@friggframework/devtools 2.0.0--canary.490.48bfca6.0 → 2.0.0--canary.490.2395f42.0

package/infrastructure/domains/security/kms-builder.js

@@ -253,6 +253,17 @@ class KmsBuilder extends InfrastructureBuilder {
         if (decisions.key.ownership === ResourceOwnership.STACK && decisions.key.physicalId) {
             // Key exists in stack - add definitions (CloudFormation idempotency)
             console.log('  → Adding KMS definitions to template (existing in stack)');
+            
+            // Check if alias exists in stack before trying to create it
+            const aliasExistsInStack = discoveredResources?.existingLogicalIds?.includes('FriggKMSKeyAlias');
+            if (!aliasExistsInStack && appDefinition.encryption?.kmsKeyAlias !== false) {
+                // Alias doesn't exist and user didn't explicitly disable it
+                // Set kmsKeyAlias: false to avoid trying to create it (permission issues)
+                console.log('  ℹ KMS alias not found in stack - skipping alias creation to avoid permission errors');
+                appDefinition.encryption = appDefinition.encryption || {};
+                appDefinition.encryption.kmsKeyAlias = false;
+            }
+            
             result.resources = this.createKmsKey(appDefinition);
             result.environment.KMS_KEY_ARN = { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] };
             console.log('  ✅ KMS key resources created');
@@ -307,7 +318,7 @@ class KmsBuilder extends InfrastructureBuilder {
      * Create KMS key CloudFormation resources
      */
     createKmsKey(appDefinition) {
-        return {
+        const resources = {
             FriggKMSKey: {
                 Type: 'AWS::KMS::Key',
                 DeletionPolicy: 'Retain',
@@ -361,15 +372,24 @@ class KmsBuilder extends InfrastructureBuilder {
                     ],
                 },
             },
-            FriggKMSKeyAlias: {
+        };
+
+        // Only create alias if explicitly enabled (default: true for backwards compatibility)
+        const createAlias = appDefinition.encryption?.kmsKeyAlias !== false;
+        if (createAlias) {
+            resources.FriggKMSKeyAlias = {
                 Type: 'AWS::KMS::Alias',
                 DeletionPolicy: 'Retain',
                 Properties: {
                     AliasName: 'alias/${self:service}-${self:provider.stage}-frigg-kms',
                     TargetKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] },
                 },
-            },
-        };
+            };
+        } else {
+            console.log('  ℹ Skipping KMS key alias creation (kmsKeyAlias: false)');
+        }
+
+        return resources;
     }
 }
 

package/infrastructure/domains/security/kms-builder.test.js

@@ -225,6 +225,23 @@ describe('KmsBuilder', () => {
             expect(result.resources.FriggKMSKeyAlias.Type).toBe('AWS::KMS::Alias');
         });
 
+        it('should skip alias creation when kmsKeyAlias: false', async () => {
+            const appDefinition = {
+                encryption: {
+                    fieldLevelEncryptionMethod: 'kms',
+                    createResourceIfNoneFound: true,
+                    kmsKeyAlias: false,
+                },
+            };
+
+            const discoveredResources = {};
+
+            const result = await kmsBuilder.build(appDefinition, discoveredResources);
+
+            expect(result.resources.FriggKMSKey).toBeDefined();
+            expect(result.resources.FriggKMSKeyAlias).toBeUndefined();
+        });
+
         it('should enable key rotation for new keys', async () => {
             const appDefinition = {
                 encryption: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.48bfca6.0",
+  "version": "2.0.0--canary.490.2395f42.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.48bfca6.0",
-    "@friggframework/schemas": "2.0.0--canary.490.48bfca6.0",
-    "@friggframework/test": "2.0.0--canary.490.48bfca6.0",
+    "@friggframework/core": "2.0.0--canary.490.2395f42.0",
+    "@friggframework/schemas": "2.0.0--canary.490.2395f42.0",
+    "@friggframework/test": "2.0.0--canary.490.2395f42.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.48bfca6.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.48bfca6.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.2395f42.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.2395f42.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "48bfca6d78f99b7b5aec094ed40e969efdda02a4"
+  "gitHead": "2395f421f8b98b461ac607a31ed9d209b57968ae"
 }