@friggframework/devtools 2.0.0--canary.623.b39b42d.0 → 2.0.0--canary.625.950ba82.0

package/infrastructure/domains/database/migration-builder.test.js

@@ -318,5 +318,106 @@ describe('MigrationBuilder', () => {
             );
         });
     });
+
+    describe('scoped environment (lambda.scopedEnvironment)', () => {
+        beforeEach(() => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+        });
+
+        it('scopes migration vars to the migration functions, keeping DB_TYPE global', async () => {
+            const result = await builder.build(
+                { lambda: { scopedEnvironment: true } },
+                {}
+            );
+
+            expect(result.environment.S3_BUCKET_NAME).toBeUndefined();
+            expect(result.environment.MIGRATION_STATUS_BUCKET).toBeUndefined();
+            expect(result.environment.DB_MIGRATION_QUEUE_URL).toBeUndefined();
+            expect(result.environment.DB_TYPE).toBe('postgresql');
+
+            for (const fnName of ['dbMigrationRouter', 'dbMigrationWorker']) {
+                expect(result.functionEnvironments[fnName]).toMatchObject({
+                    S3_BUCKET_NAME: { Ref: 'FriggMigrationStatusBucket' },
+                    MIGRATION_STATUS_BUCKET: {
+                        Ref: 'FriggMigrationStatusBucket',
+                    },
+                    DB_MIGRATION_QUEUE_URL: { Ref: 'DbMigrationQueue' },
+                });
+            }
+        });
+
+        it('broadcasts app-wide when the flag is off', async () => {
+            const result = await builder.build({}, {});
+
+            expect(result.environment.S3_BUCKET_NAME).toEqual({
+                Ref: 'FriggMigrationStatusBucket',
+            });
+            expect(result.environment.DB_MIGRATION_QUEUE_URL).toEqual({
+                Ref: 'DbMigrationQueue',
+            });
+            expect(result.functionEnvironments).toBeUndefined();
+        });
+    });
+
+    describe('scoped environment (external migration resources)', () => {
+        // managementMode='managed' + vpcIsolation='shared' resolves both
+        // resources to EXTERNAL when discovered, driving the external path.
+        const externalDiscovery = {
+            migrationStatusBucket: 'external-migration-bucket',
+            migrationQueueUrl:
+                'https://sqs.us-east-1.amazonaws.com/123456789012/external-migration-queue',
+        };
+
+        beforeEach(() => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+        });
+
+        it('scopes external migration vars to the migration functions, keeping DB_TYPE global', async () => {
+            const result = await builder.build(
+                {
+                    managementMode: 'managed',
+                    vpcIsolation: 'shared',
+                    lambda: { scopedEnvironment: true },
+                },
+                externalDiscovery
+            );
+
+            expect(result.environment.S3_BUCKET_NAME).toBeUndefined();
+            expect(result.environment.MIGRATION_STATUS_BUCKET).toBeUndefined();
+            expect(result.environment.DB_MIGRATION_QUEUE_URL).toBeUndefined();
+            expect(result.environment.DB_TYPE).toBe('postgresql');
+
+            for (const fnName of ['dbMigrationRouter', 'dbMigrationWorker']) {
+                expect(result.functionEnvironments[fnName]).toMatchObject({
+                    S3_BUCKET_NAME: externalDiscovery.migrationStatusBucket,
+                    MIGRATION_STATUS_BUCKET:
+                        externalDiscovery.migrationStatusBucket,
+                    DB_MIGRATION_QUEUE_URL: externalDiscovery.migrationQueueUrl,
+                });
+            }
+        });
+
+        it('broadcasts external migration vars app-wide when the flag is off', async () => {
+            const result = await builder.build(
+                {
+                    managementMode: 'managed',
+                    vpcIsolation: 'shared',
+                },
+                externalDiscovery
+            );
+
+            expect(result.environment.S3_BUCKET_NAME).toBe(
+                externalDiscovery.migrationStatusBucket
+            );
+            expect(result.environment.MIGRATION_STATUS_BUCKET).toBe(
+                externalDiscovery.migrationStatusBucket
+            );
+            expect(result.environment.DB_MIGRATION_QUEUE_URL).toBe(
+                externalDiscovery.migrationQueueUrl
+            );
+            expect(result.environment.DB_TYPE).toBe('postgresql');
+            expect(result.functionEnvironments).toBeUndefined();
+        });
+    });
 });
 

package/infrastructure/domains/integration/integration-builder.js

@@ -24,6 +24,11 @@ const {
     createEmptyDiscoveryResult,
     ResourceOwnership,
 } = require('../shared/types');
+const {
+    isScopedEnvironmentActive,
+    getIntegrationFunctionNames,
+    getAdminFunctionNames,
+} = require('../shared/function-environments');
 
 class IntegrationBuilder extends InfrastructureBuilder {
     constructor() {
@@ -218,13 +223,18 @@ class IntegrationBuilder extends InfrastructureBuilder {
                 console.log(
                     `      ✓ Creating ${integrationName}Queue in stack`
                 );
-                this.createIntegrationQueue(integrationName, result);
+                this.createIntegrationQueue(
+                    integrationName,
+                    result,
+                    appDefinition
+                );
             } else {
                 console.log(`      ✓ Using external ${integrationName}Queue`);
                 this.useExternalIntegrationQueue(
                     integrationName,
                     queueDecision,
-                    result
+                    result,
+                    appDefinition
                 );
             }
         }
@@ -544,7 +554,7 @@ class IntegrationBuilder extends InfrastructureBuilder {
     /**
      * Create integration-specific SQS queue CloudFormation resource
      */
-    createIntegrationQueue(integrationName, result) {
+    createIntegrationQueue(integrationName, result, appDefinition) {
         const queueReference = `${this.capitalizeFirst(integrationName)}Queue`;
         const queueName = `\${self:service}--\${self:provider.stage}-${queueReference}`;
 
@@ -564,9 +574,12 @@ class IntegrationBuilder extends InfrastructureBuilder {
         };
 
         // Add queue URL to environment
-        result.environment[`${integrationName.toUpperCase()}_QUEUE_URL`] = {
-            Ref: queueReference,
-        };
+        this.setQueueUrlEnvironment(
+            integrationName,
+            { Ref: queueReference },
+            result,
+            appDefinition
+        );
 
         // Add queue name to custom section
         result.custom[queueReference] = queueName;
@@ -577,14 +590,57 @@ class IntegrationBuilder extends InfrastructureBuilder {
     /**
      * Use external integration queue
      */
-    useExternalIntegrationQueue(integrationName, decision, result) {
+    useExternalIntegrationQueue(
+        integrationName,
+        decision,
+        result,
+        appDefinition
+    ) {
         // Add queue URL to environment for Lambda functions
-        result.environment[`${integrationName.toUpperCase()}_QUEUE_URL`] =
-            decision.physicalId;
+        this.setQueueUrlEnvironment(
+            integrationName,
+            decision.physicalId,
+            result,
+            appDefinition
+        );
 
         console.log(`  ✓ Using external queue: ${decision.physicalId}`);
     }
 
+    /**
+     * Broadcast the queue URL app-wide, or — with lambda.scopedEnvironment —
+     * scope it to the functions that can actually enqueue: the shared auth
+     * router (dispatches integration actions synchronously), the admin-script
+     * functions (instantiate arbitrary integrations), and the owning
+     * integration's own functions.
+     */
+    setQueueUrlEnvironment(integrationName, value, result, appDefinition) {
+        const key = `${integrationName.toUpperCase()}_QUEUE_URL`;
+
+        if (!isScopedEnvironmentActive(appDefinition)) {
+            result.environment[key] = value;
+            return;
+        }
+
+        const integration = appDefinition.integrations.find(
+            (entry) => entry.Definition.name === integrationName
+        );
+        const targets = [
+            'auth',
+            ...getAdminFunctionNames(appDefinition),
+            ...getIntegrationFunctionNames(integration),
+        ];
+
+        result.functionEnvironments = result.functionEnvironments || {};
+        for (const fnName of targets) {
+            result.functionEnvironments[fnName] = {
+                ...result.functionEnvironments[fnName],
+                [key]: value,
+            };
+        }
+        console.log(`  ✓ Scoped ${key} to: ${targets.join(', ')}`);
+    }
+
     /**
      * Capitalize first letter of string (e.g., 'slack' -> 'Slack')
      */

package/infrastructure/domains/integration/integration-builder.test.js

@@ -935,5 +935,100 @@ describe('IntegrationBuilder', () => {
             );
         });
     });
+
+    describe('scoped environment (lambda.scopedEnvironment)', () => {
+        const originalSkipDiscovery = process.env.FRIGG_SKIP_AWS_DISCOVERY;
+
+        beforeEach(() => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+        });
+
+        afterEach(() => {
+            if (originalSkipDiscovery === undefined) {
+                delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            } else {
+                process.env.FRIGG_SKIP_AWS_DISCOVERY = originalSkipDiscovery;
+            }
+        });
+
+        const scopedApp = {
+            lambda: { scopedEnvironment: true },
+            adminScripts: [{ Definition: { name: 'fix-things' } }],
+            integrations: [
+                { Definition: { name: 'hubspot', webhooks: true } },
+                { Definition: { name: 'slack' } },
+            ],
+        };
+
+        it('scopes queue URLs to auth, admin functions, and the owning integration only', async () => {
+            const result = await integrationBuilder.build(scopedApp, {});
+
+            expect(result.environment.HUBSPOT_QUEUE_URL).toBeUndefined();
+            expect(result.environment.SLACK_QUEUE_URL).toBeUndefined();
+
+            const scoped = result.functionEnvironments;
+            // auth and admin functions can enqueue to any integration
+            expect(scoped.auth).toEqual({
+                HUBSPOT_QUEUE_URL: { Ref: 'HubspotQueue' },
+                SLACK_QUEUE_URL: { Ref: 'SlackQueue' },
+            });
+            expect(scoped.adminScriptRouter.HUBSPOT_QUEUE_URL).toBeDefined();
+            expect(scoped.adminScriptExecutor.SLACK_QUEUE_URL).toBeDefined();
+
+            // owning integration's full function set
+            expect(scoped.hubspot.HUBSPOT_QUEUE_URL).toBeDefined();
+            expect(scoped.hubspotWebhook.HUBSPOT_QUEUE_URL).toBeDefined();
+            expect(scoped.hubspotQueueWorker.HUBSPOT_QUEUE_URL).toBeDefined();
+
+            // cross-integration isolation
+            expect(scoped.hubspotQueueWorker.SLACK_QUEUE_URL).toBeUndefined();
+            expect(scoped.slackQueueWorker.HUBSPOT_QUEUE_URL).toBeUndefined();
+        });
+
+        it('targets extension handler functions too', async () => {
+            const withExtension = {
+                lambda: { scopedEnvironment: true },
+                integrations: [
+                    {
+                        Definition: {
+                            name: 'hubspot',
+                            extensions: {
+                                'my-ext': {
+                                    extension: {
+                                        routes: [{ path: '/x', method: 'GET' }],
+                                    },
+                                },
+                            },
+                        },
+                    },
+                ],
+            };
+            const result = await integrationBuilder.build(withExtension, {});
+
+            expect(
+                result.functionEnvironments.hubspot__myext.HUBSPOT_QUEUE_URL
+            ).toBeDefined();
+        });
+
+        it('broadcasts app-wide when the flag is off', async () => {
+            const result = await integrationBuilder.build(
+                { integrations: scopedApp.integrations },
+                {}
+            );
+
+            expect(result.environment.HUBSPOT_QUEUE_URL).toEqual({
+                Ref: 'HubspotQueue',
+            });
+            expect(result.functionEnvironments).toBeUndefined();
+        });
+
+        it('broadcasts in local mode even with the flag on', async () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            const result = await integrationBuilder.build(scopedApp, {});
+
+            expect(result.environment.HUBSPOT_QUEUE_URL).toBeDefined();
+            expect(result.functionEnvironments).toBeUndefined();
+        });
+    });
 });
 

package/infrastructure/domains/networking/vpc-builder.js

@@ -22,6 +22,7 @@ const { InfrastructureBuilder, ValidationResult } = require('../shared/base-buil
 const VpcResourceResolver = require('./vpc-resolver');
 const { createEmptyDiscoveryResult } = require('../shared/types/discovery-result');
 const { ResourceOwnership } = require('../shared/types/resource-ownership');
+const { isSsmOffloadActive } = require('../parameters/offload-utils');
 
 class VpcBuilder extends InfrastructureBuilder {
     constructor() {
@@ -177,6 +178,9 @@ class VpcBuilder extends InfrastructureBuilder {
                 } else if (logicalId === 'FriggSQSVPCEndpoint' || logicalId === 'VPCEndpointSQS') {
                     resourceType = 'AWS::EC2::VPCEndpoint';
                     physicalId = flatDiscovery.sqsVpcEndpointId;
+                } else if (logicalId === 'FriggSSMVPCEndpoint' || logicalId === 'VPCEndpointSSM') {
+                    resourceType = 'AWS::EC2::VPCEndpoint';
+                    physicalId = flatDiscovery.ssmVpcEndpointId;
                 } else if (logicalId === 'FriggNATRoute' || logicalId === 'FriggPrivateRoute') {
                     resourceType = 'AWS::EC2::Route';
                     physicalId = flatDiscovery.natRoute;
@@ -296,6 +300,15 @@ class VpcBuilder extends InfrastructureBuilder {
                     properties: { ServiceName: 'sqs' }
                 });
             }
+
+            if (flatDiscovery.ssmVpcEndpointId && typeof flatDiscovery.ssmVpcEndpointId === 'string') {
+                discovery.external.push({
+                    physicalId: flatDiscovery.ssmVpcEndpointId,
+                    resourceType: 'AWS::EC2::VPCEndpoint',
+                    source: 'aws-discovery',
+                    properties: { ServiceName: 'ssm' }
+                });
+            }
         }
 
         // Add flat discovery properties directly to discovery object for resolver access
@@ -1005,7 +1018,7 @@ class VpcBuilder extends InfrastructureBuilder {
         }
 
         // Create security group for interface endpoints if needed
-        const needsInterfaceEndpoints = endpointsToCreate.some(type => ['kms', 'secretsManager', 'sqs'].includes(type));
+        const needsInterfaceEndpoints = endpointsToCreate.some(type => ['kms', 'secretsManager', 'sqs', 'ssm'].includes(type));
         if (needsInterfaceEndpoints) {
             // Determine source security group for ingress rule
             let sourceSgId;
@@ -1080,6 +1093,20 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
+        if (endpointsToCreate.includes('ssm')) {
+            result.resources.FriggSSMVPCEndpoint = {
+                Type: 'AWS::EC2::VPCEndpoint',
+                Properties: {
+                    VpcId: vpcId,
+                    ServiceName: 'com.amazonaws.${self:provider.region}.ssm',
+                    VpcEndpointType: 'Interface',
+                    SubnetIds: result.vpcConfig.subnetIds,
+                    SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
+                    PrivateDnsEnabled: true,
+                },
+            };
+        }
+
         console.log(`  ✅ VPC Endpoint resources added to template`);
     }
 
@@ -1157,7 +1184,8 @@ class VpcBuilder extends InfrastructureBuilder {
             dynamodb: existingLogicalIds.includes('VPCEndpointDynamoDB') ? 'VPCEndpointDynamoDB' : 'FriggDynamoDBVPCEndpoint',
             kms: existingLogicalIds.includes('VPCEndpointKMS') ? 'VPCEndpointKMS' : 'FriggKMSVPCEndpoint',
             secretsManager: existingLogicalIds.includes('VPCEndpointSecretsManager') ? 'VPCEndpointSecretsManager' : 'FriggSecretsManagerVPCEndpoint',
-            sqs: existingLogicalIds.includes('VPCEndpointSQS') ? 'VPCEndpointSQS' : 'FriggSQSVPCEndpoint'
+            sqs: existingLogicalIds.includes('VPCEndpointSQS') ? 'VPCEndpointSQS' : 'FriggSQSVPCEndpoint',
+            ssm: existingLogicalIds.includes('VPCEndpointSSM') ? 'VPCEndpointSSM' : 'FriggSSMVPCEndpoint'
         };
 
         Object.entries(decisions).forEach(([type, decision]) => {
@@ -1186,11 +1214,12 @@ class VpcBuilder extends InfrastructureBuilder {
                         }
                     };
                 } else {
-                    // Interface endpoints (KMS, Secrets Manager, SQS)
+                    // Interface endpoints (KMS, Secrets Manager, SQS, SSM)
                     const serviceMap = {
                         kms: 'kms',
                         secretsManager: 'secretsmanager',
-                        sqs: 'sqs'
+                        sqs: 'sqs',
+                        ssm: 'ssm'
                     };
                     
                     result.resources[logicalId] = {
@@ -1209,7 +1238,7 @@ class VpcBuilder extends InfrastructureBuilder {
         });
 
         // If any interface endpoints exist, ensure security group is in template
-        const hasInterfaceEndpoints = ['kms', 'secretsManager', 'sqs'].some(
+        const hasInterfaceEndpoints = ['kms', 'secretsManager', 'sqs', 'ssm'].some(
             type => decisions[type]?.ownership === ResourceOwnership.STACK && decisions[type]?.physicalId
         );
 
@@ -1887,8 +1916,11 @@ class VpcBuilder extends InfrastructureBuilder {
             kms: discoveredResources.kmsVpcEndpointId && typeof discoveredResources.kmsVpcEndpointId === 'string',
             secretsManager: discoveredResources.secretsManagerVpcEndpointId && typeof discoveredResources.secretsManagerVpcEndpointId === 'string',
             sqs: discoveredResources.sqsVpcEndpointId && typeof discoveredResources.sqsVpcEndpointId === 'string',
+            ssm: discoveredResources.ssmVpcEndpointId && typeof discoveredResources.ssmVpcEndpointId === 'string',
         };
 
+        const needsSsm = isSsmOffloadActive(appDefinition);
+
         // Build list of what needs creation (not stack-managed, not existing elsewhere)
         const missing = [];
         if (!stackManagedEndpoints.s3 && !existingEndpoints.s3) missing.push('S3');
@@ -1897,6 +1929,7 @@ class VpcBuilder extends InfrastructureBuilder {
         if (!stackManagedEndpoints.secretsManager && !existingEndpoints.secretsManager) missing.push('Secrets Manager');
         // SQS endpoint needed for job queues and async processing
         if (!stackManagedEndpoints.sqs && !existingEndpoints.sqs) missing.push('SQS');
+        if (!stackManagedEndpoints.ssm && !existingEndpoints.ssm && needsSsm) missing.push('SSM');
 
         // Log reused stack-managed endpoints
         const reused = [];
@@ -1905,6 +1938,7 @@ class VpcBuilder extends InfrastructureBuilder {
         if (stackManagedEndpoints.kms) reused.push('KMS');
         if (stackManagedEndpoints.secretsManager) reused.push('Secrets Manager');
         if (stackManagedEndpoints.sqs) reused.push('SQS');
+        if (stackManagedEndpoints.ssm) reused.push('SSM');
 
         if (reused.length > 0) {
             console.log(`  ✓ Reusing stack-managed VPC endpoints: ${reused.join(', ')}`);
@@ -1968,11 +2002,12 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
-        // VPC Endpoint Security Group (only if KMS, Secrets Manager, or SQS are not stack-managed and missing)
+        // VPC Endpoint Security Group (only if KMS, Secrets Manager, SQS, or SSM are not stack-managed and missing)
         const needsSecurityGroup =
             (!stackManagedEndpoints.kms && !existingEndpoints.kms && appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') ||
             (!stackManagedEndpoints.secretsManager && !existingEndpoints.secretsManager) ||
-            (!stackManagedEndpoints.sqs && !existingEndpoints.sqs);
+            (!stackManagedEndpoints.sqs && !existingEndpoints.sqs) ||
+            (!stackManagedEndpoints.ssm && !existingEndpoints.ssm && needsSsm);
 
         if (needsSecurityGroup) {
             result.resources.FriggVPCEndpointSecurityGroup = {
@@ -2043,6 +2078,21 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
+        // SSM Interface Endpoint (only if not stack-managed, missing, AND SSM offload is active)
+        if (!stackManagedEndpoints.ssm && !existingEndpoints.ssm && needsSsm) {
+            result.resources.FriggSSMVPCEndpoint = {
+                Type: 'AWS::EC2::VPCEndpoint',
+                Properties: {
+                    VpcId: vpcId,
+                    ServiceName: 'com.amazonaws.${self:provider.region}.ssm',
+                    VpcEndpointType: 'Interface',
+                    SubnetIds: result.vpcConfig.subnetIds,
+                    SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
+                    PrivateDnsEnabled: true,
+                },
+            };
+        }
+
         console.log(`    ✅ Created ${missing.length} VPC endpoint(s): ${missing.join(', ')}`);
     }
 }

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -990,6 +990,47 @@ describe('VpcBuilder', () => {
         });
     });
 
+    describe('SSM VPC Endpoint', () => {
+        const originalSkipDiscovery = process.env.FRIGG_SKIP_AWS_DISCOVERY;
+
+        afterEach(() => {
+            if (originalSkipDiscovery === undefined) {
+                delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            } else {
+                process.env.FRIGG_SKIP_AWS_DISCOVERY = originalSkipDiscovery;
+            }
+        });
+
+        it('should create SSM endpoint when offload is active and VPC is enabled', async () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                vpc: { enable: true, management: 'create-new' },
+                ssm: { enable: true },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = await vpcBuilder.build(appDefinition, {});
+
+            expect(result.resources.FriggSSMVPCEndpoint).toBeDefined();
+            expect(result.resources.FriggSSMVPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
+            expect(result.resources.FriggSSMVPCEndpoint.Properties.VpcEndpointType).toBe('Interface');
+            expect(result.resources.FriggSSMVPCEndpoint.Properties.ServiceName).toBe('com.amazonaws.${self:provider.region}.ssm');
+            expect(result.resources.FriggSSMVPCEndpoint.Properties.PrivateDnsEnabled).toBe(true);
+        });
+
+        it('should not create SSM endpoint when offload is not active', async () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                vpc: { enable: true, management: 'create-new' },
+                ssm: { enable: true },
+            };
+
+            const result = await vpcBuilder.build(appDefinition, {});
+
+            expect(result.resources.FriggSSMVPCEndpoint).toBeUndefined();
+        });
+    });
+
     describe('Self-healing', () => {
         it('should create missing subnets when selfHeal is enabled', async () => {
             const appDefinition = {

package/infrastructure/domains/networking/vpc-resolver.js

@@ -13,6 +13,7 @@
 
 const BaseResourceResolver = require('../shared/base-resolver');
 const { ResourceOwnership } = require('../shared/types');
+const { isSsmOffloadActive } = require('../parameters/offload-utils');
 
 class VpcResourceResolver extends BaseResourceResolver {
     /**
@@ -381,7 +382,8 @@ class VpcResourceResolver extends BaseResourceResolver {
                 dynamodb: { ownership: null, reason: 'VPC Endpoints disabled' },
                 kms: { ownership: null, reason: 'VPC Endpoints disabled' },
                 secretsManager: { ownership: null, reason: 'VPC Endpoints disabled' },
-                sqs: { ownership: null, reason: 'VPC Endpoints disabled' }
+                sqs: { ownership: null, reason: 'VPC Endpoints disabled' },
+                ssm: { ownership: null, reason: 'VPC Endpoints disabled' }
             };
         }
 
@@ -389,6 +391,9 @@ class VpcResourceResolver extends BaseResourceResolver {
         const encryptionMethod = appDefinition.encryption?.fieldLevelEncryptionMethod;
         const needsKms = encryptionMethod === 'kms';
 
+        // SSM endpoint only needed when parameter offload is active
+        const needsSsm = isSsmOffloadActive(appDefinition);
+
         // DynamoDB endpoint only needed if using DynamoDB (not MongoDB or PostgreSQL)
         // Currently framework only supports MongoDB (via Prisma) and PostgreSQL (via Aurora)
         // If not using DynamoDB, skip the endpoint (CloudFormation will delete if it exists)
@@ -403,7 +408,10 @@ class VpcResourceResolver extends BaseResourceResolver {
                 ? this._resolveEndpoint('FriggKMSVPCEndpoint', 'kms', userIntent, appDefinition, discovery)
                 : { ownership: null, reason: 'KMS endpoint not needed (encryption method is not KMS)' },
             secretsManager: this._resolveEndpoint('FriggSecretsManagerVPCEndpoint', 'secretsManager', userIntent, appDefinition, discovery),
-            sqs: this._resolveEndpoint('FriggSQSVPCEndpoint', 'sqs', userIntent, appDefinition, discovery)
+            sqs: this._resolveEndpoint('FriggSQSVPCEndpoint', 'sqs', userIntent, appDefinition, discovery),
+            ssm: needsSsm
+                ? this._resolveEndpoint('FriggSSMVPCEndpoint', 'ssm', userIntent, appDefinition, discovery)
+                : { ownership: null, reason: 'SSM endpoint not needed (SSM offload not active)' }
         };
 
         return endpoints;
@@ -421,7 +429,8 @@ class VpcResourceResolver extends BaseResourceResolver {
             'FriggDynamoDBVPCEndpoint': 'VPCEndpointDynamoDB',
             'FriggKMSVPCEndpoint': 'VPCEndpointKMS',
             'FriggSecretsManagerVPCEndpoint': 'VPCEndpointSecretsManager',
-            'FriggSQSVPCEndpoint': 'VPCEndpointSQS'
+            'FriggSQSVPCEndpoint': 'VPCEndpointSQS',
+            'FriggSSMVPCEndpoint': 'VPCEndpointSSM'
         };
         const oldLogicalId = oldLogicalIdMap[logicalId];
 

package/infrastructure/domains/networking/vpc-resolver.test.js

@@ -567,6 +567,46 @@ describe('VpcResourceResolver', () => {
             expect(decisions.kms.ownership).toBeNull();
             expect(decisions.secretsManager.ownership).toBeNull();
             expect(decisions.sqs.ownership).toBeNull();
+            expect(decisions.ssm.ownership).toBeNull();
+        });
+
+        describe('SSM endpoint', () => {
+            const originalSkipDiscovery = process.env.FRIGG_SKIP_AWS_DISCOVERY;
+
+            afterEach(() => {
+                if (originalSkipDiscovery === undefined) {
+                    delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+                } else {
+                    process.env.FRIGG_SKIP_AWS_DISCOVERY = originalSkipDiscovery;
+                }
+            });
+
+            it('should create SSM endpoint when offload is active', () => {
+                delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+                const appDefinition = {
+                    vpc: { ownership: { vpcEndpoints: 'auto' } },
+                    ssm: { enable: true },
+                    environment: { FOO: 'ssm' }
+                };
+                const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
+
+                const decisions = resolver.resolveVpcEndpoints(appDefinition, discovery);
+
+                expect(decisions.ssm.ownership).toBe('stack');
+            });
+
+            it('should not create SSM endpoint when offload is not active', () => {
+                delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+                const appDefinition = {
+                    vpc: { ownership: { vpcEndpoints: 'auto' } },
+                    ssm: { enable: true }
+                };
+                const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
+
+                const decisions = resolver.resolveVpcEndpoints(appDefinition, discovery);
+
+                expect(decisions.ssm.ownership).toBeNull();
+            });
         });
 
         it('should resolve to EXTERNAL with user-provided endpoint IDs', () => {