@aws/nx-plugin 1.0.0-rc.44 → 1.0.0-rc.45

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/protected-resource-metadata.ts.template

@@ -0,0 +1,13 @@
+import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const proxyUrl = `https://${event.requestContext.domainName}`;
+  return {
+    statusCode: 200,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      resource: `${proxyUrl}/mcp`,
+      authorization_servers: [proxyUrl],
+    }),
+  };
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/register.ts.template

@@ -0,0 +1,70 @@
+import type {
+  APIGatewayProxyHandlerV2,
+  APIGatewayProxyStructuredResultV2,
+} from 'aws-lambda';
+
+const COGNITO_CLIENT_ID = process.env.COGNITO_CLIENT_ID!;
+
+interface RegisterRequest {
+  redirect_uris?: unknown;
+  [key: string]: unknown;
+}
+
+function jsonResponse(
+  statusCode: number,
+  body: unknown,
+): APIGatewayProxyStructuredResultV2 {
+  return {
+    statusCode,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  };
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  if (!event.body) {
+    return jsonResponse(400, {
+      error: 'invalid_client_metadata',
+      error_description: 'request body is required',
+    });
+  }
+
+  let req: RegisterRequest;
+  try {
+    req = JSON.parse(event.body) as RegisterRequest;
+  } catch {
+    return jsonResponse(400, {
+      error: 'invalid_client_metadata',
+      error_description: 'request body must be valid JSON',
+    });
+  }
+
+  const redirectUris = req.redirect_uris;
+  if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
+    return jsonResponse(400, {
+      error: 'invalid_redirect_uri',
+      error_description: 'redirect_uris is required and must be a non-empty array',
+    });
+  }
+
+  // The proxy fronts a single Cognito App Client, so Cognito performs the
+  // authoritative check: any redirect_uri forwarded to the Hosted UI must be
+  // registered as a callback URL on that App Client. The proxy only validates
+  // the request shape here and passes the URIs through unchanged.
+  for (const uri of redirectUris) {
+    if (typeof uri !== 'string') {
+      return jsonResponse(400, {
+        error: 'invalid_redirect_uri',
+        error_description: 'each redirect_uri must be a string',
+      });
+    }
+  }
+
+  return jsonResponse(201, {
+    client_id: COGNITO_CLIENT_ID,
+    redirect_uris: redirectUris,
+    token_endpoint_auth_method: 'none',
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+  });
+};

package/src/utils/dcr-proxy-constructs/files/project/src/handlers/token.ts.template

@@ -0,0 +1,75 @@
+import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+import {
+  SecretsManagerClient,
+  GetSecretValueCommand,
+} from '@aws-sdk/client-secrets-manager';
+
+const COGNITO_HOSTED_UI_BASE = process.env.COGNITO_HOSTED_UI_BASE!;
+const COGNITO_CLIENT_ID = process.env.COGNITO_CLIENT_ID!;
+const COGNITO_CLIENT_SECRET_ARN = process.env.COGNITO_CLIENT_SECRET_ARN!;
+const COGNITO_REGION = process.env.COGNITO_REGION!;
+
+const sm = new SecretsManagerClient({ region: COGNITO_REGION });
+let cachedSecret: string | undefined;
+
+async function getClientSecret(): Promise<string> {
+  if (cachedSecret) return cachedSecret;
+  const res = await sm.send(
+    new GetSecretValueCommand({ SecretId: COGNITO_CLIENT_SECRET_ARN }),
+  );
+  if (!res.SecretString) {
+    throw new Error('client_secret missing in Secrets Manager');
+  }
+  cachedSecret = res.SecretString;
+  return cachedSecret;
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  if (!event.body) {
+    return {
+      statusCode: 400,
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        error: 'invalid_request',
+        error_description: 'request body is required',
+      }),
+    };
+  }
+
+  const rawBody = event.isBase64Encoded
+    ? Buffer.from(event.body, 'base64').toString('utf-8')
+    : event.body;
+
+  const params = new URLSearchParams(rawBody);
+
+  // Always force the real Cognito client_id and inject the server-side secret.
+  // DCR returned the same client_id to every caller, but we re-assert here
+  // to keep client_id/secret consistent regardless of what the caller sent.
+  params.set('client_id', COGNITO_CLIENT_ID);
+  params.set('client_secret', await getClientSecret());
+
+  // Cognito does not understand RFC 8707 `resource`; some MCP clients send it
+  // and Cognito has been observed to reject the exchange when present.
+  params.delete('resource');
+
+  const res = await fetch(`${COGNITO_HOSTED_UI_BASE}/oauth2/token`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: params.toString(),
+  });
+
+  const responseBody = await res.text();
+  console.log('[token]', {
+    grant_type: params.get('grant_type'),
+    status: res.status,
+    ...(res.ok ? {} : { body: responseBody }),
+  });
+
+  return {
+    statusCode: res.status,
+    headers: {
+      'content-type': res.headers.get('content-type') ?? 'application/json',
+    },
+    body: responseBody,
+  };
+};

package/src/utils/dcr-proxy-constructs/files/terraform/app/dcr-proxies/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -0,0 +1,410 @@
+# OAuth Dynamic Client Registration (DCR) proxy for Amazon Cognito.
+#
+# Lets MCP clients (Claude Code, Kiro CLI, MCP Inspector, ...) authenticate
+# against an Amazon Cognito User Pool while keeping the Hosted UI flow intact,
+# supporting RFC 7591 Dynamic Client Registration, and never exposing the
+# Cognito App Client secret to the client.
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "<%- archiveProviderVersion %>"
+    }
+  }
+}
+
+# Cognito configuration (injected by the caller)
+variable "user_pool_id" {
+  description = "Cognito User Pool id (e.g. us-east-1_abc123)"
+  type        = string
+}
+
+variable "user_pool_client_id" {
+  description = "Cognito User Pool App Client id"
+  type        = string
+}
+
+variable "cognito_client_secret_arn" {
+  description = "ARN of the Secrets Manager secret holding the Cognito App Client secret. The token handler reads this at runtime; the secret is never exposed to the client."
+  type        = string
+}
+
+variable "cognito_hosted_ui_base" {
+  description = "Base URL of the Cognito Hosted UI domain, without a trailing slash (e.g. https://my-domain.auth.us-east-1.amazoncognito.com)"
+  type        = string
+}
+
+variable "upstream_url" {
+  description = "Full URL of the upstream MCP server. The proxy forwards /mcp requests to this URL and rewrites the upstream WWW-Authenticate header."
+  type        = string
+}
+
+variable "env" {
+  description = "Additional environment variables applied to all proxy Lambda functions"
+  type        = map(string)
+  default     = {}
+}
+
+# CORS Configuration (passed to the core http-api module)
+variable "cors_allow_headers" {
+  description = "List of allowed headers for CORS"
+  type        = list(string)
+  default     = ["authorization", "content-type", "mcp-protocol-version"]
+}
+
+variable "cors_allow_methods" {
+  description = "List of allowed HTTP methods for CORS"
+  type        = list(string)
+  default     = ["GET", "POST", "DELETE", "OPTIONS"]
+}
+
+variable "cors_allow_origins" {
+  description = "List of allowed origins for CORS"
+  type        = list(string)
+  default     = ["*"]
+}
+
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zips. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
+  type        = string
+}
+
+variable "mcp_proxy_timeout" {
+  description = "Timeout (seconds) applied to the MCP proxy Lambda. Defaults to 29 (the API Gateway HTTP API integration limit)."
+  type        = number
+  default     = 29
+}
+
+variable "mcp_proxy_memory_size" {
+  description = "Memory size (MB) for the MCP proxy Lambda"
+  type        = number
+  default     = 512
+}
+
+variable "tags" {
+  description = "Tags to apply to all resources"
+  type        = map(string)
+  default     = {}
+}
+
+data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+# The Cognito App Client secret, referenced by ARN so the token handler's role
+# can be scoped to read exactly this secret.
+data "aws_secretsmanager_secret" "cognito_client_secret" {
+  arn = var.cognito_client_secret_arn
+}
+
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
+locals {
+  aws_account_id = data.aws_caller_identity.current.account_id
+  aws_region     = data.aws_region.current.region
+
+  base_env = merge({
+    COGNITO_CLIENT_ID         = var.user_pool_client_id
+    COGNITO_CLIENT_SECRET_ARN = var.cognito_client_secret_arn
+    COGNITO_ISSUER            = "https://cognito-idp.${local.aws_region}.amazonaws.com/${var.user_pool_id}"
+    COGNITO_HOSTED_UI_BASE    = var.cognito_hosted_ui_base
+    COGNITO_REGION            = local.aws_region
+  }, var.env)
+
+  # Workspace-root-relative bundle output directory per handler
+  handler_bundle_dirs = {
+    "protected-resource-metadata"   = "<%- bundlePathsFromRoot['protected-resource-metadata'] %>"
+    "authorization-server-metadata" = "<%- bundlePathsFromRoot['authorization-server-metadata'] %>"
+    "register"                      = "<%- bundlePathsFromRoot['register'] %>"
+    "authorize"                     = "<%- bundlePathsFromRoot['authorize'] %>"
+    "token"                         = "<%- bundlePathsFromRoot['token'] %>" #checkov:skip=CKV_SECRET_6:Value is a Lambda bundle output path, not a secret
+    "mcp-proxy"                     = "<%- bundlePathsFromRoot['mcp-proxy'] %>"
+  }
+
+  # Handlers deployed with the standard configuration (timeout 10s, mem 256).
+  # mcp-proxy is deployed separately since its env/timeout/memory differ.
+  standard_handlers = {
+    for name, dir in local.handler_bundle_dirs : name => dir if name != "mcp-proxy"
+  }
+}
+
+# Package each handler's rolldown bundle into a deployment zip
+data "archive_file" "handler_zip" {
+  for_each = local.handler_bundle_dirs
+
+  type        = "zip"
+  source_dir  = "${path.module}/../../../../../../../${each.value}"
+  output_path = "${path.module}/../../../../../../../dist/packages/common/terraform/dcr-proxies/<%- nameKebabCase %>/${each.key}/lambda.zip"
+}
+
+resource "aws_s3_object" "handler_zip" {
+  for_each = local.handler_bundle_dirs
+
+  bucket      = var.asset_bucket_name
+  key         = "dcr-proxies/<%- nameKebabCase %>/${each.key}/${data.archive_file.handler_zip[each.key].output_sha256}.zip"
+  source      = data.archive_file.handler_zip[each.key].output_path
+  source_hash = data.archive_file.handler_zip[each.key].output_base64sha256
+  etag        = data.archive_file.handler_zip[each.key].output_md5
+}
+
+# Shared execution role for handlers that do not read the client secret
+resource "aws_iam_role" "proxy" {
+  name = "<%- nameKebabCase %>-proxy-${random_string.suffix.result}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+
+  tags = var.tags
+}
+
+# Dedicated role for the token handler, additionally granted read access to the
+# Cognito App Client secret only.
+resource "aws_iam_role" "token" {
+  name = "<%- nameKebabCase %>-token-${random_string.suffix.result}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_iam_role_policy_attachment" "proxy_basic" {
+  role       = aws_iam_role.proxy.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "proxy_xray" {
+  role       = aws_iam_role.proxy.name
+  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
+}
+
+resource "aws_iam_role_policy_attachment" "token_basic" {
+  role       = aws_iam_role.token.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "token_xray" {
+  role       = aws_iam_role.token.name
+  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
+}
+
+resource "aws_iam_role_policy" "token_secret_read" {
+  name = "<%- nameKebabCase %>-token-secret-read-${random_string.suffix.result}"
+  role = aws_iam_role.token.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["secretsmanager:GetSecretValue"]
+      Resource = [data.aws_secretsmanager_secret.cognito_client_secret.arn]
+    }]
+  })
+}
+
+# Standard handler Lambda functions
+resource "aws_lambda_function" "standard" {
+  #checkov:skip=CKV_AWS_117:Lambda does not need to be in a VPC for this use case
+  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this use case
+  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
+  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
+  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
+  for_each = local.standard_handlers
+
+  s3_bucket        = aws_s3_object.handler_zip[each.key].bucket
+  s3_key           = aws_s3_object.handler_zip[each.key].key
+  function_name    = "<%- nameKebabCase %>-${each.key}-${random_string.suffix.result}"
+  role             = each.key == "token" ? aws_iam_role.token.arn : aws_iam_role.proxy.arn
+  handler          = "index.handler"
+  runtime          = "nodejs22.x"
+  architectures    = ["arm64"]
+  source_code_hash = data.archive_file.handler_zip[each.key].output_base64sha256
+  timeout          = 10
+  memory_size      = 256
+
+  tracing_config {
+    mode = "Active"
+  }
+
+  environment {
+    variables = local.base_env
+  }
+
+  tags = var.tags
+}
+
+# MCP proxy Lambda function (extended env, timeout and memory)
+resource "aws_lambda_function" "mcp_proxy" {
+  #checkov:skip=CKV_AWS_117:Lambda does not need to be in a VPC for this use case
+  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this use case
+  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
+  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
+  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
+  s3_bucket        = aws_s3_object.handler_zip["mcp-proxy"].bucket
+  s3_key           = aws_s3_object.handler_zip["mcp-proxy"].key
+  function_name    = "<%- nameKebabCase %>-mcp-proxy-${random_string.suffix.result}"
+  role             = aws_iam_role.proxy.arn
+  handler          = "index.handler"
+  runtime          = "nodejs22.x"
+  architectures    = ["arm64"]
+  source_code_hash = data.archive_file.handler_zip["mcp-proxy"].output_base64sha256
+  timeout          = var.mcp_proxy_timeout
+  memory_size      = var.mcp_proxy_memory_size
+
+  tracing_config {
+    mode = "Active"
+  }
+
+  environment {
+    variables = merge(local.base_env, {
+      UPSTREAM_URL       = var.upstream_url
+      PROXY_METADATA_URL = "${module.http_api.api_endpoint}/.well-known/oauth-protected-resource"
+    })
+  }
+
+  tags = var.tags
+}
+
+# HTTP API Gateway (shared core module)
+module "http_api" {
+  source = "../../../core/api/http-api"
+
+  api_name           = "<%- nameKebabCase %>-mcp-auth-proxy-${random_string.suffix.result}"
+  api_description    = "MCP-compatible OAuth proxy for Amazon Cognito"
+  stage_name         = "$default"
+  stage_auto_deploy  = true
+  cors_allow_headers = var.cors_allow_headers
+  cors_allow_methods = var.cors_allow_methods
+  cors_allow_origins = var.cors_allow_origins
+
+  tags = var.tags
+}
+
+# Integrations
+resource "aws_apigatewayv2_integration" "standard" {
+  for_each = local.standard_handlers
+
+  api_id                 = module.http_api.api_id
+  integration_type       = "AWS_PROXY"
+  integration_uri        = aws_lambda_function.standard[each.key].invoke_arn
+  payload_format_version = "2.0"
+  timeout_milliseconds   = 30000
+}
+
+resource "aws_apigatewayv2_integration" "mcp_proxy" {
+  api_id                 = module.http_api.api_id
+  integration_type       = "AWS_PROXY"
+  integration_uri        = aws_lambda_function.mcp_proxy.invoke_arn
+  payload_format_version = "2.0"
+  timeout_milliseconds   = 29000
+}
+
+# Routes. jwks_uri/issuer are handled by Cognito; the proxy hosts the OAuth
+# metadata, authorize, token and registration endpoints plus the /mcp proxy.
+locals {
+  routes = {
+    "GET /.well-known/oauth-protected-resource"   = "protected-resource-metadata"
+    "GET /.well-known/oauth-authorization-server" = "authorization-server-metadata"
+    "GET /.well-known/openid-configuration"       = "authorization-server-metadata"
+    "POST /register"                              = "register"
+    "GET /authorize"                              = "authorize"
+    "POST /oauth/token"                           = "token"
+  }
+}
+
+# OAuth discovery, registration and authorization endpoints are part of the
+# public DCR/OAuth flow and must be reachable without prior authorization.
+resource "aws_apigatewayv2_route" "standard" {
+  #checkov:skip=CKV_AWS_309:Public OAuth/DCR endpoints must be accessible without authorization
+  for_each = local.routes
+
+  api_id             = module.http_api.api_id
+  route_key          = each.key
+  target             = "integrations/${aws_apigatewayv2_integration.standard[each.value].id}"
+  authorization_type = "NONE"
+}
+
+# The /mcp route enforces authorization at the upstream MCP server, so the
+# proxy route itself is intentionally left open.
+resource "aws_apigatewayv2_route" "mcp_proxy" {
+  #checkov:skip=CKV_AWS_309:Authorization is enforced by the upstream MCP server, not this proxy route
+  api_id             = module.http_api.api_id
+  route_key          = "ANY /mcp"
+  target             = "integrations/${aws_apigatewayv2_integration.mcp_proxy.id}"
+  authorization_type = "NONE"
+}
+
+# Permissions for API Gateway to invoke each Lambda
+resource "aws_lambda_permission" "standard" {
+  for_each = local.standard_handlers
+
+  statement_id  = "AllowAPIGatewayInvoke"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.standard[each.key].function_name
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "${module.http_api.api_execution_arn}/*/*"
+}
+
+resource "aws_lambda_permission" "mcp_proxy" {
+  statement_id  = "AllowAPIGatewayInvoke"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.mcp_proxy.function_name
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "${module.http_api.api_execution_arn}/*/*"
+}
+
+# Outputs
+output "proxy_url" {
+  description = "Base URL of the DCR proxy"
+  value       = module.http_api.api_endpoint
+}
+
+output "mcp_url" {
+  description = "MCP endpoint proxied to the upstream server"
+  value       = "${module.http_api.api_endpoint}/mcp"
+}
+
+output "metadata_url" {
+  description = "OAuth protected-resource metadata URL"
+  value       = "${module.http_api.api_endpoint}/.well-known/oauth-protected-resource"
+}
+
+output "auth_server_metadata_url" {
+  description = "OAuth authorization-server metadata URL"
+  value       = "${module.http_api.api_endpoint}/.well-known/oauth-authorization-server"
+}
+
+output "token_endpoint" {
+  description = "OAuth token endpoint"
+  value       = "${module.http_api.api_endpoint}/oauth/token"
+}
+
+output "registration_endpoint" {
+  description = "Dynamic Client Registration endpoint"
+  value       = "${module.http_api.api_endpoint}/register"
+}
+
+output "api_id" {
+  description = "ID of the HTTP API Gateway"
+  value       = module.http_api.api_id
+}

package/src/utils/docker.d.ts

@@ -27,8 +27,9 @@ export interface DockerScanTargetOptions {
     readonly imageTags: string[];
 }
 /**
- * Add a cacheable Trivy scan target for the images built by a docker target,
- * wire it under the aggregate \`trivy\` target, and make \`build\` depend on it.
+ * Add a cacheable Trivy scan target for the images built by a docker target
+ * and wire it under the aggregate \`trivy\` target. The scan is not part of
+ * \`build\` — run \`nx run-many --target trivy\` (the root \`trivy\` script) in CI.
  *
  * The scan target depends on the docker target and declares the project source
  * as its inputs, so an unchanged image is never re-scanned (a cache hit skips
@@ -36,7 +37,7 @@ export interface DockerScanTargetOptions {
  * \`dist/<projectRoot>/trivy/<scan-key>\` (kept out of any Docker build context)
  * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative
  * bind mount, so the same commands work under both docker and finch. The scan
- * fails the build (exit code 1) on HIGH/CRITICAL vulnerabilities.
+ * exits non-zero (exit code 1) on HIGH/CRITICAL vulnerabilities.
  *
  * A \`.trivyignore\` is vended at the project root (kept if it already exists)
  * for suppressing findings.

package/src/utils/docker.js

@@ -7,12 +7,13 @@ import { addDependencyToTargetIfNotPresent } from "./nx.js";
 import { CONTAINER_VERSIONS } from "./versions.js";
 const TRIVY_IGNORE_FILE = '.trivyignore';
 const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to
-# suppress it during the image scan run on build.
+# suppress it during the image scan (\`nx run-many --target trivy\`).
 # https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids
 `;
 /**
- * Add a cacheable Trivy scan target for the images built by a docker target,
- * wire it under the aggregate \`trivy\` target, and make \`build\` depend on it.
+ * Add a cacheable Trivy scan target for the images built by a docker target
+ * and wire it under the aggregate \`trivy\` target. The scan is not part of
+ * \`build\` — run \`nx run-many --target trivy\` (the root \`trivy\` script) in CI.
  *
  * The scan target depends on the docker target and declares the project source
  * as its inputs, so an unchanged image is never re-scanned (a cache hit skips
@@ -20,7 +21,7 @@ const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.
  * \`dist/<projectRoot>/trivy/<scan-key>\` (kept out of any Docker build context)
  * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative
  * bind mount, so the same commands work under both docker and finch. The scan
- * fails the build (exit code 1) on HIGH/CRITICAL vulnerabilities.
+ * exits non-zero (exit code 1) on HIGH/CRITICAL vulnerabilities.
  *
  * A \`.trivyignore\` is vended at the project root (kept if it already exists)
  * for suppressing findings.
@@ -70,12 +71,15 @@ const TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.
             dockerTargetName
         ]
     };
-    // Aggregate per-component scan targets under a single `trivy` target, and
-    // make `build` run the scan.
+    // Aggregate per-component scan targets under a single `trivy` target. The
+    // scan is intentionally NOT wired into `build`: image scanning is slow and
+    // its result depends on the ever-changing vulnerability database (a scan
+    // that passes today can fail tomorrow when a new CVE is published), so
+    // coupling it to `build` would make local and CI builds non-deterministic.
+    // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.
     if (trivyTargetName !== 'trivy') {
         addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);
     }
-    addDependencyToTargetIfNotPresent(project, 'build', 'trivy');
 };
 
 //# sourceMappingURL=docker.js.map

package/src/utils/docker.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { CONTAINER_VERSIONS } from './versions';\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan run on build.\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target,\n * wire it under the aggregate \\`trivy\\` target, and make \\`build\\` depend on it.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * fails the build (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = (\n  tree: Tree,\n  options: DockerScanTargetOptions,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;\n\n  const fs = new FsCommands(tree);\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target, and\n  // make `build` run the scan.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n  addDependencyToTargetIfNotPresent(project, 'build', 'trivy');\n};\n"],"names":["joinPathFragments","FsCommands","addDependencyToTargetIfNotPresent","CONTAINER_VERSIONS","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","addDockerScanTarget","tree","options","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","trivy","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,UAAU,QAAQ,UAAO;AAClC,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,kBAAkB,QAAQ,gBAAa;AAEhD,MAAMC,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AA0BD;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEJ;IACF,MAAM,EAAEK,SAAS,EAAE,GAAGL;IACtB,MAAMM,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiBhB,kBAAkBc,aAAaV;IACtD,IAAI,CAACG,KAAKU,MAAM,CAACD,iBAAiB;QAChCT,KAAKW,KAAK,CAACF,gBAAgBX;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMc,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUrB,kBAAkB,QAAQc,aAAa,SAASK;IAChE,MAAMG,aAAa,CAAC,kCAAkC,EAAEnB,mBAAmBoB,KAAK,EAAE;IAElF,MAAMC,KAAK,IAAIvB,WAAWM;IAC1B,MAAMkB,WAAW;QACfD,GAAGE,EAAE,CAACL;QACNG,GAAGG,KAAK,CAACN;QACTG,GAAGI,EAAE,CAACZ,gBAAgBhB,kBAAkBqB,SAASjB;KAClD;IAEDS,UAAUgB,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGvB,gBAAgB,SAAS,EAAEV,kBAAkBqB,SAASW,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGpB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAEU,QAAQ,oBAAoB,EAAE5B,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAK,QAAQyB,OAAO,KAAK,CAAC;IACrBzB,QAAQyB,OAAO,CAACvB,gBAAgB,GAAG;QACjCwB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEhB,SAAS;SAAC;QACvCiB,UAAU;QACV9B,SAAS;YACPiB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC5B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,6BAA6B;IAC7B,IAAID,oBAAoB,SAAS;QAC/BT,kCAAkCO,SAAS,SAASE;IACtD;IACAT,kCAAkCO,SAAS,SAAS;AACtD,EAAE"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/docker.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n} from '@nx/devkit';\nimport { FsCommands } from './fs';\nimport { addDependencyToTargetIfNotPresent } from './nx';\nimport { CONTAINER_VERSIONS } from './versions';\n\nconst TRIVY_IGNORE_FILE = '.trivyignore';\n\nconst TRIVY_IGNORE_CONTENTS = `# Trivy ignore file. Add one vulnerability ID (e.g. CVE-2021-12345) per line to\n# suppress it during the image scan (\\`nx run-many --target trivy\\`).\n# https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids\n`;\n\nexport interface DockerScanTargetOptions {\n  /**\n   * Project configuration to add the scan target to (mutated in place).\n   */\n  readonly project: ProjectConfiguration;\n  /**\n   * Container engine command to invoke (\\`docker\\` or \\`finch\\`).\n   */\n  readonly containerEngine: string;\n  /**\n   * Name of the scan target to add, e.g. \\`my-agent-trivy\\`.\n   */\n  readonly trivyTargetName: string;\n  /**\n   * Name of the docker target that builds the image(s) to scan. The scan\n   * target depends on it.\n   */\n  readonly dockerTargetName: string;\n  /**\n   * Tags of the images built by the docker target which should be scanned.\n   */\n  readonly imageTags: string[];\n}\n\n/**\n * Add a cacheable Trivy scan target for the images built by a docker target\n * and wire it under the aggregate \\`trivy\\` target. The scan is not part of\n * \\`build\\` — run \\`nx run-many --target trivy\\` (the root \\`trivy\\` script) in CI.\n *\n * The scan target depends on the docker target and declares the project source\n * as its inputs, so an unchanged image is never re-scanned (a cache hit skips\n * the scan entirely). Each image is saved to a tarball under\n * \\`dist/<projectRoot>/trivy/<scan-key>\\` (kept out of any Docker build context)\n * and scanned with the pinned ECR-hosted Trivy image via a workspace-relative\n * bind mount, so the same commands work under both docker and finch. The scan\n * exits non-zero (exit code 1) on HIGH/CRITICAL vulnerabilities.\n *\n * A \\`.trivyignore\\` is vended at the project root (kept if it already exists)\n * for suppressing findings.\n */\nexport const addDockerScanTarget = (\n  tree: Tree,\n  options: DockerScanTargetOptions,\n): void => {\n  const { project, containerEngine, trivyTargetName, dockerTargetName } =\n    options;\n  const { imageTags } = options;\n  const projectRoot = project.root;\n\n  const ignoreFilePath = joinPathFragments(projectRoot, TRIVY_IGNORE_FILE);\n  if (!tree.exists(ignoreFilePath)) {\n    tree.write(ignoreFilePath, TRIVY_IGNORE_CONTENTS);\n  }\n\n  // Stage scan artifacts in a directory unique to this scan target so that\n  // sibling targets in the same project (e.g. multiple agents) don't clobber\n  // each other's tarballs when run in parallel. The first image tag is unique\n  // per target, so it makes a stable, collision-free key.\n  const scanKey = imageTags[0].replace(/[^a-zA-Z0-9-]/g, '-');\n  const scanDir = joinPathFragments('dist', projectRoot, 'trivy', scanKey);\n  const trivyImage = `public.ecr.aws/aquasecurity/trivy:${CONTAINER_VERSIONS.trivy}`;\n\n  const fs = new FsCommands(tree);\n  const commands = [\n    fs.rm(scanDir),\n    fs.mkdir(scanDir),\n    fs.cp(ignoreFilePath, joinPathFragments(scanDir, TRIVY_IGNORE_FILE)),\n  ];\n\n  imageTags.forEach((imageTag, index) => {\n    const tarName = `image-${index}.tar`;\n    commands.push(\n      `${containerEngine} save -o ${joinPathFragments(scanDir, tarName)} ${imageTag}`,\n      `${containerEngine} run --rm -v \"./${scanDir}\":/scan ${trivyImage} image --input /scan/${tarName} --ignorefile /scan/${TRIVY_IGNORE_FILE} --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress -q`,\n    );\n  });\n\n  project.targets ??= {};\n  project.targets[trivyTargetName] = {\n    cache: true,\n    // The scanned image is fully determined by the project source, so caching\n    // on the source ensures an unchanged image is never re-scanned.\n    inputs: ['default', '^production'],\n    outputs: [`{workspaceRoot}/${scanDir}`],\n    executor: 'nx:run-commands',\n    options: {\n      commands,\n      parallel: false,\n    },\n    dependsOn: [dockerTargetName],\n  };\n\n  // Aggregate per-component scan targets under a single `trivy` target. The\n  // scan is intentionally NOT wired into `build`: image scanning is slow and\n  // its result depends on the ever-changing vulnerability database (a scan\n  // that passes today can fail tomorrow when a new CVE is published), so\n  // coupling it to `build` would make local and CI builds non-deterministic.\n  // Run `nx run-many --target trivy` (the root `trivy` script) in CI instead.\n  if (trivyTargetName !== 'trivy') {\n    addDependencyToTargetIfNotPresent(project, 'trivy', trivyTargetName);\n  }\n};\n"],"names":["joinPathFragments","FsCommands","addDependencyToTargetIfNotPresent","CONTAINER_VERSIONS","TRIVY_IGNORE_FILE","TRIVY_IGNORE_CONTENTS","addDockerScanTarget","tree","options","project","containerEngine","trivyTargetName","dockerTargetName","imageTags","projectRoot","root","ignoreFilePath","exists","write","scanKey","replace","scanDir","trivyImage","trivy","fs","commands","rm","mkdir","cp","forEach","imageTag","index","tarName","push","targets","cache","inputs","outputs","executor","parallel","dependsOn"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SAASC,UAAU,QAAQ,UAAO;AAClC,SAASC,iCAAiC,QAAQ,UAAO;AACzD,SAASC,kBAAkB,QAAQ,gBAAa;AAEhD,MAAMC,oBAAoB;AAE1B,MAAMC,wBAAwB,CAAC;;;AAG/B,CAAC;AA0BD;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,sBAAsB,CACjCC,MACAC;IAEA,MAAM,EAAEC,OAAO,EAAEC,eAAe,EAAEC,eAAe,EAAEC,gBAAgB,EAAE,GACnEJ;IACF,MAAM,EAAEK,SAAS,EAAE,GAAGL;IACtB,MAAMM,cAAcL,QAAQM,IAAI;IAEhC,MAAMC,iBAAiBhB,kBAAkBc,aAAaV;IACtD,IAAI,CAACG,KAAKU,MAAM,CAACD,iBAAiB;QAChCT,KAAKW,KAAK,CAACF,gBAAgBX;IAC7B;IAEA,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAMc,UAAUN,SAAS,CAAC,EAAE,CAACO,OAAO,CAAC,kBAAkB;IACvD,MAAMC,UAAUrB,kBAAkB,QAAQc,aAAa,SAASK;IAChE,MAAMG,aAAa,CAAC,kCAAkC,EAAEnB,mBAAmBoB,KAAK,EAAE;IAElF,MAAMC,KAAK,IAAIvB,WAAWM;IAC1B,MAAMkB,WAAW;QACfD,GAAGE,EAAE,CAACL;QACNG,GAAGG,KAAK,CAACN;QACTG,GAAGI,EAAE,CAACZ,gBAAgBhB,kBAAkBqB,SAASjB;KAClD;IAEDS,UAAUgB,OAAO,CAAC,CAACC,UAAUC;QAC3B,MAAMC,UAAU,CAAC,MAAM,EAAED,MAAM,IAAI,CAAC;QACpCN,SAASQ,IAAI,CACX,GAAGvB,gBAAgB,SAAS,EAAEV,kBAAkBqB,SAASW,SAAS,CAAC,EAAEF,UAAU,EAC/E,GAAGpB,gBAAgB,gBAAgB,EAAEW,QAAQ,QAAQ,EAAEC,WAAW,qBAAqB,EAAEU,QAAQ,oBAAoB,EAAE5B,kBAAkB,yFAAyF,CAAC;IAEvO;IAEAK,QAAQyB,OAAO,KAAK,CAAC;IACrBzB,QAAQyB,OAAO,CAACvB,gBAAgB,GAAG;QACjCwB,OAAO;QACP,0EAA0E;QAC1E,gEAAgE;QAChEC,QAAQ;YAAC;YAAW;SAAc;QAClCC,SAAS;YAAC,CAAC,gBAAgB,EAAEhB,SAAS;SAAC;QACvCiB,UAAU;QACV9B,SAAS;YACPiB;YACAc,UAAU;QACZ;QACAC,WAAW;YAAC5B;SAAiB;IAC/B;IAEA,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAID,oBAAoB,SAAS;QAC/BT,kCAAkCO,SAAS,SAASE;IACtD;AACF,EAAE"}