@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.84

package/src/utils/files/terraform/src/metrics/providers.tf.template

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
+  }
+}

package/src/utils/function-constructs/files/terraform/app/lambda-functions/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -8,6 +8,10 @@ terraform {
       source  = "hashicorp/archive"
       version = "<%- archiveProviderVersion %>"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
   }
 }
 

package/src/utils/identity-constructs/files/cdk/core/user-identity.ts.template

@@ -29,6 +29,8 @@ import {
   CfnWebACLAssociation,
 } from 'aws-cdk-lib/aws-wafv2';
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config<% if (esm) { %>.js<% } %>';
 import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
@@ -265,18 +267,41 @@ export class UserIdentity extends Construct {
       webAclArn: webAcl.attrArn,
     });
 
-    // Send WAF request logs to CloudWatch. The log group name must start with
-    // `aws-waf-logs-` to satisfy the WAFv2 logging destination requirement.
+    // The log group name must start with `aws-waf-logs-` to satisfy the WAFv2
+    // logging destination requirement.
+    const stack = Stack.of(this);
+    const wafLogGroupName = `aws-waf-logs-${id}-${this.node.addr.slice(-8)}`;
+
+    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [new ServicePrincipal(`logs.${stack.region}.amazonaws.com`)],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnEquals: {
+            'kms:EncryptionContext:aws:logs:arn': `arn:aws:logs:${stack.region}:${stack.account}:log-group:${wafLogGroupName}`,
+          },
+        },
+      }),
+    );
+
     const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
-      logGroupName: `aws-waf-logs-${id}-${this.node.addr.slice(-8)}`,
+      logGroupName: wafLogGroupName,
       retention: RetentionDays.ONE_MONTH,
+      encryptionKey: logsKey,
       removalPolicy: RemovalPolicy.DESTROY,
     });
-    suppressRules(
-      wafLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption for WAF logs',
-    );
 
     new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
       resourceArn: webAcl.attrArn,

package/src/utils/identity-constructs/files/terraform/core/user-identity/add-callback-url/add-callback-url.tf.template

@@ -4,6 +4,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "<%- awsProviderVersion %>"
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "<%- nullProviderVersion %>"
+    }
   }
 }
 

package/src/utils/identity-constructs/files/terraform/core/user-identity/identity/identity.tf.template

@@ -73,6 +73,8 @@ locals {
     "http://localhost:4200",
     "http://localhost:4300"
   ]
+
+  user_pool_waf_log_group_name = var.enable_waf ? "aws-waf-logs-UserPool-${random_id.unique_suffix.hex}" : null
 }
 
 # Random suffix for resource names
@@ -368,14 +370,61 @@ resource "aws_wafv2_web_acl_association" "user_pool_waf_association" {
   web_acl_arn  = aws_wafv2_web_acl.user_pool_waf[0].arn
 }
 
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "user_pool_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "User pool WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:${local.user_pool_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "user_pool_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/user-pool-${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.user_pool_waf_logs[0].key_id
+}
+
 # CloudWatch Log Group for WAF request logs. Name must start with `aws-waf-logs-`.
 resource "aws_cloudwatch_log_group" "user_pool_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-UserPool-${random_id.unique_suffix.hex}"
+  name              = local.user_pool_waf_log_group_name
   retention_in_days = 30
+  kms_key_id        = aws_kms_key.user_pool_waf_logs[0].arn
 }
 
 resource "aws_wafv2_web_acl_logging_configuration" "user_pool_waf_logging" {

package/src/utils/rdb-constructs/files/cdk/core/rdb/aurora.ts.template

@@ -180,6 +180,20 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enablePerformanceInsights?: boolean;
+
+  /**
+   * Minimum Aurora Serverless v2 ACUs.
+   *
+   * @default <%= serverlessMinCapacity %>
+   */
+  readonly serverlessV2MinCapacity?: number;
+
+  /**
+   * Maximum Aurora Serverless v2 ACUs.
+   *
+   * @default <%= serverlessMaxCapacity %>
+   */
+  readonly serverlessV2MaxCapacity?: number;
 }
 
 /**
@@ -209,6 +223,8 @@ export abstract class AuroraDatabase extends Construct {
       enableKeyRotation = true,
       enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
+      serverlessV2MinCapacity = <%= serverlessMinCapacity %>,
+      serverlessV2MaxCapacity = <%= serverlessMaxCapacity %>,
       engine,
       engineVersion,
       ...clusterProps
@@ -224,6 +240,8 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
+      serverlessV2MinCapacity,
+      serverlessV2MaxCapacity,
       writer:
         writer ??
         ClusterInstance.serverlessV2("writer", {

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -10,6 +10,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "<%- awsProviderVersion %>"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "<%- externalProviderVersion %>"
+    }
     null = {
       source  = "hashicorp/null"
       version = "<%- nullProviderVersion %>"
@@ -51,13 +55,13 @@ variable "port" {
 variable "serverless_min_capacity" {
   description = "Minimum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 0.5
+  default     = <%= serverlessMinCapacity %>
 }
 
 variable "serverless_max_capacity" {
   description = "Maximum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 4
+  default     = <%= serverlessMaxCapacity %>
 }
 
 variable "instance_count" {
@@ -91,9 +95,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -114,6 +118,12 @@ variable "enable_backup" {
   default     = false
 }
 
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
 variable "tags" {
   description = "Tags to apply to all resources."
   type        = map(string)
@@ -184,6 +194,7 @@ module "aurora" {
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
   enable_backup                         = var.enable_backup
+  enable_key_rotation                   = var.enable_key_rotation
   tags                                  = var.tags
 }
 

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -84,13 +84,13 @@ variable "port" {
 variable "serverless_min_capacity" {
   description = "Minimum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 0.5
+  default     = <%= serverlessMinCapacity %>
 }
 
 variable "serverless_max_capacity" {
   description = "Maximum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 4
+  default     = <%= serverlessMaxCapacity %>
 }
 
 variable "instance_count" {

package/src/utils/rdb-constructs/rdb-constructs.d.ts

@@ -5,6 +5,18 @@
 import { type Tree } from '@nx/devkit';
 import type { Containers } from '../containers.js';
 import type { Iac } from '../iac.js';
+/**
+ * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive
+ * from so the same generator options vend the same ceiling regardless of `--iac`.
+ *
+ * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose
+ * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on
+ * the ceiling, so the maximum is headroom rather than a cost commitment.
+ */
+export declare const AURORA_SERVERLESS_V2_CAPACITY: {
+    readonly min: 0.5;
+    readonly max: 4;
+};
 export interface AddRdbConstructOptions {
     projectName: string;
     projectRoot: string;

package/src/utils/rdb-constructs/rdb-constructs.js

@@ -7,6 +7,24 @@ import { esmVars } from "../module-format.js";
 import { addDependencyToTargetIfNotPresent } from "../nx.js";
 import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 import { terraformProviderVersions } from "../versions.js";
+/**
+ * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive
+ * from so the same generator options vend the same ceiling regardless of `--iac`.
+ *
+ * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose
+ * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on
+ * the ceiling, so the maximum is headroom rather than a cost commitment.
+ */ export const AURORA_SERVERLESS_V2_CAPACITY = {
+    min: 0.5,
+    max: 4
+};
+/**
+ * Substitution variables exposing the Aurora Serverless v2 scaling bounds to
+ * generated CDK and Terraform templates.
+ */ const auroraServerlessV2Capacity = ()=>({
+        serverlessMinCapacity: AURORA_SERVERLESS_V2_CAPACITY.min,
+        serverlessMaxCapacity: AURORA_SERVERLESS_V2_CAPACITY.max
+    });
 export const addRdbInfra = async (tree, options)=>{
     if (options.iac === 'cdk') {
         await addRdbCdkConstructs(tree, options);
@@ -23,7 +41,8 @@ export const addRdbInfra = async (tree, options)=>{
 export const addRdbCdkConstructs = async (tree, options)=>{
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'rdb'), {
         ...options,
-        ...esmVars(tree)
+        ...esmVars(tree),
+        ...auroraServerlessV2Capacity()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
@@ -39,13 +58,15 @@ export const addRdbCdkConstructs = async (tree, options)=>{
 };
 export const addRdbTerraformModules = (tree, options)=>{
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'), {
-        ...terraformProviderVersions()
+        ...terraformProviderVersions(),
+        ...auroraServerlessV2Capacity()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'), {
         ...options,
-        ...terraformProviderVersions()
+        ...terraformProviderVersions(),
+        ...auroraServerlessV2Capacity()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });

package/src/utils/rdb-constructs/rdb-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Containers } from '../containers.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { terraformProviderVersions } from '../versions.js';\n\nexport interface AddRdbConstructOptions {\n  projectName: string;\n  projectRoot: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  databasePackageAlias: string;\n  databaseName: string;\n  adminUser: string;\n  engine: 'postgres' | 'mysql';\n  migrationBundleDir: string;\n  /**\n   * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).\n   * When absent the migration Docker image is reused with the\n   * `create_db_user_handler.handler` command (py#rdb).\n   */\n  createDbUserBundleDir: string;\n  /** ORM framework used by the create-db-user Lambda. */\n  framework: 'prisma' | 'sqlmodel';\n  /** Local Docker tag for the Python create-db-user Lambda image. */\n  createDbUserDockerImageTag?: string;\n  /** Local Docker tag for the migration Lambda image. */\n  migrationDockerImageTag: string;\n  containerEngine: Containers;\n}\n\nexport const addRdbInfra = async (\n  tree: Tree,\n  options: AddRdbConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addRdbCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addRdbTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nexport const addRdbCdkConstructs = async (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'rdb',\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './rdb/aurora.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dbs',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dbs/index.js',\n  );\n};\n\nexport const addRdbTerraformModules = (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","terraformProviderVersions","addRdbInfra","tree","options","iac","addRdbCdkConstructs","addRdbTerraformModules","Error","config","projectName","dirname","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,yBAAyB,QAAQ,iBAAiB;AA2B3D,OAAO,MAAMC,cAAc,OACzBC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,oBAAoBH,MAAMC;IAClC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,uBAAuBJ,MAAMC;IAC/B,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAX,WACES,MACAX,kBACEM,cACAM,QAAQC,GAAG,KAAK,QAAQN,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGL,QAAQM,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,OAAO,MAAMH,sBAAsB,OACjCH,MACAC;IAEAb,cACEY,MACAX,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,OAAO,QAAQ,QAC/DnB,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;QAAE,GAAGK,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACES,mBAAmBnB,kBAAkBoB,YAAY;IACnD;IAGFtB,cACEY,MACAX,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,OAAO,OAAO,QAC9DnB,kBAAkBM,cAAcC,uBAAuB,OAAO,OAAO,QACrE;QAAE,GAAGK,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACES,mBAAmBnB,kBAAkBoB,YAAY;IACnD;IAGF,MAAMlB,cACJQ,MACAX,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJQ,MACAX,kBACEM,cACAC,uBACA,OACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEK,QAAQU,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAMnB,cACJQ,MACAX,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ,EAAE;AAEF,OAAO,MAAMQ,yBAAyB,CACpCJ,MACAC;IAEAb,cACEY,MACAX,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,aAAa,QAAQ,QACrEnB,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGC,2BAA2B;IAAC,GACjC;QACEW,mBAAmBnB,kBAAkBoB,YAAY;IACnD;IAGFtB,cACEY,MACAX,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,aAAa,OAAO,QACpEnB,kBAAkBM,cAAcE,sBAAsB,OAAO,OAAO,QACpE;QAAE,GAAGI,OAAO;QAAE,GAAGH,2BAA2B;IAAC,GAC7C;QACEW,mBAAmBnB,kBAAkBoB,YAAY;IACnD;AAEJ,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Containers } from '../containers.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { terraformProviderVersions } from '../versions.js';\n\n/**\n * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive\n * from so the same generator options vend the same ceiling regardless of `--iac`.\n *\n * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose\n * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on\n * the ceiling, so the maximum is headroom rather than a cost commitment.\n */\nexport const AURORA_SERVERLESS_V2_CAPACITY = {\n  min: 0.5,\n  max: 4,\n} as const;\n\n/**\n * Substitution variables exposing the Aurora Serverless v2 scaling bounds to\n * generated CDK and Terraform templates.\n */\nconst auroraServerlessV2Capacity = () => ({\n  serverlessMinCapacity: AURORA_SERVERLESS_V2_CAPACITY.min,\n  serverlessMaxCapacity: AURORA_SERVERLESS_V2_CAPACITY.max,\n});\n\nexport interface AddRdbConstructOptions {\n  projectName: string;\n  projectRoot: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  databasePackageAlias: string;\n  databaseName: string;\n  adminUser: string;\n  engine: 'postgres' | 'mysql';\n  migrationBundleDir: string;\n  /**\n   * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).\n   * When absent the migration Docker image is reused with the\n   * `create_db_user_handler.handler` command (py#rdb).\n   */\n  createDbUserBundleDir: string;\n  /** ORM framework used by the create-db-user Lambda. */\n  framework: 'prisma' | 'sqlmodel';\n  /** Local Docker tag for the Python create-db-user Lambda image. */\n  createDbUserDockerImageTag?: string;\n  /** Local Docker tag for the migration Lambda image. */\n  migrationDockerImageTag: string;\n  containerEngine: Containers;\n}\n\nexport const addRdbInfra = async (\n  tree: Tree,\n  options: AddRdbConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addRdbCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addRdbTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nexport const addRdbCdkConstructs = async (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'rdb',\n    ),\n    { ...options, ...esmVars(tree), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './rdb/aurora.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dbs',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dbs/index.js',\n  );\n};\n\nexport const addRdbTerraformModules = (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'),\n    { ...terraformProviderVersions(), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'),\n    {\n      ...options,\n      ...terraformProviderVersions(),\n      ...auroraServerlessV2Capacity(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","terraformProviderVersions","AURORA_SERVERLESS_V2_CAPACITY","min","max","auroraServerlessV2Capacity","serverlessMinCapacity","serverlessMaxCapacity","addRdbInfra","tree","options","iac","addRdbCdkConstructs","addRdbTerraformModules","Error","config","projectName","dirname","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,yBAAyB,QAAQ,iBAAiB;AAE3D;;;;;;;CAOC,GACD,OAAO,MAAMC,gCAAgC;IAC3CC,KAAK;IACLC,KAAK;AACP,EAAW;AAEX;;;CAGC,GACD,MAAMC,6BAA6B,IAAO,CAAA;QACxCC,uBAAuBJ,8BAA8BC,GAAG;QACxDI,uBAAuBL,8BAA8BE,GAAG;IAC1D,CAAA;AA2BA,OAAO,MAAMI,cAAc,OACzBC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,oBAAoBH,MAAMC;IAClC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,uBAAuBJ,MAAMC;IAC/B,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAjB,WACEe,MACAjB,kBACEM,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACe;QACClB,kCACEkB,QACA,SACA,GAAGL,QAAQM,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,OAAO,MAAMH,sBAAsB,OACjCH,MACAC;IAEAnB,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,OAAO,QAAQ,QAC/DzB,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;QAAE,GAAGW,OAAO;QAAE,GAAGd,QAAQa,KAAK;QAAE,GAAGJ,4BAA4B;IAAC,GAChE;QACEa,mBAAmBzB,kBAAkB0B,YAAY;IACnD;IAGF5B,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,OAAO,OAAO,QAC9DzB,kBAAkBM,cAAcC,uBAAuB,OAAO,OAAO,QACrE;QAAE,GAAGW,OAAO;QAAE,GAAGd,QAAQa,KAAK;IAAC,GAC/B;QACES,mBAAmBzB,kBAAkB0B,YAAY;IACnD;IAGF,MAAMxB,cACJc,MACAjB,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJc,MACAjB,kBACEM,cACAC,uBACA,OACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEW,QAAQU,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAMzB,cACJc,MACAjB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ,EAAE;AAEF,OAAO,MAAMc,yBAAyB,CACpCJ,MACAC;IAEAnB,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,aAAa,QAAQ,QACrEzB,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGC,2BAA2B;QAAE,GAAGI,4BAA4B;IAAC,GAClE;QACEa,mBAAmBzB,kBAAkB0B,YAAY;IACnD;IAGF5B,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,aAAa,OAAO,QACpEzB,kBAAkBM,cAAcE,sBAAsB,OAAO,OAAO,QACpE;QACE,GAAGU,OAAO;QACV,GAAGT,2BAA2B;QAC9B,GAAGI,4BAA4B;IACjC,GACA;QACEa,mBAAmBzB,kBAAkB0B,YAAY;IACnD;AAEJ,EAAE"}

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -5,6 +5,10 @@ terraform {
       version = "<%- awsProviderVersion %>"
       configuration_aliases = [aws.us_east_1]
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "<%- nullProviderVersion %>"
+    }
     random = {
       source  = "hashicorp/random"
       version = "<%- randomProviderVersion %>"