@aws/nx-plugin 1.0.0-rc.17 → 1.0.0-rc.19

package/src/utils/agent-connection/files/py-core-mcp/agentcore_mcp_transport.py.template

@@ -0,0 +1,34 @@
+from collections.abc import Callable
+
+from .agentcore_endpoints import mcp_url_from_arn, region_from_arn
+from .agentcore_transport import (
+    TransportFactory,
+    jwt_transport,
+    no_auth_transport,
+    sigv4_transport,
+)
+
+
+class AgentCoreMCPTransport:
+    """Factory for MCP transport factories that connect to an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(agent_runtime_arn: str) -> TransportFactory:
+        """SigV4-authenticated transport for a Bedrock AgentCore runtime."""
+        return sigv4_transport(
+            mcp_url_from_arn(agent_runtime_arn), region_from_arn(agent_runtime_arn)
+        )
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str, access_token_provider: Callable[[], str]
+    ) -> TransportFactory:
+        """Bearer-authenticated transport for a Bedrock AgentCore runtime."""
+        return jwt_transport(
+            mcp_url_from_arn(agent_runtime_arn), access_token_provider
+        )
+
+    @staticmethod
+    def without_auth(url: str) -> TransportFactory:
+        """Plain-HTTP transport — for local dev."""
+        return no_auth_transport(url)

package/src/utils/agent-connection/files/py-core-shared/agentcore_transport.py.template

@@ -0,0 +1,40 @@
+from collections.abc import Callable
+from typing import Any
+
+import boto3
+
+from mcp.client.streamable_http import streamablehttp_client
+
+from .auth.session import jwt_auth, plain_auth, sigv4_auth
+
+# Agent frameworks wrap a transport *factory* — a no-arg callable returning a
+# streamable-HTTP transport context manager. Typed as ``Any`` so this layer
+# stays free of any framework-specific transport type.
+TransportFactory = Callable[[], Any]
+
+
+def _factory(url: str, auth) -> TransportFactory:
+    return lambda: streamablehttp_client(
+        url,
+        auth=auth,
+        timeout=120,
+        terminate_on_close=False,
+    )
+
+
+def sigv4_transport(url: str, region: str) -> TransportFactory:
+    """SigV4-signed transport factory for a resolved AgentCore endpoint."""
+    credentials = boto3.Session(region_name=region).get_credentials()
+    return _factory(url, sigv4_auth(credentials, region))
+
+
+def jwt_transport(
+    url: str, access_token_provider: Callable[[], str]
+) -> TransportFactory:
+    """Bearer-token transport factory for a resolved AgentCore endpoint."""
+    return _factory(url, jwt_auth(access_token_provider))
+
+
+def no_auth_transport(url: str) -> TransportFactory:
+    """Plain-HTTP transport factory — for local dev."""
+    return _factory(url, plain_auth())

package/src/utils/agent-connection/files/py-core-strands/a2a/agentcore_a2a_client_strands.py.template

@@ -0,0 +1,66 @@
+from collections.abc import Callable
+
+from strands.agent.a2a_agent import A2AAgent
+
+from .agentcore_a2a_client_config import AgentCoreA2aClientConfig
+
+
+def _build(
+    config: tuple, *, name: str | None, description: str | None
+) -> A2AAgent:
+    url, client_config = config
+    kwargs: dict = {"endpoint": url, "client_config": client_config}
+    if name:
+        kwargs["name"] = name
+    if description:
+        kwargs["description"] = description
+    return A2AAgent(**kwargs)
+
+
+class AgentCoreA2aClientStrands:
+    """Factory for Strands A2A clients that connect to an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(
+        agent_runtime_arn: str,
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """SigV4-authenticated client for a Bedrock AgentCore runtime."""
+        return _build(
+            AgentCoreA2aClientConfig.with_iam_auth(agent_runtime_arn),
+            name=name,
+            description=description,
+        )
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str,
+        access_token_provider: Callable[[], str],
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """Bearer-authenticated client for a Bedrock AgentCore runtime."""
+        return _build(
+            AgentCoreA2aClientConfig.with_jwt_auth(
+                agent_runtime_arn, access_token_provider
+            ),
+            name=name,
+            description=description,
+        )
+
+    @staticmethod
+    def without_auth(
+        url: str,
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """Plain-HTTP client — for local dev."""
+        return _build(
+            AgentCoreA2aClientConfig.without_auth(url),
+            name=name,
+            description=description,
+        )

package/src/utils/agent-connection/files/py-core-strands/gateway/agentcore_gateway_mcp_client_strands.py.template

@@ -0,0 +1,22 @@
+from strands.tools.mcp.mcp_client import MCPClient
+
+from .agentcore_gateway_mcp_transport import AgentCoreGatewayMCPTransport
+
+
+class AgentCoreGatewayMCPClientStrands:
+    """Factory for Strands MCP clients that connect to an AgentCore Gateway."""
+
+    @staticmethod
+    def with_iam_auth(
+        gateway_url: str,
+        region: str | None = None,
+    ) -> MCPClient:
+        """Create a gateway MCP client authenticated with IAM SigV4."""
+        return MCPClient(
+            AgentCoreGatewayMCPTransport.with_iam_auth(gateway_url, region)
+        )
+
+    @staticmethod
+    def without_auth(gateway_url: str) -> MCPClient:
+        """Plain-HTTP gateway client, for the local gateway started by serve-local."""
+        return MCPClient(AgentCoreGatewayMCPTransport.without_auth(gateway_url))

package/src/utils/agent-connection/files/py-core-strands/mcp/agentcore_mcp_client_strands.py.template

@@ -0,0 +1,30 @@
+from collections.abc import Callable
+
+from strands.tools.mcp.mcp_client import MCPClient
+
+from .agentcore_mcp_transport import AgentCoreMCPTransport
+
+
+class AgentCoreMCPClientStrands:
+    """Factory for Strands MCP clients that connect to an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(agent_runtime_arn: str) -> MCPClient:
+        """SigV4-authenticated client for a Bedrock AgentCore runtime."""
+        return MCPClient(AgentCoreMCPTransport.with_iam_auth(agent_runtime_arn))
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str, access_token_provider: Callable[[], str]
+    ) -> MCPClient:
+        """Bearer-authenticated client for a Bedrock AgentCore runtime."""
+        return MCPClient(
+            AgentCoreMCPTransport.with_jwt_auth(
+                agent_runtime_arn, access_token_provider
+            )
+        )
+
+    @staticmethod
+    def without_auth(url: str) -> MCPClient:
+        """Plain-HTTP client — for local dev."""
+        return MCPClient(AgentCoreMCPTransport.without_auth(url))

package/src/utils/agent-core-constructs/files/cdk/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -18,6 +18,9 @@ import { findWorkspaceRoot } from '../../../core/workspace.js';
 <%_ } _%>
  */
 export class <%- nameClassName %> extends AgentCoreGateway {
+  /** Default Gateway target name when added to another Gateway. */
+  public readonly gatewayName = '<%- nameKebabCase %>';
+
   constructor(scope: Construct, id: string) {
     super(scope, id, {
 <%_ if (cedarPolicy) { _%>

package/src/utils/agent-core-constructs/files/cdk/core/agentcore-gateway/agentcore-gateway.ts.template

@@ -187,34 +187,7 @@ export class AgentCoreGateway extends Construct implements iam.IGrantable {
       cdk.Fn.split('/', cdk.Fn.join('%3A', cdk.Fn.split(':', arn))),
     );
     const endpoint = `https://bedrock-agentcore.${region}.amazonaws.com/runtimes/${encodedArn}/invocations?qualifier=DEFAULT`;
-    // The construct id is derived from the target name so the two change
-    // together — target names are unique per gateway, and replacing a target
-    // under an unchanged name fails with AlreadyExists.
-    const target = new agentcore.CfnGatewayTarget(
-      this,
-      `Target-${props.gatewayTargetName}`,
-      {
-        gatewayIdentifier: this.gateway.gatewayId,
-        name: props.gatewayTargetName,
-        targetConfiguration: {
-          mcp: {
-            mcpServer: {
-              endpoint,
-            },
-          },
-        },
-        credentialProviderConfigurations: [
-          {
-            credentialProviderType: 'GATEWAY_IAM_ROLE',
-            credentialProvider: {
-              iamCredentialProvider: {
-                service: 'bedrock-agentcore',
-              },
-            },
-          },
-        ],
-      },
-    );
+    const target = this.addTarget(props.gatewayTargetName, endpoint);
 
     // Grant the gateway role invoke access to the target runtime before the
     // target is created — AgentCore probes the target during creation, which
@@ -253,6 +226,115 @@ export class AgentCoreGateway extends Construct implements iam.IGrantable {
     }
     target.node.addDependency(probe.trigger);
 
+    return target;
+  }
+
+  /**
+   * Add another Gateway as a target of this Gateway, exposing its tools
+   * under `<targetName>___<innerTargetName>___<toolName>` names.
+   *
+   * The target name defaults to the gateway construct's `gatewayName`
+   * (its project's class name in kebab-case, e.g. `MyGateway` ->
+   * `my-gateway`). It prefixes Cedar action names and the gateway's tool
+   * names, so renaming it later is a breaking change for consumers.
+   *
+   * Both gateways evaluate their own Cedar policies: this gateway
+   * authorizes the prefixed action, then the target gateway authorizes the
+   * inner action for this gateway's role.
+   */
+  public addGateway(
+    gateway: Construct & {
+      readonly gateway: agentcore.Gateway;
+      readonly gatewayName: string;
+    },
+    props?: {
+      gatewayTargetName?: string;
+    },
+  ): agentcore.CfnGatewayTarget {
+    const target = this.addGatewayTarget({
+      gatewayTargetName: props?.gatewayTargetName ?? gateway.gatewayName,
+      // The Gateway L2 only populates gatewayUrl when created from its own
+      // props; fall back to the CloudFormation attribute otherwise.
+      gatewayUrl:
+        gateway.gateway.gatewayUrl ??
+        (gateway.gateway.node.defaultChild as agentcore.CfnGateway)
+          .attrGatewayUrl,
+      gatewayArn: gateway.gateway.gatewayArn,
+    });
+    // AgentCore fetches the target gateway's tools during target creation,
+    // so the target gateway and all of its own targets must exist first.
+    // Construct dependencies resolve at synth time, covering targets added
+    // to the target gateway after this call.
+    target.node.addDependency(gateway);
+    return target;
+  }
+
+  /**
+   * Register another Gateway's MCP endpoint as a target of this Gateway.
+   * Prefer {@link addGateway} when the construct is in scope — it also
+   * orders this gateway's target after the target gateway's own targets,
+   * so its tools are registered before they are fetched.
+   */
+  public addGatewayTarget(props: {
+    gatewayTargetName: string;
+    gatewayUrl: string;
+    gatewayArn: string;
+  }): agentcore.CfnGatewayTarget {
+    const target = this.addTarget(props.gatewayTargetName, props.gatewayUrl);
+
+    // Grant the gateway role invoke access to the target gateway before the
+    // target is created — AgentCore fetches the target's tools during
+    // creation, which fails if the permission is not yet in place.
+    const grant = this.gateway.role.addToPrincipalPolicy(
+      new iam.PolicyStatement({
+        actions: ['bedrock-agentcore:InvokeGateway'],
+        resources: [props.gatewayArn],
+      }),
+    );
+    if (grant.policyDependable) {
+      target.node.addDependency(grant.policyDependable);
+    }
+
+    return target;
+  }
+
+  /**
+   * Create a Gateway target for an MCP endpoint, with outbound calls signed
+   * using this gateway's own execution role.
+   */
+  private addTarget(
+    gatewayTargetName: string,
+    endpoint: string,
+  ): agentcore.CfnGatewayTarget {
+    // The construct id is derived from the target name so the two change
+    // together — target names are unique per gateway, and replacing a target
+    // under an unchanged name fails with AlreadyExists.
+    const target = new agentcore.CfnGatewayTarget(
+      this,
+      `Target-${gatewayTargetName}`,
+      {
+        gatewayIdentifier: this.gateway.gatewayId,
+        name: gatewayTargetName,
+        targetConfiguration: {
+          mcp: {
+            mcpServer: {
+              endpoint,
+            },
+          },
+        },
+        credentialProviderConfigurations: [
+          {
+            credentialProviderType: 'GATEWAY_IAM_ROLE',
+            credentialProvider: {
+              iamCredentialProvider: {
+                service: 'bedrock-agentcore',
+              },
+            },
+          },
+        ],
+      },
+    );
+
     // Policies referencing this target's actions (e.g.
     // AgentCore::Action::"<targetName>___<tool>") only validate once the
     // target has registered them, so create policies after targets.

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -28,6 +28,12 @@ variable "additional_iam_policy_statements" {
   }))
   default = []
 }
+
+variable "tool_dependencies" {
+  description = "Target ids whose tools must be queryable before `gateway_url` is consumable. Set this to the gateway's own target ids (e.g. from agentcore-gateway#mcp-connection) when another gateway aggregates this one: the readiness probe waits until this gateway serves those tools, since a parent gateway fetches them at target creation."
+  type        = list(string)
+  default     = []
+}
 <%_ if (cedarPolicy) { _%>
 
 variable "policy_dependencies" {
@@ -210,6 +216,91 @@ resource "aws_bedrockagentcore_policy" "policies" {
 }
 <%_ } _%>
 
+# A parent gateway fetches this gateway's tools when it registers it as a
+# target, so this gateway must already serve them — its own targets register
+# their tools asynchronously after creation. Probe `tools/list` over SigV4
+# until the configured `tool_dependencies` are served, and route `gateway_url`
+# through this resource so a parent gateway target waits for readiness. Only
+# runs when this gateway is aggregated by another (empty `tool_dependencies`).
+resource "null_resource" "gateway_ready" {
+  count = length(var.tool_dependencies) > 0 ? 1 : 0
+
+  triggers = {
+    gateway_url       = aws_bedrockagentcore_gateway.this.gateway_url
+    region            = local.aws_region
+    tool_dependencies = join(",", var.tool_dependencies)
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      uv run --with boto3 --with httpx --with mcp python -c "
+import asyncio
+import os
+import time
+
+import boto3
+import httpx
+from botocore.auth import SigV4Auth
+from botocore.awsrequest import AWSRequest
+from mcp import ClientSession
+from mcp.client.streamable_http import streamablehttp_client
+
+gateway_url = os.environ['GATEWAY_URL']
+region = os.environ['REGION']
+credentials = boto3.Session(region_name=region).get_credentials()
+signer = SigV4Auth(credentials, 'bedrock-agentcore', region)
+
+
+class SigV4Auth_(httpx.Auth):
+    requires_request_body = True
+
+    def auth_flow(self, request):
+        aws_request = AWSRequest(
+            method=request.method,
+            url=str(request.url),
+            data=request.content,
+            headers=dict(request.headers),
+        )
+        signer.add_auth(aws_request)
+        request.headers.update(dict(aws_request.headers))
+        yield request
+
+
+async def list_tools():
+    async with streamablehttp_client(
+        gateway_url, auth=SigV4Auth_(), timeout=120
+    ) as (read, write, _):
+        async with ClientSession(read, write) as session:
+            await session.initialize()
+            result = await session.list_tools()
+            return [t.name for t in result.tools]
+
+
+# The built-in semantic-search tool is always present, so require at least one
+# more tool before declaring the gateway ready to serve its aggregated targets.
+deadline = time.time() + 5 * 60
+while True:
+    try:
+        tools = asyncio.run(list_tools())
+        if len([t for t in tools if t != 'x_amz_bedrock_agentcore_search']) > 0:
+            break
+        last = f'gateway serves no aggregated tools yet (got {tools})'
+    except Exception as e:
+        last = str(e)
+    if time.time() >= deadline:
+        raise SystemExit(f'Gateway {gateway_url} not ready: {last}')
+    time.sleep(5)
+
+print(f'Gateway {gateway_url} is serving tools')
+"
+    EOT
+    environment = {
+      GATEWAY_URL = self.triggers.gateway_url
+      REGION      = self.triggers.region
+    }
+  }
+}
+
 # Add gateway URL to runtime config
 module "add_gateway_url_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
@@ -232,8 +323,10 @@ output "gateway_arn" {
 }
 
 output "gateway_url" {
-  description = "MCP endpoint URL of the Bedrock AgentCore Gateway"
-  value       = aws_bedrockagentcore_gateway.this.gateway_url
+  description = "MCP endpoint URL of the Bedrock AgentCore Gateway. When `tool_dependencies` is set, this value flows through the readiness probe so consumers (e.g. a parent gateway target) wait until the gateway serves its aggregated tools."
+  value = length(var.tool_dependencies) > 0 ? (
+    null_resource.gateway_ready[0].triggers.gateway_url
+  ) : aws_bedrockagentcore_gateway.this.gateway_url
 }
 
 output "gateway_role_arn" {

package/src/utils/agent-core-constructs/files/terraform/core/agent-core/runtime.tf.template

@@ -281,14 +281,19 @@ resource "null_resource" "docker_publish" {
   provisioner "local-exec" {
     command = <<-EOT
       # Get ECR login token
-      aws ecr get-login-password --region ${local.aws_region} | <%= containers %> login --username AWS --password-stdin ${self.triggers.repository_url}
+      aws ecr get-login-password --region "$AWS_REGION" | <%= containers %> login --username AWS --password-stdin "$REPOSITORY_URL"
 
       # Tag the image
-      <%= containers %> tag ${self.triggers.docker_image_tag} ${self.triggers.repository_url}:latest
+      <%= containers %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
 
       # Push the image
-      <%= containers %> push ${self.triggers.repository_url}:latest
+      <%= containers %> push "$REPOSITORY_URL:latest"
     EOT
+    environment = {
+      AWS_REGION       = local.aws_region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.agent_core_ecr_policy]
@@ -350,10 +355,11 @@ resource "null_resource" "runtime_ready" {
       uv run --with boto3 python -c "
 import boto3
 import json
+import os
 import time
 import uuid
 
-runtime_arn = '${self.triggers.runtime_arn}'
+runtime_arn = os.environ['RUNTIME_ARN']
 client = boto3.client('bedrock-agentcore')
 initialize_request = json.dumps({
     'jsonrpc': '2.0',
@@ -385,6 +391,9 @@ while True:
 print(f'Runtime {runtime_arn} is serving MCP')
 "
     EOT
+    environment = {
+      RUNTIME_ARN = self.triggers.runtime_arn
+    }
   }
 }
 

package/src/utils/api-constructs/files/cdk/core/api/http/http-api.ts.template

@@ -12,6 +12,7 @@ import {
   HttpMethod,
   HttpStage,
   LogGroupLogDestination,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
 import { LogGroup } from 'aws-cdk-lib/aws-logs';
 import { suppressRules } from '../checkov.js';
@@ -38,6 +39,12 @@ export interface HttpApiProps<
    * Map of operation names to their API Gateway integrations
    */
   readonly integrations: TIntegrations;
+  /**
+   * Default throttling limits applied to the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -71,6 +78,7 @@ export class HttpApi<
       apiName,
       operations,
       integrations,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: HttpApiProps<TIntegrations, TOperation>,
   ) {
@@ -98,6 +106,7 @@ export class HttpApi<
     this.defaultStage = new HttpStage(this, 'DefaultStage', {
       httpApi: this.api,
       autoDeploy: true,
+      throttle,
       accessLogSettings: {
         destination: new LogGroupLogDestination(accessLogGroup),
       },

package/src/utils/api-constructs/files/cdk/core/api/rest/rest-api.ts.template

@@ -6,6 +6,7 @@ import {
   RestApiProps as _RestApiProps,
   IResource,
   Stage,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
 import { IAspect, RemovalPolicy } from 'aws-cdk-lib';
 import {
@@ -52,6 +53,12 @@ export interface RestApiProps<
    * @default true
    */
   readonly enableWaf?: boolean;
+  /**
+   * Default throttling limits applied to all methods on the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -86,6 +93,7 @@ export class RestApi<
       operations,
       integrations,
       enableWaf = true,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: RestApiProps<TIntegrations, TOperation>,
   ) {
@@ -93,7 +101,21 @@ export class RestApi<
     this.integrations = integrations;
 
     // Create the API Gateway REST API
-    this.api = new _RestApi(this, 'Api', props);
+    this.api = new _RestApi(this, 'Api', {
+      ...props,
+      deployOptions: {
+        ...props.deployOptions,
+        methodOptions: {
+          ...props.deployOptions?.methodOptions,
+          // Default throttling applied to all resource paths and methods
+          '/*/*': {
+            throttlingRateLimit: throttle.rateLimit,
+            throttlingBurstLimit: throttle.burstLimit,
+            ...props.deployOptions?.methodOptions?.['/*/*'],
+          },
+        },
+      },
+    });
 
     if (enableWaf) {
       this.webAcl = new CfnWebACL(this, 'WebAcl', {

package/src/utils/files/terraform/src/core/runtime-config/appconfig-deployment/appconfig-deployment.tf.template

@@ -65,12 +65,13 @@ resource "null_resource" "aggregate_namespace" {
     command = <<-EOT
       uv run python -c "
 import json
+import os
 import pathlib
 import sys
 
-namespace = '${each.key}'
-entries_dir = pathlib.Path('${local.entries_dir}') / namespace
-output_file = pathlib.Path('${local.config_dir}') / f'{namespace}.json'
+namespace = os.environ['NAMESPACE']
+entries_dir = pathlib.Path(os.environ['ENTRIES_DIR']) / namespace
+output_file = pathlib.Path(os.environ['CONFIG_DIR']) / f'{namespace}.json'
 
 def deep_merge(target: dict, source: dict) -> dict:
     for k, v in source.items():
@@ -103,6 +104,11 @@ output_file.write_text(json.dumps(merged, indent=2))
 print(f'Aggregated {namespace}.json with {len(merged)} section(s)')
 "
     EOT
+    environment = {
+      NAMESPACE   = each.key
+      ENTRIES_DIR = local.entries_dir
+      CONFIG_DIR  = local.config_dir
+    }
   }
 }
 

package/src/utils/files/terraform/src/core/runtime-config/read/read.tf.template

@@ -38,11 +38,12 @@ resource "null_resource" "aggregate_namespace" {
     command = <<-EOT
       uv run python -c "
 import json
+import os
 import pathlib
 import sys
 
-entries_dir = pathlib.Path('${local.entries_dir}')
-output_file = pathlib.Path('${local.namespace_path}')
+entries_dir = pathlib.Path(os.environ['ENTRIES_DIR'])
+output_file = pathlib.Path(os.environ['NAMESPACE_PATH'])
 
 def deep_merge(target: dict, source: dict) -> dict:
     for k, v in source.items():
@@ -71,6 +72,10 @@ output_file.parent.mkdir(parents=True, exist_ok=True)
 output_file.write_text(json.dumps(merged, indent=2))
 "
     EOT
+    environment = {
+      ENTRIES_DIR    = local.entries_dir
+      NAMESPACE_PATH = local.namespace_path
+    }
   }
 }