feat(devtools): Aurora Serverless v2 scale-to-zero + NAT-free Lambda connectivity

[seanspeaks]

Summary

Implements ADR-033. Adds two independent, opt-in, default-off capabilities on database.postgres so a Frigg-owned Aurora Serverless v2 cluster can idle at ~$0 instead of the current ~$75/mo floor (0.5 ACU always-on + an always-on NAT Gateway). Existing app definitions compose a byte-for-byte identical template.

1. Scale-to-zero (minCapacity: 0)

• Validator accepts minCapacity of 0 (Aurora Serverless v2 scale-to-zero, GA Nov 2024) or [0.5, 128]; (0, 0.5) remains invalid. Also cross-checks minCapacity <= maxCapacity.
• Scaling config uses nullish coalescing — MinCapacity: dbConfig.minCapacity ?? 0.5 / MaxCapacity: dbConfig.maxCapacity ?? 4 (the old || 0.5 turned a requested 0 back into 0.5).
• When minCapacity === 0, emits SecondsUntilAutoPause from a new optional secondsUntilAutoPause (default 300, valid 300–86400; a warning fires if it's set while minCapacity !== 0).
• Warns (not fails) if minCapacity: 0 is pinned to an engine older than Aurora PG 13.15/14.12/15.7/16.3. The default 15.13 qualifies.

2. Connectivity mode (connectivity: 'vpc' default | 'public')

• 'vpc' (default, unchanged): Aurora in private subnets, Lambda attached to the VPC, ingress from the Lambda SG.
• 'public' (NAT-free): Aurora in public subnets with PubliclyAccessible: true; ingress opens 5432 to a new allowedCidrs option (default ['0.0.0.0/0']) via CidrIp — one ingress rule per CIDR — instead of SourceSecurityGroupId; DATABASE_URL carries sslmode=require; the Lambda is left OUT of the VPC (no NAT Gateway, no VPC endpoints) but the public subnets still get an Internet Gateway default route + associations so the endpoint is reachable; VPC_ENABLED=false. Requires vpc.enable: true (validated).
• Both combine: connectivity: 'public' + minCapacity: 0 → a Frigg-owned Aurora that idles at $0 with no NAT.

The decoupling seam: the composer sets provider.vpc only when VpcBuilder returns a truthy vpcConfig (infrastructure-composer.js:126). In public mode the VpcBuilder still builds the VPC / public subnets / DB subnet group / IGW public routing Aurora requires, but skips the NAT Gateway + VPC endpoints and sets result.vpcConfig = null — so provider.vpc stays unset and the Lambda is never VPC-attached. The public-subnet IGW routing is emitted only for a Frigg-created (stack) VPC (guarded by FriggInternetGateway presence); a discovered/existing VPC is left alone.

Files changed

• packages/devtools/infrastructure/domains/database/aurora-builder.js — validator (minCapacity 0, min≤max, secondsUntilAutoPause + ignore-warning, connectivity, allowedCidrs numeric validation, empty-in-public error, public+vpc.enable rule, discover/use-existing warnings, engine warning), scaling config, public-mode subnet/PubliclyAccessible selection, per-CIDR CidrIp ingress, TLS in DATABASE_URL (create-new/discover/use-existing paths), config-mirror translation.
• packages/devtools/infrastructure/domains/networking/vpc-builder.js — public mode: emit IGW public-subnet routing (stack VPC only), skip NAT Gateway + VPC endpoints, clear vpcConfig, set VPC_ENABLED=false.
• packages/devtools/infrastructure/domains/shared/types/app-definition.js — documents the four new fields; fixes stale maxCapacity default JSDoc (1 → 4).
• packages/devtools/infrastructure/domains/database/aurora-builder.test.js — updated the minCapacity error-message assertion.
• packages/devtools/infrastructure/__tests__/aurora-scale-to-zero-connectivity.test.js — new template-shape + validator tests.
• docs/architecture-decisions/033-...md — the ADR.

Tests

./node_modules/.bin/jest infrastructure/__tests__/aurora-scale-to-zero-connectivity.test.js infrastructure/domains/database/aurora-builder.test.js from packages/devtools: 76 passed / 76 (2 suites).

• Validator: minCapacity 0/0.3/0.5/64, min>max, secondsUntilAutoPause range + ignore-warning, connectivity enum, allowedCidrs numeric-range + empty-in-public error, public-requires-vpc, discover/use-existing warnings, engine warning.
• Scale-to-zero (template): MinCapacity === 0 (mutation-checked .not.toBe(0.5)), SecondsUntilAutoPause 300/custom, MaxCapacity 4.
• Public connectivity (template): per-CIDR CidrIp ingress (default 0.0.0.0/0, no SourceSecurityGroupId), PubliclyAccessible: true in public subnets, no NAT Gateway, IGW public route + route table + both subnet associations present (no NAT route), provider.vpc unset, VPC_ENABLED=false, sslmode=require, combined $0-idle path.
• No-regression (vpc default): MinCapacity 0.5 / no SecondsUntilAutoPause, ingress via SourceSecurityGroupId (FriggAuroraIngressRule unchanged), not publicly accessible, provider.vpc set, VPC_ENABLED=true, no sslmode.

Mutation-verified: ?? 0.5 → || 0.5, removing vpcConfig = null, removing createPublicRouting, and forcing VPC_ENABLED='true' each break the intended test(s).

Review findings — status

Fixed: public-subnet IGW routing decoupled from NAT (HIGH); empty allowedCidrs in public mode now an error (SEC); stale aurora-builder.test.js assertion; discover/use-existing public warning + useExistingAurora TLS; minCapacity <= maxCapacity; connectivity:'public' requires vpc.enable; secondsUntilAutoPause ignored-warning; VPC_ENABLED=false in public mode; numeric IPv4 CIDR validation (documented IPv4-only); corrected the .config.* translation comment.

Deferred / accepted (per reviewer): sslmode=require (not verify-full) is ADR-acceptable; the FriggLambdaSecurityGroup/vpcSecurityGroupIds coupling is correct today. IPv6 (CidrIpv6) is explicitly out of scope for allowedCidrs (documented).

Note: end-to-end AWS deployment was not validated (needs a live account) — template shape only. The public-subnet IGW routing and the discover/use-existing public path in particular are argued from CloudFormation semantics + unit tests, not a live deploy. vpc-builder.test.js has 8 pre-existing failures on next (unrelated base-branch red) — unchanged by this PR (verified before/after). The repo's full "Frigg CI" is also independently red because prisma:generate isn't run before the infra tests; the new tests run without Prisma generation or a live AWS account.

🤖 Generated with Claude Code

---

Generated by Claude Code

📦 Published PR as canary version: 2.0.0--canary.640.5140601.0

✨ Test out this PR locally via:

npm install @friggframework/admin-scripts@2.0.0--canary.640.5140601.0
npm install @friggframework/core@2.0.0--canary.640.5140601.0
npm install @friggframework/devtools@2.0.0--canary.640.5140601.0
npm install @friggframework/eslint-config@2.0.0--canary.640.5140601.0
npm install @friggframework/prettier-config@2.0.0--canary.640.5140601.0
npm install @friggframework/schemas@2.0.0--canary.640.5140601.0
npm install @friggframework/serverless-plugin@2.0.0--canary.640.5140601.0
npm install @friggframework/test@2.0.0--canary.640.5140601.0
npm install @friggframework/ui@2.0.0--canary.640.5140601.0
# or 
yarn add @friggframework/admin-scripts@2.0.0--canary.640.5140601.0
yarn add @friggframework/core@2.0.0--canary.640.5140601.0
yarn add @friggframework/devtools@2.0.0--canary.640.5140601.0
yarn add @friggframework/eslint-config@2.0.0--canary.640.5140601.0
yarn add @friggframework/prettier-config@2.0.0--canary.640.5140601.0
yarn add @friggframework/schemas@2.0.0--canary.640.5140601.0
yarn add @friggframework/serverless-plugin@2.0.0--canary.640.5140601.0
yarn add @friggframework/test@2.0.0--canary.640.5140601.0
yarn add @friggframework/ui@2.0.0--canary.640.5140601.0

[netlify]

✅ Deploy Preview for friggframework-org canceled.

Name	Link
🔨 Latest commit	5140601
🔍 Latest deploy log	https://app.netlify.com/projects/friggframework-org/deploys/6a86872f62e3fc0008d02c86

[graphite-app]

Security issue: Empty array allowedCidrs: [] is treated as missing and defaults to ['0.0.0.0/0'], opening the database to the entire internet when the user may have intended to block all access.

const allowedCidrs =
    Array.isArray(dbConfig.allowedCidrs) && dbConfig.allowedCidrs.length > 0
        ? dbConfig.allowedCidrs
        : ['0.0.0.0/0'];

If a user explicitly sets allowedCidrs: [], this condition evaluates to false and falls through to the default ['0.0.0.0/0'], creating a wide-open security rule instead of no rules.

Fix: Either validate that allowedCidrs cannot be empty in the validator, or handle empty arrays explicitly to create no ingress rules (though that would make the database unreachable).

Suggested change

	const allowedCidrs =
	Array.isArray(dbConfig.allowedCidrs) && dbConfig.allowedCidrs.length > 0
	? dbConfig.allowedCidrs
	: ['0.0.0.0/0'];
	const allowedCidrs =
	Array.isArray(dbConfig.allowedCidrs)
	? dbConfig.allowedCidrs
	: ['0.0.0.0/0'];

Spotted by Graphite



Is this helpful? React 👍 or 👎 to let us know.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud