@friggframework/devtools 2.0.0--canary.461.086dedb.0 → 2.0.0--canary.461.322ea57.0

package/infrastructure/domains/security/kms-builder.js

@@ -137,20 +137,9 @@ class KmsBuilder extends InfrastructureBuilder {
                                     },
                                 },
                             },
-                            {
-                                Sid: 'AllowLambdaExecutionRole',
-                                Effect: 'Allow',
-                                Principal: {
-                                    AWS: { 'Fn::GetAtt': ['IamRoleLambdaExecution', 'Arn'] },
-                                },
-                                Action: [
-                                    'kms:Decrypt',
-                                    'kms:GenerateDataKey',
-                                    'kms:Encrypt',
-                                    'kms:DescribeKey',
-                                ],
-                                Resource: '*',
-                            },
+                            // NOTE: We do NOT add a statement referencing IamRoleLambdaExecution here
+                            // because it creates a circular dependency (KMS Key → IAM Role → KMS Key).
+                            // Instead, IAM policies grant the Lambda execution role permissions to use KMS.
                         ],
                     },
                     Tags: [

package/infrastructure/domains/security/kms-builder.test.js

@@ -329,15 +329,11 @@ describe('KmsBuilder', () => {
             const result = await kmsBuilder.build(appDefinition, {});
 
             const policy = result.resources.FriggKMSKey.Properties.KeyPolicy;
+            // Should NOT have AllowLambdaExecutionRole statement to avoid circular dependency
+            // (KMS Key → IAM Role → KMS Key = circular)
+            // IAM policies already grant KMS permissions, so key policy doesn't need to reference the role
             const roleStatement = policy.Statement.find(s => s.Sid === 'AllowLambdaExecutionRole');
-
-            expect(roleStatement).toBeDefined();
-            expect(roleStatement.Effect).toBe('Allow');
-            expect(roleStatement.Principal.AWS).toEqual({ 'Fn::GetAtt': ['IamRoleLambdaExecution', 'Arn'] });
-            expect(roleStatement.Action).toContain('kms:GenerateDataKey');
-            expect(roleStatement.Action).toContain('kms:Decrypt');
-            expect(roleStatement.Action).toContain('kms:Encrypt');
-            expect(roleStatement.Action).toContain('kms:DescribeKey');
+            expect(roleStatement).toBeUndefined();
         });
     });
 

package/infrastructure/domains/shared/cloudformation-discovery.js

@@ -28,7 +28,7 @@ class CloudFormationDiscovery {
         try {
             // Try to get the stack
             const stack = await this.provider.describeStack(stackName);
-            
+
             // Get stack resources
             const resources = await this.provider.listStackResources(stackName);
 
@@ -51,7 +51,7 @@ class CloudFormationDiscovery {
             if (error.message && error.message.includes('does not exist')) {
                 return null;
             }
-            
+
             // Other errors - log and return null
             console.warn(`⚠️  CloudFormation discovery failed: ${error.message}`);
             return null;
@@ -73,18 +73,18 @@ class CloudFormationDiscovery {
 
         // VPC outputs
         if (outputMap.VpcId) {
-            discovered.vpcId = outputMap.VpcId;
+            discovered.defaultVpcId = outputMap.VpcId; // VpcBuilder expects 'defaultVpcId'
         }
-        
+
         if (outputMap.PrivateSubnetIds) {
             // Handle comma-separated subnet IDs
             discovered.privateSubnetIds = outputMap.PrivateSubnetIds.split(',').map(id => id.trim());
         }
-        
+
         if (outputMap.PublicSubnetId) {
             discovered.publicSubnetId = outputMap.PublicSubnetId;
         }
-        
+
         if (outputMap.SecurityGroupId) {
             discovered.securityGroupId = outputMap.SecurityGroupId;
         }
@@ -116,7 +116,7 @@ class CloudFormationDiscovery {
                 discovered.securityGroupId = PhysicalResourceId;
                 console.log(`  ✓ Found security group in stack: ${PhysicalResourceId}`);
                 // Query security group to get VPC ID
-                if (this.provider && !discovered.vpcId) {
+                if (this.provider && !discovered.defaultVpcId) {
                     try {
                         console.log(`  Querying security group to get VPC ID...`);
                         const { DescribeSecurityGroupsCommand } = require('@aws-sdk/client-ec2');
@@ -126,8 +126,8 @@ class CloudFormationDiscovery {
                             })
                         );
                         if (sgDetails.SecurityGroups && sgDetails.SecurityGroups.length > 0) {
-                            discovered.vpcId = sgDetails.SecurityGroups[0].VpcId;
-                            console.log(`  ✓ Extracted VPC ID from security group: ${discovered.vpcId}`);
+                            discovered.defaultVpcId = sgDetails.SecurityGroups[0].VpcId; // VpcBuilder expects 'defaultVpcId'
+                            console.log(`  ✓ Extracted VPC ID from security group: ${discovered.defaultVpcId}`);
                         } else {
                             console.warn(`  ⚠️  Security group query returned no results`);
                         }

package/infrastructure/domains/shared/cloudformation-discovery.test.js

@@ -48,7 +48,7 @@ describe('CloudFormationDiscovery', () => {
             const result = await cfDiscovery.discoverFromStack('test-stack');
 
             expect(result).toEqual({
-                vpcId: 'vpc-123',
+                defaultVpcId: 'vpc-123', // VpcBuilder expects 'defaultVpcId', not 'vpcId'
                 privateSubnetIds: ['subnet-1', 'subnet-2'],
                 publicSubnetId: 'subnet-3',
                 securityGroupId: 'sg-123',
@@ -197,7 +197,7 @@ describe('CloudFormationDiscovery', () => {
             const result = await cfDiscovery.discoverFromStack('test-stack');
 
             expect(result).toEqual({
-                vpcId: 'vpc-123',
+                defaultVpcId: 'vpc-123', // VpcBuilder expects 'defaultVpcId'
                 defaultKmsKeyId: 'arn:aws:kms:us-east-1:123456789:key/abc',
                 auroraClusterId: 'test-cluster',
                 natGatewayId: 'nat-123',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.086dedb.0",
+  "version": "2.0.0--canary.461.322ea57.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.086dedb.0",
-    "@friggframework/test": "2.0.0--canary.461.086dedb.0",
+    "@friggframework/schemas": "2.0.0--canary.461.322ea57.0",
+    "@friggframework/test": "2.0.0--canary.461.322ea57.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.086dedb.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.086dedb.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.322ea57.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.322ea57.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "086dedb05c8918a9c762c273aef2481ecda7d231"
+  "gitHead": "322ea5711e264c07e301f58169414bc67deab2d3"
 }