@aws/nx-plugin 0.109.0 → 0.110.0

package/src/py/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -66,7 +66,20 @@ export class TestProjectTestFunction extends Function {
 
 exports[`lambda-handler project generator > terraform iacProvider > should generate terraform files for python lambda function and snapshot them > terraform-python-lambda-files 1`] = `
 {
-  "test-project-test-function.tf": "variable "tags" {
+  "test-project-test-function.tf": "terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "~> 2.0"
+    }
+  }
+}
+
+variable "tags" {
   description = "Tags to apply to resources"
   type        = map(string)
   default     = {}
@@ -88,12 +101,17 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
 locals {
   aws_account_id = data.aws_caller_identity.current.account_id
-  aws_region     = data.aws_region.current.name
+  aws_region     = data.aws_region.current.region
 }
 
 resource "random_string" "suffix" {
@@ -168,19 +186,29 @@ data "archive_file" "lambda_zip" {
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/lambda-functions/test-project-test-function/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "lambdas/test-project-test-function/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 resource "aws_lambda_function" "lambda_function" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "test-project-test-function-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_role.arn
-  handler         = "test_project.test_function.lambda_handler"
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-  runtime         = "python3.14"
-  timeout         = 30
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name     = "test-project-test-function-\${random_string.suffix.result}"
+  role              = aws_iam_role.lambda_role.arn
+  handler           = "test_project.test_function.lambda_handler"
+  source_code_hash  = data.archive_file.lambda_zip.output_base64sha256
+  runtime           = "python3.14"
+  timeout           = 30
 
   tracing_config {
     mode = "Active"
@@ -219,7 +247,20 @@ output "role_name" {
 `;
 
 exports[`lambda-handler project generator > terraform iacProvider > should match snapshot for terraform generated files with different configurations > terraform-python-lambda-snapshot-function.tf 1`] = `
-"variable "tags" {
+"terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "~> 2.0"
+    }
+  }
+}
+
+variable "tags" {
   description = "Tags to apply to resources"
   type        = map(string)
   default     = {}
@@ -241,12 +282,17 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
 locals {
   aws_account_id = data.aws_caller_identity.current.account_id
-  aws_region     = data.aws_region.current.name
+  aws_region     = data.aws_region.current.region
 }
 
 resource "random_string" "suffix" {
@@ -321,19 +367,29 @@ data "archive_file" "lambda_zip" {
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/lambda-functions/test-project-snapshot-function/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "lambdas/test-project-snapshot-function/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 resource "aws_lambda_function" "lambda_function" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "test-project-snapshot-function-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_role.arn
-  handler         = "test_project.snapshot_function.lambda_handler"
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-  runtime         = "python3.14"
-  timeout         = 30
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name     = "test-project-snapshot-function-\${random_string.suffix.result}"
+  role              = aws_iam_role.lambda_role.arn
+  handler           = "test_project.snapshot_function.lambda_handler"
+  source_code_hash  = data.archive_file.lambda_zip.output_base64sha256
+  runtime           = "python3.14"
+  timeout           = 30
 
   tracing_config {
     mode = "Active"

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -520,10 +520,14 @@ variable "tags" {
   default     = {}
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). The agent reads its runtime configuration from this application."
+  type        = string
+}
 
-  application_name = "TerraformSnapshotServer-runtime-config"
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the agent runtime."
+  type        = string
 }
 
 module "agent_core_runtime" {
@@ -533,7 +537,7 @@ module "agent_core_runtime" {
   server_protocol = "MCP"
 
   env = merge({
-    RUNTIME_CONFIG_APP_ID = module.appconfig.application_id
+    RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
   }, var.env)
   additional_iam_policy_statements = concat([
     {
@@ -542,12 +546,10 @@ module "agent_core_runtime" {
         "appconfig:StartConfigurationSession",
         "appconfig:GetLatestConfiguration"
       ]
-      Resource = ["\${module.appconfig.application_arn}/*"]
+      Resource = ["\${var.appconfig_application_arn}/*"]
     }
   ], var.additional_iam_policy_statements)
   tags = var.tags
-
-  depends_on = [module.appconfig]
 }
 
 # Add agent runtime ARN to runtime config
@@ -572,8 +574,8 @@ output "agent_core_runtime_arn" {
 }
 
 output "appconfig_application_id" {
-  description = "AppConfig Application ID for runtime config"
-  value       = module.appconfig.application_id
+  description = "AppConfig Application ID for runtime config (passthrough of the shared \`appconfig_application_id\` input)."
+  value       = var.appconfig_application_id
 }
 "
 `;

package/src/py/strands-agent/__snapshots__/generator.spec.ts.snap

@@ -183,10 +183,14 @@ variable "tags" {
   default     = {}
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). The agent reads its runtime configuration from this application."
+  type        = string
+}
 
-  application_name = "TerraformSnapshotAgent-runtime-config"
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the agent runtime."
+  type        = string
 }
 
 module "agent_core_runtime" {
@@ -196,7 +200,7 @@ module "agent_core_runtime" {
   server_protocol = "HTTP"
 
   env = merge({
-    RUNTIME_CONFIG_APP_ID = module.appconfig.application_id
+    RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
   }, var.env)
   additional_iam_policy_statements = concat([
     {
@@ -205,7 +209,7 @@ module "agent_core_runtime" {
         "appconfig:StartConfigurationSession",
         "appconfig:GetLatestConfiguration"
       ]
-      Resource = ["\${module.appconfig.application_arn}/*"]
+      Resource = ["\${var.appconfig_application_arn}/*"]
     },
     # Grant access for the agent to invoke bedrock models
     {
@@ -221,8 +225,6 @@ module "agent_core_runtime" {
     }
   ], var.additional_iam_policy_statements)
   tags = var.tags
-
-  depends_on = [module.appconfig]
 }
 
 # Add agent runtime ARN to runtime config
@@ -247,8 +249,8 @@ output "agent_core_runtime_arn" {
 }
 
 output "appconfig_application_id" {
-  description = "AppConfig Application ID for runtime config"
-  value       = module.appconfig.application_id
+  description = "AppConfig Application ID for runtime config (passthrough of the shared \`appconfig_application_id\` input)."
+  value       = var.appconfig_application_id
 }
 "
 `;