@friggframework/devtools 2.0.0--canary.493.f8d621f.0 → 2.0.0--canary.490.a6abe40.0

package/infrastructure/domains/shared/cloudformation-discovery.js

@@ -28,6 +28,9 @@ class CloudFormationDiscovery {
      */
     async discoverFromStack(stackName) {
         try {
+            // Store stack name for use in helper methods
+            this.currentStackName = stackName;
+            
             // Try to get the stack
             const stack = await this.provider.describeStack(stackName);
 
@@ -111,6 +114,93 @@ class CloudFormationDiscovery {
         }
     }
 
+    /**
+     * Extract external resource references from stack resource properties
+     * 
+     * When VPC/subnets/NAT are external, they're referenced in routing resources' properties.
+     * We query EC2 to get the actual VPC ID, NAT Gateway ID, and subnet IDs from the route table.
+     * 
+     * @private
+     * @param {Array} resources - CloudFormation stack resources
+     * @param {Object} discovered - Object to populate with discovered resources
+     */
+    async _extractExternalReferencesFromStackResources(resources, discovered) {
+        if (!this.provider || !this.provider.getEC2Client) {
+            console.log('  ℹ Skipping external reference extraction (EC2 client not available)');
+            return;
+        }
+
+        try {
+            // If we found a route table in the stack, query EC2 for its details
+            // This gives us VPC ID, NAT Gateway ID, and subnet IDs
+            if (discovered.routeTableId) {
+                try {
+                    console.log(`  ℹ Querying route table ${discovered.routeTableId} for external references...`);
+                    const { DescribeRouteTablesCommand } = require('@aws-sdk/client-ec2');
+                    const ec2 = this.provider.getEC2Client();
+                    const rtResponse = await ec2.send(new DescribeRouteTablesCommand({
+                        RouteTableIds: [discovered.routeTableId]
+                    }));
+                    
+                    if (rtResponse.RouteTables && rtResponse.RouteTables.length > 0) {
+                        const routeTable = rtResponse.RouteTables[0];
+                        
+                        // Extract VPC ID
+                        if (routeTable.VpcId && !discovered.defaultVpcId) {
+                            discovered.defaultVpcId = routeTable.VpcId;
+                            console.log(`  ✓ Extracted VPC ID from route table: ${routeTable.VpcId}`);
+                        }
+                        
+                        // Extract NAT Gateway ID from routes
+                        const natRoute = routeTable.Routes?.find(r => r.NatGatewayId);
+                        if (natRoute && natRoute.NatGatewayId && !discovered.natGatewayId) {
+                            discovered.natGatewayId = natRoute.NatGatewayId;
+                            discovered.existingNatGatewayId = natRoute.NatGatewayId;
+                            console.log(`  ✓ Extracted NAT Gateway ID from routes: ${natRoute.NatGatewayId}`);
+                        }
+                        
+                        // Extract subnet IDs from route table associations
+                        const associations = routeTable.Associations || [];
+                        const subnetAssociations = associations.filter(a => a.SubnetId);
+                        
+                        if (subnetAssociations.length >= 1 && !discovered.privateSubnetId1) {
+                            discovered.privateSubnetId1 = subnetAssociations[0].SubnetId;
+                            console.log(`  ✓ Extracted private subnet 1 from associations: ${subnetAssociations[0].SubnetId}`);
+                        }
+                        if (subnetAssociations.length >= 2 && !discovered.privateSubnetId2) {
+                            discovered.privateSubnetId2 = subnetAssociations[1].SubnetId;
+                            console.log(`  ✓ Extracted private subnet 2 from associations: ${subnetAssociations[1].SubnetId}`);
+                        }
+
+                        // Query for default security group in the VPC (matches canary behavior)
+                        if (routeTable.VpcId && !discovered.defaultSecurityGroupId) {
+                            try {
+                                const { DescribeSecurityGroupsCommand } = require('@aws-sdk/client-ec2');
+                                const sgResponse = await ec2.send(new DescribeSecurityGroupsCommand({
+                                    Filters: [
+                                        { Name: 'vpc-id', Values: [routeTable.VpcId] },
+                                        { Name: 'group-name', Values: ['default'] }
+                                    ]
+                                }));
+                                
+                                if (sgResponse.SecurityGroups && sgResponse.SecurityGroups.length > 0) {
+                                    discovered.defaultSecurityGroupId = sgResponse.SecurityGroups[0].GroupId;
+                                    console.log(`  ✓ Extracted default security group: ${discovered.defaultSecurityGroupId}`);
+                                }
+                            } catch (error) {
+                                console.warn(`  ⚠️  Could not query default security group: ${error.message}`);
+                            }
+                        }
+                    }
+                } catch (error) {
+                    console.warn(`  ⚠️  Could not query route table for external references: ${error.message}`);
+                }
+            }
+        } catch (error) {
+            console.warn(`  ⚠️  Error extracting external references: ${error.message}`);
+        }
+    }
+
     /**
      * Extract discovered resources from CloudFormation stack resources
      *
@@ -216,6 +306,30 @@ class CloudFormationDiscovery {
                 discovered.natGatewayId = PhysicalResourceId;
             }
 
+            // Route Table (Lambda route table for external VPC pattern)
+            if (LogicalResourceId === 'FriggLambdaRouteTable' && ResourceType === 'AWS::EC2::RouteTable') {
+                discovered.routeTableId = PhysicalResourceId;
+                discovered.privateRouteTableId = PhysicalResourceId;
+                console.log(`  ✓ Found route table in stack: ${PhysicalResourceId}`);
+            }
+
+            // NAT Route (proves NAT configuration exists) - support both naming patterns
+            if ((LogicalResourceId === 'FriggNATRoute' || LogicalResourceId === 'FriggPrivateRoute') && 
+                ResourceType === 'AWS::EC2::Route') {
+                discovered.natRoute = PhysicalResourceId;
+                console.log(`  ✓ Found NAT route in stack: ${LogicalResourceId}`);
+            }
+
+            // Route Table Associations (links subnets to route table)
+            if (LogicalResourceId.includes('RouteAssociation') && 
+                ResourceType === 'AWS::EC2::SubnetRouteTableAssociation') {
+                if (!discovered.routeTableAssociations) {
+                    discovered.routeTableAssociations = [];
+                }
+                discovered.routeTableAssociations.push(PhysicalResourceId);
+                console.log(`  ✓ Found route table association: ${LogicalResourceId}`);
+            }
+
             // VPC - direct extraction (primary method)
             if (LogicalResourceId === 'FriggVPC' && ResourceType === 'AWS::EC2::VPC') {
                 discovered.defaultVpcId = PhysicalResourceId;
@@ -276,26 +390,64 @@ class CloudFormationDiscovery {
             // VPC Endpoint Security Group
             if (LogicalResourceId === 'FriggVPCEndpointSecurityGroup' && ResourceType === 'AWS::EC2::SecurityGroup') {
                 discovered.vpcEndpointSecurityGroupId = PhysicalResourceId;
+                console.log(`  ✓ Found VPC endpoint security group in stack: ${PhysicalResourceId}`);
+            }
+            
+            // Lambda Security Group (if created in stack)
+            if (LogicalResourceId === 'FriggLambdaSecurityGroup' && ResourceType === 'AWS::EC2::SecurityGroup') {
+                discovered.lambdaSecurityGroupId = PhysicalResourceId;
+                // Also set as defaultSecurityGroupId so converter recognizes it
+                discovered.defaultSecurityGroupId = PhysicalResourceId;
+                console.log(`  ✓ Found Lambda security group in stack: ${PhysicalResourceId}`);
+            }
+
+            // VPC Endpoints - support both old and new naming conventions
+            // Initialize vpcEndpoints object for structured access
+            if (!discovered.vpcEndpoints) {
+                discovered.vpcEndpoints = {};
             }
 
-            // VPC Endpoints
-            if (LogicalResourceId === 'FriggS3VPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
+            // S3 Endpoint (both naming patterns)
+            if ((LogicalResourceId === 'FriggS3VPCEndpoint' || LogicalResourceId === 'VPCEndpointS3') && 
+                ResourceType === 'AWS::EC2::VPCEndpoint') {
                 discovered.s3VpcEndpointId = PhysicalResourceId;
+                discovered.vpcEndpoints.s3 = PhysicalResourceId;
+                console.log(`  ✓ Found S3 VPC endpoint in stack: ${PhysicalResourceId}`);
             }
-            if (LogicalResourceId === 'FriggDynamoDBVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
-                discovered.dynamoDbVpcEndpointId = PhysicalResourceId;
+            
+            // DynamoDB Endpoint (both naming patterns)
+            if ((LogicalResourceId === 'FriggDynamoDBVPCEndpoint' || LogicalResourceId === 'VPCEndpointDynamoDB') && 
+                ResourceType === 'AWS::EC2::VPCEndpoint') {
+                discovered.dynamodbVpcEndpointId = PhysicalResourceId; // Note: all lowercase for consistency
+                discovered.vpcEndpoints.dynamodb = PhysicalResourceId;
+                console.log(`  ✓ Found DynamoDB VPC endpoint in stack: ${PhysicalResourceId}`);
             }
-            if (LogicalResourceId === 'FriggKMSVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
+            
+            // KMS Endpoint (both naming patterns)
+            if ((LogicalResourceId === 'FriggKMSVPCEndpoint' || LogicalResourceId === 'VPCEndpointKMS') && 
+                ResourceType === 'AWS::EC2::VPCEndpoint') {
                 discovered.kmsVpcEndpointId = PhysicalResourceId;
+                discovered.vpcEndpoints.kms = PhysicalResourceId;
+                console.log(`  ✓ Found KMS VPC endpoint in stack: ${PhysicalResourceId}`);
             }
+            
+            // Secrets Manager Endpoint
             if (LogicalResourceId === 'FriggSecretsManagerVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
                 discovered.secretsManagerVpcEndpointId = PhysicalResourceId;
+                discovered.vpcEndpoints.secretsManager = PhysicalResourceId;
             }
+            
+            // SQS Endpoint
             if (LogicalResourceId === 'FriggSQSVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
                 discovered.sqsVpcEndpointId = PhysicalResourceId;
+                discovered.vpcEndpoints.sqs = PhysicalResourceId;
             }
         }
 
+        // Extract VPC ID and other external references from routing resource properties
+        // This handles the pattern where VPC is external but routing is in the stack
+        await this._extractExternalReferencesFromStackResources(resources, discovered);
+
         // If we have a VPC ID but no subnet IDs, query EC2 for Frigg-managed subnets
         if (discovered.defaultVpcId && this.provider &&
             !discovered.privateSubnetId1 && !discovered.publicSubnetId1) {

package/infrastructure/domains/shared/cloudformation-discovery.test.js

@@ -586,5 +586,223 @@ describe('CloudFormationDiscovery', () => {
             expect(mockProvider.describeKmsKey).toHaveBeenCalledWith('alias/test-service-dev-frigg-kms');
         });
     });
+
+    describe('External VPC with routing infrastructure pattern', () => {
+        it('should discover routing resources when VPC is external', async () => {
+            // This tests the Frontify pattern: external VPC/subnets/KMS,
+            // but stack creates routing infrastructure (route table, NAT route, VPC endpoints)
+            const mockStack = {
+                StackName: 'create-frigg-app-production',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggLambdaRouteTable',
+                    PhysicalResourceId: 'rtb-0b83aca77ccde20a6',
+                    ResourceType: 'AWS::EC2::RouteTable',
+                    ResourceStatus: 'UPDATE_COMPLETE',
+                },
+                {
+                    LogicalResourceId: 'FriggNATRoute',
+                    PhysicalResourceId: 'rtb-0b83aca77ccde20a6|0.0.0.0/0',
+                    ResourceType: 'AWS::EC2::Route',
+                    ResourceStatus: 'UPDATE_COMPLETE',
+                },
+                {
+                    LogicalResourceId: 'FriggSubnet1RouteAssociation',
+                    PhysicalResourceId: 'rtbassoc-07245da0b447ca469',
+                    ResourceType: 'AWS::EC2::SubnetRouteTableAssociation',
+                    ResourceStatus: 'CREATE_COMPLETE',
+                },
+                {
+                    LogicalResourceId: 'FriggSubnet2RouteAssociation',
+                    PhysicalResourceId: 'rtbassoc-0806f9783c4ea181f',
+                    ResourceType: 'AWS::EC2::SubnetRouteTableAssociation',
+                    ResourceStatus: 'CREATE_COMPLETE',
+                },
+                {
+                    LogicalResourceId: 'VPCEndpointS3',
+                    PhysicalResourceId: 'vpce-0352ceac2124c14be',
+                    ResourceType: 'AWS::EC2::VPCEndpoint',
+                    ResourceStatus: 'CREATE_COMPLETE',
+                },
+                {
+                    LogicalResourceId: 'VPCEndpointDynamoDB',
+                    PhysicalResourceId: 'vpce-0b06c4f631199ea68',
+                    ResourceType: 'AWS::EC2::VPCEndpoint',
+                    ResourceStatus: 'CREATE_COMPLETE',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+
+            const result = await cfDiscovery.discoverFromStack('create-frigg-app-production');
+
+            // Verify routing infrastructure was discovered
+            expect(result.routeTableId).toBe('rtb-0b83aca77ccde20a6');
+            expect(result.privateRouteTableId).toBe('rtb-0b83aca77ccde20a6');
+            expect(result.natRoute).toBe('rtb-0b83aca77ccde20a6|0.0.0.0/0');
+            expect(result.routeTableAssociations).toEqual([
+                'rtbassoc-07245da0b447ca469',
+                'rtbassoc-0806f9783c4ea181f',
+            ]);
+
+            // Verify VPC endpoints were discovered (both naming conventions)
+            expect(result.vpcEndpoints).toBeDefined();
+            expect(result.vpcEndpoints.s3).toBe('vpce-0352ceac2124c14be');
+            expect(result.vpcEndpoints.dynamodb).toBe('vpce-0b06c4f631199ea68');
+            expect(result.s3VpcEndpointId).toBe('vpce-0352ceac2124c14be');
+            expect(result.dynamoDbVpcEndpointId).toBe('vpce-0b06c4f631199ea68');
+
+            // Verify NO VPC/KMS resources (they're external)
+            expect(result.defaultVpcId).toBeUndefined();
+            expect(result.defaultKmsKeyId).toBeUndefined();
+        });
+
+        it('should work with legacy VPC endpoint naming (FriggS3VPCEndpoint)', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggS3VPCEndpoint',
+                    PhysicalResourceId: 'vpce-legacy-s3',
+                    ResourceType: 'AWS::EC2::VPCEndpoint',
+                    ResourceStatus: 'CREATE_COMPLETE',
+                },
+                {
+                    LogicalResourceId: 'FriggDynamoDBVPCEndpoint',
+                    PhysicalResourceId: 'vpce-legacy-ddb',
+                    ResourceType: 'AWS::EC2::VPCEndpoint',
+                    ResourceStatus: 'CREATE_COMPLETE',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            // Both naming conventions should work
+            expect(result.vpcEndpoints.s3).toBe('vpce-legacy-s3');
+            expect(result.vpcEndpoints.dynamodb).toBe('vpce-legacy-ddb');
+            expect(result.s3VpcEndpointId).toBe('vpce-legacy-s3');
+            expect(result.dynamoDbVpcEndpointId).toBe('vpce-legacy-ddb');
+        });
+
+        it('should extract FriggLambdaSecurityGroup from stack', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggLambdaSecurityGroup',
+                    PhysicalResourceId: 'sg-01002240c6a446202',
+                    ResourceType: 'AWS::EC2::SecurityGroup',
+                    ResourceStatus: 'UPDATE_COMPLETE',
+                },
+                {
+                    LogicalResourceId: 'FriggLambdaRouteTable',
+                    PhysicalResourceId: 'rtb-08af43bbf0775602d',
+                    ResourceType: 'AWS::EC2::RouteTable',
+                    ResourceStatus: 'UPDATE_COMPLETE',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            // Lambda security group should be extracted
+            expect(result.lambdaSecurityGroupId).toBe('sg-01002240c6a446202');
+            expect(result.defaultSecurityGroupId).toBe('sg-01002240c6a446202');
+            expect(result.existingLogicalIds).toContain('FriggLambdaSecurityGroup');
+        });
+
+        it('should support FriggPrivateRoute naming for NAT routes', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggLambdaRouteTable',
+                    PhysicalResourceId: 'rtb-123',
+                    ResourceType: 'AWS::EC2::RouteTable',
+                    ResourceStatus: 'UPDATE_COMPLETE',
+                },
+                {
+                    LogicalResourceId: 'FriggPrivateRoute',
+                    PhysicalResourceId: 'rtb-123|0.0.0.0/0',
+                    ResourceType: 'AWS::EC2::Route',
+                    ResourceStatus: 'UPDATE_COMPLETE',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            // Both FriggNATRoute and FriggPrivateRoute should be recognized
+            expect(result.natRoute).toBe('rtb-123|0.0.0.0/0');
+            expect(result.routeTableId).toBe('rtb-123');
+        });
+
+        it('should extract external references from route table without stackName error', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggLambdaRouteTable',
+                    PhysicalResourceId: 'rtb-real-id',
+                    ResourceType: 'AWS::EC2::RouteTable',
+                    ResourceStatus: 'UPDATE_COMPLETE',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+            
+            // Mock EC2 DescribeRouteTables to return route table with VPC info
+            mockProvider.getEC2Client = jest.fn().mockReturnValue({
+                send: jest.fn().mockResolvedValue({
+                    RouteTables: [{
+                        RouteTableId: 'rtb-real-id',
+                        VpcId: 'vpc-extracted',
+                        Routes: [
+                            { NatGatewayId: 'nat-extracted', DestinationCidrBlock: '0.0.0.0/0' }
+                        ],
+                        Associations: [
+                            { SubnetId: 'subnet-1' },
+                            { SubnetId: 'subnet-2' }
+                        ]
+                    }]
+                })
+            });
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            // Should extract VPC, NAT, and subnets from route table
+            expect(result.defaultVpcId).toBe('vpc-extracted');
+            expect(result.existingNatGatewayId).toBe('nat-extracted');
+            expect(result.privateSubnetId1).toBe('subnet-1');
+            expect(result.privateSubnetId2).toBe('subnet-2');
+            
+            // Should NOT throw 'stackName is not defined' error
+            expect(result).toBeDefined();
+        });
+    });
 });
 

package/infrastructure/domains/shared/providers/aws-provider-adapter.js

@@ -536,6 +536,29 @@ class AWSProviderAdapter extends CloudProviderAdapter {
             return [];
         }
     }
+
+    /**
+     * Describe a specific stack resource to get its full details including properties
+     * @param {string} stackName - Stack name
+     * @param {string} logicalResourceId - Logical resource ID
+     * @returns {Promise<Object>} Resource details
+     */
+    async describeStackResource(stackName, logicalResourceId) {
+        const cf = this.getCloudFormationClient();
+        
+        try {
+            const { DescribeStackResourceCommand } = require('@aws-sdk/client-cloudformation');
+            const response = await cf.send(new DescribeStackResourceCommand({
+                StackName: stackName,
+                LogicalResourceId: logicalResourceId,
+            }));
+            
+            return response.StackResourceDetail || null;
+        } catch (error) {
+            console.warn(`Failed to describe stack resource ${logicalResourceId}:`, error.message);
+            return null;
+        }
+    }
 }
 
 module.exports = {

package/infrastructure/domains/shared/resource-discovery.js

@@ -95,11 +95,23 @@ async function gatherDiscoveredResources(appDefinition) {
         const cfDiscovery = new CloudFormationDiscovery(provider, { serviceName, stage });
         const stackResources = await cfDiscovery.discoverFromStack(stackName);
 
-        // Validate CF discovery results - only use if contains useful data
-        const hasVpcData = stackResources?.defaultVpcId;
-        const hasKmsData = stackResources?.defaultKmsKeyId;
-        const hasAuroraData = stackResources?.auroraClusterId;
-        const hasSomeUsefulData = hasVpcData || hasKmsData || hasAuroraData;
+        // Validate CF discovery results - check for ANY useful infrastructure
+        const hasVpcData = stackResources?.defaultVpcId;  // VPC resource in stack
+        const hasKmsData = stackResources?.defaultKmsKeyId;  // KMS resource in stack
+        const hasAuroraData = stackResources?.auroraClusterId;  // Aurora in stack
+        
+        // Check for routing infrastructure (proves VPC config exists even with external VPC)
+        const hasRoutingInfra = stackResources?.routeTableId ||  // FriggLambdaRouteTable
+                               stackResources?.natRoute ||        // FriggNATRoute
+                               stackResources?.vpcEndpoints?.s3 || // VPC endpoints
+                               stackResources?.vpcEndpoints?.dynamodb;
+        
+        // Stack is useful if it has EITHER actual resources OR routing infrastructure
+        const hasSomeUsefulData = hasVpcData || hasKmsData || hasAuroraData || hasRoutingInfra;
+        
+        if (hasRoutingInfra && !hasVpcData) {
+            console.log('  ✓ Found VPC routing infrastructure in stack (external VPC pattern)');
+        }
 
         // Check if we're in isolated mode (each stage gets its own VPC/Aurora)
         const isIsolatedMode = appDefinition.managementMode === 'managed' &&

package/infrastructure/domains/shared/resource-discovery.test.js

@@ -415,6 +415,42 @@ describe('Resource Discovery', () => {
             delete process.env.SLS_STAGE;
         });
 
+        it('should recognize routing infrastructure as useful data', async () => {
+            const appDefinition = {
+                name: 'test-app',
+                vpc: { enable: true },
+            };
+
+            process.env.SLS_STAGE = 'production';
+
+            // Mock CloudFormation discovery to return routing infrastructure but no VPC resource
+            const mockCloudFormationDiscovery = {
+                discoverFromStack: jest.fn().mockResolvedValue({
+                    fromCloudFormationStack: true,
+                    routeTableId: 'rtb-123',
+                    natRoute: 'rtb-123|0.0.0.0/0',
+                    vpcEndpoints: {
+                        s3: 'vpce-s3',
+                        dynamodb: 'vpce-ddb'
+                    },
+                    existingLogicalIds: ['FriggLambdaRouteTable', 'FriggNATRoute']
+                    // NO defaultVpcId, NO defaultKmsKeyId, NO auroraClusterId
+                })
+            };
+
+            const { CloudFormationDiscovery } = require('./cloudformation-discovery');
+            CloudFormationDiscovery.mockImplementation(() => mockCloudFormationDiscovery);
+
+            const result = await gatherDiscoveredResources(appDefinition);
+
+            // Should use CloudFormation data without falling back to AWS API
+            expect(result.routeTableId).toBe('rtb-123');
+            expect(result.vpcEndpoints.s3).toBe('vpce-s3');
+            
+            // Should NOT call AWS API discovery
+            expect(mockVpcDiscovery.discover).not.toHaveBeenCalled();
+        });
+
         it('should include secrets in SSM discovery by default', async () => {
             const appDefinition = {
                 ssm: { enable: true },