@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.84

package/src/utils/agent-core-constructs/files/cdk/app/agentcore-harness/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -35,7 +35,10 @@ export interface <%- nameClassName %>Props
   executionRole?: iam.IRole;
   /** Model resources the generated execution role may invoke. */
   modelResourceArns?: string[];
-  /** Tools the Harness may use. Deploys with none unless supplied here. */
+  /**
+   * Tools the Harness may use. Defaults to none; pass `['@builtin']` for every
+   * built-in tool, or name individual tools.
+   */
   allowedTools?: agentcore.CfnHarnessProps['allowedTools'];
   /**
    * Run the Harness in a VPC so it can reach private resources. Selects private
@@ -68,6 +71,9 @@ export class <%- nameClassName %>
         `arn:${stack.partition}:bedrock:*::foundation-model/*`,
         `arn:${stack.partition}:bedrock:${stack.region}:${stack.account}:*`,
       ],
+      // The service treats an absent allowedTools as every tool, so this
+      // defaults to none and is always passed explicitly.
+      allowedTools = [],
       vpc,
       vpcSubnets,
       securityGroups,
@@ -137,6 +143,29 @@ export class <%- nameClassName %>
           actions: ['sts:GetServiceBearerToken'],
           resources: ['*'],
         }),
+        // In a VPC the Harness pulls its managed container from a private ECR
+        // repository in the region rather than ECR Public. The repository is
+        // service-owned, hence the wildcard account.
+        ...(vpc
+          ? [
+              new iam.PolicyStatement({
+                sid: 'EcrManagedImagePull',
+                actions: [
+                  'ecr:BatchGetImage',
+                  'ecr:GetDownloadUrlForLayer',
+                  'ecr:BatchCheckLayerAvailability',
+                ],
+                resources: [
+                  `arn:${stack.partition}:ecr:${stack.region}:*:repository/harness-*`,
+                ],
+              }),
+              new iam.PolicyStatement({
+                sid: 'EcrManagedImageToken',
+                actions: ['ecr:GetAuthorizationToken'],
+                resources: ['*'],
+              }),
+            ]
+          : []),
         new iam.PolicyStatement({
           sid: 'XRayTracingAccess',
           actions: [
@@ -239,6 +268,14 @@ export class <%- nameClassName %>
         'XRayTracingAccess: X-Ray segment and sampling APIs have no resource-level permission.',
         isPolicy,
       );
+      if (vpc) {
+        suppressRules(
+          this.executionRole,
+          WILDCARD_IAM_RULES,
+          'EcrManagedImageToken: ecr:GetAuthorizationToken has no resource-level permission.',
+          isPolicy,
+        );
+      }
     }
 
     // Rendered lazily so security groups added through `connections` after
@@ -281,6 +318,7 @@ export class <%- nameClassName %>
       },
       systemPrompt: [{ text: systemPrompt }],
       ...harnessProps,
+      allowedTools,
       // Set after harnessProps so the deployed name always matches the
       // execution role's workload-identity resource pattern.
       harnessName,

package/src/utils/agent-core-constructs/files/terraform/app/agent-core/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -1,11 +1,18 @@
 <%_ const hasSessionBucket = session === 's3' || session === 'dynamodb-s3'; _%>
-<%_ if (hasSessionBucket) { _%>
+<%_ const usesAws = hasSessionBucket || auth === 'cognito'; _%>
+<%_ if (usesAws) { _%>
 terraform {
   required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+<%_ if (hasSessionBucket) { _%>
     random = {
       source  = "hashicorp/random"
       version = "<%- randomProviderVersion %>"
     }
+<%_ } _%>
   }
 }
 

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -11,6 +11,12 @@ terraform {
       source  = "hashicorp/external"
       version = "<%- externalProviderVersion %>"
     }
+<%_ } _%>
+<%_ if (protocol === 'mcp') { _%>
+    null = {
+      source  = "hashicorp/null"
+      version = "<%- nullProviderVersion %>"
+    }
 <%_ } _%>
     time = {
       source  = "hashicorp/time"
@@ -76,6 +82,8 @@ locals {
 <%_ if (cedarPolicy) { _%>
   policies_dir   = "${path.module}/../../../../../../../<%- projectDirectory %>/policies"
 <%_ } _%>
+
+  gateway_waf_log_group_name = var.enable_waf ? "aws-waf-logs-<%- nameKebabCase %>-${random_id.unique_suffix.hex}" : null
 }
 
 resource "random_id" "unique_suffix" {
@@ -320,14 +328,61 @@ resource "aws_wafv2_web_acl_association" "gateway_waf" {
   web_acl_arn  = aws_wafv2_web_acl.gateway_waf[0].arn
 }
 
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "<%- nameClassName %> gateway WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${local.aws_account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.${local.aws_region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${local.aws_region}:${local.aws_account_id}:log-group:${local.gateway_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/<%- nameKebabCase %>-${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.gateway_waf_logs[0].key_id
+}
+
 # WAF request logs. WAFv2 requires the `aws-waf-logs-` name prefix.
 resource "aws_cloudwatch_log_group" "gateway_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one year which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-<%- nameKebabCase %>-${random_id.unique_suffix.hex}"
+  name              = local.gateway_waf_log_group_name
   retention_in_days = 365
+  kms_key_id        = aws_kms_key.gateway_waf_logs[0].arn
 }
 
 resource "aws_wafv2_web_acl_logging_configuration" "gateway_waf_logging" {

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-harness/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -19,6 +19,84 @@ variable "model_id" {
   default     = "global.anthropic.claude-sonnet-4-6"
 }
 
+variable "allowed_tools" {
+  description = "Tools the Harness may use. Defaults to none; set [\"@builtin\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool."
+  type        = list(string)
+  default     = []
+}
+
+variable "memory" {
+  description = "Memory configuration for the Harness. Null leaves the service to provision managed memory with default strategies. Set exactly one field: managed_memory_configuration to tune that managed memory, agentcore_memory_configuration to use a memory resource you own, or disabled to turn memory off."
+  type = object({
+    managed_memory_configuration = optional(object({
+      strategies            = optional(set(string))
+      event_expiry_duration = optional(number)
+      encryption_key_arn    = optional(string)
+    }))
+    agentcore_memory_configuration = optional(object({
+      arn            = string
+      actor_id       = optional(string)
+      messages_count = optional(number)
+    }))
+    disabled = optional(bool, false)
+  })
+  default = null
+
+  validation {
+    condition = var.memory == null || length([
+      for configured in [
+        var.memory.managed_memory_configuration != null,
+        var.memory.agentcore_memory_configuration != null,
+        var.memory.disabled,
+      ] : configured if configured
+    ]) == 1
+    error_message = "Set exactly one of memory.managed_memory_configuration, memory.agentcore_memory_configuration or memory.disabled."
+  }
+}
+
+variable "environment_variables" {
+  description = "Environment variables available to the Harness."
+  type        = map(string)
+  default     = null
+  sensitive   = true
+}
+
+variable "max_iterations" {
+  description = "Maximum agent loop iterations per invocation. Uses the service default when null."
+  type        = number
+  default     = null
+}
+
+variable "timeout_seconds" {
+  description = "Maximum seconds an invocation may run. Uses the service default when null."
+  type        = number
+  default     = null
+}
+
+variable "create_execution_role" {
+  description = "Create the execution role with the baseline permissions below. Set false alongside execution_role_arn to use a role you already have, which is then used as-is."
+  type        = bool
+  default     = true
+
+  validation {
+    condition     = var.create_execution_role || var.execution_role_arn != null
+    error_message = "execution_role_arn must be set when create_execution_role is false."
+  }
+
+  validation {
+    condition = var.create_execution_role || (
+      var.model_resource_arns == null && length(var.additional_execution_role_policy_statements) == 0
+    )
+    error_message = "model_resource_arns and additional_execution_role_policy_statements configure the generated execution role, which is not created when create_execution_role is false. Grant those permissions on the supplied role instead."
+  }
+}
+
+variable "execution_role_arn" {
+  description = "ARN of an existing IAM role for the Harness to assume. Requires create_execution_role = false."
+  type        = string
+  default     = null
+}
+
 variable "model_resource_arns" {
   description = "Bedrock model and inference-profile ARNs the execution role may invoke. Defaults to every foundation model plus this account's Bedrock resources in the deployment region; replace with narrower ARNs to restrict baseline model access."
   type        = set(string)
@@ -37,6 +115,36 @@ variable "additional_execution_role_policy_statements" {
   default = []
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Run the Harness inside a VPC so it can reach private resources. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to run the Harness in. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to run the Harness in. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
+variable "tags" {
+  description = "Tags to apply to resources"
+  type        = map(string)
+  default     = {}
+}
+
 data "aws_caller_identity" "current" {}
 data "aws_partition" "current" {}
 data "aws_region" "current" {}
@@ -60,9 +168,17 @@ locals {
     "arn:${local.partition}:bedrock:*::foundation-model/*",
     "arn:${local.partition}:bedrock:${local.region}:${local.account_id}:*",
   ]
+
+  execution_role_arn = var.create_execution_role ? aws_iam_role.execution_role[0].arn : var.execution_role_arn
+
+  # The service provisions managed memory unless var.memory redirects it
+  # elsewhere or turns it off.
+  has_managed_memory = var.memory == null || var.memory.managed_memory_configuration != null
 }
 
 resource "aws_iam_role" "execution_role" {
+  count = var.create_execution_role ? 1 : 0
+
   name = "${local.harness_name_prefix}-HarnessRole-${random_id.unique_suffix.hex}"
 
   assume_role_policy = jsonencode({
@@ -83,14 +199,18 @@ resource "aws_iam_role" "execution_role" {
       }
     }]
   })
+
+  tags = var.tags
 }
 
 # Baseline permissions per the AgentCore Harness security guidance; extend for
 # customer-owned resources via var.additional_execution_role_policy_statements.
 # https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-security.html
 resource "aws_iam_role_policy" "execution_role" {
+  count = var.create_execution_role ? 1 : 0
+
   name = "${local.harness_name_prefix}-HarnessPolicy"
-  role = aws_iam_role.execution_role.id
+  role = aws_iam_role.execution_role[0].id
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -184,22 +304,6 @@ resource "aws_iam_role_policy" "execution_role" {
           "arn:${local.partition}:bedrock-agentcore:${local.region}:${local.account_id}:workload-identity-directory/default/workload-identity/harness_${local.harness_name}-*",
         ]
       },
-      # The service names the managed memory from the harness name plus a
-      # generated suffix, so this scopes to that prefix.
-      {
-        Sid    = "AgentCoreManagedMemory"
-        Effect = "Allow"
-        Action = [
-          "bedrock-agentcore:CreateEvent",
-          "bedrock-agentcore:DeleteEvent",
-          "bedrock-agentcore:GetEvent",
-          "bedrock-agentcore:ListEvents",
-          "bedrock-agentcore:RetrieveMemoryRecords",
-        ]
-        Resource = [
-          "arn:${local.partition}:bedrock-agentcore:${local.region}:${local.account_id}:memory/${local.harness_name}-*",
-        ]
-      },
       {
         Sid    = "AgentCoreBrowserDefault"
         Effect = "Allow"
@@ -230,19 +334,70 @@ resource "aws_iam_role_policy" "execution_role" {
           "arn:${local.partition}:bedrock-agentcore:${local.region}:aws:code-interpreter/*",
         ]
       },
-      ], [
-      # Null Sid/Condition fields are dropped from the rendered policy.
-      for statement in var.additional_execution_role_policy_statements :
-      { for key, value in statement : key => value if value != null }
+      ],
+      # In VPC mode the Harness pulls its managed container from a private ECR
+      # repository in the region rather than ECR Public, so it needs pull
+      # permissions on it. The repository is service-owned, hence the wildcard
+      # account.
+      var.enable_vpc ? [
+        {
+          Sid    = "EcrManagedImagePull"
+          Effect = "Allow"
+          Action = [
+            "ecr:BatchGetImage",
+            "ecr:GetDownloadUrlForLayer",
+            "ecr:BatchCheckLayerAvailability",
+          ]
+          Resource = ["arn:${local.partition}:ecr:${local.region}:*:repository/harness-*"]
+        },
+        {
+          #checkov:skip=CKV_AWS_355:EcrManagedImageToken requires a wildcard resource; ecr:GetAuthorizationToken has no resource-level permission
+          Sid      = "EcrManagedImageToken"
+          Effect   = "Allow"
+          Action   = ["ecr:GetAuthorizationToken"]
+          Resource = ["*"]
+        },
+      ] : [],
+      [
+        # Null Sid/Condition fields are dropped from the rendered policy.
+        for statement in var.additional_execution_role_policy_statements :
+        { for key, value in statement : key => value if value != null }
     ])
   })
 }
 
+# Security group for the Harness, used when running inside a VPC
+resource "aws_security_group" "harness" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to the Harness via its network configuration; Checkov cannot resolve this reference
+  name_prefix = "${local.harness_name_prefix}-harness-"
+  description = "Security group for the ${local.harness_name_prefix} Harness"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "harness_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.harness[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 # Omitting authorizer_configuration uses IAM inbound authorization; add a
 # custom_jwt_authorizer block to change that.
 resource "aws_bedrockagentcore_harness" "this" {
   harness_name       = local.harness_name
-  execution_role_arn = aws_iam_role.execution_role.arn
+  execution_role_arn = local.execution_role_arn
+
+  allowed_tools         = var.allowed_tools
+  environment_variables = var.environment_variables
+  max_iterations        = var.max_iterations
+  timeout_seconds       = var.timeout_seconds
 
   model {
     bedrock_model_config {
@@ -255,9 +410,83 @@ resource "aws_bedrockagentcore_harness" "this" {
     text = file("${path.module}/../../../../../../../<%- promptPathFromTerraform %>")
   }
 
+  dynamic "memory" {
+    for_each = var.memory != null ? [var.memory] : []
+    content {
+      dynamic "managed_memory_configuration" {
+        for_each = memory.value.managed_memory_configuration != null ? [memory.value.managed_memory_configuration] : []
+        content {
+          strategies            = managed_memory_configuration.value.strategies
+          event_expiry_duration = managed_memory_configuration.value.event_expiry_duration
+          encryption_key_arn    = managed_memory_configuration.value.encryption_key_arn
+        }
+      }
+
+      dynamic "agentcore_memory_configuration" {
+        for_each = memory.value.agentcore_memory_configuration != null ? [memory.value.agentcore_memory_configuration] : []
+        content {
+          arn            = agentcore_memory_configuration.value.arn
+          actor_id       = agentcore_memory_configuration.value.actor_id
+          messages_count = agentcore_memory_configuration.value.messages_count
+        }
+      }
+
+      dynamic "disabled" {
+        for_each = memory.value.disabled ? [1] : []
+        content {}
+      }
+    }
+  }
+
+  dynamic "environment" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      agentcore_runtime_environment {
+        network_configuration {
+          network_mode = "VPC"
+          network_mode_config {
+            security_groups = [aws_security_group.harness[0].id]
+            subnets         = var.subnet_ids
+          }
+        }
+      }
+    }
+  }
+
+  tags = var.tags
+
   depends_on = [aws_iam_role_policy.execution_role]
 }
 
+# Scoped to the memory ARN the service assigns, which is only readable after the
+# Harness exists, so this is a policy of its own rather than a baseline
+# statement. Skipped when the Harness uses a role or memory the module did not
+# create.
+resource "aws_iam_role_policy" "managed_memory" {
+  count = var.create_execution_role && local.has_managed_memory ? 1 : 0
+
+  name = "${local.harness_name_prefix}-HarnessManagedMemoryPolicy"
+  role = aws_iam_role.execution_role[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Sid    = "AgentCoreManagedMemory"
+      Effect = "Allow"
+      Action = [
+        "bedrock-agentcore:CreateEvent",
+        "bedrock-agentcore:DeleteEvent",
+        "bedrock-agentcore:GetEvent",
+        "bedrock-agentcore:ListEvents",
+        "bedrock-agentcore:RetrieveMemoryRecords",
+      ]
+      Resource = [
+        aws_bedrockagentcore_harness.this.memory_actual[0].managed_memory_configuration[0].arn,
+      ]
+    }]
+  })
+}
+
 module "add_harness_arn_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
@@ -277,6 +506,11 @@ output "harness_arn" {
 }
 
 output "execution_role_arn" {
-  description = "ARN of the IAM role assumed by the Harness"
-  value       = aws_iam_role.execution_role.arn
+  description = "ARN of the IAM role assumed by the Harness, whether generated or supplied via var.execution_role_arn"
+  value       = local.execution_role_arn
+}
+
+output "security_group_id" {
+  description = "Security group ID of the Harness, for use in ingress rules on resources it must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.harness[0].id : null
 }

package/src/utils/agent-core-constructs/files/terraform/core/agent-core/runtime.tf.template

@@ -6,6 +6,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "<%- awsProviderVersion %>"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "<%- externalProviderVersion %>"
+    }
     null = {
       source  = "hashicorp/null"
       version = "<%- nullProviderVersion %>"

package/src/utils/api-constructs/files/terraform/app/apis/http/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -2,10 +2,18 @@ terraform {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "<%- archiveProviderVersion %>"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "<%- awsProviderVersion %>"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
   }
 }
 

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -2,10 +2,18 @@ terraform {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "<%- archiveProviderVersion %>"
+    }
     aws = {
       source  = "hashicorp/aws"
       version = "<%- awsProviderVersion %>"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
   }
 }
 
@@ -785,7 +793,7 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "<%- apiNameClassName %>" = aws_api_gateway_stage.api_stage.invoke_url }
+  value     = { "<%- apiNameClassName %>" = "${aws_api_gateway_stage.api_stage.invoke_url}/" }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }

package/src/utils/api-constructs/files/terraform/core/api/rest/rest-api/rest-api.tf.template

@@ -200,22 +200,75 @@ resource "aws_wafv2_web_acl" "api_waf" {
   }
 }
 
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+locals {
+  waf_log_group_name = var.enable_waf ? "aws-waf-logs-${var.api_name}-${random_id.waf_log_suffix[0].hex}" : null
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "${var.api_name} API WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:${local.waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/${var.api_name}-${random_id.waf_log_suffix[0].hex}-waf-logs"
+  target_key_id = aws_kms_key.waf_logs[0].key_id
+}
+
 # CloudWatch Log Group for WAF request logs. Name must start with `aws-waf-logs-`.
 resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-${var.api_name}-${random_id.waf_log_suffix[0].hex}"
+  name              = local.waf_log_group_name
   retention_in_days = 30
+  kms_key_id        = aws_kms_key.waf_logs[0].arn
   tags              = var.tags
 }
 
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
 resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
   count = var.enable_waf ? 1 : 0
 

package/src/utils/dcr-proxy-constructs/files/terraform/app/dcr-proxies/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -15,6 +15,10 @@ terraform {
       source  = "hashicorp/archive"
       version = "<%- archiveProviderVersion %>"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
   }
 }