@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -32,6 +32,7 @@ import {
   IntegrationBuilder,
   RestApiIntegration,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
 import {
   OPERATION_DETAILS,
@@ -86,8 +87,8 @@ export class TestApi<
     return IntegrationBuilder.rest({
       pattern: 'isolated',
       operations: OPERATION_DETAILS,
-      defaultIntegrationOptions: <FunctionProps>{
-        runtime: Runtime.NODEJS_LATEST,
+      defaultIntegrationOptions: {
+        runtime: Runtime.NODEJS_24_X,
         handler: 'index.handler',
         code: Code.fromAsset(
           url.fileURLToPath(
@@ -99,7 +100,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -127,6 +128,9 @@ export class TestApi<
         authorizer: new CognitoUserPoolsAuthorizer(scope, 'TestApiAuthorizer', {
           cognitoUserPools: [props.identity.userPool],
         }),
+        // Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+        // and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+        authorizationScopes: ['openid', 'aws.cognito.signin.user.admin'],
       },
       deployOptions: {
         tracingEnabled: true,
@@ -153,7 +157,9 @@ export class TestApi<
    *
    * Configures the provided CloudFront distribution domains or origin strings
    * as the only permitted CORS origins in API Gateway preflight responses and the
-   * AWS Lambda integrations.
+   * AWS Lambda integrations. Any custom domain names (aliases) configured on a
+   * CloudFront distribution are included automatically alongside its default
+   * \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -164,12 +170,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     this.allowedOrigins = allowedOrigins;
@@ -218,6 +226,7 @@ import {
   IntegrationBuilder,
   RestApiIntegration,
 } from '../../core/api/utils.js';
+import { findCloudFrontDomainNames } from '../../core/cloudfront.js';
 import { AddCorsPreflightAspect, RestApi } from '../../core/api/rest-api.js';
 import {
   OPERATION_DETAILS,
@@ -266,8 +275,8 @@ export class TestApi<
     return IntegrationBuilder.rest({
       pattern: 'isolated',
       operations: OPERATION_DETAILS,
-      defaultIntegrationOptions: <FunctionProps>{
-        runtime: Runtime.NODEJS_LATEST,
+      defaultIntegrationOptions: {
+        runtime: Runtime.NODEJS_24_X,
         handler: 'index.handler',
         code: Code.fromAsset(
           url.fileURLToPath(
@@ -279,7 +288,7 @@ export class TestApi<
         ),
         timeout: Duration.seconds(30),
         tracing: Tracing.ACTIVE,
-      },
+      } as FunctionProps,
       buildDefaultIntegration: (op, props: FunctionProps) => {
         const handler = new Function(scope, \`TestApi\${op}Handler\`, props);
         handler.addEnvironment(
@@ -330,7 +339,9 @@ export class TestApi<
    *
    * Configures the provided CloudFront distribution domains or origin strings
    * as the only permitted CORS origins in API Gateway preflight responses and the
-   * AWS Lambda integrations.
+   * AWS Lambda integrations. Any custom domain names (aliases) configured on a
+   * CloudFront distribution are included automatically alongside its default
+   * \`*.cloudfront.net\` domain.
    *
    * @param origins - The origin strings, CloudFront distributions, or objects containing a CloudFront distribution to grant CORS from
    */
@@ -341,12 +352,14 @@ export class TestApi<
       | { cloudFrontDistribution: Distribution }
     )[]
   ) {
-    const allowedOrigins = origins.map((origin) =>
+    const allowedOrigins = origins.flatMap((origin) =>
       typeof origin === 'string'
-        ? origin
-        : 'cloudFrontDistribution' in origin
-          ? \`https://\${origin.cloudFrontDistribution.distributionDomainName}\`
-          : \`https://\${origin.distributionDomainName}\`,
+        ? [origin]
+        : findCloudFrontDomainNames(
+            'cloudFrontDistribution' in origin
+              ? origin.cloudFrontDistribution
+              : origin,
+          ).map((domain) => \`https://\${domain}\`),
     );
 
     this.allowedOrigins = allowedOrigins;
@@ -400,11 +413,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -474,8 +487,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -492,10 +503,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -597,22 +606,75 @@ resource "aws_wafv2_web_acl" "api_waf" {
   }
 }
 
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+locals {
+  waf_log_group_name = var.enable_waf ? "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}" : null
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "\${var.api_name} API WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/\${var.api_name}-\${random_id.waf_log_suffix[0].hex}-waf-logs"
+  target_key_id = aws_kms_key.waf_logs[0].key_id
+}
+
 # CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
 resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
+  name              = local.waf_log_group_name
   retention_in_days = 30
+  kms_key_id        = aws_kms_key.waf_logs[0].arn
   tags              = var.tags
 }
 
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
 resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
   count = var.enable_waf ? 1 : 0
 
@@ -653,9 +715,7 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement"
+# Note: Stage, deployment and access log outputs are provided by the consuming module"
 `;
 
 exports[`tsSmithyApiGenerator > should generate smithy ts api with Terraform provider and None auth > none-auth-terraform.tf 1`] = `
@@ -663,9 +723,17 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with Terraform pro
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
     }
   }
 }
@@ -687,11 +755,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -736,6 +840,235 @@ resource "random_string" "suffix" {
   upper   = false
 }
 
+locals {
+  # Generated at build time from the API definition
+  operations_file = "\${path.module}/../../../generated/test-api/operations.json"
+  operations      = fileexists(local.operations_file) ? jsondecode(file(local.operations_file)) : {}
+
+  operation_slug = { for op in keys(local.operations) : op => replace(op, "/[^a-zA-Z0-9-_]/", "-") }
+  operation_hash = { for op in keys(local.operations) : op => substr(sha256(op), 0, 8) }
+
+  function_name = { for op in keys(local.operations) : op =>
+    "\${substr("TestApi-\${local.operation_slug[op]}", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-\${local.operation_hash[op]}-\${random_string.suffix.result}"
+  }
+  role_name = { for op in keys(local.operations) : op =>
+    "\${substr("TestApi-\${local.operation_slug[op]}-role", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-\${local.operation_hash[op]}-\${random_string.suffix.result}"
+  }
+
+  # A REST API needs a resource per path segment, so each operation's path is
+  # split into the distinct path prefixes the resource tree is built from below
+  operation_segments = { for op, details in local.operations : op => compact(split("/", details.path)) }
+
+  path_nodes = merge([
+    for op, segments in local.operation_segments : {
+      for i, segment in segments : join("/", slice(segments, 0, i + 1)) => {
+        depth  = i
+        parent = i == 0 ? "" : join("/", slice(segments, 0, i))
+        part   = segment
+      }
+    }
+  ]...)
+
+  # Instances of a resource cannot reference one another, so each depth is a
+  # separate resource. Deeper paths are reported by the precondition below.
+  max_path_depth = 16
+  path_nodes_by_depth = { for depth in range(local.max_path_depth) : depth => {
+    for path, node in local.path_nodes : path => node if node.depth == depth
+  } }
+  paths_too_deep = [for path, node in local.path_nodes : path if node.depth >= local.max_path_depth]
+
+  resource_ids = merge(
+    { for path, resource in aws_api_gateway_resource.path_depth_0 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_1 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_2 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_3 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_4 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_5 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_6 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_7 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_8 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_9 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_10 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_11 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_12 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_13 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_14 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_15 : path => resource.id },
+  )
+
+  operation_resource_id = { for op, segments in local.operation_segments : op =>
+    local.resource_ids[join("/", segments)]
+  }
+
+  permission_source_suffix = { for op, details in local.operations : op =>
+    "\${upper(details.method)}/\${replace(join("/", local.operation_segments[op]), "/{[^}]*}/", "*")}"
+  }
+}
+
+resource "terraform_data" "operations_metadata" {
+  # Fails the plan when the operations metadata has not been generated
+  input = local.operations_file
+
+  lifecycle {
+    precondition {
+      condition     = fileexists(local.operations_file)
+      error_message = "Operations metadata not found at \${local.operations_file}. Build the TestApi project to generate it."
+    }
+    precondition {
+      condition     = length(local.operations) > 0
+      error_message = "No operations found in \${local.operations_file}. The TestApi API must define at least one operation."
+    }
+    precondition {
+      condition     = length(local.paths_too_deep) == 0
+      error_message = "Operation paths exceed the supported depth of \${local.max_path_depth} segments: \${join(", ", local.paths_too_deep)}. Add further aws_api_gateway_resource levels to this module to support them."
+    }
+  }
+}
+
+# API Gateway resources at path depth 0
+resource "aws_api_gateway_resource" "path_depth_0" {
+  for_each = local.path_nodes_by_depth[0]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = module.rest_api.api_root_resource_id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 1
+resource "aws_api_gateway_resource" "path_depth_1" {
+  for_each = local.path_nodes_by_depth[1]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_0[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 2
+resource "aws_api_gateway_resource" "path_depth_2" {
+  for_each = local.path_nodes_by_depth[2]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_1[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 3
+resource "aws_api_gateway_resource" "path_depth_3" {
+  for_each = local.path_nodes_by_depth[3]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_2[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 4
+resource "aws_api_gateway_resource" "path_depth_4" {
+  for_each = local.path_nodes_by_depth[4]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_3[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 5
+resource "aws_api_gateway_resource" "path_depth_5" {
+  for_each = local.path_nodes_by_depth[5]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_4[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 6
+resource "aws_api_gateway_resource" "path_depth_6" {
+  for_each = local.path_nodes_by_depth[6]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_5[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 7
+resource "aws_api_gateway_resource" "path_depth_7" {
+  for_each = local.path_nodes_by_depth[7]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_6[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 8
+resource "aws_api_gateway_resource" "path_depth_8" {
+  for_each = local.path_nodes_by_depth[8]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_7[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 9
+resource "aws_api_gateway_resource" "path_depth_9" {
+  for_each = local.path_nodes_by_depth[9]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_8[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 10
+resource "aws_api_gateway_resource" "path_depth_10" {
+  for_each = local.path_nodes_by_depth[10]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_9[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 11
+resource "aws_api_gateway_resource" "path_depth_11" {
+  for_each = local.path_nodes_by_depth[11]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_10[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 12
+resource "aws_api_gateway_resource" "path_depth_12" {
+  for_each = local.path_nodes_by_depth[12]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_11[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 13
+resource "aws_api_gateway_resource" "path_depth_13" {
+  for_each = local.path_nodes_by_depth[13]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_12[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 14
+resource "aws_api_gateway_resource" "path_depth_14" {
+  for_each = local.path_nodes_by_depth[14]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_13[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 15
+resource "aws_api_gateway_resource" "path_depth_15" {
+  for_each = local.path_nodes_by_depth[15]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_14[each.value.parent].id
+  path_part   = each.value.part
+}
+
 # Resources
 
 # Create Lambda ZIP file from the bundle directory
@@ -754,6 +1087,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -783,9 +1121,33 @@ resource "aws_wafv2_web_acl_association" "api_waf_association" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-# Lambda function
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "test-api-lambda-"
+  description = "Security group for the TestApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  # One lambda function per operation, each serving just that operation
+  for_each = local.operations
+
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -793,10 +1155,10 @@ resource "aws_lambda_function" "api_lambda" {
   s3_bucket         = aws_s3_object.lambda_zip.bucket
   s3_key            = aws_s3_object.lambda_zip.key
   s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "TestApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
+  function_name    = local.function_name[each.key]
+  role            = aws_iam_role.lambda_execution_role[each.key].arn
   handler         = "index.handler"
-  runtime         = "nodejs22.x"
+  runtime         = "nodejs24.x"
   timeout         = 30
   memory_size     = 128
 
@@ -807,18 +1169,32 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
+  for_each = local.operations
+
+  name = local.role_name[each.key]
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -838,35 +1214,73 @@ resource "aws_iam_role" "lambda_execution_role" {
 
 # Attach basic execution policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
+  for_each = local.operations
+
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
+  role       = aws_iam_role.lambda_execution_role[each.key].name
 }
 
 # Attach X-Ray tracing policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
+  for_each = local.operations
+
   policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
+  role       = aws_iam_role.lambda_execution_role[each.key].name
+}
+
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  for_each = var.enable_vpc ? local.operations : {}
+
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role[each.key].name
 }
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
+  for_each = local.operations
+
+  name = "\${substr(local.function_name[each.key], 0, 55)}-policies"
+  role = aws_iam_role.lambda_execution_role[each.key].id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_document_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+
+  # IAM rejects an empty statement list, so fall back to a no-op deny
+  lambda_policy_document_statements = length(local.lambda_policy_statements) > 0 ? local.lambda_policy_statements : [
+    {
+      Effect   = "Deny"
+      Action   = ["appconfig:GetLatestConfiguration"]
+      Resource = ["arn:aws:appconfig:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:application/none"]
+    }
+  ]
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
+  for_each = local.operations
+
+  name = "/aws/lambda/\${local.function_name[each.key]}"
+  tags = var.tags
 }
 
 
@@ -883,7 +1297,7 @@ resource "aws_lambda_function" "authorizer_lambda" {
   function_name    = "TestApiAuthorizer-\${random_string.suffix.result}"
   role            = aws_iam_role.authorizer_execution_role.arn
   handler         = "index.handler"
-  runtime         = "nodejs22.x"
+  runtime         = "nodejs24.x"
   timeout         = 10
   memory_size     = 128
 
@@ -963,58 +1377,62 @@ resource "aws_lambda_permission" "authorizer_invoke" {
   source_arn    = "\${module.rest_api.api_execution_arn}/authorizers/\${aws_api_gateway_authorizer.custom_authorizer.id}"
 }
 
-# Create proxy resource (captures all paths)
-resource "aws_api_gateway_resource" "proxy_resource" {
-  rest_api_id = module.rest_api.api_id
-  parent_id   = module.rest_api.api_root_resource_id
-  path_part   = "{proxy+}"
-}
-
-# Lambda integration for REST API
-resource "aws_api_gateway_integration" "lambda_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.proxy_method.http_method
-
-  integration_http_method = "POST"
-  type                    = "AWS_PROXY"
-  uri                     = aws_lambda_function.api_lambda.invoke_arn
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
-
-# Method for proxy integration
-resource "aws_api_gateway_method" "proxy_method" {
+# Method per operation
+resource "aws_api_gateway_method" "operation_methods" {
   #checkov:skip=CKV2_AWS_53:Request validation not required for proxy integration as Lambda handles validation
+  for_each = local.operations
+
   rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "ANY"
+  resource_id   = local.operation_resource_id[each.key]
+  http_method   = upper(each.value.method)
 
   authorization = "CUSTOM"
   authorizer_id = aws_api_gateway_authorizer.custom_authorizer.id
 
+  # Path parameters must be declared on the method
   request_parameters = {
-    "method.request.path.proxy" = true
+    for segment in local.operation_segments[each.key] :
+    "method.request.path.\${trimsuffix(trimprefix(segment, "{"), "}")}" => true
+    if startswith(segment, "{")
   }
 
   depends_on = [aws_api_gateway_authorizer.custom_authorizer]
 }
 
-# OPTIONS method for CORS preflight
+# Lambda integration per operation
+resource "aws_api_gateway_integration" "lambda_integration" {
+  for_each = local.operations
+
+  rest_api_id = module.rest_api.api_id
+  resource_id = local.operation_resource_id[each.key]
+  http_method = aws_api_gateway_method.operation_methods[each.key].http_method
+
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  uri                     = aws_lambda_function.api_lambda[each.key].invoke_arn
+
+  depends_on = [aws_lambda_function.api_lambda]
+}
+
+# OPTIONS method for CORS preflight, on every resource an operation is served from
 resource "aws_api_gateway_method" "options_method" {
   #checkov:skip=CKV2_AWS_70:OPTIONS method must be unauthenticated for CORS preflight requests
   #checkov:skip=CKV2_AWS_53:Request validation not required for OPTIONS CORS preflight method
+  for_each = local.resource_ids
+
   rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
+  resource_id   = each.value
   http_method   = "OPTIONS"
   authorization = "NONE"
 }
 
-# CORS integration for OPTIONS method
+# CORS integration for OPTIONS methods
 resource "aws_api_gateway_integration" "options_integration" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
 
   type = "MOCK"
   request_templates = {
@@ -1022,11 +1440,13 @@ resource "aws_api_gateway_integration" "options_integration" {
   }
 }
 
-# OPTIONS method response
+# OPTIONS method responses
 resource "aws_api_gateway_method_response" "options_response" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
   status_code = "204"
 
   response_parameters = {
@@ -1036,18 +1456,22 @@ resource "aws_api_gateway_method_response" "options_response" {
   }
 }
 
-# OPTIONS integration response
+# OPTIONS integration responses
 resource "aws_api_gateway_integration_response" "options_integration_response" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = aws_api_gateway_method_response.options_response.status_code
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
+  status_code = aws_api_gateway_method_response.options_response[each.key].status_code
 
   response_parameters = {
     "method.response.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
     "method.response.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
     "method.response.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
   }
+
+  depends_on = [aws_api_gateway_integration.options_integration]
 }
 
 # API Gateway deployment
@@ -1055,13 +1479,28 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   rest_api_id = module.rest_api.api_id
 
   triggers = {
-    redeployment = sha1(jsonencode([
-      aws_api_gateway_resource.proxy_resource.id,
-      aws_api_gateway_method.proxy_method.id,
-      aws_api_gateway_integration.lambda_integration.id,
-      aws_api_gateway_method.options_method.id,
-      aws_api_gateway_integration.options_integration.id,
-    ]))
+    redeployment = sha1(jsonencode(concat(
+      [for r in aws_api_gateway_resource.path_depth_0 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_1 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_2 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_3 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_4 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_5 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_6 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_7 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_8 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_9 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_10 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_11 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_12 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_13 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_14 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_15 : r.id],
+      [for m in aws_api_gateway_method.operation_methods : m.id],
+      [for i in aws_api_gateway_integration.lambda_integration : i.id],
+      [for m in aws_api_gateway_method.options_method : m.id],
+      [for i in aws_api_gateway_integration.options_integration : i.id],
+    )))
   }
 
   lifecycle {
@@ -1069,7 +1508,7 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   }
 
   depends_on = [
-    aws_api_gateway_method.proxy_method,
+    aws_api_gateway_method.operation_methods,
     aws_api_gateway_integration.lambda_integration,
     aws_api_gateway_method.options_method,
     aws_api_gateway_integration.options_integration,
@@ -1079,11 +1518,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "TestApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/test-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -1091,9 +1582,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -1116,11 +1637,13 @@ resource "aws_api_gateway_rest_api_policy" "api_policy" {
 
 # Lambda permission for API Gateway to invoke the function
 resource "aws_lambda_permission" "api_gateway_invoke" {
+  for_each = local.operations
+
   statement_id  = "AllowExecutionFromAPIGateway"
   action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
+  function_name = aws_lambda_function.api_lambda[each.key].function_name
   principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
+  source_arn    = "\${module.rest_api.api_execution_arn}/*/\${local.permission_source_suffix[each.key]}"
 
   depends_on = [module.rest_api, aws_lambda_function.api_lambda]
 }
@@ -1132,7 +1655,7 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "TestApi" = aws_api_gateway_stage.api_stage.invoke_url }
+  value     = { "TestApi" = "\${aws_api_gateway_stage.api_stage.invoke_url}/" }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }
@@ -1185,78 +1708,83 @@ output "stage_id" {
   value       = aws_api_gateway_stage.api_stage.id
 }
 
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
+# Lambda Function Outputs, keyed by operation name
+output "operations" {
+  description = "Names of the API operations, each with its own Lambda function"
+  value       = keys(local.operations)
+}
+
+output "lambda_function_names" {
+  description = "Name of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.function_name }
 }
 
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
+output "lambda_function_arns" {
+  description = "ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.arn }
 }
 
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
+output "lambda_invoke_arns" {
+  description = "Invoke ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.invoke_arn }
 }
 
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
+output "lambda_qualified_arns" {
+  description = "Qualified ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.qualified_arn }
 }
 
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
+output "lambda_versions" {
+  description = "Version of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.version }
 }
 
 output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
+  description = "Base64-encoded SHA256 hash of the Lambda deployment package, shared by every operation"
+  value       = data.archive_file.lambda_zip.output_base64sha256
 }
 
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
+# IAM Role Outputs, keyed by operation name
+output "lambda_execution_role_arns" {
+  description = "ARN of each operation's Lambda execution role, keyed by operation name"
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.arn }
 }
 
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
+output "lambda_execution_role_names" {
+  description = "Name of each operation's Lambda execution role, keyed by operation name. Attach additional policies to a specific operation's role by name."
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.name }
 }
 
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
+output "security_group_id" {
+  description = "Security group ID shared by the API Lambda functions, for use in ingress rules on resources they must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
 }
 
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_api_gateway_integration.lambda_integration.id
+# Integration Outputs, keyed by operation name
+output "integration_ids" {
+  description = "ID of each operation's Lambda integration, keyed by operation name"
+  value       = { for op, i in aws_api_gateway_integration.lambda_integration : op => i.id }
 }
 
-output "proxy_resource_id" {
-  description = "ID of the proxy resource"
-  value       = aws_api_gateway_resource.proxy_resource.id
+output "method_ids" {
+  description = "ID of each operation's API Gateway method, keyed by operation name"
+  value       = { for op, m in aws_api_gateway_method.operation_methods : op => m.id }
 }
 
-output "proxy_method_id" {
-  description = "ID of the proxy method"
-  value       = aws_api_gateway_method.proxy_method.id
+output "resource_ids" {
+  description = "ID of each API Gateway resource, keyed by its path"
+  value       = local.resource_ids
 }
 
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
+# CloudWatch Log Groups, keyed by operation name
+output "lambda_log_group_names" {
+  description = "Name of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.name }
 }
 
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
+output "lambda_log_group_arns" {
+  description = "ARN of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.arn }
 }
 "
 `;
@@ -1296,25 +1824,46 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
     "apiName": "test-api",
     "auth": "custom",
     "modelProject": "@proj/test-api-model",
+    "iac": "cdk",
     "ports": [3001]
   },
   "targets": {
+    "assemble": {
+      "dependsOn": ["compile", "bundle"]
+    },
     "build": {
       "dependsOn": ["lint", "compile", "test", "bundle"]
     },
     "compile": {
       "executor": "nx:run-commands",
+      "dependsOn": ["copy-ssdk"],
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/tsc"],
       "options": {
         "command": "tsc --build tsconfig.lib.json",
         "cwd": "{projectRoot}"
+      }
+    },
+    "format": {
+      "executor": "nx:run-commands",
+      "cache": true,
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome format {projectRoot}"
       },
-      "dependsOn": ["copy-ssdk"]
+      "configurations": {
+        "fix": {
+          "command": "biome format --write {projectRoot}"
+        },
+        "skip-lint": {
+          "command": "node -e \\"\\""
+        }
+      }
     },
     "lint": {
       "executor": "nx:run-commands",
       "cache": true,
       "inputs": ["biome"],
+      "dependsOn": ["format"],
       "options": {
         "command": "biome lint {projectRoot}"
       },
@@ -1327,22 +1876,16 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
         }
       }
     },
-    "test": {
-      "executor": "@nx/vitest:test",
-      "outputs": ["{options.reportsDirectory}"],
-      "options": {
-        "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
-      }
-    },
     "bundle": {
+      "executor": "nx:run-commands",
+      "dependsOn": ["compile"],
       "cache": true,
+      "inputs": ["default"],
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/bundle"],
-      "executor": "nx:run-commands",
       "options": {
         "command": "rolldown -c rolldown.config.ts",
         "cwd": "{projectRoot}"
-      },
-      "dependsOn": ["compile"]
+      }
     },
     "copy-ssdk": {
       "cache": true,
@@ -1365,31 +1908,31 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
     },
     "watch-copy-ssdk": {
       "executor": "nx:run-commands",
+      "continuous": true,
       "options": {
-        "command": "nx watch --projects=@proj/test-api-model --includeDependentProjects -- nx run @proj/test-api:copy-ssdk"
-      },
-      "continuous": true
+        "command": "nx watch --projects=@proj/test-api-model --includeDependencies -- nx run @proj/test-api:copy-ssdk"
+      }
     },
     "serve": {
       "executor": "nx:run-commands",
+      "dependsOn": ["copy-ssdk", "watch-copy-ssdk"],
+      "continuous": true,
       "options": {
         "command": "tsx --watch src/local-server.ts",
         "cwd": "{projectRoot}"
-      },
-      "continuous": true,
-      "dependsOn": ["copy-ssdk", "watch-copy-ssdk"]
+      }
     },
-    "serve-local": {
+    "dev": {
       "executor": "nx:run-commands",
+      "dependsOn": ["copy-ssdk", "watch-copy-ssdk"],
+      "continuous": true,
       "options": {
         "command": "tsx --watch src/local-server.ts",
         "cwd": "{projectRoot}",
         "env": {
-          "SERVE_LOCAL": "true"
+          "LOCAL_DEV": "true"
         }
-      },
-      "continuous": true,
-      "dependsOn": ["copy-ssdk", "watch-copy-ssdk"]
+      }
     }
   }
 }
@@ -1427,7 +1970,7 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
 "import {
   convertEvent,
   convertVersion1Response,
-} from '@aws-smithy/server-apigateway';
+} from '@smithy/server-apigateway';
 import type { APIGatewayProxyEvent, APIGatewayProxyResult } from 'aws-lambda';
 import middy from '@middy/core';
 import { Tracer } from '@aws-lambda-powertools/tracer';
@@ -1492,7 +2035,7 @@ export const handler = middy<APIGatewayProxyEvent, APIGatewayProxyResult>()
 
 exports[`tsSmithyApiGenerator > should generate smithy ts api with default options > local-server.ts 1`] = `
 "import { IncomingMessage, ServerResponse, createServer } from 'http';
-import { convertRequest, writeResponse } from '@aws-smithy/server-node';
+import { convertRequest, writeResponse } from '@smithy/server-node';
 import { Logger } from '@aws-lambda-powertools/logger';
 import { Metrics } from '@aws-lambda-powertools/metrics';
 import { Tracer } from '@aws-lambda-powertools/tracer';
@@ -1543,22 +2086,46 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
   "projectType": "library",
   "metadata": {
     "generator": "smithy#project",
+    "smithyType": "service",
+    "namespace": "proj",
     "apiName": "test-api-model",
     "backendProject": "@proj/test-api"
   },
   "targets": {
     "build": {
-      "dependsOn": ["compile"]
+      "dependsOn": ["compile", "generate-ssdk"]
+    },
+    "assemble": {
+      "dependsOn": ["compile", "generate-ssdk"]
     },
     "compile": {
       "cache": true,
-      "outputs": ["{workspaceRoot}/dist/{projectRoot}/build"],
+      "outputs": [
+        "{workspaceRoot}/dist/{projectRoot}/smithy",
+        "{workspaceRoot}/dist/{projectRoot}/build/openapi"
+      ],
       "executor": "nx:run-commands",
       "options": {
         "commands": [
           "rimraf dist/{projectRoot}/build",
+          "rimraf dist/{projectRoot}/smithy",
           "make-dir dist/{projectRoot}/build",
-          "docker build -f {projectRoot}/build.Dockerfile --target export --output type=local,dest=dist/{projectRoot}/build {projectRoot}"
+          "npx -y mise@2026.8.14 exec smithy@1.73.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "cpy \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi --flat --rename=openapi.json"
+        ],
+        "parallel": false,
+        "cwd": "{workspaceRoot}"
+      }
+    },
+    "generate-ssdk": {
+      "cache": true,
+      "outputs": ["{workspaceRoot}/dist/{projectRoot}/build/ssdk"],
+      "executor": "nx:run-commands",
+      "dependsOn": ["compile"],
+      "options": {
+        "commands": [
+          "npm install --prefix dist/{projectRoot}/smithy/source/typescript-ssdk-codegen --include=dev --ignore-scripts --no-audit --no-fund",
+          "rolldown -c {projectRoot}/ssdk.rolldown.config.mjs"
         ],
         "parallel": false,
         "cwd": "{workspaceRoot}"
@@ -1585,7 +2152,7 @@ exports[`tsSmithyApiGenerator > should handle kebab-case API names correctly > k
 "import {
   convertEvent,
   convertVersion1Response,
-} from '@aws-smithy/server-apigateway';
+} from '@smithy/server-apigateway';
 import type { APIGatewayProxyEvent, APIGatewayProxyResult } from 'aws-lambda';
 import middy from '@middy/core';
 import { Tracer } from '@aws-lambda-powertools/tracer';
@@ -1682,11 +2249,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -1756,8 +2323,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -1774,10 +2339,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -1879,22 +2442,75 @@ resource "aws_wafv2_web_acl" "api_waf" {
   }
 }
 
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+locals {
+  waf_log_group_name = var.enable_waf ? "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}" : null
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "\${var.api_name} API WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/\${var.api_name}-\${random_id.waf_log_suffix[0].hex}-waf-logs"
+  target_key_id = aws_kms_key.waf_logs[0].key_id
+}
+
 # CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
 resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
+  name              = local.waf_log_group_name
   retention_in_days = 30
+  kms_key_id        = aws_kms_key.waf_logs[0].arn
   tags              = var.tags
 }
 
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
 resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
   count = var.enable_waf ? 1 : 0
 
@@ -1935,16 +2551,22 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
+# Note: Stage, deployment and access log outputs are provided by the consuming module",
   "test-api.tf": "terraform {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
     }
   }
 }
@@ -1976,11 +2598,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -2025,6 +2683,235 @@ resource "random_string" "suffix" {
   upper   = false
 }
 
+locals {
+  # Generated at build time from the API definition
+  operations_file = "\${path.module}/../../../generated/test-api/operations.json"
+  operations      = fileexists(local.operations_file) ? jsondecode(file(local.operations_file)) : {}
+
+  operation_slug = { for op in keys(local.operations) : op => replace(op, "/[^a-zA-Z0-9-_]/", "-") }
+  operation_hash = { for op in keys(local.operations) : op => substr(sha256(op), 0, 8) }
+
+  function_name = { for op in keys(local.operations) : op =>
+    "\${substr("TestApi-\${local.operation_slug[op]}", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-\${local.operation_hash[op]}-\${random_string.suffix.result}"
+  }
+  role_name = { for op in keys(local.operations) : op =>
+    "\${substr("TestApi-\${local.operation_slug[op]}-role", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-\${local.operation_hash[op]}-\${random_string.suffix.result}"
+  }
+
+  # A REST API needs a resource per path segment, so each operation's path is
+  # split into the distinct path prefixes the resource tree is built from below
+  operation_segments = { for op, details in local.operations : op => compact(split("/", details.path)) }
+
+  path_nodes = merge([
+    for op, segments in local.operation_segments : {
+      for i, segment in segments : join("/", slice(segments, 0, i + 1)) => {
+        depth  = i
+        parent = i == 0 ? "" : join("/", slice(segments, 0, i))
+        part   = segment
+      }
+    }
+  ]...)
+
+  # Instances of a resource cannot reference one another, so each depth is a
+  # separate resource. Deeper paths are reported by the precondition below.
+  max_path_depth = 16
+  path_nodes_by_depth = { for depth in range(local.max_path_depth) : depth => {
+    for path, node in local.path_nodes : path => node if node.depth == depth
+  } }
+  paths_too_deep = [for path, node in local.path_nodes : path if node.depth >= local.max_path_depth]
+
+  resource_ids = merge(
+    { for path, resource in aws_api_gateway_resource.path_depth_0 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_1 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_2 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_3 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_4 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_5 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_6 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_7 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_8 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_9 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_10 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_11 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_12 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_13 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_14 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_15 : path => resource.id },
+  )
+
+  operation_resource_id = { for op, segments in local.operation_segments : op =>
+    local.resource_ids[join("/", segments)]
+  }
+
+  permission_source_suffix = { for op, details in local.operations : op =>
+    "\${upper(details.method)}/\${replace(join("/", local.operation_segments[op]), "/{[^}]*}/", "*")}"
+  }
+}
+
+resource "terraform_data" "operations_metadata" {
+  # Fails the plan when the operations metadata has not been generated
+  input = local.operations_file
+
+  lifecycle {
+    precondition {
+      condition     = fileexists(local.operations_file)
+      error_message = "Operations metadata not found at \${local.operations_file}. Build the TestApi project to generate it."
+    }
+    precondition {
+      condition     = length(local.operations) > 0
+      error_message = "No operations found in \${local.operations_file}. The TestApi API must define at least one operation."
+    }
+    precondition {
+      condition     = length(local.paths_too_deep) == 0
+      error_message = "Operation paths exceed the supported depth of \${local.max_path_depth} segments: \${join(", ", local.paths_too_deep)}. Add further aws_api_gateway_resource levels to this module to support them."
+    }
+  }
+}
+
+# API Gateway resources at path depth 0
+resource "aws_api_gateway_resource" "path_depth_0" {
+  for_each = local.path_nodes_by_depth[0]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = module.rest_api.api_root_resource_id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 1
+resource "aws_api_gateway_resource" "path_depth_1" {
+  for_each = local.path_nodes_by_depth[1]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_0[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 2
+resource "aws_api_gateway_resource" "path_depth_2" {
+  for_each = local.path_nodes_by_depth[2]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_1[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 3
+resource "aws_api_gateway_resource" "path_depth_3" {
+  for_each = local.path_nodes_by_depth[3]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_2[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 4
+resource "aws_api_gateway_resource" "path_depth_4" {
+  for_each = local.path_nodes_by_depth[4]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_3[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 5
+resource "aws_api_gateway_resource" "path_depth_5" {
+  for_each = local.path_nodes_by_depth[5]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_4[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 6
+resource "aws_api_gateway_resource" "path_depth_6" {
+  for_each = local.path_nodes_by_depth[6]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_5[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 7
+resource "aws_api_gateway_resource" "path_depth_7" {
+  for_each = local.path_nodes_by_depth[7]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_6[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 8
+resource "aws_api_gateway_resource" "path_depth_8" {
+  for_each = local.path_nodes_by_depth[8]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_7[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 9
+resource "aws_api_gateway_resource" "path_depth_9" {
+  for_each = local.path_nodes_by_depth[9]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_8[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 10
+resource "aws_api_gateway_resource" "path_depth_10" {
+  for_each = local.path_nodes_by_depth[10]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_9[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 11
+resource "aws_api_gateway_resource" "path_depth_11" {
+  for_each = local.path_nodes_by_depth[11]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_10[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 12
+resource "aws_api_gateway_resource" "path_depth_12" {
+  for_each = local.path_nodes_by_depth[12]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_11[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 13
+resource "aws_api_gateway_resource" "path_depth_13" {
+  for_each = local.path_nodes_by_depth[13]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_12[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 14
+resource "aws_api_gateway_resource" "path_depth_14" {
+  for_each = local.path_nodes_by_depth[14]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_13[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 15
+resource "aws_api_gateway_resource" "path_depth_15" {
+  for_each = local.path_nodes_by_depth[15]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_14[each.value.parent].id
+  path_part   = each.value.part
+}
+
 # Resources
 
 # Create Lambda ZIP file from the bundle directory
@@ -2043,6 +2930,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -2072,9 +2964,33 @@ resource "aws_wafv2_web_acl_association" "api_waf_association" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-# Lambda function
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "test-api-lambda-"
+  description = "Security group for the TestApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  # One lambda function per operation, each serving just that operation
+  for_each = local.operations
+
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -2082,10 +2998,10 @@ resource "aws_lambda_function" "api_lambda" {
   s3_bucket         = aws_s3_object.lambda_zip.bucket
   s3_key            = aws_s3_object.lambda_zip.key
   s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "TestApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
+  function_name    = local.function_name[each.key]
+  role            = aws_iam_role.lambda_execution_role[each.key].arn
   handler         = "index.handler"
-  runtime         = "nodejs22.x"
+  runtime         = "nodejs24.x"
   timeout         = 30
   memory_size     = 128
 
@@ -2096,18 +3012,32 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
+  for_each = local.operations
+
+  name = local.role_name[each.key]
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -2127,35 +3057,73 @@ resource "aws_iam_role" "lambda_execution_role" {
 
 # Attach basic execution policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
+  for_each = local.operations
+
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
+  role       = aws_iam_role.lambda_execution_role[each.key].name
 }
 
 # Attach X-Ray tracing policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
+  for_each = local.operations
+
   policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
+  role       = aws_iam_role.lambda_execution_role[each.key].name
+}
+
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  for_each = var.enable_vpc ? local.operations : {}
+
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role[each.key].name
 }
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
+  for_each = local.operations
+
+  name = "\${substr(local.function_name[each.key], 0, 55)}-policies"
+  role = aws_iam_role.lambda_execution_role[each.key].id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_document_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+
+  # IAM rejects an empty statement list, so fall back to a no-op deny
+  lambda_policy_document_statements = length(local.lambda_policy_statements) > 0 ? local.lambda_policy_statements : [
+    {
+      Effect   = "Deny"
+      Action   = ["appconfig:GetLatestConfiguration"]
+      Resource = ["arn:aws:appconfig:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:application/none"]
+    }
+  ]
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
+  for_each = local.operations
+
+  name = "/aws/lambda/\${local.function_name[each.key]}"
+  tags = var.tags
 }
 
 
@@ -2168,58 +3136,65 @@ resource "aws_api_gateway_authorizer" "cognito_authorizer" {
   identity_source       = "method.request.header.Authorization"
 }
 
-# Create proxy resource (captures all paths)
-resource "aws_api_gateway_resource" "proxy_resource" {
-  rest_api_id = module.rest_api.api_id
-  parent_id   = module.rest_api.api_root_resource_id
-  path_part   = "{proxy+}"
-}
-
-# Lambda integration for REST API
-resource "aws_api_gateway_integration" "lambda_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.proxy_method.http_method
-
-  integration_http_method = "POST"
-  type                    = "AWS_PROXY"
-  uri                     = aws_lambda_function.api_lambda.invoke_arn
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
-
-# Method for proxy integration
-resource "aws_api_gateway_method" "proxy_method" {
+# Method per operation
+resource "aws_api_gateway_method" "operation_methods" {
   #checkov:skip=CKV2_AWS_53:Request validation not required for proxy integration as Lambda handles validation
+  for_each = local.operations
+
   rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "ANY"
+  resource_id   = local.operation_resource_id[each.key]
+  http_method   = upper(each.value.method)
 
   authorization = "COGNITO_USER_POOLS"
   authorizer_id = aws_api_gateway_authorizer.cognito_authorizer.id
+  # Accept access tokens from both sign-in flows: 'openid' (Cognito hosted UI)
+  # and 'aws.cognito.signin.user.admin' (Cognito admin/SRP auth APIs).
+  authorization_scopes = ["openid", "aws.cognito.signin.user.admin"]
 
+  # Path parameters must be declared on the method
   request_parameters = {
-    "method.request.path.proxy" = true
+    for segment in local.operation_segments[each.key] :
+    "method.request.path.\${trimsuffix(trimprefix(segment, "{"), "}")}" => true
+    if startswith(segment, "{")
   }
 
   depends_on = [aws_api_gateway_authorizer.cognito_authorizer]
 }
 
-# OPTIONS method for CORS preflight
+# Lambda integration per operation
+resource "aws_api_gateway_integration" "lambda_integration" {
+  for_each = local.operations
+
+  rest_api_id = module.rest_api.api_id
+  resource_id = local.operation_resource_id[each.key]
+  http_method = aws_api_gateway_method.operation_methods[each.key].http_method
+
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  uri                     = aws_lambda_function.api_lambda[each.key].invoke_arn
+
+  depends_on = [aws_lambda_function.api_lambda]
+}
+
+# OPTIONS method for CORS preflight, on every resource an operation is served from
 resource "aws_api_gateway_method" "options_method" {
   #checkov:skip=CKV2_AWS_70:OPTIONS method must be unauthenticated for CORS preflight requests
   #checkov:skip=CKV2_AWS_53:Request validation not required for OPTIONS CORS preflight method
+  for_each = local.resource_ids
+
   rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
+  resource_id   = each.value
   http_method   = "OPTIONS"
   authorization = "NONE"
 }
 
-# CORS integration for OPTIONS method
+# CORS integration for OPTIONS methods
 resource "aws_api_gateway_integration" "options_integration" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
 
   type = "MOCK"
   request_templates = {
@@ -2227,11 +3202,13 @@ resource "aws_api_gateway_integration" "options_integration" {
   }
 }
 
-# OPTIONS method response
+# OPTIONS method responses
 resource "aws_api_gateway_method_response" "options_response" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
   status_code = "204"
 
   response_parameters = {
@@ -2241,18 +3218,22 @@ resource "aws_api_gateway_method_response" "options_response" {
   }
 }
 
-# OPTIONS integration response
+# OPTIONS integration responses
 resource "aws_api_gateway_integration_response" "options_integration_response" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = aws_api_gateway_method_response.options_response.status_code
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
+  status_code = aws_api_gateway_method_response.options_response[each.key].status_code
 
   response_parameters = {
     "method.response.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
     "method.response.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
     "method.response.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
   }
+
+  depends_on = [aws_api_gateway_integration.options_integration]
 }
 
 # API Gateway deployment
@@ -2260,13 +3241,28 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   rest_api_id = module.rest_api.api_id
 
   triggers = {
-    redeployment = sha1(jsonencode([
-      aws_api_gateway_resource.proxy_resource.id,
-      aws_api_gateway_method.proxy_method.id,
-      aws_api_gateway_integration.lambda_integration.id,
-      aws_api_gateway_method.options_method.id,
-      aws_api_gateway_integration.options_integration.id,
-    ]))
+    redeployment = sha1(jsonencode(concat(
+      [for r in aws_api_gateway_resource.path_depth_0 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_1 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_2 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_3 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_4 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_5 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_6 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_7 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_8 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_9 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_10 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_11 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_12 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_13 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_14 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_15 : r.id],
+      [for m in aws_api_gateway_method.operation_methods : m.id],
+      [for i in aws_api_gateway_integration.lambda_integration : i.id],
+      [for m in aws_api_gateway_method.options_method : m.id],
+      [for i in aws_api_gateway_integration.options_integration : i.id],
+    )))
   }
 
   lifecycle {
@@ -2274,7 +3270,7 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   }
 
   depends_on = [
-    aws_api_gateway_method.proxy_method,
+    aws_api_gateway_method.operation_methods,
     aws_api_gateway_integration.lambda_integration,
     aws_api_gateway_method.options_method,
     aws_api_gateway_integration.options_integration,
@@ -2283,11 +3279,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "TestApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/test-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -2295,9 +3343,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -2320,11 +3398,13 @@ resource "aws_api_gateway_rest_api_policy" "api_policy" {
 
 # Lambda permission for API Gateway to invoke the function
 resource "aws_lambda_permission" "api_gateway_invoke" {
+  for_each = local.operations
+
   statement_id  = "AllowExecutionFromAPIGateway"
   action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
+  function_name = aws_lambda_function.api_lambda[each.key].function_name
   principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
+  source_arn    = "\${module.rest_api.api_execution_arn}/*/\${local.permission_source_suffix[each.key]}"
 
   depends_on = [module.rest_api, aws_lambda_function.api_lambda]
 }
@@ -2336,7 +3416,7 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "TestApi" = aws_api_gateway_stage.api_stage.invoke_url }
+  value     = { "TestApi" = "\${aws_api_gateway_stage.api_stage.invoke_url}/" }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }
@@ -2389,78 +3469,83 @@ output "stage_id" {
   value       = aws_api_gateway_stage.api_stage.id
 }
 
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
+# Lambda Function Outputs, keyed by operation name
+output "operations" {
+  description = "Names of the API operations, each with its own Lambda function"
+  value       = keys(local.operations)
 }
 
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
+output "lambda_function_names" {
+  description = "Name of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.function_name }
 }
 
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
+output "lambda_function_arns" {
+  description = "ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.arn }
 }
 
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
+output "lambda_invoke_arns" {
+  description = "Invoke ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.invoke_arn }
 }
 
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
+output "lambda_qualified_arns" {
+  description = "Qualified ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.qualified_arn }
 }
 
-output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
+output "lambda_versions" {
+  description = "Version of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.version }
 }
 
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
+output "lambda_source_code_hash" {
+  description = "Base64-encoded SHA256 hash of the Lambda deployment package, shared by every operation"
+  value       = data.archive_file.lambda_zip.output_base64sha256
+}
+
+# IAM Role Outputs, keyed by operation name
+output "lambda_execution_role_arns" {
+  description = "ARN of each operation's Lambda execution role, keyed by operation name"
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.arn }
 }
 
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
+output "lambda_execution_role_names" {
+  description = "Name of each operation's Lambda execution role, keyed by operation name. Attach additional policies to a specific operation's role by name."
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.name }
 }
 
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
+output "security_group_id" {
+  description = "Security group ID shared by the API Lambda functions, for use in ingress rules on resources they must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
 }
 
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_api_gateway_integration.lambda_integration.id
+# Integration Outputs, keyed by operation name
+output "integration_ids" {
+  description = "ID of each operation's Lambda integration, keyed by operation name"
+  value       = { for op, i in aws_api_gateway_integration.lambda_integration : op => i.id }
 }
 
-output "proxy_resource_id" {
-  description = "ID of the proxy resource"
-  value       = aws_api_gateway_resource.proxy_resource.id
+output "method_ids" {
+  description = "ID of each operation's API Gateway method, keyed by operation name"
+  value       = { for op, m in aws_api_gateway_method.operation_methods : op => m.id }
 }
 
-output "proxy_method_id" {
-  description = "ID of the proxy method"
-  value       = aws_api_gateway_method.proxy_method.id
+output "resource_ids" {
+  description = "ID of each API Gateway resource, keyed by its path"
+  value       = local.resource_ids
 }
 
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
+# CloudWatch Log Groups, keyed by operation name
+output "lambda_log_group_names" {
+  description = "Name of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.name }
 }
 
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
+output "lambda_log_group_arns" {
+  description = "ARN of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.arn }
 }
 ",
 }
@@ -2477,11 +3562,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -2551,8 +3636,6 @@ data "aws_caller_identity" "current" {}
 
 # Resources
 
-# Note: CloudWatch logging removed due to account-level CloudWatch Logs role ARN requirement
-
 # REST API Gateway
 resource "aws_api_gateway_rest_api" "rest_api" {
   name        = var.api_name
@@ -2569,10 +3652,8 @@ resource "aws_api_gateway_rest_api" "rest_api" {
   tags = var.tags
 }
 
-# Note: Deployment and stage are created in the consuming module (e.g., foo-api.tf)
-# after all methods and integrations are defined
-
-# Note: CloudWatch Log Group removed due to account-level CloudWatch Logs role ARN requirement
+# Note: Deployment, stage and access logging are created in the consuming module
+# (e.g., foo-api.tf) after all methods and integrations are defined
 
 # Gateway Response for CORS (4XX errors)
 resource "aws_api_gateway_gateway_response" "cors_4xx" {
@@ -2674,22 +3755,75 @@ resource "aws_wafv2_web_acl" "api_waf" {
   }
 }
 
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+
+locals {
+  waf_log_group_name = var.enable_waf ? "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}" : null
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "\${var.api_name} API WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/\${var.api_name}-\${random_id.waf_log_suffix[0].hex}-waf-logs"
+  target_key_id = aws_kms_key.waf_logs[0].key_id
+}
+
 # CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
 resource "aws_cloudwatch_log_group" "api_waf_logs" {
-  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
   count = var.enable_waf ? 1 : 0
 
-  name              = "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}"
+  name              = local.waf_log_group_name
   retention_in_days = 30
+  kms_key_id        = aws_kms_key.waf_logs[0].arn
   tags              = var.tags
 }
 
-resource "random_id" "waf_log_suffix" {
-  count       = var.enable_waf ? 1 : 0
-  byte_length = 4
-}
-
 resource "aws_wafv2_web_acl_logging_configuration" "api_waf_logging" {
   count = var.enable_waf ? 1 : 0
 
@@ -2730,16 +3864,22 @@ output "waf_web_acl_arn" {
   value       = var.enable_waf ? aws_wafv2_web_acl.api_waf[0].arn : null
 }
 
-# Note: Stage and deployment outputs are provided by the consuming module
-
-# Note: CloudWatch log group outputs removed due to account-level CloudWatch Logs role ARN requirement",
+# Note: Stage, deployment and access log outputs are provided by the consuming module",
   "test-api.tf": "terraform {
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
     }
   }
 }
@@ -2761,11 +3901,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -2810,6 +3986,235 @@ resource "random_string" "suffix" {
   upper   = false
 }
 
+locals {
+  # Generated at build time from the API definition
+  operations_file = "\${path.module}/../../../generated/test-api/operations.json"
+  operations      = fileexists(local.operations_file) ? jsondecode(file(local.operations_file)) : {}
+
+  operation_slug = { for op in keys(local.operations) : op => replace(op, "/[^a-zA-Z0-9-_]/", "-") }
+  operation_hash = { for op in keys(local.operations) : op => substr(sha256(op), 0, 8) }
+
+  function_name = { for op in keys(local.operations) : op =>
+    "\${substr("TestApi-\${local.operation_slug[op]}", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-\${local.operation_hash[op]}-\${random_string.suffix.result}"
+  }
+  role_name = { for op in keys(local.operations) : op =>
+    "\${substr("TestApi-\${local.operation_slug[op]}-role", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-\${local.operation_hash[op]}-\${random_string.suffix.result}"
+  }
+
+  # A REST API needs a resource per path segment, so each operation's path is
+  # split into the distinct path prefixes the resource tree is built from below
+  operation_segments = { for op, details in local.operations : op => compact(split("/", details.path)) }
+
+  path_nodes = merge([
+    for op, segments in local.operation_segments : {
+      for i, segment in segments : join("/", slice(segments, 0, i + 1)) => {
+        depth  = i
+        parent = i == 0 ? "" : join("/", slice(segments, 0, i))
+        part   = segment
+      }
+    }
+  ]...)
+
+  # Instances of a resource cannot reference one another, so each depth is a
+  # separate resource. Deeper paths are reported by the precondition below.
+  max_path_depth = 16
+  path_nodes_by_depth = { for depth in range(local.max_path_depth) : depth => {
+    for path, node in local.path_nodes : path => node if node.depth == depth
+  } }
+  paths_too_deep = [for path, node in local.path_nodes : path if node.depth >= local.max_path_depth]
+
+  resource_ids = merge(
+    { for path, resource in aws_api_gateway_resource.path_depth_0 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_1 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_2 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_3 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_4 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_5 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_6 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_7 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_8 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_9 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_10 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_11 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_12 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_13 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_14 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_15 : path => resource.id },
+  )
+
+  operation_resource_id = { for op, segments in local.operation_segments : op =>
+    local.resource_ids[join("/", segments)]
+  }
+
+  permission_source_suffix = { for op, details in local.operations : op =>
+    "\${upper(details.method)}/\${replace(join("/", local.operation_segments[op]), "/{[^}]*}/", "*")}"
+  }
+}
+
+resource "terraform_data" "operations_metadata" {
+  # Fails the plan when the operations metadata has not been generated
+  input = local.operations_file
+
+  lifecycle {
+    precondition {
+      condition     = fileexists(local.operations_file)
+      error_message = "Operations metadata not found at \${local.operations_file}. Build the TestApi project to generate it."
+    }
+    precondition {
+      condition     = length(local.operations) > 0
+      error_message = "No operations found in \${local.operations_file}. The TestApi API must define at least one operation."
+    }
+    precondition {
+      condition     = length(local.paths_too_deep) == 0
+      error_message = "Operation paths exceed the supported depth of \${local.max_path_depth} segments: \${join(", ", local.paths_too_deep)}. Add further aws_api_gateway_resource levels to this module to support them."
+    }
+  }
+}
+
+# API Gateway resources at path depth 0
+resource "aws_api_gateway_resource" "path_depth_0" {
+  for_each = local.path_nodes_by_depth[0]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = module.rest_api.api_root_resource_id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 1
+resource "aws_api_gateway_resource" "path_depth_1" {
+  for_each = local.path_nodes_by_depth[1]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_0[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 2
+resource "aws_api_gateway_resource" "path_depth_2" {
+  for_each = local.path_nodes_by_depth[2]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_1[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 3
+resource "aws_api_gateway_resource" "path_depth_3" {
+  for_each = local.path_nodes_by_depth[3]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_2[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 4
+resource "aws_api_gateway_resource" "path_depth_4" {
+  for_each = local.path_nodes_by_depth[4]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_3[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 5
+resource "aws_api_gateway_resource" "path_depth_5" {
+  for_each = local.path_nodes_by_depth[5]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_4[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 6
+resource "aws_api_gateway_resource" "path_depth_6" {
+  for_each = local.path_nodes_by_depth[6]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_5[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 7
+resource "aws_api_gateway_resource" "path_depth_7" {
+  for_each = local.path_nodes_by_depth[7]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_6[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 8
+resource "aws_api_gateway_resource" "path_depth_8" {
+  for_each = local.path_nodes_by_depth[8]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_7[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 9
+resource "aws_api_gateway_resource" "path_depth_9" {
+  for_each = local.path_nodes_by_depth[9]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_8[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 10
+resource "aws_api_gateway_resource" "path_depth_10" {
+  for_each = local.path_nodes_by_depth[10]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_9[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 11
+resource "aws_api_gateway_resource" "path_depth_11" {
+  for_each = local.path_nodes_by_depth[11]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_10[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 12
+resource "aws_api_gateway_resource" "path_depth_12" {
+  for_each = local.path_nodes_by_depth[12]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_11[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 13
+resource "aws_api_gateway_resource" "path_depth_13" {
+  for_each = local.path_nodes_by_depth[13]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_12[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 14
+resource "aws_api_gateway_resource" "path_depth_14" {
+  for_each = local.path_nodes_by_depth[14]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_13[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 15
+resource "aws_api_gateway_resource" "path_depth_15" {
+  for_each = local.path_nodes_by_depth[15]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_14[each.value.parent].id
+  path_part   = each.value.part
+}
+
 # Resources
 
 # Create Lambda ZIP file from the bundle directory
@@ -2828,6 +4233,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -2857,9 +4267,33 @@ resource "aws_wafv2_web_acl_association" "api_waf_association" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-# Lambda function
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "test-api-lambda-"
+  description = "Security group for the TestApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  # One lambda function per operation, each serving just that operation
+  for_each = local.operations
+
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -2867,10 +4301,10 @@ resource "aws_lambda_function" "api_lambda" {
   s3_bucket         = aws_s3_object.lambda_zip.bucket
   s3_key            = aws_s3_object.lambda_zip.key
   s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "TestApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
+  function_name    = local.function_name[each.key]
+  role            = aws_iam_role.lambda_execution_role[each.key].arn
   handler         = "index.handler"
-  runtime         = "nodejs22.x"
+  runtime         = "nodejs24.x"
   timeout         = 30
   memory_size     = 128
 
@@ -2881,18 +4315,32 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "TestApiHandler-execution-role-\${random_string.suffix.result}"
+  for_each = local.operations
+
+  name = local.role_name[each.key]
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -2912,90 +4360,132 @@ resource "aws_iam_role" "lambda_execution_role" {
 
 # Attach basic execution policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
+  for_each = local.operations
+
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
+  role       = aws_iam_role.lambda_execution_role[each.key].name
 }
 
 # Attach X-Ray tracing policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
+  for_each = local.operations
+
   policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
+  role       = aws_iam_role.lambda_execution_role[each.key].name
+}
+
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  for_each = var.enable_vpc ? local.operations : {}
+
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role[each.key].name
 }
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "TestApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
+  for_each = local.operations
+
+  name = "\${substr(local.function_name[each.key], 0, 55)}-policies"
+  role = aws_iam_role.lambda_execution_role[each.key].id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_document_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+
+  # IAM rejects an empty statement list, so fall back to a no-op deny
+  lambda_policy_document_statements = length(local.lambda_policy_statements) > 0 ? local.lambda_policy_statements : [
+    {
+      Effect   = "Deny"
+      Action   = ["appconfig:GetLatestConfiguration"]
+      Resource = ["arn:aws:appconfig:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:application/none"]
+    }
+  ]
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/TestApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
-}
+  for_each = local.operations
 
-
-
-# Create proxy resource (captures all paths)
-resource "aws_api_gateway_resource" "proxy_resource" {
-  rest_api_id = module.rest_api.api_id
-  parent_id   = module.rest_api.api_root_resource_id
-  path_part   = "{proxy+}"
+  name = "/aws/lambda/\${local.function_name[each.key]}"
+  tags = var.tags
 }
 
-# Lambda integration for REST API
-resource "aws_api_gateway_integration" "lambda_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.proxy_method.http_method
 
-  integration_http_method = "POST"
-  type                    = "AWS_PROXY"
-  uri                     = aws_lambda_function.api_lambda.invoke_arn
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
 
-# Method for proxy integration
-resource "aws_api_gateway_method" "proxy_method" {
+# Method per operation
+resource "aws_api_gateway_method" "operation_methods" {
   #checkov:skip=CKV2_AWS_53:Request validation not required for proxy integration as Lambda handles validation
+  for_each = local.operations
+
   rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "ANY"
+  resource_id   = local.operation_resource_id[each.key]
+  http_method   = upper(each.value.method)
 
   authorization = "AWS_IAM"
 
+  # Path parameters must be declared on the method
   request_parameters = {
-    "method.request.path.proxy" = true
+    for segment in local.operation_segments[each.key] :
+    "method.request.path.\${trimsuffix(trimprefix(segment, "{"), "}")}" => true
+    if startswith(segment, "{")
   }
 
   depends_on = []
 }
 
-# OPTIONS method for CORS preflight
+# Lambda integration per operation
+resource "aws_api_gateway_integration" "lambda_integration" {
+  for_each = local.operations
+
+  rest_api_id = module.rest_api.api_id
+  resource_id = local.operation_resource_id[each.key]
+  http_method = aws_api_gateway_method.operation_methods[each.key].http_method
+
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  uri                     = aws_lambda_function.api_lambda[each.key].invoke_arn
+
+  depends_on = [aws_lambda_function.api_lambda]
+}
+
+# OPTIONS method for CORS preflight, on every resource an operation is served from
 resource "aws_api_gateway_method" "options_method" {
   #checkov:skip=CKV2_AWS_70:OPTIONS method must be unauthenticated for CORS preflight requests
   #checkov:skip=CKV2_AWS_53:Request validation not required for OPTIONS CORS preflight method
+  for_each = local.resource_ids
+
   rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
+  resource_id   = each.value
   http_method   = "OPTIONS"
   authorization = "NONE"
 }
 
-# CORS integration for OPTIONS method
+# CORS integration for OPTIONS methods
 resource "aws_api_gateway_integration" "options_integration" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
 
   type = "MOCK"
   request_templates = {
@@ -3003,11 +4493,13 @@ resource "aws_api_gateway_integration" "options_integration" {
   }
 }
 
-# OPTIONS method response
+# OPTIONS method responses
 resource "aws_api_gateway_method_response" "options_response" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
   status_code = "204"
 
   response_parameters = {
@@ -3017,18 +4509,22 @@ resource "aws_api_gateway_method_response" "options_response" {
   }
 }
 
-# OPTIONS integration response
+# OPTIONS integration responses
 resource "aws_api_gateway_integration_response" "options_integration_response" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = aws_api_gateway_method_response.options_response.status_code
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
+  status_code = aws_api_gateway_method_response.options_response[each.key].status_code
 
   response_parameters = {
     "method.response.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
     "method.response.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
     "method.response.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
   }
+
+  depends_on = [aws_api_gateway_integration.options_integration]
 }
 
 # API Gateway deployment
@@ -3036,13 +4532,28 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   rest_api_id = module.rest_api.api_id
 
   triggers = {
-    redeployment = sha1(jsonencode([
-      aws_api_gateway_resource.proxy_resource.id,
-      aws_api_gateway_method.proxy_method.id,
-      aws_api_gateway_integration.lambda_integration.id,
-      aws_api_gateway_method.options_method.id,
-      aws_api_gateway_integration.options_integration.id,
-    ]))
+    redeployment = sha1(jsonencode(concat(
+      [for r in aws_api_gateway_resource.path_depth_0 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_1 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_2 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_3 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_4 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_5 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_6 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_7 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_8 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_9 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_10 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_11 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_12 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_13 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_14 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_15 : r.id],
+      [for m in aws_api_gateway_method.operation_methods : m.id],
+      [for i in aws_api_gateway_integration.lambda_integration : i.id],
+      [for m in aws_api_gateway_method.options_method : m.id],
+      [for i in aws_api_gateway_integration.options_integration : i.id],
+    )))
   }
 
   lifecycle {
@@ -3050,7 +4561,7 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   }
 
   depends_on = [
-    aws_api_gateway_method.proxy_method,
+    aws_api_gateway_method.operation_methods,
     aws_api_gateway_integration.lambda_integration,
     aws_api_gateway_method.options_method,
     aws_api_gateway_integration.options_integration,
@@ -3059,11 +4570,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "TestApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/test-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/test-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -3071,9 +4634,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -3107,11 +4700,13 @@ resource "aws_api_gateway_rest_api_policy" "api_policy" {
 
 # Lambda permission for API Gateway to invoke the function
 resource "aws_lambda_permission" "api_gateway_invoke" {
+  for_each = local.operations
+
   statement_id  = "AllowExecutionFromAPIGateway"
   action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
+  function_name = aws_lambda_function.api_lambda[each.key].function_name
   principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
+  source_arn    = "\${module.rest_api.api_execution_arn}/*/\${local.permission_source_suffix[each.key]}"
 
   depends_on = [module.rest_api, aws_lambda_function.api_lambda]
 }
@@ -3123,7 +4718,7 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "TestApi" = aws_api_gateway_stage.api_stage.invoke_url }
+  value     = { "TestApi" = "\${aws_api_gateway_stage.api_stage.invoke_url}/" }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }
@@ -3176,78 +4771,83 @@ output "stage_id" {
   value       = aws_api_gateway_stage.api_stage.id
 }
 
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
+# Lambda Function Outputs, keyed by operation name
+output "operations" {
+  description = "Names of the API operations, each with its own Lambda function"
+  value       = keys(local.operations)
 }
 
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
+output "lambda_function_names" {
+  description = "Name of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.function_name }
 }
 
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
+output "lambda_function_arns" {
+  description = "ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.arn }
 }
 
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
+output "lambda_invoke_arns" {
+  description = "Invoke ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.invoke_arn }
 }
 
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
+output "lambda_qualified_arns" {
+  description = "Qualified ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.qualified_arn }
+}
+
+output "lambda_versions" {
+  description = "Version of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.version }
 }
 
 output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
+  description = "Base64-encoded SHA256 hash of the Lambda deployment package, shared by every operation"
+  value       = data.archive_file.lambda_zip.output_base64sha256
 }
 
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
+# IAM Role Outputs, keyed by operation name
+output "lambda_execution_role_arns" {
+  description = "ARN of each operation's Lambda execution role, keyed by operation name"
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.arn }
 }
 
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
+output "lambda_execution_role_names" {
+  description = "Name of each operation's Lambda execution role, keyed by operation name. Attach additional policies to a specific operation's role by name."
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.name }
 }
 
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
+output "security_group_id" {
+  description = "Security group ID shared by the API Lambda functions, for use in ingress rules on resources they must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
 }
 
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_api_gateway_integration.lambda_integration.id
+# Integration Outputs, keyed by operation name
+output "integration_ids" {
+  description = "ID of each operation's Lambda integration, keyed by operation name"
+  value       = { for op, i in aws_api_gateway_integration.lambda_integration : op => i.id }
 }
 
-output "proxy_resource_id" {
-  description = "ID of the proxy resource"
-  value       = aws_api_gateway_resource.proxy_resource.id
+output "method_ids" {
+  description = "ID of each operation's API Gateway method, keyed by operation name"
+  value       = { for op, m in aws_api_gateway_method.operation_methods : op => m.id }
 }
 
-output "proxy_method_id" {
-  description = "ID of the proxy method"
-  value       = aws_api_gateway_method.proxy_method.id
+output "resource_ids" {
+  description = "ID of each API Gateway resource, keyed by its path"
+  value       = local.resource_ids
 }
 
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
+# CloudWatch Log Groups, keyed by operation name
+output "lambda_log_group_names" {
+  description = "Name of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.name }
 }
 
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
+output "lambda_log_group_arns" {
+  description = "ARN of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.arn }
 }
 ",
 }
@@ -3258,9 +4858,17 @@ exports[`tsSmithyApiGenerator > terraform iac > should generate terraform with c
   required_version = ">= 1.0"
 
   required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
     }
   }
 }
@@ -3282,11 +4890,47 @@ variable "additional_iam_policy_statements" {
   default = []
 }
 
+variable "appconfig_application_id" {
+  description = "ID of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_id\`). When set, the Lambda functions receive \`RUNTIME_CONFIG_APP_ID\` and read access to the application."
+  type        = string
+  default     = null
+}
+
+variable "appconfig_application_arn" {
+  description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the Lambda functions."
+  type        = string
+  default     = null
+}
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
 }
 
+# VPC Configuration (optional)
+variable "enable_vpc" {
+  description = "Deploy the Lambda function into a VPC. Set alongside vpc_id/subnet_ids."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = !var.enable_vpc || (var.vpc_id != null && var.subnet_ids != null)
+    error_message = "vpc_id and subnet_ids must be set when enable_vpc is true."
+  }
+}
+
+variable "subnet_ids" {
+  description = "Subnet IDs to deploy the Lambda function into. Required when enable_vpc is true."
+  type        = list(string)
+  default     = null
+}
+
 # CORS Configuration (passed to core module)
 
 variable "cors_allow_headers" {
@@ -3331,6 +4975,235 @@ resource "random_string" "suffix" {
   upper   = false
 }
 
+locals {
+  # Generated at build time from the API definition
+  operations_file = "\${path.module}/../../../generated/custom-api/operations.json"
+  operations      = fileexists(local.operations_file) ? jsondecode(file(local.operations_file)) : {}
+
+  operation_slug = { for op in keys(local.operations) : op => replace(op, "/[^a-zA-Z0-9-_]/", "-") }
+  operation_hash = { for op in keys(local.operations) : op => substr(sha256(op), 0, 8) }
+
+  function_name = { for op in keys(local.operations) : op =>
+    "\${substr("CustomApi-\${local.operation_slug[op]}", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-\${local.operation_hash[op]}-\${random_string.suffix.result}"
+  }
+  role_name = { for op in keys(local.operations) : op =>
+    "\${substr("CustomApi-\${local.operation_slug[op]}-role", 0, 64 - length(local.operation_hash[op]) - length(random_string.suffix.result) - 2)}-\${local.operation_hash[op]}-\${random_string.suffix.result}"
+  }
+
+  # A REST API needs a resource per path segment, so each operation's path is
+  # split into the distinct path prefixes the resource tree is built from below
+  operation_segments = { for op, details in local.operations : op => compact(split("/", details.path)) }
+
+  path_nodes = merge([
+    for op, segments in local.operation_segments : {
+      for i, segment in segments : join("/", slice(segments, 0, i + 1)) => {
+        depth  = i
+        parent = i == 0 ? "" : join("/", slice(segments, 0, i))
+        part   = segment
+      }
+    }
+  ]...)
+
+  # Instances of a resource cannot reference one another, so each depth is a
+  # separate resource. Deeper paths are reported by the precondition below.
+  max_path_depth = 16
+  path_nodes_by_depth = { for depth in range(local.max_path_depth) : depth => {
+    for path, node in local.path_nodes : path => node if node.depth == depth
+  } }
+  paths_too_deep = [for path, node in local.path_nodes : path if node.depth >= local.max_path_depth]
+
+  resource_ids = merge(
+    { for path, resource in aws_api_gateway_resource.path_depth_0 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_1 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_2 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_3 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_4 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_5 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_6 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_7 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_8 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_9 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_10 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_11 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_12 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_13 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_14 : path => resource.id },
+    { for path, resource in aws_api_gateway_resource.path_depth_15 : path => resource.id },
+  )
+
+  operation_resource_id = { for op, segments in local.operation_segments : op =>
+    local.resource_ids[join("/", segments)]
+  }
+
+  permission_source_suffix = { for op, details in local.operations : op =>
+    "\${upper(details.method)}/\${replace(join("/", local.operation_segments[op]), "/{[^}]*}/", "*")}"
+  }
+}
+
+resource "terraform_data" "operations_metadata" {
+  # Fails the plan when the operations metadata has not been generated
+  input = local.operations_file
+
+  lifecycle {
+    precondition {
+      condition     = fileexists(local.operations_file)
+      error_message = "Operations metadata not found at \${local.operations_file}. Build the CustomApi project to generate it."
+    }
+    precondition {
+      condition     = length(local.operations) > 0
+      error_message = "No operations found in \${local.operations_file}. The CustomApi API must define at least one operation."
+    }
+    precondition {
+      condition     = length(local.paths_too_deep) == 0
+      error_message = "Operation paths exceed the supported depth of \${local.max_path_depth} segments: \${join(", ", local.paths_too_deep)}. Add further aws_api_gateway_resource levels to this module to support them."
+    }
+  }
+}
+
+# API Gateway resources at path depth 0
+resource "aws_api_gateway_resource" "path_depth_0" {
+  for_each = local.path_nodes_by_depth[0]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = module.rest_api.api_root_resource_id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 1
+resource "aws_api_gateway_resource" "path_depth_1" {
+  for_each = local.path_nodes_by_depth[1]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_0[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 2
+resource "aws_api_gateway_resource" "path_depth_2" {
+  for_each = local.path_nodes_by_depth[2]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_1[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 3
+resource "aws_api_gateway_resource" "path_depth_3" {
+  for_each = local.path_nodes_by_depth[3]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_2[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 4
+resource "aws_api_gateway_resource" "path_depth_4" {
+  for_each = local.path_nodes_by_depth[4]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_3[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 5
+resource "aws_api_gateway_resource" "path_depth_5" {
+  for_each = local.path_nodes_by_depth[5]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_4[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 6
+resource "aws_api_gateway_resource" "path_depth_6" {
+  for_each = local.path_nodes_by_depth[6]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_5[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 7
+resource "aws_api_gateway_resource" "path_depth_7" {
+  for_each = local.path_nodes_by_depth[7]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_6[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 8
+resource "aws_api_gateway_resource" "path_depth_8" {
+  for_each = local.path_nodes_by_depth[8]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_7[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 9
+resource "aws_api_gateway_resource" "path_depth_9" {
+  for_each = local.path_nodes_by_depth[9]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_8[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 10
+resource "aws_api_gateway_resource" "path_depth_10" {
+  for_each = local.path_nodes_by_depth[10]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_9[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 11
+resource "aws_api_gateway_resource" "path_depth_11" {
+  for_each = local.path_nodes_by_depth[11]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_10[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 12
+resource "aws_api_gateway_resource" "path_depth_12" {
+  for_each = local.path_nodes_by_depth[12]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_11[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 13
+resource "aws_api_gateway_resource" "path_depth_13" {
+  for_each = local.path_nodes_by_depth[13]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_12[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 14
+resource "aws_api_gateway_resource" "path_depth_14" {
+  for_each = local.path_nodes_by_depth[14]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_13[each.value.parent].id
+  path_part   = each.value.part
+}
+
+# API Gateway resources at path depth 15
+resource "aws_api_gateway_resource" "path_depth_15" {
+  for_each = local.path_nodes_by_depth[15]
+
+  rest_api_id = module.rest_api.api_id
+  parent_id   = aws_api_gateway_resource.path_depth_14[each.value.parent].id
+  path_part   = each.value.part
+}
+
 # Resources
 
 # Create Lambda ZIP file from the bundle directory
@@ -3349,6 +5222,11 @@ resource "aws_s3_object" "lambda_zip" {
 }
 
 # Use the core REST API module
+# Account-level CloudWatch role required for REST API access logging
+module "account" {
+  source = "../../../core/api/api-gateway-account"
+}
+
 module "rest_api" {
   source = "../../../core/api/rest-api"
 
@@ -3378,9 +5256,33 @@ resource "aws_wafv2_web_acl_association" "api_waf_association" {
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
-# Lambda function
+# Security group for the API Lambda function, used when deployed into a VPC
+resource "aws_security_group" "api_lambda" {
+  count = var.enable_vpc ? 1 : 0
+
+  #checkov:skip=CKV2_AWS_5:Attached to api_lambda via vpc_config block; Checkov cannot resolve this reference
+  name_prefix = "custom-api-lambda-"
+  description = "Security group for the CustomApi API Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "api_lambda_https" {
+  count = var.enable_vpc ? 1 : 0
+
+  security_group_id = aws_security_group.api_lambda[0].id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
 resource "aws_lambda_function" "api_lambda" {
-  #checkov:skip=CKV_AWS_117:Lambda function does not need to be in VPC for this use case
+  # One lambda function per operation, each serving just that operation
+  for_each = local.operations
+
+  #checkov:skip=CKV_AWS_117:Lambda function is optionally deployed into a VPC via vpc_id/subnet_ids; not required for this use case
   #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this simple API use case
   #checkov:skip=CKV_AWS_272:Code signing not required for this use case
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
@@ -3388,10 +5290,10 @@ resource "aws_lambda_function" "api_lambda" {
   s3_bucket         = aws_s3_object.lambda_zip.bucket
   s3_key            = aws_s3_object.lambda_zip.key
   s3_object_version = aws_s3_object.lambda_zip.version_id
-  function_name    = "CustomApiHandler-\${random_string.suffix.result}"
-  role            = aws_iam_role.lambda_execution_role.arn
+  function_name    = local.function_name[each.key]
+  role            = aws_iam_role.lambda_execution_role[each.key].arn
   handler         = "index.handler"
-  runtime         = "nodejs22.x"
+  runtime         = "nodejs24.x"
   timeout         = 30
   memory_size     = 128
 
@@ -3402,18 +5304,32 @@ resource "aws_lambda_function" "api_lambda" {
     mode = "Active"
   }
 
+  dynamic "vpc_config" {
+    for_each = var.enable_vpc ? [1] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = [aws_security_group.api_lambda[0].id]
+    }
+  }
+
 
   environment {
     variables = merge({
-    }, var.env)
+    }, var.appconfig_application_id != null ? {
+      RUNTIME_CONFIG_APP_ID = var.appconfig_application_id
+    } : {}, var.env)
   }
 
   tags = var.tags
+
+  depends_on = [aws_iam_role_policy_attachment.lambda_vpc_access]
 }
 
 # IAM role for Lambda execution
 resource "aws_iam_role" "lambda_execution_role" {
-  name = "CustomApiHandler-execution-role-\${random_string.suffix.result}"
+  for_each = local.operations
+
+  name = local.role_name[each.key]
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -3433,35 +5349,73 @@ resource "aws_iam_role" "lambda_execution_role" {
 
 # Attach basic execution policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
+  for_each = local.operations
+
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-  role       = aws_iam_role.lambda_execution_role.name
+  role       = aws_iam_role.lambda_execution_role[each.key].name
 }
 
 # Attach X-Ray tracing policy to Lambda role
 resource "aws_iam_role_policy_attachment" "lambda_xray_execution" {
+  for_each = local.operations
+
   policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
-  role       = aws_iam_role.lambda_execution_role.name
+  role       = aws_iam_role.lambda_execution_role[each.key].name
+}
+
+# Attach VPC access policy to Lambda role when deployed into a VPC
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  for_each = var.enable_vpc ? local.operations : {}
+
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+  role       = aws_iam_role.lambda_execution_role[each.key].name
 }
 
 # Additional IAM policies for Lambda (if provided)
 resource "aws_iam_role_policy" "lambda_additional_policies" {
-  count = length(var.additional_iam_policy_statements) > 0 ? 1 : 0
-  name  = "CustomApiHandler-additional-policies-\${random_string.suffix.result}"
-  role  = aws_iam_role.lambda_execution_role.id
+  for_each = local.operations
+
+  name = "\${substr(local.function_name[each.key], 0, 55)}-policies"
+  role = aws_iam_role.lambda_execution_role[each.key].id
 
   policy = jsonencode({
     Version = "2012-10-17"
-    Statement = var.additional_iam_policy_statements
+    Statement = local.lambda_policy_document_statements
   })
 }
 
+locals {
+  # Grant read access to the runtime-config AppConfig application when wired
+  lambda_policy_statements = concat(var.appconfig_application_arn != null ? [
+    {
+      Effect = "Allow"
+      Action = [
+        "appconfig:StartConfigurationSession",
+        "appconfig:GetLatestConfiguration"
+      ]
+      Resource = ["\${var.appconfig_application_arn}/*"]
+    }
+  ] : [], var.additional_iam_policy_statements)
+
+  # IAM rejects an empty statement list, so fall back to a no-op deny
+  lambda_policy_document_statements = length(local.lambda_policy_statements) > 0 ? local.lambda_policy_statements : [
+    {
+      Effect   = "Deny"
+      Action   = ["appconfig:GetLatestConfiguration"]
+      Resource = ["arn:aws:appconfig:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:application/none"]
+    }
+  ]
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
   #checkov:skip=CKV_AWS_338:Log retention set to forever
   #checkov:skip=CKV_AWS_66:Log retention set to forever
-  name              = "/aws/lambda/CustomApiHandler-\${random_string.suffix.result}"
-  tags              = var.tags
+  for_each = local.operations
+
+  name = "/aws/lambda/\${local.function_name[each.key]}"
+  tags = var.tags
 }
 
 
@@ -3478,7 +5432,7 @@ resource "aws_lambda_function" "authorizer_lambda" {
   function_name    = "CustomApiAuthorizer-\${random_string.suffix.result}"
   role            = aws_iam_role.authorizer_execution_role.arn
   handler         = "index.handler"
-  runtime         = "nodejs22.x"
+  runtime         = "nodejs24.x"
   timeout         = 10
   memory_size     = 128
 
@@ -3558,58 +5512,62 @@ resource "aws_lambda_permission" "authorizer_invoke" {
   source_arn    = "\${module.rest_api.api_execution_arn}/authorizers/\${aws_api_gateway_authorizer.custom_authorizer.id}"
 }
 
-# Create proxy resource (captures all paths)
-resource "aws_api_gateway_resource" "proxy_resource" {
-  rest_api_id = module.rest_api.api_id
-  parent_id   = module.rest_api.api_root_resource_id
-  path_part   = "{proxy+}"
-}
-
-# Lambda integration for REST API
-resource "aws_api_gateway_integration" "lambda_integration" {
-  rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.proxy_method.http_method
-
-  integration_http_method = "POST"
-  type                    = "AWS_PROXY"
-  uri                     = aws_lambda_function.api_lambda.invoke_arn
-
-  depends_on = [aws_lambda_function.api_lambda]
-}
-
-# Method for proxy integration
-resource "aws_api_gateway_method" "proxy_method" {
+# Method per operation
+resource "aws_api_gateway_method" "operation_methods" {
   #checkov:skip=CKV2_AWS_53:Request validation not required for proxy integration as Lambda handles validation
+  for_each = local.operations
+
   rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
-  http_method   = "ANY"
+  resource_id   = local.operation_resource_id[each.key]
+  http_method   = upper(each.value.method)
 
   authorization = "CUSTOM"
   authorizer_id = aws_api_gateway_authorizer.custom_authorizer.id
 
+  # Path parameters must be declared on the method
   request_parameters = {
-    "method.request.path.proxy" = true
+    for segment in local.operation_segments[each.key] :
+    "method.request.path.\${trimsuffix(trimprefix(segment, "{"), "}")}" => true
+    if startswith(segment, "{")
   }
 
   depends_on = [aws_api_gateway_authorizer.custom_authorizer]
 }
 
-# OPTIONS method for CORS preflight
+# Lambda integration per operation
+resource "aws_api_gateway_integration" "lambda_integration" {
+  for_each = local.operations
+
+  rest_api_id = module.rest_api.api_id
+  resource_id = local.operation_resource_id[each.key]
+  http_method = aws_api_gateway_method.operation_methods[each.key].http_method
+
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  uri                     = aws_lambda_function.api_lambda[each.key].invoke_arn
+
+  depends_on = [aws_lambda_function.api_lambda]
+}
+
+# OPTIONS method for CORS preflight, on every resource an operation is served from
 resource "aws_api_gateway_method" "options_method" {
   #checkov:skip=CKV2_AWS_70:OPTIONS method must be unauthenticated for CORS preflight requests
   #checkov:skip=CKV2_AWS_53:Request validation not required for OPTIONS CORS preflight method
+  for_each = local.resource_ids
+
   rest_api_id   = module.rest_api.api_id
-  resource_id   = aws_api_gateway_resource.proxy_resource.id
+  resource_id   = each.value
   http_method   = "OPTIONS"
   authorization = "NONE"
 }
 
-# CORS integration for OPTIONS method
+# CORS integration for OPTIONS methods
 resource "aws_api_gateway_integration" "options_integration" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
 
   type = "MOCK"
   request_templates = {
@@ -3617,11 +5575,13 @@ resource "aws_api_gateway_integration" "options_integration" {
   }
 }
 
-# OPTIONS method response
+# OPTIONS method responses
 resource "aws_api_gateway_method_response" "options_response" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
   status_code = "204"
 
   response_parameters = {
@@ -3631,18 +5591,22 @@ resource "aws_api_gateway_method_response" "options_response" {
   }
 }
 
-# OPTIONS integration response
+# OPTIONS integration responses
 resource "aws_api_gateway_integration_response" "options_integration_response" {
+  for_each = local.resource_ids
+
   rest_api_id = module.rest_api.api_id
-  resource_id = aws_api_gateway_resource.proxy_resource.id
-  http_method = aws_api_gateway_method.options_method.http_method
-  status_code = aws_api_gateway_method_response.options_response.status_code
+  resource_id = each.value
+  http_method = aws_api_gateway_method.options_method[each.key].http_method
+  status_code = aws_api_gateway_method_response.options_response[each.key].status_code
 
   response_parameters = {
     "method.response.header.Access-Control-Allow-Headers" = "'\${join(",", var.cors_allow_headers)}'"
     "method.response.header.Access-Control-Allow-Methods" = "'\${join(",", var.cors_allow_methods)}'"
     "method.response.header.Access-Control-Allow-Origin"  = "'\${join(",", var.cors_allow_origins)}'"
   }
+
+  depends_on = [aws_api_gateway_integration.options_integration]
 }
 
 # API Gateway deployment
@@ -3650,13 +5614,28 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   rest_api_id = module.rest_api.api_id
 
   triggers = {
-    redeployment = sha1(jsonencode([
-      aws_api_gateway_resource.proxy_resource.id,
-      aws_api_gateway_method.proxy_method.id,
-      aws_api_gateway_integration.lambda_integration.id,
-      aws_api_gateway_method.options_method.id,
-      aws_api_gateway_integration.options_integration.id,
-    ]))
+    redeployment = sha1(jsonencode(concat(
+      [for r in aws_api_gateway_resource.path_depth_0 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_1 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_2 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_3 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_4 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_5 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_6 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_7 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_8 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_9 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_10 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_11 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_12 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_13 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_14 : r.id],
+      [for r in aws_api_gateway_resource.path_depth_15 : r.id],
+      [for m in aws_api_gateway_method.operation_methods : m.id],
+      [for i in aws_api_gateway_integration.lambda_integration : i.id],
+      [for m in aws_api_gateway_method.options_method : m.id],
+      [for i in aws_api_gateway_integration.options_integration : i.id],
+    )))
   }
 
   lifecycle {
@@ -3664,7 +5643,7 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   }
 
   depends_on = [
-    aws_api_gateway_method.proxy_method,
+    aws_api_gateway_method.operation_methods,
     aws_api_gateway_integration.lambda_integration,
     aws_api_gateway_method.options_method,
     aws_api_gateway_integration.options_integration,
@@ -3674,11 +5653,63 @@ resource "aws_api_gateway_deployment" "api_deployment" {
   ]
 }
 
+# KMS key for encrypting access logs at rest
+resource "aws_kms_key" "access_logs" {
+  description             = "CustomApi API access log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/custom-api-\${random_string.suffix.result}/access"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "access_logs" {
+  name          = "alias/custom-api-\${random_string.suffix.result}-access-logs"
+  target_key_id = aws_kms_key.access_logs.key_id
+}
+
+# Access logs for the API Gateway stage
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/apigateway/custom-api-\${random_string.suffix.result}/access"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.access_logs.arn
+  tags              = var.tags
+}
+
 # API Gateway stage
 resource "aws_api_gateway_stage" "api_stage" {
   #checkov:skip=CKV_AWS_120:API Gateway caching not required for this use case
-  #checkov:skip=CKV_AWS_76:API Gateway access logging disabled due to account-level CloudWatch Logs role ARN requirement
-  #checkov:skip=CKV2_AWS_4:API Gateway logging level not applicable as access logging is disabled
+  #checkov:skip=CKV2_AWS_4:Access logging is enabled below; verbose execution logging is intentionally not enabled
   #checkov:skip=CKV2_AWS_51:Client certificate authentication not required for this use case
   #checkov:skip=CKV2_AWS_77:WAFv2 Web ACL is attached via aws_wafv2_web_acl_association when var.enable_waf is true (default) and includes AWSManagedRulesKnownBadInputsRuleSet for Log4j protection; Checkov does not track the association across modules
   deployment_id        = aws_api_gateway_deployment.api_deployment.id
@@ -3686,9 +5717,39 @@ resource "aws_api_gateway_stage" "api_stage" {
   stage_name           = "prod"
   xray_tracing_enabled = true
 
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      caller         = "$context.identity.caller"
+      user           = "$context.identity.user"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      protocol       = "$context.protocol"
+      responseLength = "$context.responseLength"
+    })
+  }
+
   tags = var.tags
 
-  depends_on = [aws_api_gateway_deployment.api_deployment]
+  # Ensure the account-level role is configured before the stage is created
+  depends_on = [aws_api_gateway_deployment.api_deployment, module.account]
+}
+
+# Default throttling applied to all resource paths and methods
+resource "aws_api_gateway_method_settings" "throttling" {
+  #checkov:skip=CKV_AWS_225:API Gateway caching not required for this use case
+  rest_api_id = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  method_path = "*/*"
+
+  settings {
+    throttling_rate_limit  = 10000
+    throttling_burst_limit = 5000
+  }
 }
 
 # API Gateway Resource Policy
@@ -3711,11 +5772,13 @@ resource "aws_api_gateway_rest_api_policy" "api_policy" {
 
 # Lambda permission for API Gateway to invoke the function
 resource "aws_lambda_permission" "api_gateway_invoke" {
+  for_each = local.operations
+
   statement_id  = "AllowExecutionFromAPIGateway"
   action        = "lambda:InvokeFunction"
-  function_name = aws_lambda_function.api_lambda.function_name
+  function_name = aws_lambda_function.api_lambda[each.key].function_name
   principal     = "apigateway.amazonaws.com"
-  source_arn    = "\${module.rest_api.api_execution_arn}/*/*"
+  source_arn    = "\${module.rest_api.api_execution_arn}/*/\${local.permission_source_suffix[each.key]}"
 
   depends_on = [module.rest_api, aws_lambda_function.api_lambda]
 }
@@ -3727,7 +5790,7 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "CustomApi" = aws_api_gateway_stage.api_stage.invoke_url }
+  value     = { "CustomApi" = "\${aws_api_gateway_stage.api_stage.invoke_url}/" }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }
@@ -3780,78 +5843,83 @@ output "stage_id" {
   value       = aws_api_gateway_stage.api_stage.id
 }
 
-# Lambda Function Outputs
-output "lambda_function_name" {
-  description = "Name of the Lambda function"
-  value       = aws_lambda_function.api_lambda.function_name
+# Lambda Function Outputs, keyed by operation name
+output "operations" {
+  description = "Names of the API operations, each with its own Lambda function"
+  value       = keys(local.operations)
+}
+
+output "lambda_function_names" {
+  description = "Name of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.function_name }
 }
 
-output "lambda_function_arn" {
-  description = "ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.arn
+output "lambda_function_arns" {
+  description = "ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.arn }
 }
 
-output "lambda_invoke_arn" {
-  description = "Invoke ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.invoke_arn
+output "lambda_invoke_arns" {
+  description = "Invoke ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.invoke_arn }
 }
 
-output "lambda_qualified_arn" {
-  description = "Qualified ARN of the Lambda function"
-  value       = aws_lambda_function.api_lambda.qualified_arn
+output "lambda_qualified_arns" {
+  description = "Qualified ARN of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.qualified_arn }
 }
 
-output "lambda_version" {
-  description = "Version of the Lambda function"
-  value       = aws_lambda_function.api_lambda.version
+output "lambda_versions" {
+  description = "Version of each operation's Lambda function, keyed by operation name"
+  value       = { for op, fn in aws_lambda_function.api_lambda : op => fn.version }
 }
 
 output "lambda_source_code_hash" {
-  description = "Base64-encoded SHA256 hash of the Lambda deployment package"
-  value       = aws_lambda_function.api_lambda.source_code_hash
+  description = "Base64-encoded SHA256 hash of the Lambda deployment package, shared by every operation"
+  value       = data.archive_file.lambda_zip.output_base64sha256
 }
 
-output "lambda_source_code_size" {
-  description = "Size of the Lambda deployment package in bytes"
-  value       = aws_lambda_function.api_lambda.source_code_size
+# IAM Role Outputs, keyed by operation name
+output "lambda_execution_role_arns" {
+  description = "ARN of each operation's Lambda execution role, keyed by operation name"
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.arn }
 }
 
-# IAM Role Outputs
-output "lambda_execution_role_arn" {
-  description = "ARN of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.arn
+output "lambda_execution_role_names" {
+  description = "Name of each operation's Lambda execution role, keyed by operation name. Attach additional policies to a specific operation's role by name."
+  value       = { for op, role in aws_iam_role.lambda_execution_role : op => role.name }
 }
 
-output "lambda_execution_role_name" {
-  description = "Name of the Lambda execution role"
-  value       = aws_iam_role.lambda_execution_role.name
+output "security_group_id" {
+  description = "Security group ID shared by the API Lambda functions, for use in ingress rules on resources they must reach (e.g. a database). Null unless enable_vpc is true."
+  value       = var.enable_vpc ? aws_security_group.api_lambda[0].id : null
 }
 
-# Integration Outputs
-output "integration_id" {
-  description = "ID of the Lambda integration"
-  value       = aws_api_gateway_integration.lambda_integration.id
+# Integration Outputs, keyed by operation name
+output "integration_ids" {
+  description = "ID of each operation's Lambda integration, keyed by operation name"
+  value       = { for op, i in aws_api_gateway_integration.lambda_integration : op => i.id }
 }
 
-output "proxy_resource_id" {
-  description = "ID of the proxy resource"
-  value       = aws_api_gateway_resource.proxy_resource.id
+output "method_ids" {
+  description = "ID of each operation's API Gateway method, keyed by operation name"
+  value       = { for op, m in aws_api_gateway_method.operation_methods : op => m.id }
 }
 
-output "proxy_method_id" {
-  description = "ID of the proxy method"
-  value       = aws_api_gateway_method.proxy_method.id
+output "resource_ids" {
+  description = "ID of each API Gateway resource, keyed by its path"
+  value       = local.resource_ids
 }
 
-# CloudWatch Log Groups
-output "lambda_log_group_name" {
-  description = "Name of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.name
+# CloudWatch Log Groups, keyed by operation name
+output "lambda_log_group_names" {
+  description = "Name of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.name }
 }
 
-output "lambda_log_group_arn" {
-  description = "ARN of the Lambda CloudWatch log group"
-  value       = aws_cloudwatch_log_group.lambda_logs.arn
+output "lambda_log_group_arns" {
+  description = "ARN of each operation's Lambda CloudWatch log group, keyed by operation name"
+  value       = { for op, lg in aws_cloudwatch_log_group.lambda_logs : op => lg.arn }
 }
 "
 `;