@friggframework/devtools 2.0.0--canary.493.f8d621f.0 → 2.0.0--canary.490.71c435d.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -149,7 +149,7 @@ class VpcBuilder extends InfrastructureBuilder {
                     physicalId = flatDiscovery.defaultVpcId;
                 } else if (logicalId === 'FriggLambdaSecurityGroup') {
                     resourceType = 'AWS::EC2::SecurityGroup';
-                    physicalId = flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
+                    physicalId = flatDiscovery.lambdaSecurityGroupId || flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
                 } else if (logicalId === 'FriggPrivateSubnet1') {
                     resourceType = 'AWS::EC2::Subnet';
                     physicalId = flatDiscovery.privateSubnetId1;
@@ -159,6 +159,9 @@ class VpcBuilder extends InfrastructureBuilder {
                 } else if (logicalId === 'FriggNATGateway') {
                     resourceType = 'AWS::EC2::NatGateway';
                     physicalId = flatDiscovery.existingNatGatewayId;
+                } else if (logicalId === 'FriggLambdaRouteTable') {
+                    resourceType = 'AWS::EC2::RouteTable';
+                    physicalId = flatDiscovery.routeTableId;
                 } else if (logicalId === 'FriggS3VPCEndpoint') {
                     resourceType = 'AWS::EC2::VPCEndpoint';
                     physicalId = flatDiscovery.s3VpcEndpointId;
@@ -184,6 +187,11 @@ class VpcBuilder extends InfrastructureBuilder {
                     });
                 }
             });
+
+            // Also check for external resources extracted via CloudFormation queries
+            // (e.g., VPC ID from security group query, subnets from route table associations)
+            // These are NOT in the stack but were discovered through stack resources
+            this._addExternalResourcesFromCloudFormationQueries(flatDiscovery, discovery, existingLogicalIds);
         } else {
             // Resources discovered from AWS API (not CloudFormation)
             // These go into external array
@@ -290,6 +298,58 @@ class VpcBuilder extends InfrastructureBuilder {
         return discovery;
     }
 
+    /**
+     * Add external resources that were discovered via CloudFormation queries
+     * (e.g., VPC ID extracted from security group, subnets from route table associations)
+     * 
+     * @private
+     */
+    _addExternalResourcesFromCloudFormationQueries(flatDiscovery, discovery, existingLogicalIds) {
+        // VPC ID extracted from SG or route table (NOT a stack resource)
+        if (flatDiscovery.defaultVpcId && 
+            typeof flatDiscovery.defaultVpcId === 'string' &&
+            !existingLogicalIds.includes('FriggVPC')) {
+            discovery.external.push({
+                physicalId: flatDiscovery.defaultVpcId,
+                resourceType: 'AWS::EC2::VPC',
+                source: 'cloudformation-query'
+            });
+        }
+
+        // Subnets extracted from route table associations (NOT stack resources)
+        if (flatDiscovery.privateSubnetId1 && 
+            typeof flatDiscovery.privateSubnetId1 === 'string' &&
+            !existingLogicalIds.includes('FriggPrivateSubnet1')) {
+            discovery.external.push({
+                physicalId: flatDiscovery.privateSubnetId1,
+                resourceType: 'AWS::EC2::Subnet',
+                source: 'cloudformation-query'
+            });
+        }
+
+        if (flatDiscovery.privateSubnetId2 && 
+            typeof flatDiscovery.privateSubnetId2 === 'string' &&
+            !existingLogicalIds.includes('FriggPrivateSubnet2')) {
+            discovery.external.push({
+                physicalId: flatDiscovery.privateSubnetId2,
+                resourceType: 'AWS::EC2::Subnet',
+                source: 'cloudformation-query'
+            });
+        }
+
+        // NAT Gateway extracted from route table routes
+        if (flatDiscovery.existingNatGatewayId && 
+            typeof flatDiscovery.existingNatGatewayId === 'string' &&
+            !existingLogicalIds.includes('FriggNATGateway') &&
+            !existingLogicalIds.includes('FriggNatGateway')) {
+            discovery.external.push({
+                physicalId: flatDiscovery.existingNatGatewayId,
+                resourceType: 'AWS::EC2::NatGateway',
+                source: 'cloudformation-query'
+            });
+        }
+    }
+
     /**
      * Translate legacy configuration (management modes) to new ownership-based configuration
      * Provides backwards compatibility for existing app definitions
@@ -872,6 +932,8 @@ class VpcBuilder extends InfrastructureBuilder {
 
         if (endpointsInStack.length > 0) {
             console.log(`  ✓ VPC Endpoints in stack: ${endpointsInStack.join(', ')}`);
+            // CRITICAL: Must add stack-managed endpoints back to template or CloudFormation will DELETE them!
+            this._addStackManagedEndpointsToTemplate(decisions, result);
         }
 
         if (externalEndpoints.length > 0) {
@@ -1052,6 +1114,101 @@ class VpcBuilder extends InfrastructureBuilder {
         return healingReport;
     }
 
+    /**
+     * Add stack-managed VPC endpoints back to template
+     * 
+     * CRITICAL: CloudFormation will DELETE resources that exist in the previous template
+     * but are missing from the new template. We must re-add discovered stack-managed
+     * endpoints to prevent CloudFormation from deleting them.
+     * 
+     * @private
+     */
+    _addStackManagedEndpointsToTemplate(decisions, result) {
+        const vpcId = result.vpcId;
+        const logicalIdMap = {
+            s3: 'FriggS3VPCEndpoint',
+            dynamodb: 'FriggDynamoDBVPCEndpoint',
+            kms: 'FriggKMSVPCEndpoint',
+            secretsManager: 'FriggSecretsManagerVPCEndpoint',
+            sqs: 'FriggSQSVPCEndpoint'
+        };
+
+        Object.entries(decisions).forEach(([type, decision]) => {
+            if (decision.ownership === ResourceOwnership.STACK && decision.physicalId) {
+                const logicalId = logicalIdMap[type];
+                
+                // Determine endpoint type and properties based on service
+                if (type === 's3') {
+                    result.resources[logicalId] = {
+                        Type: 'AWS::EC2::VPCEndpoint',
+                        Properties: {
+                            VpcId: vpcId,
+                            ServiceName: 'com.amazonaws.${self:provider.region}.s3',
+                            VpcEndpointType: 'Gateway',
+                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
+                        }
+                    };
+                } else if (type === 'dynamodb') {
+                    result.resources[logicalId] = {
+                        Type: 'AWS::EC2::VPCEndpoint',
+                        Properties: {
+                            VpcId: vpcId,
+                            ServiceName: 'com.amazonaws.${self:provider.region}.dynamodb',
+                            VpcEndpointType: 'Gateway',
+                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
+                        }
+                    };
+                } else {
+                    // Interface endpoints (KMS, Secrets Manager, SQS)
+                    const serviceMap = {
+                        kms: 'kms',
+                        secretsManager: 'secretsmanager',
+                        sqs: 'sqs'
+                    };
+                    
+                    result.resources[logicalId] = {
+                        Type: 'AWS::EC2::VPCEndpoint',
+                        Properties: {
+                            VpcId: vpcId,
+                            ServiceName: `com.amazonaws.\${self:provider.region}.${serviceMap[type]}`,
+                            VpcEndpointType: 'Interface',
+                            SubnetIds: result.vpcConfig.subnetIds,
+                            SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
+                            PrivateDnsEnabled: true
+                        }
+                    };
+                }
+            }
+        });
+
+        // If any interface endpoints exist, ensure security group is in template
+        const hasInterfaceEndpoints = ['kms', 'secretsManager', 'sqs'].some(
+            type => decisions[type]?.ownership === ResourceOwnership.STACK && decisions[type]?.physicalId
+        );
+
+        if (hasInterfaceEndpoints && !result.resources.FriggVPCEndpointSecurityGroup) {
+            result.resources.FriggVPCEndpointSecurityGroup = {
+                Type: 'AWS::EC2::SecurityGroup',
+                Properties: {
+                    GroupDescription: 'Security group for VPC Endpoints',
+                    VpcId: vpcId,
+                    SecurityGroupIngress: [
+                        {
+                            IpProtocol: 'tcp',
+                            FromPort: 443,
+                            ToPort: 443,
+                            SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' }
+                        }
+                    ],
+                    Tags: [
+                        { Key: 'Name', Value: '${self:service}-${self:provider.stage}-vpc-endpoint-sg' },
+                        { Key: 'ManagedBy', Value: 'Frigg' }
+                    ]
+                }
+            };
+        }
+    }
+
     /**
      * Build new VPC from scratch
      */
@@ -1661,7 +1818,7 @@ class VpcBuilder extends InfrastructureBuilder {
         // Stack-managed resources should be reused, not recreated
         const stackManagedEndpoints = {
             s3: discoveredResources.s3VpcEndpointId && typeof discoveredResources.s3VpcEndpointId === 'string',
-            dynamodb: discoveredResources.dynamoDbVpcEndpointId && typeof discoveredResources.dynamoDbVpcEndpointId === 'string',
+            dynamodb: discoveredResources.dynamodbVpcEndpointId && typeof discoveredResources.dynamodbVpcEndpointId === 'string',
             kms: discoveredResources.kmsVpcEndpointId && typeof discoveredResources.kmsVpcEndpointId === 'string',
             secretsManager: discoveredResources.secretsManagerVpcEndpointId && typeof discoveredResources.secretsManagerVpcEndpointId === 'string',
             sqs: discoveredResources.sqsVpcEndpointId && typeof discoveredResources.sqsVpcEndpointId === 'string',

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -398,19 +398,33 @@ describe('VpcBuilder', () => {
             expect(result.resources.FriggS3VPCEndpoint.Properties.VpcId).toBe('vpc-123');
         });
 
-        it('should reuse stack-managed VPC endpoints without creating CloudFormation resources', async () => {
+        it('should add stack-managed VPC endpoints back to template to prevent deletion', async () => {
             const appDefinition = {
-                vpc: { enable: true, enableVPCEndpoints: true },
+                vpc: { enable: true },
                 encryption: { fieldLevelEncryptionMethod: 'kms' },
-                database: { postgres: { enable: true } },
             };
+            
+            // Structured discovery from CloudFormation
             const discoveredResources = {
+                fromCloudFormationStack: true,
+                stackName: 'test-stack',
+                existingLogicalIds: [
+                    'FriggLambdaSecurityGroup',
+                    'FriggLambdaRouteTable',
+                    'FriggS3VPCEndpoint',
+                    'FriggDynamoDBVPCEndpoint',
+                    'FriggKMSVPCEndpoint',
+                    'FriggSecretsManagerVPCEndpoint',
+                    'FriggSQSVPCEndpoint'
+                ],
                 defaultVpcId: 'vpc-123',
                 privateSubnetId1: 'subnet-1',
                 privateSubnetId2: 'subnet-2',
-                // VPC endpoints from CloudFormation stack (string IDs)
+                routeTableId: 'rtb-123',
+                lambdaSecurityGroupId: 'sg-123',
+                // VPC endpoints discovered in stack
                 s3VpcEndpointId: 'vpce-s3-stack',
-                dynamoDbVpcEndpointId: 'vpce-ddb-stack',
+                dynamodbVpcEndpointId: 'vpce-ddb-stack',
                 kmsVpcEndpointId: 'vpce-kms-stack',
                 secretsManagerVpcEndpointId: 'vpce-sm-stack',
                 sqsVpcEndpointId: 'vpce-sqs-stack',
@@ -418,15 +432,30 @@ describe('VpcBuilder', () => {
 
             const result = await vpcBuilder.build(appDefinition, discoveredResources);
 
-            // Should NOT create CloudFormation resources (reuse stack endpoints)
-            expect(result.resources.FriggS3VPCEndpoint).toBeUndefined();
-            expect(result.resources.FriggDynamoDBVPCEndpoint).toBeUndefined();
-            expect(result.resources.FriggKMSVPCEndpoint).toBeUndefined();
-            expect(result.resources.FriggSecretsManagerVPCEndpoint).toBeUndefined();
-            expect(result.resources.FriggSQSVPCEndpoint).toBeUndefined();
+            // CRITICAL: Must RE-ADD stack-managed endpoints to template or CloudFormation will DELETE them
+            expect(result.resources.FriggS3VPCEndpoint).toBeDefined();
+            expect(result.resources.FriggS3VPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
+            expect(result.resources.FriggS3VPCEndpoint.Properties.VpcEndpointType).toBe('Gateway');
+            
+            expect(result.resources.FriggDynamoDBVPCEndpoint).toBeDefined();
+            expect(result.resources.FriggDynamoDBVPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
+            expect(result.resources.FriggDynamoDBVPCEndpoint.Properties.VpcEndpointType).toBe('Gateway');
+            
+            expect(result.resources.FriggKMSVPCEndpoint).toBeDefined();
+            expect(result.resources.FriggKMSVPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
+            expect(result.resources.FriggKMSVPCEndpoint.Properties.VpcEndpointType).toBe('Interface');
+            
+            expect(result.resources.FriggSecretsManagerVPCEndpoint).toBeDefined();
+            expect(result.resources.FriggSecretsManagerVPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
+            expect(result.resources.FriggSecretsManagerVPCEndpoint.Properties.VpcEndpointType).toBe('Interface');
+            
+            expect(result.resources.FriggSQSVPCEndpoint).toBeDefined();
+            expect(result.resources.FriggSQSVPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
+            expect(result.resources.FriggSQSVPCEndpoint.Properties.VpcEndpointType).toBe('Interface');
 
-            // Should still NOT create VPC Endpoint Security Group
-            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeUndefined();
+            // Should create VPC Endpoint Security Group for interface endpoints
+            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeDefined();
+            expect(result.resources.FriggVPCEndpointSecurityGroup.Type).toBe('AWS::EC2::SecurityGroup');
         });
 
         it('should create VPC endpoints when discovered from AWS but not stack', async () => {
@@ -1258,5 +1287,145 @@ describe('VpcBuilder', () => {
             expect(result.outputs.PrivateSubnet2Id).toBeDefined();
         });
     });
+
+    describe('convertFlatDiscoveryToStructured - CloudFormation query results', () => {
+        it('should add VPC from CloudFormation query to external array', () => {
+            const flatDiscovery = {
+                fromCloudFormationStack: true,
+                stackName: 'test-stack',
+                existingLogicalIds: ['FriggLambdaRouteTable', 'FriggLambdaSecurityGroup'],
+                // VPC ID was extracted from security group query (NOT a stack resource)
+                defaultVpcId: 'vpc-extracted-from-sg',
+                lambdaSecurityGroupId: 'sg-123',
+                routeTableId: 'rtb-123'
+            };
+
+            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
+
+            // VPC should be in external array (discovered via query, not in stack)
+            const vpcExternal = result.external.find(r => r.resourceType === 'AWS::EC2::VPC');
+            expect(vpcExternal).toBeDefined();
+            expect(vpcExternal.physicalId).toBe('vpc-extracted-from-sg');
+            expect(vpcExternal.source).toBe('cloudformation-query');
+
+            // Security group SHOULD be in stackManaged (is in stack)
+            const sgStack = result.stackManaged.find(r => r.logicalId === 'FriggLambdaSecurityGroup');
+            expect(sgStack).toBeDefined();
+            expect(sgStack.physicalId).toBe('sg-123');
+        });
+
+        it('should add subnets from route table associations to external array', () => {
+            const flatDiscovery = {
+                fromCloudFormationStack: true,
+                stackName: 'test-stack',
+                existingLogicalIds: ['FriggLambdaRouteTable'],
+                routeTableId: 'rtb-123',
+                // Subnets extracted from route table associations (NOT stack resources)
+                privateSubnetId1: 'subnet-1',
+                privateSubnetId2: 'subnet-2'
+            };
+
+            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
+
+            // Subnets should be in external array
+            const subnet1 = result.external.find(r => r.physicalId === 'subnet-1');
+            const subnet2 = result.external.find(r => r.physicalId === 'subnet-2');
+            
+            expect(subnet1).toBeDefined();
+            expect(subnet1.resourceType).toBe('AWS::EC2::Subnet');
+            expect(subnet1.source).toBe('cloudformation-query');
+            
+            expect(subnet2).toBeDefined();
+            expect(subnet2.resourceType).toBe('AWS::EC2::Subnet');
+            expect(subnet2.source).toBe('cloudformation-query');
+        });
+
+        it('should add NAT Gateway from route table queries to external array', () => {
+            const flatDiscovery = {
+                fromCloudFormationStack: true,
+                stackName: 'test-stack',
+                existingLogicalIds: ['FriggLambdaRouteTable', 'FriggPrivateRoute'],
+                routeTableId: 'rtb-123',
+                // NAT Gateway extracted from route table routes (NOT a stack resource)
+                existingNatGatewayId: 'nat-extracted'
+            };
+
+            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
+
+            // NAT should be in external array
+            const natExternal = result.external.find(r => r.resourceType === 'AWS::EC2::NatGateway');
+            expect(natExternal).toBeDefined();
+            expect(natExternal.physicalId).toBe('nat-extracted');
+            expect(natExternal.source).toBe('cloudformation-query');
+        });
+
+        it('should NOT add resources to external if they are in stack', () => {
+            const flatDiscovery = {
+                fromCloudFormationStack: true,
+                stackName: 'test-stack',
+                existingLogicalIds: ['FriggVPC', 'FriggPrivateSubnet1'],
+                // These ARE in the stack
+                defaultVpcId: 'vpc-in-stack',
+                privateSubnetId1: 'subnet-in-stack'
+            };
+
+            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
+
+            // Should be in stackManaged, NOT external
+            expect(result.stackManaged.some(r => r.logicalId === 'FriggVPC')).toBe(true);
+            expect(result.stackManaged.some(r => r.logicalId === 'FriggPrivateSubnet1')).toBe(true);
+            
+            // Should NOT be in external
+            expect(result.external.some(r => r.physicalId === 'vpc-in-stack')).toBe(false);
+            expect(result.external.some(r => r.physicalId === 'subnet-in-stack')).toBe(false);
+        });
+
+        it('should handle Frontify pattern: stack resources + queried external references', () => {
+            const flatDiscovery = {
+                fromCloudFormationStack: true,
+                stackName: 'create-frigg-app-production',
+                existingLogicalIds: [
+                    'FriggLambdaSecurityGroup',
+                    'FriggLambdaRouteTable',
+                    'FriggPrivateRoute',
+                    'FriggPrivateSubnet1RouteTableAssociation',
+                    'FriggPrivateSubnet2RouteTableAssociation',
+                    'FriggS3VPCEndpoint',
+                    'FriggDynamoDBVPCEndpoint',
+                    'FriggKMSVPCEndpoint'
+                ],
+                // Stack resources
+                lambdaSecurityGroupId: 'sg-01002240c6a446202',
+                routeTableId: 'rtb-08af43bbf0775602d',
+                s3VpcEndpointId: 'vpce-s3',
+                // External resources (discovered via queries)
+                defaultVpcId: 'vpc-0cd17c0e06cb28b28',
+                privateSubnetId1: 'subnet-034f6562dbbc16348',
+                privateSubnetId2: 'subnet-0b8be2b82aeb5cdec',
+                existingNatGatewayId: 'nat-022660c36a47e2d79'
+            };
+
+            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
+
+            // Stack resources should be in stackManaged
+            expect(result.stackManaged).toEqual(
+                expect.arrayContaining([
+                    expect.objectContaining({ logicalId: 'FriggLambdaSecurityGroup', physicalId: 'sg-01002240c6a446202' }),
+                    expect.objectContaining({ logicalId: 'FriggLambdaRouteTable', physicalId: 'rtb-08af43bbf0775602d' }),
+                    expect.objectContaining({ logicalId: 'FriggS3VPCEndpoint' })
+                ])
+            );
+
+            // External resources should be in external array
+            expect(result.external).toEqual(
+                expect.arrayContaining([
+                    expect.objectContaining({ physicalId: 'vpc-0cd17c0e06cb28b28', resourceType: 'AWS::EC2::VPC', source: 'cloudformation-query' }),
+                    expect.objectContaining({ physicalId: 'subnet-034f6562dbbc16348', resourceType: 'AWS::EC2::Subnet', source: 'cloudformation-query' }),
+                    expect.objectContaining({ physicalId: 'subnet-0b8be2b82aeb5cdec', resourceType: 'AWS::EC2::Subnet', source: 'cloudformation-query' }),
+                    expect.objectContaining({ physicalId: 'nat-022660c36a47e2d79', resourceType: 'AWS::EC2::NatGateway', source: 'cloudformation-query' })
+                ])
+            );
+        });
+    });
 });
 

package/infrastructure/domains/networking/vpc-resolver.js

@@ -23,6 +23,7 @@ class VpcResourceResolver extends BaseResourceResolver {
      */
     resolveVpc(appDefinition, discovery) {
         const userIntent = appDefinition.vpc?.ownership?.vpc || 'auto';
+        const vpcManagement = appDefinition.vpc?.management; // Legacy config
 
         // Explicit external
         if (userIntent === 'external') {
@@ -43,20 +44,35 @@ class VpcResourceResolver extends BaseResourceResolver {
         }
 
         // Auto-decide
-        return this.resolveResourceOwnership(
+        const decision = this.resolveResourceOwnership(
             'auto',
             'FriggVPC',
             'AWS::EC2::VPC',
             discovery
         );
+
+        // CRITICAL: If auto-resolution wants to create a VPC but management mode is 'discover' (or undefined),
+        // throw an error instead. Creating a VPC is expensive and should be explicit.
+        if (decision.ownership === ResourceOwnership.STACK && 
+            !decision.physicalId && 
+            vpcManagement !== 'create-new' &&
+            userIntent === 'auto') {
+            throw new Error(
+                'VPC discovery failed: No VPC found. ' +
+                'Either set vpc.management to "create-new" or provide vpc.vpcId with vpc.management "use-existing".'
+            );
+        }
+
+        return decision;
     }
 
     /**
      * Resolve Security Group ownership
      *
-     * Special logic: We ALWAYS create our own FriggLambdaSecurityGroup with specific
-     * rules unless the user explicitly provides external SG IDs. The discovered
-     * defaultSecurityGroupId is the VPC's default SG, but we need our own Lambda SG.
+     * Logic:
+     * - If FriggLambdaSecurityGroup exists in stack → STACK (keep it)
+     * - If default SG discovered from VPC → EXTERNAL (use it)
+     * - Otherwise → STACK (create FriggLambdaSecurityGroup)
      *
      * @param {Object} appDefinition - App definition
      * @param {Object} discovery - Discovery result
@@ -65,7 +81,7 @@ class VpcResourceResolver extends BaseResourceResolver {
     resolveSecurityGroup(appDefinition, discovery) {
         const userIntent = appDefinition.vpc?.ownership?.securityGroup || 'auto';
 
-        // Explicit external - only use external SGs if user explicitly provides them
+        // Explicit external - use provided SG IDs
         if (userIntent === 'external') {
             this.requireExternalIds(
                 appDefinition.vpc?.external?.securityGroupIds,
@@ -77,21 +93,52 @@ class VpcResourceResolver extends BaseResourceResolver {
             );
         }
 
-        // For stack or auto: check if FriggLambdaSecurityGroup exists in stack
-        // If it does, reuse it. If not, create it. Never use discovered default SG.
+        // Explicit stack - always create FriggLambdaSecurityGroup
+        if (userIntent === 'stack') {
+            const inStack = this.findInStack('FriggLambdaSecurityGroup', discovery);
+            return this.createStackDecision(
+                inStack?.physicalId,
+                inStack 
+                    ? 'Found FriggLambdaSecurityGroup in CloudFormation stack'
+                    : 'User specified ownership=stack - will create FriggLambdaSecurityGroup'
+            );
+        }
+
+        // Auto mode: Check stack first, then check for discovered default SG
         const inStack = this.findInStack('FriggLambdaSecurityGroup', discovery);
 
         if (inStack) {
             return this.createStackDecision(
                 inStack.physicalId,
-                'Found FriggLambdaSecurityGroup in CloudFormation stack'
+                'Found FriggLambdaSecurityGroup in CloudFormation stack - must keep in template'
+            );
+        }
+
+        // Also check flat discovery for lambdaSecurityGroupId (from CloudFormation extraction)
+        const structured = discovery._structured || discovery;
+        const lambdaSgId = structured.lambdaSecurityGroupId || discovery.lambdaSecurityGroupId;
+        
+        if (lambdaSgId) {
+            return this.createStackDecision(
+                lambdaSgId,
+                'Found FriggLambdaSecurityGroup in CloudFormation stack - must keep in template'
+            );
+        }
+
+        // Check for discovered default security group (from external VPC pattern)
+        const defaultSgId = structured.defaultSecurityGroupId || discovery.defaultSecurityGroupId;
+        
+        if (defaultSgId) {
+            return this.createExternalDecision(
+                [defaultSgId],
+                'Found default security group via discovery - will reuse (matches canary behavior)'
             );
         }
 
-        // Create new FriggLambdaSecurityGroup in stack
+        // No SG found anywhere - create new FriggLambdaSecurityGroup
         return this.createStackDecision(
             null,
-            'No existing FriggLambdaSecurityGroup - will create in stack'
+            'No security group found - will create FriggLambdaSecurityGroup in stack'
         );
     }
 

package/infrastructure/domains/networking/vpc-resolver.test.js

@@ -109,6 +109,46 @@ describe('VpcResourceResolver', () => {
             expect(decision.physicalId).toBeUndefined();
             expect(decision.reason).toContain('No existing resource found');
         });
+
+        it('should throw error when auto mode finds no VPC and management is not create-new', () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    // No management specified - defaults to discover
+                    // No ownership specified - defaults to auto
+                }
+            };
+            const discovery = { 
+                stackManaged: [], 
+                external: [], 
+                fromCloudFormation: false 
+            };
+
+            // Should throw error instead of trying to create VPC
+            expect(() => resolver.resolveVpc(appDefinition, discovery)).toThrow(
+                'VPC discovery failed: No VPC found'
+            );
+        });
+
+        it('should allow creating VPC when management is create-new', () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    management: 'create-new'
+                }
+            };
+            const discovery = { 
+                stackManaged: [], 
+                external: [], 
+                fromCloudFormation: false 
+            };
+
+            // Should NOT throw - create-new explicitly allows VPC creation
+            const decision = resolver.resolveVpc(appDefinition, discovery);
+            
+            expect(decision.ownership).toBe(ResourceOwnership.STACK);
+            expect(decision.physicalId).toBeNull();
+        });
     });
 
     describe('resolveSecurityGroup', () => {