@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -2,12 +2,12 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
       configuration_aliases = [aws.us_east_1]
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -23,6 +23,73 @@ variable "website_file_path" {
   type        = string
 }
 
+variable "custom_domain_names" {
+  description = "Custom domain names (aliases) for the CloudFront distribution. Requires acm_certificate_arn."
+  type        = list(string)
+  default     = []
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in us-east-1) for the custom domain names. When set, viewers are required to use TLS 1.2 or later."
+  type        = string
+  default     = null
+}
+
+variable "enable_waf" {
+  description = "Whether to protect the CloudFront distribution with an AWS WAF Web ACL."
+  type        = bool
+  default     = true
+}
+
+variable "encryption" {
+  description = "Server-side encryption for the website and distribution log buckets. One of KMS or S3_MANAGED."
+  type        = string
+  default     = "KMS"
+
+  validation {
+    condition     = contains(["KMS", "S3_MANAGED"], var.encryption)
+    error_message = "encryption must be one of KMS or S3_MANAGED."
+  }
+}
+
+variable "kms_key_arn" {
+  description = "ARN of an existing KMS key used to encrypt the website and distribution log buckets when encryption is KMS. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the CloudWatch Logs, S3 and CloudFront service principals the necessary permissions in its own key policy."
+  type        = string
+  default     = null
+}
+
+variable "create_kms_key" {
+  description = "Whether to create a KMS key for the website. Only applies when encryption is KMS. Set to false when supplying kms_key_arn."
+  type        = bool
+  default     = true
+}
+
+variable "enable_key_rotation" {
+  description = "Whether the automatically created KMS key has rotation enabled. Only applies when encryption is KMS and create_kms_key is true."
+  type        = bool
+  default     = true
+}
+
+# Content-Security-Policy enforced on all responses. Restricts scripts and
+# framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+# (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+# Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+# connect-src to your specific origins once they are known.
+locals {
+  content_security_policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+
+  # Delivery source/destination names have a 60 character maximum. Truncate the
+  # website name so the longest delivery name stays within the limit.
+  access_logs_name_prefix = substr(lower(var.website_name), 0, 16)
+
+  create_website_key = var.encryption == "KMS" && var.create_kms_key
+  website_kms_key_arn = (
+    var.encryption != "KMS" ? null :
+    local.create_website_key ? aws_kms_key.website_key[0].arn :
+    var.kms_key_arn
+  )
+}
+
 
 # Data sources
 data "aws_caller_identity" "current" {}
@@ -31,9 +98,11 @@ data "aws_region" "current" {}
 
 # KMS Key for encryption
 resource "aws_kms_key" "website_key" {
+  count = local.create_website_key ? 1 : 0
+
   description             = "KMS key for ${var.website_name} website encryption"
   deletion_window_in_days = 7
-  enable_key_rotation     = true
+  enable_key_rotation     = var.enable_key_rotation
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -59,6 +128,26 @@ resource "aws_kms_key" "website_key" {
         ]
         Resource = "*"
       },
+      {
+        Sid    = "AllowCloudWatchLogs"
+        Effect = "Allow"
+        Principal = {
+          Service = "logs.${data.aws_region.current.region}.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnLike = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:*"
+          }
+        }
+      },
       {
         Sid    = "AllowCloudFrontServicePrincipalSSE-KMS"
         Effect = "Allow"
@@ -86,22 +175,18 @@ resource "aws_kms_key" "website_key" {
 }
 
 resource "aws_kms_alias" "website_key_alias" {
+  count = local.create_website_key ? 1 : 0
+
   name          = "alias/${lower(var.website_name)}-website-key-${random_id.unique_suffix.hex}"
-  target_key_id = aws_kms_key.website_key.key_id
+  target_key_id = aws_kms_key.website_key[0].key_id
 }
 
-# Access Logs Bucket
-resource "aws_s3_bucket" "access_logs" {
-  #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for access logs bucket
-  #checkov:skip=CKV_AWS_144:Cross-region replication not required for access logs
-  #checkov:skip=CKV2_AWS_62:Event notifications not required for access logs bucket
-  #checkov:skip=CKV_AWS_21:Versioning disabled for access logs to reduce storage costs
-  bucket        = "${lower(var.website_name)}-access-logs-${random_id.bucket_suffix.hex}"
-  force_destroy = true
-
-  tags = {
-    Name = "${lower(var.website_name)}-access-logs"
-  }
+# CloudWatch log group receiving S3 server access logs for the website and
+# distribution log buckets.
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/s3/${lower(var.website_name)}-access-logs-${random_id.bucket_suffix.hex}"
+  retention_in_days = 365
+  kms_key_id        = local.website_kms_key_arn
 }
 
 resource "random_id" "unique_suffix" {
@@ -112,63 +197,12 @@ resource "random_id" "bucket_suffix" {
   byte_length = 8
 }
 
-resource "aws_s3_bucket_versioning" "access_logs_versioning" {
-  bucket = aws_s3_bucket.access_logs.id
-  versioning_configuration {
-    status = "Disabled"
-  }
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "access_logs_encryption" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
-    }
-  }
-}
-
-resource "aws_s3_bucket_public_access_block" "access_logs_pab" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-resource "aws_s3_bucket_policy" "access_logs_ssl_policy" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid       = "DenyInsecureConnections"
-        Effect    = "Deny"
-        Principal = "*"
-        Action    = "s3:*"
-        Resource = [
-          aws_s3_bucket.access_logs.arn,
-          "${aws_s3_bucket.access_logs.arn}/*"
-        ]
-        Condition = {
-          Bool = {
-            "aws:SecureTransport" = "false"
-          }
-        }
-      }
-    ]
-  })
-}
-
 # Website Bucket
 resource "aws_s3_bucket" "website" {
   #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for static website content
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for static website
   #checkov:skip=CKV2_AWS_62:Event notifications not required for static website bucket
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.website)
   bucket        = "${lower(var.website_name)}-website-${random_id.bucket_suffix.hex}"
   force_destroy = true
 
@@ -189,8 +223,8 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "website_encryptio
 
   rule {
     apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
+      kms_master_key_id = var.encryption == "KMS" ? local.website_kms_key_arn : null
+      sse_algorithm     = var.encryption == "KMS" ? "aws:kms" : "AES256"
     }
   }
 }
@@ -212,20 +246,35 @@ resource "aws_s3_bucket_ownership_controls" "website_ownership" {
   }
 }
 
-resource "aws_s3_bucket_logging" "website_logging" {
-  bucket = aws_s3_bucket.website.id
+# Deliver the website bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "website" {
+  name         = "${local.access_logs_name_prefix}-website-logs-${random_id.bucket_suffix.hex}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.website.arn
+}
+
+resource "aws_cloudwatch_log_delivery_destination" "access_logs" {
+  name = "${local.access_logs_name_prefix}-access-logs-${random_id.bucket_suffix.hex}"
+
+  delivery_destination_configuration {
+    destination_resource_arn = aws_cloudwatch_log_group.access_logs.arn
+  }
+}
 
-  target_bucket = aws_s3_bucket.access_logs.id
-  target_prefix = "website-access-logs/"
+resource "aws_cloudwatch_log_delivery" "website" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.website.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.access_logs.arn
 }
 
 
-# Distribution Log Bucket
+# Distribution Log Bucket — holds CloudFront standard access logs (CloudFront
+# delivers only to S3). Its own S3 server access logs go to CloudWatch Logs.
 resource "aws_s3_bucket" "distribution_logs" {
   #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for CloudFront logs
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for CloudFront logs
   #checkov:skip=CKV2_AWS_62:Event notifications not required for CloudFront logs bucket
   #checkov:skip=CKV_AWS_21:Versioning not required for CloudFront access logs
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.distribution_logs)
   bucket        = "${lower(var.website_name)}-distribution-logs-${random_id.bucket_suffix.hex}"
   force_destroy = true
 
@@ -239,8 +288,8 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "distribution_logs
 
   rule {
     apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
+      kms_master_key_id = var.encryption == "KMS" ? local.website_kms_key_arn : null
+      sse_algorithm     = var.encryption == "KMS" ? "aws:kms" : "AES256"
     }
   }
 }
@@ -271,11 +320,16 @@ resource "aws_s3_bucket_acl" "distribution_logs_acl" {
   depends_on = [aws_s3_bucket_ownership_controls.distribution_logs_ownership]
 }
 
-resource "aws_s3_bucket_logging" "distribution_logs_logging" {
-  bucket = aws_s3_bucket.distribution_logs.id
+# Deliver the distribution log bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "distribution_logs" {
+  name         = "${local.access_logs_name_prefix}-distribution-logs-${random_id.bucket_suffix.hex}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.distribution_logs.arn
+}
 
-  target_bucket = aws_s3_bucket.access_logs.id
-  target_prefix = "distribution-access-logs/"
+resource "aws_cloudwatch_log_delivery" "distribution_logs" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.distribution_logs.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.access_logs.arn
 }
 
 resource "aws_s3_bucket_policy" "distribution_logs_ssl_policy" {
@@ -305,6 +359,8 @@ resource "aws_s3_bucket_policy" "distribution_logs_ssl_policy" {
 
 # WAF Web ACL (must be in us-east-1 for CloudFront)
 resource "aws_wafv2_web_acl" "cloudfront_waf" {
+  count = var.enable_waf ? 1 : 0
+
   #checkov:skip=CKV2_AWS_31:WAF logging disabled
   provider = aws.us_east_1
   name     = "${lower(var.website_name)}-cloudfront-waf-${random_id.unique_suffix.hex}"
@@ -383,13 +439,42 @@ resource "aws_cloudfront_origin_access_control" "website_oac" {
   signing_protocol                  = "sigv4"
 }
 
+# Security headers applied to all responses.
+resource "aws_cloudfront_response_headers_policy" "website" {
+  name = "${aws_s3_bucket.website.bucket}-security-headers"
+
+  security_headers_config {
+    strict_transport_security {
+      access_control_max_age_sec = 63072000
+      include_subdomains         = true
+      preload                    = true
+      override                   = true
+    }
+    content_type_options {
+      override = true
+    }
+    frame_options {
+      frame_option = "DENY"
+      override     = true
+    }
+    referrer_policy {
+      referrer_policy = "strict-origin-when-cross-origin"
+      override        = true
+    }
+    content_security_policy {
+      content_security_policy = local.content_security_policy
+      override                = true
+    }
+  }
+}
+
 # CloudFront Distribution
 resource "aws_cloudfront_distribution" "website" {
+  # See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
   #checkov:skip=CKV_AWS_174:Using CloudFront default certificate which does not support TLS v1.2
   #checkov:skip=CKV_AWS_310:Origin failover not required for single S3 origin static website
   #checkov:skip=CKV_AWS_374:Geo restrictions not required for global web application
   #checkov:skip=CKV2_AWS_42:Custom SSL certificate not required for development - using CloudFront default
-  #checkov:skip=CKV2_AWS_32:Response headers policy not required for basic static website
   #checkov:skip=CKV2_AWS_47:WAF includes AWSManagedRulesKnownBadInputsRuleSet which provides Log4j protection
   origin {
     domain_name              = aws_s3_bucket.website.bucket_regional_domain_name
@@ -400,7 +485,8 @@ resource "aws_cloudfront_distribution" "website" {
   enabled             = true
   is_ipv6_enabled     = true
   default_root_object = "index.html"
-  web_acl_id          = aws_wafv2_web_acl.cloudfront_waf.arn
+  web_acl_id          = var.enable_waf ? aws_wafv2_web_acl.cloudfront_waf[0].arn : null
+  aliases             = var.custom_domain_names
 
   logging_config {
     include_cookies = false
@@ -419,11 +505,12 @@ resource "aws_cloudfront_distribution" "website" {
       }
     }
 
-    viewer_protocol_policy = "redirect-to-https"
-    min_ttl                = 0
-    default_ttl            = 3600
-    max_ttl                = 86400
-    compress               = true
+    viewer_protocol_policy     = "redirect-to-https"
+    response_headers_policy_id = aws_cloudfront_response_headers_policy.website.id
+    min_ttl                    = 0
+    default_ttl                = 3600
+    max_ttl                    = 86400
+    compress                   = true
   }
 
   # Custom error responses for SPA routing
@@ -446,19 +533,16 @@ resource "aws_cloudfront_distribution" "website" {
   }
 
   viewer_certificate {
-    cloudfront_default_certificate = true
+    cloudfront_default_certificate = var.acm_certificate_arn == null
+    acm_certificate_arn            = var.acm_certificate_arn
+    ssl_support_method             = var.acm_certificate_arn == null ? null : "sni-only"
+    minimum_protocol_version       = var.acm_certificate_arn == null ? "TLSv1" : "TLSv1.2_2021"
   }
 
   tags = {
     Name = "${lower(var.website_name)}-distribution-${random_id.unique_suffix.hex}"
   }
 
-  lifecycle {
-    replace_triggered_by = [
-      aws_wafv2_web_acl.cloudfront_waf
-    ]
-  }
-
   # CloudFront validates access to the distribution logs bucket when it
   # creates the distribution.
   depends_on = [
@@ -527,8 +611,8 @@ resource "null_resource" "upload_website_files" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      cd "${path.root}"
-      uv run --with boto3 python3 -c "
+      cd "$ROOT_PATH"
+      uv run --with boto3<%= boto3Version %> python3 -c "
 import os
 import sys
 import boto3
@@ -616,9 +700,14 @@ def sync_to_s3(local_path, bucket_name):
         sys.exit(1)
 
 # Execute sync
-sync_to_s3('${var.website_file_path}', '${aws_s3_bucket.website.bucket}')
+sync_to_s3(os.environ['WEBSITE_FILE_PATH'], os.environ['BUCKET_NAME'])
 "
     EOT
+    environment = {
+      ROOT_PATH         = path.root
+      WEBSITE_FILE_PATH = var.website_file_path
+      BUCKET_NAME       = aws_s3_bucket.website.bucket
+    }
   }
 
   depends_on = [aws_s3_bucket_policy.website_cloudfront_policy]
@@ -626,11 +715,12 @@ sync_to_s3('${var.website_file_path}', '${aws_s3_bucket.website.bucket}')
 
 # Upload runtime config file
 resource "aws_s3_object" "runtime_config" {
-  bucket       = aws_s3_bucket.website.id
-  key          = "runtime-config.json"
-  content      = module.runtime_config_reader.config_json
-  content_type = "application/json"
-  etag         = md5(module.runtime_config_reader.config_json)
+  bucket        = aws_s3_bucket.website.id
+  key           = "runtime-config.json"
+  content       = module.runtime_config_reader.config_json
+  content_type  = "application/json"
+  cache_control = "no-cache"
+  etag          = md5(module.runtime_config_reader.config_json)
 
   depends_on = [null_resource.upload_website_files]
 }
@@ -645,8 +735,9 @@ resource "null_resource" "cloudfront_invalidation" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3 python3 -c "
+      uv run --with boto3<%= boto3Version %> python3 -c "
 import boto3
+import os
 import sys
 from botocore.exceptions import ClientError, NoCredentialsError
 
@@ -668,7 +759,7 @@ def create_invalidation(distribution_id):
 
         invalidation_id = response['Invalidation']['Id']
         print(f'CloudFront cache invalidation created: {invalidation_id}')
-        print(f'Distribution: ${aws_cloudfront_distribution.website.id}')
+        print(f'Distribution: {distribution_id}')
         print(f'Status: {response[\"Invalidation\"][\"Status\"]}')
 
     except NoCredentialsError:
@@ -682,9 +773,12 @@ def create_invalidation(distribution_id):
         sys.exit(1)
 
 # Execute invalidation
-create_invalidation('${aws_cloudfront_distribution.website.id}')
+create_invalidation(os.environ['DISTRIBUTION_ID'])
 "
     EOT
+    environment = {
+      DISTRIBUTION_ID = aws_cloudfront_distribution.website.id
+    }
   }
 
   depends_on = [
@@ -721,5 +815,5 @@ output "cloudfront_domain_name" {
 
 output "waf_web_acl_arn" {
   description = "ARN of the WAF Web ACL"
-  value       = aws_wafv2_web_acl.cloudfront_waf.arn
+  value       = var.enable_waf ? aws_wafv2_web_acl.cloudfront_waf[0].arn : null
 }

package/src/utils/website-constructs/website-constructs.d.ts

@@ -3,7 +3,18 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { type Tree } from '@nx/devkit';
-import type { Iac } from '../iac';
+import type { Iac } from '../iac.js';
+import { type IacMetadata } from '../shared-constructs-constants.js';
+/**
+ * Python version the generated Terraform pins in the static website module's
+ * inline `uv run --with` scripts, which upload the site's assets. Nothing
+ * installs it, so it is declared for its version alone, and only on the
+ * Terraform branch that writes the scripts.
+ */
+export declare const WEBSITE_CONSTRUCTS_PY_DEPENDENCIES: readonly [{
+    readonly name: "boto3";
+    readonly when: (m: IacMetadata) => boolean;
+}];
 export interface AddWebsiteInfraOptions {
     websiteProjectName: string;
     scopeAlias: string;

package/src/utils/website-constructs/website-constructs.js

@@ -1,50 +1,69 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addWebsiteInfra = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const ast_1 = require("../ast");
-const nx_1 = require("../nx");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { esmVars } from "../module-format.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { generatedTerraform, PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { PY_VERSIONS, terraformProviderVersions } from "../versions.js";
+/**
+ * Python version the generated Terraform pins in the static website module's
+ * inline `uv run --with` scripts, which upload the site's assets. Nothing
+ * installs it, so it is declared for its version alone, and only on the
+ * Terraform branch that writes the scripts.
+ */ export const WEBSITE_CONSTRUCTS_PY_DEPENDENCIES = [
+    {
+        name: 'boto3',
+        when: generatedTerraform
+    }
+];
 /**
  * Add infrastructure for a static website
- */
-const addWebsiteInfra = async (tree, options) => {
+ */ export const addWebsiteInfra = async (tree, options)=>{
     if (options.iac === 'cdk') {
         await addWebsiteCdkConstructs(tree, options);
-    }
-    else if (options.iac === 'terraform') {
+    } else if (options.iac === 'terraform') {
         addWebsiteTerraformModules(tree, options);
-    }
-    else {
+    } else {
         throw new Error(`Unsupported iac ${options.iac}`);
     }
-    (0, devkit_1.updateJson)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, options.iac === 'cdk' ? shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR : shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'project.json'), (config) => {
-        (0, nx_1.addDependencyToTargetIfNotPresent)(config, 'build', `${options.websiteProjectName}:build`);
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addDependencyToTargetIfNotPresent(config, 'build', `${options.websiteProjectName}:build`);
         return config;
     });
 };
-exports.addWebsiteInfra = addWebsiteInfra;
-const addWebsiteCdkConstructs = async (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'core'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+const addWebsiteCdkConstructs = async (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'), {
+        ...options,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'app'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app'), {
+        ...options,
+        ...esmVars(tree)
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './static-websites/index.js');
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'static-websites', 'index.ts'), `./${options.websiteNameKebabCase}.js`);
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './static-website.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './static-websites/index.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'static-websites', 'index.ts'), `./${options.websiteNameKebabCase}.js`);
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './static-website.js');
 };
-const addWebsiteTerraformModules = (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'core'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+const addWebsiteTerraformModules = (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'), {
+        ...options,
+        boto3Version: PY_VERSIONS.boto3,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'app'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'app'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app'), {
+        ...options,
+        ...terraformProviderVersions()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
 };
+
 //# sourceMappingURL=website-constructs.js.map

package/src/utils/website-constructs/website-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"website-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/website-constructs/website-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,gCAAuC;AAEvC,8BAA0D;AAC1D,gFAIwC;AAUxC;;GAEG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAU,EACV,OAA8C,EAC9C,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,mDAAqB,CAAC,CAAC,CAAC,kDAAoB,EACpE,cAAc,CACf,EACD,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAA,sCAAiC,EAC/B,MAAM,EACN,OAAO,EACP,GAAG,OAAO,CAAC,kBAAkB,QAAQ,CACtC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,eAAe,mBA4B1B;AAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EACpD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,EACrE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EACnD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,KAAK,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,4BAA4B,CAC7B,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,iBAAiB,EACjB,UAAU,CACX,EACD,KAAK,OAAO,CAAC,oBAAoB,KAAK,CACvC,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,qBAAqB,CACtB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,EAC1D,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,EACpE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,EACzD,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,KAAK,CAAC,EACnE,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/website-constructs/website-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { DeclaredPyDependency } from '../declared-dependencies.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  generatedTerraform,\n  type IacMetadata,\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  type IPyDepVersion,\n  PY_VERSIONS,\n  terraformProviderVersions,\n} from '../versions.js';\n\n/**\n * Python version the generated Terraform pins in the static website module's\n * inline `uv run --with` scripts, which upload the site's assets. Nothing\n * installs it, so it is declared for its version alone, and only on the\n * Terraform branch that writes the scripts.\n */\nexport const WEBSITE_CONSTRUCTS_PY_DEPENDENCIES = [\n  { name: 'boto3', when: generatedTerraform },\n] as const satisfies readonly DeclaredPyDependency<\n  IPyDepVersion,\n  IacMetadata\n>[];\n\nexport interface AddWebsiteInfraOptions {\n  websiteProjectName: string;\n  scopeAlias: string;\n  websiteContentPath: string;\n  websiteNameKebabCase: string;\n  websiteNameClassName: string;\n}\n\n/**\n * Add infrastructure for a static website\n */\nexport const addWebsiteInfra = async (\n  tree: Tree,\n  options: AddWebsiteInfraOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addWebsiteCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addWebsiteTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.websiteProjectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nconst addWebsiteCdkConstructs = async (\n  tree: Tree,\n  options: AddWebsiteInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './static-websites/index.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'static-websites',\n      'index.ts',\n    ),\n    `./${options.websiteNameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './static-website.js',\n  );\n};\n\nconst addWebsiteTerraformModules = (\n  tree: Tree,\n  options: AddWebsiteInfraOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core'),\n    {\n      ...options,\n      boto3Version: PY_VERSIONS.boto3,\n      ...terraformProviderVersions(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","generatedTerraform","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","PY_VERSIONS","terraformProviderVersions","WEBSITE_CONSTRUCTS_PY_DEPENDENCIES","name","when","addWebsiteInfra","tree","options","iac","addWebsiteCdkConstructs","addWebsiteTerraformModules","Error","config","websiteProjectName","dirname","overwriteStrategy","KeepExisting","websiteNameKebabCase","boto3Version","boto3"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,kBAAkB,EAElBC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAEEC,WAAW,EACXC,yBAAyB,QACpB,iBAAiB;AAExB;;;;;CAKC,GACD,OAAO,MAAMC,qCAAqC;IAChD;QAAEC,MAAM;QAASC,MAAMR;IAAmB;CAC3C,CAGG;AAUJ;;CAEC,GACD,OAAO,MAAMS,kBAAkB,OAC7BC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,wBAAwBH,MAAMC;IACtC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,2BAA2BJ,MAAMC;IACnC,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAhB,WACEc,MACAhB,kBACEO,cACAU,QAAQC,GAAG,KAAK,QAAQV,wBAAwBC,sBAChD,iBAEF,CAACa;QACCjB,kCACEiB,QACA,SACA,GAAGL,QAAQM,kBAAkB,CAAC,MAAM,CAAC;QAEvC,OAAOD;IACT;AAEJ,EAAE;AAEF,MAAMH,0BAA0B,OAC9BH,MACAC;IAEAlB,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,OAAO,SACvDxB,kBAAkBO,cAAcC,uBAAuB,OAAO,SAC9D;QAAE,GAAGS,OAAO;QAAE,GAAGb,QAAQY,KAAK;IAAC,GAC/B;QACES,mBAAmBxB,kBAAkByB,YAAY;IACnD;IAGF3B,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,OAAO,QACvDxB,kBAAkBO,cAAcC,uBAAuB,OAAO,QAC9D;QAAE,GAAGS,OAAO;QAAE,GAAGb,QAAQY,KAAK;IAAC,GAC/B;QACES,mBAAmBxB,kBAAkByB,YAAY;IACnD;IAGF,MAAMvB,cACJa,MACAhB,kBACEO,cACAC,uBACA,OACA,OACA,aAEF;IAEF,MAAML,cACJa,MACAhB,kBACEO,cACAC,uBACA,OACA,OACA,mBACA,aAEF,CAAC,EAAE,EAAES,QAAQU,oBAAoB,CAAC,GAAG,CAAC;IAExC,MAAMxB,cACJa,MACAhB,kBACEO,cACAC,uBACA,OACA,QACA,aAEF;AAEJ;AAEA,MAAMY,6BAA6B,CACjCJ,MACAC;IAEAlB,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,aAAa,SAC7DxB,kBAAkBO,cAAcE,sBAAsB,OAAO,SAC7D;QACE,GAAGQ,OAAO;QACVW,cAAclB,YAAYmB,KAAK;QAC/B,GAAGlB,2BAA2B;IAChC,GACA;QACEc,mBAAmBxB,kBAAkByB,YAAY;IACnD;IAGF3B,cACEiB,MACAhB,kBAAkB,YAAYwB,OAAO,EAAE,SAAS,aAAa,QAC7DxB,kBAAkBO,cAAcE,sBAAsB,OAAO,QAC7D;QAAE,GAAGQ,OAAO;QAAE,GAAGN,2BAA2B;IAAC,GAC7C;QACEc,mBAAmBxB,kBAAkByB,YAAY;IACnD;AAEJ"}

package/bin/aws-nx-mcp.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export {};