@aws/nx-plugin 0.108.0 → 0.109.1

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -716,6 +716,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -754,20 +759,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/test-api/backend/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -800,8 +819,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -826,7 +847,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -859,7 +880,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -873,7 +894,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -1053,14 +1074,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -1897,6 +1910,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -1935,20 +1953,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/test-api/backend/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -1981,8 +2013,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -2007,7 +2041,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -2040,7 +2074,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -2054,14 +2088,14 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
 
 # Cognito User Pool Authorizer
 resource "aws_api_gateway_authorizer" "cognito_authorizer" {
-  name                   = "TestApiAuthorizer"
+  name                   = "TestApiAuthorizer-\${random_string.suffix.result}"
   rest_api_id           = module.rest_api.api_id
   type                  = "COGNITO_USER_POOLS"
   provider_arns         = ["arn:aws:cognito-idp:\${data.aws_region.current.name}:\${data.aws_caller_identity.current.account_id}:userpool/\${var.user_pool_id}"]
@@ -2241,14 +2275,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -2669,6 +2695,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -2707,20 +2738,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/test-api/backend/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -2753,8 +2798,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -2779,7 +2826,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -2812,7 +2859,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -2826,7 +2873,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -3015,14 +3062,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -3177,6 +3216,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -3215,20 +3259,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/custom-api/backend/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/custom-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/custom-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "CustomApi"
+  api_name        = "CustomApi-\${random_string.suffix.result}"
   api_description = "CustomApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -3261,8 +3319,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "CustomApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "CustomApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -3287,7 +3347,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "CustomApiHandler-execution-role"
+  name = "CustomApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -3320,7 +3380,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "CustomApiHandler-additional-policies"
+  name  = "CustomApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -3334,7 +3394,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/CustomApiHandler"
+  name              = "/aws/lambda/CustomApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -3514,14 +3574,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "CustomApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)

package/src/terraform/project/files/application/scripts/aws-config.ts.template

@@ -0,0 +1,41 @@
+/**
+ * Resolves the current AWS account ID + region using the standard
+ * AWS SDK credential + config chain (same chain CDK uses).
+ */
+import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
+import {
+  NODE_REGION_CONFIG_FILE_OPTIONS,
+  NODE_REGION_CONFIG_OPTIONS,
+} from '@smithy/config-resolver';
+import { loadConfig } from '@smithy/node-config-provider';
+
+export interface AwsConfig {
+  accountId: string;
+  region: string;
+}
+
+export async function resolveAwsConfig(): Promise<AwsConfig> {
+  const region = await loadConfig(
+    NODE_REGION_CONFIG_OPTIONS,
+    NODE_REGION_CONFIG_FILE_OPTIONS,
+  )();
+  if (!region) {
+    throw new Error(
+      'Unable to resolve AWS region. Set the `AWS_REGION` environment variable or configure a default region via `aws configure`.',
+    );
+  }
+
+  const sts = new STSClient({
+    region,
+    credentials: fromNodeProviderChain(),
+  });
+  const identity = await sts.send(new GetCallerIdentityCommand({}));
+  if (!identity.Account) {
+    throw new Error(
+      'Unable to resolve AWS account ID — no credentials found in the default provider chain.',
+    );
+  }
+
+  return { accountId: identity.Account, region };
+}

package/src/terraform/project/files/application/scripts/bootstrap.ts.template

@@ -0,0 +1,91 @@
+/**
+ * Bootstraps the remote Terraform state bucket.
+ *
+ * Equivalent to `cdk bootstrap` — resolves account + region from the AWS
+ * SDK credential chain, pulls any existing bootstrap tfstate from S3,
+ * runs `terraform apply` in the `bootstrap` dir, then pushes the new
+ * state back to S3.
+ */
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import {
+  S3Client,
+  GetObjectCommand,
+  PutObjectCommand,
+} from '@aws-sdk/client-s3';
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
+import { resolveAwsConfig } from './aws-config';
+
+const projectRootRel = process.argv[2];
+if (!projectRootRel) {
+  throw new Error(
+    'Expected the project root as argv[2] — this script is wired up by the generated `bootstrap` nx target and should be invoked through it.',
+  );
+}
+const workspaceRoot = process.cwd();
+const projectRoot = resolve(workspaceRoot, projectRootRel);
+const bootstrapDir = join(projectRoot, 'bootstrap');
+const tfStatePath = join(
+  workspaceRoot,
+  'dist',
+  projectRootRel,
+  'terraform',
+  'bootstrap.tfstate',
+);
+
+const main = async () => {
+  const { accountId, region } = await resolveAwsConfig();
+  const bucket = `${accountId}-tf-state-${region}`;
+  const key = 'bootstrap.tfstate';
+
+  const s3 = new S3Client({ region, credentials: fromNodeProviderChain() });
+
+  mkdirSync(dirname(tfStatePath), { recursive: true });
+
+  // Pull any existing bootstrap tfstate. First-time bootstrap has no
+  // remote state yet — fall through and let terraform apply create the
+  // bucket.
+  try {
+    const out = await s3.send(
+      new GetObjectCommand({ Bucket: bucket, Key: key }),
+    );
+    if (out.Body) {
+      writeFileSync(tfStatePath, await out.Body.transformToByteArray());
+    }
+  } catch (err: any) {
+    const name = err?.name ?? '';
+    const status = err?.$metadata?.httpStatusCode;
+    const firstRun =
+      name === 'NoSuchBucket' ||
+      name === 'NoSuchKey' ||
+      status === 404 ||
+      status === 403;
+    if (!firstRun) throw err;
+  }
+
+  execFileSync('terraform', ['init'], { cwd: bootstrapDir, stdio: 'inherit' });
+  execFileSync(
+    'terraform',
+    [
+      'apply',
+      '-auto-approve',
+      `-state=${tfStatePath}`,
+      `-var=aws_region=${region}`,
+    ],
+    { cwd: bootstrapDir, stdio: 'inherit' },
+  );
+
+  await s3.send(
+    new PutObjectCommand({
+      Bucket: bucket,
+      Key: key,
+      Body: readFileSync(tfStatePath),
+    }),
+  );
+};
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/src/terraform/project/files/application/scripts/init.ts.template

@@ -0,0 +1,44 @@
+/**
+ * Runs `terraform init` against the remote S3 backend, resolving the
+ * backend config (bucket + region + per-env state key) from the AWS
+ * SDK credential chain. Pass the environment name via the `TF_ENV`
+ * env var (defaults to `dev`).
+ */
+import { execFileSync } from 'node:child_process';
+import { join, resolve } from 'node:path';
+import { resolveAwsConfig } from './aws-config';
+
+const STATE_KEY_PREFIX = '<%- stateKeyPrefix %>';
+
+const projectRootRel = process.argv[2];
+if (!projectRootRel) {
+  throw new Error(
+    'Expected the project root as argv[2] — this script is wired up by the generated `init` nx target and should be invoked through it.',
+  );
+}
+const srcDir = join(resolve(process.cwd(), projectRootRel), 'src');
+
+const main = async () => {
+  const { accountId, region } = await resolveAwsConfig();
+  const env = process.env.TF_ENV ?? 'dev';
+  const bucket = `${accountId}-tf-state-${region}`;
+  const key = `${STATE_KEY_PREFIX}/${env}/terraform.tfstate`;
+
+  execFileSync(
+    'terraform',
+    [
+      'init',
+      '-reconfigure',
+      `-backend-config=region=${region}`,
+      `-backend-config=bucket=${bucket}`,
+      `-backend-config=key=${key}`,
+      ...process.argv.slice(3),
+    ],
+    { cwd: srcDir, stdio: 'inherit' },
+  );
+};
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/src/terraform/project/generator.js

@@ -53,14 +53,8 @@ async function terraformProjectGenerator(tree, schema) {
             executor: 'nx:run-commands',
             options: {
                 forwardAllArgs: true,
-                commands: [
-                    `aws s3 cp s3://$(aws sts get-caller-identity --query Account --output text)-tf-state-$(aws configure get region)/bootstrap.tfstate ${tfDistDir}/bootstrap.tfstate || true`,
-                    'terraform init',
-                    `terraform apply -auto-approve -state=${tfDistDir}/bootstrap.tfstate -var="aws_region=$(aws configure get region)"`,
-                    `aws s3 cp ${tfDistDir}/bootstrap.tfstate s3://$(aws sts get-caller-identity --query Account --output text)-tf-state-$(aws configure get region)/bootstrap.tfstate`,
-                ],
-                parallel: false,
-                cwd: '{projectRoot}/bootstrap',
+                commands: ['tsx {projectRoot}/scripts/bootstrap.ts {projectRoot}'],
+                cwd: '{workspaceRoot}',
             },
         },
         'bootstrap-destroy': {
@@ -96,12 +90,13 @@ async function terraformProjectGenerator(tree, schema) {
             defaultConfiguration: 'dev',
             configurations: {
                 dev: {
-                    command: `terraform init -reconfigure -backend-config="region=$(aws configure get region)" -backend-config="bucket=$(aws sts get-caller-identity --query Account --output text)-tf-state-$(aws configure get region)" -backend-config="key=${(0, names_1.kebabCase)(lib.fullyQualifiedName)}/dev/terraform.tfstate"`,
+                    env: { TF_ENV: 'dev' },
                 },
             },
             options: {
                 forwardAllArgs: true,
-                cwd: '{projectRoot}/src',
+                commands: ['tsx {projectRoot}/scripts/init.ts {projectRoot}'],
+                cwd: '{workspaceRoot}',
             },
             dependsOn: ['^init'],
         },
@@ -198,6 +193,7 @@ async function terraformProjectGenerator(tree, schema) {
     lib.dir, // destination path of the files
     {
         metricsModulePath,
+        stateKeyPrefix: (0, names_1.kebabCase)(lib.fullyQualifiedName),
     }, {
         overwriteStrategy: devkit_1.OverwriteStrategy.Overwrite,
     });
@@ -214,7 +210,16 @@ async function terraformProjectGenerator(tree, schema) {
     await (0, metrics_1.addGeneratorMetricsIfApplicable)(tree, [
         exports.TERRAFORM_PROJECT_GENERATOR_INFO,
     ]);
-    (0, devkit_1.addDependenciesToPackageJson)(tree, {}, (0, versions_1.withVersions)(['@nx-extend/terraform', 'make-dir-cli']));
+    (0, devkit_1.addDependenciesToPackageJson)(tree, {}, (0, versions_1.withVersions)([
+        '@nx-extend/terraform',
+        'make-dir-cli',
+        'tsx',
+        '@aws-sdk/client-s3',
+        '@aws-sdk/client-sts',
+        '@aws-sdk/credential-providers',
+        '@smithy/config-resolver',
+        '@smithy/node-config-provider',
+    ]));
     // @nx-extend/terraform has a peer dependency on @nx/devkit ^21.0.0 which causes
     // npm install to fail, so for NPM we add a resolution
     // Can remove when https://github.com/TriPSs/nx-extend/issues/407 is addressed