@aws/nx-plugin 1.0.0-rc.3 → 1.0.0-rc.30

package/src/utils/function-constructs/function-constructs.js

@@ -1,52 +1,47 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addLambdaFunctionInfra = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
-const ast_1 = require("../ast");
-const nx_1 = require("../nx");
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { terraformProviderVersions } from "../versions.js";
 /**
  * Add infrastructure for a lambda function
- */
-const addLambdaFunctionInfra = async (tree, options) => {
+ */ export const addLambdaFunctionInfra = async (tree, options)=>{
     if (options.iac === 'cdk') {
         await addLambdaFunctionCdkConstructs(tree, options);
-    }
-    else if (options.iac === 'terraform') {
+    } else if (options.iac === 'terraform') {
         addLambdaFunctionTerraformModules(tree, options);
-    }
-    else {
+    } else {
         throw new Error(`Unsupported iac ${options.iac}`);
     }
-    (0, devkit_1.updateJson)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, options.iac === 'cdk' ? shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR : shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'project.json'), (config) => {
-        (0, nx_1.addDependencyToTargetIfNotPresent)(config, 'build', `${options.functionProjectName}:build`);
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addDependencyToTargetIfNotPresent(config, 'build', `${options.functionProjectName}:build`);
         return config;
     });
 };
-exports.addLambdaFunctionInfra = addLambdaFunctionInfra;
-const addLambdaFunctionCdkConstructs = async (tree, options) => {
+const addLambdaFunctionCdkConstructs = async (tree, options)=>{
     // Generate app specific CDK construct
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'app', 'lambda-functions'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'lambda-functions'), {
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'lambda-functions'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'lambda-functions'), {
         ...options,
-        runtime: `Runtime.${options.runtime === 'python' ? 'PYTHON_3_14' : 'NODEJS_LATEST'}`,
+        runtime: `Runtime.${options.runtime === 'python' ? 'PYTHON_3_14' : 'NODEJS_LATEST'}`
     }, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     // Export app specific CDK construct
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'lambda-functions', 'index.ts'), `./${options.nameKebabCase}.js`);
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './lambda-functions/index.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'lambda-functions', 'index.ts'), `./${options.nameKebabCase}.js`);
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './lambda-functions/index.js');
 };
-const addLambdaFunctionTerraformModules = (tree, options) => {
+const addLambdaFunctionTerraformModules = (tree, options)=>{
     // Generate app specific terraform module
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'app', 'lambda-functions'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'app', 'lambda-functions'), {
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'lambda-functions'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'lambda-functions'), {
         ...options,
         runtime: options.runtime === 'python' ? 'python3.14' : 'nodejs22.x',
+        ...terraformProviderVersions()
     }, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
 };
+
 //# sourceMappingURL=function-constructs.js.map

package/src/utils/function-constructs/function-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"function-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/function-constructs/function-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,gFAIwC;AACxC,gCAAuC;AAEvC,8BAA0D;AAW1D;;GAEG;AACI,MAAM,sBAAsB,GAAG,KAAK,EACzC,IAAU,EACV,OAEC,EACD,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,iCAAiC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,mDAAqB,CAAC,CAAC,CAAC,kDAAoB,EACpE,cAAc,CACf,EACD,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAA,sCAAiC,EAC/B,MAAM,EACN,OAAO,EACP,GAAG,OAAO,CAAC,mBAAmB,QAAQ,CACvC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AA9BW,QAAA,sBAAsB,0BA8BjC;AAEF,MAAM,8BAA8B,GAAG,KAAK,EAC1C,IAAU,EACV,OAA0C,EAC1C,EAAE;IACF,sCAAsC;IACtC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,EACvE,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,kBAAkB,CACnB,EACD;QACE,GAAG,OAAO;QACV,OAAO,EAAE,WAAW,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE;KACrF,EACD;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,oCAAoC;IACpC,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,kBAAkB,EAClB,UAAU,CACX,EACD,KAAK,OAAO,CAAC,aAAa,KAAK,CAChC,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,6BAA6B,CAC9B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iCAAiC,GAAG,CACxC,IAAU,EACV,OAA0C,EAC1C,EAAE;IACF,yCAAyC;IACzC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,WAAW,EACX,KAAK,EACL,kBAAkB,CACnB,EACD,IAAA,0BAAiB,EACf,0CAAY,EACZ,kDAAoB,EACpB,KAAK,EACL,KAAK,EACL,kBAAkB,CACnB,EACD;QACE,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;KACpE,EACD;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/function-constructs/function-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { terraformProviderVersions } from '../versions';\n\nexport interface AddLambdaFunctionConstructOptions {\n  functionProjectName: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  bundlePathFromRoot: string;\n  handler: string;\n  runtime: 'node' | 'python';\n}\n\n/**\n * Add infrastructure for a lambda function\n */\nexport const addLambdaFunctionInfra = async (\n  tree: Tree,\n  options: AddLambdaFunctionConstructOptions & {\n    iac: Iac;\n  },\n) => {\n  if (options.iac === 'cdk') {\n    await addLambdaFunctionCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addLambdaFunctionTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.functionProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addLambdaFunctionCdkConstructs = async (\n  tree: Tree,\n  options: AddLambdaFunctionConstructOptions,\n) => {\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'lambda-functions',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'lambda-functions',\n    ),\n    {\n      ...options,\n      runtime: `Runtime.${options.runtime === 'python' ? 'PYTHON_3_14' : 'NODEJS_LATEST'}`,\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'lambda-functions',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './lambda-functions/index.js',\n  );\n};\n\nconst addLambdaFunctionTerraformModules = (\n  tree: Tree,\n  options: AddLambdaFunctionConstructOptions,\n) => {\n  // Generate app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'lambda-functions',\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_TERRAFORM_DIR,\n      'src',\n      'app',\n      'lambda-functions',\n    ),\n    {\n      ...options,\n      runtime: options.runtime === 'python' ? 'python3.14' : 'nodejs22.x',\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","terraformProviderVersions","addLambdaFunctionInfra","tree","options","iac","addLambdaFunctionCdkConstructs","addLambdaFunctionTerraformModules","Error","config","functionProjectName","dirname","runtime","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,yBAAyB,QAAQ,iBAAc;AAWxD;;CAEC,GACD,OAAO,MAAMC,yBAAyB,OACpCC,MACAC;IAIA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,+BAA+BH,MAAMC;IAC7C,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,kCAAkCJ,MAAMC;IAC1C,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAV,WACEQ,MACAV,kBACEK,cACAM,QAAQC,GAAG,KAAK,QAAQN,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGL,QAAQM,mBAAmB,CAAC,MAAM,CAAC;QAExC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMH,iCAAiC,OACrCH,MACAC;IAEA,sCAAsC;IACtCZ,cACEW,MACAV,kBACE,YAAYkB,OAAO,EACnB,SACA,OACA,OACA,qBAEFlB,kBACEK,cACAC,uBACA,OACA,OACA,qBAEF;QACE,GAAGK,OAAO;QACVQ,SAAS,CAAC,QAAQ,EAAER,QAAQQ,OAAO,KAAK,WAAW,gBAAgB,iBAAiB;IACtF,GACA;QACEC,mBAAmBnB,kBAAkBoB,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAMlB,cACJO,MACAV,kBACEK,cACAC,uBACA,OACA,OACA,oBACA,aAEF,CAAC,EAAE,EAAEK,QAAQW,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAMnB,cACJO,MACAV,kBACEK,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA,MAAMQ,oCAAoC,CACxCJ,MACAC;IAEA,yCAAyC;IACzCZ,cACEW,MACAV,kBACE,YAAYkB,OAAO,EACnB,SACA,aACA,OACA,qBAEFlB,kBACEK,cACAE,sBACA,OACA,OACA,qBAEF;QACE,GAAGI,OAAO;QACVQ,SAASR,QAAQQ,OAAO,KAAK,WAAW,eAAe;QACvD,GAAGX,2BAA2B;IAChC,GACA;QACEY,mBAAmBnB,kBAAkBoB,YAAY;IACnD;AAEJ"}

package/src/utils/generators.d.ts

@@ -1,3 +1,7 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
 export interface GeneratorInfo {
     readonly id: string;
     readonly metric: string;

package/src/utils/generators.js

@@ -1,26 +1,24 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildGeneratorInfoList = void 0;
-const tslib_1 = require("tslib");
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const generators_json_1 = tslib_1.__importDefault(require("../../generators.json"));
-const path = tslib_1.__importStar(require("path"));
+ */ import * as path from "path";
+import GeneratorsJson from "../../generators.json" with {
+    type: 'json'
+};
 /**
  * Build the list of generator info, resolving schema/factory paths relative to the given base directory.
- */
-const buildGeneratorInfoList = (baseDir) => Object.entries(generators_json_1.default.generators).map(([id, info]) => ({
-    id,
-    metric: info.metric,
-    resolvedFactoryPath: path.resolve(baseDir, info.factory),
-    resolvedSchemaPath: path.resolve(baseDir, info.schema),
-    description: info.description,
-    ...('hidden' in info && info.hidden ? { hidden: info.hidden } : {}),
-    ...('guidePages' in info && info.guidePages
-        ? { guidePages: info.guidePages }
-        : {}),
-}));
-exports.buildGeneratorInfoList = buildGeneratorInfoList;
+ */ export const buildGeneratorInfoList = (baseDir)=>Object.entries(GeneratorsJson.generators).map(([id, info])=>({
+            id,
+            metric: info.metric,
+            resolvedFactoryPath: path.resolve(baseDir, info.factory),
+            resolvedSchemaPath: path.resolve(baseDir, info.schema),
+            description: info.description,
+            ...'hidden' in info && info.hidden ? {
+                hidden: info.hidden
+            } : {},
+            ...'guidePages' in info && info.guidePages ? {
+                guidePages: info.guidePages
+            } : {}
+        }));
+
 //# sourceMappingURL=generators.js.map

package/src/utils/generators.js.map

@@ -1 +1 @@
-{"version":3,"file":"generators.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/generators.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,oFAAmD;AACnD,mDAA6B;AAiB7B;;GAEG;AACI,MAAM,sBAAsB,GAAG,CAAC,OAAe,EAAmB,EAAE,CACzE,MAAM,CAAC,OAAO,CAAE,yBAAsC,CAAC,UAAU,CAAC,CAAC,GAAG,CACpE,CAAC,CAAC,EAAE,EAAE,IAAI,CAAgB,EAAE,EAAE,CAAC,CAAC;IAC9B,EAAE;IACF,MAAM,EAAE,IAAI,CAAC,MAAM;IACnB,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;IACxD,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,IAAI,CAAC,WAAW;IAC7B,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU;QACzC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;QACjC,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CACH,CAAC;AAbS,QAAA,sBAAsB,0BAa/B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/generators.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport * as path from 'path';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\n\nexport interface GeneratorInfo {\n  readonly id: string;\n  readonly metric: string;\n  readonly resolvedFactoryPath: string;\n  readonly resolvedSchemaPath: string;\n  readonly hidden?: boolean;\n  readonly description: string;\n  readonly guidePages?: readonly string[];\n}\n\n/**\n * Alias for GeneratorInfo used by MCP server and generators\n */\nexport type NxGeneratorInfo = GeneratorInfo;\n\n/**\n * Build the list of generator info, resolving schema/factory paths relative to the given base directory.\n */\nexport const buildGeneratorInfoList = (baseDir: string): GeneratorInfo[] =>\n  Object.entries((GeneratorsJson as Record<string, any>).generators).map(\n    ([id, info]: [string, any]) => ({\n      id,\n      metric: info.metric,\n      resolvedFactoryPath: path.resolve(baseDir, info.factory),\n      resolvedSchemaPath: path.resolve(baseDir, info.schema),\n      description: info.description,\n      ...('hidden' in info && info.hidden ? { hidden: info.hidden } : {}),\n      ...('guidePages' in info && info.guidePages\n        ? { guidePages: info.guidePages }\n        : {}),\n    }),\n  );\n"],"names":["path","GeneratorsJson","type","buildGeneratorInfoList","baseDir","Object","entries","generators","map","id","info","metric","resolvedFactoryPath","resolve","factory","resolvedSchemaPath","schema","description","hidden","guidePages"],"mappings":"AAAA;;;CAGC,GAED,YAAYA,UAAU,OAAO;AAC7B,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AAiBzE;;CAEC,GACD,OAAO,MAAMC,yBAAyB,CAACC,UACrCC,OAAOC,OAAO,CAAC,AAACL,eAAuCM,UAAU,EAAEC,GAAG,CACpE,CAAC,CAACC,IAAIC,KAAoB,GAAM,CAAA;YAC9BD;YACAE,QAAQD,KAAKC,MAAM;YACnBC,qBAAqBZ,KAAKa,OAAO,CAACT,SAASM,KAAKI,OAAO;YACvDC,oBAAoBf,KAAKa,OAAO,CAACT,SAASM,KAAKM,MAAM;YACrDC,aAAaP,KAAKO,WAAW;YAC7B,GAAI,YAAYP,QAAQA,KAAKQ,MAAM,GAAG;gBAAEA,QAAQR,KAAKQ,MAAM;YAAC,IAAI,CAAC,CAAC;YAClE,GAAI,gBAAgBR,QAAQA,KAAKS,UAAU,GACvC;gBAAEA,YAAYT,KAAKS,UAAU;YAAC,IAC9B,CAAC,CAAC;QACR,CAAA,GACA"}

package/src/utils/git.d.ts

@@ -2,7 +2,7 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Tree } from '@nx/devkit';
+import { type Tree } from '@nx/devkit';
 /**
  * Returns all files from the tree root that are not gitignored (both tracked and untracked)
  */

package/src/utils/git.js

@@ -1,62 +1,47 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateGitIgnore = exports.isWithinGitRepo = exports.getGitIncludedFiles = void 0;
-const tslib_1 = require("tslib");
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const child_process_1 = require("child_process");
-const lodash_uniqby_1 = tslib_1.__importDefault(require("lodash.uniqby"));
+ */ import { joinPathFragments } from "@nx/devkit";
+import { execSync } from "child_process";
+import uniqBy from "lodash.uniqby";
 /**
  * Returns all files from the tree root that are not gitignored (both tracked and untracked)
- */
-const getGitIncludedFiles = (tree) => {
+ */ export const getGitIncludedFiles = (tree)=>{
     return [
         // Git tracked files
-        ...(0, child_process_1.execSync)('git ls-files --exclude-standard', {
+        ...execSync('git ls-files --exclude-standard', {
             encoding: 'utf-8',
-            cwd: tree.root,
-        })
-            .split('\n')
-            .filter((x) => x),
+            cwd: tree.root
+        }).split('\n').filter((x)=>x),
         // Untracked files that aren't ignored
-        ...(0, child_process_1.execSync)('git ls-files --others --exclude-standard', {
+        ...execSync('git ls-files --others --exclude-standard', {
             encoding: 'utf-8',
-            cwd: tree.root,
-        })
-            .split('\n')
-            .filter((x) => x),
-    ].filter((f) => tree.exists(f));
+            cwd: tree.root
+        }).split('\n').filter((x)=>x)
+    ].filter((f)=>tree.exists(f));
 };
-exports.getGitIncludedFiles = getGitIncludedFiles;
 /**
  * Return whether or not a tree is within a git repo
- */
-const isWithinGitRepo = (tree) => {
+ */ export const isWithinGitRepo = (tree)=>{
     if (tree.exists('.git')) {
         return true;
     }
     try {
-        return (0, child_process_1.execSync)('git rev-parse --is-inside-work-tree', {
+        return execSync('git rev-parse --is-inside-work-tree', {
             encoding: 'utf-8',
-            cwd: tree.root,
+            cwd: tree.root
         }).startsWith('true');
-    }
-    catch {
+    } catch  {
         return false;
     }
 };
-exports.isWithinGitRepo = isWithinGitRepo;
 /**
  * Update a .gitignore file. Will create a new .gitignore file if it does not exist
- */
-const updateGitIgnore = (tree, dir, doUpdate) => {
-    const gitIgnorePath = (0, devkit_1.joinPathFragments)(dir, '.gitignore');
+ */ export const updateGitIgnore = (tree, dir, doUpdate)=>{
+    const gitIgnorePath = joinPathFragments(dir, '.gitignore');
     const existingPatterns = tree.read(gitIgnorePath, 'utf-8')?.split('\n') ?? [];
     const newPatterns = doUpdate(existingPatterns);
-    tree.write(gitIgnorePath, (0, lodash_uniqby_1.default)(newPatterns, (p) => p).join('\n'));
+    tree.write(gitIgnorePath, uniqBy(newPatterns, (p)=>p).join('\n'));
 };
-exports.updateGitIgnore = updateGitIgnore;
+
 //# sourceMappingURL=git.js.map

package/src/utils/git.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/git.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,uCAAqD;AACrD,iDAAyC;AACzC,0EAAmC;AAEnC;;GAEG;AACI,MAAM,mBAAmB,GAAG,CAAC,IAAU,EAAY,EAAE;IAC1D,OAAO;QACL,oBAAoB;QACpB,GAAG,IAAA,wBAAQ,EAAC,iCAAiC,EAAE;YAC7C,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,IAAI,CAAC,IAAI;SACf,CAAC;aACC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACnB,sCAAsC;QACtC,GAAG,IAAA,wBAAQ,EAAC,0CAA0C,EAAE;YACtD,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,IAAI,CAAC,IAAI;SACf,CAAC;aACC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;KACpB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC;AAjBW,QAAA,mBAAmB,uBAiB9B;AAEF;;GAEG;AACI,MAAM,eAAe,GAAG,CAAC,IAAU,EAAW,EAAE;IACrD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAA,wBAAQ,EAAC,qCAAqC,EAAE;YACrD,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,IAAI,CAAC,IAAI;SACf,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,eAAe,mBAY1B;AAEF;;GAEG;AACI,MAAM,eAAe,GAAG,CAC7B,IAAU,EACV,GAAW,EACX,QAA0C,EAC1C,EAAE;IACF,MAAM,aAAa,GAAG,IAAA,0BAAiB,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,WAAW,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,IAAA,uBAAM,EAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC;AATW,QAAA,eAAe,mBAS1B"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/git.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { joinPathFragments, type Tree } from '@nx/devkit';\nimport { execSync } from 'child_process';\nimport uniqBy from 'lodash.uniqby';\n\n/**\n * Returns all files from the tree root that are not gitignored (both tracked and untracked)\n */\nexport const getGitIncludedFiles = (tree: Tree): string[] => {\n  return [\n    // Git tracked files\n    ...execSync('git ls-files --exclude-standard', {\n      encoding: 'utf-8',\n      cwd: tree.root,\n    })\n      .split('\\n')\n      .filter((x) => x),\n    // Untracked files that aren't ignored\n    ...execSync('git ls-files --others --exclude-standard', {\n      encoding: 'utf-8',\n      cwd: tree.root,\n    })\n      .split('\\n')\n      .filter((x) => x),\n  ].filter((f) => tree.exists(f));\n};\n\n/**\n * Return whether or not a tree is within a git repo\n */\nexport const isWithinGitRepo = (tree: Tree): boolean => {\n  if (tree.exists('.git')) {\n    return true;\n  }\n  try {\n    return execSync('git rev-parse --is-inside-work-tree', {\n      encoding: 'utf-8',\n      cwd: tree.root,\n    }).startsWith('true');\n  } catch {\n    return false;\n  }\n};\n\n/**\n * Update a .gitignore file. Will create a new .gitignore file if it does not exist\n */\nexport const updateGitIgnore = (\n  tree: Tree,\n  dir: string,\n  doUpdate: (patterns: string[]) => string[],\n) => {\n  const gitIgnorePath = joinPathFragments(dir, '.gitignore');\n  const existingPatterns = tree.read(gitIgnorePath, 'utf-8')?.split('\\n') ?? [];\n  const newPatterns = doUpdate(existingPatterns);\n  tree.write(gitIgnorePath, uniqBy(newPatterns, (p) => p).join('\\n'));\n};\n"],"names":["joinPathFragments","execSync","uniqBy","getGitIncludedFiles","tree","encoding","cwd","root","split","filter","x","f","exists","isWithinGitRepo","startsWith","updateGitIgnore","dir","doUpdate","gitIgnorePath","existingPatterns","read","newPatterns","write","p","join"],"mappings":"AAAA;;;CAGC,GACD,SAASA,iBAAiB,QAAmB,aAAa;AAC1D,SAASC,QAAQ,QAAQ,gBAAgB;AACzC,OAAOC,YAAY,gBAAgB;AAEnC;;CAEC,GACD,OAAO,MAAMC,sBAAsB,CAACC;IAClC,OAAO;QACL,oBAAoB;WACjBH,SAAS,mCAAmC;YAC7CI,UAAU;YACVC,KAAKF,KAAKG,IAAI;QAChB,GACGC,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,IAAMA;QACjB,sCAAsC;WACnCT,SAAS,4CAA4C;YACtDI,UAAU;YACVC,KAAKF,KAAKG,IAAI;QAChB,GACGC,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,IAAMA;KAClB,CAACD,MAAM,CAAC,CAACE,IAAMP,KAAKQ,MAAM,CAACD;AAC9B,EAAE;AAEF;;CAEC,GACD,OAAO,MAAME,kBAAkB,CAACT;IAC9B,IAAIA,KAAKQ,MAAM,CAAC,SAAS;QACvB,OAAO;IACT;IACA,IAAI;QACF,OAAOX,SAAS,uCAAuC;YACrDI,UAAU;YACVC,KAAKF,KAAKG,IAAI;QAChB,GAAGO,UAAU,CAAC;IAChB,EAAE,OAAM;QACN,OAAO;IACT;AACF,EAAE;AAEF;;CAEC,GACD,OAAO,MAAMC,kBAAkB,CAC7BX,MACAY,KACAC;IAEA,MAAMC,gBAAgBlB,kBAAkBgB,KAAK;IAC7C,MAAMG,mBAAmBf,KAAKgB,IAAI,CAACF,eAAe,UAAUV,MAAM,SAAS,EAAE;IAC7E,MAAMa,cAAcJ,SAASE;IAC7Bf,KAAKkB,KAAK,CAACJ,eAAehB,OAAOmB,aAAa,CAACE,IAAMA,GAAGC,IAAI,CAAC;AAC/D,EAAE"}

package/src/utils/iac-providers.js

@@ -1,9 +1,9 @@
-"use strict";
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IAC_PROVIDERS = void 0;
-exports.IAC_PROVIDERS = ['cdk', 'terraform'];
+ */ export const IAC_PROVIDERS = [
+    'cdk',
+    'terraform'
+];
+
 //# sourceMappingURL=iac-providers.js.map

package/src/utils/iac-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"iac-providers.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/iac-providers.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEU,QAAA,aAAa,GAAG,CAAC,KAAK,EAAE,WAAW,CAAU,CAAC"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/iac-providers.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nexport const IAC_PROVIDERS = ['cdk', 'terraform'] as const;\n\nexport type Iac = (typeof IAC_PROVIDERS)[number];\n\nexport type IacOption = Iac | 'inherit';\n"],"names":["IAC_PROVIDERS"],"mappings":"AAAA;;;CAGC,GAED,OAAO,MAAMA,gBAAgB;IAAC;IAAO;CAAY,CAAU"}

package/src/utils/iac.d.ts

@@ -2,7 +2,7 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Tree } from '@nx/devkit';
+import type { Tree } from '@nx/devkit';
 export { IAC_PROVIDERS, type Iac, type IacOption } from './iac-providers';
 import { IAC_PROVIDERS } from './iac-providers';
 /**

package/src/utils/iac.js

@@ -1,25 +1,23 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveIac = exports.IAC_PROVIDERS = void 0;
-const utils_1 = require("./config/utils");
-var iac_providers_1 = require("./iac-providers");
-Object.defineProperty(exports, "IAC_PROVIDERS", { enumerable: true, get: function () { return iac_providers_1.IAC_PROVIDERS; } });
-const iac_providers_2 = require("./iac-providers");
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { AWS_NX_PLUGIN_CONFIG_FILE_NAME, readAwsNxPluginConfig } from "./config/utils.js";
+export { IAC_PROVIDERS } from "./iac-providers.js";
+import { IAC_PROVIDERS } from "./iac-providers.js";
 /**
  * Given an iac provider option, resolve the actual iac provider to use
- */
-const resolveIac = async (tree, iacOption) => {
+ */ export const resolveIac = async (tree, iacOption)=>{
     if (iacOption === 'inherit') {
-        const pluginConfig = await (0, utils_1.readAwsNxPluginConfig)(tree);
+        const pluginConfig = await readAwsNxPluginConfig(tree);
         if (!pluginConfig?.iac?.provider) {
-            throw new Error(`IaC provider "inherit" requires iac.provider to be set in ${utils_1.AWS_NX_PLUGIN_CONFIG_FILE_NAME}`);
+            throw new Error(`IaC provider "inherit" requires iac.provider to be set in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME}`);
         }
-        if (!iac_providers_2.IAC_PROVIDERS.includes(pluginConfig.iac.provider)) {
-            throw new Error(`iac.provider in ${utils_1.AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${iac_providers_2.IAC_PROVIDERS.join(', ')}`);
+        if (!IAC_PROVIDERS.includes(pluginConfig.iac.provider)) {
+            throw new Error(`iac.provider in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${IAC_PROVIDERS.join(', ')}`);
         }
         return pluginConfig.iac.provider;
     }
     return iacOption;
 };
-exports.resolveIac = resolveIac;
+
 //# sourceMappingURL=iac.js.map

package/src/utils/iac.js.map

@@ -1 +1 @@
-{"version":3,"file":"iac.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/iac.ts"],"names":[],"mappings":";;;AAKA,0CAGwB;AAExB,iDAA0E;AAAjE,8GAAA,aAAa,OAAA;AACtB,mDAAgD;AAYhD;;GAEG;AACI,MAAM,UAAU,GAAG,KAAK,EAC7B,IAAU,EACV,SAA0C,EACD,EAAE;IAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,IAAA,6BAAqB,EAAC,IAAI,CAAC,CAAC;QAEvD,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6DAA6D,sCAA8B,EAAE,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,6BAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,mBAAmB,sCAA8B,mBAAmB,6BAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AArBW,QAAA,UAAU,cAqBrB"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/iac.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport {\n  AWS_NX_PLUGIN_CONFIG_FILE_NAME,\n  readAwsNxPluginConfig,\n} from './config/utils';\n\nexport { IAC_PROVIDERS, type Iac, type IacOption } from './iac-providers';\n\nimport { IAC_PROVIDERS } from './iac-providers';\n\n/**\n * Configuration for infrastructure as code\n */\nexport interface IacConfig {\n  /**\n   * Default provider for infrastructure as code\n   */\n  provider: (typeof IAC_PROVIDERS)[number];\n}\n\n/**\n * Given an iac provider option, resolve the actual iac provider to use\n */\nexport const resolveIac = async (\n  tree: Tree,\n  iacOption: 'cdk' | 'terraform' | 'inherit',\n): Promise<(typeof IAC_PROVIDERS)[number]> => {\n  if (iacOption === 'inherit') {\n    const pluginConfig = await readAwsNxPluginConfig(tree);\n\n    if (!pluginConfig?.iac?.provider) {\n      throw new Error(\n        `IaC provider \"inherit\" requires iac.provider to be set in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME}`,\n      );\n    }\n    if (!IAC_PROVIDERS.includes(pluginConfig.iac.provider)) {\n      throw new Error(\n        `iac.provider in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${IAC_PROVIDERS.join(', ')}`,\n      );\n    }\n\n    return pluginConfig.iac.provider;\n  }\n  return iacOption;\n};\n"],"names":["AWS_NX_PLUGIN_CONFIG_FILE_NAME","readAwsNxPluginConfig","IAC_PROVIDERS","resolveIac","tree","iacOption","pluginConfig","iac","provider","Error","includes","join"],"mappings":"AAAA;;;CAGC,GAED,SACEA,8BAA8B,EAC9BC,qBAAqB,QAChB,oBAAiB;AAExB,SAASC,aAAa,QAAkC,qBAAkB;AAE1E,SAASA,aAAa,QAAQ,qBAAkB;AAYhD;;CAEC,GACD,OAAO,MAAMC,aAAa,OACxBC,MACAC;IAEA,IAAIA,cAAc,WAAW;QAC3B,MAAMC,eAAe,MAAML,sBAAsBG;QAEjD,IAAI,CAACE,cAAcC,KAAKC,UAAU;YAChC,MAAM,IAAIC,MACR,CAAC,0DAA0D,EAAET,gCAAgC;QAEjG;QACA,IAAI,CAACE,cAAcQ,QAAQ,CAACJ,aAAaC,GAAG,CAACC,QAAQ,GAAG;YACtD,MAAM,IAAIC,MACR,CAAC,gBAAgB,EAAET,+BAA+B,gBAAgB,EAAEE,cAAcS,IAAI,CAAC,OAAO;QAElG;QAEA,OAAOL,aAAaC,GAAG,CAACC,QAAQ;IAClC;IACA,OAAOH;AACT,EAAE"}

package/src/utils/identity-constructs/files/cdk/core/user-identity.ts.template

@@ -2,23 +2,50 @@ import {
   IdentityPool,
   UserPoolAuthenticationProvider,
 } from 'aws-cdk-lib/aws-cognito-identitypool';
-import { CfnOutput, CfnResource, Duration, Lazy, Stack } from 'aws-cdk-lib';
+import {
+  CfnOutput,
+  CfnResource,
+  Duration,
+  Lazy,
+  RemovalPolicy,
+  Stack,
+} from 'aws-cdk-lib';
 import {
   AccountRecovery,
   CfnManagedLoginBranding,
-  CfnUserPoolDomain,
   FeaturePlan,
+  ManagedLoginVersion,
   Mfa,
   OAuthScope,
+  StandardThreatProtectionMode,
   UserPool,
   UserPoolClient,
+  UserPoolDomain,
 } from 'aws-cdk-lib/aws-cognito';
+import {
+  CfnLoggingConfiguration,
+  CfnWebACL,
+  CfnWebACLAssociation,
+} from 'aws-cdk-lib/aws-wafv2';
+import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
 import { suppressRules } from './checkov.js';
 
 const WEB_CLIENT_ID = 'WebClient';
+
+export interface UserIdentityProps {
+  /**
+   * Whether to enable AWS WAFv2 with the default managed ruleset
+   * (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet)
+   * and associate it with the user pool.
+   *
+   * @default true
+   */
+  readonly enableWaf?: boolean;
+}
+
 /**
  * Creates a UserPool and Identity Pool with sane defaults configured intended for usage from a web client.
  */
@@ -27,13 +54,20 @@ export class UserIdentity extends Construct {
   public readonly identityPool: IdentityPool;
   public readonly userPool: UserPool;
   public readonly userPoolClient: UserPoolClient;
-  public readonly userPoolDomain: CfnUserPoolDomain;
+  public readonly userPoolDomain: UserPoolDomain;
+
+  /** The WAFv2 Web ACL associated with the user pool, if WAF is enabled */
+  public readonly webAcl?: CfnWebACL;
 
-  constructor(scope: Construct, id: string) {
+  constructor(scope: Construct, id: string, { enableWaf = true }: UserIdentityProps = {}) {
     super(scope, id);
 
     this.region = Stack.of(this).region;
     this.userPool = this.createUserPool();
+
+    if (enableWaf) {
+      this.webAcl = this.createWebAcl(id, this.userPool);
+    }
     this.userPoolDomain = this.createUserPoolDomain(this.userPool);
     this.userPoolClient = this.createUserPoolClient(this.userPool);
     this.identityPool = this.createIdentityPool(
@@ -86,6 +120,8 @@ export class UserIdentity extends Construct {
       },
       mfa: Mfa.REQUIRED,
       featurePlan: FeaturePlan.PLUS,
+      // Audit-only logs threat assessments without blocking sign-in. Switch to FULL_FUNCTION to enforce automatic responses.
+      standardThreatProtectionMode: StandardThreatProtectionMode.AUDIT_ONLY,
       mfaSecondFactor: { sms: true, otp: true },
       signInCaseSensitive: false,
       signInAliases: { username: true, email: true },
@@ -118,21 +154,94 @@ export class UserIdentity extends Construct {
     return userPool;
   };
 
+  private createWebAcl = (id: string, userPool: UserPool) => {
+    const webAcl = new CfnWebACL(this, 'WebAcl', {
+      defaultAction: { allow: {} },
+      scope: 'REGIONAL',
+      visibilityConfig: {
+        cloudWatchMetricsEnabled: true,
+        metricName: `${id}WebAcl`,
+        sampledRequestsEnabled: true,
+      },
+      rules: [
+        {
+          name: 'CRSRule',
+          priority: 0,
+          statement: {
+            managedRuleGroupStatement: {
+              name: 'AWSManagedRulesCommonRuleSet',
+              vendorName: 'AWS',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: `${id}WebAcl-CRS`,
+            sampledRequestsEnabled: true,
+          },
+          overrideAction: {
+            none: {},
+          },
+        },
+        {
+          name: 'KnownBadInputsRule',
+          priority: 1,
+          statement: {
+            managedRuleGroupStatement: {
+              name: 'AWSManagedRulesKnownBadInputsRuleSet',
+              vendorName: 'AWS',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: `${id}WebAcl-KnownBadInputs`,
+            sampledRequestsEnabled: true,
+          },
+          overrideAction: {
+            none: {},
+          },
+        },
+      ],
+    });
+
+    new CfnWebACLAssociation(this, 'WebAclAssociation', {
+      resourceArn: userPool.userPoolArn,
+      webAclArn: webAcl.attrArn,
+    });
+
+    // Send WAF request logs to CloudWatch. The log group name must start with
+    // `aws-waf-logs-` to satisfy the WAFv2 logging destination requirement.
+    const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
+      logGroupName: `aws-waf-logs-${id}-${this.node.addr.slice(-8)}`,
+      retention: RetentionDays.ONE_MONTH,
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+    suppressRules(
+      wafLogGroup,
+      ['CKV_AWS_158'],
+      'Using default CloudWatch log encryption for WAF logs',
+    );
+
+    new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
+      resourceArn: webAcl.attrArn,
+      logDestinationConfigs: [wafLogGroup.logGroupArn],
+    });
+
+    return webAcl;
+  };
+
   private createUserPoolDomain = (userPool: UserPool) =>
-    new CfnUserPoolDomain(this, 'UserPoolDomain', {
-      domain: `<%= cognitoDomain %>-${Stack.of(this).account}`,
-      userPoolId: userPool.userPoolId,
-      managedLoginVersion: 2,
+    new UserPoolDomain(this, 'UserPoolDomain', {
+      userPool,
+      cognitoDomain: {
+        domainPrefix: `<%= cognitoDomain %>-${Stack.of(this).account}`,
+      },
+      managedLoginVersion: ManagedLoginVersion.NEWER_MANAGED_LOGIN,
     });
 
   private createUserPoolClient = (userPool: UserPool) => {
     const lazilyComputedCallbackUrls = Lazy.list({
       produce: () =>
-        [
-          'http://localhost:4200',
-          'http://localhost:4300',
-          `https://${Stack.of(this).region}.console.aws.amazon.com`,
-        ].concat(
+        ['http://localhost:4200', 'http://localhost:4300'].concat(
           this.findCloudFrontDistributions().map(
             (d) => `https://${d.domainName}`
           )
@@ -176,7 +285,7 @@ export class UserIdentity extends Construct {
   private createManagedLoginBranding = (
     userPool: UserPool,
     userPoolClient: UserPoolClient,
-    userPoolDomain: CfnUserPoolDomain
+    userPoolDomain: UserPoolDomain
   ) => {
     new CfnManagedLoginBranding(this, 'ManagedLoginBranding', {
       userPoolId: userPool.userPoolId,