@friggframework/devtools 2.0.0--canary.461.9790ea9.0 → 2.0.0--canary.461.aa02ace.0

package/infrastructure/domains/database/aurora-builder.test.js

@@ -625,13 +625,13 @@ describe('AuroraBuilder', () => {
 
             expect(result.resources.FriggAuroraCluster).toBeDefined();
             expect(result.resources.FriggAuroraCluster.Type).toBe('AWS::RDS::DBCluster');
-            
+
             // PubliclyAccessible is NOT supported on Aurora clusters (only on instances)
             expect(result.resources.FriggAuroraCluster.Properties.PubliclyAccessible).toBeUndefined();
-            
+
             // Port should be explicitly set to PostgreSQL standard (5432)
             expect(result.resources.FriggAuroraCluster.Properties.Port).toBe(5432);
-            
+
             // Should create self-referencing security group ingress rule
             expect(result.resources.FriggAuroraIngressRule).toBeDefined();
             expect(result.resources.FriggAuroraIngressRule.Type).toBe('AWS::EC2::SecurityGroupIngress');

package/infrastructure/domains/networking/vpc-builder.js

@@ -141,18 +141,32 @@ class VpcBuilder extends InfrastructureBuilder {
         // Build VPC Endpoints if enabled
         const vpcManagement = appDefinition.vpc.management || 'discover';
         const selfHeal = appDefinition.vpc.selfHeal !== false;
-        const vpcEndpointsExist = discoveredResources.s3VpcEndpointId && discoveredResources.dynamodbVpcEndpointId;
+        // Check which VPC endpoints already exist
+        const existingEndpoints = {
+            s3: discoveredResources.s3VpcEndpointId,
+            dynamodb: discoveredResources.dynamodbVpcEndpointId,
+            kms: discoveredResources.kmsVpcEndpointId,
+            secretsManager: discoveredResources.secretsManagerVpcEndpointId,
+        };
+        const allEndpointsExist = existingEndpoints.s3 && existingEndpoints.dynamodb &&
+            existingEndpoints.kms && existingEndpoints.secretsManager;
+        const someEndpointsExist = existingEndpoints.s3 || existingEndpoints.dynamodb ||
+            existingEndpoints.kms || existingEndpoints.secretsManager;
 
         if (appDefinition.vpc.enableVPCEndpoints !== false) {
             if (vpcManagement === 'create-new') {
                 // Always create in create-new mode
-                this.buildVpcEndpoints(appDefinition, discoveredResources, result);
+                this.buildVpcEndpoints(appDefinition, discoveredResources, result, existingEndpoints);
             } else if (vpcManagement === 'discover') {
-                if (vpcEndpointsExist) {
-                    console.log('  VPC endpoints already exist - skipping creation');
+                if (allEndpointsExist) {
+                    console.log('  All VPC endpoints already exist - skipping creation');
                 } else if (selfHeal) {
-                    console.log('  No VPC endpoints found - selfHeal creating them');
-                    this.buildVpcEndpoints(appDefinition, discoveredResources, result);
+                    if (someEndpointsExist) {
+                        console.log('  Some VPC endpoints found - selfHeal creating missing ones');
+                    } else {
+                        console.log('  No VPC endpoints found - selfHeal creating them');
+                    }
+                    this.buildVpcEndpoints(appDefinition, discoveredResources, result, existingEndpoints);
                 } else {
                     console.log('  VPC endpoints not found and selfHeal disabled - skipping');
                 }
@@ -662,8 +676,19 @@ class VpcBuilder extends InfrastructureBuilder {
     /**
      * Build VPC Endpoints for AWS services
      */
-    buildVpcEndpoints(appDefinition, discoveredResources, result) {
-        console.log('  Creating VPC Endpoints...');
+    buildVpcEndpoints(appDefinition, discoveredResources, result, existingEndpoints = {}) {
+        const missing = [];
+        if (!existingEndpoints.s3) missing.push('S3');
+        if (!existingEndpoints.dynamodb) missing.push('DynamoDB');
+        if (!existingEndpoints.kms && appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') missing.push('KMS');
+        if (!existingEndpoints.secretsManager) missing.push('Secrets Manager');
+
+        if (missing.length > 0) {
+            console.log(`  Creating missing VPC Endpoints: ${missing.join(', ')}...`);
+        } else {
+            console.log('  All required VPC Endpoints already exist - skipping creation');
+            return;
+        }
 
         const vpcId = result.vpcId || discoveredResources.defaultVpcId;
 
@@ -682,52 +707,58 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
-        // S3 Gateway Endpoint
-        result.resources.FriggS3VPCEndpoint = {
-            Type: 'AWS::EC2::VPCEndpoint',
-            Properties: {
-                VpcId: vpcId,
-                ServiceName: 'com.amazonaws.${self:provider.region}.s3',
-                VpcEndpointType: 'Gateway',
-                RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }],
-            },
-        };
+        // S3 Gateway Endpoint (only if missing)
+        if (!existingEndpoints.s3) {
+            result.resources.FriggS3VPCEndpoint = {
+                Type: 'AWS::EC2::VPCEndpoint',
+                Properties: {
+                    VpcId: vpcId,
+                    ServiceName: 'com.amazonaws.${self:provider.region}.s3',
+                    VpcEndpointType: 'Gateway',
+                    RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }],
+                },
+            };
+        }
 
-        // DynamoDB Gateway Endpoint
-        result.resources.FriggDynamoDBVPCEndpoint = {
-            Type: 'AWS::EC2::VPCEndpoint',
-            Properties: {
-                VpcId: vpcId,
-                ServiceName: 'com.amazonaws.${self:provider.region}.dynamodb',
-                VpcEndpointType: 'Gateway',
-                RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }],
-            },
-        };
+        // DynamoDB Gateway Endpoint (only if missing)
+        if (!existingEndpoints.dynamodb) {
+            result.resources.FriggDynamoDBVPCEndpoint = {
+                Type: 'AWS::EC2::VPCEndpoint',
+                Properties: {
+                    VpcId: vpcId,
+                    ServiceName: 'com.amazonaws.${self:provider.region}.dynamodb',
+                    VpcEndpointType: 'Gateway',
+                    RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }],
+                },
+            };
+        }
 
-        // VPC Endpoint Security Group
-        result.resources.FriggVPCEndpointSecurityGroup = {
-            Type: 'AWS::EC2::SecurityGroup',
-            Properties: {
-                GroupDescription: 'Security group for VPC Endpoints',
-                VpcId: vpcId,
-                SecurityGroupIngress: [
-                    {
-                        IpProtocol: 'tcp',
-                        FromPort: 443,
-                        ToPort: 443,
-                        SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' },
-                        Description: 'HTTPS from Lambda',
-                    },
-                ],
-                Tags: [
-                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-vpc-endpoint-sg' },
-                    { Key: 'ManagedBy', Value: 'Frigg' },
-                ],
-            },
-        };
+        // VPC Endpoint Security Group (only if KMS or Secrets Manager are missing)
+        if (!existingEndpoints.kms || !existingEndpoints.secretsManager) {
+            result.resources.FriggVPCEndpointSecurityGroup = {
+                Type: 'AWS::EC2::SecurityGroup',
+                Properties: {
+                    GroupDescription: 'Security group for VPC Endpoints',
+                    VpcId: vpcId,
+                    SecurityGroupIngress: [
+                        {
+                            IpProtocol: 'tcp',
+                            FromPort: 443,
+                            ToPort: 443,
+                            SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' },
+                            Description: 'HTTPS from Lambda',
+                        },
+                    ],
+                    Tags: [
+                        { Key: 'Name', Value: '${self:service}-${self:provider.stage}-vpc-endpoint-sg' },
+                        { Key: 'ManagedBy', Value: 'Frigg' },
+                    ],
+                },
+            };
+        }
 
-        // KMS Interface Endpoint (if KMS encryption enabled)
-        if (appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
+        // KMS Interface Endpoint (only if missing AND KMS encryption is enabled)
+        if (!existingEndpoints.kms && appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
             result.resources.FriggKMSVPCEndpoint = {
                 Type: 'AWS::EC2::VPCEndpoint',
                 Properties: {
@@ -741,20 +772,22 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
-        // Secrets Manager Interface Endpoint
-        result.resources.FriggSecretsManagerVPCEndpoint = {
-            Type: 'AWS::EC2::VPCEndpoint',
-            Properties: {
-                VpcId: vpcId,
-                ServiceName: 'com.amazonaws.${self:provider.region}.secretsmanager',
-                VpcEndpointType: 'Interface',
-                SubnetIds: result.vpcConfig.subnetIds,
-                SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
-                PrivateDnsEnabled: true,
-            },
-        };
+        // Secrets Manager Interface Endpoint (only if missing)
+        if (!existingEndpoints.secretsManager) {
+            result.resources.FriggSecretsManagerVPCEndpoint = {
+                Type: 'AWS::EC2::VPCEndpoint',
+                Properties: {
+                    VpcId: vpcId,
+                    ServiceName: 'com.amazonaws.${self:provider.region}.secretsmanager',
+                    VpcEndpointType: 'Interface',
+                    SubnetIds: result.vpcConfig.subnetIds,
+                    SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
+                    PrivateDnsEnabled: true,
+                },
+            };
+        }
 
-        console.log('    ✅ VPC Endpoints created (S3, DynamoDB, KMS, Secrets Manager)');
+        console.log(`    ✅ Created ${missing.length} VPC endpoint(s): ${missing.join(', ')}`);
     }
 }
 

package/infrastructure/domains/networking/vpc-discovery.js

@@ -114,6 +114,12 @@ class VpcDiscovery {
                 const dynamodbEndpoint = rawResources.vpcEndpoints.find(
                     ep => ep.ServiceName && ep.ServiceName.includes('.dynamodb')
                 );
+                const kmsEndpoint = rawResources.vpcEndpoints.find(
+                    ep => ep.ServiceName && ep.ServiceName.includes('.kms')
+                );
+                const secretsManagerEndpoint = rawResources.vpcEndpoints.find(
+                    ep => ep.ServiceName && ep.ServiceName.includes('.secretsmanager')
+                );
 
                 if (s3Endpoint) {
                     result.s3VpcEndpointId = s3Endpoint.VpcEndpointId;
@@ -121,6 +127,12 @@ class VpcDiscovery {
                 if (dynamodbEndpoint) {
                     result.dynamodbVpcEndpointId = dynamodbEndpoint.VpcEndpointId;
                 }
+                if (kmsEndpoint) {
+                    result.kmsVpcEndpointId = kmsEndpoint.VpcEndpointId;
+                }
+                if (secretsManagerEndpoint) {
+                    result.secretsManagerVpcEndpointId = secretsManagerEndpoint.VpcEndpointId;
+                }
             }
 
             console.log(`  ✓ Found VPC: ${result.defaultVpcId}`);
@@ -133,8 +145,8 @@ class VpcDiscovery {
             if (result.existingNatGatewayId) {
                 console.log(`  ✓ Found NAT Gateway: ${result.existingNatGatewayId}`);
             }
-            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId) {
-                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}`);
+            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId || result.kmsVpcEndpointId || result.secretsManagerVpcEndpointId) {
+                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}, KMS=${result.kmsVpcEndpointId ? 'Yes' : 'No'}, SecretsManager=${result.secretsManagerVpcEndpointId ? 'Yes' : 'No'}`);
             }
 
             return result;

package/infrastructure/domains/networking/vpc-discovery.test.js

@@ -252,6 +252,99 @@ describe('VpcDiscovery', () => {
 
             expect(mockProvider.discoverVpc).toHaveBeenCalledWith(config);
         });
+
+        it('should discover all VPC endpoints (S3, DynamoDB, KMS, Secrets Manager)', async () => {
+            mockProvider.discoverVpc.mockResolvedValue({
+                vpcId: 'vpc-123',
+                vpcCidr: '10.0.0.0/16',
+                subnets: [],
+                securityGroups: [],
+                routeTables: [],
+                natGateways: [],
+                internetGateways: [],
+                vpcEndpoints: [
+                    {
+                        VpcEndpointId: 'vpce-s3-123',
+                        ServiceName: 'com.amazonaws.us-east-1.s3',
+                        State: 'available',
+                    },
+                    {
+                        VpcEndpointId: 'vpce-ddb-456',
+                        ServiceName: 'com.amazonaws.us-east-1.dynamodb',
+                        State: 'available',
+                    },
+                    {
+                        VpcEndpointId: 'vpce-kms-789',
+                        ServiceName: 'com.amazonaws.us-east-1.kms',
+                        State: 'available',
+                    },
+                    {
+                        VpcEndpointId: 'vpce-sm-abc',
+                        ServiceName: 'com.amazonaws.us-east-1.secretsmanager',
+                        State: 'available',
+                    },
+                ],
+            });
+
+            const result = await vpcDiscovery.discover({});
+
+            expect(result.s3VpcEndpointId).toBe('vpce-s3-123');
+            expect(result.dynamodbVpcEndpointId).toBe('vpce-ddb-456');
+            expect(result.kmsVpcEndpointId).toBe('vpce-kms-789');
+            expect(result.secretsManagerVpcEndpointId).toBe('vpce-sm-abc');
+        });
+
+        it('should handle partial VPC endpoint discovery', async () => {
+            mockProvider.discoverVpc.mockResolvedValue({
+                vpcId: 'vpc-123',
+                vpcCidr: '10.0.0.0/16',
+                subnets: [],
+                securityGroups: [],
+                routeTables: [],
+                natGateways: [],
+                internetGateways: [],
+                vpcEndpoints: [
+                    {
+                        VpcEndpointId: 'vpce-s3-123',
+                        ServiceName: 'com.amazonaws.us-east-1.s3',
+                        State: 'available',
+                    },
+                    {
+                        VpcEndpointId: 'vpce-ddb-456',
+                        ServiceName: 'com.amazonaws.us-east-1.dynamodb',
+                        State: 'available',
+                    },
+                    // KMS and Secrets Manager are missing
+                ],
+            });
+
+            const result = await vpcDiscovery.discover({});
+
+            expect(result.s3VpcEndpointId).toBe('vpce-s3-123');
+            expect(result.dynamodbVpcEndpointId).toBe('vpce-ddb-456');
+            expect(result.kmsVpcEndpointId).toBeUndefined();
+            expect(result.secretsManagerVpcEndpointId).toBeUndefined();
+        });
+
+        it('should handle no VPC endpoints', async () => {
+            mockProvider.discoverVpc.mockResolvedValue({
+                vpcId: 'vpc-123',
+                vpcCidr: '10.0.0.0/16',
+                subnets: [],
+                securityGroups: [],
+                routeTables: [],
+                natGateways: [],
+                internetGateways: [],
+                vpcEndpoints: [],
+            });
+
+            const result = await vpcDiscovery.discover({});
+
+            expect(result.s3VpcEndpointId).toBeUndefined();
+            expect(result.dynamodbVpcEndpointId).toBeUndefined();
+            expect(result.kmsVpcEndpointId).toBeUndefined();
+            expect(result.secretsManagerVpcEndpointId).toBeUndefined();
+        });
     });
 });
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.9790ea9.0",
+  "version": "2.0.0--canary.461.aa02ace.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.9790ea9.0",
-    "@friggframework/test": "2.0.0--canary.461.9790ea9.0",
+    "@friggframework/schemas": "2.0.0--canary.461.aa02ace.0",
+    "@friggframework/test": "2.0.0--canary.461.aa02ace.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.9790ea9.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.9790ea9.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.aa02ace.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.aa02ace.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "9790ea94c86ae2433a4cffae83139e2bf5925f93"
+  "gitHead": "aa02ace634ba3b5a59a207891f7012b5b08d9f5e"
 }