@friggframework/devtools 2.0.0--canary.428.887095f.0 → 2.0.0--canary.428.7665532.0

package/infrastructure/aws-discovery.js

@@ -96,10 +96,11 @@ class AWSDiscovery {
     /**
      * Find private subnets for the given VPC
      * @param {string} vpcId - The VPC ID to search within
+     * @param {boolean} autoConvert - If true, convert public subnets to private if needed
      * @returns {Promise<Array>} Array of subnet objects (at least 2 for high availability)
      * @throws {Error} If no subnets are found in the VPC
      */
-    async findPrivateSubnets(vpcId) {
+    async findPrivateSubnets(vpcId, autoConvert = false) {
         try {
             const command = new DescribeSubnetsCommand({
                 Filters: [
@@ -109,14 +110,16 @@ class AWSDiscovery {
                     }
                 ]
             });
-            
+
             const response = await this.ec2Client.send(command);
-            
+
             if (!response.Subnets || response.Subnets.length === 0) {
                 throw new Error(`No subnets found in VPC ${vpcId}`);
             }
 
-            // Prefer private subnets (no direct route to IGW)
+            console.log(`\n🔍 Analyzing ${response.Subnets.length} subnets in VPC ${vpcId}...`);
+
+            // Categorize subnets by their actual routing
             const privateSubnets = [];
             const publicSubnets = [];
 
@@ -125,17 +128,74 @@ class AWSDiscovery {
                 const isPrivate = await this.isSubnetPrivate(subnet.SubnetId);
                 if (isPrivate) {
                     privateSubnets.push(subnet);
+                    console.log(`  🔒 Private subnet: ${subnet.SubnetId} (AZ: ${subnet.AvailabilityZone})`);
                 } else {
                     publicSubnets.push(subnet);
+                    console.log(`  🌐 Public subnet: ${subnet.SubnetId} (AZ: ${subnet.AvailabilityZone})`);
+                }
+            }
+
+            console.log(`\n📊 Subnet Analysis Results:`);
+            console.log(`  - Private subnets: ${privateSubnets.length}`);
+            console.log(`  - Public subnets: ${publicSubnets.length}`);
+
+            // If we have at least 2 private subnets, use them
+            if (privateSubnets.length >= 2) {
+                console.log(`✅ Found ${privateSubnets.length} private subnets for Lambda deployment`);
+                return privateSubnets.slice(0, 2);
+            }
+
+            // If we have 1 private subnet, we need at least one more
+            if (privateSubnets.length === 1) {
+                console.warn(`⚠️  Only 1 private subnet found. Need at least 2 for high availability.`);
+                if (publicSubnets.length > 0 && autoConvert) {
+                    console.log(`🔄 Will convert 1 public subnet to private for high availability...`);
+                    // Note: The actual conversion happens in the serverless template
                 }
+                // Return what we have - mix of private and public if needed
+                return [...privateSubnets, ...publicSubnets].slice(0, 2);
             }
 
-            // Return at least 2 subnets for high availability
-            const selectedSubnets = privateSubnets.length >= 2 ? 
-                privateSubnets.slice(0, 2) : 
-                response.Subnets.slice(0, 2);
+            // No private subnets found at all - this is a problem!
+            if (privateSubnets.length === 0 && publicSubnets.length > 0) {
+                console.error(`❌ CRITICAL: No private subnets found, but ${publicSubnets.length} public subnets exist`);
+                console.error(`❌ Lambda functions should NOT be deployed in public subnets!`);
+
+                if (autoConvert && publicSubnets.length >= 3) {
+                    console.log(`\n🔧 AUTO-CONVERSION: Will configure subnets for proper isolation...`);
+                    console.log(`  - Keeping ${publicSubnets[0].SubnetId} as public (for NAT Gateway)`);
+                    console.log(`  - Converting ${publicSubnets[1].SubnetId} to private (for Lambda)`);
+                    if (publicSubnets[2]) {
+                        console.log(`  - Converting ${publicSubnets[2].SubnetId} to private (for Lambda)`);
+                    }
+
+                    // Return subnets that SHOULD be private (indexes 1 and 2)
+                    // The actual conversion happens in the serverless template
+                    return publicSubnets.slice(1, 3);
+                } else if (autoConvert && publicSubnets.length >= 2) {
+                    console.log(`\n🔧 AUTO-CONVERSION: Only ${publicSubnets.length} subnets available`);
+                    console.log(`  - Will need to create new subnets or reconfigure existing ones`);
+                    // Return what we have but flag for conversion
+                    return publicSubnets.slice(0, 2);
+                } else {
+                    console.error(`\n⚠️  CONFIGURATION ERROR:`);
+                    console.error(`  Found ${publicSubnets.length} public subnets but no private subnets.`);
+                    console.error(`  Lambda functions require private subnets for security.`);
+                    console.error(`\n  Options:`);
+                    console.error(`  1. Enable selfHeal: true in vpc configuration`);
+                    console.error(`  2. Create private subnets manually`);
+                    console.error(`  3. Set subnets.management: 'create' to create new private subnets`);
+
+                    throw new Error(
+                        `No private subnets found in VPC ${vpcId}. ` +
+                        `Found ${publicSubnets.length} public subnets. ` +
+                        `Lambda requires private subnets. Enable selfHeal or create private subnets.`
+                    );
+                }
+            }
 
-            return selectedSubnets;
+            // No subnets at all?
+            throw new Error(`No subnets found in VPC ${vpcId}`);
         } catch (error) {
             console.error('Error finding private subnets:', error);
             throw error;
@@ -790,30 +850,38 @@ class AWSDiscovery {
      * @returns {string|null} return.defaultKmsKeyId - Default KMS key ARN or null if not found
      * @throws {Error} If resource discovery fails
      */
-    async discoverResources() {
+    async discoverResources(options = {}) {
         try {
-            console.log('Discovering AWS resources for Frigg deployment...');
-            
+            console.log('\n🚀 Discovering AWS resources for Frigg deployment...');
+            console.log('═'.repeat(60));
+
             const vpc = await this.findDefaultVpc();
-            console.log(`Found VPC: ${vpc.VpcId}`);
-            
-            const privateSubnets = await this.findPrivateSubnets(vpc.VpcId);
-            console.log(`Found ${privateSubnets.length} private subnets: ${privateSubnets.map(s => s.SubnetId).join(', ')}`);
-            
+            console.log(`\n✅ Found VPC: ${vpc.VpcId}`);
+
+            // Enable auto-convert if selfHeal is enabled
+            const autoConvert = options.selfHeal || false;
+
+            const privateSubnets = await this.findPrivateSubnets(vpc.VpcId, autoConvert);
+            console.log(`\n✅ Selected subnets for Lambda: ${privateSubnets.map(s => s.SubnetId).join(', ')}`);
+
             const publicSubnet = await this.findPublicSubnets(vpc.VpcId);
-            console.log(`Found public subnet for NAT Gateway: ${publicSubnet.SubnetId}`);
-            
+            if (publicSubnet) {
+                console.log(`\n✅ Found public subnet for NAT Gateway: ${publicSubnet.SubnetId}`);
+            } else {
+                console.log(`\n⚠️  No public subnet found - NAT Gateway creation may fail`);
+            }
+
             const securityGroup = await this.findDefaultSecurityGroup(vpc.VpcId);
-            console.log(`Found security group: ${securityGroup.GroupId}`);
-            
+            console.log(`\n✅ Found security group: ${securityGroup.GroupId}`);
+
             const routeTable = await this.findPrivateRouteTable(vpc.VpcId);
-            console.log(`Found route table: ${routeTable.RouteTableId}`);
-            
+            console.log(`✅ Found route table: ${routeTable.RouteTableId}`);
+
             const kmsKeyArn = await this.findDefaultKmsKey();
             if (kmsKeyArn) {
-                console.log(`Found KMS key: ${kmsKeyArn}`);
+                console.log(`✅ Found KMS key: ${kmsKeyArn}`);
             } else {
-                console.log('No KMS key found');
+                console.log('ℹ️  No KMS key found');
             }
             
             // Try to find existing NAT Gateway
@@ -835,6 +903,42 @@ class AWSDiscovery {
                 }
             }
 
+            // Check if the "private" subnets are actually public
+            const subnet1IsActuallyPrivate = privateSubnets[0] ?
+                await this.isSubnetPrivate(privateSubnets[0].SubnetId) : false;
+            const subnet2IsActuallyPrivate = privateSubnets[1] ?
+                await this.isSubnetPrivate(privateSubnets[1].SubnetId) :
+                subnet1IsActuallyPrivate;
+
+            const subnetStatus = {
+                requiresConversion: !subnet1IsActuallyPrivate || !subnet2IsActuallyPrivate,
+                subnet1NeedsConversion: !subnet1IsActuallyPrivate,
+                subnet2NeedsConversion: !subnet2IsActuallyPrivate
+            };
+
+            if (subnetStatus.requiresConversion) {
+                console.log(`\n⚠️  SUBNET CONFIGURATION WARNING:`);
+                if (subnetStatus.subnet1NeedsConversion && privateSubnets[0]) {
+                    console.log(`  - Subnet ${privateSubnets[0].SubnetId} is currently PUBLIC but will be used for Lambda`);
+                }
+                if (subnetStatus.subnet2NeedsConversion && privateSubnets[1]) {
+                    console.log(`  - Subnet ${privateSubnets[1].SubnetId} is currently PUBLIC but will be used for Lambda`);
+                }
+                console.log(`  💡 Enable selfHeal: true to automatically fix this`);
+            }
+
+            console.log(`\n${'═'.repeat(60)}`);
+            console.log('📋 Discovery Summary:');
+            console.log(`  VPC: ${vpc.VpcId}`);
+            console.log(`  Lambda Subnets: ${privateSubnets.map(s => s.SubnetId).join(', ')}`);
+            console.log(`  NAT Subnet: ${publicSubnet?.SubnetId || 'None (needs creation)'}`);
+            console.log(`  NAT Gateway: ${natGatewayId || 'None (will be created)'}`);
+            console.log(`  Elastic IP: ${elasticIpAllocationId || 'None (will be allocated)'}`);
+            if (subnetStatus.requiresConversion) {
+                console.log(`  ⚠️  Subnet Conversion Required: Yes`);
+            }
+            console.log(`${'═'.repeat(60)}\n`);
+
             return {
                 defaultVpcId: vpc.VpcId,
                 defaultSecurityGroupId: securityGroup.GroupId,
@@ -844,7 +948,10 @@ class AWSDiscovery {
                 privateRouteTableId: routeTable.RouteTableId,
                 defaultKmsKeyId: kmsKeyArn,
                 existingNatGatewayId: natGatewayId,
-                existingElasticIpAllocationId: elasticIpAllocationId
+                existingElasticIpAllocationId: elasticIpAllocationId,
+                subnetConversionRequired: subnetStatus.requiresConversion,
+                privateSubnetsWithWrongRoutes: subnetStatus.requiresConversion ?
+                    [privateSubnets[0]?.SubnetId, privateSubnets[1]?.SubnetId].filter(Boolean) : []
             };
         } catch (error) {
             console.error('Error discovering AWS resources:', error);

package/infrastructure/aws-discovery.test.js

@@ -118,39 +118,144 @@ describe('AWSDiscovery', () => {
 
         it('should return private subnets when found', async () => {
             const mockSubnets = [
-                { SubnetId: 'subnet-private-1', VpcId: mockVpcId },
-                { SubnetId: 'subnet-private-2', VpcId: mockVpcId }
+                { SubnetId: 'subnet-private-1', VpcId: mockVpcId, AvailabilityZone: 'us-east-1a' },
+                { SubnetId: 'subnet-private-2', VpcId: mockVpcId, AvailabilityZone: 'us-east-1b' }
             ];
 
             mockEC2Send
                 .mockResolvedValueOnce({ Subnets: mockSubnets }) // DescribeSubnets
-                .mockResolvedValue({ RouteTables: [] }); // DescribeRouteTables (private)
+                .mockResolvedValueOnce({ // Check subnet-private-1
+                    Subnets: [{ SubnetId: 'subnet-private-1', VpcId: mockVpcId }]
+                })
+                .mockResolvedValueOnce({ // Route tables for private-1
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-private-1' }],
+                        Routes: [{ GatewayId: 'local' }] // No IGW = private
+                    }]
+                })
+                .mockResolvedValueOnce({ // Check subnet-private-2
+                    Subnets: [{ SubnetId: 'subnet-private-2', VpcId: mockVpcId }]
+                })
+                .mockResolvedValueOnce({ // Route tables for private-2
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-private-2' }],
+                        Routes: [{ GatewayId: 'local' }] // No IGW = private
+                    }]
+                });
 
-            const result = await discovery.findPrivateSubnets(mockVpcId);
+            const result = await discovery.findPrivateSubnets(mockVpcId, false);
 
             expect(result).toHaveLength(2);
             expect(result[0].SubnetId).toBe('subnet-private-1');
             expect(result[1].SubnetId).toBe('subnet-private-2');
         });
 
-        it('should return at least 2 subnets even if mixed private/public', async () => {
+        it('should handle all public subnets with autoConvert enabled', async () => {
             const mockSubnets = [
-                { SubnetId: 'subnet-1', VpcId: mockVpcId },
-                { SubnetId: 'subnet-2', VpcId: mockVpcId },
-                { SubnetId: 'subnet-3', VpcId: mockVpcId }
+                { SubnetId: 'subnet-public-1', VpcId: mockVpcId, AvailabilityZone: 'us-east-1a' },
+                { SubnetId: 'subnet-public-2', VpcId: mockVpcId, AvailabilityZone: 'us-east-1b' },
+                { SubnetId: 'subnet-public-3', VpcId: mockVpcId, AvailabilityZone: 'us-east-1c' }
             ];
 
+            // Mock all subnets as public
             mockEC2Send
                 .mockResolvedValueOnce({ Subnets: mockSubnets }) // DescribeSubnets
-                .mockResolvedValue({ // Only one private subnet
+                .mockResolvedValueOnce({ Subnets: [{ SubnetId: 'subnet-public-1', VpcId: mockVpcId }] })
+                .mockResolvedValueOnce({ // Route table for public-1
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-public-1' }],
+                        Routes: [{ GatewayId: 'igw-12345' }] // IGW = public
+                    }]
+                })
+                .mockResolvedValueOnce({ Subnets: [{ SubnetId: 'subnet-public-2', VpcId: mockVpcId }] })
+                .mockResolvedValueOnce({ // Route table for public-2
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-public-2' }],
+                        Routes: [{ GatewayId: 'igw-12345' }] // IGW = public
+                    }]
+                })
+                .mockResolvedValueOnce({ Subnets: [{ SubnetId: 'subnet-public-3', VpcId: mockVpcId }] })
+                .mockResolvedValueOnce({ // Route table for public-3
                     RouteTables: [{
-                        Routes: [] // No IGW route = private
+                        Associations: [{ SubnetId: 'subnet-public-3' }],
+                        Routes: [{ GatewayId: 'igw-12345' }] // IGW = public
                     }]
                 });
 
-            const result = await discovery.findPrivateSubnets(mockVpcId);
+            // With autoConvert=true, should return subnets to be converted
+            const result = await discovery.findPrivateSubnets(mockVpcId, true);
 
             expect(result).toHaveLength(2);
+            // Should return subnets 2 and 3 for conversion (keeping 1 as public for NAT)
+            expect(result[0].SubnetId).toBe('subnet-public-2');
+            expect(result[1].SubnetId).toBe('subnet-public-3');
+        });
+
+        it('should throw error when all subnets are public and autoConvert is false', async () => {
+            const mockSubnets = [
+                { SubnetId: 'subnet-public-1', VpcId: mockVpcId, AvailabilityZone: 'us-east-1a' },
+                { SubnetId: 'subnet-public-2', VpcId: mockVpcId, AvailabilityZone: 'us-east-1b' }
+            ];
+
+            mockEC2Send
+                .mockResolvedValueOnce({ Subnets: mockSubnets })
+                .mockResolvedValueOnce({ Subnets: [{ SubnetId: 'subnet-public-1', VpcId: mockVpcId }] })
+                .mockResolvedValueOnce({ // Public route table
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-public-1' }],
+                        Routes: [{ GatewayId: 'igw-12345' }]
+                    }]
+                })
+                .mockResolvedValueOnce({ Subnets: [{ SubnetId: 'subnet-public-2', VpcId: mockVpcId }] })
+                .mockResolvedValueOnce({ // Public route table
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-public-2' }],
+                        Routes: [{ GatewayId: 'igw-12345' }]
+                    }]
+                });
+
+            await expect(discovery.findPrivateSubnets(mockVpcId, false)).rejects.toThrow(
+                `No private subnets found in VPC ${mockVpcId}`
+            );
+        });
+
+        it('should handle mixed private/public subnets correctly', async () => {
+            const mockSubnets = [
+                { SubnetId: 'subnet-private-1', VpcId: mockVpcId, AvailabilityZone: 'us-east-1a' },
+                { SubnetId: 'subnet-public-1', VpcId: mockVpcId, AvailabilityZone: 'us-east-1b' },
+                { SubnetId: 'subnet-public-2', VpcId: mockVpcId, AvailabilityZone: 'us-east-1c' }
+            ];
+
+            mockEC2Send
+                .mockResolvedValueOnce({ Subnets: mockSubnets })
+                .mockResolvedValueOnce({ Subnets: [{ SubnetId: 'subnet-private-1', VpcId: mockVpcId }] })
+                .mockResolvedValueOnce({ // Private route table
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-private-1' }],
+                        Routes: [{ GatewayId: 'local' }] // No IGW
+                    }]
+                })
+                .mockResolvedValueOnce({ Subnets: [{ SubnetId: 'subnet-public-1', VpcId: mockVpcId }] })
+                .mockResolvedValueOnce({ // Public route table
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-public-1' }],
+                        Routes: [{ GatewayId: 'igw-12345' }]
+                    }]
+                })
+                .mockResolvedValueOnce({ Subnets: [{ SubnetId: 'subnet-public-2', VpcId: mockVpcId }] })
+                .mockResolvedValueOnce({ // Public route table
+                    RouteTables: [{
+                        Associations: [{ SubnetId: 'subnet-public-2' }],
+                        Routes: [{ GatewayId: 'igw-12345' }]
+                    }]
+                });
+
+            const result = await discovery.findPrivateSubnets(mockVpcId, false);
+
+            expect(result).toHaveLength(2);
+            // Should return the one private and one public subnet for HA
+            expect(result[0].SubnetId).toBe('subnet-private-1');
+            expect(result[1].SubnetId).toBe('subnet-public-1');
         });
 
         it('should throw error when no subnets found', async () => {
@@ -162,16 +267,22 @@ describe('AWSDiscovery', () => {
 
     describe('isSubnetPrivate', () => {
         const mockSubnetId = 'subnet-12345678';
+        const mockVpcId = 'vpc-12345678';
 
         it('should return false for public subnet (has IGW route)', async () => {
-            mockEC2Send.mockResolvedValue({
-                RouteTables: [{
-                    Routes: [{
-                        GatewayId: 'igw-12345678',
-                        DestinationCidrBlock: '0.0.0.0/0'
+            mockEC2Send
+                .mockResolvedValueOnce({ // DescribeSubnets
+                    Subnets: [{ SubnetId: mockSubnetId, VpcId: mockVpcId }]
+                })
+                .mockResolvedValueOnce({ // DescribeRouteTables
+                    RouteTables: [{
+                        Associations: [{ SubnetId: mockSubnetId }],
+                        Routes: [{
+                            GatewayId: 'igw-12345678',
+                            DestinationCidrBlock: '0.0.0.0/0'
+                        }]
                     }]
-                }]
-            });
+                });
 
             const result = await discovery.isSubnetPrivate(mockSubnetId);
 
@@ -179,27 +290,64 @@ describe('AWSDiscovery', () => {
         });
 
         it('should return true for private subnet (no IGW route)', async () => {
-            mockEC2Send.mockResolvedValue({
-                RouteTables: [{
-                    Routes: [{
-                        GatewayId: 'local',
-                        DestinationCidrBlock: '10.0.0.0/16'
+            mockEC2Send
+                .mockResolvedValueOnce({ // DescribeSubnets
+                    Subnets: [{ SubnetId: mockSubnetId, VpcId: mockVpcId }]
+                })
+                .mockResolvedValueOnce({ // DescribeRouteTables
+                    RouteTables: [{
+                        Associations: [{ SubnetId: mockSubnetId }],
+                        Routes: [{
+                            GatewayId: 'local',
+                            DestinationCidrBlock: '10.0.0.0/16'
+                        }]
                     }]
-                }]
-            });
+                });
 
             const result = await discovery.isSubnetPrivate(mockSubnetId);
 
             expect(result).toBe(true);
         });
 
+        it('should use main route table if no explicit association', async () => {
+            mockEC2Send
+                .mockResolvedValueOnce({ // DescribeSubnets
+                    Subnets: [{ SubnetId: mockSubnetId, VpcId: mockVpcId }]
+                })
+                .mockResolvedValueOnce({ // DescribeRouteTables
+                    RouteTables: [{
+                        Associations: [{ Main: true }], // Main route table
+                        Routes: [{
+                            GatewayId: 'igw-12345678',
+                            DestinationCidrBlock: '0.0.0.0/0'
+                        }]
+                    }]
+                });
+
+            const result = await discovery.isSubnetPrivate(mockSubnetId);
+
+            expect(result).toBe(false); // Public because main route has IGW
+        });
+
         it('should default to private on error', async () => {
-            mockEC2Send.mockRejectedValue(new Error('Route table error'));
+            mockEC2Send
+                .mockResolvedValueOnce({ // DescribeSubnets
+                    Subnets: [{ SubnetId: mockSubnetId, VpcId: mockVpcId }]
+                })
+                .mockRejectedValue(new Error('Route table error'));
 
             const result = await discovery.isSubnetPrivate(mockSubnetId);
 
             expect(result).toBe(true);
         });
+
+        it('should throw error when subnet not found', async () => {
+            mockEC2Send.mockResolvedValueOnce({ Subnets: [] });
+
+            await expect(discovery.isSubnetPrivate(mockSubnetId)).rejects.toThrow(
+                `Subnet ${mockSubnetId} not found`
+            );
+        });
     });
 
     describe('findDefaultSecurityGroup', () => {
@@ -300,37 +448,116 @@ describe('AWSDiscovery', () => {
         it('should discover all AWS resources successfully', async () => {
             const mockVpc = { VpcId: 'vpc-12345678' };
             const mockSubnets = [
-                { SubnetId: 'subnet-1' }, 
+                { SubnetId: 'subnet-1' },
                 { SubnetId: 'subnet-2' }
             ];
+            const mockPublicSubnet = { SubnetId: 'subnet-public-1' };
             const mockSecurityGroup = { GroupId: 'sg-12345678' };
             const mockRouteTable = { RouteTableId: 'rtb-12345678' };
             const mockKmsArn = 'arn:aws:kms:us-east-1:123456789012:key/12345678';
+            const mockNatGateway = {
+                NatGatewayId: 'nat-12345678',
+                NatGatewayAddresses: [{ AllocationId: 'eipalloc-12345' }]
+            };
 
             // Mock all the discovery methods
             jest.spyOn(discovery, 'findDefaultVpc').mockResolvedValue(mockVpc);
             jest.spyOn(discovery, 'findPrivateSubnets').mockResolvedValue(mockSubnets);
+            jest.spyOn(discovery, 'findPublicSubnets').mockResolvedValue(mockPublicSubnet);
             jest.spyOn(discovery, 'findDefaultSecurityGroup').mockResolvedValue(mockSecurityGroup);
             jest.spyOn(discovery, 'findPrivateRouteTable').mockResolvedValue(mockRouteTable);
             jest.spyOn(discovery, 'findDefaultKmsKey').mockResolvedValue(mockKmsArn);
+            jest.spyOn(discovery, 'findExistingNatGateway').mockResolvedValue(mockNatGateway);
+            jest.spyOn(discovery, 'isSubnetPrivate')
+                .mockResolvedValueOnce(true)  // subnet-1 is private
+                .mockResolvedValueOnce(true); // subnet-2 is private
 
             const result = await discovery.discoverResources();
 
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 defaultVpcId: 'vpc-12345678',
                 defaultSecurityGroupId: 'sg-12345678',
                 privateSubnetId1: 'subnet-1',
                 privateSubnetId2: 'subnet-2',
+                publicSubnetId: 'subnet-public-1',
                 privateRouteTableId: 'rtb-12345678',
-                defaultKmsKeyId: mockKmsArn
+                defaultKmsKeyId: mockKmsArn,
+                existingNatGatewayId: 'nat-12345678',
+                existingElasticIpAllocationId: 'eipalloc-12345',
+                subnetConversionRequired: false,
+                privateSubnetsWithWrongRoutes: []
             });
 
             // Verify all methods were called
             expect(discovery.findDefaultVpc).toHaveBeenCalled();
-            expect(discovery.findPrivateSubnets).toHaveBeenCalledWith('vpc-12345678');
+            expect(discovery.findPrivateSubnets).toHaveBeenCalledWith('vpc-12345678', false);
+            expect(discovery.findPublicSubnets).toHaveBeenCalledWith('vpc-12345678');
             expect(discovery.findDefaultSecurityGroup).toHaveBeenCalledWith('vpc-12345678');
             expect(discovery.findPrivateRouteTable).toHaveBeenCalledWith('vpc-12345678');
             expect(discovery.findDefaultKmsKey).toHaveBeenCalled();
+            expect(discovery.findExistingNatGateway).toHaveBeenCalledWith('vpc-12345678');
+        });
+
+        it('should detect subnet conversion requirements', async () => {
+            const mockVpc = { VpcId: 'vpc-12345678' };
+            const mockSubnets = [
+                { SubnetId: 'subnet-1' },
+                { SubnetId: 'subnet-2' }
+            ];
+            const mockPublicSubnet = { SubnetId: 'subnet-public-1' };
+            const mockSecurityGroup = { GroupId: 'sg-12345678' };
+            const mockRouteTable = { RouteTableId: 'rtb-12345678' };
+
+            jest.spyOn(discovery, 'findDefaultVpc').mockResolvedValue(mockVpc);
+            jest.spyOn(discovery, 'findPrivateSubnets').mockResolvedValue(mockSubnets);
+            jest.spyOn(discovery, 'findPublicSubnets').mockResolvedValue(mockPublicSubnet);
+            jest.spyOn(discovery, 'findDefaultSecurityGroup').mockResolvedValue(mockSecurityGroup);
+            jest.spyOn(discovery, 'findPrivateRouteTable').mockResolvedValue(mockRouteTable);
+            jest.spyOn(discovery, 'findDefaultKmsKey').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findExistingNatGateway').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findAvailableElasticIP').mockResolvedValue(null);
+            jest.spyOn(discovery, 'isSubnetPrivate')
+                .mockResolvedValueOnce(false) // subnet-1 is actually public
+                .mockResolvedValueOnce(true); // subnet-2 is private
+
+            const result = await discovery.discoverResources({ selfHeal: true });
+
+            expect(result).toMatchObject({
+                subnetConversionRequired: true,
+                privateSubnetsWithWrongRoutes: ['subnet-1']
+            });
+        });
+
+        it('should handle selfHeal option', async () => {
+            const mockVpc = { VpcId: 'vpc-12345678' };
+            const mockSubnets = [
+                { SubnetId: 'subnet-public-1' },
+                { SubnetId: 'subnet-public-2' }
+            ];
+            const mockPublicSubnet = { SubnetId: 'subnet-public-3' };
+            const mockSecurityGroup = { GroupId: 'sg-12345678' };
+            const mockRouteTable = { RouteTableId: 'rtb-12345678' };
+
+            jest.spyOn(discovery, 'findDefaultVpc').mockResolvedValue(mockVpc);
+            jest.spyOn(discovery, 'findPrivateSubnets').mockResolvedValue(mockSubnets);
+            jest.spyOn(discovery, 'findPublicSubnets').mockResolvedValue(mockPublicSubnet);
+            jest.spyOn(discovery, 'findDefaultSecurityGroup').mockResolvedValue(mockSecurityGroup);
+            jest.spyOn(discovery, 'findPrivateRouteTable').mockResolvedValue(mockRouteTable);
+            jest.spyOn(discovery, 'findDefaultKmsKey').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findExistingNatGateway').mockResolvedValue(null);
+            jest.spyOn(discovery, 'findAvailableElasticIP').mockResolvedValue(null);
+            jest.spyOn(discovery, 'isSubnetPrivate')
+                .mockResolvedValue(false); // All subnets are public
+
+            const result = await discovery.discoverResources({ selfHeal: true });
+
+            // Verify that findPrivateSubnets was called with autoConvert=true
+            expect(discovery.findPrivateSubnets).toHaveBeenCalledWith('vpc-12345678', true);
+
+            expect(result).toMatchObject({
+                subnetConversionRequired: true,
+                privateSubnetsWithWrongRoutes: ['subnet-public-1', 'subnet-public-2']
+            });
         });
 
         it('should handle single subnet scenario', async () => {

package/infrastructure/serverless-template.js

@@ -1174,7 +1174,8 @@ const composeServerlessDefinition = async (AppDefinition) => {
             healed: [],
             warnings: [],
             errors: [],
-            recommendations: []
+            recommendations: [],
+            criticalActions: []
         };
 
         // Only heal if selfHeal is explicitly enabled
@@ -1218,13 +1219,27 @@ const composeServerlessDefinition = async (AppDefinition) => {
             }
         }
 
-        // Check route table associations
-        if (discoveredResources.privateSubnetsWithWrongRoutes) {
+        // Check route table associations and subnet conversion requirements
+        if (discoveredResources.privateSubnetsWithWrongRoutes &&
+            discoveredResources.privateSubnetsWithWrongRoutes.length > 0) {
             healingReport.warnings.push(
-                `Found ${discoveredResources.privateSubnetsWithWrongRoutes.length} private subnets with incorrect routes`
+                `Found ${discoveredResources.privateSubnetsWithWrongRoutes.length} subnets that are PUBLIC but will be used for Lambda`
             );
             healingReport.healed.push(
-                'Route tables will be corrected during deployment'
+                'Route tables will be corrected during deployment - converting public subnets to private'
+            );
+            healingReport.criticalActions.push(
+                'SUBNET ISOLATION: Will create separate route tables to ensure Lambda subnets are private'
+            );
+        }
+
+        // Check if subnet conversion is required
+        if (discoveredResources.subnetConversionRequired) {
+            healingReport.warnings.push(
+                'Subnet configuration mismatch detected - Lambda functions require private subnets'
+            );
+            healingReport.healed.push(
+                'Will create proper route table configuration for subnet isolation'
             );
         }
 
@@ -1239,6 +1254,11 @@ const composeServerlessDefinition = async (AppDefinition) => {
         }
 
         // Log healing report
+        if (healingReport.criticalActions.length > 0) {
+            console.log('🚨 CRITICAL ACTIONS:');
+            healingReport.criticalActions.forEach(action => console.log(`   - ${action}`));
+        }
+
         if (healingReport.healed.length > 0) {
             console.log('✅ Self-healing actions:');
             healingReport.healed.forEach(action => console.log(`   - ${action}`));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.428.887095f.0",
+  "version": "2.0.0--canary.428.7665532.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.428.887095f.0",
-    "@friggframework/test": "2.0.0--canary.428.887095f.0",
+    "@friggframework/schemas": "2.0.0--canary.428.7665532.0",
+    "@friggframework/test": "2.0.0--canary.428.7665532.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,8 +32,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.428.887095f.0",
-    "@friggframework/prettier-config": "2.0.0--canary.428.887095f.0",
+    "@friggframework/eslint-config": "2.0.0--canary.428.7665532.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.7665532.0",
     "jest": "^30.1.3",
     "prettier": "^2.7.1",
     "serverless": "3.39.0",
@@ -66,5 +66,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "887095f388c5ff1f0cbfc86c25a803fa8b5e134a"
+  "gitHead": "7665532bd0d3fa2968e2575d9f9e79dd3d119375"
 }