@aws/nx-plugin 1.0.0-rc.3 → 1.0.0-rc.31

package/src/utils/dynamodb-constructs/files/terraform/app/dynamodb/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -0,0 +1,72 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
+  }
+}
+
+variable "billing_mode" {
+  description = "Controls how you are charged for read and write throughput."
+  type        = string
+  default     = "PAY_PER_REQUEST"
+}
+
+variable "point_in_time_recovery_enabled" {
+  description = "Whether to enable point-in-time recovery for the table."
+  type        = bool
+  default     = true
+}
+
+variable "deletion_protection_enabled" {
+  description = "Whether to enable deletion protection on the table."
+  type        = bool
+  default     = true
+}
+
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table."
+  type        = bool
+  default     = true
+}
+
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
+locals {
+  dynamodb_config = jsondecode(file("${path.module}/../../../../../../../<%= projectRoot %>/config.json"))
+  global_secondary_indexes = [for gsi in local.dynamodb_config.tableConfig.globalSecondaryIndexes : {
+    name            = gsi.indexName
+    hash_key        = gsi.partitionKey
+    range_key       = try(gsi.sortKey, null)
+    projection_type = "ALL"
+  }]
+}
+
+module "dynamodb_table" {
+  source                         = "../../../core/dynamodb"
+  name                           = "<%= tableName %>-${random_string.suffix.result}"
+  billing_mode                   = var.billing_mode
+  point_in_time_recovery_enabled = var.point_in_time_recovery_enabled
+  deletion_protection_enabled    = var.deletion_protection_enabled
+  enable_key_rotation            = var.enable_key_rotation
+  global_secondary_indexes       = local.global_secondary_indexes
+}
+
+module "add_to_runtime_config" {
+  source = "../../../core/runtime-config/entry"
+
+  namespace = "dynamodb"
+  key       = local.dynamodb_config.runtimeConfigKey
+  value = {
+    tableName = module.dynamodb_table.table_name
+  }
+}

package/src/utils/dynamodb-constructs/files/terraform/core/dynamodb/dynamodb.tf.template

@@ -0,0 +1,155 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+  }
+}
+
+variable "name" {
+  description = "Name for the DynamoDB table."
+  type        = string
+}
+
+variable "billing_mode" {
+  description = "Controls how you are charged for read and write throughput."
+  type        = string
+  default     = "PAY_PER_REQUEST"
+}
+
+variable "point_in_time_recovery_enabled" {
+  description = "Whether to enable point-in-time recovery for the table."
+  type        = bool
+  default     = true
+}
+
+variable "deletion_protection_enabled" {
+  description = "Whether to enable deletion protection on the table."
+  type        = bool
+  default     = true
+}
+
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table."
+  type        = bool
+  default     = true
+}
+
+variable "global_secondary_indexes" {
+  description = "Global secondary indexes to create on the table. All key attributes must be of type string."
+  type = list(object({
+    name            = string
+    hash_key        = string
+    range_key       = string
+    projection_type = string
+  }))
+  default = []
+}
+
+locals {
+  gsi_attribute_names = distinct(flatten([
+    for gsi in var.global_secondary_indexes : [gsi.hash_key, gsi.range_key]
+  ]))
+}
+
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+resource "aws_kms_key" "table" {
+  description         = "KMS key for DynamoDB table ${var.name}"
+  enable_key_rotation = var.enable_key_rotation
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "EnableRootAccess"
+        Effect = "Allow"
+        Principal = {
+          AWS = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
+        }
+        Action   = "kms:*"
+        Resource = "*"
+      },
+      {
+        Sid    = "AllowDynamoDBService"
+        Effect = "Allow"
+        Principal = {
+          Service = "dynamodb.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey",
+          "kms:CreateGrant"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}
+
+resource "aws_dynamodb_table" "table" {
+  name                        = var.name
+  billing_mode                = var.billing_mode
+  hash_key                    = "pk"
+  range_key                   = "sk"
+  deletion_protection_enabled = var.deletion_protection_enabled
+
+  attribute {
+    name = "pk"
+    type = "S"
+  }
+
+  attribute {
+    name = "sk"
+    type = "S"
+  }
+
+  dynamic "attribute" {
+    for_each = toset(local.gsi_attribute_names)
+    content {
+      name = attribute.value
+      type = "S"
+    }
+  }
+
+  dynamic "global_secondary_index" {
+    for_each = var.global_secondary_indexes
+    content {
+      name            = global_secondary_index.value.name
+      hash_key        = global_secondary_index.value.hash_key
+      range_key       = global_secondary_index.value.range_key
+      projection_type = global_secondary_index.value.projection_type
+    }
+  }
+
+  point_in_time_recovery {
+    enabled = var.point_in_time_recovery_enabled
+  }
+
+  server_side_encryption {
+    enabled     = true
+    kms_key_arn = aws_kms_key.table.arn
+  }
+}
+
+output "table_name" {
+  description = "Name of the DynamoDB table."
+  value       = aws_dynamodb_table.table.name
+}
+
+output "table_arn" {
+  description = "ARN of the DynamoDB table."
+  value       = aws_dynamodb_table.table.arn
+}
+
+output "kms_key_arn" {
+  description = "ARN of the KMS key used to encrypt the DynamoDB table."
+  value       = aws_kms_key.table.arn
+}

package/src/utils/files/common/scripts/src/dynamodb/create-local-table.ts.template

@@ -0,0 +1,195 @@
+import {
+  BillingMode,
+  CreateTableCommand,
+  DescribeTableCommand,
+  DynamoDBClient,
+  GlobalSecondaryIndexDescription,
+  IndexStatus,
+  KeyType,
+  ProjectionType,
+  ResourceInUseException,
+  ScalarAttributeType,
+  TableStatus,
+  UpdateTableCommand,
+} from "@aws-sdk/client-dynamodb";
+import { readFileSync } from "fs";
+
+const {
+  localDev: { port, tableName },
+  tableConfig: { globalSecondaryIndexes },
+} = JSON.parse(readFileSync("config.json", "utf-8")) as {
+  localDev: { port: number; tableName: string };
+  tableConfig: {
+    globalSecondaryIndexes: {
+      indexName: string;
+      partitionKey: string;
+      sortKey?: string;
+    }[];
+  };
+};
+
+const timeoutSignal = () => AbortSignal.timeout(10000);
+
+const client = new DynamoDBClient({
+  endpoint: `http://localhost:${port}`,
+  region: 'us-east-1',
+  credentials: { accessKeyId: 'UNUSED', secretAccessKey: 'UNUSED' },
+});
+
+const waitForTableActive = async (
+  waitClient: DynamoDBClient,
+  waitTableName: string,
+): Promise<void> => {
+  for (;;) {
+    const { Table } = await waitClient.send(
+      new DescribeTableCommand({ TableName: waitTableName }),
+      { abortSignal: timeoutSignal() },
+    );
+    const allActive =
+      Table?.TableStatus === TableStatus.ACTIVE &&
+      (Table?.GlobalSecondaryIndexes ?? []).every(
+        (g: GlobalSecondaryIndexDescription) => g.IndexStatus === IndexStatus.ACTIVE,
+      );
+    if (allActive) return;
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+};
+
+const ensureTable = async (
+  tblClient: DynamoDBClient,
+  tblName: string,
+  gsIs: { indexName: string; partitionKey: string; sortKey?: string }[],
+): Promise<void> => {
+  const gsiAttributeDefinitions = gsIs.flatMap((gsi) => [
+    { AttributeName: gsi.partitionKey, AttributeType: ScalarAttributeType.S },
+    ...(gsi.sortKey
+      ? [{ AttributeName: gsi.sortKey, AttributeType: ScalarAttributeType.S }]
+      : []),
+  ]);
+  const attributeDefinitions = [
+    { AttributeName: "pk", AttributeType: ScalarAttributeType.S },
+    { AttributeName: "sk", AttributeType: ScalarAttributeType.S },
+    ...gsiAttributeDefinitions.filter(
+      (a, i, arr) =>
+        arr.findIndex((b) => b.AttributeName === a.AttributeName) === i,
+    ),
+  ];
+  const globalSecondaryIndexes = gsIs.map((gsi) => ({
+    IndexName: gsi.indexName,
+    KeySchema: [
+      { AttributeName: gsi.partitionKey, KeyType: KeyType.HASH },
+      ...(gsi.sortKey
+        ? [{ AttributeName: gsi.sortKey, KeyType: KeyType.RANGE }]
+        : []),
+    ],
+    Projection: { ProjectionType: ProjectionType.ALL },
+  }));
+
+  for (let attempt = 0; attempt < 30; attempt++) {
+    try {
+      // New table: create with all GSIs in one shot.
+      await tblClient.send(
+        new CreateTableCommand({
+          TableName: tblName,
+          AttributeDefinitions: attributeDefinitions,
+          KeySchema: [
+            { AttributeName: "pk", KeyType: KeyType.HASH },
+            { AttributeName: "sk", KeyType: KeyType.RANGE },
+          ],
+          BillingMode: BillingMode.PAY_PER_REQUEST,
+          ...(globalSecondaryIndexes.length > 0 && {
+            GlobalSecondaryIndexes: globalSecondaryIndexes,
+          }),
+        }),
+        { abortSignal: timeoutSignal() },
+      );
+      console.log(`Created table: ${tblName}`);
+      for (const gsi of globalSecondaryIndexes) {
+        console.log(`Created GSI: ${gsi.IndexName}`);
+      }
+      return;
+    } catch (e) {
+      // Table already exists: sync GSIs to match desired state.
+      if (e instanceof ResourceInUseException) {
+        const { Table } = await tblClient.send(
+          new DescribeTableCommand({ TableName: tblName }),
+          { abortSignal: timeoutSignal() },
+        );
+        const existingGSIs = Table?.GlobalSecondaryIndexes ?? [];
+        const existingNames = new Set(
+          existingGSIs.map(
+            (g: GlobalSecondaryIndexDescription) => g.IndexName ?? "",
+          ),
+        );
+        const desiredNames = new Set(gsIs.map((g) => g.indexName));
+
+        // DynamoDB Local only allows one GSI to be created or deleted at a time.
+        for (const existing of existingGSIs) {
+          if (!existing.IndexName || desiredNames.has(existing.IndexName))
+            continue;
+          await tblClient.send(
+            new UpdateTableCommand({
+              TableName: tblName,
+              GlobalSecondaryIndexUpdates: [
+                { Delete: { IndexName: existing.IndexName } },
+              ],
+            }),
+            { abortSignal: timeoutSignal() },
+          );
+          console.log(`Deleted GSI: ${existing.IndexName}`);
+          await waitForTableActive(tblClient, tblName);
+        }
+
+        for (const gsi of gsIs) {
+          if (existingNames.has(gsi.indexName)) continue;
+          await tblClient.send(
+            new UpdateTableCommand({
+              TableName: tblName,
+              AttributeDefinitions: [
+                { AttributeName: gsi.partitionKey, AttributeType: ScalarAttributeType.S },
+                ...(gsi.sortKey
+                  ? [
+                      {
+                        AttributeName: gsi.sortKey,
+                        AttributeType: ScalarAttributeType.S,
+                      },
+                    ]
+                  : []),
+              ],
+              GlobalSecondaryIndexUpdates: [
+                {
+                  Create: {
+                    IndexName: gsi.indexName,
+                    KeySchema: [
+                      {
+                        AttributeName: gsi.partitionKey,
+                        KeyType: KeyType.HASH,
+                      },
+                      ...(gsi.sortKey
+                        ? [
+                            {
+                              AttributeName: gsi.sortKey,
+                              KeyType: KeyType.RANGE,
+                            },
+                          ]
+                        : []),
+                    ],
+                    Projection: { ProjectionType: ProjectionType.ALL },
+                  },
+                },
+              ],
+            }),
+            { abortSignal: timeoutSignal() },
+          );
+          console.log(`Created GSI: ${gsi.indexName}`);
+          await waitForTableActive(tblClient, tblName);
+        }
+        return;
+      }
+      if (attempt === 29) throw e;
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+  }
+};
+
+await ensureTable(client, tableName, globalSecondaryIndexes);

package/src/utils/files/common/scripts/src/dynamodb/pull-image.ts.template

@@ -0,0 +1,13 @@
+import { spawnSync } from 'child_process';
+import { readFileSync } from 'fs';
+
+const { containerEngine, image } =
+  JSON.parse(readFileSync('config.json', 'utf-8')).localDev;
+
+const inspect = spawnSync(containerEngine, ['image', 'inspect', image], { stdio: 'ignore' });
+if (inspect.status !== 0) {
+  const pull = spawnSync(containerEngine, ['pull', image], { stdio: 'inherit' });
+  if (pull.status !== 0) {
+    process.exit(pull.status ?? 1);
+  }
+}

package/src/utils/files/common/scripts/src/dynamodb/start-container.ts.template

@@ -0,0 +1,106 @@
+import { spawn, spawnSync } from 'child_process';
+import { readFileSync } from 'fs';
+
+const { containerEngine, containerName, image, port } =
+  JSON.parse(readFileSync('config.json', 'utf-8')).localDev;
+
+const containerExists = (): boolean =>
+  spawnSync(containerEngine, ['container', 'inspect', containerName], {
+    stdio: 'ignore',
+  }).status === 0;
+
+const isRunning = (): boolean => {
+  const result = spawnSync(
+    containerEngine,
+    ['container', 'inspect', '-f', '{{.State.Running}}', containerName],
+    { encoding: 'utf-8' },
+  );
+  return result.status === 0 && result.stdout.trim() === 'true';
+};
+
+// Ensure the image is available locally before starting the container.
+const ensureImage = (): void => {
+  const inspect = spawnSync(containerEngine, ['image', 'inspect', image], {
+    stdio: 'ignore',
+  });
+  if (inspect.status !== 0) {
+    const pull = spawnSync(containerEngine, ['pull', image], {
+      stdio: 'inherit',
+    });
+    if (pull.status !== 0) process.exit(pull.status ?? 1);
+  }
+};
+
+// Multiple dynamo table packages run dev in parallel sharing the same
+// container. All processes stream logs, but only the one that created the
+// container stops it on exit — others just detach.
+let created = false;
+let runRetries = 0;
+
+ensureImage();
+
+for (;;) {
+  if (containerExists()) {
+    if (!isRunning()) {
+      // Another process may have started it between our inspect and start — container engine start
+      // exits 0 even if the container is already running, so no special-casing needed.
+      const start = spawnSync(containerEngine, ['start', containerName], {
+        stdio: 'inherit',
+      });
+      if (start.status !== 0) process.exit(start.status ?? 1);
+    }
+    break;
+  }
+  const runArgs = [
+    'run',
+    ...(containerEngine === 'docker' ? ['--rm'] : []),
+    '--name', containerName,
+    '-u', 'root',
+    '-w', '/home/dynamodblocal',
+    `-p`, `${port}:${port}`,
+    '-v', `${containerName}-data:/home/dynamodblocal/data`,
+    '-d', image,
+    '-jar', 'DynamoDBLocal.jar',
+    '-sharedDb',
+    '-dbPath', './data',
+    '-port', `${port}`,
+    '-optimizeDbBeforeStartup',
+  ];
+  const create = spawnSync(containerEngine, runArgs, { stdio: 'pipe' });
+  if (create.status === 0) {
+    created = true;
+    break;
+  }
+  if (!containerExists() && ++runRetries > 3) {
+    process.stderr.write(create.stderr);
+    process.exit(create.status ?? 1);
+  }
+}
+
+const logs = spawn(containerEngine, ['logs', '-f', containerName], {
+  stdio: ['ignore', 'inherit', 'inherit'],
+});
+
+let exiting = false;
+
+const cleanup = () => {
+  if (exiting) return;
+  exiting = true;
+  if (created) {
+    if (containerEngine === 'docker') {
+      spawnSync(containerEngine, ['stop', containerName], { stdio: 'ignore' });
+    } else {
+      spawnSync(containerEngine, ['rm', '-f', containerName], { stdio: 'ignore' });
+    }
+  }
+  logs.kill();
+  process.exit(0);
+};
+
+process.on('SIGTERM', cleanup);
+process.on('SIGINT', cleanup);
+process.on('SIGHUP', cleanup);
+
+logs.on('exit', (code) => {
+  if (!exiting) process.exit(code ?? 0);
+});

package/src/utils/files/common/scripts/src/{stage-credentials → infra/stage-credentials}/cdk-command.ts.template

@@ -4,6 +4,10 @@
  * Defaults to --require-approval=never (standard for local dev deploys).
  * If the user explicitly passes --require-approval with any value, we
  * respect their choice and don't add the default.
+ *
+ * Pass --express to opt into CloudFormation express mode for faster
+ * iteration; it is not enabled by default so deploys wait for full
+ * resource stabilization.
  */
 export function buildCdkCommand(
   action: string,
@@ -12,7 +16,6 @@ export function buildCdkCommand(
   const hasRequireApproval = remainingArgs.some(
     (a) => a === '--require-approval' || a.startsWith('--require-approval='),
   );
-  return hasRequireApproval
-    ? ['cdk', action, ...remainingArgs]
-    : ['cdk', action, '--require-approval=never', ...remainingArgs];
+  const defaults = hasRequireApproval ? [] : ['--require-approval=never'];
+  return ['cdk', action, ...defaults, ...remainingArgs];
 }

package/src/utils/files/common/scripts/src/rdb/mysql/wait-for-mysql-db.ts.template

@@ -0,0 +1,32 @@
+import { readFileSync } from 'fs';
+import { createConnection } from 'mariadb';
+
+const { port, dbName, dbUser, dbPassword, dbEngine } =
+  JSON.parse(readFileSync('config.json', 'utf-8')).localDev;
+
+const noop = () => undefined;
+const timeoutAt = Date.now() + 60000;
+
+while (Date.now() < timeoutAt) {
+  let conn: Awaited<ReturnType<typeof createConnection>> | undefined;
+  try {
+    conn = await createConnection({
+      host: 'localhost',
+      port: parseInt(port),
+      user: dbUser,
+      password: dbPassword,
+      database: dbName,
+      connectTimeout: 500,
+      allowPublicKeyRetrieval: true,
+    });
+    await conn.end();
+    console.log('Database is ready.');
+    process.exit(0);
+  } catch {
+    console.log('Database is not ready.');
+    await conn?.end().catch(noop);
+  }
+  await new Promise((r) => setTimeout(r, 200));
+}
+
+throw new Error(`Timed out waiting for ${dbEngine} on port ${port}`);

package/src/utils/files/common/scripts/src/rdb/postgres/wait-for-postgres-db.ts.template

@@ -0,0 +1,32 @@
+import { readFileSync } from 'fs';
+import { Client } from 'pg';
+
+const { port, dbName, dbUser, dbPassword, dbEngine } =
+  JSON.parse(readFileSync('config.json', 'utf-8')).localDev;
+
+const noop = () => undefined;
+const timeoutAt = Date.now() + 60000;
+
+while (Date.now() < timeoutAt) {
+  const client = new Client({
+    host: 'localhost',
+    port: parseInt(port),
+    user: dbUser,
+    password: dbPassword,
+    database: dbName,
+    connectionTimeoutMillis: 500,
+  });
+  client.on('error', noop);
+  try {
+    await client.connect();
+    await client.end();
+    console.log('Database is ready.');
+    process.exit(0);
+  } catch {
+    console.log('Database is not ready.');
+    await client.end().catch(noop);
+  }
+  await new Promise((r) => setTimeout(r, 200));
+}
+
+throw new Error(`Timed out waiting for ${dbEngine} on port ${port}`);

package/src/utils/files/common/scripts/src/rdb/shared/pull-image.ts.template

@@ -0,0 +1,16 @@
+import { spawnSync } from 'child_process';
+import { readFileSync } from 'fs';
+
+const { containerEngine, image } =
+  JSON.parse(readFileSync('config.json', 'utf-8')).localDev;
+
+const inspect = spawnSync(containerEngine, ['image', 'inspect', image], {
+  stdio: 'ignore',
+});
+
+if (inspect.status !== 0) {
+  const pull = spawnSync(containerEngine, ['pull', image], { stdio: 'inherit' });
+  if (pull.status !== 0) {
+    process.exit(pull.status ?? 1);
+  }
+}