@aws/nx-plugin 0.109.0 → 0.109.1

package/src/py/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -66,7 +66,20 @@ export class TestProjectTestFunction extends Function {
 
 exports[`lambda-handler project generator > terraform iacProvider > should generate terraform files for python lambda function and snapshot them > terraform-python-lambda-files 1`] = `
 {
-  "test-project-test-function.tf": "variable "tags" {
+  "test-project-test-function.tf": "terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "~> 2.0"
+    }
+  }
+}
+
+variable "tags" {
   description = "Tags to apply to resources"
   type        = map(string)
   default     = {}
@@ -88,6 +101,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
@@ -168,19 +186,29 @@ data "archive_file" "lambda_zip" {
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/lambda-functions/test-project-test-function/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "lambdas/test-project-test-function/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 resource "aws_lambda_function" "lambda_function" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "test-project-test-function-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_role.arn
-  handler         = "test_project.test_function.lambda_handler"
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-  runtime         = "python3.14"
-  timeout         = 30
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name     = "test-project-test-function-\${random_string.suffix.result}"
+  role              = aws_iam_role.lambda_role.arn
+  handler           = "test_project.test_function.lambda_handler"
+  source_code_hash  = data.archive_file.lambda_zip.output_base64sha256
+  runtime           = "python3.14"
+  timeout           = 30
 
   tracing_config {
     mode = "Active"
@@ -219,7 +247,20 @@ output "role_name" {
 `;
 
 exports[`lambda-handler project generator > terraform iacProvider > should match snapshot for terraform generated files with different configurations > terraform-python-lambda-snapshot-function.tf 1`] = `
-"variable "tags" {
+"terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "~> 2.0"
+    }
+  }
+}
+
+variable "tags" {
   description = "Tags to apply to resources"
   type        = map(string)
   default     = {}
@@ -241,6 +282,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
@@ -321,19 +367,29 @@ data "archive_file" "lambda_zip" {
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/lambda-functions/test-project-snapshot-function/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "lambdas/test-project-snapshot-function/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 resource "aws_lambda_function" "lambda_function" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "test-project-snapshot-function-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_role.arn
-  handler         = "test_project.snapshot_function.lambda_handler"
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-  runtime         = "python3.14"
-  timeout         = 30
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name     = "test-project-snapshot-function-\${random_string.suffix.result}"
+  role              = aws_iam_role.lambda_role.arn
+  handler           = "test_project.snapshot_function.lambda_handler"
+  source_code_hash  = data.archive_file.lambda_zip.output_base64sha256
+  runtime           = "python3.14"
+  timeout           = 30
 
   tracing_config {
     mode = "Active"

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -520,10 +520,14 @@ variable "tags" {
   default     = {}
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). The agent reads its runtime configuration from this application."
+  type        = string
+}
 
-  application_name = "TerraformSnapshotServer-runtime-config"
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the agent runtime."
+  type        = string
 }
 
 module "agent_core_runtime" {
@@ -533,7 +537,7 @@ module "agent_core_runtime" {
   server_protocol = "MCP"
 
   env = merge({
-    RUNTIME_CONFIG_APP_ID = module.appconfig.application_id
+    RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
   }, var.env)
   additional_iam_policy_statements = concat([
     {
@@ -542,12 +546,10 @@ module "agent_core_runtime" {
         "appconfig:StartConfigurationSession",
         "appconfig:GetLatestConfiguration"
       ]
-      Resource = ["\${module.appconfig.application_arn}/*"]
+      Resource = ["\${var.appconfig_application_arn}/*"]
     }
   ], var.additional_iam_policy_statements)
   tags = var.tags
-
-  depends_on = [module.appconfig]
 }
 
 # Add agent runtime ARN to runtime config
@@ -572,8 +574,8 @@ output "agent_core_runtime_arn" {
 }
 
 output "appconfig_application_id" {
-  description = "AppConfig Application ID for runtime config"
-  value       = module.appconfig.application_id
+  description = "AppConfig Application ID for runtime config (passthrough of the shared \`appconfig_application_id\` input)."
+  value       = var.appconfig_application_id
 }
 "
 `;

package/src/py/strands-agent/__snapshots__/generator.spec.ts.snap

@@ -183,10 +183,14 @@ variable "tags" {
   default     = {}
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). The agent reads its runtime configuration from this application."
+  type        = string
+}
 
-  application_name = "TerraformSnapshotAgent-runtime-config"
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the agent runtime."
+  type        = string
 }
 
 module "agent_core_runtime" {
@@ -196,7 +200,7 @@ module "agent_core_runtime" {
   server_protocol = "HTTP"
 
   env = merge({
-    RUNTIME_CONFIG_APP_ID = module.appconfig.application_id
+    RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
   }, var.env)
   additional_iam_policy_statements = concat([
     {
@@ -205,7 +209,7 @@ module "agent_core_runtime" {
         "appconfig:StartConfigurationSession",
         "appconfig:GetLatestConfiguration"
       ]
-      Resource = ["\${module.appconfig.application_arn}/*"]
+      Resource = ["\${var.appconfig_application_arn}/*"]
     },
     # Grant access for the agent to invoke bedrock models
     {
@@ -221,8 +225,6 @@ module "agent_core_runtime" {
     }
   ], var.additional_iam_policy_statements)
   tags = var.tags
-
-  depends_on = [module.appconfig]
 }
 
 # Add agent runtime ARN to runtime config
@@ -247,8 +249,8 @@ output "agent_core_runtime_arn" {
 }
 
 output "appconfig_application_id" {
-  description = "AppConfig Application ID for runtime config"
-  value       = module.appconfig.application_id
+  description = "AppConfig Application ID for runtime config (passthrough of the shared \`appconfig_application_id\` input)."
+  value       = var.appconfig_application_id
 }
 "
 `;

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -716,6 +716,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -754,20 +759,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/test-api/backend/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -800,8 +819,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -826,7 +847,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -859,7 +880,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -873,7 +894,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -1053,14 +1074,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -1897,6 +1910,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -1935,20 +1953,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/test-api/backend/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -1981,8 +2013,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -2007,7 +2041,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -2040,7 +2074,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -2054,14 +2088,14 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
 
 # Cognito User Pool Authorizer
 resource "aws_api_gateway_authorizer" "cognito_authorizer" {
-  name                   = "TestApiAuthorizer"
+  name                   = "TestApiAuthorizer-\${random_string.suffix.result}"
   rest_api_id           = module.rest_api.api_id
   type                  = "COGNITO_USER_POOLS"
   provider_arns         = ["arn:aws:cognito-idp:\${data.aws_region.current.name}:\${data.aws_caller_identity.current.account_id}:userpool/\${var.user_pool_id}"]
@@ -2241,14 +2275,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -2669,6 +2695,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -2707,20 +2738,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/test-api/backend/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -2753,8 +2798,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -2779,7 +2826,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -2812,7 +2859,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -2826,7 +2873,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -3015,14 +3062,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -3177,6 +3216,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -3215,20 +3259,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/custom-api/backend/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/custom-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/custom-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "CustomApi"
+  api_name        = "CustomApi-\${random_string.suffix.result}"
   api_description = "CustomApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -3261,8 +3319,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "CustomApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "CustomApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -3287,7 +3347,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "CustomApiHandler-execution-role"
+  name = "CustomApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -3320,7 +3380,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "CustomApiHandler-additional-policies"
+  name  = "CustomApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -3334,7 +3394,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/CustomApiHandler"
+  name              = "/aws/lambda/CustomApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -3514,14 +3574,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "CustomApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)