@aws/nx-plugin 1.0.0-rc.4 → 1.0.0-rc.41

package/src/utils/agent-core-constructs/files/terraform/core/agent-core/runtime.tf.template

@@ -4,15 +4,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 6.23"
+      version = "<%- awsProviderVersion %>"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "<%- nullProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -70,6 +70,30 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Run the agent core runtime inside a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the agent core runtime in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the agent core runtime in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 variable "tags" {
   description = "Tags to apply to resources"
   type        = map(string)
@@ -95,8 +119,7 @@ resource "aws_ecr_repository" "agent_core_repository" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
   name = "${lower(var.agent_runtime_name)}_repository_${random_id.unique_suffix.hex}"
 
-  #checkov:skip=CKV_AWS_51:Image tag is reused for latest deployments
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -270,30 +293,64 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containers %> inspect ${var.docker_image_tag} --format '{{.Id}}')'\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 # Null resource for container image publish
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.agent_core_repository.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
       # Get ECR login token
-      aws ecr get-login-password --region ${local.aws_region} | <%= containers %> login --username AWS --password-stdin ${self.triggers.repository_url}
+      aws ecr get-login-password --region "$AWS_REGION" | <%= containers %> login --username AWS --password-stdin "$REPOSITORY_URL"
 
-      # Tag the image
-      <%= containers %> tag ${self.triggers.docker_image_tag} ${self.triggers.repository_url}:latest
+      # Tag the image with the immutable content-based tag
+      <%= containers %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
 
       # Push the image
-      <%= containers %> push ${self.triggers.repository_url}:latest
+      <%= containers %> push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
+    environment = {
+      AWS_REGION       = local.aws_region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.agent_core_ecr_policy]
 }
 
+# Security group for the agent core runtime, used when running inside a VPC
+resource "aws_security_group" "agent_core_runtime" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to the runtime via network_configuration; Checkov cannot resolve this reference
+  name_prefix = "${var.agent_runtime_name}-runtime-"
+  description = "Security group for the ${var.agent_runtime_name} agent core runtime"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "agent_core_runtime_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.agent_core_runtime[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Bedrock AgentCore Agent Runtime
 resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   agent_runtime_name = "${var.agent_runtime_name}_${random_id.unique_suffix.hex}"
@@ -302,7 +359,7 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
 
   agent_runtime_artifact {
     container_configuration {
-      container_uri = "${aws_ecr_repository.agent_core_repository.repository_url}:latest"
+      container_uri = "${aws_ecr_repository.agent_core_repository.repository_url}:${local.image_tag}"
     }
   }
 
@@ -320,7 +377,15 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   }
 
   network_configuration {
-    network_mode = "PUBLIC"
+    network_mode = var.enable_vpc ? "VPC" : "PUBLIC"
+
+    dynamic "network_mode_config" {
+      for_each = var.enable_vpc ? [1] : []
+      content {
+        security_groups = [aws_security_group.agent_core_runtime[0].id]
+        subnets         = var.subnet_ids
+      }
+    }
   }
 
   protocol_configuration {
@@ -335,7 +400,70 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   ]
 }
 
+# MCP consumers (e.g. gateway targets, which fetch tools at creation) can race
+# the runtime's first cold start, so probe it until it serves MCP. The ARN
+# output is routed through this resource so consumers wait for readiness.
+resource "null_resource" "runtime_ready" {
+  count = var.server_protocol == "MCP" ? 1 : 0
+
+  triggers = {
+    runtime_arn = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_arn
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      uv run --with boto3<%= boto3Version %> python -c "
+import boto3
+import json
+import os
+import time
+import uuid
+
+runtime_arn = os.environ['RUNTIME_ARN']
+client = boto3.client('bedrock-agentcore')
+initialize_request = json.dumps({
+    'jsonrpc': '2.0',
+    'id': 1,
+    'method': 'initialize',
+    'params': {
+        'protocolVersion': '2025-03-26',
+        'capabilities': {},
+        'clientInfo': {'name': 'readiness-probe', 'version': '1.0'},
+    },
+})
+
+deadline = time.time() + 5 * 60
+while True:
+    try:
+        client.invoke_agent_runtime(
+            agentRuntimeArn=runtime_arn,
+            runtimeSessionId=f'readiness-probe-{uuid.uuid4()}',
+            contentType='application/json',
+            accept='application/json, text/event-stream',
+            payload=initialize_request,
+        )
+        break
+    except Exception:
+        if time.time() >= deadline:
+            raise
+        time.sleep(5)
+
+print(f'Runtime {runtime_arn} is serving MCP')
+"
+    EOT
+    environment = {
+      RUNTIME_ARN = self.triggers.runtime_arn
+    }
+  }
+}
+
 # Outputs
+locals {
+  # For MCP runtimes the ARN flows through the readiness probe, so consumers
+  # wait until the runtime serves MCP.
+  ready_runtime_arn = var.server_protocol == "MCP" ? null_resource.runtime_ready[0].triggers.runtime_arn : aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_arn
+}
+
 output "agent_core_runtime_role_arn" {
   description = "ARN of the Agent Core Runtime IAM role"
   value       = aws_iam_role.agent_core_runtime_role.arn
@@ -352,8 +480,13 @@ output "agent_runtime_name" {
 }
 
 output "agent_core_runtime_arn" {
-  description = "ARN of the Bedrock Agent Core runtime"
-  value       = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_arn
+  description = "ARN of the Bedrock Agent Core runtime. For MCP runtimes the value flows through the readiness probe, so consumers wait until the runtime serves MCP."
+  value       = local.ready_runtime_arn
+}
+
+output "invocation_url" {
+  description = "HTTPS invocation URL of the runtime. MCP runtimes get the MCP endpoint (e.g. for use as a Gateway target endpoint), A2A runtimes the A2A endpoint (trailing slash required). For MCP runtimes the value flows through the readiness probe, so consumers wait until the runtime serves MCP."
+  value       = "https://bedrock-agentcore.${local.aws_region}.amazonaws.com/runtimes/${urlencode(local.ready_runtime_arn)}/invocations${var.server_protocol == "A2A" ? "/" : "?qualifier=DEFAULT"}"
 }
 
 output "agent_runtime_id" {
@@ -365,3 +498,8 @@ output "agent_runtime_version" {
   description = "Version of the Bedrock Agent Core runtime"
   value       = aws_bedrockagentcore_agent_runtime.agent_runtime.agent_runtime_version
 }
+
+output "security_group_id" {
+  description = "Security group ID of the agent core runtime, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.agent_core_runtime[0].id : null
+}

package/src/utils/agent-core-constructs/files/terraform/core/agentcore-gateway/gateway.tf.template

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
+  }
+}

package/src/utils/api-constructs/api-constructs.d.ts

@@ -2,8 +2,8 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Tree } from '@nx/devkit';
-import { Iac } from '../iac';
+import { type Tree } from '@nx/devkit';
+import type { Iac } from '../iac';
 interface BackendOptions {
     type: 'trpc' | 'fastapi' | 'smithy';
     integrationPattern: 'isolated' | 'shared';

package/src/utils/api-constructs/api-constructs.js

@@ -1,37 +1,33 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addApiGatewayInfra = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
-const ast_1 = require("../ast");
-const nx_1 = require("../nx");
-const addApiGatewayInfra = async (tree, options) => {
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { esmVars } from "../module-format.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { PY_VERSIONS, terraformProviderVersions } from "../versions.js";
+export const addApiGatewayInfra = async (tree, options)=>{
     if (options.iac === 'cdk') {
         await addApiGatewayCdkConstructs(tree, options);
-    }
-    else if (options.iac === 'terraform') {
+    } else if (options.iac === 'terraform') {
         addApiGatewayTerraformModules(tree, options);
-    }
-    else {
+    } else {
         throw new Error(`Unsupported iac ${options.iac}`);
     }
-    (0, devkit_1.updateJson)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, options.iac === 'cdk' ? shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR : shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'project.json'), (config) => {
-        (0, nx_1.addDependencyToTargetIfNotPresent)(config, 'build', `${options.apiProjectName}:build`);
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addDependencyToTargetIfNotPresent(config, 'build', `${options.apiProjectName}:build`);
         return config;
     });
 };
-exports.addApiGatewayInfra = addApiGatewayInfra;
 /**
  * Add an API CDK construct, and update the Runtime Config type to export its url
- */
-const addApiGatewayCdkConstructs = async (tree, options) => {
-    const generateCoreApiFile = (name) => {
-        (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'core', 'api', name), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core', 'api'), {}, {
-            overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+ */ const addApiGatewayCdkConstructs = async (tree, options)=>{
+    const generateCoreApiFile = (name)=>{
+        generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'api', name), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'api'), {
+            ...esmVars(tree)
+        }, {
+            overwriteStrategy: OverwriteStrategy.KeepExisting
         });
     };
     // Generate relevant core CDK construct and utilities
@@ -41,24 +37,33 @@ const addApiGatewayCdkConstructs = async (tree, options) => {
         generateCoreApiFile('trpc');
     }
     // Generate app specific CDK construct
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'app', 'apis', options.constructType), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'apis'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'apis', options.constructType), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'apis'), {
+        ...options,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     // Export app specific CDK construct
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'apis', 'index.ts'), `./${options.apiNameKebabCase}.js`);
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './apis/index.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'apis', 'index.ts'), `./${options.apiNameKebabCase}.js`);
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './apis/index.js');
 };
 /**
  * Add an API terraform module, and update the Runtime Config type to export its url
- */
-const addApiGatewayTerraformModules = (tree, options) => {
+ */ const addApiGatewayTerraformModules = (tree, options)=>{
     // Generate core terraform module
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'core', 'api', options.constructType), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core', 'api'), {}, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'api', options.constructType), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'), {
+        boto3Version: PY_VERSIONS.boto3,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     // Generate app specific terraform module
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'app', 'apis', options.constructType), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'apis', options.constructType), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'), {
+        ...options,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
 };
+
 //# sourceMappingURL=api-constructs.js.map

package/src/utils/api-constructs/api-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,gFAIwC;AACxC,gCAAuC;AAEvC,8BAA0D;AAmCnD,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAU,EACV,OAAqD,EACrD,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,6BAA6B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,mDAAqB,CAAC,CAAC,CAAC,kDAAoB,EACpE,cAAc,CACf,EACD,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAA,sCAAiC,EAC/B,MAAM,EACN,OAAO,EACP,GAAG,OAAO,CAAC,cAAc,QAAQ,CAClC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,kBAAkB,sBA4B7B;AAEF;;GAEG;AACH,MAAM,0BAA0B,GAAG,KAAK,EACtC,IAAU,EACV,OAAsC,EACtC,EAAE;IACF,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,EAAE;QAC3C,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,EACjE,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,KAAK,CACN,EACD,EAAE,EACF;YACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;SAClD,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,qDAAqD;IACrD,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACpC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,sCAAsC;IACtC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,KAAK,EACL,KAAK,EACL,MAAM,EACN,OAAO,CAAC,aAAa,CACtB,EACD,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,MAAM,CACP,EACD,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,oCAAoC;IACpC,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,KAAK,OAAO,CAAC,gBAAgB,KAAK,CACnC,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,iBAAiB,CAClB,CAAC;AACJ,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,6BAA6B,GAAG,CACpC,IAAU,EACV,OAAsC,EACtC,EAAE;IACF,iCAAiC;IACjC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,WAAW,EACX,MAAM,EACN,KAAK,EACL,OAAO,CAAC,aAAa,CACtB,EACD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAC3E,EAAE,EACF;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,yCAAyC;IACzC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,WAAW,EACX,KAAK,EACL,MAAM,EACN,OAAO,CAAC,aAAa,CACtB,EACD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAC3E,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { PY_VERSIONS, terraformProviderVersions } from '../versions';\n\ninterface BackendOptions {\n  type: 'trpc' | 'fastapi' | 'smithy';\n  integrationPattern: 'isolated' | 'shared';\n}\n\nexport interface TrpcBackendOptions extends BackendOptions {\n  type: 'trpc';\n  projectAlias: string;\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface FastApiBackendOptions extends BackendOptions {\n  type: 'fastapi';\n  moduleName: string;\n  bundleOutputDir: string;\n}\n\nexport interface SmithyBackendOptions extends BackendOptions {\n  type: 'smithy';\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface AddApiGatewayConstructOptions {\n  apiProjectName: string;\n  apiNameClassName: string;\n  apiNameKebabCase: string;\n  constructType: 'http' | 'rest';\n  backend: TrpcBackendOptions | FastApiBackendOptions | SmithyBackendOptions;\n  auth: 'iam' | 'cognito' | 'custom';\n}\n\nexport const addApiGatewayInfra = async (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addApiGatewayCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addApiGatewayTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.apiProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\n/**\n * Add an API CDK construct, and update the Runtime Config type to export its url\n */\nconst addApiGatewayCdkConstructs = async (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n) => {\n  const generateCoreApiFile = (name: string) => {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        'files',\n        'cdk',\n        'core',\n        'api',\n        name,\n      ),\n      joinPathFragments(\n        PACKAGES_DIR,\n        SHARED_CONSTRUCTS_DIR,\n        'src',\n        'core',\n        'api',\n      ),\n      { ...esmVars(tree) },\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  };\n\n  // Generate relevant core CDK construct and utilities\n  generateCoreApiFile(options.constructType);\n  generateCoreApiFile('utils');\n  if (options.backend.type === 'trpc') {\n    generateCoreApiFile('trpc');\n  }\n\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n      'index.ts',\n    ),\n    `./${options.apiNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './apis/index.js',\n  );\n};\n\n/**\n * Add an API terraform module, and update the Runtime Config type to export its url\n */\nconst addApiGatewayTerraformModules = (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n) => {\n  // Generate core terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'api',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'),\n    { boto3Version: PY_VERSIONS.boto3, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","addApiGatewayInfra","tree","options","iac","addApiGatewayCdkConstructs","addApiGatewayTerraformModules","Error","config","apiProjectName","generateCoreApiFile","name","dirname","overwriteStrategy","KeepExisting","constructType","backend","type","apiNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAEvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,WAAW,EAAEC,yBAAyB,QAAQ,iBAAc;AAmCrE,OAAO,MAAMC,qBAAqB,OAChCC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,2BAA2BH,MAAMC;IACzC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,8BAA8BJ,MAAMC;IACtC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAZ,WACEU,MACAZ,kBACEM,cACAO,QAAQC,GAAG,KAAK,QAAQP,wBAAwBC,sBAChD,iBAEF,CAACU;QACCb,kCACEa,QACA,SACA,GAAGL,QAAQM,cAAc,CAAC,MAAM,CAAC;QAEnC,OAAOD;IACT;AAEJ,EAAE;AAEF;;CAEC,GACD,MAAMH,6BAA6B,OACjCH,MACAC;IAEA,MAAMO,sBAAsB,CAACC;QAC3BtB,cACEa,MACAZ,kBACE,YAAYsB,OAAO,EACnB,SACA,OACA,QACA,OACAD,OAEFrB,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;YAAE,GAAGH,QAAQQ,KAAK;QAAC,GACnB;YACEW,mBAAmBtB,kBAAkBuB,YAAY;QACnD;IAEJ;IAEA,qDAAqD;IACrDJ,oBAAoBP,QAAQY,aAAa;IACzCL,oBAAoB;IACpB,IAAIP,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnCP,oBAAoB;IACtB;IAEA,sCAAsC;IACtCrB,cACEa,MACAZ,kBACE,YAAYsB,OAAO,EACnB,SACA,OACA,OACA,QACAT,QAAQY,aAAa,GAEvBzB,kBACEM,cACAC,uBACA,OACA,OACA,SAEF;QAAE,GAAGM,OAAO;QAAE,GAAGT,QAAQQ,KAAK;IAAC,GAC/B;QACEW,mBAAmBtB,kBAAkBuB,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAMrB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,QACA,aAEF,CAAC,EAAE,EAAEM,QAAQe,gBAAgB,CAAC,GAAG,CAAC;IAEpC,MAAMzB,cACJS,MACAZ,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA;;CAEC,GACD,MAAMS,gCAAgC,CACpCJ,MACAC;IAEA,iCAAiC;IACjCd,cACEa,MACAZ,kBACE,YAAYsB,OAAO,EACnB,SACA,aACA,QACA,OACAT,QAAQY,aAAa,GAEvBzB,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAEqB,cAAcpB,YAAYqB,KAAK;QAAE,GAAGpB,2BAA2B;IAAC,GAClE;QACEa,mBAAmBtB,kBAAkBuB,YAAY;IACnD;IAGF,yCAAyC;IACzCzB,cACEa,MACAZ,kBACE,YAAYsB,OAAO,EACnB,SACA,aACA,OACA,QACAT,QAAQY,aAAa,GAEvBzB,kBAAkBM,cAAcE,sBAAsB,OAAO,OAAO,SACpE;QAAE,GAAGK,OAAO;QAAE,GAAGH,2BAA2B;IAAC,GAC7C;QACEa,mBAAmBtB,kBAAkBuB,YAAY;IACnD;AAEJ"}

package/src/utils/api-constructs/files/cdk/app/apis/http/__apiNameKebabCase__.ts.template

@@ -13,7 +13,7 @@ import {
   <%_ } _%>
 } from 'aws-cdk-lib/aws-lambda';
 import { Duration<%_ if (backend.type === 'fastapi') { _%>, Stack<%_ } _%> } from 'aws-cdk-lib';
-import { RuntimeConfig } from '../../core/runtime-config.js';
+import { RuntimeConfig } from '../../core/runtime-config<% if (esm) { %>.js<% } %>';
 import {
   CorsHttpMethod,
   CfnApi,
@@ -41,10 +41,10 @@ import {
   ApiIntegrations,
   HttpApiIntegration,
   IntegrationBuilder,
-} from '../../core/api/utils.js';
-import { HttpApi } from '../../core/api/http-api.js';
+} from '../../core/api/utils<% if (esm) { %>.js<% } %>';
+import { HttpApi } from '../../core/api/http-api<% if (esm) { %>.js<% } %>';
 <%_ if (backend.type === 'trpc') { _%>
-import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
+import { Procedures, routerToOperations } from '../../core/api/trpc-utils<% if (esm) { %>.js<% } %>';
 import { AppRouter, appRouter } from '<%= backend.projectAlias %>';
 
 // String union type for all API operation names
@@ -116,7 +116,7 @@ export class <%= apiNameClassName %><
           url.fileURLToPath(
             new URL(
               '../../../../../../<%- backend.bundleOutputDir %>',
-              import.meta.url,
+              <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
             ),
           ),
         ),
@@ -127,7 +127,7 @@ export class <%= apiNameClassName %><
           url.fileURLToPath(
             new URL(
               '../../../../../../<%- backend.bundleOutputDir %>',
-              import.meta.url,
+              <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
             ),
           ),
         ),
@@ -184,7 +184,7 @@ export class <%= apiNameClassName %><
         url.fileURLToPath(
           new URL(
             '../../../../../../<%- backend.authorizerBundleOutputDir %>',
-            import.meta.url,
+            <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
           ),
         ),
       ),
@@ -195,7 +195,7 @@ export class <%= apiNameClassName %><
         url.fileURLToPath(
           new URL(
             '../../../../../../<%- backend.bundleOutputDir %>',
-            import.meta.url,
+            <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
           ),
         ),
       ),

package/src/utils/api-constructs/files/cdk/app/apis/rest/__apiNameKebabCase__.ts.template

@@ -12,7 +12,7 @@ import {
   SnapStartConf,
   <%_ } _%>
 } from 'aws-cdk-lib/aws-lambda';
-import { RuntimeConfig } from '../../core/runtime-config.js';
+import { RuntimeConfig } from '../../core/runtime-config<% if (esm) { %>.js<% } %>';
 import {
   AuthorizationType,
   LambdaIntegration,
@@ -44,10 +44,10 @@ import {
   ApiIntegrations,
   IntegrationBuilder,
   RestApiIntegration,
-} from '../../core/api/utils.js';
-import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
+} from '../../core/api/utils<% if (esm) { %>.js<% } %>';
+import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api<% if (esm) { %>.js<% } %>';
 <%_ if (backend.type === 'trpc') { _%>
-import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
+import { Procedures, routerToOperations } from '../../core/api/trpc-utils<% if (esm) { %>.js<% } %>';
 import { AppRouter, appRouter } from '<%= backend.projectAlias %>';
 
 // String union type for all API operation names
@@ -126,7 +126,7 @@ export class <%= apiNameClassName %><
           url.fileURLToPath(
             new URL(
               '../../../../../../<%- backend.bundleOutputDir %>',
-              import.meta.url,
+              <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
             ),
           ),
         ),
@@ -137,7 +137,7 @@ export class <%= apiNameClassName %><
           url.fileURLToPath(
             new URL(
               '../../../../../../<%- backend.bundleOutputDir %>',
-              import.meta.url,
+              <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
             ),
           ),
         ),
@@ -204,7 +204,7 @@ export class <%= apiNameClassName %><
         url.fileURLToPath(
           new URL(
             '../../../../../../<%- backend.authorizerBundleOutputDir %>',
-            import.meta.url,
+            <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
           ),
         ),
       ),
@@ -215,7 +215,7 @@ export class <%= apiNameClassName %><
         url.fileURLToPath(
           new URL(
             '../../../../../../<%- backend.bundleOutputDir %>',
-            import.meta.url,
+            <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
           ),
         ),
       ),
@@ -235,6 +235,9 @@ export class <%= apiNameClassName %><
         authorizer: new CognitoUserPoolsAuthorizer(scope, '<%= apiNameClassName %>Authorizer', {
           cognitoUserPools: [props.identity.userPool],
         }),
+        // Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+        // and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+        authorizationScopes: ['openid', 'aws.cognito.signin.user.admin'],
         <%_ } else if (auth === 'custom') { _%>
         authorizationType: AuthorizationType.CUSTOM,
         authorizer: new TokenAuthorizer(scope, '<%= apiNameClassName %>TokenAuthorizer', {

package/src/utils/api-constructs/files/cdk/core/api/http/http-api.ts.template

@@ -1,20 +1,23 @@
 import { Construct } from 'constructs';
-import { RuntimeConfig } from '../runtime-config.js';
+import { RuntimeConfig } from '../runtime-config<% if (esm) { %>.js<% } %>';
 import {
   ApiIntegrations,
   HttpApiIntegration,
   OperationDetails,
-} from './utils.js';
-import { CfnOutput } from 'aws-cdk-lib';
+} from './utils<% if (esm) { %>.js<% } %>';
+import { CfnOutput, Stack } from 'aws-cdk-lib';
 import {
   HttpApi as _HttpApi,
   HttpApiProps as _HttpApiProps,
   HttpMethod,
   HttpStage,
   LogGroupLogDestination,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
 import { LogGroup } from 'aws-cdk-lib/aws-logs';
-import { suppressRules } from '../checkov.js';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { suppressRules } from '../checkov<% if (esm) { %>.js<% } %>';
 
 /**
  * Properties for creating an HttpApi construct.
@@ -38,6 +41,12 @@ export interface HttpApiProps<
    * Map of operation names to their API Gateway integrations
    */
   readonly integrations: TIntegrations;
+  /**
+   * Default throttling limits applied to the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -71,6 +80,7 @@ export class HttpApi<
       apiName,
       operations,
       integrations,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: HttpApiProps<TIntegrations, TOperation>,
   ) {
@@ -83,12 +93,18 @@ export class HttpApi<
       ...props,
     });
 
-    const accessLogGroup = new LogGroup(this, 'AccessLogs');
-    suppressRules(
-      accessLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption',
+    // Customer-managed key for access log encryption at rest
+    const logsKey = new Key(this, 'AccessLogsKey', {
+      enableKeyRotation: true,
+    });
+    const stack = Stack.of(this);
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(`logs.${stack.region}.amazonaws.com`),
     );
+
+    const accessLogGroup = new LogGroup(this, 'AccessLogs', {
+      encryptionKey: logsKey,
+    });
     suppressRules(
       accessLogGroup,
       ['CKV_AWS_66', 'CKV_AWS_338'],
@@ -98,6 +114,7 @@ export class HttpApi<
     this.defaultStage = new HttpStage(this, 'DefaultStage', {
       httpApi: this.api,
       autoDeploy: true,
+      throttle,
       accessLogSettings: {
         destination: new LogGroupLogDestination(accessLogGroup),
       },