Skip to content

Comments

Add clean architecture proposal for resource lifecycle management#541

Merged
seanspeaks merged 1 commit intoclaude/add-admin-script-runner-013vTGRpW3vTxFGyRjfz7ajMfrom
claude/review-pr-517-discussion-T3VgD
Feb 21, 2026
Merged

Add clean architecture proposal for resource lifecycle management#541
seanspeaks merged 1 commit intoclaude/add-admin-script-runner-013vTGRpW3vTxFGyRjfz7ajMfrom
claude/review-pr-517-discussion-T3VgD

Conversation

@seanspeaks
Copy link
Contributor

Proposes a three-layer architecture to cleanly separate:

  1. Resource Lifecycle (MANAGED vs EXTERNAL vs CREATE_NEW)

    • Clarifies ownership: is it in our CloudFormation stack or not?
    • Addresses core issue: resources in stack MUST stay in template
  2. Resource Discovery (facts about what exists)

    • stackManaged: resources in OUR CloudFormation stack
    • external: resources found elsewhere (tags, names, APIs)
  3. Resource Resolution (decisions based on intent + discovery)

    • Combines app definition intent with discovery results
    • Returns explicit lifecycle decision per resource

Key improvements:

  • Eliminates confusion between "who owns it" vs "how we find it"
  • Makes self-heal purely about configuration convenience (NAT placement,
    route associations), not resource lifecycle
  • Systematic approach across ALL builders (VPC, Aurora, KMS, etc.)
  • Clear migration path from current "management" modes

Includes:

  • TypeScript interfaces for new schema
  • Detailed implementation examples
  • Migration strategy maintaining backwards compatibility
  • Real-world scenario walkthroughs

This addresses the root architectural issue identified during debugging
of the FriggLambdaSecurityGroup CloudFormation error.

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

…racking, adapter format

- AWS scheduler createSchedule now uses upsert pattern: tries CreateScheduleCommand
  first, falls back to UpdateScheduleCommand on ConflictException, preventing
  stale schedules when cron expressions are edited
- SQS handler catch block now calls completeAdminProcess with state: 'FAILED'
  when executionId is available, preventing orphaned execution records stuck
  in non-terminal state
- LocalSchedulerAdapter.listSchedules() now returns normalized format matching
  AWS adapter contract (Name, State, ScheduleExpression, ScheduleExpressionTimezone)

https://claude.ai/code/session_01BRAKMNfvY2Fpnwac7gbuq3
@seanspeaks seanspeaks changed the base branch from main to claude/add-admin-script-runner-013vTGRpW3vTxFGyRjfz7ajM February 21, 2026 19:22
@seanspeaks seanspeaks merged commit 1687d70 into claude/add-admin-script-runner-013vTGRpW3vTxFGyRjfz7ajM Feb 21, 2026
6 of 20 checks passed
@seanspeaks seanspeaks deleted the claude/review-pr-517-discussion-T3VgD branch February 21, 2026 19:22
@gitguardian
Copy link

gitguardian bot commented Feb 21, 2026

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request
GitGuardian id GitGuardian status Secret Commit Filename
22520632 Triggered Generic High Entropy Secret 29da1f3 packages/core/credential/repositories/tests/credential-repository-documentdb-encryption.test.js View secret
🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secret safely. Learn here the best practices.
  3. Revoke and rotate this secret.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider


🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

@sonarqubecloud
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants