v0.2.0

New features

• Optional WAF attachment for CloudFront (#10): scopes can now attach an existing AWS WAFv2 WebACL to their CloudFront distribution. Opt-in via the new Security tab in the scope-configuration UI; default is none (full backward compatibility, no extra IAM required).
  • WAFv2 only, same-account, scope=CLOUDFRONT (us-east-1).
  • Modeled as a separate composed layer under deployment/security/ (implementations: none, waf) — following the same pattern as provider/network/distribution.
  • Attach/detach is an in-place CloudFront update — distribution ID stays stable.
  • Operators who opt in need to grant wafv2:ListWebACLs and wafv2:GetWebACL to the agent role.

Documentation

• New page on the docsite under Agent-backed scopes → Static files → AWS → WAF.

Release 0.0.1

Initial commit