Class DeploymentContext

java.lang.Object
com.cloudforgeci.api.core.DeploymentContext
public final class DeploymentContext extends Object
Typed configuration interface for CDK deployment context.

Loads configuration from cdk.json "cfc" block or CLI flags (-c key = value). Provides type-safe access with validation and sensible defaults.

Quick Start Example (cdk.json):

{
  "app": "...",
  "context": {
    "cfc": {
      "runtime": "fargate",
      "topology": "jenkins-service",
      "env": "dev",
      "domain": "example.com",
      "subdomain": "jenkins",
      "enableSsl": true,
      "authMode": "alb-oidc",
      "cognitoAutoProvision": true,
      "cognitoDomainPrefix": "myapp-auth",
      "cognitoMfaEnabled": true
    }
  }
}

Configuration Keys (all optional unless noted):

Core Settings:

  • tier: "public" | "enterprise" (default: public)
  • runtime: "ec2" | "fargate" (default: fargate)
  • topology: "jenkins-service" | "s3-website" | "application-service" | "cms-service"
  • env: "dev" | "stage" | "prod" (default: dev)
  • securityProfile: "dev" | "staging" | "production" (default: dev)
  • region: AWS region (default: us-east-1)

DNS & SSL:

  • domain: Base domain (e.g., "example.com")
  • subdomain: Subdomain prefix (e.g., "jenkins")
  • fqdn: Full domain (e.g., "jenkins.example.com") - overrides domain+subdomain
  • enableSsl: Enable HTTPS with ACM certificate (default: false)
  • createZone: Create Route53 hosted zone (default: false)

Network & Security:

  • networkMode: "public-no-nat" | "private-with-nat" (default: public-no-nat)
  • wafEnabled: Enable AWS WAF (default: false)
  • albAccessLogging: Enable ALB access logs to S3 (default: false)
  • cloudfront: Enable CloudFront distribution (default: false)
  • bastionCidr: Retained for backwards compatibility; no longer gates ECS Exec or SSH. Instance access uses SSM Session Manager; Fargate access uses ECS Exec.

Authentication:

  • authMode: "none" | "alb-oidc" | "jenkins-oidc" | "application-oidc" (default: none)

Cognito (Auto-provision User Pool):

  • cognitoAutoProvision: Auto-create Cognito User Pool (default: false)
  • cognitoDomainPrefix: Globally unique domain prefix (required if auto-provisioning)
  • cognitoUserPoolName: User Pool name (optional)
  • cognitoMfaEnabled: Enable MFA (default: false)
  • cognitoMfaMethod: "totp" | "sms" | "both" (default: "both")
  • cognitoSelfSignupEnabled: override the security profile's self-signup default (default: null — profile decides); enabling it under an active compliance framework logs a synthesis-time warning
  • cognitoCreateGroups: Create admin/user groups (default: true)
  • cognitoAdminGroupName: Admin group name (default: "Jenkins-Admins")
  • cognitoUserGroupName: User group name (default: "Jenkins-Users")
  • cognitoUserPoolId: Existing User Pool ID (for reuse)
  • cognitoAppClientId: Existing App Client ID (for reuse)
  • cognitoInitialAdminEmail: Initial admin user email (optional)
  • cognitoInitialAdminPhone: Initial admin user phone in E.164 format, e.g., +12025551234 (optional, required for SMS MFA)

Manual OIDC (Identity Center, Okta, Auth0):

  • oidcIssuer: OIDC issuer URL
  • oidcAuthorizationEndpoint: Authorization endpoint
  • oidcTokenEndpoint: Token endpoint
  • oidcUserInfoEndpoint: UserInfo endpoint
  • oidcClientId: OIDC client ID
  • oidcClientSecretName: Secrets Manager secret name (default: "jenkins/oidc/client-secret")

Legacy IAM Identity Center:

  • ssoInstanceArn: IAM Identity Center instance ARN
  • ssoGroupId: Group UUID
  • ssoTargetAccountId: 12-digit account ID
  • autoProvisionIdentityCenter: Auto-provision (default: false)
  • identityCenterGroupName: Group name (default: "Jenkins-Users")

Compute & Scaling:

  • lbType: "alb" | "nlb" (default: alb)
  • instanceType: EC2 type (default: t3.micro)
  • cpu: Fargate vCPU units (default: 1024)
  • memory: Fargate memory MiB (default: 2048)
  • containerImage: Override container image tag, e.g., "v1.2.3" or "2024.1" (default: uses tag from ApplicationSpec)
  • minInstanceCapacity: Min instances (default: 1)
  • maxInstanceCapacity: Max instances (default: 1)
  • cpuTargetUtilization: CPU target % (default: 60)

Monitoring & Compliance:

  • enableMonitoring: CloudWatch monitoring (default: true)
  • enableEncryption: Encryption at rest (default: true)
  • logRetentionDays: CloudWatch log retention (default: security profile default)
  • awsConfigEnabled: AWS Config compliance (default: false)
  • securityMonitoringEnabled: Enable security monitoring (default: false)
  • efsEncryptionInTransitEnabled: Enable EFS encryption in transit (default: profile default)
  • automatedBackupEnabled: Enable automated backups (default: profile default)
  • crossRegionBackupEnabled: Enable cross-region backups (default: profile default)
  • complianceMode: "enforce" | "advisory" (auto: enforce for PRODUCTION, advisory for DEV/STAGING)
  • complianceFrameworks: "PCI-DSS,HIPAA,SOC2,GDPR" (comma-separated)

Health Checks:

  • healthCheckGracePeriod: Grace period seconds (default: 300)
  • healthCheckInterval: Interval seconds (default: 30)
  • healthCheckTimeout: Timeout seconds (default: 5)
  • healthyThreshold: Healthy count (default: 2)
  • unhealthyThreshold: Unhealthy count (default: 3)

Storage:

  • artifactsBucket: S3 bucket name (optional)
  • artifactsPrefix: S3 prefix (default: "jenkins/job/${JOB_NAME}/${BUILD_NUMBER}")
  • retainStorage: Retain EFS/EBS on deletion (default: false)
  • existingFileSystemId: Reuse existing EFS (disaster recovery)

Usage:

// In CDK app
DeploymentContext ctx = DeploymentContext.from(app);

// In any Construct
DeploymentContext ctx = DeploymentContext.from(scope);

  • Field Details

  • Constructor Details

  • Method Details

    • from

      public static DeploymentContext from(software.constructs.Construct scope)
      Build from the 'cfc' context object on any Construct scope (App included -- App extends Construct, and this did nothing an App-specific overload wouldn't; that overload was removed since resolving to it depended on a caller's static type, not actual behavior).

    • getConfig

      public DeploymentConfig getConfig()
      Returns the backing DeploymentConfig.

      New code should access config fields directly via ctx.cfc.config.myField or ctx.cfc.getConfig().myField rather than adding forwarding getters to this class. The existing getters below are retained for backward compatibility.

      Returns:
      the backing DeploymentConfig instance

    • tier

      public String tier()

    • env

      public String env()

    • securityProfile

      public SecurityProfile securityProfile()
      Gets the security profile enum.
      Returns:
      SecurityProfile enum value

    • region

      public String region()

    • gdprDataTransferApproved

      public Boolean gdprDataTransferApproved()

    • domain

      public String domain()

    • subdomain

      public String subdomain()

    • fqdn

      public String fqdn()

    • networkMode

      public NetworkMode networkMode()

    • wafEnabled

      public Boolean wafEnabled()

    • httpsStrictEnabled

      public Boolean httpsStrictEnabled()

    • albAccessLogging

      public Boolean albAccessLogging()

    • guardDutyEnabled

      public Boolean guardDutyEnabled()

    • createGuardDutyDetector

      public Boolean createGuardDutyDetector()

    • guardDutyAlertsConfigured

      public Boolean guardDutyAlertsConfigured()

    • certificateExpirationMonitoring

      public Boolean certificateExpirationMonitoring()

    • macieEnabled

      public Boolean macieEnabled()

    • macieAutomatedDiscoveryEnabled

      public Boolean macieAutomatedDiscoveryEnabled()

    • securityHubEnabled

      public Boolean securityHubEnabled()

    • inspectorEnabled

      public Boolean inspectorEnabled()

    • antiMalwareEnabled

      public Boolean antiMalwareEnabled()

    • fileIntegrityMonitoringEnabled

      public Boolean fileIntegrityMonitoringEnabled()

    • containerRuntimeSecurityEnabled

      public Boolean containerRuntimeSecurityEnabled()

    • containerImageScanningEnabled

      public Boolean containerImageScanningEnabled()

    • cloudWatchLogsKmsEncryptionEnabled

      public Boolean cloudWatchLogsKmsEncryptionEnabled()

    • cloudTrailInsightsEnabled

      public Boolean cloudTrailInsightsEnabled()

    • route53QueryLoggingEnabled

      public Boolean route53QueryLoggingEnabled()

    • s3ObjectLockEnabled

      public Boolean s3ObjectLockEnabled()

    • cloudfrontEnabled

      public Boolean cloudfrontEnabled()

    • lbType

      public LoadBalancerType lbType()

    • oidcProvider

      public String oidcProvider()

    • cloudforgeManagerIssuerUrl

      public String cloudforgeManagerIssuerUrl()

    • cpuTargetUtilization

      public Integer cpuTargetUtilization()

    • maxInstanceCapacity

      public Integer maxInstanceCapacity()

    • minInstanceCapacity

      public Integer minInstanceCapacity()

    • enableFlowlogs

      public Boolean enableFlowlogs()

    • cloudTrailEnabled

      public Boolean cloudTrailEnabled()

    • securityMonitoringEnabled

      public Boolean securityMonitoringEnabled()

    • efsEncryptionInTransitEnabled

      public Boolean efsEncryptionInTransitEnabled()

    • restrictSecurityGroupEgress

      public Boolean restrictSecurityGroupEgress()

    • automatedBackupEnabled

      public Boolean automatedBackupEnabled()

    • crossRegionBackupEnabled

      public Boolean crossRegionBackupEnabled()

    • bastionCidr

      public String bastionCidr()

    • retainStorage

      public Boolean retainStorage()

    • existingFileSystemId

      public String existingFileSystemId()

    • enableMonitoring

      public Boolean enableMonitoring()

    • enableEncryption

      public Boolean enableEncryption()

    • awsConfigEnabled

      public Boolean awsConfigEnabled()

    • createConfigInfrastructure

      public Boolean createConfigInfrastructure()

    • auditManagerEnabled

      public Boolean auditManagerEnabled()

    • managerDirectDeployEnabled

      public Boolean managerDirectDeployEnabled()

    • complianceFrameworks

      public String complianceFrameworks()

    • complianceMode

      public ComplianceMode complianceMode()

    • logRetentionDays

      public Integer logRetentionDays()

    • instanceType

      public String instanceType()

    • provisionDatabase

      public Boolean provisionDatabase()

    • databaseEngine

      public String databaseEngine()

    • databaseVersion

      public String databaseVersion()

    • databaseReadReplicaCount

      public Integer databaseReadReplicaCount()

    • databaseInstanceClass

      public String databaseInstanceClass()

    • databaseAllocatedStorageGB

      public Integer databaseAllocatedStorageGB()

    • databaseName

      public String databaseName()

    • databaseMultiAz

      public Boolean databaseMultiAz()

    • databaseBackupRetentionDays

      public Integer databaseBackupRetentionDays()

    • enableAutoScaling

      public Boolean enableAutoScaling()

    • provisionManagerRedisSessions

      public Boolean provisionManagerRedisSessions()

    • provisionManagerAccountCipherKey

      public Boolean provisionManagerAccountCipherKey()

    • managerLicenseKey

      public String managerLicenseKey()

    • enableS3VersioningRemediation

      public Boolean enableS3VersioningRemediation()

    • enableCloudTrailBucketAccessRemediation

      public Boolean enableCloudTrailBucketAccessRemediation()

    • enableRdsDeletionProtectionRemediation

      public Boolean enableRdsDeletionProtectionRemediation()

    • enableRdsAutoMinorVersionUpgradeRemediation

      public Boolean enableRdsAutoMinorVersionUpgradeRemediation()

    • healthCheckGracePeriod

      public Integer healthCheckGracePeriod()

    • healthCheckInterval

      public Integer healthCheckInterval()

    • healthCheckTimeout

      public Integer healthCheckTimeout()

    • healthyThreshold

      public Integer healthyThreshold()

    • unhealthyThreshold

      public Integer unhealthyThreshold()

    • authMode

      public AuthMode authMode()

    • cognitoAutoProvision

      public Boolean cognitoAutoProvision()

    • cognitoDomainPrefix

      public String cognitoDomainPrefix()

    • cognitoUserPoolName

      public String cognitoUserPoolName()

    • cognitoMfaEnabled

      public Boolean cognitoMfaEnabled()

    • cognitoMfaMethod

      public String cognitoMfaMethod()

    • cognitoSelfSignupEnabled

      public Boolean cognitoSelfSignupEnabled()

    • cognitoCreateGroups

      public Boolean cognitoCreateGroups()

    • cognitoAdminGroupName

      public String cognitoAdminGroupName()

    • cognitoUserGroupName

      public String cognitoUserGroupName()

    • cognitoUserPoolId

      public String cognitoUserPoolId()

    • cognitoAppClientId

      public String cognitoAppClientId()

    • cognitoInitialAdminEmail

      public String cognitoInitialAdminEmail()

    • cognitoInitialAdminPhone

      public String cognitoInitialAdminPhone()

    • oidcIssuer

      public String oidcIssuer()

    • oidcAuthorizationEndpoint

      public String oidcAuthorizationEndpoint()

    • oidcTokenEndpoint

      public String oidcTokenEndpoint()

    • oidcUserInfoEndpoint

      public String oidcUserInfoEndpoint()

    • oidcClientId

      public String oidcClientId()

    • oidcClientSecretName

      public String oidcClientSecretName()

    • ssoInstanceArn

      public String ssoInstanceArn()

    • ssoGroupId

      public String ssoGroupId()

    • ssoTargetAccountId

      public String ssoTargetAccountId()

    • autoProvisionIdentityCenter

      public Boolean autoProvisionIdentityCenter()

    • identityCenterGroupName

      public String identityCenterGroupName()

    • deploymentId

      public String deploymentId()

    • deploymentVersion

      public String deploymentVersion()

    • tags

      public String tags()

    • stackName

      public String stackName()

    • artifactsBucket

      public String artifactsBucket()

    • artifactsPrefix

      public String artifactsPrefix()

    • cpu

      public int cpu()

    • memory

      public int memory()

    • containerImage

      public String containerImage()

    • enableSsl

      public boolean enableSsl()

    • createZone

      public boolean createZone()

    • certificateArn

      public String certificateArn()
      See DeploymentConfig#certificateArn's javadoc — takes priority over both of FargateRuntimeConfiguration's other certificate paths when set.

    • raw

      public Map<String,Object> raw()
      Raw immutable view of all context keys.

    • runtime

      public RuntimeType runtime()
      Canonical axes (preferred).

    • topology

      public TopologyType topology()

    • runtimeRaw

      @Deprecated public String runtimeRaw()
      Deprecated.
      Legacy raw accessors (compat only).

    • topologyRaw

      @Deprecated public String topologyRaw()
      Deprecated.

    • applicationId

      public String applicationId()
      Returns the canonical application identifier from the deployment context.

      All topologies select their application through DeploymentConfig.applicationId.

      Example cdk.json usage:

      "cfc": {
  "topology": "cms-service",
  "applicationId": "wordpress",
  "runtime": "fargate"
}
      Returns:
      the application ID (e.g., "wordpress", "magento") or null if not set

    • cmsSpec

      public Optional<CmsSpec> cmsSpec()
      Resolves the CmsSpec for the configured application via CmsLoader.

      Returns Optional.empty() when no applicationId is set, or when the ID does not match any registered CMS plugin.

      Returns:
      the resolved CmsSpec, or empty if not a CMS deployment

    • isPrivateWithNat

      public boolean isPrivateWithNat()
      True if the service should run in private subnets without public IPs.

    • isEnterprise

      public boolean isEnterprise()
      True if enterprise features should be enabled.

    • getRuntime

      public RuntimeType getRuntime()
      Get the runtime type.

    • getTopology

      public TopologyType getTopology()
      Get the topology type.

    • getContextValue

      public String getContextValue(String key, String defaultValue)
      Get a context value by key with default.

    • toContextMap

      public Map<String,Object> toContextMap()
      Export all deployment context fields to a Map for serialization. This produces the same format as InteractiveDeployer's buildCfcContext. Delegates to DeploymentConfig.toContextMap() for consistency.

    • tagStack

      public void tagStack(software.amazon.awscdk.Stack stack)
      Tag a stack so you can see the config in the console.

    • toString

      public String toString()
      Overrides:
      toString in class Object