@aws/nx-plugin 1.0.0-rc.76 → 1.0.0-rc.78

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -153,12 +153,38 @@ except Exception as e:
   default     = true
 }
 
+variable "mfa" {
+  description = "Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all"
+  type        = string
+  default     = "ON"
+
+  validation {
+    condition     = contains(["OFF", "OPTIONAL", "ON"], var.mfa)
+    error_message = "mfa must be one of OFF, OPTIONAL, ON"
+  }
+}
+
+variable "mfa_second_factor_otp" {
+  description = "Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method"
+  type        = bool
+  default     = true
+}
+
+variable "mfa_second_factor_sms" {
+  description = "Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop"
+  type        = bool
+  default     = true
+}
+
 module "identity" {
   source = "./identity"
 
   user_pool_domain_prefix = "test"
   allow_signup = true
   enable_waf = var.enable_waf
+  mfa = var.mfa
+  mfa_second_factor_otp = var.mfa_second_factor_otp
+  mfa_second_factor_sms = var.mfa_second_factor_sms
 }
 
 # Outputs

package/src/utils/dynamodb-constructs/files/cdk/core/dynamodb.ts.template

@@ -8,7 +8,7 @@ import {
 } from 'aws-cdk-lib/aws-dynamodb';
 import { RemovalPolicy } from 'aws-cdk-lib';
 import { Grant, IGrantable } from 'aws-cdk-lib/aws-iam';
-import { Key } from 'aws-cdk-lib/aws-kms';
+import { IKey, Key } from 'aws-cdk-lib/aws-kms';
 import { RuntimeConfig } from './runtime-config<% if (esm) { %>.js<% } %>';
 
 type _DynamoDBTableProps = Omit<TableProps, 'tableName' | 'partitionKey' | 'sortKey' | 'encryption' | 'encryptionKey'>;
@@ -25,8 +25,23 @@ export interface DynamoDBTableProps extends _DynamoDBTableProps {
    */
   readonly runtimeConfigKey: string;
 
+  /**
+   * Server-side encryption for the table.
+   *
+   * @default TableEncryption.CUSTOMER_MANAGED
+   */
+  readonly encryption?: TableEncryption;
+
+  /**
+   * KMS key used to encrypt the table. Only used when `encryption` is
+   * `TableEncryption.CUSTOMER_MANAGED`. When not provided, a new key is created.
+   */
+  readonly encryptionKey?: IKey;
+
   /**
    * Whether to enable automatic key rotation on the KMS key used to encrypt the table.
+   * Only applies when `encryption` is `TableEncryption.CUSTOMER_MANAGED` and no
+   * `encryptionKey` is supplied.
    *
    * @default true
    */
@@ -46,13 +61,18 @@ export abstract class DynamoDBTable extends Construct {
       pointInTimeRecoverySpecification = { pointInTimeRecoveryEnabled: true },
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
+      encryption = TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey,
       enableKeyRotation = true,
       ...rest
     }: DynamoDBTableProps,
   ) {
     super(scope, id);
 
-    const key = new Key(this, 'EncryptionKey', { enableKeyRotation });
+    const key: IKey | undefined =
+      encryption === TableEncryption.CUSTOMER_MANAGED
+        ? (encryptionKey ?? new Key(this, 'EncryptionKey', { enableKeyRotation }))
+        : undefined;
 
     this.table = new Table(this, runtimeConfigKey, {
       ...rest,
@@ -63,7 +83,7 @@ export abstract class DynamoDBTable extends Construct {
       pointInTimeRecoverySpecification,
       deletionProtection,
       encryptionKey: key,
-      encryption: TableEncryption.CUSTOMER_MANAGED,
+      encryption,
       removalPolicy,
     });
 

package/src/utils/dynamodb-constructs/files/terraform/app/dynamodb/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -29,8 +29,31 @@ variable "deletion_protection_enabled" {
   default     = true
 }
 
+variable "encryption" {
+  description = "Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator's docs."
+  type        = string
+  default     = "CUSTOMER_MANAGED"
+
+  validation {
+    condition     = contains(["CUSTOMER_MANAGED", "AWS_MANAGED", "DEFAULT"], var.encryption)
+    error_message = "encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT."
+  }
+}
+
+variable "kms_key_arn" {
+  description = "ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy."
+  type        = string
+  default     = null
+}
+
+variable "create_kms_key" {
+  description = "Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn."
+  type        = bool
+  default     = true
+}
+
 variable "enable_key_rotation" {
-  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table."
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true."
   type        = bool
   default     = true
 }
@@ -57,6 +80,9 @@ module "dynamodb_table" {
   billing_mode                   = var.billing_mode
   point_in_time_recovery_enabled = var.point_in_time_recovery_enabled
   deletion_protection_enabled    = var.deletion_protection_enabled
+  encryption                     = var.encryption
+  kms_key_arn                    = var.kms_key_arn
+  create_kms_key                 = var.create_kms_key
   enable_key_rotation            = var.enable_key_rotation
   global_secondary_indexes       = local.global_secondary_indexes
 }

package/src/utils/dynamodb-constructs/files/terraform/core/dynamodb/dynamodb.tf.template

@@ -32,8 +32,31 @@ variable "deletion_protection_enabled" {
   default     = true
 }
 
+variable "encryption" {
+  description = "Server-side encryption for the table. One of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT (the AWS owned key, at no cost and with no key to manage). Changing this on an already-deployed table away from CUSTOMER_MANAGED requires a manual step first - see the ts#dynamodb generator's docs."
+  type        = string
+  default     = "CUSTOMER_MANAGED"
+
+  validation {
+    condition     = contains(["CUSTOMER_MANAGED", "AWS_MANAGED", "DEFAULT"], var.encryption)
+    error_message = "encryption must be one of CUSTOMER_MANAGED, AWS_MANAGED or DEFAULT."
+  }
+}
+
+variable "kms_key_arn" {
+  description = "ARN of an existing KMS key used to encrypt the table when encryption is CUSTOMER_MANAGED. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the DynamoDB service the necessary permissions in its own key policy."
+  type        = string
+  default     = null
+}
+
+variable "create_kms_key" {
+  description = "Whether to create a KMS key for the table. Only applies when encryption is CUSTOMER_MANAGED. Set to false when supplying kms_key_arn."
+  type        = bool
+  default     = true
+}
+
 variable "enable_key_rotation" {
-  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table."
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the table. Only applies when encryption is CUSTOMER_MANAGED and create_kms_key is true."
   type        = bool
   default     = true
 }
@@ -53,12 +76,22 @@ locals {
   gsi_attribute_names = distinct(flatten([
     for gsi in var.global_secondary_indexes : [gsi.hash_key, gsi.range_key]
   ]))
+
+  create_table_key = var.encryption == "CUSTOMER_MANAGED" && var.create_kms_key
+  table_kms_key_arn = (
+    var.encryption == "CUSTOMER_MANAGED" ? (local.create_table_key ? aws_kms_key.table[0].arn : var.kms_key_arn) :
+    var.encryption == "AWS_MANAGED" ? "arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:alias/aws/dynamodb" :
+    null
+  )
 }
 
 data "aws_caller_identity" "current" {}
 data "aws_partition" "current" {}
+data "aws_region" "current" {}
 
 resource "aws_kms_key" "table" {
+  count = local.create_table_key ? 1 : 0
+
   description         = "KMS key for DynamoDB table ${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
@@ -95,6 +128,7 @@ resource "aws_kms_key" "table" {
 }
 
 resource "aws_dynamodb_table" "table" {
+  #checkov:skip=CKV_AWS_119:Encryption is configurable via var.encryption; checkov cannot resolve the conditional server_side_encryption.enabled expression
   name                        = var.name
   billing_mode                = var.billing_mode
   hash_key                    = "pk"
@@ -134,8 +168,8 @@ resource "aws_dynamodb_table" "table" {
   }
 
   server_side_encryption {
-    enabled     = true
-    kms_key_arn = aws_kms_key.table.arn
+    enabled     = var.encryption != "DEFAULT"
+    kms_key_arn = local.table_kms_key_arn
   }
 }
 
@@ -150,6 +184,6 @@ output "table_arn" {
 }
 
 output "kms_key_arn" {
-  description = "ARN of the KMS key used to encrypt the DynamoDB table."
-  value       = aws_kms_key.table.arn
+  description = "ARN of the KMS key used to encrypt the DynamoDB table, or null when using the AWS owned key (encryption = DEFAULT)."
+  value       = local.table_kms_key_arn
 }

package/src/utils/identity-constructs/files/cdk/core/user-identity.ts.template

@@ -16,6 +16,7 @@ import {
   FeaturePlan,
   ManagedLoginVersion,
   Mfa,
+  type MfaSecondFactor,
   OAuthScope,
   StandardThreatProtectionMode,
   UserPool,
@@ -48,6 +49,20 @@ export interface UserIdentityProps {
    * @default true
    */
   readonly enableWaf?: boolean;
+
+  /**
+   * Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all.
+   *
+   * @default Mfa.REQUIRED
+   */
+  readonly mfa?: Mfa;
+
+  /**
+   * The MFA methods available to users when MFA is not off.
+   *
+   * @default { sms: true, otp: true }
+   */
+  readonly mfaSecondFactor?: MfaSecondFactor;
 }
 
 /**
@@ -63,11 +78,25 @@ export class UserIdentity extends Construct {
   /** The WAFv2 Web ACL associated with the user pool, if WAF is enabled */
   public readonly webAcl?: CfnWebACL;
 
-  constructor(scope: Construct, id: string, { enableWaf = true }: UserIdentityProps = {}) {
+  constructor(
+    scope: Construct,
+    id: string,
+    {
+      enableWaf = true,
+      mfa = Mfa.REQUIRED,
+      mfaSecondFactor = { sms: true, otp: true },
+    }: UserIdentityProps = {},
+  ) {
     super(scope, id);
 
+    if (mfa === Mfa.REQUIRED && !mfaSecondFactor.sms && !mfaSecondFactor.otp) {
+      throw new Error(
+        'UserIdentity: mfa is REQUIRED but mfaSecondFactor has no methods enabled (sms and otp are both false)',
+      );
+    }
+
     this.region = Stack.of(this).region;
-    this.userPool = this.createUserPool();
+    this.userPool = this.createUserPool(mfa, mfaSecondFactor);
 
     if (enableWaf) {
       this.webAcl = this.createWebAcl(
@@ -115,7 +144,12 @@ export class UserIdentity extends Construct {
     });
   }
 
-  private createUserPool = () => {
+  private createUserPool = (mfa: Mfa, mfaSecondFactor: MfaSecondFactor) => {
+    // Cognito rejects SmsConfiguration (emitted whenever phone is auto-verified) unless SMS is
+    // also an enabled MFA method, for any non-OFF MfaConfiguration. So phone verification via SMS
+    // can only be offered when SMS is actually usable as a second factor.
+    const phoneVerificationEnabled = mfa === Mfa.OFF || mfaSecondFactor.sms;
+
     const userPool = new UserPool(this, 'UserPool', {
       deletionProtection: true,
       passwordPolicy: {
@@ -126,11 +160,11 @@ export class UserIdentity extends Construct {
         requireSymbols: true,
         tempPasswordValidity: Duration.days(3),
       },
-      mfa: Mfa.REQUIRED,
+      mfa,
       featurePlan: FeaturePlan.PLUS,
       // Audit-only logs threat assessments without blocking sign-in. Switch to FULL_FUNCTION to enforce automatic responses.
       standardThreatProtectionMode: StandardThreatProtectionMode.AUDIT_ONLY,
-      mfaSecondFactor: { sms: true, otp: true },
+      mfaSecondFactor,
       signInCaseSensitive: false,
       signInAliases: { username: true, email: true },
       accountRecovery: AccountRecovery.EMAIL_ONLY,
@@ -143,11 +177,11 @@ export class UserIdentity extends Construct {
       },
       autoVerify: {
         email: true,
-        phone: true,
+        phone: phoneVerificationEnabled,
       },
       keepOriginal: {
         email: true,
-        phone: true,
+        phone: phoneVerificationEnabled,
       },
     });
     // Retain the SMS role alongside the pool so the pool can still be updated and deleted manually

package/src/utils/identity-constructs/files/terraform/core/user-identity/identity/identity.tf.template

@@ -28,6 +28,29 @@ variable "enable_waf" {
   default     = true
 }
 
+variable "mfa" {
+  description = "Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all"
+  type        = string
+  default     = "ON"
+
+  validation {
+    condition     = contains(["OFF", "OPTIONAL", "ON"], var.mfa)
+    error_message = "mfa must be one of OFF, OPTIONAL, ON"
+  }
+}
+
+variable "mfa_second_factor_otp" {
+  description = "Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method"
+  type        = bool
+  default     = true
+}
+
+variable "mfa_second_factor_sms" {
+  description = "Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop"
+  type        = bool
+  default     = true
+}
+
 variable "callback_urls" {
   description = "Additional callback URLs for the user pool client"
   type        = list(string)
@@ -58,10 +81,14 @@ resource "random_id" "unique_suffix" {
 }
 
 # Generate a random external ID for SMS role security
-resource "random_uuid" "sms_external_id" {}
+resource "random_uuid" "sms_external_id" {
+  count = var.mfa_second_factor_sms ? 1 : 0
+}
 
 # IAM role for SMS MFA
 resource "aws_iam_role" "cognito_sms_role" {
+  count = var.mfa_second_factor_sms ? 1 : 0
+
   name = "cognito-sms-role-${random_id.unique_suffix.hex}"
 
   assume_role_policy = jsonencode({
@@ -75,7 +102,7 @@ resource "aws_iam_role" "cognito_sms_role" {
         }
         Condition = {
           StringEquals = {
-            "sts:ExternalId" = random_uuid.sms_external_id.result
+            "sts:ExternalId" = random_uuid.sms_external_id[0].result
             "aws:SourceAccount" = data.aws_caller_identity.current.account_id
           }
           ArnLike = {
@@ -90,8 +117,10 @@ resource "aws_iam_role" "cognito_sms_role" {
 resource "aws_iam_role_policy" "cognito_sms_policy" {
   # checkov:skip=CKV_AWS_290:Cognito SMS requires sns:Publish with wildcard resource
   # checkov:skip=CKV_AWS_355:Cognito SMS requires sns:Publish with wildcard resource
+  count = var.mfa_second_factor_sms ? 1 : 0
+
   name = "cognito-sms-policy-${random_id.unique_suffix.hex}"
-  role = aws_iam_role.cognito_sms_role.id
+  role = aws_iam_role.cognito_sms_role[0].id
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -127,18 +156,23 @@ resource "aws_cognito_user_pool" "user_pool" {
   }
 
   # MFA configuration
-  mfa_configuration = "ON"
+  mfa_configuration = var.mfa
 
   # Software token MFA configuration
   software_token_mfa_configuration {
-    enabled = true
+    enabled = var.mfa_second_factor_otp
   }
 
-  # SMS MFA configuration
-  sms_configuration {
-    external_id    = random_uuid.sms_external_id.result
-    sns_caller_arn = aws_iam_role.cognito_sms_role.arn
-    sns_region     = data.aws_region.current.region
+  # SMS MFA configuration. Due to a Terraform AWS provider limitation, this also gates
+  # SMS-based phone number verification below - see the mfa_second_factor_sms variable.
+  dynamic "sms_configuration" {
+    for_each = var.mfa_second_factor_sms ? [1] : []
+
+    content {
+      external_id    = random_uuid.sms_external_id[0].result
+      sns_caller_arn = aws_iam_role.cognito_sms_role[0].arn
+      sns_region     = data.aws_region.current.region
+    }
   }
 
   depends_on = [aws_iam_role_policy.cognito_sms_policy]
@@ -158,8 +192,9 @@ resource "aws_cognito_user_pool" "user_pool" {
     }
   }
 
-  # Auto verification
-  auto_verified_attributes = ["email", "phone_number"]
+  # Auto verification. Phone number verification requires sms_configuration above, so it
+  # follows mfa_second_factor_sms - see that variable's description.
+  auto_verified_attributes = var.mfa_second_factor_sms ? ["email", "phone_number"] : ["email"]
 
   # User pool tier (equivalent to FeaturePlan.PLUS)
   user_pool_tier = "PLUS"
@@ -220,7 +255,7 @@ resource "aws_cognito_user_pool" "user_pool" {
 
   # User attribute update settings - require verification before update
   user_attribute_update_settings {
-    attributes_require_verification_before_update = ["email", "phone_number"]
+    attributes_require_verification_before_update = var.mfa_second_factor_sms ? ["email", "phone_number"] : ["email"]
   }
 
   # Verification message templates

package/src/utils/identity-constructs/files/terraform/core/user-identity/main.tf.template

@@ -4,12 +4,38 @@ variable "enable_waf" {
   default     = true
 }
 
+variable "mfa" {
+  description = "Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all"
+  type        = string
+  default     = "ON"
+
+  validation {
+    condition     = contains(["OFF", "OPTIONAL", "ON"], var.mfa)
+    error_message = "mfa must be one of OFF, OPTIONAL, ON"
+  }
+}
+
+variable "mfa_second_factor_otp" {
+  description = "Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method"
+  type        = bool
+  default     = true
+}
+
+variable "mfa_second_factor_sms" {
+  description = "Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop"
+  type        = bool
+  default     = true
+}
+
 module "identity" {
   source = "./identity"
 
   user_pool_domain_prefix = "<%= cognitoDomain %>"
   allow_signup = <%= allowSignup %>
   enable_waf = var.enable_waf
+  mfa = var.mfa
+  mfa_second_factor_otp = var.mfa_second_factor_otp
+  mfa_second_factor_sms = var.mfa_second_factor_sms
 }
 
 # Outputs

package/src/utils/website-constructs/files/cdk/app/static-websites/__websiteNameKebabCase__.ts.template

@@ -1,10 +1,19 @@
 import * as url from 'url';
 import { Construct } from 'constructs';
-import { StaticWebsite } from '../../core/index<% if (esm) { %>.js<% } %>';
+import {
+  StaticWebsite,
+  StaticWebsiteProps,
+} from '../../core/index<% if (esm) { %>.js<% } %>';
+
+export type <%= websiteNameClassName %>Props = Omit<
+  StaticWebsiteProps,
+  'websiteName' | 'websiteFilePath'
+>;
 
 export class <%= websiteNameClassName %> extends StaticWebsite {
-  constructor(scope: Construct, id: string) {
+  constructor(scope: Construct, id: string, props?: <%= websiteNameClassName %>Props) {
     super(scope, id, {
+      ...props,
       websiteName: '<%= websiteNameClassName %>',
       websiteFilePath: url.fileURLToPath(
         new URL('../../../../../../<%= websiteContentPath %>/bundle', <% if (esm) { %>import.meta.url<% } else { %>require('url').pathToFileURL(__filename).href<% } %>)

package/src/utils/website-constructs/files/cdk/core/static-website.ts.template

@@ -31,7 +31,7 @@ import {
 } from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config<% if (esm) { %>.js<% } %>';
-import { Key } from 'aws-cdk-lib/aws-kms';
+import { IKey, Key } from 'aws-cdk-lib/aws-kms';
 import {
   CfnDelivery,
   CfnDeliveryDestination,
@@ -74,6 +74,33 @@ export interface StaticWebsiteProps {
    * When provided, viewers are required to use TLS 1.2 or later.
    */
   readonly certificate?: ICertificate;
+  /**
+   * Whether to protect the CloudFront distribution with an AWS WAF Web ACL.
+   *
+   * @default true
+   */
+  readonly enableWaf?: boolean;
+  /**
+   * Server-side encryption for the website and distribution log buckets.
+   *
+   * @default BucketEncryption.KMS
+   */
+  readonly encryption?: BucketEncryption;
+  /**
+   * KMS key used to encrypt the website and distribution log buckets. Only used when `encryption` is
+   * `BucketEncryption.KMS`. When not provided, a new key is created. Note that a key imported via
+   * `Key.fromKeyArn` must already grant the CloudWatch Logs, S3 and CloudFront service principals the
+   * necessary permissions in its own key policy - `addToResourcePolicy` is a no-op on an imported key,
+   * so this construct cannot grant them on your behalf.
+   */
+  readonly encryptionKey?: IKey;
+  /**
+   * Whether the automatically created KMS key has rotation enabled. Only applies when `encryption` is
+   * `BucketEncryption.KMS` and no `encryptionKey` is supplied.
+   *
+   * @default true
+   */
+  readonly enableKeyRotation?: boolean;
 }
 
 /**
@@ -92,17 +119,27 @@ export class StaticWebsite extends Construct {
   constructor(
     scope: Construct,
     id: string,
-    { websiteFilePath, websiteName, domainNames, certificate }: StaticWebsiteProps
+    {
+      websiteFilePath,
+      websiteName,
+      domainNames,
+      certificate,
+      enableWaf = true,
+      encryption = BucketEncryption.KMS,
+      encryptionKey,
+      enableKeyRotation = true,
+    }: StaticWebsiteProps
   ) {
     super(scope, id);
 
-    const websiteKey = new Key(this, 'WebsiteKey', {
-      enableKeyRotation: true,
-    });
+    const websiteKey: IKey | undefined =
+      encryption === BucketEncryption.KMS
+        ? (encryptionKey ?? new Key(this, 'WebsiteKey', { enableKeyRotation }))
+        : undefined;
 
     // Allow CloudWatch Logs to use the website key for server access log delivery.
     const stack = Stack.of(this);
-    websiteKey.addToResourcePolicy(
+    websiteKey?.addToResourcePolicy(
       new PolicyStatement({
         effect: Effect.ALLOW,
         principals: [
@@ -136,7 +173,7 @@ export class StaticWebsite extends Construct {
       enforceSSL: true,
       autoDeleteObjects: true,
       removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+      encryption,
       encryptionKey: websiteKey,
       objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
       publicReadAccess: false,
@@ -153,7 +190,7 @@ export class StaticWebsite extends Construct {
       accessLogs,
     );
     // Web ACL
-    const wafStack = new CloudfrontWebAcl(this, 'waf');
+    const wafStack = enableWaf ? new CloudfrontWebAcl(this, 'waf') : undefined;
 
     // Bucket holding CloudFront standard access logs. CloudFront delivers its
     // own logs to S3 only, so this bucket is retained; its S3 server access
@@ -162,7 +199,7 @@ export class StaticWebsite extends Construct {
       enforceSSL: true,
       autoDeleteObjects: true,
       removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+      encryption,
       encryptionKey: websiteKey,
       objectOwnership: ObjectOwnership.BUCKET_OWNER_PREFERRED,
       publicReadAccess: false,
@@ -214,7 +251,7 @@ export class StaticWebsite extends Construct {
       this,
       'CloudfrontDistribution',
       {
-        webAclId: wafStack.wafArn,
+        webAclId: wafStack?.wafArn,
         enableLogging: true,
         logBucket: logBucket,
         ...(certificate

package/src/utils/website-constructs/files/terraform/app/static-websites/__websiteNameKebabCase__/__websiteNameKebabCase__.tf.template

@@ -8,6 +8,53 @@ terraform {
   }
 }
 
+variable "custom_domain_names" {
+  description = "Custom domain names (aliases) for the CloudFront distribution. Requires acm_certificate_arn."
+  type        = list(string)
+  default     = []
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in us-east-1) for the custom domain names. When set, viewers are required to use TLS 1.2 or later."
+  type        = string
+  default     = null
+}
+
+variable "enable_waf" {
+  description = "Whether to protect the CloudFront distribution with an AWS WAF Web ACL."
+  type        = bool
+  default     = true
+}
+
+variable "encryption" {
+  description = "Server-side encryption for the website and distribution log buckets. One of KMS or S3_MANAGED."
+  type        = string
+  default     = "KMS"
+
+  validation {
+    condition     = contains(["KMS", "S3_MANAGED"], var.encryption)
+    error_message = "encryption must be one of KMS or S3_MANAGED."
+  }
+}
+
+variable "kms_key_arn" {
+  description = "ARN of an existing KMS key used to encrypt the website and distribution log buckets when encryption is KMS. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the CloudWatch Logs, S3 and CloudFront service principals the necessary permissions in its own key policy."
+  type        = string
+  default     = null
+}
+
+variable "create_kms_key" {
+  description = "Whether to create a KMS key for the website. Only applies when encryption is KMS. Set to false when supplying kms_key_arn."
+  type        = bool
+  default     = true
+}
+
+variable "enable_key_rotation" {
+  description = "Whether the automatically created KMS key has rotation enabled. Only applies when encryption is KMS and create_kms_key is true."
+  type        = bool
+  default     = true
+}
+
 # Static website module configured for the web package
 module "static_website" {
   source = "../../../core/static-website"
@@ -15,6 +62,14 @@ module "static_website" {
   website_name      = "<%= websiteNameKebabCase %>"
   website_file_path = "${path.module}/../../../../../../../<%= websiteContentPath %>/bundle"
 
+  custom_domain_names = var.custom_domain_names
+  acm_certificate_arn = var.acm_certificate_arn
+  enable_waf          = var.enable_waf
+  encryption          = var.encryption
+  kms_key_arn         = var.kms_key_arn
+  create_kms_key      = var.create_kms_key
+  enable_key_rotation = var.enable_key_rotation
+
   providers = {
     aws.us_east_1 = aws.us_east_1
   }