Class DeploymentConfig

java.lang.Object
com.cloudforge.core.config.DeploymentConfig
public class DeploymentConfig extends Object
Universal deployment configuration for CloudForge applications.

This is the canonical configuration structure used by both interactive deployers and non-interactive deployment tools. It maps directly to deployment-context.json and can be serialized/deserialized via Jackson.

Architecture: This class lives in cloudforge-core (the contract layer) as it defines the data model interface between libraries and consumers. This ensures cfc-testing and other consumers always use the latest configuration schema without duplication.

Since:
CloudForge 3.0.0

  • Field Details

    • stackName

      public String stackName
      CloudFormation stack name

    • environment

      public String environment
      Environment name (e.g., "dev", "staging", "production")

    • applicationId

      public String applicationId
      Application identifier (e.g., "jenkins", "gitlab", "vault")

    • applicationName

      public String applicationName
      Human-readable application name

    • applicationSpec

      public ApplicationSpec applicationSpec
      ApplicationSpec instance (not serialized to JSON)

    • subdomain

      public String subdomain
      Subdomain prefix (e.g., "ci", "gitlab") — ordered ahead of domain: you pick what this app is called (the subdomain) before which domain it hangs off of, and the combined result (subdomain + "." + domain) is what actually gets requested, not the other way around.

    • domain

      public String domain
      Primary domain (e.g., "example.com")

    • fqdn

      public String fqdn
      Fully qualified domain name — always subdomain + "." + domain once both are set; this field only matters when you need to override that computed result directly (e.g. a domain structure the subdomain+domain pair can't express). @JsonIgnored deliberately: it's a derived/override value, not sent as its own JSON key — the previous description ("overrides domain+subdomain") had the relationship backwards, reading as if *this* field were the primary input and domain/subdomain were the fallback, when it's the other way around.

    • enableSsl

      public Boolean enableSsl
      Enable SSL certificate via ACM

    • certificateArn

      public String certificateArn
      ARN of an existing ACM certificate to use for the ALB's HTTPS listener, instead of provisioning a new one. Takes priority over both of FargateRuntimeConfiguration's other two certificate paths — the DNS-validated public cert (needs a Route53 hosted zone this deployment controls) and the AWS Private CA cert (issued for the bare ALB DNS name, NOT trusted by browsers — see that class's own comments). This is how a deployment gets a genuinely publicly-trusted certificate without either of those: import your own cert (issued by any public CA — ACM's own DNS/email validation, Let's Encrypt, a purchased cert, ...) into ACM yourself first (e.g. aws acm import-certificate, entirely within your own account — the key material never has to pass through this deployment config or CloudFormation), then point this at the resulting ARN.

    • runtime

      public RuntimeType runtime
      Runtime type (FARGATE or EC2)

    • topology

      public TopologyType topology
      Topology type — genuinely selectable, not just an auto-derived display value, so a future topology (or an app implementing more than one applicable interface) isn't locked out of being chosen explicitly. No allowedValues override here on purpose: leaving it unset lets the schema builder enumerate every TopologyType constant automatically — a hardcoded single-value override would hide CMS_SERVICE/JENKINS_SERVICE/S3_WEBSITE from the wizard entirely, locking out a CmsSpec app's actual topology even though DeploymentContextPreparer already defaults to it correctly.

    • securityProfile

      public SecurityProfile securityProfile
      Security profile (DEV, STAGING, PRODUCTION)

    • networkMode

      public NetworkMode networkMode
      Network mode for VPC topology

    • lbType

      public LoadBalancerType lbType
      Load balancer type

    • createZone

      public Boolean createZone
      Create Route53 hosted zone

    • enableFlowlogs

      public Boolean enableFlowlogs
      Enable VPC flow logs

    • wafEnabled

      public Boolean wafEnabled
      Enable AWS WAF

    • httpsStrictEnabled

      public Boolean httpsStrictEnabled
      HTTPS-only mode (no HTTP listener when SSL enabled)

    • albAccessLogging

      public Boolean albAccessLogging
      Enable ALB access logs to S3

    • cloudfrontEnabled

      public Boolean cloudfrontEnabled
      Enable CloudFront CDN

    • bastionCidr

      public String bastionCidr
      CIDR for bastion/VPN SSH access

    • minInstanceCapacity

      public int minInstanceCapacity
      Minimum instance capacity for auto-scaling

    • maxInstanceCapacity

      public int maxInstanceCapacity
      Maximum instance capacity for auto-scaling

    • cpuTargetUtilization

      public int cpuTargetUtilization
      CPU target utilization percentage for auto-scaling

    • cpu

      public int cpu
      Fargate CPU units (256, 512, 1024, 2048, 4096)

    • memory

      public int memory
      Fargate memory in MB

    • instanceType

      public String instanceType
      EC2 instance type (e.g., "t3.micro", "t3.small")

    • containerImage

      public String containerImage
      Override container image tag

    • retainStorage

      public Boolean retainStorage
      Retain EFS/EBS volumes on stack deletion

    • existingFileSystemId

      public String existingFileSystemId
      Reuse existing EFS by ID (for disaster recovery workflows)

    • artifactsBucket

      public String artifactsBucket
      S3 bucket for artifacts

    • artifactsPrefix

      public String artifactsPrefix
      S3 prefix for artifacts

    • authMode

      public AuthMode authMode
      Authentication mode

    • oidcProvider

      public String oidcProvider
      OIDC provider (none, cognito, identity-center, external-idp)

    • cognitoAutoProvision

      public Boolean cognitoAutoProvision
      Auto-provision new Cognito User Pool

    • cognitoUserPoolName

      public String cognitoUserPoolName
      Cognito User Pool name

    • cognitoDomainPrefix

      public String cognitoDomainPrefix
      Cognito domain prefix (must be globally unique)

    • cognitoMfaEnabled

      public Boolean cognitoMfaEnabled
      Enable MFA for Cognito

    • cognitoMfaMethod

      public String cognitoMfaMethod
      Cognito MFA method

    • cognitoSelfSignupEnabled

      public Boolean cognitoSelfSignupEnabled
      Overrides the security-profile default for whether users can self-register on the Cognito hosted UI (development defaults to allowed, staging/production to admin-only). Left null, the profile default applies unchanged. Self-signup is not enforced by any compliance framework rule today — a self-registered user still gets no group membership and resolves to the lowest-privilege role — but enabling it while a compliance framework is active (advisory or enforce) logs a warning at synthesis time, since open self-registration into an ops panel is a common audit finding independent of what role it grants.

    • cognitoCreateGroups

      public Boolean cognitoCreateGroups
      Create admin and user groups in Cognito

    • cognitoAdminGroupName

      public String cognitoAdminGroupName
      Admin group name

    • cognitoUserGroupName

      public String cognitoUserGroupName
      User group name

    • cognitoInitialAdminEmail

      public String cognitoInitialAdminEmail
      Initial admin email address

    • cognitoInitialAdminPhone

      public String cognitoInitialAdminPhone
      Initial admin phone number (E.164 format)

    • cognitoUserPoolId

      public String cognitoUserPoolId
      Existing Cognito User Pool ID

    • cognitoAppClientId

      public String cognitoAppClientId
      Existing Cognito App Client ID

    • oidcIssuer

      public String oidcIssuer
      OIDC issuer URL

    • cloudforgeManagerIssuerUrl

      public String cloudforgeManagerIssuerUrl
      CloudForge Manager's own public URL, used as the OIDC issuer when this app trusts a CloudForge Manager install as its identity provider (see com.cloudforgeci.manager.auth.oidcprovider's own package javadoc). Authorization/token/ userinfo endpoints are computed from this one URL (CloudForge Manager's OIDC-provider endpoints are at fixed paths — /oauth2/authorize, /oauth2/token, /userinfo — so unlike the generic external-idp option above, only the base URL needs entering here, not each endpoint separately).

    • oidcAuthorizationEndpoint

      public String oidcAuthorizationEndpoint
      OIDC authorization endpoint

    • oidcTokenEndpoint

      public String oidcTokenEndpoint
      OIDC token endpoint

    • oidcUserInfoEndpoint

      public String oidcUserInfoEndpoint
      OIDC user info endpoint

    • oidcClientId

      public String oidcClientId
      OIDC client ID — shared by external-idp and cloudforge-manager, both providers where an admin registers this app's client credentials by hand (external IdP's own console, or CloudForge Manager's Trusted Apps settings page) rather than CloudForge auto-provisioning them, so the field means the same thing either way.

    • oidcClientSecretName

      public String oidcClientSecretName
      OIDC client secret name in Secrets Manager — same sharing rationale as oidcClientId.

    • enableAgents

      public boolean enableAgents
      Enable JNLP build agent port (Jenkins: 50000)

    • enableSsh

      public boolean enableSsh
      Enable Git SSH port (GitLab: 22, Gitea: 2222)

    • enableSmtp

      public boolean enableSmtp
      Enable SMTP email port (Mattermost: 587)

    • enableSmtps

      public boolean enableSmtps
      Enable SMTP TLS email port (Mattermost: 465)

    • enableClustering

      public boolean enableClustering
      Enable clustering ports (Mattermost: 8074-8075, Vault: 8201)

    • enableDockerRegistry

      public boolean enableDockerRegistry
      Enable container registry port (GitLab: 5050, Nexus: 5000-5002)

    • enableMetrics

      public boolean enableMetrics
      Enable Prometheus metrics port (GitLab: 9090)

    • enableNotary

      public boolean enableNotary
      Enable Notary content trust port (Harbor: 4443)

    • enableTrivy

      public boolean enableTrivy
      Enable Trivy vulnerability scanner port (Harbor: 8080)

    • enableSentinel

      public boolean enableSentinel
      Enable Redis Sentinel port (Redis: 26379)

    • enableCluster

      public boolean enableCluster
      Enable Redis Cluster bus port (Redis: 16379)

    • autoProvisionIdentityCenter

      public Boolean autoProvisionIdentityCenter
      Auto-provision SAML application in IAM Identity Center

    • ssoInstanceArn

      public String ssoInstanceArn
      IAM Identity Center (SSO) Instance ARN

    • ssoGroupId

      public String ssoGroupId
      SSO Group ID

    • ssoTargetAccountId

      public String ssoTargetAccountId
      SSO Target Account ID

    • identityCenterGroupName

      public String identityCenterGroupName
      Identity Center group name for user assignment

    • provisionDatabase

      public Boolean provisionDatabase
      Provision RDS database for application. Only shown for applications with optional database support (e.g., Metabase, Grafana). Applications requiring database (e.g., Mattermost, GitLab) always provision one.

    • databaseEngine

      public String databaseEngine
      Database engine (e.g., postgres, mysql, mariadb). Default comes from ApplicationSpec.databaseRequirement().engine()

      Deliberately no static default here (nor on the other database* fields below with a defaultFrom): DeploymentContextPreparer only applies a field's defaultFrom-resolved ApplicationSpec value when the field is currently null/blank — a non-null Java initializer (this used to be = "postgres") permanently looks "already set" and blocks that resolution forever. That silently forced every app onto engine=postgres/version=15/instanceClass=db.t3.small/storage=20GB/name=appdb unless a caller explicitly overrode every one of these fields together — for a MySQL-only app like WordPress, a form that filled in databaseEngine=mysql but left databaseVersion untouched produced an impossible "mysql15" RDS parameter group family and failed CloudFormation with CREATE_FAILED. cloudforge-api's ApplicationFactory merges these fields against ApplicationSpec.databaseRequirement() with the same null-check pattern, now consistently reachable too.

    • databaseVersion

      public String databaseVersion
      Database engine version. Default comes from ApplicationSpec.databaseRequirement().version()

    • databaseInstanceClass

      public String databaseInstanceClass
      RDS instance class (e.g., db.t3.small, db.m5.large). DESTRUCTIVE: Changing this requires resource replacement. BILLING_IMPACT: Larger instances cost more.

    • databaseAllocatedStorageGB

      public Integer databaseAllocatedStorageGB
      Allocated storage in GB. BILLING_IMPACT: More storage costs more.

    • databaseMultiAz

      public Boolean databaseMultiAz
      Enable Multi-AZ deployment for high availability. BILLING_IMPACT: Multi-AZ doubles database costs.

    • databaseReadReplicaCount

      public Integer databaseReadReplicaCount
      Optional number of RDS read replicas. When unset, an application may provide its own default (CloudForge Manager defaults to one); zero explicitly disables replicas for applications that support them.

    • databaseName

      public String databaseName
      Database name. IMMUTABLE: Cannot be changed after creation.

    • databaseBackupRetentionDays

      public Integer databaseBackupRetentionDays
      Backup retention period in days. Compliance frameworks may override: PCI-DSS (90 days), HIPAA (30 days), SOC2 (14 days).

    • provisionManagerRedisSessions

      public Boolean provisionManagerRedisSessions
      Provision an ElastiCache Redis cluster and bind CloudForge Manager's own container to it as a shared session store (CFC_MANAGER_SESSION_MODE=redis), so every Manager instance behind the same ALB recognizes sessions any of the others created — the missing piece for running Manager itself horizontally scaled. Only ApplicationFactory acts on this, and only when applicationId == cloudforge-manager; visibleWhen below keeps it out of every other application's deploy form for the same reason. Requires RDS (embedded H2 isn't safe to share across instances) — see ManagerDeploymentPreset.rdsWithRedisSessions(...) in cloudforge-manager-deployment, the typed pairing this mirrors. Single-instance Manager (the common case) needs nothing beyond the in-memory default and should leave this false.

    • provisionManagerAccountCipherKey

      public Boolean provisionManagerAccountCipherKey
      Provision a dedicated AWS Secrets Manager entry holding the AES cipher key CloudForge Manager uses to encrypt cross-account connection secrets (external IDs) at rest — see SecretCipher/AesGcmSecretCipher in cloudforge-manager. Injected into Manager's own ECS task as CFC_MANAGER_ACCOUNT_SECRET_KEY via ecs.Secret.fromSecretsManager(...), mirroring how CFC_MANAGER_DATABASE_PASSWORD is already delivered — never a literal value in the task definition. Only ApplicationFactory acts on this, and only when applicationId == cloudforge-manager. Defaults to true (unlike provisionManagerRedisSessions) because without it Manager silently falls back to PlaintextSecretCipher — leaving it on is the secure-by-default choice for any real AWS deployment of Manager, not an opt-in scaling feature like Redis. Independent of provisionDatabase: even an embedded-H2 Manager deployment benefits from encrypting the secrets it holds.

    • managerLicenseKey

      public String managerLicenseKey
      A customer's LicenseSeat license key (LS-XXXX-XXXX-XXXX-XXXX), injected at deploy time so an install activates immediately instead of requiring a follow-up visit to the owner-only License settings screen after the stack comes up. When set, ApplicationFactory provisions a dedicated Secrets Manager entry for it and ContainerFactory binds that as CFC_MANAGER_LICENSESEAT_LICENSE_KEY — the exact env var ManagerRuntimeConfiguration's "stopgap" path already reads (see its LicenseSeat record javadoc, cloudforge-manager). Purely additive: the in-app License settings screen still works, and a key activated through it still takes precedence (see LicenseKeyStore, cloudforge-manager) — this only seeds the initial value.

      category = "database" despite not being a database setting: it sits right next to provisionManagerAccountCipherKey above for the same reason that field does — InteractiveDeployer.configureDatabaseOptions() is the one place that currently discovers and prompts for manager-only fields by reflection ( ConfigurationIntrospector.discoverVisibleFields(..., "database")); a genuine "security" category discovery pass would also surface ~30 unrelated existing security fields that were never meant for CLI prompting.

    • enableRdsDeletionProtectionRemediation

      public Boolean enableRdsDeletionProtectionRemediation
      Enable RDS deletion protection remediation

    • enableRdsAutoMinorVersionUpgradeRemediation

      public Boolean enableRdsAutoMinorVersionUpgradeRemediation
      Enable RDS auto minor version upgrade remediation

    • complianceFrameworks

      public List<ComplianceFrameworkType> complianceFrameworks
      Compliance frameworks to enable.

      Supports comma-separated string format in JSON for backward compatibility: 

      {"complianceFrameworks": "soc2,pci-dss,hipaa"}

      In Java code, use the type-safe List: 

      config.complianceFrameworks.contains(ComplianceFrameworkType.HIPAA)

    • complianceMode

      public ComplianceMode complianceMode
      Compliance validation mode controlling how validation failures are handled.

    • logRetentionDays

      public String logRetentionDays
      CloudWatch Logs retention days

    • enableMonitoring

      public Boolean enableMonitoring
      Enable CloudWatch monitoring

    • enableEncryption

      public Boolean enableEncryption
      Enable encryption at rest

    • awsConfigEnabled

      public Boolean awsConfigEnabled
      Enable AWS Config

    • createConfigInfrastructure

      public Boolean createConfigInfrastructure
      Create AWS Config infrastructure

    • guardDutyEnabled

      public Boolean guardDutyEnabled
      Enable GuardDuty threat detection

    • createGuardDutyDetector

      public Boolean createGuardDutyDetector
      Create GuardDuty detector (account-region singleton)

    • guardDutyAlertsConfigured

      public Boolean guardDutyAlertsConfigured
      GuardDuty alerts configured (EventBridge to SNS/SIEM)

    • certificateExpirationMonitoring

      public Boolean certificateExpirationMonitoring
      Certificate expiration monitoring enabled

    • cloudTrailEnabled

      public Boolean cloudTrailEnabled
      Enable CloudTrail for API audit logging

    • securityMonitoringEnabled

      public Boolean securityMonitoringEnabled
      Enable security monitoring

    • efsEncryptionInTransitEnabled

      public Boolean efsEncryptionInTransitEnabled
      Enable EFS encryption in transit

    • restrictSecurityGroupEgress

      public Boolean restrictSecurityGroupEgress
      Restrict security group egress to VPC CIDR only (requires VPC endpoints for AWS service access)

    • automatedBackupEnabled

      public Boolean automatedBackupEnabled
      Enable automated backups (null = use security profile default)

    • crossRegionBackupEnabled

      public Boolean crossRegionBackupEnabled
      Enable cross-region backups (null = use security profile default)

    • macieEnabled

      public Boolean macieEnabled
      Enable Amazon Macie for PII/PHI discovery (HIPAA/GDPR)

    • macieAutomatedDiscovery

      public Boolean macieAutomatedDiscovery
      Enable Macie automated discovery jobs

    • securityHubEnabled

      public Boolean securityHubEnabled
      Enable AWS Security Hub for centralized security findings

    • inspectorEnabled

      public Boolean inspectorEnabled
      Enable Amazon Inspector for vulnerability scanning

    • antiMalwareEnabled

      public Boolean antiMalwareEnabled
      Enable anti-malware scanning

    • fileIntegrityMonitoring

      public Boolean fileIntegrityMonitoring
      Enable file integrity monitoring

    • containerRuntimeSecurity

      public Boolean containerRuntimeSecurity
      Enable container runtime security monitoring

    • containerImageScanning

      public Boolean containerImageScanning
      Enable container image vulnerability scanning

    • auditManagerEnabled

      public Boolean auditManagerEnabled
      Enable AWS Audit Manager

    • cloudWatchLogsKmsEncryptionEnabled

      public Boolean cloudWatchLogsKmsEncryptionEnabled
      Enable CloudWatch Logs KMS encryption

    • cloudTrailInsightsEnabled

      public Boolean cloudTrailInsightsEnabled
      Enable CloudTrail Insights

    • route53QueryLoggingEnabled

      public Boolean route53QueryLoggingEnabled
      Enable Route53 Query Logging

    • s3ObjectLockEnabled

      public Boolean s3ObjectLockEnabled
      Enable S3 Object Lock for audit buckets (HIPAA/PCI-DSS immutability requirement)

    • enableS3VersioningRemediation

      public Boolean enableS3VersioningRemediation
      Enable S3 versioning remediation

    • enableCloudTrailBucketAccessRemediation

      public Boolean enableCloudTrailBucketAccessRemediation
      Enable CloudTrail bucket access logging remediation

    • healthCheckGracePeriod

      public int healthCheckGracePeriod

    • healthCheckInterval

      public int healthCheckInterval

    • healthCheckTimeout

      public int healthCheckTimeout

    • healthyThreshold

      public int healthyThreshold

    • unhealthyThreshold

      public int unhealthyThreshold

    • region

      public String region
      AWS region (e.g., "us-east-1", "us-west-2")

    • account

      public String account
      Target AWS account id to pin CDK's Environment.account to at synth time.

      Deliberately not a @ConfigField — ConfigurationIntrospector and DeploymentContextPreparer both skip unannotated fields, so this never appears in the generated deployment-context form/schema and never gets a default resolved for it. It exists purely for callers that already know the target account programmatically (cross-account deploy: CloudForge Manager resolves this from an assumed IAM role before synthesis — see cloudforge-manager's account-connection feature, which owns every concept of "which account" beyond this bare pass-through field).

      When null (the default — every existing caller), behavior is completely unchanged from before this field existed: cloudforge-api's CloudForgeSynthesizer falls back to its prior CDK_DEFAULT_ACCOUNT-env-var-or-omit resolution, producing the same account-agnostic template it always has.

    • gdprDataTransferApproved

      public Boolean gdprDataTransferApproved
      GDPR data transfer approval flag for non-EU deployments.

    • availabilityZones

      public String[] availabilityZones
      Availability zone suffixes for deployment (region-relative — "a" means whichever zone the deploy's own region calls "a", not a specific full zone name, since the same suffix set is valid regardless of which region gets picked elsewhere in the form).

    • enableAutoScaling

      public Boolean enableAutoScaling
      Enable auto-scaling

    • managerUrl

      public String managerUrl
      Base URL of a running CloudForge Manager (e.g. http://127.0.0.1:1958). Optional — when unset/unreachable, deploy history POSTs are skipped.

    • managerTarget

      public DeploymentTarget managerTarget
      Default inventory target for Manager clients (ministack | aws).

    • managerHistoryToken

      public String managerHistoryToken
      Bearer token for POST /api/v1/history. Prefer CFC_MANAGER_HISTORY_TOKEN env — do not commit.

    • managerDirectDeployEnabled

      public Boolean managerDirectDeployEnabled
      Opt-in: grants CloudForge Manager's own task/instance role the direct-deploy IAM capabilities (CFN_DEPLOY/SC_PROVISION — see ManagerAwsCapabilityCatalog), condition-scoped to CloudForge-tagged resources. Only has any effect when this deployment's applicationId is cloudforge-manager; a no-op for every other application. Defaults to false — Manager deploying AWS infrastructure on a caller's behalf (via deploy:create/ deploy:catalog) is a materially broader permission grant than Manager's normal inventory/operator role, so it must be explicitly requested per deployment, not inherited automatically from IAM profile.

  • Constructor Details

    • DeploymentConfig

      public DeploymentConfig()

  • Method Details

    • fromFile

      public static DeploymentConfig fromFile(Path path) throws IOException
      Load DeploymentConfig from a JSON file (e.g., deployment-context.json).
      Parameters:
      path - Path to the JSON file
      Returns:
      DeploymentConfig populated from JSON
      Throws:
      IOException - if file cannot be read or parsed

    • fromFile

      public static DeploymentConfig fromFile(String filePath) throws IOException
      Load DeploymentConfig from a JSON file path string.
      Parameters:
      filePath - Path to the JSON file
      Returns:
      DeploymentConfig populated from JSON
      Throws:
      IOException - if file cannot be read or parsed

    • fromJson

      public static DeploymentConfig fromJson(String json) throws com.fasterxml.jackson.core.JsonProcessingException
      Load DeploymentConfig from a JSON string.
      Parameters:
      json - JSON string
      Returns:
      DeploymentConfig populated from JSON
      Throws:
      com.fasterxml.jackson.core.JsonProcessingException - if JSON cannot be parsed

    • fromMap

      public static DeploymentConfig fromMap(Map<String,Object> map)
      Load DeploymentConfig from a Map (e.g., CDK context).

      Uses Jackson's type-safe conversion to handle:

      • String → Enum conversion via @JsonCreator methods
      • String/Number → Boolean conversion (supports "1", "yes", "0", "no")
      • Comma-separated strings → List conversion (complianceFrameworks)
      • Unknown properties are ignored for forward compatibility
      Parameters:
      map - Map containing configuration key-value pairs
      Returns:
      DeploymentConfig populated from the map

    • toJson

      public String toJson() throws com.fasterxml.jackson.core.JsonProcessingException
      Serialize this DeploymentConfig to a JSON string.
      Returns:
      JSON string representation
      Throws:
      com.fasterxml.jackson.core.JsonProcessingException - if serialization fails

    • toFile

      public void toFile(Path path) throws IOException
      Save this DeploymentConfig to a JSON file.
      Parameters:
      path - Path to write the JSON file
      Throws:
      IOException - if file cannot be written

    • toFile

      public void toFile(String filePath) throws IOException
      Save this DeploymentConfig to a JSON file path string.
      Parameters:
      filePath - Path to write the JSON file
      Throws:
      IOException - if file cannot be written

    • getComplianceFrameworksAsString

      public String getComplianceFrameworksAsString()
      Returns the compliance frameworks as a comma-separated string. Provided for backward compatibility with code expecting the old string format.
      Returns:
      comma-separated framework string (e.g., "soc2,pci-dss,hipaa")

    • hasComplianceFramework

      public boolean hasComplianceFramework(ComplianceFrameworkType framework)
      Checks if a specific compliance framework is enabled.
      Parameters:
      framework - the framework to check
      Returns:
      true if the framework is in the list

    • hasAnyComplianceFramework

      public boolean hasAnyComplianceFramework()
      Checks if any compliance framework is enabled.
      Returns:
      true if at least one framework is configured

    • toContextMap

      public Map<String,Object> toContextMap()
      Convert this DeploymentConfig to a Map for CDK context.

      Special handling:

      • Renames "environment" to "env" for CDK compatibility
      • Excludes null values
      Returns:
      Map suitable for CDK App context

    • toHistoryContextMap

      public Map<String,Object> toHistoryContextMap()
      Context map safe for durable deploy history.

      Same shape as toContextMap(), but omits fields annotated with @ConfigField(sensitive = true) (and their JsonAlias names). New non-sensitive @ConfigFields appear automatically.

      Returns:
      redacted map suitable for Manager history detail.deploymentContext