@friggframework/devtools 2.0.0--canary.490.48bfca6.0 → 2.0.0--canary.490.84409c6.0

package/infrastructure/domains/security/kms-builder.js

@@ -253,6 +253,24 @@ class KmsBuilder extends InfrastructureBuilder {
         if (decisions.key.ownership === ResourceOwnership.STACK && decisions.key.physicalId) {
             // Key exists in stack - add definitions (CloudFormation idempotency)
             console.log('  → Adding KMS definitions to template (existing in stack)');
+            
+            // CRITICAL: Check if alias exists in stack before trying to create it
+            // Matches old serverless-template.js behavior: only create alias if it doesn't exist
+            const aliasExistsInStack = discoveredResources?.existingLogicalIds?.includes('FriggKMSKeyAlias');
+            if (!aliasExistsInStack) {
+                if (appDefinition.encryption?.kmsKeyAlias !== true) {
+                    // Alias doesn't exist in stack - skip creation unless explicitly enabled
+                    // This avoids kms:CreateAlias permission errors
+                    console.log('  ℹ KMS alias not in stack - skipping creation (set kmsKeyAlias: true to force)');
+                    appDefinition.encryption = appDefinition.encryption || {};
+                    appDefinition.encryption.kmsKeyAlias = false;
+                } else {
+                    console.log('  → Will create KMS alias (kmsKeyAlias: true explicitly set)');
+                }
+            } else {
+                console.log('  ✓ KMS alias found in stack - will keep in template');
+            }
+            
             result.resources = this.createKmsKey(appDefinition);
             result.environment.KMS_KEY_ARN = { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] };
             console.log('  ✅ KMS key resources created');
@@ -270,6 +288,17 @@ class KmsBuilder extends InfrastructureBuilder {
         } else if (decisions.key.ownership === ResourceOwnership.STACK && !decisions.key.physicalId && !useEnvVarFallback) {
             // Create new KMS key (only if not using env var fallback and no external key found)
             console.log('  → Creating new KMS key in stack');
+            
+            // CRITICAL: Don't create alias by default to avoid kms:CreateAlias permission errors
+            // Matches old serverless-template.js behavior: only create alias if explicitly requested
+            if (appDefinition.encryption?.kmsKeyAlias !== true) {
+                console.log('  ℹ Skipping KMS alias creation by default (set kmsKeyAlias: true to enable)');
+                appDefinition.encryption = appDefinition.encryption || {};
+                appDefinition.encryption.kmsKeyAlias = false;
+            } else {
+                console.log('  → Will create KMS alias (kmsKeyAlias: true explicitly set)');
+            }
+            
             result.resources = this.createKmsKey(appDefinition);
             result.environment.KMS_KEY_ARN = { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] };
             console.log('  ✅ KMS key resources created');
@@ -307,7 +336,7 @@ class KmsBuilder extends InfrastructureBuilder {
      * Create KMS key CloudFormation resources
      */
     createKmsKey(appDefinition) {
-        return {
+        const resources = {
             FriggKMSKey: {
                 Type: 'AWS::KMS::Key',
                 DeletionPolicy: 'Retain',
@@ -361,15 +390,24 @@ class KmsBuilder extends InfrastructureBuilder {
                     ],
                 },
             },
-            FriggKMSKeyAlias: {
+        };
+
+        // Only create alias if explicitly enabled (default: true for backwards compatibility)
+        const createAlias = appDefinition.encryption?.kmsKeyAlias !== false;
+        if (createAlias) {
+            resources.FriggKMSKeyAlias = {
                 Type: 'AWS::KMS::Alias',
                 DeletionPolicy: 'Retain',
                 Properties: {
                     AliasName: 'alias/${self:service}-${self:provider.stage}-frigg-kms',
                     TargetKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] },
                 },
-            },
-        };
+            };
+        } else {
+            console.log('  ℹ Skipping KMS key alias creation (kmsKeyAlias: false)');
+        }
+
+        return resources;
     }
 }
 

package/infrastructure/domains/security/kms-builder.test.js

@@ -209,11 +209,12 @@ describe('KmsBuilder', () => {
             expect(result.resources.FriggKMSKey.Type).toBe('AWS::KMS::Key');
         });
 
-        it('should create KMS key alias', async () => {
+        it('should create KMS key alias when explicitly enabled', async () => {
             const appDefinition = {
                 encryption: {
                     fieldLevelEncryptionMethod: 'kms',
                     createResourceIfNoneFound: true,
+                    kmsKeyAlias: true,  // Explicitly enable alias creation
                 },
             };
 
@@ -225,6 +226,23 @@ describe('KmsBuilder', () => {
             expect(result.resources.FriggKMSKeyAlias.Type).toBe('AWS::KMS::Alias');
         });
 
+        it('should skip alias creation when kmsKeyAlias: false', async () => {
+            const appDefinition = {
+                encryption: {
+                    fieldLevelEncryptionMethod: 'kms',
+                    createResourceIfNoneFound: true,
+                    kmsKeyAlias: false,
+                },
+            };
+
+            const discoveredResources = {};
+
+            const result = await kmsBuilder.build(appDefinition, discoveredResources);
+
+            expect(result.resources.FriggKMSKey).toBeDefined();
+            expect(result.resources.FriggKMSKeyAlias).toBeUndefined();
+        });
+
         it('should enable key rotation for new keys', async () => {
             const appDefinition = {
                 encryption: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.48bfca6.0",
+  "version": "2.0.0--canary.490.84409c6.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.48bfca6.0",
-    "@friggframework/schemas": "2.0.0--canary.490.48bfca6.0",
-    "@friggframework/test": "2.0.0--canary.490.48bfca6.0",
+    "@friggframework/core": "2.0.0--canary.490.84409c6.0",
+    "@friggframework/schemas": "2.0.0--canary.490.84409c6.0",
+    "@friggframework/test": "2.0.0--canary.490.84409c6.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.48bfca6.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.48bfca6.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.84409c6.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.84409c6.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "48bfca6d78f99b7b5aec094ed40e969efdda02a4"
+  "gitHead": "84409c6304ea14a6b9789ed8fc9ca07fe2385b17"
 }