@friggframework/devtools 2.0.0--canary.490.feacde9.0 → 2.0.0--canary.497.a3f25f9.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -149,7 +149,7 @@ class VpcBuilder extends InfrastructureBuilder {
                     physicalId = flatDiscovery.defaultVpcId;
                 } else if (logicalId === 'FriggLambdaSecurityGroup') {
                     resourceType = 'AWS::EC2::SecurityGroup';
-                    physicalId = flatDiscovery.lambdaSecurityGroupId || flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
+                    physicalId = flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
                 } else if (logicalId === 'FriggPrivateSubnet1') {
                     resourceType = 'AWS::EC2::Subnet';
                     physicalId = flatDiscovery.privateSubnetId1;
@@ -159,27 +159,21 @@ class VpcBuilder extends InfrastructureBuilder {
                 } else if (logicalId === 'FriggNATGateway') {
                     resourceType = 'AWS::EC2::NatGateway';
                     physicalId = flatDiscovery.existingNatGatewayId;
-                } else if (logicalId === 'FriggLambdaRouteTable') {
-                    resourceType = 'AWS::EC2::RouteTable';
-                    physicalId = flatDiscovery.routeTableId;
-                } else if (logicalId === 'FriggS3VPCEndpoint' || logicalId === 'VPCEndpointS3') {
+                } else if (logicalId === 'FriggS3VPCEndpoint') {
                     resourceType = 'AWS::EC2::VPCEndpoint';
                     physicalId = flatDiscovery.s3VpcEndpointId;
-                } else if (logicalId === 'FriggDynamoDBVPCEndpoint' || logicalId === 'VPCEndpointDynamoDB') {
+                } else if (logicalId === 'FriggDynamoDBVPCEndpoint') {
                     resourceType = 'AWS::EC2::VPCEndpoint';
                     physicalId = flatDiscovery.dynamodbVpcEndpointId;
-                } else if (logicalId === 'FriggKMSVPCEndpoint' || logicalId === 'VPCEndpointKMS') {
+                } else if (logicalId === 'FriggKMSVPCEndpoint') {
                     resourceType = 'AWS::EC2::VPCEndpoint';
                     physicalId = flatDiscovery.kmsVpcEndpointId;
-                } else if (logicalId === 'FriggSecretsManagerVPCEndpoint' || logicalId === 'VPCEndpointSecretsManager') {
+                } else if (logicalId === 'FriggSecretsManagerVPCEndpoint') {
                     resourceType = 'AWS::EC2::VPCEndpoint';
                     physicalId = flatDiscovery.secretsManagerVpcEndpointId;
-                } else if (logicalId === 'FriggSQSVPCEndpoint' || logicalId === 'VPCEndpointSQS') {
+                } else if (logicalId === 'FriggSQSVPCEndpoint') {
                     resourceType = 'AWS::EC2::VPCEndpoint';
                     physicalId = flatDiscovery.sqsVpcEndpointId;
-                } else if (logicalId === 'FriggNATRoute' || logicalId === 'FriggPrivateRoute') {
-                    resourceType = 'AWS::EC2::Route';
-                    physicalId = flatDiscovery.natRoute;
                 }
 
                 if (physicalId && typeof physicalId === 'string') {
@@ -190,11 +184,6 @@ class VpcBuilder extends InfrastructureBuilder {
                     });
                 }
             });
-
-            // Also check for external resources extracted via CloudFormation queries
-            // (e.g., VPC ID from security group query, subnets from route table associations)
-            // These are NOT in the stack but were discovered through stack resources
-            this._addExternalResourcesFromCloudFormationQueries(flatDiscovery, discovery, existingLogicalIds);
         } else {
             // Resources discovered from AWS API (not CloudFormation)
             // These go into external array
@@ -298,70 +287,9 @@ class VpcBuilder extends InfrastructureBuilder {
             }
         }
 
-        // Add flat discovery properties directly to discovery object for resolver access
-        // The resolver checks both discovery.defaultSecurityGroupId and discovery.external array
-        discovery.defaultVpcId = flatDiscovery.defaultVpcId;
-        discovery.defaultSecurityGroupId = flatDiscovery.defaultSecurityGroupId;
-        discovery.privateSubnetId1 = flatDiscovery.privateSubnetId1;
-        discovery.privateSubnetId2 = flatDiscovery.privateSubnetId2;
-        discovery.natGatewayId = flatDiscovery.natGatewayId;
-        discovery.lambdaSecurityGroupId = flatDiscovery.lambdaSecurityGroupId;
-
         return discovery;
     }
 
-    /**
-     * Add external resources that were discovered via CloudFormation queries
-     * (e.g., VPC ID extracted from security group, subnets from route table associations)
-     * 
-     * @private
-     */
-    _addExternalResourcesFromCloudFormationQueries(flatDiscovery, discovery, existingLogicalIds) {
-        // VPC ID extracted from SG or route table (NOT a stack resource)
-        if (flatDiscovery.defaultVpcId && 
-            typeof flatDiscovery.defaultVpcId === 'string' &&
-            !existingLogicalIds.includes('FriggVPC')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.defaultVpcId,
-                resourceType: 'AWS::EC2::VPC',
-                source: 'cloudformation-query'
-            });
-        }
-
-        // Subnets extracted from route table associations (NOT stack resources)
-        if (flatDiscovery.privateSubnetId1 && 
-            typeof flatDiscovery.privateSubnetId1 === 'string' &&
-            !existingLogicalIds.includes('FriggPrivateSubnet1')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.privateSubnetId1,
-                resourceType: 'AWS::EC2::Subnet',
-                source: 'cloudformation-query'
-            });
-        }
-
-        if (flatDiscovery.privateSubnetId2 && 
-            typeof flatDiscovery.privateSubnetId2 === 'string' &&
-            !existingLogicalIds.includes('FriggPrivateSubnet2')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.privateSubnetId2,
-                resourceType: 'AWS::EC2::Subnet',
-                source: 'cloudformation-query'
-            });
-        }
-
-        // NAT Gateway extracted from route table routes
-        if (flatDiscovery.existingNatGatewayId && 
-            typeof flatDiscovery.existingNatGatewayId === 'string' &&
-            !existingLogicalIds.includes('FriggNATGateway') &&
-            !existingLogicalIds.includes('FriggNatGateway')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.existingNatGatewayId,
-                resourceType: 'AWS::EC2::NatGateway',
-                source: 'cloudformation-query'
-            });
-        }
-    }
-
     /**
      * Translate legacy configuration (management modes) to new ownership-based configuration
      * Provides backwards compatibility for existing app definitions
@@ -537,7 +465,6 @@ class VpcBuilder extends InfrastructureBuilder {
             iamStatements: [],
             outputs: {},
             environment: {},
-            discovery: discoveredResources,  // Store for backwards compatibility checks
         };
 
         // Add IAM permissions for VPC-enabled Lambda functions
@@ -556,7 +483,7 @@ class VpcBuilder extends InfrastructureBuilder {
         this.buildNatGatewayFromDecision(decisions.natGateway, appDefinition, discoveredResources, result);
 
         // Build VPC Endpoints based on ownership decisions
-        this.buildVpcEndpointsFromDecisions(decisions.vpcEndpoints, decisions.securityGroup, appDefinition, discoveredResources, result);
+        this.buildVpcEndpointsFromDecisions(decisions.vpcEndpoints, appDefinition, result);
 
         // Set VPC_ENABLED environment variable
         result.environment.VPC_ENABLED = 'true';
@@ -590,10 +517,11 @@ class VpcBuilder extends InfrastructureBuilder {
      * Build VPC based on ownership decision
      *
      * For STACK ownership: ALWAYS add definitions to template.
+     * CloudFormation idempotency ensures existing resources aren't recreated.
      */
     buildVpcFromDecision(decision, appDefinition, result) {
         if (decision.ownership === ResourceOwnership.STACK) {
-            // For STACK ownership: ALWAYS create definitions
+            // For STACK ownership: ALWAYS create definitions (CloudFormation idempotency)
             if (decision.physicalId) {
                 console.log(`  → Adding VPC definition to template (existing: ${decision.physicalId})`);
             } else {
@@ -652,6 +580,7 @@ class VpcBuilder extends InfrastructureBuilder {
     buildSecurityGroupFromDecision(decision, appDefinition, result) {
         if (decision.ownership === ResourceOwnership.STACK) {
             // Always create security group resource in template
+            // CloudFormation handles idempotency if it already exists
             console.log('  → Adding Lambda Security Group to template...');
 
             result.resources.FriggLambdaSecurityGroup = {
@@ -701,6 +630,7 @@ class VpcBuilder extends InfrastructureBuilder {
             }
 
             // For STACK ownership: ALWAYS add definitions to template
+            // CloudFormation idempotency ensures existing resources won't be recreated
             if (decision.physicalIds && decision.physicalIds.length >= 2) {
                 console.log(`  → Adding subnet definitions to template (existing: ${decision.physicalIds.join(', ')})`);
             } else {
@@ -924,8 +854,7 @@ class VpcBuilder extends InfrastructureBuilder {
     /**
      * Build VPC Endpoints based on ownership decisions
      */
-    buildVpcEndpointsFromDecisions(endpointDecisions, securityGroupDecision, appDefinition, discoveredResources, result) {
-        const decisions = endpointDecisions; // For backwards compatibility with existing code
+    buildVpcEndpointsFromDecisions(decisions, appDefinition, result) {
         const endpointsToCreate = [];
         const endpointsInStack = [];
         const externalEndpoints = [];
@@ -943,8 +872,6 @@ class VpcBuilder extends InfrastructureBuilder {
 
         if (endpointsInStack.length > 0) {
             console.log(`  ✓ VPC Endpoints in stack: ${endpointsInStack.join(', ')}`);
-            // CRITICAL: Must add stack-managed endpoints back to template or CloudFormation will DELETE them!
-            this._addStackManagedEndpointsToTemplate(decisions, securityGroupDecision, discoveredResources, result);
         }
 
         if (externalEndpoints.length > 0) {
@@ -1007,15 +934,6 @@ class VpcBuilder extends InfrastructureBuilder {
         // Create security group for interface endpoints if needed
         const needsInterfaceEndpoints = endpointsToCreate.some(type => ['kms', 'secretsManager', 'sqs'].includes(type));
         if (needsInterfaceEndpoints) {
-            // Determine source security group for ingress rule
-            let sourceSgId;
-            if (securityGroupDecision.ownership === ResourceOwnership.STACK) {
-                sourceSgId = { Ref: 'FriggLambdaSecurityGroup' };
-            } else {
-                // External - use the physical ID
-                sourceSgId = securityGroupDecision.physicalIds[0];
-            }
-
             result.resources.FriggVPCEndpointSecurityGroup = {
                 Type: 'AWS::EC2::SecurityGroup',
                 Properties: {
@@ -1026,7 +944,7 @@ class VpcBuilder extends InfrastructureBuilder {
                             IpProtocol: 'tcp',
                             FromPort: 443,
                             ToPort: 443,
-                            SourceSecurityGroupId: sourceSgId,
+                            SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' },
                             Description: 'HTTPS from Lambda',
                         },
                     ],
@@ -1134,119 +1052,6 @@ class VpcBuilder extends InfrastructureBuilder {
         return healingReport;
     }
 
-    /**
-     * Add stack-managed VPC endpoints back to template
-     * 
-     * CRITICAL: CloudFormation will DELETE resources that exist in the previous template
-     * but are missing from the new template. We must re-add discovered stack-managed
-     * endpoints to prevent CloudFormation from deleting them.
-     * 
-     * @private
-     */
-    _addStackManagedEndpointsToTemplate(endpointDecisions, securityGroupDecision, discoveredResources, result) {
-        const decisions = endpointDecisions; // For backwards compatibility
-        const vpcId = result.vpcId;
-        
-        // Determine logical IDs based on what exists in stack for backwards compatibility
-        // CRITICAL: Frontify production uses OLD naming (VPCEndpointS3, not FriggS3VPCEndpoint)
-        const existingLogicalIds = discoveredResources?.existingLogicalIds || [];
-        
-        
-        const logicalIdMap = {
-            s3: existingLogicalIds.includes('VPCEndpointS3') ? 'VPCEndpointS3' : 'FriggS3VPCEndpoint',
-            dynamodb: existingLogicalIds.includes('VPCEndpointDynamoDB') ? 'VPCEndpointDynamoDB' : 'FriggDynamoDBVPCEndpoint',
-            kms: existingLogicalIds.includes('VPCEndpointKMS') ? 'VPCEndpointKMS' : 'FriggKMSVPCEndpoint',
-            secretsManager: existingLogicalIds.includes('VPCEndpointSecretsManager') ? 'VPCEndpointSecretsManager' : 'FriggSecretsManagerVPCEndpoint',
-            sqs: existingLogicalIds.includes('VPCEndpointSQS') ? 'VPCEndpointSQS' : 'FriggSQSVPCEndpoint'
-        };
-
-        Object.entries(decisions).forEach(([type, decision]) => {
-            if (decision.ownership === ResourceOwnership.STACK) {
-                const logicalId = logicalIdMap[type];
-                
-                // Determine endpoint type and properties based on service
-                if (type === 's3') {
-                    result.resources[logicalId] = {
-                        Type: 'AWS::EC2::VPCEndpoint',
-                        Properties: {
-                            VpcId: vpcId,
-                            ServiceName: 'com.amazonaws.${self:provider.region}.s3',
-                            VpcEndpointType: 'Gateway',
-                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
-                        }
-                    };
-                } else if (type === 'dynamodb') {
-                    result.resources[logicalId] = {
-                        Type: 'AWS::EC2::VPCEndpoint',
-                        Properties: {
-                            VpcId: vpcId,
-                            ServiceName: 'com.amazonaws.${self:provider.region}.dynamodb',
-                            VpcEndpointType: 'Gateway',
-                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
-                        }
-                    };
-                } else {
-                    // Interface endpoints (KMS, Secrets Manager, SQS)
-                    const serviceMap = {
-                        kms: 'kms',
-                        secretsManager: 'secretsmanager',
-                        sqs: 'sqs'
-                    };
-                    
-                    result.resources[logicalId] = {
-                        Type: 'AWS::EC2::VPCEndpoint',
-                        Properties: {
-                            VpcId: vpcId,
-                            ServiceName: `com.amazonaws.\${self:provider.region}.${serviceMap[type]}`,
-                            VpcEndpointType: 'Interface',
-                            SubnetIds: result.vpcConfig.subnetIds,
-                            SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
-                            PrivateDnsEnabled: true
-                        }
-                    };
-                }
-            }
-        });
-
-        // If any interface endpoints exist, ensure security group is in template
-        const hasInterfaceEndpoints = ['kms', 'secretsManager', 'sqs'].some(
-            type => decisions[type]?.ownership === ResourceOwnership.STACK && decisions[type]?.physicalId
-        );
-
-        if (hasInterfaceEndpoints && !result.resources.FriggVPCEndpointSecurityGroup) {
-            // Determine source security group for ingress rule
-            // If Lambda SG is stack-managed, use CloudFormation Ref
-            // If Lambda SG is external, use the physical ID directly
-            let sourceSgId;
-            if (securityGroupDecision.ownership === ResourceOwnership.STACK) {
-                sourceSgId = { Ref: 'FriggLambdaSecurityGroup' };
-            } else {
-                // External - use the physical ID
-                sourceSgId = securityGroupDecision.physicalIds[0];
-            }
-
-            result.resources.FriggVPCEndpointSecurityGroup = {
-                Type: 'AWS::EC2::SecurityGroup',
-                Properties: {
-                    GroupDescription: 'Security group for VPC Endpoints',
-                    VpcId: vpcId,
-                    SecurityGroupIngress: [
-                        {
-                            IpProtocol: 'tcp',
-                            FromPort: 443,
-                            ToPort: 443,
-                            SourceSecurityGroupId: sourceSgId
-                        }
-                    ],
-                    Tags: [
-                        { Key: 'Name', Value: '${self:service}-${self:provider.stage}-vpc-endpoint-sg' },
-                        { Key: 'ManagedBy', Value: 'Frigg' }
-                    ]
-                }
-            };
-        }
-    }
-
     /**
      * Build new VPC from scratch
      */
@@ -1766,29 +1571,8 @@ class VpcBuilder extends InfrastructureBuilder {
 
     /**
      * Create route table and associations for NAT Gateway
-     * Always adds to template - CloudFormation handles idempotency
-     * Uses existing logical IDs from stack to prevent AlreadyExists errors
      */
     createNatGatewayRouting(appDefinition, discoveredResources, result, natGatewayId) {
-        // Note: We always add routing resources to the template.
-        // CloudFormation's idempotency ensures existing resources are updated, not recreated.
-        // Removing resources from the template causes CloudFormation to try CREATE on next deploy → AlreadyExists error
-
-        // Determine which logical ID to use for the NAT route based on what exists in stack
-        // Older stacks use 'FriggNATRoute', newer ones use 'FriggPrivateRoute'
-        // CRITICAL: Must check existingLogicalIds to avoid AlreadyExists errors on logical ID mismatch
-        const existingLogicalIds = discoveredResources?.existingLogicalIds || [];
-        
-        const routeLogicalId = existingLogicalIds.includes('FriggNATRoute') 
-            ? 'FriggNATRoute'  // Use existing logical ID from stack (backwards compatibility)
-            : 'FriggPrivateRoute';  // Default for new stacks
-
-        // Always use new logical IDs to force recreation and fix drift
-        // Old IDs (FriggSubnet1RouteAssociation) may have drifted from CloudFormation state
-        // Using new IDs forces CloudFormation to delete old and create new associations
-        const subnet1AssocLogicalId = 'FriggPrivateSubnet1RouteTableAssociation';
-        const subnet2AssocLogicalId = 'FriggPrivateSubnet2RouteTableAssociation';
-
         // Private route table with NAT Gateway route
         if (!result.resources.FriggLambdaRouteTable) {
             result.resources.FriggLambdaRouteTable = {
@@ -1803,7 +1587,7 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
-        result.resources[routeLogicalId] = {
+        result.resources.FriggPrivateRoute = {
             Type: 'AWS::EC2::Route',
             Properties: {
                 RouteTableId: { Ref: 'FriggLambdaRouteTable' },
@@ -1817,18 +1601,16 @@ class VpcBuilder extends InfrastructureBuilder {
         const subnet1Id = discoveredResources.privateSubnetId1 || { Ref: 'FriggPrivateSubnet1' };
         const subnet2Id = discoveredResources.privateSubnetId2 || { Ref: 'FriggPrivateSubnet2' };
 
-        result.resources[subnet1AssocLogicalId] = {
+        result.resources.FriggPrivateSubnet1RouteTableAssociation = {
             Type: 'AWS::EC2::SubnetRouteTableAssociation',
-            UpdateReplacePolicy: 'Delete',
             Properties: {
                 SubnetId: subnet1Id,
                 RouteTableId: { Ref: 'FriggLambdaRouteTable' },
             },
         };
 
-        result.resources[subnet2AssocLogicalId] = {
+        result.resources.FriggPrivateSubnet2RouteTableAssociation = {
             Type: 'AWS::EC2::SubnetRouteTableAssociation',
-            UpdateReplacePolicy: 'Delete',
             Properties: {
                 SubnetId: subnet2Id,
                 RouteTableId: { Ref: 'FriggLambdaRouteTable' },
@@ -1844,9 +1626,7 @@ class VpcBuilder extends InfrastructureBuilder {
      */
     ensureSubnetAssociations(appDefinition, discoveredResources, result) {
         // Skip if associations already created (by NAT Gateway routing)
-        // Check for both old and new logical ID patterns
-        if (result.resources.FriggPrivateSubnet1RouteTableAssociation ||
-            result.resources.FriggSubnet1RouteAssociation) {
+        if (result.resources.FriggPrivateSubnet1RouteTableAssociation) {
             return; // Already handled by NAT Gateway routing
         }
 
@@ -1856,7 +1636,6 @@ class VpcBuilder extends InfrastructureBuilder {
 
         result.resources.FriggPrivateSubnet1RouteTableAssociation = {
             Type: 'AWS::EC2::SubnetRouteTableAssociation',
-            UpdateReplacePolicy: 'Delete',
             Properties: {
                 SubnetId: subnet1Id,
                 RouteTableId: routeTableId,
@@ -1865,7 +1644,6 @@ class VpcBuilder extends InfrastructureBuilder {
 
         result.resources.FriggPrivateSubnet2RouteTableAssociation = {
             Type: 'AWS::EC2::SubnetRouteTableAssociation',
-            UpdateReplacePolicy: 'Delete',
             Properties: {
                 SubnetId: subnet2Id,
                 RouteTableId: routeTableId,
@@ -1883,7 +1661,7 @@ class VpcBuilder extends InfrastructureBuilder {
         // Stack-managed resources should be reused, not recreated
         const stackManagedEndpoints = {
             s3: discoveredResources.s3VpcEndpointId && typeof discoveredResources.s3VpcEndpointId === 'string',
-            dynamodb: discoveredResources.dynamodbVpcEndpointId && typeof discoveredResources.dynamodbVpcEndpointId === 'string',
+            dynamodb: discoveredResources.dynamoDbVpcEndpointId && typeof discoveredResources.dynamoDbVpcEndpointId === 'string',
             kms: discoveredResources.kmsVpcEndpointId && typeof discoveredResources.kmsVpcEndpointId === 'string',
             secretsManager: discoveredResources.secretsManagerVpcEndpointId && typeof discoveredResources.secretsManagerVpcEndpointId === 'string',
             sqs: discoveredResources.sqsVpcEndpointId && typeof discoveredResources.sqsVpcEndpointId === 'string',