@aws/nx-plugin 0.109.0 → 0.110.0

package/src/ts/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -135,7 +135,20 @@ export const handler = middy()
 
 exports[`ts-lambda-function generator > terraform iacProvider > should generate terraform files for lambda function and snapshot them > terraform-lambda-files 1`] = `
 {
-  "test-project-test-function.tf": "variable "tags" {
+  "test-project-test-function.tf": "terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "~> 2.0"
+    }
+  }
+}
+
+variable "tags" {
   description = "Tags to apply to resources"
   type        = map(string)
   default     = {}
@@ -157,12 +170,17 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
 locals {
   aws_account_id = data.aws_caller_identity.current.account_id
-  aws_region     = data.aws_region.current.name
+  aws_region     = data.aws_region.current.region
 }
 
 resource "random_string" "suffix" {
@@ -237,19 +255,29 @@ data "archive_file" "lambda_zip" {
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/lambda-functions/test-project-test-function/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "lambdas/test-project-test-function/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 resource "aws_lambda_function" "lambda_function" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "test-project-test-function-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_role.arn
-  handler         = "index.handler"
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-  runtime         = "nodejs22.x"
-  timeout         = 30
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name     = "test-project-test-function-\${random_string.suffix.result}"
+  role              = aws_iam_role.lambda_role.arn
+  handler           = "index.handler"
+  source_code_hash  = data.archive_file.lambda_zip.output_base64sha256
+  runtime           = "nodejs22.x"
+  timeout           = 30
 
   tracing_config {
     mode = "Active"
@@ -288,7 +316,20 @@ output "role_name" {
 `;
 
 exports[`ts-lambda-function generator > terraform iacProvider > should match snapshot for terraform generated files with different configurations > terraform-lambda-snapshot-function.tf 1`] = `
-"variable "tags" {
+"terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "~> 2.0"
+    }
+  }
+}
+
+variable "tags" {
   description = "Tags to apply to resources"
   type        = map(string)
   default     = {}
@@ -310,12 +351,17 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
 locals {
   aws_account_id = data.aws_caller_identity.current.account_id
-  aws_region     = data.aws_region.current.name
+  aws_region     = data.aws_region.current.region
 }
 
 resource "random_string" "suffix" {
@@ -390,19 +436,29 @@ data "archive_file" "lambda_zip" {
   output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/lambda-functions/test-project-snapshot-function/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "lambdas/test-project-snapshot-function/\${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 resource "aws_lambda_function" "lambda_function" {
   #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "test-project-snapshot-function-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_role.arn
-  handler         = "index.handler"
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-  runtime         = "nodejs22.x"
-  timeout         = 30
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name     = "test-project-snapshot-function-\${random_string.suffix.result}"
+  role              = aws_iam_role.lambda_role.arn
+  handler           = "index.handler"
+  source_code_hash  = data.archive_file.lambda_zip.output_base64sha256
+  runtime           = "nodejs22.x"
+  timeout           = 30
 
   tracing_config {
     mode = "Active"

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -520,10 +520,14 @@ variable "tags" {
   default     = {}
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). The agent reads its runtime configuration from this application."
+  type        = string
+}
 
-  application_name = "TerraformSnapshotServer-runtime-config"
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the agent runtime."
+  type        = string
 }
 
 module "agent_core_runtime" {
@@ -533,7 +537,7 @@ module "agent_core_runtime" {
   server_protocol = "MCP"
 
   env = merge({
-    RUNTIME_CONFIG_APP_ID = module.appconfig.application_id
+    RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
   }, var.env)
   additional_iam_policy_statements = concat([
     {
@@ -542,12 +546,10 @@ module "agent_core_runtime" {
         "appconfig:StartConfigurationSession",
         "appconfig:GetLatestConfiguration"
       ]
-      Resource = ["\${module.appconfig.application_arn}/*"]
+      Resource = ["\${var.appconfig_application_arn}/*"]
     }
   ], var.additional_iam_policy_statements)
   tags = var.tags
-
-  depends_on = [module.appconfig]
 }
 
 # Add agent runtime ARN to runtime config
@@ -572,8 +574,8 @@ output "agent_core_runtime_arn" {
 }
 
 output "appconfig_application_id" {
-  description = "AppConfig Application ID for runtime config"
-  value       = module.appconfig.application_id
+  description = "AppConfig Application ID for runtime config (passthrough of the shared \`appconfig_application_id\` input)."
+  value       = var.appconfig_application_id
 }
 "
 `;

package/src/ts/react-website/agui/generator.js

@@ -13,6 +13,7 @@ const agent_runtime_config_1 = require("../../../connection/agent-runtime-config
 const names_1 = require("../../../utils/names");
 const shared_shadcn_1 = require("../../../utils/shared-shadcn");
 const npm_scope_1 = require("../../../utils/npm-scope");
+const pnpm_workspace_1 = require("../../../utils/pnpm-workspace");
 /**
  * Wires a React website up to an AG-UI agent using CopilotKit and
  * @ag-ui/client's HttpAgent. Agent-server-language agnostic.
@@ -50,6 +51,12 @@ const addAgUiReactConnection = async (tree, options) => {
     const mainTsxPath = (0, devkit_1.joinPathFragments)(frontendProjectConfig.sourceRoot, 'main.tsx');
     await (0, ast_1.addSingleImport)(tree, mainTsxPath, 'AguiProvider', './components/AguiProvider');
     await (0, ast_1.applyGritQL)(tree, mainTsxPath, `\`<App />\` => \`<AguiProvider><App /></AguiProvider>\` where { $program <: not contains \`<AguiProvider>$_</AguiProvider>\` }`);
+    // @copilotkit/react-core transitively pulls in @scarf/scarf (telemetry),
+    // which has a postinstall script. Under pnpm 11's default
+    // `strictDepBuilds=true` that script is treated as an unreviewed build and
+    // fails the install. Register it as an explicitly-rejected build so pnpm
+    // knows we've seen it and will skip it instead of erroring.
+    (0, pnpm_workspace_1.registerPnpmBuiltDependencies)(tree, { '@scarf/scarf': false });
     (0, devkit_1.addDependenciesToPackageJson)(tree, (0, versions_1.withVersions)([
         '@copilotkit/react-core',
         '@ag-ui/client',

package/src/ts/react-website/agui/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/ts/react-website/agui/generator.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,2DAAqE;AACrE,sDAAuD;AACvD,4CAI4B;AAC5B,mFAAgG;AAChG,gDAAiD;AACjD,gEAAqE;AACrE,wDAA2E;AAiB3E;;;;;;;;;;;GAWG;AACI,MAAM,sBAAsB,GAAG,KAAK,EACzC,IAAU,EACV,OAAmC,EACnC,EAAE;IACF,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAClE,OAAO,CAAC;IAEV,MAAM,KAAK,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAA,wBAAY,EAAC,IAAA,6BAAiB,EAAC,IAAI,CAAC,CAAC,CAAC;IAEzD,8DAA8D;IAC9D,4EAA4E;IAC5E,+BAA+B;IAC/B,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,EAC/C,qBAAqB,CAAC,IAAI,EAC1B,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,EACvC,EAAE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY,EAAE,CACtD,CAAC;IAEF,yEAAyE;IACzE,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAA,qCAAqB,EAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAC5C,qBAAqB,CAAC,IAAI,EAC1B,EAAE,UAAU,EAAE,EACd,EAAE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY,EAAE,CACtD,CAAC;IAEF,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,0CAA0C,CAAC,EACxE,IAAA,0BAAiB,EAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,EAC5D,EAAE,EACF,EAAE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,IAAA,kCAAsB,EAAC,IAAI,EAAE;QACjC,OAAO,EAAE,qBAAqB,CAAC,IAAI;KACpC,CAAC,CAAC;IAEH,uDAAuD;IACvD,MAAM,2BAA2B,CAC/B,IAAI,EACJ,qBAAqB,EACrB,kBAAkB,CACnB,CAAC;IAEF,0DAA0D;IAC1D,MAAM,WAAW,GAAG,IAAA,0BAAiB,EACnC,qBAAqB,CAAC,UAAU,EAChC,UAAU,CACX,CAAC;IACF,MAAM,IAAA,qBAAe,EACnB,IAAI,EACJ,WAAW,EACX,cAAc,EACd,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX,gIAAgI,CACjI,CAAC;IAEF,IAAA,qCAA4B,EAC1B,IAAI,EACJ,IAAA,uBAAY,EAAC;QACX,wBAAwB;QACxB,eAAe;QACf,GAAI,CAAC,KAAK,KAAK,YAAY;YACzB,CAAC,CAAC,CAAC,oCAAoC,CAAC;YACxC,CAAC,CAAC,EAAE,CAAS;QACf,GAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAS;QACxD,GAAI,CAAC,IAAI,KAAK,KAAK;YACjB,CAAC,CAAC;gBACE,gBAAgB;gBAChB,WAAW;gBACX,+BAA+B;gBAC/B,oBAAoB;gBACpB,MAAM;aACP;YACH,CAAC,CAAC,EAAE,CAAS;QACf,GAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAS;KAC/D,CAAC,EACF,IAAA,uBAAY,EAAC,CAAC,GAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAS,CAAC,CAAC,CACtE,CAAC;IAEF,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,IAAA,2DAAoC,EAAC,IAAI,EAAE;QAC/C,kBAAkB,EAAE,IAAA,iBAAS,EAAC,kBAAkB,CAAC;QACjD,kBAAkB;KACnB,CAAC,CAAC;AACL,CAAC,CAAC;AAtGW,QAAA,sBAAsB,0BAsGjC;AAEF,MAAM,gBAAgB,GAAG,CACvB,qBAA2C,EAChC,EAAE;IACb,MAAM,UAAU,GAAI,qBAAqB,CAAC,QAAgB,EAAE,UAE/C,CAAC;IACd,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,KAAK,EACvC,IAAU,EACV,qBAA2C,EAC3C,kBAA0B,EAC1B,EAAE;IACF,MAAM,YAAY,GAAG,IAAA,0BAAiB,EACpC,qBAAqB,CAAC,UAAU,EAChC,YAAY,EACZ,kBAAkB,CACnB,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,kBAAkB,EAAE,CAAC;IAChD,wCAAwC;IACxC,MAAM,OAAO,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEpG,yBAAyB;IACzB,MAAM,IAAA,2BAAqB,EACzB,IAAI,EACJ,YAAY,EACZ,CAAC,QAAQ,CAAC,EACV,YAAY,QAAQ,EAAE,CACvB,CAAC;IAEF,6EAA6E;IAC7E,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,YAAY,EACZ,yFAAyF;QACvF,WAAW,OAAO,MAAM,QAAQ,yFAAyF;QACzH,4CAA4C,OAAO,MAAM,QAAQ,QAAQ,CAC5E,CAAC;IAEF,2EAA2E;IAC3E,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,YAAY,EACZ,yEAAyE;QACvE,8BAA8B,OAAO,KAAK;QAC1C,yCAAyC,OAAO,QAAQ;QACxD,yDAAyD,OAAO,SAAS;QACzE,uCAAuC,OAAO,OAAO;QACrD,iDAAiD,OAAO,QAAQ;QAChE,IAAI,CACP,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/ts/react-website/agui/generator.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,2DAAqE;AACrE,sDAAuD;AACvD,4CAI4B;AAC5B,mFAAgG;AAChG,gDAAiD;AACjD,gEAAqE;AACrE,wDAA2E;AAC3E,kEAA8E;AAiB9E;;;;;;;;;;;GAWG;AACI,MAAM,sBAAsB,GAAG,KAAK,EACzC,IAAU,EACV,OAAmC,EACnC,EAAE;IACF,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAClE,OAAO,CAAC;IAEV,MAAM,KAAK,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAA,wBAAY,EAAC,IAAA,6BAAiB,EAAC,IAAI,CAAC,CAAC,CAAC;IAEzD,8DAA8D;IAC9D,4EAA4E;IAC5E,+BAA+B;IAC/B,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,EAC/C,qBAAqB,CAAC,IAAI,EAC1B,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,EACvC,EAAE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY,EAAE,CACtD,CAAC;IAEF,yEAAyE;IACzE,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAA,qCAAqB,EAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAC5C,qBAAqB,CAAC,IAAI,EAC1B,EAAE,UAAU,EAAE,EACd,EAAE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY,EAAE,CACtD,CAAC;IAEF,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,0CAA0C,CAAC,EACxE,IAAA,0BAAiB,EAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,EAC5D,EAAE,EACF,EAAE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,IAAA,kCAAsB,EAAC,IAAI,EAAE;QACjC,OAAO,EAAE,qBAAqB,CAAC,IAAI;KACpC,CAAC,CAAC;IAEH,uDAAuD;IACvD,MAAM,2BAA2B,CAC/B,IAAI,EACJ,qBAAqB,EACrB,kBAAkB,CACnB,CAAC;IAEF,0DAA0D;IAC1D,MAAM,WAAW,GAAG,IAAA,0BAAiB,EACnC,qBAAqB,CAAC,UAAU,EAChC,UAAU,CACX,CAAC;IACF,MAAM,IAAA,qBAAe,EACnB,IAAI,EACJ,WAAW,EACX,cAAc,EACd,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,WAAW,EACX,gIAAgI,CACjI,CAAC;IAEF,yEAAyE;IACzE,0DAA0D;IAC1D,2EAA2E;IAC3E,yEAAyE;IACzE,4DAA4D;IAC5D,IAAA,8CAA6B,EAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/D,IAAA,qCAA4B,EAC1B,IAAI,EACJ,IAAA,uBAAY,EAAC;QACX,wBAAwB;QACxB,eAAe;QACf,GAAI,CAAC,KAAK,KAAK,YAAY;YACzB,CAAC,CAAC,CAAC,oCAAoC,CAAC;YACxC,CAAC,CAAC,EAAE,CAAS;QACf,GAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAS;QACxD,GAAI,CAAC,IAAI,KAAK,KAAK;YACjB,CAAC,CAAC;gBACE,gBAAgB;gBAChB,WAAW;gBACX,+BAA+B;gBAC/B,oBAAoB;gBACpB,MAAM;aACP;YACH,CAAC,CAAC,EAAE,CAAS;QACf,GAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAS;KAC/D,CAAC,EACF,IAAA,uBAAY,EAAC,CAAC,GAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAS,CAAC,CAAC,CACtE,CAAC;IAEF,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,IAAA,2DAAoC,EAAC,IAAI,EAAE;QAC/C,kBAAkB,EAAE,IAAA,iBAAS,EAAC,kBAAkB,CAAC;QACjD,kBAAkB;KACnB,CAAC,CAAC;AACL,CAAC,CAAC;AA7GW,QAAA,sBAAsB,0BA6GjC;AAEF,MAAM,gBAAgB,GAAG,CACvB,qBAA2C,EAChC,EAAE;IACb,MAAM,UAAU,GAAI,qBAAqB,CAAC,QAAgB,EAAE,UAE/C,CAAC;IACd,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,KAAK,EACvC,IAAU,EACV,qBAA2C,EAC3C,kBAA0B,EAC1B,EAAE;IACF,MAAM,YAAY,GAAG,IAAA,0BAAiB,EACpC,qBAAqB,CAAC,UAAU,EAChC,YAAY,EACZ,kBAAkB,CACnB,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,kBAAkB,EAAE,CAAC;IAChD,wCAAwC;IACxC,MAAM,OAAO,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEpG,yBAAyB;IACzB,MAAM,IAAA,2BAAqB,EACzB,IAAI,EACJ,YAAY,EACZ,CAAC,QAAQ,CAAC,EACV,YAAY,QAAQ,EAAE,CACvB,CAAC;IAEF,6EAA6E;IAC7E,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,YAAY,EACZ,yFAAyF;QACvF,WAAW,OAAO,MAAM,QAAQ,yFAAyF;QACzH,4CAA4C,OAAO,MAAM,QAAQ,QAAQ,CAC5E,CAAC;IAEF,2EAA2E;IAC3E,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,IAAA,iBAAW,EACf,IAAI,EACJ,YAAY,EACZ,yEAAyE;QACvE,8BAA8B,OAAO,KAAK;QAC1C,yCAAyC,OAAO,QAAQ;QACxD,yDAAyD,OAAO,SAAS;QACzE,uCAAuC,OAAO,OAAO;QACrD,iDAAiD,OAAO,QAAQ;QAChE,IAAI,CACP,CAAC;AACJ,CAAC,CAAC"}

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -587,6 +587,13 @@ resource "aws_cloudfront_distribution" "website" {
       aws_wafv2_web_acl.cloudfront_waf
     ]
   }
+
+  # CloudFront validates access to the distribution logs bucket when it
+  # creates the distribution.
+  depends_on = [
+    aws_s3_bucket_acl.distribution_logs_acl,
+    aws_s3_bucket_policy.distribution_logs_ssl_policy,
+  ]
 }
 
 # S3 Bucket Policy for CloudFront OAC

package/src/ts/strands-agent/__snapshots__/generator.spec.ts.snap

@@ -184,10 +184,14 @@ variable "tags" {
   default     = {}
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). The agent reads its runtime configuration from this application."
+  type        = string
+}
 
-  application_name = "TerraformSnapshotAgent-runtime-config"
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the agent runtime."
+  type        = string
 }
 
 module "agent_core_runtime" {
@@ -197,7 +201,7 @@ module "agent_core_runtime" {
   server_protocol = "HTTP"
 
   env = merge({
-    RUNTIME_CONFIG_APP_ID = module.appconfig.application_id
+    RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
   }, var.env)
   additional_iam_policy_statements = concat([
     {
@@ -206,7 +210,7 @@ module "agent_core_runtime" {
         "appconfig:StartConfigurationSession",
         "appconfig:GetLatestConfiguration"
       ]
-      Resource = ["\${module.appconfig.application_arn}/*"]
+      Resource = ["\${var.appconfig_application_arn}/*"]
     },
     # Grant access for the agent to invoke bedrock models
     {
@@ -222,8 +226,6 @@ module "agent_core_runtime" {
     }
   ], var.additional_iam_policy_statements)
   tags = var.tags
-
-  depends_on = [module.appconfig]
 }
 
 # Add agent runtime ARN to runtime config
@@ -248,8 +250,8 @@ output "agent_core_runtime_arn" {
 }
 
 output "appconfig_application_id" {
-  description = "AppConfig Application ID for runtime config"
-  value       = module.appconfig.application_id
+  description = "AppConfig Application ID for runtime config (passthrough of the shared \`appconfig_application_id\` input)."
+  value       = var.appconfig_application_id
 }
 "
 `;

package/src/utils/agent-core-constructs/files/terraform/app/agent-core/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -20,6 +20,16 @@ variable "tags" {
   default     = {}
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from `core/runtime-config/appconfig.application_id`). The agent reads its runtime configuration from this application."
+  type        = string
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from `core/runtime-config/appconfig.application_arn`). Used to scope the IAM read permission granted to the agent runtime."
+  type        = string
+}
+
 <%_ if (auth === 'Cognito') { _%>
 variable "user_pool_id" {
   description = "ID of the user pool for cognito authentication"
@@ -38,12 +48,6 @@ locals {
 }
 
 <%_ } _%>
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "<%= nameClassName %>-runtime-config"
-}
-
 module "agent_core_runtime" {
   source = "../../../core/agent-core"
   agent_runtime_name = "<%= nameClassName %>"
@@ -59,7 +63,7 @@ module "agent_core_runtime" {
 <%_ } _%>
 
   env = merge({
-    RUNTIME_CONFIG_APP_ID = module.appconfig.application_id
+    RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
   }, var.env)
   additional_iam_policy_statements = concat([
     {
@@ -68,7 +72,7 @@ module "agent_core_runtime" {
         "appconfig:StartConfigurationSession",
         "appconfig:GetLatestConfiguration"
       ]
-      Resource = ["${module.appconfig.application_arn}/*"]
+      Resource = ["${var.appconfig_application_arn}/*"]
     }<% if (serverProtocol !== 'MCP') { %>,
     # Grant access for the agent to invoke bedrock models
     {
@@ -84,8 +88,6 @@ module "agent_core_runtime" {
     }<% } %>
   ], var.additional_iam_policy_statements)
   tags = var.tags
-
-  depends_on = [module.appconfig]
 }
 
 # Add agent runtime ARN to runtime config
@@ -110,6 +112,6 @@ output "agent_core_runtime_arn" {
 }
 
 output "appconfig_application_id" {
-  description = "AppConfig Application ID for runtime config"
-  value       = module.appconfig.application_id
+  description = "AppConfig Application ID for runtime config (passthrough of the shared `appconfig_application_id` input)."
+  value       = var.appconfig_application_id
 }

package/src/utils/api-constructs/files/terraform/app/apis/http/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -38,6 +38,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 variable "cors_allow_credentials" {
   description = "Whether to allow credentials in CORS requests"
@@ -86,6 +91,12 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
 # Create Lambda ZIP file from the bundle directory
@@ -95,12 +106,20 @@ data "archive_file" "lambda_zip" {
   output_path = "${path.module}/../../../../../../../dist/packages/common/terraform/apis/<%- apiNameKebabCase %>/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/<%- apiNameKebabCase %>/${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 
 # Use the core HTTP API module
 module "http_api" {
   source = "../../../core/api/http-api"
 
-  api_name        = "<%- apiNameClassName %>"
+  api_name        = "<%- apiNameClassName %>-${random_string.suffix.result}"
   api_description = "<%- apiNameClassName %> HTTP API"
   stage_name      = "$default"
   stage_auto_deploy = true
@@ -125,8 +144,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "<%- apiNameClassName %>Handler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "<%- apiNameClassName %>Handler-${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   <%_ if (['trpc', 'smithy'].includes(backend.type)) { _%>
   handler         = "index.handler"
@@ -134,7 +155,7 @@ resource "aws_lambda_function" "api_lambda" {
   <%_ } else if (backend.type === 'fastapi') { _%>
   handler         = "run.sh"
   runtime         = "python3.14"
-  layers          = ["arn:aws:lambda:${data.aws_region.current.name}:753240598075:layer:LambdaAdapterLayerX86:24"]
+  layers          = ["arn:aws:lambda:${data.aws_region.current.region}:753240598075:layer:LambdaAdapterLayerX86:24"]
   <%_ } _%>
   timeout         = 30
   memory_size     = 128
@@ -171,7 +192,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "<%- apiNameClassName %>Handler-execution-role"
+  name = "<%- apiNameClassName %>Handler-execution-role-${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -204,7 +225,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "<%- apiNameClassName %>Handler-additional-policies"
+  name  = "<%- apiNameClassName %>Handler-additional-policies-${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -218,7 +239,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/<%- apiNameClassName %>Handler"
+  name              = "/aws/lambda/<%- apiNameClassName %>Handler-${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -239,11 +260,11 @@ resource "aws_apigatewayv2_authorizer" "cognito_authorizer" {
   api_id           = module.http_api.api_id
   authorizer_type  = "JWT"
   identity_sources = ["$request.header.Authorization"]
-  name             = "<%- apiNameClassName %>Authorizer"
+  name             = "<%- apiNameClassName %>Authorizer-${random_string.suffix.result}"
 
   jwt_configuration {
     audience = var.user_pool_client_ids
-    issuer   = "https://cognito-idp.${data.aws_region.current.name}.amazonaws.com/${var.user_pool_id}"
+    issuer   = "https://cognito-idp.${data.aws_region.current.region}.amazonaws.com/${var.user_pool_id}"
   }
 }
 <%_ } _%>
@@ -303,14 +324,6 @@ module "add_url_to_runtime_config" {
   depends_on = [module.http_api]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "<%- apiNameClassName %>-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Lambda permission for API Gateway to invoke the function<% if (backend.type === 'fastapi') { %> via alias<% } %>
 resource "aws_lambda_permission" "api_gateway_invoke" {
   statement_id  = "AllowExecutionFromAPIGateway"

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -38,6 +38,11 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
+  type        = string
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -76,20 +81,34 @@ variable "tags" {
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 # Resources
 
-# Create Lambda ZIP file from the FastAPI bundle directory
+# Create Lambda ZIP file from the bundle directory
 data "archive_file" "lambda_zip" {
   type        = "zip"
   source_dir  = "${path.module}/../../../../../../../<%- backend.bundleOutputDir %>"
   output_path = "${path.module}/../../../../../../../dist/packages/common/terraform/apis/<%- apiNameKebabCase %>/lambda.zip"
 }
 
+resource "aws_s3_object" "lambda_zip" {
+  bucket      = var.asset_bucket_name
+  key         = "apis/<%- apiNameKebabCase %>/${data.archive_file.lambda_zip.output_base64sha256}.zip"
+  source      = data.archive_file.lambda_zip.output_path
+  source_hash = data.archive_file.lambda_zip.output_base64sha256
+  etag        = data.archive_file.lambda_zip.output_md5
+}
+
 # Use the core REST API module
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
-  api_name        = "<%- apiNameClassName %>"
+  api_name        = "<%- apiNameClassName %>-${random_string.suffix.result}"
   api_description = "<%- apiNameClassName %> REST API"
   stage_name      = "prod"
   stage_auto_deploy = true
@@ -122,8 +141,10 @@ resource "aws_lambda_function" "api_lambda" {
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  filename         = data.archive_file.lambda_zip.output_path
-  function_name    = "<%- apiNameClassName %>Handler"
+  s3_bucket         = aws_s3_object.lambda_zip.bucket
+  s3_key            = aws_s3_object.lambda_zip.key
+  s3_object_version = aws_s3_object.lambda_zip.version_id
+  function_name    = "<%- apiNameClassName %>Handler-${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
   <%_ if (['trpc', 'smithy'].includes(backend.type)) { _%>
   handler         = "index.handler"
@@ -131,7 +152,7 @@ resource "aws_lambda_function" "api_lambda" {
   <%_ } else if (backend.type === 'fastapi') { _%>
   handler         = "run.sh"
   runtime         = "python3.14"
-  layers          = ["arn:aws:lambda:${data.aws_region.current.name}:753240598075:layer:LambdaAdapterLayerX86:24"]
+  layers          = ["arn:aws:lambda:${data.aws_region.current.region}:753240598075:layer:LambdaAdapterLayerX86:24"]
   <%_ } _%>
   timeout         = 30
   memory_size     = 128
@@ -168,7 +189,7 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "<%- apiNameClassName %>Handler-execution-role"
+  name = "<%- apiNameClassName %>Handler-execution-role-${random_string.suffix.result}"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -201,7 +222,7 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
   count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "<%- apiNameClassName %>Handler-additional-policies"
+  name  = "<%- apiNameClassName %>Handler-additional-policies-${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
@@ -215,7 +236,7 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/<%- apiNameClassName %>Handler"
+  name              = "/aws/lambda/<%- apiNameClassName %>Handler-${random_string.suffix.result}"
   tags              = var.tags
 }
 
@@ -233,10 +254,10 @@ resource "aws_lambda_alias" "live" {
 <%_ if (auth === 'Cognito') { _%>
 # Cognito User Pool Authorizer
 resource "aws_api_gateway_authorizer" "cognito_authorizer" {
-  name                   = "<%- apiNameClassName %>Authorizer"
+  name                   = "<%- apiNameClassName %>Authorizer-${random_string.suffix.result}"
   rest_api_id           = module.rest_api.api_id
   type                  = "COGNITO_USER_POOLS"
-  provider_arns         = ["arn:aws:cognito-idp:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:userpool/${var.user_pool_id}"]
+  provider_arns         = ["arn:aws:cognito-idp:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:userpool/${var.user_pool_id}"]
   identity_source       = "method.request.header.Authorization"
 }
 <%_ } _%>
@@ -258,7 +279,7 @@ resource "aws_api_gateway_integration" "lambda_integration" {
   type                    = "AWS_PROXY"
   <%_ if (backend.type === 'fastapi') { _%>
   # Use the response streaming invocation path with the alias ARN for SnapStart
-  uri                     = "arn:aws:apigateway:${data.aws_region.current.name}:lambda:path/2021-11-15/functions/${aws_lambda_alias.live.arn}/response-streaming-invocations"
+  uri                     = "arn:aws:apigateway:${data.aws_region.current.region}:lambda:path/2021-11-15/functions/${aws_lambda_alias.live.arn}/response-streaming-invocations"
   response_transfer_mode  = "STREAM"
   <%_ } else if (backend.type === 'trpc') { _%>
   uri                     = aws_lambda_function.api_lambda.response_streaming_invoke_arn
@@ -480,14 +501,6 @@ module "add_url_to_runtime_config" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-module "appconfig" {
-  source = "../../../core/runtime-config/appconfig"
-
-  application_name = "<%- apiNameClassName %>-runtime-config"
-
-  depends_on = [module.add_url_to_runtime_config]
-}
-
 # Outputs
 
 # API Gateway Outputs (from core module)

package/src/utils/api-constructs/files/terraform/core/api/http/http-api/http-api.tf.template

@@ -111,7 +111,7 @@ resource "aws_kms_key" "logs_key" {
         Sid    = "Allow CloudWatch Logs"
         Effect = "Allow"
         Principal = {
-          Service = "logs.${data.aws_region.current.name}.amazonaws.com"
+          Service = "logs.${data.aws_region.current.region}.amazonaws.com"
         }
         Action = [
           "kms:Encrypt",
@@ -123,7 +123,7 @@ resource "aws_kms_key" "logs_key" {
         Resource = "*"
         Condition = {
           ArnEquals = {
-            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/${var.api_name}"
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/${var.api_name}"
           }
         }
       }