@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.85

package/src/migrations/latest/waf-log-group-cmk-encryption/migration.js

@@ -0,0 +1,238 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { addDestructuredImport, applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * WAF request logs carry full request metadata - URIs, headers and client IPs -
+ * so the vended WAF log groups are encrypted with a customer-managed KMS key,
+ * matching how the vended access log groups beside them already are. Three were
+ * plaintext: the Terraform REST API and user-pool WAF log groups, the Terraform
+ * AgentCore gateway WAF log group, and the CDK user-pool WAF log group. Each now
+ * gets a key whose policy grants CloudWatch Logs use of it, scoped by
+ * `kms:EncryptionContext:aws:logs:arn` to that log group alone.
+ *
+ * CloudWatch Logs cannot encrypt a log group that already exists in place, so
+ * this only rewrites the vended templates. On the next deploy Terraform sets
+ * `kms_key_id` on the existing group (an in-place update) and CloudFormation
+ * replaces the CDK one, which the vended `RemovalPolicy.DESTROY` already allows.
+ * Events written before then stay unencrypted; the `nextSteps` note says so.
+ */ const CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;
+const TERRAFORM_SRC = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src`;
+const CDK_USER_IDENTITY_FILE = `${CONSTRUCTS_SRC}/core/user-identity.ts`;
+const TERRAFORM_REST_API_FILE = `${TERRAFORM_SRC}/core/api/rest-api/rest-api.tf`;
+const TERRAFORM_USER_IDENTITY_FILE = `${TERRAFORM_SRC}/core/user-identity/identity/identity.tf`;
+const TERRAFORM_GATEWAYS_DIR = `${TERRAFORM_SRC}/app/gateways`;
+const divergedMessage = (file)=>`${file}: the WAF log group has diverged from the generated shape - left untouched. Its request logs stay unencrypted. To encrypt them, add a customer-managed KMS key granting the \`logs.<region>.amazonaws.com\` service principal kms:Encrypt/Decrypt/ReEncrypt*/GenerateDataKey*/DescribeKey, conditioned on \`kms:EncryptionContext:aws:logs:arn\` matching the log group, and point the log group at it (see the vended WAF log group template).`;
+const ALREADY_ENCRYPTED_TERRAFORM = 'aws_kms_key.';
+// Terraform (HCL) patterns are built from plain strings rather than JS template
+// literals, since the HCL text itself is full of `${...}` interpolations that
+// would otherwise be parsed as JS interpolation.
+const hcl = (pattern)=>'language hcl\n' + pattern;
+const REST_API_LOG_GROUP = {
+    logGroupLabel: 'api_waf_logs',
+    keyLabel: 'waf_logs',
+    nameLocal: 'waf_log_group_name',
+    nameExpression: 'var.enable_waf ? "aws-waf-logs-${var.api_name}-${random_id.waf_log_suffix[0].hex}" : null',
+    keyDescription: '"${var.api_name} API WAF log encryption"',
+    aliasName: '"alias/${var.api_name}-${random_id.waf_log_suffix[0].hex}-waf-logs"',
+    accountId: 'data.aws_caller_identity.current.account_id',
+    region: 'data.aws_region.current.region',
+    tagged: true
+};
+const USER_IDENTITY_LOG_GROUP = {
+    logGroupLabel: 'user_pool_waf_logs',
+    keyLabel: 'user_pool_waf_logs',
+    nameLocal: 'user_pool_waf_log_group_name',
+    nameExpression: 'var.enable_waf ? "aws-waf-logs-UserPool-${random_id.unique_suffix.hex}" : null',
+    keyDescription: '"User pool WAF log encryption"',
+    aliasName: '"alias/user-pool-${random_id.unique_suffix.hex}-waf-logs"',
+    accountId: 'data.aws_caller_identity.current.account_id',
+    region: 'data.aws_region.current.region',
+    tagged: false
+};
+const gatewayLogGroup = (nameKebabCase)=>({
+        logGroupLabel: 'gateway_waf_logs',
+        keyLabel: 'gateway_waf_logs',
+        nameLocal: 'gateway_waf_log_group_name',
+        nameExpression: `var.enable_waf ? "aws-waf-logs-${nameKebabCase}-\${random_id.unique_suffix.hex}" : null`,
+        keyDescription: `"${nameKebabCase} gateway WAF log encryption"`,
+        aliasName: `"alias/${nameKebabCase}-\${random_id.unique_suffix.hex}-waf-logs"`,
+        accountId: 'local.aws_account_id',
+        region: 'local.aws_region',
+        tagged: false
+    });
+/** The KMS key and alias resources, as the templates now vend them. */ const keyResourcesText = (group)=>[
+        '# KMS key for encrypting WAF request logs at rest',
+        `resource "aws_kms_key" "${group.keyLabel}" {`,
+        '  count = var.enable_waf ? 1 : 0',
+        '',
+        `  description             = ${group.keyDescription}`,
+        '  deletion_window_in_days = 7',
+        '  enable_key_rotation     = true',
+        '',
+        '  policy = jsonencode({',
+        '    Version = "2012-10-17"',
+        '    Statement = [',
+        '      {',
+        '        Sid       = "Enable IAM User Permissions"',
+        '        Effect    = "Allow"',
+        `        Principal = { AWS = "arn:aws:iam::\${${group.accountId}}:root" }`,
+        '        Action    = "kms:*"',
+        '        Resource  = "*"',
+        '      },',
+        '      {',
+        '        Sid       = "Allow CloudWatch Logs"',
+        '        Effect    = "Allow"',
+        `        Principal = { Service = "logs.\${${group.region}}.amazonaws.com" }`,
+        '        Action = [',
+        '          "kms:Encrypt",',
+        '          "kms:Decrypt",',
+        '          "kms:ReEncrypt*",',
+        '          "kms:GenerateDataKey*",',
+        '          "kms:DescribeKey"',
+        '        ]',
+        '        Resource = "*"',
+        '        Condition = {',
+        '          ArnEquals = {',
+        `            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${${group.region}}:\${${group.accountId}}:log-group:\${local.${group.nameLocal}}"`,
+        '          }',
+        '        }',
+        '      }',
+        '    ]',
+        '  })',
+        ...group.tagged ? [
+            '',
+            '  tags = var.tags'
+        ] : [],
+        '}',
+        '',
+        `resource "aws_kms_alias" "${group.keyLabel}" {`,
+        '  count = var.enable_waf ? 1 : 0',
+        '',
+        `  name          = ${group.aliasName}`,
+        `  target_key_id = aws_kms_key.${group.keyLabel}[0].key_id`,
+        '}'
+    ].join('\n');
+const migrateTerraformLogGroup = async (tree, file, group, nextSteps)=>{
+    const contents = tree.read(file, 'utf-8') ?? '';
+    // The WAF log group is only vended when WAF is enabled, so it may be absent.
+    if (!contents.includes(`"aws_cloudwatch_log_group" "${group.logGroupLabel}"`)) {
+        return;
+    }
+    const LOG_GROUP_BLOCK = hcl(`\`resource "aws_cloudwatch_log_group" "${group.logGroupLabel}" { $body }\``);
+    const NAME_LINE = hcl(`\`name = ${group.nameExpression.replace(/^var\.enable_waf \? /, '').replace(/ : null$/, '')}\` as $line where {\n` + `  $line <: within \`resource "aws_cloudwatch_log_group" "${group.logGroupLabel}" { $_ }\`\n` + '}');
+    const SUPPRESSION_LINE = '#checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption';
+    const LOCALS_BLOCK = hcl('`locals { $body }`');
+    if (contents.includes(ALREADY_ENCRYPTED_TERRAFORM + group.keyLabel)) {
+        return; // Already migrated.
+    }
+    const ready = await matchGritQL(tree, file, LOG_GROUP_BLOCK) && await matchGritQL(tree, file, NAME_LINE) && await matchGritQL(tree, file, LOCALS_BLOCK) && contents.includes(SUPPRESSION_LINE);
+    if (!ready) {
+        nextSteps.push(divergedMessage(file));
+        return;
+    }
+    // 1. Route the log group name through a local, so the key policy's encryption
+    //    context condition can name the same log group.
+    await insertViaGritQL(tree, file, LOCALS_BLOCK + ` as $l => \`locals {\n  $body\n  ${GRIT_INSERT_PLACEHOLDER}\n}\``, `${group.nameLocal} = ${group.nameExpression}`);
+    await applyGritQL(tree, file, NAME_LINE + ` => \`name              = local.${group.nameLocal}\``);
+    // 2. Point the log group at a new key, added after it so the log group keeps
+    //    the comment above it.
+    await insertViaGritQL(tree, file, hcl(`\`name = local.${group.nameLocal}\` as $line where {\n` + `  $line <: within \`resource "aws_cloudwatch_log_group" "${group.logGroupLabel}" { $_ }\`\n` + '}') + ` => \`$line\n  ${GRIT_INSERT_PLACEHOLDER}\``, `kms_key_id        = aws_kms_key.${group.keyLabel}[0].arn`);
+    await insertViaGritQL(tree, file, LOG_GROUP_BLOCK + ` as $lg => \`$lg\n\n${GRIT_INSERT_PLACEHOLDER}\``, keyResourcesText(group));
+    // 3. Drop the suppression the encryption makes redundant.
+    const updated = (tree.read(file, 'utf-8') ?? '').split('\n').filter((line)=>line.trim() !== SUPPRESSION_LINE).join('\n');
+    tree.write(file, updated);
+};
+/**
+ * The vended CDK user-pool WAF log group gains an `encryptionKey`, matching the
+ * eight sibling CDK WAF log groups which already pass one.
+ */ const migrateCdkUserIdentity = async (tree, nextSteps)=>{
+    if (!tree.exists(CDK_USER_IDENTITY_FILE)) {
+        return; // This workspace has no CDK user identity construct.
+    }
+    const contents = tree.read(CDK_USER_IDENTITY_FILE, 'utf-8') ?? '';
+    // The WAF web ACL (and its log group) is optional, so it may be absent.
+    if (!contents.includes(`new LogGroup(this, 'WebAclLogs'`)) {
+        return;
+    }
+    if (contents.includes('WebAclLogsKey')) {
+        return; // Already migrated.
+    }
+    // Already encrypted, whether by this migration or by the user's own key.
+    if (await matchGritQL(tree, CDK_USER_IDENTITY_FILE, "`new LogGroup(this, 'WebAclLogs', { $props })` where { $props <: contains `encryptionKey` }")) {
+        return;
+    }
+    const LOG_GROUP = "`new LogGroup(this, 'WebAclLogs', { $props })` as $lg where { $props <: contains `logGroupName: $name` }";
+    const SUPPRESS_CALL = "`suppressRules(wafLogGroup, ['CKV_AWS_158'], $reason)` as $call";
+    const ready = await matchGritQL(tree, CDK_USER_IDENTITY_FILE, LOG_GROUP) && await matchGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL);
+    if (!ready) {
+        nextSteps.push(divergedMessage(CDK_USER_IDENTITY_FILE));
+        return;
+    }
+    await addDestructuredImport(tree, CDK_USER_IDENTITY_FILE, [
+        'Key'
+    ], 'aws-cdk-lib/aws-kms');
+    await addDestructuredImport(tree, CDK_USER_IDENTITY_FILE, [
+        'Effect',
+        'PolicyStatement',
+        'ServicePrincipal'
+    ], 'aws-cdk-lib/aws-iam');
+    // Hoist the log group name into a const so the key policy's encryption context
+    // condition can name the same log group, then create the key above the group.
+    await insertViaGritQL(tree, CDK_USER_IDENTITY_FILE, "`const wafLogGroup = new LogGroup(this, 'WebAclLogs', { $props })` as $decl => " + `\`${GRIT_INSERT_PLACEHOLDER}\n\n$decl\``, `const stack = Stack.of(this);
+    const wafLogGroupName = \`aws-waf-logs-\${id}-\${this.node.addr.slice(-8)}\`;
+
+    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`)],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnEquals: {
+            'kms:EncryptionContext:aws:logs:arn': \`arn:aws:logs:\${stack.region}:\${stack.account}:log-group:\${wafLogGroupName}\`,
+          },
+        },
+      }),
+    );`);
+    await applyGritQL(tree, CDK_USER_IDENTITY_FILE, "`logGroupName: $name` as $prop where { $prop <: within `new LogGroup(this, 'WebAclLogs', $_)` } => `logGroupName: wafLogGroupName,\n      encryptionKey: logsKey`");
+    // Drop the suppression the encryption makes redundant.
+    await applyGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL + ' => ``');
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (tree.exists(TERRAFORM_REST_API_FILE)) {
+        await migrateTerraformLogGroup(tree, TERRAFORM_REST_API_FILE, REST_API_LOG_GROUP, nextSteps);
+    }
+    if (tree.exists(TERRAFORM_USER_IDENTITY_FILE)) {
+        await migrateTerraformLogGroup(tree, TERRAFORM_USER_IDENTITY_FILE, USER_IDENTITY_LOG_GROUP, nextSteps);
+    }
+    if (tree.exists(TERRAFORM_GATEWAYS_DIR)) {
+        for (const dirName of tree.children(TERRAFORM_GATEWAYS_DIR)){
+            const file = joinPathFragments(TERRAFORM_GATEWAYS_DIR, dirName, `${dirName}.tf`);
+            if (tree.exists(file)) {
+                await migrateTerraformLogGroup(tree, file, gatewayLogGroup(dirName), nextSteps);
+            }
+        }
+    }
+    await migrateCdkUserIdentity(tree, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/waf-log-group-cmk-encryption/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/waf-log-group-cmk-encryption/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * WAF request logs carry full request metadata - URIs, headers and client IPs -\n * so the vended WAF log groups are encrypted with a customer-managed KMS key,\n * matching how the vended access log groups beside them already are. Three were\n * plaintext: the Terraform REST API and user-pool WAF log groups, the Terraform\n * AgentCore gateway WAF log group, and the CDK user-pool WAF log group. Each now\n * gets a key whose policy grants CloudWatch Logs use of it, scoped by\n * `kms:EncryptionContext:aws:logs:arn` to that log group alone.\n *\n * CloudWatch Logs cannot encrypt a log group that already exists in place, so\n * this only rewrites the vended templates. On the next deploy Terraform sets\n * `kms_key_id` on the existing group (an in-place update) and CloudFormation\n * replaces the CDK one, which the vended `RemovalPolicy.DESTROY` already allows.\n * Events written before then stay unencrypted; the `nextSteps` note says so.\n */\n\nconst CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;\nconst TERRAFORM_SRC = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src`;\n\nconst CDK_USER_IDENTITY_FILE = `${CONSTRUCTS_SRC}/core/user-identity.ts`;\nconst TERRAFORM_REST_API_FILE = `${TERRAFORM_SRC}/core/api/rest-api/rest-api.tf`;\nconst TERRAFORM_USER_IDENTITY_FILE = `${TERRAFORM_SRC}/core/user-identity/identity/identity.tf`;\nconst TERRAFORM_GATEWAYS_DIR = `${TERRAFORM_SRC}/app/gateways`;\n\nconst divergedMessage = (file: string) =>\n  `${file}: the WAF log group has diverged from the generated shape - left untouched. Its request logs stay unencrypted. To encrypt them, add a customer-managed KMS key granting the \\`logs.<region>.amazonaws.com\\` service principal kms:Encrypt/Decrypt/ReEncrypt*/GenerateDataKey*/DescribeKey, conditioned on \\`kms:EncryptionContext:aws:logs:arn\\` matching the log group, and point the log group at it (see the vended WAF log group template).`;\n\nconst ALREADY_ENCRYPTED_TERRAFORM = 'aws_kms_key.';\n\n// Terraform (HCL) patterns are built from plain strings rather than JS template\n// literals, since the HCL text itself is full of `${...}` interpolations that\n// would otherwise be parsed as JS interpolation.\nconst hcl = (pattern: string) => 'language hcl\\n' + pattern;\n\n/** A vended Terraform WAF log group and the key this migration gives it. */\ninterface TerraformWafLogGroup {\n  /** The `aws_cloudwatch_log_group` resource label. */\n  readonly logGroupLabel: string;\n  /** The `aws_kms_key` / `aws_kms_alias` label to create. */\n  readonly keyLabel: string;\n  /** The `locals` entry the log group name moves into. */\n  readonly nameLocal: string;\n  /** The log group's name expression, which becomes the local's value. */\n  readonly nameExpression: string;\n  /** The KMS key description. */\n  readonly keyDescription: string;\n  /** The KMS alias name expression. */\n  readonly aliasName: string;\n  /** How the account id is referenced in this module. */\n  readonly accountId: string;\n  /** How the region is referenced in this module. */\n  readonly region: string;\n  /** Whether the module tags its resources. */\n  readonly tagged: boolean;\n}\n\nconst REST_API_LOG_GROUP: TerraformWafLogGroup = {\n  logGroupLabel: 'api_waf_logs',\n  keyLabel: 'waf_logs',\n  nameLocal: 'waf_log_group_name',\n  nameExpression:\n    'var.enable_waf ? \"aws-waf-logs-${var.api_name}-${random_id.waf_log_suffix[0].hex}\" : null',\n  keyDescription: '\"${var.api_name} API WAF log encryption\"',\n  aliasName:\n    '\"alias/${var.api_name}-${random_id.waf_log_suffix[0].hex}-waf-logs\"',\n  accountId: 'data.aws_caller_identity.current.account_id',\n  region: 'data.aws_region.current.region',\n  tagged: true,\n};\n\nconst USER_IDENTITY_LOG_GROUP: TerraformWafLogGroup = {\n  logGroupLabel: 'user_pool_waf_logs',\n  keyLabel: 'user_pool_waf_logs',\n  nameLocal: 'user_pool_waf_log_group_name',\n  nameExpression:\n    'var.enable_waf ? \"aws-waf-logs-UserPool-${random_id.unique_suffix.hex}\" : null',\n  keyDescription: '\"User pool WAF log encryption\"',\n  aliasName: '\"alias/user-pool-${random_id.unique_suffix.hex}-waf-logs\"',\n  accountId: 'data.aws_caller_identity.current.account_id',\n  region: 'data.aws_region.current.region',\n  tagged: false,\n};\n\nconst gatewayLogGroup = (nameKebabCase: string): TerraformWafLogGroup => ({\n  logGroupLabel: 'gateway_waf_logs',\n  keyLabel: 'gateway_waf_logs',\n  nameLocal: 'gateway_waf_log_group_name',\n  nameExpression: `var.enable_waf ? \"aws-waf-logs-${nameKebabCase}-\\${random_id.unique_suffix.hex}\" : null`,\n  keyDescription: `\"${nameKebabCase} gateway WAF log encryption\"`,\n  aliasName: `\"alias/${nameKebabCase}-\\${random_id.unique_suffix.hex}-waf-logs\"`,\n  accountId: 'local.aws_account_id',\n  region: 'local.aws_region',\n  tagged: false,\n});\n\n/** The KMS key and alias resources, as the templates now vend them. */\nconst keyResourcesText = (group: TerraformWafLogGroup): string =>\n  [\n    '# KMS key for encrypting WAF request logs at rest',\n    `resource \"aws_kms_key\" \"${group.keyLabel}\" {`,\n    '  count = var.enable_waf ? 1 : 0',\n    '',\n    `  description             = ${group.keyDescription}`,\n    '  deletion_window_in_days = 7',\n    '  enable_key_rotation     = true',\n    '',\n    '  policy = jsonencode({',\n    '    Version = \"2012-10-17\"',\n    '    Statement = [',\n    '      {',\n    '        Sid       = \"Enable IAM User Permissions\"',\n    '        Effect    = \"Allow\"',\n    `        Principal = { AWS = \"arn:aws:iam::\\${${group.accountId}}:root\" }`,\n    '        Action    = \"kms:*\"',\n    '        Resource  = \"*\"',\n    '      },',\n    '      {',\n    '        Sid       = \"Allow CloudWatch Logs\"',\n    '        Effect    = \"Allow\"',\n    `        Principal = { Service = \"logs.\\${${group.region}}.amazonaws.com\" }`,\n    '        Action = [',\n    '          \"kms:Encrypt\",',\n    '          \"kms:Decrypt\",',\n    '          \"kms:ReEncrypt*\",',\n    '          \"kms:GenerateDataKey*\",',\n    '          \"kms:DescribeKey\"',\n    '        ]',\n    '        Resource = \"*\"',\n    '        Condition = {',\n    '          ArnEquals = {',\n    `            \"kms:EncryptionContext:aws:logs:arn\" = \"arn:aws:logs:\\${${group.region}}:\\${${group.accountId}}:log-group:\\${local.${group.nameLocal}}\"`,\n    '          }',\n    '        }',\n    '      }',\n    '    ]',\n    '  })',\n    ...(group.tagged ? ['', '  tags = var.tags'] : []),\n    '}',\n    '',\n    `resource \"aws_kms_alias\" \"${group.keyLabel}\" {`,\n    '  count = var.enable_waf ? 1 : 0',\n    '',\n    `  name          = ${group.aliasName}`,\n    `  target_key_id = aws_kms_key.${group.keyLabel}[0].key_id`,\n    '}',\n  ].join('\\n');\n\nconst migrateTerraformLogGroup = async (\n  tree: Tree,\n  file: string,\n  group: TerraformWafLogGroup,\n  nextSteps: string[],\n): Promise<void> => {\n  const contents = tree.read(file, 'utf-8') ?? '';\n\n  // The WAF log group is only vended when WAF is enabled, so it may be absent.\n  if (\n    !contents.includes(`\"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\"`)\n  ) {\n    return;\n  }\n\n  const LOG_GROUP_BLOCK = hcl(\n    `\\`resource \"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\" { $body }\\``,\n  );\n  const NAME_LINE = hcl(\n    `\\`name = ${group.nameExpression.replace(/^var\\.enable_waf \\? /, '').replace(/ : null$/, '')}\\` as $line where {\\n` +\n      `  $line <: within \\`resource \"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\" { $_ }\\`\\n` +\n      '}',\n  );\n  const SUPPRESSION_LINE =\n    '#checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption';\n  const LOCALS_BLOCK = hcl('`locals { $body }`');\n\n  if (contents.includes(ALREADY_ENCRYPTED_TERRAFORM + group.keyLabel)) {\n    return; // Already migrated.\n  }\n\n  const ready =\n    (await matchGritQL(tree, file, LOG_GROUP_BLOCK)) &&\n    (await matchGritQL(tree, file, NAME_LINE)) &&\n    (await matchGritQL(tree, file, LOCALS_BLOCK)) &&\n    contents.includes(SUPPRESSION_LINE);\n\n  if (!ready) {\n    nextSteps.push(divergedMessage(file));\n    return;\n  }\n\n  // 1. Route the log group name through a local, so the key policy's encryption\n  //    context condition can name the same log group.\n  await insertViaGritQL(\n    tree,\n    file,\n    LOCALS_BLOCK +\n      ` as $l => \\`locals {\\n  $body\\n  ${GRIT_INSERT_PLACEHOLDER}\\n}\\``,\n    `${group.nameLocal} = ${group.nameExpression}`,\n  );\n  await applyGritQL(\n    tree,\n    file,\n    NAME_LINE + ` => \\`name              = local.${group.nameLocal}\\``,\n  );\n\n  // 2. Point the log group at a new key, added after it so the log group keeps\n  //    the comment above it.\n  await insertViaGritQL(\n    tree,\n    file,\n    hcl(\n      `\\`name = local.${group.nameLocal}\\` as $line where {\\n` +\n        `  $line <: within \\`resource \"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\" { $_ }\\`\\n` +\n        '}',\n    ) + ` => \\`$line\\n  ${GRIT_INSERT_PLACEHOLDER}\\``,\n    `kms_key_id        = aws_kms_key.${group.keyLabel}[0].arn`,\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    LOG_GROUP_BLOCK + ` as $lg => \\`$lg\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    keyResourcesText(group),\n  );\n\n  // 3. Drop the suppression the encryption makes redundant.\n  const updated = (tree.read(file, 'utf-8') ?? '')\n    .split('\\n')\n    .filter((line) => line.trim() !== SUPPRESSION_LINE)\n    .join('\\n');\n  tree.write(file, updated);\n};\n\n/**\n * The vended CDK user-pool WAF log group gains an `encryptionKey`, matching the\n * eight sibling CDK WAF log groups which already pass one.\n */\nconst migrateCdkUserIdentity = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(CDK_USER_IDENTITY_FILE)) {\n    return; // This workspace has no CDK user identity construct.\n  }\n\n  const contents = tree.read(CDK_USER_IDENTITY_FILE, 'utf-8') ?? '';\n\n  // The WAF web ACL (and its log group) is optional, so it may be absent.\n  if (!contents.includes(`new LogGroup(this, 'WebAclLogs'`)) {\n    return;\n  }\n\n  if (contents.includes('WebAclLogsKey')) {\n    return; // Already migrated.\n  }\n\n  // Already encrypted, whether by this migration or by the user's own key.\n  if (\n    await matchGritQL(\n      tree,\n      CDK_USER_IDENTITY_FILE,\n      \"`new LogGroup(this, 'WebAclLogs', { $props })` where { $props <: contains `encryptionKey` }\",\n    )\n  ) {\n    return;\n  }\n\n  const LOG_GROUP =\n    \"`new LogGroup(this, 'WebAclLogs', { $props })` as $lg where { $props <: contains `logGroupName: $name` }\";\n  const SUPPRESS_CALL =\n    \"`suppressRules(wafLogGroup, ['CKV_AWS_158'], $reason)` as $call\";\n\n  const ready =\n    (await matchGritQL(tree, CDK_USER_IDENTITY_FILE, LOG_GROUP)) &&\n    (await matchGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL));\n\n  if (!ready) {\n    nextSteps.push(divergedMessage(CDK_USER_IDENTITY_FILE));\n    return;\n  }\n\n  await addDestructuredImport(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    ['Key'],\n    'aws-cdk-lib/aws-kms',\n  );\n  await addDestructuredImport(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    ['Effect', 'PolicyStatement', 'ServicePrincipal'],\n    'aws-cdk-lib/aws-iam',\n  );\n\n  // Hoist the log group name into a const so the key policy's encryption context\n  // condition can name the same log group, then create the key above the group.\n  await insertViaGritQL(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    \"`const wafLogGroup = new LogGroup(this, 'WebAclLogs', { $props })` as $decl => \" +\n      `\\`${GRIT_INSERT_PLACEHOLDER}\\n\\n$decl\\``,\n    `const stack = Stack.of(this);\n    const wafLogGroupName = \\`aws-waf-logs-\\${id}-\\${this.node.addr.slice(-8)}\\`;\n\n    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs\n    const logsKey = new Key(this, 'WebAclLogsKey', {\n      enableKeyRotation: true,\n    });\n    logsKey.addToResourcePolicy(\n      new PolicyStatement({\n        effect: Effect.ALLOW,\n        principals: [new ServicePrincipal(\\`logs.\\${stack.region}.amazonaws.com\\`)],\n        actions: [\n          'kms:Encrypt',\n          'kms:Decrypt',\n          'kms:ReEncrypt*',\n          'kms:GenerateDataKey*',\n          'kms:DescribeKey',\n        ],\n        resources: ['*'],\n        conditions: {\n          ArnEquals: {\n            'kms:EncryptionContext:aws:logs:arn': \\`arn:aws:logs:\\${stack.region}:\\${stack.account}:log-group:\\${wafLogGroupName}\\`,\n          },\n        },\n      }),\n    );`,\n  );\n\n  await applyGritQL(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    \"`logGroupName: $name` as $prop where { $prop <: within `new LogGroup(this, 'WebAclLogs', $_)` } => `logGroupName: wafLogGroupName,\\n      encryptionKey: logsKey`\",\n  );\n\n  // Drop the suppression the encryption makes redundant.\n  await applyGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL + ' => ``');\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (tree.exists(TERRAFORM_REST_API_FILE)) {\n    await migrateTerraformLogGroup(\n      tree,\n      TERRAFORM_REST_API_FILE,\n      REST_API_LOG_GROUP,\n      nextSteps,\n    );\n  }\n  if (tree.exists(TERRAFORM_USER_IDENTITY_FILE)) {\n    await migrateTerraformLogGroup(\n      tree,\n      TERRAFORM_USER_IDENTITY_FILE,\n      USER_IDENTITY_LOG_GROUP,\n      nextSteps,\n    );\n  }\n  if (tree.exists(TERRAFORM_GATEWAYS_DIR)) {\n    for (const dirName of tree.children(TERRAFORM_GATEWAYS_DIR)) {\n      const file = joinPathFragments(\n        TERRAFORM_GATEWAYS_DIR,\n        dirName,\n        `${dirName}.tf`,\n      );\n      if (tree.exists(file)) {\n        await migrateTerraformLogGroup(\n          tree,\n          file,\n          gatewayLogGroup(dirName),\n          nextSteps,\n        );\n      }\n    }\n  }\n\n  await migrateCdkUserIdentity(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","addDestructuredImport","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CONSTRUCTS_SRC","TERRAFORM_SRC","CDK_USER_IDENTITY_FILE","TERRAFORM_REST_API_FILE","TERRAFORM_USER_IDENTITY_FILE","TERRAFORM_GATEWAYS_DIR","divergedMessage","file","ALREADY_ENCRYPTED_TERRAFORM","hcl","pattern","REST_API_LOG_GROUP","logGroupLabel","keyLabel","nameLocal","nameExpression","keyDescription","aliasName","accountId","region","tagged","USER_IDENTITY_LOG_GROUP","gatewayLogGroup","nameKebabCase","keyResourcesText","group","join","migrateTerraformLogGroup","tree","nextSteps","contents","read","includes","LOG_GROUP_BLOCK","NAME_LINE","replace","SUPPRESSION_LINE","LOCALS_BLOCK","ready","push","updated","split","filter","line","trim","write","migrateCdkUserIdentity","exists","LOG_GROUP","SUPPRESS_CALL","migration","dirName","children"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,qBAAqB,EACrBC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,iBAAiB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,IAAI,CAAC;AACrE,MAAMG,gBAAgB,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,IAAI,CAAC;AAEnE,MAAMG,yBAAyB,GAAGF,eAAe,sBAAsB,CAAC;AACxE,MAAMG,0BAA0B,GAAGF,cAAc,8BAA8B,CAAC;AAChF,MAAMG,+BAA+B,GAAGH,cAAc,wCAAwC,CAAC;AAC/F,MAAMI,yBAAyB,GAAGJ,cAAc,aAAa,CAAC;AAE9D,MAAMK,kBAAkB,CAACC,OACvB,GAAGA,KAAK,+aAA+a,CAAC;AAE1b,MAAMC,8BAA8B;AAEpC,gFAAgF;AAChF,8EAA8E;AAC9E,iDAAiD;AACjD,MAAMC,MAAM,CAACC,UAAoB,mBAAmBA;AAwBpD,MAAMC,qBAA2C;IAC/CC,eAAe;IACfC,UAAU;IACVC,WAAW;IACXC,gBACE;IACFC,gBAAgB;IAChBC,WACE;IACFC,WAAW;IACXC,QAAQ;IACRC,QAAQ;AACV;AAEA,MAAMC,0BAAgD;IACpDT,eAAe;IACfC,UAAU;IACVC,WAAW;IACXC,gBACE;IACFC,gBAAgB;IAChBC,WAAW;IACXC,WAAW;IACXC,QAAQ;IACRC,QAAQ;AACV;AAEA,MAAME,kBAAkB,CAACC,gBAAiD,CAAA;QACxEX,eAAe;QACfC,UAAU;QACVC,WAAW;QACXC,gBAAgB,CAAC,+BAA+B,EAAEQ,cAAc,wCAAwC,CAAC;QACzGP,gBAAgB,CAAC,CAAC,EAAEO,cAAc,4BAA4B,CAAC;QAC/DN,WAAW,CAAC,OAAO,EAAEM,cAAc,0CAA0C,CAAC;QAC9EL,WAAW;QACXC,QAAQ;QACRC,QAAQ;IACV,CAAA;AAEA,qEAAqE,GACrE,MAAMI,mBAAmB,CAACC,QACxB;QACE;QACA,CAAC,wBAAwB,EAAEA,MAAMZ,QAAQ,CAAC,GAAG,CAAC;QAC9C;QACA;QACA,CAAC,4BAA4B,EAAEY,MAAMT,cAAc,EAAE;QACrD;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,CAAC,6CAA6C,EAAES,MAAMP,SAAS,CAAC,SAAS,CAAC;QAC1E;QACA;QACA;QACA;QACA;QACA;QACA,CAAC,yCAAyC,EAAEO,MAAMN,MAAM,CAAC,kBAAkB,CAAC;QAC5E;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,CAAC,oEAAoE,EAAEM,MAAMN,MAAM,CAAC,KAAK,EAAEM,MAAMP,SAAS,CAAC,qBAAqB,EAAEO,MAAMX,SAAS,CAAC,EAAE,CAAC;QACrJ;QACA;QACA;QACA;QACA;WACIW,MAAML,MAAM,GAAG;YAAC;YAAI;SAAoB,GAAG,EAAE;QACjD;QACA;QACA,CAAC,0BAA0B,EAAEK,MAAMZ,QAAQ,CAAC,GAAG,CAAC;QAChD;QACA;QACA,CAAC,kBAAkB,EAAEY,MAAMR,SAAS,EAAE;QACtC,CAAC,8BAA8B,EAAEQ,MAAMZ,QAAQ,CAAC,UAAU,CAAC;QAC3D;KACD,CAACa,IAAI,CAAC;AAET,MAAMC,2BAA2B,OAC/BC,MACArB,MACAkB,OACAI;IAEA,MAAMC,WAAWF,KAAKG,IAAI,CAACxB,MAAM,YAAY;IAE7C,6EAA6E;IAC7E,IACE,CAACuB,SAASE,QAAQ,CAAC,CAAC,4BAA4B,EAAEP,MAAMb,aAAa,CAAC,CAAC,CAAC,GACxE;QACA;IACF;IAEA,MAAMqB,kBAAkBxB,IACtB,CAAC,uCAAuC,EAAEgB,MAAMb,aAAa,CAAC,aAAa,CAAC;IAE9E,MAAMsB,YAAYzB,IAChB,CAAC,SAAS,EAAEgB,MAAMV,cAAc,CAACoB,OAAO,CAAC,wBAAwB,IAAIA,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,GACjH,CAAC,yDAAyD,EAAEV,MAAMb,aAAa,CAAC,YAAY,CAAC,GAC7F;IAEJ,MAAMwB,mBACJ;IACF,MAAMC,eAAe5B,IAAI;IAEzB,IAAIqB,SAASE,QAAQ,CAACxB,8BAA8BiB,MAAMZ,QAAQ,GAAG;QACnE,QAAQ,oBAAoB;IAC9B;IAEA,MAAMyB,QACJ,AAAC,MAAM3C,YAAYiC,MAAMrB,MAAM0B,oBAC9B,MAAMtC,YAAYiC,MAAMrB,MAAM2B,cAC9B,MAAMvC,YAAYiC,MAAMrB,MAAM8B,iBAC/BP,SAASE,QAAQ,CAACI;IAEpB,IAAI,CAACE,OAAO;QACVT,UAAUU,IAAI,CAACjC,gBAAgBC;QAC/B;IACF;IAEA,8EAA8E;IAC9E,oDAAoD;IACpD,MAAMb,gBACJkC,MACArB,MACA8B,eACE,CAAC,iCAAiC,EAAE5C,wBAAwB,KAAK,CAAC,EACpE,GAAGgC,MAAMX,SAAS,CAAC,GAAG,EAAEW,MAAMV,cAAc,EAAE;IAEhD,MAAMvB,YACJoC,MACArB,MACA2B,YAAY,CAAC,gCAAgC,EAAET,MAAMX,SAAS,CAAC,EAAE,CAAC;IAGpE,6EAA6E;IAC7E,2BAA2B;IAC3B,MAAMpB,gBACJkC,MACArB,MACAE,IACE,CAAC,eAAe,EAAEgB,MAAMX,SAAS,CAAC,qBAAqB,CAAC,GACtD,CAAC,yDAAyD,EAAEW,MAAMb,aAAa,CAAC,YAAY,CAAC,GAC7F,OACA,CAAC,eAAe,EAAEnB,wBAAwB,EAAE,CAAC,EACjD,CAAC,gCAAgC,EAAEgC,MAAMZ,QAAQ,CAAC,OAAO,CAAC;IAE5D,MAAMnB,gBACJkC,MACArB,MACA0B,kBAAkB,CAAC,oBAAoB,EAAExC,wBAAwB,EAAE,CAAC,EACpE+B,iBAAiBC;IAGnB,0DAA0D;IAC1D,MAAMe,UAAU,AAACZ,CAAAA,KAAKG,IAAI,CAACxB,MAAM,YAAY,EAAC,EAC3CkC,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,OAAOR,kBACjCV,IAAI,CAAC;IACRE,KAAKiB,KAAK,CAACtC,MAAMiC;AACnB;AAEA;;;CAGC,GACD,MAAMM,yBAAyB,OAC7BlB,MACAC;IAEA,IAAI,CAACD,KAAKmB,MAAM,CAAC7C,yBAAyB;QACxC,QAAQ,qDAAqD;IAC/D;IAEA,MAAM4B,WAAWF,KAAKG,IAAI,CAAC7B,wBAAwB,YAAY;IAE/D,wEAAwE;IACxE,IAAI,CAAC4B,SAASE,QAAQ,CAAC,CAAC,+BAA+B,CAAC,GAAG;QACzD;IACF;IAEA,IAAIF,SAASE,QAAQ,CAAC,kBAAkB;QACtC,QAAQ,oBAAoB;IAC9B;IAEA,yEAAyE;IACzE,IACE,MAAMrC,YACJiC,MACA1B,wBACA,gGAEF;QACA;IACF;IAEA,MAAM8C,YACJ;IACF,MAAMC,gBACJ;IAEF,MAAMX,QACJ,AAAC,MAAM3C,YAAYiC,MAAM1B,wBAAwB8C,cAChD,MAAMrD,YAAYiC,MAAM1B,wBAAwB+C;IAEnD,IAAI,CAACX,OAAO;QACVT,UAAUU,IAAI,CAACjC,gBAAgBJ;QAC/B;IACF;IAEA,MAAMX,sBACJqC,MACA1B,wBACA;QAAC;KAAM,EACP;IAEF,MAAMX,sBACJqC,MACA1B,wBACA;QAAC;QAAU;QAAmB;KAAmB,EACjD;IAGF,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAMR,gBACJkC,MACA1B,wBACA,oFACE,CAAC,EAAE,EAAET,wBAAwB,WAAW,CAAC,EAC3C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;MAyBC,CAAC;IAGL,MAAMD,YACJoC,MACA1B,wBACA;IAGF,uDAAuD;IACvD,MAAMV,YAAYoC,MAAM1B,wBAAwB+C,gBAAgB;AAClE;AAEA,eAAe,eAAeC,UAC5BtB,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAID,KAAKmB,MAAM,CAAC5C,0BAA0B;QACxC,MAAMwB,yBACJC,MACAzB,yBACAQ,oBACAkB;IAEJ;IACA,IAAID,KAAKmB,MAAM,CAAC3C,+BAA+B;QAC7C,MAAMuB,yBACJC,MACAxB,8BACAiB,yBACAQ;IAEJ;IACA,IAAID,KAAKmB,MAAM,CAAC1C,yBAAyB;QACvC,KAAK,MAAM8C,WAAWvB,KAAKwB,QAAQ,CAAC/C,wBAAyB;YAC3D,MAAME,OAAOjB,kBACXe,wBACA8C,SACA,GAAGA,QAAQ,GAAG,CAAC;YAEjB,IAAIvB,KAAKmB,MAAM,CAACxC,OAAO;gBACrB,MAAMoB,yBACJC,MACArB,MACAe,gBAAgB6B,UAChBtB;YAEJ;QACF;IACF;IAEA,MAAMiB,uBAAuBlB,MAAMC;IAEnC,MAAMjC,qBAAqBgC;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/open-api/json-metadata/generator.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+import type { CodeGenData } from '../utils/codegen-data/types.js';
+import type { OpenApiJsonMetadataGeneratorSchema } from './schema';
+/**
+ * File name the operations metadata is written to. The Terraform modules read
+ * this by name, so both the producing targets and the modules refer to it here.
+ */
+export declare const OPERATIONS_METADATA_FILE_NAME = "operations.json";
+/**
+ * Generates an operations metadata JSON file from an OpenAPI specification,
+ * read by the vended Terraform modules to define one integration per operation.
+ */
+export declare const openApiJsonMetadataGenerator: (tree: Tree, options: OpenApiJsonMetadataGeneratorSchema) => Promise<void>;
+/**
+ * Write the operations metadata for the given spec to the target directory,
+ * sorted by operation name so the file is stable across runs and does not churn
+ * the Terraform plan.
+ */
+export declare const generateOpenApiJsonMetadata: (tree: Tree, data: CodeGenData, outputPath: string) => void;
+export default openApiJsonMetadataGenerator;

package/src/open-api/json-metadata/generator.js

@@ -0,0 +1,37 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { buildOpenApiCodeGenerationData } from "../ts-client/generator.js";
+/**
+ * File name the operations metadata is written to. The Terraform modules read
+ * this by name, so both the producing targets and the modules refer to it here.
+ */ export const OPERATIONS_METADATA_FILE_NAME = 'operations.json';
+/**
+ * Generates an operations metadata JSON file from an OpenAPI specification,
+ * read by the vended Terraform modules to define one integration per operation.
+ */ export const openApiJsonMetadataGenerator = async (tree, options)=>{
+    const data = await buildOpenApiCodeGenerationData(tree, options.openApiSpecPath);
+    generateOpenApiJsonMetadata(tree, data, options.outputPath);
+};
+/**
+ * Write the operations metadata for the given spec to the target directory,
+ * sorted by operation name so the file is stable across runs and does not churn
+ * the Terraform plan.
+ */ export const generateOpenApiJsonMetadata = (tree, data, outputPath)=>{
+    const operations = Object.fromEntries(data.allOperations.map((op)=>({
+            name: op.dotNotationName ?? op.name,
+            path: op.path,
+            method: op.method.toUpperCase()
+        })).sort((a, b)=>a.name.localeCompare(b.name)).map(({ name, path, method })=>[
+            name,
+            {
+                path,
+                method
+            }
+        ]));
+    tree.write(joinPathFragments(outputPath, OPERATIONS_METADATA_FILE_NAME), `${JSON.stringify(operations, null, 2)}\n`);
+};
+export default openApiJsonMetadataGenerator;
+
+//# sourceMappingURL=generator.js.map

package/src/open-api/json-metadata/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/open-api/json-metadata/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { joinPathFragments, type Tree } from '@nx/devkit';\nimport { buildOpenApiCodeGenerationData } from '../ts-client/generator.js';\nimport type { CodeGenData } from '../utils/codegen-data/types.js';\nimport type { OpenApiJsonMetadataGeneratorSchema } from './schema';\n\n/**\n * File name the operations metadata is written to. The Terraform modules read\n * this by name, so both the producing targets and the modules refer to it here.\n */\nexport const OPERATIONS_METADATA_FILE_NAME = 'operations.json';\n\n/**\n * Generates an operations metadata JSON file from an OpenAPI specification,\n * read by the vended Terraform modules to define one integration per operation.\n */\nexport const openApiJsonMetadataGenerator = async (\n  tree: Tree,\n  options: OpenApiJsonMetadataGeneratorSchema,\n) => {\n  const data = await buildOpenApiCodeGenerationData(\n    tree,\n    options.openApiSpecPath,\n  );\n\n  generateOpenApiJsonMetadata(tree, data, options.outputPath);\n};\n\n/**\n * Write the operations metadata for the given spec to the target directory,\n * sorted by operation name so the file is stable across runs and does not churn\n * the Terraform plan.\n */\nexport const generateOpenApiJsonMetadata = (\n  tree: Tree,\n  data: CodeGenData,\n  outputPath: string,\n) => {\n  const operations = Object.fromEntries(\n    data.allOperations\n      .map((op) => ({\n        name: op.dotNotationName ?? op.name,\n        path: op.path,\n        method: op.method.toUpperCase(),\n      }))\n      .sort((a, b) => a.name.localeCompare(b.name))\n      .map(({ name, path, method }) => [name, { path, method }]),\n  );\n\n  tree.write(\n    joinPathFragments(outputPath, OPERATIONS_METADATA_FILE_NAME),\n    `${JSON.stringify(operations, null, 2)}\\n`,\n  );\n};\n\nexport default openApiJsonMetadataGenerator;\n"],"names":["joinPathFragments","buildOpenApiCodeGenerationData","OPERATIONS_METADATA_FILE_NAME","openApiJsonMetadataGenerator","tree","options","data","openApiSpecPath","generateOpenApiJsonMetadata","outputPath","operations","Object","fromEntries","allOperations","map","op","name","dotNotationName","path","method","toUpperCase","sort","a","b","localeCompare","write","JSON","stringify"],"mappings":"AAAA;;;CAGC,GACD,SAASA,iBAAiB,QAAmB,aAAa;AAC1D,SAASC,8BAA8B,QAAQ,4BAA4B;AAI3E;;;CAGC,GACD,OAAO,MAAMC,gCAAgC,kBAAkB;AAE/D;;;CAGC,GACD,OAAO,MAAMC,+BAA+B,OAC1CC,MACAC;IAEA,MAAMC,OAAO,MAAML,+BACjBG,MACAC,QAAQE,eAAe;IAGzBC,4BAA4BJ,MAAME,MAAMD,QAAQI,UAAU;AAC5D,EAAE;AAEF;;;;CAIC,GACD,OAAO,MAAMD,8BAA8B,CACzCJ,MACAE,MACAG;IAEA,MAAMC,aAAaC,OAAOC,WAAW,CACnCN,KAAKO,aAAa,CACfC,GAAG,CAAC,CAACC,KAAQ,CAAA;YACZC,MAAMD,GAAGE,eAAe,IAAIF,GAAGC,IAAI;YACnCE,MAAMH,GAAGG,IAAI;YACbC,QAAQJ,GAAGI,MAAM,CAACC,WAAW;QAC/B,CAAA,GACCC,IAAI,CAAC,CAACC,GAAGC,IAAMD,EAAEN,IAAI,CAACQ,aAAa,CAACD,EAAEP,IAAI,GAC1CF,GAAG,CAAC,CAAC,EAAEE,IAAI,EAAEE,IAAI,EAAEC,MAAM,EAAE,GAAK;YAACH;YAAM;gBAAEE;gBAAMC;YAAO;SAAE;IAG7Df,KAAKqB,KAAK,CACRzB,kBAAkBS,YAAYP,gCAC9B,GAAGwB,KAAKC,SAAS,CAACjB,YAAY,MAAM,GAAG,EAAE,CAAC;AAE9C,EAAE;AAEF,eAAeP,6BAA6B"}

package/src/open-api/json-metadata/schema.d.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ export { };
+
+//# sourceMappingURL=schema.d.js.map

package/src/open-api/json-metadata/schema.d.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/open-api/json-metadata/schema.d.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nexport interface OpenApiJsonMetadataGeneratorSchema {\n  openApiSpecPath: string;\n  outputPath: string;\n}\n"],"names":[],"mappings":"AAAA;;;CAGC,GAED,WAGC"}

package/src/open-api/json-metadata/schema.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export interface OpenApiJsonMetadataGeneratorSchema {
+  openApiSpecPath: string;
+  outputPath: string;
+}

package/src/open-api/json-metadata/schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "$id": "OpenApiJsonMetadata",
+  "title": "OpenAPI JSON Metadata",
+  "description": "Generate a JSON metadata file describing an OpenAPI specification's operations",
+  "type": "object",
+  "properties": {
+    "openApiSpecPath": {
+      "type": "string",
+      "description": "Path to the OpenAPI specification relative to the monorepo root",
+      "x-priority": "important"
+    },
+    "outputPath": {
+      "type": "string",
+      "description": "Path to the directory in which to generate the metadata relative to the monorepo root",
+      "x-priority": "important"
+    }
+  },
+  "required": ["openApiSpecPath", "outputPath"]
+}

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -3,6 +3,10 @@
 exports[`py#agent generator > should create DynamoDB checkpoint table and S3 offload bucket infrastructure when session is dynamodb-s3 (Terraform) > terraform-agent.tf (dynamodb-s3) 1`] = `
 "terraform {
   required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.61.0"
+    }
     random = {
       source  = "hashicorp/random"
       version = "3.9.0"
@@ -363,6 +367,10 @@ output "security_group_id" {
 exports[`py#agent generator > should match snapshot for Terraform generated files > terraform-agent.tf 1`] = `
 "terraform {
   required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.61.0"
+    }
     random = {
       source  = "hashicorp/random"
       version = "3.9.0"
@@ -674,6 +682,10 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
       source  = "hashicorp/aws"
       version = "6.61.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"