@aws/nx-plugin 1.0.0-rc.19 → 1.0.0-rc.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.19",
+  "version": "1.0.0-rc.20",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/py/agent/__snapshots__/generator.spec.ts.snap

@@ -922,8 +922,7 @@ resource "aws_ecr_repository" "agent_core_repository" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
   name = "\${lower(var.agent_runtime_name)}_repository_\${random_id.unique_suffix.hex}"
 
-  #checkov:skip=CKV_AWS_51:Image tag is reused for latest deployments
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -1097,12 +1096,18 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 # Null resource for container image publish
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.agent_core_repository.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
@@ -1110,16 +1115,17 @@ resource "null_resource" "docker_publish" {
       # Get ECR login token
       aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
 
-      # Tag the image
-      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
+      # Tag the image with the immutable content-based tag
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
 
       # Push the image
-      docker push "$REPOSITORY_URL:latest"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
     environment = {
       AWS_REGION       = local.aws_region
       REPOSITORY_URL   = self.triggers.repository_url
       DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
     }
   }
 
@@ -1134,7 +1140,7 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
 
   agent_runtime_artifact {
     container_configuration {
-      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:latest"
+      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:\${local.image_tag}"
     }
   }
 

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -226,8 +226,7 @@ resource "aws_ecr_repository" "agent_core_repository" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
   name = "\${lower(var.agent_runtime_name)}_repository_\${random_id.unique_suffix.hex}"
 
-  #checkov:skip=CKV_AWS_51:Image tag is reused for latest deployments
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -401,12 +400,18 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 # Null resource for container image publish
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.agent_core_repository.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
@@ -414,16 +419,17 @@ resource "null_resource" "docker_publish" {
       # Get ECR login token
       aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
 
-      # Tag the image
-      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
+      # Tag the image with the immutable content-based tag
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
 
       # Push the image
-      docker push "$REPOSITORY_URL:latest"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
     environment = {
       AWS_REGION       = local.aws_region
       REPOSITORY_URL   = self.triggers.repository_url
       DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
     }
   }
 
@@ -438,7 +444,7 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
 
   agent_runtime_artifact {
     container_configuration {
-      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:latest"
+      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:\${local.image_tag}"
     }
   }
 

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -918,8 +918,7 @@ resource "aws_ecr_repository" "agent_core_repository" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
   name = "\${lower(var.agent_runtime_name)}_repository_\${random_id.unique_suffix.hex}"
 
-  #checkov:skip=CKV_AWS_51:Image tag is reused for latest deployments
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -1093,12 +1092,18 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 # Null resource for container image publish
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.agent_core_repository.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
@@ -1106,16 +1111,17 @@ resource "null_resource" "docker_publish" {
       # Get ECR login token
       aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
 
-      # Tag the image
-      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
+      # Tag the image with the immutable content-based tag
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
 
       # Push the image
-      docker push "$REPOSITORY_URL:latest"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
     environment = {
       AWS_REGION       = local.aws_region
       REPOSITORY_URL   = self.triggers.repository_url
       DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
     }
   }
 
@@ -1130,7 +1136,7 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
 
   agent_runtime_artifact {
     container_configuration {
-      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:latest"
+      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:\${local.image_tag}"
     }
   }
 

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -226,8 +226,7 @@ resource "aws_ecr_repository" "agent_core_repository" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
   name = "\${lower(var.agent_runtime_name)}_repository_\${random_id.unique_suffix.hex}"
 
-  #checkov:skip=CKV_AWS_51:Image tag is reused for latest deployments
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -401,12 +400,18 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 # Null resource for container image publish
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.agent_core_repository.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
@@ -414,16 +419,17 @@ resource "null_resource" "docker_publish" {
       # Get ECR login token
       aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
 
-      # Tag the image
-      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
+      # Tag the image with the immutable content-based tag
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
 
       # Push the image
-      docker push "$REPOSITORY_URL:latest"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
     environment = {
       AWS_REGION       = local.aws_region
       REPOSITORY_URL   = self.triggers.repository_url
       DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
     }
   }
 
@@ -438,7 +444,7 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
 
   agent_runtime_artifact {
     container_configuration {
-      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:latest"
+      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:\${local.image_tag}"
     }
   }
 

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -1782,9 +1782,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "db-migration-\${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -1835,23 +1834,30 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
       aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
-      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
-      docker push "$REPOSITORY_URL:latest"
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
     environment = {
       AWS_REGION       = data.aws_region.current.region
       REPOSITORY_URL   = self.triggers.repository_url
       DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
     }
   }
 
@@ -2141,7 +2147,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:\${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]
@@ -3263,9 +3269,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "db-migration-\${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -3316,23 +3321,30 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
       aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
-      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
-      docker push "$REPOSITORY_URL:latest"
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
     environment = {
       AWS_REGION       = data.aws_region.current.region
       REPOSITORY_URL   = self.triggers.repository_url
       DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
     }
   }
 
@@ -3627,7 +3639,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:\${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -160,6 +160,15 @@ variable "website_file_path" {
   type        = string
 }
 
+# Content-Security-Policy enforced on all responses. Restricts scripts and
+# framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+# (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+# Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+# connect-src to your specific origins once they are known.
+locals {
+  content_security_policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+}
+
 
 # Data sources
 data "aws_caller_identity" "current" {}
@@ -520,8 +529,7 @@ resource "aws_cloudfront_origin_access_control" "website_oac" {
   signing_protocol                  = "sigv4"
 }
 
-# Security headers applied to all responses. A Content-Security-Policy is
-# intentionally omitted as it is application specific - add one for your app.
+# Security headers applied to all responses.
 resource "aws_cloudfront_response_headers_policy" "website" {
   name = "\${aws_s3_bucket.website.bucket}-security-headers"
 
@@ -543,6 +551,10 @@ resource "aws_cloudfront_response_headers_policy" "website" {
       referrer_policy = "strict-origin-when-cross-origin"
       override        = true
     }
+    content_security_policy {
+      content_security_policy = local.content_security_policy
+      override                = true
+    }
   }
 }
 
@@ -1570,6 +1582,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -1661,8 +1690,7 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
-    // Security headers applied to all responses. A Content-Security-Policy is
-    // intentionally omitted as it is application specific - add one for your app.
+    // Security headers applied to all responses.
     const responseHeadersPolicy = new ResponseHeadersPolicy(
       this,
       'ResponseHeadersPolicy',
@@ -1684,6 +1712,10 @@ export class StaticWebsite extends Construct {
               HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
             override: true,
           },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
         },
       },
     );
@@ -3197,6 +3229,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -3288,8 +3337,7 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
-    // Security headers applied to all responses. A Content-Security-Policy is
-    // intentionally omitted as it is application specific - add one for your app.
+    // Security headers applied to all responses.
     const responseHeadersPolicy = new ResponseHeadersPolicy(
       this,
       'ResponseHeadersPolicy',
@@ -3311,6 +3359,10 @@ export class StaticWebsite extends Construct {
               HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
             override: true,
           },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
         },
       },
     );
@@ -4743,6 +4795,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -4834,8 +4903,7 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
-    // Security headers applied to all responses. A Content-Security-Policy is
-    // intentionally omitted as it is application specific - add one for your app.
+    // Security headers applied to all responses.
     const responseHeadersPolicy = new ResponseHeadersPolicy(
       this,
       'ResponseHeadersPolicy',
@@ -4857,6 +4925,10 @@ export class StaticWebsite extends Construct {
               HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
             override: true,
           },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
         },
       },
     );

package/src/utils/agent-core-constructs/files/terraform/core/agent-core/runtime.tf.template

@@ -95,8 +95,7 @@ resource "aws_ecr_repository" "agent_core_repository" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
   name = "${lower(var.agent_runtime_name)}_repository_${random_id.unique_suffix.hex}"
 
-  #checkov:skip=CKV_AWS_51:Image tag is reused for latest deployments
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -270,12 +269,18 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containers %> inspect ${var.docker_image_tag} --format '{{.Id}}')'\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 # Null resource for container image publish
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.agent_core_repository.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
@@ -283,16 +288,17 @@ resource "null_resource" "docker_publish" {
       # Get ECR login token
       aws ecr get-login-password --region "$AWS_REGION" | <%= containers %> login --username AWS --password-stdin "$REPOSITORY_URL"
 
-      # Tag the image
-      <%= containers %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
+      # Tag the image with the immutable content-based tag
+      <%= containers %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
 
       # Push the image
-      <%= containers %> push "$REPOSITORY_URL:latest"
+      <%= containers %> push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
     environment = {
       AWS_REGION       = local.aws_region
       REPOSITORY_URL   = self.triggers.repository_url
       DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
     }
   }
 
@@ -307,7 +313,7 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
 
   agent_runtime_artifact {
     container_configuration {
-      container_uri = "${aws_ecr_repository.agent_core_repository.repository_url}:latest"
+      container_uri = "${aws_ecr_repository.agent_core_repository.repository_url}:${local.image_tag}"
     }
   }
 

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -225,9 +225,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "<%= nameKebabCase %>-migration-${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -278,23 +277,30 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containerEngine %> inspect ${var.docker_image_tag} --format '{{.Id}}')'\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
       aws ecr get-login-password --region "$AWS_REGION" | <%= containerEngine %> login --username AWS --password-stdin "$REPOSITORY_URL"
-      <%= containerEngine %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:latest"
-      <%= containerEngine %> push "$REPOSITORY_URL:latest"
+      <%= containerEngine %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      <%= containerEngine %> push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
     environment = {
       AWS_REGION       = data.aws_region.current.region
       REPOSITORY_URL   = self.triggers.repository_url
       DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
     }
   }
 
@@ -610,7 +616,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "${aws_ecr_repository.migration_handler.repository_url}:${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]

package/src/utils/website-constructs/files/cdk/core/static-website.ts.template

@@ -27,6 +27,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -118,8 +135,7 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
-    // Security headers applied to all responses. A Content-Security-Policy is
-    // intentionally omitted as it is application specific - add one for your app.
+    // Security headers applied to all responses.
     const responseHeadersPolicy = new ResponseHeadersPolicy(
       this,
       'ResponseHeadersPolicy',
@@ -140,6 +156,10 @@ export class StaticWebsite extends Construct {
             referrerPolicy: HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
             override: true,
           },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
         },
       },
     );

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -23,6 +23,15 @@ variable "website_file_path" {
   type        = string
 }
 
+# Content-Security-Policy enforced on all responses. Restricts scripts and
+# framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+# (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+# Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+# connect-src to your specific origins once they are known.
+locals {
+  content_security_policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+}
+
 
 # Data sources
 data "aws_caller_identity" "current" {}
@@ -383,8 +392,7 @@ resource "aws_cloudfront_origin_access_control" "website_oac" {
   signing_protocol                  = "sigv4"
 }
 
-# Security headers applied to all responses. A Content-Security-Policy is
-# intentionally omitted as it is application specific - add one for your app.
+# Security headers applied to all responses.
 resource "aws_cloudfront_response_headers_policy" "website" {
   name = "${aws_s3_bucket.website.bucket}-security-headers"
 
@@ -406,6 +414,10 @@ resource "aws_cloudfront_response_headers_policy" "website" {
       referrer_policy = "strict-origin-when-cross-origin"
       override        = true
     }
+    content_security_policy {
+      content_security_policy = local.content_security_policy
+      override                = true
+    }
   }
 }