@aws/nx-plugin 1.0.0-rc.84 → 1.0.0-rc.85

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -131,6 +131,95 @@ resource "random_string" "suffix" {
   upper   = false
 }
 
+<%_ if (backend.integrationPattern === 'isolated') { _%>
+locals {
+  # Generated at build time from the API definition
+  operations_file = "${path.module}/../../../generated/<%- apiNameKebabCase %>/operations.json"
+  operations      = fileexists(local.operations_file) ? jsondecode(file(local.operations_file)) : {}
+
+  operation_slug = { for op in keys(local.operations) : op => replace(op, "/[^a-zA-Z0-9-_]/", "-") }
+  operation_hash = { for op in keys(local.operations) : op => substr(sha256(op), 0, 8) }
+
+  function_name = { for op in keys(local.operations) : op =>
+    "${substr("<%- apiNameClassName %>-${local.operation_slug[op]}", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-${local.operation_hash[op]}-${random_string.suffix.result}"
+  }
+  role_name = { for op in keys(local.operations) : op =>
+    "${substr("<%- apiNameClassName %>-${local.operation_slug[op]}-role", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-${local.operation_hash[op]}-${random_string.suffix.result}"
+  }
+
+  # A REST API needs a resource per path segment, so each operation's path is
+  # split into the distinct path prefixes the resource tree is built from below
+  operation_segments = { for op, details in local.operations : op => compact(split("/", details.path)) }
+
+  path_nodes = merge([
+    for op, segments in local.operation_segments : {
+      for i, segment in segments : join("/", slice(segments, 0, i + 1)) => {
+        depth  = i
+        parent = i == 0 ? "" : join("/", slice(segments, 0, i))
+        part   = segment
+      }
+    }
+  ]...)
+
+  # Instances of a resource cannot reference one another, so each depth is a
+  # separate resource. Deeper paths are reported by the precondition below.
+  max_path_depth = <%- maxRestPathDepth %>
+  path_nodes_by_depth = { for depth in range(local.max_path_depth) : depth => {
+    for path, node in local.path_nodes : path => node if node.depth == depth
+  } }
+  paths_too_deep = [for path, node in local.path_nodes : path if node.depth >= local.max_path_depth]
+
+  resource_ids = merge(
+    <%_ for (let depth = 0; depth < maxRestPathDepth; depth++) { _%>
+    { for path, resource in aws_api_gateway_resource.path_depth_<%- depth %> : path => resource.id },
+    <%_ } _%>
+  )
+
+  operation_resource_id = { for op, segments in local.operation_segments : op =>
+    local.resource_ids[join("/", segments)]
+  }
+
+  permission_source_suffix = { for op, details in local.operations : op =>
+    "${upper(details.method)}/${replace(join("/", local.operation_segments[op]), "/{[^}]*}/", "*")}"
+  }
+}
+
+resource "terraform_data" "operations_metadata" {
+  # Fails the plan when the operations metadata has not been generated
+  input = local.operations_file
+
+  lifecycle {
+    precondition {
+      condition     = fileexists(local.operations_file)
+      error_message = "Operations metadata not found at ${local.operations_file}. Build the <%- apiNameClassName %> project to generate it."
+    }
+    precondition {
+      condition     = length(local.operations) > 0
+      error_message = "No operations found in ${local.operations_file}. The <%- apiNameClassName %> API must define at least one operation."
+    }
+    precondition {
+      condition     = length(local.paths_too_deep) == 0
+      error_message = "Operation paths exceed the supported depth of ${local.max_path_depth} segments: ${join(", ", local.paths_too_deep)}. Add further aws_api_gateway_resource levels to this module to support them."
+    }
+  }
+}
+
+<%_ for (let depth = 0; depth < maxRestPathDepth; depth++) { _%>
+# API Gateway resources at path depth <%- depth %>
+resource "aws_api_gateway_resource" "path_depth_<%- depth %>" {
+  for_each = local.path_nodes_by_depth[<%- depth %>]
+
+  rest_api_id = module.rest_api.api_id
+  <%_ if (depth === 0) { _%>
+  parent_id   = module.rest_api.api_root_resource_id
+  <%_ } else { _%>
+  parent_id   = aws_api_gateway_resource.path_depth_<%- depth - 1 %>[each.value.parent].id
+  <%_ } _%>
+  path_part   = each.value.part
+}
+
+<%_ } _%>
+<%_ } _%>
 # Resources
 
 # Create Lambda ZIP file from the bundle directory
@@ -205,8 +294,14 @@ resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
   description       = "Allow outbound HTTPS to AWS service endpoints"
 }
 
-# Lambda function
 resource "aws_lambda_function" "api_lambda" {
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  # One lambda function per operation, each serving just that operation
+  for_each = local.operations
+
+  <%_ } else { _%>
+  # A single "router" lambda serving all requests
+  <%_ } _%>
   #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
@@ -215,8 +310,13 @@ resource "aws_lambda_function" "api_lambda" {
   s3_bucket         = aws_s3_object.lambda_zip.bucket
   s3_key            = aws_s3_object.lambda_zip.key
   s3_object_version = aws_s3_object.lambda_zip.version_id
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  function_name    = local.function_name[each.key]
+  role            = aws_iam_role.lambda_execution_role[each.key].arn
+  <%_ } else { _%>
   function_name    = "<%- apiNameClassName %>Handler-${random_string.suffix.result}"
   role            = aws_iam_role.lambda_execution_role.arn
+  <%_ } _%>
   <%_ if (['trpc', 'smithy'].includes(backend.type)) { _%>
   handler         = "index.handler"
   runtime         = "nodejs22.x"
@@ -272,7 +372,13 @@ resource "aws_lambda_function" "api_lambda" {
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  for_each = local.operations
+
+  name = local.role_name[each.key]
+  <%_ } else { _%>
   name = "<%- apiNameClassName %>Handler-execution-role-${random_string.suffix.result}"
+  <%_ } _%>
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -292,25 +398,57 @@ resource "aws_iam_role" "lambda_execution_role" {
 
 # Attach basic execution policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  for_each = local.operations
+
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+  role       = aws_iam_role.lambda_execution_role[each.key].name
+  <%_ } else { _%>
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
   role       = aws_iam_role.lambda_execution_role.name
+  <%_ } _%>
 }
 
 # Attach X-Ray tracing policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  for_each = local.operations
+
+  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
+  role       = aws_iam_role.lambda_execution_role[each.key].name
+  <%_ } else { _%>
   policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
   role       = aws_iam_role.lambda_execution_role.name
+  <%_ } _%>
 }
 
 # Attach VPC access policy to Lambda role when deployed into a VPC
 resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  for_each = var.enable_vpc ? local.operations : {}
+
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role[each.key].name
+  <%_ } else { _%>
   count      = var.enable_vpc ? 1 : 0
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
   role       = aws_iam_role.lambda_execution_role.name
+  <%_ } _%>
 }
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  for_each = local.operations
+
+  name = "${substr(local.function_name[each.key], 0, 55)}-policies"
+  role = aws_iam_role.lambda_execution_role[each.key].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = local.lambda_policy_document_statements
+  })
+  <%_ } else { _%>
   count = length(local.lambda_policy_statements) > 0 ? 1 : 0
   name  = "<%- apiNameClassName %>Handler-additional-policies-${random_string.suffix.result}"
   role  = aws_iam_role.lambda_execution_role.id
@@ -319,6 +457,7 @@ resource "aws_iam_role_policy" "lambda_additional_policies" {
     Version = "2012-10-17"
     Statement = local.lambda_policy_statements
   })
+  <%_ } _%>
 }
 
 locals {
@@ -333,6 +472,17 @@ locals {
       Resource = ["${var.appconfig_application_arn}/*"]
     }
   ] : [], var.additional_iam_policy_statements)
+<%_ if (backend.integrationPattern === 'isolated') { _%>
+
+  # IAM rejects an empty statement list, so fall back to a no-op deny
+  lambda_policy_document_statements = length(local.lambda_policy_statements) > 0 ? local.lambda_policy_statements : [
+    {
+      Effect   = "Deny"
+      Action   = ["appconfig:GetLatestConfiguration"]
+      Resource = ["arn:aws:appconfig:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:application/none"]
+    }
+  ]
+<%_ } _%>
 }
 
 # CloudWatch Log Group for Lambda
@@ -340,16 +490,31 @@ resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  for_each = local.operations
+
+  name = "/aws/lambda/${local.function_name[each.key]}"
+  tags = var.tags
+  <%_ } else { _%>
   name              = "/aws/lambda/<%- apiNameClassName %>Handler-${random_string.suffix.result}"
   tags              = var.tags
+  <%_ } _%>
 }
 
 <%_ if (backend.type === 'fastapi') { _%>
 # Lambda alias pointing to the latest published version for SnapStart
 resource "aws_lambda_alias" "live" {
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  for_each = local.operations
+
+  name             = "live"
+  function_name    = aws_lambda_function.api_lambda[each.key].function_name
+  function_version = aws_lambda_function.api_lambda[each.key].version
+  <%_ } else { _%>
   name             = "live"
   function_name    = aws_lambda_function.api_lambda.function_name
   function_version = aws_lambda_function.api_lambda.version
+  <%_ } _%>
 
   depends_on = [aws_lambda_function.api_lambda]
 }
@@ -472,6 +637,161 @@ resource "aws_lambda_permission" "authorizer_invoke" {
 }
 <%_ } _%>
 
+<%_ if (backend.integrationPattern === 'isolated') { _%>
+# Method per operation
+resource "aws_api_gateway_method" "operation_methods" {
+  #checkov:skip=CKV2_AWS_53:Request validation not required for proxy integration as Lambda handles validation
+  for_each = local.operations
+
+  rest_api_id   = module.rest_api.api_id
+  resource_id   = local.operation_resource_id[each.key]
+  http_method   = upper(each.value.method)
+
+  <%_ if (auth === 'iam') { _%>
+  authorization = "AWS_IAM"
+  <%_ } else if (auth === 'cognito') { _%>
+  authorization = "COGNITO_USER_POOLS"
+  authorizer_id = aws_api_gateway_authorizer.cognito_authorizer.id
+  # Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+  # and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+  authorization_scopes = ["openid", "aws.cognito.signin.user.admin"]
+  <%_ } else if (auth === 'custom') { _%>
+  authorization = "CUSTOM"
+  authorizer_id = aws_api_gateway_authorizer.custom_authorizer.id
+  <%_ } _%>
+
+  # Path parameters must be declared on the method
+  request_parameters = {
+    for segment in local.operation_segments[each.key] :
+    "method.request.path.${trimsuffix(trimprefix(segment, "{"), "}")}" => true
+    if startswith(segment, "{")
+  }
+
+  depends_on = [<% if (auth === 'cognito') { %>aws_api_gateway_authorizer.cognito_authorizer<% } else if (auth === 'custom') { %>aws_api_gateway_authorizer.custom_authorizer<% } %>]
+}
+
+# Lambda integration per operation
+resource "aws_api_gateway_integration" "lambda_integration" {
+  for_each = local.operations
+
+  rest_api_id = module.rest_api.api_id
+  resource_id = local.operation_resource_id[each.key]
+  http_method = aws_api_gateway_method.operation_methods[each.key].http_method
+
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  <%_ if (backend.type === 'fastapi') { _%>
+  # Use the response streaming invocation path with the alias ARN for SnapStart
+  uri                     = "arn:aws:apigateway:${data.aws_region.current.region}:lambda:path/2021-11-15/functions/${aws_lambda_alias.live[each.key].arn}/response-streaming-invocations"
+  response_transfer_mode  = "STREAM"
+  <%_ } else if (backend.type === 'trpc') { _%>
+  uri                     = aws_lambda_function.api_lambda[each.key].response_streaming_invoke_arn
+  response_transfer_mode  = "STREAM"
+  <%_ } else { _%>
+  uri                     = aws_lambda_function.api_lambda[each.key].invoke_arn
+  <%_ } _%>
+
+  <%_ if (backend.type === 'fastapi') { _%>
+  depends_on = [aws_lambda_alias.live]
+  <%_ } else { _%>
+  depends_on = [aws_lambda_function.api_lambda]
+  <%_ } _%>
+}
+
+# OPTIONS method for CORS preflight, on every resource an operation is served from
+resource "aws_api_gateway_method" "options_method" {
+  #checkov:skip=CKV2_AWS_70:OPTIONS method must be unauthenticated for CORS preflight requests
+  #checkov:skip=CKV2_AWS_53:Request validation not required for OPTIONS CORS preflight method
+  for_each = local.resource_ids
+
+  rest_api_id   = module.rest_api.api_id
+  resource_id   = each.value
+  http_method   = "OPTIONS"
+  authorization = "NONE"
+}
+
+# CORS integration for OPTIONS methods
+resource "aws_api_gateway_integration" "options_integration" {
+  for_each = local.resource_ids
+
+  rest_api_id = module.rest_api.api_id
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
+
+  type = "MOCK"
+  request_templates = {
+    "application/json" = "{\"statusCode\": 204}"
+  }
+}
+
+# OPTIONS method responses
+resource "aws_api_gateway_method_response" "options_response" {
+  for_each = local.resource_ids
+
+  rest_api_id = module.rest_api.api_id
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
+  status_code = "204"
+
+  response_parameters = {
+    "method.response.header.Access-Control-Allow-Headers" = true
+    "method.response.header.Access-Control-Allow-Methods" = true
+    "method.response.header.Access-Control-Allow-Origin"  = true
+  }
+}
+
+# OPTIONS integration responses
+resource "aws_api_gateway_integration_response" "options_integration_response" {
+  for_each = local.resource_ids
+
+  rest_api_id = module.rest_api.api_id
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
+  status_code = aws_api_gateway_method_response.options_response[each.key].status_code
+
+  response_parameters = {
+    "method.response.header.Access-Control-Allow-Headers" = "'${join(",", var.cors_allow_headers)}'"
+    "method.response.header.Access-Control-Allow-Methods" = "'${join(",", var.cors_allow_methods)}'"
+    "method.response.header.Access-Control-Allow-Origin"  = "'${join(",", var.cors_allow_origins)}'"
+  }
+
+  depends_on = [aws_api_gateway_integration.options_integration]
+}
+
+# API Gateway deployment
+resource "aws_api_gateway_deployment" "api_deployment" {
+  rest_api_id = module.rest_api.api_id
+
+  triggers = {
+    redeployment = sha1(jsonencode(concat(
+      [for r in aws_api_gateway_resource.path_depth_0 : r.id],
+      <%_ for (let depth = 1; depth < maxRestPathDepth; depth++) { _%>
+      [for r in aws_api_gateway_resource.path_depth_<%- depth %> : r.id],
+      <%_ } _%>
+      [for m in aws_api_gateway_method.operation_methods : m.id],
+      [for i in aws_api_gateway_integration.lambda_integration : i.id],
+      [for m in aws_api_gateway_method.options_method : m.id],
+      [for i in aws_api_gateway_integration.options_integration : i.id],
+    )))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+
+  depends_on = [
+    aws_api_gateway_method.operation_methods,
+    aws_api_gateway_integration.lambda_integration,
+    aws_api_gateway_method.options_method,
+    aws_api_gateway_integration.options_integration,
+    aws_api_gateway_method_response.options_response,
+    aws_api_gateway_integration_response.options_integration_response,
+    <%_ if (auth === 'custom') { _%>
+    aws_api_gateway_authorizer.custom_authorizer,
+    <%_ } _%>
+  ]
+}
+<%_ } else { _%>
 # Create proxy resource (captures all paths)
 resource "aws_api_gateway_resource" "proxy_resource" {
   rest_api_id = module.rest_api.api_id
@@ -613,6 +933,8 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+<%_ } _%>
+
 # KMS key for encrypting access logs at rest
 resource "aws_kms_key" "access_logs" {
   description             = "<%- apiNameClassName %> API access log encryption"
@@ -757,6 +1079,18 @@ resource "aws_api_gateway_rest_api_policy" "api_policy" {
 # Lambda permission for API Gateway to invoke the function
 <%_ } _%>
 resource "aws_lambda_permission" "api_gateway_invoke" {
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  for_each = local.operations
+
+  statement_id  = "AllowExecutionFromAPIGateway"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.api_lambda[each.key].function_name
+  <%_ if (backend.type === 'fastapi') { _%>
+  qualifier     = aws_lambda_alias.live[each.key].name
+  <%_ } _%>
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "${module.rest_api.api_execution_arn}/*/${local.permission_source_suffix[each.key]}"
+  <%_ } else { _%>
   statement_id  = "AllowExecutionFromAPIGateway"
   action        = "lambda:InvokeFunction"
   function_name = aws_lambda_function.api_lambda.function_name
@@ -765,6 +1099,7 @@ resource "aws_lambda_permission" "api_gateway_invoke" {
   <%_ } _%>
   principal     = "apigateway.amazonaws.com"
   source_arn    = "${module.rest_api.api_execution_arn}/*/*"
+  <%_ } _%>
 
   <%_ if (backend.type === 'fastapi') { _%>
   depends_on = [module.rest_api, aws_lambda_alias.live]
@@ -776,12 +1111,23 @@ resource "aws_lambda_permission" "api_gateway_invoke" {
 <%_ if (backend.type === 'fastapi') { _%>
 # Lambda permission for API Gateway to invoke with response streaming via alias
 resource "aws_lambda_permission" "api_gateway_invoke_streaming" {
+  <%_ if (backend.integrationPattern === 'isolated') { _%>
+  for_each = local.operations
+
+  statement_id  = "AllowStreamingFromAPIGateway"
+  action        = "lambda:InvokeFunctionWithResponseStream"
+  function_name = aws_lambda_function.api_lambda[each.key].function_name
+  qualifier     = aws_lambda_alias.live[each.key].name
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "${module.rest_api.api_execution_arn}/*/${local.permission_source_suffix[each.key]}"
+  <%_ } else { _%>
   statement_id  = "AllowStreamingFromAPIGateway"
   action        = "lambda:InvokeFunctionWithResponseStream"
   function_name = aws_lambda_function.api_lambda.function_name
   qualifier     = aws_lambda_alias.live.name
   principal     = "apigateway.amazonaws.com"
   source_arn    = "${module.rest_api.api_execution_arn}/*/*"
+  <%_ } _%>
 
   depends_on = [module.rest_api, aws_lambda_alias.live]
 }
@@ -846,6 +1192,86 @@ output "stage_id" {
   value       = aws_api_gateway_stage.api_stage.id
 }
 
+<%_ if (backend.integrationPattern === 'isolated') { _%>
+# Lambda Function Outputs, keyed by operation name
+output "operations" {
+  description = "Names of the API operations, each with its own Lambda function"
+  value       = keys(local.operations)
+}
+
+output "lambda_function_names" {
+  description = "Name of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.function_name }
+}
+
+output "lambda_function_arns" {
+  description = "ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.arn }
+}
+
+output "lambda_invoke_arns" {
+  description = "Invoke ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.invoke_arn }
+}
+
+output "lambda_qualified_arns" {
+  description = "Qualified ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.qualified_arn }
+}
+
+output "lambda_versions" {
+  description = "Version of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.version }
+}
+
+output "lambda_source_code_hash" {
+  description = "Base64-encoded SHA256 hash of the Lambda deployment package, shared by every operation"
+  value       = data.archive_file.lambda_zip.output_base64sha256
+}
+
+# IAM Role Outputs, keyed by operation name
+output "lambda_execution_role_arns" {
+  description = "ARN of each operation's Lambda execution role, keyed by operation name"
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.arn }
+}
+
+output "lambda_execution_role_names" {
+  description = "Name of each operation's Lambda execution role, keyed by operation name. Attach additional policies to a specific operation's role by name."
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.name }
+}
+
+output "security_group_id" {
+  description = "Security group ID shared by the API Lambda functions, for use in ingress rules on resources they must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
+}
+
+# Integration Outputs, keyed by operation name
+output "integration_ids" {
+  description = "ID of each operation's Lambda integration, keyed by operation name"
+  value       = { for op, i in aws_api_gateway_integration.lambda_integration : op => i.id }
+}
+
+output "method_ids" {
+  description = "ID of each operation's API Gateway method, keyed by operation name"
+  value       = { for op, m in aws_api_gateway_method.operation_methods : op => m.id }
+}
+
+output "resource_ids" {
+  description = "ID of each API Gateway resource, keyed by its path"
+  value       = local.resource_ids
+}
+
+# CloudWatch Log Groups, keyed by operation name
+output "lambda_log_group_names" {
+  description = "Name of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.name }
+}
+
+output "lambda_log_group_arns" {
+  description = "ARN of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.arn }
+}
+<%_ } else { _%>
 # Lambda Function Outputs
 output "lambda_function_name" {
   description = "Name of the Lambda function"
@@ -924,3 +1350,4 @@ output "lambda_log_group_arn" {
   description = "ARN of the Lambda CloudWatch log group"
   value       = aws_cloudwatch_log_group.lambda_logs.arn
 }
+<%_ } _%>

package/src/utils/api-constructs/open-api-metadata.d.ts

@@ -9,9 +9,26 @@ export interface AddOpenApiMetadataGenerateTargetOptions {
     apiNameKebabCase: string;
     specPath: string;
     specBuildTargetName: string;
+    /**
+     * How integrations are mapped to operations. Terraform only needs the
+     * operations metadata for the `isolated` pattern, since the `shared` pattern
+     * routes every operation to one proxy Lambda.
+     */
+    integrationPattern?: 'isolated' | 'shared';
 }
 /**
- * Adds a generate:<api-name>-metadata target to shared constructs (CDK only)
- * This allows for API CDK constructs to have type-safety for integrations based on an OpenAPI Specification
+ * Adds a target which generates metadata about the API's operations from its
+ * OpenAPI specification, so that infrastructure can define an integration per
+ * operation.
+ *
+ * For CDK this generates TypeScript, giving the construct type-safe integrations.
+ * For Terraform this generates JSON, which the vended module reads to build one
+ * Lambda function and route per operation.
  */
-export declare const addSharedConstructsOpenApiMetadataGenerateTarget: (tree: Tree, { iac, apiNameKebabCase, specPath, specBuildTargetName, }: AddOpenApiMetadataGenerateTargetOptions) => void;
+export declare const addSharedConstructsOpenApiMetadataGenerateTarget: (tree: Tree, options: AddOpenApiMetadataGenerateTargetOptions) => void;
+/**
+ * Directory the operations metadata for an API is generated into, relative to
+ * the shared Terraform project's `src`. The vended module reads the file from
+ * here, so the module template and this target must agree on the location.
+ */
+export declare const terraformOperationsMetadataDir: (apiNameKebabCase: string) => string;

package/src/utils/api-constructs/open-api-metadata.js

@@ -4,16 +4,23 @@
  */ import { joinPathFragments, updateJson } from "@nx/devkit";
 import { updateGitIgnore } from "../git.js";
 import { addDependencyToTargetIfNotPresent } from "../nx.js";
-import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../shared-constructs-constants.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 /**
- * Adds a generate:<api-name>-metadata target to shared constructs (CDK only)
- * This allows for API CDK constructs to have type-safety for integrations based on an OpenAPI Specification
- */ export const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, { iac, apiNameKebabCase, specPath, specBuildTargetName })=>{
-    if (iac !== 'cdk') {
-        // For Terraform, we do not support type-safe integration builders, rather only the single lambda
-        // router pattern, and therefore do not need to add depenencies on metadata generation.
-        return;
+ * Adds a target which generates metadata about the API's operations from its
+ * OpenAPI specification, so that infrastructure can define an integration per
+ * operation.
+ *
+ * For CDK this generates TypeScript, giving the construct type-safe integrations.
+ * For Terraform this generates JSON, which the vended module reads to build one
+ * Lambda function and route per operation.
+ */ export const addSharedConstructsOpenApiMetadataGenerateTarget = (tree, options)=>{
+    if (options.iac === 'cdk') {
+        addCdkOpenApiMetadataGenerateTarget(tree, options);
+    } else if (options.iac === 'terraform') {
+        addTerraformOpenApiOperationsGenerateTarget(tree, options);
     }
+};
+const addCdkOpenApiMetadataGenerateTarget = (tree, { apiNameKebabCase, specPath, specBuildTargetName })=>{
     const generatedMetadataDir = joinPathFragments('generated', apiNameKebabCase);
     const generatedMetadataDirFromRoot = joinPathFragments(joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR), 'src', generatedMetadataDir);
     updateJson(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'project.json'), (config)=>{
@@ -58,5 +65,54 @@ import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR } from "../shared-constructs-consta
             joinPathFragments('src', generatedMetadataDir)
         ]);
 };
+/**
+ * Directory the operations metadata for an API is generated into, relative to
+ * the shared Terraform project's `src`. The vended module reads the file from
+ * here, so the module template and this target must agree on the location.
+ */ export const terraformOperationsMetadataDir = (apiNameKebabCase)=>joinPathFragments('generated', apiNameKebabCase);
+const addTerraformOpenApiOperationsGenerateTarget = (tree, { apiNameKebabCase, specPath, specBuildTargetName, integrationPattern })=>{
+    // The `shared` pattern routes every operation to a single proxy Lambda, so the
+    // module has no need for the operations metadata.
+    if (integrationPattern !== 'isolated') {
+        return;
+    }
+    const generatedDirFromRoot = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', terraformOperationsMetadataDir(apiNameKebabCase));
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        config.targets ??= {};
+        // Terraform reads the operations metadata with `file()`, so it must exist
+        // before plan; the target is wired into `build` below.
+        const operationsTargetName = `generate:${apiNameKebabCase}-operations`;
+        if (!config.targets[operationsTargetName]) {
+            config.targets[operationsTargetName] = {
+                cache: true,
+                executor: 'nx:run-commands',
+                inputs: [
+                    {
+                        dependentTasksOutputFiles: '**/*.json'
+                    }
+                ],
+                outputs: [
+                    joinPathFragments('{workspaceRoot}', generatedDirFromRoot)
+                ],
+                options: {
+                    commands: [
+                        `nx g @aws/nx-plugin:open-api#json-metadata --openApiSpecPath="${specPath}" --outputPath="${generatedDirFromRoot}" --no-interactive`
+                    ]
+                },
+                dependsOn: [
+                    specBuildTargetName
+                ]
+            };
+        }
+        addDependencyToTargetIfNotPresent(config, 'build', operationsTargetName);
+        return config;
+    });
+    // Ignore the generated metadata by default
+    // Users can safely remove the entry from the .gitignore if they prefer to check it in
+    updateGitIgnore(tree, joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR), (patterns)=>[
+            ...patterns,
+            joinPathFragments('src', terraformOperationsMetadataDir(apiNameKebabCase))
+        ]);
+};
 
 //# sourceMappingURL=open-api-metadata.js.map