Changelog¶

All versions of mare_aws_common_lib (setup.cfg), derived directly from the git history of that file's version field — one entry per commit that changed it, newest first.

Entries from 1.0.0 onward describe the actual code introduced in that version (the range between the previous and current version-bump commits) — concrete features, fields, fixes, and behavior changes, read directly from the diff. Entries below 1.0.0 are the raw commit message for that version-bump commit, not a curated release note; some of those are terse or generic ("increasing version") because that's what the commit actually said.

1.0.22 — 2026-10-01¶

Restrict who can read RDS database passwords. The DevOps account no longer has access to them, and within the environment's account they can now only be read by DB administrators, the deployment pipeline (and manual CDK deploys), the Foundation user-management process, automatic password rotation, and the application's own ECS containers.

1.0.21 — 2026-09-16¶

Wires this changelog into the published docs site: adds a Changelog nav entry to documentation/mkdocs.yml, a build-time copy step in pipeline/buildspec.yml (CHANGELOG.md → documentation/docs/changelog.md, regenerated fresh before every mike deploy), and gitignores the generated copy so it can't go stale in version control. (7c8e934)

1.0.20 — 2026-09-15¶

Removes a redundant cross-account IAM grant in RdsDatabaseBuilder: it looked up the shared "MareDevops" role and explicitly grant_read'd it on the RDS secret, even though that role already has the necessary access by default. (f343db6)

1.0.19 — 2026-06-16¶

Adds a utc_maintenance_window field to RDS configuration with a strict validator enforcing AWS's ddd:hh24:mi-ddd:hh24:mi format, valid weekday tokens, a minimum 30-minute window, and correct handling of windows that cross midnight/week boundaries — wired into RdsDatabaseBuilder via preferred_maintenance_window. Also switches the QA/build-assess pipeline's trigger from a per-commit EventBridge rule to a new _create_event_rule_for_schedule cron rule that fires once a week (Monday 07:00 UTC+2). (e947c80)

1.0.18 — 2026-06-03¶

Removes leftover print() debug statements that were logging every pipeline stage/action on each synth, and hardens cdk_helpers.tag_all() to use dict.get() with defaults instead of direct key access — avoiding a KeyError when repository or govis are missing from cdk.json entirely (previously only the falsy case was handled). (3fc8091)

1.0.17 — 2026-06-02¶

Re-enables the build stage in the QA/build-assess pipeline (previously disabled, leaving only the assess stage running); relocates the pipeline debug prints around stage/action creation (still present at this point, removed next version); adds Usage.SONARQUBE and Usage.PROWLER enum values with no consuming logic yet. Reworks cdk_postgres_engine_version with explicit pattern matching to correctly resolve both major-only version strings (VER_17) and major.minor strings (VER_15_3), rather than assuming every version has a minor component. (c49767e)

1.0.16 — 2026-05-26¶

Completes the QA pipeline: adds _create_assess_stage and a StageType.ASSESSMENT/assessment stage config, and loosens the "control stage is BUILD_RELEASE-only" validation to also allow Usage.BUILD_ASSESS. The pipeline's build step is disabled here so only source→assess runs (build returns next version). Adds get_all_accounts() to ApplicationHelper, reverts the Usage.SYNC↔SYNTH enum swap from the previous version, and introduces two temporary debug print() statements. (f90881b)

1.0.15 — 2026-04-28¶

Adds several new resource tags to cdk_helpers.tag_all() — Repository, ec.GovIS2SeqNum/ec.GovIS2Name (per the EC DIGIT tagging policy), ec.Application.Name, ec.CreatedBy, ec.EnvironmentType. Starts a new QA/build-assess pipeline type (Usage.BUILD_ASSESS, PipelineType.QA) with a create_build_assess_pipeline orchestrator method, though the assess stage itself is still commented out and the self-mutate stage disabled. Also silently renames the Usage.SYNC enum value to SYNTH (reverted next version). (ba4e75c)

1.0.14 — 2026-04-10¶

Removes a duplicate port mapping in ECS: the application port was being registered twice, once via the port_mappings= list passed into add_container() and once via a separate add_port_mappings() call — the latter is now commented out. Also removes a leftover dead comment in RdsDatabaseBuilder and fixes a couple of docstring typos in rds_db_config.py. (eaa6030)

1.0.13 — 2026-03-19¶

Makes postgres_engine_version a configurable, validated field (checked against the real rds.PostgresEngineVersion enum members) instead of a hardcoded VER_17_4 class constant, plus new allow_major_version_upgrade and apply_immediately fields wired into RdsDatabaseBuilder. Bumps the aws-cdk-lib dependency from 2.212.0 to 2.243.0. (3fc081a)

1.0.12 — 2026-02-05¶

Adds performance_insights_enabled/performance_insights_retention_period to RdsDBConfig (validated against AWS's supported retention periods — 7/31/93/186/372 days) and wires enable_performance_insights/ performance_insight_retention into the RDS instance. (94c1a07)

1.0.11 — 2026-01-16¶

The ECS BUILD_TS environment variable (forces a container/task-definition redeploy) is now set for every environment instead of only devops. WafBuilder.build() now returns the created wafv2.CfnWebACL instead of None, so callers can reference the created ACL. (29123e3)

1.0.10 — 2025-11-18¶

Adds signer:GetRevocationStatus to the container-signing IAM role and introduces the Usage.SIGN enum value. Also flips the CDK CloudFormationCreateUpdateStackAction's admin_permissions from False to True in the deploy pipeline — a meaningful permission-scope change for stack deployment actions. (328f358)

1.0.9 — 2025-10-28¶

Adds a KMSS3EncryptionAccess IAM statement (kms:Decrypt, kms:GenerateDataKey, kms:DescribeKey) to the container-signing role so it can read from an encrypted S3 source bucket. (55e59d9)

1.0.8 — 2025-10-28¶

Adds an S3ArtifactsAccess IAM statement (get/list/put on *) to the container-signing role for source-artifact access. (624e40d)

1.0.7 — 2025-10-28¶

New ContainerSigningInfrastructure construct (238 lines) that provisions an ECC_NIST_P256 KMS key, an AWS Signer profile (Notation-OCI format), and an IAM role for CodeBuild, for container image signing / supply-chain integrity. (b2f19dd)

1.0.6 — 2025-10-22¶

Adds a security_groups field to CodebuildConfig and attaches it to both CodeBuild project creation paths (pipeline project and standalone project). (ba8a10a)

1.0.5 — 2025-10-21¶

Three bug fixes: (1) ECS cross-account SSM parameter lookups are now cached per builder instance, avoiding duplicate CrossAccountResourceConsumer lookups/CFN parameters for the same key; (2) fixes an EFS access-point naming bug where the resource name always used efs_base_name twice instead of the actual access_point_name, which would have collided names across multiple access points on the same file system; (3) reworks cross-account SecretsManager sharing — secrets encrypted with the SNC key now grant_decrypt the KMS key to the devops account (a plain grant_read on the secret alone doesn't work for a customer-managed key), with a resource-policy fallback for secrets that don't use an SNC key. (c4574af)

1.0.4 — 2025-10-13¶

Fixes a wrong SSM parameter name for the ECS environment-files feature — it looked up se_bucket_{name} instead of s3_bucket_{name}, which would have failed the parameter lookup outright. Also exports EnvironmentFileConfig from models/__init__.py, which had been left out when the feature was added. (87a02b4)

1.0.3 — 2025-10-10¶

Adds ECS environment_files support (new EnvironmentFileConfig model, S3-backed ecs.EnvironmentFile.from_bucket wiring). Fixes ArnUriHelper.build_s3_bucket_arn(), which was producing an invalid ARN (arn:aws:s3::{account_id}:{bucket} — S3 ARNs have no account-id segment); it now correctly returns arn:aws:s3:::{bucket_name}. (bb764eb)

1.0.2 — 2025-10-09¶

Adds an optional lifecycle_rule dict to S3BucketConfig (expiration_days, abort_incomplete_multipart_upload_days, validated) and wires it into a new _build_lifecycle_rules() on S3BucketBuilder. (614a6ce)

1.0.1 — 2025-10-07¶

Consolidates SNC KMS key lookup into a shared AbstractAWSResourceBuilder._get_snc_key_by_alias() (replacing separate per-builder implementations in S3/RDS/EFS) with a from_foundation toggle; adds EFS-backed ECS support (EcsEfsConfig, EfsVolumeConfig, EfsMountPointConfig) and EFS as a first-class AWSResourceType; adds the Usage.SYNC enum value; gives S3BucketBuilder a folder_structure config that creates the initial folder hierarchy via a Lambda-backed custom resource; lets SecretsManagerBuilder encrypt secrets with the SNC KMS key and grants the devops account cross-account read access to secrets when not deployed in devops; adds schema support to the DB secret template; adds ApplicationHelper.get_application_config(). (d25857d)

1.0.0 — 2025-09-22¶

Standardizes the SNC KMS key alias format across builders by dropping a hardcoded foundation- segment that RDS and S3 previously baked into the alias (so EfsBuilder, RdsDatabaseBuilder, and S3BucketBuilder now all resolve the same alias shape), and switches EfsBuilder to look up its KMS key by alias via a new _get_efs_kms_key_by_alias() instead of creating one directly, matching the pattern already used by RDS/S3. Also removes two unused accessor methods (get_file_system, get_access_points) from EfsBuilder and adds NameValidationMixin to EfsVolumeConfig. (8a6aa81)

0.4.8 — 2025-09-01¶

bugfix on cloudfront builder, increase version (a017b42)

0.4.7 — 2025-09-01¶

reverting cloudfront logs bucket config, increase version (9d1c2c0)

0.4.6 — 2025-09-01¶

minor fix for aws generated password and dms compatibility (141e9b7)

0.4.5 — 2025-08-29¶

add support in s3 builder to add a policy to allow access from cross accounts (94bc91d)

0.4.4 — 2025-08-26¶

Waf builder now supports a new model with overrides (8824fbe)

0.4.3 — 2025-08-25¶

multiaz support for rds, health_check for ecs task and alb, advanced metrics for cloudfront (bfc2ed7)

0.4.2 — 2025-08-22¶

increasing lib version (4865169)

0.4.1 — 2025-08-19¶

bugfixes, iam auth improved (de4a8e4)

0.4.0 — 2025-08-12¶

adding support for iam auth at the db level, improving docs (7c9c557)

0.3.13 — 2025-08-07¶

bugfix in ecs builder in order to support the specification of the environment from which we should fetch the ecr image (fb90f30)

0.3.12 — 2025-08-04¶

increasing version (56381f2)

0.3.11 — 2025-08-04¶

tagging the latest codeartifact version fix (aa1510a)

0.3.10 — 2025-08-04¶

adding aws shield usage docs (92484e6)

0.3.9 — 2025-08-04¶

adding support for multiple docs versions (1eebe40)

0.3.8 — 2025-08-04¶

buildpsec fixes (cd9b16a)

0.3.7 — 2025-08-04¶

adding more documentation, changing the pipeline to include doc builds also (9bdffe0)

0.3.6 — 2025-07-16¶

sg refactoring (c71d86f)

0.3.5 — 2025-07-08¶

Minor bugfix in codepipeline builder (47c866a)

0.3.4 — 2025-07-07¶

Finished models implementation (7ca41bd) (this commit set the version back down from 0.3.5 to 0.3.4 — see anomalies note above)

0.3.5 — 2025-07-02¶

Started implementing the model for the ecs builder (dc93c1d)

0.3.4 — 2025-06-30¶

Adapt ECS and CloudFront builders (4c15061)

0.3.3 — 2025-06-25¶

Adding models and refactoring (58cb932) (this commit touched setup.cfg but did not change the version line — still 0.3.3)

0.3.3 — 2025-06-04¶

S3 logs for cloudfront and codebuild, added support for aditional inbound rules rds, added bot protection (b55b8b2)

0.3.2 — 2025-05-28¶

minor refactorings, introduced StreamTriggerType (d8334a1)

0.3.1 — 2025-05-27¶

Refactoring Password generator, added dynamodb stream trigger and pipeline event monitor constructs (e3146c1)

0.3.1 — 2025-05-23¶

Adapt env enum, change alb param in cloudfront_builder (7b226ab)

0.3.0 — 2025-05-20¶

Refactoring (d7be210)

0.2.30 — 2025-05-19¶

code cleanup, adding control stage to build and release pipeline (76aabe7)

0.2.29 — 2025-05-19¶

Adding support for advanced stored parameter for rds secrets (c787e59)

0.2.28 — 2025-05-16¶

checking for the existence of a secret (79f3c05)

0.2.27 — 2025-05-16¶

Using secret arn in rds builder (16c483d)

0.2.26 — 2025-05-15¶

refactoring rds builder to support secrets that have been created by other stacks (0f67f99)

0.2.25 — 2025-05-15¶

adding deploy stage to the deploy pipeline, minor changes to dynamodb builder (f04beec)

0.2.24 — 2025-05-06¶

bug fixes (67effa5)

0.2.23 — 2025-05-06¶

Using action_env_vars in the codepipeline builder (84a8698)

0.2.22 — 2025-05-06¶

Adding some more enums, increase version (4b54612)

0.2.21 — 2025-05-05¶

Increasing deps version (0fff1a5)

0.2.20 — 2025-04-30¶

Dynamodb builder now supports global secondary indexes (f39c406)

0.2.19 — 2025-04-30¶

Adding more stages to the codepipeline builder, new enum values, increase version (cf8a362)

0.2.18 — 2025-04-28¶

Restart pipeline on update (bb5a4d3)

0.2.17 — 2025-04-25¶

Changes to codepipeline builder, increase version (76586a0)

0.2.16 — 2025-04-24¶

Minor fixes to logical id naming convention (5deed8c)

0.2.15 — 2025-04-24¶

Updating codepipeline builder, codebuild builder, increasing version (8284aed)

0.2.14 — 2025-04-24¶

Increasing version (ad280de)

0.2.13 — 2025-04-23¶

Increasing version (b378e3e)

0.2.12 — 2025-04-23¶

Refactorings related with code pipeline builder (8d3e0fc)

0.2.11 — 2025-04-16¶

remove duplicate code (162d40c)

0.2.10 — 2025-04-16¶

version 2.10 (55559f4) (commit message says "2.10", the actual version set was 0.2.10)

0.2.9 — 2025-04-15¶

Refactoring codepipeline_builder, increase version (22b494f)

0.2.8 — 2025-04-14¶

Adding dynamodb builder, increasing version (b2f93fa)

0.2.7 — 2025-04-14¶

Adding resource_naming and arn_uri_helper classes, increase version (e3935b2)

0.2.6 — 2025-04-11¶

Increasing version (1350d8c)

0.2.5 — 2025-04-11¶

Increasing version, debugging synth for cdk (250273c)

0.2.5 — 2025-04-11¶

add usage context on codebuild builder (0637fe3)

0.2.4 — 2025-04-09¶

Adding policies to pipeline role, increasing version (b825376)

0.2.3 — 2025-04-08¶

Adding some more enums, further develop codebuild and codepipeline builders (4b8d3ae)

0.2.2 — 2025-04-03¶

Version number and corrections (f977c84)

0.2.2 — 2025-03-28¶

Adding base class for CICD pipeline stacks (c8bcc91)

0.2.1 — 2025-03-25¶

Incrasing minor version, minor fix in code pipeline builder (d3dea5a)

0.2.0 — 2025-03-25¶

Minor refactoring, adding some documentation (7cb6622)

0.1.2 — 2025-03-25¶

Increasing version, adding cache to buildspec (49d7c4c)

0.1.1 — 2025-03-17¶

Minor fixes, upgrading version (8e03f09)

0.1.0 — 2025-03-14¶

Initial commit (7044c33)