@aws/nx-plugin 1.0.0-rc.22 → 1.0.0-rc.24

package/src/py/fast-api/__snapshots__/generator.spec.ts.snap

@@ -213,11 +213,12 @@ def echo(message: Annotated[str, Query(max_length=1024)]) -> EchoOutput:
 if __name__ == "__main__":
     uvicorn.run("proj_test_api.main:app", port=8000)
 ",
-  "apps/test_api/scripts/generate_open_api.py": "from proj_test_api.main import app
-import json
+  "apps/test_api/scripts/generate_open_api.py": "import json
 import os
 import sys
 
+from proj_test_api.main import app
+
 os.makedirs(os.path.dirname(sys.argv[1]), exist_ok=True)
 with open(sys.argv[1], "w") as f:
     json.dump(app.openapi(), f)
@@ -249,7 +250,7 @@ import {
   HttpApiIntegration,
   OperationDetails,
 } from './utils.js';
-import { CfnOutput } from 'aws-cdk-lib';
+import { CfnOutput, Stack } from 'aws-cdk-lib';
 import {
   HttpApi as _HttpApi,
   HttpApiProps as _HttpApiProps,
@@ -259,6 +260,8 @@ import {
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
 import { LogGroup } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { suppressRules } from '../checkov.js';
 
 /**
@@ -335,12 +338,18 @@ export class HttpApi<
       ...props,
     });
 
-    const accessLogGroup = new LogGroup(this, 'AccessLogs');
-    suppressRules(
-      accessLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption',
+    // Customer-managed key for access log encryption at rest
+    const logsKey = new Key(this, 'AccessLogsKey', {
+      enableKeyRotation: true,
+    });
+    const stack = Stack.of(this);
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
     );
+
+    const accessLogGroup = new LogGroup(this, 'AccessLogs', {
+      encryptionKey: logsKey,
+    });
     suppressRules(
       accessLogGroup,
       ['CKV_AWS_66', 'CKV_AWS_338'],
@@ -1068,7 +1077,9 @@ export class IntegrationBuilder<
 exports[`fastapi project generator > should set up shared constructs for rest > rest-api.ts 1`] = `
 "import { Construct, IConstruct } from 'constructs';
 import {
+  AccessLogFormat,
   Cors,
+  LogGroupLogDestination,
   Resource,
   RestApi as _RestApi,
   RestApiProps as _RestApiProps,
@@ -1076,14 +1087,17 @@ import {
   Stage,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, RemovalPolicy } from 'aws-cdk-lib';
+import { IAspect, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
   CfnWebACLAssociation,
 } from 'aws-cdk-lib/aws-wafv2';
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { RuntimeConfig } from '../runtime-config.js';
+import { ApiGatewayAccount } from './api-gateway-account.js';
 import {
   ApiIntegrations,
   OperationDetails,
@@ -1168,10 +1182,28 @@ export class RestApi<
     super(scope, id);
     this.integrations = integrations;
 
+    // Account-level CloudWatch role required for REST API access logging
+    const account = ApiGatewayAccount.ensure(this);
+
+    // KMS key for encrypting logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'LogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(\`logs.\${Stack.of(this).region}.amazonaws.com\`),
+    );
+
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+    });
+
     // Create the API Gateway REST API
     this.api = new _RestApi(this, 'Api', {
       ...props,
       deployOptions: {
+        accessLogDestination: new LogGroupLogDestination(accessLogs),
+        accessLogFormat: AccessLogFormat.jsonWithStandardFields(),
         ...props.deployOptions,
         methodOptions: {
           ...props.deployOptions?.methodOptions,
@@ -1184,6 +1216,8 @@ export class RestApi<
         },
       },
     });
+    // Ensure the account-level role is configured before the stage is created
+    this.api.deploymentStage.node.addDependency(account.resource);
 
     if (enableWaf) {
       this.webAcl = new CfnWebACL(this, 'WebAcl', {
@@ -1250,14 +1284,9 @@ export class RestApi<
       // \`aws-waf-logs-\` to satisfy the WAFv2 logging destination requirement.
       const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
         logGroupName: \`aws-waf-logs-\${apiName}-\${this.node.addr.slice(-8)}\`,
-        retention: RetentionDays.ONE_MONTH,
-        removalPolicy: RemovalPolicy.DESTROY,
+        retention: RetentionDays.ONE_YEAR,
+        encryptionKey: logsKey,
       });
-      suppressRules(
-        wafLogGroup,
-        ['CKV_AWS_158'],
-        'Using default CloudWatch log encryption for WAF logs',
-      );
 
       new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
         resourceArn: this.webAcl.attrArn,
@@ -1271,12 +1300,6 @@ export class RestApi<
       'Caching not required for this use case',
       (c) => c instanceof Stage,
     );
-    suppressRules(
-      this.api,
-      ['CKV_AWS_76'],
-      'API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement',
-      (c) => c instanceof Stage,
-    );
 
     // Resolve the integration for a given operation.
     // If the operation has a dedicated integration, use it; otherwise fall back to $router.
@@ -2039,4613 +2062,3 @@ export class IntegrationBuilder<
 }
 "
 `;
-
-exports[`fastapi project generator > terraform iac > should generate terraform files for HTTP API with Cognito auth and snapshot them > terraform-http-cognito-files 1`] = `
-{
-  "http-api.tf": "# Core HTTP API Gateway module
-# This module creates the API Gateway HTTP API, stage, and logging resources
-
-terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.0"
-    }
-  }
-}
-
-# Core HTTP API Gateway Variables
-
-variable "api_name" {
-  description = "Name of the HTTP API Gateway"
-  type        = string
-}
-
-variable "api_description" {
-  description = "Description of the HTTP API Gateway"
-  type        = string
-  default     = "HTTP API Gateway"
-}
-
-variable "stage_name" {
-  description = "Name of the API Gateway stage"
-  type        = string
-  default     = "prod"
-}
-
-variable "stage_auto_deploy" {
-  description = "Whether to automatically deploy the API stage"
-  type        = bool
-  default     = true
-}
-
-# CORS Configuration
-
-variable "cors_allow_credentials" {
-  description = "Whether to allow credentials in CORS requests"
-  type        = bool
-  default     = false
-}
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_expose_headers" {
-  description = "List of headers to expose in CORS responses"
-  type        = list(string)
-  default     = []
-}
-
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 86400
-}
-
-# Tags
-
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Data sources
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-# Resources
-
-# KMS key for CloudWatch log group encryption
-resource "aws_kms_key" "logs_key" {
-  description             = "KMS key for CloudWatch log group encryption"
-  deletion_window_in_days = 7
-  enable_key_rotation     = true
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "Enable IAM User Permissions"
-        Effect = "Allow"
-        Principal = {
-          AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root"
-        }
-        Action   = "kms:*"
-        Resource = "*"
-      },
-      {
-        Sid    = "Allow CloudWatch Logs"
-        Effect = "Allow"
-        Principal = {
-          Service = "logs.\${data.aws_region.current.region}.amazonaws.com"
-        }
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey"
-        ]
-        Resource = "*"
-        Condition = {
-          ArnEquals = {
-            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/\${var.api_name}"
-          }
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-resource "aws_kms_alias" "logs_key_alias" {
-  name          = "alias/\${var.api_name}-api-logs-encryption"
-  target_key_id = aws_kms_key.logs_key.key_id
-}
-
-# HTTP API Gateway
-resource "aws_apigatewayv2_api" "http_api" {
-  name          = var.api_name
-  protocol_type = "HTTP"
-  description   = var.api_description
-
-  cors_configuration {
-    allow_credentials = var.cors_allow_credentials
-    allow_headers     = var.cors_allow_headers
-    allow_methods     = var.cors_allow_methods
-    allow_origins     = var.cors_allow_origins
-    expose_headers    = var.cors_expose_headers
-    max_age          = var.cors_max_age
-  }
-
-  tags = var.tags
-}
-
-# API Gateway stage
-resource "aws_apigatewayv2_stage" "api_stage" {
-  api_id      = aws_apigatewayv2_api.http_api.id
-  name        = var.stage_name
-  auto_deploy = var.stage_auto_deploy
-
-  access_log_settings {
-    destination_arn = aws_cloudwatch_log_group.api_logs.arn
-    format = jsonencode({
-      requestId      = "$context.requestId"
-      ip            = "$context.identity.sourceIp"
-      requestTime   = "$context.requestTime"
-      httpMethod    = "$context.httpMethod"
-      routeKey      = "$context.routeKey"
-      status        = "$context.status"
-      protocol      = "$context.protocol"
-      responseLength = "$context.responseLength"
-      error         = "$context.error.message"
-      integrationError = "$context.integrationErrorMessage"
-    })
-  }
-
-  default_route_settings {
-    throttling_burst_limit = 5000
-    throttling_rate_limit = 10000
-  }
-
-  tags = var.tags
-
-  depends_on = [aws_cloudwatch_log_group.api_logs]
-}
-
-# CloudWatch Log Group for API Gateway
-resource "aws_cloudwatch_log_group" "api_logs" {
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name         = "/aws/apigateway/\${var.api_name}"
-  kms_key_id   = aws_kms_key.logs_key.arn
-  tags         = var.tags
-}
-
-# Outputs
-
-output "api_id" {
-  description = "ID of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.id
-}
-
-output "api_arn" {
-  description = "ARN of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.api_endpoint
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.execution_arn
-}
-
-output "stage_id" {
-  description = "ID of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.id
-}
-
-output "stage_arn" {
-  description = "ARN of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.arn
-}
-
-output "stage_execution_arn" {
-  description = "Execution ARN of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.execution_arn
-}
-
-output "stage_invoke_url" {
-  description = "Invoke URL of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.invoke_url
-}
-
-output "api_log_group_name" {
-  description = "Name of the API Gateway CloudWatch log group"
-  value       = aws_cloudwatch_log_group.api_logs.name
-}
-
-output "api_log_group_arn" {
-  description = "ARN of the API Gateway CloudWatch log group"
-  value       = aws_cloudwatch_log_group.api_logs.arn
-}",
-  "test-api.tf": "terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.0"
-    }
-  }
-}
-
-# Authentication Configuration
-variable "user_pool_id" {
-  description = "Cognito User Pool ID for authentication"
-  type        = string
-}
-
-variable "user_pool_client_ids" {
-  description = "List of Cognito User Pool Client IDs"
-  type        = list(string)
-}
-
-variable "env" {
-  description = "Environment variables for the Lambda function"
-  type        = map(string)
-  default     = {}
-}
-
-variable "additional_iam_policy_statements" {
-  description = "Additional IAM policy statements for the Lambda function"
-  type        = list(object({
-    Effect   = string
-    Action   = list(string)
-    Resource = list(string)
-  }))
-  default = []
-}
-
-variable "asset_bucket_name" {
-  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
-  type        = string
-}
-
-# CORS Configuration (passed to core module)
-variable "cors_allow_credentials" {
-  description = "Whether to allow credentials in CORS requests"
-  type        = bool
-  default     = false
-}
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_expose_headers" {
-  description = "List of headers to expose in CORS responses"
-  type        = list(string)
-  default     = []
-}
-
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
-# Tags
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Get current AWS region and account ID
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-resource "random_string" "suffix" {
-  length  = 8
-  special = false
-  upper   = false
-}
-
-# Resources
-
-# Create Lambda ZIP file from the bundle directory
-data "archive_file" "lambda_zip" {
-  type        = "zip"
-  source_dir  = "\${path.module}/../../../../../../../dist/apps/test_api/bundle-x86"
-  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
-}
-
-resource "aws_s3_object" "lambda_zip" {
-  bucket      = var.asset_bucket_name
-  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_sha256}.zip"
-  source      = data.archive_file.lambda_zip.output_path
-  source_hash = data.archive_file.lambda_zip.output_base64sha256
-  etag        = data.archive_file.lambda_zip.output_md5
-}
-
-
-# Use the core HTTP API module
-module "http_api" {
-  source = "../../../core/api/http-api"
-
-  api_name        = "TestApi-\${random_string.suffix.result}"
-  api_description = "TestApi HTTP API"
-  stage_name      = "$default"
-  stage_auto_deploy = true
-
-  # CORS Configuration
-  cors_allow_credentials = var.cors_allow_credentials
-  cors_allow_headers     = var.cors_allow_headers
-  cors_allow_methods     = var.cors_allow_methods
-  cors_allow_origins     = var.cors_allow_origins
-  cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
-
-  # Tags
-  tags = var.tags
-}
-
-# Lambda function
-# This configures a single "router" lambda to serve all requests
-resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
-  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
-  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
-  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
-  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  s3_bucket         = aws_s3_object.lambda_zip.bucket
-  s3_key            = aws_s3_object.lambda_zip.key
-  s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "TestApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
-  handler         = "run.sh"
-  runtime         = "python3.14"
-  layers          = ["arn:aws:lambda:\${data.aws_region.current.region}:753240598075:layer:LambdaAdapterLayerX86:24"]
-  timeout         = 30
-  memory_size     = 128
-  publish         = true
-
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-
-  # Enable X-Ray tracing
-  tracing_config {
-    mode = "Active"
-  }
-
-  # Enable SnapStart for faster cold starts
-  snap_start {
-    apply_on = "PublishedVersions"
-  }
-
-  environment {
-    variables = merge({
-      PORT                        = "8000"
-      AWS_LWA_INVOKE_MODE         = "buffered"
-      AWS_LAMBDA_EXEC_WRAPPER     = "/opt/bootstrap"
-    }, var.env)
-  }
-
-  tags = var.tags
-}
-
-# IAM role for Lambda execution
-resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Effect = "Allow"
-        Principal = {
-          Service = "lambda.amazonaws.com"
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-# Attach basic execution policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Attach X-Ray tracing policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Additional IAM policies for Lambda (if provided)
-resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
-  })
-}
-
-# CloudWatch Log Group for Lambda
-resource "aws_cloudwatch_log_group" "lambda_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
-}
-
-# Lambda alias pointing to the latest published version for SnapStart
-resource "aws_lambda_alias" "live" {
-  name             = "live"
-  function_name    = aws_lambda_function.api_lambda.function_name
-  function_version = aws_lambda_function.api_lambda.version
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
-
-# Cognito User Pool Authorizer
-resource "aws_apigatewayv2_authorizer" "cognito_authorizer" {
-  api_id           = module.http_api.api_id
-  authorizer_type  = "JWT"
-  identity_sources = ["$request.header.Authorization"]
-  name             = "TestApiAuthorizer-\${random_string.suffix.result}"
-
-  jwt_configuration {
-    audience = var.user_pool_client_ids
-    issuer   = "https://cognito-idp.\${data.aws_region.current.region}.amazonaws.com/\${var.user_pool_id}"
-  }
-}
-
-# Lambda integration for HTTP API
-resource "aws_apigatewayv2_integration" "lambda_integration" {
-  api_id           = module.http_api.api_id
-  integration_type = "AWS_PROXY"
-  integration_uri  = aws_lambda_alias.live.invoke_arn
-
-  payload_format_version = "2.0"
-  timeout_milliseconds   = 30000
-
-  depends_on = [aws_lambda_alias.live]
-}
-
-# Route for proxy integration (catches all requests)
-resource "aws_apigatewayv2_route" "proxy_routes" {
-  # NB: OPTIONS is omitted here since API Gateway manages responding to preflight requests
-  # when cors settings are configured
-  for_each = toset(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"])
-
-  api_id    = module.http_api.api_id
-  route_key = "\${each.key} /{proxy+}"
-  target    = "integrations/\${aws_apigatewayv2_integration.lambda_integration.id}"
-
-  authorization_type = "JWT"
-  authorizer_id      = aws_apigatewayv2_authorizer.cognito_authorizer.id
-
-  depends_on = [aws_apigatewayv2_integration.lambda_integration, aws_apigatewayv2_authorizer.cognito_authorizer]
-}
-
-# Add API url to runtime config
-module "add_url_to_runtime_config" {
-  source = "../../../core/runtime-config/entry"
-
-  namespace = "connection"
-  key       = "apis"
-  value     = { "TestApi" = module.http_api.stage_invoke_url }
-
-  depends_on = [module.http_api]
-}
-
-# Lambda permission for API Gateway to invoke the function via alias
-resource "aws_lambda_permission" "api_gateway_invoke" {
-  statement_id  = "AllowExecutionFromAPIGateway"
-  action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
-  qualifier     = aws_lambda_alias.live.name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.http_api.api_execution_arn}/*/*"
-
-  depends_on = [module.http_api, aws_lambda_alias.live]
-}
-
-# Outputs
-
-# API Gateway Outputs (from core module)
-output "api_id" {
-  description = "ID of the HTTP API Gateway"
-  value       = module.http_api.api_id
-}
-
-output "api_arn" {
-  description = "ARN of the HTTP API Gateway"
-  value       = module.http_api.api_arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the HTTP API Gateway"
-  value       = module.http_api.api_endpoint
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the HTTP API Gateway"
-  value       = module.http_api.api_execution_arn
-}
-
-output "stage_invoke_url" {
-  description = "Invoke URL of the API Gateway stage"
-  value       = module.http_api.stage_invoke_url
-}
-
-output "stage_arn" {
-  description = "ARN of the API Gateway stage"
-  value       = module.http_api.stage_arn
-}
-
-output "stage_execution_arn" {
-  description = "Execution ARN of the API Gateway stage"
-  value       = module.http_api.stage_execution_arn
-}
-
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
-}
-
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
-}
-
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
-}
-
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
-}
-
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
-}
-
-output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
-}
-
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
-}
-
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
-}
-
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
-}
-
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_apigatewayv2_integration.lambda_integration.id
-}
-
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
-}
-
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
-}
-
-output "api_log_group_name" {
-  description = "Name of the API Gateway CloudWatch log group"
-  value       = module.http_api.api_log_group_name
-}
-
-output "api_log_group_arn" {
-  description = "ARN of the API Gateway CloudWatch log group"
-  value       = module.http_api.api_log_group_arn
-}",
-}
-`;
-
-exports[`fastapi project generator > terraform iac > should generate terraform files for HTTP API with Custom auth and snapshot them > terraform-http-custom-files 1`] = `
-{
-  "http-api.tf": "# Core HTTP API Gateway module
-# This module creates the API Gateway HTTP API, stage, and logging resources
-
-terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.0"
-    }
-  }
-}
-
-# Core HTTP API Gateway Variables
-
-variable "api_name" {
-  description = "Name of the HTTP API Gateway"
-  type        = string
-}
-
-variable "api_description" {
-  description = "Description of the HTTP API Gateway"
-  type        = string
-  default     = "HTTP API Gateway"
-}
-
-variable "stage_name" {
-  description = "Name of the API Gateway stage"
-  type        = string
-  default     = "prod"
-}
-
-variable "stage_auto_deploy" {
-  description = "Whether to automatically deploy the API stage"
-  type        = bool
-  default     = true
-}
-
-# CORS Configuration
-
-variable "cors_allow_credentials" {
-  description = "Whether to allow credentials in CORS requests"
-  type        = bool
-  default     = false
-}
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_expose_headers" {
-  description = "List of headers to expose in CORS responses"
-  type        = list(string)
-  default     = []
-}
-
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 86400
-}
-
-# Tags
-
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Data sources
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-# Resources
-
-# KMS key for CloudWatch log group encryption
-resource "aws_kms_key" "logs_key" {
-  description             = "KMS key for CloudWatch log group encryption"
-  deletion_window_in_days = 7
-  enable_key_rotation     = true
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "Enable IAM User Permissions"
-        Effect = "Allow"
-        Principal = {
-          AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root"
-        }
-        Action   = "kms:*"
-        Resource = "*"
-      },
-      {
-        Sid    = "Allow CloudWatch Logs"
-        Effect = "Allow"
-        Principal = {
-          Service = "logs.\${data.aws_region.current.region}.amazonaws.com"
-        }
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey"
-        ]
-        Resource = "*"
-        Condition = {
-          ArnEquals = {
-            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/\${var.api_name}"
-          }
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-resource "aws_kms_alias" "logs_key_alias" {
-  name          = "alias/\${var.api_name}-api-logs-encryption"
-  target_key_id = aws_kms_key.logs_key.key_id
-}
-
-# HTTP API Gateway
-resource "aws_apigatewayv2_api" "http_api" {
-  name          = var.api_name
-  protocol_type = "HTTP"
-  description   = var.api_description
-
-  cors_configuration {
-    allow_credentials = var.cors_allow_credentials
-    allow_headers     = var.cors_allow_headers
-    allow_methods     = var.cors_allow_methods
-    allow_origins     = var.cors_allow_origins
-    expose_headers    = var.cors_expose_headers
-    max_age          = var.cors_max_age
-  }
-
-  tags = var.tags
-}
-
-# API Gateway stage
-resource "aws_apigatewayv2_stage" "api_stage" {
-  api_id      = aws_apigatewayv2_api.http_api.id
-  name        = var.stage_name
-  auto_deploy = var.stage_auto_deploy
-
-  access_log_settings {
-    destination_arn = aws_cloudwatch_log_group.api_logs.arn
-    format = jsonencode({
-      requestId      = "$context.requestId"
-      ip            = "$context.identity.sourceIp"
-      requestTime   = "$context.requestTime"
-      httpMethod    = "$context.httpMethod"
-      routeKey      = "$context.routeKey"
-      status        = "$context.status"
-      protocol      = "$context.protocol"
-      responseLength = "$context.responseLength"
-      error         = "$context.error.message"
-      integrationError = "$context.integrationErrorMessage"
-    })
-  }
-
-  default_route_settings {
-    throttling_burst_limit = 5000
-    throttling_rate_limit = 10000
-  }
-
-  tags = var.tags
-
-  depends_on = [aws_cloudwatch_log_group.api_logs]
-}
-
-# CloudWatch Log Group for API Gateway
-resource "aws_cloudwatch_log_group" "api_logs" {
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name         = "/aws/apigateway/\${var.api_name}"
-  kms_key_id   = aws_kms_key.logs_key.arn
-  tags         = var.tags
-}
-
-# Outputs
-
-output "api_id" {
-  description = "ID of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.id
-}
-
-output "api_arn" {
-  description = "ARN of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.api_endpoint
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.execution_arn
-}
-
-output "stage_id" {
-  description = "ID of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.id
-}
-
-output "stage_arn" {
-  description = "ARN of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.arn
-}
-
-output "stage_execution_arn" {
-  description = "Execution ARN of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.execution_arn
-}
-
-output "stage_invoke_url" {
-  description = "Invoke URL of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.invoke_url
-}
-
-output "api_log_group_name" {
-  description = "Name of the API Gateway CloudWatch log group"
-  value       = aws_cloudwatch_log_group.api_logs.name
-}
-
-output "api_log_group_arn" {
-  description = "ARN of the API Gateway CloudWatch log group"
-  value       = aws_cloudwatch_log_group.api_logs.arn
-}",
-  "test-api.tf": "terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.0"
-    }
-  }
-}
-
-
-variable "env" {
-  description = "Environment variables for the Lambda function"
-  type        = map(string)
-  default     = {}
-}
-
-variable "additional_iam_policy_statements" {
-  description = "Additional IAM policy statements for the Lambda function"
-  type        = list(object({
-    Effect   = string
-    Action   = list(string)
-    Resource = list(string)
-  }))
-  default = []
-}
-
-variable "asset_bucket_name" {
-  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
-  type        = string
-}
-
-# CORS Configuration (passed to core module)
-variable "cors_allow_credentials" {
-  description = "Whether to allow credentials in CORS requests"
-  type        = bool
-  default     = false
-}
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_expose_headers" {
-  description = "List of headers to expose in CORS responses"
-  type        = list(string)
-  default     = []
-}
-
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
-# Tags
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Get current AWS region and account ID
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-resource "random_string" "suffix" {
-  length  = 8
-  special = false
-  upper   = false
-}
-
-# Resources
-
-# Create Lambda ZIP file from the bundle directory
-data "archive_file" "lambda_zip" {
-  type        = "zip"
-  source_dir  = "\${path.module}/../../../../../../../dist/apps/test_api/bundle-x86"
-  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
-}
-
-resource "aws_s3_object" "lambda_zip" {
-  bucket      = var.asset_bucket_name
-  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_sha256}.zip"
-  source      = data.archive_file.lambda_zip.output_path
-  source_hash = data.archive_file.lambda_zip.output_base64sha256
-  etag        = data.archive_file.lambda_zip.output_md5
-}
-
-
-# Use the core HTTP API module
-module "http_api" {
-  source = "../../../core/api/http-api"
-
-  api_name        = "TestApi-\${random_string.suffix.result}"
-  api_description = "TestApi HTTP API"
-  stage_name      = "$default"
-  stage_auto_deploy = true
-
-  # CORS Configuration
-  cors_allow_credentials = var.cors_allow_credentials
-  cors_allow_headers     = var.cors_allow_headers
-  cors_allow_methods     = var.cors_allow_methods
-  cors_allow_origins     = var.cors_allow_origins
-  cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
-
-  # Tags
-  tags = var.tags
-}
-
-# Lambda function
-# This configures a single "router" lambda to serve all requests
-resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
-  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
-  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
-  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
-  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  s3_bucket         = aws_s3_object.lambda_zip.bucket
-  s3_key            = aws_s3_object.lambda_zip.key
-  s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "TestApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
-  handler         = "run.sh"
-  runtime         = "python3.14"
-  layers          = ["arn:aws:lambda:\${data.aws_region.current.region}:753240598075:layer:LambdaAdapterLayerX86:24"]
-  timeout         = 30
-  memory_size     = 128
-  publish         = true
-
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-
-  # Enable X-Ray tracing
-  tracing_config {
-    mode = "Active"
-  }
-
-  # Enable SnapStart for faster cold starts
-  snap_start {
-    apply_on = "PublishedVersions"
-  }
-
-  environment {
-    variables = merge({
-      PORT                        = "8000"
-      AWS_LWA_INVOKE_MODE         = "buffered"
-      AWS_LAMBDA_EXEC_WRAPPER     = "/opt/bootstrap"
-    }, var.env)
-  }
-
-  tags = var.tags
-}
-
-# IAM role for Lambda execution
-resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Effect = "Allow"
-        Principal = {
-          Service = "lambda.amazonaws.com"
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-# Attach basic execution policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Attach X-Ray tracing policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Additional IAM policies for Lambda (if provided)
-resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
-  })
-}
-
-# CloudWatch Log Group for Lambda
-resource "aws_cloudwatch_log_group" "lambda_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
-}
-
-# Lambda alias pointing to the latest published version for SnapStart
-resource "aws_lambda_alias" "live" {
-  name             = "live"
-  function_name    = aws_lambda_function.api_lambda.function_name
-  function_version = aws_lambda_function.api_lambda.version
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
-
-# Custom Lambda Authorizer
-resource "aws_lambda_function" "authorizer_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
-  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for authorizer
-  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
-  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
-  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  s3_bucket         = aws_s3_object.authorizer_zip.bucket
-  s3_key            = aws_s3_object.authorizer_zip.key
-  s3_object_version = aws_s3_object.authorizer_zip.version_id
-  function_name    = "TestApiAuthorizer-\${random_string.suffix.result}"
-  role            = aws_iam_role.authorizer_execution_role.arn
-  handler         = "proj_test_api.authorizer.handler"
-  runtime         = "python3.14"
-  timeout         = 10
-  memory_size     = 128
-
-  source_code_hash = data.archive_file.authorizer_zip.output_base64sha256
-
-  tracing_config {
-    mode = "Active"
-  }
-
-  tags = var.tags
-}
-
-resource "aws_iam_role" "authorizer_execution_role" {
-  name = "TestApiAuthorizer-role-\${random_string.suffix.result}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Effect = "Allow"
-        Principal = {
-          Service = "lambda.amazonaws.com"
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-resource "aws_iam_role_policy_attachment" "authorizer_basic_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.authorizer_execution_role.name
-}
-
-resource "aws_iam_role_policy_attachment" "authorizer_xray_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.authorizer_execution_role.name
-}
-
-resource "aws_cloudwatch_log_group" "authorizer_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name = "/aws/lambda/TestApiAuthorizer-\${random_string.suffix.result}"
-  tags = var.tags
-}
-
-data "archive_file" "authorizer_zip" {
-  type        = "zip"
-  source_dir  = "\${path.module}/../../../../../../../dist/apps/test_api/bundle-x86"
-  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/authorizer.zip"
-}
-
-resource "aws_s3_object" "authorizer_zip" {
-  bucket      = var.asset_bucket_name
-  key         = "apis/test-api/authorizer-\${data.archive_file.authorizer_zip.output_sha256}.zip"
-  source      = data.archive_file.authorizer_zip.output_path
-  source_hash = data.archive_file.authorizer_zip.output_base64sha256
-  etag        = data.archive_file.authorizer_zip.output_md5
-}
-
-resource "aws_apigatewayv2_authorizer" "custom_authorizer" {
-  api_id                            = module.http_api.api_id
-  authorizer_type                   = "REQUEST"
-  authorizer_uri                    = aws_lambda_function.authorizer_lambda.invoke_arn
-  authorizer_payload_format_version = "2.0"
-  authorizer_result_ttl_in_seconds  = 0
-  enable_simple_responses           = true
-  name                              = "TestApiAuthorizer-\${random_string.suffix.result}"
-}
-
-resource "aws_lambda_permission" "authorizer_invoke" {
-  statement_id  = "AllowAPIGatewayInvokeAuthorizer"
-  action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.authorizer_lambda.function_name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.http_api.api_execution_arn}/authorizers/\${aws_apigatewayv2_authorizer.custom_authorizer.id}"
-}
-
-# Lambda integration for HTTP API
-resource "aws_apigatewayv2_integration" "lambda_integration" {
-  api_id           = module.http_api.api_id
-  integration_type = "AWS_PROXY"
-  integration_uri  = aws_lambda_alias.live.invoke_arn
-
-  payload_format_version = "2.0"
-  timeout_milliseconds   = 30000
-
-  depends_on = [aws_lambda_alias.live]
-}
-
-# Route for proxy integration (catches all requests)
-resource "aws_apigatewayv2_route" "proxy_routes" {
-  # NB: OPTIONS is omitted here since API Gateway manages responding to preflight requests
-  # when cors settings are configured
-  for_each = toset(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"])
-
-  api_id    = module.http_api.api_id
-  route_key = "\${each.key} /{proxy+}"
-  target    = "integrations/\${aws_apigatewayv2_integration.lambda_integration.id}"
-
-  authorization_type = "CUSTOM"
-  authorizer_id      = aws_apigatewayv2_authorizer.custom_authorizer.id
-
-  depends_on = [aws_apigatewayv2_integration.lambda_integration, aws_apigatewayv2_authorizer.custom_authorizer]
-}
-
-# Add API url to runtime config
-module "add_url_to_runtime_config" {
-  source = "../../../core/runtime-config/entry"
-
-  namespace = "connection"
-  key       = "apis"
-  value     = { "TestApi" = module.http_api.stage_invoke_url }
-
-  depends_on = [module.http_api]
-}
-
-# Lambda permission for API Gateway to invoke the function via alias
-resource "aws_lambda_permission" "api_gateway_invoke" {
-  statement_id  = "AllowExecutionFromAPIGateway"
-  action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
-  qualifier     = aws_lambda_alias.live.name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.http_api.api_execution_arn}/*/*"
-
-  depends_on = [module.http_api, aws_lambda_alias.live]
-}
-
-# Outputs
-
-# API Gateway Outputs (from core module)
-output "api_id" {
-  description = "ID of the HTTP API Gateway"
-  value       = module.http_api.api_id
-}
-
-output "api_arn" {
-  description = "ARN of the HTTP API Gateway"
-  value       = module.http_api.api_arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the HTTP API Gateway"
-  value       = module.http_api.api_endpoint
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the HTTP API Gateway"
-  value       = module.http_api.api_execution_arn
-}
-
-output "stage_invoke_url" {
-  description = "Invoke URL of the API Gateway stage"
-  value       = module.http_api.stage_invoke_url
-}
-
-output "stage_arn" {
-  description = "ARN of the API Gateway stage"
-  value       = module.http_api.stage_arn
-}
-
-output "stage_execution_arn" {
-  description = "Execution ARN of the API Gateway stage"
-  value       = module.http_api.stage_execution_arn
-}
-
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
-}
-
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
-}
-
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
-}
-
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
-}
-
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
-}
-
-output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
-}
-
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
-}
-
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
-}
-
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
-}
-
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_apigatewayv2_integration.lambda_integration.id
-}
-
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
-}
-
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
-}
-
-output "api_log_group_name" {
-  description = "Name of the API Gateway CloudWatch log group"
-  value       = module.http_api.api_log_group_name
-}
-
-output "api_log_group_arn" {
-  description = "ARN of the API Gateway CloudWatch log group"
-  value       = module.http_api.api_log_group_arn
-}",
-}
-`;
-
-exports[`fastapi project generator > terraform iac > should generate terraform files for HTTP API with IAM auth and snapshot them > terraform-http-iam-files 1`] = `
-{
-  "http-api.tf": "# Core HTTP API Gateway module
-# This module creates the API Gateway HTTP API, stage, and logging resources
-
-terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.0"
-    }
-  }
-}
-
-# Core HTTP API Gateway Variables
-
-variable "api_name" {
-  description = "Name of the HTTP API Gateway"
-  type        = string
-}
-
-variable "api_description" {
-  description = "Description of the HTTP API Gateway"
-  type        = string
-  default     = "HTTP API Gateway"
-}
-
-variable "stage_name" {
-  description = "Name of the API Gateway stage"
-  type        = string
-  default     = "prod"
-}
-
-variable "stage_auto_deploy" {
-  description = "Whether to automatically deploy the API stage"
-  type        = bool
-  default     = true
-}
-
-# CORS Configuration
-
-variable "cors_allow_credentials" {
-  description = "Whether to allow credentials in CORS requests"
-  type        = bool
-  default     = false
-}
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_expose_headers" {
-  description = "List of headers to expose in CORS responses"
-  type        = list(string)
-  default     = []
-}
-
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 86400
-}
-
-# Tags
-
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Data sources
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-# Resources
-
-# KMS key for CloudWatch log group encryption
-resource "aws_kms_key" "logs_key" {
-  description             = "KMS key for CloudWatch log group encryption"
-  deletion_window_in_days = 7
-  enable_key_rotation     = true
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "Enable IAM User Permissions"
-        Effect = "Allow"
-        Principal = {
-          AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root"
-        }
-        Action   = "kms:*"
-        Resource = "*"
-      },
-      {
-        Sid    = "Allow CloudWatch Logs"
-        Effect = "Allow"
-        Principal = {
-          Service = "logs.\${data.aws_region.current.region}.amazonaws.com"
-        }
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey"
-        ]
-        Resource = "*"
-        Condition = {
-          ArnEquals = {
-            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/\${var.api_name}"
-          }
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-resource "aws_kms_alias" "logs_key_alias" {
-  name          = "alias/\${var.api_name}-api-logs-encryption"
-  target_key_id = aws_kms_key.logs_key.key_id
-}
-
-# HTTP API Gateway
-resource "aws_apigatewayv2_api" "http_api" {
-  name          = var.api_name
-  protocol_type = "HTTP"
-  description   = var.api_description
-
-  cors_configuration {
-    allow_credentials = var.cors_allow_credentials
-    allow_headers     = var.cors_allow_headers
-    allow_methods     = var.cors_allow_methods
-    allow_origins     = var.cors_allow_origins
-    expose_headers    = var.cors_expose_headers
-    max_age          = var.cors_max_age
-  }
-
-  tags = var.tags
-}
-
-# API Gateway stage
-resource "aws_apigatewayv2_stage" "api_stage" {
-  api_id      = aws_apigatewayv2_api.http_api.id
-  name        = var.stage_name
-  auto_deploy = var.stage_auto_deploy
-
-  access_log_settings {
-    destination_arn = aws_cloudwatch_log_group.api_logs.arn
-    format = jsonencode({
-      requestId      = "$context.requestId"
-      ip            = "$context.identity.sourceIp"
-      requestTime   = "$context.requestTime"
-      httpMethod    = "$context.httpMethod"
-      routeKey      = "$context.routeKey"
-      status        = "$context.status"
-      protocol      = "$context.protocol"
-      responseLength = "$context.responseLength"
-      error         = "$context.error.message"
-      integrationError = "$context.integrationErrorMessage"
-    })
-  }
-
-  default_route_settings {
-    throttling_burst_limit = 5000
-    throttling_rate_limit = 10000
-  }
-
-  tags = var.tags
-
-  depends_on = [aws_cloudwatch_log_group.api_logs]
-}
-
-# CloudWatch Log Group for API Gateway
-resource "aws_cloudwatch_log_group" "api_logs" {
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name         = "/aws/apigateway/\${var.api_name}"
-  kms_key_id   = aws_kms_key.logs_key.arn
-  tags         = var.tags
-}
-
-# Outputs
-
-output "api_id" {
-  description = "ID of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.id
-}
-
-output "api_arn" {
-  description = "ARN of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.api_endpoint
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the HTTP API Gateway"
-  value       = aws_apigatewayv2_api.http_api.execution_arn
-}
-
-output "stage_id" {
-  description = "ID of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.id
-}
-
-output "stage_arn" {
-  description = "ARN of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.arn
-}
-
-output "stage_execution_arn" {
-  description = "Execution ARN of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.execution_arn
-}
-
-output "stage_invoke_url" {
-  description = "Invoke URL of the API Gateway stage"
-  value       = aws_apigatewayv2_stage.api_stage.invoke_url
-}
-
-output "api_log_group_name" {
-  description = "Name of the API Gateway CloudWatch log group"
-  value       = aws_cloudwatch_log_group.api_logs.name
-}
-
-output "api_log_group_arn" {
-  description = "ARN of the API Gateway CloudWatch log group"
-  value       = aws_cloudwatch_log_group.api_logs.arn
-}",
-  "test-api.tf": "terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.0"
-    }
-  }
-}
-
-
-variable "env" {
-  description = "Environment variables for the Lambda function"
-  type        = map(string)
-  default     = {}
-}
-
-variable "additional_iam_policy_statements" {
-  description = "Additional IAM policy statements for the Lambda function"
-  type        = list(object({
-    Effect   = string
-    Action   = list(string)
-    Resource = list(string)
-  }))
-  default = []
-}
-
-variable "asset_bucket_name" {
-  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
-  type        = string
-}
-
-# CORS Configuration (passed to core module)
-variable "cors_allow_credentials" {
-  description = "Whether to allow credentials in CORS requests"
-  type        = bool
-  default     = false
-}
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_expose_headers" {
-  description = "List of headers to expose in CORS responses"
-  type        = list(string)
-  default     = []
-}
-
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
-# Tags
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Get current AWS region and account ID
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-resource "random_string" "suffix" {
-  length  = 8
-  special = false
-  upper   = false
-}
-
-# Resources
-
-# Create Lambda ZIP file from the bundle directory
-data "archive_file" "lambda_zip" {
-  type        = "zip"
-  source_dir  = "\${path.module}/../../../../../../../dist/apps/test_api/bundle-x86"
-  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
-}
-
-resource "aws_s3_object" "lambda_zip" {
-  bucket      = var.asset_bucket_name
-  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_sha256}.zip"
-  source      = data.archive_file.lambda_zip.output_path
-  source_hash = data.archive_file.lambda_zip.output_base64sha256
-  etag        = data.archive_file.lambda_zip.output_md5
-}
-
-
-# Use the core HTTP API module
-module "http_api" {
-  source = "../../../core/api/http-api"
-
-  api_name        = "TestApi-\${random_string.suffix.result}"
-  api_description = "TestApi HTTP API"
-  stage_name      = "$default"
-  stage_auto_deploy = true
-
-  # CORS Configuration
-  cors_allow_credentials = var.cors_allow_credentials
-  cors_allow_headers     = var.cors_allow_headers
-  cors_allow_methods     = var.cors_allow_methods
-  cors_allow_origins     = var.cors_allow_origins
-  cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
-
-  # Tags
-  tags = var.tags
-}
-
-# Lambda function
-# This configures a single "router" lambda to serve all requests
-resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
-  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
-  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
-  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
-  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  s3_bucket         = aws_s3_object.lambda_zip.bucket
-  s3_key            = aws_s3_object.lambda_zip.key
-  s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "TestApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
-  handler         = "run.sh"
-  runtime         = "python3.14"
-  layers          = ["arn:aws:lambda:\${data.aws_region.current.region}:753240598075:layer:LambdaAdapterLayerX86:24"]
-  timeout         = 30
-  memory_size     = 128
-  publish         = true
-
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-
-  # Enable X-Ray tracing
-  tracing_config {
-    mode = "Active"
-  }
-
-  # Enable SnapStart for faster cold starts
-  snap_start {
-    apply_on = "PublishedVersions"
-  }
-
-  environment {
-    variables = merge({
-      PORT                        = "8000"
-      AWS_LWA_INVOKE_MODE         = "buffered"
-      AWS_LAMBDA_EXEC_WRAPPER     = "/opt/bootstrap"
-    }, var.env)
-  }
-
-  tags = var.tags
-}
-
-# IAM role for Lambda execution
-resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Effect = "Allow"
-        Principal = {
-          Service = "lambda.amazonaws.com"
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-# Attach basic execution policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Attach X-Ray tracing policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Additional IAM policies for Lambda (if provided)
-resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
-  })
-}
-
-# CloudWatch Log Group for Lambda
-resource "aws_cloudwatch_log_group" "lambda_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
-}
-
-# Lambda alias pointing to the latest published version for SnapStart
-resource "aws_lambda_alias" "live" {
-  name             = "live"
-  function_name    = aws_lambda_function.api_lambda.function_name
-  function_version = aws_lambda_function.api_lambda.version
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
-
-
-# Lambda integration for HTTP API
-resource "aws_apigatewayv2_integration" "lambda_integration" {
-  api_id           = module.http_api.api_id
-  integration_type = "AWS_PROXY"
-  integration_uri  = aws_lambda_alias.live.invoke_arn
-
-  payload_format_version = "2.0"
-  timeout_milliseconds   = 30000
-
-  depends_on = [aws_lambda_alias.live]
-}
-
-# Route for proxy integration (catches all requests)
-resource "aws_apigatewayv2_route" "proxy_routes" {
-  # NB: OPTIONS is omitted here since API Gateway manages responding to preflight requests
-  # when cors settings are configured
-  for_each = toset(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"])
-
-  api_id    = module.http_api.api_id
-  route_key = "\${each.key} /{proxy+}"
-  target    = "integrations/\${aws_apigatewayv2_integration.lambda_integration.id}"
-
-  authorization_type = "AWS_IAM"
-
-  depends_on = [aws_apigatewayv2_integration.lambda_integration]
-}
-
-# Add API url to runtime config
-module "add_url_to_runtime_config" {
-  source = "../../../core/runtime-config/entry"
-
-  namespace = "connection"
-  key       = "apis"
-  value     = { "TestApi" = module.http_api.stage_invoke_url }
-
-  depends_on = [module.http_api]
-}
-
-# Lambda permission for API Gateway to invoke the function via alias
-resource "aws_lambda_permission" "api_gateway_invoke" {
-  statement_id  = "AllowExecutionFromAPIGateway"
-  action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
-  qualifier     = aws_lambda_alias.live.name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.http_api.api_execution_arn}/*/*"
-
-  depends_on = [module.http_api, aws_lambda_alias.live]
-}
-
-# Outputs
-
-# API Gateway Outputs (from core module)
-output "api_id" {
-  description = "ID of the HTTP API Gateway"
-  value       = module.http_api.api_id
-}
-
-output "api_arn" {
-  description = "ARN of the HTTP API Gateway"
-  value       = module.http_api.api_arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the HTTP API Gateway"
-  value       = module.http_api.api_endpoint
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the HTTP API Gateway"
-  value       = module.http_api.api_execution_arn
-}
-
-output "stage_invoke_url" {
-  description = "Invoke URL of the API Gateway stage"
-  value       = module.http_api.stage_invoke_url
-}
-
-output "stage_arn" {
-  description = "ARN of the API Gateway stage"
-  value       = module.http_api.stage_arn
-}
-
-output "stage_execution_arn" {
-  description = "Execution ARN of the API Gateway stage"
-  value       = module.http_api.stage_execution_arn
-}
-
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
-}
-
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
-}
-
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
-}
-
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
-}
-
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
-}
-
-output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
-}
-
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
-}
-
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
-}
-
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
-}
-
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_apigatewayv2_integration.lambda_integration.id
-}
-
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
-}
-
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
-}
-
-output "api_log_group_name" {
-  description = "Name of the API Gateway CloudWatch log group"
-  value       = module.http_api.api_log_group_name
-}
-
-output "api_log_group_arn" {
-  description = "ARN of the API Gateway CloudWatch log group"
-  value       = module.http_api.api_log_group_arn
-}",
-}
-`;
-
-exports[`fastapi project generator > terraform iac > should generate terraform files for REST API with Cognito auth and snapshot them > terraform-rest-cognito-files 1`] = `
-{
-  "rest-api.tf": "# Core REST API Gateway module
-# This module creates the API Gateway REST API, deployment, stage, and logging resources
-
-terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.33"
-    }
-    random = {
-      source  = "hashicorp/random"
-      version = "~> 3.1"
-    }
-  }
-}
-
-# Core REST API Gateway Variables
-
-variable "api_name" {
-  description = "Name of the REST API Gateway"
-  type        = string
-}
-
-variable "api_description" {
-  description = "Description of the REST API Gateway"
-  type        = string
-  default     = "REST API Gateway"
-}
-
-variable "stage_name" {
-  description = "Name of the API Gateway stage"
-  type        = string
-  default     = "prod"
-}
-
-variable "stage_auto_deploy" {
-  description = "Whether to automatically deploy the API stage"
-  type        = bool
-  default     = true
-}
-
-variable "enable_waf" {
-  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet). The Web ACL is created here and associated with the stage in the consuming module."
-  type        = bool
-  default     = true
-}
-
-# CORS Configuration
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-# Tags
-
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Data sources
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-# Resources
-
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
-# REST API Gateway
-resource "aws_api_gateway_rest_api" "rest_api" {
-  name        = var.api_name
-  description = var.api_description
-
-  endpoint_configuration {
-    types = ["REGIONAL"]
-  }
-
-  lifecycle {
-    create_before_destroy = true
-  }
-
-  tags = var.tags
-}
-
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
-
-# Gateway Response for CORS (4XX errors)
-resource "aws_api_gateway_gateway_response" "cors_4xx" {
-  rest_api_id   = aws_api_gateway_rest_api.rest_api.id
-  response_type = "DEFAULT_4XX"
-
-  response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
-    "gatewayresponse.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
-    "gatewayresponse.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
-  }
-}
-
-# Gateway Response for CORS (5XX errors)
-resource "aws_api_gateway_gateway_response" "cors_5xx" {
-  rest_api_id   = aws_api_gateway_rest_api.rest_api.id
-  response_type = "DEFAULT_5XX"
-
-  response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
-    "gatewayresponse.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
-    "gatewayresponse.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
-  }
-}
-
-resource "aws_wafv2_web_acl" "api_waf" {
-  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.api_waf_logging; Checkov does not resolve the separate resource
-  count = var.enable_waf ? 1 : 0
-
-  name  = "\${var.api_name}-waf"
-  scope = "REGIONAL"
-
-  default_action {
-    allow {}
-  }
-
-  rule {
-    name     = "CRSRule"
-    priority = 0
-
-    override_action {
-      none {}
-    }
-
-    statement {
-      managed_rule_group_statement {
-        name        = "AWSManagedRulesCommonRuleSet"
-        vendor_name = "AWS"
-
-        # Count instead of Block: the CRS 8 KB body limit is too restrictive for most APIs.
-        rule_action_override {
-          name = "SizeRestrictions_BODY"
-          action_to_use {
-            count {}
-          }
-        }
-      }
-    }
-
-    visibility_config {
-      cloudwatch_metrics_enabled = true
-      metric_name                = "\${var.api_name}WebAcl-CRS"
-      sampled_requests_enabled   = true
-    }
-  }
-
-  rule {
-    name     = "KnownBadInputsRule"
-    priority = 1
-
-    override_action {
-      none {}
-    }
-
-    statement {
-      managed_rule_group_statement {
-        name        = "AWSManagedRulesKnownBadInputsRuleSet"
-        vendor_name = "AWS"
-      }
-    }
-
-    visibility_config {
-      cloudwatch_metrics_enabled = true
-      metric_name                = "\${var.api_name}WebAcl-KnownBadInputs"
-      sampled_requests_enabled   = true
-    }
-  }
-
-  visibility_config {
-    cloudwatch_metrics_enabled = true
-    metric_name                = "\${var.api_name}WebAcl"
-    sampled_requests_enabled   = true
-  }
-
-  tags = var.tags
-
-  lifecycle {
-    create_before_destroy = true
-  }
-}
-
-# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
-resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
-  count = var.enable_waf ? 1 : 0
-
-  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
-  retention_in_days = 30
-  tags              = var.tags
-}
-
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
-resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
-  count = var.enable_waf ? 1 : 0
-
-  log_destination_configs = [aws_cloudwatch_log_group.api_waf_logs[0].arn]
-  resource_arn            = aws_wafv2_web_acl.api_waf[0].arn
-}
-
-
-# Outputs
-
-output "api_id" {
-  description = "ID of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.id
-}
-
-output "api_arn" {
-  description = "ARN of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the REST API Gateway"
-  value       = "https://\${aws_api_gateway_rest_api.rest_api.id}.execute-api.\${data.aws_region.current.id}.amazonaws.com"
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.execution_arn
-}
-
-output "api_root_resource_id" {
-  description = "Root resource ID of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.root_resource_id
-}
-
-output "waf_web_acl_arn" {
-  description = "ARN of the WAFv2 Web ACL associated with the API, or null if WAF is disabled"
-  value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
-}
-
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
-  "test-api.tf": "terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.33"
-    }
-  }
-}
-
-# Authentication Configuration
-variable "user_pool_id" {
-  description = "Cognito User Pool ID for authentication"
-  type        = string
-}
-
-variable "user_pool_client_ids" {
-  description = "List of Cognito User Pool Client IDs"
-  type        = list(string)
-}
-
-variable "env" {
-  description = "Environment variables for the Lambda function"
-  type        = map(string)
-  default     = {}
-}
-
-variable "additional_iam_policy_statements" {
-  description = "Additional IAM policy statements for the Lambda function"
-  type        = list(object({
-    Effect   = string
-    Action   = list(string)
-    Resource = list(string)
-  }))
-  default = []
-}
-
-variable "asset_bucket_name" {
-  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
-  type        = string
-}
-
-# CORS Configuration (passed to core module)
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-# WAF Configuration
-variable "enable_waf" {
-  description = "Whether to enable AWS WAFv2 with the default managed ruleset on the API stage"
-  type        = bool
-  default     = true
-}
-
-# Tags
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Get current AWS region and account ID
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-resource "random_string" "suffix" {
-  length  = 8
-  special = false
-  upper   = false
-}
-
-# Resources
-
-# Create Lambda ZIP file from the bundle directory
-data "archive_file" "lambda_zip" {
-  type        = "zip"
-  source_dir  = "\${path.module}/../../../../../../../dist/apps/test_api/bundle-x86"
-  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
-}
-
-resource "aws_s3_object" "lambda_zip" {
-  bucket      = var.asset_bucket_name
-  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_sha256}.zip"
-  source      = data.archive_file.lambda_zip.output_path
-  source_hash = data.archive_file.lambda_zip.output_base64sha256
-  etag        = data.archive_file.lambda_zip.output_md5
-}
-
-# Use the core REST API module
-module "rest_api" {
-  source = "../../../core/api/rest-api"
-
-  api_name        = "TestApi-\${random_string.suffix.result}"
-  api_description = "TestApi REST API"
-  stage_name      = "prod"
-  stage_auto_deploy = true
-
-  # WAF Configuration
-  enable_waf = var.enable_waf
-
-  # CORS Configuration
-  cors_allow_headers     = var.cors_allow_headers
-  cors_allow_methods     = var.cors_allow_methods
-  cors_allow_origins     = var.cors_allow_origins
-
-  # Tags
-  tags = var.tags
-}
-
-resource "aws_wafv2_web_acl_association" "api_waf_association" {
-  count = var.enable_waf ? 1 : 0
-
-  resource_arn = aws_api_gateway_stage.api_stage.arn
-  web_acl_arn  = module.rest_api.waf_web_acl_arn
-
-  depends_on = [aws_api_gateway_stage.api_stage]
-}
-
-# Lambda function
-resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
-  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
-  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
-  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
-  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  s3_bucket         = aws_s3_object.lambda_zip.bucket
-  s3_key            = aws_s3_object.lambda_zip.key
-  s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "TestApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
-  handler         = "run.sh"
-  runtime         = "python3.14"
-  layers          = ["arn:aws:lambda:\${data.aws_region.current.region}:753240598075:layer:LambdaAdapterLayerX86:24"]
-  timeout         = 30
-  memory_size     = 128
-  publish         = true
-
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-
-  # Enable X-Ray tracing
-  tracing_config {
-    mode = "Active"
-  }
-
-  # Enable SnapStart for faster cold starts
-  snap_start {
-    apply_on = "PublishedVersions"
-  }
-
-  environment {
-    variables = merge({
-      PORT                        = "8000"
-      AWS_LWA_INVOKE_MODE         = "response_stream"
-      AWS_LAMBDA_EXEC_WRAPPER     = "/opt/bootstrap"
-    }, var.env)
-  }
-
-  tags = var.tags
-}
-
-# IAM role for Lambda execution
-resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Effect = "Allow"
-        Principal = {
-          Service = "lambda.amazonaws.com"
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-# Attach basic execution policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Attach X-Ray tracing policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Additional IAM policies for Lambda (if provided)
-resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
-  })
-}
-
-# CloudWatch Log Group for Lambda
-resource "aws_cloudwatch_log_group" "lambda_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
-}
-
-# Lambda alias pointing to the latest published version for SnapStart
-resource "aws_lambda_alias" "live" {
-  name             = "live"
-  function_name    = aws_lambda_function.api_lambda.function_name
-  function_version = aws_lambda_function.api_lambda.version
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
-
-# Cognito User Pool Authorizer
-resource "aws_api_gateway_authorizer" "cognito_authorizer" {
-  name                   = "TestApiAuthorizer-\${random_string.suffix.result}"
-  rest_api_id           = module.rest_api.api_id
-  type                  = "COGNITO_USER_POOLS"
-  provider_arns         = ["arn:aws:cognito-idp:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:userpool/\${var.user_pool_id}"]
-  identity_source       = "method.request.header.Authorization"
-}
-
-# Create proxy resource (captures all paths)
-resource "aws_api_gateway_resource" "proxy_resource" {
-  rest_api_id = module.rest_api.api_id
-  parent_id   = module.rest_api.api_root_resource_id
-  path_part   = "{proxy+}"
-}
-
-# Lambda integration for REST API
-resource "aws_api_gateway_integration" "lambda_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.proxy_method.http_method
-
-  integration_http_method = "POST"
-  type                    = "AWS_PROXY"
-  # Use the response streaming invocation path with the alias ARN for SnapStart
-  uri                     = "arn:aws:apigateway:\${data.aws_region.current.region}:lambda:path/2021-11-15/functions/\${aws_lambda_alias.live.arn}/response-streaming-invocations"
-  response_transfer_mode  = "STREAM"
-
-  depends_on = [aws_lambda_alias.live]
-}
-
-# Method for proxy integration
-resource "aws_api_gateway_method" "proxy_method" {
-  #checkov:skip=CKV2_AWS_53:Request validation not required for proxy integration as Lambda handles validation
-  rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "ANY"
-
-  authorization = "COGNITO_USER_POOLS"
-  authorizer_id = aws_api_gateway_authorizer.cognito_authorizer.id
-  # Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
-  # and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
-  authorization_scopes = ["openid", "aws.cognito.signin.user.admin"]
-
-  request_parameters = {
-    "method.request.path.proxy" = true
-  }
-
-  depends_on = [aws_api_gateway_authorizer.cognito_authorizer]
-}
-
-# OPTIONS method for CORS preflight
-resource "aws_api_gateway_method" "options_method" {
-  #checkov:skip=CKV2_AWS_70:OPTIONS method must be unauthenticated for CORS preflight requests
-  #checkov:skip=CKV2_AWS_53:Request validation not required for OPTIONS CORS preflight method
-  rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "OPTIONS"
-  authorization = "NONE"
-}
-
-# CORS integration for OPTIONS method
-resource "aws_api_gateway_integration" "options_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-
-  type = "MOCK"
-  request_templates = {
-    "application/json" = "{\\"statusCode\\": 204}"
-  }
-}
-
-# OPTIONS method response
-resource "aws_api_gateway_method_response" "options_response" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = "204"
-
-  response_parameters = {
-    "method.response.header.Access-Control-Allow-Headers" = true
-    "method.response.header.Access-Control-Allow-Methods" = true
-    "method.response.header.Access-Control-Allow-Origin"  = true
-  }
-}
-
-# OPTIONS integration response
-resource "aws_api_gateway_integration_response" "options_integration_response" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = aws_api_gateway_method_response.options_response.status_code
-
-  response_parameters = {
-    "method.response.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
-    "method.response.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
-    "method.response.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
-  }
-}
-
-# API Gateway deployment
-resource "aws_api_gateway_deployment" "api_deployment" {
-  rest_api_id = module.rest_api.api_id
-
-  triggers = {
-    redeployment = sha1(jsonencode([
-      aws_api_gateway_resource.proxy_resource.id,
-      aws_api_gateway_method.proxy_method.id,
-      aws_api_gateway_integration.lambda_integration.id,
-      aws_api_gateway_method.options_method.id,
-      aws_api_gateway_integration.options_integration.id,
-    ]))
-  }
-
-  lifecycle {
-    create_before_destroy = true
-  }
-
-  depends_on = [
-    aws_api_gateway_method.proxy_method,
-    aws_api_gateway_integration.lambda_integration,
-    aws_api_gateway_method.options_method,
-    aws_api_gateway_integration.options_integration,
-    aws_api_gateway_method_response.options_response,
-    aws_api_gateway_integration_response.options_integration_response,
-  ]
-}
-
-# API Gateway stage
-resource "aws_api_gateway_stage" "api_stage" {
-  #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
-  #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
-  #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
-  deployment_id        = aws_api_gateway_deployment.api_deployment.id
-  rest_api_id          = module.rest_api.api_id
-  stage_name           = "prod"
-  xray_tracing_enabled = true
-
-  tags = var.tags
-
-  depends_on = [aws_api_gateway_deployment.api_deployment]
-}
-
-# API Gateway Resource Policy
-resource "aws_api_gateway_rest_api_policy" "api_policy" {
-  rest_api_id = module.rest_api.api_id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        # Allow all callers to invoke the API in the resource policy, since auth is handled by Cognito
-        Effect = "Allow"
-        Principal = "*"
-        Action   = "execute-api:Invoke"
-        Resource = "execute-api:/*"
-      }
-    ]
-  })
-}
-
-# Lambda permission for API Gateway to invoke the function via alias
-resource "aws_lambda_permission" "api_gateway_invoke" {
-  statement_id  = "AllowExecutionFromAPIGateway"
-  action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
-  qualifier     = aws_lambda_alias.live.name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
-
-  depends_on = [module.rest_api, aws_lambda_alias.live]
-}
-
-# Lambda permission for API Gateway to invoke with response streaming via alias
-resource "aws_lambda_permission" "api_gateway_invoke_streaming" {
-  statement_id  = "AllowStreamingFromAPIGateway"
-  action        = "lambda:InvokeFunctionWithResponseStream"
-  function_name = aws_lambda_function.api_lambda.function_name
-  qualifier     = aws_lambda_alias.live.name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
-
-  depends_on = [module.rest_api, aws_lambda_alias.live]
-}
-
-# Add API url to runtime config
-module "add_url_to_runtime_config" {
-  source = "../../../core/runtime-config/entry"
-
-  namespace = "connection"
-  key       = "apis"
-  value     = { "TestApi" = aws_api_gateway_stage.api_stage.invoke_url }
-
-  depends_on = [aws_api_gateway_stage.api_stage]
-}
-
-# Outputs
-
-# API Gateway Outputs (from core module)
-output "api_id" {
-  description = "ID of the REST API Gateway"
-  value       = module.rest_api.api_id
-}
-
-output "api_arn" {
-  description = "ARN of the REST API Gateway"
-  value       = module.rest_api.api_arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the REST API Gateway"
-  value       = module.rest_api.api_endpoint
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the REST API Gateway"
-  value       = module.rest_api.api_execution_arn
-}
-
-output "stage_invoke_url" {
-  description = "Invoke URL of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.invoke_url
-}
-
-output "stage_arn" {
-  description = "ARN of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.arn
-}
-
-output "stage_execution_arn" {
-  description = "Execution ARN of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.execution_arn
-}
-
-output "deployment_id" {
-  description = "ID of the API Gateway deployment"
-  value       = aws_api_gateway_deployment.api_deployment.id
-}
-
-output "stage_id" {
-  description = "ID of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.id
-}
-
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
-}
-
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
-}
-
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
-}
-
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
-}
-
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
-}
-
-output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
-}
-
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
-}
-
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
-}
-
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
-}
-
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_api_gateway_integration.lambda_integration.id
-}
-
-output "proxy_resource_id" {
-  description = "ID of the proxy resource"
-  value       = aws_api_gateway_resource.proxy_resource.id
-}
-
-output "proxy_method_id" {
-  description = "ID of the proxy method"
-  value       = aws_api_gateway_method.proxy_method.id
-}
-
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
-}
-
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
-}
-",
-}
-`;
-
-exports[`fastapi project generator > terraform iac > should generate terraform files for REST API with IAM auth and snapshot them > terraform-rest-iam-files 1`] = `
-{
-  "rest-api.tf": "# Core REST API Gateway module
-# This module creates the API Gateway REST API, deployment, stage, and logging resources
-
-terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.33"
-    }
-    random = {
-      source  = "hashicorp/random"
-      version = "~> 3.1"
-    }
-  }
-}
-
-# Core REST API Gateway Variables
-
-variable "api_name" {
-  description = "Name of the REST API Gateway"
-  type        = string
-}
-
-variable "api_description" {
-  description = "Description of the REST API Gateway"
-  type        = string
-  default     = "REST API Gateway"
-}
-
-variable "stage_name" {
-  description = "Name of the API Gateway stage"
-  type        = string
-  default     = "prod"
-}
-
-variable "stage_auto_deploy" {
-  description = "Whether to automatically deploy the API stage"
-  type        = bool
-  default     = true
-}
-
-variable "enable_waf" {
-  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet). The Web ACL is created here and associated with the stage in the consuming module."
-  type        = bool
-  default     = true
-}
-
-# CORS Configuration
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-# Tags
-
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Data sources
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-# Resources
-
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
-# REST API Gateway
-resource "aws_api_gateway_rest_api" "rest_api" {
-  name        = var.api_name
-  description = var.api_description
-
-  endpoint_configuration {
-    types = ["REGIONAL"]
-  }
-
-  lifecycle {
-    create_before_destroy = true
-  }
-
-  tags = var.tags
-}
-
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
-
-# Gateway Response for CORS (4XX errors)
-resource "aws_api_gateway_gateway_response" "cors_4xx" {
-  rest_api_id   = aws_api_gateway_rest_api.rest_api.id
-  response_type = "DEFAULT_4XX"
-
-  response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
-    "gatewayresponse.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
-    "gatewayresponse.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
-  }
-}
-
-# Gateway Response for CORS (5XX errors)
-resource "aws_api_gateway_gateway_response" "cors_5xx" {
-  rest_api_id   = aws_api_gateway_rest_api.rest_api.id
-  response_type = "DEFAULT_5XX"
-
-  response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
-    "gatewayresponse.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
-    "gatewayresponse.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
-  }
-}
-
-resource "aws_wafv2_web_acl" "api_waf" {
-  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.api_waf_logging; Checkov does not resolve the separate resource
-  count = var.enable_waf ? 1 : 0
-
-  name  = "\${var.api_name}-waf"
-  scope = "REGIONAL"
-
-  default_action {
-    allow {}
-  }
-
-  rule {
-    name     = "CRSRule"
-    priority = 0
-
-    override_action {
-      none {}
-    }
-
-    statement {
-      managed_rule_group_statement {
-        name        = "AWSManagedRulesCommonRuleSet"
-        vendor_name = "AWS"
-
-        # Count instead of Block: the CRS 8 KB body limit is too restrictive for most APIs.
-        rule_action_override {
-          name = "SizeRestrictions_BODY"
-          action_to_use {
-            count {}
-          }
-        }
-      }
-    }
-
-    visibility_config {
-      cloudwatch_metrics_enabled = true
-      metric_name                = "\${var.api_name}WebAcl-CRS"
-      sampled_requests_enabled   = true
-    }
-  }
-
-  rule {
-    name     = "KnownBadInputsRule"
-    priority = 1
-
-    override_action {
-      none {}
-    }
-
-    statement {
-      managed_rule_group_statement {
-        name        = "AWSManagedRulesKnownBadInputsRuleSet"
-        vendor_name = "AWS"
-      }
-    }
-
-    visibility_config {
-      cloudwatch_metrics_enabled = true
-      metric_name                = "\${var.api_name}WebAcl-KnownBadInputs"
-      sampled_requests_enabled   = true
-    }
-  }
-
-  visibility_config {
-    cloudwatch_metrics_enabled = true
-    metric_name                = "\${var.api_name}WebAcl"
-    sampled_requests_enabled   = true
-  }
-
-  tags = var.tags
-
-  lifecycle {
-    create_before_destroy = true
-  }
-}
-
-# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
-resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
-  count = var.enable_waf ? 1 : 0
-
-  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
-  retention_in_days = 30
-  tags              = var.tags
-}
-
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
-resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
-  count = var.enable_waf ? 1 : 0
-
-  log_destination_configs = [aws_cloudwatch_log_group.api_waf_logs[0].arn]
-  resource_arn            = aws_wafv2_web_acl.api_waf[0].arn
-}
-
-
-# Outputs
-
-output "api_id" {
-  description = "ID of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.id
-}
-
-output "api_arn" {
-  description = "ARN of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the REST API Gateway"
-  value       = "https://\${aws_api_gateway_rest_api.rest_api.id}.execute-api.\${data.aws_region.current.id}.amazonaws.com"
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.execution_arn
-}
-
-output "api_root_resource_id" {
-  description = "Root resource ID of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.root_resource_id
-}
-
-output "waf_web_acl_arn" {
-  description = "ARN of the WAFv2 Web ACL associated with the API, or null if WAF is disabled"
-  value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
-}
-
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
-  "test-api.tf": "terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.33"
-    }
-  }
-}
-
-
-variable "env" {
-  description = "Environment variables for the Lambda function"
-  type        = map(string)
-  default     = {}
-}
-
-variable "additional_iam_policy_statements" {
-  description = "Additional IAM policy statements for the Lambda function"
-  type        = list(object({
-    Effect   = string
-    Action   = list(string)
-    Resource = list(string)
-  }))
-  default = []
-}
-
-variable "asset_bucket_name" {
-  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
-  type        = string
-}
-
-# CORS Configuration (passed to core module)
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-# WAF Configuration
-variable "enable_waf" {
-  description = "Whether to enable AWS WAFv2 with the default managed ruleset on the API stage"
-  type        = bool
-  default     = true
-}
-
-# Tags
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Get current AWS region and account ID
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-resource "random_string" "suffix" {
-  length  = 8
-  special = false
-  upper   = false
-}
-
-# Resources
-
-# Create Lambda ZIP file from the bundle directory
-data "archive_file" "lambda_zip" {
-  type        = "zip"
-  source_dir  = "\${path.module}/../../../../../../../dist/apps/test_api/bundle-x86"
-  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
-}
-
-resource "aws_s3_object" "lambda_zip" {
-  bucket      = var.asset_bucket_name
-  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_sha256}.zip"
-  source      = data.archive_file.lambda_zip.output_path
-  source_hash = data.archive_file.lambda_zip.output_base64sha256
-  etag        = data.archive_file.lambda_zip.output_md5
-}
-
-# Use the core REST API module
-module "rest_api" {
-  source = "../../../core/api/rest-api"
-
-  api_name        = "TestApi-\${random_string.suffix.result}"
-  api_description = "TestApi REST API"
-  stage_name      = "prod"
-  stage_auto_deploy = true
-
-  # WAF Configuration
-  enable_waf = var.enable_waf
-
-  # CORS Configuration
-  cors_allow_headers     = var.cors_allow_headers
-  cors_allow_methods     = var.cors_allow_methods
-  cors_allow_origins     = var.cors_allow_origins
-
-  # Tags
-  tags = var.tags
-}
-
-resource "aws_wafv2_web_acl_association" "api_waf_association" {
-  count = var.enable_waf ? 1 : 0
-
-  resource_arn = aws_api_gateway_stage.api_stage.arn
-  web_acl_arn  = module.rest_api.waf_web_acl_arn
-
-  depends_on = [aws_api_gateway_stage.api_stage]
-}
-
-# Lambda function
-resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
-  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
-  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
-  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
-  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  s3_bucket         = aws_s3_object.lambda_zip.bucket
-  s3_key            = aws_s3_object.lambda_zip.key
-  s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "TestApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
-  handler         = "run.sh"
-  runtime         = "python3.14"
-  layers          = ["arn:aws:lambda:\${data.aws_region.current.region}:753240598075:layer:LambdaAdapterLayerX86:24"]
-  timeout         = 30
-  memory_size     = 128
-  publish         = true
-
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-
-  # Enable X-Ray tracing
-  tracing_config {
-    mode = "Active"
-  }
-
-  # Enable SnapStart for faster cold starts
-  snap_start {
-    apply_on = "PublishedVersions"
-  }
-
-  environment {
-    variables = merge({
-      PORT                        = "8000"
-      AWS_LWA_INVOKE_MODE         = "response_stream"
-      AWS_LAMBDA_EXEC_WRAPPER     = "/opt/bootstrap"
-    }, var.env)
-  }
-
-  tags = var.tags
-}
-
-# IAM role for Lambda execution
-resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Effect = "Allow"
-        Principal = {
-          Service = "lambda.amazonaws.com"
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-# Attach basic execution policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Attach X-Ray tracing policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Additional IAM policies for Lambda (if provided)
-resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
-  })
-}
-
-# CloudWatch Log Group for Lambda
-resource "aws_cloudwatch_log_group" "lambda_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
-}
-
-# Lambda alias pointing to the latest published version for SnapStart
-resource "aws_lambda_alias" "live" {
-  name             = "live"
-  function_name    = aws_lambda_function.api_lambda.function_name
-  function_version = aws_lambda_function.api_lambda.version
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
-
-
-# Create proxy resource (captures all paths)
-resource "aws_api_gateway_resource" "proxy_resource" {
-  rest_api_id = module.rest_api.api_id
-  parent_id   = module.rest_api.api_root_resource_id
-  path_part   = "{proxy+}"
-}
-
-# Lambda integration for REST API
-resource "aws_api_gateway_integration" "lambda_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.proxy_method.http_method
-
-  integration_http_method = "POST"
-  type                    = "AWS_PROXY"
-  # Use the response streaming invocation path with the alias ARN for SnapStart
-  uri                     = "arn:aws:apigateway:\${data.aws_region.current.region}:lambda:path/2021-11-15/functions/\${aws_lambda_alias.live.arn}/response-streaming-invocations"
-  response_transfer_mode  = "STREAM"
-
-  depends_on = [aws_lambda_alias.live]
-}
-
-# Method for proxy integration
-resource "aws_api_gateway_method" "proxy_method" {
-  #checkov:skip=CKV2_AWS_53:Request validation not required for proxy integration as Lambda handles validation
-  rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "ANY"
-
-  authorization = "AWS_IAM"
-
-  request_parameters = {
-    "method.request.path.proxy" = true
-  }
-
-  depends_on = []
-}
-
-# OPTIONS method for CORS preflight
-resource "aws_api_gateway_method" "options_method" {
-  #checkov:skip=CKV2_AWS_70:OPTIONS method must be unauthenticated for CORS preflight requests
-  #checkov:skip=CKV2_AWS_53:Request validation not required for OPTIONS CORS preflight method
-  rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "OPTIONS"
-  authorization = "NONE"
-}
-
-# CORS integration for OPTIONS method
-resource "aws_api_gateway_integration" "options_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-
-  type = "MOCK"
-  request_templates = {
-    "application/json" = "{\\"statusCode\\": 204}"
-  }
-}
-
-# OPTIONS method response
-resource "aws_api_gateway_method_response" "options_response" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = "204"
-
-  response_parameters = {
-    "method.response.header.Access-Control-Allow-Headers" = true
-    "method.response.header.Access-Control-Allow-Methods" = true
-    "method.response.header.Access-Control-Allow-Origin"  = true
-  }
-}
-
-# OPTIONS integration response
-resource "aws_api_gateway_integration_response" "options_integration_response" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = aws_api_gateway_method_response.options_response.status_code
-
-  response_parameters = {
-    "method.response.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
-    "method.response.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
-    "method.response.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
-  }
-}
-
-# API Gateway deployment
-resource "aws_api_gateway_deployment" "api_deployment" {
-  rest_api_id = module.rest_api.api_id
-
-  triggers = {
-    redeployment = sha1(jsonencode([
-      aws_api_gateway_resource.proxy_resource.id,
-      aws_api_gateway_method.proxy_method.id,
-      aws_api_gateway_integration.lambda_integration.id,
-      aws_api_gateway_method.options_method.id,
-      aws_api_gateway_integration.options_integration.id,
-    ]))
-  }
-
-  lifecycle {
-    create_before_destroy = true
-  }
-
-  depends_on = [
-    aws_api_gateway_method.proxy_method,
-    aws_api_gateway_integration.lambda_integration,
-    aws_api_gateway_method.options_method,
-    aws_api_gateway_integration.options_integration,
-    aws_api_gateway_method_response.options_response,
-    aws_api_gateway_integration_response.options_integration_response,
-  ]
-}
-
-# API Gateway stage
-resource "aws_api_gateway_stage" "api_stage" {
-  #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
-  #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
-  #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
-  deployment_id        = aws_api_gateway_deployment.api_deployment.id
-  rest_api_id          = module.rest_api.api_id
-  stage_name           = "prod"
-  xray_tracing_enabled = true
-
-  tags = var.tags
-
-  depends_on = [aws_api_gateway_deployment.api_deployment]
-}
-
-# API Gateway Resource Policy
-resource "aws_api_gateway_rest_api_policy" "api_policy" {
-  rest_api_id = module.rest_api.api_id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        # Grant any AWS credentials from the account to call the API
-        # Machine to machine fine-grained access can be defined here using more specific principals
-        # (eg roles or users) and resources (eg which api paths may be invoked by which principal) if required
-        Effect = "Allow"
-        Principal = {
-          AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root"
-        }
-        Action   = "execute-api:Invoke"
-        Resource = "execute-api:/*"
-      },
-      {
-        # Open up OPTIONS to allow browsers to make unauthenticated preflight requests
-        Effect = "Allow"
-        Principal = "*"
-        Action   = "execute-api:Invoke"
-        Resource = "execute-api:/*/OPTIONS/*"
-      }
-    ]
-  })
-}
-
-# Lambda permission for API Gateway to invoke the function via alias
-resource "aws_lambda_permission" "api_gateway_invoke" {
-  statement_id  = "AllowExecutionFromAPIGateway"
-  action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
-  qualifier     = aws_lambda_alias.live.name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
-
-  depends_on = [module.rest_api, aws_lambda_alias.live]
-}
-
-# Lambda permission for API Gateway to invoke with response streaming via alias
-resource "aws_lambda_permission" "api_gateway_invoke_streaming" {
-  statement_id  = "AllowStreamingFromAPIGateway"
-  action        = "lambda:InvokeFunctionWithResponseStream"
-  function_name = aws_lambda_function.api_lambda.function_name
-  qualifier     = aws_lambda_alias.live.name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
-
-  depends_on = [module.rest_api, aws_lambda_alias.live]
-}
-
-# Add API url to runtime config
-module "add_url_to_runtime_config" {
-  source = "../../../core/runtime-config/entry"
-
-  namespace = "connection"
-  key       = "apis"
-  value     = { "TestApi" = aws_api_gateway_stage.api_stage.invoke_url }
-
-  depends_on = [aws_api_gateway_stage.api_stage]
-}
-
-# Outputs
-
-# API Gateway Outputs (from core module)
-output "api_id" {
-  description = "ID of the REST API Gateway"
-  value       = module.rest_api.api_id
-}
-
-output "api_arn" {
-  description = "ARN of the REST API Gateway"
-  value       = module.rest_api.api_arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the REST API Gateway"
-  value       = module.rest_api.api_endpoint
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the REST API Gateway"
-  value       = module.rest_api.api_execution_arn
-}
-
-output "stage_invoke_url" {
-  description = "Invoke URL of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.invoke_url
-}
-
-output "stage_arn" {
-  description = "ARN of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.arn
-}
-
-output "stage_execution_arn" {
-  description = "Execution ARN of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.execution_arn
-}
-
-output "deployment_id" {
-  description = "ID of the API Gateway deployment"
-  value       = aws_api_gateway_deployment.api_deployment.id
-}
-
-output "stage_id" {
-  description = "ID of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.id
-}
-
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
-}
-
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
-}
-
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
-}
-
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
-}
-
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
-}
-
-output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
-}
-
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
-}
-
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
-}
-
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
-}
-
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_api_gateway_integration.lambda_integration.id
-}
-
-output "proxy_resource_id" {
-  description = "ID of the proxy resource"
-  value       = aws_api_gateway_resource.proxy_resource.id
-}
-
-output "proxy_method_id" {
-  description = "ID of the proxy method"
-  value       = aws_api_gateway_method.proxy_method.id
-}
-
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
-}
-
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
-}
-",
-}
-`;
-
-exports[`fastapi project generator > terraform iac > should generate terraform files for REST API with None auth and snapshot them > terraform-rest-none-files 1`] = `
-{
-  "rest-api.tf": "# Core REST API Gateway module
-# This module creates the API Gateway REST API, deployment, stage, and logging resources
-
-terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.33"
-    }
-    random = {
-      source  = "hashicorp/random"
-      version = "~> 3.1"
-    }
-  }
-}
-
-# Core REST API Gateway Variables
-
-variable "api_name" {
-  description = "Name of the REST API Gateway"
-  type        = string
-}
-
-variable "api_description" {
-  description = "Description of the REST API Gateway"
-  type        = string
-  default     = "REST API Gateway"
-}
-
-variable "stage_name" {
-  description = "Name of the API Gateway stage"
-  type        = string
-  default     = "prod"
-}
-
-variable "stage_auto_deploy" {
-  description = "Whether to automatically deploy the API stage"
-  type        = bool
-  default     = true
-}
-
-variable "enable_waf" {
-  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet). The Web ACL is created here and associated with the stage in the consuming module."
-  type        = bool
-  default     = true
-}
-
-# CORS Configuration
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-# Tags
-
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Data sources
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-# Resources
-
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
-# REST API Gateway
-resource "aws_api_gateway_rest_api" "rest_api" {
-  name        = var.api_name
-  description = var.api_description
-
-  endpoint_configuration {
-    types = ["REGIONAL"]
-  }
-
-  lifecycle {
-    create_before_destroy = true
-  }
-
-  tags = var.tags
-}
-
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
-
-# Gateway Response for CORS (4XX errors)
-resource "aws_api_gateway_gateway_response" "cors_4xx" {
-  rest_api_id   = aws_api_gateway_rest_api.rest_api.id
-  response_type = "DEFAULT_4XX"
-
-  response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
-    "gatewayresponse.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
-    "gatewayresponse.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
-  }
-}
-
-# Gateway Response for CORS (5XX errors)
-resource "aws_api_gateway_gateway_response" "cors_5xx" {
-  rest_api_id   = aws_api_gateway_rest_api.rest_api.id
-  response_type = "DEFAULT_5XX"
-
-  response_parameters = {
-    "gatewayresponse.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
-    "gatewayresponse.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
-    "gatewayresponse.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
-  }
-}
-
-resource "aws_wafv2_web_acl" "api_waf" {
-  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.api_waf_logging; Checkov does not resolve the separate resource
-  count = var.enable_waf ? 1 : 0
-
-  name  = "\${var.api_name}-waf"
-  scope = "REGIONAL"
-
-  default_action {
-    allow {}
-  }
-
-  rule {
-    name     = "CRSRule"
-    priority = 0
-
-    override_action {
-      none {}
-    }
-
-    statement {
-      managed_rule_group_statement {
-        name        = "AWSManagedRulesCommonRuleSet"
-        vendor_name = "AWS"
-
-        # Count instead of Block: the CRS 8 KB body limit is too restrictive for most APIs.
-        rule_action_override {
-          name = "SizeRestrictions_BODY"
-          action_to_use {
-            count {}
-          }
-        }
-      }
-    }
-
-    visibility_config {
-      cloudwatch_metrics_enabled = true
-      metric_name                = "\${var.api_name}WebAcl-CRS"
-      sampled_requests_enabled   = true
-    }
-  }
-
-  rule {
-    name     = "KnownBadInputsRule"
-    priority = 1
-
-    override_action {
-      none {}
-    }
-
-    statement {
-      managed_rule_group_statement {
-        name        = "AWSManagedRulesKnownBadInputsRuleSet"
-        vendor_name = "AWS"
-      }
-    }
-
-    visibility_config {
-      cloudwatch_metrics_enabled = true
-      metric_name                = "\${var.api_name}WebAcl-KnownBadInputs"
-      sampled_requests_enabled   = true
-    }
-  }
-
-  visibility_config {
-    cloudwatch_metrics_enabled = true
-    metric_name                = "\${var.api_name}WebAcl"
-    sampled_requests_enabled   = true
-  }
-
-  tags = var.tags
-
-  lifecycle {
-    create_before_destroy = true
-  }
-}
-
-# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
-resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
-  count = var.enable_waf ? 1 : 0
-
-  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
-  retention_in_days = 30
-  tags              = var.tags
-}
-
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
-resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
-  count = var.enable_waf ? 1 : 0
-
-  log_destination_configs = [aws_cloudwatch_log_group.api_waf_logs[0].arn]
-  resource_arn            = aws_wafv2_web_acl.api_waf[0].arn
-}
-
-
-# Outputs
-
-output "api_id" {
-  description = "ID of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.id
-}
-
-output "api_arn" {
-  description = "ARN of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the REST API Gateway"
-  value       = "https://\${aws_api_gateway_rest_api.rest_api.id}.execute-api.\${data.aws_region.current.id}.amazonaws.com"
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.execution_arn
-}
-
-output "api_root_resource_id" {
-  description = "Root resource ID of the REST API Gateway"
-  value       = aws_api_gateway_rest_api.rest_api.root_resource_id
-}
-
-output "waf_web_acl_arn" {
-  description = "ARN of the WAFv2 Web ACL associated with the API, or null if WAF is disabled"
-  value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
-}
-
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
-  "test-api.tf": "terraform {
-  required_version = ">= 1.0"
-
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 6.33"
-    }
-  }
-}
-
-
-variable "env" {
-  description = "Environment variables for the Lambda function"
-  type        = map(string)
-  default     = {}
-}
-
-variable "additional_iam_policy_statements" {
-  description = "Additional IAM policy statements for the Lambda function"
-  type        = list(object({
-    Effect   = string
-    Action   = list(string)
-    Resource = list(string)
-  }))
-  default = []
-}
-
-variable "asset_bucket_name" {
-  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
-  type        = string
-}
-
-# CORS Configuration (passed to core module)
-
-variable "cors_allow_headers" {
-  description = "List of allowed headers for CORS"
-  type        = list(string)
-  default     = ["authorization", "content-type", "x-amz-content-sha256", "x-amz-date", "x-amz-security-token"]
-}
-
-variable "cors_allow_methods" {
-  description = "List of allowed HTTP methods for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-variable "cors_allow_origins" {
-  description = "List of allowed origins for CORS"
-  type        = list(string)
-  default     = ["*"]
-}
-
-# WAF Configuration
-variable "enable_waf" {
-  description = "Whether to enable AWS WAFv2 with the default managed ruleset on the API stage"
-  type        = bool
-  default     = true
-}
-
-# Tags
-variable "tags" {
-  description = "Tags to apply to all resources"
-  type        = map(string)
-  default     = {}
-}
-
-# Get current AWS region and account ID
-data "aws_region" "current" {}
-data "aws_caller_identity" "current" {}
-
-resource "random_string" "suffix" {
-  length  = 8
-  special = false
-  upper   = false
-}
-
-# Resources
-
-# Create Lambda ZIP file from the bundle directory
-data "archive_file" "lambda_zip" {
-  type        = "zip"
-  source_dir  = "\${path.module}/../../../../../../../dist/apps/test_api/bundle-x86"
-  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/lambda.zip"
-}
-
-resource "aws_s3_object" "lambda_zip" {
-  bucket      = var.asset_bucket_name
-  key         = "apis/test-api/\${data.archive_file.lambda_zip.output_sha256}.zip"
-  source      = data.archive_file.lambda_zip.output_path
-  source_hash = data.archive_file.lambda_zip.output_base64sha256
-  etag        = data.archive_file.lambda_zip.output_md5
-}
-
-# Use the core REST API module
-module "rest_api" {
-  source = "../../../core/api/rest-api"
-
-  api_name        = "TestApi-\${random_string.suffix.result}"
-  api_description = "TestApi REST API"
-  stage_name      = "prod"
-  stage_auto_deploy = true
-
-  # WAF Configuration
-  enable_waf = var.enable_waf
-
-  # CORS Configuration
-  cors_allow_headers     = var.cors_allow_headers
-  cors_allow_methods     = var.cors_allow_methods
-  cors_allow_origins     = var.cors_allow_origins
-
-  # Tags
-  tags = var.tags
-}
-
-resource "aws_wafv2_web_acl_association" "api_waf_association" {
-  count = var.enable_waf ? 1 : 0
-
-  resource_arn = aws_api_gateway_stage.api_stage.arn
-  web_acl_arn  = module.rest_api.waf_web_acl_arn
-
-  depends_on = [aws_api_gateway_stage.api_stage]
-}
-
-# Lambda function
-resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
-  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
-  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
-  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
-  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  s3_bucket         = aws_s3_object.lambda_zip.bucket
-  s3_key            = aws_s3_object.lambda_zip.key
-  s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "TestApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
-  handler         = "run.sh"
-  runtime         = "python3.14"
-  layers          = ["arn:aws:lambda:\${data.aws_region.current.region}:753240598075:layer:LambdaAdapterLayerX86:24"]
-  timeout         = 30
-  memory_size     = 128
-  publish         = true
-
-  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
-
-  # Enable X-Ray tracing
-  tracing_config {
-    mode = "Active"
-  }
-
-  # Enable SnapStart for faster cold starts
-  snap_start {
-    apply_on = "PublishedVersions"
-  }
-
-  environment {
-    variables = merge({
-      PORT                        = "8000"
-      AWS_LWA_INVOKE_MODE         = "response_stream"
-      AWS_LAMBDA_EXEC_WRAPPER     = "/opt/bootstrap"
-    }, var.env)
-  }
-
-  tags = var.tags
-}
-
-# IAM role for Lambda execution
-resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Effect = "Allow"
-        Principal = {
-          Service = "lambda.amazonaws.com"
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-# Attach basic execution policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Attach X-Ray tracing policy to Lambda role
-resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
-}
-
-# Additional IAM policies for Lambda (if provided)
-resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
-  })
-}
-
-# CloudWatch Log Group for Lambda
-resource "aws_cloudwatch_log_group" "lambda_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
-}
-
-# Lambda alias pointing to the latest published version for SnapStart
-resource "aws_lambda_alias" "live" {
-  name             = "live"
-  function_name    = aws_lambda_function.api_lambda.function_name
-  function_version = aws_lambda_function.api_lambda.version
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
-
-# Custom Lambda Authorizer
-resource "aws_lambda_function" "authorizer_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
-  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for authorizer
-  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
-  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
-  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
-  s3_bucket         = aws_s3_object.authorizer_zip.bucket
-  s3_key            = aws_s3_object.authorizer_zip.key
-  s3_object_version = aws_s3_object.authorizer_zip.version_id
-  function_name    = "TestApiAuthorizer-\${random_string.suffix.result}"
-  role            = aws_iam_role.authorizer_execution_role.arn
-  handler         = "proj_test_api.authorizer.handler"
-  runtime         = "python3.14"
-  timeout         = 10
-  memory_size     = 128
-
-  source_code_hash = data.archive_file.authorizer_zip.output_base64sha256
-
-  tracing_config {
-    mode = "Active"
-  }
-
-  tags = var.tags
-}
-
-resource "aws_iam_role" "authorizer_execution_role" {
-  name = "TestApiAuthorizer-role-\${random_string.suffix.result}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Action = "sts:AssumeRole"
-        Effect = "Allow"
-        Principal = {
-          Service = "lambda.amazonaws.com"
-        }
-      }
-    ]
-  })
-
-  tags = var.tags
-}
-
-resource "aws_iam_role_policy_attachment" "authorizer_basic_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.authorizer_execution_role.name
-}
-
-resource "aws_iam_role_policy_attachment" "authorizer_xray_execution" {
-  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.authorizer_execution_role.name
-}
-
-resource "aws_cloudwatch_log_group" "authorizer_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
-  #checkov:skip=CKV_AWS_338:Log retention set to forever
-  #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name = "/aws/lambda/TestApiAuthorizer-\${random_string.suffix.result}"
-  tags = var.tags
-}
-
-data "archive_file" "authorizer_zip" {
-  type        = "zip"
-  source_dir  = "\${path.module}/../../../../../../../dist/apps/test_api/bundle-x86"
-  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/apis/test-api/authorizer.zip"
-}
-
-resource "aws_s3_object" "authorizer_zip" {
-  bucket      = var.asset_bucket_name
-  key         = "apis/test-api/authorizer-\${data.archive_file.authorizer_zip.output_sha256}.zip"
-  source      = data.archive_file.authorizer_zip.output_path
-  source_hash = data.archive_file.authorizer_zip.output_base64sha256
-  etag        = data.archive_file.authorizer_zip.output_md5
-}
-
-resource "aws_api_gateway_authorizer" "custom_authorizer" {
-  name                   = "TestApiAuthorizer-\${random_string.suffix.result}"
-  rest_api_id           = module.rest_api.api_id
-  type                  = "TOKEN"
-  authorizer_uri        = aws_lambda_function.authorizer_lambda.invoke_arn
-  identity_source       = "method.request.header.Authorization"
-}
-
-resource "aws_lambda_permission" "authorizer_invoke" {
-  statement_id  = "AllowAPIGatewayInvokeAuthorizer"
-  action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.authorizer_lambda.function_name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/authorizers/\${aws_api_gateway_authorizer.custom_authorizer.id}"
-}
-
-# Create proxy resource (captures all paths)
-resource "aws_api_gateway_resource" "proxy_resource" {
-  rest_api_id = module.rest_api.api_id
-  parent_id   = module.rest_api.api_root_resource_id
-  path_part   = "{proxy+}"
-}
-
-# Lambda integration for REST API
-resource "aws_api_gateway_integration" "lambda_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.proxy_method.http_method
-
-  integration_http_method = "POST"
-  type                    = "AWS_PROXY"
-  # Use the response streaming invocation path with the alias ARN for SnapStart
-  uri                     = "arn:aws:apigateway:\${data.aws_region.current.region}:lambda:path/2021-11-15/functions/\${aws_lambda_alias.live.arn}/response-streaming-invocations"
-  response_transfer_mode  = "STREAM"
-
-  depends_on = [aws_lambda_alias.live]
-}
-
-# Method for proxy integration
-resource "aws_api_gateway_method" "proxy_method" {
-  #checkov:skip=CKV2_AWS_53:Request validation not required for proxy integration as Lambda handles validation
-  rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "ANY"
-
-  authorization = "CUSTOM"
-  authorizer_id = aws_api_gateway_authorizer.custom_authorizer.id
-
-  request_parameters = {
-    "method.request.path.proxy" = true
-  }
-
-  depends_on = [aws_api_gateway_authorizer.custom_authorizer]
-}
-
-# OPTIONS method for CORS preflight
-resource "aws_api_gateway_method" "options_method" {
-  #checkov:skip=CKV2_AWS_70:OPTIONS method must be unauthenticated for CORS preflight requests
-  #checkov:skip=CKV2_AWS_53:Request validation not required for OPTIONS CORS preflight method
-  rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "OPTIONS"
-  authorization = "NONE"
-}
-
-# CORS integration for OPTIONS method
-resource "aws_api_gateway_integration" "options_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-
-  type = "MOCK"
-  request_templates = {
-    "application/json" = "{\\"statusCode\\": 204}"
-  }
-}
-
-# OPTIONS method response
-resource "aws_api_gateway_method_response" "options_response" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = "204"
-
-  response_parameters = {
-    "method.response.header.Access-Control-Allow-Headers" = true
-    "method.response.header.Access-Control-Allow-Methods" = true
-    "method.response.header.Access-Control-Allow-Origin"  = true
-  }
-}
-
-# OPTIONS integration response
-resource "aws_api_gateway_integration_response" "options_integration_response" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = aws_api_gateway_method_response.options_response.status_code
-
-  response_parameters = {
-    "method.response.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
-    "method.response.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
-    "method.response.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
-  }
-}
-
-# API Gateway deployment
-resource "aws_api_gateway_deployment" "api_deployment" {
-  rest_api_id = module.rest_api.api_id
-
-  triggers = {
-    redeployment = sha1(jsonencode([
-      aws_api_gateway_resource.proxy_resource.id,
-      aws_api_gateway_method.proxy_method.id,
-      aws_api_gateway_integration.lambda_integration.id,
-      aws_api_gateway_method.options_method.id,
-      aws_api_gateway_integration.options_integration.id,
-    ]))
-  }
-
-  lifecycle {
-    create_before_destroy = true
-  }
-
-  depends_on = [
-    aws_api_gateway_method.proxy_method,
-    aws_api_gateway_integration.lambda_integration,
-    aws_api_gateway_method.options_method,
-    aws_api_gateway_integration.options_integration,
-    aws_api_gateway_method_response.options_response,
-    aws_api_gateway_integration_response.options_integration_response,
-    aws_api_gateway_authorizer.custom_authorizer,
-  ]
-}
-
-# API Gateway stage
-resource "aws_api_gateway_stage" "api_stage" {
-  #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
-  #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
-  #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
-  deployment_id        = aws_api_gateway_deployment.api_deployment.id
-  rest_api_id          = module.rest_api.api_id
-  stage_name           = "prod"
-  xray_tracing_enabled = true
-
-  tags = var.tags
-
-  depends_on = [aws_api_gateway_deployment.api_deployment]
-}
-
-# API Gateway Resource Policy
-resource "aws_api_gateway_rest_api_policy" "api_policy" {
-  rest_api_id = module.rest_api.api_id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        # Allow all callers to invoke the API in the resource policy, since auth is handled by the Lambda Authorizer
-        Effect = "Allow"
-        Principal = "*"
-        Action   = "execute-api:Invoke"
-        Resource = "execute-api:/*"
-      }
-    ]
-  })
-}
-
-# Lambda permission for API Gateway to invoke the function via alias
-resource "aws_lambda_permission" "api_gateway_invoke" {
-  statement_id  = "AllowExecutionFromAPIGateway"
-  action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
-  qualifier     = aws_lambda_alias.live.name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
-
-  depends_on = [module.rest_api, aws_lambda_alias.live]
-}
-
-# Lambda permission for API Gateway to invoke with response streaming via alias
-resource "aws_lambda_permission" "api_gateway_invoke_streaming" {
-  statement_id  = "AllowStreamingFromAPIGateway"
-  action        = "lambda:InvokeFunctionWithResponseStream"
-  function_name = aws_lambda_function.api_lambda.function_name
-  qualifier     = aws_lambda_alias.live.name
-  principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
-
-  depends_on = [module.rest_api, aws_lambda_alias.live]
-}
-
-# Add API url to runtime config
-module "add_url_to_runtime_config" {
-  source = "../../../core/runtime-config/entry"
-
-  namespace = "connection"
-  key       = "apis"
-  value     = { "TestApi" = aws_api_gateway_stage.api_stage.invoke_url }
-
-  depends_on = [aws_api_gateway_stage.api_stage]
-}
-
-# Outputs
-
-# API Gateway Outputs (from core module)
-output "api_id" {
-  description = "ID of the REST API Gateway"
-  value       = module.rest_api.api_id
-}
-
-output "api_arn" {
-  description = "ARN of the REST API Gateway"
-  value       = module.rest_api.api_arn
-}
-
-output "api_endpoint" {
-  description = "Base URL of the REST API Gateway"
-  value       = module.rest_api.api_endpoint
-}
-
-output "api_execution_arn" {
-  description = "Execution ARN of the REST API Gateway"
-  value       = module.rest_api.api_execution_arn
-}
-
-output "stage_invoke_url" {
-  description = "Invoke URL of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.invoke_url
-}
-
-output "stage_arn" {
-  description = "ARN of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.arn
-}
-
-output "stage_execution_arn" {
-  description = "Execution ARN of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.execution_arn
-}
-
-output "deployment_id" {
-  description = "ID of the API Gateway deployment"
-  value       = aws_api_gateway_deployment.api_deployment.id
-}
-
-output "stage_id" {
-  description = "ID of the API Gateway stage"
-  value       = aws_api_gateway_stage.api_stage.id
-}
-
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
-}
-
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
-}
-
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
-}
-
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
-}
-
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
-}
-
-output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
-}
-
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
-}
-
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
-}
-
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
-}
-
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_api_gateway_integration.lambda_integration.id
-}
-
-output "proxy_resource_id" {
-  description = "ID of the proxy resource"
-  value       = aws_api_gateway_resource.proxy_resource.id
-}
-
-output "proxy_method_id" {
-  description = "ID of the proxy method"
-  value       = aws_api_gateway_method.proxy_method.id
-}
-
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
-}
-
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
-}
-",
-}
-`;