Files

T

Jon Chery 031887ec56 refactor(P57): contract surface redesign + rename + .yml repo-wide

Contract surface redesign:
- New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title),
  infrastructure (map keyed by module name, replaces module:)
- Drop uses: field (dead reference; version pin lives in CI workflow uses: line)
- Drop top-level module/inputs (now nested under infrastructure map)
- Per-module optional version (defaults to latest published from registry)
- Multi-module contracts: one file deploys N modules in one pipeline run,
  resource IDs namespaced with module name to avoid collisions
- stack.schema.json: add optional title field for display name

Rename:
- pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline)
- pipelines/ci.yaml → pipelines/ci.yml
- All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies)
- .acdl/contract.yaml → .acdl/contract.yml

Resolver (core/contract_resolver.py):
- Rewrite resolve() to loop infrastructure map, default version to latest,
  merge module fragments into one stack with namespaced resource IDs
- _latest_version() picks highest non-deprecated from registry
- _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module
- Single-module path: unprefixed IDs (backward compatible)

Verification:
- 494 tests pass (0 contract-shape failures)
- Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox)

---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: execute
---/ci---

2026-07-27 21:37:40 +00:00

2.8 KiB

Raw Blame History

kms-key — KMS customer-managed key

Module kind: primitive | Version: 1.0.0

A customer-managed KMS key for per-stack encryption. Created with key rotation enabled. One key per L2 deployment (no shared keys).

Resources

Resource	Type	Purpose
kms-key	`aws_kms_key`	The KMS customer-managed key

Inputs

Name	Type	Required	Default	Description
`description`	string	yes	—	Description of the KMS key
`region`	string	yes	—	AWS region the KMS key is created in
`deletion_window_days`	number	no	30	Number of days before the key is deleted after deletion is requested

Outputs

Name	Type	Description
`kms_key_arn`	arn	The ARN of the KMS key
`kms_key_id`	string	The ID of the KMS key

NFRs

Name	Type	Default	Description
`enable_rotation`	boolean	true	Enable automatic key rotation
`deletion_protection`	boolean	true	Prevent key destruction
`encryption_enabled`	boolean	true	Encryption is always enabled for a KMS key

Usage

{
  "id": "kms-key",
  "type": "aws:kms:key",
  "module": "kms-key@1.0.0",
  "inputs": {
    "description": "ACDL per-stack CMK",
    "region": "us-east-1"
  }
}

A concrete instance is at instance.json (used by the platform pipeline as the regression baseline).

Compliance extension points

Key rotation — automatic key rotation enabled by default (SOC2 CC6.1, GDPR Art.32).
Deletion protection — pending deletion window prevents accidental destruction (SOC2 CC7.2).
Key policy — restrict key usage to the stack's IAM roles (SOC2 CC6.1, GDPR Art.32).
Audit logging — CloudTrail logs all KMS API calls (SOC2 CC7.2, DORA audit trail).

Examples

Validated example contracts are in examples/. The platform-test pipeline validates them against schemas/contract.schema.json.

Simple

A minimal deployment:

examples/simple.yml

environment: dev
id: kms
infrastructure:
  kms-key:
    inputs:
      description: Simple CMK for testing
      region: us-east-1
    version: 1.0.0
name: kms-key

Complex

A production deployment with optional inputs:

examples/complex.yml

environment: dev
id: kms
infrastructure:
  kms-key:
    inputs:
      deletion_window_days: 90
      description: Production CMK with 90-day deletion window
      region: us-east-1
    version: 1.0.0
name: kms-key

Versioning

1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps require a new registry entry (immutable publication); old entries enter a 12-month deprecation window.

2.8 KiB Raw Blame History