@friggframework/devtools 2.0.0--canary.490.10eff0a.0 → 2.0.0--canary.490.de9ed00.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -932,6 +932,8 @@ class VpcBuilder extends InfrastructureBuilder {
 
         if (endpointsInStack.length > 0) {
             console.log(`  ✓ VPC Endpoints in stack: ${endpointsInStack.join(', ')}`);
+            // CRITICAL: Must add stack-managed endpoints back to template or CloudFormation will DELETE them!
+            this._addStackManagedEndpointsToTemplate(decisions, result);
         }
 
         if (externalEndpoints.length > 0) {
@@ -1112,6 +1114,101 @@ class VpcBuilder extends InfrastructureBuilder {
         return healingReport;
     }
 
+    /**
+     * Add stack-managed VPC endpoints back to template
+     * 
+     * CRITICAL: CloudFormation will DELETE resources that exist in the previous template
+     * but are missing from the new template. We must re-add discovered stack-managed
+     * endpoints to prevent CloudFormation from deleting them.
+     * 
+     * @private
+     */
+    _addStackManagedEndpointsToTemplate(decisions, result) {
+        const vpcId = result.vpcId;
+        const logicalIdMap = {
+            s3: 'FriggS3VPCEndpoint',
+            dynamodb: 'FriggDynamoDBVPCEndpoint',
+            kms: 'FriggKMSVPCEndpoint',
+            secretsManager: 'FriggSecretsManagerVPCEndpoint',
+            sqs: 'FriggSQSVPCEndpoint'
+        };
+
+        Object.entries(decisions).forEach(([type, decision]) => {
+            if (decision.ownership === ResourceOwnership.STACK && decision.physicalId) {
+                const logicalId = logicalIdMap[type];
+                
+                // Determine endpoint type and properties based on service
+                if (type === 's3') {
+                    result.resources[logicalId] = {
+                        Type: 'AWS::EC2::VPCEndpoint',
+                        Properties: {
+                            VpcId: vpcId,
+                            ServiceName: 'com.amazonaws.${self:provider.region}.s3',
+                            VpcEndpointType: 'Gateway',
+                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
+                        }
+                    };
+                } else if (type === 'dynamodb') {
+                    result.resources[logicalId] = {
+                        Type: 'AWS::EC2::VPCEndpoint',
+                        Properties: {
+                            VpcId: vpcId,
+                            ServiceName: 'com.amazonaws.${self:provider.region}.dynamodb',
+                            VpcEndpointType: 'Gateway',
+                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
+                        }
+                    };
+                } else {
+                    // Interface endpoints (KMS, Secrets Manager, SQS)
+                    const serviceMap = {
+                        kms: 'kms',
+                        secretsManager: 'secretsmanager',
+                        sqs: 'sqs'
+                    };
+                    
+                    result.resources[logicalId] = {
+                        Type: 'AWS::EC2::VPCEndpoint',
+                        Properties: {
+                            VpcId: vpcId,
+                            ServiceName: `com.amazonaws.\${self:provider.region}.${serviceMap[type]}`,
+                            VpcEndpointType: 'Interface',
+                            SubnetIds: result.vpcConfig.subnetIds,
+                            SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
+                            PrivateDnsEnabled: true
+                        }
+                    };
+                }
+            }
+        });
+
+        // If any interface endpoints exist, ensure security group is in template
+        const hasInterfaceEndpoints = ['kms', 'secretsManager', 'sqs'].some(
+            type => decisions[type]?.ownership === ResourceOwnership.STACK && decisions[type]?.physicalId
+        );
+
+        if (hasInterfaceEndpoints && !result.resources.FriggVPCEndpointSecurityGroup) {
+            result.resources.FriggVPCEndpointSecurityGroup = {
+                Type: 'AWS::EC2::SecurityGroup',
+                Properties: {
+                    GroupDescription: 'Security group for VPC Endpoints',
+                    VpcId: vpcId,
+                    SecurityGroupIngress: [
+                        {
+                            IpProtocol: 'tcp',
+                            FromPort: 443,
+                            ToPort: 443,
+                            SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' }
+                        }
+                    ],
+                    Tags: [
+                        { Key: 'Name', Value: '${self:service}-${self:provider.stage}-vpc-endpoint-sg' },
+                        { Key: 'ManagedBy', Value: 'Frigg' }
+                    ]
+                }
+            };
+        }
+    }
+
     /**
      * Build new VPC from scratch
      */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.10eff0a.0",
+  "version": "2.0.0--canary.490.de9ed00.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.10eff0a.0",
-    "@friggframework/schemas": "2.0.0--canary.490.10eff0a.0",
-    "@friggframework/test": "2.0.0--canary.490.10eff0a.0",
+    "@friggframework/core": "2.0.0--canary.490.de9ed00.0",
+    "@friggframework/schemas": "2.0.0--canary.490.de9ed00.0",
+    "@friggframework/test": "2.0.0--canary.490.de9ed00.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.10eff0a.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.10eff0a.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.de9ed00.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.de9ed00.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "10eff0ae7ff87794900048cb0cc357714232e4cf"
+  "gitHead": "de9ed004fd58650d6be0a619a3fcd02cc35b7c6d"
 }