@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/ts/dcr-proxy/__snapshots__/generator.spec.ts.snap

@@ -0,0 +1,986 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`ts#dcr-proxy generator > matches snapshot for generated construct and a handler > dcr-proxy-authorization-server-metadata-handler.ts 1`] = `
+"import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+const COGNITO_ISSUER = process.env.COGNITO_ISSUER!;
+
+let cached: Record<string, unknown> | undefined;
+
+async function fetchUpstream(): Promise<Record<string, unknown>> {
+  if (cached) return cached;
+  const res = await fetch(\`\${COGNITO_ISSUER}/.well-known/openid-configuration\`);
+  if (!res.ok) {
+    throw new Error(
+      \`Cognito discovery failed: \${res.status} \${res.statusText}\`,
+    );
+  }
+  cached = (await res.json()) as Record<string, unknown>;
+  return cached;
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const proxyUrl = \`https://\${event.requestContext.domainName}\`;
+  const upstream = await fetchUpstream();
+
+  // Override the proxy-handled endpoints.
+  // jwks_uri is kept as Cognito's so JWT verification works directly against
+  // Cognito. issuer is kept as Cognito's so JWT.iss validation matches.
+  // authorization_endpoint points to the proxy so we can strip the RFC 8707
+  // \`resource\` parameter that some MCP clients send (Cognito rejects token
+  // exchange for unregistered resource server URLs).
+  const metadata = {
+    ...upstream,
+    authorization_endpoint: \`\${proxyUrl}/authorize\`,
+    token_endpoint: \`\${proxyUrl}/oauth/token\`,
+    registration_endpoint: \`\${proxyUrl}/register\`,
+  };
+
+  return {
+    statusCode: 200,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(metadata),
+  };
+};
+"
+`;
+
+exports[`ts#dcr-proxy generator > matches snapshot for generated construct and a handler > dcr-proxy-authorize-handler.ts 1`] = `
+"import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+const COGNITO_HOSTED_UI_BASE = process.env.COGNITO_HOSTED_UI_BASE!;
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const params = new URLSearchParams(event.rawQueryString ?? '');
+
+  console.log('[authorize]', {
+    scope: params.get('scope'),
+    redirect_uri: params.get('redirect_uri'),
+    has_resource: params.has('resource'),
+  });
+
+  // RFC 8707 \`resource\` parameter binds the access token's \`aud\` claim to
+  // the given URL. Cognito accepts it at /authorize but rejects the token
+  // exchange with \`invalid_grant\` when the URL is not registered as a
+  // resource server. MCP clients send this unconditionally, so strip it.
+  params.delete('resource');
+
+  const target = \`\${COGNITO_HOSTED_UI_BASE}/oauth2/authorize?\${params.toString()}\`;
+  return {
+    statusCode: 302,
+    headers: { location: target },
+    body: '',
+  };
+};
+"
+`;
+
+exports[`ts#dcr-proxy generator > matches snapshot for generated construct and a handler > dcr-proxy-construct.ts 1`] = `
+"import * as url from 'node:url';
+import { Construct } from 'constructs';
+import { Duration, Stack } from 'aws-cdk-lib';
+import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
+import * as integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { HttpApi } from '../../../core/api/http-api.js';
+import {
+  HttpApiIntegration,
+  OperationDetails,
+} from '../../../core/api/utils.js';
+
+export interface SnapshotProxyProps {
+  /**
+   * Cognito User Pool id (e.g. \`us-east-1_abc123\`).
+   */
+  readonly userPoolId: string;
+
+  /**
+   * Cognito User Pool App Client id.
+   */
+  readonly userPoolClientId: string;
+
+  /**
+   * ARN of the Secrets Manager secret holding the Cognito App Client secret.
+   * The token handler reads this at runtime to complete the token exchange;
+   * the secret is never exposed to the client. Create the secret in your own
+   * stack (from your App Client's generated secret) and pass its ARN here.
+   */
+  readonly cognitoClientSecretArn: string;
+
+  /**
+   * Base URL of the Cognito Hosted UI domain, without a trailing slash
+   * (e.g. \`https://my-domain.auth.us-east-1.amazoncognito.com\`). The proxy
+   * forwards \`/authorize\` and \`/oauth/token\` to this host.
+   */
+  readonly cognitoHostedUiBase: string;
+
+  /**
+   * Full URL of the upstream MCP server (e.g. AgentCore Runtime/Gateway
+   * endpoint). The proxy forwards requests on its \`/mcp\` path to this URL and
+   * rewrites the upstream \`WWW-Authenticate\` header so MCP clients discover
+   * this proxy as the protected-resource metadata host.
+   */
+  readonly upstreamUrl: string;
+}
+
+// The proxy operations wired to the shared HttpApi construct. The
+// openid-configuration route reuses the authorization-server-metadata handler.
+type SnapshotProxyOperation =
+  | 'protectedResourceMetadata'
+  | 'authServerMetadata'
+  | 'openIdConfiguration'
+  | 'register'
+  | 'authorize'
+  | 'token'
+  | 'mcp';
+
+const OPERATIONS: Record<SnapshotProxyOperation, OperationDetails> = {
+  protectedResourceMetadata: {
+    path: '/.well-known/oauth-protected-resource',
+    method: 'GET',
+  },
+  authServerMetadata: {
+    path: '/.well-known/oauth-authorization-server',
+    method: 'GET',
+  },
+  openIdConfiguration: {
+    path: '/.well-known/openid-configuration',
+    method: 'GET',
+  },
+  register: { path: '/register', method: 'POST' },
+  authorize: { path: '/authorize', method: 'GET' },
+  token: { path: '/oauth/token', method: 'POST' },
+  mcp: { path: '/mcp', method: 'ANY' },
+};
+
+// Resolve a handler's rolldown bundle output directory, relative to this
+// compiled construct file, back to the workspace root.
+const asset = (bundlePathFromRoot: string): lambda.Code =>
+  lambda.Code.fromAsset(
+    url.fileURLToPath(
+      new URL(\`../../../../../../../\${bundlePathFromRoot}\`, import.meta.url),
+    ),
+  );
+
+/**
+ * OAuth Dynamic Client Registration (DCR) proxy for Amazon Cognito.
+ *
+ * Lets MCP clients (Claude Code, Kiro CLI, MCP Inspector, ...) authenticate
+ * against an Amazon Cognito User Pool while keeping the Hosted UI flow intact,
+ * supporting RFC 7591 Dynamic Client Registration, and never exposing the
+ * Cognito App Client secret to the client.
+ */
+export class SnapshotProxy extends Construct {
+  readonly httpApi: HttpApi<
+    SnapshotProxyOperation,
+    Record<SnapshotProxyOperation, HttpApiIntegration>
+  >;
+  readonly proxyUrl: string;
+  readonly mcpUrl: string;
+  readonly metadataUrl: string;
+  readonly authServerMetadataUrl: string;
+  readonly tokenEndpoint: string;
+  readonly registrationEndpoint: string;
+
+  constructor(scope: Construct, id: string, props: SnapshotProxyProps) {
+    super(scope, id);
+
+    const region = Stack.of(this).region;
+
+    const clientSecret = secretsmanager.Secret.fromSecretCompleteArn(
+      this,
+      'CognitoClientSecret',
+      props.cognitoClientSecretArn,
+    );
+
+    const cognitoIssuer = \`https://cognito-idp.\${region}.amazonaws.com/\${props.userPoolId}\`;
+
+    const baseEnv: Record<string, string> = {
+      COGNITO_CLIENT_ID: props.userPoolClientId,
+      COGNITO_CLIENT_SECRET_ARN: clientSecret.secretArn,
+      COGNITO_ISSUER: cognitoIssuer,
+      COGNITO_HOSTED_UI_BASE: props.cognitoHostedUiBase,
+      COGNITO_REGION: region,
+    };
+
+    // Lambda functions use their auto-created log group; access logging for the
+    // API is handled by the shared HttpApi construct's KMS-encrypted log group.
+    const makeFn = (
+      id_: string,
+      bundlePathFromRoot: string,
+      overrides?: Partial<lambda.FunctionProps>,
+    ): lambda.Function =>
+      new lambda.Function(this, id_, {
+        code: asset(bundlePathFromRoot),
+        handler: 'index.handler',
+        runtime: lambda.Runtime.NODEJS_24_X,
+        architecture: lambda.Architecture.ARM_64,
+        timeout: Duration.seconds(10),
+        memorySize: 256,
+        environment: baseEnv,
+        tracing: lambda.Tracing.ACTIVE,
+        ...overrides,
+      });
+
+    const protectedResourceFn = makeFn(
+      'ProtectedResourceFn',
+      'dist/snapshot-proxy/bundle/protected-resource-metadata',
+    );
+    const authServerFn = makeFn(
+      'AuthServerFn',
+      'dist/snapshot-proxy/bundle/authorization-server-metadata',
+    );
+    const registerFn = makeFn(
+      'RegisterFn',
+      'dist/snapshot-proxy/bundle/register',
+    );
+    const authorizeFn = makeFn(
+      'AuthorizeFn',
+      'dist/snapshot-proxy/bundle/authorize',
+    );
+    const tokenFn = makeFn('TokenFn', 'dist/snapshot-proxy/bundle/token');
+
+    clientSecret.grantRead(tokenFn);
+
+    // The MCP proxy Lambda buffers upstream responses, so it is given more time
+    // (up to the API Gateway HTTP API integration limit) and memory.
+    const mcpProxyFn = makeFn(
+      'McpProxyFn',
+      'dist/snapshot-proxy/bundle/mcp-proxy',
+      {
+        timeout: Duration.seconds(29),
+        memorySize: 512,
+      },
+    );
+
+    const int = (id_: string, fn: lambda.Function): HttpApiIntegration => ({
+      integration: new integrations.HttpLambdaIntegration(id_, fn),
+    });
+
+    this.httpApi = new HttpApi(this, 'HttpApi', {
+      apiName: \`\${id}-mcp-auth-proxy\`,
+      description: 'MCP-compatible OAuth proxy for Amazon Cognito',
+      corsPreflight: {
+        allowOrigins: ['*'],
+        allowMethods: [
+          apigwv2.CorsHttpMethod.GET,
+          apigwv2.CorsHttpMethod.POST,
+          apigwv2.CorsHttpMethod.DELETE,
+          apigwv2.CorsHttpMethod.OPTIONS,
+        ],
+        allowHeaders: ['authorization', 'content-type', 'mcp-protocol-version'],
+        maxAge: Duration.minutes(10),
+      },
+      operations: OPERATIONS,
+      integrations: {
+        protectedResourceMetadata: int(
+          'ProtectedResourceInt',
+          protectedResourceFn,
+        ),
+        authServerMetadata: int('AuthServerInt', authServerFn),
+        openIdConfiguration: int('OpenIdConfigInt', authServerFn),
+        register: int('RegisterInt', registerFn),
+        authorize: int('AuthorizeInt', authorizeFn),
+        token: int('TokenInt', tokenFn),
+        mcp: int('McpProxyInt', mcpProxyFn),
+      },
+    });
+
+    this.proxyUrl = this.httpApi.api.apiEndpoint;
+    this.mcpUrl = \`\${this.proxyUrl}/mcp\`;
+    this.metadataUrl = \`\${this.proxyUrl}/.well-known/oauth-protected-resource\`;
+    this.authServerMetadataUrl = \`\${this.proxyUrl}/.well-known/oauth-authorization-server\`;
+    this.tokenEndpoint = \`\${this.proxyUrl}/oauth/token\`;
+    this.registrationEndpoint = \`\${this.proxyUrl}/register\`;
+
+    // Wire the MCP proxy handler's upstream + metadata URLs after the API is
+    // created so its endpoint is resolvable.
+    mcpProxyFn.addEnvironment('UPSTREAM_URL', props.upstreamUrl);
+    mcpProxyFn.addEnvironment('PROXY_METADATA_URL', this.metadataUrl);
+  }
+}
+"
+`;
+
+exports[`ts#dcr-proxy generator > matches snapshot for generated construct and a handler > dcr-proxy-mcp-proxy-handler.ts 1`] = `
+"import type {
+  APIGatewayProxyHandlerV2,
+  APIGatewayProxyStructuredResultV2,
+} from 'aws-lambda';
+
+const UPSTREAM_URL = process.env.UPSTREAM_URL!;
+const PROXY_METADATA_URL = process.env.PROXY_METADATA_URL!;
+
+// Headers stripped when relaying requests/responses through the proxy:
+// RFC 7230 hop-by-hop headers (scoped to a single connection, not the next
+// hop), plus entity headers that fetch() re-derives from the actual body -
+// forwarding stale values would corrupt the response.
+const HOP_BY_HOP = new Set([
+  'connection',
+  'keep-alive',
+  'proxy-authenticate',
+  'proxy-authorization',
+  'te',
+  'trailers',
+  'transfer-encoding',
+  'upgrade',
+  'content-length',
+  'content-encoding',
+  'host',
+]);
+
+export const handler: APIGatewayProxyHandlerV2 = async (
+  event,
+): Promise<APIGatewayProxyStructuredResultV2> => {
+  const method = event.requestContext.http.method;
+  const qs = event.rawQueryString ? \`?\${event.rawQueryString}\` : '';
+  const url = \`\${UPSTREAM_URL}\${qs}\`;
+
+  const fwdHeaders = new Headers();
+  for (const [k, v] of Object.entries(event.headers ?? {})) {
+    if (!v) continue;
+    if (HOP_BY_HOP.has(k.toLowerCase())) continue;
+    fwdHeaders.set(k, v);
+  }
+
+  const reqBody = event.body
+    ? event.isBase64Encoded
+      ? Buffer.from(event.body, 'base64')
+      : event.body
+    : undefined;
+
+  const upstream = await fetch(url, {
+    method,
+    headers: fwdHeaders,
+    body: reqBody as unknown as ArrayBuffer | string | undefined,
+  });
+
+  const respHeaders: Record<string, string> = {};
+  upstream.headers.forEach((v, k) => {
+    if (HOP_BY_HOP.has(k.toLowerCase())) return;
+    respHeaders[k] = v;
+  });
+
+  // Rewrite WWW-Authenticate so MCP clients discover this proxy
+  // as the protected-resource metadata host instead of the upstream.
+  const authKey = Object.keys(respHeaders).find(
+    (k) => k.toLowerCase() === 'www-authenticate',
+  );
+  if (authKey) {
+    respHeaders[authKey] = respHeaders[authKey].replace(
+      /resource_metadata="[^"]*"/i,
+      \`resource_metadata="\${PROXY_METADATA_URL}"\`,
+    );
+  }
+
+  const buf = Buffer.from(await upstream.arrayBuffer());
+  const contentType = (
+    respHeaders['content-type'] ??
+    respHeaders['Content-Type'] ??
+    ''
+  ).toLowerCase();
+  const isText =
+    contentType.includes('json') ||
+    contentType.includes('text') ||
+    contentType.includes('xml') ||
+    contentType.includes('event-stream');
+
+  return {
+    statusCode: upstream.status,
+    headers: respHeaders,
+    body: isText ? buf.toString('utf-8') : buf.toString('base64'),
+    isBase64Encoded: !isText,
+  };
+};
+"
+`;
+
+exports[`ts#dcr-proxy generator > matches snapshot for generated construct and a handler > dcr-proxy-protected-resource-metadata-handler.ts 1`] = `
+"import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  const proxyUrl = \`https://\${event.requestContext.domainName}\`;
+  return {
+    statusCode: 200,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      resource: \`\${proxyUrl}/mcp\`,
+      authorization_servers: [proxyUrl],
+    }),
+  };
+};
+"
+`;
+
+exports[`ts#dcr-proxy generator > matches snapshot for generated construct and a handler > dcr-proxy-register-handler.ts 1`] = `
+"import type {
+  APIGatewayProxyHandlerV2,
+  APIGatewayProxyStructuredResultV2,
+} from 'aws-lambda';
+
+const COGNITO_CLIENT_ID = process.env.COGNITO_CLIENT_ID!;
+
+interface RegisterRequest {
+  redirect_uris?: unknown;
+  [key: string]: unknown;
+}
+
+function jsonResponse(
+  statusCode: number,
+  body: unknown,
+): APIGatewayProxyStructuredResultV2 {
+  return {
+    statusCode,
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  };
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  if (!event.body) {
+    return jsonResponse(400, {
+      error: 'invalid_client_metadata',
+      error_description: 'request body is required',
+    });
+  }
+
+  let req: RegisterRequest;
+  try {
+    req = JSON.parse(event.body) as RegisterRequest;
+  } catch {
+    return jsonResponse(400, {
+      error: 'invalid_client_metadata',
+      error_description: 'request body must be valid JSON',
+    });
+  }
+
+  const redirectUris = req.redirect_uris;
+  if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
+    return jsonResponse(400, {
+      error: 'invalid_redirect_uri',
+      error_description:
+        'redirect_uris is required and must be a non-empty array',
+    });
+  }
+
+  // The proxy fronts a single Cognito App Client, so Cognito performs the
+  // authoritative check: any redirect_uri forwarded to the Hosted UI must be
+  // registered as a callback URL on that App Client. The proxy only validates
+  // the request shape here and passes the URIs through unchanged.
+  for (const uri of redirectUris) {
+    if (typeof uri !== 'string') {
+      return jsonResponse(400, {
+        error: 'invalid_redirect_uri',
+        error_description: 'each redirect_uri must be a string',
+      });
+    }
+  }
+
+  return jsonResponse(201, {
+    client_id: COGNITO_CLIENT_ID,
+    redirect_uris: redirectUris,
+    token_endpoint_auth_method: 'none',
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+  });
+};
+"
+`;
+
+exports[`ts#dcr-proxy generator > matches snapshot for generated construct and a handler > dcr-proxy-token-handler.ts 1`] = `
+"import type { APIGatewayProxyHandlerV2 } from 'aws-lambda';
+import {
+  SecretsManagerClient,
+  GetSecretValueCommand,
+} from '@aws-sdk/client-secrets-manager';
+
+const COGNITO_HOSTED_UI_BASE = process.env.COGNITO_HOSTED_UI_BASE!;
+const COGNITO_CLIENT_ID = process.env.COGNITO_CLIENT_ID!;
+const COGNITO_CLIENT_SECRET_ARN = process.env.COGNITO_CLIENT_SECRET_ARN!;
+const COGNITO_REGION = process.env.COGNITO_REGION!;
+
+const sm = new SecretsManagerClient({ region: COGNITO_REGION });
+let cachedSecret: string | undefined;
+
+async function getClientSecret(): Promise<string> {
+  if (cachedSecret) return cachedSecret;
+  const res = await sm.send(
+    new GetSecretValueCommand({ SecretId: COGNITO_CLIENT_SECRET_ARN }),
+  );
+  if (!res.SecretString) {
+    throw new Error('client_secret missing in Secrets Manager');
+  }
+  cachedSecret = res.SecretString;
+  return cachedSecret;
+}
+
+export const handler: APIGatewayProxyHandlerV2 = async (event) => {
+  if (!event.body) {
+    return {
+      statusCode: 400,
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        error: 'invalid_request',
+        error_description: 'request body is required',
+      }),
+    };
+  }
+
+  const rawBody = event.isBase64Encoded
+    ? Buffer.from(event.body, 'base64').toString('utf-8')
+    : event.body;
+
+  const params = new URLSearchParams(rawBody);
+
+  // Always force the real Cognito client_id and inject the server-side secret.
+  // DCR returned the same client_id to every caller, but we re-assert here
+  // to keep client_id/secret consistent regardless of what the caller sent.
+  params.set('client_id', COGNITO_CLIENT_ID);
+  params.set('client_secret', await getClientSecret());
+
+  // Cognito does not understand RFC 8707 \`resource\`; some MCP clients send it
+  // and Cognito has been observed to reject the exchange when present.
+  params.delete('resource');
+
+  const res = await fetch(\`\${COGNITO_HOSTED_UI_BASE}/oauth2/token\`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: params.toString(),
+  });
+
+  const responseBody = await res.text();
+  console.log('[token]', {
+    grant_type: params.get('grant_type'),
+    status: res.status,
+    ...(res.ok ? {} : { body: responseBody }),
+  });
+
+  return {
+    statusCode: res.status,
+    headers: {
+      'content-type': res.headers.get('content-type') ?? 'application/json',
+    },
+    body: responseBody,
+  };
+};
+"
+`;
+
+exports[`ts#dcr-proxy generator > terraform > matches snapshot for the generated terraform module > dcr-proxy-module.tf 1`] = `
+"# OAuth Dynamic Client Registration (DCR) proxy for Amazon Cognito.
+#
+# Lets MCP clients (Claude Code, Kiro CLI, MCP Inspector, ...) authenticate
+# against an Amazon Cognito User Pool while keeping the Hosted UI flow intact,
+# supporting RFC 7591 Dynamic Client Registration, and never exposing the
+# Cognito App Client secret to the client.
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.62.0"
+    }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
+  }
+}
+
+# Cognito configuration (injected by the caller)
+variable "user_pool_id" {
+  description = "Cognito User Pool id (e.g. us-east-1_abc123)"
+  type        = string
+}
+
+variable "user_pool_client_id" {
+  description = "Cognito User Pool App Client id"
+  type        = string
+}
+
+variable "cognito_client_secret_arn" {
+  description = "ARN of the Secrets Manager secret holding the Cognito App Client secret. The token handler reads this at runtime; the secret is never exposed to the client."
+  type        = string
+}
+
+variable "cognito_hosted_ui_base" {
+  description = "Base URL of the Cognito Hosted UI domain, without a trailing slash (e.g. https://my-domain.auth.us-east-1.amazoncognito.com)"
+  type        = string
+}
+
+variable "upstream_url" {
+  description = "Full URL of the upstream MCP server. The proxy forwards /mcp requests to this URL and rewrites the upstream WWW-Authenticate header."
+  type        = string
+}
+
+variable "env" {
+  description = "Additional environment variables applied to all proxy Lambda functions"
+  type        = map(string)
+  default     = {}
+}
+
+# CORS Configuration (passed to the core http-api module)
+variable "cors_allow_headers" {
+  description = "List of allowed headers for CORS"
+  type        = list(string)
+  default     = ["authorization", "content-type", "mcp-protocol-version"]
+}
+
+variable "cors_allow_methods" {
+  description = "List of allowed HTTP methods for CORS"
+  type        = list(string)
+  default     = ["GET", "POST", "DELETE", "OPTIONS"]
+}
+
+variable "cors_allow_origins" {
+  description = "List of allowed origins for CORS"
+  type        = list(string)
+  default     = ["*"]
+}
+
+variable "asset_bucket_name" {
+  description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zips. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
+  type        = string
+}
+
+variable "mcp_proxy_timeout" {
+  description = "Timeout (seconds) applied to the MCP proxy Lambda. Defaults to 29 (the API Gateway HTTP API integration limit)."
+  type        = number
+  default     = 29
+}
+
+variable "mcp_proxy_memory_size" {
+  description = "Memory size (MB) for the MCP proxy Lambda"
+  type        = number
+  default     = 512
+}
+
+variable "tags" {
+  description = "Tags to apply to all resources"
+  type        = map(string)
+  default     = {}
+}
+
+data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+# The Cognito App Client secret, referenced by ARN so the token handler's role
+# can be scoped to read exactly this secret.
+data "aws_secretsmanager_secret" "cognito_client_secret" {
+  arn = var.cognito_client_secret_arn
+}
+
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
+locals {
+  aws_account_id = data.aws_caller_identity.current.account_id
+  aws_region     = data.aws_region.current.region
+
+  base_env = merge({
+    COGNITO_CLIENT_ID         = var.user_pool_client_id
+    COGNITO_CLIENT_SECRET_ARN = var.cognito_client_secret_arn
+    COGNITO_ISSUER            = "https://cognito-idp.\${local.aws_region}.amazonaws.com/\${var.user_pool_id}"
+    COGNITO_HOSTED_UI_BASE    = var.cognito_hosted_ui_base
+    COGNITO_REGION            = local.aws_region
+  }, var.env)
+
+  # Workspace-root-relative bundle output directory per handler
+  handler_bundle_dirs = {
+    "protected-resource-metadata"   = "dist/snapshot-proxy/bundle/protected-resource-metadata"
+    "authorization-server-metadata" = "dist/snapshot-proxy/bundle/authorization-server-metadata"
+    "register"                      = "dist/snapshot-proxy/bundle/register"
+    "authorize"                     = "dist/snapshot-proxy/bundle/authorize"
+    "token"                         = "dist/snapshot-proxy/bundle/token" #checkov:skip=CKV_SECRET_6:Value is a Lambda bundle output path, not a secret
+    "mcp-proxy"                     = "dist/snapshot-proxy/bundle/mcp-proxy"
+  }
+
+  # Handlers deployed with the standard configuration (timeout 10s, mem 256).
+  # mcp-proxy is deployed separately since its env/timeout/memory differ.
+  standard_handlers = {
+    for name, dir in local.handler_bundle_dirs : name => dir if name != "mcp-proxy"
+  }
+}
+
+# Package each handler's rolldown bundle into a deployment zip
+data "archive_file" "handler_zip" {
+  for_each = local.handler_bundle_dirs
+
+  type        = "zip"
+  source_dir  = "\${path.module}/../../../../../../../\${each.value}"
+  output_path = "\${path.module}/../../../../../../../dist/packages/common/terraform/dcr-proxies/snapshot-proxy/\${each.key}/lambda.zip"
+}
+
+resource "aws_s3_object" "handler_zip" {
+  for_each = local.handler_bundle_dirs
+
+  bucket      = var.asset_bucket_name
+  key         = "dcr-proxies/snapshot-proxy/\${each.key}/\${data.archive_file.handler_zip[each.key].output_sha256}.zip"
+  source      = data.archive_file.handler_zip[each.key].output_path
+  source_hash = data.archive_file.handler_zip[each.key].output_base64sha256
+  etag        = data.archive_file.handler_zip[each.key].output_md5
+}
+
+# Shared execution role for handlers that do not read the client secret
+resource "aws_iam_role" "proxy" {
+  name = "snapshot-proxy-proxy-\${random_string.suffix.result}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+
+  tags = var.tags
+}
+
+# Dedicated role for the token handler, additionally granted read access to the
+# Cognito App Client secret only.
+resource "aws_iam_role" "token" {
+  name = "snapshot-proxy-token-\${random_string.suffix.result}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_iam_role_policy_attachment" "proxy_basic" {
+  role       = aws_iam_role.proxy.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "proxy_xray" {
+  role       = aws_iam_role.proxy.name
+  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
+}
+
+resource "aws_iam_role_policy_attachment" "token_basic" {
+  role       = aws_iam_role.token.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "token_xray" {
+  role       = aws_iam_role.token.name
+  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
+}
+
+resource "aws_iam_role_policy" "token_secret_read" {
+  name = "snapshot-proxy-token-secret-read-\${random_string.suffix.result}"
+  role = aws_iam_role.token.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["secretsmanager:GetSecretValue"]
+      Resource = [data.aws_secretsmanager_secret.cognito_client_secret.arn]
+    }]
+  })
+}
+
+# Standard handler Lambda functions
+resource "aws_lambda_function" "standard" {
+  #checkov:skip=CKV_AWS_117:Lambda does not need to be in a VPC for this use case
+  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this use case
+  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
+  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
+  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
+  for_each = local.standard_handlers
+
+  s3_bucket        = aws_s3_object.handler_zip[each.key].bucket
+  s3_key           = aws_s3_object.handler_zip[each.key].key
+  function_name    = "snapshot-proxy-\${each.key}-\${random_string.suffix.result}"
+  role             = each.key == "token" ? aws_iam_role.token.arn : aws_iam_role.proxy.arn
+  handler          = "index.handler"
+  runtime          = "nodejs24.x"
+  architectures    = ["arm64"]
+  source_code_hash = data.archive_file.handler_zip[each.key].output_base64sha256
+  timeout          = 10
+  memory_size      = 256
+
+  tracing_config {
+    mode = "Active"
+  }
+
+  environment {
+    variables = local.base_env
+  }
+
+  tags = var.tags
+}
+
+# MCP proxy Lambda function (extended env, timeout and memory)
+resource "aws_lambda_function" "mcp_proxy" {
+  #checkov:skip=CKV_AWS_117:Lambda does not need to be in a VPC for this use case
+  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for this use case
+  #checkov:skip=CKV_AWS_272:Code signing not required for this use case
+  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for this use case
+  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
+  s3_bucket        = aws_s3_object.handler_zip["mcp-proxy"].bucket
+  s3_key           = aws_s3_object.handler_zip["mcp-proxy"].key
+  function_name    = "snapshot-proxy-mcp-proxy-\${random_string.suffix.result}"
+  role             = aws_iam_role.proxy.arn
+  handler          = "index.handler"
+  runtime          = "nodejs24.x"
+  architectures    = ["arm64"]
+  source_code_hash = data.archive_file.handler_zip["mcp-proxy"].output_base64sha256
+  timeout          = var.mcp_proxy_timeout
+  memory_size      = var.mcp_proxy_memory_size
+
+  tracing_config {
+    mode = "Active"
+  }
+
+  environment {
+    variables = merge(local.base_env, {
+      UPSTREAM_URL       = var.upstream_url
+      PROXY_METADATA_URL = "\${module.http_api.api_endpoint}/.well-known/oauth-protected-resource"
+    })
+  }
+
+  tags = var.tags
+}
+
+# HTTP API Gateway (shared core module)
+module "http_api" {
+  source = "../../../core/api/http-api"
+
+  api_name           = "snapshot-proxy-mcp-auth-proxy-\${random_string.suffix.result}"
+  api_description    = "MCP-compatible OAuth proxy for Amazon Cognito"
+  stage_name         = "$default"
+  stage_auto_deploy  = true
+  cors_allow_headers = var.cors_allow_headers
+  cors_allow_methods = var.cors_allow_methods
+  cors_allow_origins = var.cors_allow_origins
+
+  tags = var.tags
+}
+
+# Integrations
+resource "aws_apigatewayv2_integration" "standard" {
+  for_each = local.standard_handlers
+
+  api_id                 = module.http_api.api_id
+  integration_type       = "AWS_PROXY"
+  integration_uri        = aws_lambda_function.standard[each.key].invoke_arn
+  payload_format_version = "2.0"
+  timeout_milliseconds   = 30000
+}
+
+resource "aws_apigatewayv2_integration" "mcp_proxy" {
+  api_id                 = module.http_api.api_id
+  integration_type       = "AWS_PROXY"
+  integration_uri        = aws_lambda_function.mcp_proxy.invoke_arn
+  payload_format_version = "2.0"
+  timeout_milliseconds   = 29000
+}
+
+# Routes. jwks_uri/issuer are handled by Cognito; the proxy hosts the OAuth
+# metadata, authorize, token and registration endpoints plus the /mcp proxy.
+locals {
+  routes = {
+    "GET /.well-known/oauth-protected-resource"   = "protected-resource-metadata"
+    "GET /.well-known/oauth-authorization-server" = "authorization-server-metadata"
+    "GET /.well-known/openid-configuration"       = "authorization-server-metadata"
+    "POST /register"                              = "register"
+    "GET /authorize"                              = "authorize"
+    "POST /oauth/token"                           = "token"
+  }
+}
+
+# OAuth discovery, registration and authorization endpoints are part of the
+# public DCR/OAuth flow and must be reachable without prior authorization.
+resource "aws_apigatewayv2_route" "standard" {
+  #checkov:skip=CKV_AWS_309:Public OAuth/DCR endpoints must be accessible without authorization
+  for_each = local.routes
+
+  api_id             = module.http_api.api_id
+  route_key          = each.key
+  target             = "integrations/\${aws_apigatewayv2_integration.standard[each.value].id}"
+  authorization_type = "NONE"
+}
+
+# The /mcp route enforces authorization at the upstream MCP server, so the
+# proxy route itself is intentionally left open.
+resource "aws_apigatewayv2_route" "mcp_proxy" {
+  #checkov:skip=CKV_AWS_309:Authorization is enforced by the upstream MCP server, not this proxy route
+  api_id             = module.http_api.api_id
+  route_key          = "ANY /mcp"
+  target             = "integrations/\${aws_apigatewayv2_integration.mcp_proxy.id}"
+  authorization_type = "NONE"
+}
+
+# Permissions for API Gateway to invoke each Lambda
+resource "aws_lambda_permission" "standard" {
+  for_each = local.standard_handlers
+
+  statement_id  = "AllowAPIGatewayInvoke"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.standard[each.key].function_name
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "\${module.http_api.api_execution_arn}/*/*"
+}
+
+resource "aws_lambda_permission" "mcp_proxy" {
+  statement_id  = "AllowAPIGatewayInvoke"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.mcp_proxy.function_name
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "\${module.http_api.api_execution_arn}/*/*"
+}
+
+# Outputs
+output "proxy_url" {
+  description = "Base URL of the DCR proxy"
+  value       = module.http_api.api_endpoint
+}
+
+output "mcp_url" {
+  description = "MCP endpoint proxied to the upstream server"
+  value       = "\${module.http_api.api_endpoint}/mcp"
+}
+
+output "metadata_url" {
+  description = "OAuth protected-resource metadata URL"
+  value       = "\${module.http_api.api_endpoint}/.well-known/oauth-protected-resource"
+}
+
+output "auth_server_metadata_url" {
+  description = "OAuth authorization-server metadata URL"
+  value       = "\${module.http_api.api_endpoint}/.well-known/oauth-authorization-server"
+}
+
+output "token_endpoint" {
+  description = "OAuth token endpoint"
+  value       = "\${module.http_api.api_endpoint}/oauth/token"
+}
+
+output "registration_endpoint" {
+  description = "Dynamic Client Registration endpoint"
+  value       = "\${module.http_api.api_endpoint}/register"
+}
+
+output "api_id" {
+  description = "ID of the HTTP API Gateway"
+  value       = module.http_api.api_id
+}
+"
+`;