@intentius/chant-lexicon-aws 0.124.31 → 0.124.32

package/dist/composites/fargate-service.js

@@ -0,0 +1,222 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { EcsService, EcsService_LoadBalancer, EcsService_NetworkConfiguration, EcsService_AwsVpcConfiguration, TaskDefinition, TaskDefinition_ContainerDefinition, TaskDefinition_MountPoint, TaskDefinition_PortMapping, TaskDefinition_LogConfiguration, TaskDefinition_KeyValuePair, TaskDefinition_EFSVolumeConfiguration, TaskDefinition_Volume, TaskDefinition_Ulimit, TargetGroup, ListenerRule, ListenerRule_Action, ListenerRule_RuleCondition, ListenerRule_PathPatternConfig, ListenerRule_HostHeaderConfig, SecurityGroup, SecurityGroup_Ingress, LogGroup, Role, ScalableTarget, ApplicationAutoScalingScalingPolicy, ApplicationAutoScalingScalingPolicy_TargetTrackingScalingPolicyConfiguration, ApplicationAutoScalingScalingPolicy_PredefinedMetricSpecification, } from "../generated/index.js";
+import { Sub, Join, Select, Split } from "../intrinsics.js";
+import { ecsTrustPolicy } from "./ecs-trust-policy.js";
+/**
+ * The ALB `ListenerRule`'s real `Priority` bounds (documented on
+ * `elasticloadbalancing:CreateRule`, and enforced the same way for a
+ * CloudFormation-managed rule) — not an opinion this composite holds.
+ *
+ * Exported for the same reason as `MICROVM_LIMITS` (#1374, #1420): a
+ * consumer routing to the same shared ALB through another control plane
+ * needs the same numbers, and copying them is how two sources of truth
+ * start.
+ */
+export const FARGATE_SERVICE_LIMITS = {
+    priority: { min: 1, max: 50000 },
+};
+/** A Fargate service routed by a listener rule on an existing ALB listener, with its task definition, target group, logs, roles and optional autoscaling. */
+export const FargateService = Composite((props) => {
+    if (!props.pathPatterns && !props.hostHeaders) {
+        throw new Error("FargateService requires at least one of pathPatterns or hostHeaders");
+    }
+    if (props.priority < FARGATE_SERVICE_LIMITS.priority.min || props.priority > FARGATE_SERVICE_LIMITS.priority.max) {
+        throw new Error(`FargateService priority must be between ${FARGATE_SERVICE_LIMITS.priority.min} and ${FARGATE_SERVICE_LIMITS.priority.max}`);
+    }
+    const containerPort = props.containerPort ?? 80;
+    const cpu = props.cpu ?? "256";
+    const memory = props.memory ?? "512";
+    const desiredCount = props.desiredCount ?? 2;
+    const healthCheckPath = props.healthCheckPath ?? "/";
+    const logRetentionDays = props.logRetentionDays ?? 30;
+    const { defaults: defs } = props;
+    // Auto-inject EFS managed policy when efsMounts are present
+    const EFS_POLICY = "arn:aws:iam::aws:policy/AmazonElasticFileSystemClientReadWriteAccess";
+    const managedPolicies = props.ManagedPolicyArns ? [...props.ManagedPolicyArns] : [];
+    if (props.efsMounts?.length && !managedPolicies.includes(EFS_POLICY)) {
+        managedPolicies.push(EFS_POLICY);
+    }
+    // Task role — app permissions
+    const taskRole = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: ecsTrustPolicy,
+        ManagedPolicyArns: managedPolicies.length > 0 ? managedPolicies : undefined,
+        Policies: props.Policies,
+    }, defs?.taskRole));
+    // Log group
+    const logGroup = new LogGroup({
+        RetentionInDays: logRetentionDays,
+    });
+    // Container definition
+    const portMapping = new TaskDefinition_PortMapping({
+        ContainerPort: containerPort,
+        Protocol: "tcp",
+    });
+    const logConfiguration = new TaskDefinition_LogConfiguration({
+        LogDriver: "awslogs",
+        Options: {
+            "awslogs-group": logGroup,
+            "awslogs-region": Sub `\${AWS::Region}`,
+            "awslogs-stream-prefix": "ecs",
+        },
+    });
+    // `.map` keeps the `new`s out of the `for`/`if` (EVL002).
+    const environmentVars = props.environment
+        ? Object.entries(props.environment).map(([name, value]) => new TaskDefinition_KeyValuePair({ Name: name, Value: value }))
+        : [];
+    // EFS volumes and mount points
+    const efsVolumes = (props.efsMounts ?? []).map((m, i) => new TaskDefinition_Volume({
+        Name: m.volumeName ?? `efs-${i}`,
+        EFSVolumeConfiguration: new TaskDefinition_EFSVolumeConfiguration({
+            FileSystemId: m.fileSystemId,
+            ...(m.accessPointId && { AuthorizationConfig: { AccessPointId: m.accessPointId } }),
+            TransitEncryption: m.transitEncryption ?? "ENABLED",
+        }),
+    }));
+    const efsMountPoints = (props.efsMounts ?? []).map((m, i) => new TaskDefinition_MountPoint({
+        ContainerPath: m.containerPath,
+        SourceVolume: m.volumeName ?? `efs-${i}`,
+    }));
+    const allMountPoints = [...efsMountPoints, ...(props.mountPoints ?? [])];
+    const container = new TaskDefinition_ContainerDefinition({
+        Name: "app",
+        Image: props.image,
+        Essential: true,
+        PortMappings: [portMapping],
+        LogConfiguration: logConfiguration,
+        Environment: environmentVars.length > 0 ? environmentVars : undefined,
+        Command: props.command,
+        MountPoints: allMountPoints.length > 0 ? allMountPoints : undefined,
+        Ulimits: props.ulimits?.map(u => new TaskDefinition_Ulimit({
+            Name: u.name,
+            SoftLimit: u.softLimit,
+            HardLimit: u.hardLimit,
+        })),
+    });
+    // Task definition
+    const taskDef = new TaskDefinition(mergeDefaults({
+        NetworkMode: "awsvpc",
+        RequiresCompatibilities: ["FARGATE"],
+        Cpu: cpu,
+        Memory: memory,
+        ExecutionRoleArn: props.executionRoleArn,
+        TaskRoleArn: taskRole.Arn,
+        ContainerDefinitions: [container],
+        ...(efsVolumes.length > 0 && { Volumes: efsVolumes }),
+    }, defs?.taskDef));
+    // Task security group — ingress on container port from ALB SG
+    const taskIngress = new SecurityGroup_Ingress({
+        IpProtocol: "tcp",
+        FromPort: containerPort,
+        ToPort: containerPort,
+        SourceSecurityGroupId: props.albSecurityGroupId,
+    });
+    const taskSg = new SecurityGroup({
+        GroupDescription: "Fargate task security group",
+        VpcId: props.vpcId,
+        SecurityGroupIngress: [taskIngress],
+    });
+    // Target group
+    const targetGroup = new TargetGroup(mergeDefaults({
+        TargetType: "ip",
+        Protocol: "HTTP",
+        Port: containerPort,
+        VpcId: props.vpcId,
+        HealthCheckPath: healthCheckPath,
+    }, defs?.targetGroup));
+    // Listener rule conditions
+    // Conditional entries via spread keep the `new`s out of the `if`s (EVL002).
+    const conditions = [
+        ...(props.pathPatterns
+            ? [new ListenerRule_RuleCondition({
+                    Field: "path-pattern",
+                    PathPatternConfig: new ListenerRule_PathPatternConfig({ Values: props.pathPatterns }),
+                })]
+            : []),
+        ...(props.hostHeaders
+            ? [new ListenerRule_RuleCondition({
+                    Field: "host-header",
+                    HostHeaderConfig: new ListenerRule_HostHeaderConfig({ Values: props.hostHeaders }),
+                })]
+            : []),
+    ];
+    // Listener rule
+    const ruleAction = new ListenerRule_Action({
+        Type: "forward",
+        TargetGroupArn: targetGroup.TargetGroupArn,
+    });
+    const rule = new ListenerRule({
+        ListenerArn: props.listenerArn,
+        Priority: props.priority,
+        Actions: [ruleAction],
+        Conditions: conditions,
+    });
+    // ECS Service
+    const serviceLoadBalancer = new EcsService_LoadBalancer({
+        ContainerName: "app",
+        ContainerPort: containerPort,
+        TargetGroupArn: targetGroup.TargetGroupArn,
+    });
+    const awsVpcConfig = new EcsService_AwsVpcConfiguration({
+        Subnets: props.privateSubnetIds,
+        SecurityGroups: [taskSg.GroupId],
+        AssignPublicIp: "DISABLED",
+    });
+    const networkConfig = new EcsService_NetworkConfiguration({
+        AwsvpcConfiguration: awsVpcConfig,
+    });
+    const service = new EcsService(mergeDefaults({
+        Cluster: props.clusterArn,
+        TaskDefinition: taskDef.TaskDefinitionArn,
+        LaunchType: "FARGATE",
+        DesiredCount: desiredCount,
+        HealthCheckGracePeriodSeconds: 60,
+        LoadBalancers: [serviceLoadBalancer],
+        NetworkConfiguration: networkConfig,
+    }, defs?.service), { DependsOn: [rule] });
+    let scalableTarget;
+    let scalingPolicy;
+    // Closure (invoked below) keeps the autoscaling `new`s out of the `if` (EVL002);
+    // the guard narrows `props.autoscaling` for the body.
+    const buildAutoscaling = () => {
+        if (!props.autoscaling)
+            return;
+        const { minCapacity = 1, maxCapacity, cpuTarget = 60, scaleInCooldown, scaleOutCooldown } = props.autoscaling;
+        const resourceId = Join("/", ["service", Select(1, Split("/", props.clusterArn)), service.Name]);
+        scalableTarget = new ScalableTarget({
+            ServiceNamespace: "ecs",
+            ScalableDimension: "ecs:service:DesiredCount",
+            ResourceId: resourceId,
+            MinCapacity: minCapacity,
+            MaxCapacity: maxCapacity,
+        });
+        const trackingConfig = new ApplicationAutoScalingScalingPolicy_TargetTrackingScalingPolicyConfiguration({
+            TargetValue: cpuTarget,
+            PredefinedMetricSpecification: new ApplicationAutoScalingScalingPolicy_PredefinedMetricSpecification({
+                PredefinedMetricType: "ECSServiceAverageCPUUtilization",
+            }),
+            ...(scaleInCooldown !== undefined && { ScaleInCooldown: scaleInCooldown }),
+            ...(scaleOutCooldown !== undefined && { ScaleOutCooldown: scaleOutCooldown }),
+        });
+        scalingPolicy = new ApplicationAutoScalingScalingPolicy({
+            PolicyName: Sub `\${AWS::StackName}-cpu`,
+            PolicyType: "TargetTrackingScaling",
+            ServiceNamespace: "ecs",
+            ScalableDimension: "ecs:service:DesiredCount",
+            ResourceId: resourceId,
+            TargetTrackingScalingPolicyConfiguration: trackingConfig,
+        });
+    };
+    if (props.autoscaling)
+        buildAutoscaling();
+    return {
+        taskRole,
+        logGroup,
+        taskDef,
+        taskSg,
+        targetGroup,
+        rule,
+        service,
+        ...(scalableTarget ? { scalableTarget } : {}),
+        ...(scalingPolicy ? { scalingPolicy } : {}),
+    };
+}, "FargateService");

package/dist/composites/index.js

@@ -0,0 +1,28 @@
+export { OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail } from "./landing-zone.js";
+export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda } from "./lambda-function.js";
+export { LambdaApi } from "./lambda-api.js";
+export { LambdaScheduled, ScheduledLambda } from "./scheduled-lambda.js";
+export { LambdaSqs } from "./lambda-sqs.js";
+export { LambdaEventBridge } from "./lambda-eventbridge.js";
+export { LambdaDynamoDB } from "./lambda-dynamodb.js";
+export { EcrRepository } from "./ecr-repository.js";
+export { DynamoDBTable } from "./dynamodb-table.js";
+export { LambdaS3 } from "./lambda-s3.js";
+export { LambdaSns } from "./lambda-sns.js";
+export { VpcDefault } from "./vpc-default.js";
+export { FargateAlb } from "./fargate-alb.js";
+export { AlbShared } from "./alb-shared.js";
+export { FargateService, FARGATE_SERVICE_LIMITS } from "./fargate-service.js";
+export { NlbService } from "./nlb-service.js";
+export { RdsInstance, RdsInstance as RdsPostgres } from "./rds-instance.js";
+export { EfsWithAccessPoint } from "./efs-with-access-point.js";
+export { SolrFargateService } from "./solr-fargate-service.js";
+export { Ec2InstanceRole } from "./ec2-instance-role.js";
+export { Ec2InstanceBundle } from "./ec2-instance-bundle.js";
+export { MinimalVpc } from "./minimal-vpc.js";
+export { EksCluster } from "./eks-cluster.js";
+export { MicrovmApp, MICROVM_LIMITS } from "./microvm-app.js";
+export { AgentCoreAgent, agentCoreDefaultEndpointArn, AGENTCORE_LIMITS } from "./agentcore-agent.js";
+export { StepFunctionsWorkflow } from "./step-functions-workflow.js";
+export { MonitoringStack } from "./monitoring-stack.js";
+export { BucketDeployment } from "./bucket-deployment.js";

package/dist/composites/lambda-api.js

@@ -0,0 +1,15 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Permission } from "../generated/index.js";
+import { LambdaFunction } from "./lambda-function.js";
+/** A Lambda function with an execution role and the permission that lets API Gateway invoke it. */
+export const LambdaApi = Composite((props) => {
+    const { defaults } = props;
+    const { role, func } = LambdaFunction(props);
+    const permission = new Permission(mergeDefaults({
+        FunctionName: func.Arn,
+        Action: "lambda:InvokeFunction",
+        Principal: "apigateway.amazonaws.com",
+        SourceArn: props.sourceArn,
+    }, defaults?.permission));
+    return { role, func, permission };
+}, "LambdaApi");

package/dist/composites/lambda-dynamodb.js

@@ -0,0 +1,77 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Table, Table_AttributeDefinition, Table_KeySchema, Table_StreamSpecification, Role_Policy, EventSourceMapping, } from "../generated/index.js";
+import { dynamoDBActionsFor } from "../actions/dynamodb.js";
+import { LambdaFunction } from "./lambda-function.js";
+/** A Lambda function with a DynamoDB table, table access for its role and an optional stream trigger. */
+export const LambdaDynamoDB = Composite((props) => {
+    // Conditional entries via spread keep the `new`s out of the `if` (EVL002).
+    const attributeDefinitions = [
+        new Table_AttributeDefinition({ AttributeName: props.partitionKey, AttributeType: "S" }),
+        ...(props.sortKey ? [new Table_AttributeDefinition({ AttributeName: props.sortKey, AttributeType: "S" })] : []),
+    ];
+    const keySchema = [
+        new Table_KeySchema({ AttributeName: props.partitionKey, KeyType: "HASH" }),
+        ...(props.sortKey ? [new Table_KeySchema({ AttributeName: props.sortKey, KeyType: "RANGE" })] : []),
+    ];
+    const { defaults } = props;
+    const table = new Table(mergeDefaults({
+        TableName: props.tableName,
+        BillingMode: "PAY_PER_REQUEST",
+        AttributeDefinitions: attributeDefinitions,
+        KeySchema: keySchema,
+        ...(props.streams && {
+            StreamSpecification: new Table_StreamSpecification({
+                StreamViewType: props.streams.viewType ?? "NEW_AND_OLD_IMAGES",
+            }),
+        }),
+    }, defaults?.table));
+    const access = props.access ?? "ReadWrite";
+    // Build the policy list with conditional spreads (no push-inside-if) (EVL002).
+    const policies = [
+        ...(access !== "None"
+            ? [new Role_Policy({
+                    PolicyName: `DynamoDB${access}`,
+                    PolicyDocument: {
+                        Version: "2012-10-17",
+                        Statement: [{ Effect: "Allow", Action: dynamoDBActionsFor(access), Resource: table.Arn }],
+                    },
+                })]
+            : []),
+        ...(props.streams
+            ? [new Role_Policy({
+                    PolicyName: "DynamoDBStreamRead",
+                    PolicyDocument: {
+                        Version: "2012-10-17",
+                        Statement: [{
+                                Effect: "Allow",
+                                Action: [
+                                    "dynamodb:GetRecords",
+                                    "dynamodb:GetShardIterator",
+                                    "dynamodb:DescribeStream",
+                                    "dynamodb:ListStreams",
+                                ],
+                                Resource: table.StreamArn,
+                            }],
+                    },
+                })]
+            : []),
+        ...(props.Policies ?? []),
+    ];
+    const env = props.Environment ?? { Variables: {} };
+    const variables = { ...(env.Variables ?? {}), TABLE_NAME: table.Ref };
+    const { role, func } = LambdaFunction({
+        ...props,
+        Policies: policies,
+        Environment: { Variables: variables },
+    });
+    const eventSourceMapping = props.streams
+        ? new EventSourceMapping(mergeDefaults({
+            FunctionName: func.Arn,
+            EventSourceArn: table.StreamArn,
+            StartingPosition: props.streams.startingPosition ?? "TRIM_HORIZON",
+            ...(props.streams.batchSize !== undefined && { BatchSize: props.streams.batchSize }),
+            ...(props.streams.bisectOnFunctionError !== undefined && { BisectBatchOnFunctionError: props.streams.bisectOnFunctionError }),
+        }, defaults?.eventSourceMapping))
+        : undefined;
+    return { table, role, func, ...(eventSourceMapping ? { eventSourceMapping } : {}) };
+}, "LambdaDynamoDB");

package/dist/composites/lambda-eventbridge.js

@@ -0,0 +1,27 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { EventRule, EventRule_Target, Permission } from "../generated/index.js";
+import { LambdaFunction } from "./lambda-function.js";
+/** A Lambda function triggered by an EventBridge rule, on a schedule or an event pattern. */
+export const LambdaEventBridge = Composite((props) => {
+    const { defaults } = props;
+    const { role, func } = LambdaFunction(props);
+    const rule = new EventRule(mergeDefaults({
+        Name: props.ruleName,
+        ScheduleExpression: props.schedule,
+        EventPattern: props.eventPattern,
+        State: (props.enabled ?? true) ? "ENABLED" : "DISABLED",
+        Targets: [
+            new EventRule_Target({
+                Arn: func.Arn,
+                Id: "Target0",
+            }),
+        ],
+    }, defaults?.rule));
+    const permission = new Permission(mergeDefaults({
+        FunctionName: func.Arn,
+        Action: "lambda:InvokeFunction",
+        Principal: "events.amazonaws.com",
+        SourceArn: rule.Arn,
+    }, defaults?.permission));
+    return { rule, role, func, permission };
+}, "LambdaEventBridge");

package/dist/composites/lambda-function.js

@@ -0,0 +1,54 @@
+import { Composite, withDefaults, mergeDefaults } from "@intentius/chant";
+import { Role, Function, Function_VpcConfig } from "../generated/index.js";
+const lambdaTrustPolicy = {
+    Version: "2012-10-17",
+    Statement: [
+        {
+            Effect: "Allow",
+            Principal: { Service: "lambda.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    ],
+};
+const BASIC_EXECUTION_ARN = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole";
+const VPC_ACCESS_ARN = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole";
+/** A Lambda function with its execution role. */
+export const LambdaFunction = Composite((props) => {
+    const { defaults } = props;
+    const managedPolicies = [BASIC_EXECUTION_ARN];
+    if (props.VpcConfig) {
+        managedPolicies.push(VPC_ACCESS_ARN);
+    }
+    if (props.ManagedPolicyArns) {
+        managedPolicies.push(...props.ManagedPolicyArns);
+    }
+    const role = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: lambdaTrustPolicy,
+        ManagedPolicyArns: managedPolicies,
+        Policies: props.Policies,
+    }, defaults?.role));
+    const func = new Function(mergeDefaults({
+        FunctionName: props.name,
+        Runtime: props.Runtime,
+        Handler: props.Handler,
+        Code: props.Code,
+        Role: role.Arn,
+        Timeout: props.Timeout ?? 30,
+        MemorySize: props.MemorySize,
+        Environment: props.Environment,
+        VpcConfig: props.VpcConfig ? new Function_VpcConfig(props.VpcConfig) : undefined,
+    }, defaults?.func));
+    return { role, func };
+}, "LambdaFunction");
+export const LambdaNode = withDefaults(LambdaFunction, {
+    Runtime: "nodejs20.x",
+    Handler: "index.handler",
+});
+export const LambdaPython = withDefaults(LambdaFunction, {
+    Runtime: "python3.12",
+    Handler: "handler.handler",
+});
+/** @deprecated Use `LambdaNode` instead */
+export const NodeLambda = LambdaNode;
+/** @deprecated Use `LambdaPython` instead */
+export const PythonLambda = LambdaPython;

package/dist/composites/lambda-s3.js

@@ -0,0 +1,93 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Bucket, Bucket_BucketEncryption, Bucket_ServerSideEncryptionRule, Bucket_ServerSideEncryptionByDefault, Bucket_PublicAccessBlockConfiguration, Bucket_NotificationConfiguration, Bucket_LambdaConfiguration, Permission, Role_Policy, } from "../generated/index.js";
+import { Sub, Join } from "../intrinsics.js";
+import { s3ActionsFor } from "../actions/s3.js";
+import { LambdaFunction } from "./lambda-function.js";
+/** A Lambda function with an S3 bucket, bucket access for its role and an optional bucket-notification trigger. */
+export const LambdaS3 = Composite((props) => {
+    const encryptionDefault = new Bucket_ServerSideEncryptionByDefault({ SSEAlgorithm: "AES256" });
+    const encryptionRule = new Bucket_ServerSideEncryptionRule({
+        ServerSideEncryptionByDefault: encryptionDefault,
+    });
+    const bucketEncryption = new Bucket_BucketEncryption({
+        ServerSideEncryptionConfiguration: [encryptionRule],
+    });
+    const publicAccessBlock = new Bucket_PublicAccessBlockConfiguration({
+        BlockPublicAcls: true,
+        BlockPublicPolicy: true,
+        IgnorePublicAcls: true,
+        RestrictPublicBuckets: true,
+    });
+    const { defaults } = props;
+    const access = props.access ?? "ReadWrite";
+    // The triggered path builds its resources in a closure so the `new`s aren't
+    // under the `if` (EVL002); it's invoked below only when a trigger is declared.
+    const buildTriggered = () => {
+        // Create Lambda first to break the circular CFN dependency.
+        // Compute bucket ARN from name (no GetAtt on bucket → no resource dep).
+        const name = props.bucketName ?? Sub `\${AWS::StackName}-bucket`;
+        const bucketArnBase = Join("", ["arn:aws:s3:::", name]);
+        const bucketArnWildcard = Join("", ["arn:aws:s3:::", name, "/*"]);
+        const s3Policy = new Role_Policy({
+            PolicyName: `S3${access}`,
+            PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [{ Effect: "Allow", Action: s3ActionsFor(access), Resource: [bucketArnBase, bucketArnWildcard] }],
+            },
+        });
+        const policies = props.Policies ? [s3Policy, ...props.Policies] : [s3Policy];
+        const env = props.Environment ?? { Variables: {} };
+        const variables = { ...(env.Variables ?? {}), BUCKET_NAME: name };
+        const { role, func } = LambdaFunction({ ...props, Policies: policies, Environment: { Variables: variables } });
+        const permission = new Permission({
+            FunctionName: func.Arn,
+            Action: "lambda:InvokeFunction",
+            Principal: "s3.amazonaws.com",
+            SourceArn: bucketArnBase,
+        });
+        // Non-null: the closure is only invoked when `props.trigger` is set (below).
+        const { events = ["s3:ObjectCreated:*"], prefix, suffix } = props.trigger;
+        const rules = [];
+        if (prefix)
+            rules.push({ Name: "prefix", Value: prefix });
+        if (suffix)
+            rules.push({ Name: "suffix", Value: suffix });
+        const lambdaConfigs = events.map((event) => new Bucket_LambdaConfiguration({
+            Event: event,
+            Function: func.Arn,
+            ...(rules.length > 0 && { Filter: { S3Key: { Rules: rules } } }),
+        }));
+        const notificationConfig = new Bucket_NotificationConfiguration({
+            LambdaConfigurations: lambdaConfigs,
+        });
+        const bucket = new Bucket(mergeDefaults({
+            BucketName: props.bucketName,
+            BucketEncryption: bucketEncryption,
+            PublicAccessBlockConfiguration: publicAccessBlock,
+            NotificationConfiguration: notificationConfig,
+        }, defaults?.bucket), { DependsOn: [permission] });
+        return { bucket, role, func, permission };
+    };
+    if (props.trigger)
+        return buildTriggered();
+    // Non-trigger path: original flow
+    const bucket = new Bucket(mergeDefaults({
+        BucketName: props.bucketName,
+        BucketEncryption: bucketEncryption,
+        PublicAccessBlockConfiguration: publicAccessBlock,
+    }, defaults?.bucket));
+    const s3PolicyDocument = {
+        Version: "2012-10-17",
+        Statement: [{ Effect: "Allow", Action: s3ActionsFor(access), Resource: [bucket.Arn, Sub `${bucket.Arn}/*`] }],
+    };
+    const s3Policy = new Role_Policy({ PolicyName: `S3${access}`, PolicyDocument: s3PolicyDocument });
+    const policies = props.Policies ? [s3Policy, ...props.Policies] : [s3Policy];
+    const env = props.Environment ?? { Variables: {} };
+    const variables = { ...(env.Variables ?? {}), BUCKET_NAME: bucket.Ref };
+    const { role, func } = LambdaFunction({
+        ...props,
+        Policies: policies,
+        Environment: { Variables: variables },
+    });
+    return { bucket, role, func };
+}, "LambdaS3");

package/dist/composites/lambda-sns.js

@@ -0,0 +1,23 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Topic, Subscription, Permission } from "../generated/index.js";
+import { LambdaFunction } from "./lambda-function.js";
+/** A Lambda function subscribed to an SNS topic. */
+export const LambdaSns = Composite((props) => {
+    const { defaults } = props;
+    const { role, func } = LambdaFunction(props);
+    const topic = new Topic(mergeDefaults({
+        TopicName: props.topicName,
+    }, defaults?.topic));
+    const subscription = new Subscription(mergeDefaults({
+        TopicArn: topic.TopicArn,
+        Protocol: "lambda",
+        Endpoint: func.Arn,
+    }, defaults?.subscription));
+    const permission = new Permission(mergeDefaults({
+        FunctionName: func.Arn,
+        Action: "lambda:InvokeFunction",
+        Principal: "sns.amazonaws.com",
+        SourceArn: topic.TopicArn,
+    }, defaults?.permission));
+    return { topic, role, func, subscription, permission };
+}, "LambdaSns");

package/dist/composites/lambda-sqs.js

@@ -0,0 +1,34 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Queue, EventSourceMapping, Role_Policy } from "../generated/index.js";
+import { SQSActions } from "../actions/sqs.js";
+import { LambdaFunction } from "./lambda-function.js";
+/** A Lambda function fed by an SQS queue through an event source mapping. */
+export const LambdaSqs = Composite((props) => {
+    const { defaults } = props;
+    const queue = new Queue(mergeDefaults({
+        QueueName: props.queueName,
+    }, defaults?.queue));
+    const sqsPolicyDocument = {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Effect: "Allow",
+                Action: SQSActions.ReceiveMessage,
+                Resource: queue.Arn,
+            },
+        ],
+    };
+    const sqsPolicy = new Role_Policy({
+        PolicyName: "SQSReceive",
+        PolicyDocument: sqsPolicyDocument,
+    });
+    const policies = props.Policies ? [sqsPolicy, ...props.Policies] : [sqsPolicy];
+    const { role, func } = LambdaFunction({ ...props, Policies: policies });
+    const eventSourceMapping = new EventSourceMapping(mergeDefaults({
+        EventSourceArn: queue.Arn,
+        FunctionName: func.Arn,
+        BatchSize: props.batchSize ?? 10,
+        MaximumBatchingWindowInSeconds: props.maxBatchingWindow,
+    }, defaults?.eventSourceMapping));
+    return { queue, role, func, eventSourceMapping };
+}, "LambdaSqs");

package/dist/composites/landing-zone.js

@@ -0,0 +1,82 @@
+/**
+ * Landing-zone bootstrap composites.
+ *
+ * Fixed-shape resources for greenfield creation of the recommended
+ * governance foundation through a management-account stack. The evaluability
+ * rules (EVL002/004) require composites to declare a fixed set of resources,
+ * so these carry the foundation only; arbitrary OU/account trees are
+ * authored as config with `landingZoneConfig()` (../governance.ts) and
+ * reconciled by an external governance reconciler, and further OUs/accounts are
+ * declared as ordinary resources referencing these members' ids.
+ *
+ * The pieces compose:
+ *   const org = OrganizationRoot({});                      // greenfield only
+ *   const lz  = GovernanceFoundation({ parentRootId: org.organization.RootId });
+ *   const rr  = RegionRestriction({ regions: ["eu-west-1"], targetIds: [org.organization.RootId] });
+ *   const at  = OrganizationTrail({ bucket: "acme-org-audit" });
+ * Brownfield skips OrganizationRoot and passes the existing root id
+ * ("r-...") to GovernanceFoundation.
+ */
+import { Composite } from "@intentius/chant";
+import { Organization, OrganizationalUnit, OrganizationsPolicy, Trail, } from "../generated/index.js";
+import { DENY_AUDIT_TAMPER, DENY_LEAVE_ORGANIZATION, regionRestriction } from "../governance.js";
+/** Creates the organization itself. Control Tower / existing orgs skip this. */
+export const OrganizationRoot = Composite((props) => {
+    const organization = new Organization({ FeatureSet: props.featureSet ?? "ALL" });
+    return { organization };
+}, "OrganizationRoot");
+/**
+ * Security / Infrastructure / Sandbox / Workloads OUs,
+ * `deny-leave-organization` attached at the root and `deny-audit-tamper`
+ * on the Security OU — the same baseline `landingZoneConfig()` declares.
+ */
+export const GovernanceFoundation = Composite((props) => {
+    const ouSecurity = new OrganizationalUnit({ Name: "Security", ParentId: props.parentRootId });
+    const ouInfrastructure = new OrganizationalUnit({ Name: "Infrastructure", ParentId: props.parentRootId });
+    const ouSandbox = new OrganizationalUnit({ Name: "Sandbox", ParentId: props.parentRootId });
+    const ouWorkloads = new OrganizationalUnit({ Name: "Workloads", ParentId: props.parentRootId });
+    const scpDenyLeaveOrganization = new OrganizationsPolicy({
+        Name: "deny-leave-organization",
+        Type: "SERVICE_CONTROL_POLICY",
+        Content: DENY_LEAVE_ORGANIZATION.document,
+        Description: DENY_LEAVE_ORGANIZATION.description,
+        TargetIds: [props.parentRootId],
+    });
+    const scpDenyAuditTamper = new OrganizationsPolicy({
+        Name: "deny-audit-tamper",
+        Type: "SERVICE_CONTROL_POLICY",
+        Content: DENY_AUDIT_TAMPER.document,
+        Description: DENY_AUDIT_TAMPER.description,
+        TargetIds: [ouSecurity.Id],
+    });
+    return {
+        ouSecurity,
+        ouInfrastructure,
+        ouSandbox,
+        ouWorkloads,
+        scpDenyLeaveOrganization,
+        scpDenyAuditTamper,
+    };
+}, "GovernanceFoundation");
+/** A service control policy that denies requests outside the listed regions. */
+export const RegionRestriction = Composite((props) => {
+    const policy = regionRestriction(props.regions);
+    const scpRegionRestriction = new OrganizationsPolicy({
+        Name: "region-restriction",
+        Type: "SERVICE_CONTROL_POLICY",
+        Content: policy.document,
+        Description: policy.description,
+        TargetIds: props.targetIds,
+    });
+    return { scpRegionRestriction };
+}, "RegionRestriction");
+/** An organization-wide CloudTrail trail. */
+export const OrganizationTrail = Composite((props) => {
+    const trail = new Trail({
+        IsLogging: true,
+        S3BucketName: props.bucket,
+        IsMultiRegionTrail: true,
+        IsOrganizationTrail: true,
+    });
+    return { trail };
+}, "OrganizationTrail");