@friggframework/devtools 2.0.0--canary.461.6b7bf79.0 → 2.0.0--canary.461.77c8d12.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -989,7 +989,7 @@ class VpcBuilder extends InfrastructureBuilder {
         }
 
         // VPC Endpoint Security Group (only if KMS, Secrets Manager, or SQS are not stack-managed and missing)
-        const needsSecurityGroup = 
+        const needsSecurityGroup =
             (!stackManagedEndpoints.kms && !existingEndpoints.kms && appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') ||
             (!stackManagedEndpoints.secretsManager && !existingEndpoints.secretsManager) ||
             (!stackManagedEndpoints.sqs && !existingEndpoints.sqs);

package/infrastructure/domains/shared/cloudformation-discovery.js

@@ -14,8 +14,10 @@
  */
 
 class CloudFormationDiscovery {
-    constructor(provider) {
+    constructor(provider, config = {}) {
         this.provider = provider;
+        this.serviceName = config.serviceName;
+        this.stage = config.stage;
     }
 
     /**
@@ -41,9 +43,8 @@ class CloudFormationDiscovery {
             }
 
             // Extract from resources (now async to query AWS for details)
-            if (resources && resources.length > 0) {
-                await this._extractFromResources(resources, discovered);
-            }
+            // Always call this even if resources is empty, as it may query AWS for resources
+            await this._extractFromResources(resources || [], discovered);
 
             return discovered;
         } catch (error) {
@@ -108,9 +109,15 @@ class CloudFormationDiscovery {
      * @param {Object} discovered - Object to populate with discovered resources
      */
     async _extractFromResources(resources, discovered) {
+        console.log(`  DEBUG: Processing ${resources.length} CloudFormation resources...`);
         for (const resource of resources) {
             const { LogicalResourceId, PhysicalResourceId, ResourceType } = resource;
 
+            // Debug Aurora detection
+            if (LogicalResourceId.includes('Aurora')) {
+                console.log(`  DEBUG: Found Aurora resource: ${LogicalResourceId} (${ResourceType})`);
+            }
+
             // Security Group - use to get VPC ID
             if (LogicalResourceId === 'FriggLambdaSecurityGroup' && ResourceType === 'AWS::EC2::SecurityGroup') {
                 discovered.securityGroupId = PhysicalResourceId;
@@ -141,21 +148,21 @@ class CloudFormationDiscovery {
             if (LogicalResourceId === 'FriggAuroraCluster' && ResourceType === 'AWS::RDS::DBCluster') {
                 discovered.auroraClusterId = PhysicalResourceId;
                 console.log(`  ✓ Found Aurora cluster in stack: ${PhysicalResourceId}`);
-                
+
                 // Query RDS to get cluster endpoint
                 if (this.provider && !discovered.auroraClusterEndpoint) {
                     try {
                         console.log(`  Querying RDS to get Aurora endpoint...`);
                         const { DescribeDBClustersCommand } = require('@aws-sdk/client-rds');
                         const { RDSClient } = require('@aws-sdk/client-rds');
-                        
+
                         const rdsClient = new RDSClient({ region: this.provider.region });
                         const clusterDetails = await rdsClient.send(
                             new DescribeDBClustersCommand({
                                 DBClusterIdentifier: PhysicalResourceId
                             })
                         );
-                        
+
                         if (clusterDetails.DBClusters && clusterDetails.DBClusters.length > 0) {
                             const cluster = clusterDetails.DBClusters[0];
                             discovered.auroraClusterEndpoint = cluster.Endpoint;
@@ -194,6 +201,30 @@ class CloudFormationDiscovery {
                 }
             }
 
+            // KMS Key Alias - query to get the actual key ARN
+            if (LogicalResourceId === 'FriggKMSKeyAlias' && ResourceType === 'AWS::KMS::Alias') {
+                discovered.kmsKeyAlias = PhysicalResourceId;
+                console.log(`  ✓ Found KMS key alias in stack: ${PhysicalResourceId}`);
+
+                // Query KMS to get the key ARN that this alias points to
+                // Always query even if key is already set, to ensure consistency
+                if (this.provider && this.provider.describeKmsKey) {
+                    try {
+                        console.log(`  Querying KMS to get key ARN from alias...`);
+                        const keyMetadata = await this.provider.describeKmsKey(PhysicalResourceId);
+
+                        if (keyMetadata) {
+                            discovered.defaultKmsKeyId = keyMetadata.Arn;
+                            console.log(`  ✓ Extracted KMS key ARN from alias: ${discovered.defaultKmsKeyId}`);
+                        } else {
+                            console.warn(`  ⚠️  KMS key query returned no metadata`);
+                        }
+                    } catch (error) {
+                        console.warn(`  ⚠️  Could not get key ARN from alias: ${error.message}`);
+                    }
+                }
+            }
+
             // Subnets
             if (LogicalResourceId === 'FriggPrivateSubnet1' && ResourceType === 'AWS::EC2::Subnet') {
                 discovered.privateSubnetId1 = PhysicalResourceId;
@@ -235,6 +266,79 @@ class CloudFormationDiscovery {
                 discovered.sqsVpcEndpointId = PhysicalResourceId;
             }
         }
+
+        // If we have a VPC ID but no subnet IDs, query EC2 for Frigg-managed subnets
+        if (discovered.defaultVpcId && this.provider &&
+            !discovered.privateSubnetId1 && !discovered.publicSubnetId1) {
+            try {
+                console.log('  Querying EC2 for Frigg-managed subnets...');
+                const { DescribeSubnetsCommand } = require('@aws-sdk/client-ec2');
+                const subnetResponse = await this.provider.getEC2Client().send(
+                    new DescribeSubnetsCommand({
+                        Filters: [
+                            { Name: 'vpc-id', Values: [discovered.defaultVpcId] },
+                            { Name: 'tag:ManagedBy', Values: ['Frigg'] },
+                        ],
+                    })
+                );
+
+                if (subnetResponse.Subnets && subnetResponse.Subnets.length > 0) {
+                    // Extract subnet IDs by logical ID from tags
+                    const subnets = subnetResponse.Subnets.map(subnet => ({
+                        subnetId: subnet.SubnetId,
+                        logicalId: subnet.Tags?.find(t => t.Key === 'aws:cloudformation:logical-id')?.Value,
+                        isPublic: subnet.MapPublicIpOnLaunch,
+                    }));
+
+                    // Find private subnets
+                    const privateSubnets = subnets.filter(s => !s.isPublic).sort((a, b) =>
+                        a.logicalId?.localeCompare(b.logicalId) || 0
+                    );
+                    if (privateSubnets.length >= 1) {
+                        discovered.privateSubnetId1 = privateSubnets[0].subnetId;
+                    }
+                    if (privateSubnets.length >= 2) {
+                        discovered.privateSubnetId2 = privateSubnets[1].subnetId;
+                    }
+
+                    // Find public subnets
+                    const publicSubnets = subnets.filter(s => s.isPublic).sort((a, b) =>
+                        a.logicalId?.localeCompare(b.logicalId) || 0
+                    );
+                    if (publicSubnets.length >= 1) {
+                        discovered.publicSubnetId1 = publicSubnets[0].subnetId;
+                    }
+                    if (publicSubnets.length >= 2) {
+                        discovered.publicSubnetId2 = publicSubnets[1].subnetId;
+                    }
+
+                    console.log(`  ✓ Found ${subnets.length} Frigg-managed subnets via EC2 query`);
+                }
+            } catch (error) {
+                console.warn(`  ⚠️  Could not query EC2 for subnets: ${error.message}`);
+            }
+        }
+
+        // Check for KMS key alias via AWS API if not found in stack resources
+        // This handles cases where the alias was created outside CloudFormation
+        if (!discovered.defaultKmsKeyId && !discovered.kmsKeyAlias &&
+            this.provider && this.provider.describeKmsKey && this.serviceName && this.stage) {
+            try {
+                const aliasName = `alias/${this.serviceName}-${this.stage}-frigg-kms`;
+                console.log(`  Querying KMS for alias: ${aliasName}...`);
+
+                const keyMetadata = await this.provider.describeKmsKey(aliasName);
+
+                if (keyMetadata) {
+                    discovered.defaultKmsKeyId = keyMetadata.Arn;
+                    discovered.kmsKeyAlias = aliasName;
+                    console.log(`  ✓ Found KMS key via alias query: ${discovered.defaultKmsKeyId}`);
+                }
+            } catch (error) {
+                // Alias not found - this is expected if no KMS key exists yet
+                console.log(`  ℹ No KMS key alias found via AWS API`);
+            }
+        }
     }
 }
 

package/infrastructure/domains/shared/cloudformation-discovery.test.js

@@ -307,6 +307,235 @@ describe('CloudFormationDiscovery', () => {
 
             expect(result).toEqual({});
         });
+
+        it('should query EC2 for subnets when VPC found but no subnet resources in stack', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggLambdaSecurityGroup',
+                    PhysicalResourceId: 'sg-123',
+                    ResourceType: 'AWS::EC2::SecurityGroup',
+                },
+            ];
+
+            const mockEC2Client = {
+                send: jest.fn(),
+            };
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+            mockProvider.getEC2Client = jest.fn().mockReturnValue(mockEC2Client);
+
+            // Mock security group query for VPC ID
+            mockEC2Client.send.mockResolvedValueOnce({
+                SecurityGroups: [{ VpcId: 'vpc-123' }],
+            });
+
+            // Mock subnet query
+            mockEC2Client.send.mockResolvedValueOnce({
+                Subnets: [
+                    {
+                        SubnetId: 'subnet-private-1',
+                        MapPublicIpOnLaunch: false,
+                        Tags: [
+                            { Key: 'ManagedBy', Value: 'Frigg' },
+                            { Key: 'aws:cloudformation:logical-id', Value: 'FriggPrivateSubnet1' },
+                        ],
+                    },
+                    {
+                        SubnetId: 'subnet-private-2',
+                        MapPublicIpOnLaunch: false,
+                        Tags: [
+                            { Key: 'ManagedBy', Value: 'Frigg' },
+                            { Key: 'aws:cloudformation:logical-id', Value: 'FriggPrivateSubnet2' },
+                        ],
+                    },
+                ],
+            });
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result.privateSubnetId1).toBe('subnet-private-1');
+            expect(result.privateSubnetId2).toBe('subnet-private-2');
+            expect(mockEC2Client.send).toHaveBeenCalledTimes(2);
+        });
+
+        it('should handle EC2 subnet query errors gracefully', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggLambdaSecurityGroup',
+                    PhysicalResourceId: 'sg-123',
+                    ResourceType: 'AWS::EC2::SecurityGroup',
+                },
+            ];
+
+            const mockEC2Client = {
+                send: jest.fn(),
+            };
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+            mockProvider.getEC2Client = jest.fn().mockReturnValue(mockEC2Client);
+
+            // Mock security group query for VPC ID
+            mockEC2Client.send.mockResolvedValueOnce({
+                SecurityGroups: [{ VpcId: 'vpc-123' }],
+            });
+
+            // Mock subnet query failure
+            mockEC2Client.send.mockRejectedValueOnce(new Error('EC2 API Error'));
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result.defaultVpcId).toBe('vpc-123');
+            expect(result.privateSubnetId1).toBeUndefined();
+        });
+
+        it('should extract KMS key alias from stack resources and query for key ARN', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggKMSKeyAlias',
+                    PhysicalResourceId: 'alias/test-service-dev-frigg-kms',
+                    ResourceType: 'AWS::KMS::Alias',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+            mockProvider.describeKmsKey = jest.fn().mockResolvedValue({
+                KeyId: 'abc-123',
+                Arn: 'arn:aws:kms:us-east-1:123456789:key/abc-123',
+            });
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result.defaultKmsKeyId).toBe('arn:aws:kms:us-east-1:123456789:key/abc-123');
+            expect(result.kmsKeyAlias).toBe('alias/test-service-dev-frigg-kms');
+            expect(mockProvider.describeKmsKey).toHaveBeenCalledWith('alias/test-service-dev-frigg-kms');
+        });
+
+        it('should query AWS API for KMS alias when serviceName and stage are provided', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+            mockProvider.region = 'us-east-1';
+            mockProvider.describeKmsKey = jest.fn().mockResolvedValue({
+                KeyId: 'abc-123',
+                Arn: 'arn:aws:kms:us-east-1:123456789:key/abc-123',
+            });
+
+            // Pass serviceName and stage to discover alias
+            cfDiscovery.serviceName = 'test-service';
+            cfDiscovery.stage = 'dev';
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result.defaultKmsKeyId).toBe('arn:aws:kms:us-east-1:123456789:key/abc-123');
+            expect(result.kmsKeyAlias).toBe('alias/test-service-dev-frigg-kms');
+            expect(mockProvider.describeKmsKey).toHaveBeenCalledWith('alias/test-service-dev-frigg-kms');
+        });
+
+        it('should handle KMS alias not found gracefully', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+            mockProvider.region = 'us-east-1';
+            mockProvider.describeKmsKey = jest.fn().mockRejectedValue(
+                new Error('Alias/test-service-dev-frigg-kms is not found')
+            );
+
+            cfDiscovery.serviceName = 'test-service';
+            cfDiscovery.stage = 'dev';
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result.defaultKmsKeyId).toBeUndefined();
+            expect(result.kmsKeyAlias).toBeUndefined();
+        });
+
+        it('should prefer KMS key from stack resources over alias query', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggKMSKey',
+                    PhysicalResourceId: 'arn:aws:kms:us-east-1:123456789:key/xyz-789',
+                    ResourceType: 'AWS::KMS::Key',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+            mockProvider.describeKmsKey = jest.fn();
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            // Should use the key from stack resources, not query for alias
+            expect(result.defaultKmsKeyId).toBe('arn:aws:kms:us-east-1:123456789:key/xyz-789');
+            expect(mockProvider.describeKmsKey).not.toHaveBeenCalled();
+        });
+
+        it('should use KMS alias from stack resources even if key is also present', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggKMSKey',
+                    PhysicalResourceId: 'arn:aws:kms:us-east-1:123456789:key/xyz-789',
+                    ResourceType: 'AWS::KMS::Key',
+                },
+                {
+                    LogicalResourceId: 'FriggKMSKeyAlias',
+                    PhysicalResourceId: 'alias/test-service-dev-frigg-kms',
+                    ResourceType: 'AWS::KMS::Alias',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+            mockProvider.describeKmsKey = jest.fn().mockResolvedValue({
+                KeyId: 'xyz-789',
+                Arn: 'arn:aws:kms:us-east-1:123456789:key/xyz-789',
+            });
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result.defaultKmsKeyId).toBe('arn:aws:kms:us-east-1:123456789:key/xyz-789');
+            expect(result.kmsKeyAlias).toBe('alias/test-service-dev-frigg-kms');
+            expect(mockProvider.describeKmsKey).toHaveBeenCalledWith('alias/test-service-dev-frigg-kms');
+        });
     });
 });
 

package/infrastructure/domains/shared/providers/aws-provider-adapter.js

@@ -469,9 +469,29 @@ class AWSProviderAdapter extends CloudProviderAdapter {
         return result;
     }
 
+    /**
+     * Describe KMS key by key ID or alias
+     *
+     * @param {string} keyIdOrAlias - Key ID or alias name
+     * @returns {Promise<Object>} Key metadata
+     */
+    async describeKmsKey(keyIdOrAlias) {
+        const kms = this.getKMSClient();
+
+        try {
+            const response = await kms.send(new DescribeKeyCommand({
+                KeyId: keyIdOrAlias,
+            }));
+
+            return response.KeyMetadata;
+        } catch (error) {
+            throw new Error(`Failed to describe KMS key ${keyIdOrAlias}: ${error.message}`);
+        }
+    }
+
     /**
      * Describe CloudFormation stack
-     * 
+     *
      * @param {string} stackName - Name of the CloudFormation stack
      * @returns {Promise<Object>} Stack details including outputs
      */

package/infrastructure/domains/shared/resource-discovery.js

@@ -73,9 +73,10 @@ async function gatherDiscoveredResources(appDefinition) {
         // Build discovery configuration
         const stage = process.env.SLS_STAGE || 'dev';
         const stackName = `${appDefinition.name || 'create-frigg-app'}-${stage}`;
+        const serviceName = appDefinition.name || 'create-frigg-app';
 
         // Try CloudFormation-first discovery
-        const cfDiscovery = new CloudFormationDiscovery(provider);
+        const cfDiscovery = new CloudFormationDiscovery(provider, { serviceName, stage });
         const stackResources = await cfDiscovery.discoverFromStack(stackName);
 
         // Validate CF discovery results - only use if contains useful data

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.6b7bf79.0",
+  "version": "2.0.0--canary.461.77c8d12.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.6b7bf79.0",
-    "@friggframework/test": "2.0.0--canary.461.6b7bf79.0",
+    "@friggframework/schemas": "2.0.0--canary.461.77c8d12.0",
+    "@friggframework/test": "2.0.0--canary.461.77c8d12.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.6b7bf79.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.6b7bf79.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.77c8d12.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.77c8d12.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "6b7bf790ee79e49375d3064a3791808798b80a26"
+  "gitHead": "77c8d12f6a33bb2d66e19b43b6d96ee27d6f5e06"
 }