@izara_project/izara-core-generate-service-code 1.0.99 → 1.0.100

package/src/emit/application/custom/templates/s3/Start_Main.ejs

@@ -0,0 +1,197 @@
+/*
+Copyright (C) 2026 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { v7 as uuidv7 } from 'uuid';
+import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+import { S3Client } from '@aws-sdk/client-s3';
+import { consts } from '@izara_project/izara-middleware';
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import { webSocket } from '@izara_project/izara-core-library-external-request';
+const { postToConnection } = webSocket;
+import { utils } from '@izara_project/izara-core-library-service-schemas';
+const { createFlowTypeConcat } = utils;
+
+const client = new S3Client({ region: process.env.AWS_REGION });
+
+//(<optionalRequired>)
+//(</optionalRequired>)
+
+/**
+ * Step 1: Start (Deferred-Node S3 Pipeline - ADR-016)
+ * Generates UUIDv7, computes S3 Presigned POST in-memory, writes ephemeral WebSocketTask,
+ * and returns upload parameters to client without writing entity records to the database.
+ *
+ * @param {Object} _izContext
+ * @param {Object} requestParams
+ * @param {Object} callingFlowConfig
+ * @returns {Promise<Object>}
+ */
+export default async function <%- functionName %>(
+  _izContext,
+  requestParams,
+  callingFlowConfig = {}
+  //(<additionalParams>)
+  //(</additionalParams>)
+) {
+  try {
+    _izContext.logger.debug('<%- functionName %> started', {
+      requestParams,
+      callingFlowConfig
+    });
+
+    const connectionId = _izContext.correlationIds.get(consts.CONNECTION_ID);
+    const submittedByUserId = _izContext.correlationIds?.get(
+      consts.SUBMITTED_BY_USER_ID
+    );
+    if (!submittedByUserId) {
+      throw new Error('Submitted by user id is required');
+    }
+
+    //(<beforeCreateObjectHook>)
+    //(</beforeCreateObjectHook>)
+
+<% if (isRbac) { -%>
+    const { checkRbacPermission } =
+      await import('@izara_project/izara-authorization');
+
+    //(<rbacParameterGroups_<%- flowTag %>>)
+    const parameterGroups = {};
+    //(</rbacParameterGroups_<%- flowTag %>>)
+
+    const resultPermissionCheck = await checkRbacPermission(
+      _izContext,
+      {
+        flowTag: requestParams.flowTag || '<%- flowTag %>',
+        serviceTag: process.env.iz_serviceTag
+      },
+      parameterGroups,
+      {
+        targetIdentifiers: requestParams.targetIdentifiers,
+        rbacObjType: {
+          serviceTag: '<%- parentServiceTag || rbacServiceTag %>',
+          objectType: '<%- parentObjectType || objectType %>'
+        },
+        sync: true
+      }
+    );
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- flowTag %>] checkRbacPermission result:`,
+      resultPermissionCheck
+    );
+
+    if (resultPermissionCheck && resultPermissionCheck.permission !== true) {
+      throw new Error('Permission denied');
+    }
+<% } -%>
+
+    const <%- objectType %>Id = uuidv7();
+
+<% if (typeof parentIdKeys !== 'undefined' && parentIdKeys && parentIdKeys.length > 0) { -%>
+    const targetParentId = requestParams.targetIdentifiers?.<%- parentIdKeys[0] %>;
+<%   for (const key of parentIdKeys) { -%>
+    const target<%- key.charAt(0).toUpperCase() + key.slice(1) %> = requestParams.targetIdentifiers?.<%- key %>;
+    if (!target<%- key.charAt(0).toUpperCase() + key.slice(1) %>) {
+      throw new Error('targetIdentifiers.<%- key %> is required');
+    }
+<%   } -%>
+<% } -%>
+
+    let maxFileSizeMb = <%- maxFileSizeMb %>;
+    if (requestParams.file?.size) {
+      maxFileSizeMb = Math.ceil(requestParams.file.size / 1048576);
+    } else if (requestParams.file?.fileSize) {
+      maxFileSizeMb = requestParams.file.fileSize;
+    } else if (requestParams.fieldNames?.fileSize) {
+      maxFileSizeMb = requestParams.fieldNames.fileSize;
+    }
+
+    //(<createKeyForUploadFile>)
+    let importType = '<%- defaultImportType %>';
+    let uploadPath = '';
+    //(</createKeyForUploadFile>)
+    const Key = `<%- s3KeyPrefix %>${uploadPath}`;
+    const maximumSize = maxFileSizeMb * 1048576;
+
+    let createPreSignUrlParam = {
+      Bucket: '<%- bucketName %>',
+      Key: Key,
+      Conditions: [
+        ['content-length-range', 0, maximumSize],
+        ['eq', '$x-amz-meta-<%- objectType %>Id', <%- objectType %>Id],
+<% if (typeof parentIdKeys !== 'undefined' && parentIdKeys && parentIdKeys.length > 0) { -%>
+<%   for (const key of parentIdKeys) { -%>
+        ['eq', '$x-amz-meta-<%- key %>', target<%- key.charAt(0).toUpperCase() + key.slice(1) %>],
+<%   } -%>
+<% } -%>
+        ['starts-with', '$x-amz-meta-submittedByUserId', ''],
+        ['starts-with', '$Content-Type', '<%- contentTypePrefix %>']
+        //(<conditionCreateUrlLink>)
+        //(</conditionCreateUrlLink>)
+      ],
+      Fields: {
+        'x-amz-meta-<%- objectType %>Id': <%- objectType %>Id,
+<% if (typeof parentIdKeys !== 'undefined' && parentIdKeys && parentIdKeys.length > 0) { -%>
+<%   for (const key of parentIdKeys) { -%>
+        'x-amz-meta-<%- key %>': target<%- key.charAt(0).toUpperCase() + key.slice(1) %>,
+<%   } -%>
+<% } -%>
+        'x-amz-meta-submittedByUserId': submittedByUserId,
+        //(<fieldCreateUrlLink>)
+        //(</fieldCreateUrlLink>)
+      },
+      Expires: <%- expires %>
+    };
+
+    //(<modifyPreSignUrlParam>)
+    //(</modifyPreSignUrlParam>)
+
+    const uploadUrl = await createPresignedPost(client, createPreSignUrlParam);
+
+    if (connectionId) {
+      await dynamodbSharedLib.putItem(
+        _izContext,
+        await dynamodbSharedLib.tableName(_izContext, 'WebSocketTask'),
+        {
+          taskKey: `${createFlowTypeConcat(_izContext, { flowTag: '<%- flowTag %>', serviceTag: process.env.iz_serviceTag })}${<%- objectType %>Id}`,
+          connectionId: connectionId,
+          expirationTime: Math.floor(Date.now() / 1000) + 7200
+        }
+      );
+
+      await postToConnection(
+        _izContext,
+        {
+          status: 'success',
+          data: {
+            uploadUrl: uploadUrl,
+            <%- objectType %>Id: <%- objectType %>Id
+          }
+        },
+        connectionId
+      );
+    }
+
+    return {
+      uploadUrl: uploadUrl,
+      <%- objectType %>Id: <%- objectType %>Id
+    };
+  } catch (err) {
+    _izContext.logger.error('Error in <%- functionName %>:', err);
+    throw err;
+  }
+}

package/src/emit/application/rbac/emitDynamicRbacFlowSchemas.js

@@ -20,7 +20,7 @@ const RBAC_CORE_FLOW_DEFINITIONS = [
 const LIMIT_FLOW_DEFINITIONS = [
   {
     flowTag: 'ReservedDynamicUsage',
-    event: ['ownTopic', 'lambdaSyncInv', 'lambdaSyncApi']
+    event: ['lambdaSyncInv', 'lambdaSyncApi']
   },
   {
     flowTag: 'ConfirmUsage',
@@ -29,6 +29,10 @@ const LIMIT_FLOW_DEFINITIONS = [
   {
     flowTag: 'CancelUsage',
     event: ['ownTopic', 'lambdaSyncInv', 'lambdaSyncApi']
+  },
+  {
+    flowTag: 'ReservedUsageTtlExpired',
+    event: ['dss']
   }
 ];
 

package/src/emit/application/rbac/emitRbacApplicationArtifacts.js

@@ -174,14 +174,21 @@ const STATIC_RBAC_APPLICATION_PATHS = [
 ];
 
 const STATIC_LIMIT_APPLICATION_PATHS = [
-  ...ACCOUNT_LIMIT_HANDLERS.flatMap((flowTag) => [
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrInv.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrApi.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_WbsMain.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrWbs.js`
-  ]),
+  ...ACCOUNT_LIMIT_HANDLERS.flatMap((flowTag) => {
+    const paths = [
+      `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
+      `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrInv.js`,
+      `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrApi.js`
+    ];
+    if (flowTag !== 'ReservedDynamicUsage') {
+      paths.splice(
+        1,
+        0,
+        `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`
+      );
+    }
+    return paths;
+  }),
   'app/src/generatedCode/FlowLimit/ReservedUsageTtlExpired/source/ReservedUsageTtlExpired_HdrDss.js',
   FLOW_LIMITS_YAML_PATH
 ];
@@ -212,65 +219,65 @@ export function rbacApplicationManagedPaths(objects = []) {
 async function createAccountLimitHandler(flowTag) {
   const sourcePath = `app/src/generatedCode/FlowLimit/${flowTag}/source`;
   const handlerPath = `src/generatedCode/FlowLimit/${flowTag}/source`;
-  const webSocket = await createWebSocketEntry(
-    flowTag,
-    sourcePath,
-    handlerPath
-  );
   const shared = {
     flowTag,
     flowStepName: '',
     mainFileName: `${flowTag}_Main`,
     functionName: flowTag
   };
+  const artifacts = [
+    {
+      path: `${sourcePath}/${flowTag}_Main.js`,
+      content: await renderRbacTemplate(`${flowTag}_Main.ejs`, { flowTag })
+    }
+  ];
+  const functions = [];
+  if (flowTag !== 'ReservedDynamicUsage') {
+    artifacts.push({
+      path: `${sourcePath}/${flowTag}_HdrSqs.js`,
+      content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
+    });
+    functions.push({
+      type: 'sqs',
+      functionName: `${flowTag}HdrSqs`,
+      handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
+      roleName: 'FlowRbacRole',
+      queueName: `${flowTag}HdrSqs`,
+      flowTag: flowTag,
+      flowStepName: ''
+    });
+  }
+  artifacts.push(
+    {
+      path: `${sourcePath}/${flowTag}_HdrInv.js`,
+      content: await renderSharedTemplate('FlowHandler_HdrInv.ejs', shared)
+    },
+    {
+      path: `${sourcePath}/${flowTag}_HdrApi.js`,
+      content: await renderSharedTemplate('FlowHandler_HdrApi.ejs', shared)
+    }
+  );
+  functions.push(
+    {
+      type: 'inv',
+      functionName: `${flowTag}HdrInv`,
+      handlerPath: `${handlerPath}/${flowTag}_HdrInv.main`,
+      roleName: 'FlowRbacRole',
+      flowTag: flowTag,
+      flowStepName: ''
+    },
+    {
+      type: 'api',
+      functionName: `${flowTag}HdrApi`,
+      handlerPath: `${handlerPath}/${flowTag}_HdrApi.main`,
+      roleName: 'FlowRbacRole',
+      flowTag: flowTag,
+      flowStepName: ''
+    }
+  );
   return {
-    artifacts: [
-      {
-        path: `${sourcePath}/${flowTag}_Main.js`,
-        content: await renderRbacTemplate(`${flowTag}_Main.ejs`, { flowTag })
-      },
-      {
-        path: `${sourcePath}/${flowTag}_HdrSqs.js`,
-        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
-      },
-      {
-        path: `${sourcePath}/${flowTag}_HdrInv.js`,
-        content: await renderSharedTemplate('FlowHandler_HdrInv.ejs', shared)
-      },
-      {
-        path: `${sourcePath}/${flowTag}_HdrApi.js`,
-        content: await renderSharedTemplate('FlowHandler_HdrApi.ejs', shared)
-      },
-      ...webSocket.artifacts
-    ],
-    functions: [
-      {
-        type: 'sqs',
-        functionName: `${flowTag}HdrSqs`,
-        handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
-        roleName: 'FlowRbacRole',
-        queueName: `${flowTag}HdrSqs`,
-        flowTag: flowTag,
-        flowStepName: ''
-      },
-      {
-        type: 'inv',
-        functionName: `${flowTag}HdrInv`,
-        handlerPath: `${handlerPath}/${flowTag}_HdrInv.main`,
-        roleName: 'FlowRbacRole',
-        flowTag: flowTag,
-        flowStepName: ''
-      },
-      {
-        type: 'api',
-        functionName: `${flowTag}HdrApi`,
-        handlerPath: `${handlerPath}/${flowTag}_HdrApi.main`,
-        roleName: 'FlowRbacRole',
-        flowTag: flowTag,
-        flowStepName: ''
-      },
-      ...webSocket.functions
-    ]
+    artifacts,
+    functions
   };
 }
 

package/src/emit/application/rbac/templates/ReservedDynamicUsage_Main.ejs

@@ -161,7 +161,7 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     let passStatus = false;
     if (currentTotal + value <= maxLimit) {
       passStatus = true;
-      const ttlTimestamp = Math.floor(Date.now() / 1000) + 3600;
+      const expirationTime = Math.floor(Date.now() / 1000) + 3600;
 
       await dynamodbSharedLib.putItem(
         _izContext,
@@ -173,7 +173,7 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
           flowTypeConcat,
           usageCount: value,
           runningTotalUsageStatus: 'reserved',
-          ttlTimestamp
+          expirationTime
         }
       );
 
@@ -196,13 +196,31 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
       identifiersConcat
     };
 
-    await sns.publishMessage(_izContext, {
-      message: { returnResult },
-      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
-        _izContext,
-        'ReservedDynamicUsage_Out'
-      )
-    });
+    const eventSourceTag =
+      _izContext.izEventSource?.eventSourceTag ||
+      requestParams?.izEventSource?.eventSourceTag;
+
+    let isSync = false;
+    if (
+      eventSourceTag === 'DirectInvoke' ||
+      eventSourceTag === 'ApiGateway' ||
+      eventSourceTag === 'ApiGatewayV2' ||
+      requestParams?.hasOwnProperty('__context__')
+    ) {
+      isSync = true;
+    }
+
+    if (!isSync) {
+      await sns.publishMessage(_izContext, {
+        message: { returnResult },
+        TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+          _izContext,
+          'ReservedDynamicUsage_Out'
+        )
+      });
+    }
+
+    return returnResult;
   } catch (error) {
     _izContext.logger.error(`[${process.env.iz_serviceTag}:ReservedDynamicUsage] error:`, error);
     throw error;

package/src/emit/application/rbac/templates/UserRbacFlow_Main.ejs

@@ -55,7 +55,8 @@ async function _getL2Cache(_izContext, submittedByUserId, cacheSubKey) {
       userId: submittedByUserId,
       cacheKey: cacheSubKey
     });
-    if (result && result.ttlTimestamp && result.ttlTimestamp > Math.floor(Date.now() / 1000)) {
+    const expTime = result && (result.expirationTime || result.ttlTimestamp);
+    if (expTime && expTime > Math.floor(Date.now() / 1000)) {
       return {
         returnValue: {
           permission: Boolean(result.permission),
@@ -75,14 +76,14 @@ async function _getL2Cache(_izContext, submittedByUserId, cacheSubKey) {
 async function _setL2Cache(_izContext, submittedByUserId, cacheSubKey, value) {
   try {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
-    const ttlTimestamp = Math.floor(Date.now() / 1000) + L2_TTL_SECONDS;
+    const expirationTime = Math.floor(Date.now() / 1000) + L2_TTL_SECONDS;
     await dynamodbSharedLib.putItem(_izContext, tableName, {
       userId: submittedByUserId,
       cacheKey: cacheSubKey,
       permission: value.returnValue ? value.returnValue.permission : value.permission,
       roleIdKey: value.returnValue ? value.returnValue.roleIdKey : value.roleIdKey,
       rbacType: 'target',
-      ttlTimestamp
+      expirationTime
     });
   } catch (error) {
     // Safely ignore L2 write errors if table is not configured

package/src/emit/application/system/templates/Register_HdrWbs.ejs

@@ -27,7 +27,8 @@ export const main = middleware.wrap(async (event, context) => {
             await dynamodbSharedLib.tableName(event._izContext, 'WebSocketTask'),
             {
               taskKey: correlationId,
-              connectionId: connectionId
+              connectionId: connectionId,
+              expirationTime: Math.floor(Date.now() / 1000) + 7200
             }
           );
 

package/src/emit/infrastructure/functions/functionYamlArtifact.js

@@ -181,6 +181,7 @@ export function renderS3FunctionYaml({
   handlerPath,
   roleName,
   bucketName,
+  s3KeyPrefix,
   flowTag,
   flowStepName
 }) {
@@ -189,6 +190,7 @@ export function renderS3FunctionYaml({
     handlerPath,
     roleName,
     bucketName,
+    s3KeyPrefix,
     environmentSetting: _environmentSetting(
       functionName,
       flowTag,
@@ -342,15 +344,8 @@ function _sqsFilterPatterns(
           - body:
               MessageAttributes:
                 callingFlow:
-                  Value:
+                  StringValue:
                     - \${self:custom.iz_resourcePrefix}${callingFlowName}
-          - body:
-              MessageAttributes:
-                callingFlow:
-                  - exists: false
-          - body:
-              MessageAttributes:
-                - exists: false
         #<#/${hookFunctionName}FilterPatterns#>
 `;
 }

package/src/emit/infrastructure/functions/templates/S3Function_Yaml.ejs

@@ -8,9 +8,8 @@
         bucket: <%= bucketName %>
         event: s3:ObjectCreated:*
         existing: true
-        rules:
+        rules:<% if (s3KeyPrefix) { %>
+          - prefix: <%- s3KeyPrefix %><% } %>
         #<#<%= functionName %>rules#>
         #<#/<%= functionName %>rules#>
-          - prefix: uploads/
-          - suffix: .csv
         forceDeploy: true

package/src/emit/infrastructure/resources/iamResourceArtifacts.js

@@ -139,6 +139,25 @@ export function roleStatements(state, roleName) {
       resource: ['arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}']
     });
   }
+  const s3FlowsForRole = (state.flows || []).filter((candidate) => {
+    const roleCandidate = customFlowRoleName(candidate?.flowTag ?? '');
+    return (
+      roleCandidate === roleName &&
+      includesEvent(candidate, 's3') &&
+      Boolean(candidate.bucketName)
+    );
+  });
+  if (s3FlowsForRole.length > 0) {
+    const bucketResources = [
+      ...new Set(
+        s3FlowsForRole.map((flow) => `arn:aws:s3:::${flow.bucketName}/*`)
+      )
+    ].sort();
+    statements.push({
+      action: ['s3:GetObject'],
+      resource: bucketResources
+    });
+  }
   addStatement(statements, dynamoActionsForRole(roleName), [
     ...dynamoArns(roleTableNames(state, roleName)),
     ...externalDynamoArns(roleExternalDynamoTables(state, roleName))
@@ -479,6 +498,9 @@ export function roleTopicNames(state, roleName) {
     if (flowHasOwnTopic(flow)) {
       topics.push(`${name}_In`);
     }
+    if (includesEvent(flow, 's3')) {
+      topics.push('Create_In');
+    }
     return topics;
   }
   return [];

package/src/emit/infrastructure/resources/resourceState.js

@@ -4,7 +4,8 @@ import {
   flowExtTopicSteps,
   generatedDsqFlows,
   generatedOwnTopicFlows,
-  supportedCustomFlows
+  supportedCustomFlows,
+  resolveS3Parts
 } from '../../application/custom/customFlows.js';
 import { hasSystemWebSocket } from '../../application/system/emitSystemWebSocketArtifacts.js';
 import { rbacFlowTag } from '../../application/rbac/rbacFlowTag.js';
@@ -161,9 +162,12 @@ export function createResourceState({ objects, relationships, flows }) {
 
   for (const flow of flows.filter((flow) => includesEvent(flow, 's3'))) {
     const tag = upperFirst(flow.flowTag);
-    customSqsQueues.push(`${tag}CreatePreSignUrlHdrSqs`);
-    customSqsQueues.push(`${tag}ReservedLimitHdrSqs`);
-    customSqsQueues.push(`${tag}ConfirmAfterUploadHdrSqs`);
+    const parts = resolveS3Parts(flow);
+    for (const part of parts) {
+      if (part.type === 'sqs') {
+        customSqsQueues.push(`${tag}${part.action}HdrSqs`);
+      }
+    }
   }
 
   const customDsqQueues = flows
@@ -281,8 +285,14 @@ export function createResourceState({ objects, relationships, flows }) {
           topicName = `Out${upperFirst(flow.outputTopic)}`;
         }
       }
+      let targetAction = 'ReservedLimit';
+      const parts = resolveS3Parts(flow);
+      const firstSqsPart = parts.find((p) => p.type === 'sqs');
+      if (firstSqsPart && firstSqsPart.action) {
+        targetAction = firstSqsPart.action;
+      }
       const queueName =
-        flow.s3Subscription?.queueName || `${tag}ReservedLimitHdrSqs`;
+        flow.s3Subscription?.queueName || `${tag}${targetAction}HdrSqs`;
       const subscriptionName =
         flow.s3Subscription?.subscriptionName ||
         `Subscription${topicName}To${queueName}`;

package/src/emit/infrastructure/resources/s3ResourceArtifacts.js

@@ -1,13 +1,29 @@
 import { indentYaml, renderResourceTemplate } from './resourceTemplate.js';
 
+export function toAlphanumericPascalCase(str) {
+  if (!str) {
+    return '';
+  }
+  const parts = str.split(/[^a-zA-Z0-9]+/);
+  const validParts = parts.filter(Boolean);
+  const capitalizedParts = validParts.map((word) => {
+    return word.charAt(0).toUpperCase() + word.slice(1);
+  });
+  return capitalizedParts.join('');
+}
+
 export async function renderS3(state) {
   if (state.s3Buckets.length === 0) {
     return '';
   }
   const renderedBuckets = await Promise.all(
-    state.s3Buckets.map((bucketName) =>
-      renderResourceTemplate('S3Bucket_Yaml.ejs', { bucketName })
-    )
+    state.s3Buckets.map((bucketName) => {
+      const bucketLogicalId = `${toAlphanumericPascalCase(bucketName)}S3Bucket`;
+      return renderResourceTemplate('S3Bucket_Yaml.ejs', {
+        bucketName,
+        bucketLogicalId
+      });
+    })
   );
   const body = renderedBuckets.join('\n');
   return `Resources:\n${indentYaml(body, 2)}`;

package/src/emit/infrastructure/resources/templates/S3Bucket_Yaml.ejs

@@ -1,5 +1,5 @@
 ##===== [S3 Bucket: <%- bucketName %>]
-<%- bucketName %>S3Bucket:
+<%- bucketLogicalId %>:
   Type: AWS::S3::Bucket
   Properties:
     BucketName: <%- bucketName %>

package/src/emit/infrastructure/resources/templates/SystemDynamoDB_Yaml.ejs

@@ -230,7 +230,7 @@ Resources:
         - AttributeName: cacheKey
           KeyType: RANGE
       TimeToLiveSpecification:
-        AttributeName: ttlTimestamp
+        AttributeName: expirationTime
         Enabled: true
 
   RunningTotalUsageTable:
@@ -265,7 +265,7 @@ Resources:
         - AttributeName: usedTimestampId
           KeyType: RANGE
       TimeToLiveSpecification:
-        AttributeName: ttlTimestamp
+        AttributeName: expirationTime
         Enabled: true
       StreamSpecification:
         StreamViewType: NEW_AND_OLD_IMAGES