@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -21,8 +21,8 @@ export default defineConfig(() => ({
   },
   plugins: [
     tanstackRouter({
-      routesDirectory: resolve(__dirname, 'src/routes'),
-      generatedRouteTree: resolve(__dirname, 'src/routeTree.gen.ts'),
+      routesDirectory: resolve(import.meta.dirname, 'src/routes'),
+      generatedRouteTree: resolve(import.meta.dirname, 'src/routeTree.gen.ts'),
     }),
     react(),
     tailwindcss(),
@@ -32,7 +32,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -48,11 +48,11 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../dist/test-app/test-output/vitest/coverage',
       provider: 'v8' as const,
     },
   },
-  resolve: { tsconfigPaths: true },
+  resolve: { tsconfigPaths: true, dedupe: ['react', 'react-dom'] },
   define: { global: {} },
 }));
 "
@@ -78,8 +78,8 @@ export default defineConfig(() => ({
   },
   plugins: [
     tanstackRouter({
-      routesDirectory: resolve(__dirname, 'src/routes'),
-      generatedRouteTree: resolve(__dirname, 'src/routeTree.gen.ts'),
+      routesDirectory: resolve(import.meta.dirname, 'src/routes'),
+      generatedRouteTree: resolve(import.meta.dirname, 'src/routeTree.gen.ts'),
     }),
     react(),
   ],
@@ -88,7 +88,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -104,11 +104,11 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../dist/test-app/test-output/vitest/coverage',
       provider: 'v8' as const,
     },
   },
-  resolve: { tsconfigPaths: true },
+  resolve: { tsconfigPaths: true, dedupe: ['react', 'react-dom'] },
   define: { global: {} },
 }));
 "
@@ -131,12 +131,16 @@ exports[`react-website generator > TailwindCSS integration > terraform iac > sho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.62.0"
       configuration_aliases = [aws.us_east_1]
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "3.3.1"
+    }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -152,6 +156,73 @@ variable "website_file_path" {
   type        = string
 }
 
+variable "custom_domain_names" {
+  description = "Custom domain names (aliases) for the CloudFront distribution. Requires acm_certificate_arn."
+  type        = list(string)
+  default     = []
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in us-east-1) for the custom domain names. When set, viewers are required to use TLS 1.2 or later."
+  type        = string
+  default     = null
+}
+
+variable "enable_waf" {
+  description = "Whether to protect the CloudFront distribution with an AWS WAF Web ACL."
+  type        = bool
+  default     = true
+}
+
+variable "encryption" {
+  description = "Server-side encryption for the website and distribution log buckets. One of KMS or S3_MANAGED."
+  type        = string
+  default     = "KMS"
+
+  validation {
+    condition     = contains(["KMS", "S3_MANAGED"], var.encryption)
+    error_message = "encryption must be one of KMS or S3_MANAGED."
+  }
+}
+
+variable "kms_key_arn" {
+  description = "ARN of an existing KMS key used to encrypt the website and distribution log buckets when encryption is KMS. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the CloudWatch Logs, S3 and CloudFront service principals the necessary permissions in its own key policy."
+  type        = string
+  default     = null
+}
+
+variable "create_kms_key" {
+  description = "Whether to create a KMS key for the website. Only applies when encryption is KMS. Set to false when supplying kms_key_arn."
+  type        = bool
+  default     = true
+}
+
+variable "enable_key_rotation" {
+  description = "Whether the automatically created KMS key has rotation enabled. Only applies when encryption is KMS and create_kms_key is true."
+  type        = bool
+  default     = true
+}
+
+# Content-Security-Policy enforced on all responses. Restricts scripts and
+# framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+# (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+# Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+# connect-src to your specific origins once they are known.
+locals {
+  content_security_policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+
+  # Delivery source/destination names have a 60 character maximum. Truncate the
+  # website name so the longest delivery name stays within the limit.
+  access_logs_name_prefix = substr(lower(var.website_name), 0, 16)
+
+  create_website_key = var.encryption == "KMS" && var.create_kms_key
+  website_kms_key_arn = (
+    var.encryption != "KMS" ? null :
+    local.create_website_key ? aws_kms_key.website_key[0].arn :
+    var.kms_key_arn
+  )
+}
+
 
 # Data sources
 data "aws_caller_identity" "current" {}
@@ -160,9 +231,11 @@ data "aws_region" "current" {}
 
 # KMS Key for encryption
 resource "aws_kms_key" "website_key" {
+  count = local.create_website_key ? 1 : 0
+
   description             = "KMS key for \${var.website_name} website encryption"
   deletion_window_in_days = 7
-  enable_key_rotation     = true
+  enable_key_rotation     = var.enable_key_rotation
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -188,6 +261,26 @@ resource "aws_kms_key" "website_key" {
         ]
         Resource = "*"
       },
+      {
+        Sid    = "AllowCloudWatchLogs"
+        Effect = "Allow"
+        Principal = {
+          Service = "logs.\${data.aws_region.current.region}.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnLike = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:*"
+          }
+        }
+      },
       {
         Sid    = "AllowCloudFrontServicePrincipalSSE-KMS"
         Effect = "Allow"
@@ -215,22 +308,18 @@ resource "aws_kms_key" "website_key" {
 }
 
 resource "aws_kms_alias" "website_key_alias" {
+  count = local.create_website_key ? 1 : 0
+
   name          = "alias/\${lower(var.website_name)}-website-key-\${random_id.unique_suffix.hex}"
-  target_key_id = aws_kms_key.website_key.key_id
+  target_key_id = aws_kms_key.website_key[0].key_id
 }
 
-# Access Logs Bucket
-resource "aws_s3_bucket" "access_logs" {
-  #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for access logs bucket
-  #checkov:skip=CKV_AWS_144:Cross-region replication not required for access logs
-  #checkov:skip=CKV2_AWS_62:Event notifications not required for access logs bucket
-  #checkov:skip=CKV_AWS_21:Versioning disabled for access logs to reduce storage costs
-  bucket        = "\${lower(var.website_name)}-access-logs-\${random_id.bucket_suffix.hex}"
-  force_destroy = true
-
-  tags = {
-    Name = "\${lower(var.website_name)}-access-logs"
-  }
+# CloudWatch log group receiving S3 server access logs for the website and
+# distribution log buckets.
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/s3/\${lower(var.website_name)}-access-logs-\${random_id.bucket_suffix.hex}"
+  retention_in_days = 365
+  kms_key_id        = local.website_kms_key_arn
 }
 
 resource "random_id" "unique_suffix" {
@@ -241,63 +330,12 @@ resource "random_id" "bucket_suffix" {
   byte_length = 8
 }
 
-resource "aws_s3_bucket_versioning" "access_logs_versioning" {
-  bucket = aws_s3_bucket.access_logs.id
-  versioning_configuration {
-    status = "Disabled"
-  }
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "access_logs_encryption" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
-    }
-  }
-}
-
-resource "aws_s3_bucket_public_access_block" "access_logs_pab" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-resource "aws_s3_bucket_policy" "access_logs_ssl_policy" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid       = "DenyInsecureConnections"
-        Effect    = "Deny"
-        Principal = "*"
-        Action    = "s3:*"
-        Resource = [
-          aws_s3_bucket.access_logs.arn,
-          "\${aws_s3_bucket.access_logs.arn}/*"
-        ]
-        Condition = {
-          Bool = {
-            "aws:SecureTransport" = "false"
-          }
-        }
-      }
-    ]
-  })
-}
-
 # Website Bucket
 resource "aws_s3_bucket" "website" {
   #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for static website content
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for static website
   #checkov:skip=CKV2_AWS_62:Event notifications not required for static website bucket
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.website)
   bucket        = "\${lower(var.website_name)}-website-\${random_id.bucket_suffix.hex}"
   force_destroy = true
 
@@ -318,8 +356,8 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "website_encryptio
 
   rule {
     apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
+      kms_master_key_id = var.encryption == "KMS" ? local.website_kms_key_arn : null
+      sse_algorithm     = var.encryption == "KMS" ? "aws:kms" : "AES256"
     }
   }
 }
@@ -341,20 +379,35 @@ resource "aws_s3_bucket_ownership_controls" "website_ownership" {
   }
 }
 
-resource "aws_s3_bucket_logging" "website_logging" {
-  bucket = aws_s3_bucket.website.id
+# Deliver the website bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "website" {
+  name         = "\${local.access_logs_name_prefix}-website-logs-\${random_id.bucket_suffix.hex}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.website.arn
+}
+
+resource "aws_cloudwatch_log_delivery_destination" "access_logs" {
+  name = "\${local.access_logs_name_prefix}-access-logs-\${random_id.bucket_suffix.hex}"
+
+  delivery_destination_configuration {
+    destination_resource_arn = aws_cloudwatch_log_group.access_logs.arn
+  }
+}
 
-  target_bucket = aws_s3_bucket.access_logs.id
-  target_prefix = "website-access-logs/"
+resource "aws_cloudwatch_log_delivery" "website" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.website.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.access_logs.arn
 }
 
 
-# Distribution Log Bucket
+# Distribution Log Bucket — holds CloudFront standard access logs (CloudFront
+# delivers only to S3). Its own S3 server access logs go to CloudWatch Logs.
 resource "aws_s3_bucket" "distribution_logs" {
   #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for CloudFront logs
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for CloudFront logs
   #checkov:skip=CKV2_AWS_62:Event notifications not required for CloudFront logs bucket
   #checkov:skip=CKV_AWS_21:Versioning not required for CloudFront access logs
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.distribution_logs)
   bucket        = "\${lower(var.website_name)}-distribution-logs-\${random_id.bucket_suffix.hex}"
   force_destroy = true
 
@@ -368,8 +421,8 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "distribution_logs
 
   rule {
     apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
+      kms_master_key_id = var.encryption == "KMS" ? local.website_kms_key_arn : null
+      sse_algorithm     = var.encryption == "KMS" ? "aws:kms" : "AES256"
     }
   }
 }
@@ -400,11 +453,16 @@ resource "aws_s3_bucket_acl" "distribution_logs_acl" {
   depends_on = [aws_s3_bucket_ownership_controls.distribution_logs_ownership]
 }
 
-resource "aws_s3_bucket_logging" "distribution_logs_logging" {
-  bucket = aws_s3_bucket.distribution_logs.id
+# Deliver the distribution log bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "distribution_logs" {
+  name         = "\${local.access_logs_name_prefix}-distribution-logs-\${random_id.bucket_suffix.hex}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.distribution_logs.arn
+}
 
-  target_bucket = aws_s3_bucket.access_logs.id
-  target_prefix = "distribution-access-logs/"
+resource "aws_cloudwatch_log_delivery" "distribution_logs" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.distribution_logs.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.access_logs.arn
 }
 
 resource "aws_s3_bucket_policy" "distribution_logs_ssl_policy" {
@@ -434,6 +492,8 @@ resource "aws_s3_bucket_policy" "distribution_logs_ssl_policy" {
 
 # WAF Web ACL (must be in us-east-1 for CloudFront)
 resource "aws_wafv2_web_acl" "cloudfront_waf" {
+  count = var.enable_waf ? 1 : 0
+
   #checkov:skip=CKV2_AWS_31:WAF logging disabled
   provider = aws.us_east_1
   name     = "\${lower(var.website_name)}-cloudfront-waf-\${random_id.unique_suffix.hex}"
@@ -512,13 +572,42 @@ resource "aws_cloudfront_origin_access_control" "website_oac" {
   signing_protocol                  = "sigv4"
 }
 
+# Security headers applied to all responses.
+resource "aws_cloudfront_response_headers_policy" "website" {
+  name = "\${aws_s3_bucket.website.bucket}-security-headers"
+
+  security_headers_config {
+    strict_transport_security {
+      access_control_max_age_sec = 63072000
+      include_subdomains         = true
+      preload                    = true
+      override                   = true
+    }
+    content_type_options {
+      override = true
+    }
+    frame_options {
+      frame_option = "DENY"
+      override     = true
+    }
+    referrer_policy {
+      referrer_policy = "strict-origin-when-cross-origin"
+      override        = true
+    }
+    content_security_policy {
+      content_security_policy = local.content_security_policy
+      override                = true
+    }
+  }
+}
+
 # CloudFront Distribution
 resource "aws_cloudfront_distribution" "website" {
+  # See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
   #checkov:skip=CKV_AWS_174:Using CloudFront default certificate which does not support TLS v1.2
   #checkov:skip=CKV_AWS_310:Origin failover not required for single S3 origin static website
   #checkov:skip=CKV_AWS_374:Geo restrictions not required for global web application
   #checkov:skip=CKV2_AWS_42:Custom SSL certificate not required for development - using CloudFront default
-  #checkov:skip=CKV2_AWS_32:Response headers policy not required for basic static website
   #checkov:skip=CKV2_AWS_47:WAF includes AWSManagedRulesKnownBadInputsRuleSet which provides Log4j protection
   origin {
     domain_name              = aws_s3_bucket.website.bucket_regional_domain_name
@@ -529,7 +618,8 @@ resource "aws_cloudfront_distribution" "website" {
   enabled             = true
   is_ipv6_enabled     = true
   default_root_object = "index.html"
-  web_acl_id          = aws_wafv2_web_acl.cloudfront_waf.arn
+  web_acl_id          = var.enable_waf ? aws_wafv2_web_acl.cloudfront_waf[0].arn : null
+  aliases             = var.custom_domain_names
 
   logging_config {
     include_cookies = false
@@ -548,11 +638,12 @@ resource "aws_cloudfront_distribution" "website" {
       }
     }
 
-    viewer_protocol_policy = "redirect-to-https"
-    min_ttl                = 0
-    default_ttl            = 3600
-    max_ttl                = 86400
-    compress               = true
+    viewer_protocol_policy     = "redirect-to-https"
+    response_headers_policy_id = aws_cloudfront_response_headers_policy.website.id
+    min_ttl                    = 0
+    default_ttl                = 3600
+    max_ttl                    = 86400
+    compress                   = true
   }
 
   # Custom error responses for SPA routing
@@ -575,19 +666,16 @@ resource "aws_cloudfront_distribution" "website" {
   }
 
   viewer_certificate {
-    cloudfront_default_certificate = true
+    cloudfront_default_certificate = var.acm_certificate_arn == null
+    acm_certificate_arn            = var.acm_certificate_arn
+    ssl_support_method             = var.acm_certificate_arn == null ? null : "sni-only"
+    minimum_protocol_version       = var.acm_certificate_arn == null ? "TLSv1" : "TLSv1.2_2021"
   }
 
   tags = {
     Name = "\${lower(var.website_name)}-distribution-\${random_id.unique_suffix.hex}"
   }
 
-  lifecycle {
-    replace_triggered_by = [
-      aws_wafv2_web_acl.cloudfront_waf
-    ]
-  }
-
   # CloudFront validates access to the distribution logs bucket when it
   # creates the distribution.
   depends_on = [
@@ -656,8 +744,8 @@ resource "null_resource" "upload_website_files" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      cd "\${path.root}"
-      uv run --with boto3 python3 -c "
+      cd "$ROOT_PATH"
+      uv run --with boto3==1.43.82 python3 -c "
 import os
 import sys
 import boto3
@@ -745,9 +833,14 @@ def sync_to_s3(local_path, bucket_name):
         sys.exit(1)
 
 # Execute sync
-sync_to_s3('\${var.website_file_path}', '\${aws_s3_bucket.website.bucket}')
+sync_to_s3(os.environ['WEBSITE_FILE_PATH'], os.environ['BUCKET_NAME'])
 "
     EOT
+    environment = {
+      ROOT_PATH         = path.root
+      WEBSITE_FILE_PATH = var.website_file_path
+      BUCKET_NAME       = aws_s3_bucket.website.bucket
+    }
   }
 
   depends_on = [aws_s3_bucket_policy.website_cloudfront_policy]
@@ -755,11 +848,12 @@ sync_to_s3('\${var.website_file_path}', '\${aws_s3_bucket.website.bucket}')
 
 # Upload runtime config file
 resource "aws_s3_object" "runtime_config" {
-  bucket       = aws_s3_bucket.website.id
-  key          = "runtime-config.json"
-  content      = module.runtime_config_reader.config_json
-  content_type = "application/json"
-  etag         = md5(module.runtime_config_reader.config_json)
+  bucket        = aws_s3_bucket.website.id
+  key           = "runtime-config.json"
+  content       = module.runtime_config_reader.config_json
+  content_type  = "application/json"
+  cache_control = "no-cache"
+  etag          = md5(module.runtime_config_reader.config_json)
 
   depends_on = [null_resource.upload_website_files]
 }
@@ -774,8 +868,9 @@ resource "null_resource" "cloudfront_invalidation" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3 python3 -c "
+      uv run --with boto3==1.43.82 python3 -c "
 import boto3
+import os
 import sys
 from botocore.exceptions import ClientError, NoCredentialsError
 
@@ -797,7 +892,7 @@ def create_invalidation(distribution_id):
 
         invalidation_id = response['Invalidation']['Id']
         print(f'CloudFront cache invalidation created: {invalidation_id}')
-        print(f'Distribution: \${aws_cloudfront_distribution.website.id}')
+        print(f'Distribution: {distribution_id}')
         print(f'Status: {response[\\"Invalidation\\"][\\"Status\\"]}')
 
     except NoCredentialsError:
@@ -811,9 +906,12 @@ def create_invalidation(distribution_id):
         sys.exit(1)
 
 # Execute invalidation
-create_invalidation('\${aws_cloudfront_distribution.website.id}')
+create_invalidation(os.environ['DISTRIBUTION_ID'])
 "
     EOT
+    environment = {
+      DISTRIBUTION_ID = aws_cloudfront_distribution.website.id
+    }
   }
 
   depends_on = [
@@ -850,18 +948,65 @@ output "cloudfront_domain_name" {
 
 output "waf_web_acl_arn" {
   description = "ARN of the WAF Web ACL"
-  value       = aws_wafv2_web_acl.cloudfront_waf.arn
+  value       = var.enable_waf ? aws_wafv2_web_acl.cloudfront_waf[0].arn : null
 }",
   "test-app.tf": "terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.62.0"
       configuration_aliases = [aws.us_east_1]
     }
   }
 }
 
+variable "custom_domain_names" {
+  description = "Custom domain names (aliases) for the CloudFront distribution. Requires acm_certificate_arn."
+  type        = list(string)
+  default     = []
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in us-east-1) for the custom domain names. When set, viewers are required to use TLS 1.2 or later."
+  type        = string
+  default     = null
+}
+
+variable "enable_waf" {
+  description = "Whether to protect the CloudFront distribution with an AWS WAF Web ACL."
+  type        = bool
+  default     = true
+}
+
+variable "encryption" {
+  description = "Server-side encryption for the website and distribution log buckets. One of KMS or S3_MANAGED."
+  type        = string
+  default     = "KMS"
+
+  validation {
+    condition     = contains(["KMS", "S3_MANAGED"], var.encryption)
+    error_message = "encryption must be one of KMS or S3_MANAGED."
+  }
+}
+
+variable "kms_key_arn" {
+  description = "ARN of an existing KMS key used to encrypt the website and distribution log buckets when encryption is KMS. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the CloudWatch Logs, S3 and CloudFront service principals the necessary permissions in its own key policy."
+  type        = string
+  default     = null
+}
+
+variable "create_kms_key" {
+  description = "Whether to create a KMS key for the website. Only applies when encryption is KMS. Set to false when supplying kms_key_arn."
+  type        = bool
+  default     = true
+}
+
+variable "enable_key_rotation" {
+  description = "Whether the automatically created KMS key has rotation enabled. Only applies when encryption is KMS and create_kms_key is true."
+  type        = bool
+  default     = true
+}
+
 # Static website module configured for the web package
 module "static_website" {
   source = "../../../core/static-website"
@@ -869,6 +1014,14 @@ module "static_website" {
   website_name      = "test-app"
   website_file_path = "\${path.module}/../../../../../../../dist/test-app/bundle"
 
+  custom_domain_names = var.custom_domain_names
+  acm_certificate_arn = var.acm_certificate_arn
+  enable_waf          = var.enable_waf
+  encryption          = var.encryption
+  kms_key_arn         = var.kms_key_arn
+  create_kms_key      = var.create_kms_key
+  enable_key_rotation = var.enable_key_rotation
+
   providers = {
     aws.us_east_1 = aws.us_east_1
   }
@@ -909,7 +1062,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.10/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -921,6 +1074,9 @@ exports[`react-website generator > Tanstack router integration > should generate
     "formatter": {
       "quoteStyle": "single",
       "trailingCommas": "all"
+    },
+    "resolver": {
+      "experimentalPnpmCatalogs": true
     }
   },
   "css": {
@@ -934,9 +1090,9 @@ exports[`react-website generator > Tanstack router integration > should generate
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": false,
+      "preset": "none",
       "correctness": {
-        "noUndeclaredDependencies": "warn"
+        "noUndeclaredDependencies": "error"
       }
     }
   },
@@ -952,12 +1108,33 @@ exports[`react-website generator > Tanstack router integration > should generate
       "**",
       "!**/dist",
       "!**/out-tsc",
+      "!**/test-output",
       "!**/node_modules",
       "!**/.nx",
       "!**/.venv",
-      "!**/*.css"
+      "!**/.grit",
+      "!**/*.css",
+      "!**/*.gen.*",
+      "!**/generated/**",
+      "!**/tsconfig*.json"
     ]
-  }
+  },
+  "overrides": [
+    {
+      "includes": [
+        "**/*.config.{ts,mts,cts,js,mjs,cjs}",
+        "**/*.{spec,test}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}",
+        "**/*.stories.{ts,tsx}"
+      ],
+      "linter": {
+        "rules": {
+          "correctness": {
+            "noUndeclaredDependencies": "off"
+          }
+        }
+      }
+    }
+  ]
 }
 "
 `;
@@ -970,35 +1147,66 @@ exports[`react-website generator > Tanstack router integration > should generate
   "targetDefaults": {
     "build": {
       "cache": true,
-      "dependsOn": ["^build"],
       "inputs": ["default"]
     },
     "lint": {
       "cache": true
     },
-    "@nx/vite:build": {
-      "cache": true,
+    "test": {
       "dependsOn": ["^build"],
-      "inputs": ["default", "^default"]
+      "inputs": ["default"]
     },
     "@nx/vitest:test": {
       "cache": true,
-      "inputs": ["default", "^default"],
+      "inputs": ["default", "^production"],
       "configurations": {
         "update-snapshot": {
           "args": "--update"
         }
       }
     },
-    "test": {
-      "dependsOn": ["^build"],
-      "inputs": ["default"]
-    },
     "compile": {
       "cache": true,
       "inputs": ["default"]
     }
   },
+  "plugins": [
+    {
+      "plugin": "@nx/js/typescript",
+      "options": {
+        "typecheck": {
+          "targetName": "typecheck"
+        },
+        "build": {
+          "targetName": "compile",
+          "configName": "tsconfig.lib.json",
+          "buildDepsName": "build-deps",
+          "watchDepsName": "watch-deps"
+        }
+      }
+    },
+    {
+      "plugin": "@nx/vite/plugin",
+      "options": {
+        "buildTargetName": "bundle",
+        "serveTargetName": "serve",
+        "devTargetName": "serve",
+        "previewTargetName": "preview",
+        "serveStaticTargetName": "serve-static",
+        "typecheckTargetName": "vite:typecheck",
+        "buildDepsTargetName": "build-deps",
+        "watchDepsTargetName": "watch-deps"
+      }
+    },
+    {
+      "plugin": "@nx/vitest",
+      "options": {
+        "testTargetName": "test",
+        "ciTargetName": "test-ci",
+        "testMode": "watch"
+      }
+    }
+  ],
   "generators": {
     "@nx/react": {
       "application": {
@@ -1020,27 +1228,11 @@ exports[`react-website generator > Tanstack router integration > should generate
     "biome": ["default", "{workspaceRoot}/biome.json"],
     "default": [
       {
-        "dependentTasksOutputFiles": "**/*",
+        "dependentTasksOutputFiles": "!{reports,coverage}/**",
         "transitive": true
       }
     ]
-  },
-  "plugins": [
-    {
-      "plugin": "@nx/js/typescript",
-      "options": {
-        "typecheck": {
-          "targetName": "typecheck"
-        },
-        "build": {
-          "targetName": "compile",
-          "configName": "tsconfig.lib.json",
-          "buildDepsName": "build-deps",
-          "watchDepsName": "watch-deps"
-        }
-      }
-    }
-  ]
+  }
 }
 "
 `;
@@ -1048,43 +1240,39 @@ exports[`react-website generator > Tanstack router integration > should generate
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > package.json 1`] = `
 "{
   "name": "@proj/source",
-  "dependencies": {
-    "@cloudscape-design/board-components": "3.0.189",
-    "@cloudscape-design/components": "3.0.1308",
-    "@cloudscape-design/global-styles": "1.0.59",
-    "aws-cdk-lib": "2.258.0",
-    "constructs": "10.6.0",
-    "react": "19.2.7",
-    "react-dom": "19.2.7",
-    "tailwindcss": "4.2.2"
-  },
+  "dependencies": {},
   "devDependencies": {
-    "@nx/js": "22.7.5",
-    "@nx/react": "22.7.5",
-    "@nx/vite": "22.7.5",
-    "@nx/vitest": "22.7.5",
-    "@nx/web": "22.7.5",
-    "@swc-node/register": "~1.11.1",
-    "@swc/core": "~1.15.5",
+    "@nx/js": "23.1.2",
+    "@nx/react": "catalog:",
+    "@nx/vite": "23.1.2",
+    "@nx/vitest": "23.1.2",
+    "@nx/web": "23.1.2",
     "@swc/helpers": "~0.5.18",
-    "@tailwindcss/vite": "4.2.2",
+    "@tailwindcss/vite": "catalog:",
     "@testing-library/dom": "10.4.0",
     "@testing-library/react": "16.3.0",
-    "@types/node": "25.9.2",
+    "@types/node": "catalog:",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^6.0.0",
-    "@vitest/coverage-v8": "4.1.8",
-    "@vitest/ui": "4.1.8",
+    "@vitest/coverage-v8": "catalog:",
+    "@vitest/ui": "catalog:",
     "jiti": "2.4.2",
-    "jsdom": "~22.1.0",
-    "typescript": "~5.9.2",
-    "vite": "8.0.16",
-    "vitest": "4.1.8"
+    "jsdom": "^27.1.0",
+    "typescript": "~6.0.3",
+    "vite": "catalog:",
+    "vitest": "catalog:"
   },
   "type": "module",
-  "scripts": {
-    "dev": "nx serve-local @proj/test-app"
+  "workspaces": [
+    "packages/*",
+    "test-app",
+    "packages/common/constructs"
+  ],
+  "overrides": {
+    "@nx/react": {
+      "express": "5.2.1"
+    }
   }
 }
 "
@@ -1097,27 +1285,27 @@ This library was generated with [@aws/nx-plugin](https://github.com/awslabs/nx-p
 
 ## Building
 
-Run \`pnpm nx build @proj/common-constructs [--skip-nx-cache]\` to build the application.
+Run \`npx nx build @proj/common-constructs [--skip-nx-cache]\` to build the application.
 
 ## Running unit tests
 
-Run \`pnpm nx test @proj/common-constructs\` to execute the unit tests via Vitest.
+Run \`npx nx test @proj/common-constructs\` to execute the unit tests via Vitest.
 
 ### Updating snapshots
 
 To update snapshots, run the following command:
 
-\`pnpm nx test @proj/common-constructs --configuration=update-snapshot\`
+\`npx nx test @proj/common-constructs --configuration=update-snapshot\`
 
 ## Run lint
 
-Run \`pnpm nx lint @proj/common-constructs\`
+Run \`npx nx lint @proj/common-constructs\`
 
 ### Fixable issues
 
 You can also automatiaclly fix some lint errors by running the following command:
 
-\`pnpm nx lint @proj/common-constructs --configuration=fix\`
+\`npx nx lint @proj/common-constructs --configuration=fix\`
 
 ## Useful links
 
@@ -1127,6 +1315,24 @@ You can also automatiaclly fix some lint errors by running the following command
 "
 `;
 
+exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > packages/common/constructs/package.json 1`] = `
+"{
+  "name": "@proj/common-constructs",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "aws-cdk-lib": "catalog:",
+    "constructs": "catalog:",
+    "tslib": "^2.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:"
+  }
+}
+"
+`;
+
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > packages/common/constructs/project.json 1`] = `
 "{
   "name": "@proj/common-constructs",
@@ -1138,6 +1344,9 @@ exports[`react-website generator > Tanstack router integration > should generate
     "generator": "ts#project"
   },
   "targets": {
+    "assemble": {
+      "dependsOn": ["compile", "@proj/test-app:assemble"]
+    },
     "build": {
       "dependsOn": ["lint", "compile", "test", "@proj/test-app:build"]
     },
@@ -1149,27 +1358,37 @@ exports[`react-website generator > Tanstack router integration > should generate
         "cwd": "{projectRoot}"
       }
     },
-    "lint": {
+    "format": {
       "executor": "nx:run-commands",
       "cache": true,
       "inputs": ["biome"],
       "options": {
-        "command": "biome lint {projectRoot}"
+        "command": "biome format {projectRoot}"
       },
       "configurations": {
         "fix": {
-          "command": "biome check --write {projectRoot}"
+          "command": "biome format --write {projectRoot}"
         },
         "skip-lint": {
           "command": "node -e \\"\\""
         }
       }
     },
-    "test": {
-      "executor": "@nx/vitest:test",
-      "outputs": ["{options.reportsDirectory}"],
+    "lint": {
+      "executor": "nx:run-commands",
+      "cache": true,
+      "inputs": ["biome"],
+      "dependsOn": ["format"],
       "options": {
-        "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
+        "command": "biome lint {projectRoot}"
+      },
+      "configurations": {
+        "fix": {
+          "command": "biome check --write {projectRoot}"
+        },
+        "skip-lint": {
+          "command": "node -e \\"\\""
+        }
       }
     }
   }
@@ -1190,11 +1409,17 @@ exports[`react-website generator > Tanstack router integration > should generate
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > packages/common/constructs/src/app/static-websites/test-app.ts 1`] = `
 "import * as url from 'url';
 import { Construct } from 'constructs';
-import { StaticWebsite } from '../../core/index.js';
+import { StaticWebsite, StaticWebsiteProps } from '../../core/index.js';
+
+export type TestAppProps = Omit<
+  StaticWebsiteProps,
+  'websiteName' | 'websiteFilePath'
+>;
 
 export class TestApp extends StaticWebsite {
-  constructor(scope: Construct, id: string) {
+  constructor(scope: Construct, id: string, props?: TestAppProps) {
     super(scope, id, {
+      ...props,
       websiteName: 'TestApp',
       websiteFilePath: url.fileURLToPath(
         new URL('../../../../../../dist/test-app/bundle', import.meta.url),
@@ -1282,10 +1507,31 @@ export const suppressRules = (
 "
 `;
 
+exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > packages/common/constructs/src/core/cloudfront.ts 1`] = `
+"import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';
+
+/**
+ * Finds the domain names associated with a CloudFront distribution.
+ *
+ * Includes the distribution's default \`*.cloudfront.net\` domain name plus any custom
+ * domain names (aliases) configured on it.
+ */
+export const findCloudFrontDomainNames = (
+  distribution: Distribution,
+): string[] => {
+  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;
+  const distributionConfig =
+    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;
+  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];
+};
+"
+`;
+
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > packages/common/constructs/src/core/index.ts 1`] = `
 "export * from './static-website.js';
 export * from './app.js';
 export * from './checkov.js';
+export * from './cloudfront.js';
 export * from './runtime-config.js';
 export * from './workspace.js';
 "
@@ -1481,11 +1727,21 @@ exports[`react-website generator > Tanstack router integration > should generate
 "import {
   CfnOutput,
   CfnResource,
+  Duration,
   Lazy,
+  Names,
   RemovalPolicy,
   Stack,
 } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  SecurityPolicyProtocol,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
+import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -1494,18 +1750,83 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
-import { Key } from 'aws-cdk-lib/aws-kms';
+import { IKey, Key } from 'aws-cdk-lib/aws-kms';
+import {
+  CfnDelivery,
+  CfnDeliveryDestination,
+  CfnDeliverySource,
+  LogGroup,
+  RetentionDays,
+} from 'aws-cdk-lib/aws-logs';
+import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { CfnWebACL } from 'aws-cdk-lib/aws-wafv2';
 import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
+  /**
+   * Custom domain names for the CloudFront distribution. Requires \`certificate\`.
+   */
+  readonly domainNames?: string[];
+  /**
+   * ACM certificate for the custom domain names. Must be in us-east-1.
+   * When provided, viewers are required to use TLS 1.2 or later.
+   */
+  readonly certificate?: ICertificate;
+  /**
+   * Whether to protect the CloudFront distribution with an AWS WAF Web ACL.
+   *
+   * @default true
+   */
+  readonly enableWaf?: boolean;
+  /**
+   * Server-side encryption for the website and distribution log buckets.
+   *
+   * @default BucketEncryption.KMS
+   */
+  readonly encryption?: BucketEncryption;
+  /**
+   * KMS key used to encrypt the website and distribution log buckets. Only used when \`encryption\` is
+   * \`BucketEncryption.KMS\`. When not provided, a new key is created. Note that a key imported via
+   * \`Key.fromKeyArn\` must already grant the CloudWatch Logs, S3 and CloudFront service principals the
+   * necessary permissions in its own key policy - \`addToResourcePolicy\` is a no-op on an imported key,
+   * so this construct cannot grant them on your behalf.
+   */
+  readonly encryptionKey?: IKey;
+  /**
+   * Whether the automatically created KMS key has rotation enabled. Only applies when \`encryption\` is
+   * \`BucketEncryption.KMS\` and no \`encryptionKey\` is supplied.
+   *
+   * @default true
+   */
+  readonly enableKeyRotation?: boolean;
 }
 
 /**
@@ -1524,39 +1845,53 @@ export class StaticWebsite extends Construct {
   constructor(
     scope: Construct,
     id: string,
-    { websiteFilePath, websiteName }: StaticWebsiteProps,
+    {
+      websiteFilePath,
+      websiteName,
+      domainNames,
+      certificate,
+      enableWaf = true,
+      encryption = BucketEncryption.KMS,
+      encryptionKey,
+      enableKeyRotation = true,
+    }: StaticWebsiteProps,
   ) {
     super(scope, id);
-    this.node.setContext(
-      '@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy',
-      true,
-    );
 
-    const websiteKey = new Key(this, 'WebsiteKey', {
-      enableKeyRotation: true,
-    });
+    const websiteKey: IKey | undefined =
+      encryption === BucketEncryption.KMS
+        ? (encryptionKey ?? new Key(this, 'WebsiteKey', { enableKeyRotation }))
+        : undefined;
+
+    // Allow CloudWatch Logs to use the website key for server access log delivery.
+    const stack = Stack.of(this);
+    websiteKey?.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [
+          new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
+        ],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnLike: {
+            'kms:EncryptionContext:aws:logs:arn': \`arn:aws:logs:\${stack.region}:\${stack.account}:log-group:*\`,
+          },
+        },
+      }),
+    );
 
-    const accessLogsBucket = new Bucket(this, 'AccessLogsBucket', {
-      versioned: false,
-      enforceSSL: true,
-      autoDeleteObjects: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
       encryptionKey: websiteKey,
-      objectOwnership: ObjectOwnership.OBJECT_WRITER,
-      publicReadAccess: false,
-      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+      removalPolicy: RemovalPolicy.DESTROY,
     });
-    suppressRules(
-      accessLogsBucket,
-      ['CKV_AWS_21'],
-      'Access log bucket does not need versioning enabled',
-    );
-    suppressRules(
-      accessLogsBucket,
-      ['CKV_AWS_18'],
-      'Access log bucket does not need an access log bucket',
-    );
 
     // S3 Bucket to hold website files
     this.websiteBucket = new Bucket(this, 'WebsiteBucket', {
@@ -1564,47 +1899,99 @@ export class StaticWebsite extends Construct {
       enforceSSL: true,
       autoDeleteObjects: true,
       removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+      encryption,
       encryptionKey: websiteKey,
       objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
       publicReadAccess: false,
       blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-      serverAccessLogsPrefix: 'website-access-logs',
-      serverAccessLogsBucket: accessLogsBucket,
     });
+    suppressRules(
+      this.websiteBucket,
+      ['CKV_AWS_18'],
+      'Server access logs are delivered to CloudWatch Logs',
+    );
+    this.deliverAccessLogsToCloudWatch(
+      'Website',
+      this.websiteBucket,
+      accessLogs,
+    );
     // Web ACL
-    const wafStack = new CloudfrontWebAcl(this, 'waf');
+    const wafStack = enableWaf ? new CloudfrontWebAcl(this, 'waf') : undefined;
 
-    // Cloudfront Distribution
+    // Bucket holding CloudFront standard access logs. CloudFront delivers its
+    // own logs to S3 only, so this bucket is retained; its S3 server access
+    // logs are delivered to CloudWatch Logs.
     const logBucket = new Bucket(this, 'DistributionLogBucket', {
       enforceSSL: true,
       autoDeleteObjects: true,
       removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+      encryption,
       encryptionKey: websiteKey,
       objectOwnership: ObjectOwnership.BUCKET_OWNER_PREFERRED,
       publicReadAccess: false,
       blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-      serverAccessLogsPrefix: 'distribution-access-logs',
-      serverAccessLogsBucket: accessLogsBucket,
     });
     suppressRules(
       logBucket,
       ['CKV_AWS_21'],
       'Distribution log bucket does not need versioning enabled',
     );
+    suppressRules(
+      logBucket,
+      ['CKV_AWS_18'],
+      'Server access logs are delivered to CloudWatch Logs',
+    );
+    this.deliverAccessLogsToCloudWatch('Distribution', logBucket, accessLogs);
+
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy:
+              HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
 
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
       'CloudfrontDistribution',
       {
-        webAclId: wafStack.wafArn,
+        webAclId: wafStack?.wafArn,
         enableLogging: true,
         logBucket: logBucket,
+        ...(certificate
+          ? {
+              certificate,
+              domainNames,
+              minimumProtocolVersion: SecurityPolicyProtocol.TLS_V1_2_2021,
+            }
+          : {}),
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -1621,16 +2008,31 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
-    suppressRules(
-      this.cloudFrontDistribution,
-      ['CKV_AWS_174'],
-      'Cloudfront default certificate does not use TLS 1.2',
-    );
+    if (!certificate) {
+      // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
+      suppressRules(
+        this.cloudFrontDistribution,
+        ['CKV_AWS_174'],
+        'Cloudfront default certificate does not use TLS 1.2',
+      );
+    }
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      // Exclude the runtime config from this deployment's sync so its default pruning
+      // never deletes the file managed separately by RuntimeConfigDeployment below.
+      exclude: [DEFAULT_RUNTIME_CONFIG_FILENAME],
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -1642,8 +2044,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 
@@ -1664,6 +2067,48 @@ export class StaticWebsite extends Construct {
       value: this.websiteBucket.bucketName,
     });
   }
+
+  /**
+   * Delivers a bucket's S3 server access logs to a CloudWatch log group using
+   * CloudWatch Logs vended log delivery.
+   */
+  private deliverAccessLogsToCloudWatch(
+    id: string,
+    bucket: IBucket,
+    logGroup: LogGroup,
+  ) {
+    const source: CfnDeliverySource = new CfnDeliverySource(
+      this,
+      \`\${id}AccessLogsSource\`,
+      {
+        name: Lazy.string({
+          produce: () => Names.uniqueResourceName(source, { maxLength: 60 }),
+        }),
+        logType: 'S3_SERVER_ACCESS_LOGS',
+        resourceArn: bucket.bucketArn,
+      },
+    );
+    const bucketPolicy = (bucket as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
+    const destination: CfnDeliveryDestination = new CfnDeliveryDestination(
+      this,
+      \`\${id}AccessLogsDestination\`,
+      {
+        name: Lazy.string({
+          produce: () =>
+            Names.uniqueResourceName(destination, { maxLength: 60 }),
+        }),
+        destinationResourceArn: logGroup.logGroupArn,
+      },
+    );
+    const delivery = new CfnDelivery(this, \`\${id}AccessLogsDelivery\`, {
+      deliverySourceName: source.name,
+      deliveryDestinationArn: destination.attrArn,
+    });
+    delivery.addDependency(source);
+  }
 }
 
 export class CloudfrontWebAcl extends Stack {
@@ -1786,9 +2231,13 @@ exports[`react-website generator > Tanstack router integration > should generate
     "emitDeclarationOnly": false,
     "module": "nodenext",
     "moduleResolution": "nodenext",
-    "types": ["node"]
+    "types": [
+      "node"
+    ]
   },
-  "include": ["src/**/*.ts"],
+  "include": [
+    "src/**/*.ts"
+  ],
   "references": [],
   "exclude": [
     "vite.config.ts",
@@ -1851,7 +2300,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 "import { defineConfig } from 'vitest/config';
 
 export default defineConfig(() => ({
-  root: __dirname,
+  root: import.meta.dirname,
   cacheDir: '../../../node_modules/.vite/packages/common/constructs',
   test: {
     passWithNoTests: true,
@@ -1862,7 +2311,8 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory:
+        '../../../dist/packages/common/constructs/test-output/vitest/coverage',
       provider: 'v8' as const,
     },
   },
@@ -1872,9 +2322,25 @@ export default defineConfig(() => ({
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > pnpm-workspace.yaml 1`] = `
 "packages:
-  - "packages/*"
-  - "test-app"
-  - "packages/common/*"
+  - packages/*
+  - test-app
+  - packages/common/*
+catalog:
+  vite: 8.2.2
+  vitest: 4.1.11
+  '@vitest/coverage-v8': 4.1.11
+  constructs: 10.8.1
+  aws-cdk-lib: 2.266.0
+  '@types/node': 26.4.0
+  react: 19.2.8
+  react-dom: 19.2.8
+  '@cloudscape-design/components': 3.0.1354
+  '@cloudscape-design/board-components': 3.0.220
+  '@cloudscape-design/global-styles': 1.0.67
+  tailwindcss: 4.3.3
+  '@nx/react': 23.1.2
+  '@vitest/ui': 4.1.11
+  '@tailwindcss/vite': 4.3.3
 "
 `;
 
@@ -1884,37 +2350,37 @@ This library was generated with [@aws/nx-plugin](https://github.com/awslabs/nx-p
 
 ## Building
 
-Run \`pnpm nx build @proj/test-app [--skip-nx-cache]\` to build the application.
+Run \`npx nx build @proj/test-app [--skip-nx-cache]\` to build the application.
 
 ## Run dev server
 
-Run \`pnpm nx serve @proj/test-app\`
+Run \`npx nx serve @proj/test-app\`
 
 ## Running unit tests
 
-Run \`pnpm nx test @proj/test-app\` to execute the unit tests via Vitest.
+Run \`npx nx test @proj/test-app\` to execute the unit tests via Vitest.
 
 ### Updating snapshots
 
 To update snapshots, run the following command:
 
-\`pnpm nx test @proj/test-app --configuration=update-snapshot\`
+\`npx nx test @proj/test-app --configuration=update-snapshot\`
 
 ## Run lint
 
-Run \`pnpm nx lint @proj/test-app\`
+Run \`npx nx lint @proj/test-app\`
 
 ### Fixable issues
 
 You can also automatically fix some lint errors by running the following command:
 
-\`pnpm nx lint @proj/test-app --configuration=fix\`
+\`npx nx lint @proj/test-app --configuration=fix\`
 
 ### Runtime config
 
 In order to integrate with cognito or trpc backends, you need to have a \`runtime-config.json\` file in your \`/public\` website directory. You can fetch this is follows:
 
-\`pnpm nx run @proj/test-app:load:runtime-config\`
+\`npx nx load-runtime-config @proj/test-app\`
 
 > [!IMPORTANT]
 > Ensure you have AWS CLI and curl installed
@@ -1948,6 +2414,25 @@ exports[`react-website generator > Tanstack router integration > should generate
 "
 `;
 
+exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > test-app/package.json 1`] = `
+"{
+  "name": "@proj/test-app",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@cloudscape-design/board-components": "catalog:",
+    "@cloudscape-design/components": "catalog:",
+    "@cloudscape-design/global-styles": "catalog:",
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "tailwindcss": "catalog:"
+  },
+  "devDependencies": {}
+}
+"
+`;
+
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > test-app/project.json 1`] = `
 "{
   "name": "@proj/test-app",
@@ -1959,33 +2444,20 @@ exports[`react-website generator > Tanstack router integration > should generate
     "generator": "ts#react-website",
     "ux": "cloudscape",
     "framework": "react",
-    "infra": "cloudfront-s3"
+    "infra": "cloudfront-s3",
+    "tailwind": true,
+    "tanstackRouter": false,
+    "iac": "cdk"
   },
   "targets": {
-    "build": {
-      "dependsOn": ["lint", "compile", "bundle", "test"],
-      "options": {
-        "outputPath": "dist/{projectRoot}/bundle"
-      }
+    "assemble": {
+      "dependsOn": ["compile", "bundle"]
     },
-    "bundle": {
-      "executor": "@nx/vite:build",
-      "outputs": ["{options.outputPath}"],
-      "defaultConfiguration": "production",
-      "options": {
-        "outputPath": "dist/{projectRoot}/bundle"
-      },
-      "configurations": {
-        "development": {
-          "mode": "development"
-        },
-        "production": {
-          "mode": "production"
-        }
-      }
+    "build": {
+      "dependsOn": ["lint", "compile", "test", "bundle"]
     },
     "compile": {
-      "dependsOn": ["bundle"],
+      "dependsOn": ["^compile"],
       "executor": "nx:run-commands",
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/tsc"],
       "options": {
@@ -1993,86 +2465,54 @@ exports[`react-website generator > Tanstack router integration > should generate
         "cwd": "{projectRoot}"
       }
     },
-    "lint": {
+    "dev": {
+      "executor": "nx:run-commands",
+      "continuous": true,
+      "options": {
+        "command": "vite --mode local-dev",
+        "cwd": "{projectRoot}"
+      }
+    },
+    "format": {
       "executor": "nx:run-commands",
       "cache": true,
       "inputs": ["biome"],
       "options": {
-        "command": "biome lint {projectRoot}"
+        "command": "biome format {projectRoot}"
       },
       "configurations": {
         "fix": {
-          "command": "biome check --write {projectRoot}"
+          "command": "biome format --write {projectRoot}"
         },
         "skip-lint": {
           "command": "node -e \\"\\""
         }
       }
     },
-    "load:runtime-config": {
+    "lint": {
       "executor": "nx:run-commands",
-      "metadata": {
-        "description": "Load runtime config from your deployed stack for dev purposes. You must set your AWS CLI credentials whilst calling 'pnpm nx run @proj/test-app:load:runtime-config'"
-      },
-      "options": {
-        "command": "aws s3 cp s3://\`aws cloudformation describe-stacks --query \\"Stacks[?starts_with(StackName, 'proj-')][].Outputs[] | [?contains(OutputKey, 'TestAppWebsiteBucketName')].OutputValue\\" --output text\`/runtime-config.json \\"{projectRoot}/public/runtime-config.json\\""
-      }
-    },
-    "preview": {
-      "dependsOn": ["build"],
-      "executor": "@nx/vite:preview-server",
-      "defaultConfiguration": "development",
+      "cache": true,
+      "inputs": ["biome"],
       "options": {
-        "buildTarget": "@proj/test-app:build"
+        "command": "biome lint {projectRoot}"
       },
       "configurations": {
-        "development": {
-          "buildTarget": "@proj/test-app:build:development"
+        "fix": {
+          "command": "biome check --write {projectRoot}"
         },
-        "production": {
-          "buildTarget": "@proj/test-app:build:production"
+        "skip-lint": {
+          "command": "node -e \\"\\""
         }
-      }
-    },
-    "serve": {
-      "executor": "@nx/vite:dev-server",
-      "defaultConfiguration": "development",
-      "options": {
-        "buildTarget": "@proj/test-app:build"
       },
-      "configurations": {
-        "development": {
-          "buildTarget": "@proj/test-app:build:development",
-          "hmr": true
-        },
-        "production": {
-          "buildTarget": "@proj/test-app:build:production",
-          "hmr": false
-        }
-      }
+      "dependsOn": ["format"]
     },
-    "serve-local": {
-      "executor": "@nx/vite:dev-server",
-      "options": {
-        "buildTarget": "@proj/test-app:build:development",
-        "hmr": true,
-        "mode": "serve-local"
+    "load-runtime-config": {
+      "executor": "nx:run-commands",
+      "metadata": {
+        "description": "Load runtime config from your deployed stack for dev purposes. You must set your AWS CLI credentials whilst calling 'npx nx load-runtime-config @proj/test-app'"
       },
-      "continuous": true
-    },
-    "serve-static": {
-      "executor": "@nx/web:file-server",
-      "dependsOn": ["build"],
       "options": {
-        "buildTarget": "@proj/test-app:build",
-        "spa": true
-      }
-    },
-    "test": {
-      "executor": "@nx/vitest:test",
-      "outputs": ["{options.reportsDirectory}"],
-      "options": {
-        "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
+        "command": "aws s3 cp s3://\`aws cloudformation describe-stacks --query \\"Stacks[?starts_with(StackName, 'proj-')][].Outputs[] | [?contains(OutputKey, 'TestAppWebsiteBucketName')].OutputValue\\" --output text\`/runtime-config.json \\"{projectRoot}/public/runtime-config.json\\""
       }
     }
   }
@@ -2280,15 +2720,22 @@ exports[`react-website generator > Tanstack router integration > should generate
     "outDir": "../dist/test-app/tsc",
     "tsBuildInfoFile": "../dist/test-app/tsc/tsconfig.lib.tsbuildinfo",
     "jsx": "react-jsx",
-    "lib": ["DOM"],
+    "lib": [
+      "DOM"
+    ],
     "types": [
       "node",
       "@nx/react/typings/cssmodule.d.ts",
       "@nx/react/typings/image.d.ts",
       "vite/client"
-    ]
+    ],
+    "rootDir": "src",
+    "module": "esnext",
+    "moduleResolution": "bundler"
   },
   "exclude": [
+    "out-tsc",
+    "dist",
     "src/**/*.spec.ts",
     "src/**/*.test.ts",
     "src/**/*.spec.tsx",
@@ -2302,7 +2749,12 @@ exports[`react-website generator > Tanstack router integration > should generate
     "vitest.config.ts",
     "vitest.config.mts"
   ],
-  "include": ["src/**/*.js", "src/**/*.jsx", "src/**/*.ts", "src/**/*.tsx"]
+  "include": [
+    "src/**/*.js",
+    "src/**/*.jsx",
+    "src/**/*.ts",
+    "src/**/*.tsx"
+  ]
 }
 "
 `;
@@ -2341,7 +2793,10 @@ exports[`react-website generator > Tanstack router integration > should generate
       "vitest",
       "@nx/react/typings/cssmodule.d.ts",
       "@nx/react/typings/image.d.ts"
-    ]
+    ],
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "bundler"
   },
   "include": [
     "vite.config.ts",
@@ -2390,7 +2845,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -2406,11 +2861,11 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../dist/test-app/test-output/vitest/coverage',
       provider: 'v8' as const,
     },
   },
-  resolve: { tsconfigPaths: true },
+  resolve: { tsconfigPaths: true, dedupe: ['react', 'react-dom'] },
   define: { global: {} },
 }));
 "
@@ -2420,9 +2875,14 @@ exports[`react-website generator > Tanstack router integration > should generate
 "{
   "compilerOptions": {
     "paths": {
-      ":proj/test-app": ["./test-app/src/index.ts"],
-      ":proj/common-constructs": ["./packages/common/constructs/src/index.ts"]
+      "@proj/test-app": [
+        "./test-app/src/index.ts"
+      ],
+      "@proj/common-constructs": [
+        "./packages/common/constructs/src/index.ts"
+      ]
     },
+    "composite": true,
     "rootDir": "."
   }
 }
@@ -2431,6 +2891,9 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > tsconfig.json 1`] = `
 "{
+  "extends": "./tsconfig.base.json",
+  "files": [],
+  "include": [],
   "references": [
     {
       "path": "./test-app"
@@ -2443,11 +2906,19 @@ exports[`react-website generator > Tanstack router integration > should generate
 "
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > vitest.workspace.ts 1`] = `
-"export default [
-  '**/vite.config.{mjs,js,ts,mts}',
-  '**/vitest.config.{mjs,js,ts,mts}',
-];
+exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > vitest.config.ts 1`] = `
+"import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    projects: [
+      '**/vite.config.{mjs,js,ts,mts}',
+      '**/vitest.config.{mjs,js,ts,mts}',
+      '!vitest.config.{mjs,js,ts,mts}',
+      '!vite.config.{mjs,js,ts,mts}',
+    ],
+  },
+});
 "
 `;
 
@@ -2463,7 +2934,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > biome.json 1`] = `
 "{
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.10/schema.json",
   "root": true,
   "formatter": {
     "enabled": true,
@@ -2475,6 +2946,9 @@ exports[`react-website generator > Tanstack router integration > should generate
     "formatter": {
       "quoteStyle": "single",
       "trailingCommas": "all"
+    },
+    "resolver": {
+      "experimentalPnpmCatalogs": true
     }
   },
   "css": {
@@ -2488,9 +2962,9 @@ exports[`react-website generator > Tanstack router integration > should generate
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": false,
+      "preset": "none",
       "correctness": {
-        "noUndeclaredDependencies": "warn"
+        "noUndeclaredDependencies": "error"
       }
     }
   },
@@ -2506,12 +2980,33 @@ exports[`react-website generator > Tanstack router integration > should generate
       "**",
       "!**/dist",
       "!**/out-tsc",
+      "!**/test-output",
       "!**/node_modules",
       "!**/.nx",
       "!**/.venv",
-      "!**/*.css"
+      "!**/.grit",
+      "!**/*.css",
+      "!**/*.gen.*",
+      "!**/generated/**",
+      "!**/tsconfig*.json"
     ]
-  }
+  },
+  "overrides": [
+    {
+      "includes": [
+        "**/*.config.{ts,mts,cts,js,mjs,cjs}",
+        "**/*.{spec,test}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}",
+        "**/*.stories.{ts,tsx}"
+      ],
+      "linter": {
+        "rules": {
+          "correctness": {
+            "noUndeclaredDependencies": "off"
+          }
+        }
+      }
+    }
+  ]
 }
 "
 `;
@@ -2524,35 +3019,66 @@ exports[`react-website generator > Tanstack router integration > should generate
   "targetDefaults": {
     "build": {
       "cache": true,
-      "dependsOn": ["^build"],
       "inputs": ["default"]
     },
     "lint": {
       "cache": true
     },
-    "@nx/vite:build": {
-      "cache": true,
+    "test": {
       "dependsOn": ["^build"],
-      "inputs": ["default", "^default"]
+      "inputs": ["default"]
     },
     "@nx/vitest:test": {
       "cache": true,
-      "inputs": ["default", "^default"],
+      "inputs": ["default", "^production"],
       "configurations": {
         "update-snapshot": {
           "args": "--update"
         }
       }
     },
-    "test": {
-      "dependsOn": ["^build"],
-      "inputs": ["default"]
-    },
     "compile": {
       "cache": true,
       "inputs": ["default"]
     }
   },
+  "plugins": [
+    {
+      "plugin": "@nx/js/typescript",
+      "options": {
+        "typecheck": {
+          "targetName": "typecheck"
+        },
+        "build": {
+          "targetName": "compile",
+          "configName": "tsconfig.lib.json",
+          "buildDepsName": "build-deps",
+          "watchDepsName": "watch-deps"
+        }
+      }
+    },
+    {
+      "plugin": "@nx/vite/plugin",
+      "options": {
+        "buildTargetName": "bundle",
+        "serveTargetName": "serve",
+        "devTargetName": "serve",
+        "previewTargetName": "preview",
+        "serveStaticTargetName": "serve-static",
+        "typecheckTargetName": "vite:typecheck",
+        "buildDepsTargetName": "build-deps",
+        "watchDepsTargetName": "watch-deps"
+      }
+    },
+    {
+      "plugin": "@nx/vitest",
+      "options": {
+        "testTargetName": "test",
+        "ciTargetName": "test-ci",
+        "testMode": "watch"
+      }
+    }
+  ],
   "generators": {
     "@nx/react": {
       "application": {
@@ -2574,27 +3100,11 @@ exports[`react-website generator > Tanstack router integration > should generate
     "biome": ["default", "{workspaceRoot}/biome.json"],
     "default": [
       {
-        "dependentTasksOutputFiles": "**/*",
+        "dependentTasksOutputFiles": "!{reports,coverage}/**",
         "transitive": true
       }
     ]
-  },
-  "plugins": [
-    {
-      "plugin": "@nx/js/typescript",
-      "options": {
-        "typecheck": {
-          "targetName": "typecheck"
-        },
-        "build": {
-          "targetName": "compile",
-          "configName": "tsconfig.lib.json",
-          "buildDepsName": "build-deps",
-          "watchDepsName": "watch-deps"
-        }
-      }
-    }
-  ]
+  }
 }
 "
 `;
@@ -2602,48 +3112,43 @@ exports[`react-website generator > Tanstack router integration > should generate
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > package.json 1`] = `
 "{
   "name": "@proj/source",
-  "dependencies": {
-    "@cloudscape-design/board-components": "3.0.189",
-    "@cloudscape-design/components": "3.0.1308",
-    "@cloudscape-design/global-styles": "1.0.59",
-    "@tanstack/react-router": "1.170.15",
-    "aws-cdk-lib": "2.258.0",
-    "constructs": "10.6.0",
-    "react": "19.2.7",
-    "react-dom": "19.2.7",
-    "tailwindcss": "4.2.2"
-  },
+  "dependencies": {},
   "devDependencies": {
-    "@nx/js": "22.7.5",
-    "@nx/react": "22.7.5",
-    "@nx/vite": "22.7.5",
-    "@nx/vitest": "22.7.5",
-    "@nx/web": "22.7.5",
-    "@swc-node/register": "~1.11.1",
-    "@swc/core": "~1.15.5",
+    "@nx/js": "23.1.2",
+    "@nx/react": "catalog:",
+    "@nx/vite": "23.1.2",
+    "@nx/vitest": "23.1.2",
+    "@nx/web": "23.1.2",
     "@swc/helpers": "~0.5.18",
-    "@tailwindcss/vite": "4.2.2",
-    "@tanstack/router-generator": "1.167.17",
-    "@tanstack/router-plugin": "1.168.18",
-    "@tanstack/router-utils": "1.162.2",
-    "@tanstack/virtual-file-routes": "1.162.0",
+    "@tailwindcss/vite": "catalog:",
+    "@tanstack/router-generator": "catalog:",
+    "@tanstack/router-plugin": "catalog:",
+    "@tanstack/router-utils": "catalog:",
+    "@tanstack/virtual-file-routes": "catalog:",
     "@testing-library/dom": "10.4.0",
     "@testing-library/react": "16.3.0",
-    "@types/node": "25.9.2",
+    "@types/node": "catalog:",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^6.0.0",
-    "@vitest/coverage-v8": "4.1.8",
-    "@vitest/ui": "4.1.8",
+    "@vitest/coverage-v8": "catalog:",
+    "@vitest/ui": "catalog:",
     "jiti": "2.4.2",
-    "jsdom": "~22.1.0",
-    "typescript": "~5.9.2",
-    "vite": "8.0.16",
-    "vitest": "4.1.8"
+    "jsdom": "^27.1.0",
+    "typescript": "~6.0.3",
+    "vite": "catalog:",
+    "vitest": "catalog:"
   },
   "type": "module",
-  "scripts": {
-    "dev": "nx serve-local @proj/test-app"
+  "workspaces": [
+    "packages/*",
+    "test-app",
+    "packages/common/constructs"
+  ],
+  "overrides": {
+    "@nx/react": {
+      "express": "5.2.1"
+    }
   }
 }
 "
@@ -2656,27 +3161,27 @@ This library was generated with [@aws/nx-plugin](https://github.com/awslabs/nx-p
 
 ## Building
 
-Run \`pnpm nx build @proj/common-constructs [--skip-nx-cache]\` to build the application.
+Run \`npx nx build @proj/common-constructs [--skip-nx-cache]\` to build the application.
 
 ## Running unit tests
 
-Run \`pnpm nx test @proj/common-constructs\` to execute the unit tests via Vitest.
+Run \`npx nx test @proj/common-constructs\` to execute the unit tests via Vitest.
 
 ### Updating snapshots
 
 To update snapshots, run the following command:
 
-\`pnpm nx test @proj/common-constructs --configuration=update-snapshot\`
+\`npx nx test @proj/common-constructs --configuration=update-snapshot\`
 
 ## Run lint
 
-Run \`pnpm nx lint @proj/common-constructs\`
+Run \`npx nx lint @proj/common-constructs\`
 
 ### Fixable issues
 
 You can also automatiaclly fix some lint errors by running the following command:
 
-\`pnpm nx lint @proj/common-constructs --configuration=fix\`
+\`npx nx lint @proj/common-constructs --configuration=fix\`
 
 ## Useful links
 
@@ -2686,6 +3191,24 @@ You can also automatiaclly fix some lint errors by running the following command
 "
 `;
 
+exports[`react-website generator > Tanstack router integration > should generate website with router correctly > packages/common/constructs/package.json 1`] = `
+"{
+  "name": "@proj/common-constructs",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "aws-cdk-lib": "catalog:",
+    "constructs": "catalog:",
+    "tslib": "^2.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:"
+  }
+}
+"
+`;
+
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > packages/common/constructs/project.json 1`] = `
 "{
   "name": "@proj/common-constructs",
@@ -2697,6 +3220,9 @@ exports[`react-website generator > Tanstack router integration > should generate
     "generator": "ts#project"
   },
   "targets": {
+    "assemble": {
+      "dependsOn": ["compile", "@proj/test-app:assemble"]
+    },
     "build": {
       "dependsOn": ["lint", "compile", "test", "@proj/test-app:build"]
     },
@@ -2704,14 +3230,31 @@ exports[`react-website generator > Tanstack router integration > should generate
       "executor": "nx:run-commands",
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/tsc"],
       "options": {
-        "command": "tsc --build tsconfig.lib.json",
-        "cwd": "{projectRoot}"
+        "command": "tsc --build tsconfig.lib.json",
+        "cwd": "{projectRoot}"
+      }
+    },
+    "format": {
+      "executor": "nx:run-commands",
+      "cache": true,
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome format {projectRoot}"
+      },
+      "configurations": {
+        "fix": {
+          "command": "biome format --write {projectRoot}"
+        },
+        "skip-lint": {
+          "command": "node -e \\"\\""
+        }
       }
     },
     "lint": {
       "executor": "nx:run-commands",
       "cache": true,
       "inputs": ["biome"],
+      "dependsOn": ["format"],
       "options": {
         "command": "biome lint {projectRoot}"
       },
@@ -2723,13 +3266,6 @@ exports[`react-website generator > Tanstack router integration > should generate
           "command": "node -e \\"\\""
         }
       }
-    },
-    "test": {
-      "executor": "@nx/vitest:test",
-      "outputs": ["{options.reportsDirectory}"],
-      "options": {
-        "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
-      }
     }
   }
 }
@@ -2749,11 +3285,17 @@ exports[`react-website generator > Tanstack router integration > should generate
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > packages/common/constructs/src/app/static-websites/test-app.ts 1`] = `
 "import * as url from 'url';
 import { Construct } from 'constructs';
-import { StaticWebsite } from '../../core/index.js';
+import { StaticWebsite, StaticWebsiteProps } from '../../core/index.js';
+
+export type TestAppProps = Omit<
+  StaticWebsiteProps,
+  'websiteName' | 'websiteFilePath'
+>;
 
 export class TestApp extends StaticWebsite {
-  constructor(scope: Construct, id: string) {
+  constructor(scope: Construct, id: string, props?: TestAppProps) {
     super(scope, id, {
+      ...props,
       websiteName: 'TestApp',
       websiteFilePath: url.fileURLToPath(
         new URL('../../../../../../dist/test-app/bundle', import.meta.url),
@@ -2841,10 +3383,31 @@ export const suppressRules = (
 "
 `;
 
+exports[`react-website generator > Tanstack router integration > should generate website with router correctly > packages/common/constructs/src/core/cloudfront.ts 1`] = `
+"import { CfnDistribution, Distribution } from 'aws-cdk-lib/aws-cloudfront';
+
+/**
+ * Finds the domain names associated with a CloudFront distribution.
+ *
+ * Includes the distribution's default \`*.cloudfront.net\` domain name plus any custom
+ * domain names (aliases) configured on it.
+ */
+export const findCloudFrontDomainNames = (
+  distribution: Distribution,
+): string[] => {
+  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;
+  const distributionConfig =
+    cfnDistribution.distributionConfig as CfnDistribution.DistributionConfigProperty;
+  return [distribution.domainName, ...(distributionConfig.aliases ?? [])];
+};
+"
+`;
+
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > packages/common/constructs/src/core/index.ts 1`] = `
 "export * from './static-website.js';
 export * from './app.js';
 export * from './checkov.js';
+export * from './cloudfront.js';
 export * from './runtime-config.js';
 export * from './workspace.js';
 "
@@ -3040,11 +3603,21 @@ exports[`react-website generator > Tanstack router integration > should generate
 "import {
   CfnOutput,
   CfnResource,
+  Duration,
   Lazy,
+  Names,
   RemovalPolicy,
   Stack,
 } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  SecurityPolicyProtocol,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
+import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -3053,18 +3626,83 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
-import { Key } from 'aws-cdk-lib/aws-kms';
+import { IKey, Key } from 'aws-cdk-lib/aws-kms';
+import {
+  CfnDelivery,
+  CfnDeliveryDestination,
+  CfnDeliverySource,
+  LogGroup,
+  RetentionDays,
+} from 'aws-cdk-lib/aws-logs';
+import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { CfnWebACL } from 'aws-cdk-lib/aws-wafv2';
 import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
+  /**
+   * Custom domain names for the CloudFront distribution. Requires \`certificate\`.
+   */
+  readonly domainNames?: string[];
+  /**
+   * ACM certificate for the custom domain names. Must be in us-east-1.
+   * When provided, viewers are required to use TLS 1.2 or later.
+   */
+  readonly certificate?: ICertificate;
+  /**
+   * Whether to protect the CloudFront distribution with an AWS WAF Web ACL.
+   *
+   * @default true
+   */
+  readonly enableWaf?: boolean;
+  /**
+   * Server-side encryption for the website and distribution log buckets.
+   *
+   * @default BucketEncryption.KMS
+   */
+  readonly encryption?: BucketEncryption;
+  /**
+   * KMS key used to encrypt the website and distribution log buckets. Only used when \`encryption\` is
+   * \`BucketEncryption.KMS\`. When not provided, a new key is created. Note that a key imported via
+   * \`Key.fromKeyArn\` must already grant the CloudWatch Logs, S3 and CloudFront service principals the
+   * necessary permissions in its own key policy - \`addToResourcePolicy\` is a no-op on an imported key,
+   * so this construct cannot grant them on your behalf.
+   */
+  readonly encryptionKey?: IKey;
+  /**
+   * Whether the automatically created KMS key has rotation enabled. Only applies when \`encryption\` is
+   * \`BucketEncryption.KMS\` and no \`encryptionKey\` is supplied.
+   *
+   * @default true
+   */
+  readonly enableKeyRotation?: boolean;
 }
 
 /**
@@ -3083,39 +3721,53 @@ export class StaticWebsite extends Construct {
   constructor(
     scope: Construct,
     id: string,
-    { websiteFilePath, websiteName }: StaticWebsiteProps,
+    {
+      websiteFilePath,
+      websiteName,
+      domainNames,
+      certificate,
+      enableWaf = true,
+      encryption = BucketEncryption.KMS,
+      encryptionKey,
+      enableKeyRotation = true,
+    }: StaticWebsiteProps,
   ) {
     super(scope, id);
-    this.node.setContext(
-      '@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy',
-      true,
-    );
 
-    const websiteKey = new Key(this, 'WebsiteKey', {
-      enableKeyRotation: true,
-    });
+    const websiteKey: IKey | undefined =
+      encryption === BucketEncryption.KMS
+        ? (encryptionKey ?? new Key(this, 'WebsiteKey', { enableKeyRotation }))
+        : undefined;
+
+    // Allow CloudWatch Logs to use the website key for server access log delivery.
+    const stack = Stack.of(this);
+    websiteKey?.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [
+          new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
+        ],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnLike: {
+            'kms:EncryptionContext:aws:logs:arn': \`arn:aws:logs:\${stack.region}:\${stack.account}:log-group:*\`,
+          },
+        },
+      }),
+    );
 
-    const accessLogsBucket = new Bucket(this, 'AccessLogsBucket', {
-      versioned: false,
-      enforceSSL: true,
-      autoDeleteObjects: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
       encryptionKey: websiteKey,
-      objectOwnership: ObjectOwnership.OBJECT_WRITER,
-      publicReadAccess: false,
-      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+      removalPolicy: RemovalPolicy.DESTROY,
     });
-    suppressRules(
-      accessLogsBucket,
-      ['CKV_AWS_21'],
-      'Access log bucket does not need versioning enabled',
-    );
-    suppressRules(
-      accessLogsBucket,
-      ['CKV_AWS_18'],
-      'Access log bucket does not need an access log bucket',
-    );
 
     // S3 Bucket to hold website files
     this.websiteBucket = new Bucket(this, 'WebsiteBucket', {
@@ -3123,47 +3775,99 @@ export class StaticWebsite extends Construct {
       enforceSSL: true,
       autoDeleteObjects: true,
       removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+      encryption,
       encryptionKey: websiteKey,
       objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
       publicReadAccess: false,
       blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-      serverAccessLogsPrefix: 'website-access-logs',
-      serverAccessLogsBucket: accessLogsBucket,
     });
+    suppressRules(
+      this.websiteBucket,
+      ['CKV_AWS_18'],
+      'Server access logs are delivered to CloudWatch Logs',
+    );
+    this.deliverAccessLogsToCloudWatch(
+      'Website',
+      this.websiteBucket,
+      accessLogs,
+    );
     // Web ACL
-    const wafStack = new CloudfrontWebAcl(this, 'waf');
+    const wafStack = enableWaf ? new CloudfrontWebAcl(this, 'waf') : undefined;
 
-    // Cloudfront Distribution
+    // Bucket holding CloudFront standard access logs. CloudFront delivers its
+    // own logs to S3 only, so this bucket is retained; its S3 server access
+    // logs are delivered to CloudWatch Logs.
     const logBucket = new Bucket(this, 'DistributionLogBucket', {
       enforceSSL: true,
       autoDeleteObjects: true,
       removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+      encryption,
       encryptionKey: websiteKey,
       objectOwnership: ObjectOwnership.BUCKET_OWNER_PREFERRED,
       publicReadAccess: false,
       blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-      serverAccessLogsPrefix: 'distribution-access-logs',
-      serverAccessLogsBucket: accessLogsBucket,
     });
     suppressRules(
       logBucket,
       ['CKV_AWS_21'],
       'Distribution log bucket does not need versioning enabled',
     );
+    suppressRules(
+      logBucket,
+      ['CKV_AWS_18'],
+      'Server access logs are delivered to CloudWatch Logs',
+    );
+    this.deliverAccessLogsToCloudWatch('Distribution', logBucket, accessLogs);
+
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy:
+              HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
 
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
       'CloudfrontDistribution',
       {
-        webAclId: wafStack.wafArn,
+        webAclId: wafStack?.wafArn,
         enableLogging: true,
         logBucket: logBucket,
+        ...(certificate
+          ? {
+              certificate,
+              domainNames,
+              minimumProtocolVersion: SecurityPolicyProtocol.TLS_V1_2_2021,
+            }
+          : {}),
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -3180,16 +3884,31 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
-    suppressRules(
-      this.cloudFrontDistribution,
-      ['CKV_AWS_174'],
-      'Cloudfront default certificate does not use TLS 1.2',
-    );
+    if (!certificate) {
+      // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
+      suppressRules(
+        this.cloudFrontDistribution,
+        ['CKV_AWS_174'],
+        'Cloudfront default certificate does not use TLS 1.2',
+      );
+    }
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      // Exclude the runtime config from this deployment's sync so its default pruning
+      // never deletes the file managed separately by RuntimeConfigDeployment below.
+      exclude: [DEFAULT_RUNTIME_CONFIG_FILENAME],
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -3201,8 +3920,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 
@@ -3223,6 +3943,48 @@ export class StaticWebsite extends Construct {
       value: this.websiteBucket.bucketName,
     });
   }
+
+  /**
+   * Delivers a bucket's S3 server access logs to a CloudWatch log group using
+   * CloudWatch Logs vended log delivery.
+   */
+  private deliverAccessLogsToCloudWatch(
+    id: string,
+    bucket: IBucket,
+    logGroup: LogGroup,
+  ) {
+    const source: CfnDeliverySource = new CfnDeliverySource(
+      this,
+      \`\${id}AccessLogsSource\`,
+      {
+        name: Lazy.string({
+          produce: () => Names.uniqueResourceName(source, { maxLength: 60 }),
+        }),
+        logType: 'S3_SERVER_ACCESS_LOGS',
+        resourceArn: bucket.bucketArn,
+      },
+    );
+    const bucketPolicy = (bucket as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
+    const destination: CfnDeliveryDestination = new CfnDeliveryDestination(
+      this,
+      \`\${id}AccessLogsDestination\`,
+      {
+        name: Lazy.string({
+          produce: () =>
+            Names.uniqueResourceName(destination, { maxLength: 60 }),
+        }),
+        destinationResourceArn: logGroup.logGroupArn,
+      },
+    );
+    const delivery = new CfnDelivery(this, \`\${id}AccessLogsDelivery\`, {
+      deliverySourceName: source.name,
+      deliveryDestinationArn: destination.attrArn,
+    });
+    delivery.addDependency(source);
+  }
 }
 
 export class CloudfrontWebAcl extends Stack {
@@ -3345,9 +4107,13 @@ exports[`react-website generator > Tanstack router integration > should generate
     "emitDeclarationOnly": false,
     "module": "nodenext",
     "moduleResolution": "nodenext",
-    "types": ["node"]
+    "types": [
+      "node"
+    ]
   },
-  "include": ["src/**/*.ts"],
+  "include": [
+    "src/**/*.ts"
+  ],
   "references": [],
   "exclude": [
     "vite.config.ts",
@@ -3410,7 +4176,7 @@ exports[`react-website generator > Tanstack router integration > should generate
 "import { defineConfig } from 'vitest/config';
 
 export default defineConfig(() => ({
-  root: __dirname,
+  root: import.meta.dirname,
   cacheDir: '../../../node_modules/.vite/packages/common/constructs',
   test: {
     passWithNoTests: true,
@@ -3421,7 +4187,8 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory:
+        '../../../dist/packages/common/constructs/test-output/vitest/coverage',
       provider: 'v8' as const,
     },
   },
@@ -3431,9 +4198,30 @@ export default defineConfig(() => ({
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > pnpm-workspace.yaml 1`] = `
 "packages:
-  - "packages/*"
-  - "test-app"
-  - "packages/common/*"
+  - packages/*
+  - test-app
+  - packages/common/*
+catalog:
+  vite: 8.2.2
+  vitest: 4.1.11
+  '@vitest/coverage-v8': 4.1.11
+  constructs: 10.8.1
+  aws-cdk-lib: 2.266.0
+  '@types/node': 26.4.0
+  react: 19.2.8
+  react-dom: 19.2.8
+  '@cloudscape-design/components': 3.0.1354
+  '@cloudscape-design/board-components': 3.0.220
+  '@cloudscape-design/global-styles': 1.0.67
+  tailwindcss: 4.3.3
+  '@tanstack/react-router': 1.170.32
+  '@nx/react': 23.1.2
+  '@vitest/ui': 4.1.11
+  '@tailwindcss/vite': 4.3.3
+  '@tanstack/router-plugin': 1.168.35
+  '@tanstack/router-generator': 1.167.33
+  '@tanstack/virtual-file-routes': 1.162.0
+  '@tanstack/router-utils': 1.162.2
 "
 `;
 
@@ -3443,37 +4231,37 @@ This library was generated with [@aws/nx-plugin](https://github.com/awslabs/nx-p
 
 ## Building
 
-Run \`pnpm nx build @proj/test-app [--skip-nx-cache]\` to build the application.
+Run \`npx nx build @proj/test-app [--skip-nx-cache]\` to build the application.
 
 ## Run dev server
 
-Run \`pnpm nx serve @proj/test-app\`
+Run \`npx nx serve @proj/test-app\`
 
 ## Running unit tests
 
-Run \`pnpm nx test @proj/test-app\` to execute the unit tests via Vitest.
+Run \`npx nx test @proj/test-app\` to execute the unit tests via Vitest.
 
 ### Updating snapshots
 
 To update snapshots, run the following command:
 
-\`pnpm nx test @proj/test-app --configuration=update-snapshot\`
+\`npx nx test @proj/test-app --configuration=update-snapshot\`
 
 ## Run lint
 
-Run \`pnpm nx lint @proj/test-app\`
+Run \`npx nx lint @proj/test-app\`
 
 ### Fixable issues
 
 You can also automatically fix some lint errors by running the following command:
 
-\`pnpm nx lint @proj/test-app --configuration=fix\`
+\`npx nx lint @proj/test-app --configuration=fix\`
 
 ### Runtime config
 
 In order to integrate with cognito or trpc backends, you need to have a \`runtime-config.json\` file in your \`/public\` website directory. You can fetch this is follows:
 
-\`pnpm nx run @proj/test-app:load:runtime-config\`
+\`npx nx load-runtime-config @proj/test-app\`
 
 > [!IMPORTANT]
 > Ensure you have AWS CLI and curl installed
@@ -3507,6 +4295,26 @@ exports[`react-website generator > Tanstack router integration > should generate
 "
 `;
 
+exports[`react-website generator > Tanstack router integration > should generate website with router correctly > test-app/package.json 1`] = `
+"{
+  "name": "@proj/test-app",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@cloudscape-design/board-components": "catalog:",
+    "@cloudscape-design/components": "catalog:",
+    "@cloudscape-design/global-styles": "catalog:",
+    "@tanstack/react-router": "catalog:",
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "tailwindcss": "catalog:"
+  },
+  "devDependencies": {}
+}
+"
+`;
+
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > test-app/project.json 1`] = `
 "{
   "name": "@proj/test-app",
@@ -3518,33 +4326,20 @@ exports[`react-website generator > Tanstack router integration > should generate
     "generator": "ts#react-website",
     "ux": "cloudscape",
     "framework": "react",
-    "infra": "cloudfront-s3"
+    "infra": "cloudfront-s3",
+    "tailwind": true,
+    "tanstackRouter": true,
+    "iac": "cdk"
   },
   "targets": {
-    "build": {
-      "dependsOn": ["lint", "compile", "bundle", "test"],
-      "options": {
-        "outputPath": "dist/{projectRoot}/bundle"
-      }
+    "assemble": {
+      "dependsOn": ["compile", "bundle"]
     },
-    "bundle": {
-      "executor": "@nx/vite:build",
-      "outputs": ["{options.outputPath}"],
-      "defaultConfiguration": "production",
-      "options": {
-        "outputPath": "dist/{projectRoot}/bundle"
-      },
-      "configurations": {
-        "development": {
-          "mode": "development"
-        },
-        "production": {
-          "mode": "production"
-        }
-      }
+    "build": {
+      "dependsOn": ["lint", "compile", "test", "bundle"]
     },
     "compile": {
-      "dependsOn": ["bundle"],
+      "dependsOn": ["^compile"],
       "executor": "nx:run-commands",
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/tsc"],
       "options": {
@@ -3552,86 +4347,54 @@ exports[`react-website generator > Tanstack router integration > should generate
         "cwd": "{projectRoot}"
       }
     },
-    "lint": {
+    "dev": {
+      "executor": "nx:run-commands",
+      "continuous": true,
+      "options": {
+        "command": "vite --mode local-dev",
+        "cwd": "{projectRoot}"
+      }
+    },
+    "format": {
       "executor": "nx:run-commands",
       "cache": true,
       "inputs": ["biome"],
       "options": {
-        "command": "biome lint {projectRoot}"
+        "command": "biome format {projectRoot}"
       },
       "configurations": {
         "fix": {
-          "command": "biome check --write {projectRoot}"
+          "command": "biome format --write {projectRoot}"
         },
         "skip-lint": {
           "command": "node -e \\"\\""
         }
       }
     },
-    "load:runtime-config": {
+    "lint": {
       "executor": "nx:run-commands",
-      "metadata": {
-        "description": "Load runtime config from your deployed stack for dev purposes. You must set your AWS CLI credentials whilst calling 'pnpm nx run @proj/test-app:load:runtime-config'"
-      },
-      "options": {
-        "command": "aws s3 cp s3://\`aws cloudformation describe-stacks --query \\"Stacks[?starts_with(StackName, 'proj-')][].Outputs[] | [?contains(OutputKey, 'TestAppWebsiteBucketName')].OutputValue\\" --output text\`/runtime-config.json \\"{projectRoot}/public/runtime-config.json\\""
-      }
-    },
-    "preview": {
-      "dependsOn": ["build"],
-      "executor": "@nx/vite:preview-server",
-      "defaultConfiguration": "development",
+      "cache": true,
+      "inputs": ["biome"],
       "options": {
-        "buildTarget": "@proj/test-app:build"
+        "command": "biome lint {projectRoot}"
       },
       "configurations": {
-        "development": {
-          "buildTarget": "@proj/test-app:build:development"
+        "fix": {
+          "command": "biome check --write {projectRoot}"
         },
-        "production": {
-          "buildTarget": "@proj/test-app:build:production"
+        "skip-lint": {
+          "command": "node -e \\"\\""
         }
-      }
-    },
-    "serve": {
-      "executor": "@nx/vite:dev-server",
-      "defaultConfiguration": "development",
-      "options": {
-        "buildTarget": "@proj/test-app:build"
       },
-      "configurations": {
-        "development": {
-          "buildTarget": "@proj/test-app:build:development",
-          "hmr": true
-        },
-        "production": {
-          "buildTarget": "@proj/test-app:build:production",
-          "hmr": false
-        }
-      }
+      "dependsOn": ["format"]
     },
-    "serve-local": {
-      "executor": "@nx/vite:dev-server",
-      "options": {
-        "buildTarget": "@proj/test-app:build:development",
-        "hmr": true,
-        "mode": "serve-local"
+    "load-runtime-config": {
+      "executor": "nx:run-commands",
+      "metadata": {
+        "description": "Load runtime config from your deployed stack for dev purposes. You must set your AWS CLI credentials whilst calling 'npx nx load-runtime-config @proj/test-app'"
       },
-      "continuous": true
-    },
-    "serve-static": {
-      "executor": "@nx/web:file-server",
-      "dependsOn": ["build"],
-      "options": {
-        "buildTarget": "@proj/test-app:build",
-        "spa": true
-      }
-    },
-    "test": {
-      "executor": "@nx/vitest:test",
-      "outputs": ["{options.reportsDirectory}"],
       "options": {
-        "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
+        "command": "aws s3 cp s3://\`aws cloudformation describe-stacks --query \\"Stacks[?starts_with(StackName, 'proj-')][].Outputs[] | [?contains(OutputKey, 'TestAppWebsiteBucketName')].OutputValue\\" --output text\`/runtime-config.json \\"{projectRoot}/public/runtime-config.json\\""
       }
     }
   }
@@ -3917,55 +4680,55 @@ exports[`react-website generator > Tanstack router integration > should generate
 // You should NOT make any changes in this file as it will be overwritten.
 // Additionally, you should also exclude this file from your linter and/or formatter to prevent it from being checked or modified.
 
-import { Route as rootRouteImport } from './routes/__root';
-import { Route as IndexRouteImport } from './routes/index';
+import { Route as rootRouteImport } from './routes/__root'
+import { Route as IndexRouteImport } from './routes/index'
 
 const IndexRoute = IndexRouteImport.update({
   id: '/',
   path: '/',
   getParentRoute: () => rootRouteImport,
-} as any);
+} as any)
 
 export interface FileRoutesByFullPath {
-  '/': typeof IndexRoute;
+  '/': typeof IndexRoute
 }
 export interface FileRoutesByTo {
-  '/': typeof IndexRoute;
+  '/': typeof IndexRoute
 }
 export interface FileRoutesById {
-  __root__: typeof rootRouteImport;
-  '/': typeof IndexRoute;
+  __root__: typeof rootRouteImport
+  '/': typeof IndexRoute
 }
 export interface FileRouteTypes {
-  fileRoutesByFullPath: FileRoutesByFullPath;
-  fullPaths: '/';
-  fileRoutesByTo: FileRoutesByTo;
-  to: '/';
-  id: '__root__' | '/';
-  fileRoutesById: FileRoutesById;
+  fileRoutesByFullPath: FileRoutesByFullPath
+  fullPaths: '/'
+  fileRoutesByTo: FileRoutesByTo
+  to: '/'
+  id: '__root__' | '/'
+  fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
-  IndexRoute: typeof IndexRoute;
+  IndexRoute: typeof IndexRoute
 }
 
 declare module '@tanstack/react-router' {
   interface FileRoutesByPath {
     '/': {
-      id: '/';
-      path: '/';
-      fullPath: '/';
-      preLoaderRoute: typeof IndexRouteImport;
-      parentRoute: typeof rootRouteImport;
-    };
+      id: '/'
+      path: '/'
+      fullPath: '/'
+      preLoaderRoute: typeof IndexRouteImport
+      parentRoute: typeof rootRouteImport
+    }
   }
 }
 
 const rootRouteChildren: RootRouteChildren = {
   IndexRoute: IndexRoute,
-};
+}
 export const routeTree = rootRouteImport
   ._addFileChildren(rootRouteChildren)
-  ._addFileTypes<FileRouteTypes>();
+  ._addFileTypes<FileRouteTypes>()
 "
 `;
 
@@ -4023,15 +4786,22 @@ exports[`react-website generator > Tanstack router integration > should generate
     "outDir": "../dist/test-app/tsc",
     "tsBuildInfoFile": "../dist/test-app/tsc/tsconfig.lib.tsbuildinfo",
     "jsx": "react-jsx",
-    "lib": ["DOM"],
+    "lib": [
+      "DOM"
+    ],
     "types": [
       "node",
       "@nx/react/typings/cssmodule.d.ts",
       "@nx/react/typings/image.d.ts",
       "vite/client"
-    ]
+    ],
+    "rootDir": "src",
+    "module": "esnext",
+    "moduleResolution": "bundler"
   },
   "exclude": [
+    "out-tsc",
+    "dist",
     "src/**/*.spec.ts",
     "src/**/*.test.ts",
     "src/**/*.spec.tsx",
@@ -4045,7 +4815,12 @@ exports[`react-website generator > Tanstack router integration > should generate
     "vitest.config.ts",
     "vitest.config.mts"
   ],
-  "include": ["src/**/*.js", "src/**/*.jsx", "src/**/*.ts", "src/**/*.tsx"]
+  "include": [
+    "src/**/*.js",
+    "src/**/*.jsx",
+    "src/**/*.ts",
+    "src/**/*.tsx"
+  ]
 }
 "
 `;
@@ -4084,7 +4859,10 @@ exports[`react-website generator > Tanstack router integration > should generate
       "vitest",
       "@nx/react/typings/cssmodule.d.ts",
       "@nx/react/typings/image.d.ts"
-    ]
+    ],
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "bundler"
   },
   "include": [
     "vite.config.ts",
@@ -4131,8 +4909,8 @@ export default defineConfig(() => ({
   },
   plugins: [
     tanstackRouter({
-      routesDirectory: resolve(__dirname, 'src/routes'),
-      generatedRouteTree: resolve(__dirname, 'src/routeTree.gen.ts'),
+      routesDirectory: resolve(import.meta.dirname, 'src/routes'),
+      generatedRouteTree: resolve(import.meta.dirname, 'src/routeTree.gen.ts'),
     }),
     react(),
     tailwindcss(),
@@ -4142,7 +4920,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -4158,11 +4936,11 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../dist/test-app/test-output/vitest/coverage',
       provider: 'v8' as const,
     },
   },
-  resolve: { tsconfigPaths: true },
+  resolve: { tsconfigPaths: true, dedupe: ['react', 'react-dom'] },
   define: { global: {} },
 }));
 "
@@ -4172,9 +4950,14 @@ exports[`react-website generator > Tanstack router integration > should generate
 "{
   "compilerOptions": {
     "paths": {
-      ":proj/test-app": ["./test-app/src/index.ts"],
-      ":proj/common-constructs": ["./packages/common/constructs/src/index.ts"]
+      "@proj/test-app": [
+        "./test-app/src/index.ts"
+      ],
+      "@proj/common-constructs": [
+        "./packages/common/constructs/src/index.ts"
+      ]
     },
+    "composite": true,
     "rootDir": "."
   }
 }
@@ -4183,6 +4966,9 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > tsconfig.json 1`] = `
 "{
+  "extends": "./tsconfig.base.json",
+  "files": [],
+  "include": [],
   "references": [
     {
       "path": "./test-app"
@@ -4195,11 +4981,19 @@ exports[`react-website generator > Tanstack router integration > should generate
 "
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with router correctly > vitest.workspace.ts 1`] = `
-"export default [
-  '**/vite.config.{mjs,js,ts,mts}',
-  '**/vitest.config.{mjs,js,ts,mts}',
-];
+exports[`react-website generator > Tanstack router integration > should generate website with router correctly > vitest.config.ts 1`] = `
+"import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    projects: [
+      '**/vite.config.{mjs,js,ts,mts}',
+      '**/vitest.config.{mjs,js,ts,mts}',
+      '!vitest.config.{mjs,js,ts,mts}',
+      '!vite.config.{mjs,js,ts,mts}',
+    ],
+  },
+});
 "
 `;
 
@@ -4244,8 +5038,8 @@ export default defineConfig(() => ({
   },
   plugins: [
     tanstackRouter({
-      routesDirectory: resolve(__dirname, 'src/routes'),
-      generatedRouteTree: resolve(__dirname, 'src/routeTree.gen.ts'),
+      routesDirectory: resolve(import.meta.dirname, 'src/routes'),
+      generatedRouteTree: resolve(import.meta.dirname, 'src/routeTree.gen.ts'),
     }),
     react(),
     tailwindcss(),
@@ -4255,7 +5049,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -4271,11 +5065,11 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../dist/test-app/test-output/vitest/coverage',
       provider: 'v8' as const,
     },
   },
-  resolve: { tsconfigPaths: true },
+  resolve: { tsconfigPaths: true, dedupe: ['react', 'react-dom'] },
   define: { global: {} },
 }));
 "
@@ -4520,6 +5314,7 @@ exports[`react-website generator > should generate shared constructs > common/co
 "export * from './static-website.js';
 export * from './app.js';
 export * from './checkov.js';
+export * from './cloudfront.js';
 export * from './runtime-config.js';
 export * from './workspace.js';
 "
@@ -4529,11 +5324,21 @@ exports[`react-website generator > should generate shared constructs > common/co
 "import {
   CfnOutput,
   CfnResource,
+  Duration,
   Lazy,
+  Names,
   RemovalPolicy,
   Stack,
 } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  SecurityPolicyProtocol,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
+import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -4542,18 +5347,83 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
-import { Key } from 'aws-cdk-lib/aws-kms';
+import { IKey, Key } from 'aws-cdk-lib/aws-kms';
+import {
+  CfnDelivery,
+  CfnDeliveryDestination,
+  CfnDeliverySource,
+  LogGroup,
+  RetentionDays,
+} from 'aws-cdk-lib/aws-logs';
+import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { CfnWebACL } from 'aws-cdk-lib/aws-wafv2';
 import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
+  /**
+   * Custom domain names for the CloudFront distribution. Requires \`certificate\`.
+   */
+  readonly domainNames?: string[];
+  /**
+   * ACM certificate for the custom domain names. Must be in us-east-1.
+   * When provided, viewers are required to use TLS 1.2 or later.
+   */
+  readonly certificate?: ICertificate;
+  /**
+   * Whether to protect the CloudFront distribution with an AWS WAF Web ACL.
+   *
+   * @default true
+   */
+  readonly enableWaf?: boolean;
+  /**
+   * Server-side encryption for the website and distribution log buckets.
+   *
+   * @default BucketEncryption.KMS
+   */
+  readonly encryption?: BucketEncryption;
+  /**
+   * KMS key used to encrypt the website and distribution log buckets. Only used when \`encryption\` is
+   * \`BucketEncryption.KMS\`. When not provided, a new key is created. Note that a key imported via
+   * \`Key.fromKeyArn\` must already grant the CloudWatch Logs, S3 and CloudFront service principals the
+   * necessary permissions in its own key policy - \`addToResourcePolicy\` is a no-op on an imported key,
+   * so this construct cannot grant them on your behalf.
+   */
+  readonly encryptionKey?: IKey;
+  /**
+   * Whether the automatically created KMS key has rotation enabled. Only applies when \`encryption\` is
+   * \`BucketEncryption.KMS\` and no \`encryptionKey\` is supplied.
+   *
+   * @default true
+   */
+  readonly enableKeyRotation?: boolean;
 }
 
 /**
@@ -4572,39 +5442,53 @@ export class StaticWebsite extends Construct {
   constructor(
     scope: Construct,
     id: string,
-    { websiteFilePath, websiteName }: StaticWebsiteProps,
+    {
+      websiteFilePath,
+      websiteName,
+      domainNames,
+      certificate,
+      enableWaf = true,
+      encryption = BucketEncryption.KMS,
+      encryptionKey,
+      enableKeyRotation = true,
+    }: StaticWebsiteProps,
   ) {
     super(scope, id);
-    this.node.setContext(
-      '@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy',
-      true,
-    );
 
-    const websiteKey = new Key(this, 'WebsiteKey', {
-      enableKeyRotation: true,
-    });
+    const websiteKey: IKey | undefined =
+      encryption === BucketEncryption.KMS
+        ? (encryptionKey ?? new Key(this, 'WebsiteKey', { enableKeyRotation }))
+        : undefined;
+
+    // Allow CloudWatch Logs to use the website key for server access log delivery.
+    const stack = Stack.of(this);
+    websiteKey?.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [
+          new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
+        ],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnLike: {
+            'kms:EncryptionContext:aws:logs:arn': \`arn:aws:logs:\${stack.region}:\${stack.account}:log-group:*\`,
+          },
+        },
+      }),
+    );
 
-    const accessLogsBucket = new Bucket(this, 'AccessLogsBucket', {
-      versioned: false,
-      enforceSSL: true,
-      autoDeleteObjects: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+    const accessLogs = new LogGroup(this, 'AccessLogs', {
+      retention: RetentionDays.ONE_YEAR,
       encryptionKey: websiteKey,
-      objectOwnership: ObjectOwnership.OBJECT_WRITER,
-      publicReadAccess: false,
-      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+      removalPolicy: RemovalPolicy.DESTROY,
     });
-    suppressRules(
-      accessLogsBucket,
-      ['CKV_AWS_21'],
-      'Access log bucket does not need versioning enabled',
-    );
-    suppressRules(
-      accessLogsBucket,
-      ['CKV_AWS_18'],
-      'Access log bucket does not need an access log bucket',
-    );
 
     // S3 Bucket to hold website files
     this.websiteBucket = new Bucket(this, 'WebsiteBucket', {
@@ -4612,47 +5496,99 @@ export class StaticWebsite extends Construct {
       enforceSSL: true,
       autoDeleteObjects: true,
       removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+      encryption,
       encryptionKey: websiteKey,
       objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
       publicReadAccess: false,
       blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-      serverAccessLogsPrefix: 'website-access-logs',
-      serverAccessLogsBucket: accessLogsBucket,
     });
+    suppressRules(
+      this.websiteBucket,
+      ['CKV_AWS_18'],
+      'Server access logs are delivered to CloudWatch Logs',
+    );
+    this.deliverAccessLogsToCloudWatch(
+      'Website',
+      this.websiteBucket,
+      accessLogs,
+    );
     // Web ACL
-    const wafStack = new CloudfrontWebAcl(this, 'waf');
+    const wafStack = enableWaf ? new CloudfrontWebAcl(this, 'waf') : undefined;
 
-    // Cloudfront Distribution
+    // Bucket holding CloudFront standard access logs. CloudFront delivers its
+    // own logs to S3 only, so this bucket is retained; its S3 server access
+    // logs are delivered to CloudWatch Logs.
     const logBucket = new Bucket(this, 'DistributionLogBucket', {
       enforceSSL: true,
       autoDeleteObjects: true,
       removalPolicy: RemovalPolicy.DESTROY,
-      encryption: BucketEncryption.KMS,
+      encryption,
       encryptionKey: websiteKey,
       objectOwnership: ObjectOwnership.BUCKET_OWNER_PREFERRED,
       publicReadAccess: false,
       blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-      serverAccessLogsPrefix: 'distribution-access-logs',
-      serverAccessLogsBucket: accessLogsBucket,
     });
     suppressRules(
       logBucket,
       ['CKV_AWS_21'],
       'Distribution log bucket does not need versioning enabled',
     );
+    suppressRules(
+      logBucket,
+      ['CKV_AWS_18'],
+      'Server access logs are delivered to CloudWatch Logs',
+    );
+    this.deliverAccessLogsToCloudWatch('Distribution', logBucket, accessLogs);
+
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy:
+              HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
 
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
       'CloudfrontDistribution',
       {
-        webAclId: wafStack.wafArn,
+        webAclId: wafStack?.wafArn,
         enableLogging: true,
         logBucket: logBucket,
+        ...(certificate
+          ? {
+              certificate,
+              domainNames,
+              minimumProtocolVersion: SecurityPolicyProtocol.TLS_V1_2_2021,
+            }
+          : {}),
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -4669,16 +5605,31 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
-    suppressRules(
-      this.cloudFrontDistribution,
-      ['CKV_AWS_174'],
-      'Cloudfront default certificate does not use TLS 1.2',
-    );
+    if (!certificate) {
+      // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
+      suppressRules(
+        this.cloudFrontDistribution,
+        ['CKV_AWS_174'],
+        'Cloudfront default certificate does not use TLS 1.2',
+      );
+    }
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      // Exclude the runtime config from this deployment's sync so its default pruning
+      // never deletes the file managed separately by RuntimeConfigDeployment below.
+      exclude: [DEFAULT_RUNTIME_CONFIG_FILENAME],
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -4690,8 +5641,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 
@@ -4712,6 +5664,48 @@ export class StaticWebsite extends Construct {
       value: this.websiteBucket.bucketName,
     });
   }
+
+  /**
+   * Delivers a bucket's S3 server access logs to a CloudWatch log group using
+   * CloudWatch Logs vended log delivery.
+   */
+  private deliverAccessLogsToCloudWatch(
+    id: string,
+    bucket: IBucket,
+    logGroup: LogGroup,
+  ) {
+    const source: CfnDeliverySource = new CfnDeliverySource(
+      this,
+      \`\${id}AccessLogsSource\`,
+      {
+        name: Lazy.string({
+          produce: () => Names.uniqueResourceName(source, { maxLength: 60 }),
+        }),
+        logType: 'S3_SERVER_ACCESS_LOGS',
+        resourceArn: bucket.bucketArn,
+      },
+    );
+    const bucketPolicy = (bucket as Bucket).policy;
+    if (bucketPolicy) {
+      source.node.addDependency(bucketPolicy);
+    }
+    const destination: CfnDeliveryDestination = new CfnDeliveryDestination(
+      this,
+      \`\${id}AccessLogsDestination\`,
+      {
+        name: Lazy.string({
+          produce: () =>
+            Names.uniqueResourceName(destination, { maxLength: 60 }),
+        }),
+        destinationResourceArn: logGroup.logGroupArn,
+      },
+    );
+    const delivery = new CfnDelivery(this, \`\${id}AccessLogsDelivery\`, {
+      deliverySourceName: source.name,
+      deliveryDestinationArn: destination.attrArn,
+    });
+    delivery.addDependency(source);
+  }
 }
 
 export class CloudfrontWebAcl extends Stack {
@@ -4780,11 +5774,17 @@ export class CloudfrontWebAcl extends Stack {
 exports[`react-website generator > should generate shared constructs > test-app.ts 1`] = `
 "import * as url from 'url';
 import { Construct } from 'constructs';
-import { StaticWebsite } from '../../core/index.js';
+import { StaticWebsite, StaticWebsiteProps } from '../../core/index.js';
+
+export type TestAppProps = Omit<
+  StaticWebsiteProps,
+  'websiteName' | 'websiteFilePath'
+>;
 
 export class TestApp extends StaticWebsite {
-  constructor(scope: Construct, id: string) {
+  constructor(scope: Construct, id: string, props?: TestAppProps) {
     super(scope, id, {
+      ...props,
       websiteName: 'TestApp',
       websiteFilePath: url.fileURLToPath(
         new URL('../../../../../../dist/test-app/bundle', import.meta.url),
@@ -4835,19 +5835,7 @@ root &&
 "
 `;
 
-exports[`react-website generator > should handle npm scope prefix correctly > scoped-dependencies 1`] = `
-{
-  "@cloudscape-design/board-components": "3.0.189",
-  "@cloudscape-design/components": "3.0.1308",
-  "@cloudscape-design/global-styles": "1.0.59",
-  "@tanstack/react-router": "1.170.15",
-  "aws-cdk-lib": "2.258.0",
-  "constructs": "10.6.0",
-  "react": "19.2.7",
-  "react-dom": "19.2.7",
-  "tailwindcss": "4.2.2",
-}
-`;
+exports[`react-website generator > should handle npm scope prefix correctly > scoped-dependencies 1`] = `{}`;
 
 exports[`react-website generator ux tests > Cloudscape > should update package.json with required dependencies > test-app/src/components/AppLayout/index.tsx 1`] = `
 "import * as React from 'react';
@@ -5088,55 +6076,55 @@ exports[`react-website generator ux tests > Cloudscape > should update package.j
 // You should NOT make any changes in this file as it will be overwritten.
 // Additionally, you should also exclude this file from your linter and/or formatter to prevent it from being checked or modified.
 
-import { Route as rootRouteImport } from './routes/__root';
-import { Route as IndexRouteImport } from './routes/index';
+import { Route as rootRouteImport } from './routes/__root'
+import { Route as IndexRouteImport } from './routes/index'
 
 const IndexRoute = IndexRouteImport.update({
   id: '/',
   path: '/',
   getParentRoute: () => rootRouteImport,
-} as any);
+} as any)
 
 export interface FileRoutesByFullPath {
-  '/': typeof IndexRoute;
+  '/': typeof IndexRoute
 }
 export interface FileRoutesByTo {
-  '/': typeof IndexRoute;
+  '/': typeof IndexRoute
 }
 export interface FileRoutesById {
-  __root__: typeof rootRouteImport;
-  '/': typeof IndexRoute;
+  __root__: typeof rootRouteImport
+  '/': typeof IndexRoute
 }
 export interface FileRouteTypes {
-  fileRoutesByFullPath: FileRoutesByFullPath;
-  fullPaths: '/';
-  fileRoutesByTo: FileRoutesByTo;
-  to: '/';
-  id: '__root__' | '/';
-  fileRoutesById: FileRoutesById;
+  fileRoutesByFullPath: FileRoutesByFullPath
+  fullPaths: '/'
+  fileRoutesByTo: FileRoutesByTo
+  to: '/'
+  id: '__root__' | '/'
+  fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
-  IndexRoute: typeof IndexRoute;
+  IndexRoute: typeof IndexRoute
 }
 
 declare module '@tanstack/react-router' {
   interface FileRoutesByPath {
     '/': {
-      id: '/';
-      path: '/';
-      fullPath: '/';
-      preLoaderRoute: typeof IndexRouteImport;
-      parentRoute: typeof rootRouteImport;
-    };
+      id: '/'
+      path: '/'
+      fullPath: '/'
+      preLoaderRoute: typeof IndexRouteImport
+      parentRoute: typeof rootRouteImport
+    }
   }
 }
 
 const rootRouteChildren: RootRouteChildren = {
   IndexRoute: IndexRoute,
-};
+}
 export const routeTree = rootRouteImport
   ._addFileChildren(rootRouteChildren)
-  ._addFileTypes<FileRouteTypes>();
+  ._addFileTypes<FileRouteTypes>()
 "
 `;
 
@@ -5193,8 +6181,8 @@ import {
   SidebarInset,
   SidebarProvider,
   SidebarTrigger,
-} from ':proj/common-shadcn/components/ui/sidebar';
-import { Separator } from ':proj/common-shadcn/components/ui/separator';
+} from '@proj/common-shadcn/components/ui/sidebar';
+import { Separator } from '@proj/common-shadcn/components/ui/separator';
 import Config from '../../config';
 
 import { Link, useLocation, useMatchRoute } from '@tanstack/react-router';
@@ -5205,7 +6193,7 @@ import {
   BreadcrumbList,
   BreadcrumbPage,
   BreadcrumbSeparator,
-} from ':proj/common-shadcn/components/ui/breadcrumb';
+} from '@proj/common-shadcn/components/ui/breadcrumb';
 import { AppSidebar } from '../app-sidebar';
 
 const getBreadcrumbs = (
@@ -5316,7 +6304,7 @@ import {
   Alert as ShadcnAlert,
   AlertDescription,
   AlertTitle,
-} from ':proj/common-shadcn/components/ui/alert';
+} from '@proj/common-shadcn/components/ui/alert';
 
 type AlertType = 'info' | 'error';
 
@@ -5356,7 +6344,7 @@ import {
   SidebarMenu,
   SidebarMenuButton,
   SidebarMenuItem,
-} from ':proj/common-shadcn/components/ui/sidebar';
+} from '@proj/common-shadcn/components/ui/sidebar';
 import { Link } from '@tanstack/react-router';
 
 import Config from '../config';
@@ -5398,7 +6386,7 @@ export function AppSidebar() {
 `;
 
 exports[`react-website generator ux tests > Shadcn > should update package.json with required dependencies > test-app/src/components/spinner.tsx 1`] = `
-"import { Spinner as ShadcnSpinner } from ':proj/common-shadcn/components/ui/spinner';
+"import { Spinner as ShadcnSpinner } from '@proj/common-shadcn/components/ui/spinner';
 
 export const Spinner = ShadcnSpinner;
 "
@@ -5459,55 +6447,55 @@ exports[`react-website generator ux tests > Shadcn > should update package.json
 // You should NOT make any changes in this file as it will be overwritten.
 // Additionally, you should also exclude this file from your linter and/or formatter to prevent it from being checked or modified.
 
-import { Route as rootRouteImport } from './routes/__root';
-import { Route as IndexRouteImport } from './routes/index';
+import { Route as rootRouteImport } from './routes/__root'
+import { Route as IndexRouteImport } from './routes/index'
 
 const IndexRoute = IndexRouteImport.update({
   id: '/',
   path: '/',
   getParentRoute: () => rootRouteImport,
-} as any);
+} as any)
 
 export interface FileRoutesByFullPath {
-  '/': typeof IndexRoute;
+  '/': typeof IndexRoute
 }
 export interface FileRoutesByTo {
-  '/': typeof IndexRoute;
+  '/': typeof IndexRoute
 }
 export interface FileRoutesById {
-  __root__: typeof rootRouteImport;
-  '/': typeof IndexRoute;
+  __root__: typeof rootRouteImport
+  '/': typeof IndexRoute
 }
 export interface FileRouteTypes {
-  fileRoutesByFullPath: FileRoutesByFullPath;
-  fullPaths: '/';
-  fileRoutesByTo: FileRoutesByTo;
-  to: '/';
-  id: '__root__' | '/';
-  fileRoutesById: FileRoutesById;
+  fileRoutesByFullPath: FileRoutesByFullPath
+  fullPaths: '/'
+  fileRoutesByTo: FileRoutesByTo
+  to: '/'
+  id: '__root__' | '/'
+  fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
-  IndexRoute: typeof IndexRoute;
+  IndexRoute: typeof IndexRoute
 }
 
 declare module '@tanstack/react-router' {
   interface FileRoutesByPath {
     '/': {
-      id: '/';
-      path: '/';
-      fullPath: '/';
-      preLoaderRoute: typeof IndexRouteImport;
-      parentRoute: typeof rootRouteImport;
-    };
+      id: '/'
+      path: '/'
+      fullPath: '/'
+      preLoaderRoute: typeof IndexRouteImport
+      parentRoute: typeof rootRouteImport
+    }
   }
 }
 
 const rootRouteChildren: RootRouteChildren = {
   IndexRoute: IndexRoute,
-};
+}
 export const routeTree = rootRouteImport
   ._addFileChildren(rootRouteChildren)
-  ._addFileTypes<FileRouteTypes>();
+  ._addFileTypes<FileRouteTypes>()
 "
 `;