@aws/nx-plugin 0.109.0 → 0.110.0

package/src/utils/files/terraform/scripts/reset-runtime-config.ts.template

@@ -0,0 +1,25 @@
+/**
+ * Clears the runtime-config dist dir before every build so that removed
+ * modules don't leave behind stale entries in `connection.json` /
+ * `agentcore.json` / per-entry leaf files.
+ *
+ * Invoked by the `reset-runtime-config` nx target, which the `build`
+ * target depends on.
+ */
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+const distDir = process.env.DIST_DIR;
+if (!distDir) {
+  throw new Error('DIST_DIR environment variable is required');
+}
+
+// `runtime-config.json` starts as `{}` so the reader Terraform module can
+// assume the file exists.
+mkdirSync(distDir, { recursive: true });
+writeFileSync(join(distDir, 'runtime-config.json'), '{}');
+
+// Clear and recreate the per-entry leaf-file tree.
+const runtimeConfigDir = join(distDir, 'runtime-config');
+rmSync(runtimeConfigDir, { recursive: true, force: true });
+mkdirSync(join(runtimeConfigDir, 'entries'), { recursive: true });

package/src/utils/files/terraform/src/core/asset-bucket/asset-bucket.tf.template

@@ -0,0 +1,203 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
+  }
+}
+
+variable "bucket_name_prefix" {
+  description = "Optional prefix to apply to the generated bucket name. Useful when you want a stable, human-recognisable identifier in addition to the account/region/random suffix."
+  type        = string
+  default     = "assets"
+}
+
+variable "tags" {
+  description = "Tags to apply to all resources"
+  type        = map(string)
+  default     = {}
+}
+
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
+# Access logs bucket for the asset bucket.
+resource "aws_s3_bucket" "access_logs" {
+  #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for access log bucket
+  #checkov:skip=CKV_AWS_144:Cross-region replication not required for access log bucket
+  #checkov:skip=CKV2_AWS_62:Event notifications not required for access log bucket
+  #checkov:skip=CKV_AWS_18:Access logging the access log bucket would create a cycle
+  #checkov:skip=CKV_AWS_145:AES256 (S3-managed) encryption is sufficient for access logs
+  bucket        = "${var.bucket_name_prefix}-logs-${data.aws_caller_identity.current.account_id}-${data.aws_region.current.region}-${random_string.suffix.result}"
+  force_destroy = true
+
+  tags = var.tags
+}
+
+resource "aws_s3_bucket_versioning" "access_logs" {
+  bucket = aws_s3_bucket.access_logs.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "access_logs" {
+  bucket = aws_s3_bucket.access_logs.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "access_logs" {
+  bucket = aws_s3_bucket.access_logs.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_policy" "access_logs" {
+  bucket = aws_s3_bucket.access_logs.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "DenyInsecureConnections"
+        Effect    = "Deny"
+        Principal = "*"
+        Action    = "s3:*"
+        Resource = [
+          aws_s3_bucket.access_logs.arn,
+          "${aws_s3_bucket.access_logs.arn}/*"
+        ]
+        Condition = {
+          Bool = {
+            "aws:SecureTransport" = "false"
+          }
+        }
+      },
+      {
+        Sid       = "AllowS3LogDelivery"
+        Effect    = "Allow"
+        Principal = {
+          Service = "logging.s3.amazonaws.com"
+        }
+        Action   = "s3:PutObject"
+        Resource = "${aws_s3_bucket.access_logs.arn}/*"
+        Condition = {
+          StringEquals = {
+            "aws:SourceAccount" = data.aws_caller_identity.current.account_id
+          }
+        }
+      }
+    ]
+  })
+}
+
+# Shared asset bucket
+resource "aws_s3_bucket" "assets" {
+  #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for transient build artefacts
+  #checkov:skip=CKV_AWS_144:Cross-region replication not required for asset bucket
+  #checkov:skip=CKV2_AWS_62:Event notifications not required for asset bucket
+  #checkov:skip=CKV_AWS_145:AES256 (S3-managed) encryption is sufficient for build artefacts
+  bucket        = "${var.bucket_name_prefix}-${data.aws_caller_identity.current.account_id}-${data.aws_region.current.region}-${random_string.suffix.result}"
+  force_destroy = true
+
+  tags = var.tags
+}
+
+resource "aws_s3_bucket_versioning" "assets" {
+  bucket = aws_s3_bucket.assets.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "assets" {
+  bucket = aws_s3_bucket.assets.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "assets" {
+  bucket = aws_s3_bucket.assets.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_logging" "assets" {
+  bucket = aws_s3_bucket.assets.id
+
+  target_bucket = aws_s3_bucket.access_logs.id
+  target_prefix = "s3-access-logs/"
+}
+
+resource "aws_s3_bucket_policy" "assets" {
+  bucket = aws_s3_bucket.assets.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "DenyInsecureConnections"
+        Effect    = "Deny"
+        Principal = "*"
+        Action    = "s3:*"
+        Resource = [
+          aws_s3_bucket.assets.arn,
+          "${aws_s3_bucket.assets.arn}/*"
+        ]
+        Condition = {
+          Bool = {
+            "aws:SecureTransport" = "false"
+          }
+        }
+      }
+    ]
+  })
+}
+
+output "bucket_name" {
+  description = "Name of the shared asset bucket — pass to app modules' `asset_bucket_name` input."
+  value       = aws_s3_bucket.assets.id
+}
+
+output "bucket_arn" {
+  description = "ARN of the shared asset bucket"
+  value       = aws_s3_bucket.assets.arn
+}
+
+output "access_logs_bucket_name" {
+  description = "Name of the access-logs bucket that receives S3 access logs for the asset bucket."
+  value       = aws_s3_bucket.access_logs.id
+}
+
+output "access_logs_bucket_arn" {
+  description = "ARN of the access-logs bucket"
+  value       = aws_s3_bucket.access_logs.arn
+}

package/src/utils/files/terraform/src/core/runtime-config/appconfig/appconfig.tf.template

@@ -6,36 +6,48 @@ terraform {
       source  = "hashicorp/aws"
       version = ">= 5.0"
     }
-    local = {
-      source  = "hashicorp/local"
-      version = "~> 2.0"
-    }
   }
 }
 
+# Shared AppConfig application — call this module once per deployment and
+# thread its outputs into every API / agent / MCP / lambda module that
+# contributes a runtime-config entry. Aggregation and deployment of the
+# collected entries happens in the sibling `appconfig-deployment` module,
+# which you call once at the end of the root module with `depends_on`
+# covering every entry-contributing module.
+
 variable "application_name" {
   description = "Name of the AppConfig application"
   type        = string
 }
 
-locals {
-  config_dir = "${path.module}/../../../../../../../dist/packages/common/terraform/runtime-config"
+variable "namespaces" {
+  description = "List of runtime-config namespaces this AppConfig application should expose (one Configuration Profile is created per namespace)."
+  type        = list(string)
+  default     = ["connection", "agentcore"]
+}
+
+variable "deployment_strategy_id" {
+  description = "Optional AppConfig Deployment Strategy ID to use. When null (the default), this module provisions a zero-wait strategy so deployed config is visible to consumers as soon as terraform apply completes. Pass an existing strategy ID (e.g. `AppConfig.AllAtOnce` or a custom one) to reuse it across multiple AppConfig applications."
+  type        = string
+  default     = null
 }
 
-# AppConfig Application
 resource "aws_appconfig_application" "runtime_config" {
   name        = var.application_name
   description = "Runtime configuration for ${var.application_name}"
 }
 
-# AppConfig Environment
 resource "aws_appconfig_environment" "default" {
   name           = "default"
   application_id = aws_appconfig_application.runtime_config.id
 }
 
-# Instant deployment strategy (zero wait)
+# Instant (zero-wait) deployment strategy — only provisioned when the
+# caller doesn't pass a shared `deployment_strategy_id`.
 resource "aws_appconfig_deployment_strategy" "instant" {
+  count = var.deployment_strategy_id == null ? 1 : 0
+
   name                           = "${var.application_name}-instant"
   deployment_duration_in_minutes = 0
   growth_factor                  = 100
@@ -43,18 +55,9 @@ resource "aws_appconfig_deployment_strategy" "instant" {
   final_bake_time_in_minutes     = 0
 }
 
-# Read all namespace JSON files from the config directory
-locals {
-  namespace_files = fileset(local.config_dir, "*.json")
-  namespaces = {
-    for f in local.namespace_files :
-    trimsuffix(f, ".json") => jsondecode(file("${local.config_dir}/${f}"))
-  }
-}
-
 # Configuration Profile per namespace
 resource "aws_appconfig_configuration_profile" "namespace" {
-  for_each = local.namespaces
+  for_each = toset(var.namespaces)
 
   application_id = aws_appconfig_application.runtime_config.id
   name           = each.key
@@ -62,28 +65,13 @@ resource "aws_appconfig_configuration_profile" "namespace" {
   type           = "AWS.Freeform"
 }
 
-# Hosted Configuration Version per namespace
-resource "aws_appconfig_hosted_configuration_version" "namespace" {
-  for_each = local.namespaces
-
-  application_id           = aws_appconfig_application.runtime_config.id
-  configuration_profile_id = aws_appconfig_configuration_profile.namespace[each.key].configuration_profile_id
-  content_type             = "application/json"
-  content                  = jsonencode(each.value)
-}
-
-# Deployment per namespace
-resource "aws_appconfig_deployment" "namespace" {
-  for_each = local.namespaces
-
-  application_id           = aws_appconfig_application.runtime_config.id
-  environment_id           = aws_appconfig_environment.default.environment_id
-  configuration_profile_id = aws_appconfig_configuration_profile.namespace[each.key].configuration_profile_id
-  configuration_version    = aws_appconfig_hosted_configuration_version.namespace[each.key].version_number
-  deployment_strategy_id   = aws_appconfig_deployment_strategy.instant.id
+locals {
+  resolved_deployment_strategy_id = coalesce(
+    var.deployment_strategy_id,
+    try(aws_appconfig_deployment_strategy.instant[0].id, null),
+  )
 }
 
-# Outputs
 output "application_id" {
   description = "AppConfig Application ID"
   value       = aws_appconfig_application.runtime_config.id
@@ -98,3 +86,18 @@ output "environment_id" {
   description = "AppConfig Environment ID"
   value       = aws_appconfig_environment.default.environment_id
 }
+
+output "deployment_strategy_id" {
+  description = "AppConfig Deployment Strategy ID — either the one supplied via `var.deployment_strategy_id` or the zero-wait strategy provisioned by this module."
+  value       = local.resolved_deployment_strategy_id
+}
+
+output "configuration_profile_ids" {
+  description = "Map of namespace to Configuration Profile ID."
+  value       = { for k, p in aws_appconfig_configuration_profile.namespace : k => p.configuration_profile_id }
+}
+
+output "namespaces" {
+  description = "Passthrough of the namespaces configured on this application."
+  value       = var.namespaces
+}

package/src/utils/files/terraform/src/core/runtime-config/appconfig-deployment/appconfig-deployment.tf.template

@@ -0,0 +1,138 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.0"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.0"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = ">= 3.0"
+    }
+  }
+}
+
+variable "application_id" {
+  description = "AppConfig application ID (from `core/runtime-config/appconfig.application_id`)."
+  type        = string
+}
+
+variable "environment_id" {
+  description = "AppConfig environment ID (from `core/runtime-config/appconfig.environment_id`)."
+  type        = string
+}
+
+variable "deployment_strategy_id" {
+  description = "AppConfig deployment strategy ID (from `core/runtime-config/appconfig.deployment_strategy_id`)."
+  type        = string
+}
+
+variable "configuration_profile_ids" {
+  description = "Map of namespace to Configuration Profile ID (from `core/runtime-config/appconfig.configuration_profile_ids`)."
+  type        = map(string)
+}
+
+variable "namespaces" {
+  description = "List of namespaces to aggregate + deploy. Must match the keys of `configuration_profile_ids`."
+  type        = list(string)
+  default     = ["connection", "agentcore"]
+}
+
+locals {
+  config_dir  = "${path.module}/../../../../../../../dist/packages/common/terraform/runtime-config"
+  entries_dir = "${local.config_dir}/entries"
+}
+
+# Aggregate the per-entry leaf JSON files into a single JSON file per
+# namespace. Runs at apply time so every contributor's entry file is
+# guaranteed to be on disk when aggregation happens.
+resource "null_resource" "aggregate_namespace" {
+  for_each = toset(var.namespaces)
+
+  triggers = {
+    namespace = each.key
+    # Re-run the aggregation every apply so newly-written entries are
+    # always picked up. The local-exec is idempotent.
+    always = timestamp()
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      uv run python -c "
+import json
+import pathlib
+import sys
+
+namespace = '${each.key}'
+entries_dir = pathlib.Path('${local.entries_dir}') / namespace
+output_file = pathlib.Path('${local.config_dir}') / f'{namespace}.json'
+
+def deep_merge(target: dict, source: dict) -> dict:
+    for k, v in source.items():
+        if k in target and isinstance(target[k], dict) and isinstance(v, dict):
+            deep_merge(target[k], v)
+        else:
+            target[k] = v
+    return target
+
+# Each entry file is named '<key>-<sha>.json' — callers that share the
+# same (namespace, key) pair hash their value into a distinct sha suffix,
+# and their contributions are deep-merged back together under 'key' here.
+merged: dict = {}
+if entries_dir.is_dir():
+    for entry_path in sorted(entries_dir.glob('*.json')):
+        section = entry_path.stem.rsplit('-', 1)[0]
+        try:
+            contribution = json.loads(entry_path.read_text())
+        except json.JSONDecodeError as e:
+            print(f'Skipping malformed entry {entry_path}: {e}', file=sys.stderr)
+            continue
+        existing = merged.get(section)
+        if isinstance(existing, dict) and isinstance(contribution, dict):
+            deep_merge(existing, contribution)
+        else:
+            merged[section] = contribution
+
+output_file.parent.mkdir(parents=True, exist_ok=True)
+output_file.write_text(json.dumps(merged, indent=2))
+print(f'Aggregated {namespace}.json with {len(merged)} section(s)')
+"
+    EOT
+  }
+}
+
+data "local_file" "namespace_content" {
+  for_each = toset(var.namespaces)
+
+  filename   = "${local.config_dir}/${each.key}.json"
+  depends_on = [null_resource.aggregate_namespace]
+}
+
+resource "aws_appconfig_hosted_configuration_version" "namespace" {
+  for_each = toset(var.namespaces)
+
+  application_id           = var.application_id
+  configuration_profile_id = var.configuration_profile_ids[each.key]
+  content_type             = "application/json"
+  content                  = data.local_file.namespace_content[each.key].content
+}
+
+resource "aws_appconfig_deployment" "namespace" {
+  for_each = toset(var.namespaces)
+
+  application_id           = var.application_id
+  environment_id           = var.environment_id
+  configuration_profile_id = var.configuration_profile_ids[each.key]
+  configuration_version    = aws_appconfig_hosted_configuration_version.namespace[each.key].version_number
+  deployment_strategy_id   = var.deployment_strategy_id
+}
+
+output "hosted_configuration_version_numbers" {
+  description = "Map of namespace to hosted configuration version number."
+  value       = { for k, v in aws_appconfig_hosted_configuration_version.namespace : k => v.version_number }
+}

package/src/utils/files/terraform/src/core/runtime-config/entry/entry.tf.template

@@ -15,107 +15,43 @@ variable "namespace" {
 }
 
 variable "key" {
-  description = "Key name within the namespace (e.g., 'apis', 'cognitoProps')"
+  description = "Section name within the namespace (e.g., 'apis', 'cognitoProps'). Multiple `entry` modules may share the same key — the `appconfig` / `read` aggregation deep-merges their contributions under that key."
   type        = string
 }
 
 variable "value" {
-  description = "Value to set at the key"
+  description = "Value to set at the key. When the value is an object, its fields are deep-merged with any other `entry` module that targets the same (namespace, key) pair."
   type        = any
 }
 
 locals {
-  config_dir       = "${path.module}/../../../../../../../dist/packages/common/terraform/runtime-config"
-  config_file_path = "${local.config_dir}/${var.namespace}.json"
+  entries_dir = "${path.module}/../../../../../../../dist/packages/common/terraform/runtime-config/entries"
+  # A per-entry SHA256 so two modules writing to the same (namespace, key)
+  # produce distinct leaf files — the `appconfig-deployment` / `read`
+  # modules deep-merge them back together at apply time.
+  entry_id        = sha256(jsonencode({ key = var.key, value = var.value }))
+  entry_file_path = "${local.entries_dir}/${var.namespace}/${var.key}-${local.entry_id}.json"
 }
 
-# This module writes an entry to a namespaced runtime config JSON file.
-# Each namespace maps to a separate file (e.g., connection.json, tables.json)
-# which is then used by the AppConfig module and static website module.
-
-data "external" "updated_config" {
-  program = ["uv", "run", "python", "-c", <<-EOT
-import json
-import sys
-import os
-import time
-import fcntl
-from pathlib import Path
-
-# Read input from Terraform
-input_data = json.load(sys.stdin)
-config_file = input_data['config_file']
-key = input_data['key']
-value = json.loads(input_data['value'])
-
-# Create lock file path
-lock_file = config_file + '.lock'
-
-# Ensure directory exists
-Path(config_file).parent.mkdir(parents=True, exist_ok=True)
-
-# Acquire exclusive lock with retry mechanism
-max_retries = 30
-retry_delay = 1.0
-
-for attempt in range(max_retries):
-    try:
-        # Open lock file for exclusive access
-        with open(lock_file, 'w') as lock_fd:
-            # Try to acquire exclusive lock (non-blocking)
-            fcntl.flock(lock_fd.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
-
-            # Critical section - file operations under lock
-            try:
-                # Create empty base config if file doesn't exist
-                if not os.path.exists(config_file):
-                    base_config = {}
-                    with open(config_file, 'w') as f:
-                        json.dump(base_config, f, indent=2)
-
-                # Read current config
-                with open(config_file, 'r') as f:
-                    config = json.load(f)
-
-                # Set the key directly in the namespace file
-                config[key] = value
-
-                # Write updated config back to file atomically
-                temp_file = config_file + '.tmp'
-                with open(temp_file, 'w') as f:
-                    json.dump(config, f, indent=2)
-                os.rename(temp_file, config_file)
-
-                # Output the updated config for Terraform
-                print(json.dumps({"updated_json": json.dumps(config)}))
-
-                # Success - break out of retry loop
-                break
-
-            finally:
-                # Lock is automatically released when file is closed
-                pass
+# Write this entry's contribution as a standalone JSON file.
+resource "local_file" "entry" {
+  filename        = local.entry_file_path
+  content         = jsonencode(var.value)
+  file_permission = "0644"
+}
 
-    except (IOError, OSError) as e:
-        if attempt < max_retries - 1:
-            # Wait before retrying
-            time.sleep(retry_delay)
-            continue
-        else:
-            # Final attempt failed
-            raise Exception(f"Failed to acquire lock after {max_retries} attempts: {e}")
+# Outputs
+output "entry_file_path" {
+  description = "Absolute path to the JSON file that stores this entry's value"
+  value       = local_file.entry.filename
+}
 
-# Clean up lock file if it exists
-try:
-    os.remove(lock_file)
-except OSError:
-    pass
-EOT
-  ]
+output "namespace" {
+  description = "Namespace this entry was written under"
+  value       = var.namespace
+}
 
-  query = {
-    config_file = local.config_file_path
-    key         = var.key
-    value       = jsonencode(var.value)
-  }
+output "key" {
+  description = "Key this entry was written as"
+  value       = var.key
 }