@friggframework/devtools 2.0.0-next.37 → 2.0.0-next.38

package/frigg-cli/generate-command/__tests__/generate-command.test.js

@@ -54,7 +54,7 @@ describe('Generate Command', () => {
         // Mock app definition
         jest.doMock(mockAppDefinitionPath, () => ({
             vpc: { enable: true },
-            encryption: { useDefaultKMSForFieldLevelEncryption: true },
+            encryption: { fieldLevelEncryptionMethod: 'kms' },
             ssm: { enable: true },
             websockets: { enable: false }
         }), { virtual: true });

package/frigg-cli/generate-command/index.js

@@ -228,7 +228,7 @@ async function generateCommand(options = {}) {
 function analyzeAppFeatures(appDefinition) {
     const features = {
         vpc: appDefinition.vpc?.enable === true,
-        kms: appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption === true,
+        kms: appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms',
         ssm: appDefinition.ssm?.enable === true,
         websockets: appDefinition.websockets?.enable === true,
         // Add more feature detection as needed

package/frigg-cli/init-command/backend-first-handler.js

@@ -670,7 +670,7 @@ To integrate Frigg into your production application:
             const appDefinition = {
                 integrations: [], // Will be populated based on selected integrations
                 user: { password: true },
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 vpc: { enable: true },
                 security: {
                     cors: {

package/infrastructure/AWS-DISCOVERY-TROUBLESHOOTING.md

@@ -9,7 +9,7 @@ AWS Discovery automatically finds your default AWS resources (VPC, subnets, secu
 AWS Discovery runs automatically during `frigg build` and `frigg deploy` when your AppDefinition includes:
 
 - `vpc.enable: true` - VPC support
-- `encryption.useDefaultKMSForFieldLevelEncryption: true` - KMS encryption
+- `encryption.fieldLevelEncryptionMethod: 'kms'` - KMS encryption
 - `ssm.enable: true` - SSM Parameter Store
 
 ## Fail-Fast Behavior
@@ -222,7 +222,7 @@ If you're stuck, try this recovery process:
    // backend/index.js - temporarily disable problematic features
    const appDefinition = {
        vpc: { enable: false },
-       encryption: { useDefaultKMSForFieldLevelEncryption: false },
+       encryption: { fieldLevelEncryptionMethod: 'aes' },
        ssm: { enable: false }
    };
    ```

package/infrastructure/AWS-IAM-CREDENTIAL-NEEDS.md

@@ -354,7 +354,7 @@ Additional permissions needed when your app definition includes `vpc: { enable:
 
 ### KMS Support
 
-Additional permissions needed when your app definition includes `encryption: { useDefaultKMSForFieldLevelEncryption: true }`:
+Additional permissions needed when your app definition includes `encryption: { fieldLevelEncryptionMethod: 'kms' }`:
 
 ```json
 {

package/infrastructure/GENERATE-IAM-DOCS.md

@@ -58,7 +58,7 @@ The command analyzes your `backend/index.js` AppDefinition and generates IAM pol
 -   Route table and security group management
 -   Elastic IP allocation
 
-#### KMS Encryption (`encryption.useDefaultKMSForFieldLevelEncryption: true`)
+#### KMS Encryption (`encryption.fieldLevelEncryptionMethod: 'kms'`)
 
 -   KMS key usage for Lambda and S3
 -   Data encryption and decryption permissions
@@ -85,7 +85,7 @@ const appDefinition = {
         enable: true,
     },
     encryption: {
-        useDefaultKMSForFieldLevelEncryption: true,
+        fieldLevelEncryptionMethod: 'kms',
     },
     ssm: {
         enable: false,

package/infrastructure/README.md

@@ -155,7 +155,8 @@ const appDefinition = {
 
   // KMS encryption
   encryption: {
-    useDefaultKMSForFieldLevelEncryption: true
+    fieldLevelEncryptionMethod: 'kms',
+    createResourceIfNoneFound: true
   },
 
   // SSM Parameter Store
@@ -217,7 +218,7 @@ const serverlessConfig = await composeServerlessDefinition(appDefinition);
 const appDefinition = {
     name: 'secure-app',
     vpc: { enable: true },
-    encryption: { useDefaultKMSForFieldLevelEncryption: true },
+    encryption: { fieldLevelEncryptionMethod: 'kms' },
     ssm: { enable: true },
     integrations: [{ Definition: { name: 'salesforce' } }],
 };

package/infrastructure/__tests__/fixtures/mock-aws-resources.js

@@ -151,7 +151,7 @@ const mockAppDefinitions = {
     
     kmsOnly: {
         name: 'kms-test-app',
-        encryption: { useDefaultKMSForFieldLevelEncryption: true },
+        encryption: { fieldLevelEncryptionMethod: 'kms' },
         integrations: []
     },
     
@@ -164,7 +164,7 @@ const mockAppDefinitions = {
     allFeatures: {
         name: 'full-feature-app',
         vpc: { enable: true },
-        encryption: { useDefaultKMSForFieldLevelEncryption: true },
+        encryption: { fieldLevelEncryptionMethod: 'kms' },
         ssm: { enable: true },
         integrations: [{
             Definition: {
@@ -281,7 +281,7 @@ const mockEnvironmentVariables = {
     AWS_DISCOVERY_SUBNET_ID_1: mockSubnets[0].SubnetId,
     AWS_DISCOVERY_SUBNET_ID_2: mockSubnets[1].SubnetId,
     AWS_DISCOVERY_ROUTE_TABLE_ID: mockRouteTables[0].RouteTableId,
-    AWS_DISCOVERY_KMS_KEY_ID: mockKmsKeyMetadata.Arn
+    AWS_DISCOVERY_KMS_KEY_ID:mockKmsKeyMetadata.Arn
 };
 
 // Fallback environment variables for error scenarios
@@ -291,7 +291,7 @@ const mockFallbackEnvironmentVariables = {
     AWS_DISCOVERY_SUBNET_ID_1: 'subnet-fallback-1',
     AWS_DISCOVERY_SUBNET_ID_2: 'subnet-fallback-2',
     AWS_DISCOVERY_ROUTE_TABLE_ID: 'rtb-fallback',
-    AWS_DISCOVERY_KMS_KEY_ID: 'arn:aws:kms:*:*:key/*'
+    AWS_DISCOVERY_KMS_KEY_ID:'arn:aws:kms:*:*:key/*'
 };
 
 // Mock AWS SDK responses

package/infrastructure/__tests__/helpers/test-utils.js

@@ -115,7 +115,7 @@ function createMockAppDefinition(features = {}, integrations = []) {
     }
 
     if (features.kms) {
-        appDefinition.encryption = { useDefaultKMSForFieldLevelEncryption: true };
+        appDefinition.encryption = { fieldLevelEncryptionMethod: 'kms' };
     }
 
     if (features.ssm) {

package/infrastructure/aws-discovery.js

@@ -453,18 +453,16 @@ class AWSDiscovery {
 
     /**
      * Find the default KMS key for the account
-     * @returns {Promise<string>} KMS key ARN or wildcard pattern as fallback
+     * @returns {Promise<string|null>} KMS key ARN or null if no key found
      */
     async findDefaultKmsKey() {
         try {
-            // First try to find a key with alias/aws/lambda
             const command = new ListKeysCommand({});
             const response = await this.kmsClient.send(command);
             
             if (!response.Keys || response.Keys.length === 0) {
-                // Return AWS managed key ARN pattern as fallback
-                const accountId = await this.getAccountId();
-                return `arn:aws:kms:${this.region}:${accountId}:key/*`;
+                console.log('No KMS keys found in account');
+                return null;
             }
 
             // Look for customer managed keys first
@@ -476,21 +474,21 @@ class AWSDiscovery {
                     if (keyDetails.KeyMetadata && 
                         keyDetails.KeyMetadata.KeyManager === 'CUSTOMER' &&
                         keyDetails.KeyMetadata.KeyState === 'Enabled') {
+                        console.log(`Found customer managed KMS key: ${keyDetails.KeyMetadata.Arn}`);
                         return keyDetails.KeyMetadata.Arn;
                     }
                 } catch (error) {
                     // Continue to next key if we can't describe this one
+                    console.warn(`Could not describe key ${key.KeyId}:`, error.message);
                     continue;
                 }
             }
 
-            // Fallback to wildcard pattern for AWS managed keys
-            const accountId = await this.getAccountId();
-            return `arn:aws:kms:${this.region}:${accountId}:key/*`;
+            console.log('No customer managed KMS keys found');
+            return null;
         } catch (error) {
             console.error('Error finding default KMS key:', error);
-            // Return wildcard pattern as ultimate fallback
-            return '*';
+            return null;
         }
     }
 
@@ -503,7 +501,7 @@ class AWSDiscovery {
      * @returns {string} return.privateSubnetId2 - Second private subnet ID
      * @returns {string} return.publicSubnetId - Public subnet ID for NAT Gateway
      * @returns {string} return.privateRouteTableId - Private route table ID
-     * @returns {string} return.defaultKmsKeyId - Default KMS key ARN
+     * @returns {string|null} return.defaultKmsKeyId - Default KMS key ARN or null if not found
      * @throws {Error} If resource discovery fails
      */
     async discoverResources() {
@@ -526,7 +524,11 @@ class AWSDiscovery {
             console.log(`Found route table: ${routeTable.RouteTableId}`);
             
             const kmsKeyArn = await this.findDefaultKmsKey();
-            console.log(`Found KMS key: ${kmsKeyArn}`);
+            if (kmsKeyArn) {
+                console.log(`Found KMS key: ${kmsKeyArn}`);
+            } else {
+                console.log('No KMS key found');
+            }
             
             // Try to find existing NAT Gateway
             const existingNatGateway = await this.findExistingNatGateway(vpc.VpcId);

package/infrastructure/build-time-discovery.js

@@ -137,8 +137,8 @@ class BuildTimeDiscovery {
             console.log('Running pre-build AWS discovery hook...');
             
             // Only run discovery if VPC, KMS, or SSM features are enabled
-            const needsDiscovery = appDefinition.vpc?.enable || 
-                                 appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ||
+            const needsDiscovery = appDefinition.vpc?.enable ||
+                                 appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms' ||
                                  appDefinition.ssm?.enable;
             
             if (!needsDiscovery) {
@@ -159,7 +159,7 @@ class BuildTimeDiscovery {
                 AWS_DISCOVERY_SUBNET_ID_2: resources.privateSubnetId2,
                 AWS_DISCOVERY_PUBLIC_SUBNET_ID: resources.publicSubnetId,
                 AWS_DISCOVERY_ROUTE_TABLE_ID: resources.privateRouteTableId,
-                AWS_DISCOVERY_KMS_KEY_ID: resources.defaultKmsKeyId
+                AWS_DISCOVERY_KMS_KEY_ID: resources.defaultKmsKeyId  // Keep consistent naming convention (even though it's an ARN)
             };
             
             // Set environment variables for serverless to use

package/infrastructure/build-time-discovery.test.js

@@ -250,7 +250,7 @@ describe('BuildTimeDiscovery', () => {
 
         it('should run discovery when KMS is enabled', async () => {
             const appDefinition = {
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 integrations: []
             };
 

package/infrastructure/iam-generator.js

@@ -35,7 +35,7 @@ function generateIAMCloudFormation(appDefinition, options = {}) {
             vpc: appDefinition.vpc?.enable === true,
             kms:
                 appDefinition.encryption
-                    ?.useDefaultKMSForFieldLevelEncryption === true,
+                    ?.fieldLevelEncryptionMethod === 'kms',
             ssm: appDefinition.ssm?.enable === true,
             websockets: appDefinition.websockets?.enable === true,
         };
@@ -605,6 +605,19 @@ function generateIAMCloudFormation(appDefinition, options = {}) {
                                 },
                             },
                         },
+                        {
+                            Sid: 'FriggKMSManagement',
+                            Effect: 'Allow',
+                            Action: [
+                                'kms:CreateKey',
+                                'kms:PutKeyPolicy',
+                                'kms:EnableKeyRotation',
+                                'kms:TagResource',
+                                'kms:UntagResource',
+                                'kms:ListResourceTags',
+                            ],
+                            Resource: '*',
+                        },
                     ],
                 },
             },
@@ -724,8 +737,7 @@ function getFeatureSummary(appDefinition) {
         core: true, // Always enabled
         vpc: appDefinition.vpc?.enable === true,
         kms:
-            appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ===
-            true,
+            appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms',
         ssm: appDefinition.ssm?.enable === true,
         websockets: appDefinition.websockets?.enable === true,
     };

package/infrastructure/iam-generator.test.js

@@ -7,7 +7,7 @@ describe('IAM Generator', () => {
                 name: 'test-app',
                 integrations: ['Integration1', 'Integration2'],
                 vpc: { enable: true },
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 ssm: { enable: true },
                 websockets: { enable: true }
             };
@@ -46,7 +46,7 @@ describe('IAM Generator', () => {
                 name: 'test-app',
                 integrations: [],
                 vpc: { enable: false },
-                encryption: { useDefaultKMSForFieldLevelEncryption: false },
+                encryption: { fieldLevelEncryptionMethod: 'aes' },
                 ssm: { enable: false },
                 websockets: { enable: false }
             };
@@ -77,7 +77,7 @@ describe('IAM Generator', () => {
             const appDefinition = {
                 name: 'test-app',
                 integrations: [],
-                encryption: { useDefaultKMSForFieldLevelEncryption: true }
+                encryption: { fieldLevelEncryptionMethod: 'kms' }
             };
 
             const yaml = generateIAMCloudFormation(appDefinition);
@@ -106,7 +106,7 @@ describe('IAM Generator', () => {
                 name: 'test-app',
                 integrations: [],
                 vpc: { enable: true },
-                encryption: { useDefaultKMSForFieldLevelEncryption: false },
+                encryption: { fieldLevelEncryptionMethod: 'aes' },
                 ssm: { enable: true }
             };
 

package/infrastructure/integration.test.js

@@ -49,7 +49,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             const appDefinition = {
                 name: 'test-frigg-app',
                 vpc: { enable: true },
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 ssm: { enable: true },
                 integrations: [{
                     Definition: {
@@ -67,7 +67,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             process.env.AWS_DISCOVERY_SUBNET_ID_1 = discoveredResources.privateSubnetId1;
             process.env.AWS_DISCOVERY_SUBNET_ID_2 = discoveredResources.privateSubnetId2;
             process.env.AWS_DISCOVERY_ROUTE_TABLE_ID = discoveredResources.privateRouteTableId;
-            process.env.AWS_DISCOVERY_KMS_KEY_ID = discoveredResources.defaultKmsKeyId;
+            process.env.AWS_DISCOVERY_KMS_KEY_ID =discoveredResources.defaultKmsKeyId;
 
             // Generate serverless configuration
             const serverlessConfig = composeServerlessDefinition(appDefinition);
@@ -173,11 +173,11 @@ describe('VPC/KMS/SSM Integration Tests', () => {
         it('should generate config with only KMS enabled', async () => {
             const appDefinition = {
                 name: 'kms-only-app',
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 integrations: []
             };
 
-            process.env.AWS_DISCOVERY_KMS_KEY_ID = mockAWSResources.defaultKmsKeyId;
+            process.env.AWS_DISCOVERY_KMS_KEY_ID =mockAWSResources.defaultKmsKeyId;
 
             const serverlessConfig = composeServerlessDefinition(appDefinition);
 
@@ -231,7 +231,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             expect(mockBuildTimeDiscovery.preBuildHook).toHaveBeenCalledWith(
                 expect.objectContaining({
                     vpc: { enable: true },
-                    encryption: { useDefaultKMSForFieldLevelEncryption: true }
+                    encryption: { fieldLevelEncryptionMethod: 'kms' }
                 }),
                 'us-east-1'
             );
@@ -302,7 +302,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
             process.env.AWS_DISCOVERY_SECURITY_GROUP_ID = mockAWSResources.defaultSecurityGroupId;
             process.env.AWS_DISCOVERY_SUBNET_ID_1 = mockAWSResources.privateSubnetId1;
             process.env.AWS_DISCOVERY_SUBNET_ID_2 = mockAWSResources.privateSubnetId2;
-            process.env.AWS_DISCOVERY_KMS_KEY_ID = mockAWSResources.defaultKmsKeyId;
+            process.env.AWS_DISCOVERY_KMS_KEY_ID =mockAWSResources.defaultKmsKeyId;
 
             // In a real deployment, serverless framework would resolve these environment variables
             // For testing, we can verify the placeholders are correctly formatted
@@ -353,7 +353,7 @@ describe('VPC/KMS/SSM Integration Tests', () => {
 
             const appDefinition = {
                 vpc: { enable: true },
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 integrations: []
             };
 

package/infrastructure/run-discovery.js

@@ -41,7 +41,7 @@ async function runDiscovery() {
 
         // Check if discovery is needed
         const needsDiscovery = appDefinition.vpc?.enable || 
-                              appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ||
+                              appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms' ||
                               appDefinition.ssm?.enable;
         
         if (!needsDiscovery) {
@@ -51,7 +51,7 @@ async function runDiscovery() {
 
         console.log('📋 App requires AWS discovery for:');
         if (appDefinition.vpc?.enable) console.log('   ✅ VPC support');
-        if (appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption) console.log('   ✅ KMS encryption');
+        if (appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') console.log('   ✅ KMS encryption');
         if (appDefinition.ssm?.enable) console.log('   ✅ SSM parameters');
 
         // Run discovery
@@ -82,7 +82,7 @@ async function runDiscovery() {
         } else {
             console.error('🚨 Discovery is required because your AppDefinition has these features enabled:');
             if (appDefinition.vpc?.enable) console.error('   ❌ VPC support (vpc.enable: true)');
-            if (appDefinition.encryption?.useDefaultKMSForFieldLevelEncryption) console.error('   ❌ KMS encryption (encryption.useDefaultKMSForFieldLevelEncryption: true)');
+            if (appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') console.error('   ❌ KMS encryption (encryption.fieldLevelEncryptionMethod: \'kms\')');
             if (appDefinition.ssm?.enable) console.error('   ❌ SSM parameters (ssm.enable: true)');
             console.error('');
             console.error('💡 To fix this issue:');
@@ -95,7 +95,7 @@ async function runDiscovery() {
         
         console.error('🔧 Or disable features in backend/index.js:');
         console.error('   vpc: { enable: false }');
-        console.error('   encryption: { useDefaultKMSForFieldLevelEncryption: false }');
+        console.error('   encryption: { fieldLevelEncryptionMethod: \'aes\' }');
         console.error('   ssm: { enable: false }');
         
         process.exit(1);

package/infrastructure/serverless-template.js

@@ -10,8 +10,7 @@ const { AWSDiscovery } = require('./aws-discovery');
 const shouldRunDiscovery = (AppDefinition) => {
     return (
         AppDefinition.vpc?.enable === true ||
-        AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ===
-            true ||
+        AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms' ||
         AppDefinition.ssm?.enable === true
     );
 };
@@ -493,10 +492,7 @@ const createVPCInfrastructure = (AppDefinition) => {
         };
 
         // KMS Interface Endpoint (paid, but useful if using KMS)
-        if (
-            AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption ===
-            true
-        ) {
+        if (AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
             vpcResources.FriggKMSVPCEndpoint = {
                 Type: 'AWS::EC2::VPCEndpoint',
                 Properties: {
@@ -891,9 +887,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
     };
 
     // KMS Configuration based on App Definition
-    if (
-        AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption === true
-    ) {
+    if (AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
         // Check if a KMS key was discovered
         if (discoveredResources.defaultKmsKeyId) {
             // Use the existing discovered KMS key
@@ -907,55 +901,112 @@ const composeServerlessDefinition = async (AppDefinition) => {
                 Resource: [discoveredResources.defaultKmsKeyId],
             });
 
-            definition.provider.environment.KMS_KEY_ARN =
-                discoveredResources.defaultKmsKeyId;
+            // KMS_KEY_ARN will be set later from custom.kmsGrants for consistency
         } else {
-            // No existing key found, provision a dedicated KMS key
-            console.log('No existing KMS key found, creating a new one...');
+            // No existing key found - check if we should create one or error
+            if (AppDefinition.encryption?.createResourceIfNoneFound === true) {
+                // Create a new KMS key
+                console.log('No existing KMS key found, creating a new one...');
 
-            definition.resources.Resources.FriggKMSKey = {
-                Type: 'AWS::KMS::Key',
-                Properties: {
-                    EnableKeyRotation: true,
-                    KeyPolicy: {
-                        Version: '2012-10-17',
-                        Statement: [
-                            {
-                                Sid: 'AllowRootAccountAdmin',
-                                Effect: 'Allow',
-                                Principal: {
-                                    AWS: {
-                                        'Fn::Sub':
-                                            'arn:aws:iam::${AWS::AccountId}:root',
+                definition.resources.Resources.FriggKMSKey = {
+                    Type: 'AWS::KMS::Key',
+                    Properties: {
+                        EnableKeyRotation: true,
+                        Description: 'Frigg KMS key for field-level encryption',
+                        KeyPolicy: {
+                            Version: '2012-10-17',
+                            Statement: [
+                                {
+                                    Sid: 'AllowRootAccountAdmin',
+                                    Effect: 'Allow',
+                                    Principal: {
+                                        AWS: {
+                                            'Fn::Sub':
+                                                'arn:aws:iam::${AWS::AccountId}:root',
+                                        },
+                                    },
+                                    Action: 'kms:*',
+                                    Resource: '*',
+                                },
+                                {
+                                    Sid: 'AllowLambdaService',
+                                    Effect: 'Allow',
+                                    Principal: {
+                                        Service: 'lambda.amazonaws.com',
+                                    },
+                                    Action: [
+                                        'kms:GenerateDataKey',
+                                        'kms:Decrypt',
+                                        'kms:DescribeKey',
+                                    ],
+                                    Resource: '*',
+                                    Condition: {
+                                        StringEquals: {
+                                            'kms:ViaService': `lambda.${
+                                                process.env.AWS_REGION ||
+                                                'us-east-1'
+                                            }.amazonaws.com`,
+                                        },
                                     },
                                 },
-                                Action: 'kms:*',
-                                Resource: '*',
+                            ],
+                        },
+                        Tags: [
+                            {
+                                Key: 'Name',
+                                Value: '${self:service}-${self:provider.stage}-frigg-kms-key',
+                            },
+                            {
+                                Key: 'Purpose',
+                                Value: 'Field-level encryption for Frigg application',
                             },
                         ],
                     },
-                },
-            };
+                };
 
-            definition.provider.iamRoleStatements.push({
-                Effect: 'Allow',
-                Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
-                Resource: [{ 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }],
-            });
+                definition.provider.iamRoleStatements.push({
+                    Effect: 'Allow',
+                    Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
+                    Resource: [{ 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }],
+                });
 
-            definition.provider.environment.KMS_KEY_ARN = {
-                'Fn::GetAtt': ['FriggKMSKey', 'Arn'],
-            };
+                definition.provider.environment.KMS_KEY_ARN = {
+                    'Fn::GetAtt': ['FriggKMSKey', 'Arn'],
+                };
+
+                // Configure KMS grants to reference the created key
+                definition.custom.kmsGrants = {
+                    kmsKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }
+                };
+            } else {
+                // No key found and createIfNoneFound is not enabled - error
+                throw new Error(
+                    'KMS field-level encryption is enabled but no KMS key was found. ' +
+                        'Either provide an existing KMS key or set encryption.createResourceIfNoneFound to true to create a new key.'
+                );
+            }
         }
 
         definition.plugins.push('serverless-kms-grants');
 
-        // Configure KMS grants with discovered default key or environment variable
-        definition.custom.kmsGrants = {
-            kmsKeyId:
+        // Configure KMS grants if not already set (when using existing key)
+        if (!definition.custom.kmsGrants) {
+            definition.custom.kmsGrants = {
+                kmsKeyId:
+                    discoveredResources.defaultKmsKeyId ||
+                    '${env:AWS_DISCOVERY_KMS_KEY_ID}',
+            };
+        }
+
+        // Always set KMS_KEY_ARN from custom.kmsGrants for consistency
+        // This translates AWS_DISCOVERY_KMS_KEY_ID to the runtime variable KMS_KEY_ARN
+        if (!definition.provider.environment.KMS_KEY_ARN) {
+            // Use the discovered value directly when available (from in-process discovery)
+            // Otherwise fall back to environment variable (from separate discovery process)
+            definition.provider.environment.KMS_KEY_ARN =
                 discoveredResources.defaultKmsKeyId ||
-                '${env:AWS_DISCOVERY_KMS_KEY_ID}',
-        };
+                '${env:AWS_DISCOVERY_KMS_KEY_ID}';
+        }
     }
 
     // VPC Configuration based on App Definition
@@ -1252,62 +1303,6 @@ const composeServerlessDefinition = async (AppDefinition) => {
                 definition.custom[queueReference] = queueName;
             }
         }
-
-        // Discovery has already run successfully at this point if needed
-        // The discoveredResources object contains all the necessary AWS resources
-
-        // Add websocket function if enabled
-        if (AppDefinition.websockets?.enable === true) {
-            definition.functions.defaultWebsocket = {
-                handler:
-                    'node_modules/@friggframework/core/handlers/routers/websocket.handler',
-                events: [
-                    {
-                        websocket: {
-                            route: '$connect',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$default',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$disconnect',
-                        },
-                    },
-                ],
-            };
-        }
-
-        // Discovery has already run successfully at this point if needed
-        // The discoveredResources object contains all the necessary AWS resources
-
-        // Add websocket function if enabled
-        if (AppDefinition.websockets?.enable === true) {
-            definition.functions.defaultWebsocket = {
-                handler:
-                    'node_modules/@friggframework/core/handlers/routers/websocket.handler',
-                events: [
-                    {
-                        websocket: {
-                            route: '$connect',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$default',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$disconnect',
-                        },
-                    },
-                ],
-            };
-        }
     }
 
     // Discovery has already run successfully at this point if needed
@@ -1338,9 +1333,6 @@ const composeServerlessDefinition = async (AppDefinition) => {
         };
     }
 
-    // Discovery has already run successfully at this point if needed
-    // The discoveredResources object contains all the necessary AWS resources
-
     // Modify handler paths to point to the correct node_modules location
     definition.functions = modifyHandlerPaths(definition.functions);
 

package/infrastructure/serverless-template.test.js

@@ -118,16 +118,9 @@ describe('composeServerlessDefinition', () => {
 
             const result = await composeServerlessDefinition(appDefinition);
 
-            expect(result.provider.vpc).toBe('${self:custom.vpc.${self:provider.stage}}');
-            expect(result.custom.vpc).toEqual({
-                '${self:provider.stage}': {
-                    securityGroupIds: ['${env:AWS_DISCOVERY_SECURITY_GROUP_ID}'],
-                    subnetIds: [
-                        '${env:AWS_DISCOVERY_SUBNET_ID_1}',
-                        '${env:AWS_DISCOVERY_SUBNET_ID_2}'
-                    ]
-                }
-            });
+            expect(result.provider.vpc).toBeDefined();
+            expect(result.provider.vpc.securityGroupIds).toEqual(['sg-123456']);
+            expect(result.provider.vpc.subnetIds).toEqual(['subnet-123456', 'subnet-789012']);
         });
 
         it('should add VPC endpoint for S3 when VPC is enabled', async () => {
@@ -138,15 +131,9 @@ describe('composeServerlessDefinition', () => {
 
             const result = await composeServerlessDefinition(appDefinition);
 
-            expect(result.resources.Resources.VPCEndpointS3).toEqual({
-                Type: 'AWS::EC2::VPCEndpoint',
-                Properties: {
-                    VpcId: '${env:AWS_DISCOVERY_VPC_ID}',
-                    ServiceName: 'com.amazonaws.${self:provider.region}.s3',
-                    VpcEndpointType: 'Gateway',
-                    RouteTableIds: ['${env:AWS_DISCOVERY_ROUTE_TABLE_ID}']
-                }
-            });
+            expect(result.resources.Resources.VPCEndpointS3).toBeDefined();
+            expect(result.resources.Resources.VPCEndpointS3.Type).toBe('AWS::EC2::VPCEndpoint');
+            expect(result.resources.Resources.VPCEndpointS3.Properties.VpcId).toBe('vpc-123456');
         });
 
         it('should not add VPC configuration when vpc.enable is false', async () => {
@@ -158,7 +145,6 @@ describe('composeServerlessDefinition', () => {
             const result = await composeServerlessDefinition(appDefinition);
 
             expect(result.provider.vpc).toBeUndefined();
-            expect(result.custom.vpc).toBeUndefined();
             expect(result.resources.Resources.VPCEndpointS3).toBeUndefined();
         });
 
@@ -170,14 +156,13 @@ describe('composeServerlessDefinition', () => {
             const result = await composeServerlessDefinition(appDefinition);
 
             expect(result.provider.vpc).toBeUndefined();
-            expect(result.custom.vpc).toBeUndefined();
         });
     });
 
     describe('KMS Configuration', () => {
-        it('should add KMS configuration when encryption is enabled', async () => {
+        it('should add KMS configuration when encryption is enabled and key is found', async () => {
             const appDefinition = {
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 integrations: []
             };
 
@@ -193,24 +178,188 @@ describe('composeServerlessDefinition', () => {
                     'kms:GenerateDataKey',
                     'kms:Decrypt'
                 ],
-                Resource: ['${self:custom.kmsGrants.kmsKeyId}']
+                Resource: ['arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012']
             });
 
             // Check environment variable
-            expect(result.provider.environment.KMS_KEY_ARN).toBe('${self:custom.kmsGrants.kmsKeyId}');
+            expect(result.provider.environment.KMS_KEY_ARN).toBe('arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012');
 
             // Check plugin
             expect(result.plugins).toContain('serverless-kms-grants');
 
             // Check custom configuration
             expect(result.custom.kmsGrants).toEqual({
-                kmsKeyId: '${env:AWS_DISCOVERY_KMS_KEY_ID}'
+                kmsKeyId: 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012'
+            });
+        });
+
+        it('should create new KMS key when encryption is enabled, no key found, and createResourceIfNoneFound is true', async () => {
+            // Mock AWS discovery to return no KMS key
+            const { AWSDiscovery } = require('./aws-discovery');
+            const mockDiscoverResources = jest.fn().mockResolvedValue({
+                defaultVpcId: 'vpc-123456',
+                defaultSecurityGroupId: 'sg-123456',
+                privateSubnetId1: 'subnet-123456',
+                privateSubnetId2: 'subnet-789012',
+                publicSubnetId: 'subnet-public',
+                defaultRouteTableId: 'rtb-123456',
+                defaultKmsKeyId: null // No KMS key found
+            });
+            AWSDiscovery.mockImplementation(() => ({
+                discoverResources: mockDiscoverResources
+            }));
+
+            const appDefinition = {
+                encryption: {
+                    fieldLevelEncryptionMethod: 'kms',
+                    createResourceIfNoneFound: true
+                },
+                integrations: []
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            // Check that KMS key resource was created
+            expect(result.resources.Resources.FriggKMSKey).toEqual({
+                Type: 'AWS::KMS::Key',
+                Properties: {
+                    EnableKeyRotation: true,
+                    Description: 'Frigg KMS key for field-level encryption',
+                    KeyPolicy: {
+                        Version: '2012-10-17',
+                        Statement: [
+                            {
+                                Sid: 'AllowRootAccountAdmin',
+                                Effect: 'Allow',
+                                Principal: {
+                                    AWS: {
+                                        'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:root'
+                                    }
+                                },
+                                Action: 'kms:*',
+                                Resource: '*'
+                            },
+                            {
+                                Sid: 'AllowLambdaService',
+                                Effect: 'Allow',
+                                Principal: {
+                                    Service: 'lambda.amazonaws.com'
+                                },
+                                Action: [
+                                    'kms:GenerateDataKey',
+                                    'kms:Decrypt',
+                                    'kms:DescribeKey'
+                                ],
+                                Resource: '*',
+                                Condition: {
+                                    StringEquals: {
+                                        'kms:ViaService': 'lambda.us-east-1.amazonaws.com'
+                                    }
+                                }
+                            }
+                        ]
+                    },
+                    Tags: [
+                        {
+                            Key: 'Name',
+                            Value: '${self:service}-${self:provider.stage}-frigg-kms-key'
+                        },
+                        {
+                            Key: 'Purpose',
+                            Value: 'Field-level encryption for Frigg application'
+                        }
+                    ]
+                }
+            });
+
+            // Check IAM permissions for the new key
+            const kmsPermission = result.provider.iamRoleStatements.find(
+                statement => statement.Action.includes('kms:GenerateDataKey')
+            );
+            expect(kmsPermission).toEqual({
+                Effect: 'Allow',
+                Action: ['kms:GenerateDataKey', 'kms:Decrypt'],
+                Resource: [{ 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }]
+            });
+
+            // Check environment variable
+            expect(result.provider.environment.KMS_KEY_ARN).toEqual({
+                'Fn::GetAtt': ['FriggKMSKey', 'Arn']
+            });
+
+            // Check plugin
+            expect(result.plugins).toContain('serverless-kms-grants');
+
+            // Check custom configuration
+            // When creating a new key, it should reference the CloudFormation resource
+            expect(result.custom.kmsGrants).toEqual({
+                kmsKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] }
+            });
+        });
+
+        it('should throw error when encryption is enabled, no key found, and createResourceIfNoneFound is false', async () => {
+            // Mock AWS discovery to return no KMS key
+            const { AWSDiscovery } = require('./aws-discovery');
+            const mockDiscoverResources = jest.fn().mockResolvedValue({
+                defaultVpcId: 'vpc-123456',
+                defaultSecurityGroupId: 'sg-123456',
+                privateSubnetId1: 'subnet-123456',
+                privateSubnetId2: 'subnet-789012',
+                publicSubnetId: 'subnet-public',
+                defaultRouteTableId: 'rtb-123456',
+                defaultKmsKeyId: null // No KMS key found
+            });
+            AWSDiscovery.mockImplementation(() => ({
+                discoverResources: mockDiscoverResources
+            }));
+
+            const appDefinition = {
+                encryption: {
+                    fieldLevelEncryptionMethod: 'kms',
+                    createResourceIfNoneFound: false
+                },
+                integrations: []
+            };
+
+            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow(
+                'KMS field-level encryption is enabled but no KMS key was found. ' +
+                'Either provide an existing KMS key or set encryption.createResourceIfNoneFound to true to create a new key.'
+            );
+        });
+
+        it('should throw error when encryption is enabled, no key found, and createResourceIfNoneFound is not specified', async () => {
+            // Mock AWS discovery to return no KMS key
+            const { AWSDiscovery } = require('./aws-discovery');
+            const mockDiscoverResources = jest.fn().mockResolvedValue({
+                defaultVpcId: 'vpc-123456',
+                defaultSecurityGroupId: 'sg-123456',
+                privateSubnetId1: 'subnet-123456',
+                privateSubnetId2: 'subnet-789012',
+                publicSubnetId: 'subnet-public',
+                defaultRouteTableId: 'rtb-123456',
+                defaultKmsKeyId: null // No KMS key found
             });
+            AWSDiscovery.mockImplementation(() => ({
+                discoverResources: mockDiscoverResources
+            }));
+
+            const appDefinition = {
+                encryption: {
+                    fieldLevelEncryptionMethod: 'kms'
+                    // createResourceIfNoneFound not specified, defaults to false
+                },
+                integrations: []
+            };
+
+            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow(
+                'KMS field-level encryption is enabled but no KMS key was found. ' +
+                'Either provide an existing KMS key or set encryption.createResourceIfNoneFound to true to create a new key.'
+            );
         });
 
         it('should not add KMS configuration when encryption is disabled', async () => {
             const appDefinition = {
-                encryption: { useDefaultKMSForFieldLevelEncryption: false },
+                encryption: { fieldLevelEncryptionMethod: 'aes' },
                 integrations: []
             };
 
@@ -315,10 +464,9 @@ describe('composeServerlessDefinition', () => {
             expect(result.functions.testIntegration).toEqual({
                 handler: 'node_modules/@friggframework/core/handlers/routers/integration-defined-routers.handlers.testIntegration.handler',
                 events: [{
-                    http: {
+                    httpApi: {
                         path: '/api/testIntegration-integration/{proxy+}',
-                        method: 'ANY',
-                        cors: true
+                        method: 'ANY'
                     }
                 }]
             });
@@ -389,7 +537,7 @@ describe('composeServerlessDefinition', () => {
         it('should combine VPC, KMS, and SSM configurations', async () => {
             const appDefinition = {
                 vpc: { enable: true },
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 ssm: { enable: true },
                 integrations: [mockIntegration]
             };
@@ -398,7 +546,7 @@ describe('composeServerlessDefinition', () => {
 
             // VPC
             expect(result.provider.vpc).toBeDefined();
-            expect(result.custom.vpc).toBeDefined();
+            // custom.vpc doesn't exist in the serverless template
             expect(result.resources.Resources.VPCEndpointS3).toBeDefined();
 
             // KMS
@@ -428,7 +576,7 @@ describe('composeServerlessDefinition', () => {
         it('should handle partial configuration combinations', async () => {
             const appDefinition = {
                 vpc: { enable: true },
-                encryption: { useDefaultKMSForFieldLevelEncryption: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
                 integrations: []
             };
 
@@ -459,9 +607,9 @@ describe('composeServerlessDefinition', () => {
             expect(result.resources.Resources.ApiGatewayAlarm5xx).toBeDefined();
 
             // Check default functions
-            expect(result.functions.defaultWebsocket).toBeDefined();
             expect(result.functions.auth).toBeDefined();
             expect(result.functions.user).toBeDefined();
+            expect(result.functions.health).toBeDefined();
 
             // Check default plugins
             expect(result.plugins).toContain('serverless-jetpack');
@@ -496,11 +644,64 @@ describe('composeServerlessDefinition', () => {
 
             const result = await composeServerlessDefinition(appDefinition);
 
-            expect(result.provider.environment.STAGE).toBe('${opt:stage}');
+            expect(result.provider.environment.STAGE).toBe('${opt:stage, "dev"}');
             expect(result.provider.environment.AWS_NODEJS_CONNECTION_REUSE_ENABLED).toBe(1);
         });
     });
 
+    describe('WebSocket Configuration', () => {
+        it('should add websocket function when websockets.enable is true', async () => {
+            const appDefinition = {
+                websockets: { enable: true },
+                integrations: []
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.functions.defaultWebsocket).toEqual({
+                handler: 'node_modules/@friggframework/core/handlers/routers/websocket.handler',
+                events: [
+                    {
+                        websocket: {
+                            route: '$connect',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$default',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$disconnect',
+                        },
+                    },
+                ],
+            });
+        });
+
+        it('should not add websocket function when websockets.enable is false', async () => {
+            const appDefinition = {
+                websockets: { enable: false },
+                integrations: []
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.functions.defaultWebsocket).toBeUndefined();
+        });
+
+        it('should not add websocket function when websockets is not defined', async () => {
+            const appDefinition = {
+                integrations: []
+            };
+
+            const result = await composeServerlessDefinition(appDefinition);
+
+            expect(result.functions.defaultWebsocket).toBeUndefined();
+        });
+    });
+
     describe('Edge Cases', () => {
         it('should handle empty app definition', async () => {
             const appDefinition = {};
@@ -515,7 +716,9 @@ describe('composeServerlessDefinition', () => {
                 integrations: null
             };
 
-            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow();
+            // Should not throw, just ignore invalid integrations
+            const result = await composeServerlessDefinition(appDefinition);
+            expect(result).toBeDefined();
         });
 
         it('should handle integration with missing Definition', async () => {
@@ -524,7 +727,7 @@ describe('composeServerlessDefinition', () => {
                 integrations: [invalidIntegration]
             };
 
-            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow();
+            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow('Invalid integration: missing Definition or name');
         });
 
         it('should handle integration with missing name', async () => {
@@ -535,7 +738,7 @@ describe('composeServerlessDefinition', () => {
                 integrations: [invalidIntegration]
             };
 
-            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow();
+            await expect(composeServerlessDefinition(appDefinition)).rejects.toThrow('Invalid integration: missing Definition or name');
         });
     });
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0-next.37",
+  "version": "2.0.0-next.38",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0-next.37",
-    "@friggframework/test": "2.0.0-next.37",
+    "@friggframework/schemas": "2.0.0-next.38",
+    "@friggframework/test": "2.0.0-next.38",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,8 +32,9 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0-next.37",
-    "@friggframework/prettier-config": "2.0.0-next.37",
+    "@friggframework/eslint-config": "2.0.0-next.38",
+    "@friggframework/prettier-config": "2.0.0-next.38",
+    "jest": "^30.1.3",
     "prettier": "^2.7.1",
     "serverless": "3.39.0",
     "serverless-dotenv-plugin": "^6.0.0",
@@ -65,5 +66,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "39f0a48fa6bd17c4b8c5caba58c88edc6d6fdd1f"
+  "gitHead": "a9c9c28fd9abdc8c96a38b8ab0fbb3cbf7d89960"
 }