@aws/nx-plugin 0.101.0 → 0.103.0

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -16,6 +16,7 @@ export * from './workspace.js';
 exports[`py#mcp-server generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > mcp-server-construct.ts 1`] = `
 "import { Lazy, Names } from 'aws-cdk-lib';
 import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
+import { Connections, IConnectable } from 'aws-cdk-lib/aws-ec2';
 import { Construct } from 'constructs';
 import * as path from 'path';
 import * as url from 'url';
@@ -37,7 +38,10 @@ export type SnapshotBedrockServerProps = Omit<
   | 'authorizerConfiguration'
 >;
 
-export class SnapshotBedrockServer extends Construct implements IGrantable {
+export class SnapshotBedrockServer
+  extends Construct
+  implements IGrantable, IConnectable
+{
   public readonly dockerImage: AgentRuntimeArtifact;
   public readonly agentCoreRuntime: Runtime;
 
@@ -89,6 +93,13 @@ export class SnapshotBedrockServer extends Construct implements IGrantable {
     return this.agentCoreRuntime.grantPrincipal;
   }
 
+  /**
+   * Network connections for this agent runtime.
+   */
+  public get connections(): Connections {
+    return this.agentCoreRuntime.connections;
+  }
+
   /**
    * Grants IAM permissions to invoke this agent runtime.
    *

package/src/py/strands-agent/__snapshots__/generator.spec.ts.snap

@@ -22,6 +22,7 @@ CMD ["python", "bin/opentelemetry-instrument", "python", "-m", "proj_test_projec
 exports[`py#strands-agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > agent-construct.ts 1`] = `
 "import { Lazy, Names } from 'aws-cdk-lib';
 import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
+import { Connections, IConnectable } from 'aws-cdk-lib/aws-ec2';
 import { Construct } from 'constructs';
 import * as path from 'path';
 import * as url from 'url';
@@ -48,7 +49,10 @@ export type SnapshotBedrockAgentProps = Omit<
   | 'authorizerConfiguration'
 >;
 
-export class SnapshotBedrockAgent extends Construct implements IGrantable {
+export class SnapshotBedrockAgent
+  extends Construct
+  implements IGrantable, IConnectable
+{
   public readonly dockerImage: AgentRuntimeArtifact;
   public readonly agentCoreRuntime: Runtime;
 
@@ -110,6 +114,13 @@ export class SnapshotBedrockAgent extends Construct implements IGrantable {
     return this.agentCoreRuntime.grantPrincipal;
   }
 
+  /**
+   * Network connections for this agent runtime.
+   */
+  public get connections(): Connections {
+    return this.agentCoreRuntime.connections;
+  }
+
   /**
    * Grants IAM permissions to invoke this agent runtime.
    *

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -85,6 +85,12 @@ export interface TestApiProps<
   identity: {
     userPool: IUserPool;
   };
+  /**
+   * Whether to enable AWS WAFv2 with the default managed ruleset on the API's default stage.
+   *
+   * @default true
+   */
+  enableWaf?: boolean;
 }
 
 /**
@@ -259,6 +265,12 @@ export interface TestApiProps<
    * Map of operation names to their API Gateway integrations
    */
   integrations: TIntegrations;
+  /**
+   * Whether to enable AWS WAFv2 with the default managed ruleset on the API's default stage.
+   *
+   * @default true
+   */
+  enableWaf?: boolean;
 }
 
 /**
@@ -419,6 +431,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 6.33"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.1"
+    }
   }
 }
 
@@ -447,6 +463,12 @@ variable "stage_auto_deploy" {
   default     = true
 }
 
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet). The Web ACL is created here and associated with the stage in the consuming module."
+  type        = bool
+  default     = true
+}
+
 # CORS Configuration
 
 variable "cors_allow_headers" {
@@ -528,6 +550,106 @@ resource "aws_api_gateway_gateway_response" "cors_5xx" {
   }
 }
 
+resource "aws_wafv2_web_acl" "api_waf" {
+  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.api_waf_logging; Checkov does not resolve the separate resource
+  count = var.enable_waf ? 1 : 0
+
+  name  = "\${var.api_name}-waf"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "CRSRule"
+    priority = 0
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+
+        # Count instead of Block: the CRS 8 KB body limit is too restrictive for most APIs.
+        rule_action_override {
+          name = "SizeRestrictions_BODY"
+          action_to_use {
+            count {}
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "\${var.api_name}WebAcl-CRS"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "KnownBadInputsRule"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "\${var.api_name}WebAcl-KnownBadInputs"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "\${var.api_name}WebAcl"
+    sampled_requests_enabled   = true
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
+resource "aws_cloudwatch_log_group" "api_waf_logs" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
+  retention_in_days = 30
+  tags              = var.tags
+}
+
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
+  count = var.enable_waf ? 1 : 0
+
+  log_destination_configs = [aws_cloudwatch_log_group.api_waf_logs[0].arn]
+  resource_arn            = aws_wafv2_web_acl.api_waf[0].arn
+}
+
+
 # Outputs
 
 output "api_id" {
@@ -555,6 +677,11 @@ output "api_root_resource_id" {
   value       = aws_api_gateway_rest_api.rest_api.root_resource_id
 }
 
+output "waf_web_acl_arn" {
+  description = "ARN of the WAFv2 Web ACL associated with the API, or null if WAF is disabled"
+  value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
+}
+
 # Note: Stage and deployment outputs are provided by the consuming module
 
 # Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement"
@@ -609,6 +736,13 @@ variable "cors_allow_origins" {
   default     = ["*"]
 }
 
+# WAF Configuration
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset on the API stage"
+  type        = bool
+  default     = true
+}
+
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -638,6 +772,9 @@ module "rest_api" {
   stage_name      = "prod"
   stage_auto_deploy = true
 
+  # WAF Configuration
+  enable_waf = var.enable_waf
+
   # CORS Configuration
   cors_allow_headers     = var.cors_allow_headers
   cors_allow_methods     = var.cors_allow_methods
@@ -647,6 +784,15 @@ module "rest_api" {
   tags = var.tags
 }
 
+resource "aws_wafv2_web_acl_association" "api_waf_association" {
+  count = var.enable_waf ? 1 : 0
+
+  resource_arn = aws_api_gateway_stage.api_stage.arn
+  web_acl_arn  = module.rest_api.waf_web_acl_arn
+
+  depends_on = [aws_api_gateway_stage.api_stage]
+}
+
 # Lambda function
 resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
@@ -855,6 +1001,7 @@ resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
   #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
+  #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
   rest_api_id          = module.rest_api.api_id
   stage_name           = "prod"
@@ -1446,6 +1593,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 6.33"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.1"
+    }
   }
 }
 
@@ -1474,6 +1625,12 @@ variable "stage_auto_deploy" {
   default     = true
 }
 
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet). The Web ACL is created here and associated with the stage in the consuming module."
+  type        = bool
+  default     = true
+}
+
 # CORS Configuration
 
 variable "cors_allow_headers" {
@@ -1555,6 +1712,106 @@ resource "aws_api_gateway_gateway_response" "cors_5xx" {
   }
 }
 
+resource "aws_wafv2_web_acl" "api_waf" {
+  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.api_waf_logging; Checkov does not resolve the separate resource
+  count = var.enable_waf ? 1 : 0
+
+  name  = "\${var.api_name}-waf"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "CRSRule"
+    priority = 0
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+
+        # Count instead of Block: the CRS 8 KB body limit is too restrictive for most APIs.
+        rule_action_override {
+          name = "SizeRestrictions_BODY"
+          action_to_use {
+            count {}
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "\${var.api_name}WebAcl-CRS"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "KnownBadInputsRule"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "\${var.api_name}WebAcl-KnownBadInputs"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "\${var.api_name}WebAcl"
+    sampled_requests_enabled   = true
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
+resource "aws_cloudwatch_log_group" "api_waf_logs" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
+  retention_in_days = 30
+  tags              = var.tags
+}
+
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
+  count = var.enable_waf ? 1 : 0
+
+  log_destination_configs = [aws_cloudwatch_log_group.api_waf_logs[0].arn]
+  resource_arn            = aws_wafv2_web_acl.api_waf[0].arn
+}
+
+
 # Outputs
 
 output "api_id" {
@@ -1582,6 +1839,11 @@ output "api_root_resource_id" {
   value       = aws_api_gateway_rest_api.rest_api.root_resource_id
 }
 
+output "waf_web_acl_arn" {
+  description = "ARN of the WAFv2 Web ACL associated with the API, or null if WAF is disabled"
+  value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
+}
+
 # Note: Stage and deployment outputs are provided by the consuming module
 
 # Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
@@ -1643,6 +1905,13 @@ variable "cors_allow_origins" {
   default     = ["*"]
 }
 
+# WAF Configuration
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset on the API stage"
+  type        = bool
+  default     = true
+}
+
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -1672,6 +1941,9 @@ module "rest_api" {
   stage_name      = "prod"
   stage_auto_deploy = true
 
+  # WAF Configuration
+  enable_waf = var.enable_waf
+
   # CORS Configuration
   cors_allow_headers     = var.cors_allow_headers
   cors_allow_methods     = var.cors_allow_methods
@@ -1681,6 +1953,15 @@ module "rest_api" {
   tags = var.tags
 }
 
+resource "aws_wafv2_web_acl_association" "api_waf_association" {
+  count = var.enable_waf ? 1 : 0
+
+  resource_arn = aws_api_gateway_stage.api_stage.arn
+  web_acl_arn  = module.rest_api.waf_web_acl_arn
+
+  depends_on = [aws_api_gateway_stage.api_stage]
+}
+
 # Lambda function
 resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
@@ -1896,6 +2177,7 @@ resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
   #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
+  #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
   rest_api_id          = module.rest_api.api_id
   stage_name           = "prod"
@@ -2093,6 +2375,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 6.33"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.1"
+    }
   }
 }
 
@@ -2121,6 +2407,12 @@ variable "stage_auto_deploy" {
   default     = true
 }
 
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet). The Web ACL is created here and associated with the stage in the consuming module."
+  type        = bool
+  default     = true
+}
+
 # CORS Configuration
 
 variable "cors_allow_headers" {
@@ -2202,6 +2494,106 @@ resource "aws_api_gateway_gateway_response" "cors_5xx" {
   }
 }
 
+resource "aws_wafv2_web_acl" "api_waf" {
+  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.api_waf_logging; Checkov does not resolve the separate resource
+  count = var.enable_waf ? 1 : 0
+
+  name  = "\${var.api_name}-waf"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "CRSRule"
+    priority = 0
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+
+        # Count instead of Block: the CRS 8 KB body limit is too restrictive for most APIs.
+        rule_action_override {
+          name = "SizeRestrictions_BODY"
+          action_to_use {
+            count {}
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "\${var.api_name}WebAcl-CRS"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "KnownBadInputsRule"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "\${var.api_name}WebAcl-KnownBadInputs"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "\${var.api_name}WebAcl"
+    sampled_requests_enabled   = true
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
+resource "aws_cloudwatch_log_group" "api_waf_logs" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
+  retention_in_days = 30
+  tags              = var.tags
+}
+
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
+  count = var.enable_waf ? 1 : 0
+
+  log_destination_configs = [aws_cloudwatch_log_group.api_waf_logs[0].arn]
+  resource_arn            = aws_wafv2_web_acl.api_waf[0].arn
+}
+
+
 # Outputs
 
 output "api_id" {
@@ -2229,6 +2621,11 @@ output "api_root_resource_id" {
   value       = aws_api_gateway_rest_api.rest_api.root_resource_id
 }
 
+output "waf_web_acl_arn" {
+  description = "ARN of the WAFv2 Web ACL associated with the API, or null if WAF is disabled"
+  value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
+}
+
 # Note: Stage and deployment outputs are provided by the consuming module
 
 # Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
@@ -2280,6 +2677,13 @@ variable "cors_allow_origins" {
   default     = ["*"]
 }
 
+# WAF Configuration
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset on the API stage"
+  type        = bool
+  default     = true
+}
+
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -2309,6 +2713,9 @@ module "rest_api" {
   stage_name      = "prod"
   stage_auto_deploy = true
 
+  # WAF Configuration
+  enable_waf = var.enable_waf
+
   # CORS Configuration
   cors_allow_headers     = var.cors_allow_headers
   cors_allow_methods     = var.cors_allow_methods
@@ -2318,6 +2725,15 @@ module "rest_api" {
   tags = var.tags
 }
 
+resource "aws_wafv2_web_acl_association" "api_waf_association" {
+  count = var.enable_waf ? 1 : 0
+
+  resource_arn = aws_api_gateway_stage.api_stage.arn
+  web_acl_arn  = module.rest_api.waf_web_acl_arn
+
+  depends_on = [aws_api_gateway_stage.api_stage]
+}
+
 # Lambda function
 resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
@@ -2524,6 +2940,7 @@ resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
   #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
+  #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
   rest_api_id          = module.rest_api.api_id
   stage_name           = "prod"
@@ -2768,6 +3185,13 @@ variable "cors_allow_origins" {
   default     = ["*"]
 }
 
+# WAF Configuration
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset on the API stage"
+  type        = bool
+  default     = true
+}
+
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -2797,6 +3221,9 @@ module "rest_api" {
   stage_name      = "prod"
   stage_auto_deploy = true
 
+  # WAF Configuration
+  enable_waf = var.enable_waf
+
   # CORS Configuration
   cors_allow_headers     = var.cors_allow_headers
   cors_allow_methods     = var.cors_allow_methods
@@ -2806,6 +3233,15 @@ module "rest_api" {
   tags = var.tags
 }
 
+resource "aws_wafv2_web_acl_association" "api_waf_association" {
+  count = var.enable_waf ? 1 : 0
+
+  resource_arn = aws_api_gateway_stage.api_stage.arn
+  web_acl_arn  = module.rest_api.waf_web_acl_arn
+
+  depends_on = [aws_api_gateway_stage.api_stage]
+}
+
 # Lambda function
 resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
@@ -3014,6 +3450,7 @@ resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
   #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
+  #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
   rest_api_id          = module.rest_api.api_id
   stage_name           = "prod"