@aws/nx-plugin 1.0.0-rc.3 → 1.0.0-rc.31

package/src/trpc/backend/__snapshots__/generator.spec.ts.snap

@@ -281,7 +281,7 @@ import { EchoInputSchema, EchoOutputSchema } from '../schema/index.js';
 export const echo = publicProcedure
   .input(EchoInputSchema)
   .output(EchoOutputSchema)
-  .query((opts) => ({ result: opts.input.message }));
+  .query((opts) => ({ message: opts.input.message }));
 "
 `;
 
@@ -303,13 +303,13 @@ exports[`trpc backend generator > should generate the project > apps/test-api/sr
 "import { z } from 'zod';
 
 export const EchoInputSchema = z.object({
-  message: z.string(),
+  message: z.string().max(1024),
 });
 
 export type IEchoInput = z.TypeOf<typeof EchoInputSchema>;
 
 export const EchoOutputSchema = z.object({
-  result: z.string(),
+  message: z.string().max(1024),
 });
 
 export type IEchoOutput = z.TypeOf<typeof EchoOutputSchema>;
@@ -478,6 +478,9 @@ export class TestApi<
         authorizer: new CognitoUserPoolsAuthorizer(scope, 'TestApiAuthorizer', {
           cognitoUserPools: [props.identity.userPool],
         }),
+        // Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+        // and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+        authorizationScopes: ['openid', 'aws.cognito.signin.user.admin'],
       },
       deployOptions: {
         tracingEnabled: true,
@@ -1199,15 +1202,18 @@ import {
   HttpApiIntegration,
   OperationDetails,
 } from './utils.js';
-import { CfnOutput } from 'aws-cdk-lib';
+import { CfnOutput, Stack } from 'aws-cdk-lib';
 import {
   HttpApi as _HttpApi,
   HttpApiProps as _HttpApiProps,
   HttpMethod,
   HttpStage,
   LogGroupLogDestination,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
 import { LogGroup } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { suppressRules } from '../checkov.js';
 
 /**
@@ -1232,6 +1238,12 @@ export interface HttpApiProps<
    * Map of operation names to their API Gateway integrations
    */
   readonly integrations: TIntegrations;
+  /**
+   * Default throttling limits applied to the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -1265,6 +1277,7 @@ export class HttpApi<
       apiName,
       operations,
       integrations,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: HttpApiProps<TIntegrations, TOperation>,
   ) {
@@ -1277,12 +1290,18 @@ export class HttpApi<
       ...props,
     });
 
-    const accessLogGroup = new LogGroup(this, 'AccessLogs');
-    suppressRules(
-      accessLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption',
+    // Customer-managed key for access log encryption at rest
+    const logsKey = new Key(this, 'AccessLogsKey', {
+      enableKeyRotation: true,
+    });
+    const stack = Stack.of(this);
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
     );
+
+    const accessLogGroup = new LogGroup(this, 'AccessLogs', {
+      encryptionKey: logsKey,
+    });
     suppressRules(
       accessLogGroup,
       ['CKV_AWS_66', 'CKV_AWS_338'],
@@ -1292,6 +1311,7 @@ export class HttpApi<
     this.defaultStage = new HttpStage(this, 'DefaultStage', {
       httpApi: this.api,
       autoDeploy: true,
+      throttle,
       accessLogSettings: {
         destination: new LogGroupLogDestination(accessLogGroup),
       },
@@ -1751,6 +1771,8 @@ export type ApiIntegrations<TOperation extends string, TBaseIntegration> =
  * @template TDefaultIntegrationProps - Type for default integration properties
  * @template TDefaultIntegration - Type for default integration implementation
  * @template TPattern - The integration pattern ('shared' or 'isolated')
+ * @template TOverridden - Union of operation names that have been overridden
+ * @template TOperationOptioned - Union of operation names with per-operation options
  */
 export class IntegrationBuilder<
   TOperation extends string,
@@ -1759,6 +1781,8 @@ export class IntegrationBuilder<
   TDefaultIntegrationProps extends object,
   TDefaultIntegration extends TBaseIntegration,
   TPattern extends 'shared' | 'isolated',
+  TOverridden extends string = never,
+  TOperationOptioned extends string = never,
 > {
   /** Options for the integration builder */
   private options: IntegrationBuilderProps<
@@ -1771,6 +1795,11 @@ export class IntegrationBuilder<
   /** Map of operation names to their custom integrations */
   private integrations: Partial<TIntegrations> = {};
 
+  /** Map of default integration keys to per-operation default option overrides */
+  private perOperationOptions: Partial<
+    Record<string, Partial<TDefaultIntegrationProps>>
+  > = {};
+
   /**
    * Create an Integration Builder for an HTTP API with a shared pattern
    */
@@ -1925,11 +1954,16 @@ export class IntegrationBuilder<
   /**
    * Overrides default integrations with custom implementations for specific operations.
    *
+   * Operations which have per-operation options set via withOperationOptions cannot be
+   * overridden, since these still use the default integration.
+   *
    * @param overrides - Map of operation names to their custom integration implementations
    * @returns The builder instance with updated type information reflecting the overrides
    */
   public withOverrides<
-    TOverrideIntegrations extends Partial<Record<TOperation, TBaseIntegration>>,
+    TOverrideIntegrations extends Partial<
+      Record<Exclude<TOperation, TOperationOptioned>, TBaseIntegration>
+    >,
   >(overrides: TOverrideIntegrations) {
     this.integrations = { ...this.integrations, ...overrides };
     // Re-type to include the overridden integration types.
@@ -1945,7 +1979,9 @@ export class IntegrationBuilder<
       MergedIntegrations,
       TDefaultIntegrationProps,
       TDefaultIntegration,
-      TPattern
+      TPattern,
+      TOverridden | Extract<keyof TOverrideIntegrations, string>,
+      TOperationOptioned
     >;
   }
 
@@ -1964,6 +2000,43 @@ export class IntegrationBuilder<
     return this;
   }
 
+  /**
+   * Updates the default integration options for specific operations, without
+   * affecting the others. The given options are merged with the defaults (and
+   * any options set via withDefaultOptions) when building each default integration.
+   *
+   * Operations which have been replaced via withOverrides cannot be targeted, since
+   * they no longer use the default integration.
+   *
+   * @param options - Map of operation names to partial default integration options
+   * @returns The builder instance
+   */
+  public withOperationOptions<
+    TOptions extends Partial<
+      Record<
+        Exclude<DefaultIntegrationKeys<TPattern, TOperation>, TOverridden>,
+        Partial<TDefaultIntegrationProps>
+      >
+    >,
+  >(options: TOptions) {
+    Object.entries(options).forEach(([op, opOptions]) => {
+      this.perOperationOptions[op] = {
+        ...this.perOperationOptions[op],
+        ...(opOptions as Partial<TDefaultIntegrationProps>),
+      };
+    });
+    return this as unknown as IntegrationBuilder<
+      TOperation,
+      TBaseIntegration,
+      TIntegrations,
+      TDefaultIntegrationProps,
+      TDefaultIntegration,
+      TPattern,
+      TOverridden,
+      TOperationOptioned | Extract<keyof TOptions, string>
+    >;
+  }
+
   /**
    * Builds and returns the complete set of integrations.
    *
@@ -1978,6 +2051,10 @@ export class IntegrationBuilder<
    */
   public build(): TIntegrations {
     const options = this.options;
+    const buildOptionsFor = (op: string): TDefaultIntegrationProps => ({
+      ...options.defaultIntegrationOptions,
+      ...this.perOperationOptions[op],
+    });
     return {
       ...Object.fromEntries(
         options.pattern === 'shared'
@@ -1986,7 +2063,7 @@ export class IntegrationBuilder<
                 '$router',
                 options.buildDefaultIntegration(
                   '$router',
-                  options.defaultIntegrationOptions,
+                  buildOptionsFor('$router'),
                 ),
               ],
             ]
@@ -1997,10 +2074,7 @@ export class IntegrationBuilder<
               )
               .map((op) => [
                 op,
-                options.buildDefaultIntegration(
-                  op,
-                  options.defaultIntegrationOptions,
-                ),
+                options.buildDefaultIntegration(op, buildOptionsFor(op)),
               ]),
       ),
       ...this.integrations,
@@ -2013,21 +2087,27 @@ export class IntegrationBuilder<
 exports[`trpc backend generator > should set up shared constructs for rest > rest-api.ts 1`] = `
 "import { Construct, IConstruct } from 'constructs';
 import {
+  AccessLogFormat,
   Cors,
+  LogGroupLogDestination,
   Resource,
   RestApi as _RestApi,
   RestApiProps as _RestApiProps,
   IResource,
   Stage,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, RemovalPolicy } from 'aws-cdk-lib';
+import { IAspect, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
   CfnWebACLAssociation,
 } from 'aws-cdk-lib/aws-wafv2';
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { RuntimeConfig } from '../runtime-config.js';
+import { ApiGatewayAccount } from './api-gateway-account.js';
 import {
   ApiIntegrations,
   OperationDetails,
@@ -2065,6 +2145,12 @@ export interface RestApiProps<
    * @default true
    */
   readonly enableWaf?: boolean;
+  /**
+   * Default throttling limits applied to all methods on the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -2099,14 +2185,49 @@ export class RestApi<
       operations,
       integrations,
       enableWaf = true,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: RestApiProps<TIntegrations, TOperation>,
   ) {
     super(scope, id);
     this.integrations = integrations;
 
+    // Account-level CloudWatch role required for REST API access logging
+    const account = ApiGatewayAccount.ensure(this);
+
+    // KMS key for encrypting logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'LogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(\`logs.\${Stack.of(this).region}.amazonaws.com\`),
+    );
+
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+    });
+
     // Create the API Gateway REST API
-    this.api = new _RestApi(this, 'Api', props);
+    this.api = new _RestApi(this, 'Api', {
+      ...props,
+      deployOptions: {
+        accessLogDestination: new LogGroupLogDestination(accessLogs),
+        accessLogFormat: AccessLogFormat.jsonWithStandardFields(),
+        ...props.deployOptions,
+        methodOptions: {
+          ...props.deployOptions?.methodOptions,
+          // Default throttling applied to all resource paths and methods
+          '/*/*': {
+            throttlingRateLimit: throttle.rateLimit,
+            throttlingBurstLimit: throttle.burstLimit,
+            ...props.deployOptions?.methodOptions?.['/*/*'],
+          },
+        },
+      },
+    });
+    // Ensure the account-level role is configured before the stage is created
+    this.api.deploymentStage.node.addDependency(account.resource);
 
     if (enableWaf) {
       this.webAcl = new CfnWebACL(this, 'WebAcl', {
@@ -2173,14 +2294,9 @@ export class RestApi<
       // \`aws-waf-logs-\` to satisfy the WAFv2 logging destination requirement.
       const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
         logGroupName: \`aws-waf-logs-\${apiName}-\${this.node.addr.slice(-8)}\`,
-        retention: RetentionDays.ONE_MONTH,
-        removalPolicy: RemovalPolicy.DESTROY,
+        retention: RetentionDays.ONE_YEAR,
+        encryptionKey: logsKey,
       });
-      suppressRules(
-        wafLogGroup,
-        ['CKV_AWS_158'],
-        'Using default CloudWatch log encryption for WAF logs',
-      );
 
       new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
         resourceArn: this.webAcl.attrArn,
@@ -2194,12 +2310,6 @@ export class RestApi<
       'Caching not required for this use case',
       (c) => c instanceof Stage,
     );
-    suppressRules(
-      this.api,
-      ['CKV_AWS_76'],
-      'API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement',
-      (c) => c instanceof Stage,
-    );
 
     // Resolve the integration for a given operation.
     // If the operation has a dedicated integration, use it; otherwise fall back to $router.
@@ -2708,6 +2818,8 @@ export type ApiIntegrations<TOperation extends string, TBaseIntegration> =
  * @template TDefaultIntegrationProps - Type for default integration properties
  * @template TDefaultIntegration - Type for default integration implementation
  * @template TPattern - The integration pattern ('shared' or 'isolated')
+ * @template TOverridden - Union of operation names that have been overridden
+ * @template TOperationOptioned - Union of operation names with per-operation options
  */
 export class IntegrationBuilder<
   TOperation extends string,
@@ -2716,6 +2828,8 @@ export class IntegrationBuilder<
   TDefaultIntegrationProps extends object,
   TDefaultIntegration extends TBaseIntegration,
   TPattern extends 'shared' | 'isolated',
+  TOverridden extends string = never,
+  TOperationOptioned extends string = never,
 > {
   /** Options for the integration builder */
   private options: IntegrationBuilderProps<
@@ -2728,6 +2842,11 @@ export class IntegrationBuilder<
   /** Map of operation names to their custom integrations */
   private integrations: Partial<TIntegrations> = {};
 
+  /** Map of default integration keys to per-operation default option overrides */
+  private perOperationOptions: Partial<
+    Record<string, Partial<TDefaultIntegrationProps>>
+  > = {};
+
   /**
    * Create an Integration Builder for an HTTP API with a shared pattern
    */
@@ -2882,11 +3001,16 @@ export class IntegrationBuilder<
   /**
    * Overrides default integrations with custom implementations for specific operations.
    *
+   * Operations which have per-operation options set via withOperationOptions cannot be
+   * overridden, since these still use the default integration.
+   *
    * @param overrides - Map of operation names to their custom integration implementations
    * @returns The builder instance with updated type information reflecting the overrides
    */
   public withOverrides<
-    TOverrideIntegrations extends Partial<Record<TOperation, TBaseIntegration>>,
+    TOverrideIntegrations extends Partial<
+      Record<Exclude<TOperation, TOperationOptioned>, TBaseIntegration>
+    >,
   >(overrides: TOverrideIntegrations) {
     this.integrations = { ...this.integrations, ...overrides };
     // Re-type to include the overridden integration types.
@@ -2902,7 +3026,9 @@ export class IntegrationBuilder<
       MergedIntegrations,
       TDefaultIntegrationProps,
       TDefaultIntegration,
-      TPattern
+      TPattern,
+      TOverridden | Extract<keyof TOverrideIntegrations, string>,
+      TOperationOptioned
     >;
   }
 
@@ -2921,6 +3047,43 @@ export class IntegrationBuilder<
     return this;
   }
 
+  /**
+   * Updates the default integration options for specific operations, without
+   * affecting the others. The given options are merged with the defaults (and
+   * any options set via withDefaultOptions) when building each default integration.
+   *
+   * Operations which have been replaced via withOverrides cannot be targeted, since
+   * they no longer use the default integration.
+   *
+   * @param options - Map of operation names to partial default integration options
+   * @returns The builder instance
+   */
+  public withOperationOptions<
+    TOptions extends Partial<
+      Record<
+        Exclude<DefaultIntegrationKeys<TPattern, TOperation>, TOverridden>,
+        Partial<TDefaultIntegrationProps>
+      >
+    >,
+  >(options: TOptions) {
+    Object.entries(options).forEach(([op, opOptions]) => {
+      this.perOperationOptions[op] = {
+        ...this.perOperationOptions[op],
+        ...(opOptions as Partial<TDefaultIntegrationProps>),
+      };
+    });
+    return this as unknown as IntegrationBuilder<
+      TOperation,
+      TBaseIntegration,
+      TIntegrations,
+      TDefaultIntegrationProps,
+      TDefaultIntegration,
+      TPattern,
+      TOverridden,
+      TOperationOptioned | Extract<keyof TOptions, string>
+    >;
+  }
+
   /**
    * Builds and returns the complete set of integrations.
    *
@@ -2935,6 +3098,10 @@ export class IntegrationBuilder<
    */
   public build(): TIntegrations {
     const options = this.options;
+    const buildOptionsFor = (op: string): TDefaultIntegrationProps => ({
+      ...options.defaultIntegrationOptions,
+      ...this.perOperationOptions[op],
+    });
     return {
       ...Object.fromEntries(
         options.pattern === 'shared'
@@ -2943,7 +3110,7 @@ export class IntegrationBuilder<
                 '$router',
                 options.buildDefaultIntegration(
                   '$router',
-                  options.defaultIntegrationOptions,
+                  buildOptionsFor('$router'),
                 ),
               ],
             ]
@@ -2954,10 +3121,7 @@ export class IntegrationBuilder<
               )
               .map((op) => [
                 op,
-                options.buildDefaultIntegration(
-                  op,
-                  options.defaultIntegrationOptions,
-                ),
+                options.buildDefaultIntegration(op, buildOptionsFor(op)),
               ]),
       ),
       ...this.integrations,
@@ -2978,7 +3142,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.52.0"
     }
   }
 }
@@ -3225,7 +3389,7 @@ output "api_log_group_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.52.0"
     }
   }
 }
@@ -3293,12 +3457,6 @@ variable "cors_expose_headers" {
   default     = []
 }
 
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -3349,7 +3507,6 @@ module "http_api" {
   cors_allow_methods     = var.cors_allow_methods
   cors_allow_origins     = var.cors_allow_origins
   cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
 
   # Tags
   tags = var.tags
@@ -3631,7 +3788,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.52.0"
     }
   }
 }
@@ -3878,7 +4035,7 @@ output "api_log_group_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.52.0"
     }
   }
 }
@@ -3936,12 +4093,6 @@ variable "cors_expose_headers" {
   default     = []
 }
 
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -3992,7 +4143,6 @@ module "http_api" {
   cors_allow_methods     = var.cors_allow_methods
   cors_allow_origins     = var.cors_allow_origins
   cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
 
   # Tags
   tags = var.tags
@@ -4356,7 +4506,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.52.0"
     }
   }
 }
@@ -4603,7 +4753,7 @@ output "api_log_group_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.52.0"
     }
   }
 }
@@ -4661,12 +4811,6 @@ variable "cors_expose_headers" {
   default     = []
 }
 
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -4717,7 +4861,6 @@ module "http_api" {
   cors_allow_methods     = var.cors_allow_methods
   cors_allow_origins     = var.cors_allow_origins
   cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
 
   # Tags
   tags = var.tags
@@ -4986,11 +5129,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -5060,8 +5203,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -5078,10 +5219,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -5239,16 +5378,14 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
+# Note: Stage, deployment and access log outputs are provided by the consuming module",
   "test-api.tf": "terraform {
   required_version = ">= 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
   }
 }
@@ -5347,6 +5484,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -5502,6 +5644,9 @@ resource "aws_api_gateway_method" "proxy_method" {
 
   authorization = "COGNITO_USER_POOLS"
   authorizer_id = aws_api_gateway_authorizer.cognito_authorizer.id
+  # Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+  # and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+  authorization_scopes = ["openid", "aws.cognito.signin.user.admin"]
 
   request_parameters = {
     "method.request.path.proxy" = true
@@ -5588,11 +5733,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "TestApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/test-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -5600,9 +5797,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -5782,11 +6009,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -5856,8 +6083,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -5874,10 +6099,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -6035,16 +6258,14 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
+# Note: Stage, deployment and access log outputs are provided by the consuming module",
   "test-api.tf": "terraform {
   required_version = ">= 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
   }
 }
@@ -6133,6 +6354,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -6365,11 +6591,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "TestApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/test-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -6377,9 +6655,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -6570,11 +6878,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -6644,8 +6952,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -6662,10 +6968,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -6823,16 +7127,14 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
+# Note: Stage, deployment and access log outputs are provided by the consuming module",
   "test-api.tf": "terraform {
   required_version = ">= 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
   }
 }
@@ -6921,6 +7223,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -7247,11 +7554,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "TestApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/test-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -7259,9 +7618,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy