@aws/nx-plugin 1.0.0-rc.49 → 1.0.0-rc.50

package/src/migrations/latest/restrict-cors-to-custom-domains/migration.js

@@ -0,0 +1,110 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { visitNotIgnoredFiles } from "@nx/devkit";
+import { addDestructuredImport, addStarExport, applyGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { isEsmWorkspace } from "../../../utils/module-format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, rather than
+ *   clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ const CORE_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core`;
+const APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;
+const CLOUDFRONT_CORE_FILE = `${CORE_DIR}/cloudfront.ts`;
+const CORE_INDEX_FILE = `${CORE_DIR}/index.ts`;
+const USER_IDENTITY_FILE = `${CORE_DIR}/user-identity.ts`;
+const CLOUDFRONT_HELPER_CONTENT = `import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';
+
+/**
+ * Finds the domain names associated with a CloudFront distribution.
+ *
+ * Includes the distribution's default \`*.cloudfront.net\` domain name plus any custom
+ * domain names (aliases) configured on it.
+ */
+export const findCloudFrontDomainNames = (
+  distribution: Distribution,
+): string[] => {
+  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;
+  const distributionConfig =
+    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;
+  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];
+};
+`;
+// Rewrites the `restrictCorsTo` body as produced by generators prior to this fix.
+const RESTRICT_CORS_TO_GRITQL_PATTERN = "`origins.map(($o) => typeof $o === 'string' ? $o : 'cloudFrontDistribution' in $o ? $branch1 : $branch2)` where { $branch1 <: contains `distributionDomainName`, $branch2 <: contains `distributionDomainName` } => raw`origins.flatMap(($o) => typeof $o === 'string' ? [$o] : findCloudFrontDomainNames('cloudFrontDistribution' in $o ? $o.cloudFrontDistribution : $o).map((domain) => \\`https://${domain}\\`))`";
+// Rewrites UserIdentity's callback/logout URL logic as produced by generators
+// prior to this fix.
+const USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN = '`this.findCloudFrontDomainNames()` => `Stack.of(this).node.findAll().filter((child): child is Distribution => child instanceof Distribution).flatMap(findCloudFrontDomainNames)`';
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(CORE_INDEX_FILE)) {
+        // No common/constructs shared library in this workspace - nothing to migrate.
+        return {
+            nextSteps
+        };
+    }
+    const esm = isEsmWorkspace(tree);
+    const apiCloudFrontImportSpecifier = esm ? '../../core/cloudfront.js' : '../../core/cloudfront';
+    const coreCloudFrontImportSpecifier = esm ? './cloudfront.js' : './cloudfront';
+    if (!tree.exists(CLOUDFRONT_CORE_FILE)) {
+        tree.write(CLOUDFRONT_CORE_FILE, CLOUDFRONT_HELPER_CONTENT);
+    }
+    await addStarExport(tree, CORE_INDEX_FILE, './cloudfront.js');
+    const apiAppFiles = [];
+    visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath)=>{
+        apiAppFiles.push(filePath);
+    });
+    for (const filePath of apiAppFiles){
+        if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {
+            continue;
+        }
+        const rewrote = await applyGritQL(tree, filePath, RESTRICT_CORS_TO_GRITQL_PATTERN);
+        if (rewrote) {
+            await addDestructuredImport(tree, filePath, [
+                'findCloudFrontDomainNames'
+            ], apiCloudFrontImportSpecifier);
+            nextSteps.push(`${filePath}: restrictCorsTo now includes CloudFront custom domain aliases automatically.`);
+            continue;
+        }
+        const contents = tree.read(filePath, 'utf-8') ?? '';
+        if (!contents.includes('findCloudFrontDomainNames(')) {
+            nextSteps.push(`${filePath}: restrictCorsTo has diverged from the generated shape - left untouched. Manually apply the CloudFront custom domain fix (see findCloudFrontDomainNames in common/constructs/src/core/cloudfront.ts).`);
+        }
+    // Otherwise already migrated - silent skip.
+    }
+    if (tree.exists(USER_IDENTITY_FILE)) {
+        const rewrote = await applyGritQL(tree, USER_IDENTITY_FILE, USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN);
+        if (rewrote) {
+            await applyGritQL(tree, USER_IDENTITY_FILE, "`import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront'` => `import { Distribution } from 'aws-cdk-lib/aws-cloudfront';`");
+            await applyGritQL(tree, USER_IDENTITY_FILE, "or { `// Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.` => ., `private findCloudFrontDomainNames = (): string[] => $body` => . }");
+            await addDestructuredImport(tree, USER_IDENTITY_FILE, [
+                'findCloudFrontDomainNames'
+            ], coreCloudFrontImportSpecifier);
+            nextSteps.push(`${USER_IDENTITY_FILE}: now reuses the shared findCloudFrontDomainNames helper.`);
+        } else {
+            const contents = tree.read(USER_IDENTITY_FILE, 'utf-8') ?? '';
+            if (!contents.includes('.flatMap(findCloudFrontDomainNames)')) {
+                nextSteps.push(`${USER_IDENTITY_FILE}: the callback URL logic has diverged from the generated shape - left untouched. Manually apply the shared findCloudFrontDomainNames helper (see common/constructs/src/core/cloudfront.ts).`);
+            }
+        // Otherwise already migrated - silent skip.
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/restrict-cors-to-custom-domains/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/restrict-cors-to-custom-domains/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  addStarExport,\n  applyGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\nimport { isEsmWorkspace } from '../../../utils/module-format';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../../../utils/shared-constructs-constants';\n\n/**\n * Include CloudFront custom domain aliases in restrictCorsTo and UserIdentity callback URLs\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, rather than\n *   clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\nconst CORE_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/core`;\nconst APIS_APP_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/apis`;\nconst CLOUDFRONT_CORE_FILE = `${CORE_DIR}/cloudfront.ts`;\nconst CORE_INDEX_FILE = `${CORE_DIR}/index.ts`;\nconst USER_IDENTITY_FILE = `${CORE_DIR}/user-identity.ts`;\n\nconst CLOUDFRONT_HELPER_CONTENT = `import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';\n\n/**\n * Finds the domain names associated with a CloudFront distribution.\n *\n * Includes the distribution's default \\`*.cloudfront.net\\` domain name plus any custom\n * domain names (aliases) configured on it.\n */\nexport const findCloudFrontDomainNames = (\n  distribution: Distribution,\n): string[] => {\n  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;\n  const distributionConfig =\n    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;\n  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];\n};\n`;\n\n// Rewrites the `restrictCorsTo` body as produced by generators prior to this fix.\nconst RESTRICT_CORS_TO_GRITQL_PATTERN =\n  \"`origins.map(($o) => typeof $o === 'string' ? $o : 'cloudFrontDistribution' in $o ? $branch1 : $branch2)` where { $branch1 <: contains `distributionDomainName`, $branch2 <: contains `distributionDomainName` } => raw`origins.flatMap(($o) => typeof $o === 'string' ? [$o] : findCloudFrontDomainNames('cloudFrontDistribution' in $o ? $o.cloudFrontDistribution : $o).map((domain) => \\\\`https://${domain}\\\\`))`\";\n\n// Rewrites UserIdentity's callback/logout URL logic as produced by generators\n// prior to this fix.\nconst USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN =\n  '`this.findCloudFrontDomainNames()` => `Stack.of(this).node.findAll().filter((child): child is Distribution => child instanceof Distribution).flatMap(findCloudFrontDomainNames)`';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(CORE_INDEX_FILE)) {\n    // No common/constructs shared library in this workspace - nothing to migrate.\n    return { nextSteps };\n  }\n\n  const esm = isEsmWorkspace(tree);\n  const apiCloudFrontImportSpecifier = esm\n    ? '../../core/cloudfront.js'\n    : '../../core/cloudfront';\n  const coreCloudFrontImportSpecifier = esm\n    ? './cloudfront.js'\n    : './cloudfront';\n\n  if (!tree.exists(CLOUDFRONT_CORE_FILE)) {\n    tree.write(CLOUDFRONT_CORE_FILE, CLOUDFRONT_HELPER_CONTENT);\n  }\n  await addStarExport(tree, CORE_INDEX_FILE, './cloudfront.js');\n\n  const apiAppFiles: string[] = [];\n  visitNotIgnoredFiles(tree, APIS_APP_DIR, (filePath) => {\n    apiAppFiles.push(filePath);\n  });\n\n  for (const filePath of apiAppFiles) {\n    if (!filePath.endsWith('.ts') || filePath.endsWith('/index.ts')) {\n      continue;\n    }\n    const rewrote = await applyGritQL(\n      tree,\n      filePath,\n      RESTRICT_CORS_TO_GRITQL_PATTERN,\n    );\n    if (rewrote) {\n      await addDestructuredImport(\n        tree,\n        filePath,\n        ['findCloudFrontDomainNames'],\n        apiCloudFrontImportSpecifier,\n      );\n      nextSteps.push(\n        `${filePath}: restrictCorsTo now includes CloudFront custom domain aliases automatically.`,\n      );\n      continue;\n    }\n    const contents = tree.read(filePath, 'utf-8') ?? '';\n    if (!contents.includes('findCloudFrontDomainNames(')) {\n      nextSteps.push(\n        `${filePath}: restrictCorsTo has diverged from the generated shape - left untouched. Manually apply the CloudFront custom domain fix (see findCloudFrontDomainNames in common/constructs/src/core/cloudfront.ts).`,\n      );\n    }\n    // Otherwise already migrated - silent skip.\n  }\n\n  if (tree.exists(USER_IDENTITY_FILE)) {\n    const rewrote = await applyGritQL(\n      tree,\n      USER_IDENTITY_FILE,\n      USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN,\n    );\n    if (rewrote) {\n      await applyGritQL(\n        tree,\n        USER_IDENTITY_FILE,\n        \"`import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront'` => `import { Distribution } from 'aws-cdk-lib/aws-cloudfront';`\",\n      );\n      await applyGritQL(\n        tree,\n        USER_IDENTITY_FILE,\n        \"or { `// Includes each distribution's default domain name plus any custom domain names (aliases) configured on it.` => ., `private findCloudFrontDomainNames = (): string[] => $body` => . }\",\n      );\n      await addDestructuredImport(\n        tree,\n        USER_IDENTITY_FILE,\n        ['findCloudFrontDomainNames'],\n        coreCloudFrontImportSpecifier,\n      );\n      nextSteps.push(\n        `${USER_IDENTITY_FILE}: now reuses the shared findCloudFrontDomainNames helper.`,\n      );\n    } else {\n      const contents = tree.read(USER_IDENTITY_FILE, 'utf-8') ?? '';\n      if (!contents.includes('.flatMap(findCloudFrontDomainNames)')) {\n        nextSteps.push(\n          `${USER_IDENTITY_FILE}: the callback URL logic has diverged from the generated shape - left untouched. Manually apply the shared findCloudFrontDomainNames helper (see common/constructs/src/core/cloudfront.ts).`,\n        );\n      }\n      // Otherwise already migrated - silent skip.\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["visitNotIgnoredFiles","addDestructuredImport","addStarExport","applyGritQL","formatFilesInSubtree","isEsmWorkspace","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","CORE_DIR","APIS_APP_DIR","CLOUDFRONT_CORE_FILE","CORE_INDEX_FILE","USER_IDENTITY_FILE","CLOUDFRONT_HELPER_CONTENT","RESTRICT_CORS_TO_GRITQL_PATTERN","USER_IDENTITY_CALLBACK_URLS_GRITQL_PATTERN","migration","tree","nextSteps","exists","esm","apiCloudFrontImportSpecifier","coreCloudFrontImportSpecifier","write","apiAppFiles","filePath","push","endsWith","rewrote","contents","read","includes"],"mappings":"AAAA;;;CAGC,GACD,SAGEA,oBAAoB,QACf,aAAa;AACpB,SACEC,qBAAqB,EACrBC,aAAa,EACbC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAC7D,SAASC,cAAc,QAAQ,kCAA+B;AAC9D,SACEC,YAAY,EACZC,qBAAqB,QAChB,gDAA6C;AAEpD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,WAAW,GAAGF,aAAa,CAAC,EAAEC,sBAAsB,SAAS,CAAC;AACpE,MAAME,eAAe,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,aAAa,CAAC;AAC5E,MAAMG,uBAAuB,GAAGF,SAAS,cAAc,CAAC;AACxD,MAAMG,kBAAkB,GAAGH,SAAS,SAAS,CAAC;AAC9C,MAAMI,qBAAqB,GAAGJ,SAAS,iBAAiB,CAAC;AAEzD,MAAMK,4BAA4B,CAAC;;;;;;;;;;;;;;;;AAgBnC,CAAC;AAED,kFAAkF;AAClF,MAAMC,kCACJ;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,MAAMC,6CACJ;AAEF,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAI,CAACD,KAAKE,MAAM,CAACR,kBAAkB;QACjC,8EAA8E;QAC9E,OAAO;YAAEO;QAAU;IACrB;IAEA,MAAME,MAAMf,eAAeY;IAC3B,MAAMI,+BAA+BD,MACjC,6BACA;IACJ,MAAME,gCAAgCF,MAClC,oBACA;IAEJ,IAAI,CAACH,KAAKE,MAAM,CAACT,uBAAuB;QACtCO,KAAKM,KAAK,CAACb,sBAAsBG;IACnC;IACA,MAAMX,cAAce,MAAMN,iBAAiB;IAE3C,MAAMa,cAAwB,EAAE;IAChCxB,qBAAqBiB,MAAMR,cAAc,CAACgB;QACxCD,YAAYE,IAAI,CAACD;IACnB;IAEA,KAAK,MAAMA,YAAYD,YAAa;QAClC,IAAI,CAACC,SAASE,QAAQ,CAAC,UAAUF,SAASE,QAAQ,CAAC,cAAc;YAC/D;QACF;QACA,MAAMC,UAAU,MAAMzB,YACpBc,MACAQ,UACAX;QAEF,IAAIc,SAAS;YACX,MAAM3B,sBACJgB,MACAQ,UACA;gBAAC;aAA4B,EAC7BJ;YAEFH,UAAUQ,IAAI,CACZ,GAAGD,SAAS,6EAA6E,CAAC;YAE5F;QACF;QACA,MAAMI,WAAWZ,KAAKa,IAAI,CAACL,UAAU,YAAY;QACjD,IAAI,CAACI,SAASE,QAAQ,CAAC,+BAA+B;YACpDb,UAAUQ,IAAI,CACZ,GAAGD,SAAS,qMAAqM,CAAC;QAEtN;IACA,4CAA4C;IAC9C;IAEA,IAAIR,KAAKE,MAAM,CAACP,qBAAqB;QACnC,MAAMgB,UAAU,MAAMzB,YACpBc,MACAL,oBACAG;QAEF,IAAIa,SAAS;YACX,MAAMzB,YACJc,MACAL,oBACA;YAEF,MAAMT,YACJc,MACAL,oBACA;YAEF,MAAMX,sBACJgB,MACAL,oBACA;gBAAC;aAA4B,EAC7BU;YAEFJ,UAAUQ,IAAI,CACZ,GAAGd,mBAAmB,yDAAyD,CAAC;QAEpF,OAAO;YACL,MAAMiB,WAAWZ,KAAKa,IAAI,CAAClB,oBAAoB,YAAY;YAC3D,IAAI,CAACiB,SAASE,QAAQ,CAAC,wCAAwC;gBAC7Db,UAAUQ,IAAI,CACZ,GAAGd,mBAAmB,2LAA2L,CAAC;YAEtN;QACA,4CAA4C;QAC9C;IACF;IAEA,MAAMR,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/terraform-bootstrap-adopt-existing-bucket/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/terraform-bootstrap-adopt-existing-bucket/migration.js

@@ -0,0 +1,129 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { TERRAFORM_PROJECT_GENERATOR_INFO } from "../../../terraform/project/generator.js";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+/**
+ * Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing
+ *
+ * The state bucket stores its own tfstate inside itself, so if that object is
+ * deleted while the bucket survives, `bootstrap` reads the 404 as a first run
+ * and asks terraform to create a bucket that already exists — failing with
+ * `BucketAlreadyOwnedByYou` on every subsequent run, with no retry that clears
+ * it. The vended script now imports the existing bucket instead.
+ *
+ * Every edit is expressed as a GritQL rewrite so the script is matched on its
+ * AST rather than its formatting.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ *
+ * Guardrails:
+ * - Pattern-match before writing: skip files that have diverged from the shape
+ *   your generators produce and report them via `nextSteps`, or consider a
+ *   hybrid migration, rather than clobbering the user's changes.
+ * - Idempotent: re-running must be a no-op.
+ * - Format what you write: finish with `formatFilesInSubtree` so the files your
+ *   migration wrote are formatted correctly.
+ */ // Guards the whole migration: present only once the import step exists.
+const MIGRATED_PATTERN = '`bucketExists($_, $_)`';
+// Every edit site, matched structurally so formatting and argument layout
+// don't affect whether the script is recognised.
+const STATE_FETCH_TRY_PATTERN = 'try_statement() as $try where { $try <: contains `GetObjectCommand` }';
+const STATE_FLAG_SET_PATTERN = '`if (out.Body) { $body }`';
+const HELPER_PATTERN = '`const main = async () => { $body }`';
+const INIT_PATTERN = "`execFileSync('terraform', ['init'], $opts)`";
+const S3_IMPORT_PATTERN = "`import { $before, GetObjectCommand, $after } from '@aws-sdk/client-s3'`";
+const HEADER_COMMENT_PATTERN = 'comment() as $c where { $c <: includes "state back to S3." }';
+// GritQL snippets are parsed as backtick-quoted patterns, so any backtick in
+// the inserted source has to survive that layer escaped.
+const BUCKET_EXISTS_HELPER = `// S3 answers 404 only when the name is genuinely free; 403 means it exists
+// but is not readable with these credentials.
+const bucketExists = async (s3: S3Client, bucket: string) => {
+  try {
+    await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+    return true;
+  } catch (err: any) {
+    const status = err?.$metadata?.httpStatusCode;
+    if (status === 404) return false;
+    if (status === 403) return true;
+    throw err;
+  }
+};`;
+const IMPORT_STEP = `// The bucket holds its own state, so losing the state object while the
+  // bucket survives would otherwise wedge bootstrap on a permanent
+  // \`BucketAlreadyOwnedByYou\`. Adopt the existing bucket instead.
+  if (!haveState && (await bucketExists(s3, bucket))) {
+    console.log(
+      \`State bucket \${bucket} already exists but its bootstrap state is missing — importing it.\`,
+    );
+    execFileSync(
+      'terraform',
+      [
+        'import',
+        \`-state=\${tfStatePath}\`,
+        \`-var=aws_region=\${region}\`,
+        'aws_s3_bucket.terraform_state',
+        bucket,
+      ],
+      { cwd: bootstrapDir, stdio: 'inherit' },
+    );
+  }`;
+// Rewritten wholesale rather than appended to, since the summary sentence
+// changes rather than gaining a clause.
+const NEW_HEADER_COMMENT = `/**
+ * Bootstraps the remote Terraform state bucket.
+ *
+ * Equivalent to \\\`cdk bootstrap\\\` — resolves account + region from the AWS
+ * SDK credential chain, pulls any existing bootstrap tfstate from S3,
+ * runs \\\`terraform apply\\\` in the \\\`bootstrap\\\` dir, then pushes the new
+ * state back to S3. Adopts an already-existing state bucket when its
+ * state object is missing.
+ */`;
+const DIVERGED_NEXT_STEP = (filePath)=>`${filePath}: the bootstrap script has diverged from the generated shape - left untouched. Manually \`terraform import aws_s3_bucket.terraform_state <bucket>\` before \`terraform apply\` when the state bucket exists but its \`bootstrap.tfstate\` object does not, otherwise bootstrap fails with BucketAlreadyOwnedByYou.`;
+export default async function migration(tree) {
+    const nextSteps = [];
+    // Terraform application projects are the only ones that vend bootstrap.ts.
+    const bootstrapScripts = [
+        ...getProjects(tree).values()
+    ].filter((project)=>project.metadata?.generator === TERRAFORM_PROJECT_GENERATOR_INFO.id).map((project)=>joinPathFragments(project.root, 'scripts/bootstrap.ts')).filter((filePath)=>tree.exists(filePath));
+    for (const filePath of bootstrapScripts){
+        if (await matchGritQL(tree, filePath, MIGRATED_PATTERN)) {
+            continue;
+        }
+        // Confirm every edit site is present before writing any of them, so a
+        // script that only partly matches is left whole rather than half-edited.
+        const allSitesPresent = (await Promise.all([
+            STATE_FETCH_TRY_PATTERN,
+            STATE_FLAG_SET_PATTERN,
+            HELPER_PATTERN,
+            INIT_PATTERN,
+            S3_IMPORT_PATTERN,
+            HEADER_COMMENT_PATTERN
+        ].map((pattern)=>matchGritQL(tree, filePath, pattern)))).every(Boolean);
+        if (!allSitesPresent) {
+            nextSteps.push(DIVERGED_NEXT_STEP(filePath));
+            continue;
+        }
+        // `haveState` distinguishes "no remote state" from "no bucket", so the
+        // import only runs when terraform has no prior knowledge of the bucket.
+        await insertViaGritQL(tree, filePath, `${STATE_FETCH_TRY_PATTERN} => \`${GRIT_INSERT_PLACEHOLDER}\n  $try\``, 'let haveState = false;');
+        await applyGritQL(tree, filePath, `${STATE_FLAG_SET_PATTERN} => \`if (out.Body) {\n      $body\n      haveState = true;\n    }\``);
+        await insertViaGritQL(tree, filePath, `${HELPER_PATTERN} => \`${GRIT_INSERT_PLACEHOLDER}\n\nconst main = async () => { $body }\``, BUCKET_EXISTS_HELPER);
+        await insertViaGritQL(tree, filePath, `${INIT_PATTERN} => \`execFileSync('terraform', ['init'], $opts);\n\n  ${GRIT_INSERT_PLACEHOLDER}\n\``, IMPORT_STEP);
+        // Placed in the generator's import position rather than appended, so a
+        // migrated workspace matches a freshly generated one.
+        await applyGritQL(tree, filePath, `${S3_IMPORT_PATTERN} => \`import { $before, GetObjectCommand, HeadBucketCommand, $after } from '@aws-sdk/client-s3'\``);
+        await applyGritQL(tree, filePath, `${HEADER_COMMENT_PATTERN} => \`${NEW_HEADER_COMMENT}\``);
+        nextSteps.push(`${filePath}: now adopts an existing Terraform state bucket when its bootstrap.tfstate object is missing.`);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-bootstrap-adopt-existing-bucket/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-bootstrap-adopt-existing-bucket/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast';\nimport { formatFilesInSubtree } from '../../../utils/format';\n\n/**\n * Adopt an existing Terraform state bucket in the vended bootstrap script when its state object is missing\n *\n * The state bucket stores its own tfstate inside itself, so if that object is\n * deleted while the bucket survives, `bootstrap` reads the 404 as a first run\n * and asks terraform to create a bucket that already exists — failing with\n * `BucketAlreadyOwnedByYou` on every subsequent run, with no retry that clears\n * it. The vended script now imports the existing bucket instead.\n *\n * Every edit is expressed as a GritQL rewrite so the script is matched on its\n * AST rather than its formatting.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n *\n * Guardrails:\n * - Pattern-match before writing: skip files that have diverged from the shape\n *   your generators produce and report them via `nextSteps`, or consider a\n *   hybrid migration, rather than clobbering the user's changes.\n * - Idempotent: re-running must be a no-op.\n * - Format what you write: finish with `formatFilesInSubtree` so the files your\n *   migration wrote are formatted correctly.\n */\n\n// Guards the whole migration: present only once the import step exists.\nconst MIGRATED_PATTERN = '`bucketExists($_, $_)`';\n\n// Every edit site, matched structurally so formatting and argument layout\n// don't affect whether the script is recognised.\nconst STATE_FETCH_TRY_PATTERN =\n  'try_statement() as $try where { $try <: contains `GetObjectCommand` }';\nconst STATE_FLAG_SET_PATTERN = '`if (out.Body) { $body }`';\nconst HELPER_PATTERN = '`const main = async () => { $body }`';\nconst INIT_PATTERN = \"`execFileSync('terraform', ['init'], $opts)`\";\nconst S3_IMPORT_PATTERN =\n  \"`import { $before, GetObjectCommand, $after } from '@aws-sdk/client-s3'`\";\nconst HEADER_COMMENT_PATTERN =\n  'comment() as $c where { $c <: includes \"state back to S3.\" }';\n\n// GritQL snippets are parsed as backtick-quoted patterns, so any backtick in\n// the inserted source has to survive that layer escaped.\nconst BUCKET_EXISTS_HELPER = `// S3 answers 404 only when the name is genuinely free; 403 means it exists\n// but is not readable with these credentials.\nconst bucketExists = async (s3: S3Client, bucket: string) => {\n  try {\n    await s3.send(new HeadBucketCommand({ Bucket: bucket }));\n    return true;\n  } catch (err: any) {\n    const status = err?.$metadata?.httpStatusCode;\n    if (status === 404) return false;\n    if (status === 403) return true;\n    throw err;\n  }\n};`;\n\nconst IMPORT_STEP = `// The bucket holds its own state, so losing the state object while the\n  // bucket survives would otherwise wedge bootstrap on a permanent\n  // \\`BucketAlreadyOwnedByYou\\`. Adopt the existing bucket instead.\n  if (!haveState && (await bucketExists(s3, bucket))) {\n    console.log(\n      \\`State bucket \\${bucket} already exists but its bootstrap state is missing — importing it.\\`,\n    );\n    execFileSync(\n      'terraform',\n      [\n        'import',\n        \\`-state=\\${tfStatePath}\\`,\n        \\`-var=aws_region=\\${region}\\`,\n        'aws_s3_bucket.terraform_state',\n        bucket,\n      ],\n      { cwd: bootstrapDir, stdio: 'inherit' },\n    );\n  }`;\n\n// Rewritten wholesale rather than appended to, since the summary sentence\n// changes rather than gaining a clause.\nconst NEW_HEADER_COMMENT = `/**\n * Bootstraps the remote Terraform state bucket.\n *\n * Equivalent to \\\\\\`cdk bootstrap\\\\\\` — resolves account + region from the AWS\n * SDK credential chain, pulls any existing bootstrap tfstate from S3,\n * runs \\\\\\`terraform apply\\\\\\` in the \\\\\\`bootstrap\\\\\\` dir, then pushes the new\n * state back to S3. Adopts an already-existing state bucket when its\n * state object is missing.\n */`;\n\nconst DIVERGED_NEXT_STEP = (filePath: string) =>\n  `${filePath}: the bootstrap script has diverged from the generated shape - left untouched. Manually \\`terraform import aws_s3_bucket.terraform_state <bucket>\\` before \\`terraform apply\\` when the state bucket exists but its \\`bootstrap.tfstate\\` object does not, otherwise bootstrap fails with BucketAlreadyOwnedByYou.`;\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  // Terraform application projects are the only ones that vend bootstrap.ts.\n  const bootstrapScripts = [...getProjects(tree).values()]\n    .filter(\n      (project) =>\n        (project.metadata as any)?.generator ===\n        TERRAFORM_PROJECT_GENERATOR_INFO.id,\n    )\n    .map((project) => joinPathFragments(project.root, 'scripts/bootstrap.ts'))\n    .filter((filePath) => tree.exists(filePath));\n\n  for (const filePath of bootstrapScripts) {\n    if (await matchGritQL(tree, filePath, MIGRATED_PATTERN)) {\n      // Already migrated - silent skip keeps re-runs a no-op.\n      continue;\n    }\n\n    // Confirm every edit site is present before writing any of them, so a\n    // script that only partly matches is left whole rather than half-edited.\n    const allSitesPresent = (\n      await Promise.all(\n        [\n          STATE_FETCH_TRY_PATTERN,\n          STATE_FLAG_SET_PATTERN,\n          HELPER_PATTERN,\n          INIT_PATTERN,\n          S3_IMPORT_PATTERN,\n          HEADER_COMMENT_PATTERN,\n        ].map((pattern) => matchGritQL(tree, filePath, pattern)),\n      )\n    ).every(Boolean);\n\n    if (!allSitesPresent) {\n      nextSteps.push(DIVERGED_NEXT_STEP(filePath));\n      continue;\n    }\n\n    // `haveState` distinguishes \"no remote state\" from \"no bucket\", so the\n    // import only runs when terraform has no prior knowledge of the bucket.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      `${STATE_FETCH_TRY_PATTERN} => \\`${GRIT_INSERT_PLACEHOLDER}\\n  $try\\``,\n      'let haveState = false;',\n    );\n    await applyGritQL(\n      tree,\n      filePath,\n      `${STATE_FLAG_SET_PATTERN} => \\`if (out.Body) {\\n      $body\\n      haveState = true;\\n    }\\``,\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      `${HELPER_PATTERN} => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\nconst main = async () => { $body }\\``,\n      BUCKET_EXISTS_HELPER,\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      `${INIT_PATTERN} => \\`execFileSync('terraform', ['init'], $opts);\\n\\n  ${GRIT_INSERT_PLACEHOLDER}\\n\\``,\n      IMPORT_STEP,\n    );\n\n    // Placed in the generator's import position rather than appended, so a\n    // migrated workspace matches a freshly generated one.\n    await applyGritQL(\n      tree,\n      filePath,\n      `${S3_IMPORT_PATTERN} => \\`import { $before, GetObjectCommand, HeadBucketCommand, $after } from '@aws-sdk/client-s3'\\``,\n    );\n\n    await applyGritQL(\n      tree,\n      filePath,\n      `${HEADER_COMMENT_PATTERN} => \\`${NEW_HEADER_COMMENT}\\``,\n    );\n\n    nextSteps.push(\n      `${filePath}: now adopts an existing Terraform state bucket when its bootstrap.tfstate object is missing.`,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","TERRAFORM_PROJECT_GENERATOR_INFO","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","MIGRATED_PATTERN","STATE_FETCH_TRY_PATTERN","STATE_FLAG_SET_PATTERN","HELPER_PATTERN","INIT_PATTERN","S3_IMPORT_PATTERN","HEADER_COMMENT_PATTERN","BUCKET_EXISTS_HELPER","IMPORT_STEP","NEW_HEADER_COMMENT","DIVERGED_NEXT_STEP","filePath","migration","tree","nextSteps","bootstrapScripts","values","filter","project","metadata","generator","id","map","root","exists","allSitesPresent","Promise","all","pattern","every","Boolean","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,gCAAgC,QAAQ,0CAAuC;AACxF,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAqB;AAC5B,SAASC,oBAAoB,QAAQ,2BAAwB;AAE7D;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,wEAAwE;AACxE,MAAMC,mBAAmB;AAEzB,0EAA0E;AAC1E,iDAAiD;AACjD,MAAMC,0BACJ;AACF,MAAMC,yBAAyB;AAC/B,MAAMC,iBAAiB;AACvB,MAAMC,eAAe;AACrB,MAAMC,oBACJ;AACF,MAAMC,yBACJ;AAEF,6EAA6E;AAC7E,yDAAyD;AACzD,MAAMC,uBAAuB,CAAC;;;;;;;;;;;;EAY5B,CAAC;AAEH,MAAMC,cAAc,CAAC;;;;;;;;;;;;;;;;;;GAkBlB,CAAC;AAEJ,0EAA0E;AAC1E,wCAAwC;AACxC,MAAMC,qBAAqB,CAAC;;;;;;;;GAQzB,CAAC;AAEJ,MAAMC,qBAAqB,CAACC,WAC1B,GAAGA,SAAS,kTAAkT,CAAC;AAEjU,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,2EAA2E;IAC3E,MAAMC,mBAAmB;WAAIvB,YAAYqB,MAAMG,MAAM;KAAG,CACrDC,MAAM,CACL,CAACC,UACC,AAACA,QAAQC,QAAQ,EAAUC,cAC3B1B,iCAAiC2B,EAAE,EAEtCC,GAAG,CAAC,CAACJ,UAAYzB,kBAAkByB,QAAQK,IAAI,EAAE,yBACjDN,MAAM,CAAC,CAACN,WAAaE,KAAKW,MAAM,CAACb;IAEpC,KAAK,MAAMA,YAAYI,iBAAkB;QACvC,IAAI,MAAMjB,YAAYe,MAAMF,UAAUX,mBAAmB;YAEvD;QACF;QAEA,sEAAsE;QACtE,yEAAyE;QACzE,MAAMyB,kBAAkB,AACtB,CAAA,MAAMC,QAAQC,GAAG,CACf;YACE1B;YACAC;YACAC;YACAC;YACAC;YACAC;SACD,CAACgB,GAAG,CAAC,CAACM,UAAY9B,YAAYe,MAAMF,UAAUiB,UACjD,EACAC,KAAK,CAACC;QAER,IAAI,CAACL,iBAAiB;YACpBX,UAAUiB,IAAI,CAACrB,mBAAmBC;YAClC;QACF;QAEA,uEAAuE;QACvE,wEAAwE;QACxE,MAAMd,gBACJgB,MACAF,UACA,GAAGV,wBAAwB,MAAM,EAAEL,wBAAwB,UAAU,CAAC,EACtE;QAEF,MAAMD,YACJkB,MACAF,UACA,GAAGT,uBAAuB,oEAAoE,CAAC;QAEjG,MAAML,gBACJgB,MACAF,UACA,GAAGR,eAAe,MAAM,EAAEP,wBAAwB,wCAAwC,CAAC,EAC3FW;QAEF,MAAMV,gBACJgB,MACAF,UACA,GAAGP,aAAa,uDAAuD,EAAER,wBAAwB,IAAI,CAAC,EACtGY;QAGF,uEAAuE;QACvE,sDAAsD;QACtD,MAAMb,YACJkB,MACAF,UACA,GAAGN,kBAAkB,iGAAiG,CAAC;QAGzH,MAAMV,YACJkB,MACAF,UACA,GAAGL,uBAAuB,MAAM,EAAEG,mBAAmB,EAAE,CAAC;QAG1DK,UAAUiB,IAAI,CACZ,GAAGpB,SAAS,6FAA6F,CAAC;IAE9G;IAEA,MAAMZ,qBAAqBc;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -171,6 +171,7 @@ exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime
 exports[`py#agent generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > core-index.ts 1`] = `
 "export * from './app.js';
 export * from './checkov.js';
+export * from './cloudfront.js';
 export * from './runtime-config.js';
 export * from './workspace.js';
 "

package/src/py/fast-api/__snapshots__/generator.spec.ts.snap

@@ -434,6 +434,7 @@ import {
   HttpApiIntegration,
   IntegrationBuilder,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { HttpApi } from '../../core/api/http-api.js';
 import {
   OPERATION_DETAILS,
@@ -474,7 +475,7 @@ export class TestApi<
     return IntegrationBuilder.http({
       pattern: 'isolated',
       operations: OPERATION_DETAILS,
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.PYTHON_3_14,
         handler: 'run.sh',
         code: Code.fromAsset(
@@ -488,7 +489,7 @@ export class TestApi<
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
         snapStart: SnapStartConf.ON_PUBLISHED_VERSIONS,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -549,6 +550,8 @@ export class TestApi<
    * as the only permitted CORS origins
    * in the API gateway. The CORS origins are not configured within the AWS Lambda
    * integrations since the associated header is controlled by API Gateway v2.
+   * Any custom domain names (aliases) configured on a CloudFront distribution are
+   * included automatically alongside its default \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -559,12 +562,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     const cfnApi = this.api.node.defaultChild;
@@ -1406,6 +1411,7 @@ import {
   IntegrationBuilder,
   RestApiIntegration,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
 import {
   OPERATION_DETAILS,
@@ -1454,7 +1460,7 @@ export class TestApi<
     return IntegrationBuilder.rest({
       pattern: 'isolated',
       operations: OPERATION_DETAILS,
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.PYTHON_3_14,
         handler: 'run.sh',
         code: Code.fromAsset(
@@ -1468,7 +1474,7 @@ export class TestApi<
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
         snapStart: SnapStartConf.ON_PUBLISHED_VERSIONS,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -1532,7 +1538,9 @@ export class TestApi<
    *
    * Configures the provided CloudFront distribution domains or origin strings
    * as the only permitted CORS origins in API Gateway preflight responses and the
-   * AWS Lambda integrations.
+   * AWS Lambda integrations. Any custom domain names (aliases) configured on a
+   * CloudFront distribution are included automatically alongside its default
+   * \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -1543,12 +1551,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     this.allowedOrigins = allowedOrigins;

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -8,6 +8,7 @@ exports[`py#mcp-server generator > should match snapshot for BedrockAgentCoreRun
 exports[`py#mcp-server generator > should match snapshot for BedrockAgentCoreRuntime generated constructs files > core-index.ts 1`] = `
 "export * from './app.js';
 export * from './checkov.js';
+export * from './cloudfront.js';
 export * from './runtime-config.js';
 export * from './workspace.js';
 "

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -32,6 +32,7 @@ import {
   IntegrationBuilder,
   RestApiIntegration,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
 import {
   OPERATION_DETAILS,
@@ -86,7 +87,7 @@ export class TestApi<
     return IntegrationBuilder.rest({
       pattern: 'isolated',
       operations: OPERATION_DETAILS,
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
         code: Code.fromAsset(
@@ -99,7 +100,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -156,7 +157,9 @@ export class TestApi<
    *
    * Configures the provided CloudFront distribution domains or origin strings
    * as the only permitted CORS origins in API Gateway preflight responses and the
-   * AWS Lambda integrations.
+   * AWS Lambda integrations. Any custom domain names (aliases) configured on a
+   * CloudFront distribution are included automatically alongside its default
+   * \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -167,12 +170,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     this.allowedOrigins = allowedOrigins;
@@ -221,6 +226,7 @@ import {
   IntegrationBuilder,
   RestApiIntegration,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
 import {
   OPERATION_DETAILS,
@@ -269,7 +275,7 @@ export class TestApi<
     return IntegrationBuilder.rest({
       pattern: 'isolated',
       operations: OPERATION_DETAILS,
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
         code: Code.fromAsset(
@@ -282,7 +288,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -333,7 +339,9 @@ export class TestApi<
    *
    * Configures the provided CloudFront distribution domains or origin strings
    * as the only permitted CORS origins in API Gateway preflight responses and the
-   * AWS Lambda integrations.
+   * AWS Lambda integrations. Any custom domain names (aliases) configured on a
+   * CloudFront distribution are included automatically alongside its default
+   * \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -344,12 +352,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     this.allowedOrigins = allowedOrigins;

package/src/terraform/project/files/application/scripts/bootstrap.ts.template

@@ -4,7 +4,8 @@
  * Equivalent to `cdk bootstrap` — resolves account + region from the AWS
  * SDK credential chain, pulls any existing bootstrap tfstate from S3,
  * runs `terraform apply` in the `bootstrap` dir, then pushes the new
- * state back to S3.
+ * state back to S3. Adopts an already-existing state bucket when its
+ * state object is missing.
  */
 import { execFileSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -12,6 +13,7 @@ import { dirname, join, resolve } from 'node:path';
 import {
   S3Client,
   GetObjectCommand,
+  HeadBucketCommand,
   PutObjectCommand,
 } from '@aws-sdk/client-s3';
 import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
@@ -34,6 +36,20 @@ const tfStatePath = join(
   'bootstrap.tfstate',
 );
 
+// S3 answers 404 only when the name is genuinely free; 403 means it exists
+// but is not readable with these credentials.
+const bucketExists = async (s3: S3Client, bucket: string) => {
+  try {
+    await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+    return true;
+  } catch (err: any) {
+    const status = err?.$metadata?.httpStatusCode;
+    if (status === 404) return false;
+    if (status === 403) return true;
+    throw err;
+  }
+};
+
 const main = async () => {
   const { accountId, region } = await resolveAwsConfig();
   const bucket = `${accountId}-tf-state-${region}`;
@@ -46,12 +62,14 @@ const main = async () => {
   // Pull any existing bootstrap tfstate. First-time bootstrap has no
   // remote state yet — fall through and let terraform apply create the
   // bucket.
+  let haveState = false;
   try {
     const out = await s3.send(
       new GetObjectCommand({ Bucket: bucket, Key: key }),
     );
     if (out.Body) {
       writeFileSync(tfStatePath, await out.Body.transformToByteArray());
+      haveState = true;
     }
   } catch (err: any) {
     const name = err?.name ?? '';
@@ -65,6 +83,27 @@ const main = async () => {
   }
 
   execFileSync('terraform', ['init'], { cwd: bootstrapDir, stdio: 'inherit' });
+
+  // The bucket holds its own state, so losing the state object while the
+  // bucket survives would otherwise wedge bootstrap on a permanent
+  // `BucketAlreadyOwnedByYou`. Adopt the existing bucket instead.
+  if (!haveState && (await bucketExists(s3, bucket))) {
+    console.log(
+      `State bucket ${bucket} already exists but its bootstrap state is missing — importing it.`,
+    );
+    execFileSync(
+      'terraform',
+      [
+        'import',
+        `-state=${tfStatePath}`,
+        `-var=aws_region=${region}`,
+        'aws_s3_bucket.terraform_state',
+        bucket,
+      ],
+      { cwd: bootstrapDir, stdio: 'inherit' },
+    );
+  }
+
   execFileSync(
     'terraform',
     [