@aws/nx-plugin 0.109.0 → 0.110.0

package/src/trpc/backend/__snapshots__/generator.spec.ts.snap

@@ -3034,7 +3034,7 @@ resource "aws_kms_key" "logs_key" {
         Sid    = "Allow CloudWatch Logs"
         Effect = "Allow"
         Principal = {
-          Service = "logs.\${data.aws_region.current.name}.amazonaws.com"
+          Service = "logs.\${data.aws_region.current.region}.amazonaws.com"
         }
         Action = [
           "kms:Encrypt",
@@ -3046,7 +3046,7 @@ resource "aws_kms_key" "logs_key" {
         Resource = "*"
         Condition = {
           ArnEquals = {
-            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.name}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/\${var.api_name}"
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/\${var.api_name}"
           }
         }
       }
@@ -3209,6 +3209,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 variable "cors_allow_credentials" {
   description = "Whether to allow credentials in CORS requests"
@@ -3257,6 +3262,12 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
 # Create Lambda ZIP file from the bundle directory
@@ -3266,12 +3277,20 @@ data "archive_file" "lambda_zip" {
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 
 # Use the core HTTP API module
 module "http_api" {
   source = "../../../core/api/http-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi HTTP API"
   stage_name      = "$default"
   stage_auto_deploy = true
@@ -3296,8 +3315,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -3322,7 +3343,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -3355,7 +3376,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -3369,7 +3390,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -3379,11 +3400,11 @@ resource "aws_apigatewayv2_authorizer" "cognito_authorizer" {
   api_id           = module.http_api.api_id
   authorizer_type  = "JWT"
   identity_sources = ["$request.header.Authorization"]
-  name             = "TestApiAuthorizer"
+  name             = "TestApiAuthorizer-\${random_string.suffix.result}"
 
   jwt_configuration {
     audience = var.user_pool_client_ids
-    issuer   = "https://cognito-idp.\${data.aws_region.current.name}.amazonaws.com/\${var.user_pool_id}"
+    issuer   = "https://cognito-idp.\${data.aws_region.current.region}.amazonaws.com/\${var.user_pool_id}"
   }
 }
 
@@ -3426,14 +3447,6 @@ module "add_url_to_runtime_config" {
   depends_on = [module.http_api]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Lambda permission for API Gateway to invoke the function
 resource "aws_lambda_permission" "api_gateway_invoke" {
   statement_id  = "AllowExecutionFromAPIGateway"
@@ -3674,7 +3687,7 @@ resource "aws_kms_key" "logs_key" {
         Sid    = "Allow CloudWatch Logs"
         Effect = "Allow"
         Principal = {
-          Service = "logs.\${data.aws_region.current.name}.amazonaws.com"
+          Service = "logs.\${data.aws_region.current.region}.amazonaws.com"
         }
         Action = [
           "kms:Encrypt",
@@ -3686,7 +3699,7 @@ resource "aws_kms_key" "logs_key" {
         Resource = "*"
         Condition = {
           ArnEquals = {
-            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.name}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/\${var.api_name}"
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/\${var.api_name}"
           }
         }
       }
@@ -3839,6 +3852,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 variable "cors_allow_credentials" {
   description = "Whether to allow credentials in CORS requests"
@@ -3887,6 +3905,12 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
 # Create Lambda ZIP file from the bundle directory
@@ -3896,12 +3920,20 @@ data "archive_file" "lambda_zip" {
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 
 # Use the core HTTP API module
 module "http_api" {
   source = "../../../core/api/http-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi HTTP API"
   stage_name      = "$default"
   stage_auto_deploy = true
@@ -3926,8 +3958,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -3952,7 +3986,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -3985,7 +4019,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -3999,7 +4033,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -4043,14 +4077,6 @@ module "add_url_to_runtime_config" {
   depends_on = [module.http_api]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Lambda permission for API Gateway to invoke the function
 resource "aws_lambda_permission" "api_gateway_invoke" {
   statement_id  = "AllowExecutionFromAPIGateway"
@@ -4291,7 +4317,7 @@ resource "aws_kms_key" "logs_key" {
         Sid    = "Allow CloudWatch Logs"
         Effect = "Allow"
         Principal = {
-          Service = "logs.\${data.aws_region.current.name}.amazonaws.com"
+          Service = "logs.\${data.aws_region.current.region}.amazonaws.com"
         }
         Action = [
           "kms:Encrypt",
@@ -4303,7 +4329,7 @@ resource "aws_kms_key" "logs_key" {
         Resource = "*"
         Condition = {
           ArnEquals = {
-            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.name}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/\${var.api_name}"
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/\${var.api_name}"
           }
         }
       }
@@ -4456,6 +4482,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 variable "cors_allow_credentials" {
   description = "Whether to allow credentials in CORS requests"
@@ -4504,6 +4535,12 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
 # Create Lambda ZIP file from the bundle directory
@@ -4513,12 +4550,20 @@ data "archive_file" "lambda_zip" {
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 
 # Use the core HTTP API module
 module "http_api" {
   source = "../../../core/api/http-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi HTTP API"
   stage_name      = "$default"
   stage_auto_deploy = true
@@ -4543,8 +4588,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -4569,7 +4616,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -4602,7 +4649,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -4616,7 +4663,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -4662,14 +4709,6 @@ module "add_url_to_runtime_config" {
   depends_on = [module.http_api]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Lambda permission for API Gateway to invoke the function
 resource "aws_lambda_permission" "api_gateway_invoke" {
   statement_id  = "AllowExecutionFromAPIGateway"
@@ -5100,6 +5139,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -5138,20 +5182,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/apps/test-api/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -5184,8 +5242,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -5210,7 +5270,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -5243,7 +5303,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -5257,17 +5317,17 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
 
 # Cognito User Pool Authorizer
 resource "aws_api_gateway_authorizer" "cognito_authorizer" {
-  name                   = "TestApiAuthorizer"
+  name                   = "TestApiAuthorizer-\${random_string.suffix.result}"
   rest_api_id           = module.rest_api.api_id
   type                  = "COGNITO_USER_POOLS"
-  provider_arns         = ["arn:aws:cognito-idp:\${data.aws_region.current.name}:\${data.aws_caller_identity.current.account_id}:userpool/\${var.user_pool_id}"]
+  provider_arns         = ["arn:aws:cognito-idp:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:userpool/\${var.user_pool_id}"]
   identity_source       = "method.request.header.Authorization"
 }
 
@@ -5445,14 +5505,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -5873,6 +5925,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -5911,20 +5968,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/apps/test-api/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -5957,8 +6028,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -5983,7 +6056,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -6016,7 +6089,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -6030,7 +6103,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -6220,14 +6293,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -6648,6 +6713,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -6686,20 +6756,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "\${path.module}/../../../../../../../dist/apps/test-api/bundle"
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "TestApi"
+  api_name        = "TestApi-\${random_string.suffix.result}"
   api_description = "TestApi REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -6732,8 +6816,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "TestApiHandler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "TestApiHandler-\${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -6758,7 +6844,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role"
+  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -6791,7 +6877,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies"
+  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -6805,7 +6891,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler"
+  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -6986,14 +7072,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "TestApi-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)