Package com.cloudforgeci.api.core

Class DeploymentContext

java.lang.Object
com.cloudforgeci.api.core.DeploymentContext
public final class DeploymentContext extends Object
Typed configuration interface for CDK deployment context.

Loads configuration from cdk.json "cfc" block or CLI flags (-c key = value). Provides type-safe access with validation and sensible defaults.

Quick Start Example (cdk.json):

 {
   "app": "...",
   "context": {
     "cfc": {
       "runtime": "fargate",
       "topology": "jenkins-service",
       "env": "dev",
       "domain": "example.com",
       "subdomain": "jenkins",
       "enableSsl": true,
       "authMode": "alb-oidc",
       "cognitoAutoProvision": true,
       "cognitoDomainPrefix": "myapp-auth",
       "cognitoMfaEnabled": true
     }
   }
 }

Configuration Keys (all optional unless noted):

Core Settings:

  • tier: "public" | "enterprise" (default: public)
  • runtime: "ec2" | "fargate" (default: fargate)
  • topology: "jenkins-single-node" | "jenkins-service" | "s3-website"
  • env: "dev" | "stage" | "prod" (default: dev)
  • securityProfile: "dev" | "staging" | "production" (default: dev)
  • region: AWS region (default: us-east-1)

DNS & SSL:

  • domain: Base domain (e.g., "example.com")
  • subdomain: Subdomain prefix (e.g., "jenkins")
  • fqdn: Full domain (e.g., "jenkins.example.com") - overrides domain+subdomain
  • enableSsl: Enable HTTPS with ACM certificate (default: false)
  • createZone: Create Route53 hosted zone (default: false)

Network & Security:

  • networkMode: "public-no-nat" | "private-with-nat" (default: public-no-nat)
  • wafEnabled: Enable AWS WAF (default: false)
  • albAccessLogging: Enable ALB access logs to S3 (default: false)
  • cloudfront: Enable CloudFront distribution (default: false)
  • bastionCidr: CIDR for SSH bastion access (default: 10.0.1.0/24)

Authentication:

  • authMode: "none" | "alb-oidc" | "jenkins-oidc" | "application-oidc" (default: none)

Cognito (Auto-provision User Pool):

  • cognitoAutoProvision: Auto-create Cognito User Pool (default: false)
  • cognitoDomainPrefix: Globally unique domain prefix (required if auto-provisioning)
  • cognitoUserPoolName: User Pool name (optional)
  • cognitoMfaEnabled: Enable MFA (default: false)
  • cognitoMfaMethod: "totp" | "sms" | "both" (default: "both")
  • cognitoCreateGroups: Create admin/user groups (default: true)
  • cognitoAdminGroupName: Admin group name (default: "Jenkins-Admins")
  • cognitoUserGroupName: User group name (default: "Jenkins-Users")
  • cognitoUserPoolId: Existing User Pool ID (for reuse)
  • cognitoAppClientId: Existing App Client ID (for reuse)
  • cognitoInitialAdminEmail: Initial admin user email (optional)
  • cognitoInitialAdminPhone: Initial admin user phone in E.164 format, e.g., +12025551234 (optional, required for SMS MFA)

Manual OIDC (Identity Center, Okta, Auth0):

  • oidcIssuer: OIDC issuer URL
  • oidcAuthorizationEndpoint: Authorization endpoint
  • oidcTokenEndpoint: Token endpoint
  • oidcUserInfoEndpoint: UserInfo endpoint
  • oidcClientId: OIDC client ID
  • oidcClientSecretName: Secrets Manager secret name (default: "jenkins/oidc/client-secret")

Legacy IAM Identity Center:

  • ssoInstanceArn: IAM Identity Center instance ARN
  • ssoGroupId: Group UUID
  • ssoTargetAccountId: 12-digit account ID
  • autoProvisionIdentityCenter: Auto-provision (default: false)
  • identityCenterGroupName: Group name (default: "Jenkins-Users")

Compute & Scaling:

  • lbType: "alb" | "nlb" (default: alb)
  • instanceType: EC2 type (default: t3.micro)
  • cpu: Fargate vCPU units (default: 1024)
  • memory: Fargate memory MiB (default: 2048)
  • containerImage: Override container image tag, e.g., "v1.2.3" or "2024.1" (default: uses tag from ApplicationSpec)
  • minInstanceCapacity: Min instances (default: 1)
  • maxInstanceCapacity: Max instances (default: 1)
  • cpuTargetUtilization: CPU target % (default: 60)

Monitoring & Compliance:

  • enableMonitoring: CloudWatch monitoring (default: true)
  • enableEncryption: Encryption at rest (default: true)
  • logRetentionDays: CloudWatch log retention (default: security profile default)
  • awsConfigEnabled: AWS Config compliance (default: false)
  • securityMonitoringEnabled: Enable security monitoring (default: false)
  • efsEncryptionInTransitEnabled: Enable EFS encryption in transit (default: profile default)
  • automatedBackupEnabled: Enable automated backups (default: profile default)
  • crossRegionBackupEnabled: Enable cross-region backups (default: profile default)
  • complianceMode: "enforce" | "advisory" (auto: enforce for PRODUCTION, advisory for DEV/STAGING)
  • complianceFrameworks: "PCI-DSS,HIPAA,SOC2,GDPR" (comma-separated)

Health Checks:

  • healthCheckGracePeriod: Grace period seconds (default: 300)
  • healthCheckInterval: Interval seconds (default: 30)
  • healthCheckTimeout: Timeout seconds (default: 5)
  • healthyThreshold: Healthy count (default: 2)
  • unhealthyThreshold: Unhealthy count (default: 3)

Storage:

  • artifactsBucket: S3 bucket name (optional)
  • artifactsPrefix: S3 prefix (default: "jenkins/job/${JOB_NAME}/${BUILD_NUMBER}")
  • retainStorage: Retain EFS/EBS on deletion (default: false)
  • existingFileSystemId: Reuse existing EFS (disaster recovery)

Usage:

 // In CDK app
 DeploymentContext ctx = DeploymentContext.from(app);

 // In any Construct
 DeploymentContext ctx = DeploymentContext.from(scope);

  • Constructor Details

  • Method Details

    • from

      public static DeploymentContext from(software.amazon.awscdk.App app)
      Build from the 'cfc' context object on the App.

    • from

      public static DeploymentContext from(software.constructs.Construct scope)
      Build from the 'cfc' context object on any Construct scope.

    • tier

      public String tier()

    • env

      public String env()

    • securityProfile

      public SecurityProfile securityProfile()
      Gets the security profile enum.
      Returns:
      SecurityProfile enum value

    • region

      public String region()

    • gdprDataTransferApproved

      public Boolean gdprDataTransferApproved()

    • domain

      public String domain()

    • subdomain

      public String subdomain()

    • fqdn

      public String fqdn()

    • networkMode

      public NetworkMode networkMode()

    • wafEnabled

      public Boolean wafEnabled()

    • httpsStrictEnabled

      public Boolean httpsStrictEnabled()

    • albAccessLogging

      public Boolean albAccessLogging()

    • guardDutyEnabled

      public Boolean guardDutyEnabled()

    • createGuardDutyDetector

      public Boolean createGuardDutyDetector()

    • guardDutyAlertsConfigured

      public Boolean guardDutyAlertsConfigured()

    • certificateExpirationMonitoring

      public Boolean certificateExpirationMonitoring()

    • macieEnabled

      public Boolean macieEnabled()

    • macieAutomatedDiscoveryEnabled

      public Boolean macieAutomatedDiscoveryEnabled()

    • securityHubEnabled

      public Boolean securityHubEnabled()

    • inspectorEnabled

      public Boolean inspectorEnabled()

    • antiMalwareEnabled

      public Boolean antiMalwareEnabled()

    • fileIntegrityMonitoringEnabled

      public Boolean fileIntegrityMonitoringEnabled()

    • containerRuntimeSecurityEnabled

      public Boolean containerRuntimeSecurityEnabled()

    • containerImageScanningEnabled

      public Boolean containerImageScanningEnabled()

    • cloudWatchLogsKmsEncryptionEnabled

      public Boolean cloudWatchLogsKmsEncryptionEnabled()

    • cloudTrailInsightsEnabled

      public Boolean cloudTrailInsightsEnabled()

    • route53QueryLoggingEnabled

      public Boolean route53QueryLoggingEnabled()

    • s3ObjectLockEnabled

      public Boolean s3ObjectLockEnabled()

    • cloudfrontEnabled

      public Boolean cloudfrontEnabled()

    • lbType

      public LoadBalancerType lbType()

    • cpuTargetUtilization

      public Integer cpuTargetUtilization()

    • maxInstanceCapacity

      public Integer maxInstanceCapacity()

    • minInstanceCapacity

      public Integer minInstanceCapacity()

    • enableFlowlogs

      public Boolean enableFlowlogs()

    • cloudTrailEnabled

      public Boolean cloudTrailEnabled()

    • securityMonitoringEnabled

      public Boolean securityMonitoringEnabled()

    • efsEncryptionInTransitEnabled

      public Boolean efsEncryptionInTransitEnabled()

    • restrictSecurityGroupEgress

      public Boolean restrictSecurityGroupEgress()

    • automatedBackupEnabled

      public Boolean automatedBackupEnabled()

    • crossRegionBackupEnabled

      public Boolean crossRegionBackupEnabled()

    • bastionCidr

      public String bastionCidr()

    • retainStorage

      public Boolean retainStorage()

    • existingFileSystemId

      public String existingFileSystemId()

    • enableMonitoring

      public Boolean enableMonitoring()

    • enableEncryption

      public Boolean enableEncryption()

    • awsConfigEnabled

      public Boolean awsConfigEnabled()

    • createConfigInfrastructure

      public Boolean createConfigInfrastructure()

    • auditManagerEnabled

      public Boolean auditManagerEnabled()

    • complianceFrameworks

      public String complianceFrameworks()

    • complianceMode

      public ComplianceMode complianceMode()

    • logRetentionDays

      public Integer logRetentionDays()

    • instanceType

      public String instanceType()

    • provisionDatabase

      public Boolean provisionDatabase()

    • enableS3VersioningRemediation

      public Boolean enableS3VersioningRemediation()

    • enableCloudTrailBucketAccessRemediation

      public Boolean enableCloudTrailBucketAccessRemediation()

    • enableRdsDeletionProtectionRemediation

      public Boolean enableRdsDeletionProtectionRemediation()

    • enableRdsAutoMinorVersionUpgradeRemediation

      public Boolean enableRdsAutoMinorVersionUpgradeRemediation()

    • healthCheckGracePeriod

      public Integer healthCheckGracePeriod()

    • healthCheckInterval

      public Integer healthCheckInterval()

    • healthCheckTimeout

      public Integer healthCheckTimeout()

    • healthyThreshold

      public Integer healthyThreshold()

    • unhealthyThreshold

      public Integer unhealthyThreshold()

    • authMode

      public AuthMode authMode()

    • cognitoAutoProvision

      public Boolean cognitoAutoProvision()

    • cognitoDomainPrefix

      public String cognitoDomainPrefix()

    • cognitoUserPoolName

      public String cognitoUserPoolName()

    • cognitoMfaEnabled

      public Boolean cognitoMfaEnabled()

    • cognitoMfaMethod

      public String cognitoMfaMethod()

    • cognitoCreateGroups

      public Boolean cognitoCreateGroups()

    • cognitoAdminGroupName

      public String cognitoAdminGroupName()

    • cognitoUserGroupName

      public String cognitoUserGroupName()

    • cognitoUserPoolId

      public String cognitoUserPoolId()

    • cognitoAppClientId

      public String cognitoAppClientId()

    • cognitoInitialAdminEmail

      public String cognitoInitialAdminEmail()

    • cognitoInitialAdminPhone

      public String cognitoInitialAdminPhone()

    • oidcIssuer

      public String oidcIssuer()

    • oidcAuthorizationEndpoint

      public String oidcAuthorizationEndpoint()

    • oidcTokenEndpoint

      public String oidcTokenEndpoint()

    • oidcUserInfoEndpoint

      public String oidcUserInfoEndpoint()

    • oidcClientId

      public String oidcClientId()

    • oidcClientSecretName

      public String oidcClientSecretName()

    • ssoInstanceArn

      public String ssoInstanceArn()

    • ssoGroupId

      public String ssoGroupId()

    • ssoTargetAccountId

      public String ssoTargetAccountId()

    • autoProvisionIdentityCenter

      public Boolean autoProvisionIdentityCenter()

    • identityCenterGroupName

      public String identityCenterGroupName()

    • deploymentId

      public String deploymentId()

    • deploymentVersion

      public String deploymentVersion()

    • tags

      public String tags()

    • stackName

      public String stackName()

    • artifactsBucket

      public String artifactsBucket()

    • artifactsPrefix

      public String artifactsPrefix()

    • cpu

      public int cpu()

    • memory

      public int memory()

    • containerImage

      public String containerImage()

    • enableSsl

      public boolean enableSsl()

    • createZone

      public boolean createZone()

    • raw

      public Map<String,Object> raw()
      Raw immutable view of all context keys.

    • runtime

      public RuntimeType runtime()
      Canonical axes (preferred).

    • topology

      public TopologyType topology()

    • runtimeRaw

      @Deprecated public String runtimeRaw()
      Deprecated.
      Legacy raw accessors (compat only).

    • topologyRaw

      @Deprecated public String topologyRaw()
      Deprecated.

    • isPrivateWithNat

      public boolean isPrivateWithNat()
      True if the service should run in private subnets without public IPs.

    • isEnterprise

      public boolean isEnterprise()
      True if enterprise features should be enabled.

    • getRuntime

      public RuntimeType getRuntime()
      Get the runtime type.

    • getTopology

      public TopologyType getTopology()
      Get the topology type.

    • getContextValue

      public String getContextValue(String key, String defaultValue)
      Get a context value by key with default.

    • toContextMap

      public Map<String,Object> toContextMap()
      Export all deployment context fields to a Map for serialization. This produces the same format as InteractiveDeployer's buildCfcContext. Delegates to DeploymentConfig.toContextMap() for consistency.

    • tagStack

      public void tagStack(software.amazon.awscdk.Stack stack)
      Tag a stack so you can see the config in the console.

    • toString

      public String toString()
      Overrides:
      toString in class Object