@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.84

package/migrations.json

@@ -47,6 +47,31 @@
       "description": "Declare ejs at the workspace root so the Terraform gateway's Cedar render script resolves it",
       "implementation": "./src/migrations/latest/terraform-gateway-cedar-render-root-ejs/migration"
     },
+    "latest-rdb-terraform-aurora-app-module-defaults": {
+      "version": "1.0.0-rc.84",
+      "description": "Align the vended Terraform Aurora app module variable defaults with the core module, enabling CloudWatch engine log export and exposing enable_key_rotation",
+      "implementation": "./src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration"
+    },
+    "latest-agentcore-harness-no-tools-by-default": {
+      "version": "1.0.0-rc.84",
+      "description": "Pin the vended AgentCore Harness construct/module to no tools by default, since AgentCore treats an absent allowedTools as every tool",
+      "implementation": "./src/migrations/latest/agentcore-harness-no-tools-by-default/migration"
+    },
+    "latest-terraform-declare-used-providers": {
+      "version": "1.0.0-rc.84",
+      "description": "Declare every provider each vended Terraform module uses in its own required_providers",
+      "implementation": "./src/migrations/latest/terraform-declare-used-providers/migration"
+    },
+    "latest-waf-log-group-cmk-encryption": {
+      "version": "1.0.0-rc.84",
+      "description": "Encrypt vended WAF log groups with a customer-managed KMS key",
+      "implementation": "./src/migrations/latest/waf-log-group-cmk-encryption/migration"
+    },
+    "latest-terraform-harness-vpc-role-and-memory-grant": {
+      "version": "1.0.0-rc.84",
+      "description": "Add VPC, execution role and native field support to the vended Terraform AgentCore Harness module, and scope its managed-memory grant to the service-assigned ARN",
+      "implementation": "./src/migrations/latest/terraform-harness-vpc-role-and-memory-grant/migration"
+    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -188,7 +213,7 @@
       "implementation": "./src/migrations/v1.0.0-rc.75/0001-ts-agent-session-id-middleware-extraction/migration"
     },
     "sync-vended-versions": {
-      "version": "1.0.0-rc.83",
+      "version": "1.0.0-rc.84",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.83",
+  "version": "1.0.0-rc.84",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/agentcore-gateway/__snapshots__/generator.spec.ts.snap

@@ -43,6 +43,8 @@ data "aws_region" "current" {}
 locals {
   aws_account_id = data.aws_caller_identity.current.account_id
   aws_region     = data.aws_region.current.id
+
+  gateway_waf_log_group_name = var.enable_waf ? "aws-waf-logs-my-gateway-\${random_id.unique_suffix.hex}" : null
 }
 
 resource "random_id" "unique_suffix" {
@@ -205,14 +207,61 @@ resource "aws_wafv2_web_acl_association" "gateway_waf" {
   web_acl_arn  = aws_wafv2_web_acl.gateway_waf[0].arn
 }
 
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "MyGateway gateway WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${local.aws_account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${local.aws_region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${local.aws_region}:\${local.aws_account_id}:log-group:\${local.gateway_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/my-gateway-\${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.gateway_waf_logs[0].key_id
+}
+
 # WAF request logs. WAFv2 requires the \`aws-waf-logs-\` name prefix.
 resource "aws_cloudwatch_log_group" "gateway_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one year which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-my-gateway-\${random_id.unique_suffix.hex}"
+  name              = local.gateway_waf_log_group_name
   retention_in_days = 365
+  kms_key_id        = aws_kms_key.gateway_waf_logs[0].arn
 }
 
 resource "aws_wafv2_web_acl_logging_configuration" "gateway_waf_logging" {

package/src/agentcore-harness/__snapshots__/generator.spec.ts.snap

@@ -62,14 +62,13 @@ construct's \`grantInvokeAccess\` grants exactly those two actions.
 ## Customizing your Harness
 
 Edit \`src/PROMPT.md\` for the system prompt. Everything else is configured
-where you instantiate the infrastructure — including tools, which the
-Harness deploys without:
+where you instantiate the infrastructure — including tools, which default
+to none:
 
 - CDK construct props, for example
   \`new MyHarness(this, 'MyHarness', { allowedTools: ['@builtin'] })\`
-- Terraform, by setting \`allowed_tools = ["@builtin"]\` on the module's
-  \`aws_bedrockagentcore_harness\` resource, or by adding an \`allowed_tools\`
-  variable if you would rather set it as a module argument
+- Terraform, by setting the module's \`allowed_tools\` variable, for example
+  \`allowed_tools = ["@builtin"]\`
 
 The generated infrastructure is also yours to edit directly:
 

package/src/agentcore-harness/files/project/README.md.template

@@ -59,14 +59,13 @@ construct's `grantInvokeAccess` grants exactly those two actions.
 ## Customizing your Harness
 
 Edit `src/PROMPT.md` for the system prompt. Everything else is configured
-where you instantiate the infrastructure — including tools, which the
-Harness deploys without:
+where you instantiate the infrastructure — including tools, which default
+to none:
 
 - CDK construct props, for example
   `new <%- nameClassName %>(this, '<%- nameClassName %>', { allowedTools: ['@builtin'] })`
-- Terraform, by setting `allowed_tools = ["@builtin"]` on the module's
-  `aws_bedrockagentcore_harness` resource, or by adding an `allowed_tools`
-  variable if you would rather set it as a module argument
+- Terraform, by setting the module's `allowed_tools` variable, for example
+  `allowed_tools = ["@builtin"]`
 
 The generated infrastructure is also yours to edit directly:
 

package/src/migrations/latest/agentcore-harness-no-tools-by-default/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,79 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`agentcore-harness-no-tools-by-default migration > cdk > defaults allowedTools to none and passes it explicitly 1`] = `
+"import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
+import { Construct } from 'constructs';
+
+export class MyHarness extends Construct {
+  public readonly harness: agentcore.CfnHarness;
+
+  constructor(scope: Construct, id: string, props?: MyHarnessProps) {
+    super(scope, id);
+
+    const stack = Stack.of(this);
+    const {
+      // The service treats an absent allowedTools as every tool, so this
+      // defaults to none and is always passed explicitly.
+      allowedTools = [],
+      executionRole,
+      modelResourceArns = [
+        \`arn:\${stack.partition}:bedrock:*::foundation-model/*\`,
+      ],
+      vpc,
+      vpcSubnets,
+      securityGroups,
+      ...harnessProps
+    } = props ?? {};
+
+    this.harness = new agentcore.CfnHarness(this, 'Harness', {
+      model: {
+        bedrockModelConfig: {
+          modelId: 'global.anthropic.claude-sonnet-4-6',
+        },
+      },
+      systemPrompt: [{ text: systemPrompt }],
+      ...harnessProps,
+      allowedTools,
+      // Set after harnessProps so the deployed name always matches the
+      // execution role's workload-identity resource pattern.
+      harnessName,
+      executionRoleArn: this.executionRole.roleArn,
+      environment,
+    });
+  }
+}
+"
+`;
+
+exports[`agentcore-harness-no-tools-by-default migration > terraform > declares allowed_tools defaulting to none and assigns it 1`] = `
+"variable "model_id" {
+  description = "Amazon Bedrock model or inference profile used by default."
+  type        = string
+  default     = "global.anthropic.claude-sonnet-4-6"
+}
+
+variable "allowed_tools" {
+  description = "Tools the Harness may use. Defaults to none; set [\\"@builtin\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool."
+  type        = list(string)
+  default     = []
+}
+
+variable "model_resource_arns" {
+  description = "Bedrock model and inference-profile ARNs the execution role may invoke."
+  type        = set(string)
+  default     = null
+}
+
+resource "aws_bedrockagentcore_harness" "this" {
+  harness_name       = local.harness_name
+  execution_role_arn = aws_iam_role.execution_role.arn
+  allowed_tools      = var.allowed_tools
+
+  model {
+    bedrock_model_config {
+      model_id = var.model_id
+    }
+  }
+}
+"
+`;

package/src/migrations/latest/agentcore-harness-no-tools-by-default/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Pin the vended AgentCore Harness construct/module to no tools by default, since AgentCore treats an absent allowedTools as every tool"
+}

package/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.js

@@ -0,0 +1,87 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Pin each vended Harness to no tools by default.
+ *
+ * AgentCore treats an absent `allowedTools` as every tool, so a Harness that
+ * never set it deployed with `allowedTools: ["*"]` — shell execution and file
+ * read/write included. Both providers now send the field explicitly, defaulting
+ * to none.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the implicit every-tool default until this runs. Diverged files are left
+ * untouched and reported via `nextSteps`.
+ */ const CDK_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/harnesses`;
+const TERRAFORM_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const ALLOWED_TOOLS_VARIABLE = [
+    'variable "allowed_tools" {',
+    '  description = "Tools the Harness may use. Defaults to none; set [\\"@builtin\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool."',
+    '  type        = list(string)',
+    '  default     = []',
+    '}'
+].join('\n');
+const divergedMessage = (filePath, remedy)=>`${filePath}: has diverged from the generated shape - left untouched. AgentCore treats an absent allowedTools as every tool, so this Harness deploys with all built-in tools (including shell and file access). ${remedy}`;
+/**
+ * Default the construct's `allowedTools` to none and pass it to the resource
+ * after the props spread, so an undefined caller value cannot reinstate the
+ * service's every-tool default.
+ */ const migrateCdkConstruct = async (tree, filePath)=>{
+    const destructured = await insertViaGritQL(tree, filePath, `\`const { $fields } = props ?? {};\` => \`const {\n      ${GRIT_INSERT_PLACEHOLDER}\n      $fields\n    } = props ?? {};\``, [
+        '// The service treats an absent allowedTools as every tool, so this',
+        '// defaults to none and is always passed explicitly.',
+        'allowedTools = [],'
+    ].join('\n      '));
+    if (!destructured) return false;
+    return await applyGritQL(tree, filePath, '`new agentcore.CfnHarness($scope, $id, { $props })` where {' + ' $props <: contains spread_element() as $spread,' + ' $spread => `$spread,\n      allowedTools`' + ' }');
+};
+/**
+ * Declare `allowed_tools` and assign it to the Harness resource, so the module
+ * always sends the field.
+ */ const migrateTerraformModule = async (tree, filePath)=>{
+    const declared = await insertViaGritQL(tree, filePath, hcl(`\`variable "model_resource_arns" { $props }\` => \`${GRIT_INSERT_PLACEHOLDER}\n\nvariable "model_resource_arns" {\n  $props\n}\``), ALLOWED_TOOLS_VARIABLE);
+    if (!declared) return false;
+    // Appended after the existing arguments so their alignment is preserved;
+    // `terraform fmt` re-aligns the block.
+    return await applyGritQL(tree, filePath, hcl('`execution_role_arn = aws_iam_role.execution_role.arn` => `execution_role_arn = aws_iam_role.execution_role.arn\n  allowed_tools      = var.allowed_tools`'));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const dirName of tree.exists(CDK_HARNESSES_DIR) ? tree.children(CDK_HARNESSES_DIR) : []){
+        const filePath = joinPathFragments(CDK_HARNESSES_DIR, dirName, `${dirName}.ts`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a Harness construct directory.
+        }
+        // Already pinned, by this migration or by hand.
+        if (tree.read(filePath, 'utf-8')?.includes('allowedTools = [],')) {
+            continue;
+        }
+        if (!await migrateCdkConstruct(tree, filePath)) {
+            nextSteps.push(divergedMessage(filePath, 'Default `allowedTools` to `[]` when destructuring props, and pass `allowedTools` to the CfnHarness after the `...harnessProps` spread.'));
+        }
+    }
+    for (const dirName of tree.exists(TERRAFORM_HARNESSES_DIR) ? tree.children(TERRAFORM_HARNESSES_DIR) : []){
+        const filePath = joinPathFragments(TERRAFORM_HARNESSES_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a Harness module directory.
+        }
+        // Already assigned, by this migration or by hand.
+        if (await matchGritQL(tree, filePath, hcl('`allowed_tools = $_`'))) {
+            continue;
+        }
+        if (!await migrateTerraformModule(tree, filePath)) {
+            nextSteps.push(divergedMessage(filePath, 'Declare an `allowed_tools` variable (list(string), default []) and assign `allowed_tools = var.allowed_tools` on the `aws_bedrockagentcore_harness` resource.'));
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/agentcore-harness-no-tools-by-default/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Pin each vended Harness to no tools by default.\n *\n * AgentCore treats an absent `allowedTools` as every tool, so a Harness that\n * never set it deployed with `allowedTools: [\"*\"]` — shell execution and file\n * read/write included. Both providers now send the field explicitly, defaulting\n * to none.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the implicit every-tool default until this runs. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst CDK_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/harnesses`;\nconst TERRAFORM_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst ALLOWED_TOOLS_VARIABLE = [\n  'variable \"allowed_tools\" {',\n  '  description = \"Tools the Harness may use. Defaults to none; set [\\\\\"@builtin\\\\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool.\"',\n  '  type        = list(string)',\n  '  default     = []',\n  '}',\n].join('\\n');\n\nconst divergedMessage = (filePath: string, remedy: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. AgentCore treats an absent allowedTools as every tool, so this Harness deploys with all built-in tools (including shell and file access). ${remedy}`;\n\n/**\n * Default the construct's `allowedTools` to none and pass it to the resource\n * after the props spread, so an undefined caller value cannot reinstate the\n * service's every-tool default.\n */\nconst migrateCdkConstruct = async (\n  tree: Tree,\n  filePath: string,\n): Promise<boolean> => {\n  const destructured = await insertViaGritQL(\n    tree,\n    filePath,\n    `\\`const { $fields } = props ?? {};\\` => \\`const {\\n      ${GRIT_INSERT_PLACEHOLDER}\\n      $fields\\n    } = props ?? {};\\``,\n    [\n      '// The service treats an absent allowedTools as every tool, so this',\n      '// defaults to none and is always passed explicitly.',\n      'allowedTools = [],',\n    ].join('\\n      '),\n  );\n  if (!destructured) return false;\n\n  return await applyGritQL(\n    tree,\n    filePath,\n    '`new agentcore.CfnHarness($scope, $id, { $props })` where {' +\n      ' $props <: contains spread_element() as $spread,' +\n      ' $spread => `$spread,\\n      allowedTools`' +\n      ' }',\n  );\n};\n\n/**\n * Declare `allowed_tools` and assign it to the Harness resource, so the module\n * always sends the field.\n */\nconst migrateTerraformModule = async (\n  tree: Tree,\n  filePath: string,\n): Promise<boolean> => {\n  const declared = await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`variable \"model_resource_arns\" { $props }\\` => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\nvariable \"model_resource_arns\" {\\n  $props\\n}\\``,\n    ),\n    ALLOWED_TOOLS_VARIABLE,\n  );\n  if (!declared) return false;\n\n  // Appended after the existing arguments so their alignment is preserved;\n  // `terraform fmt` re-aligns the block.\n  return await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      '`execution_role_arn = aws_iam_role.execution_role.arn` => `execution_role_arn = aws_iam_role.execution_role.arn\\n  allowed_tools      = var.allowed_tools`',\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const dirName of tree.exists(CDK_HARNESSES_DIR)\n    ? tree.children(CDK_HARNESSES_DIR)\n    : []) {\n    const filePath = joinPathFragments(\n      CDK_HARNESSES_DIR,\n      dirName,\n      `${dirName}.ts`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a Harness construct directory.\n    }\n\n    // Already pinned, by this migration or by hand.\n    if (tree.read(filePath, 'utf-8')?.includes('allowedTools = [],')) {\n      continue;\n    }\n\n    if (!(await migrateCdkConstruct(tree, filePath))) {\n      nextSteps.push(\n        divergedMessage(\n          filePath,\n          'Default `allowedTools` to `[]` when destructuring props, and pass `allowedTools` to the CfnHarness after the `...harnessProps` spread.',\n        ),\n      );\n    }\n  }\n\n  for (const dirName of tree.exists(TERRAFORM_HARNESSES_DIR)\n    ? tree.children(TERRAFORM_HARNESSES_DIR)\n    : []) {\n    const filePath = joinPathFragments(\n      TERRAFORM_HARNESSES_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a Harness module directory.\n    }\n\n    // Already assigned, by this migration or by hand.\n    if (await matchGritQL(tree, filePath, hcl('`allowed_tools = $_`'))) {\n      continue;\n    }\n\n    if (!(await migrateTerraformModule(tree, filePath))) {\n      nextSteps.push(\n        divergedMessage(\n          filePath,\n          'Declare an `allowed_tools` variable (list(string), default []) and assign `allowed_tools = var.allowed_tools` on the `aws_bedrockagentcore_harness` resource.',\n        ),\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_HARNESSES_DIR","TERRAFORM_HARNESSES_DIR","hcl","pattern","ALLOWED_TOOLS_VARIABLE","join","divergedMessage","filePath","remedy","migrateCdkConstruct","tree","destructured","migrateTerraformModule","declared","migration","nextSteps","dirName","exists","children","read","includes","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;CAWC,GAED,MAAMC,oBAAoB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,kBAAkB,CAAC;AACtF,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,kBAAkB,CAAC;AAE3F,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,UAAkBC,SACzC,GAAGD,SAAS,oMAAoM,EAAEC,QAAQ;AAE5N;;;;CAIC,GACD,MAAMC,sBAAsB,OAC1BC,MACAH;IAEA,MAAMI,eAAe,MAAMjB,gBACzBgB,MACAH,UACA,CAAC,yDAAyD,EAAEd,wBAAwB,uCAAuC,CAAC,EAC5H;QACE;QACA;QACA;KACD,CAACY,IAAI,CAAC;IAET,IAAI,CAACM,cAAc,OAAO;IAE1B,OAAO,MAAMnB,YACXkB,MACAH,UACA,gEACE,qDACA,+CACA;AAEN;AAEA;;;CAGC,GACD,MAAMK,yBAAyB,OAC7BF,MACAH;IAEA,MAAMM,WAAW,MAAMnB,gBACrBgB,MACAH,UACAL,IACE,CAAC,mDAAmD,EAAET,wBAAwB,mDAAmD,CAAC,GAEpIW;IAEF,IAAI,CAACS,UAAU,OAAO;IAEtB,yEAAyE;IACzE,uCAAuC;IACvC,OAAO,MAAMrB,YACXkB,MACAH,UACAL,IACE;AAGN;AAEA,eAAe,eAAeY,UAC5BJ,IAAU;IAEV,MAAMK,YAAsB,EAAE;IAE9B,KAAK,MAAMC,WAAWN,KAAKO,MAAM,CAACjB,qBAC9BU,KAAKQ,QAAQ,CAAClB,qBACd,EAAE,CAAE;QACN,MAAMO,WAAWhB,kBACfS,mBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKO,MAAM,CAACV,WAAW;YAC1B,UAAU,qCAAqC;QACjD;QAEA,gDAAgD;QAChD,IAAIG,KAAKS,IAAI,CAACZ,UAAU,UAAUa,SAAS,uBAAuB;YAChE;QACF;QAEA,IAAI,CAAE,MAAMX,oBAAoBC,MAAMH,WAAY;YAChDQ,UAAUM,IAAI,CACZf,gBACEC,UACA;QAGN;IACF;IAEA,KAAK,MAAMS,WAAWN,KAAKO,MAAM,CAAChB,2BAC9BS,KAAKQ,QAAQ,CAACjB,2BACd,EAAE,CAAE;QACN,MAAMM,WAAWhB,kBACfU,yBACAe,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKO,MAAM,CAACV,WAAW;YAC1B,UAAU,kCAAkC;QAC9C;QAEA,kDAAkD;QAClD,IAAI,MAAMZ,YAAYe,MAAMH,UAAUL,IAAI,0BAA0B;YAClE;QACF;QAEA,IAAI,CAAE,MAAMU,uBAAuBF,MAAMH,WAAY;YACnDQ,UAAUM,IAAI,CACZf,gBACEC,UACA;QAGN;IACF;IAEA,MAAMX,qBAAqBc;IAE3B,OAAO;QAAEK;IAAU;AACrB"}

package/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,54 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`rdb-terraform-aurora-app-module-defaults migration > should align the app module defaults with the core module 1`] = `
+"variable "enable_credential_rotation" {
+  description = "Whether to enable automatic credential rotation for the admin secret."
+  type        = bool
+  default     = true
+}
+
+variable "enable_cloudwatch_logs" {
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
+  type        = bool
+  default = true
+}
+
+variable "enable_performance_insights" {
+  description = "Whether to enable Performance Insights on Aurora cluster instances."
+  type        = bool
+  default     = true
+}
+
+variable "enable_backup" {
+  description = "Whether to provision an AWS Backup plan for the Aurora cluster."
+  type        = bool
+  default     = false
+}
+
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
+variable "tags" {
+  description = "Tags to apply to all resources."
+  type        = map(string)
+  default     = {}
+}
+
+module "aurora" {
+  source = "../../../core/rdb/aurora"
+
+  name                        = "my-db"
+  engine                      = "aurora-postgresql"
+  enable_credential_rotation  = var.enable_credential_rotation
+  enable_cloudwatch_logs      = var.enable_cloudwatch_logs
+  enable_performance_insights = var.enable_performance_insights
+  enable_backup               = var.enable_backup
+  tags                        = var.tags
+
+  enable_key_rotation = var.enable_key_rotation
+}
+"
+`;

package/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Align the vended Terraform Aurora app module variable defaults with the core module, enabling CloudWatch engine log export and exposing enable_key_rotation"
+}

package/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.js

@@ -0,0 +1,86 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Align each vended per-database Terraform app module
+ * (`app/dbs/<name>/<name>.tf`) with the core Aurora module it wraps.
+ *
+ * The app module is what a root configuration instantiates and it forwards its
+ * own value down, so its default is the one that takes effect:
+ *
+ * - `enable_cloudwatch_logs` defaulted to `false` against the core module's
+ *   `true`, so Aurora exported no engine logs and the cluster parameter group
+ *   that configures them (`log_statement=ddl` on PostgreSQL,
+ *   `server_audit_events=CONNECT,QUERY_DDL` on MySQL) was never created —
+ *   the CDK construct enabled both.
+ * - `enable_key_rotation` was never declared, leaving the core module's
+ *   variable unreachable from a root configuration.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the diverged defaults until this runs. Diverged files are left untouched and
+ * reported via `nextSteps`.
+ */ const TERRAFORM_DBS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const KEY_ROTATION_VARIABLE = [
+    'variable "enable_key_rotation" {',
+    '  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."',
+    '  type        = bool',
+    '  default     = true',
+    '}'
+].join('\n');
+const divergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To export Aurora engine logs to CloudWatch as the CDK construct and the core Terraform module do, default \`enable_cloudwatch_logs\` to true here, and declare an \`enable_key_rotation\` variable (bool, default true) forwarded to the aurora module (see the ts#rdb generator's dbs app template).`;
+const OLD_LOGS_DESCRIPTION = 'Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging.';
+const NEW_LOGS_DESCRIPTION = 'Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data.';
+/**
+ * Flip the app module's `enable_cloudwatch_logs` default to match the core
+ * module, and replace the description that documented the old behaviour.
+ *
+ * Keyed on that description, which is the only thing distinguishing the vended
+ * `default = false` from a user who deliberately turned log export off.
+ */ const migrateCloudwatchLogsDefault = (tree, filePath)=>applyGritQL(tree, filePath, hcl(`\`variable "enable_cloudwatch_logs" { $props }\` where {` + ` $props <: contains \`description = "${OLD_LOGS_DESCRIPTION}"\` => \`description = "${NEW_LOGS_DESCRIPTION}"\`,` + ` $props <: contains \`default = false\` => \`default = true\`` + ` }`));
+/**
+ * Declare `enable_key_rotation` and forward it to the core aurora module, so a
+ * root configuration can reach the variable the core module already exposes.
+ */ const migrateKeyRotationVariable = async (tree, filePath)=>{
+    if (await matchGritQL(tree, filePath, hcl('`variable "enable_key_rotation" { $_ }`'))) {
+        return; // Already declared.
+    }
+    const declared = await insertViaGritQL(tree, filePath, hcl(`\`variable "enable_backup" { $props }\` => \`variable "enable_backup" {\n  $props\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), KEY_ROTATION_VARIABLE);
+    if (!declared) return;
+    // Appended after the existing arguments so their alignment is preserved;
+    // `terraform fmt` re-aligns the block.
+    await applyGritQL(tree, filePath, hcl(`\`module "aurora" { $props }\` => \`module "aurora" {\n  $props\n\n  enable_key_rotation = var.enable_key_rotation\n}\``));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(TERRAFORM_DBS_APP_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform database modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_DBS_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_DBS_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a database app module directory.
+        }
+        // Both edits hang off the shape the generator produces: the two variables
+        // and the module call that forwards them.
+        const recognised = await matchGritQL(tree, filePath, hcl('`variable "enable_cloudwatch_logs" { $_ }`')) && await matchGritQL(tree, filePath, hcl('`variable "enable_backup" { $_ }`')) && await matchGritQL(tree, filePath, hcl('`module "aurora" { $props }` where { $props <: contains `enable_cloudwatch_logs = var.enable_cloudwatch_logs` }'));
+        if (!recognised) {
+            nextSteps.push(divergedMessage(filePath));
+            continue;
+        }
+        await migrateCloudwatchLogsDefault(tree, filePath);
+        await migrateKeyRotationVariable(tree, filePath);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Align each vended per-database Terraform app module\n * (`app/dbs/<name>/<name>.tf`) with the core Aurora module it wraps.\n *\n * The app module is what a root configuration instantiates and it forwards its\n * own value down, so its default is the one that takes effect:\n *\n * - `enable_cloudwatch_logs` defaulted to `false` against the core module's\n *   `true`, so Aurora exported no engine logs and the cluster parameter group\n *   that configures them (`log_statement=ddl` on PostgreSQL,\n *   `server_audit_events=CONNECT,QUERY_DDL` on MySQL) was never created —\n *   the CDK construct enabled both.\n * - `enable_key_rotation` was never declared, leaving the core module's\n *   variable unreachable from a root configuration.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the diverged defaults until this runs. Diverged files are left untouched and\n * reported via `nextSteps`.\n */\n\nconst TERRAFORM_DBS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst KEY_ROTATION_VARIABLE = [\n  'variable \"enable_key_rotation\" {',\n  '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n].join('\\n');\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To export Aurora engine logs to CloudWatch as the CDK construct and the core Terraform module do, default \\`enable_cloudwatch_logs\\` to true here, and declare an \\`enable_key_rotation\\` variable (bool, default true) forwarded to the aurora module (see the ts#rdb generator's dbs app template).`;\n\nconst OLD_LOGS_DESCRIPTION =\n  'Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging.';\nconst NEW_LOGS_DESCRIPTION =\n  'Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data.';\n\n/**\n * Flip the app module's `enable_cloudwatch_logs` default to match the core\n * module, and replace the description that documented the old behaviour.\n *\n * Keyed on that description, which is the only thing distinguishing the vended\n * `default = false` from a user who deliberately turned log export off.\n */\nconst migrateCloudwatchLogsDefault = (tree: Tree, filePath: string) =>\n  applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`variable \"enable_cloudwatch_logs\" { $props }\\` where {` +\n        ` $props <: contains \\`description = \"${OLD_LOGS_DESCRIPTION}\"\\` => \\`description = \"${NEW_LOGS_DESCRIPTION}\"\\`,` +\n        ` $props <: contains \\`default = false\\` => \\`default = true\\`` +\n        ` }`,\n    ),\n  );\n\n/**\n * Declare `enable_key_rotation` and forward it to the core aurora module, so a\n * root configuration can reach the variable the core module already exposes.\n */\nconst migrateKeyRotationVariable = async (\n  tree: Tree,\n  filePath: string,\n): Promise<void> => {\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      hcl('`variable \"enable_key_rotation\" { $_ }`'),\n    )\n  ) {\n    return; // Already declared.\n  }\n\n  const declared = await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`variable \"enable_backup\" { $props }\\` => \\`variable \"enable_backup\" {\\n  $props\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    ),\n    KEY_ROTATION_VARIABLE,\n  );\n  if (!declared) return;\n\n  // Appended after the existing arguments so their alignment is preserved;\n  // `terraform fmt` re-aligns the block.\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`module \"aurora\" { $props }\\` => \\`module \"aurora\" {\\n  $props\\n\\n  enable_key_rotation = var.enable_key_rotation\\n}\\``,\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_DBS_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform database modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DBS_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DBS_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a database app module directory.\n    }\n\n    // Both edits hang off the shape the generator produces: the two variables\n    // and the module call that forwards them.\n    const recognised =\n      (await matchGritQL(\n        tree,\n        filePath,\n        hcl('`variable \"enable_cloudwatch_logs\" { $_ }`'),\n      )) &&\n      (await matchGritQL(\n        tree,\n        filePath,\n        hcl('`variable \"enable_backup\" { $_ }`'),\n      )) &&\n      (await matchGritQL(\n        tree,\n        filePath,\n        hcl(\n          '`module \"aurora\" { $props }` where { $props <: contains `enable_cloudwatch_logs = var.enable_cloudwatch_logs` }',\n        ),\n      ));\n\n    if (!recognised) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    await migrateCloudwatchLogsDefault(tree, filePath);\n    await migrateKeyRotationVariable(tree, filePath);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DBS_APP_DIR","hcl","pattern","KEY_ROTATION_VARIABLE","join","divergedMessage","filePath","OLD_LOGS_DESCRIPTION","NEW_LOGS_DESCRIPTION","migrateCloudwatchLogsDefault","tree","migrateKeyRotationVariable","declared","migration","nextSteps","exists","dirName","children","recognised","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,wBAAwB,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,YAAY,CAAC;AAEnF,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,wBAAwB;IAC5B;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,+VAA+V,CAAC;AAE9W,MAAMC,uBACJ;AACF,MAAMC,uBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,+BAA+B,CAACC,MAAYJ,WAChDb,YACEiB,MACAJ,UACAL,IACE,CAAC,wDAAwD,CAAC,GACxD,CAAC,qCAAqC,EAAEM,qBAAqB,wBAAwB,EAAEC,qBAAqB,IAAI,CAAC,GACjH,CAAC,6DAA6D,CAAC,GAC/D,CAAC,EAAE,CAAC;AAIZ;;;CAGC,GACD,MAAMG,6BAA6B,OACjCD,MACAJ;IAEA,IACE,MAAMV,YACJc,MACAJ,UACAL,IAAI,6CAEN;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,WAAW,MAAMjB,gBACrBe,MACAJ,UACAL,IACE,CAAC,wFAAwF,EAAEP,wBAAwB,EAAE,CAAC,GAExHS;IAEF,IAAI,CAACS,UAAU;IAEf,yEAAyE;IACzE,uCAAuC;IACvC,MAAMnB,YACJiB,MACAJ,UACAL,IACE,CAAC,uHAAuH,CAAC;AAG/H;AAEA,eAAe,eAAeY,UAC5BH,IAAU;IAEV,MAAMI,YAAsB,EAAE;IAE9B,IAAI,CAACJ,KAAKK,MAAM,CAACf,wBAAwB;QACvC,OAAO;YAAEc;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAME,WAAWN,KAAKO,QAAQ,CAACjB,uBAAwB;QAC1D,MAAMM,WAAWd,kBACfQ,uBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKK,MAAM,CAACT,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAMY,aACJ,AAAC,MAAMtB,YACLc,MACAJ,UACAL,IAAI,kDAEL,MAAML,YACLc,MACAJ,UACAL,IAAI,yCAEL,MAAML,YACLc,MACAJ,UACAL,IACE;QAIN,IAAI,CAACiB,YAAY;YACfJ,UAAUK,IAAI,CAACd,gBAAgBC;YAC/B;QACF;QAEA,MAAMG,6BAA6BC,MAAMJ;QACzC,MAAMK,2BAA2BD,MAAMJ;IACzC;IAEA,MAAMT,qBAAqBa;IAE3B,OAAO;QAAEI;IAAU;AACrB"}

package/src/migrations/latest/terraform-declare-used-providers/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare every provider each vended Terraform module uses in its own required_providers"
+}

package/src/migrations/latest/terraform-declare-used-providers/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;