Uses of Annotation Interface
com.cloudforge.core.annotation.ConfigField

Packages that use ConfigField

Package	Description
com.cloudforge.core.config

Uses of ConfigField in com.cloudforge.core.config

Fields in com.cloudforge.core.config with annotations of type ConfigField

Modifier and Type	Field	Description
List<String>	DeploymentConfig.additionalProtectedPaths	Additional URL path patterns requiring authentication, added on top of whichever base list (DeploymentConfig.protectedPaths or the application default) is in effect.
Boolean	DeploymentConfig.albAccessLogging	Enable ALB access logs to S3.
Boolean	DeploymentConfig.antiMalwareEnabled	Enable anti-malware scanning
String	DeploymentConfig.applicationId	Application identifier (e.g., "jenkins", "gitlab", "vault")
String	DeploymentConfig.applicationName	Human-readable application name
String	DeploymentConfig.artifactsBucket	S3 bucket for artifacts
String	DeploymentConfig.artifactsPrefix	S3 prefix for artifacts
Boolean	DeploymentConfig.auditManagerEnabled	Enable AWS Audit Manager
String	DeploymentConfig.auditManagerFrameworkId	Legacy single-framework override, superseded by DeploymentConfig.complianceFrameworks (which supports multiple).
Boolean	DeploymentConfig.auditManagerServiceEnabled	Enable the AWS Audit Manager service itself (null = use security profile default).
AuthMode	DeploymentConfig.authMode	Authentication mode
Boolean	DeploymentConfig.automatedBackupEnabled	Enable automated backups (null = use security profile default)
Boolean	DeploymentConfig.autoProvisionIdentityCenter	Auto-provision SAML application in IAM Identity Center
String[]	DeploymentConfig.availabilityZones	Availability zone suffixes for deployment (region-relative — "a" means whichever zone the deploy's own region calls "a", not a specific full zone name, since the same suffix set is valid regardless of which region gets picked elsewhere in the form).
Boolean	DeploymentConfig.awsConfigEnabled	Enable AWS Config
String	DeploymentConfig.backupCrossRegionVaultArn	ARN of the AWS Backup vault, in another region, that backups are copied to.
Boolean	DeploymentConfig.backupVaultLockEnabled	Enable AWS Backup Vault Lock (null = profile default: false except when the compliance matrix requires BACKUP_RECOVERY).
Boolean	DeploymentConfig.backupVaultRetentionEnabled	Retain the AWS Backup vault on stack deletion (null = profile default).
String	DeploymentConfig.bastionCidr	CIDR for bastion/VPN SSH access
String	DeploymentConfig.certificateArn	ARN of an existing ACM certificate to use for the ALB's HTTPS listener, instead of provisioning a new one.
Boolean	DeploymentConfig.certificateExpirationMonitoring	Certificate expiration monitoring enabled
String	DeploymentConfig.cloudforgeManagerIssuerUrl	CloudForge Manager's own public URL, used as the OIDC issuer when this app trusts a CloudForge Manager install as its identity provider (see com.cloudforgeci.manager.auth.oidcprovider's own package javadoc).
Boolean	DeploymentConfig.cloudfrontEnabled	Enable CloudFront CDN
Boolean	DeploymentConfig.cloudTrailEnabled	Enable CloudTrail for API audit logging
Boolean	DeploymentConfig.cloudTrailInsightsEnabled	Enable CloudTrail Insights
Boolean	DeploymentConfig.cloudWatchLogsKmsEncryptionEnabled	Enable CloudWatch Logs KMS encryption
String	DeploymentConfig.cognitoAdminGroupName	Admin group name
String	DeploymentConfig.cognitoAppClientId	Existing Cognito App Client ID
Boolean	DeploymentConfig.cognitoAutoProvision	Auto-provision new Cognito User Pool
Boolean	DeploymentConfig.cognitoCreateGroups	Create admin and user groups in Cognito
String	DeploymentConfig.cognitoDomainPrefix	Cognito domain prefix (must be globally unique)
String	DeploymentConfig.cognitoInitialAdminEmail	Initial admin email address
String	DeploymentConfig.cognitoInitialAdminPhone	Initial admin phone number (E.164 format)
Boolean	DeploymentConfig.cognitoMfaEnabled	Enable MFA for Cognito
String	DeploymentConfig.cognitoMfaMethod	Cognito MFA method
Boolean	DeploymentConfig.cognitoSelfSignupEnabled	Overrides the security-profile default for whether users can self-register on the Cognito hosted UI (development defaults to allowed, staging/production to admin-only).
String	DeploymentConfig.cognitoUserGroupName	User group name
String	DeploymentConfig.cognitoUserPoolClientId	Manually configured Cognito app client ID, for a client that wasn't auto-provisioned.
String	DeploymentConfig.cognitoUserPoolId	Existing Cognito User Pool ID
String	DeploymentConfig.cognitoUserPoolName	Cognito User Pool name
List<ComplianceFrameworkType>	DeploymentConfig.complianceFrameworks	Compliance frameworks to enable.
ComplianceMode	DeploymentConfig.complianceMode	Compliance validation mode controlling how validation failures are handled.
String	DeploymentConfig.containerImage	Override container image tag
Boolean	DeploymentConfig.containerImageScanning	Enable container image vulnerability scanning
Boolean	DeploymentConfig.containerRuntimeSecurity	Enable container runtime security monitoring
int	DeploymentConfig.cpu	Fargate CPU units (256, 512, 1024, 2048, 4096)
int	DeploymentConfig.cpuTargetUtilization	CPU target utilization percentage for auto-scaling
Boolean	DeploymentConfig.createConfigInfrastructure	Create AWS Config infrastructure — an account+region-wide singleton (AWS allows exactly one recorder and one delivery channel per account per region), so this must stay an explicit, single-stack-only opt-in.
Boolean	DeploymentConfig.createGuardDutyDetector	Create GuardDuty detector (account-region singleton).
Boolean	DeploymentConfig.createZone	Create Route53 hosted zone
Boolean	DeploymentConfig.crossRegionBackupEnabled	Enable cross-region backups (null = use security profile default)
Integer	DeploymentConfig.databaseAllocatedStorageGB	Allocated storage in GB.
Integer	DeploymentConfig.databaseBackupRetentionDays	Backup retention period in days.
String	DeploymentConfig.databaseEngine	Database engine (e.g., postgres, mysql, mariadb).
String	DeploymentConfig.databaseInstanceClass	RDS instance class (e.g., db.t3.small, db.m5.large).
Boolean	DeploymentConfig.databaseMultiAz	Enable Multi-AZ deployment for high availability.
String	DeploymentConfig.databaseName	Database name.
Integer	DeploymentConfig.databaseReadReplicaCount	Optional number of RDS read replicas.
String	DeploymentConfig.databaseVersion	Database engine version.
String	DeploymentConfig.domain	Primary domain (e.g., "example.com")
Boolean	DeploymentConfig.ebsEncryptionEnabled	Enable EBS volume encryption (null = profile default: PRODUCTION/STAGING=true unless the compliance matrix already requires it, DEV=true).
Boolean	DeploymentConfig.efsEncryptionAtRestEnabled	Enable EFS at-rest encryption (null = profile default).
Boolean	DeploymentConfig.efsEncryptionInTransitEnabled	Enable EFS encryption in transit
boolean	DeploymentConfig.enableAgents	Enable JNLP build agent port (Jenkins: 50000)
Boolean	DeploymentConfig.enableAutoScaling	Enable auto-scaling
Boolean	DeploymentConfig.enableCloudTrailBucketAccessRemediation	Enable CloudTrail bucket access logging remediation
boolean	DeploymentConfig.enableCluster	Enable Redis Cluster bus port (Redis: 16379)
boolean	DeploymentConfig.enableClustering	Enable clustering ports (Mattermost: 8074-8075, Vault: 8201)
boolean	DeploymentConfig.enableDockerRegistry	Enable container registry port (GitLab: 5050, Nexus: 5000-5002)
Boolean	DeploymentConfig.enableEncryption	Enable encryption at rest
Boolean	DeploymentConfig.enableFlowlogs	Enable VPC flow logs
Boolean	DeploymentConfig.enableGuardDutyRemediation	Enable GuardDuty finding remediation (null = profile default: auto-enabled in PRODUCTION, same pattern as DeploymentConfig.imdsv2Required -- ComplianceFactory's consumers treat null as "PRODUCTION enables it, otherwise off" and an explicit value as an override either way, so this must NOT get a static default or that fallback can never trigger.
Boolean	DeploymentConfig.enableInspectorRemediation	Enable Inspector finding remediation.
Boolean	DeploymentConfig.enableMacieRemediation	Enable Macie finding remediation.
boolean	DeploymentConfig.enableMetrics	Enable Prometheus metrics port (GitLab: 9090)
Boolean	DeploymentConfig.enableMonitoring	Enable CloudWatch monitoring
boolean	DeploymentConfig.enableNotary	Enable Notary content trust port (Harbor: 4443)
Boolean	DeploymentConfig.enableRdsAutoMinorVersionUpgradeRemediation	Enable RDS auto minor version upgrade remediation
Boolean	DeploymentConfig.enableRdsDeletionProtectionRemediation	Enable RDS deletion protection remediation
Boolean	DeploymentConfig.enableS3VersioningRemediation	Enable S3 versioning remediation
Boolean	DeploymentConfig.enableSecurityHubRemediation	Enable Security Hub finding remediation.
boolean	DeploymentConfig.enableSentinel	Enable Redis Sentinel port (Redis: 26379)
boolean	DeploymentConfig.enableSmtp	Enable SMTP email port (Mattermost: 587)
boolean	DeploymentConfig.enableSmtps	Enable SMTP TLS email port (Mattermost: 465)
boolean	DeploymentConfig.enableSsh	Enable Git SSH port (GitLab: 22, Gitea: 2222)
Boolean	DeploymentConfig.enableSsl	Enable SSL certificate via ACM
boolean	DeploymentConfig.enableTrivy	Enable Trivy vulnerability scanner port (Harbor: 8080)
String	DeploymentConfig.environment	Environment name (e.g., "dev", "staging", "production")
String	DeploymentConfig.existingFileSystemId	Reuse existing EFS by ID (for disaster recovery workflows)
Boolean	DeploymentConfig.fileIntegrityMonitoring	Enable file integrity monitoring
String	DeploymentConfig.fqdn	Fully qualified domain name — always subdomain + "." + domain once both are set; this field only matters when you need to override that computed result directly (e.g.
Boolean	DeploymentConfig.gdprDataTransferApproved	GDPR data transfer approval flag for non-EU deployments.
Boolean	DeploymentConfig.guardDutyAlertsConfigured	GuardDuty alerts configured (EventBridge to SNS/SIEM)
Boolean	DeploymentConfig.guardDutyEnabled	Enable GuardDuty threat detection.
int	DeploymentConfig.healthCheckGracePeriod
int	DeploymentConfig.healthCheckInterval
int	DeploymentConfig.healthCheckTimeout
int	DeploymentConfig.healthyThreshold
Boolean	DeploymentConfig.httpsStrictEnabled	HTTPS-only mode (no HTTP listener when SSL enabled)
String	DeploymentConfig.identityCenterGroupName	Identity Center group name for user assignment
Boolean	DeploymentConfig.imdsv2Required	Require IMDSv2 on EC2 instances (null = profile default: PRODUCTION/STAGING=true unless the compliance matrix requires EC2_IMDSV2, DEV=false).
Boolean	DeploymentConfig.inspectorEc2Scanning	Enable Inspector EC2 instance scanning
Boolean	DeploymentConfig.inspectorEcrScanning	Enable Inspector ECR image scanning
Boolean	DeploymentConfig.inspectorEnabled	Enable Amazon Inspector for vulnerability scanning.
String	DeploymentConfig.instanceType	EC2 instance type (e.g., "t3.micro", "t3.small")
LoadBalancerType	DeploymentConfig.lbType	Load balancer type
String	DeploymentConfig.logRetentionDays	CloudWatch Logs retention days
Boolean	DeploymentConfig.macieAutomatedDiscovery	Enable Macie automated discovery jobs
Boolean	DeploymentConfig.macieEnabled	Enable Amazon Macie for PII/PHI discovery (HIPAA/GDPR).
Boolean	DeploymentConfig.managerDirectDeployEnabled	Opt-in: grants CloudForge Manager's own task/instance role the direct-deploy IAM capability (CFN_DEPLOY — see ManagerAwsCapabilityCatalog), condition-scoped to CloudForge-tagged resources.
String	DeploymentConfig.managerLicenseKey	A customer's LicenseSeat license key (CFC-XXXX-XXXX-XXXX-XXXX), injected at deploy time so an install activates immediately instead of requiring a follow-up visit to the owner-only License settings screen after the stack comes up.
int	DeploymentConfig.maxInstanceCapacity	Maximum instance capacity for auto-scaling
int	DeploymentConfig.memory	Fargate memory in MB
int	DeploymentConfig.minInstanceCapacity	Minimum instance capacity for auto-scaling
NetworkMode	DeploymentConfig.networkMode	Network mode for VPC topology
String	DeploymentConfig.oidcAuthorizationEndpoint	OIDC authorization endpoint
String	DeploymentConfig.oidcClientId	OIDC client ID — shared by external-idp and cloudforge-manager, both providers where an admin registers this app's client credentials by hand (external IdP's own console, or CloudForge Manager's Trusted Apps settings page) rather than CloudForge auto-provisioning them, so the field means the same thing either way.
String	DeploymentConfig.oidcClientSecretName	OIDC client secret name in Secrets Manager — same sharing rationale as DeploymentConfig.oidcClientId.
String	DeploymentConfig.oidcIssuer	OIDC issuer URL
String	DeploymentConfig.oidcProvider	OIDC provider (none, cognito, identity-center, external-idp)
String	DeploymentConfig.oidcTokenEndpoint	OIDC token endpoint
String	DeploymentConfig.oidcUserInfoEndpoint	OIDC user info endpoint
Boolean	DeploymentConfig.performanceInsightsEnabled	RDS Performance Insights (query-level performance monitoring).
List<String>	DeploymentConfig.protectedPaths	URL path patterns that require authentication, replacing the application's own default list (ApplicationSpec#protectedPaths()) when set.
Boolean	DeploymentConfig.provisionDatabase	Provision RDS database for application.
Boolean	DeploymentConfig.provisionManagerAccountCipherKey	Provision a dedicated AWS Secrets Manager entry holding the AES cipher key CloudForge Manager uses to encrypt cross-account connection secrets (external IDs) at rest — see SecretCipher/AesGcmSecretCipher in cloudforge-manager.
Boolean	DeploymentConfig.provisionManagerRedisSessions	Provision an ElastiCache Redis cluster and bind CloudForge Manager's own container to it as a shared session store (CFC_MANAGER_SESSION_MODE=redis), so every Manager instance behind the same ALB recognizes sessions any of the others created — the missing piece for running Manager itself horizontally scaled.
List<String>	DeploymentConfig.publicPaths	URL path patterns explicitly excluded from authentication, removed from the effective protected-paths list after DeploymentConfig.protectedPaths/DeploymentConfig.additionalProtectedPaths and the application's own defaults are combined.
Boolean	DeploymentConfig.rdsAutoMinorVersionUpgrade	Automatic minor-version upgrades for the RDS instance.
Boolean	DeploymentConfig.rdsDatabaseMultiAzEnabled	Enable RDS Multi-AZ (null = profile default: PRODUCTION=true, STAGING/DEV=false unless the compliance matrix requires DATABASE_MULTI_AZ).
Boolean	DeploymentConfig.rdsDeletionProtectionEnabled	Enable RDS deletion protection (null = profile default: PRODUCTION=false unless the compliance matrix requires DELETION_PROTECTION, STAGING/DEV=false).
Boolean	DeploymentConfig.rdsEnhancedMonitoringEnabled	RDS Enhanced Monitoring (OS-level metrics at a configurable interval).
String	DeploymentConfig.region	AWS region (e.g., "us-east-1", "us-west-2")
Boolean	DeploymentConfig.restrictSecurityGroupEgress	Restrict security group egress to VPC CIDR only (requires VPC endpoints for AWS service access)
Boolean	DeploymentConfig.retainStorage	Retain EFS/EBS volumes on stack deletion
Boolean	DeploymentConfig.route53QueryLoggingEnabled	Enable Route53 Query Logging
RuntimeType	DeploymentConfig.runtime	Runtime type (FARGATE or EC2)
Boolean	DeploymentConfig.s3EncryptionEnabled	Enable S3 bucket encryption (null = profile default).
Boolean	DeploymentConfig.s3ObjectLockEnabled	Enable S3 Object Lock for audit buckets (HIPAA/PCI-DSS immutability requirement)
Boolean	DeploymentConfig.scopeConfigRulesToDeployment	Scope AWS Config rules to only monitor this deployment's own resources (by stack name) instead of every resource in the account/region.
Boolean	DeploymentConfig.securityHubAwsFoundationalEnabled	Enable the AWS Foundational Security Best Practices standard in Security Hub
Boolean	DeploymentConfig.securityHubCisEnabled	Enable the CIS AWS Foundations Benchmark standard in Security Hub
String	DeploymentConfig.securityHubCisVersion	CIS AWS Foundations Benchmark version to enable.
Boolean	DeploymentConfig.securityHubEnabled	Enable AWS Security Hub for centralized security findings.
String	DeploymentConfig.securityHubFsbpVersion	AWS Foundational Security Best Practices version to enable.
Boolean	DeploymentConfig.securityHubPciDssEnabled	Enable the PCI DSS standard in Security Hub
String	DeploymentConfig.securityHubPciDssVersion	PCI DSS version to enable.
Boolean	DeploymentConfig.securityMonitoringEnabled	Enable security monitoring
SecurityProfile	DeploymentConfig.securityProfile	Security profile (DEV, STAGING, PRODUCTION)
Boolean	DeploymentConfig.snsKmsEncryptionEnabled	Enable SNS topic KMS encryption (null = profile default: false unless the compliance matrix requires SNS_KMS_ENCRYPTION).
String	DeploymentConfig.ssoGroupId	SSO Group ID
String	DeploymentConfig.ssoInstanceArn	IAM Identity Center (SSO) Instance ARN
String	DeploymentConfig.ssoTargetAccountId	SSO Target Account ID
String	DeploymentConfig.stackName	CloudFormation stack name
String	DeploymentConfig.subdomain	Subdomain prefix (e.g., "ci", "gitlab") — ordered ahead of DeploymentConfig.domain: you pick what this app is called (the subdomain) before which domain it hangs off of, and the combined result (subdomain + "." + domain) is what gets requested, not the other way around.
TopologyType	DeploymentConfig.topology	Topology type — user-selectable, not just an auto-derived display value, so a future topology (or an app implementing more than one applicable interface) isn't locked out of being chosen explicitly.
int	DeploymentConfig.unhealthyThreshold
Boolean	DeploymentConfig.wafEnabled	Enable AWS WAF