@aws/nx-plugin 1.0.0-rc.7 → 1.0.0-rc.71

package/src/utils/api-constructs/api-constructs.js

@@ -1,37 +1,65 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addApiGatewayInfra = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const ast_1 = require("../ast");
-const nx_1 = require("../nx");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
-const addApiGatewayInfra = async (tree, options) => {
-    if (options.iac === 'cdk') {
-        await addApiGatewayCdkConstructs(tree, options);
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { forDependencies } from "../declared-dependencies.js";
+import { addDependenciesToPackageJson } from "../dependencies.js";
+import { esmVars } from "../module-format.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { generatedInfrastructure, generatedTerraform, PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { PY_VERSIONS, terraformProviderVersions, withVersions } from "../versions.js";
+/**
+ * Dependencies a caller must declare to add API Gateway infrastructure.
+ *
+ * Gated on infrastructure having been generated: `addApiGatewayInfra` only runs
+ * on that branch, so a project generated with `infra: 'none'` never receives
+ * these.
+ */ export const API_CONSTRUCTS_DEPENDENCIES = [
+    {
+        name: '@aws-sdk/client-api-gateway',
+        when: generatedInfrastructure
+    },
+    {
+        name: '@aws-sdk/client-iam',
+        when: generatedInfrastructure
+    },
+    {
+        name: '@trpc/server',
+        when: generatedInfrastructure
     }
-    else if (options.iac === 'terraform') {
-        addApiGatewayTerraformModules(tree, options);
+];
+/**
+ * Python version the generated Terraform pins in the account module's inline
+ * `uv run --with` script. Nothing installs it, so it is declared for its version
+ * alone, and only on the Terraform branch that writes the script.
+ */ export const API_CONSTRUCTS_PY_DEPENDENCIES = [
+    {
+        name: 'boto3',
+        when: generatedTerraform
     }
-    else {
+];
+export const addApiGatewayInfra = async (tree, options, declaration)=>{
+    if (options.iac === 'cdk') {
+        await addApiGatewayCdkConstructs(tree, options, declaration);
+    } else if (options.iac === 'terraform') {
+        addApiGatewayTerraformModules(tree, options);
+    } else {
         throw new Error(`Unsupported iac ${options.iac}`);
     }
-    (0, devkit_1.updateJson)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, options.iac === 'cdk' ? shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR : shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'project.json'), (config) => {
-        (0, nx_1.addDependencyToTargetIfNotPresent)(config, 'build', `${options.apiProjectName}:build`);
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addDependencyToTargetIfNotPresent(config, 'build', `${options.apiProjectName}:build`);
         return config;
     });
 };
-exports.addApiGatewayInfra = addApiGatewayInfra;
 /**
  * Add an API CDK construct, and update the Runtime Config type to export its url
- */
-const addApiGatewayCdkConstructs = async (tree, options) => {
-    const generateCoreApiFile = (name) => {
-        (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'core', 'api', name), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core', 'api'), {}, {
-            overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+ */ const addApiGatewayCdkConstructs = async (tree, options, declaration)=>{
+    const generateCoreApiFile = (name)=>{
+        generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'api', name), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'api'), {
+            ...esmVars(tree)
+        }, {
+            overwriteStrategy: OverwriteStrategy.KeepExisting
         });
     };
     // Generate relevant core CDK construct and utilities
@@ -40,25 +68,47 @@ const addApiGatewayCdkConstructs = async (tree, options) => {
     if (options.backend.type === 'trpc') {
         generateCoreApiFile('trpc');
     }
+    // Declare the deps the generated core construct files import.
+    const constructDeps = [];
+    if (options.constructType === 'rest') {
+        // REST account construct configures the account via the AWS SDK.
+        constructDeps.push('@aws-sdk/client-api-gateway', '@aws-sdk/client-iam');
+    }
+    if (options.backend.type === 'trpc') {
+        // trpc-utils.ts types the router with @trpc/server.
+        constructDeps.push('@trpc/server');
+    }
+    if (constructDeps.length > 0) {
+        addDependenciesToPackageJson(tree, withVersions(forDependencies(declaration), constructDeps), {}, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'));
+    }
     // Generate app specific CDK construct
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'app', 'apis', options.constructType), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'apis'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'apis', options.constructType), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'apis'), {
+        ...options,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     // Export app specific CDK construct
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'apis', 'index.ts'), `./${options.apiNameKebabCase}.js`);
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './apis/index.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'apis', 'index.ts'), `./${options.apiNameKebabCase}.js`);
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './apis/index.js');
 };
 /**
  * Add an API terraform module, and update the Runtime Config type to export its url
- */
-const addApiGatewayTerraformModules = (tree, options) => {
+ */ const addApiGatewayTerraformModules = (tree, options)=>{
     // Generate core terraform module
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'core', 'api', options.constructType), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core', 'api'), {}, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'api', options.constructType), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'), {
+        boto3Version: PY_VERSIONS.boto3,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     // Generate app specific terraform module
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'app', 'apis', options.constructType), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'apis', options.constructType), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'), {
+        ...options,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
 };
+
 //# sourceMappingURL=api-constructs.js.map

package/src/utils/api-constructs/api-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,gCAAuC;AAEvC,8BAA0D;AAC1D,gFAIwC;AAmCjC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAU,EACV,OAAqD,EACrD,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,6BAA6B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,mDAAqB,CAAC,CAAC,CAAC,kDAAoB,EACpE,cAAc,CACf,EACD,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAA,sCAAiC,EAC/B,MAAM,EACN,OAAO,EACP,GAAG,OAAO,CAAC,cAAc,QAAQ,CAClC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,kBAAkB,sBA4B7B;AAEF;;GAEG;AACH,MAAM,0BAA0B,GAAG,KAAK,EACtC,IAAU,EACV,OAAsC,EACtC,EAAE;IACF,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,EAAE;QAC3C,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,EACjE,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,KAAK,CACN,EACD,EAAE,EACF;YACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;SAClD,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,qDAAqD;IACrD,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACpC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,sCAAsC;IACtC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,KAAK,EACL,KAAK,EACL,MAAM,EACN,OAAO,CAAC,aAAa,CACtB,EACD,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,MAAM,CACP,EACD,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,oCAAoC;IACpC,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,KAAK,OAAO,CAAC,gBAAgB,KAAK,CACnC,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,iBAAiB,CAClB,CAAC;AACJ,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,6BAA6B,GAAG,CACpC,IAAU,EACV,OAAsC,EACtC,EAAE;IACF,iCAAiC;IACjC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,WAAW,EACX,MAAM,EACN,KAAK,EACL,OAAO,CAAC,aAAa,CACtB,EACD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAC3E,EAAE,EACF;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,yCAAyC;IACzC,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EACf,SAAS,EACT,OAAO,EACP,WAAW,EACX,KAAK,EACL,MAAM,EACN,OAAO,CAAC,aAAa,CACtB,EACD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAC3E,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/api-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport {\n  type DeclaredPyDependency,\n  type DeclaredTsDependency,\n  type DependencyDeclaration,\n  forDependencies,\n  type MustDeclare,\n} from '../declared-dependencies';\nimport { addDependenciesToPackageJson } from '../dependencies';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  generatedInfrastructure,\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport {\n  type IPyDepVersion,\n  type ITsDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n  withVersions,\n} from '../versions';\n\n/**\n * Dependencies a caller must declare to add API Gateway infrastructure.\n *\n * Gated on infrastructure having been generated: `addApiGatewayInfra` only runs\n * on that branch, so a project generated with `infra: 'none'` never receives\n * these.\n */\nexport const API_CONSTRUCTS_DEPENDENCIES = [\n  { name: '@aws-sdk/client-api-gateway', when: generatedInfrastructure },\n  { name: '@aws-sdk/client-iam', when: generatedInfrastructure },\n  { name: '@trpc/server', when: generatedInfrastructure },\n] as const satisfies readonly DeclaredTsDependency<\n  ITsDepVersion,\n  IacMetadata\n>[];\n\n/**\n * Python version the generated Terraform pins in the account module's inline\n * `uv run --with` script. Nothing installs it, so it is declared for its version\n * alone, and only on the Terraform branch that writes the script.\n */\nexport const API_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\ninterface BackendOptions {\n  type: 'trpc' | 'fastapi' | 'smithy';\n  integrationPattern: 'isolated' | 'shared';\n}\n\nexport interface TrpcBackendOptions extends BackendOptions {\n  type: 'trpc';\n  projectAlias: string;\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface FastApiBackendOptions extends BackendOptions {\n  type: 'fastapi';\n  moduleName: string;\n  bundleOutputDir: string;\n}\n\nexport interface SmithyBackendOptions extends BackendOptions {\n  type: 'smithy';\n  bundleOutputDir: string;\n  authorizerBundleOutputDir?: string;\n}\n\nexport interface AddApiGatewayConstructOptions {\n  apiProjectName: string;\n  apiNameClassName: string;\n  apiNameKebabCase: string;\n  constructType: 'http' | 'rest';\n  backend: TrpcBackendOptions | FastApiBackendOptions | SmithyBackendOptions;\n  auth: 'iam' | 'cognito' | 'custom';\n}\n\nexport const addApiGatewayInfra = async <const D extends DependencyDeclaration>(\n  tree: Tree,\n  options: AddApiGatewayConstructOptions & { iac: Iac },\n  declaration: D & MustDeclare<typeof API_CONSTRUCTS_DEPENDENCIES, D>,\n) => {\n  if (options.iac === 'cdk') {\n    await addApiGatewayCdkConstructs(tree, options, declaration);\n  } else if (options.iac === 'terraform') {\n    addApiGatewayTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.apiProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\n/**\n * Add an API CDK construct, and update the Runtime Config type to export its url\n */\nconst addApiGatewayCdkConstructs = async (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n  declaration: DependencyDeclaration,\n) => {\n  const generateCoreApiFile = (name: string) => {\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        'files',\n        'cdk',\n        'core',\n        'api',\n        name,\n      ),\n      joinPathFragments(\n        PACKAGES_DIR,\n        SHARED_CONSTRUCTS_DIR,\n        'src',\n        'core',\n        'api',\n      ),\n      { ...esmVars(tree) },\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  };\n\n  // Generate relevant core CDK construct and utilities\n  generateCoreApiFile(options.constructType);\n  generateCoreApiFile('utils');\n  if (options.backend.type === 'trpc') {\n    generateCoreApiFile('trpc');\n  }\n\n  // Declare the deps the generated core construct files import.\n  const constructDeps: (typeof API_CONSTRUCTS_DEPENDENCIES)[number]['name'][] =\n    [];\n  if (options.constructType === 'rest') {\n    // REST account construct configures the account via the AWS SDK.\n    constructDeps.push('@aws-sdk/client-api-gateway', '@aws-sdk/client-iam');\n  }\n  if (options.backend.type === 'trpc') {\n    // trpc-utils.ts types the router with @trpc/server.\n    constructDeps.push('@trpc/server');\n  }\n  if (constructDeps.length > 0) {\n    addDependenciesToPackageJson(\n      tree,\n      withVersions(\n        forDependencies<typeof API_CONSTRUCTS_DEPENDENCIES>(declaration),\n        constructDeps,\n      ),\n      {},\n      joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'package.json'),\n    );\n  }\n\n  // Generate app specific CDK construct\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'cdk',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Export app specific CDK construct\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'apis',\n      'index.ts',\n    ),\n    `./${options.apiNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './apis/index.js',\n  );\n};\n\n/**\n * Add an API terraform module, and update the Runtime Config type to export its url\n */\nconst addApiGatewayTerraformModules = (\n  tree: Tree,\n  options: AddApiGatewayConstructOptions,\n) => {\n  // Generate core terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'core',\n      'api',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'api'),\n    { boto3Version: PY_VERSIONS.boto3, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  // Generate app specific terraform module\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      'files',\n      'terraform',\n      'app',\n      'apis',\n      options.constructType,\n    ),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'apis'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","forDependencies","addDependenciesToPackageJson","esmVars","addDependencyToTargetIfNotPresent","generatedInfrastructure","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","withVersions","API_CONSTRUCTS_DEPENDENCIES","name","when","API_CONSTRUCTS_PY_DEPENDENCIES","addApiGatewayInfra","tree","options","declaration","iac","addApiGatewayCdkConstructs","addApiGatewayTerraformModules","Error","config","apiProjectName","generateCoreApiFile","dirname","overwriteStrategy","KeepExisting","constructType","backend","type","constructDeps","push","length","apiNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AACvC,SAIEC,eAAe,QAEV,8BAA2B;AAClC,SAASC,4BAA4B,QAAQ,qBAAkB;AAE/D,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,uBAAuB,EACvBC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAGEC,WAAW,EACXC,yBAAyB,EACzBC,YAAY,QACP,iBAAc;AAErB;;;;;;CAMC,GACD,OAAO,MAAMC,8BAA8B;IACzC;QAAEC,MAAM;QAA+BC,MAAMV;IAAwB;IACrE;QAAES,MAAM;QAAuBC,MAAMV;IAAwB;IAC7D;QAAES,MAAM;QAAgBC,MAAMV;IAAwB;CACvD,CAGG;AAEJ;;;;CAIC,GACD,OAAO,MAAMW,iCAAiC;IAC5C;QAAEF,MAAM;QAASC,MAAMT;IAAmB;CAC3C,CAGG;AAmCJ,OAAO,MAAMW,qBAAqB,OAChCC,MACAC,SACAC;IAEA,IAAID,QAAQE,GAAG,KAAK,OAAO;QACzB,MAAMC,2BAA2BJ,MAAMC,SAASC;IAClD,OAAO,IAAID,QAAQE,GAAG,KAAK,aAAa;QACtCE,8BAA8BL,MAAMC;IACtC,OAAO;QACL,MAAM,IAAIK,MAAM,CAAC,gBAAgB,EAAEL,QAAQE,GAAG,EAAE;IAClD;IAEAtB,WACEmB,MACArB,kBACEU,cACAY,QAAQE,GAAG,KAAK,QAAQb,wBAAwBC,sBAChD,iBAEF,CAACgB;QACCrB,kCACEqB,QACA,SACA,GAAGN,QAAQO,cAAc,CAAC,MAAM,CAAC;QAEnC,OAAOD;IACT;AAEJ,EAAE;AAEF;;CAEC,GACD,MAAMH,6BAA6B,OACjCJ,MACAC,SACAC;IAEA,MAAMO,sBAAsB,CAACb;QAC3BlB,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,OACA,QACA,OACAd,OAEFjB,kBACEU,cACAC,uBACA,OACA,QACA,QAEF;YAAE,GAAGL,QAAQe,KAAK;QAAC,GACnB;YACEW,mBAAmB/B,kBAAkBgC,YAAY;QACnD;IAEJ;IAEA,qDAAqD;IACrDH,oBAAoBR,QAAQY,aAAa;IACzCJ,oBAAoB;IACpB,IAAIR,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnCN,oBAAoB;IACtB;IAEA,8DAA8D;IAC9D,MAAMO,gBACJ,EAAE;IACJ,IAAIf,QAAQY,aAAa,KAAK,QAAQ;QACpC,iEAAiE;QACjEG,cAAcC,IAAI,CAAC,+BAA+B;IACpD;IACA,IAAIhB,QAAQa,OAAO,CAACC,IAAI,KAAK,QAAQ;QACnC,oDAAoD;QACpDC,cAAcC,IAAI,CAAC;IACrB;IACA,IAAID,cAAcE,MAAM,GAAG,GAAG;QAC5BlC,6BACEgB,MACAN,aACEX,gBAAoDmB,cACpDc,gBAEF,CAAC,GACDrC,kBAAkBU,cAAcC,uBAAuB;IAE3D;IAEA,sCAAsC;IACtCZ,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,OACA,OACA,QACAT,QAAQY,aAAa,GAEvBlC,kBACEU,cACAC,uBACA,OACA,OACA,SAEF;QAAE,GAAGW,OAAO;QAAE,GAAGhB,QAAQe,KAAK;IAAC,GAC/B;QACEW,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,oCAAoC;IACpC,MAAM9B,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,QACA,aAEF,CAAC,EAAE,EAAEW,QAAQkB,gBAAgB,CAAC,GAAG,CAAC;IAEpC,MAAMrC,cACJkB,MACArB,kBACEU,cACAC,uBACA,OACA,OACA,aAEF;AAEJ;AAEA;;CAEC,GACD,MAAMe,gCAAgC,CACpCL,MACAC;IAEA,iCAAiC;IACjCvB,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,aACA,QACA,OACAT,QAAQY,aAAa,GAEvBlC,kBAAkBU,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE6B,cAAc5B,YAAY6B,KAAK;QAAE,GAAG5B,2BAA2B;IAAC,GAClE;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;IAGF,yCAAyC;IACzClC,cACEsB,MACArB,kBACE,YAAY+B,OAAO,EACnB,SACA,aACA,OACA,QACAT,QAAQY,aAAa,GAEvBlC,kBAAkBU,cAAcE,sBAAsB,OAAO,OAAO,SACpE;QAAE,GAAGU,OAAO;QAAE,GAAGR,2BAA2B;IAAC,GAC7C;QACEkB,mBAAmB/B,kBAAkBgC,YAAY;IACnD;AAEJ"}

package/src/utils/api-constructs/files/cdk/app/apis/http/__apiNameKebabCase__.ts.template

@@ -13,7 +13,7 @@ import {
   <%_ } _%>
 } from 'aws-cdk-lib/aws-lambda';
 import { Duration<%_ if (backend.type === 'fastapi') { _%>, Stack<%_ } _%> } from 'aws-cdk-lib';
-import { RuntimeConfig } from '../../core/runtime-config.js';
+import { RuntimeConfig } from '../../core/runtime-config<% if (esm) { %>.js<% } %>';
 import {
   CorsHttpMethod,
   CfnApi,
@@ -41,10 +41,11 @@ import {
   ApiIntegrations,
   HttpApiIntegration,
   IntegrationBuilder,
-} from '../../core/api/utils.js';
-import { HttpApi } from '../../core/api/http-api.js';
+} from '../../core/api/utils<% if (esm) { %>.js<% } %>';
+import { findCloudFrontDomainNames } from '../../core/cloudfront<% if (esm) { %>.js<% } %>';
+import { HttpApi } from '../../core/api/http-api<% if (esm) { %>.js<% } %>';
 <%_ if (backend.type === 'trpc') { _%>
-import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
+import { Procedures, routerToOperations } from '../../core/api/trpc-utils<% if (esm) { %>.js<% } %>';
 import { AppRouter, appRouter } from '<%= backend.projectAlias %>';
 
 // String union type for all API operation names
@@ -108,7 +109,7 @@ export class <%= apiNameClassName %><
       <%_ } else { _%>
       operations: OPERATION_DETAILS,
       <%_ } _%>
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         <%_ if (['trpc', 'smithy'].includes(backend.type)) { _%>
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
@@ -116,7 +117,7 @@ export class <%= apiNameClassName %><
           url.fileURLToPath(
             new URL(
               '../../../../../../<%- backend.bundleOutputDir %>',
-              import.meta.url,
+              <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
             ),
           ),
         ),
@@ -127,7 +128,7 @@ export class <%= apiNameClassName %><
           url.fileURLToPath(
             new URL(
               '../../../../../../<%- backend.bundleOutputDir %>',
-              import.meta.url,
+              <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
             ),
           ),
         ),
@@ -137,7 +138,7 @@ export class <%= apiNameClassName %><
         <%_ if (backend.type === 'fastapi') { _%>
         snapStart: SnapStartConf.ON_PUBLISHED_VERSIONS,
         <%_ } _%>
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         <%_ const lambdaTarget = backend.type === 'fastapi' ? 'handler.currentVersion' : 'handler'; _%>
         <%_ const integrationOptions = backend.integrationPattern === 'shared' ? ', { scopePermissionToRoute: false }' : ''; _%>
@@ -184,7 +185,7 @@ export class <%= apiNameClassName %><
         url.fileURLToPath(
           new URL(
             '../../../../../../<%- backend.authorizerBundleOutputDir %>',
-            import.meta.url,
+            <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
           ),
         ),
       ),
@@ -195,7 +196,7 @@ export class <%= apiNameClassName %><
         url.fileURLToPath(
           new URL(
             '../../../../../../<%- backend.bundleOutputDir %>',
-            import.meta.url,
+            <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
           ),
         ),
       ),
@@ -245,18 +246,22 @@ export class <%= apiNameClassName %><
    * as the only permitted CORS origins
    * in the API gateway. The CORS origins are not configured within the AWS Lambda
    * integrations since the associated header is controlled by API Gateway v2.
+   * Any custom domain names (aliases) configured on a CloudFront distribution are
+   * included automatically alongside its default `*.cloudfront.net` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
   public restrictCorsTo(
     ...origins: (string | Distribution | { cloudFrontDistribution: Distribution })[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? `https://${origin.cloudFrontDistribution.distributionDomainName}`
-          : `https://${origin.distributionDomainName}`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => `https://${domain}`),
     );
 
     const cfnApi = this.api.node.defaultChild;

package/src/utils/api-constructs/files/cdk/app/apis/rest/__apiNameKebabCase__.ts.template

@@ -12,7 +12,7 @@ import {
   SnapStartConf,
   <%_ } _%>
 } from 'aws-cdk-lib/aws-lambda';
-import { RuntimeConfig } from '../../core/runtime-config.js';
+import { RuntimeConfig } from '../../core/runtime-config<% if (esm) { %>.js<% } %>';
 import {
   AuthorizationType,
   LambdaIntegration,
@@ -44,10 +44,11 @@ import {
   ApiIntegrations,
   IntegrationBuilder,
   RestApiIntegration,
-} from '../../core/api/utils.js';
-import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
+} from '../../core/api/utils<% if (esm) { %>.js<% } %>';
+import { findCloudFrontDomainNames } from '../../core/cloudfront<% if (esm) { %>.js<% } %>';
+import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api<% if (esm) { %>.js<% } %>';
 <%_ if (backend.type === 'trpc') { _%>
-import { Procedures, routerToOperations } from '../../core/api/trpc-utils.js';
+import { Procedures, routerToOperations } from '../../core/api/trpc-utils<% if (esm) { %>.js<% } %>';
 import { AppRouter, appRouter } from '<%= backend.projectAlias %>';
 
 // String union type for all API operation names
@@ -118,7 +119,7 @@ export class <%= apiNameClassName %><
       <%_ } else { _%>
       operations: OPERATION_DETAILS,
       <%_ } _%>
-      defaultIntegrationOptions: <FunctionProps>{
+      defaultIntegrationOptions: {
         <%_ if (['trpc', 'smithy'].includes(backend.type)) { _%>
         runtime: Runtime.NODEJS_LATEST,
         handler: 'index.handler',
@@ -126,7 +127,7 @@ export class <%= apiNameClassName %><
           url.fileURLToPath(
             new URL(
               '../../../../../../<%- backend.bundleOutputDir %>',
-              import.meta.url,
+              <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
             ),
           ),
         ),
@@ -137,7 +138,7 @@ export class <%= apiNameClassName %><
           url.fileURLToPath(
             new URL(
               '../../../../../../<%- backend.bundleOutputDir %>',
-              import.meta.url,
+              <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
             ),
           ),
         ),
@@ -147,7 +148,7 @@ export class <%= apiNameClassName %><
         <%_ if (backend.type === 'fastapi') { _%>
         snapStart: SnapStartConf.ON_PUBLISHED_VERSIONS,
         <%_ } _%>
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         <%_ const lambdaTarget = backend.type === 'fastapi' ? 'handler.currentVersion' : 'handler'; _%>
         <%_
@@ -204,7 +205,7 @@ export class <%= apiNameClassName %><
         url.fileURLToPath(
           new URL(
             '../../../../../../<%- backend.authorizerBundleOutputDir %>',
-            import.meta.url,
+            <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
           ),
         ),
       ),
@@ -215,7 +216,7 @@ export class <%= apiNameClassName %><
         url.fileURLToPath(
           new URL(
             '../../../../../../<%- backend.bundleOutputDir %>',
-            import.meta.url,
+            <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>,
           ),
         ),
       ),
@@ -235,6 +236,9 @@ export class <%= apiNameClassName %><
         authorizer: new CognitoUserPoolsAuthorizer(scope, '<%= apiNameClassName %>Authorizer', {
           cognitoUserPools: [props.identity.userPool],
         }),
+        // Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+        // and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+        authorizationScopes: ['openid', 'aws.cognito.signin.user.admin'],
         <%_ } else if (auth === 'custom') { _%>
         authorizationType: AuthorizationType.CUSTOM,
         authorizer: new TokenAuthorizer(scope, '<%= apiNameClassName %>TokenAuthorizer', {
@@ -281,19 +285,23 @@ export class <%= apiNameClassName %><
    *
    * Configures the provided CloudFront distribution domains or origin strings
    * as the only permitted CORS origins in API Gateway preflight responses and the
-   * AWS Lambda integrations.
+   * AWS Lambda integrations. Any custom domain names (aliases) configured on a
+   * CloudFront distribution are included automatically alongside its default
+   * `*.cloudfront.net` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
   public restrictCorsTo(
     ...origins: (string | Distribution | { cloudFrontDistribution: Distribution })[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? `https://${origin.cloudFrontDistribution.distributionDomainName}`
-          : `https://${origin.distributionDomainName}`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => `https://${domain}`),
     );
 
     this.allowedOrigins = allowedOrigins;

package/src/utils/api-constructs/files/cdk/core/api/http/http-api.ts.template

@@ -1,20 +1,23 @@
 import { Construct } from 'constructs';
-import { RuntimeConfig } from '../runtime-config.js';
+import { RuntimeConfig } from '../runtime-config<% if (esm) { %>.js<% } %>';
 import {
   ApiIntegrations,
   HttpApiIntegration,
   OperationDetails,
-} from './utils.js';
-import { CfnOutput } from 'aws-cdk-lib';
+} from './utils<% if (esm) { %>.js<% } %>';
+import { CfnOutput, Stack } from 'aws-cdk-lib';
 import {
   HttpApi as _HttpApi,
   HttpApiProps as _HttpApiProps,
   HttpMethod,
   HttpStage,
   LogGroupLogDestination,
+  ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
 import { LogGroup } from 'aws-cdk-lib/aws-logs';
-import { suppressRules } from '../checkov.js';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { suppressRules } from '../checkov<% if (esm) { %>.js<% } %>';
 
 /**
  * Properties for creating an HttpApi construct.
@@ -38,6 +41,12 @@ export interface HttpApiProps<
    * Map of operation names to their API Gateway integrations
    */
   readonly integrations: TIntegrations;
+  /**
+   * Default throttling limits applied to the API's default stage.
+   *
+   * @default { rateLimit: 10000, burstLimit: 5000 }
+   */
+  readonly throttle?: ThrottleSettings;
 }
 
 /**
@@ -71,6 +80,7 @@ export class HttpApi<
       apiName,
       operations,
       integrations,
+      throttle = { rateLimit: 10000, burstLimit: 5000 },
       ...props
     }: HttpApiProps<TIntegrations, TOperation>,
   ) {
@@ -83,12 +93,18 @@ export class HttpApi<
       ...props,
     });
 
-    const accessLogGroup = new LogGroup(this, 'AccessLogs');
-    suppressRules(
-      accessLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption',
+    // Customer-managed key for access log encryption at rest
+    const logsKey = new Key(this, 'AccessLogsKey', {
+      enableKeyRotation: true,
+    });
+    const stack = Stack.of(this);
+    logsKey.grantEncryptDecrypt(
+      new ServicePrincipal(`logs.${stack.region}.amazonaws.com`),
     );
+
+    const accessLogGroup = new LogGroup(this, 'AccessLogs', {
+      encryptionKey: logsKey,
+    });
     suppressRules(
       accessLogGroup,
       ['CKV_AWS_66', 'CKV_AWS_338'],
@@ -98,6 +114,7 @@ export class HttpApi<
     this.defaultStage = new HttpStage(this, 'DefaultStage', {
       httpApi: this.api,
       autoDeploy: true,
+      throttle,
       accessLogSettings: {
         destination: new LogGroupLogDestination(accessLogGroup),
       },

package/src/utils/api-constructs/files/cdk/core/api/rest/api-gateway-account/index.js.template

@@ -0,0 +1,70 @@
+/**
+ * Configures the account-level API Gateway CloudWatch Logs role required for
+ * REST API access logging. The setting is a singleton per region per account,
+ * so this handler only writes when no live role is already configured (the
+ * first stack to deploy wins, others defer) and never resets it on delete.
+ */
+const {
+  APIGatewayClient,
+  GetAccountCommand,
+  UpdateAccountCommand,
+} = require('@aws-sdk/client-api-gateway');
+const { IAMClient, GetRoleCommand } = require('@aws-sdk/client-iam');
+
+const apigw = new APIGatewayClient();
+const iam = new IAMClient();
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+const RETRYABLE = ['BadRequestException', 'TooManyRequestsException'];
+
+// Throttling may surface as a bare 429 with no modeled error code, so check
+// response metadata as well as error names
+const isRetryable = (e) =>
+  RETRYABLE.includes(e.name) ||
+  e.$metadata?.httpStatusCode === 429 ||
+  e.$retryable?.throttling === true;
+
+// Retry while the freshly created role propagates through IAM, and on
+// throttling of the account-level API (shared across concurrent deployments)
+const send = async (command) => {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await apigw.send(command);
+    } catch (e) {
+      if (isRetryable(e) && attempt < 11) {
+        await sleep(5000);
+      } else {
+        throw e;
+      }
+    }
+  }
+};
+
+const hasLiveRole = async () => {
+  const { cloudwatchRoleArn } = await send(new GetAccountCommand({}));
+  if (!cloudwatchRoleArn) return false;
+  try {
+    await iam.send(
+      new GetRoleCommand({ RoleName: cloudwatchRoleArn.split('/').pop() }),
+    );
+    return true;
+  } catch (e) {
+    if (e.name === 'NoSuchEntityException') return false;
+    throw e;
+  }
+};
+
+const setRole = (value) =>
+  send(
+    new UpdateAccountCommand({
+      patchOperations: [{ op: 'replace', path: '/cloudwatchRoleArn', value }],
+    }),
+  );
+
+exports.handler = async (event) => {
+  if (event.RequestType !== 'Delete' && !(await hasLiveRole())) {
+    await setRole(event.ResourceProperties.CloudWatchRoleArn);
+  }
+  return { PhysicalResourceId: 'ApiGatewayAccount' };
+};

package/src/utils/api-constructs/files/cdk/core/api/rest/api-gateway-account.ts.template

@@ -0,0 +1,82 @@
+import { Construct } from 'constructs';
+import * as url from 'url';
+import { CustomResource, Duration, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import {
+  ManagedPolicy,
+  PolicyStatement,
+  Role,
+  ServicePrincipal,
+} from 'aws-cdk-lib/aws-iam';
+import { Code, Function, Runtime } from 'aws-cdk-lib/aws-lambda';
+import { Provider } from 'aws-cdk-lib/custom-resources';
+
+const ApiGatewayAccountKey = '__ApiGatewayAccount__';
+
+/**
+ * Stack-scoped singleton that configures the account-level CloudWatch Logs role
+ * used by API Gateway REST APIs for access logging.
+ *
+ * `AWS::ApiGateway::Account` is a singleton per region per account, so it is
+ * managed via an idempotent custom resource: the role is set only when none is
+ * already configured, and is never reset on delete. This keeps logging working
+ * across multiple stacks sharing an account without one clobbering another.
+ */
+export class ApiGatewayAccount extends Construct {
+  static ensure(scope: Construct): ApiGatewayAccount {
+    const stack = Stack.of(scope);
+    return (
+      (stack.node.tryFindChild(ApiGatewayAccountKey) as ApiGatewayAccount) ??
+      new ApiGatewayAccount(stack, ApiGatewayAccountKey)
+    );
+  }
+
+  public readonly resource: CustomResource;
+
+  private constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    const cloudWatchRole = new Role(this, 'CloudWatchRole', {
+      assumedBy: new ServicePrincipal('apigateway.amazonaws.com'),
+      managedPolicies: [
+        ManagedPolicy.fromAwsManagedPolicyName(
+          'service-role/AmazonAPIGatewayPushToCloudWatchLogs',
+        ),
+      ],
+    });
+    cloudWatchRole.applyRemovalPolicy(RemovalPolicy.RETAIN);
+
+    const onEvent = new Function(this, 'OnEvent', {
+      runtime: Runtime.NODEJS_LATEST,
+      handler: 'index.handler',
+      timeout: Duration.minutes(2),
+      code: Code.fromAsset(
+        url.fileURLToPath(new URL('./api-gateway-account', <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>)),
+      ),
+    });
+    const { region } = Stack.of(this);
+    onEvent.addToRolePolicy(
+      new PolicyStatement({
+        actions: ['apigateway:GET', 'apigateway:PATCH'],
+        resources: [`arn:aws:apigateway:${region}::/account`],
+      }),
+    );
+    onEvent.addToRolePolicy(
+      new PolicyStatement({
+        actions: ['iam:PassRole'],
+        resources: [cloudWatchRole.roleArn],
+      }),
+    );
+    // Read-only; inspects whichever role the account currently references
+    onEvent.addToRolePolicy(
+      new PolicyStatement({ actions: ['iam:GetRole'], resources: ['*'] }),
+    );
+
+    this.resource = new CustomResource(this, 'Resource', {
+      serviceToken: new Provider(this, 'Provider', { onEventHandler: onEvent })
+        .serviceToken,
+      resourceType: 'Custom::ApiGatewayAccount',
+      properties: { CloudWatchRoleArn: cloudWatchRole.roleArn },
+    });
+    this.resource.node.addDependency(cloudWatchRole);
+  }
+}