Auto-fired by hulumi-ops-v1-3-research-kickoff routine on 2026-05-29. v1.2.0 ship-check passed (GitHub release non-draft published 2026-05-05; all four npm packages @hulumi/baseline, @hulumi/policies, @hulumi/drift, @hulumi/k8s-baseline confirmed at 1.2.0).
Full dossier: docs/research/hulumi-for-operations-v1-3/dossier.md (on branch research/hulumi-for-operations-v1-3-dossier).
Summary of findings
Q1 — EventApiDestination payload customization
Confirmed viable. EventBridge InputTransformer supports up to 100 JSONPath variables injected into a custom InputTemplate sent as the HTTP body. All four fields (cve_id, ecr_image_digest, severity, kev_added_date) can be extracted from Inspector v2 findings and injected into client_payload. No Lambda required. One caveat: kev_added_date maps to VendorCreatedAt (NVD publish date), not the CISA KEV add date — document this in the M4 JSDoc. Add an EventBridge event-pattern filter to prevent multi-finding batches from silently truncating to findings[0].
Q2 — EC2 Image Builder cost
Affordable. EC2 Image Builder charges $0/build-minute — costs are underlying EC2 + EBS snapshots only. Daily rebuild (30 min/build, m5.large) + 3 distribution targets in eu-west-2 with 7-day retention: **$6-7/month**. Sandbox weekly cadence: ~$1.50/month. Both tiers are affordable vs. v1.2 line items (Inspector v2 $1.26/EC2/month, Client VPN $73/month, EKS $73/month). Condition: Ec2GoldenAmiPipeline must ship a 7-day lifecycle policy as the component default or costs compound unchecked.
Q3 — GitHub repository_dispatch rate limits + retry semantics
AWS-native retry is sufficient. GitHub's primary rate limit is 1,000 req/hr/repo (fine-grained PAT) — far above expected KEV dispatch volume (single digits/week). GitHub returns HTTP 403 or 429 on rate limit; EventBridge retries all 4xx/5xx for up to 24 hours / 185 attempts with exponential backoff. Hulumi should NOT ship a mandatory DLQ. Instead: expose an optional deadLetterQueue?: aws.sqs.Queue prop on ContainerImageRebuildTrigger; emit pulumi.log.warn at StartupHardened when omitted.
Q4 — AsgInstanceRefresh.triggerOnAmiBump mechanism
Output<string> chain is correct for v1.3. The EventBridge rule on imagebuilder.amazonaws.com events requires a Lambda to resolve AMI tags → ASG name, violating the no-Lambda constraint. Output<string> chain is idiomatic Pulumi, type-safe, and keeps the deployment graph coherent. Document the CI integration gap (post-image-builder-pulumi-up.yml snippet in the M3 cookbook). Defer EventBridge rule to v1.4 opt-in.
A/B/C recommendation
Approach B — confirmed. No revision.
All four open questions resolved without blocking unknowns. The five-milestone shape (M1 EcrPullThroughCache → M2 Ec2GoldenAmiPipeline → M3 AsgInstanceRefresh → M4 ContainerImageRebuildTrigger → M5 threat-model scenarios + v1.3.0 release) stands unchanged. Three additive spec refinements identified:
Ec2GoldenAmiPipeline: 7-day lifecycle policy as component defaultContainerImageRebuildTrigger: event-pattern filter (CRITICAL, single-resource); optional deadLetterQueue prop; JSDoc on kev_added_date provenanceAsgInstanceRefresh: M3 cookbook CI snippet; document v1.4 EventBridge rule opt-in
Next step: /slo-architect hulumi-for-operations-v1-3 to produce the design record + threat model.
Filed by hulumi-ops-v1-3-research-kickoff routine.
Auto-fired by
hulumi-ops-v1-3-research-kickoffroutine on 2026-05-29. v1.2.0 ship-check passed (GitHub release non-draft published 2026-05-05; all four npm packages@hulumi/baseline,@hulumi/policies,@hulumi/drift,@hulumi/k8s-baselineconfirmed at 1.2.0).Full dossier:
docs/research/hulumi-for-operations-v1-3/dossier.md(on branchresearch/hulumi-for-operations-v1-3-dossier).Summary of findings
Q1 — EventApiDestination payload customization
Confirmed viable. EventBridge
InputTransformersupports up to 100 JSONPath variables injected into a customInputTemplatesent as the HTTP body. All four fields (cve_id,ecr_image_digest,severity,kev_added_date) can be extracted from Inspector v2 findings and injected intoclient_payload. No Lambda required. One caveat:kev_added_datemaps toVendorCreatedAt(NVD publish date), not the CISA KEV add date — document this in the M4 JSDoc. Add an EventBridge event-pattern filter to prevent multi-finding batches from silently truncating tofindings[0].Q2 — EC2 Image Builder cost
Affordable. EC2 Image Builder charges $0/build-minute — costs are underlying EC2 + EBS snapshots only. Daily rebuild (
30 min/build, m5.large) + 3 distribution targets in eu-west-2 with 7-day retention: **$6-7/month**. Sandbox weekly cadence: ~$1.50/month. Both tiers are affordable vs. v1.2 line items (Inspector v2 $1.26/EC2/month, Client VPN $73/month, EKS $73/month). Condition:Ec2GoldenAmiPipelinemust ship a 7-day lifecycle policy as the component default or costs compound unchecked.Q3 — GitHub repository_dispatch rate limits + retry semantics
AWS-native retry is sufficient. GitHub's primary rate limit is 1,000 req/hr/repo (fine-grained PAT) — far above expected KEV dispatch volume (single digits/week). GitHub returns HTTP 403 or 429 on rate limit; EventBridge retries all 4xx/5xx for up to 24 hours / 185 attempts with exponential backoff. Hulumi should NOT ship a mandatory DLQ. Instead: expose an optional
deadLetterQueue?: aws.sqs.Queueprop onContainerImageRebuildTrigger; emitpulumi.log.warnat StartupHardened when omitted.Q4 — AsgInstanceRefresh.triggerOnAmiBump mechanism
Output<string>chain is correct for v1.3. The EventBridge rule onimagebuilder.amazonaws.comevents requires a Lambda to resolve AMI tags → ASG name, violating the no-Lambda constraint.Output<string>chain is idiomatic Pulumi, type-safe, and keeps the deployment graph coherent. Document the CI integration gap (post-image-builder-pulumi-up.ymlsnippet in the M3 cookbook). Defer EventBridge rule to v1.4 opt-in.A/B/C recommendation
Approach B — confirmed. No revision.
All four open questions resolved without blocking unknowns. The five-milestone shape (M1 EcrPullThroughCache → M2 Ec2GoldenAmiPipeline → M3 AsgInstanceRefresh → M4 ContainerImageRebuildTrigger → M5 threat-model scenarios + v1.3.0 release) stands unchanged. Three additive spec refinements identified:
Ec2GoldenAmiPipeline: 7-day lifecycle policy as component defaultContainerImageRebuildTrigger: event-pattern filter (CRITICAL, single-resource); optionaldeadLetterQueueprop; JSDoc onkev_added_dateprovenanceAsgInstanceRefresh: M3 cookbook CI snippet; document v1.4 EventBridge rule opt-inNext step:
/slo-architect hulumi-for-operations-v1-3to produce the design record + threat model.Filed by hulumi-ops-v1-3-research-kickoff routine.