feat(vault): gate the secret store on a deployer input

.github/workflows/e2e-cloud.yml

@@ -64,6 +64,7 @@ on:
           - comprehensive-rust
           - comprehensive-ts
           - full-stack-microservices
+          - enabled-demo
           - command-routing-ts
           - container-rust
           - runtime-less-mixed
@@ -359,6 +360,11 @@ jobs:
               TERRAFORM_ENTRIES=$(echo "$TERRAFORM_ENTRIES" | jq -c '. + [{"name":"terraform-aks-helm-pull-comprehensive-rust","test_filter":"terraform_aks_helm_pull_comprehensive_rust","needs_oidc":true,"resource_suffix":"tfakscr"}]')
             fi
           fi
+          if [ "$APP" = "All" ] || [ "$APP" = "enabled-demo" ]; then
+            if [ "$PUSH_AWS_TERRAFORM" = "true" ]; then
+              TERRAFORM_ENTRIES=$(echo "$TERRAFORM_ENTRIES" | jq -c '. + [{"name":"terraform-aws-push-enabled-demo","test_filter":"terraform_aws_push_enabled_demo","needs_oidc":false,"resource_suffix":"tfawsed","bindings_arch":"aarch64"}]')
+            fi
+          fi
           if [ "$APP" = "All" ] || [ "$APP" = "full-stack-microservices" ]; then
             if [ "$KUBERNETES_AWS_TERRAFORM_HELM" = "true" ]; then
               TERRAFORM_ENTRIES=$(echo "$TERRAFORM_ENTRIES" | jq -c '. + [{"name":"terraform-eks-helm-pull-full-stack-microservices","test_filter":"terraform_eks_helm_pull_full_stack_microservices","needs_oidc":false,"resource_suffix":"tfeksfs","bindings_arch":"aarch64"}]')

crates/alien-cloudformation/src/emitters/aws/vault.rs

@@ -76,6 +76,14 @@ impl CfEmitter for AwsVaultEmitter {
         ]))
     }
 
+    /// The vault is a Parameter Store name prefix, so the only resources this
+    /// emitter returns are the IAM policies granting access to it. The generator
+    /// stamps the gate's `Condition` onto each of them, so declining the vault
+    /// also withholds the grants.
+    fn supports_enabled_when(&self) -> bool {
+        true
+    }
+
     fn emit_binding_ref(&self, ctx: &EmitContext<'_>) -> Result<Option<CfExpression>> {
         let vault = resource_config::<Vault>(ctx, Vault::RESOURCE_TYPE)?;
         Ok(Some(CfExpression::object([

crates/alien-cloudformation/tests/generator.rs

@@ -15,9 +15,9 @@ mod generator {
     pub mod aws_email_tests;
     pub mod aws_full_stack_tests;
     pub mod aws_open_search_tests;
-    pub mod enabled_queue_tests;
     pub mod enabled_storage_tests;
     pub mod enabled_tests;
+    pub mod enabled_vault_queue_tests;
     pub mod kubernetes_cluster_tests;
     pub mod network_tests;
     pub mod output_chunking_tests;