acdl/modules/l1/kms-key/examples/complex.yaml at 7585c828f0001de7019a6432100e09babdff80d1 - acdl - Cloudinit Services GIT

continuous-intelligence/acdl

Files

T

Jon Chery de91a4bb76 feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85)

---ci---
project: acdl
phase: 31
milestone: v1.8
status: execute
---/ci---

- New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true
  (AWS-managed annual rotation, D-075). Registered in registry.json.
- Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias.
- Adapter emits enable_key_rotation from NFR.
- S3 adapter emits server_side_encryption_configuration with KMS when
  kms_key_arn provided; managed KMS fallback with stderr warning when not.
- All 10 existing L1 primitives now have encryption_enabled NFR (default true).
- s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input.
- Both L2 compositions (static-assets, microservice) now include a kms-key
  child + wires connecting kms_key_arn to children.
- L2 stack outputs include kms_key_arn.

Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green
(static-assets now resolves to 5 resources with the CMK).

2026-07-22 22:11:03 +00:00

7 lines

185 B

YAML

Raw Blame History

 uses: acdl/pipelines/deploy.yaml@v1.8
 module: kms-key
 environment: dev
 inputs:
   description: "Production CMK with 90-day deletion window"
   region: us-east-1
   deletion_window_days: 90