@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.85

package/src/migrations/latest/terraform-project-checkov-target-and-bootstrap-destroy/migration.js

@@ -0,0 +1,146 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { generateFiles, getProjects, joinPathFragments, OverwriteStrategy, updateProjectConfiguration } from "@nx/devkit";
+import { TERRAFORM_PROJECT_GENERATOR_INFO } from "../../../terraform/project/generator.js";
+import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { kebabCase } from "../../../utils/names.js";
+import { normalizeTargetKeyOrder } from "../../../utils/nx.js";
+import { sortObjectKeys } from "../../../utils/object.js";
+/**
+ * Terraform projects gained three fixes:
+ *
+ * - A `checkov` target carries the security scan, matching the name CDK
+ *   infrastructure projects already use, so `nx run-many --target checkov` no
+ *   longer skips Terraform projects. An existing `test` target is the user's,
+ *   so it is left exactly as it is.
+ * - A `checkov.yml` gives Terraform users the same central place to configure
+ *   skips that the CDK app has, wired in via `--config-file`.
+ * - `bootstrap-destroy` runs a script that resolves the region from the AWS SDK
+ *   credential chain and passes it as `-var=aws_region`. The vended
+ *   `aws_region` variable has no default, so the previous bare
+ *   `terraform destroy` blocked forever on an input prompt in any non-TTY
+ *   context.
+ * - Both vended `providers.tf` declare `required_version = ">= 1.0"`, matching
+ *   every other `.tf` file the plugin vends, and the bootstrap one pins the AWS
+ *   provider.
+ *
+ * How to write a migration:
+ * - https://nx.dev/docs/kb/migration-generators
+ * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject
+ */ const hcl = (pattern)=>`language hcl\n${pattern}`;
+/** The scan command, as the pre-fix generator vended it on `test`. */ const CHECKOV_COMMAND_PATTERN = /uvx --from checkov==/;
+const divergedTargetsStep = (projectName)=>`${projectName}: no 'test' target carrying the checkov scan was found, so no 'checkov' target was added - add one running checkov over the project so 'nx run-many --target checkov' includes this project.`;
+const divergedProvidersStep = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. Add \`required_version = ">= 1.0"\` to its \`terraform\` block to pin the minimum Terraform version.`;
+const divergedBootstrapDestroyStep = (projectName)=>`${projectName}: its 'bootstrap-destroy' target no longer matches the shape the generator produced - left untouched. Pass \`-var=aws_region=<region>\` to \`terraform destroy\`, otherwise it blocks on an input prompt when run without a TTY.`;
+/**
+ * Add `required_version` to a `providers.tf` that omits it.
+ *
+ * The bootstrap copy has no `terraform` block at all, so it is created;
+ * the src copy has one holding `required_providers`, so it is added to.
+ */ const migrateRequiredVersion = async (tree, filePath, nextSteps)=>{
+    if (!tree.exists(filePath)) return;
+    // Already declared - nothing to do, whatever constraint the user chose.
+    if (await matchGritQL(tree, filePath, hcl('`required_version = $_`'))) {
+        return;
+    }
+    const hasRequiredProviders = await matchGritQL(tree, filePath, hcl('`terraform { $body }` where { $body <: contains `required_providers` }'));
+    if (hasRequiredProviders) {
+        await applyGritQL(tree, filePath, hcl('`terraform { $body }` => `terraform {\n  required_version = ">= 1.0"\n\n  $body\n}`'));
+        return;
+    }
+    // No `terraform` block: prepend one ahead of the aws provider block.
+    const providerBlock = hcl('`provider "aws" { $body }`');
+    if (!await matchGritQL(tree, filePath, providerBlock)) {
+        nextSteps.push(divergedProvidersStep(filePath));
+        return;
+    }
+    await applyGritQL(tree, filePath, hcl('`provider "aws" { $body }` => `terraform {\n  required_version = ">= 1.0"\n}\n\nprovider "aws" {\n  $body\n}`'));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [projectName, project] of getProjects(tree)){
+        const generator = project.metadata?.generator;
+        if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;
+        const targets = project.targets ?? {};
+        let changed = false;
+        // Add `checkov`, copying the scan from the `test` target the pre-fix
+        // generator put it on. `test` itself belongs to the user and is left as it
+        // is. Guarded on `checkov` being absent so a re-run is a no-op.
+        if (!targets.checkov) {
+            const command = targets.test?.options?.command;
+            if (typeof command !== 'string' || !CHECKOV_COMMAND_PATTERN.test(command)) {
+                nextSteps.push(divergedTargetsStep(projectName));
+            } else {
+                // The config file is vended below, so wire it in at the same time.
+                const withConfigFile = command.includes('--config-file') ? command : command.replace('checkov --directory', 'checkov --config-file ../checkov.yml --directory');
+                targets.checkov = normalizeTargetKeyOrder({
+                    ...targets.test,
+                    options: {
+                        ...targets.test.options,
+                        command: withConfigFile
+                    }
+                });
+                changed = true;
+            }
+        }
+        // Point `bootstrap-destroy` at the vended script, which resolves the
+        // region rather than leaving terraform to prompt for it.
+        const bootstrapDestroy = targets['bootstrap-destroy'];
+        if (bootstrapDestroy) {
+            const scriptCommand = `tsx {projectRoot}/scripts/bootstrap-destroy.ts {projectRoot}`;
+            const alreadyMigrated = bootstrapDestroy.options?.commands?.[0] === scriptCommand;
+            if (!alreadyMigrated) {
+                const command = bootstrapDestroy.options?.command;
+                // Only rewrite the exact shape the generator produced.
+                const isVendedShape = typeof command === 'string' && /^terraform destroy -state=\S+bootstrap\.tfstate$/.test(command.trim());
+                if (!isVendedShape) {
+                    nextSteps.push(divergedBootstrapDestroyStep(projectName));
+                } else {
+                    targets['bootstrap-destroy'] = normalizeTargetKeyOrder({
+                        executor: bootstrapDestroy.executor,
+                        options: {
+                            forwardAllArgs: true,
+                            commands: [
+                                scriptCommand
+                            ],
+                            cwd: '{workspaceRoot}'
+                        }
+                    });
+                    changed = true;
+                }
+            }
+        }
+        if (changed) {
+            updateProjectConfiguration(tree, projectName, {
+                ...project,
+                targets: sortObjectKeys(targets)
+            });
+        }
+        // Vend the checkov config and the bootstrap-destroy script. KeepExisting
+        // leaves a user's own copy alone and makes a re-run a no-op.
+        generateFiles(tree, joinPathFragments(import.meta.dirname, '../../../terraform/project/files/checkov'), project.root, {}, {
+            overwriteStrategy: OverwriteStrategy.KeepExisting
+        });
+        // Only application projects have a bootstrap dir to destroy. The scripts
+        // dir is shared with the generator's templates, so `stateKeyPrefix` is
+        // resolved the same way it computes it; KeepExisting leaves the scripts
+        // that already exist untouched regardless.
+        if (tree.exists(joinPathFragments(project.root, 'bootstrap'))) {
+            generateFiles(tree, joinPathFragments(import.meta.dirname, '../../../terraform/project/files/application/scripts'), joinPathFragments(project.root, 'scripts'), {
+                stateKeyPrefix: kebabCase(projectName)
+            }, {
+                overwriteStrategy: OverwriteStrategy.KeepExisting
+            });
+        }
+        await migrateRequiredVersion(tree, joinPathFragments(project.root, 'src/providers.tf'), nextSteps);
+        await migrateRequiredVersion(tree, joinPathFragments(project.root, 'bootstrap/providers.tf'), nextSteps);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-project-checkov-target-and-bootstrap-destroy/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-project-checkov-target-and-bootstrap-destroy/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  OverwriteStrategy,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { kebabCase } from '../../../utils/names.js';\nimport { normalizeTargetKeyOrder } from '../../../utils/nx.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\n\n/**\n * Terraform projects gained three fixes:\n *\n * - A `checkov` target carries the security scan, matching the name CDK\n *   infrastructure projects already use, so `nx run-many --target checkov` no\n *   longer skips Terraform projects. An existing `test` target is the user's,\n *   so it is left exactly as it is.\n * - A `checkov.yml` gives Terraform users the same central place to configure\n *   skips that the CDK app has, wired in via `--config-file`.\n * - `bootstrap-destroy` runs a script that resolves the region from the AWS SDK\n *   credential chain and passes it as `-var=aws_region`. The vended\n *   `aws_region` variable has no default, so the previous bare\n *   `terraform destroy` blocked forever on an input prompt in any non-TTY\n *   context.\n * - Both vended `providers.tf` declare `required_version = \">= 1.0\"`, matching\n *   every other `.tf` file the plugin vends, and the bootstrap one pins the AWS\n *   provider.\n *\n * How to write a migration:\n * - https://nx.dev/docs/kb/migration-generators\n * - What `nextSteps` means: https://nx.dev/docs/reference/devkit/MigrationReturnObject\n */\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/** The scan command, as the pre-fix generator vended it on `test`. */\nconst CHECKOV_COMMAND_PATTERN = /uvx --from checkov==/;\n\nconst divergedTargetsStep = (projectName: string) =>\n  `${projectName}: no 'test' target carrying the checkov scan was found, so no 'checkov' target was added - add one running checkov over the project so 'nx run-many --target checkov' includes this project.`;\n\nconst divergedProvidersStep = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. Add \\`required_version = \">= 1.0\"\\` to its \\`terraform\\` block to pin the minimum Terraform version.`;\n\nconst divergedBootstrapDestroyStep = (projectName: string) =>\n  `${projectName}: its 'bootstrap-destroy' target no longer matches the shape the generator produced - left untouched. Pass \\`-var=aws_region=<region>\\` to \\`terraform destroy\\`, otherwise it blocks on an input prompt when run without a TTY.`;\n\n/**\n * Add `required_version` to a `providers.tf` that omits it.\n *\n * The bootstrap copy has no `terraform` block at all, so it is created;\n * the src copy has one holding `required_providers`, so it is added to.\n */\nconst migrateRequiredVersion = async (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(filePath)) return;\n\n  // Already declared - nothing to do, whatever constraint the user chose.\n  if (await matchGritQL(tree, filePath, hcl('`required_version = $_`'))) {\n    return;\n  }\n\n  const hasRequiredProviders = await matchGritQL(\n    tree,\n    filePath,\n    hcl(\n      '`terraform { $body }` where { $body <: contains `required_providers` }',\n    ),\n  );\n\n  if (hasRequiredProviders) {\n    await applyGritQL(\n      tree,\n      filePath,\n      hcl(\n        '`terraform { $body }` => `terraform {\\n  required_version = \">= 1.0\"\\n\\n  $body\\n}`',\n      ),\n    );\n    return;\n  }\n\n  // No `terraform` block: prepend one ahead of the aws provider block.\n  const providerBlock = hcl('`provider \"aws\" { $body }`');\n  if (!(await matchGritQL(tree, filePath, providerBlock))) {\n    nextSteps.push(divergedProvidersStep(filePath));\n    return;\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      '`provider \"aws\" { $body }` => `terraform {\\n  required_version = \">= 1.0\"\\n}\\n\\nprovider \"aws\" {\\n  $body\\n}`',\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;\n\n    const targets = project.targets ?? {};\n    let changed = false;\n\n    // Add `checkov`, copying the scan from the `test` target the pre-fix\n    // generator put it on. `test` itself belongs to the user and is left as it\n    // is. Guarded on `checkov` being absent so a re-run is a no-op.\n    if (!targets.checkov) {\n      const command = targets.test?.options?.command;\n\n      if (\n        typeof command !== 'string' ||\n        !CHECKOV_COMMAND_PATTERN.test(command)\n      ) {\n        nextSteps.push(divergedTargetsStep(projectName));\n      } else {\n        // The config file is vended below, so wire it in at the same time.\n        const withConfigFile = command.includes('--config-file')\n          ? command\n          : command.replace(\n              'checkov --directory',\n              'checkov --config-file ../checkov.yml --directory',\n            );\n\n        targets.checkov = normalizeTargetKeyOrder({\n          ...targets.test,\n          options: { ...targets.test.options, command: withConfigFile },\n        });\n        changed = true;\n      }\n    }\n\n    // Point `bootstrap-destroy` at the vended script, which resolves the\n    // region rather than leaving terraform to prompt for it.\n    const bootstrapDestroy = targets['bootstrap-destroy'];\n    if (bootstrapDestroy) {\n      const scriptCommand = `tsx {projectRoot}/scripts/bootstrap-destroy.ts {projectRoot}`;\n      const alreadyMigrated =\n        bootstrapDestroy.options?.commands?.[0] === scriptCommand;\n\n      if (!alreadyMigrated) {\n        const command = bootstrapDestroy.options?.command;\n        // Only rewrite the exact shape the generator produced.\n        const isVendedShape =\n          typeof command === 'string' &&\n          /^terraform destroy -state=\\S+bootstrap\\.tfstate$/.test(\n            command.trim(),\n          );\n\n        if (!isVendedShape) {\n          nextSteps.push(divergedBootstrapDestroyStep(projectName));\n        } else {\n          targets['bootstrap-destroy'] = normalizeTargetKeyOrder({\n            executor: bootstrapDestroy.executor,\n            options: {\n              forwardAllArgs: true,\n              commands: [scriptCommand],\n              cwd: '{workspaceRoot}',\n            },\n          });\n          changed = true;\n        }\n      }\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, {\n        ...project,\n        targets: sortObjectKeys(targets),\n      });\n    }\n\n    // Vend the checkov config and the bootstrap-destroy script. KeepExisting\n    // leaves a user's own copy alone and makes a re-run a no-op.\n    generateFiles(\n      tree,\n      joinPathFragments(\n        import.meta.dirname,\n        '../../../terraform/project/files/checkov',\n      ),\n      project.root,\n      {},\n      { overwriteStrategy: OverwriteStrategy.KeepExisting },\n    );\n\n    // Only application projects have a bootstrap dir to destroy. The scripts\n    // dir is shared with the generator's templates, so `stateKeyPrefix` is\n    // resolved the same way it computes it; KeepExisting leaves the scripts\n    // that already exist untouched regardless.\n    if (tree.exists(joinPathFragments(project.root, 'bootstrap'))) {\n      generateFiles(\n        tree,\n        joinPathFragments(\n          import.meta.dirname,\n          '../../../terraform/project/files/application/scripts',\n        ),\n        joinPathFragments(project.root, 'scripts'),\n        { stateKeyPrefix: kebabCase(projectName) },\n        { overwriteStrategy: OverwriteStrategy.KeepExisting },\n      );\n    }\n\n    await migrateRequiredVersion(\n      tree,\n      joinPathFragments(project.root, 'src/providers.tf'),\n      nextSteps,\n    );\n    await migrateRequiredVersion(\n      tree,\n      joinPathFragments(project.root, 'bootstrap/providers.tf'),\n      nextSteps,\n    );\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["generateFiles","getProjects","joinPathFragments","OverwriteStrategy","updateProjectConfiguration","TERRAFORM_PROJECT_GENERATOR_INFO","applyGritQL","matchGritQL","formatFilesInSubtree","kebabCase","normalizeTargetKeyOrder","sortObjectKeys","hcl","pattern","CHECKOV_COMMAND_PATTERN","divergedTargetsStep","projectName","divergedProvidersStep","filePath","divergedBootstrapDestroyStep","migrateRequiredVersion","tree","nextSteps","exists","hasRequiredProviders","providerBlock","push","migration","project","generator","metadata","id","targets","changed","checkov","command","test","options","withConfigFile","includes","replace","bootstrapDestroy","scriptCommand","alreadyMigrated","commands","isVendedShape","trim","executor","forwardAllArgs","cwd","dirname","root","overwriteStrategy","KeepExisting","stateKeyPrefix"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,WAAW,EACXC,iBAAiB,EAEjBC,iBAAiB,EAEjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SAASC,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,SAAS,QAAQ,0BAA0B;AACpD,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,cAAc,QAAQ,2BAA2B;AAE1D;;;;;;;;;;;;;;;;;;;;;CAqBC,GAED,MAAMC,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,oEAAoE,GACpE,MAAMC,0BAA0B;AAEhC,MAAMC,sBAAsB,CAACC,cAC3B,GAAGA,YAAY,4LAA4L,CAAC;AAE9M,MAAMC,wBAAwB,CAACC,WAC7B,GAAGA,SAAS,8JAA8J,CAAC;AAE7K,MAAMC,+BAA+B,CAACH,cACpC,GAAGA,YAAY,gOAAgO,CAAC;AAElP;;;;;CAKC,GACD,MAAMI,yBAAyB,OAC7BC,MACAH,UACAI;IAEA,IAAI,CAACD,KAAKE,MAAM,CAACL,WAAW;IAE5B,wEAAwE;IACxE,IAAI,MAAMX,YAAYc,MAAMH,UAAUN,IAAI,6BAA6B;QACrE;IACF;IAEA,MAAMY,uBAAuB,MAAMjB,YACjCc,MACAH,UACAN,IACE;IAIJ,IAAIY,sBAAsB;QACxB,MAAMlB,YACJe,MACAH,UACAN,IACE;QAGJ;IACF;IAEA,qEAAqE;IACrE,MAAMa,gBAAgBb,IAAI;IAC1B,IAAI,CAAE,MAAML,YAAYc,MAAMH,UAAUO,gBAAiB;QACvDH,UAAUI,IAAI,CAACT,sBAAsBC;QACrC;IACF;IAEA,MAAMZ,YACJe,MACAH,UACAN,IACE;AAGN;AAEA,eAAe,eAAee,UAC5BN,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACN,aAAaY,QAAQ,IAAI3B,YAAYoB,MAAO;QACtD,MAAMQ,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcxB,iCAAiC0B,EAAE,EAAE;QAEvD,MAAMC,UAAUJ,QAAQI,OAAO,IAAI,CAAC;QACpC,IAAIC,UAAU;QAEd,qEAAqE;QACrE,2EAA2E;QAC3E,gEAAgE;QAChE,IAAI,CAACD,QAAQE,OAAO,EAAE;YACpB,MAAMC,UAAUH,QAAQI,IAAI,EAAEC,SAASF;YAEvC,IACE,OAAOA,YAAY,YACnB,CAACrB,wBAAwBsB,IAAI,CAACD,UAC9B;gBACAb,UAAUI,IAAI,CAACX,oBAAoBC;YACrC,OAAO;gBACL,mEAAmE;gBACnE,MAAMsB,iBAAiBH,QAAQI,QAAQ,CAAC,mBACpCJ,UACAA,QAAQK,OAAO,CACb,uBACA;gBAGNR,QAAQE,OAAO,GAAGxB,wBAAwB;oBACxC,GAAGsB,QAAQI,IAAI;oBACfC,SAAS;wBAAE,GAAGL,QAAQI,IAAI,CAACC,OAAO;wBAAEF,SAASG;oBAAe;gBAC9D;gBACAL,UAAU;YACZ;QACF;QAEA,qEAAqE;QACrE,yDAAyD;QACzD,MAAMQ,mBAAmBT,OAAO,CAAC,oBAAoB;QACrD,IAAIS,kBAAkB;YACpB,MAAMC,gBAAgB,CAAC,4DAA4D,CAAC;YACpF,MAAMC,kBACJF,iBAAiBJ,OAAO,EAAEO,UAAU,CAAC,EAAE,KAAKF;YAE9C,IAAI,CAACC,iBAAiB;gBACpB,MAAMR,UAAUM,iBAAiBJ,OAAO,EAAEF;gBAC1C,uDAAuD;gBACvD,MAAMU,gBACJ,OAAOV,YAAY,YACnB,mDAAmDC,IAAI,CACrDD,QAAQW,IAAI;gBAGhB,IAAI,CAACD,eAAe;oBAClBvB,UAAUI,IAAI,CAACP,6BAA6BH;gBAC9C,OAAO;oBACLgB,OAAO,CAAC,oBAAoB,GAAGtB,wBAAwB;wBACrDqC,UAAUN,iBAAiBM,QAAQ;wBACnCV,SAAS;4BACPW,gBAAgB;4BAChBJ,UAAU;gCAACF;6BAAc;4BACzBO,KAAK;wBACP;oBACF;oBACAhB,UAAU;gBACZ;YACF;QACF;QAEA,IAAIA,SAAS;YACX7B,2BAA2BiB,MAAML,aAAa;gBAC5C,GAAGY,OAAO;gBACVI,SAASrB,eAAeqB;YAC1B;QACF;QAEA,yEAAyE;QACzE,6DAA6D;QAC7DhC,cACEqB,MACAnB,kBACE,YAAYgD,OAAO,EACnB,6CAEFtB,QAAQuB,IAAI,EACZ,CAAC,GACD;YAAEC,mBAAmBjD,kBAAkBkD,YAAY;QAAC;QAGtD,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,2CAA2C;QAC3C,IAAIhC,KAAKE,MAAM,CAACrB,kBAAkB0B,QAAQuB,IAAI,EAAE,eAAe;YAC7DnD,cACEqB,MACAnB,kBACE,YAAYgD,OAAO,EACnB,yDAEFhD,kBAAkB0B,QAAQuB,IAAI,EAAE,YAChC;gBAAEG,gBAAgB7C,UAAUO;YAAa,GACzC;gBAAEoC,mBAAmBjD,kBAAkBkD,YAAY;YAAC;QAExD;QAEA,MAAMjC,uBACJC,MACAnB,kBAAkB0B,QAAQuB,IAAI,EAAE,qBAChC7B;QAEF,MAAMF,uBACJC,MACAnB,kBAAkB0B,QAAQuB,IAAI,EAAE,2BAChC7B;IAEJ;IAEA,MAAMd,qBAAqBa;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/migrations/latest/waf-log-group-cmk-encryption/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,286 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`waf-log-group-cmk-encryption migration > should encrypt the cdk user identity WAF log group 1`] = `
+"import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { CfnLoggingConfiguration, CfnWebACL } from 'aws-cdk-lib/aws-wafv2';
+import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Construct } from 'constructs';
+import { suppressRules } from './checkov.js';
+
+export class UserIdentity extends Construct {
+  private createWebAcl = (id: string) => {
+    const webAcl = new CfnWebACL(this, 'WebAcl', {});
+
+    // Send WAF request logs to CloudWatch. The log group name must start with
+    // \`aws-waf-logs-\` to satisfy the WAFv2 logging destination requirement.
+    const stack = Stack.of(this);
+    const wafLogGroupName = \`aws-waf-logs-\${id}-\${this.node.addr.slice(-8)}\`;
+
+    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [
+          new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
+        ],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnEquals: {
+            'kms:EncryptionContext:aws:logs:arn': \`arn:aws:logs:\${stack.region}:\${stack.account}:log-group:\${wafLogGroupName}\`,
+          },
+        },
+      }),
+    );
+
+    const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
+      logGroupName: wafLogGroupName,
+      encryptionKey: logsKey,
+      retention: RetentionDays.ONE_MONTH,
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+
+    new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
+      resourceArn: webAcl.attrArn,
+      logDestinationConfigs: [wafLogGroup.logGroupArn],
+    });
+
+    return webAcl;
+  };
+}
+"
+`;
+
+exports[`waf-log-group-cmk-encryption migration > should encrypt the terraform gateway WAF log group via the module locals 1`] = `
+"data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+locals {
+  aws_account_id = data.aws_caller_identity.current.account_id
+  aws_region     = data.aws_region.current.id
+  gateway_waf_log_group_name = var.enable_waf ? "aws-waf-logs-my-gateway-\${random_id.unique_suffix.hex}" : null
+}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+# WAF request logs. WAFv2 requires the \`aws-waf-logs-\` name prefix.
+resource "aws_cloudwatch_log_group" "gateway_waf_logs" {
+  #checkov:skip=CKV_AWS_338:Log retention set to one year which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = local.gateway_waf_log_group_name
+  kms_key_id        = aws_kms_key.gateway_waf_logs[0].arn
+  retention_in_days = 365
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "my-gateway gateway WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${local.aws_account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${local.aws_region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${local.aws_region}:\${local.aws_account_id}:log-group:\${local.gateway_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/my-gateway-\${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.gateway_waf_logs[0].key_id
+}
+"
+`;
+
+exports[`waf-log-group-cmk-encryption migration > should encrypt the terraform rest api WAF log group 1`] = `
+"data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+locals {
+  existing = "untouched"
+  waf_log_group_name = var.enable_waf ? "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}" : null
+}
+
+# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
+resource "aws_cloudwatch_log_group" "api_waf_logs" {
+  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = local.waf_log_group_name
+  kms_key_id        = aws_kms_key.waf_logs[0].arn
+  retention_in_days = 30
+  tags              = var.tags
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "\${var.api_name} API WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/\${var.api_name}-\${random_id.waf_log_suffix[0].hex}-waf-logs"
+  target_key_id = aws_kms_key.waf_logs[0].key_id
+}
+
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+"
+`;
+
+exports[`waf-log-group-cmk-encryption migration > should encrypt the terraform user identity WAF log group 1`] = `
+"data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+locals {
+  local_callback_urls = [
+    "http://localhost:4200"
+  ]
+  user_pool_waf_log_group_name = var.enable_waf ? "aws-waf-logs-UserPool-\${random_id.unique_suffix.hex}" : null
+}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
+resource "aws_cloudwatch_log_group" "user_pool_waf_logs" {
+  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = local.user_pool_waf_log_group_name
+  kms_key_id        = aws_kms_key.user_pool_waf_logs[0].arn
+  retention_in_days = 30
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "user_pool_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "User pool WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.user_pool_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "user_pool_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/user-pool-\${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.user_pool_waf_logs[0].key_id
+}
+"
+`;

package/src/migrations/latest/waf-log-group-cmk-encryption/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Encrypt vended WAF log groups with a customer-managed KMS key"
+}

package/src/migrations/latest/waf-log-group-cmk-encryption/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;