@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.84

package/src/trpc/backend/__snapshots__/generator.spec.ts.snap

@@ -3420,10 +3420,18 @@ output "api_log_group_arn" {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 
@@ -4162,10 +4170,18 @@ output "api_log_group_arn" {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 
@@ -4976,10 +4992,18 @@ output "api_log_group_arn" {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 
@@ -5643,22 +5667,75 @@ resource "aws_wafv2_web_acl" "api_waf" {
   }
 }
 
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+locals {
+  waf_log_group_name = var.enable_waf ? "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}" : null
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "\${var.api_name} API WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/\${var.api_name}-\${random_id.waf_log_suffix[0].hex}-waf-logs"
+  target_key_id = aws_kms_key.waf_logs[0].key_id
+}
+
 # CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
 resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
+  name              = local.waf_log_group_name
   retention_in_days = 30
+  kms_key_id        = aws_kms_key.waf_logs[0].arn
   tags              = var.tags
 }
 
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
 resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
   count = var.enable_waf ? 1 : 0
 
@@ -5704,10 +5781,18 @@ output "waf_web_acl_arn" {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 
@@ -6280,7 +6365,7 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "TestApi" = aws_api_gateway_stage.api_stage.invoke_url }
+  value     = { "TestApi" = "\${aws_api_gateway_stage.api_stage.invoke_url}/" }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }
@@ -6619,22 +6704,75 @@ resource "aws_wafv2_web_acl" "api_waf" {
   }
 }
 
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+locals {
+  waf_log_group_name = var.enable_waf ? "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}" : null
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "\${var.api_name} API WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/\${var.api_name}-\${random_id.waf_log_suffix[0].hex}-waf-logs"
+  target_key_id = aws_kms_key.waf_logs[0].key_id
+}
+
 # CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
 resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
+  name              = local.waf_log_group_name
   retention_in_days = 30
+  kms_key_id        = aws_kms_key.waf_logs[0].arn
   tags              = var.tags
 }
 
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
 resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
   count = var.enable_waf ? 1 : 0
 
@@ -6680,10 +6818,18 @@ output "waf_web_acl_arn" {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 
@@ -7245,7 +7391,7 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "TestApi" = aws_api_gateway_stage.api_stage.invoke_url }
+  value     = { "TestApi" = "\${aws_api_gateway_stage.api_stage.invoke_url}/" }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }
@@ -7584,22 +7730,75 @@ resource "aws_wafv2_web_acl" "api_waf" {
   }
 }
 
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+locals {
+  waf_log_group_name = var.enable_waf ? "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}" : null
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "\${var.api_name} API WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/\${var.api_name}-\${random_id.waf_log_suffix[0].hex}-waf-logs"
+  target_key_id = aws_kms_key.waf_logs[0].key_id
+}
+
 # CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
 resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
+  name              = local.waf_log_group_name
   retention_in_days = 30
+  kms_key_id        = aws_kms_key.waf_logs[0].arn
   tags              = var.tags
 }
 
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
 resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
   count = var.enable_waf ? 1 : 0
 
@@ -7645,10 +7844,18 @@ output "waf_web_acl_arn" {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 
@@ -8293,7 +8500,7 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "TestApi" = aws_api_gateway_stage.api_stage.invoke_url }
+  value     = { "TestApi" = "\${aws_api_gateway_stage.api_stage.invoke_url}/" }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -982,6 +982,10 @@ export * from './workspace.js';
 exports[`ts#agent generator > should match snapshot for Terraform generated files > terraform-agent.tf 1`] = `
 "terraform {
   required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.61.0"
+    }
     random = {
       source  = "hashicorp/random"
       version = "3.9.0"
@@ -1293,6 +1297,10 @@ exports[`ts#agent generator > should match snapshot for Terraform generated file
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"

package/src/ts/dcr-proxy/__snapshots__/generator.spec.ts.snap

@@ -585,6 +585,10 @@ terraform {
       source  = "hashicorp/archive"
       version = "2.8.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 

package/src/ts/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -147,6 +147,10 @@ exports[`ts-lambda-function generator > terraform iac > should generate terrafor
       source  = "hashicorp/archive"
       version = "2.8.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 
@@ -328,6 +332,10 @@ exports[`ts-lambda-function generator > terraform iac > should match snapshot fo
       source  = "hashicorp/archive"
       version = "2.8.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -157,6 +157,10 @@ exports[`ts#mcp-server generator > should match snapshot for Terraform generated
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -539,6 +539,20 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enablePerformanceInsights?: boolean;
+
+  /**
+   * Minimum Aurora Serverless v2 ACUs.
+   *
+   * @default 0.5
+   */
+  readonly serverlessV2MinCapacity?: number;
+
+  /**
+   * Maximum Aurora Serverless v2 ACUs.
+   *
+   * @default 4
+   */
+  readonly serverlessV2MaxCapacity?: number;
 }
 
 /**
@@ -568,6 +582,8 @@ export abstract class AuroraDatabase extends Construct {
       enableKeyRotation = true,
       enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
+      serverlessV2MinCapacity = 0.5,
+      serverlessV2MaxCapacity = 4,
       engine,
       engineVersion,
       ...clusterProps
@@ -583,6 +599,8 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
+      serverlessV2MinCapacity,
+      serverlessV2MaxCapacity,
       writer:
         writer ??
         ClusterInstance.serverlessV2('writer', {
@@ -1562,6 +1580,10 @@ exports[`ts#rdb generator > should generate terraform modules when iac is Terraf
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"
@@ -1643,9 +1665,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -1666,6 +1688,12 @@ variable "enable_backup" {
   default     = false
 }
 
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
 variable "tags" {
   description = "Tags to apply to all resources."
   type        = map(string)
@@ -1725,6 +1753,7 @@ module "aurora" {
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
   enable_backup                         = var.enable_backup
+  enable_key_rotation                   = var.enable_key_rotation
   tags                                  = var.tags
 }
 
@@ -3054,6 +3083,10 @@ exports[`ts#rdb generator > should generate terraform modules with MySQL engine
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"
@@ -3135,9 +3168,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -3158,6 +3191,12 @@ variable "enable_backup" {
   default     = false
 }
 
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
 variable "tags" {
   description = "Tags to apply to all resources."
   type        = map(string)
@@ -3217,6 +3256,7 @@ module "aurora" {
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
   enable_backup                         = var.enable_backup
+  enable_key_rotation                   = var.enable_key_rotation
   tags                                  = var.tags
 }
 
@@ -4344,6 +4384,20 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enablePerformanceInsights?: boolean;
+
+  /**
+   * Minimum Aurora Serverless v2 ACUs.
+   *
+   * @default 0.5
+   */
+  readonly serverlessV2MinCapacity?: number;
+
+  /**
+   * Maximum Aurora Serverless v2 ACUs.
+   *
+   * @default 4
+   */
+  readonly serverlessV2MaxCapacity?: number;
 }
 
 /**
@@ -4373,6 +4427,8 @@ export abstract class AuroraDatabase extends Construct {
       enableKeyRotation = true,
       enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
+      serverlessV2MinCapacity = 0.5,
+      serverlessV2MaxCapacity = 4,
       engine,
       engineVersion,
       ...clusterProps
@@ -4388,6 +4444,8 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
+      serverlessV2MinCapacity,
+      serverlessV2MaxCapacity,
       writer:
         writer ??
         ClusterInstance.serverlessV2('writer', {

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -134,6 +134,10 @@ exports[`react-website generator > TailwindCSS integration > terraform iac > sho
       version = "6.61.0"
       configuration_aliases = [aws.us_east_1]
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "3.3.1"
+    }
     random = {
       source  = "hashicorp/random"
       version = "3.9.0"

package/src/ts/react-website/cognito-auth/__snapshots__/generator.spec.ts.snap

@@ -118,6 +118,8 @@ import {
   CfnWebACLAssociation,
 } from 'aws-cdk-lib/aws-wafv2';
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
@@ -354,18 +356,43 @@ export class UserIdentity extends Construct {
       webAclArn: webAcl.attrArn,
     });
 
-    // Send WAF request logs to CloudWatch. The log group name must start with
-    // \`aws-waf-logs-\` to satisfy the WAFv2 logging destination requirement.
+    // The log group name must start with \`aws-waf-logs-\` to satisfy the WAFv2
+    // logging destination requirement.
+    const stack = Stack.of(this);
+    const wafLogGroupName = \`aws-waf-logs-\${id}-\${this.node.addr.slice(-8)}\`;
+
+    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [
+          new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
+        ],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnEquals: {
+            'kms:EncryptionContext:aws:logs:arn': \`arn:aws:logs:\${stack.region}:\${stack.account}:log-group:\${wafLogGroupName}\`,
+          },
+        },
+      }),
+    );
+
     const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
-      logGroupName: \`aws-waf-logs-\${id}-\${this.node.addr.slice(-8)}\`,
+      logGroupName: wafLogGroupName,
       retention: RetentionDays.ONE_MONTH,
+      encryptionKey: logsKey,
       removalPolicy: RemovalPolicy.DESTROY,
     });
-    suppressRules(
-      wafLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption for WAF logs',
-    );
 
     new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
       resourceArn: webAcl.attrArn,

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -8,6 +8,10 @@ exports[`cognito-auth generator terraform iac > should generate terraform files
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "3.3.1"
+    }
   }
 }