@go-to-k/cdkd 0.51.10 → 0.52.0

package/dist/cli.js

@@ -17059,11 +17059,15 @@ var DynamoDBTableProvider = class {
 // src/provisioning/providers/logs-loggroup-provider.ts
 import {
   CreateLogGroupCommand,
+  DeleteIndexPolicyCommand,
   DeleteLogGroupCommand,
   DescribeIndexPoliciesCommand,
   DescribeLogGroupsCommand,
   GetDataProtectionPolicyCommand,
   ListTagsForResourceCommand as ListTagsForResourceCommand2,
+  PutBearerTokenAuthenticationCommand,
+  PutIndexPolicyCommand,
+  PutLogGroupDeletionProtectionCommand,
   PutRetentionPolicyCommand,
   DeleteRetentionPolicyCommand,
   TagResourceCommand as TagResourceCommand5,
@@ -17116,6 +17120,9 @@ var LogsLogGroupProvider = class {
       if (properties["LogGroupClass"]) {
         createParams.logGroupClass = properties["LogGroupClass"];
       }
+      if (properties["DeletionProtectionEnabled"] !== void 0) {
+        createParams.deletionProtectionEnabled = properties["DeletionProtectionEnabled"];
+      }
       if (properties["Tags"]) {
         const cfnTags = properties["Tags"];
         createParams.tags = Object.fromEntries(cfnTags.map((t) => [t.Key, t.Value]));
@@ -17139,6 +17146,30 @@ var LogsLogGroupProvider = class {
           })
         );
       }
+      const fieldIndexPolicies = properties["FieldIndexPolicies"];
+      if (fieldIndexPolicies && fieldIndexPolicies.length > 0) {
+        if (fieldIndexPolicies.length > 1) {
+          this.logger.debug(
+            `Log group ${logicalId} declares ${fieldIndexPolicies.length} FieldIndexPolicies; AWS only supports one log-group-level field index policy. Applying the first.`
+          );
+        }
+        const first = fieldIndexPolicies[0];
+        const policyDocument = typeof first === "string" ? first : JSON.stringify(first);
+        await this.logsClient.send(
+          new PutIndexPolicyCommand({
+            logGroupIdentifier: logGroupName,
+            policyDocument
+          })
+        );
+      }
+      if (properties["BearerTokenAuthenticationEnabled"] !== void 0) {
+        await this.logsClient.send(
+          new PutBearerTokenAuthenticationCommand({
+            logGroupIdentifier: logGroupName,
+            bearerTokenAuthenticationEnabled: properties["BearerTokenAuthenticationEnabled"]
+          })
+        );
+      }
       this.logger.debug(`Successfully created log group ${logicalId}: ${logGroupName}`);
       const arn = await this.buildArn(logGroupName);
       return {
@@ -17171,7 +17202,10 @@ var LogsLogGroupProvider = class {
   /**
    * Update a CloudWatch Logs log group
    *
-   * Only RetentionInDays can be updated. LogGroupName is immutable (requires replacement).
+   * Mutable: `RetentionInDays`, `DataProtectionPolicy`, `Tags`,
+   * `DeletionProtectionEnabled`, `BearerTokenAuthenticationEnabled`,
+   * `FieldIndexPolicies`. `LogGroupName` / `KmsKeyId` / `LogGroupClass`
+   * are immutable on AWS-side and require replacement.
    */
   async update(logicalId, physicalId, _resourceType, properties, previousProperties) {
     this.logger.debug(`Updating log group ${logicalId}: ${physicalId}`);
@@ -17210,6 +17244,70 @@ var LogsLogGroupProvider = class {
         );
       }
     }
+    if (properties["DeletionProtectionEnabled"] !== previousProperties["DeletionProtectionEnabled"]) {
+      const next = properties["DeletionProtectionEnabled"];
+      if (next !== void 0) {
+        await this.logsClient.send(
+          new PutLogGroupDeletionProtectionCommand({
+            logGroupIdentifier: physicalId,
+            deletionProtectionEnabled: next
+          })
+        );
+      } else {
+        await this.logsClient.send(
+          new PutLogGroupDeletionProtectionCommand({
+            logGroupIdentifier: physicalId,
+            deletionProtectionEnabled: false
+          })
+        );
+      }
+    }
+    if (properties["BearerTokenAuthenticationEnabled"] !== previousProperties["BearerTokenAuthenticationEnabled"]) {
+      const next = properties["BearerTokenAuthenticationEnabled"];
+      if (next !== void 0) {
+        await this.logsClient.send(
+          new PutBearerTokenAuthenticationCommand({
+            logGroupIdentifier: physicalId,
+            bearerTokenAuthenticationEnabled: next
+          })
+        );
+      } else {
+        await this.logsClient.send(
+          new PutBearerTokenAuthenticationCommand({
+            logGroupIdentifier: physicalId,
+            bearerTokenAuthenticationEnabled: false
+          })
+        );
+      }
+    }
+    const newFieldIndex = properties["FieldIndexPolicies"];
+    const oldFieldIndex = previousProperties["FieldIndexPolicies"];
+    if (JSON.stringify(newFieldIndex) !== JSON.stringify(oldFieldIndex)) {
+      if (newFieldIndex && newFieldIndex.length > 0) {
+        if (newFieldIndex.length > 1) {
+          this.logger.debug(
+            `Log group ${physicalId} declares ${newFieldIndex.length} FieldIndexPolicies; AWS only supports one log-group-level field index policy. Applying the first.`
+          );
+        }
+        const first = newFieldIndex[0];
+        const policyDocument = typeof first === "string" ? first : JSON.stringify(first);
+        await this.logsClient.send(
+          new PutIndexPolicyCommand({
+            logGroupIdentifier: physicalId,
+            policyDocument
+          })
+        );
+      } else {
+        try {
+          await this.logsClient.send(
+            new DeleteIndexPolicyCommand({ logGroupIdentifier: physicalId })
+          );
+        } catch (err) {
+          if (!(err instanceof ResourceNotFoundException7))
+            throw err;
+        }
+      }
+    }
     const newTags = properties["Tags"];
     const oldTags = previousProperties["Tags"];
     if (JSON.stringify(newTags) !== JSON.stringify(oldTags)) {
@@ -17326,14 +17424,15 @@ var LogsLogGroupProvider = class {
    * `AWS::Logs::ResourcePolicy` resource type — account-wide, not
    * per-log-group).
    *
-   * Known limitation: cdkd's `create()` / `update()` flows do NOT yet
-   * apply `FieldIndexPolicies` / `DeletionProtectionEnabled` /
-   * `BearerTokenAuthenticationEnabled` — they're in `handledProperties`
-   * to prevent CC API fallback but no actual `PutIndexPolicy` /
-   * `PutLogGroupDeletionProtection` / `PutBearerTokenAuthentication`
-   * calls fire. Surfacing these in `readCurrentState` means a user
-   * who templates them will see drift on the first run; a follow-up
-   * needs to wire the create/update flow.
+   * Write-side coverage: `FieldIndexPolicies` is applied via
+   * `PutIndexPolicy` (CloudWatch Logs allows at most one log-group-level
+   * field index policy at a time, so the CFn array is effectively 0-or-1
+   * — the first entry is applied and a debug log notes any additional
+   * entries are ignored). `DeletionProtectionEnabled` is forwarded as
+   * part of `CreateLogGroup` and updated via
+   * `PutLogGroupDeletionProtection`. `BearerTokenAuthenticationEnabled`
+   * is applied via `PutBearerTokenAuthentication` after the log group
+   * exists (it is not part of `CreateLogGroupRequest`).
    *
    * Tags are read via `ListTagsForResource` (using the log-group ARN from
    * the same `DescribeLogGroups` response). CDK's `aws:*` auto-tags are
@@ -33991,10 +34090,10 @@ var KMSProvider = class {
    * Dispatches by resource type:
    *   - `AWS::KMS::Key` → `DescribeKey`. Surfaces `Description`, `KeySpec`,
    *     `KeyUsage`, `Enabled`, `MultiRegion`, `Origin`. `KeyPolicy` is
-   *     intentionally NOT retrieved — `GetKeyPolicy` is a separate call
-   *     and the policy body needs JSON parsing for comparison; deferred
-   *     to a follow-up. `EnableKeyRotation` / `RotationPeriodInDays`
-   *     would require `GetKeyRotationStatus`; also deferred.
+   *     additionally retrieved via `GetKeyPolicy` (URL-decoded JSON-parsed)
+   *     and `EnableKeyRotation` / `RotationPeriodInDays` via
+   *     `GetKeyRotationStatus` (Class 1 discriminator-gated on `KeySpec`
+   *     since asymmetric keys reject the call).
    *   - `AWS::KMS::Alias` → `ListAliases` filtered to the alias name.
    *     Surfaces `AliasName`, `TargetKeyId`. `ListAliases` is paginated
    *     since there's no direct "describe one alias" API.
@@ -45240,7 +45339,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.51.10");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.52.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());