        it('should return null when no NAT Gateways found', async () => {
+            ec2Mock.on(DescribeNatGatewaysCommand).resolves({
+                NatGateways: []
+            });
 
-            expect(result).toBe('*');
+            const result = await discovery.findExistingNatGateway(mockVpcId);
+            expect(result).toBeNull();
         });
     });
 
@@ -300,48 +547,171 @@ describe('AWSDiscovery', () => {
         it('should discover all AWS resources successfully', async () => {
             const mockVpc = { VpcId: 'vpc-12345678' };
             const mockSubnets = [
-                { SubnetId: 'subnet-1' }, 
+                { SubnetId: 'subnet-1' },
                 { SubnetId: 'subnet-2' }
             ];
+            const mockPublicSubnet = { SubnetId: 'subnet-public-1' };
             const mockSecurityGroup = { GroupId: 'sg-12345678' };
             const mockRouteTable = { RouteTableId: 'rtb-12345678' };
             const mockKmsArn = 'arn:aws:kms:us-east-1:123456789012:key/12345678';
+            const mockNatGateway = {
+                NatGatewayId: 'nat-12345678',
+                SubnetId: 'subnet-public-1',
+                NatGatewayAddresses: [{ AllocationId: 'eipalloc-12345' }],
+                _isInPrivateSubnet: false
+            };
 
             // Mock all the discovery methods
             jest.spyOn(discovery, 'findDefaultVpc').mockResolvedValue(mockVpc);
             jest.spyOn(discovery, 'findPrivateSubnets').mockResolvedValue(mockSubnets);
+            jest.spyOn(discovery, 'findPublicSubnets').mockResolvedValue(mockPublicSubnet);
             jest.spyOn(discovery, 'findDefaultSecurityGroup').mockResolvedValue(mockSecurityGroup);
             jest.spyOn(discovery, 'findPrivateRouteTable').mockResolvedValue(mockRouteTable);
             jest.spyOn(discovery, 'findDefaultKmsKey').mockResolvedValue(mockKmsArn);
+            jest.spyOn(discovery, 'findExistingNatGateway').mockResolvedValue(mockNatGateway);
+            jest.spyOn(discovery, 'isSubnetPrivate')
+                .mockResolvedValueOnce(true)  // subnet-1 is private
+                .mockResolvedValueOnce(true); // subnet-2 is private
 
             const result = await discovery.discoverResources();
 
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 defaultVpcId: 'vpc-12345678',
                 defaultSecurityGroupId: 'sg-12345678',
                 privateSubnetId1: 'subnet-1',
                 privateSubnetId2: 'subnet-2',
+                publicSubnetId: 'subnet-public-1',
                 privateRouteTableId: 'rtb-12345678',
-                defaultKmsKeyId: mockKmsArn
+                defaultKmsKeyId: mockKmsArn,
+                existingNatGatewayId: 'nat-12345678',
+                existingElasticIpAllocationId: 'eipalloc-12345',
+                natGatewayInPrivateSubnet: false,
+                subnetConversionRequired: false,
+                privateSubnetsWithWrongRoutes: []
             });
 
             // Verify all methods were called
             expect(discovery.findDefaultVpc).toHaveBeenCalled();
-            expect(discovery.findPrivateSubnets).toHaveBeenCalledWith('vpc-12345678');
+            expect(discovery.findPrivateSubnets).toHaveBeenCalledWith('vpc-12345678', false);
+            expect(discovery.findPublicSubnets).toHaveBeenCalledWith('vpc-12345678');
             expect(discovery.findDefaultSecurityGroup).toHaveBeenCalledWith('vpc-12345678');
             expect(discovery.findPrivateRouteTable).toHaveBeenCalledWith('vpc-12345678');
             expect(discovery.findDefaultKmsKey).toHaveBeenCalled();
+            expect(discovery.findExistingNatGateway).toHaveBeenCalledWith('vpc-12345678');
+        });
+
+        it('should detect subnet conversion requirements', async () => {
+            const mockVpc = { VpcId: 'vpc-12345678' };
+            const mockSubnets = [
+                { SubnetId: 'subnet-1' },
+                { SubnetId: 'subnet-2' }
+            ];
+            const mockPublicSubnet = { SubnetId: 'subnet-public-1' };
+            const mockSecurityGroup = { GroupId: 'sg-12345678' };
+            const mockRouteTable = { RouteTableId: 'rtb-12345678' };
+
+            jest.spyOn(discovery, 'findDefaultVpc').mockResolvedValue(mockVpc);
+            jest.spyOn(discovery, 'findPrivateSubnets').mockResolvedValue(mockSubnets);
+            jest.spyOn(discovery, 'findPublicSubnets').mockResolvedValue(mockPublicSubnet);
+            jest.spyOn(discovery, 'findDefaultSecurityGroup').mockResolvedValue(mockSecurityGroup);
+            jest.spyOn(discovery, 'findPrivateRouteTable').mockResolvedValue(mockRouteTable);
+            jest.spyOn(discovery, 'findDefaultKmsKey').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findExistingNatGateway').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findAvailableElasticIP').mockResolvedValue(null);
+            jest.spyOn(discovery, 'isSubnetPrivate')
+                .mockImplementation((subnetId) => {
+                    // subnet-1 is public, subnet-2 is private
+                    return Promise.resolve(subnetId === 'subnet-2');
+                });
+
+            const result = await discovery.discoverResources({ selfHeal: true });
+
+            expect(result).toMatchObject({
+                subnetConversionRequired: true,
+                privateSubnetsWithWrongRoutes: ['subnet-1']
+            });
+        });
+
+        it('should handle selfHeal option', async () => {
+            const mockVpc = { VpcId: 'vpc-12345678' };
+            const mockSubnets = [
+                { SubnetId: 'subnet-public-1' },
+                { SubnetId: 'subnet-public-2' }
+            ];
+            const mockPublicSubnet = { SubnetId: 'subnet-public-3' };
+            const mockSecurityGroup = { GroupId: 'sg-12345678' };
+            const mockRouteTable = { RouteTableId: 'rtb-12345678' };
+
+            jest.spyOn(discovery, 'findDefaultVpc').mockResolvedValue(mockVpc);
+            jest.spyOn(discovery, 'findPrivateSubnets').mockResolvedValue(mockSubnets);
+            jest.spyOn(discovery, 'findPublicSubnets').mockResolvedValue(mockPublicSubnet);
+            jest.spyOn(discovery, 'findDefaultSecurityGroup').mockResolvedValue(mockSecurityGroup);
+            jest.spyOn(discovery, 'findPrivateRouteTable').mockResolvedValue(mockRouteTable);
+            jest.spyOn(discovery, 'findDefaultKmsKey').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findExistingNatGateway').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findAvailableElasticIP').mockResolvedValue(null);
+            jest.spyOn(discovery, 'isSubnetPrivate')
+                .mockResolvedValue(false); // All subnets are public
+
+            const result = await discovery.discoverResources({ selfHeal: true });
+
+            // Verify that findPrivateSubnets was called with autoConvert=true
+            expect(discovery.findPrivateSubnets).toHaveBeenCalledWith('vpc-12345678', true);
+
+            expect(result).toMatchObject({
+                subnetConversionRequired: true,
+                privateSubnetsWithWrongRoutes: ['subnet-public-1', 'subnet-public-2']
+            });
+        });
+
+        it('should detect NAT Gateway in private subnet in discoverResources', async () => {
+            const mockVpc = { VpcId: 'vpc-12345678' };
+            const mockSubnets = [
+                { SubnetId: 'subnet-1' },
+                { SubnetId: 'subnet-2' }
+            ];
+            const mockPublicSubnet = { SubnetId: 'subnet-public-1' };
+            const mockSecurityGroup = { GroupId: 'sg-12345678' };
+            const mockRouteTable = { RouteTableId: 'rtb-12345678' };
+            const mockNatGateway = {
+                NatGatewayId: 'nat-12345678',
+                NatGatewayAddresses: [{ AllocationId: 'eipalloc-12345' }],
+                _isInPrivateSubnet: true // NAT is in private subnet
+            };
+
+            jest.spyOn(discovery, 'findDefaultVpc').mockResolvedValue(mockVpc);
+            jest.spyOn(discovery, 'findPrivateSubnets').mockResolvedValue(mockSubnets);
+            jest.spyOn(discovery, 'findPublicSubnets').mockResolvedValue(mockPublicSubnet);
+            jest.spyOn(discovery, 'findDefaultSecurityGroup').mockResolvedValue(mockSecurityGroup);
+            jest.spyOn(discovery, 'findPrivateRouteTable').mockResolvedValue(mockRouteTable);
+            jest.spyOn(discovery, 'findDefaultKmsKey').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findExistingNatGateway').mockResolvedValue(mockNatGateway);
+            jest.spyOn(discovery, 'isSubnetPrivate')
+                .mockResolvedValueOnce(true)
+                .mockResolvedValueOnce(true);
+
+            const result = await discovery.discoverResources();
+
+            expect(result).toMatchObject({
+                defaultVpcId: 'vpc-12345678',
+                existingNatGatewayId: 'nat-12345678',
+                natGatewayInPrivateSubnet: true, // Should be true
+                subnetConversionRequired: false,
+                privateSubnetsWithWrongRoutes: []
+            });
         });
 
         it('should handle single subnet scenario', async () => {
             const mockVpc = { VpcId: 'vpc-12345678' };
             const mockSubnets = [{ SubnetId: 'subnet-1' }]; // Only one subnet
+            const mockPublicSubnet = { SubnetId: 'subnet-public-1' };
             const mockSecurityGroup = { GroupId: 'sg-12345678' };
             const mockRouteTable = { RouteTableId: 'rtb-12345678' };
             const mockKmsArn = 'arn:aws:kms:us-east-1:123456789012:key/12345678';
 
             jest.spyOn(discovery, 'findDefaultVpc').mockResolvedValue(mockVpc);
             jest.spyOn(discovery, 'findPrivateSubnets').mockResolvedValue(mockSubnets);
+            jest.spyOn(discovery, 'findPublicSubnets').mockResolvedValue(mockPublicSubnet);
             jest.spyOn(discovery, 'findDefaultSecurityGroup').mockResolvedValue(mockSecurityGroup);
             jest.spyOn(discovery, 'findPrivateRouteTable').mockResolvedValue(mockRouteTable);
             jest.spyOn(discovery, 'findDefaultKmsKey').mockResolvedValue(mockKmsArn);

package/infrastructure/serverless-template.js

@@ -1174,7 +1174,8 @@ const composeServerlessDefinition = async (AppDefinition) => {
             healed: [],
             warnings: [],
             errors: [],
-            recommendations: []
+            recommendations: [],
+            criticalActions: []
         };
 
         // Only heal if selfHeal is explicitly enabled
@@ -1218,13 +1219,27 @@ const composeServerlessDefinition = async (AppDefinition) => {
             }
         }
 
-        // Check route table associations
-        if (discoveredResources.privateSubnetsWithWrongRoutes) {
+        // Check route table associations and subnet conversion requirements
+        if (discoveredResources.privateSubnetsWithWrongRoutes &&
+            discoveredResources.privateSubnetsWithWrongRoutes.length > 0) {
             healingReport.warnings.push(
-                `Found ${discoveredResources.privateSubnetsWithWrongRoutes.length} private subnets with incorrect routes`
+                `Found ${discoveredResources.privateSubnetsWithWrongRoutes.length} subnets that are PUBLIC but will be used for Lambda`
             );
             healingReport.healed.push(
-                'Route tables will be corrected during deployment'
+                'Route tables will be corrected during deployment - converting public subnets to private'
+            );
+            healingReport.criticalActions.push(
+                'SUBNET ISOLATION: Will create separate route tables to ensure Lambda subnets are private'
+            );
+        }
+
+        // Check if subnet conversion is required
+        if (discoveredResources.subnetConversionRequired) {
+            healingReport.warnings.push(
+                'Subnet configuration mismatch detected - Lambda functions require private subnets'
+            );
+            healingReport.healed.push(
+                'Will create proper route table configuration for subnet isolation'
             );
         }
 
@@ -1239,6 +1254,11 @@ const composeServerlessDefinition = async (AppDefinition) => {
         }
 
         // Log healing report
+        if (healingReport.criticalActions.length > 0) {
+            console.log('🚨 CRITICAL ACTIONS:');
+            healingReport.criticalActions.forEach(action => console.log(`   - ${action}`));
+        }
+
         if (healingReport.healed.length > 0) {
             console.log('✅ Self-healing actions:');
             healingReport.healed.forEach(action => console.log(`   - ${action}`));

package/infrastructure/test-subnet-logic.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+
+/**
+ * Test script to verify subnet detection and classification logic
+ */
+
+const { AWSDiscovery } = require('./aws-discovery');
+
+async function testSubnetLogic() {
+    console.log('🧪 Testing Subnet Detection and Classification Logic');
+    console.log('═'.repeat(60));
+
+    try {
+        const discovery = new AWSDiscovery();
+
+        // Test with selfHeal enabled
+        console.log('\n📋 Testing with selfHeal: true');
+        console.log('-'.repeat(40));
+
+        const resources = await discovery.discoverResources({ selfHeal: true });
+
+        console.log('\n📊 Results:');
+        console.log(`  VPC ID: ${resources.defaultVpcId}`);
+        console.log(`  Private Subnet 1: ${resources.privateSubnetId1}`);
+        console.log(`  Private Subnet 2: ${resources.privateSubnetId2}`);
+        console.log(`  Public Subnet: ${resources.publicSubnetId}`);
+        console.log(`  Conversion Required: ${resources.subnetConversionRequired}`);
+
+        if (resources.privateSubnetsWithWrongRoutes && resources.privateSubnetsWithWrongRoutes.length > 0) {
+            console.log(`\n⚠️  Subnets needing conversion:`);
+            resources.privateSubnetsWithWrongRoutes.forEach(subnet => {
+                console.log(`    - ${subnet}`);
+            });
+        }
+
+        console.log('\n✅ Test completed successfully!');
+
+    } catch (error) {
+        console.error('\n❌ Test failed:', error.message);
+        console.error('\nStack trace:', error.stack);
+        process.exit(1);
+    }
+}
+
+// Run the test
+testSubnetLogic().catch(error => {
+    console.error('Unhandled error:', error);
+    process.exit(1);
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.428.887095f.0",
+  "version": "2.0.0--canary.428.6b04c24.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.428.887095f.0",
-    "@friggframework/test": "2.0.0--canary.428.887095f.0",
+    "@friggframework/schemas": "2.0.0--canary.428.6b04c24.0",
+    "@friggframework/test": "2.0.0--canary.428.6b04c24.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,8 +32,10 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.428.887095f.0",
-    "@friggframework/prettier-config": "2.0.0--canary.428.887095f.0",
+    "@friggframework/eslint-config": "2.0.0--canary.428.6b04c24.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.6b04c24.0",
+    "aws-sdk-client-mock": "^4.1.0",
+    "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
     "prettier": "^2.7.1",
     "serverless": "3.39.0",
@@ -66,5 +68,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "887095f388c5ff1f0cbfc86c25a803fa8b5e134a"
+  "gitHead": "6b04c24df1e253fd23afd6acb39ec9b5ad61456f"
 }