Class DeploymentConfig

java.lang.Object
com.cloudforge.core.config.DeploymentConfig
public class DeploymentConfig extends Object
Universal deployment configuration for CloudForge applications.

This is the canonical configuration structure used by both interactive deployers and non-interactive deployment tools. It maps directly to deployment-context.json and can be serialized/deserialized via Jackson.

Architecture: This class lives in cloudforge-core (the contract layer) as it defines the data model interface between libraries and consumers. This ensures cloudforge-cli and other consumers always use the latest configuration schema without duplication.

Since:
CloudForge 3.0.0

  • Field Details

    • stackName

      public String stackName
      CloudFormation stack name

    • environment

      public String environment
      Environment name (e.g., "dev", "staging", "production")

    • applicationId

      public String applicationId
      Application identifier (e.g., "jenkins", "gitlab", "vault")

    • applicationName

      public String applicationName
      Human-readable application name

    • applicationSpec

      public ApplicationSpec applicationSpec
      ApplicationSpec instance (not serialized to JSON)

    • subdomain

      public String subdomain
      Subdomain prefix (e.g., "ci", "gitlab") — ordered ahead of domain: you pick what this app is called (the subdomain) before which domain it hangs off of, and the combined result (subdomain + "." + domain) is what gets requested, not the other way around.

    • domain

      public String domain
      Primary domain (e.g., "example.com")

    • fqdn

      public String fqdn
      Fully qualified domain name — always subdomain + "." + domain once both are set; this field only matters when you need to override that computed result directly (e.g. a domain structure the subdomain+domain pair can't express), or when a caller only has the full FQDN available and no reliable way to split it (e.g. recovering it from a live CloudFormation template's ACM certificate, where the domain/subdomain boundary isn't knowable without a hosted-zone lookup). Previously @JsonIgnored on the theory that it should never round-trip as its own JSON key — that silently dropped any caller-supplied override during deserialization (an explicit fqdn in a submitted JSON body was discarded, reverting to null and falling through to the subdomain+domain computation instead), which is the opposite of "override."

    • enableSsl

      public Boolean enableSsl
      Enable SSL certificate via ACM

    • certificateArn

      public String certificateArn
      ARN of an existing ACM certificate to use for the ALB's HTTPS listener, instead of provisioning a new one. Takes priority over both of FargateRuntimeConfiguration's other two certificate paths — the DNS-validated public cert (needs a Route53 hosted zone this deployment controls) and the AWS Private CA cert (issued for the bare ALB DNS name, NOT trusted by browsers — see that class's comments). This is how a deployment gets a publicly-trusted certificate without either of those: import your own cert (issued by any public CA — ACM's own DNS/email validation, Let's Encrypt, a purchased cert, ...) into ACM yourself first (e.g. aws acm import-certificate, entirely within your own account — the key material never has to pass through this deployment config or CloudFormation), then point this at the resulting ARN.

    • runtime

      public RuntimeType runtime
      Runtime type (FARGATE or EC2)

    • topology

      public TopologyType topology
      Topology type — user-selectable, not just an auto-derived display value, so a future topology (or an app implementing more than one applicable interface) isn't locked out of being chosen explicitly. No allowedValues override here on purpose: leaving it unset lets the schema builder enumerate every TopologyType constant automatically — a hardcoded single-value override would hide CMS_SERVICE/JENKINS_SERVICE/S3_WEBSITE from the wizard entirely, locking out a CmsSpec app's actual topology even though DeploymentContextPreparer already defaults to it correctly.

    • securityProfile

      public SecurityProfile securityProfile
      Security profile (DEV, STAGING, PRODUCTION)

    • networkMode

      public NetworkMode networkMode
      Network mode for VPC topology

    • lbType

      public LoadBalancerType lbType
      Load balancer type

    • createZone

      public Boolean createZone
      Create Route53 hosted zone

    • enableFlowlogs

      public Boolean enableFlowlogs
      Enable VPC flow logs

    • wafEnabled

      public Boolean wafEnabled
      Enable AWS WAF

    • httpsStrictEnabled

      public Boolean httpsStrictEnabled
      HTTPS-only mode (no HTTP listener when SSL enabled)

    • albAccessLogging

      public Boolean albAccessLogging
      Enable ALB access logs to S3. Null means the security profile decides.

    • cloudfrontEnabled

      public Boolean cloudfrontEnabled
      Enable CloudFront CDN

    • bastionCidr

      public String bastionCidr
      CIDR for bastion/VPN SSH access

    • minInstanceCapacity

      public int minInstanceCapacity
      Minimum instance capacity for auto-scaling

    • maxInstanceCapacity

      public int maxInstanceCapacity
      Maximum instance capacity for auto-scaling

    • cpuTargetUtilization

      public int cpuTargetUtilization
      CPU target utilization percentage for auto-scaling

    • cpu

      public int cpu
      Fargate CPU units (256, 512, 1024, 2048, 4096)

    • memory

      public int memory
      Fargate memory in MB

    • instanceType

      public String instanceType
      EC2 instance type (e.g., "t3.micro", "t3.small")

    • containerImage

      public String containerImage
      Override container image tag

    • retainStorage

      public Boolean retainStorage
      Retain EFS/EBS volumes on stack deletion

    • existingFileSystemId

      public String existingFileSystemId
      Reuse existing EFS by ID (for disaster recovery workflows)

    • artifactsBucket

      public String artifactsBucket
      S3 bucket for artifacts

    • artifactsPrefix

      public String artifactsPrefix
      S3 prefix for artifacts

    • authMode

      public AuthMode authMode
      Authentication mode

    • oidcProvider

      public String oidcProvider
      OIDC provider (none, cognito, identity-center, external-idp)

    • protectedPaths

      public List<String> protectedPaths
      URL path patterns that require authentication, replacing the application's own default list (ApplicationSpec#protectedPaths()) when set. Consumed by both CognitoAuthenticationFactory and OidcAuthenticationFactory -- see their calculateEffectiveProtectedPaths(): unset/empty means "use the application's default protected paths", not "protect nothing".

    • additionalProtectedPaths

      public List<String> additionalProtectedPaths
      Additional URL path patterns requiring authentication, added on top of whichever base list (protectedPaths or the application default) is in effect.

    • publicPaths

      public List<String> publicPaths
      URL path patterns explicitly excluded from authentication, removed from the effective protected-paths list after protectedPaths/additionalProtectedPaths and the application's own defaults are combined.

    • cognitoAutoProvision

      public Boolean cognitoAutoProvision
      Auto-provision new Cognito User Pool

    • cognitoUserPoolName

      public String cognitoUserPoolName
      Cognito User Pool name

    • cognitoDomainPrefix

      public String cognitoDomainPrefix
      Cognito domain prefix (must be globally unique)

    • cognitoMfaEnabled

      public Boolean cognitoMfaEnabled
      Enable MFA for Cognito

    • cognitoMfaMethod

      public String cognitoMfaMethod
      Cognito MFA method

    • cognitoSelfSignupEnabled

      public Boolean cognitoSelfSignupEnabled
      Overrides the security-profile default for whether users can self-register on the Cognito hosted UI (development defaults to allowed, staging/production to admin-only). Left null, the profile default applies unchanged. Self-signup is not enforced by any compliance framework rule today — a self-registered user still gets no group membership and resolves to the lowest-privilege role — but enabling it while a compliance framework is active (advisory or enforce) logs a warning at synthesis time, since open self-registration into an ops panel is a common audit finding independent of what role it grants.

    • cognitoCreateGroups

      public Boolean cognitoCreateGroups
      Create admin and user groups in Cognito

    • cognitoAdminGroupName

      public String cognitoAdminGroupName
      Admin group name

    • cognitoUserGroupName

      public String cognitoUserGroupName
      User group name

    • cognitoInitialAdminEmail

      public String cognitoInitialAdminEmail
      Initial admin email address

    • cognitoInitialAdminPhone

      public String cognitoInitialAdminPhone
      Initial admin phone number (E.164 format)

    • cognitoUserPoolId

      public String cognitoUserPoolId
      Existing Cognito User Pool ID

    • cognitoAppClientId

      public String cognitoAppClientId
      Existing Cognito App Client ID

    • cognitoUserPoolClientId

      public String cognitoUserPoolClientId
      Manually configured Cognito app client ID, for a client that wasn't auto-provisioned. Distinct from cognitoAppClientId above (used to reference an *existing user pool's* client when cognitoAutoProvision == false) -- this is read directly by ApplicationOidcFactory as a manual-configuration fallback.

    • oidcIssuer

      public String oidcIssuer
      OIDC issuer URL

    • cloudforgeManagerIssuerUrl

      public String cloudforgeManagerIssuerUrl
      CloudForge Manager's own public URL, used as the OIDC issuer when this app trusts a CloudForge Manager install as its identity provider (see com.cloudforgeci.manager.auth.oidcprovider's own package javadoc). Authorization/token/ userinfo endpoints are computed from this one URL (CloudForge Manager's OIDC-provider endpoints are at fixed paths — /oauth2/authorize, /oauth2/token, /userinfo — so unlike the generic external-idp option above, only the base URL needs entering here, not each endpoint separately).

    • oidcAuthorizationEndpoint

      public String oidcAuthorizationEndpoint
      OIDC authorization endpoint

    • oidcTokenEndpoint

      public String oidcTokenEndpoint
      OIDC token endpoint

    • oidcUserInfoEndpoint

      public String oidcUserInfoEndpoint
      OIDC user info endpoint

    • oidcClientId

      public String oidcClientId
      OIDC client ID — shared by external-idp and cloudforge-manager, both providers where an admin registers this app's client credentials by hand (external IdP's own console, or CloudForge Manager's Trusted Apps settings page) rather than CloudForge auto-provisioning them, so the field means the same thing either way.

    • oidcClientSecretName

      public String oidcClientSecretName
      OIDC client secret name in Secrets Manager — same sharing rationale as oidcClientId.

    • enableAgents

      public boolean enableAgents
      Enable JNLP build agent port (Jenkins: 50000)

    • enableSsh

      public boolean enableSsh
      Enable Git SSH port (GitLab: 22, Gitea: 2222)

    • enableSmtp

      public boolean enableSmtp
      Enable SMTP email port (Mattermost: 587)

    • enableSmtps

      public boolean enableSmtps
      Enable SMTP TLS email port (Mattermost: 465)

    • enableClustering

      public boolean enableClustering
      Enable clustering ports (Mattermost: 8074-8075, Vault: 8201)

    • enableDockerRegistry

      public boolean enableDockerRegistry
      Enable container registry port (GitLab: 5050, Nexus: 5000-5002)

    • enableMetrics

      public boolean enableMetrics
      Enable Prometheus metrics port (GitLab: 9090)

    • enableNotary

      public boolean enableNotary
      Enable Notary content trust port (Harbor: 4443)

    • enableTrivy

      public boolean enableTrivy
      Enable Trivy vulnerability scanner port (Harbor: 8080)

    • enableSentinel

      public boolean enableSentinel
      Enable Redis Sentinel port (Redis: 26379)

    • enableCluster

      public boolean enableCluster
      Enable Redis Cluster bus port (Redis: 16379)

    • autoProvisionIdentityCenter

      public Boolean autoProvisionIdentityCenter
      Auto-provision SAML application in IAM Identity Center

    • ssoInstanceArn

      public String ssoInstanceArn
      IAM Identity Center (SSO) Instance ARN

    • ssoGroupId

      public String ssoGroupId
      SSO Group ID

    • ssoTargetAccountId

      public String ssoTargetAccountId
      SSO Target Account ID

    • identityCenterGroupName

      public String identityCenterGroupName
      Identity Center group name for user assignment

    • provisionDatabase

      public Boolean provisionDatabase
      Provision RDS database for application. Only shown for applications with optional database support (e.g., Metabase, Grafana). Applications requiring database (e.g., Mattermost, GitLab) always provision one.

    • databaseEngine

      public String databaseEngine
      Database engine (e.g., postgres, mysql, mariadb). Default comes from ApplicationSpec.databaseRequirement().engine()

      Deliberately no static default here (nor on the other database* fields below with a defaultFrom): DeploymentContextPreparer only applies a field's defaultFrom-resolved ApplicationSpec value when the field is currently null/blank, so a non-null Java initializer would always look "already set" and block that resolution. Mixing a caller-supplied engine with a static default version can then produce an invalid combination (e.g. databaseEngine=mysql with a Postgres version yields a nonexistent "mysql15" RDS parameter group family). cloudforge-api's ApplicationFactory merges these fields against ApplicationSpec.databaseRequirement() with the same null-check pattern.

    • databaseVersion

      public String databaseVersion
      Database engine version. Default comes from ApplicationSpec.databaseRequirement().effectiveDefaultVersion(). The application's declared version is a minimum: a higher version may be chosen, a lower one is rejected, and a version above the application's tested maximum is accepted with a warning.

    • databaseInstanceClass

      public String databaseInstanceClass
      RDS instance class (e.g., db.t3.small, db.m5.large). DESTRUCTIVE: Changing this requires resource replacement. BILLING_IMPACT: Larger instances cost more.

    • databaseAllocatedStorageGB

      public Integer databaseAllocatedStorageGB
      Allocated storage in GB. BILLING_IMPACT: More storage costs more.

    • databaseMultiAz

      public Boolean databaseMultiAz
      Enable Multi-AZ deployment for high availability. BILLING_IMPACT: Multi-AZ doubles database costs.

      Deliberately no static default: any non-null value is treated as an explicit override of the security profile, so a false initializer would keep PRODUCTION and compliance-driven Multi-AZ from ever applying. When unset, the profile decides.

    • rdsAutoMinorVersionUpgrade

      public Boolean rdsAutoMinorVersionUpgrade
      Automatic minor-version upgrades for the RDS instance.

      Deliberately no static default: unset lets RdsFactory fall back to its security-profile default (PRODUCTION only). A false initializer would make an explicit override indistinguishable from "not set".

    • performanceInsightsEnabled

      public Boolean performanceInsightsEnabled
      RDS Performance Insights (query-level performance monitoring).

      Deliberately no static default -- see databaseMultiAz. RdsFactory also skips this regardless of override on instance classes too small to support it (e.g. db.t3.micro).

    • rdsEnhancedMonitoringEnabled

      public Boolean rdsEnhancedMonitoringEnabled
      RDS Enhanced Monitoring (OS-level metrics at a configurable interval).

      Deliberately no static default -- see databaseMultiAz.

    • databaseReadReplicaCount

      public Integer databaseReadReplicaCount
      Optional number of RDS read replicas. When unset, an application may provide its own default (CloudForge Manager defaults to one); zero explicitly disables replicas for applications that support them.

    • databaseName

      public String databaseName
      Database name. IMMUTABLE: Cannot be changed after creation.

    • databaseBackupRetentionDays

      public Integer databaseBackupRetentionDays
      Backup retention period in days. Compliance frameworks may override: PCI-DSS (90 days), HIPAA (30 days), SOC2 (14 days).

    • provisionManagerRedisSessions

      public Boolean provisionManagerRedisSessions
      Provision an ElastiCache Redis cluster and bind CloudForge Manager's own container to it as a shared session store (CFC_MANAGER_SESSION_MODE=redis), so every Manager instance behind the same ALB recognizes sessions any of the others created — the missing piece for running Manager itself horizontally scaled. Only ApplicationFactory acts on this, and only when applicationId == "cloudforge-manager"; visibleWhen below keeps it out of every other application's deploy form for the same reason. Requires RDS (embedded H2 isn't safe to share across instances) — see ManagerDeploymentPreset.rdsWithRedisSessions(...) in cloudforge-manager-deployment, the typed pairing this mirrors. Single-instance Manager (the common case) needs nothing beyond the in-memory default and should leave this false.

    • provisionManagerAccountCipherKey

      public Boolean provisionManagerAccountCipherKey
      Provision a dedicated AWS Secrets Manager entry holding the AES cipher key CloudForge Manager uses to encrypt cross-account connection secrets (external IDs) at rest — see SecretCipher/AesGcmSecretCipher in cloudforge-manager. Injected into Manager's own ECS task as CFC_MANAGER_ACCOUNT_SECRET_KEY via ecs.Secret.fromSecretsManager(...), mirroring how CFC_MANAGER_DATABASE_PASSWORD is already delivered — never a literal value in the task definition. Only ApplicationFactory acts on this, and only when applicationId == cloudforge-manager. Defaults to true (unlike provisionManagerRedisSessions) because without it Manager falls back to PlaintextSecretCipher — leaving it on is the secure-by-default choice for any AWS deployment of Manager, not an opt-in scaling feature like Redis. Independent of provisionDatabase: even an embedded-H2 Manager deployment benefits from encrypting the secrets it holds.

    • managerLicenseKey

      public String managerLicenseKey
      A customer's LicenseSeat license key (CFC-XXXX-XXXX-XXXX-XXXX), injected at deploy time so an install activates immediately instead of requiring a follow-up visit to the owner-only License settings screen after the stack comes up. When set, ApplicationFactory provisions a dedicated Secrets Manager entry for it and ContainerFactory binds that as CFC_MANAGER_LICENSESEAT_LICENSE_KEY — the exact env var ManagerRuntimeConfiguration reads for its environment-supplied license key (see its LicenseSeat record javadoc, cloudforge-manager). Purely additive: the in-app License settings screen still works, and a key activated through it still takes precedence (see LicenseKeyStore, cloudforge-manager) — this only seeds the initial value.

      category = "database" despite not being a database setting: it sits right next to provisionManagerAccountCipherKey above for the same reason that field does — InteractiveDeployer.configureDatabaseOptions() is the one place that currently discovers and prompts for manager-only fields by reflection ( ConfigurationIntrospector.discoverVisibleFields(..., "database")); a "security" category discovery pass would also surface ~30 unrelated existing security fields that were never meant for CLI prompting.

    • enableRdsDeletionProtectionRemediation

      public Boolean enableRdsDeletionProtectionRemediation
      Enable RDS deletion protection remediation

    • enableRdsAutoMinorVersionUpgradeRemediation

      public Boolean enableRdsAutoMinorVersionUpgradeRemediation
      Enable RDS auto minor version upgrade remediation

    • complianceFrameworks

      public List<ComplianceFrameworkType> complianceFrameworks
      Compliance frameworks to enable.

      Supports comma-separated string format in JSON for backward compatibility: 

      {"complianceFrameworks": "soc2,pci-dss,hipaa"}

      In Java code, use the type-safe List: 

      config.complianceFrameworks.contains(ComplianceFrameworkType.HIPAA)

    • complianceFrameworksRawOverride

      public transient String complianceFrameworksRawOverride
      Raw compliance-framework token override for an on-demand advisory check (see CloudForgeSynthesizer#synthesizeAdvisoryDryRun) -- lets a caller ask cdk-nag / FrameworkRules to validate against tokens with no ComplianceFrameworkType entry at all (e.g. "ISO-27001", or "AWS-BEST-PRACTICES" for cdk-nag's own generic AwsSolutionsChecks fallback pack — see SecurityRules#mapFrameworkToNagPack's default case), without extending the license-gated complianceFrameworks enum real deploys use. Comma-separated, same format complianceFrameworks itself serializes to.

      Deliberately NOT part of toContextMap()'s output: the "cfc" context map it builds gets round-tripped back through a strict DeploymentConfig deserialization inside DeploymentContext.from (jsii construct-tree plumbing), and that round trip enforces the same ComplianceFrameworkType enum this field exists specifically to bypass — feeding it through that key would just re-throw the same "unknown compliance framework" error one layer later. CloudForgeSynthesizer#synthesize instead seeds this under its own separate, sibling top-level CDK context key (not nested in "cfc" at all), and SecurityRules#install reads it directly off the construct tree rather than through DeploymentContext. transient/@JsonIgnore since it must never round-trip through a saved deployment context the way every other field here does.

    • auditManagerFrameworkId

      public String auditManagerFrameworkId
      Legacy single-framework override, superseded by complianceFrameworks (which supports multiple). Kept for backward compatibility with older deployment contexts.

    • complianceMode

      public ComplianceMode complianceMode
      Compliance validation mode controlling how validation failures are handled.

    • logRetentionDays

      public String logRetentionDays
      CloudWatch Logs retention days

    • enableMonitoring

      public Boolean enableMonitoring
      Enable CloudWatch monitoring

    • enableEncryption

      public Boolean enableEncryption
      Enable encryption at rest

    • awsConfigEnabled

      public Boolean awsConfigEnabled
      Enable AWS Config

    • createConfigInfrastructure

      public Boolean createConfigInfrastructure
      Create AWS Config infrastructure — an account+region-wide singleton (AWS allows exactly one recorder and one delivery channel per account per region), so this must stay an explicit, single-stack-only opt-in. false by default, same as awsConfigEnabled: unset means neither compliance rules nor the recorder/channel they'd attach to ever get created.

    • scopeConfigRulesToDeployment

      public Boolean scopeConfigRulesToDeployment
      Scope AWS Config rules to only monitor this deployment's own resources (by stack name) instead of every resource in the account/region.

    • guardDutyEnabled

      public Boolean guardDutyEnabled
      Enable GuardDuty threat detection. Deliberately no static default -- see macieEnabled. isGuardDutyEnabled() falls back to "always enabled for production" when unset; a false initializer here would make every deployment look like an explicit opt-out, permanently skipping both that fallback and the compliance-matrix requirement check ahead of it.

    • createGuardDutyDetector

      public Boolean createGuardDutyDetector
      Create GuardDuty detector (account-region singleton). Deliberately no static default -- see guardDutyEnabled above; GuardDutyFactory only auto-sets this to true when it's unset.

    • guardDutyAlertsConfigured

      public Boolean guardDutyAlertsConfigured
      GuardDuty alerts configured (EventBridge to SNS/SIEM)

    • certificateExpirationMonitoring

      public Boolean certificateExpirationMonitoring
      Certificate expiration monitoring enabled

    • cloudTrailEnabled

      public Boolean cloudTrailEnabled
      Enable CloudTrail for API audit logging

    • securityMonitoringEnabled

      public Boolean securityMonitoringEnabled
      Enable security monitoring

    • efsEncryptionInTransitEnabled

      public Boolean efsEncryptionInTransitEnabled
      Enable EFS encryption in transit

    • restrictSecurityGroupEgress

      public Boolean restrictSecurityGroupEgress
      Restrict security group egress to VPC CIDR only (requires VPC endpoints for AWS service access)

    • automatedBackupEnabled

      public Boolean automatedBackupEnabled
      Enable automated backups (null = use security profile default)

    • crossRegionBackupEnabled

      public Boolean crossRegionBackupEnabled
      Enable cross-region backups (null = use security profile default)

    • backupCrossRegionVaultArn

      public String backupCrossRegionVaultArn
      ARN of the AWS Backup vault, in another region, that backups are copied to.

    • macieEnabled

      public Boolean macieEnabled
      Enable Amazon Macie for PII/PHI discovery (HIPAA/GDPR). Deliberately no static default -- see crossRegionBackupEnabled. Left unset, isMacieEnabled() falls through to the compliance-matrix requirement and then the profile default; a false initializer here would make every deployment look like an explicit opt-out, permanently skipping both.

    • macieAutomatedDiscovery

      public Boolean macieAutomatedDiscovery
      Enable Macie automated discovery jobs

    • securityHubEnabled

      public Boolean securityHubEnabled
      Enable AWS Security Hub for centralized security findings. Deliberately no static default -- see macieEnabled above.

    • securityHubCisEnabled

      public Boolean securityHubCisEnabled
      Enable the CIS AWS Foundations Benchmark standard in Security Hub

    • securityHubCisVersion

      public String securityHubCisVersion
      CIS AWS Foundations Benchmark version to enable. AWS has shipped 1.2.0, 1.4.0, 3.0.0, and 5.0.0 as coexisting standard versions over time -- configurable so a future version bump is a config change, not a code change.

    • securityHubAwsFoundationalEnabled

      public Boolean securityHubAwsFoundationalEnabled
      Enable the AWS Foundational Security Best Practices standard in Security Hub

    • securityHubFsbpVersion

      public String securityHubFsbpVersion
      AWS Foundational Security Best Practices version to enable. Has stayed at 1.0.0 since the standard launched in 2020 (controls are added within the version, not by version bump), but configurable for consistency with the other two standards.

    • securityHubPciDssEnabled

      public Boolean securityHubPciDssEnabled
      Enable the PCI DSS standard in Security Hub

    • securityHubPciDssVersion

      public String securityHubPciDssVersion
      PCI DSS version to enable. 4.0.1 is current -- the PCI Council retired the prior version, and AWS Security Hub follows suit. Configurable for the next version bump.

    • inspectorEnabled

      public Boolean inspectorEnabled
      Enable Amazon Inspector for vulnerability scanning. Deliberately no static default -- see macieEnabled above.

    • inspectorEc2Scanning

      public Boolean inspectorEc2Scanning
      Enable Inspector EC2 instance scanning

    • inspectorEcrScanning

      public Boolean inspectorEcrScanning
      Enable Inspector ECR image scanning

    • antiMalwareEnabled

      public Boolean antiMalwareEnabled
      Enable anti-malware scanning

    • fileIntegrityMonitoring

      public Boolean fileIntegrityMonitoring
      Enable file integrity monitoring

    • containerRuntimeSecurity

      public Boolean containerRuntimeSecurity
      Enable container runtime security monitoring

    • containerImageScanning

      public Boolean containerImageScanning
      Enable container image vulnerability scanning

    • auditManagerEnabled

      public Boolean auditManagerEnabled
      Enable AWS Audit Manager

    • auditManagerServiceEnabled

      public Boolean auditManagerServiceEnabled
      Enable the AWS Audit Manager service itself (null = use security profile default).

      This is distinct from auditManagerEnabled, which is the master gate SecurityRules.install() uses to decide whether any CloudForge FrameworkRules compliance validation runs at all. This field is the independent, configurable fact of whether the Audit Manager service should actually be provisioned/enabled for a given deployment -- it is what SecurityProfileConfiguration#isAuditManagerEnabled() reads.

    • cloudWatchLogsKmsEncryptionEnabled

      public Boolean cloudWatchLogsKmsEncryptionEnabled
      Enable CloudWatch Logs KMS encryption

    • cloudTrailInsightsEnabled

      public Boolean cloudTrailInsightsEnabled
      Enable CloudTrail Insights

    • route53QueryLoggingEnabled

      public Boolean route53QueryLoggingEnabled
      Enable Route53 Query Logging

    • s3ObjectLockEnabled

      public Boolean s3ObjectLockEnabled
      Enable S3 Object Lock for audit buckets (HIPAA/PCI-DSS immutability requirement)

    • ebsEncryptionEnabled

      public Boolean ebsEncryptionEnabled
      Enable EBS volume encryption (null = profile default: PRODUCTION/STAGING=true unless the compliance matrix already requires it, DEV=true). Independent of efsEncryptionAtRestEnabled and s3EncryptionEnabled -- every framework's Rules.java reads these as 3 separate controls.

    • efsEncryptionAtRestEnabled

      public Boolean efsEncryptionAtRestEnabled
      Enable EFS at-rest encryption (null = profile default). See ebsEncryptionEnabled.

    • s3EncryptionEnabled

      public Boolean s3EncryptionEnabled
      Enable S3 bucket encryption (null = profile default). See ebsEncryptionEnabled.

    • backupVaultLockEnabled

      public Boolean backupVaultLockEnabled
      Enable AWS Backup Vault Lock (null = profile default: false except when the compliance matrix requires BACKUP_RECOVERY). Vault Lock makes the vault's retention policy immutable.

    • backupVaultRetentionEnabled

      public Boolean backupVaultRetentionEnabled
      Retain the AWS Backup vault on stack deletion (null = profile default).

    • rdsDeletionProtectionEnabled

      public Boolean rdsDeletionProtectionEnabled
      Enable RDS deletion protection (null = profile default: PRODUCTION=false unless the compliance matrix requires DELETION_PROTECTION, STAGING/DEV=false).

    • rdsDatabaseMultiAzEnabled

      public Boolean rdsDatabaseMultiAzEnabled
      Enable RDS Multi-AZ (null = profile default: PRODUCTION=true, STAGING/DEV=false unless the compliance matrix requires DATABASE_MULTI_AZ).

    • snsKmsEncryptionEnabled

      public Boolean snsKmsEncryptionEnabled
      Enable SNS topic KMS encryption (null = profile default: false unless the compliance matrix requires SNS_KMS_ENCRYPTION).

    • imdsv2Required

      public Boolean imdsv2Required
      Require IMDSv2 on EC2 instances (null = profile default: PRODUCTION/STAGING=true unless the compliance matrix requires EC2_IMDSV2, DEV=false). ADVISORY for PCI-DSS and GDPR -- this field is what lets a deployer opt out where the framework doesn't mandate it.

    • enableS3VersioningRemediation

      public Boolean enableS3VersioningRemediation
      Enable S3 versioning remediation

    • enableCloudTrailBucketAccessRemediation

      public Boolean enableCloudTrailBucketAccessRemediation
      Enable CloudTrail bucket access logging remediation

    • enableGuardDutyRemediation

      public Boolean enableGuardDutyRemediation
      Enable GuardDuty finding remediation (null = profile default: auto-enabled in PRODUCTION, same pattern as imdsv2Required -- ComplianceFactory's consumers treat null as "PRODUCTION enables it, otherwise off" and an explicit value as an override either way, so this must NOT get a static default or that fallback can never trigger.

    • enableSecurityHubRemediation

      public Boolean enableSecurityHubRemediation
      Enable Security Hub finding remediation. Deliberately no static default -- see enableGuardDutyRemediation.

    • enableInspectorRemediation

      public Boolean enableInspectorRemediation
      Enable Inspector finding remediation. Deliberately no static default -- see enableGuardDutyRemediation.

    • enableMacieRemediation

      public Boolean enableMacieRemediation
      Enable Macie finding remediation. Deliberately no static default -- see enableGuardDutyRemediation.

    • healthCheckGracePeriod

      public int healthCheckGracePeriod

    • healthCheckInterval

      public int healthCheckInterval

    • healthCheckTimeout

      public int healthCheckTimeout

    • healthyThreshold

      public int healthyThreshold

    • unhealthyThreshold

      public int unhealthyThreshold

    • region

      public String region
      AWS region (e.g., "us-east-1", "us-west-2")

    • account

      public String account
      Target AWS account id to pin CDK's Environment.account to at synth time.

      Deliberately not a @ConfigField — ConfigurationIntrospector and DeploymentContextPreparer both skip unannotated fields, so this never appears in the generated deployment-context form/schema and never gets a default resolved for it. It exists purely for callers that already know the target account programmatically (cross-account deploy: CloudForge Manager resolves this from an assumed IAM role before synthesis — see cloudforge-manager's account-connection feature, which owns every concept of "which account" beyond this bare pass-through field).

      When null (the default), cloudforge-api's CloudForgeSynthesizer falls back to CDK_DEFAULT_ACCOUNT if set, or omits the account, producing an account-agnostic template.

    • gdprDataTransferApproved

      public Boolean gdprDataTransferApproved
      GDPR data transfer approval flag for non-EU deployments.

    • availabilityZones

      public String[] availabilityZones
      Availability zone suffixes for deployment (region-relative — "a" means whichever zone the deploy's own region calls "a", not a specific full zone name, since the same suffix set is valid regardless of which region gets picked elsewhere in the form).

    • enableAutoScaling

      public Boolean enableAutoScaling
      Enable auto-scaling

    • managerDirectDeployEnabled

      public Boolean managerDirectDeployEnabled
      Opt-in: grants CloudForge Manager's own task/instance role the direct-deploy IAM capability (CFN_DEPLOY — see ManagerAwsCapabilityCatalog), condition-scoped to CloudForge-tagged resources. Only has any effect when this deployment's applicationId is cloudforge-manager; a no-op for every other application. Defaults to false — Manager deploying AWS infrastructure on a caller's behalf (via deploy:create) is a materially broader permission grant than Manager's normal inventory/operator role, so it must be explicitly requested per deployment, not inherited automatically from IAM profile.

  • Constructor Details

    • DeploymentConfig

      public DeploymentConfig()

  • Method Details

    • fromFile

      public static DeploymentConfig fromFile(Path path) throws IOException
      Load DeploymentConfig from a JSON file (e.g., deployment-context.json).
      Parameters:
      path - Path to the JSON file
      Returns:
      DeploymentConfig populated from JSON
      Throws:
      IOException - if file cannot be read or parsed

    • fromFile

      public static DeploymentConfig fromFile(String filePath) throws IOException
      Load DeploymentConfig from a JSON file path string.
      Parameters:
      filePath - Path to the JSON file
      Returns:
      DeploymentConfig populated from JSON
      Throws:
      IOException - if file cannot be read or parsed

    • fromJson

      public static DeploymentConfig fromJson(String json) throws com.fasterxml.jackson.core.JsonProcessingException
      Load DeploymentConfig from a JSON string.
      Parameters:
      json - JSON string
      Returns:
      DeploymentConfig populated from JSON
      Throws:
      com.fasterxml.jackson.core.JsonProcessingException - if JSON cannot be parsed

    • fromMap

      public static DeploymentConfig fromMap(Map<String,Object> map)
      Load DeploymentConfig from a Map (e.g., CDK context).

      Uses Jackson's type-safe conversion to handle:

      • String → Enum conversion via @JsonCreator methods
      • String/Number → Boolean conversion (supports "1", "yes", "0", "no")
      • Comma-separated strings → List conversion (complianceFrameworks)
      • Unknown properties are ignored for forward compatibility
      Parameters:
      map - Map containing configuration key-value pairs
      Returns:
      DeploymentConfig populated from the map

    • toJson

      public String toJson() throws com.fasterxml.jackson.core.JsonProcessingException
      Serialize this DeploymentConfig to a JSON string.
      Returns:
      JSON string representation
      Throws:
      com.fasterxml.jackson.core.JsonProcessingException - if serialization fails

    • toFile

      public void toFile(Path path) throws IOException
      Save this DeploymentConfig to a JSON file.
      Parameters:
      path - Path to write the JSON file
      Throws:
      IOException - if file cannot be written

    • toFile

      public void toFile(String filePath) throws IOException
      Save this DeploymentConfig to a JSON file path string.
      Parameters:
      filePath - Path to write the JSON file
      Throws:
      IOException - if file cannot be written

    • getComplianceFrameworksAsString

      public String getComplianceFrameworksAsString()
      Returns the compliance frameworks as a comma-separated string. Provided for backward compatibility with code expecting the old string format.
      Returns:
      comma-separated framework string (e.g., "soc2,pci-dss,hipaa")

    • hasComplianceFramework

      public boolean hasComplianceFramework(ComplianceFrameworkType framework)
      Checks if a specific compliance framework is enabled.
      Parameters:
      framework - the framework to check
      Returns:
      true if the framework is in the list

    • hasAnyComplianceFramework

      public boolean hasAnyComplianceFramework()
      Checks if any compliance framework is enabled.
      Returns:
      true if at least one framework is configured

    • toContextMap

      public Map<String,Object> toContextMap()
      Convert this DeploymentConfig to a Map for CDK context.

      Special handling:

      • Renames "environment" to "env" for CDK compatibility
      • Excludes null values
      Returns:
      Map suitable for CDK App context