@friggframework/devtools 2.0.0--canary.461.b8c7c6b.0 → 2.0.0--canary.461.0afe1c4.0

package/infrastructure/domains/security/kms-builder.js

@@ -7,7 +7,7 @@
  * - KMS key creation or discovery
  * - KMS key configuration for field-level encryption
  * - IAM permissions for KMS operations
- * - KMS grants via serverless-kms-grants plugin
+ * - KMS key policy configuration for Lambda execution role
  */
 
 const { InfrastructureBuilder, ValidationResult } = require('../shared/base-builder');
@@ -73,28 +73,21 @@ class KmsBuilder extends InfrastructureBuilder {
             console.log('  Creating new KMS key...');
             result.resources = this.createKmsKey(appDefinition);
             result.environment.KMS_KEY_ARN = { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] };
-            result.pluginConfig.kmsGrants = {
-                kmsKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] },
-            };
             console.log('  ✅ KMS key resources created');
         } else {
             // Use discovered KMS key
             const kmsKeyId = discoveredResources.defaultKmsKeyId || '${env:AWS_DISCOVERY_KMS_KEY_ID}';
             console.log(`  Using ${discoveredResources.defaultKmsKeyId ? 'discovered' : 'environment variable'} KMS key`);
             result.environment.KMS_KEY_ARN = kmsKeyId;
-            result.pluginConfig.kmsGrants = { kmsKeyId };
         }
 
-        // Add IAM permissions
+        // Add IAM permissions for Lambda role
         result.iamStatements.push({
             Effect: 'Allow',
-            Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
+            Action: ['kms:GenerateDataKey', 'kms:Decrypt', 'kms:Encrypt', 'kms:DescribeKey'],
             Resource: result.environment.KMS_KEY_ARN,
         });
 
-        // Enable KMS grants plugin
-        result.plugins.push('serverless-kms-grants');
-
         console.log(`[${this.name}] ✅ KMS configuration completed`);
         return result;
     }
@@ -110,12 +103,13 @@ class KmsBuilder extends InfrastructureBuilder {
                 UpdateReplacePolicy: 'Retain',
                 Properties: {
                     Description: 'Frigg Field-Level Encryption Key for ${self:service}-${self:provider.stage}',
+                    EnableKeyRotation: true,
                     KeyPolicy: {
                         Version: '2012-10-17',
                         Id: 'key-policy-1',
                         Statement: [
                             {
-                                Sid: 'Enable IAM User Permissions',
+                                Sid: 'AllowRootAccountAdmin',
                                 Effect: 'Allow',
                                 Principal: {
                                     AWS: {
@@ -126,7 +120,7 @@ class KmsBuilder extends InfrastructureBuilder {
                                 Resource: '*',
                             },
                             {
-                                Sid: 'Allow Lambda to use the key',
+                                Sid: 'AllowLambdaService',
                                 Effect: 'Allow',
                                 Principal: {
                                     Service: 'lambda.amazonaws.com',
@@ -143,6 +137,20 @@ class KmsBuilder extends InfrastructureBuilder {
                                     },
                                 },
                             },
+                            {
+                                Sid: 'AllowLambdaExecutionRole',
+                                Effect: 'Allow',
+                                Principal: {
+                                    AWS: { 'Fn::GetAtt': ['IamRoleLambdaExecution', 'Arn'] },
+                                },
+                                Action: [
+                                    'kms:Decrypt',
+                                    'kms:GenerateDataKey',
+                                    'kms:Encrypt',
+                                    'kms:DescribeKey',
+                                ],
+                                Resource: '*',
+                            },
                         ],
                     },
                     Tags: [

package/infrastructure/domains/security/kms-builder.test.js

@@ -148,7 +148,7 @@ describe('KmsBuilder', () => {
             const result = await kmsBuilder.build(appDefinition, discoveredResources);
 
             expect(result.environment.KMS_KEY_ARN).toBe('arn:aws:kms:us-east-1:123456:key/abc-123');
-            expect(result.pluginConfig.kmsGrants.kmsKeyId).toBe('arn:aws:kms:us-east-1:123456:key/abc-123');
+            expect(result.pluginConfig.kmsGrants).toBeUndefined();
         });
 
         it('should add IAM permissions for KMS operations', async () => {
@@ -167,12 +167,12 @@ describe('KmsBuilder', () => {
             expect(result.iamStatements).toHaveLength(1);
             expect(result.iamStatements[0]).toEqual({
                 Effect: 'Allow',
-                Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
+                Action: ['kms:GenerateDataKey', 'kms:Decrypt', 'kms:Encrypt', 'kms:DescribeKey'],
                 Resource: 'arn:aws:kms:us-east-1:123456:key/abc',
             });
         });
 
-        it('should enable serverless-kms-grants plugin', async () => {
+        it('should NOT use serverless-kms-grants plugin (deprecated)', async () => {
             const appDefinition = {
                 encryption: {
                     fieldLevelEncryptionMethod: 'kms',
@@ -185,7 +185,8 @@ describe('KmsBuilder', () => {
 
             const result = await kmsBuilder.build(appDefinition, discoveredResources);
 
-            expect(result.plugins).toContain('serverless-kms-grants');
+            expect(result.plugins).not.toContain('serverless-kms-grants');
+            expect(result.pluginConfig.kmsGrants).toBeUndefined();
         });
     });
 
@@ -316,6 +317,28 @@ describe('KmsBuilder', () => {
             expect(lambdaStatement.Action).toContain('kms:GenerateDataKey');
             expect(lambdaStatement.Action).toContain('kms:Decrypt');
         });
+
+        it('should create key policy allowing Lambda execution role direct access', async () => {
+            const appDefinition = {
+                encryption: {
+                    fieldLevelEncryptionMethod: 'kms',
+                    createResourceIfNoneFound: true,
+                },
+            };
+
+            const result = await kmsBuilder.build(appDefinition, {});
+
+            const policy = result.resources.FriggKMSKey.Properties.KeyPolicy;
+            const roleStatement = policy.Statement.find(s => s.Sid === 'AllowLambdaExecutionRole');
+
+            expect(roleStatement).toBeDefined();
+            expect(roleStatement.Effect).toBe('Allow');
+            expect(roleStatement.Principal.AWS).toEqual({ 'Fn::GetAtt': ['IamRoleLambdaExecution', 'Arn'] });
+            expect(roleStatement.Action).toContain('kms:GenerateDataKey');
+            expect(roleStatement.Action).toContain('kms:Decrypt');
+            expect(roleStatement.Action).toContain('kms:Encrypt');
+            expect(roleStatement.Action).toContain('kms:DescribeKey');
+        });
     });
 
     describe('Error handling', () => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.b8c7c6b.0",
+  "version": "2.0.0--canary.461.0afe1c4.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.b8c7c6b.0",
-    "@friggframework/test": "2.0.0--canary.461.b8c7c6b.0",
+    "@friggframework/schemas": "2.0.0--canary.461.0afe1c4.0",
+    "@friggframework/test": "2.0.0--canary.461.0afe1c4.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.b8c7c6b.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.b8c7c6b.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.0afe1c4.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.0afe1c4.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "b8c7c6bedb12c3dd0c055eedae89456050458d48"
+  "gitHead": "0afe1c4c284cd5ee939bdcb7ef011f36098f76fc"
 }