continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85)

Browse Source 
---ci---
project: acdl
phase: 31
milestone: v1.8
status: execute
---/ci---

- New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true
  (AWS-managed annual rotation, D-075). Registered in registry.json.
- Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias.
- Adapter emits enable_key_rotation from NFR.
- S3 adapter emits server_side_encryption_configuration with KMS when
  kms_key_arn provided; managed KMS fallback with stderr warning when not.
- All 10 existing L1 primitives now have encryption_enabled NFR (default true).
- s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input.
- Both L2 compositions (static-assets, microservice) now include a kms-key
  child + wires connecting kms_key_arn to children.
- L2 stack outputs include kms_key_arn.

Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green
(static-assets now resolves to 5 resources with the CMK).
This commit is contained in:
Jon Chery
2026-07-22 22:11:03 +00:00
parent 1e4133e11a
commit de91a4bb76
20 changed files with 477 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/l2/microservice/composition.json
+7 -3
View File
@@ -10,7 +10,8 @@
{"id": "ecr", "module": "ecr@1.0.0"},
{"id": "roles", "module": "iam-role@1.0.0"},
{"id": "alb", "module": "alb@1.0.0"},
{"id": "service", "module": "ecs-service@1.0.0"}
{"id": "service", "module": "ecs-service@1.0.0"},
{"id": "kms", "module": "kms-key@1.0.0"}
],
"wires": [
{"from": "contract.inputs.bucket_name", "to": "vpc.inputs.cidr", "default": "10.0.0.0/16"},
@@ -25,10 +26,13 @@
{"from": "cluster.outputs.cluster_arn", "to": "service.inputs.cluster_arn"},
{"from": "ecr.outputs.repository_url", "to": "service.inputs.image"},
{"from": "roles.outputs.role_arn", "to": "service.inputs.security_group"},
{"from": "alb.outputs.target_group_arn", "to": "service.inputs.lb_target_group_arn"}
{"from": "alb.outputs.target_group_arn", "to": "service.inputs.lb_target_group_arn"},
{"from": "contract.inputs.region", "to": "kms.inputs.region"},
{"from": "kms.outputs.kms_key_arn", "to": "ecr.inputs.kms_key_arn"}
],
"outputs": [
{"from": "alb.outputs.lb_arn", "to": "stack.outputs.lb_arn"},
{"from": "service.outputs.service_arn", "to": "stack.outputs.service_arn"}
{"from": "service.outputs.service_arn", "to": "stack.outputs.service_arn"},
{"from": "kms.outputs.kms_key_arn", "to": "stack.outputs.kms_key_arn"}
]
}
modules/l2/static-assets/composition.json
+7 -3
View File
@@ -7,7 +7,8 @@
"children": [
{"id": "s3", "module": "s3@1.0.0"},
{"id": "cloudfront", "module": "cloudfront@1.0.0"},
{"id": "waf", "module": "waf@1.0.0"}
{"id": "waf", "module": "waf@1.0.0"},
{"id": "kms", "module": "kms-key@1.0.0"}
],
"wires": [
{"from": "contract.inputs.bucket_name", "to": "s3.inputs.bucket_name"},
@@ -15,11 +16,14 @@
{"from": "contract.inputs.region", "to": "cloudfront.inputs.region"},
{"from": "contract.inputs.region", "to": "waf.inputs.region"},
{"from": "s3.outputs.bucket_regional_domain_name", "to": "cloudfront.inputs.bucket_regional_domain_name"},
{"from": "waf.outputs.web_acl_arn", "to": "cloudfront.inputs.waf_web_acl_arn"}
{"from": "waf.outputs.web_acl_arn", "to": "cloudfront.inputs.waf_web_acl_arn"},
{"from": "contract.inputs.region", "to": "kms.inputs.region"},
{"from": "kms.outputs.kms_key_arn", "to": "s3.inputs.kms_key_arn"}
],
"outputs": [
{"from": "cloudfront.outputs.distribution_domain_name", "to": "stack.outputs.distribution_domain_name"},
{"from": "s3.outputs.bucket_arn", "to": "stack.outputs.bucket_arn"},
{"from": "waf.outputs.web_acl_arn", "to": "stack.outputs.web_acl_arn"}
{"from": "waf.outputs.web_acl_arn", "to": "stack.outputs.web_acl_arn"},
{"from": "kms.outputs.kms_key_arn", "to": "stack.outputs.kms_key_arn"}
]
}