rastack 0.0.41 → 0.0.42

package/dist/templates/cloudformation/app.yaml

@@ -0,0 +1,635 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: >-
+  React API Stack per-app backend. Runs the rastack-server Rust API as a Lambda
+  custom runtime over an S3 Iceberg warehouse with Cognito identity. Deployed
+  once per app; thereafter CI only runs aws lambda update-function-code. See
+  docs/serverless-deploy.md.
+
+Parameters:
+  AppName:
+    Type: String
+    Default: airline
+    Description: >
+      Short slug identifying this app; namespaces buckets, roles, SSM. No hyphens:
+      it feeds the Cognito IdentityPoolName, which AWS validates against [\w ]+
+      (letters/digits/underscore/space only).
+    AllowedPattern: "^[a-z0-9]{1,20}$"
+
+  NamePrefix:
+    Type: String
+    Default: rastack
+    # No hyphens — same Cognito IdentityPoolName [\w ]+ constraint as AppName.
+    AllowedPattern: "^[a-z0-9]{1,20}$"
+
+  GitHubOwner:
+    Type: String
+    Default: theserverkid
+    Description: GitHub org/user of the consumer repo whose CI ships the Lambda code.
+
+  GitHubRepo:
+    Type: String
+    Default: reactapistack-demo
+    Description: Consumer repo whose workflow may assume the deploy role (code-only).
+
+  GitHubBranch:
+    Type: String
+    Default: master
+    Description: Branch of GitHubRepo allowed to deploy.
+
+  ArtifactsBucket:
+    Type: String
+    Description: >
+      Name of the bootstrap artifacts bucket that holds the Lambda placeholder
+      bundle (ArtifactsBucketName output of bootstrap.yaml).
+
+  PlaceholderKey:
+    Type: String
+    Default: placeholders/bootstrap.zip
+    Description: >
+      Key of the placeholder bundle the function is CREATED from. CI replaces the
+      real code out of band via update-function-code; this key never changes, so
+      stack updates never revert CI's code.
+
+  OIDCProviderArn:
+    Type: String
+    Default: ""
+    Description: >
+      GitHub OIDC provider ARN. Leave blank to derive the account's single
+      provider ARN automatically (bootstrap.yaml created it).
+
+  IcebergNamespace:
+    Type: String
+    Default: production
+
+  EnableDataEventTrail:
+    Type: String
+    Default: "true"
+    AllowedValues: ["true", "false"]
+    Description: >
+      Create a CloudTrail trail of S3 object-level data events on the warehouse.
+      Accounts are limited to 5 trails per region — set "false" to skip if you
+      are near the limit or centralize data events elsewhere.
+
+  AdvancedSecurity:
+    Type: String
+    Default: "ENFORCED"
+    AllowedValues: ["ENFORCED", "AUDIT", "OFF"]
+    Description: >
+      Cognito advanced security (threat protection) mode. Several regions do not
+      offer it — e.g. af-south-1, ap-east-1, ap-south-2, ap-southeast-3/4/5,
+      eu-central-2, eu-south-2, me-central-1, ca-west-1 — and there a User Pool
+      carrying a UserPoolAddOns block is undeployable (CloudFormation's early
+      validation rejects the change set). Set OFF in those regions to omit the
+      add-on entirely; `rastack init` sets this automatically from the target
+      region.
+
+Conditions:
+  DeriveOIDCArn: !Equals [!Ref OIDCProviderArn, ""]
+  ShouldTrailDataEvents: !Equals [!Ref EnableDataEventTrail, "true"]
+  UseAdvancedSecurity: !Not [!Equals [!Ref AdvancedSecurity, "OFF"]]
+
+Resources:
+
+  # -- Encryption key -----------------------------------------------------------
+  WarehouseKey:
+    Type: AWS::KMS::Key
+    DeletionPolicy: Retain
+    UpdateReplacePolicy: Retain
+    Properties:
+      Description: !Sub "React API Stack warehouse key (${AppName})"
+      EnableKeyRotation: true
+      KeyPolicy:
+        Version: "2012-10-17"
+        Statement:
+          - Sid: AccountAdministration
+            Effect: Allow
+            Principal:
+              AWS: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:root"
+            Action: "kms:*"
+            Resource: "*"
+
+  WarehouseKeyAlias:
+    Type: AWS::KMS::Alias
+    Properties:
+      AliasName: !Sub "alias/${NamePrefix}-${AppName}-warehouse"
+      TargetKeyId: !Ref WarehouseKey
+
+  # -- Storage — S3 IS the database (Iceberg warehouse) -------------------------
+  WarehouseBucket:
+    Type: AWS::S3::Bucket
+    DeletionPolicy: Retain
+    UpdateReplacePolicy: Retain
+    # Server-access logging needs the audit bucket's log-delivery grant in place
+    # first (ACLs are disabled, so the permission comes from its bucket policy).
+    DependsOn: AuditLogBucketPolicy
+    Properties:
+      BucketName: !Sub "${NamePrefix}-${AppName}-${AWS::AccountId}-warehouse"
+      VersioningConfiguration:
+        Status: Enabled
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: aws:kms
+              KMSMasterKeyID: !GetAtt WarehouseKey.Arn
+            BucketKeyEnabled: true
+      PublicAccessBlockConfiguration:
+        BlockPublicAcls: true
+        BlockPublicPolicy: true
+        IgnorePublicAcls: true
+        RestrictPublicBuckets: true
+      OwnershipControls:
+        Rules:
+          - ObjectOwnership: BucketOwnerEnforced
+      LifecycleConfiguration:
+        Rules:
+          - Id: expire-noncurrent-versions
+            Status: Enabled
+            NoncurrentVersionExpiration:
+              NoncurrentDays: 7
+            AbortIncompleteMultipartUpload:
+              DaysAfterInitiation: 7
+      LoggingConfiguration:
+        DestinationBucketName: !Ref AuditLogBucket
+        LogFilePrefix: s3-access/warehouse/
+
+  WarehouseBucketPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties:
+      Bucket: !Ref WarehouseBucket
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Sid: DenyInsecureTransport
+            Effect: Deny
+            Principal: "*"
+            Action: "s3:*"
+            Resource:
+              - !GetAtt WarehouseBucket.Arn
+              - !Sub "${WarehouseBucket.Arn}/*"
+            Condition:
+              Bool:
+                aws:SecureTransport: "false"
+
+  # -- Audit trail --------------------------------------------------------------
+  AuditLogBucket:
+    Type: AWS::S3::Bucket
+    DeletionPolicy: Retain
+    UpdateReplacePolicy: Retain
+    Properties:
+      BucketName: !Sub "${NamePrefix}-${AppName}-${AWS::AccountId}-audit"
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
+      PublicAccessBlockConfiguration:
+        BlockPublicAcls: true
+        BlockPublicPolicy: true
+        IgnorePublicAcls: true
+        RestrictPublicBuckets: true
+      OwnershipControls:
+        Rules:
+          - ObjectOwnership: BucketOwnerEnforced
+      LifecycleConfiguration:
+        Rules:
+          - Id: expire-audit-logs
+            Status: Enabled
+            ExpirationInDays: 400
+
+  AuditLogBucketPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties:
+      Bucket: !Ref AuditLogBucket
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Sid: S3ServerAccessLogsPolicy
+            Effect: Allow
+            Principal:
+              Service: logging.s3.amazonaws.com
+            Action: s3:PutObject
+            Resource: !Sub "${AuditLogBucket.Arn}/s3-access/*"
+            Condition:
+              StringEquals:
+                aws:SourceAccount: !Ref AWS::AccountId
+          - Sid: CloudTrailAclCheck
+            Effect: Allow
+            Principal:
+              Service: cloudtrail.amazonaws.com
+            Action: s3:GetBucketAcl
+            Resource: !GetAtt AuditLogBucket.Arn
+          - Sid: CloudTrailWrite
+            Effect: Allow
+            Principal:
+              Service: cloudtrail.amazonaws.com
+            Action: s3:PutObject
+            Resource: !Sub "${AuditLogBucket.Arn}/cloudtrail/AWSLogs/${AWS::AccountId}/*"
+            Condition:
+              StringEquals:
+                s3:x-amz-acl: bucket-owner-full-control
+          - Sid: DenyInsecureTransport
+            Effect: Deny
+            Principal: "*"
+            Action: "s3:*"
+            Resource:
+              - !GetAtt AuditLogBucket.Arn
+              - !Sub "${AuditLogBucket.Arn}/*"
+            Condition:
+              Bool:
+                aws:SecureTransport: "false"
+
+  WarehouseTrail:
+    Type: AWS::CloudTrail::Trail
+    Condition: ShouldTrailDataEvents
+    DependsOn: AuditLogBucketPolicy
+    Properties:
+      TrailName: !Sub "${NamePrefix}-${AppName}-warehouse-data-events"
+      S3BucketName: !Ref AuditLogBucket
+      S3KeyPrefix: cloudtrail
+      IsLogging: true
+      IncludeGlobalServiceEvents: false
+      EventSelectors:
+        - ReadWriteType: All
+          IncludeManagementEvents: false
+          DataResources:
+            - Type: AWS::S3::Object
+              Values:
+                - !Sub "${WarehouseBucket.Arn}/"
+
+  # -- Identity -----------------------------------------------------------------
+  UserPool:
+    Type: AWS::Cognito::UserPool
+    Properties:
+      UserPoolName: !Sub "${NamePrefix}-${AppName}-users"
+      AutoVerifiedAttributes: [email]
+      UsernameAttributes: [email]
+      MfaConfiguration: "ON"
+      EnabledMfas:
+        - SOFTWARE_TOKEN_MFA
+      # Omitted entirely (not just set OFF) where the region lacks threat
+      # protection — the property itself is unavailable there, so a null add-on
+      # would still fail early validation.
+      UserPoolAddOns: !If
+        - UseAdvancedSecurity
+        - AdvancedSecurityMode: !Ref AdvancedSecurity
+        - !Ref "AWS::NoValue"
+      Policies:
+        PasswordPolicy:
+          MinimumLength: 12
+          RequireLowercase: false
+          RequireUppercase: false
+          RequireNumbers: false
+          RequireSymbols: false
+
+  UserPoolClient:
+    Type: AWS::Cognito::UserPoolClient
+    Properties:
+      UserPoolId: !Ref UserPool
+      ClientName: !Sub "${NamePrefix}-${AppName}-web"
+      GenerateSecret: false
+      ExplicitAuthFlows:
+        - ALLOW_USER_SRP_AUTH
+        - ALLOW_REFRESH_TOKEN_AUTH
+      PreventUserExistenceErrors: ENABLED
+      TokenValidityUnits:
+        AccessToken: minutes
+        IdToken: minutes
+        RefreshToken: days
+      AccessTokenValidity: 30
+      IdTokenValidity: 30
+      RefreshTokenValidity: 30
+      EnableTokenRevocation: true
+
+  IdentityPool:
+    Type: AWS::Cognito::IdentityPool
+    Properties:
+      IdentityPoolName: !Sub "${NamePrefix}_${AppName}_identity"
+      AllowUnauthenticatedIdentities: false
+      CognitoIdentityProviders:
+        - ClientId: !Ref UserPoolClient
+          ProviderName: !GetAtt UserPool.ProviderName
+
+  # Temp S3 credentials fenced to warehouse/tenants/{own sub}/ via the
+  # ${cognito-identity.amazonaws.com:sub} IAM policy variable. One role, every user.
+  WarehouseTenantRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub "${NamePrefix}-${AppName}-tenant"
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Federated: cognito-identity.amazonaws.com
+            Action: sts:AssumeRoleWithWebIdentity
+            Condition:
+              StringEquals:
+                cognito-identity.amazonaws.com:aud: !Ref IdentityPool
+              ForAnyValue:StringLike:
+                cognito-identity.amazonaws.com:amr: authenticated
+      Policies:
+        - PolicyName: own-tenant-prefix-only
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Sid: OwnTenantObjects
+                Effect: Allow
+                Action:
+                  - s3:GetObject
+                  - s3:PutObject
+                  - s3:DeleteObject
+                Resource: !Sub "${WarehouseBucket.Arn}/warehouse/tenants/${!cognito-identity.amazonaws.com:sub}/*"
+              - Sid: OwnTenantListing
+                Effect: Allow
+                Action: s3:ListBucket
+                Resource: !GetAtt WarehouseBucket.Arn
+                Condition:
+                  StringLike:
+                    s3:prefix: !Sub "warehouse/tenants/${!cognito-identity.amazonaws.com:sub}/*"
+              - Sid: WarehouseKeyViaS3Only
+                Effect: Allow
+                Action:
+                  - kms:Decrypt
+                  - kms:GenerateDataKey
+                Resource: !GetAtt WarehouseKey.Arn
+                Condition:
+                  StringEquals:
+                    kms:ViaService: !Sub "s3.${AWS::Region}.amazonaws.com"
+
+  IdentityPoolRoles:
+    Type: AWS::Cognito::IdentityPoolRoleAttachment
+    Properties:
+      IdentityPoolId: !Ref IdentityPool
+      Roles:
+        authenticated: !GetAtt WarehouseTenantRole.Arn
+
+  # -- API (API Gateway v2 HTTP API) --------------------------------------------
+  ApiAccessLogGroup:
+    Type: AWS::Logs::LogGroup
+    Properties:
+      LogGroupName: !Sub "/rastack/${AppName}/api-access"
+      RetentionInDays: 90
+
+  HttpApi:
+    Type: AWS::ApiGatewayV2::Api
+    Properties:
+      Name: !Sub "${NamePrefix}-${AppName}-api"
+      ProtocolType: HTTP
+
+  HttpApiIntegration:
+    Type: AWS::ApiGatewayV2::Integration
+    Properties:
+      ApiId: !Ref HttpApi
+      IntegrationType: AWS_PROXY
+      IntegrationUri: !GetAtt ApiFunction.Arn
+      IntegrationMethod: POST
+      PayloadFormatVersion: "2.0"
+
+  HttpApiRoute:
+    Type: AWS::ApiGatewayV2::Route
+    Properties:
+      ApiId: !Ref HttpApi
+      # $default catches every method + path (incl. /) so the Rust router owns
+      # all routing — /api/{app}/v1/{model}/ and /admin alike.
+      RouteKey: "$default"
+      Target: !Sub "integrations/${HttpApiIntegration}"
+
+  HttpApiStage:
+    Type: AWS::ApiGatewayV2::Stage
+    Properties:
+      ApiId: !Ref HttpApi
+      StageName: "$default"
+      AutoDeploy: true
+      AccessLogSettings:
+        DestinationArn: !GetAtt ApiAccessLogGroup.Arn
+        Format: '{"requestId":"$context.requestId","ip":"$context.identity.sourceIp","requestTime":"$context.requestTime","method":"$context.httpMethod","path":"$context.path","status":"$context.status","latencyMs":"$context.responseLatency","userAgent":"$context.identity.userAgent"}'
+      DefaultRouteSettings:
+        ThrottlingBurstLimit: 200
+        ThrottlingRateLimit: 100
+
+  # -- Compute — the Rust API as a Lambda custom runtime ------------------------
+  # Least-privilege execution role: the API touches only warehouse/* (plus its
+  # KMS key via S3) and writes its own logs — not the whole bucket, not others.
+  LambdaExecutionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub "${NamePrefix}-${AppName}-lambda-exec"
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: lambda.amazonaws.com
+            Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+      Policies:
+        - PolicyName: warehouse-access
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Sid: WarehouseObjects
+                Effect: Allow
+                Action:
+                  - s3:GetObject
+                  - s3:PutObject
+                  - s3:DeleteObject
+                Resource: !Sub "${WarehouseBucket.Arn}/warehouse/*"
+              - Sid: WarehouseListing
+                Effect: Allow
+                Action: s3:ListBucket
+                Resource: !GetAtt WarehouseBucket.Arn
+                Condition:
+                  StringLike:
+                    s3:prefix: "warehouse/*"
+              - Sid: WarehouseKeyViaS3Only
+                Effect: Allow
+                Action:
+                  - kms:Decrypt
+                  - kms:GenerateDataKey
+                Resource: !GetAtt WarehouseKey.Arn
+                Condition:
+                  StringEquals:
+                    kms:ViaService: !Sub "s3.${AWS::Region}.amazonaws.com"
+
+  ApiFunctionLogGroup:
+    Type: AWS::Logs::LogGroup
+    Properties:
+      LogGroupName: !Sub "/aws/lambda/${NamePrefix}-${AppName}-api"
+      RetentionInDays: 90
+
+  # provided.al2023 arm64 (Graviton). Created from the placeholder bundle in the
+  # bootstrap artifacts bucket; CI replaces the code out of band. Code.S3Key is
+  # fixed, so stack updates never diff/overwrite what CI shipped.
+  ApiFunction:
+    Type: AWS::Lambda::Function
+    DependsOn: ApiFunctionLogGroup
+    Properties:
+      FunctionName: !Sub "${NamePrefix}-${AppName}-api"
+      Runtime: provided.al2023
+      Handler: bootstrap
+      Architectures:
+        - arm64
+      MemorySize: 512
+      Timeout: 30
+      Role: !GetAtt LambdaExecutionRole.Arn
+      Code:
+        S3Bucket: !Ref ArtifactsBucket
+        S3Key: !Ref PlaceholderKey
+      Environment:
+        Variables:
+          RASTACK_MANIFEST: /var/task/schema.rastack.json
+          RASTACK_OPENAPI: /var/task/openapi.json
+          RASTACK_WAREHOUSE: !Sub "s3://${WarehouseBucket}/warehouse"
+          RASTACK_NAMESPACE: !Ref IcebergNamespace
+          RASTACK_JWKS: /var/task/jwks.json
+          RASTACK_ISSUER: !Sub "https://cognito-idp.${AWS::Region}.amazonaws.com/${UserPool}"
+          RASTACK_AUDIENCE: !Ref UserPoolClient
+          RASTACK_TOKEN_USE: access
+
+  ApiInvokePermission:
+    Type: AWS::Lambda::Permission
+    Properties:
+      FunctionName: !Ref ApiFunction
+      Action: lambda:InvokeFunction
+      Principal: apigateway.amazonaws.com
+      SourceArn: !Sub "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*"
+
+  # -- Deploy role (GitHub OIDC) — code only ------------------------------------
+  # CI assumes this to ship compiled code. It can UpdateFunctionCode on THIS one
+  # function and read this app's SSM params — nothing else — with an explicit
+  # deny that stops it touching data, keys, identity, or its own trust.
+  DeployRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub "${NamePrefix}-${AppName}-deploy"
+      Description: OIDC role CI assumes to run `aws lambda update-function-code`.
+      MaxSessionDuration: 3600
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Federated: !If
+                - DeriveOIDCArn
+                - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com"
+                - !Ref OIDCProviderArn
+            Action: sts:AssumeRoleWithWebIdentity
+            Condition:
+              StringEquals:
+                token.actions.githubusercontent.com:aud: sts.amazonaws.com
+              StringLike:
+                token.actions.githubusercontent.com:sub: !Sub "repo:${GitHubOwner}/${GitHubRepo}:ref:refs/heads/${GitHubBranch}"
+      Policies:
+        - PolicyName: update-function-code-only
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Sid: UpdateThisFunction
+                Effect: Allow
+                Action:
+                  - lambda:UpdateFunctionCode
+                  - lambda:GetFunction
+                  - lambda:GetFunctionConfiguration
+                Resource: !GetAtt ApiFunction.Arn
+              - Sid: ReadAppParameters
+                Effect: Allow
+                Action:
+                  - ssm:GetParameter
+                  - ssm:GetParameters
+                  - ssm:GetParametersByPath
+                Resource: !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/rastack/${AppName}/*"
+        - PolicyName: deny-privilege-escalation
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Sid: DenyPrivilegeEscalation
+                Effect: Deny
+                Action:
+                  - iam:*
+                  - sts:AssumeRole
+                  - organizations:*
+                  - account:*
+                  - kms:*
+                  - s3:*
+                  - cognito-idp:*
+                  - cognito-identity:*
+                  - lambda:AddPermission
+                  - lambda:UpdateFunctionConfiguration
+                  - lambda:CreateFunction
+                  - lambda:DeleteFunction
+                Resource: "*"
+
+  # -- SSM — the non-secret interface CI and the frontend read ------------------
+  ParamApiUrl:
+    Type: AWS::SSM::Parameter
+    Properties:
+      Name: !Sub "/rastack/${AppName}/api-url"
+      Type: String
+      Value: !Sub "https://${HttpApi}.execute-api.${AWS::Region}.amazonaws.com"
+
+  ParamFunctionName:
+    Type: AWS::SSM::Parameter
+    Properties:
+      Name: !Sub "/rastack/${AppName}/function-name"
+      Type: String
+      Value: !Ref ApiFunction
+
+  ParamUserPoolId:
+    Type: AWS::SSM::Parameter
+    Properties:
+      Name: !Sub "/rastack/${AppName}/user-pool-id"
+      Type: String
+      Value: !Ref UserPool
+
+  ParamUserPoolClientId:
+    Type: AWS::SSM::Parameter
+    Properties:
+      Name: !Sub "/rastack/${AppName}/user-pool-client-id"
+      Type: String
+      Value: !Ref UserPoolClient
+
+  ParamIdentityPoolId:
+    Type: AWS::SSM::Parameter
+    Properties:
+      Name: !Sub "/rastack/${AppName}/identity-pool-id"
+      Type: String
+      Value: !Ref IdentityPool
+
+  ParamJwksUrl:
+    Type: AWS::SSM::Parameter
+    Properties:
+      Name: !Sub "/rastack/${AppName}/jwks-url"
+      Type: String
+      Value: !Sub "https://cognito-idp.${AWS::Region}.amazonaws.com/${UserPool}/.well-known/jwks.json"
+
+Outputs:
+  ApiUrl:
+    Description: Base URL of the deployed API (set as the frontend's remote base).
+    Value: !Sub "https://${HttpApi}.execute-api.${AWS::Region}.amazonaws.com"
+  FunctionName:
+    Description: Lambda function name — CI targets this with update-function-code.
+    Value: !Ref ApiFunction
+  DeployRoleArn:
+    Description: Wire as the AWS_DEPLOY_ROLE_ARN repo Variable in the consumer repo.
+    Value: !GetAtt DeployRole.Arn
+  Region:
+    Description: Deployment region — wire as the AWS_REGION repo Variable.
+    Value: !Ref AWS::Region
+  UserPoolId:
+    Description: Cognito User Pool (identity / JWTs).
+    Value: !Ref UserPool
+  UserPoolClientId:
+    Description: App client id — the token audience rastack-server pins.
+    Value: !Ref UserPoolClient
+  IdentityPoolId:
+    Description: Cognito Identity Pool (temp S3 credentials, sub-scoped).
+    Value: !Ref IdentityPool
+  JwksUrl:
+    Description: JWKS to bake into the Lambda bundle at build time.
+    Value: !Sub "https://cognito-idp.${AWS::Region}.amazonaws.com/${UserPool}/.well-known/jwks.json"
+  WarehouseBucketName:
+    Description: S3 Iceberg warehouse — the system of record.
+    Value: !Ref WarehouseBucket
+  AuditLogBucketName:
+    Description: S3 access logs + CloudTrail data events for the warehouse.
+    Value: !Ref AuditLogBucket