@friggframework/devtools 2.0.0--canary.625.3f500f2.0 → 2.0.0--canary.625.6bef7de.0

package/frigg-cli/ssm-command/index.js

@@ -163,21 +163,59 @@ async function pushOffloadedParameters(appDefinition, stage, options = {}) {
         options
     );
 
-    for (const key of skipped) {
-        console.warn(
-            `⚠️  Skipping ${key}: no value in the environment (--allow-empty)`
-        );
-    }
-
-    if (specs.length === 0) {
+    if (specs.length === 0 && skipped.length === 0) {
         return { pushed: [], skipped };
     }
 
-    const { SSMClient, PutParameterCommand } = require('@aws-sdk/client-ssm');
+    const {
+        SSMClient,
+        PutParameterCommand,
+        GetParametersCommand,
+    } = require('@aws-sdk/client-ssm');
     const client = new SSMClient({
         region: resolvePushRegion(options),
     });
 
+    // --allow-empty only rotates keys that already exist. A skipped key still
+    // ships in FRIGG_SSM_OFFLOADED_KEYS, so if its parameter does not exist the
+    // runtime fails fast at cold start on every function — a green deploy that
+    // bricks the fleet. Verify existence and abort instead.
+    if (skipped.length > 0) {
+        const prefix = resolveParameterPrefix(appDefinition, stage);
+        const names = skipped.map((key) => `${prefix}/${key}`);
+        const existing = new Set();
+        for (let i = 0; i < names.length; i += 10) {
+            const { Parameters = [] } = await client.send(
+                new GetParametersCommand({ Names: names.slice(i, i + 10) })
+            );
+            for (const param of Parameters) {
+                existing.add(param.Name);
+            }
+        }
+        const orphaned = skipped.filter(
+            (key) => !existing.has(`${prefix}/${key}`)
+        );
+        if (orphaned.length > 0) {
+            throw new Error(
+                `--allow-empty skipped ${orphaned.join(
+                    ', '
+                )}, but no such parameter exists in Parameter Store. --allow-empty ` +
+                    `only rotates keys that already have a value; a skipped key with no ` +
+                    `parameter stays in FRIGG_SSM_OFFLOADED_KEYS and fails every function ` +
+                    `at cold start. Set a value and push without --allow-empty.`
+            );
+        }
+        for (const key of skipped) {
+            console.warn(
+                `⚠️  Skipping ${key}: no value in the environment; keeping the existing Parameter Store value (--allow-empty)`
+            );
+        }
+    }
+
+    if (specs.length === 0) {
+        return { pushed: [], skipped };
+    }
+
     const pushed = [];
     for (const spec of specs) {
         const input = {

package/frigg-cli/ssm-command/index.test.js

@@ -1,5 +1,9 @@
 const { mockClient } = require('aws-sdk-client-mock');
-const { SSMClient, PutParameterCommand } = require('@aws-sdk/client-ssm');
+const {
+    SSMClient,
+    PutParameterCommand,
+    GetParametersCommand,
+} = require('@aws-sdk/client-ssm');
 const { pushOffloadedParameters, resolvePushRegion } = require('./index');
 
 describe('ssm-command pushOffloadedParameters', () => {
@@ -95,8 +99,11 @@ describe('ssm-command pushOffloadedParameters', () => {
         expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(0);
     });
 
-    it('skips missing values with allowEmpty instead of throwing', async () => {
+    it('skips missing values with allowEmpty when the parameter already exists', async () => {
         delete process.env.MY_SECRET;
+        ssmMock.on(GetParametersCommand).resolves({
+            Parameters: [{ Name: '/frigg/my-app/dev/MY_SECRET' }],
+        });
 
         const result = await pushOffloadedParameters(appDefinition, 'dev', {
             allowEmpty: true,
@@ -105,6 +112,16 @@ describe('ssm-command pushOffloadedParameters', () => {
         expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(1);
     });
 
+    it('aborts when allowEmpty skips a key that does not exist in Parameter Store', async () => {
+        delete process.env.MY_SECRET;
+        ssmMock.on(GetParametersCommand).resolves({ Parameters: [] });
+
+        await expect(
+            pushOffloadedParameters(appDefinition, 'dev', { allowEmpty: true })
+        ).rejects.toThrow(/MY_SECRET.*no such parameter|--allow-empty/s);
+        expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(0);
+    });
+
     it('rejects values over the standard tier limit and suggests advanced', async () => {
         process.env.MY_CONFIG = 'x'.repeat(4097);
 

package/infrastructure/domains/networking/vpc-discovery.js

@@ -123,6 +123,10 @@ class VpcDiscovery {
                 const sqsEndpoint = rawResources.vpcEndpoints.find(
                     ep => ep.ServiceName && ep.ServiceName.includes('.sqs')
                 );
+                // endsWith avoids matching sibling services like `.ssmmessages`
+                const ssmEndpoint = rawResources.vpcEndpoints.find(
+                    ep => ep.ServiceName && ep.ServiceName.endsWith('.ssm')
+                );
 
                 if (s3Endpoint) {
                     result.s3VpcEndpointId = s3Endpoint.VpcEndpointId;
@@ -139,6 +143,9 @@ class VpcDiscovery {
                 if (sqsEndpoint) {
                     result.sqsVpcEndpointId = sqsEndpoint.VpcEndpointId;
                 }
+                if (ssmEndpoint) {
+                    result.ssmVpcEndpointId = ssmEndpoint.VpcEndpointId;
+                }
             }
 
             console.log(`  ✓ Found VPC: ${result.defaultVpcId}`);
@@ -151,8 +158,8 @@ class VpcDiscovery {
             if (result.existingNatGatewayId) {
                 console.log(`  ✓ Found NAT Gateway: ${result.existingNatGatewayId}`);
             }
-            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId || result.kmsVpcEndpointId || result.secretsManagerVpcEndpointId || result.sqsVpcEndpointId) {
-                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}, KMS=${result.kmsVpcEndpointId ? 'Yes' : 'No'}, SecretsManager=${result.secretsManagerVpcEndpointId ? 'Yes' : 'No'}, SQS=${result.sqsVpcEndpointId ? 'Yes' : 'No'}`);
+            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId || result.kmsVpcEndpointId || result.secretsManagerVpcEndpointId || result.sqsVpcEndpointId || result.ssmVpcEndpointId) {
+                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}, KMS=${result.kmsVpcEndpointId ? 'Yes' : 'No'}, SecretsManager=${result.secretsManagerVpcEndpointId ? 'Yes' : 'No'}, SQS=${result.sqsVpcEndpointId ? 'Yes' : 'No'}, SSM=${result.ssmVpcEndpointId ? 'Yes' : 'No'}`);
             }
 
             return result;

package/infrastructure/domains/networking/vpc-discovery.test.js

@@ -253,7 +253,7 @@ describe('VpcDiscovery', () => {
             expect(mockProvider.discoverVpc).toHaveBeenCalledWith(config);
         });
 
-        it('should discover all VPC endpoints (S3, DynamoDB, KMS, Secrets Manager)', async () => {
+        it('should discover all VPC endpoints (S3, DynamoDB, KMS, Secrets Manager, SQS, SSM)', async () => {
             mockProvider.discoverVpc.mockResolvedValue({
                 vpcId: 'vpc-123',
                 vpcCidr: '10.0.0.0/16',
@@ -283,6 +283,22 @@ describe('VpcDiscovery', () => {
                         ServiceName: 'com.amazonaws.us-east-1.secretsmanager',
                         State: 'available',
                     },
+                    {
+                        VpcEndpointId: 'vpce-sqs-def',
+                        ServiceName: 'com.amazonaws.us-east-1.sqs',
+                        State: 'available',
+                    },
+                    // ssmmessages must NOT be mistaken for the ssm endpoint
+                    {
+                        VpcEndpointId: 'vpce-ssmmessages-000',
+                        ServiceName: 'com.amazonaws.us-east-1.ssmmessages',
+                        State: 'available',
+                    },
+                    {
+                        VpcEndpointId: 'vpce-ssm-ghi',
+                        ServiceName: 'com.amazonaws.us-east-1.ssm',
+                        State: 'available',
+                    },
                 ],
             });
 
@@ -292,6 +308,8 @@ describe('VpcDiscovery', () => {
             expect(result.dynamodbVpcEndpointId).toBe('vpce-ddb-456');
             expect(result.kmsVpcEndpointId).toBe('vpce-kms-789');
             expect(result.secretsManagerVpcEndpointId).toBe('vpce-sm-abc');
+            expect(result.sqsVpcEndpointId).toBe('vpce-sqs-def');
+            expect(result.ssmVpcEndpointId).toBe('vpce-ssm-ghi');
         });
 
         it('should handle partial VPC endpoint discovery', async () => {

package/infrastructure/domains/parameters/offload-utils.js

@@ -94,7 +94,7 @@ function getOffloadedKeys(appDefinition = {}) {
         keys.add(key);
     }
 
-    return [...keys].sort();
+    return [...keys].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
 }
 
 /**

package/infrastructure/domains/security/iam-generator.js

@@ -703,7 +703,10 @@ function generateIAMCloudFormation(options = {}) {
                                       },
                                   ],
                             Condition: {
-                                StringEquals: {
+                                // StringLike: kms:ViaService is regional
+                                // (ssm.us-east-1.amazonaws.com), so the wildcard
+                                // must be matched, not compared literally.
+                                StringLike: {
                                     'kms:ViaService': [
                                         'ssm.*.amazonaws.com',
                                     ],

package/infrastructure/domains/security/iam-generator.test.js

@@ -166,6 +166,16 @@ describe('IAM Generator', () => {
             expect(yaml).toContain('ssm.*.amazonaws.com');
             // No customer-managed key configured: falls back to the account key wildcard
             expect(yaml).toContain('arn:aws:kms:*:${AWS::AccountId}:key/*');
+
+            // The regional ViaService wildcard must be matched with StringLike;
+            // StringEquals would compare literally and never match
+            // ssm.<region>.amazonaws.com, denying the SecureString KMS call.
+            const ssmKmsBlock = yaml.slice(
+                yaml.indexOf('FriggSSMParameterKMSEncryption'),
+                yaml.indexOf('FriggSSMParameterKMSEncryption') + 600
+            );
+            expect(ssmKmsBlock).toContain('StringLike');
+            expect(ssmKmsBlock).not.toContain('StringEquals');
         });
 
         it('should scope the SSM KMS grant to ssm.kmsKeyArn when provided', () => {

package/infrastructure/domains/security/templates/frigg-deployment-iam-stack.yaml

@@ -375,7 +375,9 @@ Resources:
             Resource:
               - !Sub 'arn:aws:kms:*:${AWS::AccountId}:key/*'
             Condition:
-              StringEquals:
+              # StringLike: kms:ViaService is regional (ssm.us-east-1.amazonaws.com),
+              # so the wildcard must be matched, not compared literally.
+              StringLike:
                 'kms:ViaService':
                   - 'ssm.*.amazonaws.com'
 

package/infrastructure/domains/security/templates/iam-policy-full.json

@@ -264,7 +264,7 @@
         "arn:aws:kms:*:*:key/*"
       ],
       "Condition": {
-        "StringEquals": {
+        "StringLike": {
           "kms:ViaService": [
             "lambda.*.amazonaws.com",
             "s3.*.amazonaws.com",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.625.3f500f2.0",
+  "version": "2.0.0--canary.625.6bef7de.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -26,9 +26,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.625.3f500f2.0",
-    "@friggframework/schemas": "2.0.0--canary.625.3f500f2.0",
-    "@friggframework/test": "2.0.0--canary.625.3f500f2.0",
+    "@friggframework/core": "2.0.0--canary.625.6bef7de.0",
+    "@friggframework/schemas": "2.0.0--canary.625.6bef7de.0",
+    "@friggframework/test": "2.0.0--canary.625.6bef7de.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.18.0",
@@ -56,8 +56,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.625.3f500f2.0",
-    "@friggframework/prettier-config": "2.0.0--canary.625.3f500f2.0",
+    "@friggframework/eslint-config": "2.0.0--canary.625.6bef7de.0",
+    "@friggframework/prettier-config": "2.0.0--canary.625.6bef7de.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -89,5 +89,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "3f500f202c8dcf2210c07835c76abbab30e0d0ee"
+  "gitHead": "6bef7de84e4deea31c8dea40c177e2f7343eea4c"
 }