@aws/nx-plugin 0.82.2 → 0.83.1

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -25,6 +25,7 @@ import {
   Runtime,
   RuntimeProps,
 } from '@aws-cdk/aws-bedrock-agentcore-alpha';
+import { RuntimeConfig } from '../../../core/runtime-config.js';
 
 export type SnapshotBedrockServerProps = Omit<
   RuntimeProps,
@@ -42,6 +43,8 @@ export class SnapshotBedrockServer extends Construct {
   ) {
     super(scope, id);
 
+    const rc = RuntimeConfig.ensure(this);
+
     this.dockerImage = AgentRuntimeArtifact.fromAsset(
       path.dirname(url.fileURLToPath(new URL(import.meta.url))),
       {
@@ -61,6 +64,17 @@ export class SnapshotBedrockServer extends Construct {
       protocolConfiguration: ProtocolType.MCP,
       agentRuntimeArtifact: this.dockerImage,
       ...props,
+      environmentVariables: {
+        RUNTIME_CONFIG_APP_ID: rc.appConfigApplicationId,
+        ...props?.environmentVariables,
+      },
+    });
+
+    rc.grantReadAppConfig(this.agentCoreRuntime);
+
+    rc.set('connection', 'agentRuntimes', {
+      ...rc.get('connection').agentRuntimes,
+      SnapshotBedrockServer: this.agentCoreRuntime.agentRuntimeArn,
     });
   }
 }
@@ -406,7 +420,7 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
 
   depends_on = [
     null_resource.docker_publish,
-    aws_iam_role_policy.agent_core_runtime_policy
+    aws_iam_role_policy_attachment.agent_core_policy
   ]
 }
 
@@ -466,6 +480,12 @@ variable "tags" {
   default     = {}
 }
 
+module "appconfig" {
+  source = "../../../core/runtime-config/appconfig"
+
+  application_name = "TerraformSnapshotServer-runtime-config"
+}
+
 module "agent_core_runtime" {
   source = "../../../core/agent-core"
   agent_runtime_name = "TerraformSnapshotServer"
@@ -478,9 +498,33 @@ module "agent_core_runtime" {
 #    }
 #  }
 
-  env = var.env
-  additional_iam_policy_statements = var.additional_iam_policy_statements
+  env = merge({
+    RUNTIME_CONFIG_APP_ID = module.appconfig.application_id
+  }, var.env)
+  additional_iam_policy_statements = concat([
+    {
+      Effect   = "Allow"
+      Action   = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${module.appconfig.application_arn}/*"]
+    }
+  ], var.additional_iam_policy_statements)
   tags = var.tags
+
+  depends_on = [module.appconfig]
+}
+
+# Add agent runtime ARN to runtime config
+module "add_agent_runtime_to_runtime_config" {
+  source = "../../../core/runtime-config/entry"
+
+  namespace = "connection"
+  key       = "agentRuntimes"
+  value     = { "TerraformSnapshotServer" = module.agent_core_runtime.agent_core_runtime_arn }
+
+  depends_on = [module.agent_core_runtime]
 }
 
 output "agent_core_runtime_role_arn" {
@@ -492,6 +536,11 @@ output "agent_core_runtime_arn" {
   description = "ARN of the Bedrock Agent Core runtime"
   value       = module.agent_core_runtime.agent_core_runtime_arn
 }
+
+output "appconfig_application_id" {
+  description = "AppConfig Application ID for runtime config"
+  value       = module.appconfig.application_id
+}
 "
 `;
 
@@ -640,6 +689,8 @@ exports[`ts#mcp-server generator > should match snapshot for generated files > u
     "snapshot-server": "./src/snapshot-server/stdio.js"
   },
   "dependencies": {
+    "@aws-lambda-powertools/parameters": "2.31.0",
+    "@aws-sdk/client-appconfigdata": "3.1004.0",
     "@modelcontextprotocol/sdk": "1.27.1",
     "express": "5.2.1",
     "zod": "4.3.6"

package/src/ts/mcp-server/generator.js

@@ -62,7 +62,13 @@ const tsMcpServerGenerator = (tree, options) => tslib_1.__awaiter(void 0, void 0
         distDir,
     }, { overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting });
     // Add dependencies
-    const deps = (0, versions_1.withVersions)(['@modelcontextprotocol/sdk', 'zod', 'express']);
+    const deps = (0, versions_1.withVersions)([
+        '@modelcontextprotocol/sdk',
+        'zod',
+        'express',
+        '@aws-lambda-powertools/parameters',
+        '@aws-sdk/client-appconfigdata',
+    ]);
     const devDeps = (0, versions_1.withVersions)([
         'tsx',
         '@types/express',

package/src/ts/mcp-server/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,uCAYoB;AAEpB,uCAMwB;AACxB,iDAAsE;AACtE,+CAA0D;AAC1D,mDAAoD;AACpD,6CAA2D;AAC3D,qEAA0E;AAC1E,mGAA4F;AAC5F,qDAAoD;AACpD,yCAAqD;AACrD,sDAAsE;AACtE,2CAA8C;AAEjC,QAAA,4BAA4B,GACvC,IAAA,qBAAgB,EAAC,UAAU,CAAC,CAAC;AAExB,MAAM,oBAAoB,GAAG,CAClC,IAAU,EACV,OAAmC,EACP,EAAE;;IAC9B,MAAM,OAAO,GAAG,IAAA,wCAAmC,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAA,0BAAiB,EAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,OAAO,wDAAwD,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,IAAA,iBAAS,EAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAA,iBAAS,EAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IAC3D,MAAM,oCAAoC,GAAG,IAAA,0BAAiB,EAC5D,KAAK,EACL,eAAe,CAChB,CAAC;IACF,MAAM,eAAe,GAAG,IAAA,0BAAiB,EACvC,OAAO,CAAC,IAAI,EACZ,oCAAoC,CACrC,CAAC;IACF,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAA,0BAAiB,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,MAAM,WAAW,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,yBAAyB,CAAC;IAErE,8FAA8F;IAC9F,MAAM,sBAAsB,GAAG,IAAA,0BAAiB,EAC9C,OAAO,CAAC,IAAI,EACZ,cAAc,CACf,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACzC,0CAA0C;QAC1C,IAAA,kBAAS,EAAC,IAAI,EAAE,sBAAsB,EAAE;YACtC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,+DAA+D;IAC/D,0CAA0C;IAC1C,MAAM,GAAG,GAAG,IAAA,iBAAQ,EAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;IAErE,+DAA+D;IAC/D,uFAAuF;IACvF,+BAA+B;IAC/B,IAAA,mBAAU,EAAC,IAAI,EAAE,sBAAsB,EAAE,CAAC,GAAG,EAAE,EAAE;;QAC/C,MAAA,GAAG,CAAC,GAAG,oCAAP,GAAG,CAAC,GAAG,GAAK,EAAE,EAAC;QACf,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,iBAAiB,WAAW,CAAC;QAChD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,CAAC,EACrC,eAAe,EACf;QACE,IAAI;QACJ,GAAG;QACH,OAAO;KACR,EACD,EAAE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY,EAAE,CACtD,CAAC;IAEF,mBAAmB;IACnB,MAAM,IAAI,GAAG,IAAA,uBAAY,EAAC,CAAC,2BAA2B,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAA,uBAAY,EAAC;QAC3B,KAAK;QACL,gBAAgB;QAChB,iCAAiC;KAClC,CAAC,CAAC;IAEH,oCAAoC;IACpC,IAAI,WAAW,KAAK,yBAAyB,EAAE,CAAC;QAC9C,MAAM,cAAc,GAAG,GAAG,IAAA,uBAAW,EAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;QAE7D,oBAAoB;QACpB,IAAA,kCAAyB,EAAC,IAAI,EAAE,OAAO,EAAE;YACvC,cAAc,EAAE,GAAG,oCAAoC,UAAU;YACjE,eAAe,EAAE,IAAA,0BAAiB,EAAC,KAAK,EAAE,IAAI,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,GAAG,eAAe,SAAS,CAAC;QAErD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG;YAClC,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,OAAO,EAAE,0CAA0C,cAAc,IAAI,eAAe,8BAA8B;aACnH;YACD,SAAS,EAAE,CAAC,QAAQ,CAAC;SACtB,CAAC;QAEF,IAAA,sCAAiC,EAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACvE,IAAA,sCAAiC,EAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE9D,wBAAwB;QACxB,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,IAAA,6CAAyB,EAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAEvD,6CAA6C;QAC7C,IAAA,yCAAiB,EAAC,IAAI,EAAE;YACtB,sBAAsB,EAAE,IAAI;YAC5B,sBAAsB,EAAE,IAAA,mBAAW,EAAC,IAAI,CAAC;YACzC,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,cAAc;YACd,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAA,0BAAiB,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,IAAA,qCAA4B,EAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,IAAA,qCAA4B,EAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAE1E,MAAM,YAAY,GAAG,IAAA,iBAAU,EAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAErD,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,IAAI,kCACxC,OAAO,KACV,OAAO,kCACF,OAAO,CAAC,OAAO;YAClB,yCAAyC;YACzC,CAAC,GAAG,eAAe,cAAc,CAAC,EAAE;gBAClC,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,QAAQ,EAAE,CAAC,eAAe,iBAAiB,WAAW,CAAC;oBACvD,GAAG,EAAE,eAAe;iBACrB;gBACD,UAAU,EAAE,IAAI;aACjB,EACD,CAAC,GAAG,eAAe,QAAQ,CAAC,EAAE;gBAC5B,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,QAAQ,EAAE,CAAC,eAAe,iBAAiB,UAAU,CAAC;oBACtD,GAAG,EAAE,eAAe;oBACpB,GAAG,EAAE;wBACH,IAAI,EAAE,GAAG,YAAY,EAAE;qBACxB;iBACF;gBACD,UAAU,EAAE,IAAI;aACjB,EACD,CAAC,GAAG,eAAe,UAAU,CAAC,EAAE;gBAC9B,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,QAAQ,EAAE;wBACR,gCAAgC,iBAAiB,WAAW;qBAC7D;oBACD,GAAG,EAAE,eAAe;iBACrB;gBACD,UAAU,EAAE,IAAI;aACjB,OAEH,CAAC;IAEH,IAAA,kCAA6B,EAC3B,IAAI,EACJ,OAAO,CAAC,IAAI,EACZ,oCAA4B,EAC5B,oCAAoC,EACpC,eAAe,EACf;QACE,IAAI,EAAE,YAAY;KACnB,CACF,CAAC;IAEF,MAAM,IAAA,yCAA+B,EAAC,IAAI,EAAE,CAAC,oCAA4B,CAAC,CAAC,CAAC;IAE5E,MAAM,IAAA,6BAAoB,EAAC,IAAI,CAAC,CAAC;IACjC,OAAO,GAAG,EAAE;QACV,IAAA,4BAAmB,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC,CAAA,CAAC;AAhLW,QAAA,oBAAoB,wBAgL/B;AAEF,kBAAe,4BAAoB,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/ts/mcp-server/generator.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,uCAYoB;AAEpB,uCAMwB;AACxB,iDAAsE;AACtE,+CAA0D;AAC1D,mDAAoD;AACpD,6CAA2D;AAC3D,qEAA0E;AAC1E,mGAA4F;AAC5F,qDAAoD;AACpD,yCAAqD;AACrD,sDAAsE;AACtE,2CAA8C;AAEjC,QAAA,4BAA4B,GACvC,IAAA,qBAAgB,EAAC,UAAU,CAAC,CAAC;AAExB,MAAM,oBAAoB,GAAG,CAClC,IAAU,EACV,OAAmC,EACP,EAAE;;IAC9B,MAAM,OAAO,GAAG,IAAA,wCAAmC,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAA,0BAAiB,EAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,OAAO,wDAAwD,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,IAAA,iBAAS,EAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAA,iBAAS,EAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IAC3D,MAAM,oCAAoC,GAAG,IAAA,0BAAiB,EAC5D,KAAK,EACL,eAAe,CAChB,CAAC;IACF,MAAM,eAAe,GAAG,IAAA,0BAAiB,EACvC,OAAO,CAAC,IAAI,EACZ,oCAAoC,CACrC,CAAC;IACF,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAA,0BAAiB,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,MAAM,WAAW,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,yBAAyB,CAAC;IAErE,8FAA8F;IAC9F,MAAM,sBAAsB,GAAG,IAAA,0BAAiB,EAC9C,OAAO,CAAC,IAAI,EACZ,cAAc,CACf,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACzC,0CAA0C;QAC1C,IAAA,kBAAS,EAAC,IAAI,EAAE,sBAAsB,EAAE;YACtC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,+DAA+D;IAC/D,0CAA0C;IAC1C,MAAM,GAAG,GAAG,IAAA,iBAAQ,EAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;IAErE,+DAA+D;IAC/D,uFAAuF;IACvF,+BAA+B;IAC/B,IAAA,mBAAU,EAAC,IAAI,EAAE,sBAAsB,EAAE,CAAC,GAAG,EAAE,EAAE;;QAC/C,MAAA,GAAG,CAAC,GAAG,oCAAP,GAAG,CAAC,GAAG,GAAK,EAAE,EAAC;QACf,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,iBAAiB,WAAW,CAAC;QAChD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,CAAC,EACrC,eAAe,EACf;QACE,IAAI;QACJ,GAAG;QACH,OAAO;KACR,EACD,EAAE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY,EAAE,CACtD,CAAC;IAEF,mBAAmB;IACnB,MAAM,IAAI,GAAG,IAAA,uBAAY,EAAC;QACxB,2BAA2B;QAC3B,KAAK;QACL,SAAS;QACT,mCAAmC;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAA,uBAAY,EAAC;QAC3B,KAAK;QACL,gBAAgB;QAChB,iCAAiC;KAClC,CAAC,CAAC;IAEH,oCAAoC;IACpC,IAAI,WAAW,KAAK,yBAAyB,EAAE,CAAC;QAC9C,MAAM,cAAc,GAAG,GAAG,IAAA,uBAAW,EAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;QAE7D,oBAAoB;QACpB,IAAA,kCAAyB,EAAC,IAAI,EAAE,OAAO,EAAE;YACvC,cAAc,EAAE,GAAG,oCAAoC,UAAU;YACjE,eAAe,EAAE,IAAA,0BAAiB,EAAC,KAAK,EAAE,IAAI,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,GAAG,eAAe,SAAS,CAAC;QAErD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG;YAClC,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,OAAO,EAAE,0CAA0C,cAAc,IAAI,eAAe,8BAA8B;aACnH;YACD,SAAS,EAAE,CAAC,QAAQ,CAAC;SACtB,CAAC;QAEF,IAAA,sCAAiC,EAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACvE,IAAA,sCAAiC,EAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE9D,wBAAwB;QACxB,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,IAAA,6CAAyB,EAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAEvD,6CAA6C;QAC7C,IAAA,yCAAiB,EAAC,IAAI,EAAE;YACtB,sBAAsB,EAAE,IAAI;YAC5B,sBAAsB,EAAE,IAAA,mBAAW,EAAC,IAAI,CAAC;YACzC,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,cAAc;YACd,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAA,0BAAiB,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,IAAA,qCAA4B,EAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,IAAA,qCAA4B,EAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAE1E,MAAM,YAAY,GAAG,IAAA,iBAAU,EAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAErD,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,IAAI,kCACxC,OAAO,KACV,OAAO,kCACF,OAAO,CAAC,OAAO;YAClB,yCAAyC;YACzC,CAAC,GAAG,eAAe,cAAc,CAAC,EAAE;gBAClC,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,QAAQ,EAAE,CAAC,eAAe,iBAAiB,WAAW,CAAC;oBACvD,GAAG,EAAE,eAAe;iBACrB;gBACD,UAAU,EAAE,IAAI;aACjB,EACD,CAAC,GAAG,eAAe,QAAQ,CAAC,EAAE;gBAC5B,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,QAAQ,EAAE,CAAC,eAAe,iBAAiB,UAAU,CAAC;oBACtD,GAAG,EAAE,eAAe;oBACpB,GAAG,EAAE;wBACH,IAAI,EAAE,GAAG,YAAY,EAAE;qBACxB;iBACF;gBACD,UAAU,EAAE,IAAI;aACjB,EACD,CAAC,GAAG,eAAe,UAAU,CAAC,EAAE;gBAC9B,QAAQ,EAAE,iBAAiB;gBAC3B,OAAO,EAAE;oBACP,QAAQ,EAAE;wBACR,gCAAgC,iBAAiB,WAAW;qBAC7D;oBACD,GAAG,EAAE,eAAe;iBACrB;gBACD,UAAU,EAAE,IAAI;aACjB,OAEH,CAAC;IAEH,IAAA,kCAA6B,EAC3B,IAAI,EACJ,OAAO,CAAC,IAAI,EACZ,oCAA4B,EAC5B,oCAAoC,EACpC,eAAe,EACf;QACE,IAAI,EAAE,YAAY;KACnB,CACF,CAAC;IAEF,MAAM,IAAA,yCAA+B,EAAC,IAAI,EAAE,CAAC,oCAA4B,CAAC,CAAC,CAAC;IAE5E,MAAM,IAAA,6BAAoB,EAAC,IAAI,CAAC,CAAC;IACjC,OAAO,GAAG,EAAE;QACV,IAAA,4BAAmB,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC,CAAA,CAAC;AAtLW,QAAA,oBAAoB,wBAsL/B;AAEF,kBAAe,4BAAoB,CAAC"}

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -390,6 +390,13 @@ resource "aws_s3_bucket_ownership_controls" "distribution_logs_ownership" {
   }
 }
 
+resource "aws_s3_bucket_acl" "distribution_logs_acl" {
+  #checkov:skip=CKV_AWS_70:ACL required for CloudFront standard logging
+  bucket = aws_s3_bucket.distribution_logs.id
+  acl    = "log-delivery-write"
+
+  depends_on = [aws_s3_bucket_ownership_controls.distribution_logs_ownership]
+}
 
 resource "aws_s3_bucket_logging" "distribution_logs_logging" {
   bucket = aws_s3_bucket.distribution_logs.id
@@ -622,9 +629,11 @@ resource "aws_s3_bucket_policy" "website_cloudfront_policy" {
   depends_on = [aws_cloudfront_distribution.website]
 }
 
-# Read runtime config using the reader module
+# Read runtime config using the reader module (connection namespace for website)
 module "runtime_config_reader" {
   source = "../runtime-config/read"
+
+  namespace = "connection"
 }
 
 # Upload website files to S3
@@ -1322,13 +1331,44 @@ export * from './runtime-config.js';
 `;
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > packages/common/constructs/src/core/runtime-config.ts 1`] = `
-"import { Stack, Stage } from 'aws-cdk-lib';
-import { Construct } from 'constructs';
+"import {
+  ArnFormat,
+  Aspects,
+  CfnOutput,
+  Lazy,
+  Names,
+  Stack,
+  Stage,
+} from 'aws-cdk-lib';
+import {
+  CfnApplication,
+  CfnConfigurationProfile,
+  CfnDeployment,
+  CfnDeploymentStrategy,
+  CfnEnvironment,
+  CfnHostedConfigurationVersion,
+} from 'aws-cdk-lib/aws-appconfig';
+import { Grant, IGrantable } from 'aws-cdk-lib/aws-iam';
+import { Construct, IConstruct } from 'constructs';
 
 const RuntimeConfigKey = '__RuntimeConfig__';
 
+/**
+ * Stage-scoped singleton that collects runtime configuration from CDK constructs
+ * and delivers it to server-side (AppConfig) and client-side (S3) consumers.
+ *
+ * Configuration is organised into namespaces (mapped to AppConfig Configuration Profiles):
+ * \`\`\`ts
+ * const rc = RuntimeConfig.ensure(this);
+ * rc.set('connection', 'cognitoProps', { region: '...', userPoolId: '...' });
+ * rc.set('tables', 'users', { tableName: '...', arn: '...' });
+ * \`\`\`
+ */
 export class RuntimeConfig extends Construct {
-  private readonly _runtimeConfig: any = {};
+  private readonly _namespaces = new Map<string, Record<string, any>>();
+  private _appConfigApplicationId?: string;
+  private _appConfigApplicationArn?: string;
+  private _aspectRegistered = false;
 
   static ensure(scope: Construct): RuntimeConfig {
     const parent = Stage.of(scope) ?? Stack.of(scope);
@@ -1348,15 +1388,142 @@ export class RuntimeConfig extends Construct {
     super(scope, id);
   }
 
-  get config(): any {
-    return this._runtimeConfig;
+  /** Sets a key in the given namespace. Creates the namespace if it doesn't exist. */
+  set(namespace: string, key: string, value: any): void {
+    let data = this._namespaces.get(namespace);
+    if (!data) {
+      data = {};
+      this._namespaces.set(namespace, data);
+    }
+    data[key] = value;
+  }
+
+  /** Returns the config data for a namespace. Creates it if it doesn't exist. */
+  get(namespace: string): Record<string, any> {
+    let data = this._namespaces.get(namespace);
+    if (!data) {
+      data = {};
+      this._namespaces.set(namespace, data);
+    }
+    return data;
+  }
+
+  /** Returns a lazy token resolving to the AppConfig Application ID. */
+  get appConfigApplicationId(): string {
+    this.ensureAspect();
+    return Lazy.string({
+      produce: () => {
+        if (!this._appConfigApplicationId) {
+          throw new Error(
+            'RuntimeConfig AppConfig resources were not created.',
+          );
+        }
+        return this._appConfigApplicationId;
+      },
+    });
+  }
+
+  /** Grants a server-side consumer permission to read from AppConfig. */
+  grantReadAppConfig(grantee: IGrantable): Grant {
+    this.ensureAspect();
+    return Grant.addToPrincipal({
+      grantee,
+      actions: [
+        'appconfig:StartConfigurationSession',
+        'appconfig:GetLatestConfiguration',
+      ],
+      resourceArns: [
+        Lazy.string({ produce: () => this._appConfigApplicationArn }),
+      ],
+    });
+  }
+
+  private ensureAspect(): void {
+    if (this._aspectRegistered) return;
+    this._aspectRegistered = true;
+    let created = false;
+
+    Aspects.of(this.node.scope!).add({
+      visit: (node: IConstruct) => {
+        if (created || !(node instanceof Stack)) return;
+        created = true;
+
+        const stack = node;
+        const name = Names.uniqueResourceName(this, {
+          maxLength: 64,
+          separator: '-',
+        });
+
+        const app = new CfnApplication(stack, 'RcAppConfigApp', { name });
+        const strategy = new CfnDeploymentStrategy(
+          stack,
+          'RcAppConfigStrategy',
+          {
+            name,
+            deploymentDurationInMinutes: 0,
+            growthFactor: 100,
+            replicateTo: 'NONE',
+            finalBakeTimeInMinutes: 0,
+          },
+        );
+        const env = new CfnEnvironment(stack, 'RcAppConfigEnv', {
+          applicationId: app.ref,
+          name: 'default',
+        });
+
+        for (const [ns, data] of this._namespaces.entries()) {
+          const profile = new CfnConfigurationProfile(
+            stack,
+            \`RcAppConfigProfile\${ns}\`,
+            {
+              applicationId: app.ref,
+              name: ns,
+              locationUri: 'hosted',
+              type: 'AWS.Freeform',
+            },
+          );
+          const version = new CfnHostedConfigurationVersion(
+            stack,
+            \`RcAppConfigVersion\${ns}\`,
+            {
+              applicationId: app.ref,
+              configurationProfileId: profile.ref,
+              contentType: 'application/json',
+              content: Lazy.string({ produce: () => stack.toJsonString(data) }),
+            },
+          );
+          new CfnDeployment(stack, \`RcAppConfigDeploy\${ns}\`, {
+            applicationId: app.ref,
+            environmentId: env.ref,
+            configurationProfileId: profile.ref,
+            configurationVersion: version.ref,
+            deploymentStrategyId: strategy.ref,
+          });
+        }
+
+        new CfnOutput(stack, 'RuntimeConfigApplicationId', { value: app.ref });
+        this._appConfigApplicationId = app.ref;
+        this._appConfigApplicationArn = stack.formatArn({
+          service: 'appconfig',
+          resource: 'application',
+          resourceName: \`\${app.ref}/*\`,
+          arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+        });
+      },
+    });
   }
 }
 "
 `;
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > packages/common/constructs/src/core/static-website.ts 1`] = `
-"import { CfnOutput, CfnResource, RemovalPolicy, Stack } from 'aws-cdk-lib';
+"import {
+  CfnOutput,
+  CfnResource,
+  Lazy,
+  RemovalPolicy,
+  Stack,
+} from 'aws-cdk-lib';
 import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
@@ -1503,9 +1670,14 @@ export class StaticWebsite extends Construct {
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
       sources: [
         Source.asset(websiteFilePath),
-        Source.jsonData(
+        Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
-          RuntimeConfig.ensure(this).config,
+          Lazy.string({
+            produce: () =>
+              Stack.of(this).toJsonString(
+                RuntimeConfig.ensure(this).get('connection'),
+              ),
+          }),
         ),
       ],
       destinationBucket: this.websiteBucket,
@@ -2754,13 +2926,44 @@ export * from './runtime-config.js';
 `;
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > packages/common/constructs/src/core/runtime-config.ts 1`] = `
-"import { Stack, Stage } from 'aws-cdk-lib';
-import { Construct } from 'constructs';
+"import {
+  ArnFormat,
+  Aspects,
+  CfnOutput,
+  Lazy,
+  Names,
+  Stack,
+  Stage,
+} from 'aws-cdk-lib';
+import {
+  CfnApplication,
+  CfnConfigurationProfile,
+  CfnDeployment,
+  CfnDeploymentStrategy,
+  CfnEnvironment,
+  CfnHostedConfigurationVersion,
+} from 'aws-cdk-lib/aws-appconfig';
+import { Grant, IGrantable } from 'aws-cdk-lib/aws-iam';
+import { Construct, IConstruct } from 'constructs';
 
 const RuntimeConfigKey = '__RuntimeConfig__';
 
+/**
+ * Stage-scoped singleton that collects runtime configuration from CDK constructs
+ * and delivers it to server-side (AppConfig) and client-side (S3) consumers.
+ *
+ * Configuration is organised into namespaces (mapped to AppConfig Configuration Profiles):
+ * \`\`\`ts
+ * const rc = RuntimeConfig.ensure(this);
+ * rc.set('connection', 'cognitoProps', { region: '...', userPoolId: '...' });
+ * rc.set('tables', 'users', { tableName: '...', arn: '...' });
+ * \`\`\`
+ */
 export class RuntimeConfig extends Construct {
-  private readonly _runtimeConfig: any = {};
+  private readonly _namespaces = new Map<string, Record<string, any>>();
+  private _appConfigApplicationId?: string;
+  private _appConfigApplicationArn?: string;
+  private _aspectRegistered = false;
 
   static ensure(scope: Construct): RuntimeConfig {
     const parent = Stage.of(scope) ?? Stack.of(scope);
@@ -2780,15 +2983,142 @@ export class RuntimeConfig extends Construct {
     super(scope, id);
   }
 
-  get config(): any {
-    return this._runtimeConfig;
+  /** Sets a key in the given namespace. Creates the namespace if it doesn't exist. */
+  set(namespace: string, key: string, value: any): void {
+    let data = this._namespaces.get(namespace);
+    if (!data) {
+      data = {};
+      this._namespaces.set(namespace, data);
+    }
+    data[key] = value;
+  }
+
+  /** Returns the config data for a namespace. Creates it if it doesn't exist. */
+  get(namespace: string): Record<string, any> {
+    let data = this._namespaces.get(namespace);
+    if (!data) {
+      data = {};
+      this._namespaces.set(namespace, data);
+    }
+    return data;
+  }
+
+  /** Returns a lazy token resolving to the AppConfig Application ID. */
+  get appConfigApplicationId(): string {
+    this.ensureAspect();
+    return Lazy.string({
+      produce: () => {
+        if (!this._appConfigApplicationId) {
+          throw new Error(
+            'RuntimeConfig AppConfig resources were not created.',
+          );
+        }
+        return this._appConfigApplicationId;
+      },
+    });
+  }
+
+  /** Grants a server-side consumer permission to read from AppConfig. */
+  grantReadAppConfig(grantee: IGrantable): Grant {
+    this.ensureAspect();
+    return Grant.addToPrincipal({
+      grantee,
+      actions: [
+        'appconfig:StartConfigurationSession',
+        'appconfig:GetLatestConfiguration',
+      ],
+      resourceArns: [
+        Lazy.string({ produce: () => this._appConfigApplicationArn }),
+      ],
+    });
+  }
+
+  private ensureAspect(): void {
+    if (this._aspectRegistered) return;
+    this._aspectRegistered = true;
+    let created = false;
+
+    Aspects.of(this.node.scope!).add({
+      visit: (node: IConstruct) => {
+        if (created || !(node instanceof Stack)) return;
+        created = true;
+
+        const stack = node;
+        const name = Names.uniqueResourceName(this, {
+          maxLength: 64,
+          separator: '-',
+        });
+
+        const app = new CfnApplication(stack, 'RcAppConfigApp', { name });
+        const strategy = new CfnDeploymentStrategy(
+          stack,
+          'RcAppConfigStrategy',
+          {
+            name,
+            deploymentDurationInMinutes: 0,
+            growthFactor: 100,
+            replicateTo: 'NONE',
+            finalBakeTimeInMinutes: 0,
+          },
+        );
+        const env = new CfnEnvironment(stack, 'RcAppConfigEnv', {
+          applicationId: app.ref,
+          name: 'default',
+        });
+
+        for (const [ns, data] of this._namespaces.entries()) {
+          const profile = new CfnConfigurationProfile(
+            stack,
+            \`RcAppConfigProfile\${ns}\`,
+            {
+              applicationId: app.ref,
+              name: ns,
+              locationUri: 'hosted',
+              type: 'AWS.Freeform',
+            },
+          );
+          const version = new CfnHostedConfigurationVersion(
+            stack,
+            \`RcAppConfigVersion\${ns}\`,
+            {
+              applicationId: app.ref,
+              configurationProfileId: profile.ref,
+              contentType: 'application/json',
+              content: Lazy.string({ produce: () => stack.toJsonString(data) }),
+            },
+          );
+          new CfnDeployment(stack, \`RcAppConfigDeploy\${ns}\`, {
+            applicationId: app.ref,
+            environmentId: env.ref,
+            configurationProfileId: profile.ref,
+            configurationVersion: version.ref,
+            deploymentStrategyId: strategy.ref,
+          });
+        }
+
+        new CfnOutput(stack, 'RuntimeConfigApplicationId', { value: app.ref });
+        this._appConfigApplicationId = app.ref;
+        this._appConfigApplicationArn = stack.formatArn({
+          service: 'appconfig',
+          resource: 'application',
+          resourceName: \`\${app.ref}/*\`,
+          arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+        });
+      },
+    });
   }
 }
 "
 `;
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > packages/common/constructs/src/core/static-website.ts 1`] = `
-"import { CfnOutput, CfnResource, RemovalPolicy, Stack } from 'aws-cdk-lib';
+"import {
+  CfnOutput,
+  CfnResource,
+  Lazy,
+  RemovalPolicy,
+  Stack,
+} from 'aws-cdk-lib';
 import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
@@ -2935,9 +3265,14 @@ export class StaticWebsite extends Construct {
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
       sources: [
         Source.asset(websiteFilePath),
-        Source.jsonData(
+        Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
-          RuntimeConfig.ensure(this).config,
+          Lazy.string({
+            produce: () =>
+              Stack.of(this).toJsonString(
+                RuntimeConfig.ensure(this).get('connection'),
+              ),
+          }),
         ),
       ],
       destinationBucket: this.websiteBucket,
@@ -4253,7 +4588,13 @@ export * from './runtime-config.js';
 `;
 
 exports[`react-website generator > should generate shared constructs > common/constructs-core-static-website.ts 1`] = `
-"import { CfnOutput, CfnResource, RemovalPolicy, Stack } from 'aws-cdk-lib';
+"import {
+  CfnOutput,
+  CfnResource,
+  Lazy,
+  RemovalPolicy,
+  Stack,
+} from 'aws-cdk-lib';
 import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
@@ -4400,9 +4741,14 @@ export class StaticWebsite extends Construct {
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
       sources: [
         Source.asset(websiteFilePath),
-        Source.jsonData(
+        Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
-          RuntimeConfig.ensure(this).config,
+          Lazy.string({
+            produce: () =>
+              Stack.of(this).toJsonString(
+                RuntimeConfig.ensure(this).get('connection'),
+              ),
+          }),
         ),
       ],
       destinationBucket: this.websiteBucket,

package/src/ts/react-website/cognito-auth/__snapshots__/generator.spec.ts.snap

@@ -133,12 +133,12 @@ export class UserIdentity extends Construct {
       this.userPoolDomain,
     );
 
-    RuntimeConfig.ensure(this).config.cognitoProps = {
+    RuntimeConfig.ensure(this).set('connection', 'cognitoProps', {
       region: Stack.of(this).region,
       identityPoolId: this.identityPool.identityPoolId,
       userPoolId: this.userPool.userPoolId,
       userPoolWebClientId: this.userPoolClient.userPoolClientId,
-    };
+    });
 
     suppressRules(
       this.userPool,

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -20,6 +20,8 @@ variable "callback_url" {
 # Read runtime config to get user pool client details
 module "runtime_config_reader" {
   source = "../../runtime-config/read"
+
+  namespace = "connection"
 }
 
 # Extract cognito details from runtime config