quidproquo-deploy-awscdk 0.1.2 → 0.1.3

package/lib/commonjs/constructs/basic/Function.d.ts

@@ -16,6 +16,7 @@ export interface FunctionProps extends QpqConstructBlockProps {
     role?: aws_iam.IRole;
     reacreateOnFunctionNameChange?: boolean;
     vpc?: aws_ec2.IVpc;
+    securityGroups?: aws_ec2.ISecurityGroup[];
 }
 export declare class Function extends QpqConstructBlock {
     readonly lambdaFunction: aws_lambda.Function;

package/lib/commonjs/constructs/basic/Function.js

@@ -34,14 +34,36 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Function = void 0;
+const quidproquo_actionprocessor_awslambda_1 = require("quidproquo-actionprocessor-awslambda");
 const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const quidproquo_config_aws_2 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const cdk = __importStar(require("aws-cdk-lib"));
 const upath_1 = require("upath");
 const constants_1 = require("../../constants");
 const utils_1 = require("../../utils");
+const qpqDeployAwsCdkUtils = __importStar(require("../../utils/qpqDeployAwsCdkUtils"));
 const QpqConstructBlock_1 = require("../base/QpqConstructBlock");
+// Resolves the federated code store location for this service, if it opted in via
+// defineFederatedModuleStore. Points the lambda at the referenced storage drive's
+// bucket, namespaced by service (s3://<bucket>/<service>), so many services can share
+// one bucket. Read access comes from the storage drive's own grants. Returns {} when
+// federation isn't configured, so the lambda runs only its bundled code.
+const getFederatedCodeStoreEnv = (qpqConfig) => {
+    var _a;
+    const federatedStore = quidproquo_core_1.qpqCoreUtils.getFederatedModuleStore(qpqConfig);
+    if (!federatedStore) {
+        return {};
+    }
+    const storageDrive = quidproquo_core_1.qpqCoreUtils.getStorageDriveByName(federatedStore.storageDrive, qpqConfig);
+    if (!storageDrive) {
+        throw new Error(`defineFederatedModuleStore references storage drive [${federatedStore.storageDrive}] which is not defined - add a matching defineStorageDrive`);
+    }
+    const bucketName = quidproquo_actionprocessor_awslambda_1.awsNamingUtils.resolveConfigRuntimeResourceNameFromConfig(((_a = storageDrive.owner) === null || _a === void 0 ? void 0 : _a.resourceNameOverride) || storageDrive.storageDrive, qpqConfig, storageDrive.owner);
+    const serviceName = quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    return Object.assign({ federatedCodeStoreUrl: `s3://${bucketName}/${serviceName}` }, (federatedStore.recheckMs !== undefined ? { federatedCodeStoreRecheckMs: `${federatedStore.recheckMs}` } : {}));
+};
 class Function extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
         var _a;
@@ -53,12 +75,13 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
         this.lambdaFunction = new aws_cdk_lib_1.aws_lambda.Function(this, functionId, {
             functionName: props.functionName,
             timeout: cdk.Duration.seconds(props.timeoutInSeconds || 25),
-            runtime: aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_22_X,
+            runtime: (0, utils_1.getLambdaRuntime)(props.qpqConfig),
+            architecture: (0, utils_1.getLambdaArchitecture)(props.qpqConfig),
             memorySize: props.memoryInBytes || serviceInfo.lambdaMaxMemoryInMiB || 1024,
             layers: props.apiLayerVersions,
             code: aws_cdk_lib_1.aws_lambda.Code.fromAsset((0, upath_1.join)(utils_1.qpqAwsCdkPathUtils.getApiBuildPathFullPath(props.qpqConfig), props.functionType)),
             handler: `${handlerFile}.${props.executorName}`,
-            environment: Object.assign({ AWS_NODEJS_CONNECTION_REUSE_ENABLED: '1' }, (props.environment || {})),
+            environment: Object.assign(Object.assign({ AWS_NODEJS_CONNECTION_REUSE_ENABLED: '1' }, getFederatedCodeStoreEnv(props.qpqConfig)), (props.environment || {})),
             reservedConcurrentExecutions: quidproquo_config_aws_2.qpqConfigAwsUtils.isReservedConcurrencyDisabled(props.qpqConfig) ? undefined : props.reservedConcurrentExecutions,
             tracing: quidproquo_config_aws_2.qpqConfigAwsUtils.isTracingDisabled(props.qpqConfig) ? aws_cdk_lib_1.aws_lambda.Tracing.DISABLED : aws_cdk_lib_1.aws_lambda.Tracing.ACTIVE,
             logGroup: new aws_cdk_lib_1.aws_logs.LogGroup(this, 'LogGroup', {
@@ -72,7 +95,9 @@ class Function extends QpqConstructBlock_1.QpqConstructBlock {
                     subnetType: aws_cdk_lib_1.aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,
                 }
                 : undefined,
+            securityGroups: props.securityGroups,
         });
+        qpqDeployAwsCdkUtils.applyEnvironmentTags(this.lambdaFunction, props.qpqConfig);
         if (!quidproquo_config_aws_2.qpqConfigAwsUtils.isLambdaWarmingDisabled(props.qpqConfig)) {
             const region = quidproquo_config_aws_2.qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);
             const accountId = quidproquo_config_aws_2.qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);

package/lib/commonjs/constructs/basic/LambdaLayers.js

@@ -9,6 +9,7 @@ const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const quidproquo_core_1 = require("quidproquo-core");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const path_1 = __importDefault(require("path"));
+const utils_1 = require("../../utils");
 const QpqConstructBlock_1 = require("../base/QpqConstructBlock");
 const getLambdaLayersWithFullPaths = (qpqConfig) => {
     const awsServiceAccountInfoConfig = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoConfig)(qpqConfig);
@@ -23,12 +24,13 @@ class LambdaLayers extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
         super(scope, id, props);
         const apiLayers = (0, exports.getLambdaLayersWithFullPaths)(props.qpqConfig);
+        const lambdaRuntime = (0, utils_1.getLambdaRuntime)(props.qpqConfig);
         const userLayers = apiLayers.map((layer) => {
             return layer.buildPath
                 ? new aws_cdk_lib_1.aws_lambda.LayerVersion(this, `${layer.name}-layer`, {
                     layerVersionName: quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceNameFromConfig(layer.name, props.qpqConfig),
                     code: new aws_cdk_lib_1.aws_lambda.AssetCode(layer.buildPath),
-                    compatibleRuntimes: [aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_22_X],
+                    compatibleRuntimes: [lambdaRuntime],
                 })
                 : aws_cdk_lib_1.aws_lambda.LayerVersion.fromLayerVersionArn(this, `${layer.name}-layer-ref`, layer.layerArn);
         });
@@ -37,7 +39,7 @@ class LambdaLayers extends QpqConstructBlock_1.QpqConstructBlock {
         const logExtensionLayer = new aws_cdk_lib_1.aws_lambda.LayerVersion(this, 'qpq-log-extension-layer', {
             layerVersionName: quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getQpqRuntimeResourceNameFromConfig('qpq-log-extension', props.qpqConfig),
             code: new aws_cdk_lib_1.aws_lambda.AssetCode((0, quidproquo_actionprocessor_awslambda_1.getLogExtensionLayerPath)()),
-            compatibleRuntimes: [aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_22_X],
+            compatibleRuntimes: [lambdaRuntime],
         });
         this.layers = [...userLayers, logExtensionLayer];
     }

package/lib/commonjs/constructs/basic/WebserverRoll.js

@@ -1,7 +1,44 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WebserverRoll = void 0;
+const quidproquo_actionprocessor_awslambda_1 = require("quidproquo-actionprocessor-awslambda");
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
+const qpqDeployAwsCdkUtils = __importStar(require("../../utils/qpqDeployAwsCdkUtils"));
 const QpqConstructBlock_1 = require("../base/QpqConstructBlock");
 class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
@@ -10,6 +47,22 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
             roleName: this.resourceName('service-role'),
             assumedBy: new aws_cdk_lib_1.aws_iam.CompositePrincipal(new aws_cdk_lib_1.aws_iam.ServicePrincipal('lambda.amazonaws.com'), new aws_cdk_lib_1.aws_iam.ServicePrincipal('transfer.amazonaws.com'), new aws_cdk_lib_1.aws_iam.ServicePrincipal('edgelambda.amazonaws.com')),
         });
+        qpqDeployAwsCdkUtils.applyEnvironmentTags(role, props.qpqConfig);
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(props.qpqConfig);
+        const accountId = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);
+        const applicationName = quidproquo_core_1.qpqCoreUtils.getApplicationName(props.qpqConfig);
+        const environment = quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig);
+        const feature = quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig);
+        // This deployment's identity tags, as applied to every qpq resource by applyEnvironmentTags.
+        // Used for tag-based conditions where the target resource's id is unknowable at synth
+        // (later deploy phase / AWS-generated) but the resource is still owned by this deployment.
+        const applicationResourceTagConditions = Object.assign({ 'aws:ResourceTag/application': quidproquo_core_1.qpqCoreUtils.getApplicationName(props.qpqConfig), 'aws:ResourceTag/environment': quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig) }, (feature ? { 'aws:ResourceTag/feature': feature } : {}));
+        // Every event-bus topic this service can publish to (owned + referenced cross-module) -
+        // the same owner-fallback derivation the runtime send processor uses to build the ARN.
+        const eventBusTopicArns = quidproquo_core_1.qpqCoreUtils.getAllEventBusConfigs(props.qpqConfig).map((eventBusConfig) => {
+            var _a, _b, _c, _d, _e;
+            return quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getEventBusSnsTopicArn(((_a = eventBusConfig.owner) === null || _a === void 0 ? void 0 : _a.resourceNameOverride) || eventBusConfig.name, props.qpqConfig, ((_b = eventBusConfig.owner) === null || _b === void 0 ? void 0 : _b.module) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(props.qpqConfig), ((_c = eventBusConfig.owner) === null || _c === void 0 ? void 0 : _c.environment) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(props.qpqConfig), ((_d = eventBusConfig.owner) === null || _d === void 0 ? void 0 : _d.application) || quidproquo_core_1.qpqCoreUtils.getApplicationName(props.qpqConfig), ((_e = eventBusConfig.owner) === null || _e === void 0 ? void 0 : _e.feature) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(props.qpqConfig));
+        });
         const policies = [
             // Resolve cross-stack resource names at runtime via CloudFormation exports.
             {
@@ -17,35 +70,39 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
                 actions: ['cloudformation:ListExports'],
                 resources: ['*'],
             },
-            // Look up API Gateway metadata (stages, deployments) from within Lambdas.
+            // Read api-key values at runtime for api-key validation - keys are fetched individually
+            // by id (never listed), so the grant is per-key, pinned to this application's tags.
+            // Module is deliberately NOT pinned: routes may reference another service's key
+            // (ApiKeyReference.serviceName) within the same application + environment.
             {
                 sid: 'APIGatewayGetOperations',
                 actions: ['apigateway:GET'],
-                resources: ['*'],
-            },
-            // Invalidate CloudFront caches after web-entry static asset deploys.
-            {
-                sid: 'CloudFrontCreateInvalidation',
-                actions: ['cloudfront:CreateInvalidation'],
-                resources: ['*'],
-            },
-            // Publish to event-bus SNS topics (the framework's pub/sub layer).
-            {
-                sid: 'SNSPublishMessages',
-                actions: ['sns:Publish'],
-                resources: ['*'],
+                resources: [`arn:aws:apigateway:${region}::/apikeys/*`],
+                conditions: {
+                    StringEquals: applicationResourceTagConditions,
+                },
             },
-            // Invoke QPQ service functions (`*sfunc*`) from other Lambdas.
+            // Publish to event-bus SNS topics (the framework's pub/sub layer), scoped to the
+            // buses this service declares. Omitted entirely when no event buses are configured.
+            ...(eventBusTopicArns.length > 0
+                ? [
+                    {
+                        sid: 'SNSPublishMessages',
+                        actions: ['sns:Publish'],
+                        resources: eventBusTopicArns,
+                    },
+                ]
+                : []),
+            // Invoke QPQ service functions from other lambdas. The runtime derives target names
+            // with getConfigRuntimeResourceName from its own app/env/feature (only the target
+            // service varies), so the same helper builds this pattern with the function and
+            // service segments wildcarded - cross-app/env invocation is not possible.
             {
                 sid: 'LambdaInvokeFunction',
                 actions: ['lambda:InvokeFunction'],
-                resources: ['arn:aws:lambda:*:*:function:*sfunc*'],
-            },
-            // Push messages to websocket clients via API Gateway Management API.
-            {
-                sid: 'APIGatewayManageConnections',
-                actions: ['execute-api:ManageConnections'],
-                resources: ['*'],
+                resources: [
+                    `arn:aws:lambda:${region}:${accountId}:function:${quidproquo_actionprocessor_awslambda_1.awsNamingUtils.getConfigRuntimeResourceName('*-sfunc', applicationName, '*', environment, feature)}`,
+                ],
             },
             // Look up ACM certs when wiring up custom domains at runtime.
             {
@@ -53,7 +110,8 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
                 actions: ['acm:DescribeCertificate', 'acm:ListCertificates'],
                 resources: ['*'],
             },
-            // Standard Lambda logging + log retrieval for the `askGetLogs` flow.
+            // Standard Lambda logging + log retrieval for the `askGetLogs` flow. Account-pinned;
+            // region is left open because edge lambdas write logs in their execution region.
             {
                 sid: 'CloudWatchLogsManagement',
                 actions: [
@@ -65,7 +123,7 @@ class WebserverRoll extends QpqConstructBlock_1.QpqConstructBlock {
                     'logs:GetLogEvents',
                     'logs:FilterLogEvents',
                 ],
-                resources: ['*'],
+                resources: [`arn:aws:logs:*:${accountId}:log-group:*`],
             },
             // Required for VPC-attached Lambdas to manage their ENIs.
             {

package/lib/commonjs/constructs/feature/account/QpqAccountBudgetConstruct.d.ts

@@ -0,0 +1,9 @@
+import { AccountBudgetQPQConfigSetting } from 'quidproquo-config-aws';
+import { Construct } from 'constructs';
+import { QpqConstructBlock, QpqConstructBlockProps } from '../../base/QpqConstructBlock';
+export interface QpqAccountBudgetConstructProps extends QpqConstructBlockProps {
+    budgetConfig: AccountBudgetQPQConfigSetting;
+}
+export declare class QpqAccountBudgetConstruct extends QpqConstructBlock {
+    constructor(scope: Construct, id: string, props: QpqAccountBudgetConstructProps);
+}

package/lib/commonjs/constructs/feature/account/QpqAccountBudgetConstruct.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QpqAccountBudgetConstruct = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const QpqConstructBlock_1 = require("../../base/QpqConstructBlock");
+const defaultThresholds = [
+    { thresholdPercent: 80, type: quidproquo_config_aws_1.BudgetThresholdType.actual },
+    { thresholdPercent: 100, type: quidproquo_config_aws_1.BudgetThresholdType.forecasted },
+    { thresholdPercent: 100, type: quidproquo_config_aws_1.BudgetThresholdType.actual },
+    { thresholdPercent: 150, type: quidproquo_config_aws_1.BudgetThresholdType.actual },
+];
+class QpqAccountBudgetConstruct extends QpqConstructBlock_1.QpqConstructBlock {
+    constructor(scope, id, props) {
+        var _a;
+        super(scope, id, props);
+        const { name, monthlyLimitUsd, subscriberEmails, thresholds = defaultThresholds, anomalyDetection } = props.budgetConfig;
+        const accountId = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployAccountId(props.qpqConfig);
+        const emailSubscribers = subscriberEmails.map((email) => ({
+            subscriptionType: 'EMAIL',
+            address: email,
+        }));
+        new aws_cdk_lib_1.aws_budgets.CfnBudget(this, 'budget', {
+            budget: {
+                budgetName: `qpq-budget-${accountId}-${name}`,
+                budgetType: 'COST',
+                timeUnit: 'MONTHLY',
+                budgetLimit: {
+                    amount: monthlyLimitUsd,
+                    unit: 'USD',
+                },
+            },
+            notificationsWithSubscribers: thresholds.map((threshold) => ({
+                notification: {
+                    notificationType: threshold.type === quidproquo_config_aws_1.BudgetThresholdType.forecasted ? 'FORECASTED' : 'ACTUAL',
+                    comparisonOperator: 'GREATER_THAN',
+                    threshold: threshold.thresholdPercent,
+                    thresholdType: 'PERCENTAGE',
+                },
+                subscribers: emailSubscribers,
+            })),
+        });
+        if (!(anomalyDetection === null || anomalyDetection === void 0 ? void 0 : anomalyDetection.disabled)) {
+            // AWS allows only one DIMENSIONAL(SERVICE) anomaly monitor per account - declare a
+            // single defineAccountBudget per account (or disable anomalyDetection on extras)
+            const anomalyMonitor = new aws_cdk_lib_1.aws_ce.CfnAnomalyMonitor(this, 'anomaly-monitor', {
+                monitorName: `qpq-anomaly-monitor-${accountId}-${name}`,
+                monitorType: 'DIMENSIONAL',
+                monitorDimension: 'SERVICE',
+            });
+            new aws_cdk_lib_1.aws_ce.CfnAnomalySubscription(this, 'anomaly-subscription', {
+                subscriptionName: `qpq-anomaly-subscription-${accountId}-${name}`,
+                monitorArnList: [anomalyMonitor.attrMonitorArn],
+                // DAILY is required for EMAIL subscribers (IMMEDIATE is SNS-only)
+                frequency: 'DAILY',
+                subscribers: subscriberEmails.map((email) => ({
+                    type: 'EMAIL',
+                    address: email,
+                })),
+                thresholdExpression: JSON.stringify({
+                    Dimensions: {
+                        Key: 'ANOMALY_TOTAL_IMPACT_ABSOLUTE',
+                        MatchOptions: ['GREATER_THAN_OR_EQUAL'],
+                        Values: [`${(_a = anomalyDetection === null || anomalyDetection === void 0 ? void 0 : anomalyDetection.minimumImpactUsd) !== null && _a !== void 0 ? _a : 10}`],
+                    },
+                }),
+            });
+        }
+    }
+}
+exports.QpqAccountBudgetConstruct = QpqAccountBudgetConstruct;

package/lib/commonjs/constructs/feature/account/QpqAccountCloudTrailConstruct.d.ts

@@ -0,0 +1,11 @@
+import { AccountCloudTrailQPQConfigSetting } from 'quidproquo-config-aws';
+import { aws_logs } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { QpqConstructBlock, QpqConstructBlockProps } from '../../base/QpqConstructBlock';
+export interface QpqAccountCloudTrailConstructProps extends QpqConstructBlockProps {
+    cloudTrailConfig: AccountCloudTrailQPQConfigSetting;
+}
+export declare class QpqAccountCloudTrailConstruct extends QpqConstructBlock {
+    readonly logGroup?: aws_logs.LogGroup;
+    constructor(scope: Construct, id: string, props: QpqAccountCloudTrailConstructProps);
+}

package/lib/commonjs/constructs/feature/{config/cloudTrail/QpqBootstrapConfigCloudTrailConstruct.js → account/QpqAccountCloudTrailConstruct.js}

@@ -33,37 +33,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.QpqBootstrapConfigCloudTrailConstruct = void 0;
+exports.QpqAccountCloudTrailConstruct = void 0;
 const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const cdk = __importStar(require("aws-cdk-lib"));
 const aws_cdk_lib_1 = require("aws-cdk-lib");
-const QpqConstructBlock_1 = require("../../../base/QpqConstructBlock");
-const SUPPORTED_RETENTION_DAYS = [
-    aws_cdk_lib_1.aws_logs.RetentionDays.ONE_DAY,
-    aws_cdk_lib_1.aws_logs.RetentionDays.THREE_DAYS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.FIVE_DAYS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.ONE_WEEK,
-    aws_cdk_lib_1.aws_logs.RetentionDays.TWO_WEEKS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.ONE_MONTH,
-    aws_cdk_lib_1.aws_logs.RetentionDays.TWO_MONTHS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.THREE_MONTHS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.FOUR_MONTHS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.FIVE_MONTHS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.SIX_MONTHS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.ONE_YEAR,
-    aws_cdk_lib_1.aws_logs.RetentionDays.THIRTEEN_MONTHS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.EIGHTEEN_MONTHS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.TWO_YEARS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.FIVE_YEARS,
-    aws_cdk_lib_1.aws_logs.RetentionDays.TEN_YEARS,
-];
-const resolveLogRetention = (days) => {
-    var _a;
-    if (!days)
-        return aws_cdk_lib_1.aws_logs.RetentionDays.ONE_MONTH;
-    return (_a = SUPPORTED_RETENTION_DAYS.find((v) => v >= days)) !== null && _a !== void 0 ? _a : aws_cdk_lib_1.aws_logs.RetentionDays.TEN_YEARS;
-};
-class QpqBootstrapConfigCloudTrailConstruct extends QpqConstructBlock_1.QpqConstructBlock {
+const utils_1 = require("../../../utils");
+const QpqConstructBlock_1 = require("../../base/QpqConstructBlock");
+class QpqAccountCloudTrailConstruct extends QpqConstructBlock_1.QpqConstructBlock {
     constructor(scope, id, props) {
         super(scope, id, props);
         const { name, retentionDays = 365, enableLogFileValidation = true, multiRegion = true, includeGlobalServiceEvents = true, cloudWatchLogs, } = props.cloudTrailConfig;
@@ -77,10 +53,10 @@ class QpqBootstrapConfigCloudTrailConstruct extends QpqConstructBlock_1.QpqConst
             removalPolicy: cdk.RemovalPolicy.RETAIN,
             lifecycleRules: [{ expiration: cdk.Duration.days(retentionDays) }],
         });
-        const logGroup = cloudWatchLogs
+        this.logGroup = cloudWatchLogs
             ? new aws_cdk_lib_1.aws_logs.LogGroup(this, 'log-group', {
                 logGroupName: `/qpq/cloudtrail/${name}`,
-                retention: resolveLogRetention(cloudWatchLogs.retentionDays),
+                retention: (0, utils_1.resolveLogRetention)(cloudWatchLogs.retentionDays),
                 removalPolicy: cdk.RemovalPolicy.DESTROY,
             })
             : undefined;
@@ -90,9 +66,9 @@ class QpqBootstrapConfigCloudTrailConstruct extends QpqConstructBlock_1.QpqConst
             enableFileValidation: enableLogFileValidation,
             isMultiRegionTrail: multiRegion,
             includeGlobalServiceEvents,
-            sendToCloudWatchLogs: !!logGroup,
-            cloudWatchLogGroup: logGroup,
+            sendToCloudWatchLogs: !!this.logGroup,
+            cloudWatchLogGroup: this.logGroup,
         });
     }
 }
-exports.QpqBootstrapConfigCloudTrailConstruct = QpqBootstrapConfigCloudTrailConstruct;
+exports.QpqAccountCloudTrailConstruct = QpqAccountCloudTrailConstruct;

package/lib/commonjs/constructs/feature/account/QpqAccountSecurityServicesConstruct.d.ts

@@ -0,0 +1,12 @@
+import { AccountSecurityServicesQPQConfigSetting } from 'quidproquo-config-aws';
+import { aws_logs } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { QpqConstructBlock, QpqConstructBlockProps } from '../../base/QpqConstructBlock';
+export interface QpqAccountSecurityServicesConstructProps extends QpqConstructBlockProps {
+    securityServicesConfig: AccountSecurityServicesQPQConfigSetting;
+    /** The account CloudTrail's CloudWatch log group - required for cognitoAuthFailureAlert. */
+    cloudTrailLogGroup?: aws_logs.ILogGroup;
+}
+export declare class QpqAccountSecurityServicesConstruct extends QpqConstructBlock {
+    constructor(scope: Construct, id: string, props: QpqAccountSecurityServicesConstructProps);
+}

package/lib/commonjs/constructs/feature/account/QpqAccountSecurityServicesConstruct.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QpqAccountSecurityServicesConstruct = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const QpqConstructBlock_1 = require("../../base/QpqConstructBlock");
+// GuardDuty detectors and Security Hub hubs are one-per-account+region, which is exactly
+// why they live in the account stack rather than any app's bootstrap - an app teardown
+// must not take the account's threat detection with it.
+class QpqAccountSecurityServicesConstruct extends QpqConstructBlock_1.QpqConstructBlock {
+    constructor(scope, id, props) {
+        var _a;
+        super(scope, id, props);
+        if (props.securityServicesConfig.enableGuardDuty) {
+            new aws_cdk_lib_1.aws_guardduty.CfnDetector(this, 'guardduty-detector', {
+                enable: true,
+            });
+        }
+        if (props.securityServicesConfig.enableSecurityHub) {
+            // Security Hub's compliance standards require AWS Config recording, which bills per
+            // configuration item recorded - enabling this is a deliberate cost decision
+            new aws_cdk_lib_1.aws_securityhub.CfnHub(this, 'security-hub');
+        }
+        // Credential stuffing hitting Cognito directly (bypassing the apis) shows up as
+        // cognito-idp NotAuthorizedException events in CloudTrail - alert by email when the
+        // failure rate spikes. (Failed logins through qpq routes are covered separately by
+        // the per-api 401-rate alarms.)
+        const cognitoAuthFailureAlert = props.securityServicesConfig.cognitoAuthFailureAlert;
+        if (cognitoAuthFailureAlert) {
+            if (!props.cloudTrailLogGroup) {
+                throw new Error('cognitoAuthFailureAlert requires a defineAccountCloudTrail with cloudWatchLogs enabled');
+            }
+            const metricFilter = new aws_cdk_lib_1.aws_logs.MetricFilter(this, 'cognito-auth-failure-filter', {
+                logGroup: props.cloudTrailLogGroup,
+                filterPattern: aws_cdk_lib_1.aws_logs.FilterPattern.all(aws_cdk_lib_1.aws_logs.FilterPattern.stringValue('$.eventSource', '=', 'cognito-idp.amazonaws.com'), aws_cdk_lib_1.aws_logs.FilterPattern.stringValue('$.errorCode', '=', 'NotAuthorizedException')),
+                metricNamespace: 'qpq/security',
+                metricName: 'cognito-auth-failures',
+                metricValue: '1',
+            });
+            const alertTopic = new aws_cdk_lib_1.aws_sns.Topic(this, 'security-alerts-topic', {
+                topicName: 'qpq-account-security-alerts',
+            });
+            cognitoAuthFailureAlert.emails.forEach((email) => {
+                alertTopic.addSubscription(new aws_cdk_lib_1.aws_sns_subscriptions.EmailSubscription(email));
+            });
+            const alarm = new aws_cdk_lib_1.aws_cloudwatch.Alarm(this, 'cognito-auth-failure-alarm', {
+                alarmName: 'qpq-account-cognito-auth-failures',
+                metric: metricFilter.metric({
+                    statistic: 'Sum',
+                    period: aws_cdk_lib_1.Duration.minutes(5),
+                }),
+                threshold: (_a = cognitoAuthFailureAlert.thresholdPer5Minutes) !== null && _a !== void 0 ? _a : 10,
+                comparisonOperator: aws_cdk_lib_1.aws_cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+                evaluationPeriods: 1,
+                // No sign-in attempts = no datapoints - that is not an alarm state
+                treatMissingData: aws_cdk_lib_1.aws_cloudwatch.TreatMissingData.NOT_BREACHING,
+            });
+            alarm.addAlarmAction(new aws_cdk_lib_1.aws_cloudwatch_actions.SnsAction(alertTopic));
+        }
+    }
+}
+exports.QpqAccountSecurityServicesConstruct = QpqAccountSecurityServicesConstruct;

package/lib/commonjs/constructs/feature/account/index.d.ts

@@ -0,0 +1,3 @@
+export * from './QpqAccountBudgetConstruct';
+export * from './QpqAccountCloudTrailConstruct';
+export * from './QpqAccountSecurityServicesConstruct';

package/lib/commonjs/constructs/feature/account/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./QpqAccountBudgetConstruct"), exports);
+__exportStar(require("./QpqAccountCloudTrailConstruct"), exports);
+__exportStar(require("./QpqAccountSecurityServicesConstruct"), exports);

package/lib/commonjs/constructs/feature/config/dashboard/QpqConfigAwsDashboardConstruct.d.ts

@@ -0,0 +1,9 @@
+import { AwsServiceDashboardQPQConfigSetting } from 'quidproquo-config-aws';
+import { Construct } from 'constructs';
+import { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';
+export interface QpqConfigAwsDashboardConstructProps extends QpqConstructBlockProps {
+    dashboardConfig: AwsServiceDashboardQPQConfigSetting;
+}
+export declare class QpqConfigAwsDashboardConstruct extends QpqConstructBlock {
+    constructor(scope: Construct, id: string, props: QpqConfigAwsDashboardConstructProps);
+}