@friggframework/devtools 2.0.0--canary.461.e6fc7c7.0 → 2.0.0--canary.461.7c8f1c6.0

package/infrastructure/domains/security/kms-builder.js

@@ -137,20 +137,9 @@ class KmsBuilder extends InfrastructureBuilder {
                                     },
                                 },
                             },
-                            {
-                                Sid: 'AllowLambdaExecutionRole',
-                                Effect: 'Allow',
-                                Principal: {
-                                    AWS: { 'Fn::GetAtt': ['IamRoleLambdaExecution', 'Arn'] },
-                                },
-                                Action: [
-                                    'kms:Decrypt',
-                                    'kms:GenerateDataKey',
-                                    'kms:Encrypt',
-                                    'kms:DescribeKey',
-                                ],
-                                Resource: '*',
-                            },
+                            // NOTE: We do NOT add a statement referencing IamRoleLambdaExecution here
+                            // because it creates a circular dependency (KMS Key → IAM Role → KMS Key).
+                            // Instead, IAM policies grant the Lambda execution role permissions to use KMS.
                         ],
                     },
                     Tags: [

package/infrastructure/domains/security/kms-builder.test.js

@@ -329,15 +329,11 @@ describe('KmsBuilder', () => {
             const result = await kmsBuilder.build(appDefinition, {});
 
             const policy = result.resources.FriggKMSKey.Properties.KeyPolicy;
+            // Should NOT have AllowLambdaExecutionRole statement to avoid circular dependency
+            // (KMS Key → IAM Role → KMS Key = circular)
+            // IAM policies already grant KMS permissions, so key policy doesn't need to reference the role
             const roleStatement = policy.Statement.find(s => s.Sid === 'AllowLambdaExecutionRole');
-
-            expect(roleStatement).toBeDefined();
-            expect(roleStatement.Effect).toBe('Allow');
-            expect(roleStatement.Principal.AWS).toEqual({ 'Fn::GetAtt': ['IamRoleLambdaExecution', 'Arn'] });
-            expect(roleStatement.Action).toContain('kms:GenerateDataKey');
-            expect(roleStatement.Action).toContain('kms:Decrypt');
-            expect(roleStatement.Action).toContain('kms:Encrypt');
-            expect(roleStatement.Action).toContain('kms:DescribeKey');
+            expect(roleStatement).toBeUndefined();
         });
     });
 

package/infrastructure/domains/shared/resource-discovery.js

@@ -78,14 +78,24 @@ async function gatherDiscoveredResources(appDefinition) {
         const cfDiscovery = new CloudFormationDiscovery(provider);
         const stackResources = await cfDiscovery.discoverFromStack(stackName);
 
-        if (stackResources) {
+        // Validate CF discovery results - only use if contains useful data
+        const hasVpcData = stackResources?.defaultVpcId;
+        const hasKmsData = stackResources?.defaultKmsKeyId;
+        const hasAuroraData = stackResources?.auroraClusterId;
+        const hasSomeUsefulData = hasVpcData || hasKmsData || hasAuroraData;
+
+        if (stackResources && hasSomeUsefulData) {
             console.log('  ✓ Discovered resources from existing CloudFormation stack');
             console.log('✅ Cloud resource discovery completed successfully!');
             return stackResources;
         }
 
-        // Fallback to AWS API discovery (fresh deployment or stack not found)
-        console.log('  ℹ No stack found - running AWS API discovery...');
+        // Fallback to AWS API discovery (fresh deployment, stack not found, or stack has no useful data)
+        if (stackResources && !hasSomeUsefulData) {
+            console.log('  ℹ Stack found but contains no usable resources - running AWS API discovery...');
+        } else {
+            console.log('  ℹ No stack found - running AWS API discovery...');
+        }
 
         // Create domain discovery services with provider
         const vpcDiscovery = new VpcDiscovery(provider);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.e6fc7c7.0",
+  "version": "2.0.0--canary.461.7c8f1c6.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.e6fc7c7.0",
-    "@friggframework/test": "2.0.0--canary.461.e6fc7c7.0",
+    "@friggframework/schemas": "2.0.0--canary.461.7c8f1c6.0",
+    "@friggframework/test": "2.0.0--canary.461.7c8f1c6.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.e6fc7c7.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.e6fc7c7.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.7c8f1c6.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.7c8f1c6.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "e6fc7c76e03cc5a0698efc4705b005d02d941654"
+  "gitHead": "7c8f1c667adf2fe7cd8e70b1dc3120414fed24b9"
 }