@aws/nx-plugin 1.0.0-rc.23 → 1.0.0-rc.25

package/src/utils/api-constructs/api-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,gCAAuC;AAEvC,8BAA0D;AAC1D,gFAIwC;AAmCjC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAU,EACV,OAAqD,EACrD,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,6BAA6B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,mDAAqB,CAAC,CAAC,CAAC,kDAAoB,EACpE,cAAc,CACf,EACD,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAA,sCAAiC,EAC/B,MAAM,EACN,OAAO,EACP,GAAG,OAAO,CAAC,cAAc,QAAQ,CAClC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,kBAAkB,sBA4B7B;AAEF;;GAEG;AACH,MAAM,0BAA0B,GAAG,KAAK,EACtC,IAAU,EACV,OAAsC,EACtC,EAAE;IACF,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,EAAE;QAC3C,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,EACjE,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,KAAK,CACN,EACD,EAAE,EACF;YACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;SAClD,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,qDAAqD;IACrD,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACpC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,sCAAsC;IACtC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,KAAK,EACL,KAAK,EACL,MAAM,EACN,OAAO,CAAC,aAAa,CACtB,EACD,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,MAAM,CACP,EACD,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,oCAAoC;IACpC,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,KAAK,OAAO,CAAC,gBAAgB,KAAK,CACnC,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,iBAAiB,CAClB,CAAC;AACJ,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,6BAA6B,GAAG,CACpC,IAAU,EACV,OAAsC,EACtC,EAAE;IACF,iCAAiC;IACjC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,WAAW,EACX,MAAM,EACN,KAAK,EACL,OAAO,CAAC,aAAa,CACtB,EACD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAC3E,EAAE,EACF;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,yCAAyC;IACzC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,WAAW,EACX,KAAK,EACL,MAAM,EACN,OAAO,CAAC,aAAa,CACtB,EACD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAC3E,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\ninterface BackendOptions {\n  type: 'trpc' | 'fastapi' | 'smithy';\n  integrationPattern: 'isolated' | 'shared';\n}\n\nexport interface TrpcBackendOptions extends BackendOptions {\n  type: 'trpc';\n  projectAlias: string;\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface FastApiBackendOptions extends BackendOptions {\n  type: 'fastapi';\n  moduleName: string;\n  bundleOutputDir: string;\n}\n\nexport interface SmithyBackendOptions extends BackendOptions {\n  type: 'smithy';\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface AddApiGatewayConstructOptions {\n  apiProjectName: string;\n  apiNameClassName: string;\n  apiNameKebabCase: string;\n  constructType: 'http' | 'rest';\n  backend: TrpcBackendOptions | FastApiBackendOptions | SmithyBackendOptions;\n  auth: 'iam' | 'cognito' | 'custom';\n}\n\nexport const addApiGatewayInfra = async (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addApiGatewayCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addApiGatewayTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.apiProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\n/**\n * Add an API CDK construct, and update the Runtime Config type to export its url\n */\nconst addApiGatewayCdkConstructs = async (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n) => {\n  const generateCoreApiFile = (name: string) => {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        'files',\n        'cdk',\n        'core',\n        'api',\n        name,\n      ),\n      joinPathFragments(\n        PACKAGES_DIR,\n        SHARED_CONSTRUCTS_DIR,\n        'src',\n        'core',\n        'api',\n      ),\n      {},\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  };\n\n  // Generate relevant core CDK construct and utilities\n  generateCoreApiFile(options.constructType);\n  generateCoreApiFile('utils');\n  if (options.backend.type === 'trpc') {\n    generateCoreApiFile('trpc');\n  }\n\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n    ),\n    options,\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n      'index.ts',\n    ),\n    `./${options.apiNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './apis/index.js',\n  );\n};\n\n/**\n * Add an API terraform module, and update the Runtime Config type to export its url\n */\nconst addApiGatewayTerraformModules = (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n) => {\n  // Generate core terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'api',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'),\n    { boto3Version: PY_VERSIONS.boto3, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addApiGatewayInfra","tree","options","iac","addApiGatewayCdkConstructs","addApiGatewayTerraformModules","Error","config","apiProjectName","generateCoreApiFile","name","dirname","overwriteStrategy","KeepExisting","constructType","backend","type","apiNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAmCrE,OAAO,MAAMC,qBAAqB,OAChCC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,2BAA2BH,MAAMC;IACzC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,8BAA8BJ,MAAMC;IACtC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAX,WACES,MACAX,kBACEK,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACU;QACCb,kCACEa,QACA,SACA,GAAGL,QAAQM,cAAc,CAAC,MAAM,CAAC;QAEnC,OAAOD;IACT;AAEJ,EAAE;AAEF;;CAEC,GACD,MAAMH,6BAA6B,OACjCH,MACAC;IAEA,MAAMO,sBAAsB,CAACC;QAC3BrB,cACEY,MACAX,kBACE,YAAYqB,OAAO,EACnB,SACA,OACA,QACA,OACAD,OAEFpB,kBACEK,cACAC,uBACA,OACA,QACA,QAEF,CAAC,GACD;YACEgB,mBAAmBrB,kBAAkBsB,YAAY;QACnD;IAEJ;IAEA,qDAAqD;IACrDJ,oBAAoBP,QAAQY,aAAa;IACzCL,oBAAoB;IACpB,IAAIP,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnCP,oBAAoB;IACtB;IAEA,sCAAsC;IACtCpB,cACEY,MACAX,kBACE,YAAYqB,OAAO,EACnB,SACA,OACA,OACA,QACAT,QAAQY,aAAa,GAEvBxB,kBACEK,cACAC,uBACA,OACA,OACA,SAEFM,SACA;QACEU,mBAAmBrB,kBAAkBsB,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAMpB,cACJQ,MACAX,kBACEK,cACAC,uBACA,OACA,OACA,QACA,aAEF,CAAC,EAAE,EAAEM,QAAQe,gBAAgB,CAAC,GAAG,CAAC;IAEpC,MAAMxB,cACJQ,MACAX,kBACEK,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA;;CAEC,GACD,MAAMS,gCAAgC,CACpCJ,MACAC;IAEA,iCAAiC;IACjCb,cACEY,MACAX,kBACE,YAAYqB,OAAO,EACnB,SACA,aACA,QACA,OACAT,QAAQY,aAAa,GAEvBxB,kBAAkBK,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAEqB,cAAcpB,YAAYqB,KAAK;QAAE,GAAGpB,2BAA2B;IAAC,GAClE;QACEa,mBAAmBrB,kBAAkBsB,YAAY;IACnD;IAGF,yCAAyC;IACzCxB,cACEY,MACAX,kBACE,YAAYqB,OAAO,EACnB,SACA,aACA,OACA,QACAT,QAAQY,aAAa,GAEvBxB,kBAAkBK,cAAcE,sBAAsB,OAAO,OAAO,SACpE;QAAE,GAAGK,OAAO;QAAE,GAAGH,2BAA2B;IAAC,GAC7C;QACEa,mBAAmBrB,kBAAkBsB,YAAY;IACnD;AAEJ"}

package/src/utils/api-constructs/files/cdk/core/api/http/http-api.ts.template

@@ -5,7 +5,7 @@ import {
   HttpApiIntegration,
   OperationDetails,
 } from './utils.js';
-import { CfnOutput } from 'aws-cdk-lib';
+import { CfnOutput, Stack } from 'aws-cdk-lib';
 import {
   HttpApi as _HttpApi,
   HttpApiProps as _HttpApiProps,
@@ -15,6 +15,8 @@ import {
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
 import { LogGroup } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { suppressRules } from '../checkov.js';
 
 /**
@@ -91,12 +93,18 @@ export class HttpApi<
       ...props,
     });
 
-    const accessLogGroup = new LogGroup(this, 'AccessLogs');
-    suppressRules(
-      accessLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption',
+    // Customer-managed key for access log encryption at rest
+    const logsKey = new Key(this, 'AccessLogsKey', {
+      enableKeyRotation: true,
+    });
+    const stack = Stack.of(this);
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(`logs.${stack.region}.amazonaws.com`),
     );
+
+    const accessLogGroup = new LogGroup(this, 'AccessLogs', {
+      encryptionKey: logsKey,
+    });
     suppressRules(
       accessLogGroup,
       ['CKV_AWS_66', 'CKV_AWS_338'],

package/src/utils/api-constructs/files/cdk/core/api/rest/api-gateway-account/index.js.template

@@ -0,0 +1,58 @@
+/**
+ * Configures the account-level API Gateway CloudWatch Logs role required for
+ * REST API access logging. The setting is a singleton per region per account,
+ * so this handler only writes when no live role is already configured (the
+ * first stack to deploy wins, others defer) and never resets it on delete.
+ */
+const {
+  APIGatewayClient,
+  GetAccountCommand,
+  UpdateAccountCommand,
+} = require('@aws-sdk/client-api-gateway');
+const { IAMClient, GetRoleCommand } = require('@aws-sdk/client-iam');
+
+const apigw = new APIGatewayClient();
+const iam = new IAMClient();
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+const hasLiveRole = async () => {
+  const { cloudwatchRoleArn } = await apigw.send(new GetAccountCommand({}));
+  if (!cloudwatchRoleArn) return false;
+  try {
+    await iam.send(
+      new GetRoleCommand({ RoleName: cloudwatchRoleArn.split('/').pop() }),
+    );
+    return true;
+  } catch (e) {
+    if (e.name === 'NoSuchEntityException') return false;
+    throw e;
+  }
+};
+
+const RETRYABLE = ['BadRequestException', 'TooManyRequestsException'];
+
+const setRole = async (value) => {
+  const command = new UpdateAccountCommand({
+    patchOperations: [{ op: 'replace', path: '/cloudwatchRoleArn', value }],
+  });
+  // Retry while the freshly created role propagates through IAM, and on throttling
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await apigw.send(command);
+    } catch (e) {
+      if (RETRYABLE.includes(e.name) && attempt < 11) {
+        await sleep(5000);
+      } else {
+        throw e;
+      }
+    }
+  }
+};
+
+exports.handler = async (event) => {
+  if (event.RequestType !== 'Delete' && !(await hasLiveRole())) {
+    await setRole(event.ResourceProperties.CloudWatchRoleArn);
+  }
+  return { PhysicalResourceId: 'ApiGatewayAccount' };
+};

package/src/utils/api-constructs/files/cdk/core/api/rest/api-gateway-account.ts.template

@@ -0,0 +1,82 @@
+import { Construct } from 'constructs';
+import * as url from 'url';
+import { CustomResource, Duration, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import {
+  ManagedPolicy,
+  PolicyStatement,
+  Role,
+  ServicePrincipal,
+} from 'aws-cdk-lib/aws-iam';
+import { Code, Function, Runtime } from 'aws-cdk-lib/aws-lambda';
+import { Provider } from 'aws-cdk-lib/custom-resources';
+
+const ApiGatewayAccountKey = '__ApiGatewayAccount__';
+
+/**
+ * Stack-scoped singleton that configures the account-level CloudWatch Logs role
+ * used by API Gateway REST APIs for access logging.
+ *
+ * `AWS::ApiGateway::Account` is a singleton per region per account, so it is
+ * managed via an idempotent custom resource: the role is set only when none is
+ * already configured, and is never reset on delete. This keeps logging working
+ * across multiple stacks sharing an account without one clobbering another.
+ */
+export class ApiGatewayAccount extends Construct {
+  static ensure(scope: Construct): ApiGatewayAccount {
+    const stack = Stack.of(scope);
+    return (
+      (stack.node.tryFindChild(ApiGatewayAccountKey) as ApiGatewayAccount) ??
+      new ApiGatewayAccount(stack, ApiGatewayAccountKey)
+    );
+  }
+
+  public readonly resource: CustomResource;
+
+  private constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    const cloudWatchRole = new Role(this, 'CloudWatchRole', {
+      assumedBy: new ServicePrincipal('apigateway.amazonaws.com'),
+      managedPolicies: [
+        ManagedPolicy.fromAwsManagedPolicyName(
+          'service-role/AmazonAPIGatewayPushToCloudWatchLogs',
+        ),
+      ],
+    });
+    cloudWatchRole.applyRemovalPolicy(RemovalPolicy.RETAIN);
+
+    const onEvent = new Function(this, 'OnEvent', {
+      runtime: Runtime.NODEJS_LATEST,
+      handler: 'index.handler',
+      timeout: Duration.minutes(2),
+      code: Code.fromAsset(
+        url.fileURLToPath(new URL('./api-gateway-account', import.meta.url)),
+      ),
+    });
+    const { region } = Stack.of(this);
+    onEvent.addToRolePolicy(
+      new PolicyStatement({
+        actions: ['apigateway:GET', 'apigateway:PATCH'],
+        resources: [`arn:aws:apigateway:${region}::/account`],
+      }),
+    );
+    onEvent.addToRolePolicy(
+      new PolicyStatement({
+        actions: ['iam:PassRole'],
+        resources: [cloudWatchRole.roleArn],
+      }),
+    );
+    // Read-only; inspects whichever role the account currently references
+    onEvent.addToRolePolicy(
+      new PolicyStatement({ actions: ['iam:GetRole'], resources: ['*'] }),
+    );
+
+    this.resource = new CustomResource(this, 'Resource', {
+      serviceToken: new Provider(this, 'Provider', { onEventHandler: onEvent })
+        .serviceToken,
+      resourceType: 'Custom::ApiGatewayAccount',
+      properties: { CloudWatchRoleArn: cloudWatchRole.roleArn },
+    });
+    this.resource.node.addDependency(cloudWatchRole);
+  }
+}

package/src/utils/api-constructs/files/cdk/core/api/rest/rest-api.ts.template

@@ -1,6 +1,8 @@
 import { Construct, IConstruct } from 'constructs';
 import {
+  AccessLogFormat,
   Cors,
+  LogGroupLogDestination,
   Resource,
   RestApi as _RestApi,
   RestApiProps as _RestApiProps,
@@ -8,14 +10,17 @@ import {
   Stage,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, RemovalPolicy } from 'aws-cdk-lib';
+import { IAspect, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
   CfnWebACLAssociation,
 } from 'aws-cdk-lib/aws-wafv2';
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { RuntimeConfig } from '../runtime-config.js';
+import { ApiGatewayAccount } from './api-gateway-account.js';
 import {
   ApiIntegrations,
   OperationDetails,
@@ -100,10 +105,28 @@ export class RestApi<
     super(scope, id);
     this.integrations = integrations;
 
+    // Account-level CloudWatch role required for REST API access logging
+    const account = ApiGatewayAccount.ensure(this);
+
+    // KMS key for encrypting logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'LogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(`logs.${Stack.of(this).region}.amazonaws.com`),
+    );
+
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+    });
+
     // Create the API Gateway REST API
     this.api = new _RestApi(this, 'Api', {
       ...props,
       deployOptions: {
+        accessLogDestination: new LogGroupLogDestination(accessLogs),
+        accessLogFormat: AccessLogFormat.jsonWithStandardFields(),
         ...props.deployOptions,
         methodOptions: {
           ...props.deployOptions?.methodOptions,
@@ -116,6 +139,8 @@ export class RestApi<
         },
       },
     });
+    // Ensure the account-level role is configured before the stage is created
+    this.api.deploymentStage.node.addDependency(account.resource);
 
     if (enableWaf) {
       this.webAcl = new CfnWebACL(this, 'WebAcl', {
@@ -182,14 +207,9 @@ export class RestApi<
       // `aws-waf-logs-` to satisfy the WAFv2 logging destination requirement.
       const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
         logGroupName: `aws-waf-logs-${apiName}-${this.node.addr.slice(-8)}`,
-        retention: RetentionDays.ONE_MONTH,
-        removalPolicy: RemovalPolicy.DESTROY,
+        retention: RetentionDays.ONE_YEAR,
+        encryptionKey: logsKey,
       });
-      suppressRules(
-        wafLogGroup,
-        ['CKV_AWS_158'],
-        'Using default CloudWatch log encryption for WAF logs',
-      );
 
       new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
         resourceArn: this.webAcl.attrArn,
@@ -203,12 +223,6 @@ export class RestApi<
       'Caching not required for this use case',
       (c) => c instanceof Stage,
     );
-    suppressRules(
-      this.api,
-      ['CKV_AWS_76'],
-      'API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement',
-      (c) => c instanceof Stage,
-    );
 
     // Resolve the integration for a given operation.
     // If the operation has a dedicated integration, use it; otherwise fall back to $router.

package/src/utils/api-constructs/files/terraform/app/apis/http/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }
@@ -74,12 +74,6 @@ variable "cors_expose_headers" {
   default     = []
 }
 
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -130,7 +124,6 @@ module "http_api" {
   cors_allow_methods     = var.cors_allow_methods
   cors_allow_origins     = var.cors_allow_origins
   cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
 
   # Tags
   tags = var.tags

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }
@@ -105,6 +105,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -509,11 +514,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "<%- apiNameClassName %> API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/<%- apiNameKebabCase %>-${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/<%- apiNameKebabCase %>-${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/<%- apiNameKebabCase %>-${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -521,9 +578,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy

package/src/utils/api-constructs/files/terraform/core/api/http/http-api/http-api.tf.template

@@ -7,7 +7,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }

package/src/utils/api-constructs/files/terraform/core/api/rest/api-gateway-account/api-gateway-account.tf.template

@@ -0,0 +1,83 @@
+# Account-level CloudWatch Logs role used by API Gateway REST APIs for access
+# logging. The setting is a singleton per region per account, so it is managed
+# idempotently: the role is set only when none is already configured (the first
+# deployment wins, others defer) and is never reset on destroy. This keeps
+# logging working across multiple deployments sharing an account.
+
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+  }
+}
+
+data "aws_region" "current" {}
+
+resource "aws_iam_role" "cloudwatch" {
+  name_prefix = "apigw-cloudwatch-"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "apigateway.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "cloudwatch" {
+  role       = aws_iam_role.cloudwatch.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
+}
+
+# Configures the account role on create/update only; destroying this resource is
+# a no-op, so teardown never disables logging for other REST APIs in the region.
+resource "terraform_data" "account" {
+  triggers_replace = [aws_iam_role.cloudwatch.arn]
+
+  provisioner "local-exec" {
+    command = "uv run --with boto3<%= boto3Version %> python -c \"$SCRIPT\""
+    environment = {
+      ROLE_ARN = aws_iam_role.cloudwatch.arn
+      REGION   = data.aws_region.current.region
+      SCRIPT   = <<-PY
+        import os, time, boto3
+        from botocore.exceptions import ClientError
+        apigw = boto3.client("apigateway", region_name=os.environ["REGION"])
+
+        def has_live_role():
+            arn = apigw.get_account().get("cloudwatchRoleArn")
+            if not arn:
+                return False
+            try:
+                boto3.client("iam").get_role(RoleName=arn.split("/")[-1])
+                return True
+            except ClientError as e:
+                if e.response["Error"]["Code"] == "NoSuchEntity":
+                    return False
+                raise
+
+        if not has_live_role():
+            op = {"op": "replace", "path": "/cloudwatchRoleArn", "value": os.environ["ROLE_ARN"]}
+            # Retry while the freshly created role propagates through IAM, and on throttling
+            retryable = ("BadRequestException", "TooManyRequestsException")
+            for attempt in range(12):
+                try:
+                    apigw.update_account(patchOperations=[op])
+                    break
+                except ClientError as e:
+                    if e.response["Error"]["Code"] in retryable and attempt < 11:
+                        time.sleep(5)
+                    else:
+                        raise
+      PY
+    }
+  }
+
+  depends_on = [aws_iam_role_policy_attachment.cloudwatch]
+}

package/src/utils/api-constructs/files/terraform/core/api/rest/rest-api/rest-api.tf.template

@@ -7,11 +7,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "<%- awsProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -81,8 +81,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -99,10 +97,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -260,6 +256,4 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Stage, deployment and access log outputs are provided by the consuming module