API Reference

Constructs

Network

AWS CDK Network Stack for creating VPCs with IPAM integration and Transit Gateway connectivity.

This stack creates:

• Two VPCs (Public and Private) with IPAM-allocated CIDR blocks
• VPC Flow Logs with CloudWatch Logs integration and KMS encryption
• Transit Gateway attachment for cross-VPC connectivity
• Optional VPC Gateway Endpoints for S3 and DynamoDB

Key features:

• Cross-account access to network resources via IAM roles
• Configurable CIDR block sizes for different environment needs
• Isolated subnet configuration for enhanced security
• CloudFormation exports for cross-stack references
• Consistent removal policy application across all resources

The stack supports configurable CIDR block sizes and removal policies for all resources.

Initializers

import { Network } from '@wenaas/wenaas-cdk'

new Network(scope: Construct, id: string, props: NetworkProps)

Name	Type	Description
scope	constructs.Construct	No description.
id	string	No description.
props	NetworkProps	No description.

---

scope^Required

• Type: constructs.Construct

---

id^Required

• Type: string

---

props^Required

• Type: NetworkProps

---

Methods

Name	Description
toString	Returns a string representation of this construct.

---

toString

public toString(): string

Returns a string representation of this construct.

Static Functions

Name	Description
isConstruct	Checks if x is a construct.

---

isConstruct

import { Network } from '@wenaas/wenaas-cdk'

Network.isConstruct(x: any)

Checks if x is a construct.

x^Required

• Type: any

Any object.

---

Properties

Name	Type	Description
node	constructs.Node	The tree node.
privateSubnetIds	string[]	Array of private subnet IDs.
publicSubnetIds	string[]	Array of public subnet IDs.
vpcPrivate	aws-cdk-lib.aws_ec2.Vpc	The private VPC instance.
vpcPublic	aws-cdk-lib.aws_ec2.Vpc	The public VPC instance.

---

node^Required

public readonly node: Node;

• Type: constructs.Node

The tree node.

---

privateSubnetIds^Required

public readonly privateSubnetIds: string[];

• Type: string[]

Array of private subnet IDs.

---

publicSubnetIds^Required

public readonly publicSubnetIds: string[];

• Type: string[]

Array of public subnet IDs.

---

vpcPrivate^Required

public readonly vpcPrivate: Vpc;

• Type: aws-cdk-lib.aws_ec2.Vpc

The private VPC instance.

---

vpcPublic^Required

public readonly vpcPublic: Vpc;

• Type: aws-cdk-lib.aws_ec2.Vpc

The public VPC instance.

---

SecureNodejsFunction

A secure Lambda NodejsFunction construct that enforces best security practices and complies with cdk-nag AwsSolutionsChecks and NIST80053R5Checks.

This construct ensures:

• CloudWatch logs are encrypted
• X-Ray tracing is enabled
• Dead letter queues are configured (optional)
• Appropriate IAM permissions are set
• Modern Node.js runtime is used
• Reasonable defaults for memory and timeout

Example

// Create a secure function with custom configuration
const secureFunction = new SecureNodejsFunction(this, 'CustomSecureFunction', {
  entry: path.join(__dirname, 'lambda/handler.ts'),
  logEncryptionKey: kmsKey,
  memorySize: 512,
  timeout: Duration.minutes(15),
  environment: {
    STAGE: 'production',
    LOG_LEVEL: 'info'
  },
  runtime: Runtime.NODEJS_20_X,
  architecture: Architecture.ARM_64
});

Initializers

import { SecureNodejsFunction } from '@wenaas/wenaas-cdk'

new SecureNodejsFunction(scope: Construct, id: string, props: SecureNodejsFunctionProps)

Name	Type	Description
scope	constructs.Construct	- The parent construct.
id	string	- The construct ID.
props	SecureNodejsFunctionProps	- The function properties.

---

scope^Required

• Type: constructs.Construct

The parent construct.

---

id^Required

• Type: string

The construct ID.

---

props^Required

• Type: SecureNodejsFunctionProps

The function properties.

---

Methods

Name	Description
toString	Returns a string representation of this construct.

---

toString

public toString(): string

Returns a string representation of this construct.

Static Functions

Name	Description
isConstruct	Checks if x is a construct.

---

isConstruct

import { SecureNodejsFunction } from '@wenaas/wenaas-cdk'

SecureNodejsFunction.isConstruct(x: any)

Checks if x is a construct.

x^Required

• Type: any

Any object.

---

Properties

Name	Type	Description
node	constructs.Node	The tree node.
function	aws-cdk-lib.aws_lambda.IFunction	The CloudFormation Lambda function resource.
functionArn	string	The Lambda function's ARN.
role	string	The Lambda function's execution role.

---

node^Required

public readonly node: Node;

• Type: constructs.Node

The tree node.

---

function^Required

public readonly function: IFunction;

• Type: aws-cdk-lib.aws_lambda.IFunction

The CloudFormation Lambda function resource.

---

functionArn^Required

public readonly functionArn: string;

• Type: string

The Lambda function's ARN.

---

role^Required

public readonly role: string;

• Type: string

The Lambda function's execution role.

---

SecureQueue

A construct for a default SQS queue with enforced SSL and sensible defaults.

This construct creates an SQS queue with SSL enforcement, ensuring secure communications by default. Users can customize all other aspects of the queue while maintaining this security requirement.

Example

// Create a FIFO queue with custom settings
const fifoQueue = new SecureQueue(this, 'FifoQueue', {
  encryptionMasterKey: kmsKey,
  fifo: true,
  visibilityTimeout: Duration.seconds(60),
  encryption: QueueEncryption.KMS,
  removalPolicy: RemovalPolicy.DESTROY
});

Initializers

import { SecureQueue } from '@wenaas/wenaas-cdk'

new SecureQueue(scope: Construct, id: string, props: SecureQueueProps)

Name	Type	Description
scope	constructs.Construct	- The parent construct.
id	string	- The construct ID.
props	SecureQueueProps	- The queue properties (optional).

---

scope^Required

• Type: constructs.Construct

The parent construct.

---

id^Required

• Type: string

The construct ID.

---

props^Required

• Type: SecureQueueProps

The queue properties (optional).

---

Methods

Name	Description
toString	Returns a string representation of this construct.

---

toString

public toString(): string

Returns a string representation of this construct.

Static Functions

Name	Description
isConstruct	Checks if x is a construct.

---

isConstruct

import { SecureQueue } from '@wenaas/wenaas-cdk'

SecureQueue.isConstruct(x: any)

Checks if x is a construct.

x^Required

• Type: any

Any object.

---

Properties

Name	Type	Description
node	constructs.Node	The tree node.
queue	aws-cdk-lib.aws_sqs.Queue	The SQS queue instance.
queueArn	string	The ARN of the SQS queue.
queueUrl	string	The URL of the SQS queue.

---

node^Required

public readonly node: Node;

• Type: constructs.Node

The tree node.

---

queue^Required

public readonly queue: Queue;

• Type: aws-cdk-lib.aws_sqs.Queue

The SQS queue instance.

---

queueArn^Required

public readonly queueArn: string;

• Type: string

The ARN of the SQS queue.

---

queueUrl^Required

public readonly queueUrl: string;

• Type: string

The URL of the SQS queue.

---

SecureQueueWithDLQ

A construct for a default SQS queue with enforced SSL and sensible defaults.

This construct creates an SQS queue with SSL enforcement, ensuring secure communications by default. Users can customize all other aspects of the queue while maintaining this security requirement.

Example

// Create a FIFO queue with custom settings
const fifoQueue = new SecureQueueWithDLQ(this, 'FifoQueue', {
  encryptionMasterKey: kmsKey,
  fifo: true,
  visibilityTimeout: Duration.seconds(60),
  encryption: QueueEncryption.KMS,
  removalPolicy: RemovalPolicy.DESTROY
});

Initializers

import { SecureQueueWithDLQ } from '@wenaas/wenaas-cdk'

new SecureQueueWithDLQ(scope: Construct, id: string, props: SecureQueueWithDLQProps)

Name	Type	Description
scope	constructs.Construct	- The parent construct.
id	string	- The construct ID.
props	SecureQueueWithDLQProps	- The queue properties (optional).

---

scope^Required

• Type: constructs.Construct

The parent construct.

---

id^Required

• Type: string

The construct ID.

---

props^Required

• Type: SecureQueueWithDLQProps

The queue properties (optional).

---

Methods

Name	Description
toString	Returns a string representation of this construct.

---

toString

public toString(): string

Returns a string representation of this construct.

Static Functions

Name	Description
isConstruct	Checks if x is a construct.

---

isConstruct

import { SecureQueueWithDLQ } from '@wenaas/wenaas-cdk'

SecureQueueWithDLQ.isConstruct(x: any)

Checks if x is a construct.

x^Required

• Type: any

Any object.

---

Properties

Name	Type	Description
node	constructs.Node	The tree node.
queue	aws-cdk-lib.aws_sqs.Queue	The SQS queue instance.
queueArn	string	The ARN of the SQS queue.
queueUrl	string	The URL of the SQS queue.

---

node^Required

public readonly node: Node;

• Type: constructs.Node

The tree node.

---

queue^Required

public readonly queue: Queue;

• Type: aws-cdk-lib.aws_sqs.Queue

The SQS queue instance.

---

queueArn^Required

public readonly queueArn: string;

• Type: string

The ARN of the SQS queue.

---

queueUrl^Required

public readonly queueUrl: string;

• Type: string

The URL of the SQS queue.

---

SwaggerUi

A construct that creates a Swagger UI endpoint for API Gateway.

This construct creates a Lambda function that serves the OpenAPI/Swagger documentation for the API Gateway. The function is integrated with API Gateway at the '/api-docs.json' path and returns the OpenAPI specification for the API.

The Lambda function retrieves the OpenAPI/Swagger specification from API Gateway using the AWS SDK, patches it to remove certain paths, and returns it as JSON.

Example

const api = new apigateway.RestApi(this, 'API');
const key = new kms.Key(this, 'LogKey');
const vpc = new ec2.Vpc(this, 'VPC');

new SwaggerUi(this, 'ApiDocs', {
  resource: api.root,
  logEncryptionKey: key,
  removalPolicy: RemovalPolicy.DESTROY,
  vpc: vpc,
});

Initializers

import { SwaggerUi } from '@wenaas/wenaas-cdk'

new SwaggerUi(scope: Construct, id: string, props: SwaggerUiProps)

Name	Type	Description
scope	constructs.Construct	- The scope in which to define this construct.
id	string	- The scoped ID of the construct.
props	SwaggerUiProps	- Properties for configuring the SwaggerUi construct.

---

scope^Required

• Type: constructs.Construct

The scope in which to define this construct.

---

id^Required

• Type: string

The scoped ID of the construct.

---

props^Required

• Type: SwaggerUiProps

Properties for configuring the SwaggerUi construct.

---

Methods

Name	Description
toString	Returns a string representation of this construct.

---

toString

public toString(): string

Returns a string representation of this construct.

Static Functions

Name	Description
isConstruct	Checks if x is a construct.

---

isConstruct

import { SwaggerUi } from '@wenaas/wenaas-cdk'

SwaggerUi.isConstruct(x: any)

Checks if x is a construct.

x^Required

• Type: any

Any object.

---

Properties

Name	Type	Description
node	constructs.Node	The tree node.
apiDocsFunction	aws-cdk-lib.aws_lambda.IFunction	The Lambda function that serves the API documentation.

---

node^Required

public readonly node: Node;

• Type: constructs.Node

The tree node.

---

apiDocsFunction^Required

public readonly apiDocsFunction: IFunction;

• Type: aws-cdk-lib.aws_lambda.IFunction

The Lambda function that serves the API documentation.

This function is integrated with API Gateway and returns the OpenAPI specification for the API.

---

Structs

NetworkProps

Configuration properties for the NetworkStack.

This interface defines all configurable options for creating VPCs with IPAM integration, Transit Gateway connectivity, and optional VPC Gateway Endpoints.

Initializer

import { NetworkProps } from '@wenaas/wenaas-cdk'

const networkProps: NetworkProps = { ... }

Properties

Name	Type	Description
exportNamePrefix	string	Export name prefix for CloudFormation outputs.
privateVpcFlowLogsKmsKey	aws-cdk-lib.aws_kms.IKey	KMS key for encrypting CloudWatch Logs for the Private VPC Flow Logs.
publicVpcFlowLogsKmsKey	aws-cdk-lib.aws_kms.IKey	KMS key for encrypting CloudWatch Logs for the Public VPC Flow Logs.
removalPolicy	aws-cdk-lib.RemovalPolicy	Removal policy for all stack resources that support it.
availabilityZones	string[]	The availability zones to use for VPC subnets.
privateVpcGatewayEndpoints	VpcGatewayEndpointConfig	Gateway endpoint configuration for the Private VPC.
privateVpcInterfaceEndpoints	VpcInterfaceEndpointConfig	Interface endpoint configuration for the Private VPC.
publicVpcGatewayEndpoints	VpcGatewayEndpointConfig	Gateway endpoint configuration for the Public VPC.
publicVpcInterfaceEndpoints	VpcInterfaceEndpointConfig	Interface endpoint configuration for the Public VPC.
subnetNetmask	number	The subnet mask length for individual subnets within the VPC. Must be larger than vpcNetmask (smaller CIDR block size).
vpcNetmask	number	The IPv4 netmask length for VPC CIDR allocation from IPAM pool.

---

exportNamePrefix^Required

public readonly exportNamePrefix: string;

• Type: string

Export name prefix for CloudFormation outputs.

This prefix is used to create unique export names for stack outputs, allowing other stacks to import these values using CloudFormation cross-stack references

Example: If prefix is "MyApp-Network", exports will be:

• MyApp-Network-PrivateVpcId
• MyApp-Network-PublicVpcId
• MyApp-Network-PrivateSubnetIds
• etc.

---

privateVpcFlowLogsKmsKey^Required

public readonly privateVpcFlowLogsKmsKey: IKey;

• Type: aws-cdk-lib.aws_kms.IKey

KMS key for encrypting CloudWatch Logs for the Private VPC Flow Logs.

Must be a valid KMS key with proper permissions for CloudWatch Logs service.

The key should have the following policy permissions for the logs service:

• kms:Encrypt
• kms:Decrypt
• kms:ReEncrypt*
• kms:GenerateDataKey
• kms:DescribeKey

Required parameter to ensure proper encryption of VPC Flow Logs.

---

publicVpcFlowLogsKmsKey^Required

public readonly publicVpcFlowLogsKmsKey: IKey;

• Type: aws-cdk-lib.aws_kms.IKey

KMS key for encrypting CloudWatch Logs for the Public VPC Flow Logs.

Must be a valid KMS key with proper permissions for CloudWatch Logs service.

The key should have the following policy permissions for the logs service:

• kms:Encrypt
• kms:Decrypt
• kms:ReEncrypt*
• kms:GenerateDataKey
• kms:DescribeKey

Required parameter to ensure proper encryption of VPC Flow Logs.

---

removalPolicy^Required

public readonly removalPolicy: RemovalPolicy;

• Type: aws-cdk-lib.RemovalPolicy

Removal policy for all stack resources that support it.

Options:

• DESTROY: Resources will be deleted when the stack is deleted
• RETAIN: Resources will be retained when the stack is deleted
• SNAPSHOT: Resources will be snapshotted before deletion (where applicable)

Note: This affects KMS keys, CloudWatch Log Groups, and other resources that support removal policies. Network resources like VPCs and subnets are always destroyed when the stack is deleted.

Required parameter to ensure consistent handling of resources.

---

availabilityZones^Optional

public readonly availabilityZones: string[];

• Type: string[]
• Default: All available AZs in the current region

The availability zones to use for VPC subnets.

When specified, subnets will be created in these specific AZs. This allows for consistent AZ placement across regions or limiting deployment to specific AZs for cost optimization.

Examples:

• ['eu-north-1a', 'eu-north-1b', 'eu-north-1c'] for all AZs in eu-north-1
• ['eu-central-1a', 'eu-central-1b'] for specific AZs in eu-central-1
• ['us-east-1a'] for single AZ deployment in us-east-1

If not specified, all available AZs in the current region will be used, which provides the best availability but may increase costs.

---

privateVpcGatewayEndpoints^Optional

public readonly privateVpcGatewayEndpoints: VpcGatewayEndpointConfig;

• Type: VpcGatewayEndpointConfig
• Default: No gateway endpoints enabled

Gateway endpoint configuration for the Private VPC.

Gateway endpoints provide cost-effective access to S3 and DynamoDB.

---

privateVpcInterfaceEndpoints^Optional

public readonly privateVpcInterfaceEndpoints: VpcInterfaceEndpointConfig;

• Type: VpcInterfaceEndpointConfig
• Default: No interface endpoints enabled

Interface endpoint configuration for the Private VPC.

Interface endpoints provide secure access to AWS services from within the VPC. Note: Interface endpoints incur hourly charges.

---

publicVpcGatewayEndpoints^Optional

public readonly publicVpcGatewayEndpoints: VpcGatewayEndpointConfig;

• Type: VpcGatewayEndpointConfig
• Default: No gateway endpoints enabled

Gateway endpoint configuration for the Public VPC.

Gateway endpoints provide cost-effective access to S3 and DynamoDB.

---

publicVpcInterfaceEndpoints^Optional

public readonly publicVpcInterfaceEndpoints: VpcInterfaceEndpointConfig;

• Type: VpcInterfaceEndpointConfig
• Default: No interface endpoints enabled

Interface endpoint configuration for the Public VPC.

Interface endpoints provide secure access to AWS services from within the VPC. Note: Interface endpoints incur hourly charges.

---

subnetNetmask^Optional

public readonly subnetNetmask: number;

• Type: number
• Default: 23

The subnet mask length for individual subnets within the VPC. Must be larger than vpcNetmask (smaller CIDR block size).

Subnet Planning Examples:

With /21 VPC (2,048 IPs total):

• /22 subnet = 2 subnets with 1,019 usable IPs each (1,024 - 5 reserved)
• /23 subnet = 4 subnets with 507 usable IPs each (512 - 5 reserved)
• /24 subnet = 8 subnets with 251 usable IPs each (256 - 5 reserved)
• /25 subnet = 16 subnets with 123 usable IPs each (128 - 5 reserved)

With /22 VPC (1,024 IPs total):

• /22 subnet = 1 subnet with 1,019 usable IPs (1,024 - 5 reserved)
• /23 subnet = 2 subnets with 507 usable IPs each (512 - 5 reserved)
• /24 subnet = 4 subnets with 251 usable IPs each (256 - 5 reserved)
• /25 subnet = 8 subnets with 123 usable IPs each (128 - 5 reserved)

Common Use Cases:

• /22-/23: Application tier subnets with many instances
• /24-/25: Database tier subnets with fewer instances
• /26-/27: Management/utility subnets with minimal resources

---

vpcNetmask^Optional

public readonly vpcNetmask: number;

• Type: number
• Default: 22

The IPv4 netmask length for VPC CIDR allocation from IPAM pool.

This determines the size of the entire VPC CIDR block.

CIDR Block Size Examples:

• /21 = 2,048 IPs (255.255.248.0) - Medium-large environments
• /22 = 1,024 IPs (255.255.252.0) - Medium environments
• /23 = 512 IPs (255.255.254.0) - Small-medium environments
• /24 = 256 IPs (255.255.255.0) - Small environments
• /25 = 128 IPs (255.255.255.128) - Minimal environments
• /26 = 64 IPs (255.255.255.192) - Very small environments
• /27 = 32 IPs (255.255.255.224) - Micro environments
• /28 = 16 IPs (255.255.255.240) - Development/Testing only

Note: AWS reserves 5 IP addresses in each subnet (first 4 and last 1).

---

SecureNodejsFunctionProps

Properties for the SecureNodejsFunction construct.

These properties define security-focused defaults that fulfill cdk-nag AwsSolutionsChecks and NIST80053R5Checks requirements.

Initializer

import { SecureNodejsFunctionProps } from '@wenaas/wenaas-cdk'

const secureNodejsFunctionProps: SecureNodejsFunctionProps = { ... }

Properties

Name	Type	Description
entry	string	Path to the entry file (JavaScript or TypeScript).
logEncryptionKey	aws-cdk-lib.aws_kms.IKey	Required encryption key for logs.
removalPolicy	aws-cdk-lib.RemovalPolicy	The policy to apply when the Lambda function is removed from the stack.
vpc	aws-cdk-lib.aws_ec2.IVpc	The VPC to associate with the Lambda function.
bundling	{[ key: string ]: any}	Bundle configuration.
deadLetterConfigEnabled	boolean	Whether to enable dead letter configuration.
deadLetterEncryptionKey	aws-cdk-lib.aws_kms.IKey	Dead letter configuration key for SQS/SNS encryption Strongly recommended for Lambda dead letter configurations.
deadLetterQueue	SecureQueue	The dead letter queue for the Lambda function.
depsLockFilePath	string	Path to the directory with the handler file.
description	string	Description for the Lambda function.
environment	{[ key: string ]: string}	Environment variables to pass to the function.
handler	string	The name of the exported handler in the entry file.
loggingFormat	aws-cdk-lib.aws_lambda.LoggingFormat	The format for CloudWatch logs.
logGroup	aws-cdk-lib.aws_logs.ILogGroup	The log group for the Lambda function.
logRetention	aws-cdk-lib.aws_logs.RetentionDays	The number of days log events are kept in CloudWatch Logs.
memorySize	number	The amount of memory, in MB, that is allocated to your Lambda function.
reservedConcurrentExecutions	number	The maximum of concurrent executions you want to reserve for the function.
role	aws-cdk-lib.aws_iam.Role	Lambda execution role.
runtime	aws-cdk-lib.aws_lambda.Runtime	The runtime environment.
securityGroups	aws-cdk-lib.aws_ec2.ISecurityGroup[]	The security groups to associate with the Lambda function.
systemLogLevelV2	aws-cdk-lib.aws_lambda.SystemLogLevel	The system log level for the Lambda function.
timeout	aws-cdk-lib.Duration	The function execution time (in seconds) after which Lambda terminates the function.
tracing	aws-cdk-lib.aws_lambda.Tracing	Enable active tracing with AWS X-Ray.
vpcSubnets	aws-cdk-lib.aws_ec2.SubnetSelection	The subnets to associate with the Lambda function.

---

entry^Required

public readonly entry: string;

• Type: string
• Default: Derived from the name of the defining file and the construct's id. If the NodejsFunction is defined in stack.ts with my-handler as id (new NodejsFunction(this, 'my-handler')), the construct will look at stack.my-handler.ts and stack.my-handler.js.

Path to the entry file (JavaScript or TypeScript).

---

logEncryptionKey^Required

public readonly logEncryptionKey: IKey;

• Type: aws-cdk-lib.aws_kms.IKey

Required encryption key for logs.

---

removalPolicy^Required

public readonly removalPolicy: RemovalPolicy;

• Type: aws-cdk-lib.RemovalPolicy
• Default: RemovalPolicy.RETAIN

The policy to apply when the Lambda function is removed from the stack.

---

vpc^Required

public readonly vpc: IVpc;

• Type: aws-cdk-lib.aws_ec2.IVpc

The VPC to associate with the Lambda function.

---

bundling^Optional

public readonly bundling: \{[ key: string ]: any\};

• Type: {[ key: string ]: any}
• Default: automatically determined by the runtime and entry file

Bundle configuration.

---

deadLetterConfigEnabled^Optional

public readonly deadLetterConfigEnabled: boolean;

• Type: boolean
• Default: true

Whether to enable dead letter configuration.

---

deadLetterEncryptionKey^Optional

public readonly deadLetterEncryptionKey: IKey;

• Type: aws-cdk-lib.aws_kms.IKey
• Default: undefined - Use logEncryptionKey if deadLetterConfigEnabled is true

Dead letter configuration key for SQS/SNS encryption Strongly recommended for Lambda dead letter configurations.

---

deadLetterQueue^Optional

public readonly deadLetterQueue: SecureQueue;

• Type: SecureQueue
• Default: A new Secure SQS queue is created

The dead letter queue for the Lambda function.

---

depsLockFilePath^Optional

public readonly depsLockFilePath: string;

• Type: string
• Default: the directory of the entry file

Path to the directory with the handler file.

---

description^Optional

public readonly description: string;

• Type: string
• Default: No description

Description for the Lambda function.

---

environment^Optional

public readonly environment: \{[ key: string ]: string\};

• Type: {[ key: string ]: string}
• Default: undefined

Environment variables to pass to the function.

---

handler^Optional

public readonly handler: string;

• Type: string
• Default: handler

The name of the exported handler in the entry file.

• If the code property is supplied, then you must include the handler property. The handler should be the name of the file that contains the exported handler and the function that should be called when the AWS Lambda is invoked. For example, if you had a file called myLambda.js and the function to be invoked was myHandler, then you should input handler property as myLambda.myHandler.

• If the code property is not supplied and the handler input does not contain a ., then the handler is prefixed with index. (index period). Otherwise, the handler property is not modified.

---

loggingFormat^Optional

public readonly loggingFormat: LoggingFormat;

• Type: aws-cdk-lib.aws_lambda.LoggingFormat
• Default: LoggingFormat.JSON

The format for CloudWatch logs.

---

logGroup^Optional

public readonly logGroup: ILogGroup;

• Type: aws-cdk-lib.aws_logs.ILogGroup
• Default: A new log group is created

The log group for the Lambda function.

---

logRetention^Optional

public readonly logRetention: RetentionDays;

• Type: aws-cdk-lib.aws_logs.RetentionDays
• Default: logs.RetentionDays.INFINITE

The number of days log events are kept in CloudWatch Logs.

When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to INFINITE.

This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with logs.LogGroup and use the logGroup property to instruct the Lambda function to send logs to it. Migrating from logRetention to logGroup will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust.

In AWS CDK code, you can access the log group name directly from the LogGroup construct:

import * as logs from 'aws-cdk-lib/aws-logs';

declare const myLogGroup: logs.LogGroup;
myLogGroup.logGroupName;

---

memorySize^Optional

public readonly memorySize: number;

• Type: number
• Default: 128

The amount of memory, in MB, that is allocated to your Lambda function.

Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide.

https://docs.aws.amazon.com/lambda/latest/dg/configuration-memory.html

---

reservedConcurrentExecutions^Optional

public readonly reservedConcurrentExecutions: number;

• Type: number
• Default: No specific limit - account limit.

The maximum of concurrent executions you want to reserve for the function.

https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html

---

role^Optional

public readonly role: Role;

• Type: aws-cdk-lib.aws_iam.Role
• Default: A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling addToRolePolicy.

Lambda execution role.

This is the role that will be assumed by the function upon execution. It controls the permissions that the function will have. The Role must be assumable by the 'lambda.amazonaws.com' service principal.

The default Role automatically has permissions granted for Lambda execution. If you provide a Role, you must add the relevant AWS managed policies yourself.

The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and "service-role/AWSLambdaVPCAccessExecutionRole".

---

runtime^Optional

public readonly runtime: Runtime;

• Type: aws-cdk-lib.aws_lambda.Runtime
• Default: Runtime.NODEJS_22_X

The runtime environment.

Only runtimes of the Node.js family are supported.

https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html

---

securityGroups^Optional

public readonly securityGroups: ISecurityGroup[];

• Type: aws-cdk-lib.aws_ec2.ISecurityGroup[]
• Default: A new security group is created

The security groups to associate with the Lambda function.

---

systemLogLevelV2^Optional

public readonly systemLogLevelV2: SystemLogLevel;

• Type: aws-cdk-lib.aws_lambda.SystemLogLevel
• Default: SystemLogLevel.INFO

The system log level for the Lambda function.

---

timeout^Optional

public readonly timeout: Duration;

• Type: aws-cdk-lib.Duration
• Default: Duration.seconds(3)

The function execution time (in seconds) after which Lambda terminates the function.

Because the execution time affects cost, set this value based on the function's expected execution time.

---

tracing^Optional

public readonly tracing: Tracing;

• Type: aws-cdk-lib.aws_lambda.Tracing
• Default: Tracing.ACTIVE

Enable active tracing with AWS X-Ray.

---

vpcSubnets^Optional

public readonly vpcSubnets: SubnetSelection;

• Type: aws-cdk-lib.aws_ec2.SubnetSelection
• Default: All private subnets in the VPC

The subnets to associate with the Lambda function.

---

SecureQueueProps

Properties for the SecureQueue construct.

All properties are optional and will use sensible defaults if not provided. Note that enforceSSL is always set to true and cannot be overridden.

Initializer

import { SecureQueueProps } from '@wenaas/wenaas-cdk'

const secureQueueProps: SecureQueueProps = { ... }

Properties

Name	Type	Description
encryptionMasterKey	aws-cdk-lib.aws_kms.IKey	Server-side encryption key (mandatory).
contentBasedDeduplication	boolean	The message content based deduplication.
deadLetterQueue	aws-cdk-lib.aws_sqs.Queue	The dead letter queue to which Amazon SQS moves messages.
deduplicationScope	aws-cdk-lib.aws_sqs.DeduplicationScope	Specifies whether message deduplication occurs at the message group or queue level.
deliveryDelay	aws-cdk-lib.Duration	The number of seconds for which the delivery of all messages in the queue is delayed.
fifo	boolean	Whether queue is FIFO (first-in-first-out).
fifoThroughputLimit	aws-cdk-lib.aws_sqs.FifoThroughputLimit	Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group.
maxMessageSizeBytes	number	The maximum size of the message in bytes.
maxReceiveCount	number	The number of times a message can be unsuccessfully dequeued before being moved to the dead letter queue.
removalPolicy	aws-cdk-lib.RemovalPolicy	The policy to apply when the queue is removed from the stack.
retentionPeriod	aws-cdk-lib.Duration	The number of seconds Amazon SQS retains a message.
visibilityTimeout	aws-cdk-lib.Duration	The length of time during which a message will be unavailable after a consumer starts processing it.

---

encryptionMasterKey^Required

public readonly encryptionMasterKey: IKey;

• Type: aws-cdk-lib.aws_kms.IKey

Server-side encryption key (mandatory).

---

contentBasedDeduplication^Optional

public readonly contentBasedDeduplication: boolean;

• Type: boolean
• Default: false

The message content based deduplication.

---

deadLetterQueue^Optional

public readonly deadLetterQueue: Queue;

• Type: aws-cdk-lib.aws_sqs.Queue
• Default: No dead-letter queue enabled

The dead letter queue to which Amazon SQS moves messages.

---

deduplicationScope^Optional

public readonly deduplicationScope: DeduplicationScope;

• Type: aws-cdk-lib.aws_sqs.DeduplicationScope
• Default: Amazon SQS defaults to MessageGroup

Specifies whether message deduplication occurs at the message group or queue level.

Only valid for FIFO queues.

---

deliveryDelay^Optional

public readonly deliveryDelay: Duration;

• Type: aws-cdk-lib.Duration
• Default: No delay

The number of seconds for which the delivery of all messages in the queue is delayed.

---

fifo^Optional

public readonly fifo: boolean;

• Type: boolean
• Default: false

Whether queue is FIFO (first-in-first-out).

---

fifoThroughputLimit^Optional

public readonly fifoThroughputLimit: FifoThroughputLimit;

• Type: aws-cdk-lib.aws_sqs.FifoThroughputLimit
• Default: Amazon SQS defaults to PerQueue

Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group.

Only valid for FIFO queues.

---

maxMessageSizeBytes^Optional

public readonly maxMessageSizeBytes: number;

• Type: number
• Default: 262144 (256 KiB)

The maximum size of the message in bytes.

---

maxReceiveCount^Optional

public readonly maxReceiveCount: number;

• Type: number
• Default: 3

The number of times a message can be unsuccessfully dequeued before being moved to the dead letter queue.

---

removalPolicy^Optional

public readonly removalPolicy: RemovalPolicy;

• Type: aws-cdk-lib.RemovalPolicy
• Default: RemovalPolicy.RETAIN

The policy to apply when the queue is removed from the stack.

---

retentionPeriod^Optional

public readonly retentionPeriod: Duration;

• Type: aws-cdk-lib.Duration
• Default: Duration.days(4)

The number of seconds Amazon SQS retains a message.

---

visibilityTimeout^Optional

public readonly visibilityTimeout: Duration;

• Type: aws-cdk-lib.Duration
• Default: Duration.seconds(30)

The length of time during which a message will be unavailable after a consumer starts processing it.

---

SecureQueueWithDLQProps

Properties for the SecureQueueWithDLQ construct.

All properties are optional and will use sensible defaults if not provided. Note that enforceSSL is always set to true and cannot be overridden.

Initializer

import { SecureQueueWithDLQProps } from '@wenaas/wenaas-cdk'

const secureQueueWithDLQProps: SecureQueueWithDLQProps = { ... }

Properties

Name	Type	Description
encryptionMasterKey	aws-cdk-lib.aws_kms.IKey	Server-side encryption key (mandatory).
contentBasedDeduplication	boolean	The message content based deduplication.
deadLetterQueue	aws-cdk-lib.aws_sqs.Queue	The dead letter queue to which Amazon SQS moves messages.
deduplicationScope	aws-cdk-lib.aws_sqs.DeduplicationScope	Specifies whether message deduplication occurs at the message group or queue level.
deliveryDelay	aws-cdk-lib.Duration	The number of seconds for which the delivery of all messages in the queue is delayed.
fifo	boolean	Whether queue is FIFO (first-in-first-out).
fifoThroughputLimit	aws-cdk-lib.aws_sqs.FifoThroughputLimit	Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group.
maxMessageSizeBytes	number	The maximum size of the message in bytes.
maxReceiveCount	number	The number of times a message can be unsuccessfully dequeued before being moved to the dead letter queue.
removalPolicy	aws-cdk-lib.RemovalPolicy	The policy to apply when the queue is removed from the stack.
retentionPeriod	aws-cdk-lib.Duration	The number of seconds Amazon SQS retains a message.
visibilityTimeout	aws-cdk-lib.Duration	The length of time during which a message will be unavailable after a consumer starts processing it.

---

encryptionMasterKey^Required

public readonly encryptionMasterKey: IKey;

• Type: aws-cdk-lib.aws_kms.IKey

Server-side encryption key (mandatory).

---

contentBasedDeduplication^Optional

public readonly contentBasedDeduplication: boolean;

• Type: boolean
• Default: false

The message content based deduplication.

---

deadLetterQueue^Optional

public readonly deadLetterQueue: Queue;

• Type: aws-cdk-lib.aws_sqs.Queue
• Default: No dead-letter queue enabled

The dead letter queue to which Amazon SQS moves messages.

---

deduplicationScope^Optional

public readonly deduplicationScope: DeduplicationScope;

• Type: aws-cdk-lib.aws_sqs.DeduplicationScope
• Default: Amazon SQS defaults to MessageGroup

Specifies whether message deduplication occurs at the message group or queue level.

Only valid for FIFO queues.

---

deliveryDelay^Optional

public readonly deliveryDelay: Duration;

• Type: aws-cdk-lib.Duration
• Default: No delay

The number of seconds for which the delivery of all messages in the queue is delayed.

---

fifo^Optional

public readonly fifo: boolean;

• Type: boolean
• Default: false

Whether queue is FIFO (first-in-first-out).

---

fifoThroughputLimit^Optional

public readonly fifoThroughputLimit: FifoThroughputLimit;

• Type: aws-cdk-lib.aws_sqs.FifoThroughputLimit
• Default: Amazon SQS defaults to PerQueue

Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group.

Only valid for FIFO queues.

---

maxMessageSizeBytes^Optional

public readonly maxMessageSizeBytes: number;

• Type: number
• Default: 262144 (256 KiB)

The maximum size of the message in bytes.

---

maxReceiveCount^Optional

public readonly maxReceiveCount: number;

• Type: number
• Default: 3

The number of times a message can be unsuccessfully dequeued before being moved to the dead letter queue.

---

removalPolicy^Optional

public readonly removalPolicy: RemovalPolicy;

• Type: aws-cdk-lib.RemovalPolicy
• Default: RemovalPolicy.RETAIN

The policy to apply when the queue is removed from the stack.

---

retentionPeriod^Optional

public readonly retentionPeriod: Duration;

• Type: aws-cdk-lib.Duration
• Default: Duration.days(4)

The number of seconds Amazon SQS retains a message.

---

visibilityTimeout^Optional

public readonly visibilityTimeout: Duration;

• Type: aws-cdk-lib.Duration
• Default: Duration.seconds(30)

The length of time during which a message will be unavailable after a consumer starts processing it.

---

SwaggerUiProps

Properties for the SwaggerUi construct.

This interface defines the required properties to create a Swagger UI integration with API Gateway using a secure Lambda function.

Initializer

import { SwaggerUiProps } from '@wenaas/wenaas-cdk'

const swaggerUiProps: SwaggerUiProps = { ... }

Properties

Name	Type	Description
logEncryptionKey	aws-cdk-lib.aws_kms.IKey	Required encryption key for Lambda function logs.
removalPolicy	aws-cdk-lib.RemovalPolicy	The removal policy for the resources created by this construct.
resource	aws-cdk-lib.aws_apigateway.IResource	The API Gateway resource where the Swagger UI will be attached.
vpc	aws-cdk-lib.aws_ec2.IVpc	The VPC to associate with the Lambda function for Swagger UI.
vpcSubnets	aws-cdk-lib.aws_ec2.SubnetSelection	The subnets to use for the Lambda function. This controls where the function will be deployed within the VPC.

---

logEncryptionKey^Required

public readonly logEncryptionKey: IKey;

• Type: aws-cdk-lib.aws_kms.IKey

Required encryption key for Lambda function logs.

Used to ensure log data is encrypted at rest.

---

removalPolicy^Required

public readonly removalPolicy: RemovalPolicy;

• Type: aws-cdk-lib.RemovalPolicy

The removal policy for the resources created by this construct.

Controls what happens when the resources are removed from the stack.

---

resource^Required

public readonly resource: IResource;

• Type: aws-cdk-lib.aws_apigateway.IResource

The API Gateway resource where the Swagger UI will be attached.

An 'api-docs.json' path will be created under this resource.

---

vpc^Required

public readonly vpc: IVpc;

• Type: aws-cdk-lib.aws_ec2.IVpc

The VPC to associate with the Lambda function for Swagger UI.

Lambda function will be deployed within this VPC for network isolation.

---

vpcSubnets^Required

public readonly vpcSubnets: SubnetSelection;

• Type: aws-cdk-lib.aws_ec2.SubnetSelection

The subnets to use for the Lambda function. This controls where the function will be deployed within the VPC.

IMPORTANT: This requires the subnets to be have a NAT Gateway

---

VpcGatewayEndpointConfig

Configuration for VPC Gateway Endpoints.

Gateway endpoints have no hourly charges and route traffic through AWS backbone.

Initializer

import { VpcGatewayEndpointConfig } from '@wenaas/wenaas-cdk'

const vpcGatewayEndpointConfig: VpcGatewayEndpointConfig = { ... }

Properties

Name	Type	Description
enableDynamoDB	boolean	Enable DynamoDB VPC Gateway Endpoint for cost-effective DynamoDB access.
enableS3	boolean	Enable S3 VPC Gateway Endpoint for cost-effective S3 access.

---

enableDynamoDB^Optional

public readonly enableDynamoDB: boolean;

• Type: boolean
• Default: false

Enable DynamoDB VPC Gateway Endpoint for cost-effective DynamoDB access.

Benefits:

• No data transfer charges for DynamoDB traffic within the same region
• Traffic stays within AWS backbone network
• Improved security by avoiding internet routing
• No additional hourly charges (unlike Interface Endpoints)

Considerations:

• Only works for DynamoDB traffic from EC2 instances in the VPC
• Requires route table configuration (handled automatically)
• Regional service - works within the same AWS region

---

enableS3^Optional

public readonly enableS3: boolean;

• Type: boolean
• Default: false

Enable S3 VPC Gateway Endpoint for cost-effective S3 access.

Benefits:

• No data transfer charges for S3 traffic within the same region
• Traffic stays within AWS backbone network
• Improved security by avoiding internet routing
• No additional hourly charges (unlike Interface Endpoints)

Considerations:

• Only works for S3 traffic from EC2 instances in the VPC
• Requires route table configuration (handled automatically)
• Regional service - works within the same AWS region

---

VpcInterfaceEndpointConfig

Configuration for VPC Interface Endpoints.

Interface endpoints have hourly charges but provide access to AWS services within VPC.

Initializer

import { VpcInterfaceEndpointConfig } from '@wenaas/wenaas-cdk'

const vpcInterfaceEndpointConfig: VpcInterfaceEndpointConfig = { ... }

Properties

Name	Type	Description
enableCloudWatch	boolean	Enable CloudWatch Monitoring VPC Interface Endpoint.
enableCloudWatchLogs	boolean	Enable CloudWatch Logs VPC Interface Endpoint.
enableEc2	boolean	Enable EC2 VPC Interface Endpoint.
enableEc2Messages	boolean	Enable EC2 Messages VPC Interface Endpoint.
enableEcr	boolean	Enable ECR VPC Interface Endpoint.
enableEcrDocker	boolean	Enable ECR Docker VPC Interface Endpoint.
enableEcs	boolean	Enable ECS VPC Interface Endpoint.
enableEcsTelemetry	boolean	Enable ECS Telemetry VPC Interface Endpoint.
enableKms	boolean	Enable KMS VPC Interface Endpoint.
enableLambda	boolean	Enable Lambda VPC Interface Endpoint.
enableMonitoring	boolean	Enable CloudWatch Monitoring VPC Interface Endpoint.
enableSecretsManager	boolean	Enable Secrets Manager VPC Interface Endpoint.
enableSns	boolean	Enable SNS VPC Interface Endpoint.
enableSqs	boolean	Enable SQS VPC Interface Endpoint.
enableSsm	boolean	Enable SSM (Systems Manager) VPC Interface Endpoint.
enableSsmMessages	boolean	Enable SSM Messages VPC Interface Endpoint.
enableSts	boolean	Enable STS (Security Token Service) VPC Interface Endpoint.

---

enableCloudWatch^Optional

public readonly enableCloudWatch: boolean;

• Type: boolean
• Default: false

Enable CloudWatch Monitoring VPC Interface Endpoint.

Allows CloudWatch metrics publishing without internet access.

---

enableCloudWatchLogs^Optional

public readonly enableCloudWatchLogs: boolean;

• Type: boolean
• Default: false

Enable CloudWatch Logs VPC Interface Endpoint.

Allows log streaming to CloudWatch without internet access.

---

enableEc2^Optional

public readonly enableEc2: boolean;

• Type: boolean
• Default: false

Enable EC2 VPC Interface Endpoint.

Allows EC2 API calls from within the VPC without internet access.

---

enableEc2Messages^Optional

public readonly enableEc2Messages: boolean;

• Type: boolean
• Default: false

Enable EC2 Messages VPC Interface Endpoint.

Required for SSM Agent communication.

---

enableEcr^Optional

public readonly enableEcr: boolean;

• Type: boolean
• Default: false

Enable ECR VPC Interface Endpoint.

Required for Docker image pulls from ECR without internet access. Note: This covers the ECR API functionality.

---

enableEcrDocker^Optional

public readonly enableEcrDocker: boolean;

• Type: boolean
• Default: false

Enable ECR Docker VPC Interface Endpoint.

Required for Docker image layer downloads from ECR.

---

enableEcs^Optional

public readonly enableEcs: boolean;

• Type: boolean
• Default: false

Enable ECS VPC Interface Endpoint.

Required for ECS tasks to communicate with ECS service.

---

enableEcsTelemetry^Optional

public readonly enableEcsTelemetry: boolean;

• Type: boolean
• Default: false

Enable ECS Telemetry VPC Interface Endpoint.

Required for ECS telemetry data collection.

---

enableKms^Optional

public readonly enableKms: boolean;

• Type: boolean
• Default: false

Enable KMS VPC Interface Endpoint.

Allows KMS operations from within the VPC without internet access.

---

enableLambda^Optional

public readonly enableLambda: boolean;

• Type: boolean
• Default: false

Enable Lambda VPC Interface Endpoint.

Allows Lambda function invocations from within the VPC.

---

enableMonitoring^Optional

public readonly enableMonitoring: boolean;

• Type: boolean
• Default: false

Enable CloudWatch Monitoring VPC Interface Endpoint.

Alternative name for CloudWatch metrics endpoint.

---

enableSecretsManager^Optional

public readonly enableSecretsManager: boolean;

• Type: boolean
• Default: false

Enable Secrets Manager VPC Interface Endpoint.

Allows secrets retrieval from within the VPC without internet access.

---

enableSns^Optional

public readonly enableSns: boolean;

• Type: boolean
• Default: false

Enable SNS VPC Interface Endpoint.

Allows SNS operations from within the VPC without internet access.

---

enableSqs^Optional

public readonly enableSqs: boolean;

• Type: boolean
• Default: false

Enable SQS VPC Interface Endpoint.

Allows SQS operations from within the VPC without internet access.

---

enableSsm^Optional

public readonly enableSsm: boolean;

• Type: boolean
• Default: false

Enable SSM (Systems Manager) VPC Interface Endpoint.

Required for SSM Session Manager and parameter access from within VPC.

---

enableSsmMessages^Optional

public readonly enableSsmMessages: boolean;

• Type: boolean
• Default: false

Enable SSM Messages VPC Interface Endpoint.

Required for SSM Session Manager functionality.

---

enableSts^Optional

public readonly enableSts: boolean;

• Type: boolean
• Default: false

Enable STS (Security Token Service) VPC Interface Endpoint.

Required for IAM role assumption from within the VPC.

---