Jon Chery
de91a4bb76
---ci--- project: acdl phase: 31 milestone: v1.8 status: execute ---/ci--- - New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true (AWS-managed annual rotation, D-075). Registered in registry.json. - Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias. - Adapter emits enable_key_rotation from NFR. - S3 adapter emits server_side_encryption_configuration with KMS when kms_key_arn provided; managed KMS fallback with stderr warning when not. - All 10 existing L1 primitives now have encryption_enabled NFR (default true). - s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input. - Both L2 compositions (static-assets, microservice) now include a kms-key child + wires connecting kms_key_arn to children. - L2 stack outputs include kms_key_arn. Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green (static-assets now resolves to 5 resources with the CMK).
29 lines
1.4 KiB
JSON
29 lines
1.4 KiB
JSON
{
|
|
"name": "static-assets",
|
|
"version": "1.0.0",
|
|
"kind": "l2",
|
|
"depth": 1,
|
|
"description": "A production-ready pattern that references the s3, cloudfront, and waf primitives to deploy a static asset site with a CloudFront CDN edge and WAF protection.",
|
|
"children": [
|
|
{"id": "s3", "module": "s3@1.0.0"},
|
|
{"id": "cloudfront", "module": "cloudfront@1.0.0"},
|
|
{"id": "waf", "module": "waf@1.0.0"},
|
|
{"id": "kms", "module": "kms-key@1.0.0"}
|
|
],
|
|
"wires": [
|
|
{"from": "contract.inputs.bucket_name", "to": "s3.inputs.bucket_name"},
|
|
{"from": "contract.inputs.region", "to": "s3.inputs.region"},
|
|
{"from": "contract.inputs.region", "to": "cloudfront.inputs.region"},
|
|
{"from": "contract.inputs.region", "to": "waf.inputs.region"},
|
|
{"from": "s3.outputs.bucket_regional_domain_name", "to": "cloudfront.inputs.bucket_regional_domain_name"},
|
|
{"from": "waf.outputs.web_acl_arn", "to": "cloudfront.inputs.waf_web_acl_arn"},
|
|
{"from": "contract.inputs.region", "to": "kms.inputs.region"},
|
|
{"from": "kms.outputs.kms_key_arn", "to": "s3.inputs.kms_key_arn"}
|
|
],
|
|
"outputs": [
|
|
{"from": "cloudfront.outputs.distribution_domain_name", "to": "stack.outputs.distribution_domain_name"},
|
|
{"from": "s3.outputs.bucket_arn", "to": "stack.outputs.bucket_arn"},
|
|
{"from": "waf.outputs.web_acl_arn", "to": "stack.outputs.web_acl_arn"},
|
|
{"from": "kms.outputs.kms_key_arn", "to": "stack.outputs.kms_key_arn"}
|
|
]
|
|
} |