@aws/nx-plugin 1.0.0-rc.34 → 1.0.0-rc.36

package/src/trpc/backend/__snapshots__/generator.spec.ts.snap

@@ -3421,6 +3421,18 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
@@ -3594,7 +3606,9 @@ resource "aws_lambda_function" "api_lambda" {
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
@@ -3643,16 +3657,30 @@ resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -4125,6 +4153,18 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
@@ -4298,7 +4338,9 @@ resource "aws_lambda_function" "api_lambda" {
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
@@ -4347,16 +4389,30 @@ resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -4911,6 +4967,18 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
@@ -5084,7 +5152,9 @@ resource "aws_lambda_function" "api_lambda" {
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
@@ -5133,16 +5203,30 @@ resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -5621,6 +5705,18 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
@@ -5803,7 +5899,9 @@ resource "aws_lambda_function" "api_lambda" {
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
@@ -5852,16 +5950,30 @@ resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -6559,6 +6671,18 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
@@ -6741,7 +6865,9 @@ resource "aws_lambda_function" "api_lambda" {
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
@@ -6790,16 +6916,30 @@ resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -7496,6 +7636,18 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
@@ -7678,7 +7830,9 @@ resource "aws_lambda_function" "api_lambda" {
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
@@ -7727,16 +7881,30 @@ resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption

package/src/utils/api-constructs/files/terraform/app/apis/http/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -38,6 +38,18 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from `core/runtime-config/appconfig.application_id`). When set, the Lambda functions receive `RUNTIME_CONFIG_APP_ID` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from `core/runtime-config/appconfig.application_arn`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
   type        = string
@@ -231,7 +243,9 @@ resource "aws_lambda_function" "api_lambda" {
       AWS_LWA_INVOKE_MODE         = "buffered"
       AWS_LAMBDA_EXEC_WRAPPER     = "/opt/bootstrap"
       <%_ } _%>
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
@@ -280,16 +294,30 @@ resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "<%- apiNameClassName %>Handler-additional-policies-${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -38,6 +38,18 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from `core/runtime-config/appconfig.application_id`). When set, the Lambda functions receive `RUNTIME_CONFIG_APP_ID` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from `core/runtime-config/appconfig.application_arn`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
   type        = string
@@ -240,7 +252,9 @@ resource "aws_lambda_function" "api_lambda" {
       AWS_LWA_INVOKE_MODE         = "response_stream"
       AWS_LAMBDA_EXEC_WRAPPER     = "/opt/bootstrap"
       <%_ } _%>
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
@@ -289,16 +303,30 @@ resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "<%- apiNameClassName %>Handler-additional-policies-${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption