@friggframework/devtools 2.0.0--canary.461.e4a989e.0 → 2.0.0--canary.461.d94b7a7.0

package/infrastructure/domains/database/aurora-builder.js

@@ -235,6 +235,20 @@ class AuroraBuilder extends InfrastructureBuilder {
             Resource: { Ref: 'FriggDBSecret' },
         });
 
+        // Add self-referencing security group ingress rule to allow Lambda to connect to Aurora
+        // Since both Lambda and Aurora share the same security group, we need to allow the SG to accept traffic from itself
+        result.resources.FriggAuroraIngressRule = {
+            Type: 'AWS::EC2::SecurityGroupIngress',
+            Properties: {
+                GroupId: { Ref: 'FriggLambdaSecurityGroup' },
+                IpProtocol: 'tcp',
+                FromPort: 5432,
+                ToPort: 5432,
+                SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' },
+                Description: 'Allow Lambda functions to connect to Aurora PostgreSQL (self-referencing rule)',
+            },
+        };
+
         console.log('  ✅ Aurora Serverless v2 cluster resources created');
     }
 

package/infrastructure/domains/database/aurora-builder.test.js

@@ -625,12 +625,18 @@ describe('AuroraBuilder', () => {
 
             expect(result.resources.FriggAuroraCluster).toBeDefined();
             expect(result.resources.FriggAuroraCluster.Type).toBe('AWS::RDS::DBCluster');
-            
+
             // PubliclyAccessible is NOT supported on Aurora clusters (only on instances)
             expect(result.resources.FriggAuroraCluster.Properties.PubliclyAccessible).toBeUndefined();
-            
+
             // Port should be explicitly set to PostgreSQL standard (5432)
             expect(result.resources.FriggAuroraCluster.Properties.Port).toBe(5432);
+
+            // Should create self-referencing security group ingress rule
+            expect(result.resources.FriggAuroraIngressRule).toBeDefined();
+            expect(result.resources.FriggAuroraIngressRule.Type).toBe('AWS::EC2::SecurityGroupIngress');
+            expect(result.resources.FriggAuroraIngressRule.Properties.FromPort).toBe(5432);
+            expect(result.resources.FriggAuroraIngressRule.Properties.ToPort).toBe(5432);
         });
 
         it('should create database subnet group', async () => {

package/infrastructure/domains/networking/vpc-builder.js

@@ -141,18 +141,32 @@ class VpcBuilder extends InfrastructureBuilder {
         // Build VPC Endpoints if enabled
         const vpcManagement = appDefinition.vpc.management || 'discover';
         const selfHeal = appDefinition.vpc.selfHeal !== false;
-        const vpcEndpointsExist = discoveredResources.s3VpcEndpointId && discoveredResources.dynamodbVpcEndpointId;
+        // Check which VPC endpoints already exist
+        const existingEndpoints = {
+            s3: discoveredResources.s3VpcEndpointId,
+            dynamodb: discoveredResources.dynamodbVpcEndpointId,
+            kms: discoveredResources.kmsVpcEndpointId,
+            secretsManager: discoveredResources.secretsManagerVpcEndpointId,
+        };
+        const allEndpointsExist = existingEndpoints.s3 && existingEndpoints.dynamodb && 
+                                   existingEndpoints.kms && existingEndpoints.secretsManager;
+        const someEndpointsExist = existingEndpoints.s3 || existingEndpoints.dynamodb || 
+                                    existingEndpoints.kms || existingEndpoints.secretsManager;
 
         if (appDefinition.vpc.enableVPCEndpoints !== false) {
             if (vpcManagement === 'create-new') {
                 // Always create in create-new mode
-                this.buildVpcEndpoints(appDefinition, discoveredResources, result);
+                this.buildVpcEndpoints(appDefinition, discoveredResources, result, existingEndpoints);
             } else if (vpcManagement === 'discover') {
-                if (vpcEndpointsExist) {
-                    console.log('  VPC endpoints already exist - skipping creation');
+                if (allEndpointsExist) {
+                    console.log('  All VPC endpoints already exist - skipping creation');
                 } else if (selfHeal) {
-                    console.log('  No VPC endpoints found - selfHeal creating them');
-                    this.buildVpcEndpoints(appDefinition, discoveredResources, result);
+                    if (someEndpointsExist) {
+                        console.log('  Some VPC endpoints found - selfHeal creating missing ones');
+                    } else {
+                        console.log('  No VPC endpoints found - selfHeal creating them');
+                    }
+                    this.buildVpcEndpoints(appDefinition, discoveredResources, result, existingEndpoints);
                 } else {
                     console.log('  VPC endpoints not found and selfHeal disabled - skipping');
                 }
@@ -662,8 +676,19 @@ class VpcBuilder extends InfrastructureBuilder {
     /**
      * Build VPC Endpoints for AWS services
      */
-    buildVpcEndpoints(appDefinition, discoveredResources, result) {
-        console.log('  Creating VPC Endpoints...');
+    buildVpcEndpoints(appDefinition, discoveredResources, result, existingEndpoints = {}) {
+        const missing = [];
+        if (!existingEndpoints.s3) missing.push('S3');
+        if (!existingEndpoints.dynamodb) missing.push('DynamoDB');
+        if (!existingEndpoints.kms && appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') missing.push('KMS');
+        if (!existingEndpoints.secretsManager) missing.push('Secrets Manager');
+        
+        if (missing.length > 0) {
+            console.log(`  Creating missing VPC Endpoints: ${missing.join(', ')}...`);
+        } else {
+            console.log('  All required VPC Endpoints already exist - skipping creation');
+            return;
+        }
 
         const vpcId = result.vpcId || discoveredResources.defaultVpcId;
 
@@ -682,8 +707,9 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
-        // S3 Gateway Endpoint
-        result.resources.FriggS3VPCEndpoint = {
+        // S3 Gateway Endpoint (only if missing)
+        if (!existingEndpoints.s3) {
+            result.resources.FriggS3VPCEndpoint = {
             Type: 'AWS::EC2::VPCEndpoint',
             Properties: {
                 VpcId: vpcId,
@@ -692,9 +718,11 @@ class VpcBuilder extends InfrastructureBuilder {
                 RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }],
             },
         };
+        }
 
-        // DynamoDB Gateway Endpoint
-        result.resources.FriggDynamoDBVPCEndpoint = {
+        // DynamoDB Gateway Endpoint (only if missing)
+        if (!existingEndpoints.dynamodb) {
+            result.resources.FriggDynamoDBVPCEndpoint = {
             Type: 'AWS::EC2::VPCEndpoint',
             Properties: {
                 VpcId: vpcId,
@@ -703,9 +731,11 @@ class VpcBuilder extends InfrastructureBuilder {
                 RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }],
             },
         };
+        }
 
-        // VPC Endpoint Security Group
-        result.resources.FriggVPCEndpointSecurityGroup = {
+        // VPC Endpoint Security Group (only if KMS or Secrets Manager are missing)
+        if (!existingEndpoints.kms || !existingEndpoints.secretsManager) {
+            result.resources.FriggVPCEndpointSecurityGroup = {
             Type: 'AWS::EC2::SecurityGroup',
             Properties: {
                 GroupDescription: 'Security group for VPC Endpoints',
@@ -725,9 +755,10 @@ class VpcBuilder extends InfrastructureBuilder {
                 ],
             },
         };
+        }
 
-        // KMS Interface Endpoint (if KMS encryption enabled)
-        if (appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
+        // KMS Interface Endpoint (only if missing AND KMS encryption is enabled)
+        if (!existingEndpoints.kms && appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
             result.resources.FriggKMSVPCEndpoint = {
                 Type: 'AWS::EC2::VPCEndpoint',
                 Properties: {
@@ -741,8 +772,9 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
-        // Secrets Manager Interface Endpoint
-        result.resources.FriggSecretsManagerVPCEndpoint = {
+        // Secrets Manager Interface Endpoint (only if missing)
+        if (!existingEndpoints.secretsManager) {
+            result.resources.FriggSecretsManagerVPCEndpoint = {
             Type: 'AWS::EC2::VPCEndpoint',
             Properties: {
                 VpcId: vpcId,
@@ -753,8 +785,9 @@ class VpcBuilder extends InfrastructureBuilder {
                 PrivateDnsEnabled: true,
             },
         };
+        }
 
-        console.log('    ✅ VPC Endpoints created (S3, DynamoDB, KMS, Secrets Manager)');
+        console.log(`    ✅ Created ${missing.length} VPC endpoint(s): ${missing.join(', ')}`);
     }
 }
 

package/infrastructure/domains/networking/vpc-discovery.js

@@ -114,6 +114,12 @@ class VpcDiscovery {
                 const dynamodbEndpoint = rawResources.vpcEndpoints.find(
                     ep => ep.ServiceName && ep.ServiceName.includes('.dynamodb')
                 );
+                const kmsEndpoint = rawResources.vpcEndpoints.find(
+                    ep => ep.ServiceName && ep.ServiceName.includes('.kms')
+                );
+                const secretsManagerEndpoint = rawResources.vpcEndpoints.find(
+                    ep => ep.ServiceName && ep.ServiceName.includes('.secretsmanager')
+                );
 
                 if (s3Endpoint) {
                     result.s3VpcEndpointId = s3Endpoint.VpcEndpointId;
@@ -121,6 +127,12 @@ class VpcDiscovery {
                 if (dynamodbEndpoint) {
                     result.dynamodbVpcEndpointId = dynamodbEndpoint.VpcEndpointId;
                 }
+                if (kmsEndpoint) {
+                    result.kmsVpcEndpointId = kmsEndpoint.VpcEndpointId;
+                }
+                if (secretsManagerEndpoint) {
+                    result.secretsManagerVpcEndpointId = secretsManagerEndpoint.VpcEndpointId;
+                }
             }
 
             console.log(`  ✓ Found VPC: ${result.defaultVpcId}`);
@@ -133,8 +145,8 @@ class VpcDiscovery {
             if (result.existingNatGatewayId) {
                 console.log(`  ✓ Found NAT Gateway: ${result.existingNatGatewayId}`);
             }
-            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId) {
-                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}`);
+            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId || result.kmsVpcEndpointId || result.secretsManagerVpcEndpointId) {
+                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}, KMS=${result.kmsVpcEndpointId ? 'Yes' : 'No'}, SecretsManager=${result.secretsManagerVpcEndpointId ? 'Yes' : 'No'}`);
             }
 
             return result;

package/infrastructure/domains/networking/vpc-discovery.test.js

@@ -252,6 +252,99 @@ describe('VpcDiscovery', () => {
 
             expect(mockProvider.discoverVpc).toHaveBeenCalledWith(config);
         });
+
+        it('should discover all VPC endpoints (S3, DynamoDB, KMS, Secrets Manager)', async () => {
+            mockProvider.discoverVpc.mockResolvedValue({
+                vpcId: 'vpc-123',
+                vpcCidr: '10.0.0.0/16',
+                subnets: [],
+                securityGroups: [],
+                routeTables: [],
+                natGateways: [],
+                internetGateways: [],
+                vpcEndpoints: [
+                    {
+                        VpcEndpointId: 'vpce-s3-123',
+                        ServiceName: 'com.amazonaws.us-east-1.s3',
+                        State: 'available',
+                    },
+                    {
+                        VpcEndpointId: 'vpce-ddb-456',
+                        ServiceName: 'com.amazonaws.us-east-1.dynamodb',
+                        State: 'available',
+                    },
+                    {
+                        VpcEndpointId: 'vpce-kms-789',
+                        ServiceName: 'com.amazonaws.us-east-1.kms',
+                        State: 'available',
+                    },
+                    {
+                        VpcEndpointId: 'vpce-sm-abc',
+                        ServiceName: 'com.amazonaws.us-east-1.secretsmanager',
+                        State: 'available',
+                    },
+                ],
+            });
+
+            const result = await vpcDiscovery.discover({});
+
+            expect(result.s3VpcEndpointId).toBe('vpce-s3-123');
+            expect(result.dynamodbVpcEndpointId).toBe('vpce-ddb-456');
+            expect(result.kmsVpcEndpointId).toBe('vpce-kms-789');
+            expect(result.secretsManagerVpcEndpointId).toBe('vpce-sm-abc');
+        });
+
+        it('should handle partial VPC endpoint discovery', async () => {
+            mockProvider.discoverVpc.mockResolvedValue({
+                vpcId: 'vpc-123',
+                vpcCidr: '10.0.0.0/16',
+                subnets: [],
+                securityGroups: [],
+                routeTables: [],
+                natGateways: [],
+                internetGateways: [],
+                vpcEndpoints: [
+                    {
+                        VpcEndpointId: 'vpce-s3-123',
+                        ServiceName: 'com.amazonaws.us-east-1.s3',
+                        State: 'available',
+                    },
+                    {
+                        VpcEndpointId: 'vpce-ddb-456',
+                        ServiceName: 'com.amazonaws.us-east-1.dynamodb',
+                        State: 'available',
+                    },
+                    // KMS and Secrets Manager are missing
+                ],
+            });
+
+            const result = await vpcDiscovery.discover({});
+
+            expect(result.s3VpcEndpointId).toBe('vpce-s3-123');
+            expect(result.dynamodbVpcEndpointId).toBe('vpce-ddb-456');
+            expect(result.kmsVpcEndpointId).toBeUndefined();
+            expect(result.secretsManagerVpcEndpointId).toBeUndefined();
+        });
+
+        it('should handle no VPC endpoints', async () => {
+            mockProvider.discoverVpc.mockResolvedValue({
+                vpcId: 'vpc-123',
+                vpcCidr: '10.0.0.0/16',
+                subnets: [],
+                securityGroups: [],
+                routeTables: [],
+                natGateways: [],
+                internetGateways: [],
+                vpcEndpoints: [],
+            });
+
+            const result = await vpcDiscovery.discover({});
+
+            expect(result.s3VpcEndpointId).toBeUndefined();
+            expect(result.dynamodbVpcEndpointId).toBeUndefined();
+            expect(result.kmsVpcEndpointId).toBeUndefined();
+            expect(result.secretsManagerVpcEndpointId).toBeUndefined();
+        });
     });
 });
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.e4a989e.0",
+  "version": "2.0.0--canary.461.d94b7a7.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.e4a989e.0",
-    "@friggframework/test": "2.0.0--canary.461.e4a989e.0",
+    "@friggframework/schemas": "2.0.0--canary.461.d94b7a7.0",
+    "@friggframework/test": "2.0.0--canary.461.d94b7a7.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.e4a989e.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.e4a989e.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.d94b7a7.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.d94b7a7.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "e4a989e8eaa78cd8020962c0fc7f52b06d2565cb"
+  "gitHead": "d94b7a7ce1086865523407232f49071136c8eb9b"
 }