@intentius/chant-lexicon-aws 0.124.30 → 0.124.32

package/dist/composites/dynamodb-table.js

@@ -0,0 +1,66 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Table, Table_AttributeDefinition, Table_KeySchema, Table_GlobalSecondaryIndex, Table_Projection, Table_ProvisionedThroughput, Table_StreamSpecification, Table_TimeToLiveSpecification, } from "../generated/index.js";
+const DEFAULT_CAPACITY = { readCapacity: 5, writeCapacity: 5 };
+function toProvisionedThroughput(capacity) {
+    return new Table_ProvisionedThroughput({
+        ReadCapacityUnits: capacity.readCapacity,
+        WriteCapacityUnits: capacity.writeCapacity,
+    });
+}
+function toKeySchema(partitionKey, sortKey) {
+    // A ternary (not an `if`) keeps the `new`s unconditional per EVL002, and
+    // returning array literals directly from each branch — no spread — sidesteps
+    // EVL004 (outside a Composite factory, EVL004 only traces a spread source to a
+    // module-top-level const or a literal, not a local variable).
+    const partitionEntry = new Table_KeySchema({ AttributeName: partitionKey.name, KeyType: "HASH" });
+    const sortEntry = sortKey ? new Table_KeySchema({ AttributeName: sortKey.name, KeyType: "RANGE" }) : undefined;
+    return sortEntry ? [partitionEntry, sortEntry] : [partitionEntry];
+}
+/** A DynamoDB table from a partition key, an optional sort key and optional global secondary indexes. */
+export const DynamoDBTable = Composite((props) => {
+    const billingMode = props.billingMode ?? "PAY_PER_REQUEST";
+    const { defaults } = props;
+    // Every key attribute used anywhere (table keys + every GSI's keys) needs exactly
+    // one AttributeDefinition. A Map dedupes by name so a GSI reusing the table's
+    // partition key (a common pattern) doesn't produce a duplicate definition.
+    const attributeTypes = new Map();
+    attributeTypes.set(props.partitionKey.name, props.partitionKey.type ?? "S");
+    if (props.sortKey)
+        attributeTypes.set(props.sortKey.name, props.sortKey.type ?? "S");
+    for (const gsi of props.globalSecondaryIndexes ?? []) {
+        attributeTypes.set(gsi.partitionKey.name, gsi.partitionKey.type ?? "S");
+        if (gsi.sortKey)
+            attributeTypes.set(gsi.sortKey.name, gsi.sortKey.type ?? "S");
+    }
+    const attributeDefinitions = [...attributeTypes.entries()].map(([AttributeName, AttributeType]) => new Table_AttributeDefinition({ AttributeName, AttributeType }));
+    const globalSecondaryIndexes = (props.globalSecondaryIndexes ?? []).map((gsi) => new Table_GlobalSecondaryIndex({
+        IndexName: gsi.name,
+        KeySchema: toKeySchema(gsi.partitionKey, gsi.sortKey),
+        Projection: new Table_Projection({
+            ProjectionType: gsi.projectionType ?? "ALL",
+            ...(gsi.nonKeyAttributes ? { NonKeyAttributes: gsi.nonKeyAttributes } : {}),
+        }),
+        ...(billingMode === "PROVISIONED"
+            ? { ProvisionedThroughput: toProvisionedThroughput(gsi.provisionedThroughput ?? props.provisionedThroughput ?? DEFAULT_CAPACITY) }
+            : {}),
+    }));
+    const streamConfig = props.stream === true ? {} : props.stream || undefined;
+    const ttlEnabled = props.ttlAttribute !== undefined;
+    const table = new Table(mergeDefaults({
+        TableName: props.tableName,
+        BillingMode: billingMode,
+        AttributeDefinitions: attributeDefinitions,
+        KeySchema: toKeySchema(props.partitionKey, props.sortKey),
+        ...(globalSecondaryIndexes.length > 0 ? { GlobalSecondaryIndexes: globalSecondaryIndexes } : {}),
+        ...(billingMode === "PROVISIONED"
+            ? { ProvisionedThroughput: toProvisionedThroughput(props.provisionedThroughput ?? DEFAULT_CAPACITY) }
+            : {}),
+        ...(streamConfig
+            ? { StreamSpecification: new Table_StreamSpecification({ StreamViewType: streamConfig.viewType ?? "NEW_AND_OLD_IMAGES" }) }
+            : {}),
+        ...(ttlEnabled
+            ? { TimeToLiveSpecification: new Table_TimeToLiveSpecification({ Enabled: true, AttributeName: props.ttlAttribute }) }
+            : {}),
+    }, defaults?.table));
+    return { table };
+}, "DynamoDBTable");

package/dist/composites/ec2-instance-bundle.js

@@ -0,0 +1,75 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Instance, InstanceProfile, Role, SecurityGroup, SecurityGroup_Ingress } from "../generated/index.js";
+import { Base64, Ref } from "../intrinsics.js";
+const EC2_ASSUME_ROLE = {
+    Version: "2012-10-17",
+    Statement: [
+        {
+            Effect: "Allow",
+            Principal: { Service: "ec2.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    ],
+};
+// A rule needs exactly one traffic source. Kept as a lookup (not an if/else
+// chain that builds the `SecurityGroup_Ingress` inline) so the `new` stays out
+// of control flow (EVL002).
+function ingressSource(rule) {
+    if (rule.cidr)
+        return { CidrIp: rule.cidr };
+    if (rule.cidrIpv6)
+        return { CidrIpv6: rule.cidrIpv6 };
+    if (rule.sourceSecurityGroupId)
+        return { SourceSecurityGroupId: rule.sourceSecurityGroupId };
+    throw new Error(`Ec2InstanceBundle ingress rule for port ${rule.fromPort} needs one of cidr, cidrIpv6, or sourceSecurityGroupId`);
+}
+/**
+ * EC2 instance bundle — instance + security group + role/profile + subnet
+ * placement, the hand-rolled unit the aws-bench corpus showed 25 times
+ * (`ec2.Instance`) alongside 79 `ec2.SecurityGroup` instantiations (#1139).
+ * `Ec2InstanceRole` already covers the role/profile half; this composite adds
+ * the instance and its security group, wired to that same role.
+ */
+export const Ec2InstanceBundle = Composite((props) => {
+    const { defaults } = props;
+    const instanceType = props.instanceType ?? "t3.micro";
+    const ingress = props.ingress ?? [];
+    const role = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: EC2_ASSUME_ROLE,
+        ManagedPolicyArns: props.ManagedPolicyArns ?? [],
+        Policies: props.Policies ?? [],
+    }, defaults?.role));
+    const instanceProfile = new InstanceProfile(mergeDefaults({
+        Roles: [Ref(role)],
+    }, defaults?.instanceProfile));
+    // The list-length is dynamic (a caller-supplied array of rules, unlike the
+    // fixed one-or-zero-rule shape RdsInstance's ternary handles), so this
+    // `.map()` — and the `ingressSource(rule)` spread inside it — has to live
+    // in the factory rather than be pre-computed as a const above it. Both are
+    // the accepted, already-shipped shape for this in the codebase: EVL004
+    // exempts spreads inside the Composite factory precisely for this case,
+    // and EVL010's warning on the `.map()` here matches the same warning on
+    // FargateAlb, FargateService, and EksCluster's per-item resource lists.
+    const ingressRules = ingress.map((rule) => new SecurityGroup_Ingress({
+        IpProtocol: rule.protocol ?? "tcp",
+        FromPort: rule.fromPort,
+        ToPort: rule.toPort ?? rule.fromPort,
+        Description: rule.description,
+        ...ingressSource(rule),
+    }));
+    const sg = new SecurityGroup(mergeDefaults({
+        GroupDescription: "Security group for EC2 instance",
+        VpcId: props.vpcId,
+        SecurityGroupIngress: ingressRules.length > 0 ? ingressRules : undefined,
+    }, defaults?.sg));
+    const instance = new Instance(mergeDefaults({
+        ImageId: props.imageId,
+        InstanceType: instanceType,
+        SubnetId: props.subnetId,
+        SecurityGroupIds: [sg.GroupId],
+        IamInstanceProfile: Ref(instanceProfile),
+        KeyName: props.keyName,
+        UserData: props.userData ? Base64(props.userData) : undefined,
+    }, defaults?.instance));
+    return { role, instanceProfile, sg, instance };
+}, "Ec2InstanceBundle");

package/dist/composites/ec2-instance-role.js

@@ -0,0 +1,26 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Role, InstanceProfile } from "../generated/index.js";
+import { Ref } from "../intrinsics.js";
+const EC2_ASSUME_ROLE = {
+    Version: "2012-10-17",
+    Statement: [
+        {
+            Effect: "Allow",
+            Principal: { Service: "ec2.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    ],
+};
+/** An IAM role that EC2 can assume, with the instance profile that attaches it to an instance. */
+export const Ec2InstanceRole = Composite((props) => {
+    const { defaults } = props;
+    const role = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: EC2_ASSUME_ROLE,
+        ManagedPolicyArns: props.ManagedPolicyArns ?? [],
+        Policies: props.Policies ?? [],
+    }, defaults?.role));
+    const instanceProfile = new InstanceProfile(mergeDefaults({
+        Roles: [Ref(role)],
+    }, defaults?.instanceProfile));
+    return { role, instanceProfile };
+}, "Ec2InstanceRole");

package/dist/composites/ecr-repository.js

@@ -0,0 +1,64 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { ECRRepository, ECRRepository_EncryptionConfiguration, ECRRepository_ImageScanningConfiguration, ECRRepository_LifecyclePolicy, } from "../generated/index.js";
+const DEFAULT_LIFECYCLE_RULES = [
+    {
+        rulePriority: 1,
+        description: "Expire untagged images after 14 days",
+        tagStatus: "untagged",
+        countType: "sinceImagePushed",
+        countUnit: "days",
+        countNumber: 14,
+    },
+];
+function toJsonRule(rule) {
+    // Plain conditional assignment (not spread) keeps this traceable for EVL004 —
+    // that rule only exempts spreads inside a Composite factory, and this helper
+    // runs outside one.
+    const selection = {
+        tagStatus: rule.tagStatus ?? "any",
+        countType: rule.countType,
+        countNumber: rule.countNumber,
+    };
+    if (rule.tagPrefixList)
+        selection.tagPrefixList = rule.tagPrefixList;
+    if (rule.tagPatternList)
+        selection.tagPatternList = rule.tagPatternList;
+    if (rule.countUnit)
+        selection.countUnit = rule.countUnit;
+    const jsonRule = {
+        rulePriority: rule.rulePriority,
+        selection,
+        action: { type: "expire" },
+    };
+    if (rule.description)
+        jsonRule.description = rule.description;
+    return jsonRule;
+}
+function toLifecyclePolicyText(rules) {
+    return JSON.stringify({ rules: rules.map(toJsonRule) });
+}
+/** An ECR repository with image scanning, encryption and lifecycle rules. */
+export const EcrRepository = Composite((props) => {
+    const { defaults } = props;
+    const scanOnPush = props.scanOnPush ?? true;
+    const lifecycleRules = props.lifecycleRules ?? DEFAULT_LIFECYCLE_RULES;
+    const repository = new ECRRepository(mergeDefaults({
+        RepositoryName: props.repositoryName,
+        ImageTagMutability: props.imageTagMutability,
+        EmptyOnDelete: props.emptyOnDelete,
+        ImageScanningConfiguration: new ECRRepository_ImageScanningConfiguration({ ScanOnPush: scanOnPush }),
+        ...(lifecycleRules.length > 0
+            ? { LifecyclePolicy: new ECRRepository_LifecyclePolicy({ LifecyclePolicyText: toLifecyclePolicyText(lifecycleRules) }) }
+            : {}),
+        ...(props.encryption
+            ? {
+                EncryptionConfiguration: new ECRRepository_EncryptionConfiguration({
+                    EncryptionType: props.encryption.type ?? "AES256",
+                    ...(props.encryption.kmsKeyId ? { KmsKey: props.encryption.kmsKeyId } : {}),
+                }),
+            }
+            : {}),
+        ...(props.repositoryPolicy ? { RepositoryPolicyText: props.repositoryPolicy } : {}),
+    }, defaults?.repository));
+    return { repository };
+}, "EcrRepository");

package/dist/composites/ecs-trust-policy.js

@@ -0,0 +1,10 @@
+export const ecsTrustPolicy = {
+    Version: "2012-10-17",
+    Statement: [
+        {
+            Effect: "Allow",
+            Principal: { Service: "ecs-tasks.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    ],
+};

package/dist/composites/efs-with-access-point.js

@@ -0,0 +1,44 @@
+import { Composite } from "@intentius/chant";
+import { EFSFileSystem, EFSFileSystem_ElasticFileSystemTag, EFSAccessPoint, EFSAccessPoint_PosixUser, EFSAccessPoint_RootDirectory, EFSAccessPoint_CreationInfo, EFSAccessPoint_AccessPointTag, SecurityGroup, SecurityGroup_Ingress, } from "../generated/index.js";
+/** An EFS file system with an access point and the security group that admits NFS traffic to it. */
+export const EfsWithAccessPoint = Composite((props) => {
+    // Ternary (not push-inside-if) keeps the `new`s out of control flow (EVL002).
+    const ingressRules = props.sourceSecurityGroupId
+        ? [new SecurityGroup_Ingress({ IpProtocol: "tcp", FromPort: 2049, ToPort: 2049, SourceSecurityGroupId: props.sourceSecurityGroupId })]
+        : props.ingressCidr
+            ? [new SecurityGroup_Ingress({ IpProtocol: "tcp", FromPort: 2049, ToPort: 2049, CidrIp: props.ingressCidr })]
+            : [];
+    const securityGroup = new SecurityGroup({
+        GroupDescription: "EFS mount target SG",
+        VpcId: props.vpcId,
+        ...(ingressRules.length > 0 ? { SecurityGroupIngress: ingressRules } : {}),
+    });
+    const nameTag = new EFSFileSystem_ElasticFileSystemTag({
+        Key: "Name",
+        Value: props.name,
+    });
+    const fs = new EFSFileSystem({
+        Encrypted: true,
+        PerformanceMode: props.performanceMode ?? "generalPurpose",
+        ThroughputMode: props.throughputMode ?? "bursting",
+        FileSystemTags: [nameTag],
+    });
+    const posixUser = new EFSAccessPoint_PosixUser({ Uid: props.uid, Gid: props.gid });
+    const creationInfo = new EFSAccessPoint_CreationInfo({
+        OwnerUid: props.uid,
+        OwnerGid: props.gid,
+        Permissions: props.permissions ?? "755",
+    });
+    const rootDirectory = new EFSAccessPoint_RootDirectory({
+        Path: props.rootPath,
+        CreationInfo: creationInfo,
+    });
+    const apNameTag = new EFSAccessPoint_AccessPointTag({ Key: "Name", Value: props.name });
+    const accessPoint = new EFSAccessPoint({
+        FileSystemId: fs.FileSystemId,
+        PosixUser: posixUser,
+        RootDirectory: rootDirectory,
+        AccessPointTags: [apNameTag],
+    });
+    return { securityGroup, fs, accessPoint };
+}, "EfsWithAccessPoint");

package/dist/composites/eks-cluster.js

@@ -0,0 +1,118 @@
+/**
+ * EksCluster — a managed EKS control plane, its node group, and the two IAM
+ * roles they cannot exist without, as the one unit they are.
+ *
+ * The first consumer is kubemicrovm-ops' cluster plane (its "all infra from
+ * the tiers and targets" directive: the cluster stops being a
+ * reference-existing input and becomes provisionable), but nothing here is
+ * kubemicrovm-shaped — a cluster+nodegroup+roles bundle is what every EKS
+ * estate starts with, and cc-aws-canonical's bare cluster is the degenerate
+ * form of it.
+ *
+ * What is deliberately NOT here:
+ *  - Networking. EKS requires subnets in at least two AZs, and `VpcDefault`
+ *    (this directory) already provisions exactly that shape — the two
+ *    composites compose rather than nest, so an adopter with their own VPC
+ *    passes their own subnet ids.
+ *  - Add-ons, OIDC/IRSA, access entries. Real per-estate decisions; a bundle
+ *    that guessed them would fight every adopter. `defaults.cluster` /
+ *    `defaults.nodegroup` are the escape hatch for the fields this surface
+ *    does not name.
+ *
+ * On floci the cluster is k3s-backed and real (`aws eks update-kubeconfig`
+ * works, pods run — the cc-aws-canonical estate proved the path); the node
+ * group is accepted and tracked but backs no separate machines, which is the
+ * emulator being honest about what a laptop can host.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Addon, EKSCluster, Nodegroup, Role } from "../generated/index.js";
+import { Sub } from "../intrinsics.js";
+const managedPolicy = (name) => Sub `arn:\${AWS::Partition}:iam::aws:policy/${name}`;
+export const EksCluster = Composite((props) => {
+    const { defaults } = props;
+    const clusterRole = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+                { Effect: "Allow", Principal: { Service: "eks.amazonaws.com" }, Action: "sts:AssumeRole" },
+            ],
+        },
+        ManagedPolicyArns: [managedPolicy("AmazonEKSClusterPolicy")],
+        Tags: props.tags,
+    }, defaults?.clusterRole));
+    const cluster = new EKSCluster(mergeDefaults({
+        Name: props.name,
+        RoleArn: clusterRole.Arn,
+        Version: props.version,
+        ResourcesVpcConfig: {
+            SubnetIds: props.subnetIds,
+            ...(props.securityGroupIds ? { SecurityGroupIds: props.securityGroupIds } : {}),
+        },
+        Tags: props.tags,
+    }, defaults?.cluster));
+    // Three fixed add-on slots, the same statically-evaluable shape
+    // vpc-default uses for its optional third AZ: a ternary is an expression
+    // (EVL-clean); a loop-built member map is control flow the reference
+    // composites must not contain (EVL002/EVL003). Members are addon1..addon3
+    // in the caller's order — logical ids stay stable as long as the order
+    // does, which the caller controls.
+    const a1 = props.addons?.[0];
+    const a2 = props.addons?.[1];
+    const a3 = props.addons?.[2];
+    const addon1 = a1
+        ? new Addon({ ClusterName: props.name, AddonName: a1.name, AddonVersion: a1.version, Tags: props.tags }, { DependsOn: [cluster] })
+        : undefined;
+    const addon2 = a2
+        ? new Addon({ ClusterName: props.name, AddonName: a2.name, AddonVersion: a2.version, Tags: props.tags }, { DependsOn: [cluster] })
+        : undefined;
+    const addon3 = a3
+        ? new Addon({ ClusterName: props.name, AddonName: a3.name, AddonVersion: a3.version, Tags: props.tags }, { DependsOn: [cluster] })
+        : undefined;
+    if (!props.nodegroup) {
+        return {
+            clusterRole,
+            cluster,
+            ...(addon1 ? { addon1 } : {}),
+            ...(addon2 ? { addon2 } : {}),
+            ...(addon3 ? { addon3 } : {}),
+        };
+    }
+    const nodeRole = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+                { Effect: "Allow", Principal: { Service: "ec2.amazonaws.com" }, Action: "sts:AssumeRole" },
+            ],
+        },
+        ManagedPolicyArns: [
+            managedPolicy("AmazonEKSWorkerNodePolicy"),
+            managedPolicy("AmazonEKS_CNI_Policy"),
+            managedPolicy("AmazonEC2ContainerRegistryReadOnly"),
+        ],
+        Tags: props.tags,
+    }, defaults?.nodeRole));
+    const nodegroup = new Nodegroup(mergeDefaults({
+        // The literal, not an attribute reference: Name is an input the caller
+        // gave us, and the generated class exposes accessors only for GetAtt
+        // attributes. The creation-order edge is DependsOn below.
+        ClusterName: props.name,
+        NodeRole: nodeRole.Arn,
+        Subnets: props.nodegroup.subnetIds ?? props.subnetIds,
+        InstanceTypes: props.nodegroup.instanceTypes ?? ["t3.medium"],
+        ScalingConfig: {
+            DesiredSize: props.nodegroup.desiredSize ?? 2,
+            MinSize: props.nodegroup.minSize ?? props.nodegroup.desiredSize ?? 2,
+            MaxSize: props.nodegroup.maxSize ?? props.nodegroup.desiredSize ?? 2,
+        },
+        Tags: props.tags ? Object.fromEntries(props.tags.map((t) => [t.Key, t.Value])) : undefined,
+    }, defaults?.nodegroup), { DependsOn: [cluster] });
+    return {
+        clusterRole,
+        cluster,
+        nodeRole,
+        nodegroup,
+        ...(addon1 ? { addon1 } : {}),
+        ...(addon2 ? { addon2 } : {}),
+        ...(addon3 ? { addon3 } : {}),
+    };
+}, "EksCluster");

package/dist/composites/fargate-alb.js

@@ -0,0 +1,216 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { EcsCluster, EcsService, EcsService_LoadBalancer, EcsService_NetworkConfiguration, EcsService_AwsVpcConfiguration, TaskDefinition, TaskDefinition_ContainerDefinition, TaskDefinition_PortMapping, TaskDefinition_LogConfiguration, TaskDefinition_KeyValuePair, LoadBalancer, TargetGroup, Listener, Listener_Action, Listener_Certificate, Listener_RedirectConfig, SecurityGroup, SecurityGroup_Ingress, LogGroup, Role, Role_Policy, } from "../generated/index.js";
+import { Sub } from "../intrinsics.js";
+import { ECRActions } from "../actions/ecr.js";
+import { LogsActions } from "../actions/logs.js";
+import { ecsTrustPolicy } from "./ecs-trust-policy.js";
+/** A Fargate service behind its own Application Load Balancer: cluster, task definition, service, target group, listener, logs and roles. */
+export const FargateAlb = Composite((props) => {
+    const containerPort = props.containerPort ?? 80;
+    const cpu = props.cpu ?? "256";
+    const memory = props.memory ?? "512";
+    const desiredCount = props.desiredCount ?? 2;
+    const healthCheckPath = props.healthCheckPath ?? "/";
+    const listenerPort = props.listenerPort ?? 80;
+    const logRetentionDays = props.logRetentionDays ?? 30;
+    const { defaults: defs } = props;
+    // ECS Cluster
+    const cluster = new EcsCluster(mergeDefaults({}, defs?.cluster));
+    // Execution role — ECR pull + CloudWatch Logs write
+    const executionPolicyDocument = {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Effect: "Allow",
+                Action: ECRActions.Pull,
+                Resource: "*",
+            },
+            {
+                Effect: "Allow",
+                Action: LogsActions.Write,
+                Resource: "*",
+            },
+            // Allow pulling private-registry credentials when configured.
+            ...(props.repositoryCredentials
+                ? [{
+                        Effect: "Allow",
+                        Action: ["secretsmanager:GetSecretValue"],
+                        Resource: props.repositoryCredentials,
+                    }]
+                : []),
+        ],
+    };
+    const executionPolicy = new Role_Policy({
+        PolicyName: "ExecutionPolicy",
+        PolicyDocument: executionPolicyDocument,
+    });
+    const executionRole = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: ecsTrustPolicy,
+        Policies: [executionPolicy],
+    }, defs?.executionRole));
+    // Task role — app permissions
+    const taskRole = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: ecsTrustPolicy,
+        ManagedPolicyArns: props.ManagedPolicyArns,
+        Policies: props.Policies,
+    }, defs?.taskRole));
+    // Log group
+    const logGroup = new LogGroup({
+        RetentionInDays: logRetentionDays,
+    });
+    // Container definition
+    const portMapping = new TaskDefinition_PortMapping({
+        ContainerPort: containerPort,
+        Protocol: "tcp",
+    });
+    const logConfiguration = new TaskDefinition_LogConfiguration({
+        LogDriver: "awslogs",
+        Options: {
+            "awslogs-group": logGroup,
+            "awslogs-region": Sub `\${AWS::Region}`,
+            "awslogs-stream-prefix": "ecs",
+        },
+    });
+    // `.map` keeps the `new`s out of the `for`/`if` (EVL002).
+    const environmentVars = props.environment
+        ? Object.entries(props.environment).map(([name, value]) => new TaskDefinition_KeyValuePair({ Name: name, Value: value }))
+        : [];
+    const container = new TaskDefinition_ContainerDefinition({
+        Name: "app",
+        Image: props.image,
+        Essential: true,
+        PortMappings: [portMapping],
+        LogConfiguration: logConfiguration,
+        Environment: environmentVars.length > 0 ? environmentVars : undefined,
+        Command: props.command,
+        RepositoryCredentials: props.repositoryCredentials
+            ? { CredentialsParameter: props.repositoryCredentials }
+            : undefined,
+    });
+    // Task definition
+    const taskDef = new TaskDefinition(mergeDefaults({
+        NetworkMode: "awsvpc",
+        RequiresCompatibilities: ["FARGATE"],
+        Cpu: cpu,
+        Memory: memory,
+        ExecutionRoleArn: executionRole.Arn,
+        TaskRoleArn: taskRole.Arn,
+        ContainerDefinitions: [container],
+    }, defs?.taskDef));
+    // ALB security group — ingress on the served port(s) from anywhere. With a
+    // cert that's 443 (HTTPS) + 80 (redirect); otherwise the plain listener port.
+    const ingressPorts = props.certificateArn ? [443, 80] : [listenerPort];
+    const albIngress = ingressPorts.map((port) => new SecurityGroup_Ingress({
+        IpProtocol: "tcp",
+        FromPort: port,
+        ToPort: port,
+        CidrIp: "0.0.0.0/0",
+    }));
+    const albSg = new SecurityGroup({
+        GroupDescription: "ALB security group",
+        VpcId: props.vpcId,
+        SecurityGroupIngress: albIngress,
+    });
+    // Task security group — ingress on container port from ALB SG
+    const taskIngress = new SecurityGroup_Ingress({
+        IpProtocol: "tcp",
+        FromPort: containerPort,
+        ToPort: containerPort,
+        SourceSecurityGroupId: albSg.GroupId,
+    });
+    const taskSg = new SecurityGroup({
+        GroupDescription: "Fargate task security group",
+        VpcId: props.vpcId,
+        SecurityGroupIngress: [taskIngress],
+    });
+    // Application Load Balancer
+    const alb = new LoadBalancer(mergeDefaults({
+        Type: "application",
+        Scheme: "internet-facing",
+        Subnets: props.publicSubnetIds,
+        SecurityGroups: [albSg.GroupId],
+    }, defs?.alb));
+    // Target group
+    const targetGroup = new TargetGroup(mergeDefaults({
+        TargetType: "ip",
+        Protocol: "HTTP",
+        Port: containerPort,
+        VpcId: props.vpcId,
+        HealthCheckPath: healthCheckPath,
+    }, defs?.targetGroup));
+    // Listener(s). With a cert: HTTPS:443 forwards to the target group and HTTP:80
+    // redirects to HTTPS. Without: a single HTTP listener on `listenerPort`.
+    const forwardAction = new Listener_Action({
+        Type: "forward",
+        TargetGroupArn: targetGroup.TargetGroupArn,
+    });
+    // Ternaries keep the `new`s out of the `if`/`else` (EVL002).
+    const listener = props.certificateArn
+        ? new Listener({
+            LoadBalancerArn: alb.LoadBalancerArn,
+            Port: 443,
+            Protocol: "HTTPS",
+            Certificates: [new Listener_Certificate({ CertificateArn: props.certificateArn })],
+            DefaultActions: [forwardAction],
+        })
+        : new Listener({
+            LoadBalancerArn: alb.LoadBalancerArn,
+            Port: listenerPort,
+            Protocol: "HTTP",
+            DefaultActions: [forwardAction],
+        });
+    const redirectListener = props.certificateArn
+        ? new Listener({
+            LoadBalancerArn: alb.LoadBalancerArn,
+            Port: 80,
+            Protocol: "HTTP",
+            DefaultActions: [
+                new Listener_Action({
+                    Type: "redirect",
+                    RedirectConfig: new Listener_RedirectConfig({
+                        Protocol: "HTTPS",
+                        Port: "443",
+                        StatusCode: "HTTP_301",
+                    }),
+                }),
+            ],
+        })
+        : undefined;
+    // ECS Service
+    const serviceLoadBalancer = new EcsService_LoadBalancer({
+        ContainerName: "app",
+        ContainerPort: containerPort,
+        TargetGroupArn: targetGroup.TargetGroupArn,
+    });
+    const awsVpcConfig = new EcsService_AwsVpcConfiguration({
+        Subnets: props.privateSubnetIds,
+        SecurityGroups: [taskSg.GroupId],
+        AssignPublicIp: "DISABLED",
+    });
+    const networkConfig = new EcsService_NetworkConfiguration({
+        AwsvpcConfiguration: awsVpcConfig,
+    });
+    const service = new EcsService(mergeDefaults({
+        Cluster: cluster.Arn,
+        TaskDefinition: taskDef.TaskDefinitionArn,
+        LaunchType: "FARGATE",
+        DesiredCount: desiredCount,
+        HealthCheckGracePeriodSeconds: 60,
+        LoadBalancers: [serviceLoadBalancer],
+        NetworkConfiguration: networkConfig,
+    }, defs?.service), { DependsOn: [listener] });
+    return {
+        cluster,
+        executionRole,
+        taskRole,
+        logGroup,
+        taskDef,
+        albSg,
+        taskSg,
+        alb,
+        targetGroup,
+        listener,
+        ...(redirectListener ? { redirectListener } : {}),
+        service,
+    };
+}, "FargateAlb");