Merge pull request #2930 from guardian/changeset-release/main

🦋 Release package updates

Author: akash1810

.changeset/famous-laws-sneeze.md

@@ -1,5 +1,61 @@
 # @guardian/cdk
 
+## 64.0.0
+
+### Major Changes
+
+- d880b52: Implement `GuParameterStoreReadPolicy` as a singleton to support `GuLoadBalancedAppExperimental` instantiating it once for the EC2 app and once for the ECS app.
+  The result is a single `AWS::IAM::Policy` resource in the CloudFormation template, which is attached to both the EC2 and ECS roles, keeping the diff small.
+
+  A [GitHub search](https://github.com/search?q=org%3Aguardian+GuParameterStoreReadPolicy+NOT+repo%3Aguardian%2Fcdk++NOT+is%3Aarchived&type=code) shows `GuParameterStoreReadPolicy` is never directly instantiated by clients.
+
+- 348cc70: Removes the `roleConfiguration` property when instantiating a `GuEc2App` or `GuLoadBalancedAppExperimental` in favour of declaring `additionalPolicies` as a top level property.
+  As a consequence, it is no longer possible to opt-out of log shipping with `withoutLogShipping`; the IAM Policy will always grant PutRecord to the account's logging Kinesis stream.
+
+  To migrate, remove the `roleConfiguration` property and move any policies declared in `roleConfiguration.additionalPolicies` to the top level `additionalPolicies` property:
+
+  ```ts
+  // Before
+  new GuEc2App(this, {
+    // other props
+    roleConfiguration: {
+      additionalPolicies: [
+        new GuAllowPolicy(this, "AllowPolicyCloudwatchLogs", {
+          actions: ["cloudwatch:*", "logs:*"],
+          resources: ["*"],
+        }),
+        new GuAllowPolicy(this, "AllowPolicyDescribeDecryptKms", {
+          actions: ["kms:Decrypt", "kms:DescribeKey"],
+          resources: [`arn:aws:kms:${region}:${account}:FrontendConfigKey`],
+        }),
+      ],
+    },
+  });
+
+  // After
+  new GuEc2App(this, {
+    // other props
+    additionalPolicies: [
+      new GuAllowPolicy(this, "AllowPolicyCloudwatchLogs", {
+        actions: ["cloudwatch:*", "logs:*"],
+        resources: ["*"],
+      }),
+      new GuAllowPolicy(this, "AllowPolicyDescribeDecryptKms", {
+        actions: ["kms:Decrypt", "kms:DescribeKey"],
+        resources: [`arn:aws:kms:${region}:${account}:FrontendConfigKey`],
+      }),
+    ],
+  });
+  ```
+
+  A [GitHub search](https://github.com/search?q=org%3Aguardian+withoutLogShipping+NOT+repo%3Aguardian%2Fcdk++NOT+is%3Aarchived+NOT+repo%3Aguardian%2Faws-account-setup&type=code)
+  shows the `withoutLogShipping` property is never set by clients when instantiating a `GuEc2App` or `GuLoadBalancedAppExperimental`.
+
+### Minor Changes
+
+- b97db0e: Apply `additionalPolicies` to ECS task role created for `GuLoadBalancedAppExperimental` so the ECS task role inherits any custom permissions needed to run the application.
+  These are already applied to the EC2 instance role.
+
 ## 63.6.2
 
 ### Patch Changes

.changeset/sweet-chicken-travel.md

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "63.6.2",
+  "version": "64.0.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [