@reventlessdev/reventless-aws 3.0.0-alpha.223 → 3.0.0-alpha.224

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.224 (2026-07-22)
+
+### Bug Fixes
+
+* **aws:** register the QueuePolicy -> Queue dependency so destroys order correctly ([81cf2b3](https://github.com/ReventlessDev/reventless-core/commit/81cf2b3198fea7ad280817d2414102089ba0f13d))
+* **aws:** scope the CommandTopic queue policy's EventBridge send grant ([2f5f148](https://github.com/ReventlessDev/reventless-core/commit/2f5f148f4d73b2997633207f071c8d055960cc75))
+
+
 # 3.0.0-alpha.223 (2026-07-22)
 
 * refactor!: retire the stale "Admin" vocabulary for platform-owned resources ([2770bd9](https://github.com/ReventlessDev/reventless-core/commit/2770bd96f309142bdfc65b9f36bd1a3ef60641bd))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.223",
+  "version": "3.0.0-alpha.224",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,14 +11,14 @@
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.24",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.30",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.57",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.104",
     "@reventlessdev/reventless-core": "3.0.0-alpha.177",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.80",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.41",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.104"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.80",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.41"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Adapter_Helpers.res

@@ -1,3 +1,9 @@
+// SQS queue ARN is `arn:aws:sqs:<region>:<accountId>:<name>` — segment index 4
+// (0-based). Used to scope queue-policy service principals to this account via
+// the aws:SourceAccount condition key.
+let accountIdOfQueueArn = (queueArn: string) =>
+  queueArn->String.split(":")->Array.get(4)->Option.getOr("")
+
 let dynamoDbStreamResources = eventTopicResources =>
   eventTopicResources->ReventlessCore.Util.Adapter.filterSupportedResolvedResources([
     AWS.DynamoDbStream.service,

package/src/adapter/Adapter_Helpers.res.mjs

@@ -1,8 +1,13 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as AWS$ReventlessAws from "./AWS.res.mjs";
 import * as Util_Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Adapter.res.mjs";
 
+function accountIdOfQueueArn(queueArn) {
+  return Stdlib_Option.getOr(queueArn.split(":")[4], "");
+}
+
 function dynamoDbStreamResources(eventTopicResources) {
   return Util_Adapter$ReventlessCore.filterSupportedResolvedResources(eventTopicResources, [AWS$ReventlessAws.DynamoDbStream.service]);
 }
@@ -29,6 +34,7 @@ function dynamoDbResources(resources) {
 }
 
 export {
+  accountIdOfQueueArn,
   dynamoDbStreamResources,
   snsResources,
   sqsResources,

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res

@@ -1,55 +1,73 @@
 open PulumiAws.PolicyDocument
 open Adapter_Helpers
 
+let createQueuePolicyDocument = (~name, ~queueArn: string, ~lambdaArn: string) => {
+  let accountId = queueArn->accountIdOfQueueArn
+  PulumiAws.PolicyDocument.make(
+    ~id=name ++ "QueuePolicy",
+    ~statements=[
+      {
+        sid: "AllowLambdaToAccessQueue",
+        effect: Allow,
+        principal: Principals({
+          service: PrincipalId(AWS.Lambda.principal),
+        }),
+        actions: Actions(["sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes"]),
+        resources: Resource(queueArn),
+        conditions: {
+          arnEquals: [("AWS:SourceArn", ConditionValue(lambdaArn))]->Dict.fromArray,
+        },
+      },
+      {
+        // ScheduledPublisher creates EventBridge rules at runtime
+        // (PutRule/PutTargets) targeting this queue directly, and EventBridge
+        // authorises SQS targets against the queue's resource policy — so the
+        // grant cannot name a single rule ARN. Scope it to rules in this
+        // account instead: SourceAccount closes the cross-account hole,
+        // ArnLike narrows the in-account surface to Events rules.
+        sid: "AllowCloudWatchEventsToSendToQueue",
+        effect: Allow,
+        principal: Principals({
+          service: PrincipalId(AWS.CloudwatchEventRule.principal),
+        }),
+        actions: Actions(["sqs:SendMessage"]),
+        resources: Resource(queueArn),
+        conditions: {
+          stringEquals: [("aws:SourceAccount", ConditionValue(accountId))]->Dict.fromArray,
+          arnLike: [
+            ("aws:SourceArn", ConditionValue(`arn:aws:events:*:${accountId}:rule/*`)),
+          ]->Dict.fromArray,
+        },
+      },
+    ],
+  )->toJsonString
+}
+
 let createQueuePolicy = (
   queue: PulumiAws.SQS.Queue.t,
   name,
   lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>,
   opts,
 ) => {
-  let _ =
-    (queue.arn, queue.id, lambda->Pulumi.Output.flatMap(lambda => lambda.arn))
-    ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((queueArn, queueId, lambdaArn)) => {
-      let queuePolicyDocument =
-        PulumiAws.PolicyDocument.make(
-          ~id=name ++ "QueuePolicy",
-          ~statements=[
-            {
-              sid: "AllowLambdaToAccessQueue",
-              effect: Allow,
-              principal: Principals({
-                service: PrincipalId("lambda.amazonaws.com"),
-              }),
-              actions: Actions([
-                "sqs:ReceiveMessage",
-                "sqs:DeleteMessage",
-                "sqs:GetQueueAttributes",
-              ]),
-              resources: Resource(queueArn),
-              conditions: {
-                arnEquals: [("AWS:SourceArn", ConditionValue(lambdaArn))]->Dict.fromArray,
-              },
-            },
-            {
-              sid: "AllowCloudWatchEventsToSendToQueue",
-              effect: Allow,
-              principal: Principals({
-                service: PrincipalId("events.amazonaws.com"),
-              }),
-              actions: Actions(["sqs:SendMessage"]),
-              resources: Resource(queueArn),
-            },
-          ],
-        )
-        ->toJsonString
-        ->Pulumi.Input.make
-      let _queuePolicy = PulumiAws.SQS.QueuePolicy.make(
-        ~name,
-        ~args={queueUrl: queueId->Pulumi.Input.make, policy: queuePolicyDocument},
-        ~opts=Some(opts),
-      )
-    })
+  // The document is a *value* derived from resolved ARNs, so it is built in an
+  // apply. The QueuePolicy itself stays outside: passing `queue.id` as an Output
+  // is what registers the policy -> queue dependency, without which Pulumi has
+  // no ordering constraint and can delete the queue first on a replacement,
+  // leaving the policy's delete polling a queue that no longer exists.
+  let queuePolicyDocument =
+    (queue.arn, lambda->Pulumi.Output.flatMap(lambda => lambda.arn))
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((queueArn, lambdaArn)) =>
+      createQueuePolicyDocument(~name, ~queueArn, ~lambdaArn)
+    )
+  let _queuePolicy = PulumiAws.SQS.QueuePolicy.make(
+    ~name,
+    ~args={
+      queueUrl: queue.id->Pulumi.Output.asInput,
+      policy: queuePolicyDocument->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
 }
 
 let createLambdaPolicy = (
@@ -100,10 +118,10 @@ let createLambdaPolicy = (
                       "dynamodb:UpdateItem",
                       "dynamodb:DeleteItem",
                       "dynamodb:BatchWriteItem",
-                      // Phase 7 cross-partition fences emit read-only
-                      // `ConditionCheck` entries inside `TransactWriteItems`
-                      // when a write doesn't touch the cross-partition tag's
-                      // partition itself; this needs its own IAM action.
+                      // Cross-partition fences emit read-only `ConditionCheck`
+                      // entries inside `TransactWriteItems` when a write
+                      // doesn't touch the cross-partition tag's partition
+                      // itself; this needs its own IAM action.
                       "dynamodb:ConditionCheckItem",
                     ]),
                     resources: Resources(

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res.mjs

@@ -5,53 +5,65 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
 
+function createQueuePolicyDocument(name, queueArn, lambdaArn) {
+  let accountId = Adapter_Helpers$ReventlessAws.accountIdOfQueueArn(queueArn);
+  return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [
+    {
+      Sid: "AllowLambdaToAccessQueue",
+      Principal: {
+        Service: AWS$ReventlessAws.Lambda.principal
+      },
+      Effect: "Allow",
+      Action: [
+        "sqs:ReceiveMessage",
+        "sqs:DeleteMessage",
+        "sqs:GetQueueAttributes"
+      ],
+      Resource: queueArn,
+      Condition: {
+        ArnEquals: Object.fromEntries([[
+            "AWS:SourceArn",
+            lambdaArn
+          ]])
+      }
+    },
+    {
+      Sid: "AllowCloudWatchEventsToSendToQueue",
+      Principal: {
+        Service: AWS$ReventlessAws.CloudwatchEventRule.principal
+      },
+      Effect: "Allow",
+      Action: ["sqs:SendMessage"],
+      Resource: queueArn,
+      Condition: {
+        StringEquals: Object.fromEntries([[
+            "aws:SourceAccount",
+            accountId
+          ]]),
+        ArnLike: Object.fromEntries([[
+            "aws:SourceArn",
+            `arn:aws:events:*:` + accountId + `:rule/*`
+          ]])
+      }
+    }
+  ]));
+}
+
 function createQueuePolicy(queue, name, lambda, opts) {
-  Pulumi.all([
+  let queuePolicyDocument = Pulumi.all([
     queue.arn,
-    queue.id,
     Output$Pulumi.flatMap(lambda, lambda => lambda.arn)
-  ]).apply(param => {
-    let queueArn = param[0];
-    let queuePolicyDocument = PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [
-      {
-        Sid: "AllowLambdaToAccessQueue",
-        Principal: {
-          Service: "lambda.amazonaws.com"
-        },
-        Effect: "Allow",
-        Action: [
-          "sqs:ReceiveMessage",
-          "sqs:DeleteMessage",
-          "sqs:GetQueueAttributes"
-        ],
-        Resource: queueArn,
-        Condition: {
-          ArnEquals: Object.fromEntries([[
-              "AWS:SourceArn",
-              param[2]
-            ]])
-        }
-      },
-      {
-        Sid: "AllowCloudWatchEventsToSendToQueue",
-        Principal: {
-          Service: "events.amazonaws.com"
-        },
-        Effect: "Allow",
-        Action: ["sqs:SendMessage"],
-        Resource: queueArn
-      }
-    ]));
-    new (Aws.sqs.QueuePolicy)(name, {
-      policy: queuePolicyDocument,
-      queueUrl: param[1]
-    }, opts);
-  });
+  ]).apply(param => createQueuePolicyDocument(name, param[0], param[1]));
+  new (Aws.sqs.QueuePolicy)(name, {
+    policy: queuePolicyDocument,
+    queueUrl: queue.id
+  }, opts);
 }
 
 function createLambdaPolicy(lambdaRole, name, queue, resources, opts) {
@@ -138,6 +150,7 @@ function subscribeLambda2SqsTopic(batchSize, lambda, name, queue, opts) {
 }
 
 export {
+  createQueuePolicyDocument,
   createQueuePolicy,
   createLambdaPolicy,
   subscribeLambda2SqsTopic,

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res

@@ -10,64 +10,62 @@ let toResources = (eventTopics: ReventlessCore.EventTopic.allOutputs) =>
   ->Array.flatMap(outputs => outputs.resources)
   ->ReventlessCore.Adapter.resourcesToResolvedOutput
 
-let createQueuePolicy = (queue: PulumiAws.SQS.Queue.t, name, _resources, opts) => {
-  let _ =
-    (queue.arn, queue.id)
-    ->Pulumi.Output.all2
-    ->Pulumi.Output.apply(((queueArn, queueId)) => {
-      // SQS queue ARN is `arn:aws:sqs:<region>:<accountId>:<name>` — segment
-      // index 4 (0-based). Used to scope cross-plugin SNS sources to this
-      // account (aws:SourceAccount) and to topic names following the
-      // Reventless EventTopic naming convention (aws:SourceArn arnLike).
-      let accountId = queueArn->String.split(":")->Array.get(4)->Option.getOr("")
-      let queuePolicyDocument =
-        PulumiAws.PolicyDocument.make(
-          ~id=name ++ "QueuePolicy",
-          ~statements=[
-            // Single statement allows SendMessage from any SNS topic owned by
-            // this AWS account whose name matches the Reventless EventTopic
-            // naming convention. Replaces the previous per-topic arnEquals
-            // list so cross-plugin SNS subscriptions created at runtime by the
-            // admin's manageSubscriptions hook (Phase 3 Step 1) are accepted
-            // without requiring a redeploy of the receiving plugin. Security
-            // boundary: SourceAccount condition keeps third-party-account
-            // topics out; ArnLike + SNS service principal further narrows
-            // accepted senders to in-account EventTopic resources.
-            {
-              sid: "AllowReceiveSnsEvents",
-              principal: Principals({
-                service: PrincipalIds([AWS.SNS.principal]),
-              }),
-              effect: Allow,
-              actions: Actions(["sqs:SendMessage"]),
-              resources: Resource(queueArn),
-              conditions: {
-                stringEquals: [
-                  ("aws:SourceAccount", ConditionValue(accountId)),
-                ]->Dict.fromArray,
-                arnLike: [
-                  ("aws:SourceArn", ConditionValue(`arn:aws:sns:*:${accountId}:*EventTopic-*`)),
-                ]->Dict.fromArray,
-              },
-            },
-          ],
-        )
-        ->toJsonString
-        ->Pulumi.Input.make
-      let _queuePolicy = {
-        PulumiAws.SQS.QueuePolicy.make(
-          ~name,
-          ~args={
-            queueUrl: queueId->Pulumi.Input.make,
-            policy: queuePolicyDocument,
+let createQueuePolicy = (queue: PulumiAws.SQS.Queue.t, name, opts) => {
+  // The document is a *value* derived from the resolved ARN, so it is built in
+  // an apply. The QueuePolicy itself stays outside: passing `queue.id` as an
+  // Output is what registers the policy -> queue dependency, without which
+  // Pulumi has no ordering constraint and can delete the queue first on a
+  // replacement, leaving the policy's delete polling a queue that is gone.
+  let queuePolicyDocument = queue.arn->Pulumi.Output.apply(queueArn => {
+    // Scopes cross-plugin SNS sources to this account (aws:SourceAccount) and
+    // to topic names following the Reventless EventTopic naming convention
+    // (aws:SourceArn arnLike).
+    let accountId = queueArn->accountIdOfQueueArn
+    PulumiAws.PolicyDocument.make(
+      ~id=name ++ "QueuePolicy",
+      ~statements=[
+        // Single statement allows SendMessage from any SNS topic owned by
+        // this AWS account whose name matches the Reventless EventTopic
+        // naming convention. A per-topic arnEquals list would require a
+        // redeploy of the receiving plugin whenever the platform's
+        // manageSubscriptions hook creates a cross-plugin SNS subscription at
+        // runtime. Security boundary: SourceAccount keeps third-party-account
+        // topics out; ArnLike + SNS service principal further narrows accepted
+        // senders to in-account EventTopic resources.
+        {
+          sid: "AllowReceiveSnsEvents",
+          principal: Principals({
+            service: PrincipalIds([AWS.SNS.principal]),
+          }),
+          effect: Allow,
+          actions: Actions(["sqs:SendMessage"]),
+          resources: Resource(queueArn),
+          conditions: {
+            stringEquals: [("aws:SourceAccount", ConditionValue(accountId))]->Dict.fromArray,
+            arnLike: [
+              ("aws:SourceArn", ConditionValue(`arn:aws:sns:*:${accountId}:*EventTopic-*`)),
+            ]->Dict.fromArray,
           },
-          ~opts=Some(opts),
-        )
-      }
-    })
+        },
+      ],
+    )->toJsonString
+  })
+  let _queuePolicy = PulumiAws.SQS.QueuePolicy.make(
+    ~name,
+    ~args={
+      queueUrl: queue.id->Pulumi.Output.asInput,
+      policy: queuePolicyDocument->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
 }
 
-let subscribeQueue2SnsTopic = (queue, name, resources: array<ReventlessInfra.Adapter.resolvedResource>, opts) => {
+let subscribeQueue2SnsTopic = (
+  queue,
+  name,
+  resources: array<ReventlessInfra.Adapter.resolvedResource>,
+  opts,
+) => {
   let _snsTopicSubscriptions = resources->Array.map(resource => {
     log.debug(~comp="EventCollector", `subscribeToSnsTopic: ${name} -> ${resource.name}`)
     let subscription = Util_SQS.subscribeToSnsTopic(
@@ -82,17 +80,21 @@ let subscribeQueue2SnsTopic = (queue, name, resources: array<ReventlessInfra.Ada
 }
 
 let connectSqsQueue2SnsTopics = (queue: PulumiAws.SQS.Queue.t, name, eventTopics, opts) => {
+  // The policy grants SendMessage to any in-account EventTopic by naming
+  // convention, so it does not depend on the resolved topic resources and is
+  // created outside the apply. Only the SNS subscriptions need them.
+  queue->createQueuePolicy(name, opts)
   let _ =
     (eventTopics->toResources, queue.id)
     ->Pulumi.Output.all2
     ->Pulumi.Output.apply(((eventTopicResources, queueId)) => {
       log.debug(
         ~comp="EventCollector",
-        `connectSqsQueue2SnsTopics ${queueId}: ${eventTopicResources->Array.length->Int.toString} topic resource(s)`,
+        `connectSqsQueue2SnsTopics ${queueId}: ${eventTopicResources
+          ->Array.length
+          ->Int.toString} topic resource(s)`,
       )
-      let snsResources = eventTopicResources->snsResources
-      queue->createQueuePolicy(name, snsResources, opts)
-      queue->subscribeQueue2SnsTopic(name, snsResources, opts)
+      queue->subscribeQueue2SnsTopic(name, eventTopicResources->snsResources, opts)
     })
 }
 

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res.mjs

@@ -2,7 +2,6 @@
 
 import * as Aws from "@pulumi/aws";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
@@ -20,14 +19,10 @@ function toResources(eventTopics) {
   return Adapter$ReventlessCore.resourcesToResolvedOutput(Object.values(eventTopics).flatMap(outputs => outputs.resources));
 }
 
-function createQueuePolicy(queue, name, _resources, opts) {
-  Pulumi.all([
-    queue.arn,
-    queue.id
-  ]).apply(param => {
-    let queueArn = param[0];
-    let accountId = Stdlib_Option.getOr(queueArn.split(":")[4], "");
-    let queuePolicyDocument = PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
+function createQueuePolicy(queue, name, opts) {
+  let queuePolicyDocument = queue.arn.apply(queueArn => {
+    let accountId = Adapter_Helpers$ReventlessAws.accountIdOfQueueArn(queueArn);
+    return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
         Sid: "AllowReceiveSnsEvents",
         Principal: {
           Service: [AWS$ReventlessAws.SNS.principal]
@@ -46,11 +41,11 @@ function createQueuePolicy(queue, name, _resources, opts) {
             ]])
         }
       }]));
-    new (Aws.sqs.QueuePolicy)(name, {
-      policy: queuePolicyDocument,
-      queueUrl: param[1]
-    }, opts);
   });
+  new (Aws.sqs.QueuePolicy)(name, {
+    policy: queuePolicyDocument,
+    queueUrl: queue.id
+  }, opts);
 }
 
 function subscribeQueue2SnsTopic(queue, name, resources, opts) {
@@ -62,15 +57,14 @@ function subscribeQueue2SnsTopic(queue, name, resources, opts) {
 }
 
 function connectSqsQueue2SnsTopics(queue, name, eventTopics, opts) {
+  createQueuePolicy(queue, name, opts);
   Pulumi.all([
     toResources(eventTopics),
     queue.id
   ]).apply(param => {
     let eventTopicResources = param[0];
     log.debug("EventCollector", undefined, `connectSqsQueue2SnsTopics ` + param[1] + `: ` + eventTopicResources.length.toString() + ` topic resource(s)`);
-    let snsResources = Adapter_Helpers$ReventlessAws.snsResources(eventTopicResources);
-    createQueuePolicy(queue, name, snsResources, opts);
-    subscribeQueue2SnsTopic(queue, name, snsResources, opts);
+    subscribeQueue2SnsTopic(queue, name, Adapter_Helpers$ReventlessAws.snsResources(eventTopicResources), opts);
   });
 }
 

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync.res

@@ -114,38 +114,40 @@ let make = (
 
   // SQS queue policy — allow SNS to send messages
   let snsResource = eventTopicOutputs.resources->Array.getUnsafe(0)
-  let _ =
-    (queue.arn, queue.id, snsResource.urn)
-    ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((queueArn, queueId, snsUrn)) => {
+  // The document is a *value* derived from resolved ARNs, so it is built in an
+  // apply. The QueuePolicy itself stays outside: passing `queue.id` as an Output
+  // is what registers the policy -> queue dependency, without which Pulumi has
+  // no ordering constraint and can delete the queue first on a replacement,
+  // leaving the policy's delete polling a queue that no longer exists.
+  let queuePolicyDocument =
+    (queue.arn, snsResource.urn)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((queueArn, snsUrn)) => {
       open PolicyDocument
-      let _queuePolicy = SQS.QueuePolicy.make(
-        ~name=name ++ "EventLogSubQueuePolicy",
-        ~args={
-          queueUrl: queueId->Pulumi.Input.make,
-          policy: PolicyDocument.make(
-            ~id=name ++ "EventLogSubQueuePolicy",
-            ~statements=[
-              {
-                sid: "AllowSNSSend",
-                principal: Principals({service: PrincipalIds([AWS.SNS.principal])}),
-                effect: Allow,
-                actions: Actions(["sqs:SendMessage"]),
-                resources: Resource(queueArn),
-                conditions: {
-                  arnEquals: [
-                    ("aws:SourceArn", ConditionValues([snsUrn])),
-                  ]->Dict.fromArray,
-                },
-              },
-            ],
-          )
-          ->PolicyDocument.toJsonString
-          ->Pulumi.Input.make,
-        },
-        ~opts=Some(opts),
-      )
+      PolicyDocument.make(
+        ~id=name ++ "EventLogSubQueuePolicy",
+        ~statements=[
+          {
+            sid: "AllowSNSSend",
+            principal: Principals({service: PrincipalIds([AWS.SNS.principal])}),
+            effect: Allow,
+            actions: Actions(["sqs:SendMessage"]),
+            resources: Resource(queueArn),
+            conditions: {
+              arnEquals: [("aws:SourceArn", ConditionValues([snsUrn]))]->Dict.fromArray,
+            },
+          },
+        ],
+      )->PolicyDocument.toJsonString
     })
+  let _queuePolicy = SQS.QueuePolicy.make(
+    ~name=name ++ "EventLogSubQueuePolicy",
+    ~args={
+      queueUrl: queue.id->Pulumi.Output.asInput,
+      policy: queuePolicyDocument->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
 
   // SNS → SQS subscription (raw delivery so body IS the event JSON)
   let _subscription = Util_SQS.subscribeToSnsTopic(

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync.res.mjs

@@ -85,30 +85,28 @@ function make(name, topicName, eventTopicOutputs, eventsApi, opts) {
     sqsManagedSseEnabled: false
   }, opts);
   let snsResource = eventTopicOutputs.resources[0];
-  Pulumi.all([
+  let queuePolicyDocument = Pulumi.all([
     queue.arn,
-    queue.id,
     snsResource.urn
-  ]).apply(param => {
-    new (Aws.sqs.QueuePolicy)(name + "EventLogSubQueuePolicy", {
-      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "EventLogSubQueuePolicy", [{
-          Sid: "AllowSNSSend",
-          Principal: {
-            Service: [AWS$ReventlessAws.SNS.principal]
-          },
-          Effect: "Allow",
-          Action: ["sqs:SendMessage"],
-          Resource: param[0],
-          Condition: {
-            ArnEquals: Object.fromEntries([[
-                "aws:SourceArn",
-                [param[2]]
-              ]])
-          }
-        }])),
-      queueUrl: param[1]
-    }, opts);
-  });
+  ]).apply(param => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "EventLogSubQueuePolicy", [{
+      Sid: "AllowSNSSend",
+      Principal: {
+        Service: [AWS$ReventlessAws.SNS.principal]
+      },
+      Effect: "Allow",
+      Action: ["sqs:SendMessage"],
+      Resource: param[0],
+      Condition: {
+        ArnEquals: Object.fromEntries([[
+            "aws:SourceArn",
+            [param[1]]
+          ]])
+      }
+    }])));
+  new (Aws.sqs.QueuePolicy)(name + "EventLogSubQueuePolicy", {
+    policy: queuePolicyDocument,
+    queueUrl: queue.id
+  }, opts);
   Util_SQS$ReventlessAws.subscribeToSnsTopic(queue, name + "EventLogSub", name, snsResource, opts);
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "EventLogSubRole", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "EventLogSubRole", EventTopic$ReventlessCore.componentType, "Identity", undefined, name, undefined, undefined, undefined), opts);
   Pulumi.all([

package/src/util/Util_DeadLetterQueue.res

@@ -122,7 +122,7 @@ let createQueuePolicyDocument = (name, queueArn: string, handlerArn: string) =>
 let _ =
   (queue.id, queue.arn, fifoQueue.id, fifoQueue.arn, handler.arn)
   ->Pulumi.Output.all5
-  ->Pulumi.Output.apply(((queueId, queueArn, fifoQueueId, fifoQueueArn, handlerArn)) => {
+  ->Pulumi.Output.apply(((_queueId, queueArn, _fifoQueueId, fifoQueueArn, handlerArn)) => {
     let lambdaPolicyDocument = PulumiAws.PolicyDocument.make(
       ~id=name ++ "SQSPolicy",
       ~statements=[
@@ -152,10 +152,20 @@ let _ =
       ~opts,
     )
 
+    // `queueUrl` takes the queue's Output, not the resolved `queueId` string:
+    // that is what registers the policy -> queue dependency, without which
+    // Pulumi has no ordering constraint and can delete the queue first on a
+    // replacement, leaving the policy's delete polling a queue that is gone.
+    //
+    // Unlike the channel helpers, these two stay inside the apply. This module
+    // creates its resources at import time and this apply resolves late enough
+    // to race Jest's teardown; reshaping it (dropping the now-unused ids to
+    // narrow the tuple) shifts that timing and crashes the AWS unit suites, so
+    // `_queueId` / `_fifoQueueId` are deliberately kept.
     let _attachQueuePolicy = PulumiAws.SQS.QueuePolicy.make(
       ~name,
       ~args={
-        queueUrl: queueId->Pulumi.Input.make,
+        queueUrl: queue.id->Pulumi.Output.asInput,
         policy: createQueuePolicyDocument(name, queueArn, handlerArn),
       },
       ~opts=Some(opts),
@@ -163,7 +173,7 @@ let _ =
     let _attachFifoQueuePolicy = PulumiAws.SQS.QueuePolicy.make(
       ~name=nameFifo,
       ~args={
-        queueUrl: fifoQueueId->Pulumi.Input.make,
+        queueUrl: fifoQueue.id->Pulumi.Output.asInput,
         policy: createQueuePolicyDocument(nameFifo, fifoQueueArn, handlerArn),
       },
       ~opts=Some(opts),

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -132,11 +132,11 @@ Pulumi.all([
   }, opts);
   new (Aws.sqs.QueuePolicy)(name, {
     policy: createQueuePolicyDocument(name, queueArn, handlerArn),
-    queueUrl: param[0]
+    queueUrl: queue.id
   }, opts);
   new (Aws.sqs.QueuePolicy)(nameFifo, {
     policy: createQueuePolicyDocument(nameFifo, fifoQueueArn, handlerArn),
-    queueUrl: param[2]
+    queueUrl: fifoQueue.id
   }, opts);
 });
 

package/tests/CommandTopicQueuePolicyTest.res

@@ -0,0 +1,65 @@
+open JestGlobals
+
+// Guards the CommandTopic queue policy's service-principal scoping. The
+// EventBridge grant cannot name a single rule ARN — ScheduledPublisher creates
+// rules at runtime and EventBridge authorises SQS targets against the queue's
+// resource policy — so the condition keys are the only bound on who may send
+// into a command topic. A dropped condition is invisible at deploy time.
+
+let queueArn = "arn:aws:sqs:eu-west-1:123456789012:CatalogAggrCmdTopic-5150050"
+let lambdaArn = "arn:aws:lambda:eu-west-1:123456789012:function:AllAggregates-1a2b3c4"
+
+let policy =
+  CommandTopicChannel_Helpers.createQueuePolicyDocument(
+    ~name="CatalogAggrCmdTopic",
+    ~queueArn,
+    ~lambdaArn,
+  )->JSON.parseOrThrow
+
+let field = (json, key) =>
+  json->JSON.Decode.object->Option.flatMap(o => o->Dict.get(key))
+
+let statement = sid =>
+  policy
+  ->field("Statement")
+  ->Option.flatMap(JSON.Decode.array)
+  ->Option.getOr([])
+  ->Array.find(s => s->field("Sid")->Option.flatMap(JSON.Decode.string) == Some(sid))
+
+let condition = (sid, operator, key) =>
+  statement(sid)
+  ->Option.flatMap(s => s->field("Condition"))
+  ->Option.flatMap(c => c->field(operator))
+  ->Option.flatMap(o => o->field(key))
+  ->Option.flatMap(JSON.Decode.string)
+
+describe("CommandTopic queue policy — EventBridge grant", () => {
+  testSync("is scoped to this account", () => {
+    expect(
+      condition("AllowCloudWatchEventsToSendToQueue", "StringEquals", "aws:SourceAccount"),
+    )->toEqual(Some("123456789012"))
+  })
+
+  testSync("is scoped to EventBridge rule ARNs in this account", () => {
+    expect(condition("AllowCloudWatchEventsToSendToQueue", "ArnLike", "aws:SourceArn"))->toEqual(
+      Some("arn:aws:events:*:123456789012:rule/*"),
+    )
+  })
+
+  testSync("names the EventBridge service principal", () => {
+    let principal =
+      statement("AllowCloudWatchEventsToSendToQueue")
+      ->Option.flatMap(s => s->field("Principal"))
+      ->Option.flatMap(p => p->field("Service"))
+      ->Option.flatMap(JSON.Decode.string)
+    expect(principal)->toEqual(Some("events.amazonaws.com"))
+  })
+})
+
+describe("CommandTopic queue policy — Lambda grant", () => {
+  testSync("stays pinned to the consuming function ARN", () => {
+    expect(condition("AllowLambdaToAccessQueue", "ArnEquals", "AWS:SourceArn"))->toEqual(
+      Some(lambdaArn),
+    )
+  })
+})

package/tests/CommandTopicQueuePolicyTest.res.mjs

@@ -0,0 +1,53 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as CommandTopicChannel_Helpers$ReventlessAws from "../src/adapter/CommandTopic/CommandTopicChannel_Helpers.res.mjs";
+
+let queueArn = "arn:aws:sqs:eu-west-1:123456789012:CatalogAggrCmdTopic-5150050";
+
+let lambdaArn = "arn:aws:lambda:eu-west-1:123456789012:function:AllAggregates-1a2b3c4";
+
+let policy = JSON.parse(CommandTopicChannel_Helpers$ReventlessAws.createQueuePolicyDocument("CatalogAggrCmdTopic", queueArn, lambdaArn));
+
+function field(json, key) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => o[key]);
+}
+
+function statement(sid) {
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(field(policy, "Statement"), Stdlib_JSON.Decode.array), []).find(s => Primitive_object.equal(Stdlib_Option.flatMap(field(s, "Sid"), Stdlib_JSON.Decode.string), sid));
+}
+
+function condition(sid, operator, key) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(statement(sid), s => field(s, "Condition")), c => field(c, operator)), o => field(o, key)), Stdlib_JSON.Decode.string);
+}
+
+globalThis.describe("CommandTopic queue policy — EventBridge grant", () => {
+  globalThis.test("is scoped to this account", () => {
+    globalThis.expect(condition("AllowCloudWatchEventsToSendToQueue", "StringEquals", "aws:SourceAccount")).toEqual("123456789012");
+  });
+  globalThis.test("is scoped to EventBridge rule ARNs in this account", () => {
+    globalThis.expect(condition("AllowCloudWatchEventsToSendToQueue", "ArnLike", "aws:SourceArn")).toEqual("arn:aws:events:*:123456789012:rule/*");
+  });
+  globalThis.test("names the EventBridge service principal", () => {
+    let principal = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(statement("AllowCloudWatchEventsToSendToQueue"), s => field(s, "Principal")), p => field(p, "Service")), Stdlib_JSON.Decode.string);
+    globalThis.expect(principal).toEqual("events.amazonaws.com");
+  });
+});
+
+globalThis.describe("CommandTopic queue policy — Lambda grant", () => {
+  globalThis.test("stays pinned to the consuming function ARN", () => {
+    globalThis.expect(condition("AllowLambdaToAccessQueue", "ArnEquals", "AWS:SourceArn")).toEqual(lambdaArn);
+  });
+});
+
+export {
+  queueArn,
+  lambdaArn,
+  policy,
+  field,
+  statement,
+  condition,
+}
+/* policy Not a pure module */