@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.85

package/src/utils/api-constructs/open-api-metadata.d.ts

@@ -9,9 +9,26 @@ export interface AddOpenApiMetadataGenerateTargetOptions {
     apiNameKebabCase: string;
     specPath: string;
     specBuildTargetName: string;
+    /**
+     * How integrations are mapped to operations. Terraform only needs the
+     * operations metadata for the `isolated` pattern, since the `shared` pattern
+     * routes every operation to one proxy Lambda.
+     */
+    integrationPattern?: 'isolated' | 'shared';
 }
 /**
- * Adds a generate:<api-name>-metadata target to shared constructs (CDK only)
- * This allows for API CDK constructs to have type-safety for integrations based on an OpenAPI Specification
+ * Adds a target which generates metadata about the API's operations from its
+ * OpenAPI specification, so that infrastructure can define an integration per
+ * operation.
+ *
+ * For CDK this generates TypeScript, giving the construct type-safe integrations.
+ * For Terraform this generates JSON, which the vended module reads to build one
+ * Lambda function and route per operation.
  */
-export declare const addSharedConstructsOpenApiMetadataGenerateTarget: (tree: Tree, { iac, apiNameKebabCase, specPath, specBuildTargetName, }: AddOpenApiMetadataGenerateTargetOptions) => void;
+export declare const addSharedConstructsOpenApiMetadataGenerateTarget: (tree: Tree, options: AddOpenApiMetadataGenerateTargetOptions) => void;
+/**
+ * Directory the operations metadata for an API is generated into, relative to
+ * the shared Terraform project's `src`. The vended module reads the file from
+ * here, so the module template and this target must agree on the location.
+ */
+export declare const terraformOperationsMetadataDir: (apiNameKebabCase: string) => string;

package/src/utils/api-constructs/open-api-metadata.js

@@ -4,16 +4,23 @@
  */ import { joinPathFragments, updateJson } from "@nx/devkit";
 import { updateGitIgnore } from "../git.js";
 import { addDependencyToTargetIfNotPresent } from "../nx.js";
-import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../shared-constructs-constants.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 /**
- * Adds a generate:<api-name>-metadata target to shared constructs (CDK only)
- * This allows for API CDK constructs to have type-safety for integrations based on an OpenAPI Specification
- */ export const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, { iac, apiNameKebabCase, specPath, specBuildTargetName })=>{
-    if (iac !== 'cdk') {
-        // For Terraform, we do not support type-safe integration builders, rather only the single lambda
-        // router pattern, and therefore do not need to add depenencies on metadata generation.
-        return;
+ * Adds a target which generates metadata about the API's operations from its
+ * OpenAPI specification, so that infrastructure can define an integration per
+ * operation.
+ *
+ * For CDK this generates TypeScript, giving the construct type-safe integrations.
+ * For Terraform this generates JSON, which the vended module reads to build one
+ * Lambda function and route per operation.
+ */ export const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, options)=>{
+    if (options.iac === 'cdk') {
+        addCdkOpenApiMetadataGenerateTarget(tree, options);
+    } else if (options.iac === 'terraform') {
+        addTerraformOpenApiOperationsGenerateTarget(tree, options);
     }
+};
+const addCdkOpenApiMetadataGenerateTarget = (tree, { apiNameKebabCase, specPath, specBuildTargetName })=>{
     const generatedMetadataDir = joinPathFragments('generated', apiNameKebabCase);
     const generatedMetadataDirFromRoot = joinPathFragments(joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR), 'src', generatedMetadataDir);
     updateJson(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'), (config)=>{
@@ -58,5 +65,54 @@ import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../shared-constructs-consta
             joinPathFragments('src', generatedMetadataDir)
         ]);
 };
+/**
+ * Directory the operations metadata for an API is generated into, relative to
+ * the shared Terraform project's `src`. The vended module reads the file from
+ * here, so the module template and this target must agree on the location.
+ */ export const terraformOperationsMetadataDir = (apiNameKebabCase)=>joinPathFragments('generated', apiNameKebabCase);
+const addTerraformOpenApiOperationsGenerateTarget = (tree, { apiNameKebabCase, specPath, specBuildTargetName, integrationPattern })=>{
+    // The `shared` pattern routes every operation to a single proxy Lambda, so the
+    // module has no need for the operations metadata.
+    if (integrationPattern !== 'isolated') {
+        return;
+    }
+    const generatedDirFromRoot = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', terraformOperationsMetadataDir(apiNameKebabCase));
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        config.targets ??= {};
+        // Terraform reads the operations metadata with `file()`, so it must exist
+        // before plan; the target is wired into `build` below.
+        const operationsTargetName = `generate:${apiNameKebabCase}-operations`;
+        if (!config.targets[operationsTargetName]) {
+            config.targets[operationsTargetName] = {
+                cache: true,
+                executor: 'nx:run-commands',
+                inputs: [
+                    {
+                        dependentTasksOutputFiles: '**/*.json'
+                    }
+                ],
+                outputs: [
+                    joinPathFragments('{workspaceRoot}', generatedDirFromRoot)
+                ],
+                options: {
+                    commands: [
+                        `nx g @aws/nx-plugin:open-api#json-metadata --openApiSpecPath="${specPath}" --outputPath="${generatedDirFromRoot}" --no-interactive`
+                    ]
+                },
+                dependsOn: [
+                    specBuildTargetName
+                ]
+            };
+        }
+        addDependencyToTargetIfNotPresent(config, 'build', operationsTargetName);
+        return config;
+    });
+    // Ignore the generated metadata by default
+    // Users can safely remove the entry from the .gitignore if they prefer to check it in
+    updateGitIgnore(tree, joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR), (patterns)=>[
+            ...patterns,
+            joinPathFragments('src', terraformOperationsMetadataDir(apiNameKebabCase))
+        ]);
+};
 
 //# sourceMappingURL=open-api-metadata.js.map

package/src/utils/api-constructs/open-api-metadata.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/open-api-metadata.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { updateGitIgnore } from '../git.js';\nimport type { Iac } from '../iac.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n} from '../shared-constructs-constants.js';\n\nexport interface AddOpenApiMetadataGenerateTargetOptions {\n  iac: Iac;\n  apiNameKebabCase: string;\n  specPath: string;\n  specBuildTargetName: string;\n}\n\n/**\n * Adds a generate:<api-name>-metadata target to shared constructs (CDK only)\n * This allows for API CDK constructs to have type-safety for integrations based on an OpenAPI Specification\n */\nexport const addSharedConstructsOpenApiMetadataGenerateTarget = (\n  tree: Tree,\n  {\n    iac,\n    apiNameKebabCase,\n    specPath,\n    specBuildTargetName,\n  }: AddOpenApiMetadataGenerateTargetOptions,\n) => {\n  if (iac !== 'cdk') {\n    // For Terraform, we do not support type-safe integration builders, rather only the single lambda\n    // router pattern, and therefore do not need to add depenencies on metadata generation.\n    return;\n  }\n\n  const generatedMetadataDir = joinPathFragments('generated', apiNameKebabCase);\n  const generatedMetadataDirFromRoot = joinPathFragments(\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n    'src',\n    generatedMetadataDir,\n  );\n\n  updateJson(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'),\n    (config: ProjectConfiguration) => {\n      if (!config.targets) {\n        config.targets = {};\n      }\n      if (!config.targets.build) {\n        config.targets.build = {};\n      }\n      // If not already defined, add a target to generate metadata from the OpenAPI spec, used\n      // for providing a type-safe CDK construct\n      const metadataTargetName = `generate:${apiNameKebabCase}-metadata`;\n      if (!config.targets[metadataTargetName]) {\n        config.targets[metadataTargetName] = {\n          cache: true,\n          executor: 'nx:run-commands',\n          inputs: [\n            {\n              dependentTasksOutputFiles: '**/*.json',\n            },\n          ],\n          outputs: [\n            joinPathFragments('{workspaceRoot}', generatedMetadataDirFromRoot),\n          ],\n          options: {\n            commands: [\n              `nx g @aws/nx-plugin:open-api#ts-metadata --openApiSpecPath=\"${specPath}\" --outputPath=\"${generatedMetadataDirFromRoot}\" --no-interactive`,\n            ],\n          },\n          dependsOn: [specBuildTargetName],\n        };\n      }\n      addDependencyToTargetIfNotPresent(config, 'compile', metadataTargetName);\n      return config;\n    },\n  );\n\n  // Ignore the generated metadata by default\n  // Users can safely remove the entry from the .gitignore if they prefer to check it in\n  updateGitIgnore(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n    (patterns) => [...patterns, joinPathFragments('src', generatedMetadataDir)],\n  );\n};\n"],"names":["joinPathFragments","updateJson","updateGitIgnore","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","addSharedConstructsOpenApiMetadataGenerateTarget","tree","iac","apiNameKebabCase","specPath","specBuildTargetName","generatedMetadataDir","generatedMetadataDirFromRoot","config","targets","build","metadataTargetName","cache","executor","inputs","dependentTasksOutputFiles","outputs","options","commands","dependsOn","patterns"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,eAAe,QAAQ,YAAY;AAE5C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,qBAAqB,QAChB,oCAAoC;AAS3C;;;CAGC,GACD,OAAO,MAAMC,mDAAmD,CAC9DC,MACA,EACEC,GAAG,EACHC,gBAAgB,EAChBC,QAAQ,EACRC,mBAAmB,EACqB;IAE1C,IAAIH,QAAQ,OAAO;QACjB,iGAAiG;QACjG,uFAAuF;QACvF;IACF;IAEA,MAAMI,uBAAuBZ,kBAAkB,aAAaS;IAC5D,MAAMI,+BAA+Bb,kBACnCA,kBAAkBI,cAAcC,wBAChC,OACAO;IAGFX,WACEM,MACAP,kBAAkBI,cAAcC,uBAAuB,iBACvD,CAACS;QACC,IAAI,CAACA,OAAOC,OAAO,EAAE;YACnBD,OAAOC,OAAO,GAAG,CAAC;QACpB;QACA,IAAI,CAACD,OAAOC,OAAO,CAACC,KAAK,EAAE;YACzBF,OAAOC,OAAO,CAACC,KAAK,GAAG,CAAC;QAC1B;QACA,wFAAwF;QACxF,0CAA0C;QAC1C,MAAMC,qBAAqB,CAAC,SAAS,EAAER,iBAAiB,SAAS,CAAC;QAClE,IAAI,CAACK,OAAOC,OAAO,CAACE,mBAAmB,EAAE;YACvCH,OAAOC,OAAO,CAACE,mBAAmB,GAAG;gBACnCC,OAAO;gBACPC,UAAU;gBACVC,QAAQ;oBACN;wBACEC,2BAA2B;oBAC7B;iBACD;gBACDC,SAAS;oBACPtB,kBAAkB,mBAAmBa;iBACtC;gBACDU,SAAS;oBACPC,UAAU;wBACR,CAAC,4DAA4D,EAAEd,SAAS,gBAAgB,EAAEG,6BAA6B,kBAAkB,CAAC;qBAC3I;gBACH;gBACAY,WAAW;oBAACd;iBAAoB;YAClC;QACF;QACAR,kCAAkCW,QAAQ,WAAWG;QACrD,OAAOH;IACT;IAGF,2CAA2C;IAC3C,sFAAsF;IACtFZ,gBACEK,MACAP,kBAAkBI,cAAcC,wBAChC,CAACqB,WAAa;eAAIA;YAAU1B,kBAAkB,OAAOY;SAAsB;AAE/E,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/open-api-metadata.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { updateGitIgnore } from '../git.js';\nimport type { Iac } from '../iac.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\n\nexport interface AddOpenApiMetadataGenerateTargetOptions {\n  iac: Iac;\n  apiNameKebabCase: string;\n  specPath: string;\n  specBuildTargetName: string;\n  /**\n   * How integrations are mapped to operations. Terraform only needs the\n   * operations metadata for the `isolated` pattern, since the `shared` pattern\n   * routes every operation to one proxy Lambda.\n   */\n  integrationPattern?: 'isolated' | 'shared';\n}\n\n/**\n * Adds a target which generates metadata about the API's operations from its\n * OpenAPI specification, so that infrastructure can define an integration per\n * operation.\n *\n * For CDK this generates TypeScript, giving the construct type-safe integrations.\n * For Terraform this generates JSON, which the vended module reads to build one\n * Lambda function and route per operation.\n */\nexport const addSharedConstructsOpenApiMetadataGenerateTarget = (\n  tree: Tree,\n  options: AddOpenApiMetadataGenerateTargetOptions,\n) => {\n  if (options.iac === 'cdk') {\n    addCdkOpenApiMetadataGenerateTarget(tree, options);\n  } else if (options.iac === 'terraform') {\n    addTerraformOpenApiOperationsGenerateTarget(tree, options);\n  }\n};\n\nconst addCdkOpenApiMetadataGenerateTarget = (\n  tree: Tree,\n  {\n    apiNameKebabCase,\n    specPath,\n    specBuildTargetName,\n  }: AddOpenApiMetadataGenerateTargetOptions,\n) => {\n  const generatedMetadataDir = joinPathFragments('generated', apiNameKebabCase);\n  const generatedMetadataDirFromRoot = joinPathFragments(\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n    'src',\n    generatedMetadataDir,\n  );\n\n  updateJson(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'),\n    (config: ProjectConfiguration) => {\n      if (!config.targets) {\n        config.targets = {};\n      }\n      if (!config.targets.build) {\n        config.targets.build = {};\n      }\n      // If not already defined, add a target to generate metadata from the OpenAPI spec, used\n      // for providing a type-safe CDK construct\n      const metadataTargetName = `generate:${apiNameKebabCase}-metadata`;\n      if (!config.targets[metadataTargetName]) {\n        config.targets[metadataTargetName] = {\n          cache: true,\n          executor: 'nx:run-commands',\n          inputs: [\n            {\n              dependentTasksOutputFiles: '**/*.json',\n            },\n          ],\n          outputs: [\n            joinPathFragments('{workspaceRoot}', generatedMetadataDirFromRoot),\n          ],\n          options: {\n            commands: [\n              `nx g @aws/nx-plugin:open-api#ts-metadata --openApiSpecPath=\"${specPath}\" --outputPath=\"${generatedMetadataDirFromRoot}\" --no-interactive`,\n            ],\n          },\n          dependsOn: [specBuildTargetName],\n        };\n      }\n      addDependencyToTargetIfNotPresent(config, 'compile', metadataTargetName);\n      return config;\n    },\n  );\n\n  // Ignore the generated metadata by default\n  // Users can safely remove the entry from the .gitignore if they prefer to check it in\n  updateGitIgnore(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR),\n    (patterns) => [...patterns, joinPathFragments('src', generatedMetadataDir)],\n  );\n};\n\n/**\n * Directory the operations metadata for an API is generated into, relative to\n * the shared Terraform project's `src`. The vended module reads the file from\n * here, so the module template and this target must agree on the location.\n */\nexport const terraformOperationsMetadataDir = (apiNameKebabCase: string) =>\n  joinPathFragments('generated', apiNameKebabCase);\n\nconst addTerraformOpenApiOperationsGenerateTarget = (\n  tree: Tree,\n  {\n    apiNameKebabCase,\n    specPath,\n    specBuildTargetName,\n    integrationPattern,\n  }: AddOpenApiMetadataGenerateTargetOptions,\n) => {\n  // The `shared` pattern routes every operation to a single proxy Lambda, so the\n  // module has no need for the operations metadata.\n  if (integrationPattern !== 'isolated') {\n    return;\n  }\n\n  const generatedDirFromRoot = joinPathFragments(\n    PACKAGES_DIR,\n    SHARED_TERRAFORM_DIR,\n    'src',\n    terraformOperationsMetadataDir(apiNameKebabCase),\n  );\n\n  updateJson(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'project.json'),\n    (config: ProjectConfiguration) => {\n      config.targets ??= {};\n      // Terraform reads the operations metadata with `file()`, so it must exist\n      // before plan; the target is wired into `build` below.\n      const operationsTargetName = `generate:${apiNameKebabCase}-operations`;\n      if (!config.targets[operationsTargetName]) {\n        config.targets[operationsTargetName] = {\n          cache: true,\n          executor: 'nx:run-commands',\n          inputs: [\n            {\n              dependentTasksOutputFiles: '**/*.json',\n            },\n          ],\n          outputs: [joinPathFragments('{workspaceRoot}', generatedDirFromRoot)],\n          options: {\n            commands: [\n              `nx g @aws/nx-plugin:open-api#json-metadata --openApiSpecPath=\"${specPath}\" --outputPath=\"${generatedDirFromRoot}\" --no-interactive`,\n            ],\n          },\n          dependsOn: [specBuildTargetName],\n        };\n      }\n      addDependencyToTargetIfNotPresent(config, 'build', operationsTargetName);\n      return config;\n    },\n  );\n\n  // Ignore the generated metadata by default\n  // Users can safely remove the entry from the .gitignore if they prefer to check it in\n  updateGitIgnore(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR),\n    (patterns) => [\n      ...patterns,\n      joinPathFragments(\n        'src',\n        terraformOperationsMetadataDir(apiNameKebabCase),\n      ),\n    ],\n  );\n};\n"],"names":["joinPathFragments","updateJson","updateGitIgnore","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","addSharedConstructsOpenApiMetadataGenerateTarget","tree","options","iac","addCdkOpenApiMetadataGenerateTarget","addTerraformOpenApiOperationsGenerateTarget","apiNameKebabCase","specPath","specBuildTargetName","generatedMetadataDir","generatedMetadataDirFromRoot","config","targets","build","metadataTargetName","cache","executor","inputs","dependentTasksOutputFiles","outputs","commands","dependsOn","patterns","terraformOperationsMetadataDir","integrationPattern","generatedDirFromRoot","operationsTargetName"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,eAAe,QAAQ,YAAY;AAE5C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAe3C;;;;;;;;CAQC,GACD,OAAO,MAAMC,mDAAmD,CAC9DC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzBC,oCAAoCH,MAAMC;IAC5C,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,4CAA4CJ,MAAMC;IACpD;AACF,EAAE;AAEF,MAAME,sCAAsC,CAC1CH,MACA,EACEK,gBAAgB,EAChBC,QAAQ,EACRC,mBAAmB,EACqB;IAE1C,MAAMC,uBAAuBhB,kBAAkB,aAAaa;IAC5D,MAAMI,+BAA+BjB,kBACnCA,kBAAkBI,cAAcC,wBAChC,OACAW;IAGFf,WACEO,MACAR,kBAAkBI,cAAcC,uBAAuB,iBACvD,CAACa;QACC,IAAI,CAACA,OAAOC,OAAO,EAAE;YACnBD,OAAOC,OAAO,GAAG,CAAC;QACpB;QACA,IAAI,CAACD,OAAOC,OAAO,CAACC,KAAK,EAAE;YACzBF,OAAOC,OAAO,CAACC,KAAK,GAAG,CAAC;QAC1B;QACA,wFAAwF;QACxF,0CAA0C;QAC1C,MAAMC,qBAAqB,CAAC,SAAS,EAAER,iBAAiB,SAAS,CAAC;QAClE,IAAI,CAACK,OAAOC,OAAO,CAACE,mBAAmB,EAAE;YACvCH,OAAOC,OAAO,CAACE,mBAAmB,GAAG;gBACnCC,OAAO;gBACPC,UAAU;gBACVC,QAAQ;oBACN;wBACEC,2BAA2B;oBAC7B;iBACD;gBACDC,SAAS;oBACP1B,kBAAkB,mBAAmBiB;iBACtC;gBACDR,SAAS;oBACPkB,UAAU;wBACR,CAAC,4DAA4D,EAAEb,SAAS,gBAAgB,EAAEG,6BAA6B,kBAAkB,CAAC;qBAC3I;gBACH;gBACAW,WAAW;oBAACb;iBAAoB;YAClC;QACF;QACAZ,kCAAkCe,QAAQ,WAAWG;QACrD,OAAOH;IACT;IAGF,2CAA2C;IAC3C,sFAAsF;IACtFhB,gBACEM,MACAR,kBAAkBI,cAAcC,wBAChC,CAACwB,WAAa;eAAIA;YAAU7B,kBAAkB,OAAOgB;SAAsB;AAE/E;AAEA;;;;CAIC,GACD,OAAO,MAAMc,iCAAiC,CAACjB,mBAC7Cb,kBAAkB,aAAaa,kBAAkB;AAEnD,MAAMD,8CAA8C,CAClDJ,MACA,EACEK,gBAAgB,EAChBC,QAAQ,EACRC,mBAAmB,EACnBgB,kBAAkB,EACsB;IAE1C,+EAA+E;IAC/E,kDAAkD;IAClD,IAAIA,uBAAuB,YAAY;QACrC;IACF;IAEA,MAAMC,uBAAuBhC,kBAC3BI,cACAE,sBACA,OACAwB,+BAA+BjB;IAGjCZ,WACEO,MACAR,kBAAkBI,cAAcE,sBAAsB,iBACtD,CAACY;QACCA,OAAOC,OAAO,KAAK,CAAC;QACpB,0EAA0E;QAC1E,uDAAuD;QACvD,MAAMc,uBAAuB,CAAC,SAAS,EAAEpB,iBAAiB,WAAW,CAAC;QACtE,IAAI,CAACK,OAAOC,OAAO,CAACc,qBAAqB,EAAE;YACzCf,OAAOC,OAAO,CAACc,qBAAqB,GAAG;gBACrCX,OAAO;gBACPC,UAAU;gBACVC,QAAQ;oBACN;wBACEC,2BAA2B;oBAC7B;iBACD;gBACDC,SAAS;oBAAC1B,kBAAkB,mBAAmBgC;iBAAsB;gBACrEvB,SAAS;oBACPkB,UAAU;wBACR,CAAC,8DAA8D,EAAEb,SAAS,gBAAgB,EAAEkB,qBAAqB,kBAAkB,CAAC;qBACrI;gBACH;gBACAJ,WAAW;oBAACb;iBAAoB;YAClC;QACF;QACAZ,kCAAkCe,QAAQ,SAASe;QACnD,OAAOf;IACT;IAGF,2CAA2C;IAC3C,sFAAsF;IACtFhB,gBACEM,MACAR,kBAAkBI,cAAcE,uBAChC,CAACuB,WAAa;eACTA;YACH7B,kBACE,OACA8B,+BAA+BjB;SAElC;AAEL"}

package/src/utils/api-constructs/trpc-operations-metadata.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type ProjectConfiguration, type Tree } from '@nx/devkit';
+export interface AddTrpcOperationsMetadataTargetOptions {
+    apiNameKebabCase: string;
+    /** The tRPC backend project the operations are derived from. */
+    project: ProjectConfiguration;
+    /** Template variables for the vended script (module format). */
+    templateOptions: Record<string, unknown>;
+}
+/**
+ * Adds operations metadata generation for a tRPC API deployed with Terraform.
+ *
+ * tRPC has no OpenAPI specification, so the operations are derived by walking
+ * the router: a vended script writes the same JSON shape the OpenAPI-based
+ * generator produces, which the Terraform module reads to define one Lambda
+ * function and route per procedure.
+ */
+export declare const addTrpcOperationsMetadataTarget: (tree: Tree, { apiNameKebabCase, project, templateOptions, }: AddTrpcOperationsMetadataTargetOptions) => void;

package/src/utils/api-constructs/trpc-operations-metadata.js

@@ -0,0 +1,55 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { OPERATIONS_METADATA_FILE_NAME } from "../../open-api/json-metadata/generator.js";
+import { updateGitIgnore } from "../git.js";
+import { addDependencyToTargetIfNotPresent } from "../nx.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { terraformOperationsMetadataDir } from "./open-api-metadata.js";
+/**
+ * Adds operations metadata generation for a tRPC API deployed with Terraform.
+ *
+ * tRPC has no OpenAPI specification, so the operations are derived by walking
+ * the router: a vended script writes the same JSON shape the OpenAPI-based
+ * generator produces, which the Terraform module reads to define one Lambda
+ * function and route per procedure.
+ */ export const addTrpcOperationsMetadataTarget = (tree, { apiNameKebabCase, project, templateOptions })=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, '..', '..', 'trpc', 'backend', 'files-operations'), project.root, templateOptions, {
+        overwriteStrategy: OverwriteStrategy.Overwrite
+    });
+    const generatedDirFromRoot = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', terraformOperationsMetadataDir(apiNameKebabCase));
+    const operationsFile = joinPathFragments(generatedDirFromRoot, OPERATIONS_METADATA_FILE_NAME);
+    project.targets ??= {};
+    project.targets.operations ??= {
+        cache: true,
+        executor: 'nx:run-commands',
+        outputs: [
+            joinPathFragments('{workspaceRoot}', generatedDirFromRoot)
+        ],
+        options: {
+            commands: [
+                `tsx {projectRoot}/scripts/generate-operations.ts ${operationsFile}`
+            ],
+            cwd: '{workspaceRoot}'
+        },
+        dependsOn: [
+            'compile'
+        ]
+    };
+    addDependencyToTargetIfNotPresent(project, 'build', 'operations');
+    // The shared Terraform project reads the generated file with `file()`, so it
+    // must be written before that project is planned.
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addDependencyToTargetIfNotPresent(config, 'build', `${project.name}:operations`);
+        return config;
+    });
+    // Ignore the generated metadata by default
+    // Users can safely remove the entry from the .gitignore if they prefer to check it in
+    updateGitIgnore(tree, joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR), (patterns)=>[
+            ...patterns,
+            joinPathFragments('src', terraformOperationsMetadataDir(apiNameKebabCase))
+        ]);
+};
+
+//# sourceMappingURL=trpc-operations-metadata.js.map

package/src/utils/api-constructs/trpc-operations-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/api-constructs/trpc-operations-metadata.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { OPERATIONS_METADATA_FILE_NAME } from '../../open-api/json-metadata/generator.js';\nimport { updateGitIgnore } from '../git.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { terraformOperationsMetadataDir } from './open-api-metadata.js';\n\nexport interface AddTrpcOperationsMetadataTargetOptions {\n  apiNameKebabCase: string;\n  /** The tRPC backend project the operations are derived from. */\n  project: ProjectConfiguration;\n  /** Template variables for the vended script (module format). */\n  templateOptions: Record<string, unknown>;\n}\n\n/**\n * Adds operations metadata generation for a tRPC API deployed with Terraform.\n *\n * tRPC has no OpenAPI specification, so the operations are derived by walking\n * the router: a vended script writes the same JSON shape the OpenAPI-based\n * generator produces, which the Terraform module reads to define one Lambda\n * function and route per procedure.\n */\nexport const addTrpcOperationsMetadataTarget = (\n  tree: Tree,\n  {\n    apiNameKebabCase,\n    project,\n    templateOptions,\n  }: AddTrpcOperationsMetadataTargetOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(\n      import.meta.dirname,\n      '..',\n      '..',\n      'trpc',\n      'backend',\n      'files-operations',\n    ),\n    project.root,\n    templateOptions,\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  const generatedDirFromRoot = joinPathFragments(\n    PACKAGES_DIR,\n    SHARED_TERRAFORM_DIR,\n    'src',\n    terraformOperationsMetadataDir(apiNameKebabCase),\n  );\n  const operationsFile = joinPathFragments(\n    generatedDirFromRoot,\n    OPERATIONS_METADATA_FILE_NAME,\n  );\n\n  project.targets ??= {};\n  project.targets.operations ??= {\n    cache: true,\n    executor: 'nx:run-commands',\n    outputs: [joinPathFragments('{workspaceRoot}', generatedDirFromRoot)],\n    options: {\n      commands: [\n        `tsx {projectRoot}/scripts/generate-operations.ts ${operationsFile}`,\n      ],\n      cwd: '{workspaceRoot}',\n    },\n    dependsOn: ['compile'],\n  };\n  addDependencyToTargetIfNotPresent(project, 'build', 'operations');\n\n  // The shared Terraform project reads the generated file with `file()`, so it\n  // must be written before that project is planned.\n  updateJson(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'project.json'),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${project.name}:operations`,\n      );\n      return config;\n    },\n  );\n\n  // Ignore the generated metadata by default\n  // Users can safely remove the entry from the .gitignore if they prefer to check it in\n  updateGitIgnore(\n    tree,\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR),\n    (patterns) => [\n      ...patterns,\n      joinPathFragments(\n        'src',\n        terraformOperationsMetadataDir(apiNameKebabCase),\n      ),\n    ],\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","OPERATIONS_METADATA_FILE_NAME","updateGitIgnore","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_TERRAFORM_DIR","terraformOperationsMetadataDir","addTrpcOperationsMetadataTarget","tree","apiNameKebabCase","project","templateOptions","dirname","root","overwriteStrategy","Overwrite","generatedDirFromRoot","operationsFile","targets","operations","cache","executor","outputs","options","commands","cwd","dependsOn","config","name","patterns"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,6BAA6B,QAAQ,4CAA4C;AAC1F,SAASC,eAAe,QAAQ,YAAY;AAC5C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,8BAA8B,QAAQ,yBAAyB;AAUxE;;;;;;;CAOC,GACD,OAAO,MAAMC,kCAAkC,CAC7CC,MACA,EACEC,gBAAgB,EAChBC,OAAO,EACPC,eAAe,EACwB;IAEzCd,cACEW,MACAV,kBACE,YAAYc,OAAO,EACnB,MACA,MACA,QACA,WACA,qBAEFF,QAAQG,IAAI,EACZF,iBACA;QACEG,mBAAmBf,kBAAkBgB,SAAS;IAChD;IAGF,MAAMC,uBAAuBlB,kBAC3BM,cACAC,sBACA,OACAC,+BAA+BG;IAEjC,MAAMQ,iBAAiBnB,kBACrBkB,sBACAf;IAGFS,QAAQQ,OAAO,KAAK,CAAC;IACrBR,QAAQQ,OAAO,CAACC,UAAU,KAAK;QAC7BC,OAAO;QACPC,UAAU;QACVC,SAAS;YAACxB,kBAAkB,mBAAmBkB;SAAsB;QACrEO,SAAS;YACPC,UAAU;gBACR,CAAC,iDAAiD,EAAEP,gBAAgB;aACrE;YACDQ,KAAK;QACP;QACAC,WAAW;YAAC;SAAU;IACxB;IACAvB,kCAAkCO,SAAS,SAAS;IAEpD,6EAA6E;IAC7E,kDAAkD;IAClDV,WACEQ,MACAV,kBAAkBM,cAAcC,sBAAsB,iBACtD,CAACsB;QACCxB,kCACEwB,QACA,SACA,GAAGjB,QAAQkB,IAAI,CAAC,WAAW,CAAC;QAE9B,OAAOD;IACT;IAGF,2CAA2C;IAC3C,sFAAsF;IACtFzB,gBACEM,MACAV,kBAAkBM,cAAcC,uBAChC,CAACwB,WAAa;eACTA;YACH/B,kBACE,OACAQ,+BAA+BG;SAElC;AAEL,EAAE"}

package/src/utils/dcr-proxy-constructs/files/terraform/app/dcr-proxies/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -15,6 +15,10 @@ terraform {
       source  = "hashicorp/archive"
       version = "<%- archiveProviderVersion %>"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
   }
 }
 

package/src/utils/files/terraform/src/metrics/providers.tf.template

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "<%- awsProviderVersion %>"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
+  }
+}

package/src/utils/function-constructs/files/terraform/app/lambda-functions/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -8,6 +8,10 @@ terraform {
       source  = "hashicorp/archive"
       version = "<%- archiveProviderVersion %>"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "<%- randomProviderVersion %>"
+    }
   }
 }
 

package/src/utils/identity-constructs/files/cdk/core/user-identity.ts.template

@@ -29,6 +29,8 @@ import {
   CfnWebACLAssociation,
 } from 'aws-cdk-lib/aws-wafv2';
 import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config<% if (esm) { %>.js<% } %>';
 import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
@@ -265,18 +267,41 @@ export class UserIdentity extends Construct {
       webAclArn: webAcl.attrArn,
     });
 
-    // Send WAF request logs to CloudWatch. The log group name must start with
-    // `aws-waf-logs-` to satisfy the WAFv2 logging destination requirement.
+    // The log group name must start with `aws-waf-logs-` to satisfy the WAFv2
+    // logging destination requirement.
+    const stack = Stack.of(this);
+    const wafLogGroupName = `aws-waf-logs-${id}-${this.node.addr.slice(-8)}`;
+
+    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [new ServicePrincipal(`logs.${stack.region}.amazonaws.com`)],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnEquals: {
+            'kms:EncryptionContext:aws:logs:arn': `arn:aws:logs:${stack.region}:${stack.account}:log-group:${wafLogGroupName}`,
+          },
+        },
+      }),
+    );
+
     const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
-      logGroupName: `aws-waf-logs-${id}-${this.node.addr.slice(-8)}`,
+      logGroupName: wafLogGroupName,
       retention: RetentionDays.ONE_MONTH,
+      encryptionKey: logsKey,
       removalPolicy: RemovalPolicy.DESTROY,
     });
-    suppressRules(
-      wafLogGroup,
-      ['CKV_AWS_158'],
-      'Using default CloudWatch log encryption for WAF logs',
-    );
 
     new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
       resourceArn: webAcl.attrArn,

package/src/utils/identity-constructs/files/terraform/core/user-identity/add-callback-url/add-callback-url.tf.template

@@ -4,6 +4,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "<%- awsProviderVersion %>"
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "<%- nullProviderVersion %>"
+    }
   }
 }
 

package/src/utils/identity-constructs/files/terraform/core/user-identity/identity/identity.tf.template

@@ -73,6 +73,8 @@ locals {
     "http://localhost:4200",
     "http://localhost:4300"
   ]
+
+  user_pool_waf_log_group_name = var.enable_waf ? "aws-waf-logs-UserPool-${random_id.unique_suffix.hex}" : null
 }
 
 # Random suffix for resource names
@@ -368,14 +370,61 @@ resource "aws_wafv2_web_acl_association" "user_pool_waf_association" {
   web_acl_arn  = aws_wafv2_web_acl.user_pool_waf[0].arn
 }
 
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "user_pool_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "User pool WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:${local.user_pool_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "user_pool_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/user-pool-${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.user_pool_waf_logs[0].key_id
+}
+
 # CloudWatch Log Group for WAF request logs. Name must start with `aws-waf-logs-`.
 resource "aws_cloudwatch_log_group" "user_pool_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-UserPool-${random_id.unique_suffix.hex}"
+  name              = local.user_pool_waf_log_group_name
   retention_in_days = 30
+  kms_key_id        = aws_kms_key.user_pool_waf_logs[0].arn
 }
 
 resource "aws_wafv2_web_acl_logging_configuration" "user_pool_waf_logging" {

package/src/utils/rdb-constructs/files/cdk/core/rdb/aurora.ts.template

@@ -180,6 +180,20 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enablePerformanceInsights?: boolean;
+
+  /**
+   * Minimum Aurora Serverless v2 ACUs.
+   *
+   * @default <%= serverlessMinCapacity %>
+   */
+  readonly serverlessV2MinCapacity?: number;
+
+  /**
+   * Maximum Aurora Serverless v2 ACUs.
+   *
+   * @default <%= serverlessMaxCapacity %>
+   */
+  readonly serverlessV2MaxCapacity?: number;
 }
 
 /**
@@ -209,6 +223,8 @@ export abstract class AuroraDatabase extends Construct {
       enableKeyRotation = true,
       enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
+      serverlessV2MinCapacity = <%= serverlessMinCapacity %>,
+      serverlessV2MaxCapacity = <%= serverlessMaxCapacity %>,
       engine,
       engineVersion,
       ...clusterProps
@@ -224,6 +240,8 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
+      serverlessV2MinCapacity,
+      serverlessV2MaxCapacity,
       writer:
         writer ??
         ClusterInstance.serverlessV2("writer", {

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -10,6 +10,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "<%- awsProviderVersion %>"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "<%- externalProviderVersion %>"
+    }
     null = {
       source  = "hashicorp/null"
       version = "<%- nullProviderVersion %>"
@@ -51,13 +55,13 @@ variable "port" {
 variable "serverless_min_capacity" {
   description = "Minimum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 0.5
+  default     = <%= serverlessMinCapacity %>
 }
 
 variable "serverless_max_capacity" {
   description = "Maximum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 4
+  default     = <%= serverlessMaxCapacity %>
 }
 
 variable "instance_count" {
@@ -91,9 +95,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -114,6 +118,12 @@ variable "enable_backup" {
   default     = false
 }
 
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
 variable "tags" {
   description = "Tags to apply to all resources."
   type        = map(string)
@@ -184,6 +194,7 @@ module "aurora" {
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
   enable_backup                         = var.enable_backup
+  enable_key_rotation                   = var.enable_key_rotation
   tags                                  = var.tags
 }
 

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -84,13 +84,13 @@ variable "port" {
 variable "serverless_min_capacity" {
   description = "Minimum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 0.5
+  default     = <%= serverlessMinCapacity %>
 }
 
 variable "serverless_max_capacity" {
   description = "Maximum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 4
+  default     = <%= serverlessMaxCapacity %>
 }
 
 variable "instance_count" {

package/src/utils/rdb-constructs/rdb-constructs.d.ts

@@ -5,6 +5,18 @@
 import { type Tree } from '@nx/devkit';
 import type { Containers } from '../containers.js';
 import type { Iac } from '../iac.js';
+/**
+ * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive
+ * from so the same generator options vend the same ceiling regardless of `--iac`.
+ *
+ * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose
+ * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on
+ * the ceiling, so the maximum is headroom rather than a cost commitment.
+ */
+export declare const AURORA_SERVERLESS_V2_CAPACITY: {
+    readonly min: 0.5;
+    readonly max: 4;
+};
 export interface AddRdbConstructOptions {
     projectName: string;
     projectRoot: string;

package/src/utils/rdb-constructs/rdb-constructs.js

@@ -7,6 +7,24 @@ import { esmVars } from "../module-format.js";
 import { addDependencyToTargetIfNotPresent } from "../nx.js";
 import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 import { terraformProviderVersions } from "../versions.js";
+/**
+ * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive
+ * from so the same generator options vend the same ceiling regardless of `--iac`.
+ *
+ * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose
+ * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on
+ * the ceiling, so the maximum is headroom rather than a cost commitment.
+ */ export const AURORA_SERVERLESS_V2_CAPACITY = {
+    min: 0.5,
+    max: 4
+};
+/**
+ * Substitution variables exposing the Aurora Serverless v2 scaling bounds to
+ * generated CDK and Terraform templates.
+ */ const auroraServerlessV2Capacity = ()=>({
+        serverlessMinCapacity: AURORA_SERVERLESS_V2_CAPACITY.min,
+        serverlessMaxCapacity: AURORA_SERVERLESS_V2_CAPACITY.max
+    });
 export const addRdbInfra = async (tree, options)=>{
     if (options.iac === 'cdk') {
         await addRdbCdkConstructs(tree, options);
@@ -23,7 +41,8 @@ export const addRdbInfra = async (tree, options)=>{
 export const addRdbCdkConstructs = async (tree, options)=>{
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'rdb'), {
         ...options,
-        ...esmVars(tree)
+        ...esmVars(tree),
+        ...auroraServerlessV2Capacity()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
@@ -39,13 +58,15 @@ export const addRdbCdkConstructs = async (tree, options)=>{
 };
 export const addRdbTerraformModules = (tree, options)=>{
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'), {
-        ...terraformProviderVersions()
+        ...terraformProviderVersions(),
+        ...auroraServerlessV2Capacity()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'), {
         ...options,
-        ...terraformProviderVersions()
+        ...terraformProviderVersions(),
+        ...auroraServerlessV2Capacity()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });