@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.84

package/src/migrations/latest/terraform-harness-vpc-role-and-memory-grant/migration.js

@@ -0,0 +1,504 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { applyGritQL, captureAllGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Bring each vended Terraform AgentCore Harness app module
+ * (`app/harnesses/<name>/<name>.tf`) up to the shape the generator now writes:
+ *
+ * - `enable_vpc` / `vpc_id` / `subnet_ids` with a security group and a 443-only
+ *   egress rule, so the Harness can reach private resources.
+ * - `create_execution_role` / `execution_role_arn`, so an existing role can be
+ *   supplied. The generated role and its baseline policy are then not created.
+ * - `allowed_tools`, `memory`, `environment_variables`, `max_iterations` and
+ *   `timeout_seconds` as variables rather than HCL edits.
+ * - The managed-memory grant moved to its own policy, made conditional and
+ *   re-scoped from a name-prefix guess to the ARN the service assigns.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the older module until this runs. Modules that have diverged from the
+ * generated shape are left untouched and reported via `nextSteps`.
+ */ const TERRAFORM_HARNESS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const divergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To pick up VPC support, a supplied execution role, the allowed_tools/memory/environment_variables/max_iterations/timeout_seconds variables and the corrected managed-memory grant, compare it against the agentcore-harness generator's Terraform template and apply the parts you want.`;
+/**
+ * Variables added ahead of the existing `model_resource_arns` variable.
+ * `allowed_tools` is not among them: the earlier `agentcore-harness-no-tools-by-default`
+ * migration already declares it, and runs first.
+ */ const NEW_VARIABLES_TEXT = `variable "memory" {
+  description = "Memory configuration for the Harness. Null leaves the service to provision managed memory with default strategies. Set exactly one field: managed_memory_configuration to tune that managed memory, agentcore_memory_configuration to use a memory resource you own, or disabled to turn memory off."
+  type = object({
+    managed_memory_configuration = optional(object({
+      strategies            = optional(set(string))
+      event_expiry_duration = optional(number)
+      encryption_key_arn    = optional(string)
+    }))
+    agentcore_memory_configuration = optional(object({
+      arn            = string
+      actor_id       = optional(string)
+      messages_count = optional(number)
+    }))
+    disabled = optional(bool, false)
+  })
+  default = null
+
+  validation {
+    condition = var.memory == null || length([
+      for configured in [
+        var.memory.managed_memory_configuration != null,
+        var.memory.agentcore_memory_configuration != null,
+        var.memory.disabled,
+      ] : configured if configured
+    ]) == 1
+    error_message = "Set exactly one of memory.managed_memory_configuration, memory.agentcore_memory_configuration or memory.disabled."
+  }
+}
+
+variable "environment_variables" {
+  description = "Environment variables available to the Harness."
+  type        = map(string)
+  default     = null
+  sensitive   = true
+}
+
+variable "max_iterations" {
+  description = "Maximum agent loop iterations per invocation. Uses the service default when null."
+  type        = number
+  default     = null
+}
+
+variable "timeout_seconds" {
+  description = "Maximum seconds an invocation may run. Uses the service default when null."
+  type        = number
+  default     = null
+}
+
+variable "create_execution_role" {
+  description = "Create the execution role with the baseline permissions below. Set false alongside execution_role_arn to use a role you already have, which is then used as-is."
+  type        = bool
+  default     = true
+
+  validation {
+    condition     = var.create_execution_role || var.execution_role_arn != null
+    error_message = "execution_role_arn must be set when create_execution_role is false."
+  }
+
+  validation {
+    condition = var.create_execution_role || (
+      var.model_resource_arns == null && length(var.additional_execution_role_policy_statements) == 0
+    )
+    error_message = "model_resource_arns and additional_execution_role_policy_statements configure the generated execution role, which is not created when create_execution_role is false. Grant those permissions on the supplied role instead."
+  }
+}
+
+variable "execution_role_arn" {
+  description = "ARN of an existing IAM role for the Harness to assume. Requires create_execution_role = false."
+  type        = string
+  default     = null
+}`;
+/** VPC and tag variables added after `additional_execution_role_policy_statements`. */ const VPC_VARIABLES_TEXT = `# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Run the Harness inside a VPC so it can reach private resources. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the Harness in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the Harness in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
+variable "tags" {
+  description = "Tags to apply to resources"
+  type        = map(string)
+  default     = {}
+}`;
+/** Locals added to the module's existing `locals` block. */ const NEW_LOCALS_TEXT = `  execution_role_arn = var.create_execution_role ? aws_iam_role.execution_role[0].arn : var.execution_role_arn
+
+  # The service provisions managed memory unless var.memory redirects it
+  # elsewhere or turns it off.
+  has_managed_memory = var.memory == null || var.memory.managed_memory_configuration != null`;
+/** Security group and egress rule, added before the Harness resource. */ const SECURITY_GROUP_TEXT = `# Security group for the Harness, used when running inside a VPC
+resource "aws_security_group" "harness" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to the Harness via its network configuration; Checkov cannot resolve this reference
+  name_prefix = "\${local.harness_name_prefix}-harness-"
+  description = "Security group for the \${local.harness_name_prefix} Harness"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "harness_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.harness[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}`;
+/**
+ * Native fields added to the Harness resource. `allowed_tools` is re-emitted
+ * here, aligned with the rest, replacing the line the earlier
+ * no-tools-by-default migration added.
+ */ const HARNESS_FIELDS_TEXT = `  allowed_tools         = var.allowed_tools
+  environment_variables = var.environment_variables
+  max_iterations        = var.max_iterations
+  timeout_seconds       = var.timeout_seconds`;
+const HARNESS_BLOCKS_TEXT = `  dynamic "memory" {
+    for_each = var.memory != null ? [var.memory] : []
+    content {
+      dynamic "managed_memory_configuration" {
+        for_each = memory.value.managed_memory_configuration != null ? [memory.value.managed_memory_configuration] : []
+        content {
+          strategies            = managed_memory_configuration.value.strategies
+          event_expiry_duration = managed_memory_configuration.value.event_expiry_duration
+          encryption_key_arn    = managed_memory_configuration.value.encryption_key_arn
+        }
+      }
+
+      dynamic "agentcore_memory_configuration" {
+        for_each = memory.value.agentcore_memory_configuration != null ? [memory.value.agentcore_memory_configuration] : []
+        content {
+          arn            = agentcore_memory_configuration.value.arn
+          actor_id       = agentcore_memory_configuration.value.actor_id
+          messages_count = agentcore_memory_configuration.value.messages_count
+        }
+      }
+
+      dynamic "disabled" {
+        for_each = memory.value.disabled ? [1] : []
+        content {}
+      }
+    }
+  }
+
+  dynamic "environment" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      agentcore_runtime_environment {
+        network_configuration {
+          network_mode = "VPC"
+          network_mode_config {
+            security_groups = [aws_security_group.harness[0].id]
+            subnets         = var.subnet_ids
+          }
+        }
+      }
+    }
+  }
+
+  tags = var.tags`;
+/** The managed-memory grant, as its own policy scoped to the assigned ARN. */ const MANAGED_MEMORY_POLICY_TEXT = `# Scoped to the memory ARN the service assigns, which is only readable after the
+# Harness exists, so this is a policy of its own rather than a baseline
+# statement. Skipped when the Harness uses a role or memory the module did not
+# create.
+resource "aws_iam_role_policy" "managed_memory" {
+  count = var.create_execution_role && local.has_managed_memory ? 1 : 0
+
+  name = "\${local.harness_name_prefix}-HarnessManagedMemoryPolicy"
+  role = aws_iam_role.execution_role[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Sid    = "AgentCoreManagedMemory"
+      Effect = "Allow"
+      Action = [
+        "bedrock-agentcore:CreateEvent",
+        "bedrock-agentcore:DeleteEvent",
+        "bedrock-agentcore:GetEvent",
+        "bedrock-agentcore:ListEvents",
+        "bedrock-agentcore:RetrieveMemoryRecords",
+      ]
+      Resource = [
+        aws_bedrockagentcore_harness.this.memory_actual[0].managed_memory_configuration[0].arn,
+      ]
+    }]
+  })
+}`;
+const SECURITY_GROUP_OUTPUT_TEXT = `output "security_group_id" {
+  description = "Security group ID of the Harness, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.harness[0].id : null
+}`;
+/**
+ * The baseline policy, replaced whole: the managed-memory statement leaves it
+ * for a policy of its own, and the resource gains a `count`. Rewriting the
+ * statement list in place would strand the comment and comma around the
+ * statement being removed.
+ */ const BASELINE_POLICY_TEXT = `resource "aws_iam_role_policy" "execution_role" {
+  count = var.create_execution_role ? 1 : 0
+
+  name = "\${local.harness_name_prefix}-HarnessPolicy"
+  role = aws_iam_role.execution_role[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat([
+      {
+        Sid    = "BedrockModelInvocation"
+        Effect = "Allow"
+        Action = [
+          "bedrock:InvokeModel",
+          "bedrock:InvokeModelWithResponseStream",
+        ]
+        Resource = local.model_resource_arns
+      },
+      {
+        #checkov:skip=CKV_AWS_355:EcrPublicTokenAccess requires a wildcard resource; ecr-public:GetAuthorizationToken has no resource-level permission
+        Sid      = "EcrPublicTokenAccess"
+        Effect   = "Allow"
+        Action   = ["ecr-public:GetAuthorizationToken"]
+        Resource = ["*"]
+      },
+      {
+        #checkov:skip=CKV_AWS_355:StsForEcrPublicPull requires a wildcard resource; sts:GetServiceBearerToken has no resource-level permission
+        Sid      = "StsForEcrPublicPull"
+        Effect   = "Allow"
+        Action   = ["sts:GetServiceBearerToken"]
+        Resource = ["*"]
+      },
+      {
+        #checkov:skip=CKV_AWS_355:XRayTracingAccess requires a wildcard resource; the X-Ray segment and sampling APIs have no resource-level permission
+        #checkov:skip=CKV_AWS_290:XRayTracingAccess requires a wildcard resource; the X-Ray segment and sampling APIs have no resource-level permission
+        Sid    = "XRayTracingAccess"
+        Effect = "Allow"
+        Action = [
+          "xray:PutTraceSegments",
+          "xray:PutTelemetryRecords",
+          "xray:GetSamplingRules",
+          "xray:GetSamplingTargets",
+        ]
+        Resource = ["*"]
+      },
+      {
+        Sid    = "CloudWatchLogsGroup"
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogGroup",
+          "logs:DescribeLogStreams",
+        ]
+        Resource = [
+          "arn:\${local.partition}:logs:\${local.region}:\${local.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*",
+        ]
+      },
+      {
+        Sid      = "CloudWatchLogsDescribeGroups"
+        Effect   = "Allow"
+        Action   = ["logs:DescribeLogGroups"]
+        Resource = ["arn:\${local.partition}:logs:\${local.region}:\${local.account_id}:log-group:*"]
+      },
+      {
+        Sid    = "CloudWatchLogsStream"
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+        ]
+        Resource = [
+          "arn:\${local.partition}:logs:\${local.region}:\${local.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*",
+        ]
+      },
+      {
+        #checkov:skip=CKV_AWS_355:CloudWatchMetricsPublish requires a wildcard resource; cloudwatch:PutMetricData is scoped by the namespace condition instead
+        #checkov:skip=CKV_AWS_290:CloudWatchMetricsPublish requires a wildcard resource; cloudwatch:PutMetricData is scoped by the namespace condition instead
+        Sid      = "CloudWatchMetricsPublish"
+        Effect   = "Allow"
+        Action   = ["cloudwatch:PutMetricData"]
+        Resource = ["*"]
+        Condition = {
+          StringEquals = {
+            "cloudwatch:namespace" = "bedrock-agentcore"
+          }
+        }
+      },
+      {
+        Sid    = "AgentCoreWorkloadIdentity"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:GetWorkloadAccessToken",
+          "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
+        ]
+        Resource = [
+          "arn:\${local.partition}:bedrock-agentcore:\${local.region}:\${local.account_id}:workload-identity-directory/default",
+          "arn:\${local.partition}:bedrock-agentcore:\${local.region}:\${local.account_id}:workload-identity-directory/default/workload-identity/harness_\${local.harness_name}-*",
+        ]
+      },
+      {
+        Sid    = "AgentCoreBrowserDefault"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:StartBrowserSession",
+          "bedrock-agentcore:StopBrowserSession",
+          "bedrock-agentcore:GetBrowserSession",
+          "bedrock-agentcore:ListBrowserSessions",
+          "bedrock-agentcore:UpdateBrowserStream",
+          "bedrock-agentcore:ConnectBrowserAutomationStream",
+          "bedrock-agentcore:ConnectBrowserLiveViewStream",
+        ]
+        Resource = [
+          "arn:\${local.partition}:bedrock-agentcore:\${local.region}:aws:browser/*",
+        ]
+      },
+      {
+        Sid    = "AgentCoreCodeInterpreterDefault"
+        Effect = "Allow"
+        Action = [
+          "bedrock-agentcore:StartCodeInterpreterSession",
+          "bedrock-agentcore:StopCodeInterpreterSession",
+          "bedrock-agentcore:GetCodeInterpreterSession",
+          "bedrock-agentcore:ListCodeInterpreterSessions",
+          "bedrock-agentcore:InvokeCodeInterpreter",
+        ]
+        Resource = [
+          "arn:\${local.partition}:bedrock-agentcore:\${local.region}:aws:code-interpreter/*",
+        ]
+      },
+      ],
+      # In VPC mode the Harness pulls its managed container from a private ECR
+      # repository in the region rather than ECR Public, so it needs pull
+      # permissions on it. The repository is service-owned, hence the wildcard
+      # account.
+      var.enable_vpc ? [
+        {
+          Sid    = "EcrManagedImagePull"
+          Effect = "Allow"
+          Action = [
+            "ecr:BatchGetImage",
+            "ecr:GetDownloadUrlForLayer",
+            "ecr:BatchCheckLayerAvailability",
+          ]
+          Resource = ["arn:\${local.partition}:ecr:\${local.region}:*:repository/harness-*"]
+        },
+        {
+          #checkov:skip=CKV_AWS_355:EcrManagedImageToken requires a wildcard resource; ecr:GetAuthorizationToken has no resource-level permission
+          Sid      = "EcrManagedImageToken"
+          Effect   = "Allow"
+          Action   = ["ecr:GetAuthorizationToken"]
+          Resource = ["*"]
+        },
+      ] : [],
+      [
+        # Null Sid/Condition fields are dropped from the rendered policy.
+        for statement in var.additional_execution_role_policy_statements :
+        { for key, value in statement : key => value if value != null }
+    ])
+  })
+}`;
+/**
+ * Every shape the migration rewrites, so a module missing any of them is
+ * reported rather than half-migrated.
+ */ const REQUIRED_SHAPES = [
+    '`variable "model_resource_arns" { $_ }`',
+    '`variable "additional_execution_role_policy_statements" { $_ }`',
+    '`locals { $_ }`',
+    '`resource "aws_iam_role" "execution_role" { $_ }`',
+    '`resource "aws_iam_role_policy" "execution_role" { $_ }`',
+    '`resource "aws_bedrockagentcore_harness" "this" { $_ }`',
+    '`output "execution_role_arn" { $_ }`',
+    // The no-tools-by-default migration runs first, so its assignment is present
+    // and is what the native fields below are anchored on.
+    '`allowed_tools = var.allowed_tools`'
+];
+/**
+ * The baseline policy is replaced whole, so it is only safe to touch when it
+ * still carries exactly the statements the generator wrote. Any addition,
+ * removal or reordering means the user has edited it, and the replacement would
+ * discard that.
+ */ const BASELINE_SIDS = [
+    'BedrockModelInvocation',
+    'EcrPublicTokenAccess',
+    'StsForEcrPublicPull',
+    'XRayTracingAccess',
+    'CloudWatchLogsGroup',
+    'CloudWatchLogsDescribeGroups',
+    'CloudWatchLogsStream',
+    'CloudWatchMetricsPublish',
+    'AgentCoreWorkloadIdentity',
+    'AgentCoreManagedMemory',
+    'AgentCoreBrowserDefault',
+    'AgentCoreCodeInterpreterDefault'
+];
+/**
+ * Whether the module's baseline policy still carries exactly the generated
+ * statements, in order. Sids are read from the whole file: the only other `Sid`
+ * is the `optional(string)` field of the additional-statements variable, which
+ * carries no string literal and so is filtered out.
+ */ const hasUneditedBaselinePolicy = async (tree, filePath)=>{
+    const sids = (await captureAllGritQL(tree, filePath, hcl('`Sid = $sid`'))).map((text)=>/=\s*"([^"]+)"/.exec(text)?.[1]).filter((sid)=>sid !== undefined);
+    return sids.length === BASELINE_SIDS.length && sids.every((sid, index)=>sid === BASELINE_SIDS[index]);
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(TERRAFORM_HARNESS_APP_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform harness modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_HARNESS_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_HARNESS_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a harness app module directory.
+        }
+        if (await matchGritQL(tree, filePath, hcl('`variable "enable_vpc" { $_ }`'))) {
+            continue; // Already migrated.
+        }
+        const shapeChecks = await Promise.all(REQUIRED_SHAPES.map((shape)=>matchGritQL(tree, filePath, hcl(shape))));
+        if (shapeChecks.includes(false) || !await hasUneditedBaselinePolicy(tree, filePath)) {
+            nextSteps.push(divergedMessage(filePath));
+            continue;
+        }
+        // Variables, ahead of the model/role variables they sit beside in the
+        // template.
+        await insertViaGritQL(tree, filePath, hcl(`\`variable "model_resource_arns" { $body }\` => \`${GRIT_INSERT_PLACEHOLDER}\n\nvariable "model_resource_arns" {\n  $body\n}\``), NEW_VARIABLES_TEXT);
+        await insertViaGritQL(tree, filePath, hcl(`\`variable "additional_execution_role_policy_statements" { $body }\` => \`variable "additional_execution_role_policy_statements" {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), VPC_VARIABLES_TEXT);
+        // Locals resolving the role ARN and whether managed memory applies.
+        await insertViaGritQL(tree, filePath, hcl(`\`locals { $body }\` => \`locals {\n  $body\n\n${GRIT_INSERT_PLACEHOLDER}\n}\``), NEW_LOCALS_TEXT);
+        // The role becomes conditional on none being supplied, so it is indexed
+        // wherever it is referenced, and gains the shared tags.
+        await applyGritQL(tree, filePath, hcl('`resource "aws_iam_role" "execution_role" { $body }` => `resource "aws_iam_role" "execution_role" {\n  count = var.create_execution_role ? 1 : 0\n\n  $body\n\n  tags = var.tags\n}`'));
+        // The baseline policy is replaced whole, dropping the managed-memory
+        // statement, which becomes a policy of its own scoped to the assigned ARN.
+        await insertViaGritQL(tree, filePath, hcl(`\`resource "aws_iam_role_policy" "execution_role" { $_ }\` => \`${GRIT_INSERT_PLACEHOLDER}\``), BASELINE_POLICY_TEXT);
+        // The role ARN follows whichever role is in use, and the `allowed_tools`
+        // line the no-tools-by-default migration added is re-aligned with the
+        // native fields that now sit beside it.
+        await applyGritQL(tree, filePath, hcl('`allowed_tools      = var.allowed_tools` => ``'));
+        await insertViaGritQL(tree, filePath, hcl(`\`execution_role_arn = aws_iam_role.execution_role.arn\` => \`execution_role_arn = local.execution_role_arn\n\n${GRIT_INSERT_PLACEHOLDER}\``), HARNESS_FIELDS_TEXT);
+        // Ahead of `depends_on`, which the resource ends with.
+        await insertViaGritQL(tree, filePath, hcl(`\`depends_on = [aws_iam_role_policy.execution_role]\` => \`${GRIT_INSERT_PLACEHOLDER}\n\n  depends_on = [aws_iam_role_policy.execution_role]\``), // The placeholder already sits at the block's indentation.
+        HARNESS_BLOCKS_TEXT.replace(/^ {2}/, ''));
+        // Security group ahead of the Harness resource, and the managed-memory
+        // policy after it, since it reads an attribute of the deployed Harness.
+        // Anchored on the comment introducing the resource so it stays attached.
+        await insertViaGritQL(tree, filePath, hcl(`\`# Omitting authorizer_configuration uses IAM inbound authorization; add a\` => \`${GRIT_INSERT_PLACEHOLDER}\n\n# Omitting authorizer_configuration uses IAM inbound authorization; add a\``), SECURITY_GROUP_TEXT);
+        await insertViaGritQL(tree, filePath, hcl(`\`resource "aws_bedrockagentcore_harness" "this" { $body }\` => \`resource "aws_bedrockagentcore_harness" "this" {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), MANAGED_MEMORY_POLICY_TEXT);
+        // The role ARN output follows whichever role is in use, and the security
+        // group is exposed for ingress rules on resources the Harness reaches.
+        await applyGritQL(tree, filePath, hcl('`output "execution_role_arn" { $_ }` => `output "execution_role_arn" {\n  description = "ARN of the IAM role assumed by the Harness, whether generated or supplied via var.execution_role_arn"\n  value       = local.execution_role_arn\n}`'));
+        await insertViaGritQL(tree, filePath, hcl(`\`output "execution_role_arn" { $body }\` => \`output "execution_role_arn" {\n  $body\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), SECURITY_GROUP_OUTPUT_TEXT);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-harness-vpc-role-and-memory-grant/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-harness-vpc-role-and-memory-grant/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  applyGritQL,\n  captureAllGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Bring each vended Terraform AgentCore Harness app module\n * (`app/harnesses/<name>/<name>.tf`) up to the shape the generator now writes:\n *\n * - `enable_vpc` / `vpc_id` / `subnet_ids` with a security group and a 443-only\n *   egress rule, so the Harness can reach private resources.\n * - `create_execution_role` / `execution_role_arn`, so an existing role can be\n *   supplied. The generated role and its baseline policy are then not created.\n * - `allowed_tools`, `memory`, `environment_variables`, `max_iterations` and\n *   `timeout_seconds` as variables rather than HCL edits.\n * - The managed-memory grant moved to its own policy, made conditional and\n *   re-scoped from a name-prefix guess to the ARN the service assigns.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the older module until this runs. Modules that have diverged from the\n * generated shape are left untouched and reported via `nextSteps`.\n */\n\nconst TERRAFORM_HARNESS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To pick up VPC support, a supplied execution role, the allowed_tools/memory/environment_variables/max_iterations/timeout_seconds variables and the corrected managed-memory grant, compare it against the agentcore-harness generator's Terraform template and apply the parts you want.`;\n\n/**\n * Variables added ahead of the existing `model_resource_arns` variable.\n * `allowed_tools` is not among them: the earlier `agentcore-harness-no-tools-by-default`\n * migration already declares it, and runs first.\n */\nconst NEW_VARIABLES_TEXT = `variable \"memory\" {\n  description = \"Memory configuration for the Harness. Null leaves the service to provision managed memory with default strategies. Set exactly one field: managed_memory_configuration to tune that managed memory, agentcore_memory_configuration to use a memory resource you own, or disabled to turn memory off.\"\n  type = object({\n    managed_memory_configuration = optional(object({\n      strategies            = optional(set(string))\n      event_expiry_duration = optional(number)\n      encryption_key_arn    = optional(string)\n    }))\n    agentcore_memory_configuration = optional(object({\n      arn            = string\n      actor_id       = optional(string)\n      messages_count = optional(number)\n    }))\n    disabled = optional(bool, false)\n  })\n  default = null\n\n  validation {\n    condition = var.memory == null || length([\n      for configured in [\n        var.memory.managed_memory_configuration != null,\n        var.memory.agentcore_memory_configuration != null,\n        var.memory.disabled,\n      ] : configured if configured\n    ]) == 1\n    error_message = \"Set exactly one of memory.managed_memory_configuration, memory.agentcore_memory_configuration or memory.disabled.\"\n  }\n}\n\nvariable \"environment_variables\" {\n  description = \"Environment variables available to the Harness.\"\n  type        = map(string)\n  default     = null\n  sensitive   = true\n}\n\nvariable \"max_iterations\" {\n  description = \"Maximum agent loop iterations per invocation. Uses the service default when null.\"\n  type        = number\n  default     = null\n}\n\nvariable \"timeout_seconds\" {\n  description = \"Maximum seconds an invocation may run. Uses the service default when null.\"\n  type        = number\n  default     = null\n}\n\nvariable \"create_execution_role\" {\n  description = \"Create the execution role with the baseline permissions below. Set false alongside execution_role_arn to use a role you already have, which is then used as-is.\"\n  type        = bool\n  default     = true\n\n  validation {\n    condition     = var.create_execution_role || var.execution_role_arn != null\n    error_message = \"execution_role_arn must be set when create_execution_role is false.\"\n  }\n\n  validation {\n    condition = var.create_execution_role || (\n      var.model_resource_arns == null && length(var.additional_execution_role_policy_statements) == 0\n    )\n    error_message = \"model_resource_arns and additional_execution_role_policy_statements configure the generated execution role, which is not created when create_execution_role is false. Grant those permissions on the supplied role instead.\"\n  }\n}\n\nvariable \"execution_role_arn\" {\n  description = \"ARN of an existing IAM role for the Harness to assume. Requires create_execution_role = false.\"\n  type        = string\n  default     = null\n}`;\n\n/** VPC and tag variables added after `additional_execution_role_policy_statements`. */\nconst VPC_VARIABLES_TEXT = `# VPC Configuration (optional)\nvariable \"enable_vpc\" {\n  description = \"Run the Harness inside a VPC so it can reach private resources. Set alongside vpc_id/subnet_ids.\"\n  type        = bool\n  default     = false\n}\n\nvariable \"vpc_id\" {\n  description = \"VPC ID to run the Harness in. Required when enable_vpc is true.\"\n  type        = string\n  default     = null\n\n  validation {\n    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)\n    error_message = \"vpc_id and subnet_ids must be set when enable_vpc is true.\"\n  }\n}\n\nvariable \"subnet_ids\" {\n  description = \"Subnet IDs to run the Harness in. Required when enable_vpc is true.\"\n  type        = list(string)\n  default     = null\n}\n\nvariable \"tags\" {\n  description = \"Tags to apply to resources\"\n  type        = map(string)\n  default     = {}\n}`;\n\n/** Locals added to the module's existing `locals` block. */\nconst NEW_LOCALS_TEXT = `  execution_role_arn = var.create_execution_role ? aws_iam_role.execution_role[0].arn : var.execution_role_arn\n\n  # The service provisions managed memory unless var.memory redirects it\n  # elsewhere or turns it off.\n  has_managed_memory = var.memory == null || var.memory.managed_memory_configuration != null`;\n\n/** Security group and egress rule, added before the Harness resource. */\nconst SECURITY_GROUP_TEXT = `# Security group for the Harness, used when running inside a VPC\nresource \"aws_security_group\" \"harness\" {\n  count = var.enable_vpc ? 1 : 0\n\n  #checkov:skip=CKV2_AWS_5:Attached to the Harness via its network configuration; Checkov cannot resolve this reference\n  name_prefix = \"\\${local.harness_name_prefix}-harness-\"\n  description = \"Security group for the \\${local.harness_name_prefix} Harness\"\n  vpc_id      = var.vpc_id\n  tags        = var.tags\n}\n\nresource \"aws_vpc_security_group_egress_rule\" \"harness_https\" {\n  count = var.enable_vpc ? 1 : 0\n\n  security_group_id = aws_security_group.harness[0].id\n  cidr_ipv4         = \"0.0.0.0/0\"\n  from_port         = 443\n  to_port           = 443\n  ip_protocol       = \"tcp\"\n  description       = \"Allow outbound HTTPS to AWS service endpoints\"\n}`;\n\n/**\n * Native fields added to the Harness resource. `allowed_tools` is re-emitted\n * here, aligned with the rest, replacing the line the earlier\n * no-tools-by-default migration added.\n */\nconst HARNESS_FIELDS_TEXT = `  allowed_tools         = var.allowed_tools\n  environment_variables = var.environment_variables\n  max_iterations        = var.max_iterations\n  timeout_seconds       = var.timeout_seconds`;\n\nconst HARNESS_BLOCKS_TEXT = `  dynamic \"memory\" {\n    for_each = var.memory != null ? [var.memory] : []\n    content {\n      dynamic \"managed_memory_configuration\" {\n        for_each = memory.value.managed_memory_configuration != null ? [memory.value.managed_memory_configuration] : []\n        content {\n          strategies            = managed_memory_configuration.value.strategies\n          event_expiry_duration = managed_memory_configuration.value.event_expiry_duration\n          encryption_key_arn    = managed_memory_configuration.value.encryption_key_arn\n        }\n      }\n\n      dynamic \"agentcore_memory_configuration\" {\n        for_each = memory.value.agentcore_memory_configuration != null ? [memory.value.agentcore_memory_configuration] : []\n        content {\n          arn            = agentcore_memory_configuration.value.arn\n          actor_id       = agentcore_memory_configuration.value.actor_id\n          messages_count = agentcore_memory_configuration.value.messages_count\n        }\n      }\n\n      dynamic \"disabled\" {\n        for_each = memory.value.disabled ? [1] : []\n        content {}\n      }\n    }\n  }\n\n  dynamic \"environment\" {\n    for_each = var.enable_vpc ? [1] : []\n    content {\n      agentcore_runtime_environment {\n        network_configuration {\n          network_mode = \"VPC\"\n          network_mode_config {\n            security_groups = [aws_security_group.harness[0].id]\n            subnets         = var.subnet_ids\n          }\n        }\n      }\n    }\n  }\n\n  tags = var.tags`;\n\n/** The managed-memory grant, as its own policy scoped to the assigned ARN. */\nconst MANAGED_MEMORY_POLICY_TEXT = `# Scoped to the memory ARN the service assigns, which is only readable after the\n# Harness exists, so this is a policy of its own rather than a baseline\n# statement. Skipped when the Harness uses a role or memory the module did not\n# create.\nresource \"aws_iam_role_policy\" \"managed_memory\" {\n  count = var.create_execution_role && local.has_managed_memory ? 1 : 0\n\n  name = \"\\${local.harness_name_prefix}-HarnessManagedMemoryPolicy\"\n  role = aws_iam_role.execution_role[0].id\n\n  policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [{\n      Sid    = \"AgentCoreManagedMemory\"\n      Effect = \"Allow\"\n      Action = [\n        \"bedrock-agentcore:CreateEvent\",\n        \"bedrock-agentcore:DeleteEvent\",\n        \"bedrock-agentcore:GetEvent\",\n        \"bedrock-agentcore:ListEvents\",\n        \"bedrock-agentcore:RetrieveMemoryRecords\",\n      ]\n      Resource = [\n        aws_bedrockagentcore_harness.this.memory_actual[0].managed_memory_configuration[0].arn,\n      ]\n    }]\n  })\n}`;\n\nconst SECURITY_GROUP_OUTPUT_TEXT = `output \"security_group_id\" {\n  description = \"Security group ID of the Harness, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true.\"\n  value       = var.enable_vpc ? aws_security_group.harness[0].id : null\n}`;\n\n/**\n * The baseline policy, replaced whole: the managed-memory statement leaves it\n * for a policy of its own, and the resource gains a `count`. Rewriting the\n * statement list in place would strand the comment and comma around the\n * statement being removed.\n */\nconst BASELINE_POLICY_TEXT = `resource \"aws_iam_role_policy\" \"execution_role\" {\n  count = var.create_execution_role ? 1 : 0\n\n  name = \"\\${local.harness_name_prefix}-HarnessPolicy\"\n  role = aws_iam_role.execution_role[0].id\n\n  policy = jsonencode({\n    Version = \"2012-10-17\"\n    Statement = concat([\n      {\n        Sid    = \"BedrockModelInvocation\"\n        Effect = \"Allow\"\n        Action = [\n          \"bedrock:InvokeModel\",\n          \"bedrock:InvokeModelWithResponseStream\",\n        ]\n        Resource = local.model_resource_arns\n      },\n      {\n        #checkov:skip=CKV_AWS_355:EcrPublicTokenAccess requires a wildcard resource; ecr-public:GetAuthorizationToken has no resource-level permission\n        Sid      = \"EcrPublicTokenAccess\"\n        Effect   = \"Allow\"\n        Action   = [\"ecr-public:GetAuthorizationToken\"]\n        Resource = [\"*\"]\n      },\n      {\n        #checkov:skip=CKV_AWS_355:StsForEcrPublicPull requires a wildcard resource; sts:GetServiceBearerToken has no resource-level permission\n        Sid      = \"StsForEcrPublicPull\"\n        Effect   = \"Allow\"\n        Action   = [\"sts:GetServiceBearerToken\"]\n        Resource = [\"*\"]\n      },\n      {\n        #checkov:skip=CKV_AWS_355:XRayTracingAccess requires a wildcard resource; the X-Ray segment and sampling APIs have no resource-level permission\n        #checkov:skip=CKV_AWS_290:XRayTracingAccess requires a wildcard resource; the X-Ray segment and sampling APIs have no resource-level permission\n        Sid    = \"XRayTracingAccess\"\n        Effect = \"Allow\"\n        Action = [\n          \"xray:PutTraceSegments\",\n          \"xray:PutTelemetryRecords\",\n          \"xray:GetSamplingRules\",\n          \"xray:GetSamplingTargets\",\n        ]\n        Resource = [\"*\"]\n      },\n      {\n        Sid    = \"CloudWatchLogsGroup\"\n        Effect = \"Allow\"\n        Action = [\n          \"logs:CreateLogGroup\",\n          \"logs:DescribeLogStreams\",\n        ]\n        Resource = [\n          \"arn:\\${local.partition}:logs:\\${local.region}:\\${local.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*\",\n        ]\n      },\n      {\n        Sid      = \"CloudWatchLogsDescribeGroups\"\n        Effect   = \"Allow\"\n        Action   = [\"logs:DescribeLogGroups\"]\n        Resource = [\"arn:\\${local.partition}:logs:\\${local.region}:\\${local.account_id}:log-group:*\"]\n      },\n      {\n        Sid    = \"CloudWatchLogsStream\"\n        Effect = \"Allow\"\n        Action = [\n          \"logs:CreateLogStream\",\n          \"logs:PutLogEvents\",\n        ]\n        Resource = [\n          \"arn:\\${local.partition}:logs:\\${local.region}:\\${local.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*\",\n        ]\n      },\n      {\n        #checkov:skip=CKV_AWS_355:CloudWatchMetricsPublish requires a wildcard resource; cloudwatch:PutMetricData is scoped by the namespace condition instead\n        #checkov:skip=CKV_AWS_290:CloudWatchMetricsPublish requires a wildcard resource; cloudwatch:PutMetricData is scoped by the namespace condition instead\n        Sid      = \"CloudWatchMetricsPublish\"\n        Effect   = \"Allow\"\n        Action   = [\"cloudwatch:PutMetricData\"]\n        Resource = [\"*\"]\n        Condition = {\n          StringEquals = {\n            \"cloudwatch:namespace\" = \"bedrock-agentcore\"\n          }\n        }\n      },\n      {\n        Sid    = \"AgentCoreWorkloadIdentity\"\n        Effect = \"Allow\"\n        Action = [\n          \"bedrock-agentcore:GetWorkloadAccessToken\",\n          \"bedrock-agentcore:GetWorkloadAccessTokenForJWT\",\n        ]\n        Resource = [\n          \"arn:\\${local.partition}:bedrock-agentcore:\\${local.region}:\\${local.account_id}:workload-identity-directory/default\",\n          \"arn:\\${local.partition}:bedrock-agentcore:\\${local.region}:\\${local.account_id}:workload-identity-directory/default/workload-identity/harness_\\${local.harness_name}-*\",\n        ]\n      },\n      {\n        Sid    = \"AgentCoreBrowserDefault\"\n        Effect = \"Allow\"\n        Action = [\n          \"bedrock-agentcore:StartBrowserSession\",\n          \"bedrock-agentcore:StopBrowserSession\",\n          \"bedrock-agentcore:GetBrowserSession\",\n          \"bedrock-agentcore:ListBrowserSessions\",\n          \"bedrock-agentcore:UpdateBrowserStream\",\n          \"bedrock-agentcore:ConnectBrowserAutomationStream\",\n          \"bedrock-agentcore:ConnectBrowserLiveViewStream\",\n        ]\n        Resource = [\n          \"arn:\\${local.partition}:bedrock-agentcore:\\${local.region}:aws:browser/*\",\n        ]\n      },\n      {\n        Sid    = \"AgentCoreCodeInterpreterDefault\"\n        Effect = \"Allow\"\n        Action = [\n          \"bedrock-agentcore:StartCodeInterpreterSession\",\n          \"bedrock-agentcore:StopCodeInterpreterSession\",\n          \"bedrock-agentcore:GetCodeInterpreterSession\",\n          \"bedrock-agentcore:ListCodeInterpreterSessions\",\n          \"bedrock-agentcore:InvokeCodeInterpreter\",\n        ]\n        Resource = [\n          \"arn:\\${local.partition}:bedrock-agentcore:\\${local.region}:aws:code-interpreter/*\",\n        ]\n      },\n      ],\n      # In VPC mode the Harness pulls its managed container from a private ECR\n      # repository in the region rather than ECR Public, so it needs pull\n      # permissions on it. The repository is service-owned, hence the wildcard\n      # account.\n      var.enable_vpc ? [\n        {\n          Sid    = \"EcrManagedImagePull\"\n          Effect = \"Allow\"\n          Action = [\n            \"ecr:BatchGetImage\",\n            \"ecr:GetDownloadUrlForLayer\",\n            \"ecr:BatchCheckLayerAvailability\",\n          ]\n          Resource = [\"arn:\\${local.partition}:ecr:\\${local.region}:*:repository/harness-*\"]\n        },\n        {\n          #checkov:skip=CKV_AWS_355:EcrManagedImageToken requires a wildcard resource; ecr:GetAuthorizationToken has no resource-level permission\n          Sid      = \"EcrManagedImageToken\"\n          Effect   = \"Allow\"\n          Action   = [\"ecr:GetAuthorizationToken\"]\n          Resource = [\"*\"]\n        },\n      ] : [],\n      [\n        # Null Sid/Condition fields are dropped from the rendered policy.\n        for statement in var.additional_execution_role_policy_statements :\n        { for key, value in statement : key => value if value != null }\n    ])\n  })\n}`;\n\n/**\n * Every shape the migration rewrites, so a module missing any of them is\n * reported rather than half-migrated.\n */\nconst REQUIRED_SHAPES = [\n  '`variable \"model_resource_arns\" { $_ }`',\n  '`variable \"additional_execution_role_policy_statements\" { $_ }`',\n  '`locals { $_ }`',\n  '`resource \"aws_iam_role\" \"execution_role\" { $_ }`',\n  '`resource \"aws_iam_role_policy\" \"execution_role\" { $_ }`',\n  '`resource \"aws_bedrockagentcore_harness\" \"this\" { $_ }`',\n  '`output \"execution_role_arn\" { $_ }`',\n  // The no-tools-by-default migration runs first, so its assignment is present\n  // and is what the native fields below are anchored on.\n  '`allowed_tools = var.allowed_tools`',\n];\n\n/**\n * The baseline policy is replaced whole, so it is only safe to touch when it\n * still carries exactly the statements the generator wrote. Any addition,\n * removal or reordering means the user has edited it, and the replacement would\n * discard that.\n */\nconst BASELINE_SIDS = [\n  'BedrockModelInvocation',\n  'EcrPublicTokenAccess',\n  'StsForEcrPublicPull',\n  'XRayTracingAccess',\n  'CloudWatchLogsGroup',\n  'CloudWatchLogsDescribeGroups',\n  'CloudWatchLogsStream',\n  'CloudWatchMetricsPublish',\n  'AgentCoreWorkloadIdentity',\n  'AgentCoreManagedMemory',\n  'AgentCoreBrowserDefault',\n  'AgentCoreCodeInterpreterDefault',\n];\n\n/**\n * Whether the module's baseline policy still carries exactly the generated\n * statements, in order. Sids are read from the whole file: the only other `Sid`\n * is the `optional(string)` field of the additional-statements variable, which\n * carries no string literal and so is filtered out.\n */\nconst hasUneditedBaselinePolicy = async (\n  tree: Tree,\n  filePath: string,\n): Promise<boolean> => {\n  const sids = (await captureAllGritQL(tree, filePath, hcl('`Sid = $sid`')))\n    .map((text) => /=\\s*\"([^\"]+)\"/.exec(text)?.[1])\n    .filter((sid): sid is string => sid !== undefined);\n  return (\n    sids.length === BASELINE_SIDS.length &&\n    sids.every((sid, index) => sid === BASELINE_SIDS[index])\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_HARNESS_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform harness modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_HARNESS_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_HARNESS_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a harness app module directory.\n    }\n\n    if (\n      await matchGritQL(tree, filePath, hcl('`variable \"enable_vpc\" { $_ }`'))\n    ) {\n      continue; // Already migrated.\n    }\n\n    const shapeChecks = await Promise.all(\n      REQUIRED_SHAPES.map((shape) => matchGritQL(tree, filePath, hcl(shape))),\n    );\n    if (\n      shapeChecks.includes(false) ||\n      !(await hasUneditedBaselinePolicy(tree, filePath))\n    ) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    // Variables, ahead of the model/role variables they sit beside in the\n    // template.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`variable \"model_resource_arns\" { $body }\\` => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\nvariable \"model_resource_arns\" {\\n  $body\\n}\\``,\n      ),\n      NEW_VARIABLES_TEXT,\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`variable \"additional_execution_role_policy_statements\" { $body }\\` => \\`variable \"additional_execution_role_policy_statements\" {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      VPC_VARIABLES_TEXT,\n    );\n\n    // Locals resolving the role ARN and whether managed memory applies.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`locals { $body }\\` => \\`locals {\\n  $body\\n\\n${GRIT_INSERT_PLACEHOLDER}\\n}\\``,\n      ),\n      NEW_LOCALS_TEXT,\n    );\n\n    // The role becomes conditional on none being supplied, so it is indexed\n    // wherever it is referenced, and gains the shared tags.\n    await applyGritQL(\n      tree,\n      filePath,\n      hcl(\n        '`resource \"aws_iam_role\" \"execution_role\" { $body }` => `resource \"aws_iam_role\" \"execution_role\" {\\n  count = var.create_execution_role ? 1 : 0\\n\\n  $body\\n\\n  tags = var.tags\\n}`',\n      ),\n    );\n\n    // The baseline policy is replaced whole, dropping the managed-memory\n    // statement, which becomes a policy of its own scoped to the assigned ARN.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`resource \"aws_iam_role_policy\" \"execution_role\" { $_ }\\` => \\`${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      BASELINE_POLICY_TEXT,\n    );\n\n    // The role ARN follows whichever role is in use, and the `allowed_tools`\n    // line the no-tools-by-default migration added is re-aligned with the\n    // native fields that now sit beside it.\n    await applyGritQL(\n      tree,\n      filePath,\n      hcl('`allowed_tools      = var.allowed_tools` => ``'),\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`execution_role_arn = aws_iam_role.execution_role.arn\\` => \\`execution_role_arn = local.execution_role_arn\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      HARNESS_FIELDS_TEXT,\n    );\n    // Ahead of `depends_on`, which the resource ends with.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`depends_on = [aws_iam_role_policy.execution_role]\\` => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\n  depends_on = [aws_iam_role_policy.execution_role]\\``,\n      ),\n      // The placeholder already sits at the block's indentation.\n      HARNESS_BLOCKS_TEXT.replace(/^ {2}/, ''),\n    );\n\n    // Security group ahead of the Harness resource, and the managed-memory\n    // policy after it, since it reads an attribute of the deployed Harness.\n    // Anchored on the comment introducing the resource so it stays attached.\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`# Omitting authorizer_configuration uses IAM inbound authorization; add a\\` => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\n# Omitting authorizer_configuration uses IAM inbound authorization; add a\\``,\n      ),\n      SECURITY_GROUP_TEXT,\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`resource \"aws_bedrockagentcore_harness\" \"this\" { $body }\\` => \\`resource \"aws_bedrockagentcore_harness\" \"this\" {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      MANAGED_MEMORY_POLICY_TEXT,\n    );\n\n    // The role ARN output follows whichever role is in use, and the security\n    // group is exposed for ingress rules on resources the Harness reaches.\n    await applyGritQL(\n      tree,\n      filePath,\n      hcl(\n        '`output \"execution_role_arn\" { $_ }` => `output \"execution_role_arn\" {\\n  description = \"ARN of the IAM role assumed by the Harness, whether generated or supplied via var.execution_role_arn\"\\n  value       = local.execution_role_arn\\n}`',\n      ),\n    );\n    await insertViaGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`output \"execution_role_arn\" { $body }\\` => \\`output \"execution_role_arn\" {\\n  $body\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n      ),\n      SECURITY_GROUP_OUTPUT_TEXT,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","captureAllGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_HARNESS_APP_DIR","hcl","pattern","divergedMessage","filePath","NEW_VARIABLES_TEXT","VPC_VARIABLES_TEXT","NEW_LOCALS_TEXT","SECURITY_GROUP_TEXT","HARNESS_FIELDS_TEXT","HARNESS_BLOCKS_TEXT","MANAGED_MEMORY_POLICY_TEXT","SECURITY_GROUP_OUTPUT_TEXT","BASELINE_POLICY_TEXT","REQUIRED_SHAPES","BASELINE_SIDS","hasUneditedBaselinePolicy","tree","sids","map","text","exec","filter","sid","undefined","length","every","index","migration","nextSteps","exists","dirName","children","shapeChecks","Promise","all","shape","includes","push","replace"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,WAAW,EACXC,gBAAgB,EAChBC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;CAgBC,GAED,MAAMC,4BAA4B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,kBAAkB,CAAC;AAE7F,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,kVAAkV,CAAC;AAEjW;;;;CAIC,GACD,MAAMC,qBAAqB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsE3B,CAAC;AAEF,qFAAqF,GACrF,MAAMC,qBAAqB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4B3B,CAAC;AAEF,0DAA0D,GAC1D,MAAMC,kBAAkB,CAAC;;;;4FAImE,CAAC;AAE7F,uEAAuE,GACvE,MAAMC,sBAAsB,CAAC;;;;;;;;;;;;;;;;;;;;CAoB5B,CAAC;AAEF;;;;CAIC,GACD,MAAMC,sBAAsB,CAAC;;;6CAGgB,CAAC;AAE9C,MAAMC,sBAAsB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CZ,CAAC;AAElB,4EAA4E,GAC5E,MAAMC,6BAA6B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BnC,CAAC;AAEF,MAAMC,6BAA6B,CAAC;;;CAGnC,CAAC;AAEF;;;;;CAKC,GACD,MAAMC,uBAAuB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8J7B,CAAC;AAEF;;;CAGC,GACD,MAAMC,kBAAkB;IACtB;IACA;IACA;IACA;IACA;IACA;IACA;IACA,6EAA6E;IAC7E,uDAAuD;IACvD;CACD;AAED;;;;;CAKC,GACD,MAAMC,gBAAgB;IACpB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;CAKC,GACD,MAAMC,4BAA4B,OAChCC,MACAb;IAEA,MAAMc,OAAO,AAAC,CAAA,MAAMzB,iBAAiBwB,MAAMb,UAAUH,IAAI,gBAAe,EACrEkB,GAAG,CAAC,CAACC,OAAS,gBAAgBC,IAAI,CAACD,OAAO,CAAC,EAAE,EAC7CE,MAAM,CAAC,CAACC,MAAuBA,QAAQC;IAC1C,OACEN,KAAKO,MAAM,KAAKV,cAAcU,MAAM,IACpCP,KAAKQ,KAAK,CAAC,CAACH,KAAKI,QAAUJ,QAAQR,aAAa,CAACY,MAAM;AAE3D;AAEA,eAAe,eAAeC,UAC5BX,IAAU;IAEV,MAAMY,YAAsB,EAAE;IAE9B,IAAI,CAACZ,KAAKa,MAAM,CAAC9B,4BAA4B;QAC3C,OAAO;YAAE6B;QAAU,GAAG,mDAAmD;IAC3E;IAEA,KAAK,MAAME,WAAWd,KAAKe,QAAQ,CAAChC,2BAA4B;QAC9D,MAAMI,WAAWb,kBACfS,2BACA+B,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACd,KAAKa,MAAM,CAAC1B,WAAW;YAC1B,UAAU,sCAAsC;QAClD;QAEA,IACE,MAAMR,YAAYqB,MAAMb,UAAUH,IAAI,oCACtC;YACA,UAAU,oBAAoB;QAChC;QAEA,MAAMgC,cAAc,MAAMC,QAAQC,GAAG,CACnCrB,gBAAgBK,GAAG,CAAC,CAACiB,QAAUxC,YAAYqB,MAAMb,UAAUH,IAAImC;QAEjE,IACEH,YAAYI,QAAQ,CAAC,UACrB,CAAE,MAAMrB,0BAA0BC,MAAMb,WACxC;YACAyB,UAAUS,IAAI,CAACnC,gBAAgBC;YAC/B;QACF;QAEA,sEAAsE;QACtE,YAAY;QACZ,MAAMT,gBACJsB,MACAb,UACAH,IACE,CAAC,kDAAkD,EAAEP,wBAAwB,kDAAkD,CAAC,GAElIW;QAEF,MAAMV,gBACJsB,MACAb,UACAH,IACE,CAAC,kJAAkJ,EAAEP,wBAAwB,EAAE,CAAC,GAElLY;QAGF,oEAAoE;QACpE,MAAMX,gBACJsB,MACAb,UACAH,IACE,CAAC,+CAA+C,EAAEP,wBAAwB,KAAK,CAAC,GAElFa;QAGF,wEAAwE;QACxE,wDAAwD;QACxD,MAAMf,YACJyB,MACAb,UACAH,IACE;QAIJ,qEAAqE;QACrE,2EAA2E;QAC3E,MAAMN,gBACJsB,MACAb,UACAH,IACE,CAAC,gEAAgE,EAAEP,wBAAwB,EAAE,CAAC,GAEhGmB;QAGF,yEAAyE;QACzE,sEAAsE;QACtE,wCAAwC;QACxC,MAAMrB,YACJyB,MACAb,UACAH,IAAI;QAEN,MAAMN,gBACJsB,MACAb,UACAH,IACE,CAAC,+GAA+G,EAAEP,wBAAwB,EAAE,CAAC,GAE/Ie;QAEF,uDAAuD;QACvD,MAAMd,gBACJsB,MACAb,UACAH,IACE,CAAC,2DAA2D,EAAEP,wBAAwB,yDAAyD,CAAC,GAElJ,2DAA2D;QAC3DgB,oBAAoB6B,OAAO,CAAC,SAAS;QAGvC,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM5C,gBACJsB,MACAb,UACAH,IACE,CAAC,mFAAmF,EAAEP,wBAAwB,+EAA+E,CAAC,GAEhMc;QAEF,MAAMb,gBACJsB,MACAb,UACAH,IACE,CAAC,kIAAkI,EAAEP,wBAAwB,EAAE,CAAC,GAElKiB;QAGF,yEAAyE;QACzE,uEAAuE;QACvE,MAAMnB,YACJyB,MACAb,UACAH,IACE;QAGJ,MAAMN,gBACJsB,MACAb,UACAH,IACE,CAAC,4FAA4F,EAAEP,wBAAwB,EAAE,CAAC,GAE5HkB;IAEJ;IAEA,MAAMf,qBAAqBoB;IAE3B,OAAO;QAAEY;IAAU;AACrB"}