@mettlecast/domain-cdk-packer 0.2.95 → 0.2.97

package/dist/DomainStack.d.ts

@@ -98,6 +98,23 @@ export interface DomainStackProps extends cdk.StackProps {
      * Existing dashboards will be removed on the next CDK deploy.
      */
     disableCloudWatchDashboards?: boolean;
+    /**
+     * When true, the per-domain DynamoDB table and S3 bucket are imported
+     * (adopted) instead of created. This is the migration-safe path for
+     * environments where those resources already exist OUTSIDE the CloudFormation
+     * stack (e.g. created manually or by an earlier deployment generation) —
+     * CloudFormation would otherwise fail the change-set with "already exists".
+     *
+     * Imported resources are not owned by the stack, so:
+     *   - their data is preserved untouched;
+     *   - CloudFormation can never accidentally delete them on stack deletion;
+     *   - IAM grants, env vars (DOMAIN_TABLE_NAME / DOMAIN_BUCKET_NAME) and
+     *     CfnOutputs keep referencing the same physical names.
+     *
+     * The deploy workflow detects pre-existing resources and passes the CDK
+     * context `adopt-existing-resources=true` (see workflowGenerator.ts).
+     */
+    adoptExistingResources?: boolean;
 }
 export declare class DomainStack extends cdk.Stack {
     /** Shared HTTP API for routing API and webhook requests. */

package/dist/DomainStack.js

@@ -75,7 +75,7 @@ export class DomainStack extends cdk.Stack {
             throw new Error(`Registry validation failed for domain '${props.registry.domain?.id ?? '<unknown>'}':\n${lines.join('\n')}\n\n` +
                 `Fix registry data before deploying.`);
         }
-        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, appSecretArn, userPoolArn, userPoolId, userPoolClientId, internalSubnetSelection, internetSubnetSelection, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials, disableCloudWatchDashboards } = props;
+        const { registry, eventBusArn, eventBusName, databaseUrl, dbSecretArn, appSecretArn, userPoolArn, userPoolId, userPoolClientId, internalSubnetSelection, internetSubnetSelection, enableCmk, enableWaf, enableAlarms, alarmSnsTopicArn, enableCanaryDeploy, reservedConcurrency, logRetentionDays, corsAllowedOrigins, allowCredentials, disableCloudWatchDashboards, adoptExistingResources } = props;
         const vpc = props.vpc ?? (props.vpcId
             ? ec2.Vpc.fromVpcAttributes(this, 'SharedVpc', {
                 vpcId: props.vpcId,
@@ -328,34 +328,45 @@ export class DomainStack extends cdk.Stack {
             }
             return { lambdas, byId };
         };
-        // Per-domain DynamoDB table — PK=tenantId (tenant is primary partition), SK=entity key
-        const domainTable = new dynamodb.Table(this, 'DomainTable', {
-            tableName: resourceBaseName,
-            partitionKey: { name: 'tenantId', type: dynamodb.AttributeType.STRING },
-            sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
-            billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
-            encryption: enableCmk ? dynamodb.TableEncryption.CUSTOMER_MANAGED : dynamodb.TableEncryption.AWS_MANAGED,
-            encryptionKey: cmkKey,
-            timeToLiveAttribute: 'expiresAt',
-            removalPolicy: cdk.RemovalPolicy.RETAIN,
-            pointInTimeRecovery: true,
-        });
-        // Per-domain S3 bucket — all objects prefixed {tenantId}/ enforced in runtime
+        // Per-domain DynamoDB table — PK=tenantId (tenant is primary partition), SK=entity key.
+        //
+        // Issue #5234: when `adoptExistingResources` is set (detected by the deploy
+        // workflow), the table already exists OUTSIDE this CloudFormation stack.
+        // Import it instead of creating it so the change-set does not fail with
+        // "resource already exists"; the imported table is not owned by the stack,
+        // so its data is preserved and CloudFormation can never delete it.
+        const domainTable = adoptExistingResources
+            ? dynamodb.Table.fromTableName(this, 'DomainTable', resourceBaseName)
+            : new dynamodb.Table(this, 'DomainTable', {
+                tableName: resourceBaseName,
+                partitionKey: { name: 'tenantId', type: dynamodb.AttributeType.STRING },
+                sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
+                billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+                encryption: enableCmk ? dynamodb.TableEncryption.CUSTOMER_MANAGED : dynamodb.TableEncryption.AWS_MANAGED,
+                encryptionKey: cmkKey,
+                timeToLiveAttribute: 'expiresAt',
+                removalPolicy: cdk.RemovalPolicy.RETAIN,
+                pointInTimeRecovery: true,
+            });
+        // Per-domain S3 bucket — all objects prefixed {tenantId}/ enforced in runtime.
         const bucketName = resourceBaseName.length <= 63
             ? resourceBaseName
             : `${resourceBaseName.slice(0, 55)}-${cdk.Fn.select(0, cdk.Fn.split('-', cdk.Names.uniqueId(this))).toLowerCase()}`;
-        const domainBucket = new s3.Bucket(this, 'DomainBucket', {
-            bucketName,
-            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
-            encryption: enableCmk ? s3.BucketEncryption.KMS : s3.BucketEncryption.S3_MANAGED,
-            encryptionKey: cmkKey,
-            versioned: true,
-            enforceSSL: true,
-            removalPolicy: cdk.RemovalPolicy.RETAIN,
-            lifecycleRules: [{
-                    noncurrentVersionExpiration: cdk.Duration.days(90),
-                }],
-        });
+        // Issue #5234: same adoption path for the bucket as the table above.
+        const domainBucket = adoptExistingResources
+            ? s3.Bucket.fromBucketName(this, 'DomainBucket', bucketName)
+            : new s3.Bucket(this, 'DomainBucket', {
+                bucketName,
+                blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+                encryption: enableCmk ? s3.BucketEncryption.KMS : s3.BucketEncryption.S3_MANAGED,
+                encryptionKey: cmkKey,
+                versioned: true,
+                enforceSSL: true,
+                removalPolicy: cdk.RemovalPolicy.RETAIN,
+                lifecycleRules: [{
+                        noncurrentVersionExpiration: cdk.Duration.days(90),
+                    }],
+            });
         environment['DOMAIN_TABLE_NAME'] = domainTable.tableName;
         environment['DOMAIN_BUCKET_NAME'] = domainBucket.bucketName;
         // Per-domain tenant-scoped IAM role for defence-in-depth storage segregation

package/dist/__tests__/domain-stack.test.js

@@ -191,6 +191,52 @@ describe('DomainStack', () => {
             template.hasOutput('DomainBucketName', {});
         });
     });
+    describe('adopt existing resources (#5234)', () => {
+        const app = new cdk.App();
+        const stack = new DomainStack(app, 'TestDomainStackAdopt', {
+            registry: minimalRegistry,
+            eventBusArn,
+            projectId: 'Test',
+            envCode: 'Dev',
+            adoptExistingResources: true,
+        });
+        const template = Template.fromStack(stack);
+        it('does NOT create a DynamoDB table — the pre-existing table is imported', () => {
+            template.resourceCountIs('AWS::DynamoDB::Table', 0);
+        });
+        it('does NOT create an S3 bucket — the pre-existing bucket is imported', () => {
+            template.resourceCountIs('AWS::S3::Bucket', 0);
+        });
+        it('keeps the CfnOutputs for the adopted table and bucket names', () => {
+            template.hasOutput('DomainTableName', {});
+            template.hasOutput('DomainBucketName', {});
+        });
+        it('sets DOMAIN_TABLE_NAME and DOMAIN_BUCKET_NAME env vars to the adopted names', () => {
+            const lambdas = template.findResources('AWS::Lambda::Function');
+            const domainLambdas = Object.entries(lambdas).filter(([id]) => !id.includes('Health') && !id.includes('Ready') && !id.includes('LogRetention'));
+            for (const [, res] of domainLambdas) {
+                expect(res.Properties.Environment?.Variables?.DOMAIN_TABLE_NAME).toBe('test-dev-test-domain');
+                expect(res.Properties.Environment?.Variables?.DOMAIN_BUCKET_NAME).toBe('test-dev-test-domain');
+            }
+        });
+        it('still grants Lambdas read/write on the adopted table and bucket', () => {
+            const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+            const statementResources = (action) => policies.flatMap(p => p.Properties.PolicyDocument.Statement
+                .filter(s => s.Action?.includes(action))
+                .flatMap(s => {
+                const res = s.Resource;
+                if (Array.isArray(res))
+                    return res.map(r => JSON.stringify(r));
+                if (res === undefined)
+                    return [];
+                return [JSON.stringify(res)];
+            }));
+            // DynamoDB grant targets the imported table ARN (synthesized as Fn::Join).
+            expect(statementResources('dynamodb:PutItem').some(r => r.includes(':table/test-dev-test-domain'))).toBe(true);
+            // S3 grant targets the imported bucket ARN.
+            expect(statementResources('s3:PutObject').some(r => r.includes(':s3:::test-dev-test-domain/*'))).toBe(true);
+        });
+    });
     describe('tenant-scoped IAM role (defence in depth)', () => {
         const app = new cdk.App();
         const stack = new DomainStack(app, 'TestDomainStackTenant', { registry: minimalRegistry, eventBusArn, projectId: 'Test', envCode: 'Dev' });

package/dist/pack-domain.d.ts

@@ -57,6 +57,12 @@ export interface PackDomainOptions {
     crossDomainActionArns?: Record<string, string>;
     /** Disable auto-generated per-domain CloudWatch dashboard. */
     disableCloudWatchDashboards?: boolean;
+    /**
+     * When true, the per-domain DynamoDB table and S3 bucket are imported
+     * (adopted) instead of created — the migration-safe path when those
+     * resources already exist outside the CloudFormation stack (#5234).
+     */
+    adoptExistingResources?: boolean;
 }
 /**
  * Convenience entry-point: constructs a DomainStack from a compiled registry.

package/dist/pack-domain.js

@@ -61,5 +61,6 @@ export function packDomain(registry, app, stackId, eventBusArn, options) {
         envCode: opts.envCode,
         crossDomainActionArns: opts.crossDomainActionArns,
         disableCloudWatchDashboards: opts.disableCloudWatchDashboards,
+        adoptExistingResources: opts.adoptExistingResources,
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.95",
+  "version": "0.2.97",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",