@aws/nx-plugin 1.0.0-rc.7 → 1.0.0-rc.70

package/src/trpc/backend/__snapshots__/generator.spec.ts.snap

@@ -281,7 +281,7 @@ import { EchoInputSchema, EchoOutputSchema } from '../schema/index.js';
 export const echo = publicProcedure
   .input(EchoInputSchema)
   .output(EchoOutputSchema)
-  .query((opts) => ({ result: opts.input.message }));
+  .query((opts) => ({ message: opts.input.message }));
 "
 `;
 
@@ -303,13 +303,13 @@ exports[`trpc backend generator > should generate the project > apps/test-api/sr
 "import { z } from 'zod';
 
 export const EchoInputSchema = z.object({
-  message: z.string(),
+  message: z.string().max(1024),
 });
 
 export type IEchoInput = z.TypeOf<typeof EchoInputSchema>;
 
 export const EchoOutputSchema = z.object({
-  result: z.string(),
+  message: z.string().max(1024),
 });
 
 export type IEchoOutput = z.TypeOf<typeof EchoOutputSchema>;
@@ -380,9 +380,10 @@ import {
   IntegrationBuilder,
   RestApiIntegration,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
 import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
-import { AppRouter, appRouter } from ':proj/test-api';
+import { AppRouter, appRouter } from '@proj/test-api';
 
 // String union type for all API operation names
 type Operations = Procedures<AppRouter>;
@@ -435,7 +436,7 @@ export class TestApi<
     return IntegrationBuilder.rest({
       pattern: 'isolated',
       operations: routerToOperations(appRouter),
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
         code: Code.fromAsset(
@@ -448,7 +449,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -478,6 +479,9 @@ export class TestApi<
         authorizer: new CognitoUserPoolsAuthorizer(scope, 'TestApiAuthorizer', {
           cognitoUserPools: [props.identity.userPool],
         }),
+        // Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+        // and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+        authorizationScopes: ['openid', 'aws.cognito.signin.user.admin'],
       },
       deployOptions: {
         tracingEnabled: true,
@@ -504,7 +508,9 @@ export class TestApi<
    *
    * Configures the provided CloudFront distribution domains or origin strings
    * as the only permitted CORS origins in API Gateway preflight responses and the
-   * AWS Lambda integrations.
+   * AWS Lambda integrations. Any custom domain names (aliases) configured on a
+   * CloudFront distribution are included automatically alongside its default
+   * \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -515,12 +521,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     this.allowedOrigins = allowedOrigins;
@@ -589,9 +597,10 @@ import {
   HttpApiIntegration,
   IntegrationBuilder,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { HttpApi } from '../../core/api/http-api.js';
 import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
-import { AppRouter, appRouter } from ':proj/test-api';
+import { AppRouter, appRouter } from '@proj/test-api';
 
 // String union type for all API operation names
 type Operations = Procedures<AppRouter>;
@@ -637,7 +646,7 @@ export class TestApi<
     return IntegrationBuilder.http({
       pattern: 'isolated',
       operations: routerToOperations(appRouter),
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
         code: Code.fromAsset(
@@ -650,7 +659,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -706,6 +715,8 @@ export class TestApi<
    * as the only permitted CORS origins
    * in the API gateway. The CORS origins are not configured within the AWS Lambda
    * integrations since the associated header is controlled by API Gateway v2.
+   * Any custom domain names (aliases) configured on a CloudFront distribution are
+   * included automatically alongside its default \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -716,12 +727,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     const cfnApi = this.api.node.defaultChild;
@@ -801,9 +814,10 @@ import {
   IntegrationBuilder,
   RestApiIntegration,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
 import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
-import { AppRouter, appRouter } from ':proj/test-api';
+import { AppRouter, appRouter } from '@proj/test-api';
 
 // String union type for all API operation names
 type Operations = Procedures<AppRouter>;
@@ -850,7 +864,7 @@ export class TestApi<
     return IntegrationBuilder.rest({
       pattern: 'isolated',
       operations: routerToOperations(appRouter),
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
         code: Code.fromAsset(
@@ -863,7 +877,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -938,7 +952,9 @@ export class TestApi<
    *
    * Configures the provided CloudFront distribution domains or origin strings
    * as the only permitted CORS origins in API Gateway preflight responses and the
-   * AWS Lambda integrations.
+   * AWS Lambda integrations. Any custom domain names (aliases) configured on a
+   * CloudFront distribution are included automatically alongside its default
+   * \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -949,12 +965,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     this.allowedOrigins = allowedOrigins;
@@ -1021,9 +1039,10 @@ import {
   HttpApiIntegration,
   IntegrationBuilder,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { HttpApi } from '../../core/api/http-api.js';
 import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
-import { AppRouter, appRouter } from ':proj/test-api';
+import { AppRouter, appRouter } from '@proj/test-api';
 
 // String union type for all API operation names
 type Operations = Procedures<AppRouter>;
@@ -1062,7 +1081,7 @@ export class TestApi<
     return IntegrationBuilder.http({
       pattern: 'isolated',
       operations: routerToOperations(appRouter),
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
         code: Code.fromAsset(
@@ -1075,7 +1094,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -1150,6 +1169,8 @@ export class TestApi<
    * as the only permitted CORS origins
    * in the API gateway. The CORS origins are not configured within the AWS Lambda
    * integrations since the associated header is controlled by API Gateway v2.
+   * Any custom domain names (aliases) configured on a CloudFront distribution are
+   * included automatically alongside its default \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -1160,12 +1181,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     const cfnApi = this.api.node.defaultChild;
@@ -1199,15 +1222,18 @@ import {
   HttpApiIntegration,
   OperationDetails,
 } from './utils.js';
-import { CfnOutput } from 'aws-cdk-lib';
+import { CfnOutput, Stack } from 'aws-cdk-lib';
 import {
   HttpApi as _HttpApi,
   HttpApiProps as _HttpApiProps,
   HttpMethod,
   HttpStage,
   LogGroupLogDestination,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
 import { LogGroup } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { suppressRules } from '../checkov.js';
 
 /**
@@ -1232,6 +1258,12 @@ export interface HttpApiProps<
    * Map of operation names to their API Gateway integrations
    */
   readonly integrations: TIntegrations;
+  /**
+   * Default throttling limits applied to the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -1265,6 +1297,7 @@ export class HttpApi<
       apiName,
       operations,
       integrations,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: HttpApiProps<TIntegrations, TOperation>,
   ) {
@@ -1277,12 +1310,18 @@ export class HttpApi<
       ...props,
     });
 
-    const accessLogGroup = new LogGroup(this, 'AccessLogs');
-    suppressRules(
-      accessLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption',
+    // Customer-managed key for access log encryption at rest
+    const logsKey = new Key(this, 'AccessLogsKey', {
+      enableKeyRotation: true,
+    });
+    const stack = Stack.of(this);
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
     );
+
+    const accessLogGroup = new LogGroup(this, 'AccessLogs', {
+      encryptionKey: logsKey,
+    });
     suppressRules(
       accessLogGroup,
       ['CKV_AWS_66', 'CKV_AWS_338'],
@@ -1292,6 +1331,7 @@ export class HttpApi<
     this.defaultStage = new HttpStage(this, 'DefaultStage', {
       httpApi: this.api,
       autoDeploy: true,
+      throttle,
       accessLogSettings: {
         destination: new LogGroupLogDestination(accessLogGroup),
       },
@@ -1371,9 +1411,10 @@ import {
   HttpApiIntegration,
   IntegrationBuilder,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { HttpApi } from '../../core/api/http-api.js';
 import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
-import { AppRouter, appRouter } from ':proj/test-api';
+import { AppRouter, appRouter } from '@proj/test-api';
 
 // String union type for all API operation names
 type Operations = Procedures<AppRouter>;
@@ -1412,7 +1453,7 @@ export class TestApi<
     return IntegrationBuilder.http({
       pattern: 'isolated',
       operations: routerToOperations(appRouter),
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
         code: Code.fromAsset(
@@ -1425,7 +1466,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -1475,6 +1516,8 @@ export class TestApi<
    * as the only permitted CORS origins
    * in the API gateway. The CORS origins are not configured within the AWS Lambda
    * integrations since the associated header is controlled by API Gateway v2.
+   * Any custom domain names (aliases) configured on a CloudFront distribution are
+   * included automatically alongside its default \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -1485,12 +1528,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     const cfnApi = this.api.node.defaultChild;
@@ -1751,6 +1796,8 @@ export type ApiIntegrations<TOperation extends string, TBaseIntegration> =
  * @template TDefaultIntegrationProps - Type for default integration properties
  * @template TDefaultIntegration - Type for default integration implementation
  * @template TPattern - The integration pattern ('shared' or 'isolated')
+ * @template TOverridden - Union of operation names that have been overridden
+ * @template TOperationOptioned - Union of operation names with per-operation options
  */
 export class IntegrationBuilder<
   TOperation extends string,
@@ -1759,6 +1806,8 @@ export class IntegrationBuilder<
   TDefaultIntegrationProps extends object,
   TDefaultIntegration extends TBaseIntegration,
   TPattern extends 'shared' | 'isolated',
+  TOverridden extends string = never,
+  TOperationOptioned extends string = never,
 > {
   /** Options for the integration builder */
   private options: IntegrationBuilderProps<
@@ -1771,6 +1820,11 @@ export class IntegrationBuilder<
   /** Map of operation names to their custom integrations */
   private integrations: Partial<TIntegrations> = {};
 
+  /** Map of default integration keys to per-operation default option overrides */
+  private perOperationOptions: Partial<
+    Record<string, Partial<TDefaultIntegrationProps>>
+  > = {};
+
   /**
    * Create an Integration Builder for an HTTP API with a shared pattern
    */
@@ -1925,11 +1979,16 @@ export class IntegrationBuilder<
   /**
    * Overrides default integrations with custom implementations for specific operations.
    *
+   * Operations which have per-operation options set via withOperationOptions cannot be
+   * overridden, since these still use the default integration.
+   *
    * @param overrides - Map of operation names to their custom integration implementations
    * @returns The builder instance with updated type information reflecting the overrides
    */
   public withOverrides<
-    TOverrideIntegrations extends Partial<Record<TOperation, TBaseIntegration>>,
+    TOverrideIntegrations extends Partial<
+      Record<Exclude<TOperation, TOperationOptioned>, TBaseIntegration>
+    >,
   >(overrides: TOverrideIntegrations) {
     this.integrations = { ...this.integrations, ...overrides };
     // Re-type to include the overridden integration types.
@@ -1945,7 +2004,9 @@ export class IntegrationBuilder<
       MergedIntegrations,
       TDefaultIntegrationProps,
       TDefaultIntegration,
-      TPattern
+      TPattern,
+      TOverridden | Extract<keyof TOverrideIntegrations, string>,
+      TOperationOptioned
     >;
   }
 
@@ -1964,6 +2025,43 @@ export class IntegrationBuilder<
     return this;
   }
 
+  /**
+   * Updates the default integration options for specific operations, without
+   * affecting the others. The given options are merged with the defaults (and
+   * any options set via withDefaultOptions) when building each default integration.
+   *
+   * Operations which have been replaced via withOverrides cannot be targeted, since
+   * they no longer use the default integration.
+   *
+   * @param options - Map of operation names to partial default integration options
+   * @returns The builder instance
+   */
+  public withOperationOptions<
+    TOptions extends Partial<
+      Record<
+        Exclude<DefaultIntegrationKeys<TPattern, TOperation>, TOverridden>,
+        Partial<TDefaultIntegrationProps>
+      >
+    >,
+  >(options: TOptions) {
+    Object.entries(options).forEach(([op, opOptions]) => {
+      this.perOperationOptions[op] = {
+        ...this.perOperationOptions[op],
+        ...(opOptions as Partial<TDefaultIntegrationProps>),
+      };
+    });
+    return this as unknown as IntegrationBuilder<
+      TOperation,
+      TBaseIntegration,
+      TIntegrations,
+      TDefaultIntegrationProps,
+      TDefaultIntegration,
+      TPattern,
+      TOverridden,
+      TOperationOptioned | Extract<keyof TOptions, string>
+    >;
+  }
+
   /**
    * Builds and returns the complete set of integrations.
    *
@@ -1978,6 +2076,10 @@ export class IntegrationBuilder<
    */
   public build(): TIntegrations {
     const options = this.options;
+    const buildOptionsFor = (op: string): TDefaultIntegrationProps => ({
+      ...options.defaultIntegrationOptions,
+      ...this.perOperationOptions[op],
+    });
     return {
       ...Object.fromEntries(
         options.pattern === 'shared'
@@ -1986,7 +2088,7 @@ export class IntegrationBuilder<
                 '$router',
                 options.buildDefaultIntegration(
                   '$router',
-                  options.defaultIntegrationOptions,
+                  buildOptionsFor('$router'),
                 ),
               ],
             ]
@@ -1997,10 +2099,7 @@ export class IntegrationBuilder<
               )
               .map((op) => [
                 op,
-                options.buildDefaultIntegration(
-                  op,
-                  options.defaultIntegrationOptions,
-                ),
+                options.buildDefaultIntegration(op, buildOptionsFor(op)),
               ]),
       ),
       ...this.integrations,
@@ -2013,21 +2112,27 @@ export class IntegrationBuilder<
 exports[`trpc backend generator > should set up shared constructs for rest > rest-api.ts 1`] = `
 "import { Construct, IConstruct } from 'constructs';
 import {
+  AccessLogFormat,
   Cors,
+  LogGroupLogDestination,
   Resource,
   RestApi as _RestApi,
   RestApiProps as _RestApiProps,
   IResource,
   Stage,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, RemovalPolicy } from 'aws-cdk-lib';
+import { IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
   CfnWebACLAssociation,
 } from 'aws-cdk-lib/aws-wafv2';
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { RuntimeConfig } from '../runtime-config.js';
+import { ApiGatewayAccount } from './api-gateway-account.js';
 import {
   ApiIntegrations,
   OperationDetails,
@@ -2065,6 +2170,12 @@ export interface RestApiProps<
    * @default true
    */
   readonly enableWaf?: boolean;
+  /**
+   * Default throttling limits applied to all methods on the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -2099,14 +2210,49 @@ export class RestApi<
       operations,
       integrations,
       enableWaf = true,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: RestApiProps<TIntegrations, TOperation>,
   ) {
     super(scope, id);
     this.integrations = integrations;
 
+    // Account-level CloudWatch role required for REST API access logging
+    const account = ApiGatewayAccount.ensure(this);
+
+    // KMS key for encrypting logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'LogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(\`logs.\${Stack.of(this).region}.amazonaws.com\`),
+    );
+
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+    });
+
     // Create the API Gateway REST API
-    this.api = new _RestApi(this, 'Api', props);
+    this.api = new _RestApi(this, 'Api', {
+      ...props,
+      deployOptions: {
+        accessLogDestination: new LogGroupLogDestination(accessLogs),
+        accessLogFormat: AccessLogFormat.jsonWithStandardFields(),
+        ...props.deployOptions,
+        methodOptions: {
+          ...props.deployOptions?.methodOptions,
+          // Default throttling applied to all resource paths and methods
+          '/*/*': {
+            throttlingRateLimit: throttle.rateLimit,
+            throttlingBurstLimit: throttle.burstLimit,
+            ...props.deployOptions?.methodOptions?.['/*/*'],
+          },
+        },
+      },
+    });
+    // Ensure the account-level role is configured before the stage is created
+    this.api.deploymentStage.node.addDependency(account.resource);
 
     if (enableWaf) {
       this.webAcl = new CfnWebACL(this, 'WebAcl', {
@@ -2173,14 +2319,12 @@ export class RestApi<
       // \`aws-waf-logs-\` to satisfy the WAFv2 logging destination requirement.
       const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
         logGroupName: \`aws-waf-logs-\${apiName}-\${this.node.addr.slice(-8)}\`,
-        retention: RetentionDays.ONE_MONTH,
+        retention: RetentionDays.ONE_YEAR,
+        encryptionKey: logsKey,
+        // The log group name is deterministic, so retaining it on delete would
+        // orphan it and block re-creation (e.g. after a rolled-back deploy).
         removalPolicy: RemovalPolicy.DESTROY,
       });
-      suppressRules(
-        wafLogGroup,
-        ['CKV_AWS_158'],
-        'Using default CloudWatch log encryption for WAF logs',
-      );
 
       new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
         resourceArn: this.webAcl.attrArn,
@@ -2194,12 +2338,6 @@ export class RestApi<
       'Caching not required for this use case',
       (c) => c instanceof Stage,
     );
-    suppressRules(
-      this.api,
-      ['CKV_AWS_76'],
-      'API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement',
-      (c) => c instanceof Stage,
-    );
 
     // Resolve the integration for a given operation.
     // If the operation has a dedicated integration, use it; otherwise fall back to $router.
@@ -2311,9 +2449,10 @@ import {
   IntegrationBuilder,
   RestApiIntegration,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
 import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
-import { AppRouter, appRouter } from ':proj/test-api';
+import { AppRouter, appRouter } from '@proj/test-api';
 
 // String union type for all API operation names
 type Operations = Procedures<AppRouter>;
@@ -2360,7 +2499,7 @@ export class TestApi<
     return IntegrationBuilder.rest({
       pattern: 'isolated',
       operations: routerToOperations(appRouter),
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
         code: Code.fromAsset(
@@ -2373,7 +2512,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -2426,7 +2565,9 @@ export class TestApi<
    *
    * Configures the provided CloudFront distribution domains or origin strings
    * as the only permitted CORS origins in API Gateway preflight responses and the
-   * AWS Lambda integrations.
+   * AWS Lambda integrations. Any custom domain names (aliases) configured on a
+   * CloudFront distribution are included automatically alongside its default
+   * \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -2437,12 +2578,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     this.allowedOrigins = allowedOrigins;
@@ -2708,6 +2851,8 @@ export type ApiIntegrations<TOperation extends string, TBaseIntegration> =
  * @template TDefaultIntegrationProps - Type for default integration properties
  * @template TDefaultIntegration - Type for default integration implementation
  * @template TPattern - The integration pattern ('shared' or 'isolated')
+ * @template TOverridden - Union of operation names that have been overridden
+ * @template TOperationOptioned - Union of operation names with per-operation options
  */
 export class IntegrationBuilder<
   TOperation extends string,
@@ -2716,6 +2861,8 @@ export class IntegrationBuilder<
   TDefaultIntegrationProps extends object,
   TDefaultIntegration extends TBaseIntegration,
   TPattern extends 'shared' | 'isolated',
+  TOverridden extends string = never,
+  TOperationOptioned extends string = never,
 > {
   /** Options for the integration builder */
   private options: IntegrationBuilderProps<
@@ -2728,6 +2875,11 @@ export class IntegrationBuilder<
   /** Map of operation names to their custom integrations */
   private integrations: Partial<TIntegrations> = {};
 
+  /** Map of default integration keys to per-operation default option overrides */
+  private perOperationOptions: Partial<
+    Record<string, Partial<TDefaultIntegrationProps>>
+  > = {};
+
   /**
    * Create an Integration Builder for an HTTP API with a shared pattern
    */
@@ -2882,11 +3034,16 @@ export class IntegrationBuilder<
   /**
    * Overrides default integrations with custom implementations for specific operations.
    *
+   * Operations which have per-operation options set via withOperationOptions cannot be
+   * overridden, since these still use the default integration.
+   *
    * @param overrides - Map of operation names to their custom integration implementations
    * @returns The builder instance with updated type information reflecting the overrides
    */
   public withOverrides<
-    TOverrideIntegrations extends Partial<Record<TOperation, TBaseIntegration>>,
+    TOverrideIntegrations extends Partial<
+      Record<Exclude<TOperation, TOperationOptioned>, TBaseIntegration>
+    >,
   >(overrides: TOverrideIntegrations) {
     this.integrations = { ...this.integrations, ...overrides };
     // Re-type to include the overridden integration types.
@@ -2902,7 +3059,9 @@ export class IntegrationBuilder<
       MergedIntegrations,
       TDefaultIntegrationProps,
       TDefaultIntegration,
-      TPattern
+      TPattern,
+      TOverridden | Extract<keyof TOverrideIntegrations, string>,
+      TOperationOptioned
     >;
   }
 
@@ -2921,6 +3080,43 @@ export class IntegrationBuilder<
     return this;
   }
 
+  /**
+   * Updates the default integration options for specific operations, without
+   * affecting the others. The given options are merged with the defaults (and
+   * any options set via withDefaultOptions) when building each default integration.
+   *
+   * Operations which have been replaced via withOverrides cannot be targeted, since
+   * they no longer use the default integration.
+   *
+   * @param options - Map of operation names to partial default integration options
+   * @returns The builder instance
+   */
+  public withOperationOptions<
+    TOptions extends Partial<
+      Record<
+        Exclude<DefaultIntegrationKeys<TPattern, TOperation>, TOverridden>,
+        Partial<TDefaultIntegrationProps>
+      >
+    >,
+  >(options: TOptions) {
+    Object.entries(options).forEach(([op, opOptions]) => {
+      this.perOperationOptions[op] = {
+        ...this.perOperationOptions[op],
+        ...(opOptions as Partial<TDefaultIntegrationProps>),
+      };
+    });
+    return this as unknown as IntegrationBuilder<
+      TOperation,
+      TBaseIntegration,
+      TIntegrations,
+      TDefaultIntegrationProps,
+      TDefaultIntegration,
+      TPattern,
+      TOverridden,
+      TOperationOptioned | Extract<keyof TOptions, string>
+    >;
+  }
+
   /**
    * Builds and returns the complete set of integrations.
    *
@@ -2935,6 +3131,10 @@ export class IntegrationBuilder<
    */
   public build(): TIntegrations {
     const options = this.options;
+    const buildOptionsFor = (op: string): TDefaultIntegrationProps => ({
+      ...options.defaultIntegrationOptions,
+      ...this.perOperationOptions[op],
+    });
     return {
       ...Object.fromEntries(
         options.pattern === 'shared'
@@ -2943,7 +3143,7 @@ export class IntegrationBuilder<
                 '$router',
                 options.buildDefaultIntegration(
                   '$router',
-                  options.defaultIntegrationOptions,
+                  buildOptionsFor('$router'),
                 ),
               ],
             ]
@@ -2954,10 +3154,7 @@ export class IntegrationBuilder<
               )
               .map((op) => [
                 op,
-                options.buildDefaultIntegration(
-                  op,
-                  options.defaultIntegrationOptions,
-                ),
+                options.buildDefaultIntegration(op, buildOptionsFor(op)),
               ]),
       ),
       ...this.integrations,
@@ -2978,7 +3175,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.58.0"
     }
   }
 }
@@ -3225,7 +3422,7 @@ output "api_log_group_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.58.0"
     }
   }
 }
@@ -3257,11 +3454,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 variable "cors_allow_credentials" {
   description = "Whether to allow credentials in CORS requests"
@@ -3293,12 +3526,6 @@ variable "cors_expose_headers" {
   default     = []
 }
 
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -3349,16 +3576,37 @@ module "http_api" {
   cors_allow_methods     = var.cors_allow_methods
   cors_allow_origins     = var.cors_allow_origins
   cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
 
   # Tags
   tags = var.tags
 }
 
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "test-api-lambda-"
+  description = "Security group for the TestApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Lambda function
 # This configures a single "router" lambda to serve all requests
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -3380,13 +3628,25 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
@@ -3421,18 +3681,39 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
   role       = aws_iam_role.lambda_execution_role.name
 }
 
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  count      = var.enable_vpc ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role.name
+}
+
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -3591,6 +3872,11 @@ output "lambda_execution_role_name" {
   value       = aws_iam_role.lambda_execution_role.name
 }
 
+output "security_group_id" {
+  description = "Security group ID of the API Lambda function, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
+}
+
 # Integration Outputs
 output "integration_id" {
   description = "ID of the Lambda integration"
@@ -3631,7 +3917,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.58.0"
     }
   }
 }
@@ -3878,7 +4164,7 @@ output "api_log_group_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.58.0"
     }
   }
 }
@@ -3900,11 +4186,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 variable "cors_allow_credentials" {
   description = "Whether to allow credentials in CORS requests"
@@ -3936,12 +4258,6 @@ variable "cors_expose_headers" {
   default     = []
 }
 
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -3992,16 +4308,37 @@ module "http_api" {
   cors_allow_methods     = var.cors_allow_methods
   cors_allow_origins     = var.cors_allow_origins
   cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
 
   # Tags
   tags = var.tags
 }
 
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "test-api-lambda-"
+  description = "Security group for the TestApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Lambda function
 # This configures a single "router" lambda to serve all requests
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -4023,13 +4360,25 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
@@ -4064,18 +4413,39 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
   role       = aws_iam_role.lambda_execution_role.name
 }
 
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  count      = var.enable_vpc ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role.name
+}
+
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -4316,6 +4686,11 @@ output "lambda_execution_role_name" {
   value       = aws_iam_role.lambda_execution_role.name
 }
 
+output "security_group_id" {
+  description = "Security group ID of the API Lambda function, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
+}
+
 # Integration Outputs
 output "integration_id" {
   description = "ID of the Lambda integration"
@@ -4356,7 +4731,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.58.0"
     }
   }
 }
@@ -4603,7 +4978,7 @@ output "api_log_group_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.58.0"
     }
   }
 }
@@ -4625,11 +5000,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 variable "cors_allow_credentials" {
   description = "Whether to allow credentials in CORS requests"
@@ -4661,12 +5072,6 @@ variable "cors_expose_headers" {
   default     = []
 }
 
-variable "cors_max_age" {
-  description = "Maximum age for CORS preflight requests in seconds"
-  type        = number
-  default     = 0
-}
-
 # Tags
 variable "tags" {
   description = "Tags to apply to all resources"
@@ -4717,16 +5122,37 @@ module "http_api" {
   cors_allow_methods     = var.cors_allow_methods
   cors_allow_origins     = var.cors_allow_origins
   cors_expose_headers    = var.cors_expose_headers
-  cors_max_age           = var.cors_max_age
 
   # Tags
   tags = var.tags
 }
 
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "test-api-lambda-"
+  description = "Security group for the TestApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Lambda function
 # This configures a single "router" lambda to serve all requests
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -4748,13 +5174,25 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
@@ -4789,18 +5227,39 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
   role       = aws_iam_role.lambda_execution_role.name
 }
 
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  count      = var.enable_vpc ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role.name
+}
+
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -4946,6 +5405,11 @@ output "lambda_execution_role_name" {
   value       = aws_iam_role.lambda_execution_role.name
 }
 
+output "security_group_id" {
+  description = "Security group ID of the API Lambda function, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
+}
+
 # Integration Outputs
 output "integration_id" {
   description = "ID of the Lambda integration"
@@ -4986,11 +5450,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.58.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -5060,8 +5524,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -5078,10 +5540,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -5239,16 +5699,14 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
+# Note: Stage, deployment and access log outputs are provided by the consuming module",
   "test-api.tf": "terraform {
   required_version = ">= 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.58.0"
     }
   }
 }
@@ -5280,11 +5738,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -5347,6 +5841,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -5376,9 +5875,31 @@ resource "aws_wafv2_web_acl_association" "api_waf_association" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "test-api-lambda-"
+  description = "Security group for the TestApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Lambda function
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -5400,13 +5921,25 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
@@ -5441,18 +5974,39 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
   role       = aws_iam_role.lambda_execution_role.name
 }
 
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  count      = var.enable_vpc ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role.name
+}
+
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -5502,6 +6056,9 @@ resource "aws_api_gateway_method" "proxy_method" {
 
   authorization = "COGNITO_USER_POOLS"
   authorizer_id = aws_api_gateway_authorizer.cognito_authorizer.id
+  # Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+  # and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+  authorization_scopes = ["openid", "aws.cognito.signin.user.admin"]
 
   request_parameters = {
     "method.request.path.proxy" = true
@@ -5588,11 +6145,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "TestApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/test-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -5600,9 +6209,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -5741,6 +6380,11 @@ output "lambda_execution_role_name" {
   value       = aws_iam_role.lambda_execution_role.name
 }
 
+output "security_group_id" {
+  description = "Security group ID of the API Lambda function, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
+}
+
 # Integration Outputs
 output "integration_id" {
   description = "ID of the Lambda integration"
@@ -5782,11 +6426,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.58.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -5856,8 +6500,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -5874,10 +6516,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -6035,16 +6675,14 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
+# Note: Stage, deployment and access log outputs are provided by the consuming module",
   "test-api.tf": "terraform {
   required_version = ">= 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.58.0"
     }
   }
 }
@@ -6066,11 +6704,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -6133,6 +6807,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -6162,9 +6841,31 @@ resource "aws_wafv2_web_acl_association" "api_waf_association" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "test-api-lambda-"
+  description = "Security group for the TestApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Lambda function
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -6186,13 +6887,25 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
@@ -6227,18 +6940,39 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
   role       = aws_iam_role.lambda_execution_role.name
 }
 
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  count      = var.enable_vpc ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role.name
+}
+
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -6365,11 +7099,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "TestApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/test-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -6377,9 +7163,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -6529,6 +7345,11 @@ output "lambda_execution_role_name" {
   value       = aws_iam_role.lambda_execution_role.name
 }
 
+output "security_group_id" {
+  description = "Security group ID of the API Lambda function, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
+}
+
 # Integration Outputs
 output "integration_id" {
   description = "ID of the Lambda integration"
@@ -6570,11 +7391,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.58.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -6644,8 +7465,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -6662,10 +7481,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -6823,16 +7640,14 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
+# Note: Stage, deployment and access log outputs are provided by the consuming module",
   "test-api.tf": "terraform {
   required_version = ">= 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.58.0"
     }
   }
 }
@@ -6854,11 +7669,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -6921,6 +7772,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -6950,9 +7806,31 @@ resource "aws_wafv2_web_acl_association" "api_waf_association" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "test-api-lambda-"
+  description = "Security group for the TestApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Lambda function
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -6974,13 +7852,25 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
@@ -7015,18 +7905,39 @@ resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
   role       = aws_iam_role.lambda_execution_role.name
 }
 
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  count      = var.enable_vpc ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role.name
+}
+
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
+  count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -7247,11 +8158,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "TestApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/test-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -7259,9 +8222,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -7400,6 +8393,11 @@ output "lambda_execution_role_name" {
   value       = aws_iam_role.lambda_execution_role.name
 }
 
+output "security_group_id" {
+  description = "Security group ID of the API Lambda function, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
+}
+
 # Integration Outputs
 output "integration_id" {
   description = "ID of the Lambda integration"