@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.85

package/src/trpc/backend/files-operations/scripts/generate-operations.ts.template

@@ -0,0 +1,40 @@
+import { mkdirSync, writeFileSync } from 'fs';
+import { dirname } from 'path';
+import { appRouter } from '../src/router<% if (esm) { %>.js<% } %>';
+
+/**
+ * Flattens the router into operation names (dot notation for nested routers)
+ * with the path and method each procedure is served on.
+ */
+const toOperations = (
+  router: any,
+  prefix = '',
+): Record<string, { path: string; method: string }> =>
+  Object.fromEntries(
+    Object.entries(router._def.procedures).flatMap(
+      ([name, procedureOrRouter]: [string, any]) => {
+        const fullPath = prefix ? `${prefix}.${name}` : name;
+        return procedureOrRouter._def?.router
+          ? Object.entries(toOperations(procedureOrRouter, fullPath))
+          : [
+              [
+                fullPath,
+                {
+                  path: fullPath,
+                  method:
+                    procedureOrRouter._def.type === 'mutation' ? 'POST' : 'GET',
+                },
+              ],
+            ];
+      },
+    ),
+  );
+
+// Sorted by operation name so the file is stable and does not churn the Terraform plan
+const operations = Object.fromEntries(
+  Object.entries(toOperations(appRouter)).sort(([a], [b]) => a.localeCompare(b)),
+);
+
+const outputFile = process.argv[2];
+mkdirSync(dirname(outputFile), { recursive: true });
+writeFileSync(outputFile, `${JSON.stringify(operations, null, 2)}\n`);

package/src/trpc/backend/generator.js

@@ -5,6 +5,7 @@
 import tsProjectGenerator from "../../ts/lib/generator.js";
 import { addTsDependencies } from "../../utils/add-dependencies.js";
 import { API_CONSTRUCTS_DEPENDENCIES, API_CONSTRUCTS_PY_DEPENDENCIES, addApiGatewayInfra } from "../../utils/api-constructs/api-constructs.js";
+import { addTrpcOperationsMetadataTarget } from "../../utils/api-constructs/trpc-operations-metadata.js";
 import { addTypeScriptBundleTarget, BUNDLE_DEPENDENCIES } from "../../utils/bundle/bundle.js";
 import { declareDependencies, ownedElsewhere } from "../../utils/declared-dependencies.js";
 import { formatFilesInSubtree } from "../../utils/format.js";
@@ -216,6 +217,15 @@ export async function tsTrpcApiGenerator(tree, options) {
             }, DEPENDENCIES);
         }
         addDependencyToTargetIfNotPresent(projectConfig, 'build', 'bundle');
+        // Terraform defines one Lambda function per operation from a generated
+        // metadata file; CDK derives the same information from the router's types.
+        if (iac === 'terraform' && getIntegrationPattern(options) === 'isolated') {
+            addTrpcOperationsMetadataTarget(tree, {
+                apiNameKebabCase,
+                project: projectConfig,
+                templateOptions: esmVars(tree)
+            });
+        }
     }
     projectConfig.targets = sortObjectKeys(projectConfig.targets);
     updateProjectConfiguration(tree, projectConfig.name, projectConfig);

package/src/trpc/backend/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/trpc/backend/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport tsProjectGenerator from '../../ts/lib/generator.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport {\n  API_CONSTRUCTS_DEPENDENCIES,\n  API_CONSTRUCTS_PY_DEPENDENCIES,\n  addApiGatewayInfra,\n} from '../../utils/api-constructs/api-constructs.js';\nimport {\n  addTypeScriptBundleTarget,\n  BUNDLE_DEPENDENCIES,\n} from '../../utils/bundle/bundle.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { resolveIac } from '../../utils/iac.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { esmVars } from '../../utils/module-format.js';\nimport { kebabCase, toClassName } from '../../utils/names.js';\nimport { getNpmScopePrefix } from '../../utils/npm-scope.js';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { getPackageManagerDisplayCommands } from '../../utils/pkg-manager.js';\nimport { assignPort } from '../../utils/port.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../../utils/shared-constructs.js';\nimport type { IacMetadata } from '../../utils/shared-constructs-constants.js';\nimport type { TsTrpcApiGeneratorSchema } from './schema';\n\n/** The metadata this generator records, which its predicates read. */\nexport interface TsTrpcApiMetadata extends IacMetadata {\n  readonly apiName: string;\n  readonly apiType: string;\n  readonly auth: TsTrpcApiGeneratorSchema['auth'];\n  readonly infra: TsTrpcApiGeneratorSchema['infra'];\n  readonly integrationPattern: 'isolated' | 'shared';\n}\n\n// Each entry names the branch it belongs to, so the same declaration drives both\n// adding and the version sync.\nexport const DEPENDENCIES = declareDependencies<TsTrpcApiMetadata>()({\n  ts: [\n    { name: 'aws-xray-sdk-core' },\n    { name: 'zod' },\n    { name: '@aws-lambda-powertools/logger' },\n    { name: '@aws-lambda-powertools/metrics' },\n    { name: '@aws-lambda-powertools/parameters' },\n    { name: '@aws-lambda-powertools/tracer' },\n    { name: '@aws-sdk/client-appconfigdata' },\n    { name: '@trpc/server' },\n    { name: '@trpc/client' },\n    { name: 'aws4fetch' },\n    { name: '@aws-sdk/credential-providers' },\n    // The custom authorizer handler wraps itself with middy and parses its event.\n    { name: '@middy/core', when: (m) => m.auth === 'custom' },\n    { name: '@aws-lambda-powertools/parser', when: (m) => m.auth === 'custom' },\n    { name: '@types/aws-lambda', dev: true },\n    { name: 'cors', dev: true },\n    { name: '@types/cors', dev: true },\n    // tsx runs the local server from the workspace root.\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(API_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(BUNDLE_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n  py: ownedElsewhere(API_CONSTRUCTS_PY_DEPENDENCIES),\n});\n\nexport const TRPC_BACKEND_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nconst VALID_TRPC_INTEGRATION_PERMUTATIONS = new Set([\n  'rest-lambda::isolated',\n  'rest-lambda::shared',\n  'http-lambda::isolated',\n  'http-lambda::shared',\n  'none::isolated',\n  'none::shared',\n]);\n\nexport async function tsTrpcApiGenerator(\n  tree: Tree,\n  options: TsTrpcApiGeneratorSchema,\n) {\n  // Recorded in the metadata below so the version sync can tell a CDK\n  // project from a Terraform one; undefined when no infrastructure was\n  // generated, in which case neither provider's packages were added.\n  const iac =\n    options.infra !== 'none' ? await resolveIac(tree, options.iac) : undefined;\n\n  if (options.infra !== 'none') {\n    validateTrpcInfraAndIntegrationPatternCombination(options);\n  }\n\n  const apiNamespace = getNpmScopePrefix(tree);\n  const apiNameKebabCase = kebabCase(options.name);\n  const apiNameClassName = toClassName(options.name);\n\n  const backendName = apiNameKebabCase;\n  const backendProjectName = `${apiNamespace}${backendName}`;\n\n  let projectExists: boolean;\n  try {\n    readProjectConfigurationUnqualified(tree, backendProjectName);\n    projectExists = true;\n  } catch {\n    projectExists = false;\n  }\n\n  if (!projectExists) {\n    await tsProjectGenerator(tree, {\n      name: backendName,\n      directory: options.directory,\n      subDirectory: options.subDirectory,\n      preferInstallDependencies: false,\n    });\n  }\n\n  const projectConfig = readProjectConfigurationUnqualified(\n    tree,\n    backendProjectName,\n  );\n  const backendRoot = projectConfig.root;\n\n  const port = assignPort(tree, projectConfig, 2022);\n\n  const enhancedOptions = {\n    backendProjectName,\n    backendProjectAlias: backendProjectName,\n    apiNameKebabCase,\n    apiNameClassName,\n    backendRoot,\n    pkgMgrCmd: getPackageManagerDisplayCommands().exec,\n    apiGatewayEventType: getApiGatewayEventType(options),\n    port,\n    ...options,\n    ...esmVars(tree),\n  };\n\n  if (options.infra !== 'none') {\n    await sharedConstructsGenerator(\n      tree,\n      {\n        iac,\n      },\n      DEPENDENCIES,\n    );\n\n    await addApiGatewayInfra(\n      tree,\n      {\n        apiProjectName: backendProjectName,\n        apiNameClassName,\n        apiNameKebabCase,\n        constructType: options.infra === 'http-lambda' ? 'http' : 'rest',\n        backend: {\n          type: 'trpc',\n          projectAlias: enhancedOptions.backendProjectAlias,\n          bundleOutputDir: joinPathFragments('dist', backendRoot, 'bundle'),\n          integrationPattern: getIntegrationPattern(options),\n          ...(options.auth === 'custom' && {\n            authorizerBundleOutputDir: joinPathFragments(\n              'dist',\n              backendRoot,\n              'bundle',\n              'authorizer',\n            ),\n          }),\n        },\n        auth: options.auth,\n        iac,\n      },\n      DEPENDENCIES,\n    );\n  }\n\n  // Recorded on the project below and read by the declaration's predicates, so\n  // the packages added here are exactly the ones the version sync will own.\n  const metadata: TsTrpcApiMetadata = {\n    apiName: options.name,\n    apiType: 'trpc',\n    auth: options.auth,\n    infra: options.infra,\n    integrationPattern: getIntegrationPattern(options),\n    ...(iac ? { iac } : {}),\n  };\n\n  projectConfig.metadata = {\n    ...projectConfig.metadata,\n    ...metadata,\n  } as unknown;\n\n  projectConfig.targets.serve = {\n    executor: 'nx:run-commands',\n    continuous: true,\n    options: {\n      commands: ['tsx --watch src/local-server.ts'],\n      cwd: '{projectRoot}',\n    },\n  };\n\n  projectConfig.targets['dev'] = {\n    ...projectConfig.targets['dev'],\n    ...projectConfig.targets.serve,\n    options: {\n      ...projectConfig.targets.serve.options,\n      env: {\n        LOCAL_DEV: 'true',\n      },\n    },\n  };\n\n  if (options.infra !== 'none') {\n    await addTypeScriptBundleTarget(\n      tree,\n      projectConfig,\n      {\n        targetFilePath: 'src/handler.ts',\n        external: [/@aws-sdk\\/.*/], // lambda runtime provides aws sdk\n      },\n      DEPENDENCIES,\n    );\n\n    if (options.auth === 'custom') {\n      await addTypeScriptBundleTarget(\n        tree,\n        projectConfig,\n        {\n          targetFilePath: 'src/authorizer.ts',\n          bundleOutputDir: 'authorizer',\n          external: [/@aws-sdk\\/.*/],\n        },\n        DEPENDENCIES,\n      );\n    }\n\n    addDependencyToTargetIfNotPresent(projectConfig, 'build', 'bundle');\n  }\n\n  projectConfig.targets = sortObjectKeys(projectConfig.targets);\n\n  updateProjectConfiguration(tree, projectConfig.name, projectConfig);\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    backendRoot,\n    enhancedOptions,\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  tree.delete(joinPathFragments(backendRoot, 'src', 'lib'));\n\n  if (options.infra !== 'none' && options.auth === 'custom') {\n    const authorizerType = options.infra === 'http-lambda' ? 'http' : 'rest';\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        '..',\n        '..',\n        'utils',\n        'api-constructs',\n        'files',\n        'cdk',\n        'authorizer',\n        authorizerType,\n      ),\n      joinPathFragments(backendRoot, 'src'),\n      {},\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  }\n\n  // Remove streaming schema helper for HTTP APIs (API Gateway HTTP API doesn't support streaming)\n  if (options.infra !== 'rest-lambda' && options.infra !== 'none') {\n    tree.delete(\n      joinPathFragments(backendRoot, 'src', 'schema', 'z-async-iterable.ts'),\n    );\n  }\n\n  addTsDependencies(tree, DEPENDENCIES, {\n    metadata,\n    projectRoot: backendRoot,\n  });\n  addGeneratorMetadata(\n    tree,\n    backendName,\n    TRPC_BACKEND_GENERATOR_INFO,\n    metadata,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TRPC_BACKEND_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n}\n\nconst validateTrpcInfraAndIntegrationPatternCombination = (\n  options: TsTrpcApiGeneratorSchema,\n) => {\n  const integrationPattern = getIntegrationPattern(options);\n  const permutation = `${options.infra}::${integrationPattern}`;\n\n  if (!VALID_TRPC_INTEGRATION_PERMUTATIONS.has(permutation)) {\n    throw new Error(\n      `Invalid tRPC infra/integrationPattern combination: ${options.infra} + ${integrationPattern}.`,\n    );\n  }\n};\n\nconst getIntegrationPattern = (\n  options: TsTrpcApiGeneratorSchema,\n): 'isolated' | 'shared' => {\n  return options.integrationPattern ?? 'isolated';\n};\n\nconst getApiGatewayEventType = (options: TsTrpcApiGeneratorSchema): string => {\n  if (options.infra === 'rest-lambda') {\n    return 'APIGatewayProxyEvent';\n  }\n  if (options.auth === 'iam') {\n    return 'APIGatewayProxyEventV2WithIAMAuthorizer';\n  } else if (options.auth === 'cognito') {\n    return 'APIGatewayProxyEventV2WithJWTAuthorizer';\n  }\n  return 'APIGatewayProxyEventV2';\n};\n\nexport default tsTrpcApiGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","tsProjectGenerator","addTsDependencies","API_CONSTRUCTS_DEPENDENCIES","API_CONSTRUCTS_PY_DEPENDENCIES","addApiGatewayInfra","addTypeScriptBundleTarget","BUNDLE_DEPENDENCIES","declareDependencies","ownedElsewhere","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","toClassName","getNpmScopePrefix","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","getPackageManagerDisplayCommands","assignPort","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","DEPENDENCIES","ts","name","when","m","auth","dev","root","py","TRPC_BACKEND_GENERATOR_INFO","filename","VALID_TRPC_INTEGRATION_PERMUTATIONS","Set","tsTrpcApiGenerator","tree","options","iac","infra","undefined","validateTrpcInfraAndIntegrationPatternCombination","apiNamespace","apiNameKebabCase","apiNameClassName","backendName","backendProjectName","projectExists","directory","subDirectory","preferInstallDependencies","projectConfig","backendRoot","port","enhancedOptions","backendProjectAlias","pkgMgrCmd","exec","apiGatewayEventType","getApiGatewayEventType","apiProjectName","constructType","backend","type","projectAlias","bundleOutputDir","integrationPattern","getIntegrationPattern","authorizerBundleOutputDir","metadata","apiName","apiType","targets","serve","executor","continuous","commands","cwd","env","LOCAL_DEV","targetFilePath","external","dirname","overwriteStrategy","Overwrite","delete","authorizerType","KeepExisting","projectRoot","languages","permutation","has","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,OAAOC,wBAAwB,4BAA4B;AAC3D,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SACEC,2BAA2B,EAC3BC,8BAA8B,EAC9BC,kBAAkB,QACb,+CAA+C;AACtD,SACEC,yBAAyB,EACzBC,mBAAmB,QACd,+BAA+B;AACtC,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,UAAU,QAAQ,qBAAqB;AAChD,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,OAAO,QAAQ,+BAA+B;AACvD,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAuB;AAC9D,SAASC,iBAAiB,QAAQ,2BAA2B;AAC7D,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,gCAAgC,QAAQ,6BAA6B;AAC9E,SAASC,UAAU,QAAQ,sBAAsB;AACjD,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,mCAAmC;AAa1C,iFAAiF;AACjF,+BAA+B;AAC/B,OAAO,MAAMC,eAAenB,sBAAyC;IACnEoB,IAAI;QACF;YAAEC,MAAM;QAAoB;QAC5B;YAAEA,MAAM;QAAM;QACd;YAAEA,MAAM;QAAgC;QACxC;YAAEA,MAAM;QAAiC;QACzC;YAAEA,MAAM;QAAoC;QAC5C;YAAEA,MAAM;QAAgC;QACxC;YAAEA,MAAM;QAAgC;QACxC;YAAEA,MAAM;QAAe;QACvB;YAAEA,MAAM;QAAe;QACvB;YAAEA,MAAM;QAAY;QACpB;YAAEA,MAAM;QAAgC;QACxC,8EAA8E;QAC9E;YAAEA,MAAM;YAAeC,MAAM,CAACC,IAAMA,EAAEC,IAAI,KAAK;QAAS;QACxD;YAAEH,MAAM;YAAiCC,MAAM,CAACC,IAAMA,EAAEC,IAAI,KAAK;QAAS;QAC1E;YAAEH,MAAM;YAAqBI,KAAK;QAAK;QACvC;YAAEJ,MAAM;YAAQI,KAAK;QAAK;QAC1B;YAAEJ,MAAM;YAAeI,KAAK;QAAK;QACjC,qDAAqD;QACrD;YAAEJ,MAAM;YAAOI,KAAK;YAAMC,MAAM;QAAK;WAClCzB,eAAeN;WACfM,eAAeF;WACfE,eAAegB;KACnB;IACDU,IAAI1B,eAAeL;AACrB,GAAG;AAEH,OAAO,MAAMgC,8BAA+ChB,iBAC1D,YAAYiB,QAAQ,EACpB;AAEF,MAAMC,sCAAsC,IAAIC,IAAI;IAClD;IACA;IACA;IACA;IACA;IACA;CACD;AAED,OAAO,eAAeC,mBACpBC,IAAU,EACVC,OAAiC;IAEjC,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,MAAMC,MACJD,QAAQE,KAAK,KAAK,SAAS,MAAMjC,WAAW8B,MAAMC,QAAQC,GAAG,IAAIE;IAEnE,IAAIH,QAAQE,KAAK,KAAK,QAAQ;QAC5BE,kDAAkDJ;IACpD;IAEA,MAAMK,eAAe9B,kBAAkBwB;IACvC,MAAMO,mBAAmBjC,UAAU2B,QAAQb,IAAI;IAC/C,MAAMoB,mBAAmBjC,YAAY0B,QAAQb,IAAI;IAEjD,MAAMqB,cAAcF;IACpB,MAAMG,qBAAqB,GAAGJ,eAAeG,aAAa;IAE1D,IAAIE;IACJ,IAAI;QACF/B,oCAAoCoB,MAAMU;QAC1CC,gBAAgB;IAClB,EAAE,OAAM;QACNA,gBAAgB;IAClB;IAEA,IAAI,CAACA,eAAe;QAClB,MAAMnD,mBAAmBwC,MAAM;YAC7BZ,MAAMqB;YACNG,WAAWX,QAAQW,SAAS;YAC5BC,cAAcZ,QAAQY,YAAY;YAClCC,2BAA2B;QAC7B;IACF;IAEA,MAAMC,gBAAgBnC,oCACpBoB,MACAU;IAEF,MAAMM,cAAcD,cAActB,IAAI;IAEtC,MAAMwB,OAAOlC,WAAWiB,MAAMe,eAAe;IAE7C,MAAMG,kBAAkB;QACtBR;QACAS,qBAAqBT;QACrBH;QACAC;QACAQ;QACAI,WAAWtC,mCAAmCuC,IAAI;QAClDC,qBAAqBC,uBAAuBtB;QAC5CgB;QACA,GAAGhB,OAAO;QACV,GAAG5B,QAAQ2B,KAAK;IAClB;IAEA,IAAIC,QAAQE,KAAK,KAAK,QAAQ;QAC5B,MAAMlB,0BACJe,MACA;YACEE;QACF,GACAhB;QAGF,MAAMtB,mBACJoC,MACA;YACEwB,gBAAgBd;YAChBF;YACAD;YACAkB,eAAexB,QAAQE,KAAK,KAAK,gBAAgB,SAAS;YAC1DuB,SAAS;gBACPC,MAAM;gBACNC,cAAcV,gBAAgBC,mBAAmB;gBACjDU,iBAAiBxE,kBAAkB,QAAQ2D,aAAa;gBACxDc,oBAAoBC,sBAAsB9B;gBAC1C,GAAIA,QAAQV,IAAI,KAAK,YAAY;oBAC/ByC,2BAA2B3E,kBACzB,QACA2D,aACA,UACA;gBAEJ,CAAC;YACH;YACAzB,MAAMU,QAAQV,IAAI;YAClBW;QACF,GACAhB;IAEJ;IAEA,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM+C,WAA8B;QAClCC,SAASjC,QAAQb,IAAI;QACrB+C,SAAS;QACT5C,MAAMU,QAAQV,IAAI;QAClBY,OAAOF,QAAQE,KAAK;QACpB2B,oBAAoBC,sBAAsB9B;QAC1C,GAAIC,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;IAEAa,cAAckB,QAAQ,GAAG;QACvB,GAAGlB,cAAckB,QAAQ;QACzB,GAAGA,QAAQ;IACb;IAEAlB,cAAcqB,OAAO,CAACC,KAAK,GAAG;QAC5BC,UAAU;QACVC,YAAY;QACZtC,SAAS;YACPuC,UAAU;gBAAC;aAAkC;YAC7CC,KAAK;QACP;IACF;IAEA1B,cAAcqB,OAAO,CAAC,MAAM,GAAG;QAC7B,GAAGrB,cAAcqB,OAAO,CAAC,MAAM;QAC/B,GAAGrB,cAAcqB,OAAO,CAACC,KAAK;QAC9BpC,SAAS;YACP,GAAGc,cAAcqB,OAAO,CAACC,KAAK,CAACpC,OAAO;YACtCyC,KAAK;gBACHC,WAAW;YACb;QACF;IACF;IAEA,IAAI1C,QAAQE,KAAK,KAAK,QAAQ;QAC5B,MAAMtC,0BACJmC,MACAe,eACA;YACE6B,gBAAgB;YAChBC,UAAU;gBAAC;aAAe;QAC5B,GACA3D;QAGF,IAAIe,QAAQV,IAAI,KAAK,UAAU;YAC7B,MAAM1B,0BACJmC,MACAe,eACA;gBACE6B,gBAAgB;gBAChBf,iBAAiB;gBACjBgB,UAAU;oBAAC;iBAAe;YAC5B,GACA3D;QAEJ;QAEAT,kCAAkCsC,eAAe,SAAS;IAC5D;IAEAA,cAAcqB,OAAO,GAAGvD,eAAekC,cAAcqB,OAAO;IAE5D7E,2BAA2ByC,MAAMe,cAAc3B,IAAI,EAAE2B;IAErD3D,cACE4C,MACA3C,kBAAkB,YAAYyF,OAAO,EAAE,UACvC9B,aACAE,iBACA;QACE6B,mBAAmBzF,kBAAkB0F,SAAS;IAChD;IAGFhD,KAAKiD,MAAM,CAAC5F,kBAAkB2D,aAAa,OAAO;IAElD,IAAIf,QAAQE,KAAK,KAAK,UAAUF,QAAQV,IAAI,KAAK,UAAU;QACzD,MAAM2D,iBAAiBjD,QAAQE,KAAK,KAAK,gBAAgB,SAAS;QAClE/C,cACE4C,MACA3C,kBACE,YAAYyF,OAAO,EACnB,MACA,MACA,SACA,kBACA,SACA,OACA,cACAI,iBAEF7F,kBAAkB2D,aAAa,QAC/B,CAAC,GACD;YACE+B,mBAAmBzF,kBAAkB6F,YAAY;QACnD;IAEJ;IAEA,gGAAgG;IAChG,IAAIlD,QAAQE,KAAK,KAAK,iBAAiBF,QAAQE,KAAK,KAAK,QAAQ;QAC/DH,KAAKiD,MAAM,CACT5F,kBAAkB2D,aAAa,OAAO,UAAU;IAEpD;IAEAvD,kBAAkBuC,MAAMd,cAAc;QACpC+C;QACAmB,aAAapC;IACf;IACAtC,qBACEsB,MACAS,aACAd,6BACAsC;IAGF,MAAM7D,gCAAgC4B,MAAM;QAACL;KAA4B;IAEzE,MAAM1B,qBAAqB+B;IAC3B,OAAO,IACL7B,oBAAoB6B,MAAMC,QAAQa,yBAAyB,EAAE;YAC3DuC,WAAW;gBAAC;aAAa;QAC3B;AACJ;AAEA,MAAMhD,oDAAoD,CACxDJ;IAEA,MAAM6B,qBAAqBC,sBAAsB9B;IACjD,MAAMqD,cAAc,GAAGrD,QAAQE,KAAK,CAAC,EAAE,EAAE2B,oBAAoB;IAE7D,IAAI,CAACjC,oCAAoC0D,GAAG,CAACD,cAAc;QACzD,MAAM,IAAIE,MACR,CAAC,mDAAmD,EAAEvD,QAAQE,KAAK,CAAC,GAAG,EAAE2B,mBAAmB,CAAC,CAAC;IAElG;AACF;AAEA,MAAMC,wBAAwB,CAC5B9B;IAEA,OAAOA,QAAQ6B,kBAAkB,IAAI;AACvC;AAEA,MAAMP,yBAAyB,CAACtB;IAC9B,IAAIA,QAAQE,KAAK,KAAK,eAAe;QACnC,OAAO;IACT;IACA,IAAIF,QAAQV,IAAI,KAAK,OAAO;QAC1B,OAAO;IACT,OAAO,IAAIU,QAAQV,IAAI,KAAK,WAAW;QACrC,OAAO;IACT;IACA,OAAO;AACT;AAEA,eAAeQ,mBAAmB"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/trpc/backend/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport tsProjectGenerator from '../../ts/lib/generator.js';\nimport { addTsDependencies } from '../../utils/add-dependencies.js';\nimport {\n  API_CONSTRUCTS_DEPENDENCIES,\n  API_CONSTRUCTS_PY_DEPENDENCIES,\n  addApiGatewayInfra,\n} from '../../utils/api-constructs/api-constructs.js';\nimport { addTrpcOperationsMetadataTarget } from '../../utils/api-constructs/trpc-operations-metadata.js';\nimport {\n  addTypeScriptBundleTarget,\n  BUNDLE_DEPENDENCIES,\n} from '../../utils/bundle/bundle.js';\nimport {\n  declareDependencies,\n  ownedElsewhere,\n} from '../../utils/declared-dependencies.js';\nimport { formatFilesInSubtree } from '../../utils/format.js';\nimport { resolveIac } from '../../utils/iac.js';\nimport { installDependencies } from '../../utils/install.js';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics.js';\nimport { esmVars } from '../../utils/module-format.js';\nimport { kebabCase, toClassName } from '../../utils/names.js';\nimport { getNpmScopePrefix } from '../../utils/npm-scope.js';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n  readProjectConfigurationUnqualified,\n} from '../../utils/nx.js';\nimport { sortObjectKeys } from '../../utils/object.js';\nimport { getPackageManagerDisplayCommands } from '../../utils/pkg-manager.js';\nimport { assignPort } from '../../utils/port.js';\nimport {\n  SHARED_CONSTRUCTS_DEPENDENCIES,\n  sharedConstructsGenerator,\n} from '../../utils/shared-constructs.js';\nimport type { IacMetadata } from '../../utils/shared-constructs-constants.js';\nimport type { TsTrpcApiGeneratorSchema } from './schema';\n\n/** The metadata this generator records, which its predicates read. */\nexport interface TsTrpcApiMetadata extends IacMetadata {\n  readonly apiName: string;\n  readonly apiType: string;\n  readonly auth: TsTrpcApiGeneratorSchema['auth'];\n  readonly infra: TsTrpcApiGeneratorSchema['infra'];\n  readonly integrationPattern: 'isolated' | 'shared';\n}\n\n// Each entry names the branch it belongs to, so the same declaration drives both\n// adding and the version sync.\nexport const DEPENDENCIES = declareDependencies<TsTrpcApiMetadata>()({\n  ts: [\n    { name: 'aws-xray-sdk-core' },\n    { name: 'zod' },\n    { name: '@aws-lambda-powertools/logger' },\n    { name: '@aws-lambda-powertools/metrics' },\n    { name: '@aws-lambda-powertools/parameters' },\n    { name: '@aws-lambda-powertools/tracer' },\n    { name: '@aws-sdk/client-appconfigdata' },\n    { name: '@trpc/server' },\n    { name: '@trpc/client' },\n    { name: 'aws4fetch' },\n    { name: '@aws-sdk/credential-providers' },\n    // The custom authorizer handler wraps itself with middy and parses its event.\n    { name: '@middy/core', when: (m) => m.auth === 'custom' },\n    { name: '@aws-lambda-powertools/parser', when: (m) => m.auth === 'custom' },\n    { name: '@types/aws-lambda', dev: true },\n    { name: 'cors', dev: true },\n    { name: '@types/cors', dev: true },\n    // tsx runs the local server from the workspace root.\n    { name: 'tsx', dev: true, root: true },\n    ...ownedElsewhere(API_CONSTRUCTS_DEPENDENCIES),\n    ...ownedElsewhere(BUNDLE_DEPENDENCIES),\n    ...ownedElsewhere(SHARED_CONSTRUCTS_DEPENDENCIES),\n  ],\n  py: ownedElsewhere(API_CONSTRUCTS_PY_DEPENDENCIES),\n});\n\nexport const TRPC_BACKEND_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nconst VALID_TRPC_INTEGRATION_PERMUTATIONS = new Set([\n  'rest-lambda::isolated',\n  'rest-lambda::shared',\n  'http-lambda::isolated',\n  'http-lambda::shared',\n  'none::isolated',\n  'none::shared',\n]);\n\nexport async function tsTrpcApiGenerator(\n  tree: Tree,\n  options: TsTrpcApiGeneratorSchema,\n) {\n  // Recorded in the metadata below so the version sync can tell a CDK\n  // project from a Terraform one; undefined when no infrastructure was\n  // generated, in which case neither provider's packages were added.\n  const iac =\n    options.infra !== 'none' ? await resolveIac(tree, options.iac) : undefined;\n\n  if (options.infra !== 'none') {\n    validateTrpcInfraAndIntegrationPatternCombination(options);\n  }\n\n  const apiNamespace = getNpmScopePrefix(tree);\n  const apiNameKebabCase = kebabCase(options.name);\n  const apiNameClassName = toClassName(options.name);\n\n  const backendName = apiNameKebabCase;\n  const backendProjectName = `${apiNamespace}${backendName}`;\n\n  let projectExists: boolean;\n  try {\n    readProjectConfigurationUnqualified(tree, backendProjectName);\n    projectExists = true;\n  } catch {\n    projectExists = false;\n  }\n\n  if (!projectExists) {\n    await tsProjectGenerator(tree, {\n      name: backendName,\n      directory: options.directory,\n      subDirectory: options.subDirectory,\n      preferInstallDependencies: false,\n    });\n  }\n\n  const projectConfig = readProjectConfigurationUnqualified(\n    tree,\n    backendProjectName,\n  );\n  const backendRoot = projectConfig.root;\n\n  const port = assignPort(tree, projectConfig, 2022);\n\n  const enhancedOptions = {\n    backendProjectName,\n    backendProjectAlias: backendProjectName,\n    apiNameKebabCase,\n    apiNameClassName,\n    backendRoot,\n    pkgMgrCmd: getPackageManagerDisplayCommands().exec,\n    apiGatewayEventType: getApiGatewayEventType(options),\n    port,\n    ...options,\n    ...esmVars(tree),\n  };\n\n  if (options.infra !== 'none') {\n    await sharedConstructsGenerator(\n      tree,\n      {\n        iac,\n      },\n      DEPENDENCIES,\n    );\n\n    await addApiGatewayInfra(\n      tree,\n      {\n        apiProjectName: backendProjectName,\n        apiNameClassName,\n        apiNameKebabCase,\n        constructType: options.infra === 'http-lambda' ? 'http' : 'rest',\n        backend: {\n          type: 'trpc',\n          projectAlias: enhancedOptions.backendProjectAlias,\n          bundleOutputDir: joinPathFragments('dist', backendRoot, 'bundle'),\n          integrationPattern: getIntegrationPattern(options),\n          ...(options.auth === 'custom' && {\n            authorizerBundleOutputDir: joinPathFragments(\n              'dist',\n              backendRoot,\n              'bundle',\n              'authorizer',\n            ),\n          }),\n        },\n        auth: options.auth,\n        iac,\n      },\n      DEPENDENCIES,\n    );\n  }\n\n  // Recorded on the project below and read by the declaration's predicates, so\n  // the packages added here are exactly the ones the version sync will own.\n  const metadata: TsTrpcApiMetadata = {\n    apiName: options.name,\n    apiType: 'trpc',\n    auth: options.auth,\n    infra: options.infra,\n    integrationPattern: getIntegrationPattern(options),\n    ...(iac ? { iac } : {}),\n  };\n\n  projectConfig.metadata = {\n    ...projectConfig.metadata,\n    ...metadata,\n  } as unknown;\n\n  projectConfig.targets.serve = {\n    executor: 'nx:run-commands',\n    continuous: true,\n    options: {\n      commands: ['tsx --watch src/local-server.ts'],\n      cwd: '{projectRoot}',\n    },\n  };\n\n  projectConfig.targets['dev'] = {\n    ...projectConfig.targets['dev'],\n    ...projectConfig.targets.serve,\n    options: {\n      ...projectConfig.targets.serve.options,\n      env: {\n        LOCAL_DEV: 'true',\n      },\n    },\n  };\n\n  if (options.infra !== 'none') {\n    await addTypeScriptBundleTarget(\n      tree,\n      projectConfig,\n      {\n        targetFilePath: 'src/handler.ts',\n        external: [/@aws-sdk\\/.*/], // lambda runtime provides aws sdk\n      },\n      DEPENDENCIES,\n    );\n\n    if (options.auth === 'custom') {\n      await addTypeScriptBundleTarget(\n        tree,\n        projectConfig,\n        {\n          targetFilePath: 'src/authorizer.ts',\n          bundleOutputDir: 'authorizer',\n          external: [/@aws-sdk\\/.*/],\n        },\n        DEPENDENCIES,\n      );\n    }\n\n    addDependencyToTargetIfNotPresent(projectConfig, 'build', 'bundle');\n\n    // Terraform defines one Lambda function per operation from a generated\n    // metadata file; CDK derives the same information from the router's types.\n    if (iac === 'terraform' && getIntegrationPattern(options) === 'isolated') {\n      addTrpcOperationsMetadataTarget(tree, {\n        apiNameKebabCase,\n        project: projectConfig,\n        templateOptions: esmVars(tree),\n      });\n    }\n  }\n\n  projectConfig.targets = sortObjectKeys(projectConfig.targets);\n\n  updateProjectConfiguration(tree, projectConfig.name, projectConfig);\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    backendRoot,\n    enhancedOptions,\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  tree.delete(joinPathFragments(backendRoot, 'src', 'lib'));\n\n  if (options.infra !== 'none' && options.auth === 'custom') {\n    const authorizerType = options.infra === 'http-lambda' ? 'http' : 'rest';\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        '..',\n        '..',\n        'utils',\n        'api-constructs',\n        'files',\n        'cdk',\n        'authorizer',\n        authorizerType,\n      ),\n      joinPathFragments(backendRoot, 'src'),\n      {},\n      {\n        overwriteStrategy: OverwriteStrategy.KeepExisting,\n      },\n    );\n  }\n\n  // Remove streaming schema helper for HTTP APIs (API Gateway HTTP API doesn't support streaming)\n  if (options.infra !== 'rest-lambda' && options.infra !== 'none') {\n    tree.delete(\n      joinPathFragments(backendRoot, 'src', 'schema', 'z-async-iterable.ts'),\n    );\n  }\n\n  addTsDependencies(tree, DEPENDENCIES, {\n    metadata,\n    projectRoot: backendRoot,\n  });\n  addGeneratorMetadata(\n    tree,\n    backendName,\n    TRPC_BACKEND_GENERATOR_INFO,\n    metadata,\n  );\n\n  await addGeneratorMetricsIfApplicable(tree, [TRPC_BACKEND_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n}\n\nconst validateTrpcInfraAndIntegrationPatternCombination = (\n  options: TsTrpcApiGeneratorSchema,\n) => {\n  const integrationPattern = getIntegrationPattern(options);\n  const permutation = `${options.infra}::${integrationPattern}`;\n\n  if (!VALID_TRPC_INTEGRATION_PERMUTATIONS.has(permutation)) {\n    throw new Error(\n      `Invalid tRPC infra/integrationPattern combination: ${options.infra} + ${integrationPattern}.`,\n    );\n  }\n};\n\nconst getIntegrationPattern = (\n  options: TsTrpcApiGeneratorSchema,\n): 'isolated' | 'shared' => {\n  return options.integrationPattern ?? 'isolated';\n};\n\nconst getApiGatewayEventType = (options: TsTrpcApiGeneratorSchema): string => {\n  if (options.infra === 'rest-lambda') {\n    return 'APIGatewayProxyEvent';\n  }\n  if (options.auth === 'iam') {\n    return 'APIGatewayProxyEventV2WithIAMAuthorizer';\n  } else if (options.auth === 'cognito') {\n    return 'APIGatewayProxyEventV2WithJWTAuthorizer';\n  }\n  return 'APIGatewayProxyEventV2';\n};\n\nexport default tsTrpcApiGenerator;\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","tsProjectGenerator","addTsDependencies","API_CONSTRUCTS_DEPENDENCIES","API_CONSTRUCTS_PY_DEPENDENCIES","addApiGatewayInfra","addTrpcOperationsMetadataTarget","addTypeScriptBundleTarget","BUNDLE_DEPENDENCIES","declareDependencies","ownedElsewhere","formatFilesInSubtree","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","esmVars","kebabCase","toClassName","getNpmScopePrefix","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","readProjectConfigurationUnqualified","sortObjectKeys","getPackageManagerDisplayCommands","assignPort","SHARED_CONSTRUCTS_DEPENDENCIES","sharedConstructsGenerator","DEPENDENCIES","ts","name","when","m","auth","dev","root","py","TRPC_BACKEND_GENERATOR_INFO","filename","VALID_TRPC_INTEGRATION_PERMUTATIONS","Set","tsTrpcApiGenerator","tree","options","iac","infra","undefined","validateTrpcInfraAndIntegrationPatternCombination","apiNamespace","apiNameKebabCase","apiNameClassName","backendName","backendProjectName","projectExists","directory","subDirectory","preferInstallDependencies","projectConfig","backendRoot","port","enhancedOptions","backendProjectAlias","pkgMgrCmd","exec","apiGatewayEventType","getApiGatewayEventType","apiProjectName","constructType","backend","type","projectAlias","bundleOutputDir","integrationPattern","getIntegrationPattern","authorizerBundleOutputDir","metadata","apiName","apiType","targets","serve","executor","continuous","commands","cwd","env","LOCAL_DEV","targetFilePath","external","project","templateOptions","dirname","overwriteStrategy","Overwrite","delete","authorizerType","KeepExisting","projectRoot","languages","permutation","has","Error"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,OAAOC,wBAAwB,4BAA4B;AAC3D,SAASC,iBAAiB,QAAQ,kCAAkC;AACpE,SACEC,2BAA2B,EAC3BC,8BAA8B,EAC9BC,kBAAkB,QACb,+CAA+C;AACtD,SAASC,+BAA+B,QAAQ,yDAAyD;AACzG,SACEC,yBAAyB,EACzBC,mBAAmB,QACd,+BAA+B;AACtC,SACEC,mBAAmB,EACnBC,cAAc,QACT,uCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,wBAAwB;AAC7D,SAASC,UAAU,QAAQ,qBAAqB;AAChD,SAASC,mBAAmB,QAAQ,yBAAyB;AAC7D,SAASC,+BAA+B,QAAQ,yBAAyB;AACzE,SAASC,OAAO,QAAQ,+BAA+B;AACvD,SAASC,SAAS,EAAEC,WAAW,QAAQ,uBAAuB;AAC9D,SAASC,iBAAiB,QAAQ,2BAA2B;AAC7D,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,EAEhBC,mCAAmC,QAC9B,oBAAoB;AAC3B,SAASC,cAAc,QAAQ,wBAAwB;AACvD,SAASC,gCAAgC,QAAQ,6BAA6B;AAC9E,SAASC,UAAU,QAAQ,sBAAsB;AACjD,SACEC,8BAA8B,EAC9BC,yBAAyB,QACpB,mCAAmC;AAa1C,iFAAiF;AACjF,+BAA+B;AAC/B,OAAO,MAAMC,eAAenB,sBAAyC;IACnEoB,IAAI;QACF;YAAEC,MAAM;QAAoB;QAC5B;YAAEA,MAAM;QAAM;QACd;YAAEA,MAAM;QAAgC;QACxC;YAAEA,MAAM;QAAiC;QACzC;YAAEA,MAAM;QAAoC;QAC5C;YAAEA,MAAM;QAAgC;QACxC;YAAEA,MAAM;QAAgC;QACxC;YAAEA,MAAM;QAAe;QACvB;YAAEA,MAAM;QAAe;QACvB;YAAEA,MAAM;QAAY;QACpB;YAAEA,MAAM;QAAgC;QACxC,8EAA8E;QAC9E;YAAEA,MAAM;YAAeC,MAAM,CAACC,IAAMA,EAAEC,IAAI,KAAK;QAAS;QACxD;YAAEH,MAAM;YAAiCC,MAAM,CAACC,IAAMA,EAAEC,IAAI,KAAK;QAAS;QAC1E;YAAEH,MAAM;YAAqBI,KAAK;QAAK;QACvC;YAAEJ,MAAM;YAAQI,KAAK;QAAK;QAC1B;YAAEJ,MAAM;YAAeI,KAAK;QAAK;QACjC,qDAAqD;QACrD;YAAEJ,MAAM;YAAOI,KAAK;YAAMC,MAAM;QAAK;WAClCzB,eAAeP;WACfO,eAAeF;WACfE,eAAegB;KACnB;IACDU,IAAI1B,eAAeN;AACrB,GAAG;AAEH,OAAO,MAAMiC,8BAA+ChB,iBAC1D,YAAYiB,QAAQ,EACpB;AAEF,MAAMC,sCAAsC,IAAIC,IAAI;IAClD;IACA;IACA;IACA;IACA;IACA;CACD;AAED,OAAO,eAAeC,mBACpBC,IAAU,EACVC,OAAiC;IAEjC,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,MAAMC,MACJD,QAAQE,KAAK,KAAK,SAAS,MAAMjC,WAAW8B,MAAMC,QAAQC,GAAG,IAAIE;IAEnE,IAAIH,QAAQE,KAAK,KAAK,QAAQ;QAC5BE,kDAAkDJ;IACpD;IAEA,MAAMK,eAAe9B,kBAAkBwB;IACvC,MAAMO,mBAAmBjC,UAAU2B,QAAQb,IAAI;IAC/C,MAAMoB,mBAAmBjC,YAAY0B,QAAQb,IAAI;IAEjD,MAAMqB,cAAcF;IACpB,MAAMG,qBAAqB,GAAGJ,eAAeG,aAAa;IAE1D,IAAIE;IACJ,IAAI;QACF/B,oCAAoCoB,MAAMU;QAC1CC,gBAAgB;IAClB,EAAE,OAAM;QACNA,gBAAgB;IAClB;IAEA,IAAI,CAACA,eAAe;QAClB,MAAMpD,mBAAmByC,MAAM;YAC7BZ,MAAMqB;YACNG,WAAWX,QAAQW,SAAS;YAC5BC,cAAcZ,QAAQY,YAAY;YAClCC,2BAA2B;QAC7B;IACF;IAEA,MAAMC,gBAAgBnC,oCACpBoB,MACAU;IAEF,MAAMM,cAAcD,cAActB,IAAI;IAEtC,MAAMwB,OAAOlC,WAAWiB,MAAMe,eAAe;IAE7C,MAAMG,kBAAkB;QACtBR;QACAS,qBAAqBT;QACrBH;QACAC;QACAQ;QACAI,WAAWtC,mCAAmCuC,IAAI;QAClDC,qBAAqBC,uBAAuBtB;QAC5CgB;QACA,GAAGhB,OAAO;QACV,GAAG5B,QAAQ2B,KAAK;IAClB;IAEA,IAAIC,QAAQE,KAAK,KAAK,QAAQ;QAC5B,MAAMlB,0BACJe,MACA;YACEE;QACF,GACAhB;QAGF,MAAMvB,mBACJqC,MACA;YACEwB,gBAAgBd;YAChBF;YACAD;YACAkB,eAAexB,QAAQE,KAAK,KAAK,gBAAgB,SAAS;YAC1DuB,SAAS;gBACPC,MAAM;gBACNC,cAAcV,gBAAgBC,mBAAmB;gBACjDU,iBAAiBzE,kBAAkB,QAAQ4D,aAAa;gBACxDc,oBAAoBC,sBAAsB9B;gBAC1C,GAAIA,QAAQV,IAAI,KAAK,YAAY;oBAC/ByC,2BAA2B5E,kBACzB,QACA4D,aACA,UACA;gBAEJ,CAAC;YACH;YACAzB,MAAMU,QAAQV,IAAI;YAClBW;QACF,GACAhB;IAEJ;IAEA,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM+C,WAA8B;QAClCC,SAASjC,QAAQb,IAAI;QACrB+C,SAAS;QACT5C,MAAMU,QAAQV,IAAI;QAClBY,OAAOF,QAAQE,KAAK;QACpB2B,oBAAoBC,sBAAsB9B;QAC1C,GAAIC,MAAM;YAAEA;QAAI,IAAI,CAAC,CAAC;IACxB;IAEAa,cAAckB,QAAQ,GAAG;QACvB,GAAGlB,cAAckB,QAAQ;QACzB,GAAGA,QAAQ;IACb;IAEAlB,cAAcqB,OAAO,CAACC,KAAK,GAAG;QAC5BC,UAAU;QACVC,YAAY;QACZtC,SAAS;YACPuC,UAAU;gBAAC;aAAkC;YAC7CC,KAAK;QACP;IACF;IAEA1B,cAAcqB,OAAO,CAAC,MAAM,GAAG;QAC7B,GAAGrB,cAAcqB,OAAO,CAAC,MAAM;QAC/B,GAAGrB,cAAcqB,OAAO,CAACC,KAAK;QAC9BpC,SAAS;YACP,GAAGc,cAAcqB,OAAO,CAACC,KAAK,CAACpC,OAAO;YACtCyC,KAAK;gBACHC,WAAW;YACb;QACF;IACF;IAEA,IAAI1C,QAAQE,KAAK,KAAK,QAAQ;QAC5B,MAAMtC,0BACJmC,MACAe,eACA;YACE6B,gBAAgB;YAChBC,UAAU;gBAAC;aAAe;QAC5B,GACA3D;QAGF,IAAIe,QAAQV,IAAI,KAAK,UAAU;YAC7B,MAAM1B,0BACJmC,MACAe,eACA;gBACE6B,gBAAgB;gBAChBf,iBAAiB;gBACjBgB,UAAU;oBAAC;iBAAe;YAC5B,GACA3D;QAEJ;QAEAT,kCAAkCsC,eAAe,SAAS;QAE1D,uEAAuE;QACvE,2EAA2E;QAC3E,IAAIb,QAAQ,eAAe6B,sBAAsB9B,aAAa,YAAY;YACxErC,gCAAgCoC,MAAM;gBACpCO;gBACAuC,SAAS/B;gBACTgC,iBAAiB1E,QAAQ2B;YAC3B;QACF;IACF;IAEAe,cAAcqB,OAAO,GAAGvD,eAAekC,cAAcqB,OAAO;IAE5D9E,2BAA2B0C,MAAMe,cAAc3B,IAAI,EAAE2B;IAErD5D,cACE6C,MACA5C,kBAAkB,YAAY4F,OAAO,EAAE,UACvChC,aACAE,iBACA;QACE+B,mBAAmB5F,kBAAkB6F,SAAS;IAChD;IAGFlD,KAAKmD,MAAM,CAAC/F,kBAAkB4D,aAAa,OAAO;IAElD,IAAIf,QAAQE,KAAK,KAAK,UAAUF,QAAQV,IAAI,KAAK,UAAU;QACzD,MAAM6D,iBAAiBnD,QAAQE,KAAK,KAAK,gBAAgB,SAAS;QAClEhD,cACE6C,MACA5C,kBACE,YAAY4F,OAAO,EACnB,MACA,MACA,SACA,kBACA,SACA,OACA,cACAI,iBAEFhG,kBAAkB4D,aAAa,QAC/B,CAAC,GACD;YACEiC,mBAAmB5F,kBAAkBgG,YAAY;QACnD;IAEJ;IAEA,gGAAgG;IAChG,IAAIpD,QAAQE,KAAK,KAAK,iBAAiBF,QAAQE,KAAK,KAAK,QAAQ;QAC/DH,KAAKmD,MAAM,CACT/F,kBAAkB4D,aAAa,OAAO,UAAU;IAEpD;IAEAxD,kBAAkBwC,MAAMd,cAAc;QACpC+C;QACAqB,aAAatC;IACf;IACAtC,qBACEsB,MACAS,aACAd,6BACAsC;IAGF,MAAM7D,gCAAgC4B,MAAM;QAACL;KAA4B;IAEzE,MAAM1B,qBAAqB+B;IAC3B,OAAO,IACL7B,oBAAoB6B,MAAMC,QAAQa,yBAAyB,EAAE;YAC3DyC,WAAW;gBAAC;aAAa;QAC3B;AACJ;AAEA,MAAMlD,oDAAoD,CACxDJ;IAEA,MAAM6B,qBAAqBC,sBAAsB9B;IACjD,MAAMuD,cAAc,GAAGvD,QAAQE,KAAK,CAAC,EAAE,EAAE2B,oBAAoB;IAE7D,IAAI,CAACjC,oCAAoC4D,GAAG,CAACD,cAAc;QACzD,MAAM,IAAIE,MACR,CAAC,mDAAmD,EAAEzD,QAAQE,KAAK,CAAC,GAAG,EAAE2B,mBAAmB,CAAC,CAAC;IAElG;AACF;AAEA,MAAMC,wBAAwB,CAC5B9B;IAEA,OAAOA,QAAQ6B,kBAAkB,IAAI;AACvC;AAEA,MAAMP,yBAAyB,CAACtB;IAC9B,IAAIA,QAAQE,KAAK,KAAK,eAAe;QACnC,OAAO;IACT;IACA,IAAIF,QAAQV,IAAI,KAAK,OAAO;QAC1B,OAAO;IACT,OAAO,IAAIU,QAAQV,IAAI,KAAK,WAAW;QACrC,OAAO;IACT;IACA,OAAO;AACT;AAEA,eAAeQ,mBAAmB"}

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -982,6 +982,10 @@ export * from './workspace.js';
 exports[`ts#agent generator > should match snapshot for Terraform generated files > terraform-agent.tf 1`] = `
 "terraform {
   required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.61.0"
+    }
     random = {
       source  = "hashicorp/random"
       version = "3.9.0"
@@ -1293,6 +1297,10 @@ exports[`ts#agent generator > should match snapshot for Terraform generated file
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"

package/src/ts/dcr-proxy/__snapshots__/generator.spec.ts.snap

@@ -585,6 +585,10 @@ terraform {
       source  = "hashicorp/archive"
       version = "2.8.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 

package/src/ts/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -147,6 +147,10 @@ exports[`ts-lambda-function generator > terraform iac > should generate terrafor
       source  = "hashicorp/archive"
       version = "2.8.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 
@@ -328,6 +332,10 @@ exports[`ts-lambda-function generator > terraform iac > should match snapshot fo
       source  = "hashicorp/archive"
       version = "2.8.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
   }
 }
 

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -157,6 +157,10 @@ exports[`ts#mcp-server generator > should match snapshot for Terraform generated
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -539,6 +539,20 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enablePerformanceInsights?: boolean;
+
+  /**
+   * Minimum Aurora Serverless v2 ACUs.
+   *
+   * @default 0.5
+   */
+  readonly serverlessV2MinCapacity?: number;
+
+  /**
+   * Maximum Aurora Serverless v2 ACUs.
+   *
+   * @default 4
+   */
+  readonly serverlessV2MaxCapacity?: number;
 }
 
 /**
@@ -568,6 +582,8 @@ export abstract class AuroraDatabase extends Construct {
       enableKeyRotation = true,
       enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
+      serverlessV2MinCapacity = 0.5,
+      serverlessV2MaxCapacity = 4,
       engine,
       engineVersion,
       ...clusterProps
@@ -583,6 +599,8 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
+      serverlessV2MinCapacity,
+      serverlessV2MaxCapacity,
       writer:
         writer ??
         ClusterInstance.serverlessV2('writer', {
@@ -1562,6 +1580,10 @@ exports[`ts#rdb generator > should generate terraform modules when iac is Terraf
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"
@@ -1643,9 +1665,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -1666,6 +1688,12 @@ variable "enable_backup" {
   default     = false
 }
 
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
 variable "tags" {
   description = "Tags to apply to all resources."
   type        = map(string)
@@ -1725,6 +1753,7 @@ module "aurora" {
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
   enable_backup                         = var.enable_backup
+  enable_key_rotation                   = var.enable_key_rotation
   tags                                  = var.tags
 }
 
@@ -3054,6 +3083,10 @@ exports[`ts#rdb generator > should generate terraform modules with MySQL engine
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"
@@ -3135,9 +3168,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -3158,6 +3191,12 @@ variable "enable_backup" {
   default     = false
 }
 
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
 variable "tags" {
   description = "Tags to apply to all resources."
   type        = map(string)
@@ -3217,6 +3256,7 @@ module "aurora" {
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
   enable_backup                         = var.enable_backup
+  enable_key_rotation                   = var.enable_key_rotation
   tags                                  = var.tags
 }
 
@@ -4344,6 +4384,20 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enablePerformanceInsights?: boolean;
+
+  /**
+   * Minimum Aurora Serverless v2 ACUs.
+   *
+   * @default 0.5
+   */
+  readonly serverlessV2MinCapacity?: number;
+
+  /**
+   * Maximum Aurora Serverless v2 ACUs.
+   *
+   * @default 4
+   */
+  readonly serverlessV2MaxCapacity?: number;
 }
 
 /**
@@ -4373,6 +4427,8 @@ export abstract class AuroraDatabase extends Construct {
       enableKeyRotation = true,
       enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
+      serverlessV2MinCapacity = 0.5,
+      serverlessV2MaxCapacity = 4,
       engine,
       engineVersion,
       ...clusterProps
@@ -4388,6 +4444,8 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
+      serverlessV2MinCapacity,
+      serverlessV2MaxCapacity,
       writer:
         writer ??
         ClusterInstance.serverlessV2('writer', {

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -134,6 +134,10 @@ exports[`react-website generator > TailwindCSS integration > terraform iac > sho
       version = "6.61.0"
       configuration_aliases = [aws.us_east_1]
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "3.3.1"
+    }
     random = {
       source  = "hashicorp/random"
       version = "3.9.0"

package/src/ts/react-website/cognito-auth/__snapshots__/generator.spec.ts.snap

@@ -118,6 +118,8 @@ import {
   CfnWebACLAssociation,
 } from 'aws-cdk-lib/aws-wafv2';
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
@@ -354,18 +356,43 @@ export class UserIdentity extends Construct {
       webAclArn: webAcl.attrArn,
     });
 
-    // Send WAF request logs to CloudWatch. The log group name must start with
-    // \`aws-waf-logs-\` to satisfy the WAFv2 logging destination requirement.
+    // The log group name must start with \`aws-waf-logs-\` to satisfy the WAFv2
+    // logging destination requirement.
+    const stack = Stack.of(this);
+    const wafLogGroupName = \`aws-waf-logs-\${id}-\${this.node.addr.slice(-8)}\`;
+
+    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [
+          new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
+        ],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnEquals: {
+            'kms:EncryptionContext:aws:logs:arn': \`arn:aws:logs:\${stack.region}:\${stack.account}:log-group:\${wafLogGroupName}\`,
+          },
+        },
+      }),
+    );
+
     const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
-      logGroupName: \`aws-waf-logs-\${id}-\${this.node.addr.slice(-8)}\`,
+      logGroupName: wafLogGroupName,
       retention: RetentionDays.ONE_MONTH,
+      encryptionKey: logsKey,
       removalPolicy: RemovalPolicy.DESTROY,
     });
-    suppressRules(
-      wafLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption for WAF logs',
-    );
 
     new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
       resourceArn: webAcl.attrArn,

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -8,6 +8,10 @@ exports[`cognito-auth generator terraform iac > should generate terraform files
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "3.3.1"
+    }
   }
 }
 

package/src/utils/agent-core-constructs/files/cdk/app/agentcore-harness/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -35,7 +35,10 @@ export interface <%- nameClassName %>Props
   executionRole?: iam.IRole;
   /** Model resources the generated execution role may invoke. */
   modelResourceArns?: string[];
-  /** Tools the Harness may use. Deploys with none unless supplied here. */
+  /**
+   * Tools the Harness may use. Defaults to none; pass `['@builtin']` for every
+   * built-in tool, or name individual tools.
+   */
   allowedTools?: agentcore.CfnHarnessProps['allowedTools'];
   /**
    * Run the Harness in a VPC so it can reach private resources. Selects private
@@ -68,6 +71,9 @@ export class <%- nameClassName %>
         `arn:${stack.partition}:bedrock:*::foundation-model/*`,
         `arn:${stack.partition}:bedrock:${stack.region}:${stack.account}:*`,
       ],
+      // The service treats an absent allowedTools as every tool, so this
+      // defaults to none and is always passed explicitly.
+      allowedTools = [],
       vpc,
       vpcSubnets,
       securityGroups,
@@ -137,6 +143,29 @@ export class <%- nameClassName %>
           actions: ['sts:GetServiceBearerToken'],
           resources: ['*'],
         }),
+        // In a VPC the Harness pulls its managed container from a private ECR
+        // repository in the region rather than ECR Public. The repository is
+        // service-owned, hence the wildcard account.
+        ...(vpc
+          ? [
+              new iam.PolicyStatement({
+                sid: 'EcrManagedImagePull',
+                actions: [
+                  'ecr:BatchGetImage',
+                  'ecr:GetDownloadUrlForLayer',
+                  'ecr:BatchCheckLayerAvailability',
+                ],
+                resources: [
+                  `arn:${stack.partition}:ecr:${stack.region}:*:repository/harness-*`,
+                ],
+              }),
+              new iam.PolicyStatement({
+                sid: 'EcrManagedImageToken',
+                actions: ['ecr:GetAuthorizationToken'],
+                resources: ['*'],
+              }),
+            ]
+          : []),
         new iam.PolicyStatement({
           sid: 'XRayTracingAccess',
           actions: [
@@ -239,6 +268,14 @@ export class <%- nameClassName %>
         'XRayTracingAccess: X-Ray segment and sampling APIs have no resource-level permission.',
         isPolicy,
       );
+      if (vpc) {
+        suppressRules(
+          this.executionRole,
+          WILDCARD_IAM_RULES,
+          'EcrManagedImageToken: ecr:GetAuthorizationToken has no resource-level permission.',
+          isPolicy,
+        );
+      }
     }
 
     // Rendered lazily so security groups added through `connections` after
@@ -281,6 +318,7 @@ export class <%- nameClassName %>
       },
       systemPrompt: [{ text: systemPrompt }],
       ...harnessProps,
+      allowedTools,
       // Set after harnessProps so the deployed name always matches the
       // execution role's workload-identity resource pattern.
       harnessName,

package/src/utils/agent-core-constructs/files/terraform/app/agent-core/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -1,11 +1,18 @@
 <%_ const hasSessionBucket = session === 's3' || session === 'dynamodb-s3'; _%>
-<%_ if (hasSessionBucket) { _%>
+<%_ const usesAws = hasSessionBucket || auth === 'cognito'; _%>
+<%_ if (usesAws) { _%>
 terraform {
   required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+<%_ if (hasSessionBucket) { _%>
     random = {
       source  = "hashicorp/random"
       version = "<%- randomProviderVersion %>"
     }
+<%_ } _%>
   }
 }
 

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -11,6 +11,12 @@ terraform {
       source  = "hashicorp/external"
       version = "<%- externalProviderVersion %>"
     }
+<%_ } _%>
+<%_ if (protocol === 'mcp') { _%>
+    null = {
+      source  = "hashicorp/null"
+      version = "<%- nullProviderVersion %>"
+    }
 <%_ } _%>
     time = {
       source  = "hashicorp/time"
@@ -76,6 +82,8 @@ locals {
 <%_ if (cedarPolicy) { _%>
   policies_dir   = "${path.module}/../../../../../../../<%- projectDirectory %>/policies"
 <%_ } _%>
+
+  gateway_waf_log_group_name = var.enable_waf ? "aws-waf-logs-<%- nameKebabCase %>-${random_id.unique_suffix.hex}" : null
 }
 
 resource "random_id" "unique_suffix" {
@@ -320,14 +328,61 @@ resource "aws_wafv2_web_acl_association" "gateway_waf" {
   web_acl_arn  = aws_wafv2_web_acl.gateway_waf[0].arn
 }
 
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "<%- nameClassName %> gateway WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${local.aws_account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.${local.aws_region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${local.aws_region}:${local.aws_account_id}:log-group:${local.gateway_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/<%- nameKebabCase %>-${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.gateway_waf_logs[0].key_id
+}
+
 # WAF request logs. WAFv2 requires the `aws-waf-logs-` name prefix.
 resource "aws_cloudwatch_log_group" "gateway_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one year which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-<%- nameKebabCase %>-${random_id.unique_suffix.hex}"
+  name              = local.gateway_waf_log_group_name
   retention_in_days = 365
+  kms_key_id        = aws_kms_key.gateway_waf_logs[0].arn
 }
 
 resource "aws_wafv2_web_acl_logging_configuration" "gateway_waf_logging" {