All Classes and Interfaces
Class
Description
Shared Docker lifecycle for CloudForge local emulators.
Shared Docker lifecycle for target-owned StackPort resource browsers.
Advanced security monitoring and compliance dashboard validation rules.
Which CloudForge Agent client a registered device is — cloudforge-studio (macOS),
cloudforge-desktop (Windows), or cloudforge-terminal (Linux).
Creates CloudWatch alarms for application health monitoring.
Configuration properties for alarm creation.
ALB Factory using annotation-based context injection.
Optional, application-owned behavior around a CloudForge deployment.
Classpath-wide registry for optional application deployment extensions.
Optional application-owned defaults applied before generic interactive prompts.
Classpath discovery for optional
ApplicationDeploymentPreset providers.Universal Application EC2 Stack — see
ApplicationFargateStack's javadoc for why this
lives here rather than only in cfc-testing's identically-shaped launcher.Universal factory class for deploying any application using ApplicationSpec.
Container for application system components created by the factory.
Universal Application Fargate Stack.
Application metadata for display and configuration purposes.
Auto-discovery utility for ApplicationSpec implementations using Java ServiceLoader.
Application-level OIDC Authentication Factory.
Marks a class as a pluggable application specification.
Loads
application.properties then application-local.properties
from the classpath, with later resources overriding earlier ones.Application SAML Factory - configures SAML authentication for applications.
Universal application service topology configuration.
Application specification interface defining application-specific configuration.
Optional service port that can be enabled via deployment configuration.
Declares an always-running, same-Fargate-task companion container:
ContainerFactory
adds it to the same task definition as this app's own container, wires the main container
to wait for it (a startup dependency on HEALTHY, not SUCCESS — unlike the
SAML certificate init container this deliberately isn't modeled after, a sidecar never
exits), and gives it its own CloudWatch log stream.Shared plumbing for asset-free, Lambda-backed CloudFormation custom resources -- a raw
CustomResource wired directly to a Code.fromInline Lambda's ARN, not
AwsCustomResource/Provider (both of those pull in CDK's own bundled framework Lambda,
staged to the deployer's private cdk-hnb659fds-assets bootstrap bucket -- unusable by
an AWS Marketplace buyer launching a template directly in their own, unbootstrapped account).The Lambda function and the CustomResource wired to it, returned together so callers can
add NagSuppressions, dependencies, or read response attributes via
customResource.getAttString(...) as needed.Maps compliance controls to AWS infrastructure monitoring and Audit Manager evidence.
Framework-specific control mapping.
Central registry mapping infrastructure controls to multiple compliance frameworks.
A CloudForge Manager user-directory account, as seen through
AuthBackend, with one
shape for both local rows and Cognito pool users.Request to create a new account via
AuthBackend.createAccount(AuthAccountRequest).Partial update for
AuthBackend.updateAccount(String, AuthAccountUpdate) — every field is null/unset unless
the caller means to change it (no "clear this field" sentinel is needed; every field here is
meaningful when present and skipped when absent, matching the semantics of the
Map<String,Object> body-based updates this replaced).CloudForge Manager's Users-page CRUD, abstracted over whichever directory of accounts is
currently authoritative — the local H2/Postgres DB, or an AWS Cognito User Pool.
Authentication mode for application access control.
AWS Config managed rules mapped to ComplianceMatrix SecurityControls.
Creates and incrementally updates CloudFormation stacks on AWS via change sets.
AWS Regions enumeration with metadata for disaster recovery and compliance.
Geographic areas for data residency requirements.
The commercial AWS regions CloudForge offers for deployment.
Outcome of deploying (or no-op'ing) a stack via
AwsDirectDeployer.Factory for creating AWS Backup resources for EFS and RDS.
Bagisto E-commerce ApplicationSpec implementation.
OIDC integration for Bagisto via Laravel Socialite / ALB OIDC.
Base class for factory classes that provides convenient access to SystemContext,
DeploymentContext, and SecurityProfileConfiguration.
Bakes a compile-time constant into a generated class from a single
-A compiler option,
so a build-time fact (which Maven profile compiled these sources) survives into the compiled
artifact as a static final field — not something a caller can influence by how the
resulting binary is later invoked.Resolves the canonical synthesized CloudFormation template on disk.
Validates that maxCapacity >= minCapacity for scaling configurations.
Maps cdk-nag rule IDs to CloudForge SecurityControl enums for unified compliance reporting.
CDN and API security compliance validation rules.
CloudFormation string utilities using intrinsic functions.
Central deploy façade for MiniStack, LocalStack, and (as of the
deploy:create/
deploy:catalog work) direct-to-AWS.Deployment-time OIDC contract for CloudForge Manager.
In-process CDK synthesis — produces the canonical CloudFormation template
CloudForgeDeployment (specifically AwsDirectDeployer, but the shape is target-
agnostic) needs, without shelling out to the cdk CLI.CloudForgeSynthesizer.synthesizeAdvisoryDryRun(DeploymentConfig, Path)'s result — every finding cdk-nag and the requested
FrameworkRules implementations produced, with nothing filtered out the way CloudForgeSynthesizer.synthesize(DeploymentConfig, Path)'s own ENFORCE-mode check only reads error-level cdk-nag lines.Semantic resource-level diff for canonical CloudFormation templates.
CloudFront CDN configuration for CMS platforms.
Auto-discovery utility for CmsSpec implementations using Java ServiceLoader.
Configuration for CMS media storage on S3.
Media storage configuration for CMS platforms.
ElastiCache Redis/Memcached configuration for CMS object caching.
Object cache configuration for CMS platforms.
Marks a class as a pluggable CMS/e-commerce application specification.
CMS-specific topology that auto-wires infrastructure from
CmsSpec capabilities.CMS/E-commerce specification interface extending ApplicationSpec.
Manages AWS Cognito User Pools for OIDC authentication.
OIDC configuration for Amazon Cognito User Pools.
Cognito SAML Factory for applications requiring SAML authentication.
Shared STAGING/ADVISORY/ENFORCE enforcement policy for a
FrameworkRules plugin's
Node.addValidation callback -- every framework class (HipaaRules,
PciDssRules, GdprRules, FedRampRules, Iso27001Rules,
Soc2Rules) was independently reimplementing this identical policy, risking exactly the
kind of drift that happened before this class existed (FedRAMP's STAGING/ADVISORY branches not
recording to ComplianceFindingsCollector the way every other framework's did).Factory for creating compliance and audit resources (CloudTrail, AWS Config, AWS Audit Manager).
Thread-local side channel for framework-rule (
FrameworkRules.install(T))
ADVISORY-mode findings -- see NagReportReader for cdk-nag's own equivalent, file-based
mechanism.Marks a class as a pluggable compliance framework validator.
Jackson serializer/deserializer for converting between comma-separated strings
and
List<ComplianceFrameworkType>.Deserializes a comma-separated string or JSON array to
List<ComplianceFrameworkType>.Serializes
List<ComplianceFrameworkType> to a comma-separated string.Defines the supported compliance frameworks for CloudForge deployments.
Multi-framework compliance control mapping matrix.
Framework-specific requirement with enforcement level.
Requirement enforcement level for a control within a compliance framework.
Security control definitions mapped to framework requirements.
Validation result for a control check.
Compliance validation mode controlling how validation failures are handled.
Represents a compliance rule with its validation status and AWS Config rule mapping.
Thrown by
CloudForgeSynthesizer.synthesize(DeploymentConfig, Path) when complianceMode=enforce and
cdk-nag found at least one non-suppressed ERROR-level violation.Compute security compliance validation rules.
Concrete CMS ApplicationSpec implementation.
OIDC integration for Concrete CMS via OAuth extension / ALB OIDC.
Marks a field in DeploymentConfig as user-configurable with metadata for
automatic prompt generation, validation, and JSON schema generation.
Runtime metadata for a configuration field discovered via introspection.
Discovers and filters configuration fields using reflection and annotations.
General configuration validation rules that apply to all deployments.
Standalone utility for injecting context values into annotated fields.
Target CPU architecture for a Fargate task definition.
The RDS engine versions CloudForge can provision, by engine.
Database security compliance validation rules.
Database specification interface for applications requiring external databases.
The engine and version a deployment resolved to, and the supported option it matches.
Database connection information provided to applications.
One engine and version an application can be deployed with.
Database requirement specification.
Dockerized nginx edge for
*.cloudforge.localhost Host routing.Resolves default values for configuration fields using layered priority.
Universal deployment configuration for CloudForge applications.
Annotation to extract specific values from DeploymentContext.
Typed configuration interface for CDK deployment context.
Persists per-stack deployment context snippets for Manager multi-stack enrichment.
Fills missing
DeploymentConfig fields from ApplicationSpec, property files,
and auth/domain coherence rules — mirroring the interactive deployer when loading
a partial deployment-context.json.Messages describing defaults applied or auth coercions performed.
Inputs for
CloudForgeDeployment.Outcome from
CloudForgeDeployment.Post-synthesis deployment target for CloudForge templates.
Local deployment operation mode for
CloudForgeDeployment.Optional post-deploy behavior for
CloudForgeDeployment.Body of
POST /api/v1/settings/devices — the one request every CloudForge Agent client
(cloudforge-studio/desktop/terminal) sends to register itself.Response to a successful
POST /api/v1/settings/devices — carries the plaintext
deviceToken exactly once.Development security configuration with relaxed security settings.
Development security profile configuration with minimal security constraints.
Shared Docker CLI helpers for local emulator containers.
Dolphin/UNA Social Network ApplicationSpec implementation.
OIDC integration for Dolphin/UNA via OAuth module / ALB OIDC.
Domain Factory using annotation-based context extraction.
Drone CI ApplicationSpec implementation.
Drupal CMS ApplicationSpec implementation.
OIDC integration for Drupal using the native OpenID Connect module.
Runtime context information for EC2 UserData configuration.
Implementation of Ec2Context providing runtime information for UserData configuration.
Factory for creating EC2-based Jenkins compute infrastructure.
Factory for creating EFS file systems with support for persistence and reuse.
Elastic Load Balancer security compliance validation rules.
Command-line entry point for
EmulatorEdgeLifecycle — backs the
scripts/emulator-edge-*.sh wrappers in cloudforge-localstack and cloudforge-ministack
(this class itself lives here, in cloudforge-core, which both repos depend on as a resolved
artifact; the wrapper scripts do not live in cfc-core).Applies
EmulatorEdgeLifecycleAction to the shared nginx emulator edge.Emulator edge (nginx) lifecycle actions for Maven goals and
EmulatorLifecycle.Shared nginx edge in front of MiniStack/LocalStack host-published ECS ports.
Applies
EmulatorLifecycleAction to a LocalEmulatorRuntime.Lifecycle operations exposed by Maven goals and programmatic callers.
Extended IAM configuration with broader permissions for development.
Validates AWS Fargate CPU/memory combinations.
Factory for creating Fargate-based Jenkins compute infrastructure.
FedRAMP High Impact Level compliance validator.
FedRAMP Moderate compliance validation.
Field equality check for visibility conditions.
Tags that describe the impact and characteristics of configuration field changes.
Custom validator for configuration field cross-field validation.
Flarum Forum ApplicationSpec implementation.
OIDC integration for Flarum via FoF OAuth extension / ALB OIDC.
VPC Flow Log Factory using annotation-based context injection.
Discovers and loads compliance framework validators using Java ServiceLoader.
Interface for pluggable compliance framework validators.
GDPR organizational and data protection validation rules.
GDPR (General Data Protection Regulation) compliance validation.
Gitea ApplicationSpec implementation.
GitLab ApplicationSpec implementation.
OIDC integration for GitLab using OmniAuth OpenID Connect.
Grafana ApplicationSpec implementation.
OIDC integration for Grafana using generic_oauth provider.
Factory for AWS GuardDuty threat detection and compliance automation.
Harbor Container Registry ApplicationSpec implementation.
HIPAA organizational and administrative safeguard validation rules.
HIPAA Security Rule compliance validation.
IAM Configuration interface that extends the base BaseConfiguration interface.
Example demonstrating how to use the IAM Rules system with different permission profiles.
IAM Profile enum defining different levels of permissions for AWS resources.
Maps Security Profiles to appropriate IAM Profiles following security best practices.
IAM security compliance validation rules.
Identity Center Factory for AWS IAM Identity Center (formerly AWS SSO) setup.
OIDC configuration for AWS IAM Identity Center (formerly AWS SSO).
IAM Identity Center SAML Factory for automated SAML 2.0 application provisioning.
Incident response and disaster recovery compliance validation rules.
Factory for Amazon Inspector v2 account enablement.
Verifies Amazon Inspector is reachable for this account, instead of enabling it from the
application stack.
The instance sizes CloudForge offers for EC2 and RDS.
Interactive prompting utility that generates questions from @ConfigField annotations.
ISO/IEC 27001:2022 Information Security Management compliance validation.
Jenkins ApplicationSpec implementation.
Deprecated, for removal: This API element is subject to removal in a future version.
OIDC integration for Jenkins using the OpenID Connect Authentication Plugin.
Joomla CMS ApplicationSpec implementation.
OIDC integration for Joomla using miniOrange plugin.
Keycloak SAML Bridge Factory.
Key Management compliance validation rules.
Lambda security compliance validation rules.
Load balancer type for application ingress.
Reconciles local processes required when canonical templates include auth the emulator
cannot execute at the load balancer (for example ALB OIDC/Cognito).
Deploys adapted CloudFormation templates to a local emulator endpoint.
Canonical, adapted, and adaptation-report paths for a local deployment.
Resolves
applicationId from per-stack catalog files under deployment-contexts/.Stack and artifact naming conventions for local deployment targets.
Target-agnostic adapt → deploy → auth-runtime reconcile pipeline.
Combined outcome of template adaptation and local CloudFormation deploy.
Inputs for adapt-and-deploy against a local emulator target.
Runs target-specific deploy preflight before local emulator pipelines execute.
Outcome of deploying an adapted template to a local emulator endpoint.
Canonical Docker and gateway defaults shared by all CloudForge local emulators.
Detects host ports already used by local emulator ECS tasks (Docker) or stack outputs (CFN).
Resolves on-disk paths used by local emulator runtimes.
Docker lifecycle for a local AWS emulator (MiniStack or LocalStack).
ServiceLoader entry point for
LocalEmulatorRuntime implementations in target modules.Discovers
LocalEmulatorRuntime implementations registered by target modules.Immutable metadata for a CloudForge-managed local emulator container.
Blocks local emulator deploys when the required
localhost port is already in use.A host port already claimed on the local machine by an emulator ECS task or stack output.
Resolves the host port a MiniStack Fargate deploy will bind (
localhost:port).One CloudFormation resource change from a local deploy change set.
Deletes prior local emulator stacks for the same CloudForge
applicationId
when redeploying under a new stack name.Snapshot of LocalStack health, edition, and service availability for adapt/deploy decisions.
JSON-friendly projection of
LocalStackCapabilitySnapshot for health APIs.AWS service areas CloudForge probes on LocalStack before adapt/deploy.
LocalStack product tier profile used by the template adapter.
CloudWatch Logging Factory using annotation-based context injection.
Creates the customer-managed KMS key used to encrypt CloudWatch log groups.
Factory for Amazon Macie (sensitive-data discovery), account/region-scoped like GuardDuty.
Verifies Amazon Macie is already enabled in this account/Region, instead of enabling it from
the application stack.
Magento 2 E-commerce ApplicationSpec implementation.
OIDC integration for Magento 2 using miniOrange module.
Versioned catalog of AWS API capabilities CloudForge Manager uses for per-instance
operator actions (RDS snapshot/restore/upgrade, ECS lifecycle, CFN inventory/delete).
Resolves LocalStack / MiniStack gateway URLs from env or system properties.
Canonical environment / system-property keys for CloudForge Manager.
Attaches
ManagerAwsCapabilityCatalog baseline operator IAM to CloudForge Manager
task/instance roles at CDK synthesis time.Framework-neutral bridge that materializes Manager settings into system properties
when the process environment does not already define them.
Which of the two AWS Marketplace CloudFormation templates for CloudForge Manager to produce.
Mattermost Enterprise Edition ApplicationSpec implementation.
OIDC integration for Mattermost Team Edition using GitLab OAuth provider.
OIDC integration for Mattermost using native OpenID Connect.
SAML 2.0 integration for Mattermost.
Mattermost Team Edition ApplicationSpec implementation (FREE).
MediaWiki ApplicationSpec implementation.
OIDC integration for MediaWiki via PluggableAuth / OpenIDConnect extension.
Messaging security compliance validation rules.
Metabase Business Intelligence ApplicationSpec implementation.
SAML integration for Metabase (Pro/Enterprise editions).
Migration guide for converting existing factory classes to use annotation-based context injection.
Minimal IAM configuration with least privilege permissions.
Maps CloudFormation resource types to MiniStack support policy.
How MiniStack treats a CloudFormation resource type.
Moodle LMS ApplicationSpec implementation.
OIDC integration for Moodle using the Microsoft OpenID Connect plugin.
MyBB Forum ApplicationSpec implementation.
OIDC integration for MyBB via OAuth plugin / ALB OIDC.
Reads cdk-nag's own
<PackName>-<StackName>-NagReport.json files back off disk after
app.synth() completes, implementing ComplianceMode.ENFORCE's "blocks CDK
synthesis" behavior.One row from a
NagReport's lines[] array.Network topology mode for VPC configuration.
Sonatype Nexus Repository Manager ApplicationSpec implementation.
October CMS ApplicationSpec implementation.
OIDC integration for October CMS via RainLab.User OAuth / ALB OIDC.
OIDC Authentication Factory for ALB-based authentication with any OIDC provider.
OIDC configuration for application-level authentication.
Application-level OIDC integration interface.
OpenCart E-commerce ApplicationSpec implementation.
OIDC integration for OpenCart via ALB-level authentication.
Permission matrix for the operator provisioning layer: the AWS actions CloudForge
Manager's task role needs, as the calling principal, to create and manage the infrastructure a
deploy:create target application's CloudFormation template describes (VPC, EFS, ALB,
ECS cluster/service/task definition).PCI-DSS compliance validation rules.
Permission Matrix defining the minimum required permissions for each topology/runtime combination.
Validation result containing success status and any issues found.
phpBB Forum ApplicationSpec implementation.
OIDC integration for phpBB via OAuth extension / ALB OIDC.
Factory for creating PHP container configurations for CMS platforms.
PHP runtime configuration for CMS deployments.
UserData builder extension for PHP applications on EC2.
Lifecycle capability exposed by a local deployment platform.
Target-owned platform lifecycle capability, discovered through
ServiceLoader.Classpath registry for target-owned
PlatformRuntimeProvider implementations.PostgreSQL ApplicationSpec implementation.
Resolves the best "open this application" URL from a deployed stack's CFN outputs.
Formats preflight outcomes for CLI and exception messages.
How local emulator deploy preflight treats violations.
Outcome of a local emulator deploy preflight check.
Single preflight finding.
PrestaShop E-commerce ApplicationSpec implementation.
OIDC integration for PrestaShop using OAuth modules.
Production security configuration with hardened security settings.
Production security profile configuration for logging, monitoring, encryption,
backups, and audit controls used by SOC 2, HIPAA, and PCI-DSS configurations.
Prometheus ApplicationSpec implementation.
Factory for provisioning AWS RDS database instances based on DatabaseSpec requirements.
Redis ApplicationSpec implementation.
One row of
GET /api/v1/settings/devices — never carries the device token itself (see
DeviceRegistrationResponse's javadoc: that value exists only once, at registration).Marks a CloudForge Manager REST controller method as requiring only that the caller pass
Manager's baseline access check — no specific
policy and no resolved
caller identity beyond that.Marks a CloudForge Manager REST controller method as requiring the caller hold a privileged
role (
admin/manager) or the operations:run policy — the same bar
destructive/high-blast-radius operations have always used, distinct from a single named
policy.Marks a CloudForge Manager REST controller method as requiring a resolved caller who is
permitted at least one of the named policies.
Marks a CloudForge Manager REST controller method as requiring a resolved caller identity, but
no specific
policy check beyond being authenticated — self-service
endpoints where the caller acts on their own account/resources use this (e.g.Marks a CloudForge Manager REST controller method as requiring a resolved caller who is
permitted the named policy.
Utility for converting integer day values to AWS CDK RetentionDays enum.
Defines the compute runtime environments supported by CloudForge.
Example demonstrating how to use the Security Rules system with different security profiles.
Factory for AWS Security Hub and its standards subscriptions.
Verifies Security Hub is already enabled in this account/Region, instead of enabling it from
the application stack.
Factory for creating security monitoring and alerting configurations.
Defines the security profile levels for CloudForge deployments.
Annotation to extract specific values from SecurityProfileConfiguration.
Configuration interface for security profile settings.
Example demonstrating how to access SecurityProfileConfiguration from SystemContext.
Security rules installation and compliance framework orchestration.
Strategy interface for where Manager's own session cookies live — sibling to
AuthBackend (local-DB-vs-Cognito for the *user directory*; this is in-memory-vs-Redis for
*which session cookies this process currently recognizes*, an orthogonal concern).Registry for shared/account-level resources that should be reused across stacks.
SOC 2 (Service Organization Control 2) Trust Services Criteria compliance validation.
SonarQube ApplicationSpec -- continuous code quality and security analysis.
Applies
StackPortLifecycleAction to a StackPortRuntime.StackPort lifecycle operations exposed by Maven goals and programmatic callers.
Docker lifecycle for a target-owned StackPort resource browser.
ServiceLoader entry point for
StackPortRuntime implementations in target modules.Discovers
StackPortRuntime implementations registered by target modules.Metadata for a target-owned StackPort resource browser container.
Receives each new CloudFormation stack event as
AwsDirectDeployer observes it, in the
order CloudFormation reported it.One captured CloudFormation stack event.
Staging security configuration with moderate security settings.
Staging security profile configuration for pre-production environments.
Standard IAM configuration with balanced permissions.
SuiteCRM ApplicationSpec implementation.
OIDC integration for SuiteCRM via built-in OAuth / ALB OIDC.
Apache Superset Business Intelligence ApplicationSpec implementation.
Sylius E-commerce ApplicationSpec implementation.
OIDC integration for Sylius via Symfony Security Bundle / ALB OIDC.
Annotation to extract specific values from SystemContext.
Container for domain and SSL factories.
Container for infrastructure factories created by the orchestration layer.
Container for complete Jenkins deployment.
Container for Jenkins-specific factories.
Container for complete S3 + CloudFront deployment.
Container for S3 and CloudFront factories.
One audited change applied while adapting a canonical template for local deployment.
Adapted CloudFormation template plus an explicit adaptation audit trail.
Adapts a canonical AWS CloudFormation template for a local emulator target.
File-based helpers for
TemplateAdapter implementations.Reads canonical CloudFormation templates for preflight scans.
Threat protection compliance validation rules.
Single source of truth for whether a deployment's ALB HTTPS listener uses a publicly trusted
certificate.
Defines the deployment topology patterns supported by CloudForge.
TYPO3 CMS ApplicationSpec implementation.
OIDC integration for TYPO3 via typo3/cms-openid extension / ALB OIDC.
Builder interface for constructing EC2 UserData scripts.
Implementation of UserDataBuilder that generates bash commands for EC2 UserData scripts.
Result of field validation.
HashiCorp Vault ApplicationSpec implementation.
Visibility condition expression language for configuration fields.
Example expressions for testing and documentation.
Evaluates visibility expressions for configuration fields.
Factory for creating VPC (Virtual Private Cloud) infrastructure.
Factory for creating AWS WAF WebACL resources.
WooCommerce E-commerce ApplicationSpec implementation.
WordPress CMS ApplicationSpec implementation.
OIDC integration for WordPress using OpenID Connect Generic plugin.