@meyicloud/meyi-insight-server 1.1.2 → 1.1.4

package/dist/features/sources/cloudtrail/stackTemplates.d.ts

@@ -1,3 +1,3 @@
-export declare const STACK_YAML = "AWSTemplateFormatVersion: '2010-09-09'\nDescription: |\n  Meyi Connect Security Monitoring - Regional Events Stack.\n  Deploys regional security alerting rules and SNS webhook delivery.\n\nParameters:\n  Environment:\n    Type: String\n    Default: \"MeyiConnect\"\n    Description: Environment name (used as a prefix for resource names)\n\n  WebhookUrl:\n    Type: String\n    Description: MeyiConnect webhook URL for security alerts.\n\n  CreateCloudTrail:\n    Type: String\n    Default: 'false'\n    Description: Kept for backwards compatibility.\n\n  PrimaryRegion:\n    Type: String\n    Default: 'us-east-1'\n    Description: Kept for backwards compatibility.\n\n  DeploymentMode:\n    Type: String\n    Default: 'Organizations'\n    Description: Kept for backwards compatibility.\n\nResources:\n\n  # ============================================================\n  # SNS TOPIC & SUBSCRIPTION FOR ALERTS\n  # ============================================================\n\n  SecurityAlertsTopic:\n    Type: AWS::SNS::Topic\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n\n  SecurityAlertsTopicPolicy:\n    Type: AWS::SNS::TopicPolicy\n    Properties:\n      Topics:\n        - !Ref SecurityAlertsTopic\n      PolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              Service: events.amazonaws.com\n            Action: sns:Publish\n            Resource: !Ref SecurityAlertsTopic\n\n  WebhookSubscription:\n    Type: AWS::SNS::Subscription\n    Properties:\n      TopicArn: !Ref SecurityAlertsTopic\n      Endpoint: !Ref WebhookUrl\n      Protocol: https\n\n  # ============================================================\n  # EVENTBRIDGE RULES ON DEFAULT BUS\n  # Regional events fire directly in this region - no forwarding needed\n  # ============================================================\n\n  DataAndInfrastructureSecurityRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: EC2, VPC, network, S3, and RDS configuration changes in the deployment region\n      EventPattern:\n        source:\n          - aws.ec2\n          - aws.s3\n          - aws.rds\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventSource:\n            - ec2.amazonaws.com\n            - s3.amazonaws.com\n            - rds.amazonaws.com\n          eventName:\n            # EC2 & Network Events\n            - StopInstances\n            - RunInstances\n            - RebootInstances\n            - StartInstances\n            - TerminateInstances\n            - CreateCustomerGateway\n            - DeleteCustomerGateway\n            - AttachInternetGateway\n            - CreateInternetGateway\n            - DeleteInternetGateway\n            - DetachInternetGateway\n            - CreateNetworkAcl\n            - DeleteNetworkAcl\n            - CreateNetworkAclEntry\n            - DeleteNetworkAclEntry\n            - ReplaceNetworkAclEntry\n            - ReplaceNetworkAclAssociation\n            - AuthorizeSecurityGroupIngress\n            - AuthorizeSecurityGroupEgress\n            - RevokeSecurityGroupIngress\n            - RevokeSecurityGroupEgress\n            - ModifySecurityGroupRules\n            - UpdateSecurityGroupRuleDescriptionsIngress\n            - UpdateSecurityGroupRuleDescriptionsEgress\n            - CreateSecurityGroup\n            - DeleteSecurityGroup\n            - CreateVpc\n            - DeleteVpc\n            - ModifyVpcAttribute\n            - AcceptVpcPeeringConnection\n            - CreateVpcPeeringConnection\n            - DeleteVpcPeeringConnection\n            - RejectVpcPeeringConnection\n            - AttachClassicLinkVpc\n            - DetachClassicLinkVpc\n            - DisableVpcClassicLink\n            - EnableVpcClassicLink\n            - ModifyImageAttribute\n            - ModifySnapshotAttribute\n            - ModifyInstanceAttribute\n            - ImportKeyPair\n            - CreateKeyPair\n            - DisableEbsEncryptionByDefault\n            - DeleteFlowLogs\n            # S3 Events\n            - PutBucketPublicAccessBlock\n            - DeletePublicAccessBlock\n            - PutBucketPolicy\n            - DeleteBucketPolicy\n            - PutBucketAcl\n            - PutBucketEncryption\n            - DeleteBucketEncryption\n            - DeleteBucket\n            # RDS Events\n            - ModifyDBInstance\n            - ModifyDBSnapshotAttribute\n            - DeleteDBInstance\n            - DeleteDBClusterSnapshot\n            - RestoreDBInstanceFromDBSnapshot\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n  OperationsAndSecretsSecurityRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Lambda, SSM, Secrets Manager, and KMS configuration/management events\n      EventPattern:\n        source:\n          - aws.lambda\n          - aws.ssm\n          - aws.secretsmanager\n          - aws.kms\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventSource:\n            - lambda.amazonaws.com\n            - ssm.amazonaws.com\n            - secretsmanager.amazonaws.com\n            - kms.amazonaws.com\n          eventName:\n            # Lambda, SSM, Secrets Manager\n            - AddPermission\n            - CreateFunction\n            - UpdateFunctionCode\n            - CreateEventSourceMapping\n            - SendCommand\n            - StartSession\n            - PutParameter\n            - DeleteParameter\n            - DeleteSecret\n            - PutResourcePolicy\n            # KMS\n            - ScheduleKeyDeletion\n            - DisableKey\n            - DisableKeyRotation\n            - PutKeyPolicy\n            - DeleteAlias\n            - CancelKeyDeletion\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n  AuditAndTamperingSecurityRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: CloudTrail, GuardDuty, Security Hub, and Config auditing or tampering events\n      EventPattern:\n        source:\n          - aws.cloudtrail\n          - aws.securityhub\n          - aws.guardduty\n          - aws.config\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventSource:\n            - cloudtrail.amazonaws.com\n            - securityhub.amazonaws.com\n            - guardduty.amazonaws.com\n            - config.amazonaws.com\n          eventName:\n            # CloudTrail\n            - CreateTrail\n            - UpdateTrail\n            - DeleteTrail\n            - StartLogging\n            - StopLogging\n            - PutEventSelectors\n            - DeleteEventDataStore\n            # Security Services Tampering\n            - BatchDisableStandards\n            - DeleteMembers\n            - DisassociateMembers\n            - DeleteDetector\n            - UpdateDetector\n            - CreateFilter\n            - StopMonitoringMembers\n            - DisableSecurityHub\n            - StopConfigurationRecorder\n            - DeleteConfigurationRecorder\n            - DeleteDeliveryChannel\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n  ControlTowerManagedRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Security Hub findings imported by AWS Control Tower\n      EventPattern:\n        source:\n          - aws.securityhub\n        detail-type:\n          - Security Hub Findings - Imported\n        detail:\n          findings:\n            Compliance:\n              AssociatedStandards:\n                StandardsId:\n                  - prefix: standards/service-managed-aws-control-tower\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n# ============================================================\n# OUTPUTS\n# ============================================================\n\nOutputs:\n  SecurityAlertsTopicArn:\n    Description: ARN of the regional security alerts SNS topic\n    Value: !Ref SecurityAlertsTopic";
+export declare const STACK_YAML = "AWSTemplateFormatVersion: '2010-09-09'\nDescription: |\n  Meyi Connect Security Monitoring - Regional Events Stack.\n  Deploys regional security alerting rules and SNS webhook delivery.\n\nParameters:\n  Environment:\n    Type: String\n    Default: \"MeyiConnect\"\n    Description: Environment name (used as a prefix for resource names)\n\n  WebhookUrl:\n    Type: String\n    Description: MeyiConnect webhook URL for security alerts.\n\n  CreateCloudTrail:\n    Type: String\n    Default: 'false'\n    Description: Kept for backwards compatibility.\n\n  PrimaryRegion:\n    Type: String\n    Default: 'us-east-1'\n    Description: Kept for backwards compatibility.\n\n  DeploymentMode:\n    Type: String\n    Default: 'Organizations'\n    Description: Kept for backwards compatibility.\n\nResources:\n\n  # ============================================================\n  # SNS TOPIC & SUBSCRIPTION FOR ALERTS\n  # ============================================================\n\n  SecurityAlertsTopic:\n    Type: AWS::SNS::Topic\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n\n  SecurityAlertsTopicPolicy:\n    Type: AWS::SNS::TopicPolicy\n    Properties:\n      Topics:\n        - !Ref SecurityAlertsTopic\n      PolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              Service: events.amazonaws.com\n            Action: sns:Publish\n            Resource: !Ref SecurityAlertsTopic\n\n  WebhookSubscription:\n    Type: AWS::SNS::Subscription\n    Properties:\n      TopicArn: !Ref SecurityAlertsTopic\n      Endpoint: !Ref WebhookUrl\n      Protocol: https\n\n  # ============================================================\n  # EVENTBRIDGE RULES ON DEFAULT BUS\n  # Regional events fire directly in this region - no forwarding needed\n  # ============================================================\n\n  DataAndInfrastructureSecurityRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: EC2, VPC, network, S3, and RDS configuration changes in the deployment region\n      EventPattern:\n        source:\n          - aws.ec2\n          - aws.s3\n          - aws.rds\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventSource:\n            - ec2.amazonaws.com\n            - s3.amazonaws.com\n            - rds.amazonaws.com\n          eventName:\n            # EC2 & Network Events\n            - StopInstances\n            - RunInstances\n            - RebootInstances\n            - StartInstances\n            - TerminateInstances\n            - CreateCustomerGateway\n            - DeleteCustomerGateway\n            - AttachInternetGateway\n            - CreateInternetGateway\n            - DeleteInternetGateway\n            - DetachInternetGateway\n            - CreateNetworkAcl\n            - DeleteNetworkAcl\n            - CreateNetworkAclEntry\n            - DeleteNetworkAclEntry\n            - ReplaceNetworkAclEntry\n            - ReplaceNetworkAclAssociation\n            - AuthorizeSecurityGroupIngress\n            - AuthorizeSecurityGroupEgress\n            - RevokeSecurityGroupIngress\n            - RevokeSecurityGroupEgress\n            - ModifySecurityGroupRules\n            - UpdateSecurityGroupRuleDescriptionsIngress\n            - UpdateSecurityGroupRuleDescriptionsEgress\n            - CreateSecurityGroup\n            - DeleteSecurityGroup\n            - CreateVpc\n            - DeleteVpc\n            - ModifyVpcAttribute\n            - AcceptVpcPeeringConnection\n            - CreateVpcPeeringConnection\n            - DeleteVpcPeeringConnection\n            - RejectVpcPeeringConnection\n            - AttachClassicLinkVpc\n            - DetachClassicLinkVpc\n            - DisableVpcClassicLink\n            - EnableVpcClassicLink\n            - ModifyImageAttribute\n            - ModifySnapshotAttribute\n            - ModifyInstanceAttribute\n            - ImportKeyPair\n            - CreateKeyPair\n            - DisableEbsEncryptionByDefault\n            - DeleteFlowLogs\n            # S3 Events\n            - PutBucketPublicAccessBlock\n            - DeletePublicAccessBlock\n            - PutBucketPolicy\n            - DeleteBucketPolicy\n            - PutBucketAcl\n            - PutBucketEncryption\n            - DeleteBucketEncryption\n            - DeleteBucket\n            # RDS Events\n            - ModifyDBInstance\n            - ModifyDBSnapshotAttribute\n            - DeleteDBInstance\n            - DeleteDBClusterSnapshot\n            - RestoreDBInstanceFromDBSnapshot\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n  OperationsAndSecretsSecurityRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Lambda, SSM, Secrets Manager, and KMS configuration/management events\n      EventPattern:\n        source:\n          - aws.lambda\n          - aws.ssm\n          - aws.secretsmanager\n          - aws.kms\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventSource:\n            - lambda.amazonaws.com\n            - ssm.amazonaws.com\n            - secretsmanager.amazonaws.com\n            - kms.amazonaws.com\n          eventName:\n                # Lambda, SSM, Secrets Manager\n                - AddPermission\n                - CreateFunction\n                - UpdateFunctionCode\n                - CreateEventSourceMapping\n                - StartSession\n                - PutParameter\n                - DeleteParameter\n                - DeleteSecret\n                - PutResourcePolicy\n                # KMS\n                - ScheduleKeyDeletion\n                - DisableKey\n                - DisableKeyRotation\n                - PutKeyPolicy\n                - DeleteAlias\n                - CancelKeyDeletion\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n  AuditAndTamperingSecurityRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: CloudTrail, GuardDuty, Security Hub, and Config auditing or tampering events\n      EventPattern:\n        source:\n          - aws.cloudtrail\n          - aws.securityhub\n          - aws.guardduty\n          - aws.config\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventSource:\n            - cloudtrail.amazonaws.com\n            - securityhub.amazonaws.com\n            - guardduty.amazonaws.com\n            - config.amazonaws.com\n          eventName:\n            # CloudTrail\n            - CreateTrail\n            - UpdateTrail\n            - DeleteTrail\n            - StartLogging\n            - StopLogging\n            - PutEventSelectors\n            - DeleteEventDataStore\n            # Security Services Tampering\n            - BatchDisableStandards\n            - DeleteMembers\n            - DisassociateMembers\n            - DeleteDetector\n            - UpdateDetector\n            - CreateFilter\n            - StopMonitoringMembers\n            - DisableSecurityHub\n            - StopConfigurationRecorder\n            - DeleteConfigurationRecorder\n            - DeleteDeliveryChannel\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n  ControlTowerManagedRule:\n    Type: AWS::Events::Rule\n    DependsOn: SecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Security Hub findings imported by AWS Control Tower\n      EventPattern:\n        source:\n          - aws.securityhub\n        detail-type:\n          - Security Hub Findings - Imported\n        detail:\n          findings:\n            Compliance:\n              AssociatedStandards:\n                StandardsId:\n                  - prefix: standards/service-managed-aws-control-tower\n      State: ENABLED\n      Targets:\n        - Arn: !Ref SecurityAlertsTopic\n          Id: SNSTarget\n\n# ============================================================\n# OUTPUTS\n# ============================================================\n\nOutputs:\n  SecurityAlertsTopicArn:\n    Description: ARN of the regional security alerts SNS topic\n    Value: !Ref SecurityAlertsTopic";
 export declare const GLOBAL_STACK_YAML = "AWSTemplateFormatVersion: '2010-09-09'\nDescription: |\n  Meyi Connect Security Monitoring - Global Events Stack (us-east-1). Fully independent of\n  the regional Central Stack. Captures IAM, Root Login, Console Login Failure, and AWS Health\n  events (all global services that only fire in us-east-1) and delivers them directly to the\n  Meyi Connect webhook via Amazon SNS. No cross-region forwarding,\n  no shared resources with any other stack.\n\nParameters:\n  Environment:\n    Type: String\n    Default: \"MeyiConnect\"\n    Description: Environment name (used as a prefix for resource names)\n\n  WebhookUrl:\n    Type: String\n    Description: MeyiConnect webhook URL for global security alerts.\n\n  CreateCloudTrail:\n    Type: String\n    Default: 'false'\n    Description: Dummy parameter for compatibility with meyi-security-monitoring.yaml.\n\n  PrimaryRegion:\n    Type: String\n    Default: 'us-east-1'\n    Description: Dummy parameter for compatibility with meyi-security-monitoring.yaml.\n\n  DeploymentMode:\n    Type: String\n    Default: 'Organizations'\n    AllowedValues:\n      - 'Organizations'\n      - 'Standalone'\n    Description: Whether this is deployed via AWS Organizations or as a standalone account.\n\nResources:\n\n  # ============================================================\n  # SNS TOPIC & SUBSCRIPTION FOR GLOBAL ALERTS\n  # ============================================================\n\n  GlobalSecurityAlertsTopic:\n    Type: AWS::SNS::Topic\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n\n  GlobalSecurityAlertsTopicPolicy:\n    Type: AWS::SNS::TopicPolicy\n    Properties:\n      Topics:\n        - !Ref GlobalSecurityAlertsTopic\n      PolicyDocument:\n        Version: '2012-10-17'\n        Statement:\n          - Effect: Allow\n            Principal:\n              Service: events.amazonaws.com\n            Action: sns:Publish\n            Resource: !Ref GlobalSecurityAlertsTopic\n\n  WebhookSubscription:\n    Type: AWS::SNS::Subscription\n    Properties:\n      TopicArn: !Ref GlobalSecurityAlertsTopic\n      Endpoint: !Ref WebhookUrl\n      Protocol: https\n\n  # ============================================================\n  # EVENTBRIDGE RULES - GLOBAL EVENTS\n  # IAM, Root Login, Console Login, Health, and Organizations all fire only in us-east-1\n  # ============================================================\n\n  IAMAndOrganizationsSecurityEventsRule:\n    Type: AWS::Events::Rule\n    DependsOn: GlobalSecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: IAM and Organizations security configuration changes\n      EventPattern:\n        source:\n          - aws.iam\n          - aws.organizations\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          eventName:\n            # IAM events\n            - CreateUser\n            - DeleteUser\n            - CreateAccessKey\n            - UpdateAccessKey\n            - DeleteAccessKey\n            - AttachRolePolicy\n            - DetachRolePolicy\n            - PutUserPolicy\n            - PutRolePolicy\n            - UpdateAssumeRolePolicy\n            - DeactivateMFADevice\n            - CreateLoginProfile\n            - UpdateLoginProfile\n            - DeleteLoginProfile\n            - CreateAccountAlias\n            - DeleteAccountAlias\n            - UpdateAccountPasswordPolicy\n            - DeleteAccountPasswordPolicy\n            - DeleteGroupPolicy\n            - PutGroupPolicy\n            - CreatePolicy\n            - DeletePolicy\n            - CreatePolicyVersion\n            - DeletePolicyVersion\n            - AttachUserPolicy\n            - DetachUserPolicy\n            - AttachGroupPolicy\n            - DetachGroupPolicy\n            - CreateRole\n            - DeleteRole\n            - CreateSAMLProvider\n            - UpdateSAMLProvider\n            - CreateOpenIDConnectProvider\n            - UpdateOpenIDConnectProvider\n            - CreateServiceSpecificCredential\n            # Organizations events\n            - LeaveOrganization\n            - RemoveAccountFromOrganization\n            - DeletePolicy\n            - DetachPolicy\n            - DisablePolicyType\n            - UpdatePolicy\n            - CreateAccount\n            - InviteAccountToOrganization\n      State: ENABLED\n      Targets:\n        - Arn: !Ref GlobalSecurityAlertsTopic\n          Id: SNSTarget\n\n  ConsoleLoginRule:\n    Type: AWS::Events::Rule\n    DependsOn: GlobalSecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Root login, failed console logins, and MFA-not-used console login attempts\n      EventPattern:\n        detail-type:\n          - AWS Console Sign In via CloudTrail\n        detail:\n          eventName:\n            - ConsoleLogin\n          $or:\n            - userIdentity:\n                type:\n                  - Root\n              responseElements:\n                ConsoleLogin:\n                  - Success\n            - responseElements:\n                ConsoleLogin:\n                  - Failure\n            - responseElements:\n                ConsoleLogin:\n                  - Success\n              additionalEventData:\n                MFAUsed:\n                  - \"No\"\n      State: ENABLED\n      Targets:\n        - Arn: !Ref GlobalSecurityAlertsTopic\n          Id: SNSTarget\n\n  HealthEventsRule:\n    Type: AWS::Events::Rule\n    DependsOn: GlobalSecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: AWS Health notifications\n      EventPattern:\n        source:\n          - aws.health\n        detail-type:\n          - AWS Health Event\n      State: ENABLED\n      Targets:\n        - Arn: !Ref GlobalSecurityAlertsTopic\n          Id: SNSTarget\n\n  RootAPICallsRule:\n    Type: AWS::Events::Rule\n    DependsOn: GlobalSecurityAlertsTopicPolicy\n    Properties:\n      Tags:\n        - Key: Project\n          Value: MeyiConnect\n        - Key: Created_for\n          Value: L1 Security\n        - Key: aws-apn-id\n          Value: pc:eyl8vo7kcwv8k9qctzbathhiq\n      Description: Capture any API call made by the Root user account in us-east-1\n      EventPattern:\n        detail-type:\n          - AWS API Call via CloudTrail\n        detail:\n          userIdentity:\n            type:\n              - Root\n      State: ENABLED\n      Targets:\n        - Arn: !Ref GlobalSecurityAlertsTopic\n          Id: SNSTarget\n\n# ============================================================\n# OUTPUTS\n# ============================================================\n\nOutputs:\n  TopicArn:\n    Description: Global security alerts SNS Topic ARN\n    Value: !Ref GlobalSecurityAlertsTopic\n\n  RulesDeployed:\n    Description: Rules deployed in this stack\n    Value: IAMAndOrganizationsSecurityEvents, ConsoleLogin, HealthEvents, RootAPICalls";
 //# sourceMappingURL=stackTemplates.d.ts.map

package/dist/features/sources/cloudtrail/stackTemplates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stackTemplates.d.ts","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/stackTemplates.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,+kSA4Sa,CAAC;AAErC,eAAO,MAAM,iBAAiB,u6OAqPyD,CAAC"}
+{"version":3,"file":"stackTemplates.d.ts","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/stackTemplates.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,wnSA2Sa,CAAC;AAErC,eAAO,MAAM,iBAAiB,u6OAqPyD,CAAC"}

package/dist/features/sources/cloudtrail/stackTemplates.js

@@ -188,24 +188,23 @@ Resources:
             - secretsmanager.amazonaws.com
             - kms.amazonaws.com
           eventName:
-            # Lambda, SSM, Secrets Manager
-            - AddPermission
-            - CreateFunction
-            - UpdateFunctionCode
-            - CreateEventSourceMapping
-            - SendCommand
-            - StartSession
-            - PutParameter
-            - DeleteParameter
-            - DeleteSecret
-            - PutResourcePolicy
-            # KMS
-            - ScheduleKeyDeletion
-            - DisableKey
-            - DisableKeyRotation
-            - PutKeyPolicy
-            - DeleteAlias
-            - CancelKeyDeletion
+                # Lambda, SSM, Secrets Manager
+                - AddPermission
+                - CreateFunction
+                - UpdateFunctionCode
+                - CreateEventSourceMapping
+                - StartSession
+                - PutParameter
+                - DeleteParameter
+                - DeleteSecret
+                - PutResourcePolicy
+                # KMS
+                - ScheduleKeyDeletion
+                - DisableKey
+                - DisableKeyRotation
+                - PutKeyPolicy
+                - DeleteAlias
+                - CancelKeyDeletion
       State: ENABLED
       Targets:
         - Arn: !Ref SecurityAlertsTopic

package/dist/features/sources/cloudtrail/stackTemplates.js.map

@@ -1 +1 @@
-{"version":3,"file":"stackTemplates.js","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/stackTemplates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA4SU,CAAC;AAErC,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uFAqPsD,CAAC"}
+{"version":3,"file":"stackTemplates.js","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/stackTemplates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA2SU,CAAC;AAErC,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uFAqPsD,CAAC"}

package/dist/features/sources/cloudtrail/template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/template.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,sBAAsB,QAUxB,CAAC;AA+rCZ,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,eAAe,GAAG,YAAY,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAoBT"}
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/template.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,sBAAsB,QAUxB,CAAC;AA4zCZ,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,eAAe,GAAG,YAAY,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAqBT"}

package/dist/features/sources/cloudtrail/template.js

@@ -34,6 +34,7 @@ Metadata:
         Parameters:
           - DeploymentMode
           - CreateIAMRoles
+          - DeployToManagementAccount
           - TargetOUs
           - TargetAccounts
           - TargetRegions
@@ -59,6 +60,8 @@ Metadata:
         default: "Deployment Mode"
       CreateIAMRoles:
         default: "Create StackSet IAM Roles?"
+      DeployToManagementAccount:
+        default: "Also deploy to this (management) account?"
       TargetOUs:
         default: "Target Organizational Unit IDs (comma separated)"
       TargetAccounts:
@@ -95,7 +98,15 @@ Parameters:
     AllowedValues:
       - 'true'
       - 'false'
-    Description: "Create standard AWSCloudFormationStackSetAdministrationRole and AWSCloudFormationStackSetExecutionRole? Only used in Standalone mode."
+    Description: "Create standard AWSCloudFormationStackSetAdministrationRole and AWSCloudFormationStackSetExecutionRole? Used in Standalone mode, and in Organizations mode when DeployToManagementAccount is true. Set to false if these roles already exist in this account."
+
+  DeployToManagementAccount:
+    Type: String
+    Default: 'true'
+    AllowedValues:
+      - 'true'
+      - 'false'
+    Description: "Organizations mode only. Service-managed StackSets never deploy to the management account, so when true this stack also deploys the same monitoring to THIS account through two additional self-managed StackSets."
 
   TargetOUs:
     Type: CommaDelimitedList
@@ -141,7 +152,8 @@ Conditions:
   HasTargetAccounts: !Not [ !Equals [ !Join [ "", !Ref TargetAccounts ], "" ] ]
   IsServiceManaged: !Equals [ !Ref DeploymentMode, 'Organizations' ]
   IsSelfManaged: !Equals [ !Ref DeploymentMode, 'Standalone' ]
-  ShouldCreateRoles: !And [ !Equals [ !Ref DeploymentMode, 'Standalone' ], !Equals [ !Ref CreateIAMRoles, 'true' ] ]
+  DeployManagement: !And [ !Condition IsServiceManaged, !Equals [ !Ref DeployToManagementAccount, 'true' ] ]
+  ShouldCreateRoles: !And [ !Or [ !Condition IsSelfManaged, !Condition DeployManagement ], !Equals [ !Ref CreateIAMRoles, 'true' ] ]
   ShouldCreateStackInstances: !Or [ !Condition IsSelfManaged, !Condition HasTargetOUs ]
 
 Resources:
@@ -229,6 +241,8 @@ Resources:
                   - cloudtrail:GetTrailStatus
                   - cloudtrail:StartLogging
                   - cloudtrail:StopLogging
+                  - cloudtrail:PutEventSelectors
+                  - cloudtrail:GetEventSelectors
                   - cloudtrail:ListTags
                   - cloudtrail:AddTags
                   - cloudtrail:RemoveTags
@@ -260,6 +274,45 @@ Resources:
                   - events:UntagResource
                   - events:ListTagsForResource
                 Resource: !Sub "arn:aws:events:*:\${AWS::AccountId}:rule/\${AWS::StackName}-*"
+              - Sid: EventBridgeApiDestinationOperations
+                Effect: Allow
+                Action:
+                  - events:CreateConnection
+                  - events:UpdateConnection
+                  - events:DeleteConnection
+                  - events:DescribeConnection
+                  - events:CreateApiDestination
+                  - events:UpdateApiDestination
+                  - events:DeleteApiDestination
+                  - events:DescribeApiDestination
+                Resource:
+                  - !Sub "arn:aws:events:*:\${AWS::AccountId}:connection/\${AWS::StackName}-*"
+                  - !Sub "arn:aws:events:*:\${AWS::AccountId}:api-destination/\${AWS::StackName}-*"
+              - Sid: EventBridgeConnectionSecret
+                Effect: Allow
+                Action:
+                  - secretsmanager:CreateSecret
+                  - secretsmanager:UpdateSecret
+                  - secretsmanager:DeleteSecret
+                  - secretsmanager:DescribeSecret
+                  - secretsmanager:GetSecretValue
+                  - secretsmanager:PutSecretValue
+                Resource: !Sub "arn:aws:secretsmanager:*:\${AWS::AccountId}:secret:events!connection/*"
+              - Sid: ApiDestinationInvokeRole
+                Effect: Allow
+                Action:
+                  - iam:CreateRole
+                  - iam:DeleteRole
+                  - iam:GetRole
+                  - iam:PutRolePolicy
+                  - iam:DeleteRolePolicy
+                  - iam:GetRolePolicy
+                  - iam:TagRole
+                  - iam:UntagRole
+                  - iam:PassRole
+                Resource:
+                  - !Sub "arn:aws:iam::\${AWS::AccountId}:role/\${AWS::StackName}-EbRole-*"
+                  - !Sub "arn:aws:iam::\${AWS::AccountId}:role/\${AWS::StackName}-GlEbRole-*"
 
   # ============================================================
   # STACKSET
@@ -599,24 +652,23 @@ Resources:
                     - secretsmanager.amazonaws.com
                     - kms.amazonaws.com
                   eventName:
-                    # Lambda, SSM, Secrets Manager
-                    - AddPermission
-                    - CreateFunction
-                    - UpdateFunctionCode
-                    - CreateEventSourceMapping
-                    - SendCommand
-                    - StartSession
-                    - PutParameter
-                    - DeleteParameter
-                    - DeleteSecret
-                    - PutResourcePolicy
-                    # KMS
-                    - ScheduleKeyDeletion
-                    - DisableKey
-                    - DisableKeyRotation
-                    - PutKeyPolicy
-                    - DeleteAlias
-                    - CancelKeyDeletion
+                        # Lambda, SSM, Secrets Manager
+                        - AddPermission
+                        - CreateFunction
+                        - UpdateFunctionCode
+                        - CreateEventSourceMapping
+                        - StartSession
+                        - PutParameter
+                        - DeleteParameter
+                        - DeleteSecret
+                        - PutResourcePolicy
+                        # KMS
+                        - ScheduleKeyDeletion
+                        - DisableKey
+                        - DisableKeyRotation
+                        - PutKeyPolicy
+                        - DeleteAlias
+                        - CancelKeyDeletion
               State: ENABLED
               Targets:
                 - Id: ApiDestinationTarget
@@ -1089,6 +1141,7 @@ Resources:
         - Key: aws-apn-id
           Value: pc:eyl8vo7kcwv8k9qctzbathhiq
 
+__MEYI_MANAGEMENT_STACKSETS__
   # ============================================================
   # EVENTBRIDGE API DESTINATION & CONNECTION (PARENT STACKSET STATUS)
   # ============================================================
@@ -1230,15 +1283,87 @@ Outputs:
       Backend:     \${BackendUrl}
 
 `;
+/**
+ * Service-managed StackSets never deploy to the Organizations management account.
+ * To cover it from the same stack, clone the two StackSets above as self-managed
+ * StackSets that target only this account, reusing their inline TemplateBody.
+ */
+function buildManagementStackSets(yaml) {
+    const bodyOf = (resource) => {
+        const start = yaml.indexOf(`  ${resource}:\n`);
+        if (start < 0)
+            throw new Error(`Template resource not found: ${resource}`);
+        const from = yaml.indexOf('      TemplateBody: |\n', start);
+        const to = yaml.indexOf('      PermissionModel:', from);
+        if (from < 0 || to < 0)
+            throw new Error(`TemplateBody not found: ${resource}`);
+        return yaml.slice(from, to);
+    };
+    const build = (id, suffix, description, body, regions) => `  ${id}:
+    Type: AWS::CloudFormation::StackSet
+    Condition: DeployManagement
+    DependsOn:
+      - StackSetApiDestination
+      - StackSetOperationRule
+    Properties:
+      StackSetName: !Sub "\${AWS::StackName}-SecurityMonitoring${suffix}-Mgmt"
+      Description: !Sub "\${AWS::StackName} ${description} (management account)"
+${body}      PermissionModel: SELF_MANAGED
+      AdministrationRoleARN: !If
+        - ShouldCreateRoles
+        - !GetAtt StackSetAdministrationRole.Arn
+        - !Sub "arn:aws:iam::\${AWS::AccountId}:role/AWSCloudFormationStackSetAdministrationRole"
+      ExecutionRoleName: AWSCloudFormationStackSetExecutionRole
+      Parameters:
+        - ParameterKey: ParentStackName
+          ParameterValue: !Ref "AWS::StackName"
+        - ParameterKey: WebhookUrl
+          ParameterValue: !Ref WebhookUrl
+        - ParameterKey: WebhookAuthToken
+          ParameterValue: !Ref WebhookAuthToken
+        - ParameterKey: CreateCloudTrail
+          ParameterValue: !Ref CreateCloudTrail
+        - ParameterKey: PrimaryRegion
+          ParameterValue: !Ref PrimaryRegion
+      StackInstancesGroup:
+        - DeploymentTargets:
+            Accounts:
+              - !Ref AWS::AccountId
+          Regions: ${regions}
+      OperationPreferences:
+        MaxConcurrentPercentage: 50
+        FailureToleranceCount: 1
+        RegionConcurrencyType: PARALLEL
+      Capabilities:
+        - CAPABILITY_NAMED_IAM
+      Tags:
+        - Key: Project
+          Value: MeyiConnectSecurityMonitoring
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+
+`;
+    return [
+        '  # ============================================================',
+        '  # MANAGEMENT ACCOUNT STACKSETS (self-managed, Organizations mode only)',
+        '  # ============================================================',
+        '',
+        build('ManagementSecurityMonitoringStackSet', '', 'Security Monitoring (regional logs)', bodyOf('SecurityMonitoringStackSet'), '!Ref TargetRegions'),
+        build('ManagementGlobalSecurityMonitoringStackSet', '-Global', 'Global Security Monitoring (us-east-1 only)', bodyOf('GlobalSecurityMonitoringStackSet'), '[ us-east-1 ]'),
+    ].join('\n');
+}
 export function buildCloudTrailCentralStackTemplate(input) {
     const mode = input.deploymentMode ?? 'Standalone';
-    const createIAMRoles = mode === 'Standalone' ? 'true' : 'false';
+    const createIAMRoles = 'true';
     const targetOUs = input.targetOUs ?? '';
     const targetAccounts = input.targetAccounts ?? '';
     const resolvedRegions = (input.targetRegions ?? '').trim() || ALL_AWS_ACTIVE_REGIONS;
     const primaryRegion = resolvedRegions.split(',')[0].trim() || 'us-east-1';
     const createCloudTrailDefault = input.createCloudTrail ? "true" : "false";
     return CENTRAL_STACK_YAML
+        .replace(/__MEYI_MANAGEMENT_STACKSETS__/g, buildManagementStackSets(CENTRAL_STACK_YAML))
         .replace(/__MEYI_WEBHOOK_URL__/g, input.webhookUrl)
         .replace(/__MEYI_WEBHOOK_AUTH_TOKEN__/g, input.webhookAuthToken || '')
         .replace(/__MEYI_DEPLOYMENT_STATUS_URL__/g, input.deploymentStatusUrl)

package/dist/features/sources/cloudtrail/template.js.map

@@ -1 +1 @@
-{"version":3,"file":"template.js","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/template.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAClD,cAAc;IACd,WAAW,EAAE,WAAW,EAAE,WAAW;IACrC,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,gBAAgB,EAAE,gBAAgB;IAClC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;IACpD,WAAW;CACZ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2rC1B,CAAC;AAEF,MAAM,UAAU,mCAAmC,CAAC,KASnD;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,IAAI,YAAY,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;IAClD,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,sBAAsB,CAAC;IACrF,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC;IAC1E,MAAM,uBAAuB,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAE1E,OAAO,kBAAkB;SACtB,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,UAAU,CAAC;SAClD,OAAO,CAAC,8BAA8B,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACrE,OAAO,CAAC,iCAAiC,EAAE,KAAK,CAAC,mBAAmB,CAAC;SACrE,OAAO,CAAC,qCAAqC,EAAE,uBAAuB,CAAC;SACvE,OAAO,CAAC,2BAA2B,EAAE,IAAI,CAAC;SAC1C,OAAO,CAAC,4BAA4B,EAAE,cAAc,CAAC;SACrD,OAAO,CAAC,8BAA8B,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,SAAS,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;SACtG,OAAO,CAAC,mCAAmC,EAAE,cAAc,CAAC,CAAC,CAAC,iBAAiB,cAAc,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;SACrH,OAAO,CAAC,0BAA0B,EAAE,eAAe,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"template.js","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/template.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAClD,cAAc;IACd,WAAW,EAAE,WAAW,EAAE,WAAW;IACrC,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,gBAAgB,EAAE,gBAAgB;IAClC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;IACpD,WAAW;CACZ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgvC1B,CAAC;AAEF;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAU,EAAE;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,MAAc,EAAE,WAAmB,EAAE,IAAY,EAAE,OAAe,EAAU,EAAE,CAAC,KAAK,EAAE;;;;;;;iEAOlD,MAAM;8CACzB,WAAW;EACvD,IAAI;;;;;;;;;;;;;;;;;;;;;qBAqBe,OAAO;;;;;;;;;;;;;;;CAe3B,CAAC;IAEA,OAAO;QACL,kEAAkE;QAClE,0EAA0E;QAC1E,kEAAkE;QAClE,EAAE;QACF,KAAK,CAAC,sCAAsC,EAAE,EAAE,EAAE,qCAAqC,EAAE,MAAM,CAAC,4BAA4B,CAAC,EAAE,oBAAoB,CAAC;QACpJ,KAAK,CAAC,4CAA4C,EAAE,SAAS,EAAE,6CAA6C,EAAE,MAAM,CAAC,kCAAkC,CAAC,EAAE,eAAe,CAAC;KAC3K,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KASnD;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,IAAI,YAAY,CAAC;IAClD,MAAM,cAAc,GAAG,MAAM,CAAC;IAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;IAClD,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,sBAAsB,CAAC;IACrF,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC;IAC1E,MAAM,uBAAuB,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAE1E,OAAO,kBAAkB;SACtB,OAAO,CAAC,gCAAgC,EAAE,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;SACvF,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,UAAU,CAAC;SAClD,OAAO,CAAC,8BAA8B,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACrE,OAAO,CAAC,iCAAiC,EAAE,KAAK,CAAC,mBAAmB,CAAC;SACrE,OAAO,CAAC,qCAAqC,EAAE,uBAAuB,CAAC;SACvE,OAAO,CAAC,2BAA2B,EAAE,IAAI,CAAC;SAC1C,OAAO,CAAC,4BAA4B,EAAE,cAAc,CAAC;SACrD,OAAO,CAAC,8BAA8B,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,SAAS,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;SACtG,OAAO,CAAC,mCAAmC,EAAE,cAAc,CAAC,CAAC,CAAC,iBAAiB,cAAc,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;SACrH,OAAO,CAAC,0BAA0B,EAAE,eAAe,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;AACxD,CAAC"}

package/dist/migrations/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrations/run.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAohD1D"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/migrations/run.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAiiD1D"}

package/dist/migrations/run.js

@@ -1,12 +1,22 @@
 import { sql } from "drizzle-orm";
 import yaml from "js-yaml";
+import { isMultiTenantEnabled } from "../tenancy.js";
 /**
  * Run all DDL migrations for the Insight plugin.
  * Safe to run on every start - all statements use IF NOT EXISTS / IF EXISTS guards.
  */
 export async function runMigrations(db) {
-    const defaultTenantId = (process.env.INSIGHT_DEFAULT_TENANT_ID || "default").trim() || "default";
+    // Standalone single-tenant mode keeps one tenant that owns everything. A
+    // multi-tenant host (Meyi Connect) has no default tenant: nothing is created
+    // for one and no row is assigned to one.
+    const defaultTenantId = isMultiTenantEnabled()
+        ? ""
+        : (process.env.INSIGHT_DEFAULT_TENANT_ID || "default").trim() || "default";
     const defaultTenantSql = defaultTenantId.replace(/'/g, "''");
+    const backfill = async (statement) => {
+        if (defaultTenantId)
+            await db.execute(sql.raw(statement));
+    };
     const defaultTokenTtlDaysRaw = Number.parseInt(process.env.INSIGHT_WEBHOOK_TOKEN_DEFAULT_DAYS || "30", 10);
     const defaultTokenTtlDays = Number.isFinite(defaultTokenTtlDaysRaw) && defaultTokenTtlDaysRaw > 0
         ? defaultTokenTtlDaysRaw
@@ -111,13 +121,13 @@ export async function runMigrations(db) {
           "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
           "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
         );
-        INSERT INTO "meyiconnect"."insight_tenants" ("id", "name", "is_default")
+        ${defaultTenantId ? `INSERT INTO "meyiconnect"."insight_tenants" ("id", "name", "is_default")
         VALUES ('${defaultTenantSql}', 'Default tenant', true)
-        ON CONFLICT ("id") DO UPDATE SET "is_default" = true, "updated_at" = NOW();
+        ON CONFLICT ("id") DO UPDATE SET "is_default" = true, "updated_at" = NOW();` : "NULL;"}
       ELSIF v_relkind = 'r' THEN
-        INSERT INTO "meyiconnect"."insight_tenants" ("id", "name", "is_default")
+        ${defaultTenantId ? `INSERT INTO "meyiconnect"."insight_tenants" ("id", "name", "is_default")
         VALUES ('${defaultTenantSql}', 'Default tenant', true)
-        ON CONFLICT ("id") DO UPDATE SET "is_default" = true, "updated_at" = NOW();
+        ON CONFLICT ("id") DO UPDATE SET "is_default" = true, "updated_at" = NOW();` : "NULL;"}
       END IF;
     END $$;
   `));
@@ -153,7 +163,7 @@ export async function runMigrations(db) {
       END IF;
     END $$;
   `));
-    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_sources" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`));
+    await backfill(`UPDATE "meyiconnect"."insight_sources" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`);
     await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_sources_tenant_id_idx ON "meyiconnect"."insight_sources" ("tenant_id")`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sources" ADD COLUMN IF NOT EXISTS "webhook_token_never_expires" BOOLEAN NOT NULL DEFAULT false`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sources" ADD COLUMN IF NOT EXISTS "webhook_token_expires_at" TIMESTAMPTZ`));
@@ -430,7 +440,7 @@ export async function runMigrations(db) {
     ADD COLUMN IF NOT EXISTS "aws_secret_access_key" TEXT,
     ADD COLUMN IF NOT EXISTS "aws_region" TEXT
   `));
-    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_projects" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`));
+    await backfill(`UPDATE "meyiconnect"."insight_projects" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`);
     await db.execute(sql.raw(`DROP INDEX IF EXISTS "meyiconnect"."insight_projects_tag_unique"`)).catch(() => { });
     await db.execute(sql.raw(`DROP INDEX IF EXISTS insight_projects_tag_unique`)).catch(() => { });
     await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_projects_tenant_tag_unique ON "meyiconnect"."insight_projects" ("tenant_id", "tag")`));
@@ -486,7 +496,7 @@ export async function runMigrations(db) {
       END IF;
     END $$;
   `));
-    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_incidents" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`));
+    await backfill(`UPDATE "meyiconnect"."insight_incidents" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`);
     await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_incidents_tenant_id_idx ON "meyiconnect"."insight_incidents" ("tenant_id")`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "incident_down_time" TEXT NOT NULL DEFAULT ''`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "name" TEXT`));
@@ -628,7 +638,7 @@ export async function runMigrations(db) {
       END IF;
     END $$;
   `));
-    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_alerts" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`));
+    await backfill(`UPDATE "meyiconnect"."insight_alerts" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`);
     await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alerts_tenant_id_idx ON "meyiconnect"."insight_alerts" ("tenant_id")`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "alias_id" TEXT`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "additional_configuration" JSONB`));
@@ -744,7 +754,7 @@ export async function runMigrations(db) {
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_settings" ADD COLUMN IF NOT EXISTS "aws_bedrock_secret_access_key" TEXT`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_settings" ADD COLUMN IF NOT EXISTS "aws_bedrock_region" TEXT`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_settings" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
-    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_settings" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`));
+    await backfill(`UPDATE "meyiconnect"."insight_settings" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`);
     await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_settings_tenant_id_idx ON "meyiconnect"."insight_settings" ("tenant_id")`));
     // notification_providers
     await db.execute(sql.raw(`
@@ -762,7 +772,7 @@ export async function runMigrations(db) {
     )
   `));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."notification_providers" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`)).catch(() => { });
-    await db.execute(sql.raw(`UPDATE "meyiconnect"."notification_providers" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`)).catch(() => { });
+    await backfill(`UPDATE "meyiconnect"."notification_providers" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`).catch(() => { });
     await db.execute(sql.raw(`DROP INDEX IF EXISTS "meyiconnect"."notification_providers_provider_name_unique"`)).catch(() => { });
     await db.execute(sql.raw(`DROP INDEX IF EXISTS notification_providers_provider_name_unique`)).catch(() => { });
     await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS notification_providers_tenant_name_unique ON "meyiconnect"."notification_providers" ("tenant_id", "provider_name")`)).catch(() => { });
@@ -869,7 +879,7 @@ export async function runMigrations(db) {
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "project" TEXT`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "ai_model_used" TEXT`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
-    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_sops" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`));
+    await backfill(`UPDATE "meyiconnect"."insight_sops" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`);
     await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_sops_tenant_id_idx ON "meyiconnect"."insight_sops" ("tenant_id")`));
     await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_sops_tenant_sop_id_unique ON "meyiconnect"."insight_sops" ("tenant_id", "sop_id")`));
     //  incident_evidence 
@@ -904,7 +914,7 @@ export async function runMigrations(db) {
   `));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_workflows" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_workflows" ADD COLUMN IF NOT EXISTS "source_id" UUID REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE`));
-    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_workflows" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`));
+    await backfill(`UPDATE "meyiconnect"."insight_workflows" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`);
     await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_workflows_tenant_id_idx ON "meyiconnect"."insight_workflows" ("tenant_id")`));
     await db.execute(sql.raw(`
     ALTER TABLE "meyiconnect"."insight_workflows"
@@ -937,12 +947,12 @@ export async function runMigrations(db) {
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_workflow_executions" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
     await db.execute(sql.raw(`
     UPDATE "meyiconnect"."insight_workflow_executions" e
-    SET "tenant_id" = COALESCE(w."tenant_id", '${defaultTenantSql}')
+    SET "tenant_id" = ${defaultTenantId ? `COALESCE(w."tenant_id", '${defaultTenantSql}')` : `w."tenant_id"`}
     FROM "meyiconnect"."insight_workflows" w
     WHERE e."workflow_id" = w."id"
       AND (e."tenant_id" IS NULL OR e."tenant_id" = '')
   `));
-    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_workflow_executions" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`));
+    await backfill(`UPDATE "meyiconnect"."insight_workflow_executions" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`);
     await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_workflow_executions_tenant_id_idx ON "meyiconnect"."insight_workflow_executions" ("tenant_id")`));
     // ─── insight_alerts pipeline columns (Phase 1) ───────────────────────────────
     await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "fingerprint" TEXT`));
@@ -1439,6 +1449,11 @@ export async function runMigrations(db) {
     // the same column, so either host can migrate first.
     await db.execute(sql.raw(`
     ALTER TABLE "meyiconnect"."ai_usage_log" ADD COLUMN IF NOT EXISTS "report_id" TEXT;
+  `));
+    // The AI usage API (src/features/ai-usage) reads a tenant's rows by time window.
+    await db.execute(sql.raw(`
+    CREATE INDEX IF NOT EXISTS ai_usage_log_tenant_created_idx
+      ON "meyiconnect"."ai_usage_log" ("tenant_id", "created_at" DESC);
   `));
     // ─── insight_incidents.priority ───────────────────────────────────────────
     // P1..P4. The default is set before the backfill so rows inserted meanwhile (e.g. by a server that