@aws/nx-plugin 1.0.0-rc.18 → 1.0.0-rc.19

package/src/utils/agent-connection/files/py-core-mcp/agentcore_mcp_transport.py.template

@@ -0,0 +1,34 @@
+from collections.abc import Callable
+
+from .agentcore_endpoints import mcp_url_from_arn, region_from_arn
+from .agentcore_transport import (
+    TransportFactory,
+    jwt_transport,
+    no_auth_transport,
+    sigv4_transport,
+)
+
+
+class AgentCoreMCPTransport:
+    """Factory for MCP transport factories that connect to an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(agent_runtime_arn: str) -> TransportFactory:
+        """SigV4-authenticated transport for a Bedrock AgentCore runtime."""
+        return sigv4_transport(
+            mcp_url_from_arn(agent_runtime_arn), region_from_arn(agent_runtime_arn)
+        )
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str, access_token_provider: Callable[[], str]
+    ) -> TransportFactory:
+        """Bearer-authenticated transport for a Bedrock AgentCore runtime."""
+        return jwt_transport(
+            mcp_url_from_arn(agent_runtime_arn), access_token_provider
+        )
+
+    @staticmethod
+    def without_auth(url: str) -> TransportFactory:
+        """Plain-HTTP transport — for local dev."""
+        return no_auth_transport(url)

package/src/utils/agent-connection/files/py-core-shared/agentcore_transport.py.template

@@ -0,0 +1,40 @@
+from collections.abc import Callable
+from typing import Any
+
+import boto3
+
+from mcp.client.streamable_http import streamablehttp_client
+
+from .auth.session import jwt_auth, plain_auth, sigv4_auth
+
+# Agent frameworks wrap a transport *factory* — a no-arg callable returning a
+# streamable-HTTP transport context manager. Typed as ``Any`` so this layer
+# stays free of any framework-specific transport type.
+TransportFactory = Callable[[], Any]
+
+
+def _factory(url: str, auth) -> TransportFactory:
+    return lambda: streamablehttp_client(
+        url,
+        auth=auth,
+        timeout=120,
+        terminate_on_close=False,
+    )
+
+
+def sigv4_transport(url: str, region: str) -> TransportFactory:
+    """SigV4-signed transport factory for a resolved AgentCore endpoint."""
+    credentials = boto3.Session(region_name=region).get_credentials()
+    return _factory(url, sigv4_auth(credentials, region))
+
+
+def jwt_transport(
+    url: str, access_token_provider: Callable[[], str]
+) -> TransportFactory:
+    """Bearer-token transport factory for a resolved AgentCore endpoint."""
+    return _factory(url, jwt_auth(access_token_provider))
+
+
+def no_auth_transport(url: str) -> TransportFactory:
+    """Plain-HTTP transport factory — for local dev."""
+    return _factory(url, plain_auth())

package/src/utils/agent-connection/files/py-core-strands/a2a/agentcore_a2a_client_strands.py.template

@@ -0,0 +1,66 @@
+from collections.abc import Callable
+
+from strands.agent.a2a_agent import A2AAgent
+
+from .agentcore_a2a_client_config import AgentCoreA2aClientConfig
+
+
+def _build(
+    config: tuple, *, name: str | None, description: str | None
+) -> A2AAgent:
+    url, client_config = config
+    kwargs: dict = {"endpoint": url, "client_config": client_config}
+    if name:
+        kwargs["name"] = name
+    if description:
+        kwargs["description"] = description
+    return A2AAgent(**kwargs)
+
+
+class AgentCoreA2aClientStrands:
+    """Factory for Strands A2A clients that connect to an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(
+        agent_runtime_arn: str,
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """SigV4-authenticated client for a Bedrock AgentCore runtime."""
+        return _build(
+            AgentCoreA2aClientConfig.with_iam_auth(agent_runtime_arn),
+            name=name,
+            description=description,
+        )
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str,
+        access_token_provider: Callable[[], str],
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """Bearer-authenticated client for a Bedrock AgentCore runtime."""
+        return _build(
+            AgentCoreA2aClientConfig.with_jwt_auth(
+                agent_runtime_arn, access_token_provider
+            ),
+            name=name,
+            description=description,
+        )
+
+    @staticmethod
+    def without_auth(
+        url: str,
+        *,
+        name: str | None = None,
+        description: str | None = None,
+    ) -> A2AAgent:
+        """Plain-HTTP client — for local dev."""
+        return _build(
+            AgentCoreA2aClientConfig.without_auth(url),
+            name=name,
+            description=description,
+        )

package/src/utils/agent-connection/files/py-core-strands/gateway/agentcore_gateway_mcp_client_strands.py.template

@@ -0,0 +1,22 @@
+from strands.tools.mcp.mcp_client import MCPClient
+
+from .agentcore_gateway_mcp_transport import AgentCoreGatewayMCPTransport
+
+
+class AgentCoreGatewayMCPClientStrands:
+    """Factory for Strands MCP clients that connect to an AgentCore Gateway."""
+
+    @staticmethod
+    def with_iam_auth(
+        gateway_url: str,
+        region: str | None = None,
+    ) -> MCPClient:
+        """Create a gateway MCP client authenticated with IAM SigV4."""
+        return MCPClient(
+            AgentCoreGatewayMCPTransport.with_iam_auth(gateway_url, region)
+        )
+
+    @staticmethod
+    def without_auth(gateway_url: str) -> MCPClient:
+        """Plain-HTTP gateway client, for the local gateway started by serve-local."""
+        return MCPClient(AgentCoreGatewayMCPTransport.without_auth(gateway_url))

package/src/utils/agent-connection/files/py-core-strands/mcp/agentcore_mcp_client_strands.py.template

@@ -0,0 +1,30 @@
+from collections.abc import Callable
+
+from strands.tools.mcp.mcp_client import MCPClient
+
+from .agentcore_mcp_transport import AgentCoreMCPTransport
+
+
+class AgentCoreMCPClientStrands:
+    """Factory for Strands MCP clients that connect to an AgentCore runtime."""
+
+    @staticmethod
+    def with_iam_auth(agent_runtime_arn: str) -> MCPClient:
+        """SigV4-authenticated client for a Bedrock AgentCore runtime."""
+        return MCPClient(AgentCoreMCPTransport.with_iam_auth(agent_runtime_arn))
+
+    @staticmethod
+    def with_jwt_auth(
+        agent_runtime_arn: str, access_token_provider: Callable[[], str]
+    ) -> MCPClient:
+        """Bearer-authenticated client for a Bedrock AgentCore runtime."""
+        return MCPClient(
+            AgentCoreMCPTransport.with_jwt_auth(
+                agent_runtime_arn, access_token_provider
+            )
+        )
+
+    @staticmethod
+    def without_auth(url: str) -> MCPClient:
+        """Plain-HTTP client — for local dev."""
+        return MCPClient(AgentCoreMCPTransport.without_auth(url))

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -235,6 +235,7 @@ resource "null_resource" "gateway_ready" {
     command = <<-EOT
       uv run --with boto3 --with httpx --with mcp python -c "
 import asyncio
+import os
 import time
 
 import boto3
@@ -244,8 +245,8 @@ from botocore.awsrequest import AWSRequest
 from mcp import ClientSession
 from mcp.client.streamable_http import streamablehttp_client
 
-gateway_url = '${self.triggers.gateway_url}'
-region = '${self.triggers.region}'
+gateway_url = os.environ['GATEWAY_URL']
+region = os.environ['REGION']
 credentials = boto3.Session(region_name=region).get_credentials()
 signer = SigV4Auth(credentials, 'bedrock-agentcore', region)
 
@@ -293,6 +294,10 @@ while True:
 print(f'Gateway {gateway_url} is serving tools')
 "
     EOT
+    environment = {
+      GATEWAY_URL = self.triggers.gateway_url
+      REGION      = self.triggers.region
+    }
   }
 }
 

package/src/utils/agent-core-constructs/files/terraform/core/agent-core/runtime.tf.template

@@ -281,14 +281,19 @@ resource "null_resource" "docker_publish" {
   provisioner "local-exec" {
     command = <<-EOT
       # Get ECR login token
-      aws ecr get-login-password --region ${local.aws_region} | <%= containers %> login --username AWS --password-stdin ${self.triggers.repository_url}
+      aws ecr get-login-password --region "$AWS_REGION" | <%= containers %> login --username AWS --password-stdin "$REPOSITORY_URL"
 
       # Tag the image
-      <%= containers %> tag ${self.triggers.docker_image_tag} ${self.triggers.repository_url}:latest
+      <%= containers %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
 
       # Push the image
-      <%= containers %> push ${self.triggers.repository_url}:latest
+      <%= containers %> push "$REPOSITORY_URL:latest"
     EOT
+    environment = {
+      AWS_REGION       = local.aws_region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.agent_core_ecr_policy]
@@ -350,10 +355,11 @@ resource "null_resource" "runtime_ready" {
       uv run --with boto3 python -c "
 import boto3
 import json
+import os
 import time
 import uuid
 
-runtime_arn = '${self.triggers.runtime_arn}'
+runtime_arn = os.environ['RUNTIME_ARN']
 client = boto3.client('bedrock-agentcore')
 initialize_request = json.dumps({
     'jsonrpc': '2.0',
@@ -385,6 +391,9 @@ while True:
 print(f'Runtime {runtime_arn} is serving MCP')
 "
     EOT
+    environment = {
+      RUNTIME_ARN = self.triggers.runtime_arn
+    }
   }
 }
 

package/src/utils/api-constructs/files/cdk/core/api/http/http-api.ts.template

@@ -12,6 +12,7 @@ import {
   HttpMethod,
   HttpStage,
   LogGroupLogDestination,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
 import { LogGroup } from 'aws-cdk-lib/aws-logs';
 import { suppressRules } from '../checkov.js';
@@ -38,6 +39,12 @@ export interface HttpApiProps<
    * Map of operation names to their API Gateway integrations
    */
   readonly integrations: TIntegrations;
+  /**
+   * Default throttling limits applied to the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -71,6 +78,7 @@ export class HttpApi<
       apiName,
       operations,
       integrations,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: HttpApiProps<TIntegrations, TOperation>,
   ) {
@@ -98,6 +106,7 @@ export class HttpApi<
     this.defaultStage = new HttpStage(this, 'DefaultStage', {
       httpApi: this.api,
       autoDeploy: true,
+      throttle,
       accessLogSettings: {
         destination: new LogGroupLogDestination(accessLogGroup),
       },

package/src/utils/api-constructs/files/cdk/core/api/rest/rest-api.ts.template

@@ -6,6 +6,7 @@ import {
   RestApiProps as _RestApiProps,
   IResource,
   Stage,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
 import { IAspect, RemovalPolicy } from 'aws-cdk-lib';
 import {
@@ -52,6 +53,12 @@ export interface RestApiProps<
    * @default true
    */
   readonly enableWaf?: boolean;
+  /**
+   * Default throttling limits applied to all methods on the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -86,6 +93,7 @@ export class RestApi<
       operations,
       integrations,
       enableWaf = true,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: RestApiProps<TIntegrations, TOperation>,
   ) {
@@ -93,7 +101,21 @@ export class RestApi<
     this.integrations = integrations;
 
     // Create the API Gateway REST API
-    this.api = new _RestApi(this, 'Api', props);
+    this.api = new _RestApi(this, 'Api', {
+      ...props,
+      deployOptions: {
+        ...props.deployOptions,
+        methodOptions: {
+          ...props.deployOptions?.methodOptions,
+          // Default throttling applied to all resource paths and methods
+          '/*/*': {
+            throttlingRateLimit: throttle.rateLimit,
+            throttlingBurstLimit: throttle.burstLimit,
+            ...props.deployOptions?.methodOptions?.['/*/*'],
+          },
+        },
+      },
+    });
 
     if (enableWaf) {
       this.webAcl = new CfnWebACL(this, 'WebAcl', {

package/src/utils/files/terraform/src/core/runtime-config/appconfig-deployment/appconfig-deployment.tf.template

@@ -65,12 +65,13 @@ resource "null_resource" "aggregate_namespace" {
     command = <<-EOT
       uv run python -c "
 import json
+import os
 import pathlib
 import sys
 
-namespace = '${each.key}'
-entries_dir = pathlib.Path('${local.entries_dir}') / namespace
-output_file = pathlib.Path('${local.config_dir}') / f'{namespace}.json'
+namespace = os.environ['NAMESPACE']
+entries_dir = pathlib.Path(os.environ['ENTRIES_DIR']) / namespace
+output_file = pathlib.Path(os.environ['CONFIG_DIR']) / f'{namespace}.json'
 
 def deep_merge(target: dict, source: dict) -> dict:
     for k, v in source.items():
@@ -103,6 +104,11 @@ output_file.write_text(json.dumps(merged, indent=2))
 print(f'Aggregated {namespace}.json with {len(merged)} section(s)')
 "
     EOT
+    environment = {
+      NAMESPACE   = each.key
+      ENTRIES_DIR = local.entries_dir
+      CONFIG_DIR  = local.config_dir
+    }
   }
 }
 

package/src/utils/files/terraform/src/core/runtime-config/read/read.tf.template

@@ -38,11 +38,12 @@ resource "null_resource" "aggregate_namespace" {
     command = <<-EOT
       uv run python -c "
 import json
+import os
 import pathlib
 import sys
 
-entries_dir = pathlib.Path('${local.entries_dir}')
-output_file = pathlib.Path('${local.namespace_path}')
+entries_dir = pathlib.Path(os.environ['ENTRIES_DIR'])
+output_file = pathlib.Path(os.environ['NAMESPACE_PATH'])
 
 def deep_merge(target: dict, source: dict) -> dict:
     for k, v in source.items():
@@ -71,6 +72,10 @@ output_file.parent.mkdir(parents=True, exist_ok=True)
 output_file.write_text(json.dumps(merged, indent=2))
 "
     EOT
+    environment = {
+      ENTRIES_DIR    = local.entries_dir
+      NAMESPACE_PATH = local.namespace_path
+    }
   }
 }
 

package/src/utils/identity-constructs/files/terraform/core/user-identity/add-callback-url/add-callback-url.tf.template

@@ -61,12 +61,13 @@ resource "null_resource" "add_callback_url" {
     command = <<-EOT
       uv run --with boto3 python -c "
 import boto3
+import os
 import sys
 
 # Configuration
-user_pool_id = '${local.user_pool_id}'
-client_id = '${local.user_pool_client_id}'
-new_callback_url = '${var.callback_url}'
+user_pool_id = os.environ['USER_POOL_ID']
+client_id = os.environ['CLIENT_ID']
+new_callback_url = os.environ['NEW_CALLBACK_URL']
 
 # Initialize Cognito client
 cognito = boto3.client('cognito-idp')
@@ -118,6 +119,11 @@ except Exception as e:
     sys.exit(1)
 "
     EOT
+    environment = {
+      USER_POOL_ID     = local.user_pool_id
+      CLIENT_ID        = local.user_pool_client_id
+      NEW_CALLBACK_URL = var.callback_url
+    }
   }
 
   depends_on = [terraform_data.validate_cognito_props]

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -287,10 +287,15 @@ resource "null_resource" "docker_publish" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region ${data.aws_region.current.region} | <%= containerEngine %> login --username AWS --password-stdin ${self.triggers.repository_url}
-      <%= containerEngine %> tag ${self.triggers.docker_image_tag} ${self.triggers.repository_url}:latest
-      <%= containerEngine %> push ${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | <%= containerEngine %> login --username AWS --password-stdin "$REPOSITORY_URL"
+      <%= containerEngine %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
+      <%= containerEngine %> push "$REPOSITORY_URL:latest"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -574,10 +579,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \
-        --region ${data.aws_region.current.region} \
-        --function-name ${self.triggers.function_name} \
+        --region "$AWS_REGION" \
+        --function-name "$FUNCTION_NAME" \
         --cli-binary-format raw-in-base64-out \
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:${self.triggers.db_user}"}' \
+        --payload "{\"RequestType\":\"Create\",\"PhysicalResourceId\":\"db-user:$DB_USER\"}" \
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -587,6 +592,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -655,8 +665,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \
-        --region ${data.aws_region.current.region} \
-        --function-name ${self.triggers.function_name} \
+        --region "$AWS_REGION" \
+        --function-name "$FUNCTION_NAME" \
         --cli-binary-format raw-in-base64-out \
         "$output_file")
       cat "$output_file"
@@ -667,6 +677,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -540,9 +540,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \
-          --region ${data.aws_region.current.region} \
-          --db-proxy-name ${self.triggers.db_proxy_name} \
-          --target-group-name ${self.triggers.target_group_name} \
+          --region "$AWS_REGION" \
+          --db-proxy-name "$DB_PROXY_NAME" \
+          --target-group-name "$TARGET_GROUP_NAME" \
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \
           --output text)
 
@@ -552,13 +552,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target ${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -553,7 +553,7 @@ resource "null_resource" "upload_website_files" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      cd "${path.root}"
+      cd "$ROOT_PATH"
       uv run --with boto3 python3 -c "
 import os
 import sys
@@ -642,9 +642,14 @@ def sync_to_s3(local_path, bucket_name):
         sys.exit(1)
 
 # Execute sync
-sync_to_s3('${var.website_file_path}', '${aws_s3_bucket.website.bucket}')
+sync_to_s3(os.environ['WEBSITE_FILE_PATH'], os.environ['BUCKET_NAME'])
 "
     EOT
+    environment = {
+      ROOT_PATH         = path.root
+      WEBSITE_FILE_PATH = var.website_file_path
+      BUCKET_NAME       = aws_s3_bucket.website.bucket
+    }
   }
 
   depends_on = [aws_s3_bucket_policy.website_cloudfront_policy]
@@ -674,6 +679,7 @@ resource "null_resource" "cloudfront_invalidation" {
     command = <<-EOT
       uv run --with boto3 python3 -c "
 import boto3
+import os
 import sys
 from botocore.exceptions import ClientError, NoCredentialsError
 
@@ -695,7 +701,7 @@ def create_invalidation(distribution_id):
 
         invalidation_id = response['Invalidation']['Id']
         print(f'CloudFront cache invalidation created: {invalidation_id}')
-        print(f'Distribution: ${aws_cloudfront_distribution.website.id}')
+        print(f'Distribution: {distribution_id}')
         print(f'Status: {response[\"Invalidation\"][\"Status\"]}')
 
     except NoCredentialsError:
@@ -709,9 +715,12 @@ def create_invalidation(distribution_id):
         sys.exit(1)
 
 # Execute invalidation
-create_invalidation('${aws_cloudfront_distribution.website.id}')
+create_invalidation(os.environ['DISTRIBUTION_ID'])
 "
     EOT
+    environment = {
+      DISTRIBUTION_ID = aws_cloudfront_distribution.website.id
+    }
   }
 
   depends_on = [