@prism-d1/cli 1.2.0 → 1.3.0

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -238,7 +238,7 @@ jobs:
           fi
 
           # Shared rule set: .prism/review/rules.md is the one source for this
-          # gate and the local pre-push review (prism-cli enable security).
+          # gate and the local pre-push review (prism-cli enable codewatch).
           # kiro-cli loads rules from .kiro/steering/, so sync it in for this run.
           if [ -f .prism/review/rules.md ]; then
             mkdir -p .kiro/steering
@@ -648,7 +648,7 @@ jobs:
 
             if [ -z "$CODE_REVIEW_ID" ]; then
               echo "::error::Could not create the Continuum Code Review resource: ${CR_OUTPUT}"
-              echo "  Run 'prism-cli securityagent setup' to create it manually."
+              echo "  Run 'prism-cli enable security' to create it manually."
               echo "scan_error=true" >> "$GITHUB_OUTPUT"
               echo "findings=-1" >> "$GITHUB_OUTPUT"
               exit 0

package/dist/assets/infra/bin/app.ts

@@ -6,6 +6,7 @@ import { AwsSolutionsChecks } from 'cdk-nag';
 import { MetricsPipelineStack } from '../lib/metrics-pipeline-stack';
 import { ApiStack } from '../lib/api-stack';
 import { DashboardStack } from '../lib/dashboard-stack';
+import { SecurityAgentStack } from '../lib/security-agent-stack';
 
 const app = new cdk.App();
 
@@ -14,43 +15,66 @@ const env: cdk.Environment = {
   region: process.env.CDK_DEFAULT_REGION ?? 'us-west-2',
 };
 
-const pipelineStack = new MetricsPipelineStack(app, 'PrismD1MetricsPipeline', {
-  env,
-  description: 'PRISM D1 Velocity - Core metrics event pipeline (EventBridge, DynamoDB)',
-  tags: {
-    'prism:project': 'PRISM',
-    'prism:domain': 'D1-Velocity',
-    'prism:component': 'MetricsPipeline',
-  },
-});
-
-const apiStack = new ApiStack(app, 'PrismD1Api', {
-  env,
-  description: 'PRISM D1 Velocity - Metric ingestion and query API',
-  eventBus: pipelineStack.eventBus,
-  eventsTable: pipelineStack.eventsTable,
-  metadataTable: pipelineStack.metadataTable,
-  kmsKey: pipelineStack.kmsKey,
-  tags: {
-    'prism:project': 'PRISM',
-    'prism:domain': 'D1-Velocity',
-    'prism:component': 'Api',
-  },
-});
-
-const dashboardStack = new DashboardStack(app, 'PrismD1Dashboard', {
-  env,
-  description: 'PRISM D1 Velocity - CloudWatch dashboards and alarms',
-  productivityWidgetArn: pipelineStack.otelCollector?.productivityWidgetArn,
-  velocityWidgetArn: pipelineStack.velocityWidgetArn,
-  tags: {
-    'prism:project': 'PRISM',
-    'prism:domain': 'D1-Velocity',
-    'prism:component': 'Dashboard',
-  },
-});
-
-apiStack.addDependency(pipelineStack);
+// securityAgentStandalone=true builds ONLY PrismD1SecurityAgent: AWS Security
+// Agent without the metrics pipeline (what `prism-cli enable security` deploys
+// in an account that does not host it in the pipeline). It and
+// enableSecurityAgent=true (Security Agent inside PrismD1MetricsPipeline) use
+// the same resource and export names, so one account can only have one.
+const standalone = app.node.tryGetContext('securityAgentStandalone') === 'true';
+if (standalone && app.node.tryGetContext('enableSecurityAgent') === 'true') {
+  throw new Error('securityAgentStandalone=true and enableSecurityAgent=true are exclusive: Security Agent lives either in PrismD1SecurityAgent or in PrismD1MetricsPipeline, never both.');
+}
+
+if (standalone) {
+  new SecurityAgentStack(app, 'PrismD1SecurityAgent', {
+    env,
+    description: 'PRISM D1 Velocity - AWS Security Agent (standalone, without the metrics pipeline)',
+    kmsKeyArn: app.node.tryGetContext('securityAgentKmsKeyArn') as string | undefined,
+    tags: {
+      'prism:project': 'PRISM',
+      'prism:domain': 'D1-Velocity',
+      'prism:component': 'SecurityAgent',
+    },
+  });
+} else {
+  const pipelineStack = new MetricsPipelineStack(app, 'PrismD1MetricsPipeline', {
+    env,
+    description: 'PRISM D1 Velocity - Core metrics event pipeline (EventBridge, DynamoDB)',
+    tags: {
+      'prism:project': 'PRISM',
+      'prism:domain': 'D1-Velocity',
+      'prism:component': 'MetricsPipeline',
+    },
+  });
+
+  const apiStack = new ApiStack(app, 'PrismD1Api', {
+    env,
+    description: 'PRISM D1 Velocity - Metric ingestion and query API',
+    eventBus: pipelineStack.eventBus,
+    eventsTable: pipelineStack.eventsTable,
+    metadataTable: pipelineStack.metadataTable,
+    kmsKey: pipelineStack.kmsKey,
+    tags: {
+      'prism:project': 'PRISM',
+      'prism:domain': 'D1-Velocity',
+      'prism:component': 'Api',
+    },
+  });
+
+  const dashboardStack = new DashboardStack(app, 'PrismD1Dashboard', {
+    env,
+    description: 'PRISM D1 Velocity - CloudWatch dashboards and alarms',
+    productivityWidgetArn: pipelineStack.otelCollector?.productivityWidgetArn,
+    velocityWidgetArn: pipelineStack.velocityWidgetArn,
+    tags: {
+      'prism:project': 'PRISM',
+      'prism:domain': 'D1-Velocity',
+      'prism:component': 'Dashboard',
+    },
+  });
+
+  apiStack.addDependency(pipelineStack);
+}
 
 // Enable cdk-nag AWS Solutions checks on all stacks
 Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));

package/dist/assets/infra/lib/constructs/security-agent-construct.ts

@@ -168,6 +168,32 @@ export class SecurityAgentConstruct extends Construct {
       );
     }
 
+    // -------------------------------------------------------
+    // S3 Scan Bucket — stores repo ZIPs and diff files for
+    // API-triggered code reviews (diff scans from CI/CD) and
+    // threat models. Created before the agent space, which lists it.
+    // -------------------------------------------------------
+    this.scanBucket = new s3.Bucket(this, 'ScanBucket', {
+      bucketName: `security-agent-scans-${cdk.Aws.ACCOUNT_ID}-${cdk.Aws.REGION}`,
+      // SSE-S3 (not the customer-managed KMS key): the Continuum service reads
+      // this bucket when creating the code review and cannot access a CMK it
+      // has no grant on. Artifacts here are ephemeral diffs (30-day lifecycle),
+      // the bucket is private (BLOCK_ALL) and SSL-enforced.
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      enforceSSL: true,
+      versioned: false,
+      lifecycleRules: [
+        {
+          id: 'expire-scan-artifacts',
+          expiration: cdk.Duration.days(30),
+          enabled: true,
+        },
+      ],
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+    });
+
     // Agent Space
     const agentSpace = new securityagent.CfnAgentSpace(this, 'AgentSpace', {
       name: props.agentSpaceName,
@@ -177,6 +203,9 @@ export class SecurityAgentConstruct extends Construct {
       }),
       awsResources: {
         iamRoles: [this.serviceRole.roleArn],
+        // create-threat-model refuses S3 sources and scope docs in a bucket the
+        // agent space does not list ("S3 bucket not found in agent instance S3 buckets").
+        s3Buckets: [this.scanBucket.bucketArn],
       },
       tags: [
         { key: 'prism:component', value: 'security-agent' },
@@ -210,7 +239,7 @@ export class SecurityAgentConstruct extends Construct {
 
     // Log group for pen test results (Security Agent writes to /aws/securityagent/<space>/pt-<id>)
     // Note: we do NOT set logGroupName to avoid conflicts with pre-existing log groups
-    // created by prism-cli securityagent setup or the Security Agent service itself.
+    // created by prism-cli enable security or the Security Agent service itself.
     const pentestLogGroup = logs.LogGroup.fromLogGroupName(
       this, 'PentestLogGroup',
       `/aws/securityagent/${props.agentSpaceName}`,
@@ -237,31 +266,6 @@ export class SecurityAgentConstruct extends Construct {
       });
     }
 
-    // -------------------------------------------------------
-    // S3 Scan Bucket — stores repo ZIPs and diff files for
-    // API-triggered code reviews (diff scans from CI/CD).
-    // -------------------------------------------------------
-    this.scanBucket = new s3.Bucket(this, 'ScanBucket', {
-      bucketName: `security-agent-scans-${cdk.Aws.ACCOUNT_ID}-${cdk.Aws.REGION}`,
-      // SSE-S3 (not the customer-managed KMS key): the Continuum service reads
-      // this bucket when creating the code review and cannot access a CMK it
-      // has no grant on. Artifacts here are ephemeral diffs (30-day lifecycle),
-      // the bucket is private (BLOCK_ALL) and SSL-enforced.
-      encryption: s3.BucketEncryption.S3_MANAGED,
-      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
-      enforceSSL: true,
-      versioned: false,
-      lifecycleRules: [
-        {
-          id: 'expire-scan-artifacts',
-          expiration: cdk.Duration.days(30),
-          enabled: true,
-        },
-      ],
-      removalPolicy: cdk.RemovalPolicy.DESTROY,
-      autoDeleteObjects: true,
-    });
-
     // Grant Security Agent service role read access to the scan bucket
     this.scanBucket.grantRead(this.serviceRole);
 
@@ -298,10 +302,11 @@ export class SecurityAgentConstruct extends Construct {
     // Code Review resource — NOT created here in CDK.
     // CreateCodeReview requires assets.sourceCode pointing to
     // an existing ZIP of the repo (chicken-and-egg at deploy).
-    // Instead, `prism-cli securityagent setup` handles:
-    //   1. git archive → upload repo.zip to scan bucket
+    // Instead, `prism-cli enable security` (or the CI eval gate on its
+    // first run) handles, per repo:
+    //   1. git archive → upload repo/<repo-slug>/latest.zip to the scan bucket
     //   2. CreateCodeReview API call
-    //   3. Write code-review-id to SSM
+    //   3. Write /prism/continuum/code-review-id/<repo-slug> to SSM
     // The CDK only provisions the bucket + role + SSM scaffold.
     // -------------------------------------------------------
 
@@ -325,7 +330,7 @@ export class SecurityAgentConstruct extends Construct {
       tier: ssm.ParameterTier.STANDARD,
     });
 
-    // code-review-id is written by `prism-cli securityagent setup` (not CDK)
+    // code-review-id/<repo-slug> is written by `prism-cli enable security` (not CDK)
     // because CreateCodeReview needs an existing repo ZIP in S3 first.
 
     new ssm.StringParameter(this, 'ParamScanBucket', {

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -15,6 +15,7 @@ import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import { PrismVpcConstruct } from './constructs/prism-vpc-construct';
 import { GuardrailEnforcerConstruct } from './constructs/guardrail-enforcer-construct';
 import { SecurityAgentConstruct } from './constructs/security-agent-construct';
+import { addSecurityAgentResources } from './security-agent-resources';
 import { OtelCollectorConstruct } from './constructs/otel-collector-construct';
 import { NagSuppressions } from 'cdk-nag';
 
@@ -613,116 +614,7 @@ export class MetricsPipelineStack extends cdk.Stack {
     // -------------------------------------------------------
     const enableSecurityAgent = this.node.tryGetContext('enableSecurityAgent') === 'true';
     if (enableSecurityAgent) {
-      this.securityAgent = new SecurityAgentConstruct(this, 'SecurityAgent', {
-        agentSpaceName: 'prism-d1-security',
-        description: 'PRISM D1 Continuum space for design review, code review, and pen testing',
-        kmsKey: prismKmsKey,
-        codeRemediationStrategy: 'DISABLED',
-        tags: {
-          'prism:pillar': 'security',
-        },
-      });
-
-      // Grant GitHub OIDC roles access to scan bucket and Continuum APIs.
-      // The OIDC role is created by `prism-cli bootstrapper setup-github-oidc`
-      // with name pattern prism-d1-github-oidc-*.
-      this.securityAgent.scanBucket.addToResourcePolicy(
-        new iam.PolicyStatement({
-          effect: iam.Effect.ALLOW,
-          principals: [new iam.ArnPrincipal(`arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:root`)],
-          actions: ['s3:PutObject', 's3:GetObject'],
-          resources: [this.securityAgent.scanBucket.arnForObjects('*')],
-          conditions: {
-            ArnLike: {
-              'aws:PrincipalArn': `arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:role/prism-d1-github-oidc-*`,
-            },
-          },
-        }),
-      );
-
-      // Create a managed policy for Continuum scan API access.
-      // Attached to the OIDC role by the bootstrapper setup script.
-      const continuumCiPolicy = new iam.ManagedPolicy(this, 'ContinuumCiPolicy', {
-        managedPolicyName: 'prism-d1-continuum-ci-scan',
-        description: 'Grants GitHub Actions workflows access to Continuum diff scan APIs and SSM config',
-        statements: [
-          new iam.PolicyStatement({
-            sid: 'ContinuumScanAPIs',
-            effect: iam.Effect.ALLOW,
-            actions: [
-              'securityagent:StartCodeReviewJob',
-              'securityagent:BatchGetCodeReviewJobs',
-              'securityagent:BatchGetCodeReviewJobTasks',
-              'securityagent:ListFindings',
-              'securityagent:BatchGetFindings',
-              'securityagent:CreateCodeReview',
-              'securityagent:ListCodeReviews',
-            ],
-            resources: [
-              `arn:aws:securityagent:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:agent-space/*`,
-            ],
-          }),
-          new iam.PolicyStatement({
-            sid: 'PassRoleForCodeReview',
-            effect: iam.Effect.ALLOW,
-            actions: ['iam:PassRole'],
-            resources: [this.securityAgent.serviceRole.roleArn],
-            conditions: {
-              StringEquals: { 'iam:PassedToService': 'securityagent.amazonaws.com' },
-            },
-          }),
-          new iam.PolicyStatement({
-            sid: 'ScanBucketWrite',
-            effect: iam.Effect.ALLOW,
-            actions: ['s3:PutObject', 's3:GetObject', 's3:ListBucket'],
-            resources: [
-              this.securityAgent.scanBucket.bucketArn,
-              this.securityAgent.scanBucket.arnForObjects('*'),
-            ],
-          }),
-          new iam.PolicyStatement({
-            sid: 'KMSForScanBucket',
-            effect: iam.Effect.ALLOW,
-            actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
-            resources: [prismKmsKey.keyArn],
-          }),
-          new iam.PolicyStatement({
-            sid: 'SSMReadConfig',
-            effect: iam.Effect.ALLOW,
-            actions: ['ssm:GetParameter', 'ssm:GetParameters', 'ssm:PutParameter'],
-            resources: [
-              `arn:aws:ssm:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:parameter/prism/continuum/*`,
-            ],
-          }),
-        ],
-      });
-
-      NagSuppressions.addResourceSuppressions(
-        continuumCiPolicy,
-        [
-          {
-            id: 'AwsSolutions-IAM5',
-            reason: 'Agent space ID is dynamic; wildcard scoped to securityagent service resources only',
-            appliesTo: [`Resource::arn:aws:securityagent:<AWS::Region>:<AWS::AccountId>:agent-space/*`],
-          },
-          {
-            id: 'AwsSolutions-IAM5',
-            reason: 'Scan bucket objects include dynamic diff filenames (SHA-based); wildcard on objects only',
-            appliesTo: ['Resource::<SecurityAgentScanBucketB752F4A9.Arn>/*'],
-          },
-          {
-            id: 'AwsSolutions-IAM5',
-            reason: 'SSM parameters under /prism/continuum/ are all non-sensitive config values (IDs and bucket names)',
-            appliesTo: ['Resource::arn:aws:ssm:<AWS::Region>:<AWS::AccountId>:parameter/prism/continuum/*'],
-          },
-        ],
-        true,
-      );
-
-      new cdk.CfnOutput(this, 'ContinuumCiPolicyArn', {
-        value: continuumCiPolicy.managedPolicyArn,
-        description: 'Attach this policy to your GitHub OIDC role for Continuum CI scans',
-      });
+      this.securityAgent = addSecurityAgentResources(this, prismKmsKey);
     }
 
     // -------------------------------------------------------

package/dist/assets/infra/lib/security-agent-resources.ts

@@ -0,0 +1,136 @@
+/**
+ * The Security Agent resources and the CI access to them, shared by the two
+ * places they can live:
+ *
+ * - PrismD1MetricsPipeline, with context enableSecurityAgent=true (the
+ *   original layout; existing accounts keep it);
+ * - PrismD1SecurityAgent, the standalone stack (context
+ *   securityAgentStandalone=true), for accounts that want Security Agent
+ *   without the metrics pipeline.
+ *
+ * Construct ids are relative to the given scope, so the pipeline's logical ids
+ * are unchanged by moving this code here. Both layouts use the same fixed names
+ * (role, managed policy, bucket, SSM parameters, exports), so CloudFormation
+ * refuses a second copy in the same account and region.
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import { Construct } from 'constructs';
+import { NagSuppressions } from 'cdk-nag';
+import { SecurityAgentConstruct } from './constructs/security-agent-construct';
+
+export function addSecurityAgentResources(scope: Construct, kmsKey: kms.IKey): SecurityAgentConstruct {
+  const securityAgent = new SecurityAgentConstruct(scope, 'SecurityAgent', {
+    agentSpaceName: 'prism-d1-security',
+    description: 'PRISM D1 Continuum space for design review, code review, and pen testing',
+    kmsKey: kmsKey,
+    codeRemediationStrategy: 'DISABLED',
+    tags: {
+      'prism:pillar': 'security',
+    },
+  });
+
+  // Grant GitHub OIDC roles access to scan bucket and Continuum APIs.
+  // The OIDC role is created by `prism-cli bootstrapper setup-github-oidc`
+  // with name pattern prism-d1-github-oidc-*.
+  securityAgent.scanBucket.addToResourcePolicy(
+    new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      principals: [new iam.ArnPrincipal(`arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:root`)],
+      actions: ['s3:PutObject', 's3:GetObject'],
+      resources: [securityAgent.scanBucket.arnForObjects('*')],
+      conditions: {
+        ArnLike: {
+          'aws:PrincipalArn': `arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:role/prism-d1-github-oidc-*`,
+        },
+      },
+    }),
+  );
+
+  // Create a managed policy for Continuum scan API access.
+  // Attached to the OIDC role by the bootstrapper setup script.
+  const continuumCiPolicy = new iam.ManagedPolicy(scope, 'ContinuumCiPolicy', {
+    managedPolicyName: 'prism-d1-continuum-ci-scan',
+    description: 'Grants GitHub Actions workflows access to Continuum diff scan APIs and SSM config',
+    statements: [
+      new iam.PolicyStatement({
+        sid: 'ContinuumScanAPIs',
+        effect: iam.Effect.ALLOW,
+        actions: [
+          'securityagent:StartCodeReviewJob',
+          'securityagent:BatchGetCodeReviewJobs',
+          'securityagent:BatchGetCodeReviewJobTasks',
+          'securityagent:ListFindings',
+          'securityagent:BatchGetFindings',
+          'securityagent:CreateCodeReview',
+          'securityagent:ListCodeReviews',
+        ],
+        resources: [
+          `arn:aws:securityagent:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:agent-space/*`,
+        ],
+      }),
+      new iam.PolicyStatement({
+        sid: 'PassRoleForCodeReview',
+        effect: iam.Effect.ALLOW,
+        actions: ['iam:PassRole'],
+        resources: [securityAgent.serviceRole.roleArn],
+        conditions: {
+          StringEquals: { 'iam:PassedToService': 'securityagent.amazonaws.com' },
+        },
+      }),
+      new iam.PolicyStatement({
+        sid: 'ScanBucketWrite',
+        effect: iam.Effect.ALLOW,
+        actions: ['s3:PutObject', 's3:GetObject', 's3:ListBucket'],
+        resources: [
+          securityAgent.scanBucket.bucketArn,
+          securityAgent.scanBucket.arnForObjects('*'),
+        ],
+      }),
+      new iam.PolicyStatement({
+        sid: 'KMSForScanBucket',
+        effect: iam.Effect.ALLOW,
+        actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
+        resources: [kmsKey.keyArn],
+      }),
+      new iam.PolicyStatement({
+        sid: 'SSMReadConfig',
+        effect: iam.Effect.ALLOW,
+        actions: ['ssm:GetParameter', 'ssm:GetParameters', 'ssm:PutParameter'],
+        resources: [
+          `arn:aws:ssm:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:parameter/prism/continuum/*`,
+        ],
+      }),
+    ],
+  });
+
+  NagSuppressions.addResourceSuppressions(
+    continuumCiPolicy,
+    [
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'Agent space ID is dynamic; wildcard scoped to securityagent service resources only',
+        appliesTo: [`Resource::arn:aws:securityagent:<AWS::Region>:<AWS::AccountId>:agent-space/*`],
+      },
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'Scan bucket objects include dynamic diff filenames (SHA-based); wildcard on objects only',
+        appliesTo: ['Resource::<SecurityAgentScanBucketB752F4A9.Arn>/*'],
+      },
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'SSM parameters under /prism/continuum/ are all non-sensitive config values (IDs and bucket names)',
+        appliesTo: ['Resource::arn:aws:ssm:<AWS::Region>:<AWS::AccountId>:parameter/prism/continuum/*'],
+      },
+    ],
+    true,
+  );
+
+  new cdk.CfnOutput(scope, 'ContinuumCiPolicyArn', {
+    value: continuumCiPolicy.managedPolicyArn,
+    description: 'Attach this policy to your GitHub OIDC role for Continuum CI scans',
+  });
+
+  return securityAgent;
+}

package/dist/assets/infra/lib/security-agent-stack.ts

@@ -0,0 +1,69 @@
+import * as cdk from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import { Construct } from 'constructs';
+import { NagSuppressions } from 'cdk-nag';
+import { SecurityAgentConstruct } from './constructs/security-agent-construct';
+import { addSecurityAgentResources } from './security-agent-resources';
+
+export interface SecurityAgentStackProps extends cdk.StackProps {
+  /**
+   * ARN of an existing KMS key to encrypt the agent space with. Its key policy
+   * must already allow securityagent.amazonaws.com to encrypt and decrypt; an
+   * imported key's policy cannot be changed from here. Default: a new key.
+   */
+  kmsKeyArn?: string;
+}
+
+/**
+ * PrismD1SecurityAgent: AWS Security Agent for PRISM without the metrics
+ * pipeline. Same resources, names and exports as the pipeline's
+ * enableSecurityAgent=true path, plus its own KMS key. Only for accounts that
+ * do not host Security Agent in PrismD1MetricsPipeline; the fixed resource
+ * and export names make CloudFormation refuse a second copy.
+ *
+ * Not here: the security-agent-processor and remediation tracker Lambdas,
+ * which read the pipeline's tables and stay in PrismD1MetricsPipeline.
+ */
+export class SecurityAgentStack extends cdk.Stack {
+  public readonly securityAgent: SecurityAgentConstruct;
+
+  constructor(scope: Construct, id: string, props: SecurityAgentStackProps = {}) {
+    super(scope, id, props);
+
+    let key: kms.IKey;
+    if (props.kmsKeyArn) {
+      key = kms.Key.fromKeyArn(this, 'SecurityAgentKey', props.kmsKeyArn);
+    } else {
+      // The same grants the pipeline's PrismDataKey gives Security Agent.
+      const k = new kms.Key(this, 'SecurityAgentKey', {
+        alias: 'alias/prism-d1-security-agent-key',
+        description: 'Encryption key for the PRISM D1 Security Agent space',
+        enableKeyRotation: true,
+        removalPolicy: cdk.RemovalPolicy.RETAIN,
+      });
+      k.grantEncryptDecrypt(new iam.ServicePrincipal('securityagent.amazonaws.com'));
+      k.addToResourcePolicy(new iam.PolicyStatement({
+        effect: iam.Effect.ALLOW,
+        principals: [new iam.ServicePrincipal('logs.amazonaws.com')],
+        actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
+        resources: ['*'],
+        conditions: {
+          ArnLike: {
+            'kms:EncryptionContext:aws:logs:arn': `arn:aws:logs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:log-group:/aws/securityagent/*`,
+          },
+        },
+      }));
+      key = k;
+    }
+
+    this.securityAgent = addSecurityAgentResources(this, key);
+
+    // The pipeline stack carries the same suppression stack-wide.
+    NagSuppressions.addStackSuppressions(this, [{
+      id: 'AwsSolutions-IAM5',
+      reason: 'CDK KMS grant generates kms:GenerateDataKey* and kms:ReEncrypt* wildcard actions which are required for envelope encryption',
+      appliesTo: ['Action::kms:GenerateDataKey*', 'Action::kms:ReEncrypt*'],
+    }]);
+  }
+}

package/dist/assets/pentest-cdk/bin/app.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import * as cdk from 'aws-cdk-lib';
+import { PentestTargetStack } from '../lib/pentest-target-stack';
+
+const app = new cdk.App();
+const slug = String(app.node.tryGetContext('slug') || '');
+if (!slug) throw new Error('pentest-cdk: context "slug" is required (the adapter sets it)');
+// The adapter addresses this stack by the same name (PrismPentest-<slug>).
+new PentestTargetStack(app, `PrismPentest-${slug}`, {
+  env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: process.env.CDK_DEFAULT_REGION },
+  description: 'prism-cli security pentest target: private VPC + Fargate + internal ALB (temporary)',
+});

package/dist/assets/pentest-cdk/cdk.json

@@ -0,0 +1,7 @@
+{
+  "app": "npx ts-node --prefer-ts-exts bin/app.ts",
+  "context": {
+    "@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
+    "@aws-cdk/core:checkSecretUsage": true
+  }
+}