@friggframework/devtools 2.0.0-next.39 → 2.0.0-next.40

package/infrastructure/aws-discovery.js

@@ -1,34 +1,49 @@
-let EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand;
+let EC2Client,
+    DescribeVpcsCommand,
+    DescribeSubnetsCommand,
+    DescribeSecurityGroupsCommand,
+    DescribeRouteTablesCommand,
+    DescribeNatGatewaysCommand,
+    DescribeAddressesCommand,
+    DescribeInternetGatewaysCommand;
 let KMSClient, ListKeysCommand, DescribeKeyCommand;
 let STSClient, GetCallerIdentityCommand;
 
 function loadEC2() {
     if (!EC2Client) {
-        ({ EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand } = require('@aws-sdk/client-ec2'));
+        ({
+            EC2Client,
+            DescribeVpcsCommand,
+            DescribeSubnetsCommand,
+            DescribeSecurityGroupsCommand,
+            DescribeRouteTablesCommand,
+            DescribeNatGatewaysCommand,
+            DescribeAddressesCommand,
+            DescribeInternetGatewaysCommand,
+        } = require('@aws-sdk/client-ec2'));
     }
 }
 
 function loadKMS() {
     if (!KMSClient) {
-        ({ KMSClient, ListKeysCommand, DescribeKeyCommand } = require('@aws-sdk/client-kms'));
+        ({
+            KMSClient,
+            ListKeysCommand,
+            DescribeKeyCommand,
+        } = require('@aws-sdk/client-kms'));
     }
 }
 
 function loadSTS() {
     if (!STSClient) {
-        ({ STSClient, GetCallerIdentityCommand } = require('@aws-sdk/client-sts'));
+        ({
+            STSClient,
+            GetCallerIdentityCommand,
+        } = require('@aws-sdk/client-sts'));
     }
 }
 
-/**
- * AWS Resource Discovery utilities for Frigg applications
- * These functions use AWS credentials to discover default resources during build time
- */
 class AWSDiscovery {
-    /**
-     * Creates an instance of AWSDiscovery
-     * @param {string} [region='us-east-1'] - AWS region to use for discovery
-     */
     constructor(region = 'us-east-1') {
         this.region = region;
         loadEC2();
@@ -39,11 +54,6 @@ class AWSDiscovery {
         this.stsClient = new STSClient({ region });
     }
 
-    /**
-     * Get AWS account ID
-     * @returns {Promise<string>} The AWS account ID
-     * @throws {Error} If unable to retrieve account ID
-     */
     async getAccountId() {
         try {
             const command = new GetCallerIdentityCommand({});
@@ -55,37 +65,31 @@ class AWSDiscovery {
         }
     }
 
-    /**
-     * Find the default VPC for the account
-     * @returns {Promise<Object>} VPC object containing VpcId and other properties
-     * @throws {Error} If no VPC is found in the account
-     */
     async findDefaultVpc() {
         try {
             const command = new DescribeVpcsCommand({
                 Filters: [
                     {
                         Name: 'is-default',
-                        Values: ['true']
-                    }
-                ]
+                        Values: ['true'],
+                    },
+                ],
             });
-            
+
             const response = await this.ec2Client.send(command);
-            
+
             if (response.Vpcs && response.Vpcs.length > 0) {
                 return response.Vpcs[0];
             }
-            
-            // If no default VPC, get the first available VPC
+
             const allVpcsCommand = new DescribeVpcsCommand({});
             const allVpcsResponse = await this.ec2Client.send(allVpcsCommand);
-            
+
             if (allVpcsResponse.Vpcs && allVpcsResponse.Vpcs.length > 0) {
                 console.log('No default VPC found, using first available VPC');
                 return allVpcsResponse.Vpcs[0];
             }
-            
+
             throw new Error('No VPC found in the account');
         } catch (error) {
             console.error('Error finding default VPC:', error.message);
@@ -93,179 +97,94 @@ class AWSDiscovery {
         }
     }
 
-    /**
-     * Find private subnets for the given VPC
-     * @param {string} vpcId - The VPC ID to search within
-     * @returns {Promise<Array>} Array of subnet objects (at least 2 for high availability)
-     * @throws {Error} If no subnets are found in the VPC
-     */
-    async findPrivateSubnets(vpcId) {
+    async findPrivateSubnets(vpcId, autoConvert = false) {
         try {
-            const command = new DescribeSubnetsCommand({
-                Filters: [
-                    {
-                        Name: 'vpc-id',
-                        Values: [vpcId]
-                    }
-                ]
-            });
-            
-            const response = await this.ec2Client.send(command);
-            
-            if (!response.Subnets || response.Subnets.length === 0) {
+            const subnets = await this._fetchSubnets(vpcId);
+
+            if (subnets.length === 0) {
                 throw new Error(`No subnets found in VPC ${vpcId}`);
             }
 
-            // Prefer private subnets (no direct route to IGW)
-            const privateSubnets = [];
-            const publicSubnets = [];
+            console.log(`\n🔍 Analyzing ${subnets.length} subnets in VPC ${vpcId}...`);
 
-            for (const subnet of response.Subnets) {
-                // Check route tables to determine if subnet is private
-                const isPrivate = await this.isSubnetPrivate(subnet.SubnetId);
-                if (isPrivate) {
-                    privateSubnets.push(subnet);
-                } else {
-                    publicSubnets.push(subnet);
-                }
-            }
+            const { privateSubnets, publicSubnets } = await this._classifySubnets(
+                subnets,
+                { logDetails: true }
+            );
+
+            this._logSubnetSummary(privateSubnets.length, publicSubnets.length);
+
+            const selection = this._selectSubnetsForLambda({
+                privateSubnets,
+                publicSubnets,
+                autoConvert,
+                vpcId,
+            });
 
-            // Return at least 2 subnets for high availability
-            const selectedSubnets = privateSubnets.length >= 2 ? 
-                privateSubnets.slice(0, 2) : 
-                response.Subnets.slice(0, 2);
+            if (selection) {
+                return selection;
+            }
 
-            return selectedSubnets;
+            throw new Error(`No subnets found in VPC ${vpcId}`);
         } catch (error) {
             console.error('Error finding private subnets:', error);
             throw error;
         }
     }
 
-    /**
-     * Check if a subnet is private (no direct route to Internet Gateway)
-     * @param {string} subnetId - The subnet ID to check
-     * @returns {Promise<boolean>} True if subnet is private, false if public
-     */
-    async isSubnetPrivate(subnetId) {
+    async isSubnetPublic(subnetId, vpcId) {
+        const isPrivate = await this.isSubnetPrivate(subnetId, vpcId);
+        return !isPrivate;
+    }
+
+    async isSubnetPrivate(subnetId, vpcId) {
         try {
-            // First, get the subnet details to find its VPC
-            const subnetCommand = new DescribeSubnetsCommand({
-                SubnetIds: [subnetId]
-            });
-            const subnetResponse = await this.ec2Client.send(subnetCommand);
-            
-            if (!subnetResponse.Subnets || subnetResponse.Subnets.length === 0) {
-                throw new Error(`Subnet ${subnetId} not found`);
-            }
-            
-            const subnet = subnetResponse.Subnets[0];
-            const vpcId = subnet.VpcId;
-            
-            // Get all route tables for this VPC
-            const routeTablesCommand = new DescribeRouteTablesCommand({
-                Filters: [
-                    {
-                        Name: 'vpc-id',
-                        Values: [vpcId]
-                    }
-                ]
-            });
-            
-            const routeTablesResponse = await this.ec2Client.send(routeTablesCommand);
-            
-            // Find the route table for this subnet
-            let routeTable = null;
-            
-            // First check for explicit association
-            for (const rt of routeTablesResponse.RouteTables || []) {
-                for (const assoc of rt.Associations || []) {
-                    if (assoc.SubnetId === subnetId) {
-                        routeTable = rt;
-                        break;
-                    }
-                }
-                if (routeTable) break;
-            }
-            
-            // If no explicit association, use the main route table
-            if (!routeTable) {
-                for (const rt of routeTablesResponse.RouteTables || []) {
-                    for (const assoc of rt.Associations || []) {
-                        if (assoc.Main === true) {
-                            routeTable = rt;
-                            break;
-                        }
-                    }
-                    if (routeTable) break;
-                }
-            }
-            
+            const targetVpcId = vpcId || (await this._getSubnetVpcId(subnetId));
+
+            const routeTables = await this.findRouteTables(targetVpcId);
+            const routeTable = this._findRouteTableForSubnet(routeTables, subnetId);
+
             if (!routeTable) {
                 console.warn(`No route table found for subnet ${subnetId}`);
-                return true; // Default to private for safety
+                return true;
             }
-            
-            // Check if route table has a route to an Internet Gateway
-            for (const route of routeTable.Routes || []) {
-                if (route.GatewayId && route.GatewayId.startsWith('igw-')) {
-                    return false; // It's a public subnet
-                }
+
+            const gatewayId = this._findIgwRoute(routeTable);
+            if (gatewayId) {
+                console.log(
+                    `✅ Subnet ${subnetId} is PUBLIC (has route to IGW ${gatewayId})`
+                );
+                return false;
             }
-            
-            return true; // No IGW route found, it's private
+
+            console.log(
+                `🔒 Subnet ${subnetId} is PRIVATE (no IGW route found)`
+            );
+            return true;
         } catch (error) {
-            console.warn(`Could not determine if subnet ${subnetId} is private:`, error);
-            return true; // Default to private for safety
+            console.warn(
+                `Could not determine if subnet ${subnetId} is private:`,
+                error
+            );
+            return true;
         }
     }
 
-    /**
-     * Find or create a default security group for Lambda functions
-     * @param {string} vpcId - The VPC ID to search within
-     * @returns {Promise<Object>} Security group object containing GroupId and other properties
-     * @throws {Error} If no security group is found for the VPC
-     */
     async findDefaultSecurityGroup(vpcId) {
         try {
-            // First try to find existing Frigg security group
-            const friggSgCommand = new DescribeSecurityGroupsCommand({
-                Filters: [
-                    {
-                        Name: 'vpc-id',
-                        Values: [vpcId]
-                    },
-                    {
-                        Name: 'group-name',
-                        Values: ['frigg-lambda-sg']
-                    }
-                ]
-            });
-            
-            const friggResponse = await this.ec2Client.send(friggSgCommand);
-            if (friggResponse.SecurityGroups && friggResponse.SecurityGroups.length > 0) {
-                return friggResponse.SecurityGroups[0];
+            const friggGroup = await this._findSecurityGroupByName(
+                vpcId,
+                'frigg-lambda-sg'
+            );
+            if (friggGroup) {
+                return friggGroup;
             }
 
-            // Fall back to default security group
-            const defaultSgCommand = new DescribeSecurityGroupsCommand({
-                Filters: [
-                    {
-                        Name: 'vpc-id',
-                        Values: [vpcId]
-                    },
-                    {
-                        Name: 'group-name',
-                        Values: ['default']
-                    }
-                ]
-            });
-            
-            const defaultResponse = await this.ec2Client.send(defaultSgCommand);
-            if (defaultResponse.SecurityGroups && defaultResponse.SecurityGroups.length > 0) {
-                return defaultResponse.SecurityGroups[0];
+            const defaultGroup = await this._findSecurityGroupByName(vpcId, 'default');
+            if (defaultGroup) {
+                return defaultGroup;
             }
-            
+
             throw new Error(`No security group found for VPC ${vpcId}`);
         } catch (error) {
             console.error('Error finding default security group:', error);
@@ -273,45 +192,32 @@ class AWSDiscovery {
         }
     }
 
-    /**
-     * Find public subnets for NAT Gateway placement
-     * @param {string} vpcId - The VPC ID to search within
-     * @returns {Promise<Object>} First public subnet object for NAT Gateway placement
-     * @throws {Error} If no public subnets are found in the VPC
-     */
     async findPublicSubnets(vpcId) {
         try {
-            const command = new DescribeSubnetsCommand({
-                Filters: [
-                    {
-                        Name: 'vpc-id',
-                        Values: [vpcId]
-                    }
-                ]
-            });
-            
-            const response = await this.ec2Client.send(command);
-            
-            if (!response.Subnets || response.Subnets.length === 0) {
+            const subnets = await this._fetchSubnets(vpcId);
+
+            if (subnets.length === 0) {
                 throw new Error(`No subnets found in VPC ${vpcId}`);
             }
 
-            // Find public subnets (have direct route to IGW)
-            const publicSubnets = [];
-
-            for (const subnet of response.Subnets) {
-                // Check route tables to determine if subnet is public
-                const isPrivate = await this.isSubnetPrivate(subnet.SubnetId);
-                if (!isPrivate) {
-                    publicSubnets.push(subnet);
-                }
-            }
+            const { publicSubnets } = await this._classifySubnets(subnets);
 
             if (publicSubnets.length === 0) {
-                throw new Error(`No public subnets found in VPC ${vpcId} for NAT Gateway placement`);
+                console.warn(
+                    `WARNING: No public subnets found in VPC ${vpcId}`
+                );
+                console.warn(
+                    'A public subnet with Internet Gateway route is required for NAT Gateway placement'
+                );
+                console.warn(
+                    'Please create a public subnet or use VPC endpoints instead'
+                );
+                return null;
             }
 
-            // Return first public subnet for NAT Gateway
+            console.log(
+                `Found ${publicSubnets.length} public subnets, using ${publicSubnets[0].SubnetId} for NAT Gateway`
+            );
             return publicSubnets[0];
         } catch (error) {
             console.error('Error finding public subnets:', error);
@@ -319,91 +225,121 @@ class AWSDiscovery {
         }
     }
 
-    /**
-     * Find private route table for VPC endpoints
-     * @param {string} vpcId - The VPC ID to search within
-     * @returns {Promise<Object>} Route table object containing RouteTableId and other properties
-     * @throws {Error} If no route tables are found for the VPC
-     */
     async findPrivateRouteTable(vpcId) {
         try {
-            const command = new DescribeRouteTablesCommand({
-                Filters: [
-                    {
-                        Name: 'vpc-id',
-                        Values: [vpcId]
-                    }
-                ]
-            });
-            
-            const response = await this.ec2Client.send(command);
-            
-            if (!response.RouteTables || response.RouteTables.length === 0) {
+            const routeTables = await this.findRouteTables(vpcId);
+
+            if (routeTables.length === 0) {
                 throw new Error(`No route tables found for VPC ${vpcId}`);
             }
 
-            // Find a route table that doesn't have direct IGW route (private)
-            for (const routeTable of response.RouteTables) {
-                let hasIgwRoute = false;
-                for (const route of routeTable.Routes || []) {
-                    if (route.GatewayId && route.GatewayId.startsWith('igw-')) {
-                        hasIgwRoute = true;
-                        break;
-                    }
-                }
-                if (!hasIgwRoute) {
-                    return routeTable;
-                }
-            }
+            const privateTable = routeTables.find(
+                (rt) => !this._findIgwRoute(rt)
+            );
 
-            // If no private route table found, return the first one
-            return response.RouteTables[0];
+            return privateTable || routeTables[0];
         } catch (error) {
             console.error('Error finding private route table:', error);
             throw error;
         }
     }
 
-    /**
-     * Find existing NAT Gateways in the VPC
-     * @param {string} vpcId - The VPC ID to search within
-     * @returns {Promise<Object|null>} NAT Gateway object or null if none found
-     */
     async findExistingNatGateway(vpcId) {
         try {
             const command = new DescribeNatGatewaysCommand({
                 Filter: [
                     {
                         Name: 'vpc-id',
-                        Values: [vpcId]
+                        Values: [vpcId],
                     },
                     {
                         Name: 'state',
-                        Values: ['available']
-                    }
-                ]
+                        Values: ['available'],
+                    },
+                ],
             });
-            
+
             const response = await this.ec2Client.send(command);
-            
-            if (response.NatGateways && response.NatGateways.length > 0) {
-                // Find a NAT Gateway tagged for Frigg first
-                const friggNatGateway = response.NatGateways.find(nat => 
-                    nat.Tags && nat.Tags.some(tag => 
-                        tag.Key === 'Name' && tag.Value.includes('frigg')
-                    )
+
+            const natGateways = (response.NatGateways || []).filter((nat) => {
+                if (nat.State !== 'available') {
+                    console.warn(
+                        `Skipping NAT Gateway ${nat.NatGatewayId} with state: ${nat.State}`
+                    );
+                    return false;
+                }
+                return true;
+            });
+
+            if (natGateways.length === 0) {
+                console.warn('No truly available NAT Gateways found in VPC');
+                return null;
+            }
+
+            const sortedNatGateways = natGateways.sort((a, b) => {
+                const aIsFrigg = this._isFriggManaged(a.Tags);
+                const bIsFrigg = this._isFriggManaged(b.Tags);
+
+                if (aIsFrigg && !bIsFrigg) return -1;
+                if (!aIsFrigg && bIsFrigg) return 1;
+                return 0;
+            });
+
+            for (const natGateway of sortedNatGateways) {
+                const subnetId = natGateway.SubnetId;
+                const isPrivate = await this.isSubnetPrivate(
+                    subnetId,
+                    natGateway.VpcId
                 );
-                
-                if (friggNatGateway) {
-                    console.log(`Found existing Frigg NAT Gateway: ${friggNatGateway.NatGatewayId}`);
-                    return friggNatGateway;
+                const isFriggNat = this._isFriggManaged(natGateway.Tags);
+
+                if (isPrivate) {
+                    console.warn(
+                        `WARNING: NAT Gateway ${natGateway.NatGatewayId} is in subnet ${subnetId} which appears to be private`
+                    );
+
+                    if (isFriggNat) {
+                        console.warn(
+                            'This is a Frigg-managed NAT Gateway that may have been misconfigured by route table changes'
+                        );
+                        console.warn(
+                            'Consider enabling selfHeal: true to fix this automatically'
+                        );
+                        natGateway._isInPrivateSubnet = true;
+                        return natGateway;
+                    }
+
+                    console.warn(
+                        'NAT Gateways MUST be placed in public subnets with Internet Gateway routes'
+                    );
+                    console.warn('Skipping this misconfigured NAT Gateway...');
+                    continue;
                 }
-                
-                // Return first available NAT Gateway if no Frigg-specific one found
-                console.log(`Found existing NAT Gateway: ${response.NatGateways[0].NatGatewayId}`);
-                return response.NatGateways[0];
+
+                if (isFriggNat) {
+                    console.log(
+                        `Found existing Frigg-managed NAT Gateway: ${natGateway.NatGatewayId} (State: ${natGateway.State})`
+                    );
+                    natGateway._isInPrivateSubnet = false;
+                    return natGateway;
+                }
+
+                console.log(
+                    `Found existing NAT Gateway in public subnet: ${natGateway.NatGatewayId} (State: ${natGateway.State})`
+                );
+                natGateway._isInPrivateSubnet = false;
+                return natGateway;
             }
-            
+
+            console.error(
+                `ERROR: Found ${(response.NatGateways || []).length} NAT Gateway(s) but all non-Frigg ones are in private subnets!`
+            );
+            console.error(
+                'These NAT Gateways will not provide internet connectivity without route table fixes'
+            );
+            console.error(
+                'Enable selfHeal: true to fix automatically or create a new NAT Gateway'
+            );
             return null;
         } catch (error) {
             console.warn('Error finding existing NAT Gateway:', error.message);
@@ -411,39 +347,38 @@ class AWSDiscovery {
         }
     }
 
-    /**
-     * Find available Elastic IPs
-     * @returns {Promise<Object|null>} Available EIP object or null if none found
-     */
     async findAvailableElasticIP() {
         try {
             const command = new DescribeAddressesCommand({});
             const response = await this.ec2Client.send(command);
-            
+
             if (response.Addresses && response.Addresses.length > 0) {
-                // Find an unassociated EIP first
-                const availableEIP = response.Addresses.find(eip => 
-                    !eip.AssociationId && !eip.InstanceId && !eip.NetworkInterfaceId
+                const availableEIP = response.Addresses.find(
+                    (eip) =>
+                        !eip.AssociationId &&
+                        !eip.InstanceId &&
+                        !eip.NetworkInterfaceId
                 );
-                
+
                 if (availableEIP) {
-                    console.log(`Found available Elastic IP: ${availableEIP.AllocationId}`);
+                    console.log(
+                        `Found available Elastic IP: ${availableEIP.AllocationId}`
+                    );
                     return availableEIP;
                 }
-                
-                // Check for EIPs tagged for Frigg
-                const friggEIP = response.Addresses.find(eip => 
-                    eip.Tags && eip.Tags.some(tag => 
-                        tag.Key === 'Name' && tag.Value.includes('frigg')
-                    )
+
+                const friggEIP = response.Addresses.find((eip) =>
+                    this._isFriggManaged(eip.Tags)
                 );
-                
+
                 if (friggEIP) {
-                    console.log(`Found Frigg-tagged Elastic IP: ${friggEIP.AllocationId}`);
+                    console.log(
+                        `Found Frigg-tagged Elastic IP: ${friggEIP.AllocationId}`
+                    );
                     return friggEIP;
                 }
             }
-            
+
             return null;
         } catch (error) {
             console.warn('Error finding available Elastic IP:', error.message);
@@ -451,120 +386,791 @@ class AWSDiscovery {
         }
     }
 
-    /**
-     * Find the default KMS key for the account
-     * @returns {Promise<string|null>} KMS key ARN or null if no key found
-     */
     async findDefaultKmsKey() {
+        console.log('KMS Discovery Starting...');
         try {
+            console.log(`[KMS Discovery] Running in region: ${this.region}`);
+            try {
+                const accountId = await this.getAccountId();
+                console.log(`[KMS Discovery] AWS Account ID: ${accountId}`);
+            } catch (error) {
+                console.warn(
+                    '[KMS Discovery] Could not retrieve account ID:',
+                    error.message
+                );
+            }
+
             const command = new ListKeysCommand({});
             const response = await this.kmsClient.send(command);
-            
+
             if (!response.Keys || response.Keys.length === 0) {
-                console.log('No KMS keys found in account');
+                console.log('[KMS Discovery] No KMS keys found in account');
                 return null;
             }
 
-            // Look for customer managed keys first
+            console.log(
+                `[KMS Discovery] Found ${response.Keys.length} total keys in account`
+            );
+            let keysExamined = 0;
+            let customerManagedKeys = 0;
+            let enabledKeys = 0;
+            let pendingDeletionKeys = 0;
+
             for (const key of response.Keys) {
                 try {
-                    const describeCommand = new DescribeKeyCommand({ KeyId: key.KeyId });
-                    const keyDetails = await this.kmsClient.send(describeCommand);
-                    
-                    if (keyDetails.KeyMetadata && 
-                        keyDetails.KeyMetadata.KeyManager === 'CUSTOMER' &&
-                        keyDetails.KeyMetadata.KeyState === 'Enabled') {
-                        console.log(`Found customer managed KMS key: ${keyDetails.KeyMetadata.Arn}`);
-                        return keyDetails.KeyMetadata.Arn;
+                    const describeCommand = new DescribeKeyCommand({
+                        KeyId: key.KeyId,
+                    });
+                    const keyDetails = await this.kmsClient.send(
+                        describeCommand
+                    );
+                    keysExamined++;
+
+                    const metadata = keyDetails.KeyMetadata;
+                    if (!metadata) {
+                        continue;
+                    }
+
+                    console.log(`[KMS Discovery] Key ${key.KeyId}:`, {
+                        KeyManager: metadata.KeyManager,
+                        KeyState: metadata.KeyState,
+                        Enabled: metadata.Enabled,
+                        DeletionDate:
+                            metadata.DeletionDate || 'Not scheduled for deletion',
+                        Arn: metadata.Arn,
+                    });
+
+                    if (metadata.KeyManager === 'CUSTOMER') {
+                        customerManagedKeys++;
+
+                        if (metadata.KeyState === 'Enabled') {
+                            enabledKeys++;
+                        } else if (metadata.KeyState === 'PendingDeletion') {
+                            pendingDeletionKeys++;
+                            console.warn(
+                                `[KMS Discovery] Skipping key ${key.KeyId} - State: PendingDeletion, DeletionDate: ${metadata.DeletionDate}`
+                            );
+                        }
+
+                        if (
+                            metadata.KeyState === 'Enabled' &&
+                            !metadata.DeletionDate
+                        ) {
+                            console.log(
+                                `[KMS Discovery] Found eligible customer managed KMS key: ${metadata.Arn}`
+                            );
+                            return metadata.Arn;
+                        } else if (
+                            metadata.KeyState === 'Enabled' &&
+                            metadata.DeletionDate
+                        ) {
+                            console.error(
+                                `[KMS Discovery] WARNING: Key ${key.KeyId} has KeyState='Enabled' but DeletionDate is set: ${metadata.DeletionDate}`
+                            );
+                        }
                     }
                 } catch (error) {
-                    // Continue to next key if we can't describe this one
-                    console.warn(`Could not describe key ${key.KeyId}:`, error.message);
+                    console.warn(
+                        `[KMS Discovery] Could not describe key ${key.KeyId}:`,
+                        error.message
+                    );
                     continue;
                 }
             }
 
-            console.log('No customer managed KMS keys found');
+            console.log('[KMS Discovery] Summary:', {
+                totalKeys: response.Keys.length,
+                keysExamined,
+                customerManagedKeys,
+                enabledKeys,
+                pendingDeletionKeys,
+            });
+
+            if (customerManagedKeys === 0) {
+                console.log(
+                    '[KMS Discovery] No customer managed KMS keys found in account'
+                );
+            } else if (enabledKeys === 0) {
+                console.warn(
+                    '[KMS Discovery] Found customer managed keys but none are in Enabled state'
+                );
+            } else {
+                console.warn(
+                    '[KMS Discovery] Found enabled customer managed keys but none met all criteria'
+                );
+            }
+
             return null;
         } catch (error) {
-            console.error('Error finding default KMS key:', error);
+            console.error(
+                '[KMS Discovery] Error finding default KMS key:',
+                error
+            );
             return null;
         }
     }
 
-    /**
-     * Discover all AWS resources needed for Frigg deployment
-     * @returns {Promise<Object>} Object containing discovered resource IDs:
-     * @returns {string} return.defaultVpcId - The default VPC ID
-     * @returns {string} return.defaultSecurityGroupId - The default security group ID
-     * @returns {string} return.privateSubnetId1 - First private subnet ID
-     * @returns {string} return.privateSubnetId2 - Second private subnet ID
-     * @returns {string} return.publicSubnetId - Public subnet ID for NAT Gateway
-     * @returns {string} return.privateRouteTableId - Private route table ID
-     * @returns {string|null} return.defaultKmsKeyId - Default KMS key ARN or null if not found
-     * @throws {Error} If resource discovery fails
-     */
-    async discoverResources() {
+    async detectMisconfiguredResources(vpcId) {
+        try {
+            const misconfigurations = {
+                natGatewaysInPrivateSubnets: [],
+                orphanedElasticIps: [],
+                misconfiguredRouteTables: [],
+                privateSubnetsWithoutNatRoute: [],
+            };
+
+            const natCommand = new DescribeNatGatewaysCommand({
+                Filter: [
+                    { Name: 'vpc-id', Values: [vpcId] },
+                    { Name: 'state', Values: ['available'] },
+                ],
+            });
+            const natResponse = await this.ec2Client.send(natCommand);
+
+            for (const nat of natResponse.NatGateways || []) {
+                const isPrivate = await this.isSubnetPrivate(nat.SubnetId, vpcId);
+                if (isPrivate) {
+                    misconfigurations.natGatewaysInPrivateSubnets.push({
+                        natGatewayId: nat.NatGatewayId,
+                        subnetId: nat.SubnetId,
+                        tags: nat.Tags,
+                    });
+                }
+            }
+
+            const eipCommand = new DescribeAddressesCommand({});
+            const eipResponse = await this.ec2Client.send(eipCommand);
+
+            for (const eip of eipResponse.Addresses || []) {
+                if (
+                    !eip.InstanceId &&
+                    !eip.NetworkInterfaceId &&
+                    !eip.AssociationId &&
+                    this._isFriggManaged(eip.Tags)
+                ) {
+                    misconfigurations.orphanedElasticIps.push({
+                        allocationId: eip.AllocationId,
+                        publicIp: eip.PublicIp,
+                        tags: eip.Tags,
+                    });
+                }
+            }
+
+            const subnets = await this.findPrivateSubnets(vpcId);
+            const routeTables = await this.findRouteTables(vpcId);
+
+            for (const subnet of subnets) {
+                const hasNatRoute = routeTables.some((rt) => {
+                    const isAssociated = (rt.Associations || []).some(
+                        (assoc) => assoc.SubnetId === subnet.SubnetId
+                    );
+                    if (!isAssociated) {
+                        return false;
+                    }
+                    return (rt.Routes || []).some(
+                        (route) =>
+                            route.NatGatewayId &&
+                            route.DestinationCidrBlock === '0.0.0.0/0'
+                    );
+                });
+
+                if (!hasNatRoute) {
+                    misconfigurations.privateSubnetsWithoutNatRoute.push({
+                        subnetId: subnet.SubnetId,
+                        availabilityZone: subnet.AvailabilityZone,
+                    });
+                }
+            }
+
+            return misconfigurations;
+        } catch (error) {
+            console.error('Error detecting misconfigurations:', error);
+            return {
+                natGatewaysInPrivateSubnets: [],
+                orphanedElasticIps: [],
+                misconfiguredRouteTables: [],
+                privateSubnetsWithoutNatRoute: [],
+            };
+        }
+    }
+
+    getHealingRecommendations(misconfigurations) {
+        const recommendations = [];
+
+        if (misconfigurations.natGatewaysInPrivateSubnets.length > 0) {
+            recommendations.push({
+                severity: 'critical',
+                issue: 'NAT Gateway in private subnet',
+                recommendation:
+                    'Recreate NAT Gateway in public subnet or fix route tables',
+                affectedResources:
+                    misconfigurations.natGatewaysInPrivateSubnets.map(
+                        (n) => n.natGatewayId
+                    ),
+            });
+        }
+
+        if (misconfigurations.orphanedElasticIps.length > 0) {
+            recommendations.push({
+                severity: 'warning',
+                issue: 'Orphaned Elastic IPs',
+                recommendation: 'Release unused Elastic IPs to avoid charges',
+                affectedResources: misconfigurations.orphanedElasticIps.map(
+                    (e) => e.allocationId
+                ),
+            });
+        }
+
+        if (misconfigurations.privateSubnetsWithoutNatRoute.length > 0) {
+            recommendations.push({
+                severity: 'critical',
+                issue: 'Private subnets without NAT route',
+                recommendation:
+                    'Add NAT Gateway route to private subnet route tables',
+                affectedResources:
+                    misconfigurations.privateSubnetsWithoutNatRoute.map(
+                        (s) => s.subnetId
+                    ),
+            });
+        }
+
+        recommendations.sort((a, b) => {
+            const severityOrder = { critical: 0, warning: 1, info: 2 };
+            return severityOrder[a.severity] - severityOrder[b.severity];
+        });
+
+        return recommendations;
+    }
+
+    async discoverResources(options = {}) {
         try {
-            console.log('Discovering AWS resources for Frigg deployment...');
-            
+            console.log(
+                '\n🚀 Discovering AWS resources for Frigg deployment...'
+            );
+            console.log('═'.repeat(60));
+
             const vpc = await this.findDefaultVpc();
-            console.log(`Found VPC: ${vpc.VpcId}`);
-            
-            const privateSubnets = await this.findPrivateSubnets(vpc.VpcId);
-            console.log(`Found ${privateSubnets.length} private subnets: ${privateSubnets.map(s => s.SubnetId).join(', ')}`);
-            
+            console.log(`\n✅ Found VPC: ${vpc.VpcId}`);
+
+            const autoConvert = options.selfHeal || false;
+
+            const privateSubnets = await this.findPrivateSubnets(
+                vpc.VpcId,
+                autoConvert
+            );
+            console.log(
+                `\n✅ Selected subnets for Lambda: ${privateSubnets
+                    .map((s) => s.SubnetId)
+                    .join(', ')}`
+            );
+
             const publicSubnet = await this.findPublicSubnets(vpc.VpcId);
-            console.log(`Found public subnet for NAT Gateway: ${publicSubnet.SubnetId}`);
-            
-            const securityGroup = await this.findDefaultSecurityGroup(vpc.VpcId);
-            console.log(`Found security group: ${securityGroup.GroupId}`);
-            
+            if (publicSubnet) {
+                console.log(
+                    `\n✅ Found public subnet for NAT Gateway: ${publicSubnet.SubnetId}`
+                );
+            } else {
+                console.log(
+                    `\n⚠️  No public subnet found - NAT Gateway creation may fail`
+                );
+            }
+
+            const securityGroup = await this.findDefaultSecurityGroup(
+                vpc.VpcId
+            );
+            console.log(`\n✅ Found security group: ${securityGroup.GroupId}`);
+
             const routeTable = await this.findPrivateRouteTable(vpc.VpcId);
-            console.log(`Found route table: ${routeTable.RouteTableId}`);
-            
+            console.log(`✅ Found route table: ${routeTable.RouteTableId}`);
+
             const kmsKeyArn = await this.findDefaultKmsKey();
             if (kmsKeyArn) {
-                console.log(`Found KMS key: ${kmsKeyArn}`);
+                console.log(`✅ Found KMS key: ${kmsKeyArn}`);
             } else {
-                console.log('No KMS key found');
+                console.log('ℹ️  No KMS key found');
             }
-            
-            // Try to find existing NAT Gateway
-            const existingNatGateway = await this.findExistingNatGateway(vpc.VpcId);
+
+            const existingNatGateway = await this.findExistingNatGateway(
+                vpc.VpcId
+            );
             let natGatewayId = null;
             let elasticIpAllocationId = null;
-            
+            let natGatewayInPrivateSubnet = false;
+
             if (existingNatGateway) {
                 natGatewayId = existingNatGateway.NatGatewayId;
-                // Get the EIP allocation ID from the NAT Gateway
-                if (existingNatGateway.NatGatewayAddresses && existingNatGateway.NatGatewayAddresses.length > 0) {
-                    elasticIpAllocationId = existingNatGateway.NatGatewayAddresses[0].AllocationId;
+                natGatewayInPrivateSubnet =
+                    existingNatGateway._isInPrivateSubnet || false;
+
+                if (
+                    existingNatGateway.NatGatewayAddresses &&
+                    existingNatGateway.NatGatewayAddresses.length > 0
+                ) {
+                    elasticIpAllocationId =
+                        existingNatGateway.NatGatewayAddresses[0].AllocationId;
                 }
             } else {
-                // If no NAT Gateway exists, check for available EIP
                 const availableEIP = await this.findAvailableElasticIP();
                 if (availableEIP) {
                     elasticIpAllocationId = availableEIP.AllocationId;
                 }
             }
 
+            const subnet1IsActuallyPrivate = privateSubnets[0]
+                ? await this.isSubnetPrivate(
+                      privateSubnets[0].SubnetId,
+                      privateSubnets[0].VpcId || vpc.VpcId
+                  )
+                : false;
+            const subnet2IsActuallyPrivate = privateSubnets[1]
+                ? await this.isSubnetPrivate(
+                      privateSubnets[1].SubnetId,
+                      privateSubnets[1].VpcId || vpc.VpcId
+                  )
+                : subnet1IsActuallyPrivate;
+
+            const subnetStatus = {
+                requiresConversion:
+                    !subnet1IsActuallyPrivate || !subnet2IsActuallyPrivate,
+                subnet1NeedsConversion: !subnet1IsActuallyPrivate,
+                subnet2NeedsConversion: !subnet2IsActuallyPrivate,
+            };
+
+            if (subnetStatus.requiresConversion) {
+                console.log(`\n⚠️  SUBNET CONFIGURATION WARNING:`);
+                if (subnetStatus.subnet1NeedsConversion && privateSubnets[0]) {
+                    console.log(
+                        `  - Subnet ${privateSubnets[0].SubnetId} is currently PUBLIC but will be used for Lambda`
+                    );
+                }
+                if (subnetStatus.subnet2NeedsConversion && privateSubnets[1]) {
+                    console.log(
+                        `  - Subnet ${privateSubnets[1].SubnetId} is currently PUBLIC but will be used for Lambda`
+                    );
+                }
+                console.log(
+                    `  💡 Enable selfHeal: true to automatically fix this`
+                );
+            }
+
+            console.log(`\n${'═'.repeat(60)}`);
+            console.log('📋 Discovery Summary:');
+            console.log(`  VPC: ${vpc.VpcId}`);
+            console.log(
+                `  Lambda Subnets: ${privateSubnets
+                    .map((s) => s.SubnetId)
+                    .join(', ')}`
+            );
+            console.log(
+                `  NAT Subnet: ${
+                    publicSubnet?.SubnetId || 'None (needs creation)'
+                }`
+            );
+            console.log(
+                `  NAT Gateway: ${natGatewayId || 'None (will be created)'}`
+            );
+            console.log(
+                `  Elastic IP: ${
+                    elasticIpAllocationId || 'None (will be allocated)'
+                }`
+            );
+            if (subnetStatus.requiresConversion) {
+                console.log(`  ⚠️  Subnet Conversion Required: Yes`);
+            }
+            console.log(`${'═'.repeat(60)}\n`);
+
             return {
                 defaultVpcId: vpc.VpcId,
+                vpcCidr: vpc.CidrBlock,
                 defaultSecurityGroupId: securityGroup.GroupId,
                 privateSubnetId1: privateSubnets[0]?.SubnetId,
-                privateSubnetId2: privateSubnets[1]?.SubnetId || privateSubnets[0]?.SubnetId,
-                publicSubnetId: publicSubnet.SubnetId,
+                privateSubnetId2:
+                    privateSubnets[1]?.SubnetId || privateSubnets[0]?.SubnetId,
+                publicSubnetId: publicSubnet?.SubnetId || null,
                 privateRouteTableId: routeTable.RouteTableId,
                 defaultKmsKeyId: kmsKeyArn,
                 existingNatGatewayId: natGatewayId,
-                existingElasticIpAllocationId: elasticIpAllocationId
+                existingElasticIpAllocationId: elasticIpAllocationId,
+                natGatewayInPrivateSubnet: natGatewayInPrivateSubnet,
+                subnetConversionRequired: subnetStatus.requiresConversion,
+                privateSubnetsWithWrongRoutes: (() => {
+                    const wrongRoutes = [];
+                    if (
+                        subnetStatus.subnet1NeedsConversion &&
+                        privateSubnets[0]
+                    ) {
+                        wrongRoutes.push(privateSubnets[0].SubnetId);
+                    }
+                    if (
+                        subnetStatus.subnet2NeedsConversion &&
+                        privateSubnets[1]
+                    ) {
+                        wrongRoutes.push(privateSubnets[1].SubnetId);
+                    }
+                    return wrongRoutes;
+                })(),
             };
         } catch (error) {
             console.error('Error discovering AWS resources:', error);
             throw error;
         }
     }
+
+    async findInternetGateway(vpcId) {
+        try {
+            const command = new DescribeInternetGatewaysCommand({
+                Filters: [
+                    {
+                        Name: 'attachment.vpc-id',
+                        Values: [vpcId],
+                    },
+                    {
+                        Name: 'attachment.state',
+                        Values: ['available'],
+                    },
+                ],
+            });
+
+            const response = await this.ec2Client.send(command);
+
+            if (
+                response.InternetGateways &&
+                response.InternetGateways.length > 0
+            ) {
+                console.log(
+                    `Found existing Internet Gateway: ${response.InternetGateways[0].InternetGatewayId}`
+                );
+                return response.InternetGateways[0];
+            }
+
+            return null;
+        } catch (error) {
+            console.warn('Error finding Internet Gateway:', error.message);
+            return null;
+        }
+    }
+
+    async findFriggManagedResources(serviceName, stage) {
+        const results = {
+            natGateways: [],
+            elasticIps: [],
+            routeTables: [],
+            subnets: [],
+            securityGroups: [],
+        };
+
+        try {
+            const filters = [
+                {
+                    Name: 'tag:ManagedBy',
+                    Values: ['Frigg'],
+                },
+            ];
+
+            if (serviceName) {
+                filters.push({
+                    Name: 'tag:Service',
+                    Values: [serviceName],
+                });
+            }
+
+            if (stage) {
+                filters.push({
+                    Name: 'tag:Stage',
+                    Values: [stage],
+                });
+            }
+
+            const fetchWithFallback = async (Command, input, field, label) => {
+                try {
+                    const response = await this.ec2Client.send(
+                        new Command(input)
+                    );
+                    return response[field] || [];
+                } catch (err) {
+                    console.warn(
+                        `Error finding Frigg ${label}:`,
+                        err.message
+                    );
+                    return [];
+                }
+            };
+
+            results.natGateways = await fetchWithFallback(
+                DescribeNatGatewaysCommand,
+                {
+                    Filter: [
+                        ...filters,
+                        {
+                            Name: 'state',
+                            Values: ['available'],
+                        },
+                    ],
+                },
+                'NatGateways',
+                'NAT Gateways'
+            );
+
+            results.elasticIps = await fetchWithFallback(
+                DescribeAddressesCommand,
+                { Filters: filters },
+                'Addresses',
+                'Elastic IPs'
+            );
+
+            results.routeTables = await fetchWithFallback(
+                DescribeRouteTablesCommand,
+                { Filters: filters },
+                'RouteTables',
+                'Route Tables'
+            );
+
+            results.subnets = await fetchWithFallback(
+                DescribeSubnetsCommand,
+                { Filters: filters },
+                'Subnets',
+                'Subnets'
+            );
+
+            results.securityGroups = await fetchWithFallback(
+                DescribeSecurityGroupsCommand,
+                { Filters: filters },
+                'SecurityGroups',
+                'Security Groups'
+            );
+
+            console.log('Found Frigg-managed resources:', {
+                natGateways: results.natGateways.length,
+                elasticIps: results.elasticIps.length,
+                routeTables: results.routeTables.length,
+                subnets: results.subnets.length,
+                securityGroups: results.securityGroups.length,
+            });
+
+            return results;
+        } catch (error) {
+            console.error('Error finding Frigg-managed resources:', error);
+            return results;
+        }
+    }
+
+    async findRouteTables(vpcId) {
+        const command = new DescribeRouteTablesCommand({
+            Filters: [
+                {
+                    Name: 'vpc-id',
+                    Values: [vpcId],
+                },
+            ],
+        });
+        const response = await this.ec2Client.send(command);
+        return response.RouteTables || [];
+    }
+
+    async _fetchSubnets(vpcId) {
+        const command = new DescribeSubnetsCommand({
+            Filters: [
+                {
+                    Name: 'vpc-id',
+                    Values: [vpcId],
+                },
+            ],
+        });
+        const response = await this.ec2Client.send(command);
+        return response.Subnets || [];
+    }
+
+    async _getSubnetVpcId(subnetId) {
+        const command = new DescribeSubnetsCommand({
+            SubnetIds: [subnetId],
+        });
+        const response = await this.ec2Client.send(command);
+
+        if (!response.Subnets || response.Subnets.length === 0) {
+            throw new Error(`Subnet ${subnetId} not found`);
+        }
+
+        return response.Subnets[0].VpcId;
+    }
+
+    async _classifySubnets(subnets, { logDetails = false } = {}) {
+        const privateSubnets = [];
+        const publicSubnets = [];
+
+        for (const subnet of subnets) {
+            const isPrivate = await this.isSubnetPrivate(
+                subnet.SubnetId,
+                subnet.VpcId
+            );
+            if (isPrivate) {
+                privateSubnets.push(subnet);
+                if (logDetails) {
+                    console.log(
+                        `  🔒 Private subnet: ${subnet.SubnetId} (AZ: ${subnet.AvailabilityZone})`
+                    );
+                }
+            } else {
+                publicSubnets.push(subnet);
+                if (logDetails) {
+                    console.log(
+                        `  🌐 Public subnet: ${subnet.SubnetId} (AZ: ${subnet.AvailabilityZone})`
+                    );
+                }
+            }
+        }
+
+        return { privateSubnets, publicSubnets };
+    }
+
+    _logSubnetSummary(privateCount, publicCount) {
+        console.log(`\n📊 Subnet Analysis Results:`);
+        console.log(`  - Private subnets: ${privateCount}`);
+        console.log(`  - Public subnets: ${publicCount}`);
+    }
+
+    _selectSubnetsForLambda({ privateSubnets, publicSubnets, autoConvert, vpcId }) {
+        if (privateSubnets.length >= 2) {
+            console.log(
+                `✅ Found ${privateSubnets.length} private subnets for Lambda deployment`
+            );
+            return privateSubnets.slice(0, 2);
+        }
+
+        if (privateSubnets.length === 1) {
+            console.warn(
+                `⚠️  Only 1 private subnet found. Need at least 2 for high availability.`
+            );
+            if (publicSubnets.length > 0 && autoConvert) {
+                console.log(
+                    `🔄 Will convert 1 public subnet to private for high availability...`
+                );
+            }
+            return [...privateSubnets, ...publicSubnets].slice(0, 2);
+        }
+
+        if (privateSubnets.length === 0 && publicSubnets.length > 0) {
+            console.error(
+                `❌ CRITICAL: No private subnets found, but ${publicSubnets.length} public subnets exist`
+            );
+            console.error(
+                `❌ Lambda functions should NOT be deployed in public subnets!`
+            );
+
+            if (autoConvert && publicSubnets.length >= 3) {
+                console.log(
+                    `\n🔧 AUTO-CONVERSION: Will configure subnets for proper isolation...`
+                );
+                console.log(
+                    `  - Keeping ${publicSubnets[0].SubnetId} as public (for NAT Gateway)`
+                );
+                console.log(
+                    `  - Converting ${publicSubnets[1].SubnetId} to private (for Lambda)`
+                );
+                if (publicSubnets[2]) {
+                    console.log(
+                        `  - Converting ${publicSubnets[2].SubnetId} to private (for Lambda)`
+                    );
+                }
+                return publicSubnets.slice(1, 3);
+            }
+
+            if (autoConvert && publicSubnets.length >= 2) {
+                console.log(
+                    `\n🔧 AUTO-CONVERSION: Only ${publicSubnets.length} subnets available`
+                );
+                console.log(
+                    `  - Will need to create new subnets or reconfigure existing ones`
+                );
+                return publicSubnets.slice(0, 2);
+            }
+
+            console.error(`\n⚠️  CONFIGURATION ERROR:`);
+            console.error(
+                `  Found ${publicSubnets.length} public subnets but no private subnets.`
+            );
+            console.error(
+                `  Lambda functions require private subnets for security.`
+            );
+            console.error(`\n  Options:`);
+            console.error(
+                `  1. Enable selfHeal: true in vpc configuration`
+            );
+            console.error(`  2. Create private subnets manually`);
+            console.error(
+                `  3. Set subnets.management: 'create' to create new private subnets`
+            );
+
+            throw new Error(
+                `No private subnets found in VPC ${vpcId}. ` +
+                    `Found ${publicSubnets.length} public subnets. ` +
+                    `Lambda requires private subnets. Enable selfHeal or create private subnets.`
+            );
+        }
+
+        return null;
+    }
+
+    _findRouteTableForSubnet(routeTables, subnetId) {
+        for (const rt of routeTables) {
+            for (const assoc of rt.Associations || []) {
+                if (assoc.SubnetId === subnetId) {
+                    return rt;
+                }
+            }
+        }
+
+        for (const rt of routeTables) {
+            for (const assoc of rt.Associations || []) {
+                if (assoc.Main === true) {
+                    return rt;
+                }
+            }
+        }
+
+        return null;
+    }
+
+    _findIgwRoute(routeTable) {
+        for (const route of routeTable.Routes || []) {
+            if (route.GatewayId && route.GatewayId.startsWith('igw-')) {
+                return route.GatewayId;
+            }
+        }
+        return null;
+    }
+
+    _isFriggManaged(tags) {
+        if (!tags) {
+            return false;
+        }
+
+        return tags.some(
+            (tag) =>
+                (tag.Key === 'ManagedBy' && tag.Value === 'Frigg') ||
+                (tag.Key === 'Name' &&
+                    typeof tag.Value === 'string' &&
+                    tag.Value.includes('frigg'))
+        );
+    }
+
+    async _findSecurityGroupByName(vpcId, groupName) {
+        const command = new DescribeSecurityGroupsCommand({
+            Filters: [
+                {
+                    Name: 'vpc-id',
+                    Values: [vpcId],
+                },
+                {
+                    Name: 'group-name',
+                    Values: [groupName],
+                },
+            ],
+        });
+
+        const response = await this.ec2Client.send(command);
+        const groups = response.SecurityGroups || [];
+        return groups[0] || null;
+    }
 }
 
-module.exports = { AWSDiscovery };
+module.exports = { AWSDiscovery };