@intentius/chant-lexicon-aws 0.18.17 → 0.18.19

package/dist/types/index.d.ts

@@ -2707,6 +2707,42 @@ export declare class Assessment {
   readonly CreationTime: number;
 }
 
+export declare class AssessmentFramework {
+  constructor(props: {
+    /** The control sets that are associated with the framework. */
+    ControlSets: AssessmentFramework_ControlSet[];
+    /** The name of the framework. */
+    Name: string;
+    /** The Amazon Resource Name (ARN) of the framework. */
+    Arn?: string;
+    /** The compliance type that the framework supports, such as CIS or HIPAA. */
+    ComplianceType?: string;
+    /** The time when the framework was created. */
+    CreatedAt?: string;
+    /** The user or role that created the framework. */
+    CreatedBy?: string;
+    /** The description of the framework. */
+    Description?: string;
+    /** The unique identifier for the framework. */
+    FrameworkId?: string;
+    /** The time when the framework was most recently updated. */
+    LastUpdatedAt?: string;
+    /** The user or role that most recently updated the framework. */
+    LastUpdatedBy?: string;
+    /** The tags associated with the framework. */
+    Tags?: AssessmentFramework_Tag[];
+    /** The framework type, such as a standard framework or a custom framework. */
+    Type?: "Custom" | "Standard";
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreatedAt: string;
+  readonly CreatedBy: string;
+  readonly FrameworkId: string;
+  readonly LastUpdatedAt: string;
+  readonly LastUpdatedBy: string;
+  readonly Type: "Custom" | "Standard";
+}
+
 export declare class AssessmentTarget {
   constructor(props: {
     Arn?: string;
@@ -5684,6 +5720,20 @@ export declare class CodeDeployApplication {
   }, attributes?: CFResourceAttributes);
 }
 
+export declare class CodeInterpreter {
+  constructor(props: {
+    /** The Amazon Resource Name (ARN) of the code interpreter. */
+    CodeInterpreterArn?: string;
+    /** The unique identifier of the code interpreter. */
+    CodeInterpreterId?: string;
+    /** The current status of the code interpreter. */
+    Status?: "CREATE_FAILED" | "CREATING" | "DELETED" | "DELETE_FAILED" | "DELETING" | "READY";
+  }, attributes?: CFResourceAttributes);
+  readonly CodeInterpreterArn: string;
+  readonly CodeInterpreterId: string;
+  readonly Status: "CREATE_FAILED" | "CREATING" | "DELETED" | "DELETE_FAILED" | "DELETING" | "READY";
+}
+
 export declare class CodeInterpreterCustom {
   constructor(props: {
     /** The name of the code interpreter. */
@@ -13747,6 +13797,27 @@ export declare class EventType {
   readonly LastUpdatedTime: string;
 }
 
+export declare class EvidentlyExperiment {
+  constructor(props: {
+    MetricGoals: EvidentlyExperiment_MetricGoalObject[];
+    Name: string;
+    OnlineAbConfig: EvidentlyExperiment_OnlineAbConfigObject;
+    Project: string;
+    Treatments: EvidentlyExperiment_TreatmentObject[];
+    Arn?: string;
+    Description?: string;
+    RandomizationSalt?: string;
+    RemoveSegment?: boolean;
+    /** Start Experiment. Default is False */
+    RunningStatus?: EvidentlyExperiment_RunningStatusObject;
+    SamplingRate?: number;
+    Segment?: string;
+    /** An array of key-value pairs to apply to this resource. */
+    Tags?: EvidentlyExperiment_Tag[];
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+}
+
 export declare class EvidentlyProject {
   constructor(props: {
     Name: string;
@@ -13828,27 +13899,6 @@ export declare class ExecutionPlan {
   readonly Id: string;
 }
 
-export declare class Experiment {
-  constructor(props: {
-    MetricGoals: Experiment_MetricGoalObject[];
-    Name: string;
-    OnlineAbConfig: Experiment_OnlineAbConfigObject;
-    Project: string;
-    Treatments: Experiment_TreatmentObject[];
-    Arn?: string;
-    Description?: string;
-    RandomizationSalt?: string;
-    RemoveSegment?: boolean;
-    /** Start Experiment. Default is False */
-    RunningStatus?: Experiment_RunningStatusObject;
-    SamplingRate?: number;
-    Segment?: string;
-    /** An array of key-value pairs to apply to this resource. */
-    Tags?: Experiment_Tag[];
-  }, attributes?: CFResourceAttributes);
-  readonly Arn: string;
-}
-
 export declare class ExperimentTemplate {
   constructor(props: {
     Description: string;
@@ -30766,6 +30816,28 @@ export declare class SageMakerEndpoint {
   readonly EndpointName: string;
 }
 
+export declare class SageMakerExperiment {
+  constructor(props: {
+    /** The name of the experiment. Must be unique in your AWS account and is not case-sensitive. */
+    ExperimentName: string;
+    /** The Amazon Resource Name (ARN) of the experiment. */
+    Arn?: string;
+    /** When the experiment was created. */
+    CreationTime?: string;
+    /** The description of the experiment. */
+    Description?: string;
+    /** The name of the experiment as displayed. The name does not need to be unique. */
+    DisplayName?: string;
+    /** When the experiment was last modified. */
+    LastModifiedTime?: string;
+    /** A list of tags to associate with the experiment. */
+    Tags?: Record<string, unknown>[];
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreationTime: string;
+  readonly LastModifiedTime: string;
+}
+
 export declare class SageMakerHub {
   constructor(props: {
     /** A description of the hub. */
@@ -43721,6 +43793,31 @@ export declare class Assessment_Tag {
   });
 }
 
+export declare class AssessmentFramework_ControlSet {
+  constructor(props: {
+    /** The list of controls within the control set. */
+    Controls: AssessmentFramework_ControlSetControl[];
+    /** The name of the control set. */
+    Name: string;
+  });
+}
+
+export declare class AssessmentFramework_ControlSetControl {
+  constructor(props: {
+    /** The unique identifier of the control. */
+    Id: string;
+  });
+}
+
+export declare class AssessmentFramework_Tag {
+  constructor(props: {
+    /** The key name of the tag. */
+    Key: string;
+    /** The value for the tag. */
+    Value: string;
+  });
+}
+
 export declare class AssessmentReportsDestination {
   constructor(props: {
     Destination?: string;
@@ -56334,6 +56431,22 @@ export declare class ControlPlaneScalingConfig {
   });
 }
 
+export declare class ControlSet {
+  constructor(props: {
+    /** The list of controls within the control set. */
+    Controls: AssessmentFramework_ControlSetControl[];
+    /** The name of the control set. */
+    Name: string;
+  });
+}
+
+export declare class ControlSetControl {
+  constructor(props: {
+    /** The unique identifier of the control. */
+    Id: string;
+  });
+}
+
 export declare class CookieObject {
   constructor(props: {
     /** The specific cookies to forward to your distribution's origin. */
@@ -69810,6 +69923,65 @@ export declare class EventType_Tag {
   });
 }
 
+export declare class EvidentlyExperiment_MetricGoalObject {
+  constructor(props: {
+    DesiredChange: "DECREASE" | "INCREASE";
+    /** The JSON path to reference the entity id in the event. */
+    EntityIdKey: string;
+    MetricName: string;
+    /** The JSON path to reference the numerical metric value in the event. */
+    ValueKey: string;
+    /** Event patterns have the same structure as the events they match. Rules use event patterns to select events. An event pattern either matches an event or it doesn't. */
+    EventPattern?: string;
+    UnitLabel?: string;
+  });
+}
+
+export declare class EvidentlyExperiment_OnlineAbConfigObject {
+  constructor(props: {
+    ControlTreatmentName?: string;
+    TreatmentWeights?: EvidentlyExperiment_TreatmentToWeight[];
+  });
+}
+
+export declare class EvidentlyExperiment_RunningStatusObject {
+  constructor(props: {
+    /** Provide the analysis Completion time for an experiment */
+    AnalysisCompleteTime?: string;
+    /** Provide CANCELLED or COMPLETED desired state when stopping an experiment */
+    DesiredState?: string;
+    /** Reason is a required input for stopping the experiment */
+    Reason?: string;
+    /** Provide START or STOP action to apply on an experiment */
+    Status?: string;
+  });
+}
+
+export declare class EvidentlyExperiment_Tag {
+  constructor(props: {
+    /** The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. */
+    Key: string;
+    /** The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. */
+    Value: string;
+  });
+}
+
+export declare class EvidentlyExperiment_TreatmentObject {
+  constructor(props: {
+    Feature: string;
+    TreatmentName: string;
+    Variation: string;
+    Description?: string;
+  });
+}
+
+export declare class EvidentlyExperiment_TreatmentToWeight {
+  constructor(props: {
+    SplitWeight: number;
+    Treatment: string;
+  });
+}
+
 export declare class EvidentlyProject_AppConfigResourceObject {
   constructor(props: {
     ApplicationId: string;
@@ -69979,65 +70151,6 @@ export declare class ExecutiveSummaryOption {
   });
 }
 
-export declare class Experiment_MetricGoalObject {
-  constructor(props: {
-    DesiredChange: "DECREASE" | "INCREASE";
-    /** The JSON path to reference the entity id in the event. */
-    EntityIdKey: string;
-    MetricName: string;
-    /** The JSON path to reference the numerical metric value in the event. */
-    ValueKey: string;
-    /** Event patterns have the same structure as the events they match. Rules use event patterns to select events. An event pattern either matches an event or it doesn't. */
-    EventPattern?: string;
-    UnitLabel?: string;
-  });
-}
-
-export declare class Experiment_OnlineAbConfigObject {
-  constructor(props: {
-    ControlTreatmentName?: string;
-    TreatmentWeights?: Experiment_TreatmentToWeight[];
-  });
-}
-
-export declare class Experiment_RunningStatusObject {
-  constructor(props: {
-    /** Provide the analysis Completion time for an experiment */
-    AnalysisCompleteTime?: string;
-    /** Provide CANCELLED or COMPLETED desired state when stopping an experiment */
-    DesiredState?: string;
-    /** Reason is a required input for stopping the experiment */
-    Reason?: string;
-    /** Provide START or STOP action to apply on an experiment */
-    Status?: string;
-  });
-}
-
-export declare class Experiment_Tag {
-  constructor(props: {
-    /** The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. */
-    Key: string;
-    /** The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. */
-    Value: string;
-  });
-}
-
-export declare class Experiment_TreatmentObject {
-  constructor(props: {
-    Feature: string;
-    TreatmentName: string;
-    Variation: string;
-    Description?: string;
-  });
-}
-
-export declare class Experiment_TreatmentToWeight {
-  constructor(props: {
-    SplitWeight: number;
-    Treatment: string;
-  });
-}
-
 export declare class ExperimentConfig {
   constructor(props: {
     /** The name of an existing experiment to associate with the trial component. */
@@ -94672,7 +94785,7 @@ export declare class OnInput {
 export declare class OnlineAbConfigObject {
   constructor(props: {
     ControlTreatmentName?: string;
-    TreatmentWeights?: Experiment_TreatmentToWeight[];
+    TreatmentWeights?: EvidentlyExperiment_TreatmentToWeight[];
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.18.17",
+  "version": "0.18.19",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.18.17",
+    "@intentius/chant": "^0.18.19",
     "typescript": "^5.9.3"
   }
 }

package/src/actions/actions.test.ts

@@ -1,7 +1,7 @@
 import { describe, test, expect } from "vitest";
-import { S3Actions } from "./s3";
+import { S3Actions, s3ActionsFor } from "./s3";
 import { LambdaActions } from "./lambda";
-import { DynamoDBActions } from "./dynamodb";
+import { DynamoDBActions, dynamoDBActionsFor } from "./dynamodb";
 import { SQSActions } from "./sqs";
 import { SNSActions } from "./sns";
 import { IAMActions } from "./iam";
@@ -73,3 +73,17 @@ describe("Action Constants", () => {
     });
   });
 });
+
+// The EVL003-clean lookup helpers must return the same arrays as the tables (#952).
+describe("action-level lookup helpers", () => {
+  test("s3ActionsFor mirrors S3Actions for every access level", () => {
+    for (const level of Object.keys(S3Actions) as (keyof typeof S3Actions)[]) {
+      expect(s3ActionsFor(level)).toEqual(S3Actions[level]);
+    }
+  });
+  test("dynamoDBActionsFor mirrors DynamoDBActions for every access level", () => {
+    for (const level of Object.keys(DynamoDBActions) as (keyof typeof DynamoDBActions)[]) {
+      expect(dynamoDBActionsFor(level)).toEqual(DynamoDBActions[level]);
+    }
+  });
+});

package/src/actions/dynamodb.ts

@@ -34,3 +34,14 @@ export const DynamoDBActions = {
   Query: ["dynamodb:Query"],
   Scan: ["dynamodb:Scan"],
 } as const;
+
+export type DynamoDBAccessLevel = keyof typeof DynamoDBActions;
+
+// Map-backed lookup — avoids computed element access `DynamoDBActions[access]`
+// that the evaluability lint (EVL003) flags despite the statically-typed key (#952).
+const DYNAMODB_ACTIONS = new Map<DynamoDBAccessLevel, readonly string[]>(
+  Object.entries(DynamoDBActions) as [DynamoDBAccessLevel, readonly string[]][],
+);
+export function dynamoDBActionsFor(access: DynamoDBAccessLevel): readonly string[] {
+  return DYNAMODB_ACTIONS.get(access) ?? [];
+}

package/src/actions/s3.ts

@@ -32,3 +32,15 @@ export const S3Actions = {
   DeleteObject: ["s3:DeleteObject", "s3:DeleteObjectVersion"],
   ListObjects: ["s3:ListBucket", "s3:ListBucketVersions"],
 } as const;
+
+export type S3AccessLevel = keyof typeof S3Actions;
+
+// A Map-backed lookup avoids computed element access (`S3Actions[access]`), which
+// the evaluability lint (EVL003) flags even though the key is statically typed —
+// prefer this in evaluable code such as composites (#952).
+const S3_ACTIONS = new Map<S3AccessLevel, readonly string[]>(
+  Object.entries(S3Actions) as [S3AccessLevel, readonly string[]][],
+);
+export function s3ActionsFor(access: S3AccessLevel): readonly string[] {
+  return S3_ACTIONS.get(access) ?? [];
+}

package/src/components/apply.test.ts

@@ -48,6 +48,57 @@ describe("cfn-deploy (#557)", () => {
     ).rejects.toThrow(/CREATE_FAILED/);
   });
 
+  it("throws fail-closed on an undefined stack status (Floci) instead of a TypeError (#947)", async () => {
+    const base = createMockCloudExecutor({ stacks: { "search-service": {} } });
+    const executor = {
+      ...base.executor,
+      cloudformation: {
+        ...base.executor.cloudformation,
+        waitForStack: async () => ({ stackStatus: undefined as unknown as string, outputs: {} }),
+      },
+    };
+    const capability = createCfnDeployCapability(executor);
+    await expect(
+      capability.run(ctx, { stack: "search-service", template: "archive:search.template.json" }),
+    ).rejects.toThrow(/indeterminate status/);
+  });
+
+  it("rollback degrades gracefully when the target lacks RollbackStack (Floci) (#947)", async () => {
+    const base = createMockCloudExecutor({ stacks: { "search-service": {} } });
+    const executor = {
+      ...base.executor,
+      cloudformation: {
+        ...base.executor.cloudformation,
+        rollbackStack: async () => {
+          throw new Error(
+            "An error occurred (UnknownAction) when calling the RollbackStack operation: Action RollbackStack is not supported.",
+          );
+        },
+      },
+    };
+    const capability = createCfnDeployCapability(executor);
+    await expect(
+      capability.rollback!(ctx, { stack: "search-service", template: "archive:search.template.json" }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("rollback rethrows a genuine failure (not an unsupported action) (#947)", async () => {
+    const base = createMockCloudExecutor({ stacks: { "search-service": {} } });
+    const executor = {
+      ...base.executor,
+      cloudformation: {
+        ...base.executor.cloudformation,
+        rollbackStack: async () => {
+          throw new Error("An error occurred (AccessDenied): not authorized to RollbackStack");
+        },
+      },
+    };
+    const capability = createCfnDeployCapability(executor);
+    await expect(
+      capability.rollback!(ctx, { stack: "search-service", template: "archive:search.template.json" }),
+    ).rejects.toThrow(/AccessDenied/);
+  });
+
   it("passes wired inputs and imageRef through as CloudFormation parameters", async () => {
     const mock = createMockCloudExecutor({ stacks: { "search-service": {} } });
     const capability = createCfnDeployCapability(mock.executor);

package/src/components/apply.ts

@@ -153,15 +153,33 @@ export function createCfnDeployCapability(
       // failed deploy as green (and hand downstream steps an empty `outputs`),
       // so throw — the same fail-closed contract the rest of the release model
       // relies on.
-      if (stackStatus.includes("ROLLBACK") || stackStatus.endsWith("_FAILED")) {
+      // A missing status is fail-closed too: Floci's describe-stacks can omit
+      // StackStatus mid-rollback, and `undefined.includes` would throw a TypeError
+      // that masks the real deploy failure (#947).
+      if (!stackStatus || stackStatus.includes("ROLLBACK") || stackStatus.endsWith("_FAILED")) {
         throw new Error(
-          `cfn-deploy "${stack}": stack reached ${stackStatus} — the deploy failed and was rolled back. Inspect the stack events for the resource that failed to create/update.`,
+          `cfn-deploy "${stack}": stack reached ${stackStatus ?? "an indeterminate status"} — the deploy failed and was rolled back. Inspect the stack events for the resource that failed to create/update.`,
         );
       }
       return { stackStatus, outputs, ...(snapshotId ? { snapshotId } : {}) };
     },
     async rollback(ctx, input) {
-      await executor.cloudformation.rollbackStack(input.stack ?? ctx.component);
+      const stack = input.stack ?? ctx.component;
+      try {
+        await executor.cloudformation.rollbackStack(stack);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        // Local emulators (Floci) don't implement RollbackStack → `UnknownAction`.
+        // The stack is already in a terminal failed state; degrade to a clear
+        // message instead of crashing the compensation phase (#947).
+        if (/UnknownAction|not supported/i.test(message)) {
+          console.error(
+            `cfn-deploy rollback "${stack}": the target doesn't support RollbackStack (a local emulator such as Floci) — skipping automated rollback. Original: ${message}`,
+          );
+          return;
+        }
+        throw err;
+      }
     },
   };
 }

package/src/composites/alb-shared.ts

@@ -103,15 +103,13 @@ export const AlbShared = Composite<AlbSharedProps>((props) => {
     Port: listenerPort,
     Protocol: protocol,
     DefaultActions: [defaultAction],
+    // HTTPS listeners carry a cert; a ternary keeps the `new` out of an `if` (EVL002).
+    Certificates:
+      protocol === "HTTPS" && props.certificateArn
+        ? [new Listener_Certificate({ CertificateArn: props.certificateArn })]
+        : undefined,
   };
 
-  if (protocol === "HTTPS" && props.certificateArn) {
-    const cert = new Listener_Certificate({
-      CertificateArn: props.certificateArn,
-    });
-    listenerProps.Certificates = [cert];
-  }
-
   const listener = new Listener(mergeDefaults(listenerProps, defs?.listener));
 
   return {

package/src/composites/efs-with-access-point.ts

@@ -29,22 +29,12 @@ export interface EfsWithAccessPointProps {
 }
 
 export const EfsWithAccessPoint = Composite<EfsWithAccessPointProps>((props) => {
-  const ingressRules: InstanceType<typeof SecurityGroup_Ingress>[] = [];
-  if (props.sourceSecurityGroupId) {
-    ingressRules.push(new SecurityGroup_Ingress({
-      IpProtocol: "tcp",
-      FromPort: 2049,
-      ToPort: 2049,
-      SourceSecurityGroupId: props.sourceSecurityGroupId,
-    }));
-  } else if (props.ingressCidr) {
-    ingressRules.push(new SecurityGroup_Ingress({
-      IpProtocol: "tcp",
-      FromPort: 2049,
-      ToPort: 2049,
-      CidrIp: props.ingressCidr,
-    }));
-  }
+  // Ternary (not push-inside-if) keeps the `new`s out of control flow (EVL002).
+  const ingressRules: InstanceType<typeof SecurityGroup_Ingress>[] = props.sourceSecurityGroupId
+    ? [new SecurityGroup_Ingress({ IpProtocol: "tcp", FromPort: 2049, ToPort: 2049, SourceSecurityGroupId: props.sourceSecurityGroupId })]
+    : props.ingressCidr
+      ? [new SecurityGroup_Ingress({ IpProtocol: "tcp", FromPort: 2049, ToPort: 2049, CidrIp: props.ingressCidr })]
+      : [];
 
   const securityGroup = new SecurityGroup({
     GroupDescription: "EFS mount target SG",

package/src/composites/fargate-alb.ts

@@ -143,14 +143,10 @@ export const FargateAlb = Composite<FargateAlbProps>((props) => {
     },
   });
 
-  const environmentVars: InstanceType<typeof TaskDefinition_KeyValuePair>[] = [];
-  if (props.environment) {
-    for (const [name, value] of Object.entries(props.environment)) {
-      environmentVars.push(
-        new TaskDefinition_KeyValuePair({ Name: name, Value: value }),
-      );
-    }
-  }
+  // `.map` keeps the `new`s out of the `for`/`if` (EVL002).
+  const environmentVars: InstanceType<typeof TaskDefinition_KeyValuePair>[] = props.environment
+    ? Object.entries(props.environment).map(([name, value]) => new TaskDefinition_KeyValuePair({ Name: name, Value: value }))
+    : [];
 
   const container = new TaskDefinition_ContainerDefinition({
     Name: "app",
@@ -232,40 +228,38 @@ export const FargateAlb = Composite<FargateAlbProps>((props) => {
     TargetGroupArn: targetGroup.TargetGroupArn,
   });
 
-  let listener: InstanceType<typeof Listener>;
-  let redirectListener: InstanceType<typeof Listener> | undefined;
-
-  if (props.certificateArn) {
-    listener = new Listener({
-      LoadBalancerArn: alb.LoadBalancerArn,
-      Port: 443,
-      Protocol: "HTTPS",
-      Certificates: [new Listener_Certificate({ CertificateArn: props.certificateArn })],
-      DefaultActions: [forwardAction],
-    });
-    redirectListener = new Listener({
-      LoadBalancerArn: alb.LoadBalancerArn,
-      Port: 80,
-      Protocol: "HTTP",
-      DefaultActions: [
-        new Listener_Action({
-          Type: "redirect",
-          RedirectConfig: new Listener_RedirectConfig({
-            Protocol: "HTTPS",
-            Port: "443",
-            StatusCode: "HTTP_301",
+  // Ternaries keep the `new`s out of the `if`/`else` (EVL002).
+  const listener: InstanceType<typeof Listener> = props.certificateArn
+    ? new Listener({
+        LoadBalancerArn: alb.LoadBalancerArn,
+        Port: 443,
+        Protocol: "HTTPS",
+        Certificates: [new Listener_Certificate({ CertificateArn: props.certificateArn })],
+        DefaultActions: [forwardAction],
+      })
+    : new Listener({
+        LoadBalancerArn: alb.LoadBalancerArn,
+        Port: listenerPort,
+        Protocol: "HTTP",
+        DefaultActions: [forwardAction],
+      });
+  const redirectListener: InstanceType<typeof Listener> | undefined = props.certificateArn
+    ? new Listener({
+        LoadBalancerArn: alb.LoadBalancerArn,
+        Port: 80,
+        Protocol: "HTTP",
+        DefaultActions: [
+          new Listener_Action({
+            Type: "redirect",
+            RedirectConfig: new Listener_RedirectConfig({
+              Protocol: "HTTPS",
+              Port: "443",
+              StatusCode: "HTTP_301",
+            }),
           }),
-        }),
-      ],
-    });
-  } else {
-    listener = new Listener({
-      LoadBalancerArn: alb.LoadBalancerArn,
-      Port: listenerPort,
-      Protocol: "HTTP",
-      DefaultActions: [forwardAction],
-    });
-  }
+        ],
+      })
+    : undefined;
 
   // ECS Service
   const serviceLoadBalancer = new EcsService_LoadBalancer({