@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/migrations/v1.0.0-rc.83/0002-terraform-data-resource-destroy-protection/migration.js

@@ -0,0 +1,78 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { applyGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Bring existing workspaces up to the destroy protection the generators now
+ * vend on the data-bearing Terraform resources:
+ *
+ * - The DynamoDB table and the Aurora cluster gain
+ *   `lifecycle { prevent_destroy = true }`. This is a second, independent layer
+ *   on top of the service-side `deletion_protection_enabled` /
+ *   `deletion_protection` flags, matching the two guards the CDK constructs
+ *   already have (`deletionProtection` plus `RemovalPolicy.RETAIN`). Without it,
+ *   clearing the service-side flag destroys the data in the same apply.
+ *   `prevent_destroy` cannot reference a variable, so it is vended as a literal
+ *   and removed to tear down.
+ * - Their KMS keys pin `deletion_window_in_days = 30`, the provider maximum and
+ *   the CDK default. Restoring either resource from a point-in-time backup or
+ *   snapshot requires its key, so the window in which a scheduled key deletion
+ *   can still be cancelled matters as much as the backup itself.
+ *
+ * These files are generated with `KeepExisting`, so without this an upgraded
+ * workspace keeps the weaker single-layer protection. Diverged files are left
+ * untouched and reported via `nextSteps`.
+ */ const TERRAFORM_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/dynamodb/dynamodb.tf`;
+const TERRAFORM_AURORA_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/rdb/aurora/aurora.tf`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const divergedMessage = (filePath, resource)=>`${filePath}: has diverged from the generated shape - left untouched. To protect the ${resource} from being destroyed when the service-side deletion protection flag is cleared, add \`lifecycle { prevent_destroy = true }\` to it, and set \`deletion_window_in_days = 30\` on its KMS key.`;
+/**
+ * Add the maximum KMS pending window to a key that omits it, so a scheduled
+ * deletion stays cancellable for as long as the provider allows.
+ */ const migrateKmsKey = async (tree, filePath, keyLabel)=>{
+    const keyBlock = hcl(`\`resource "aws_kms_key" "${keyLabel}" { $props }\``);
+    // Already pinned - nothing to do.
+    if (await matchGritQL(tree, filePath, hcl(`\`resource "aws_kms_key" "${keyLabel}" { $props }\` where { $props <: contains \`deletion_window_in_days = $_\` }`))) {
+        return;
+    }
+    if (!await matchGritQL(tree, filePath, keyBlock)) {
+        return; // Reported by the caller, which matches the data resource too.
+    }
+    await applyGritQL(tree, filePath, hcl(`\`resource "aws_kms_key" "${keyLabel}" { $props }\` where { $props <: contains \`enable_key_rotation = $rotation\` => \`enable_key_rotation = $rotation\n\n  deletion_window_in_days = 30\` }`));
+};
+/**
+ * Add `lifecycle { prevent_destroy = true }` to a data-bearing resource.
+ */ const migrateDataResource = async (tree, filePath, resourceType, resourceLabel, nextSteps, description)=>{
+    const resourceBlock = hcl(`\`resource "${resourceType}" "${resourceLabel}" { $props }\``);
+    if (!await matchGritQL(tree, filePath, resourceBlock)) {
+        nextSteps.push(divergedMessage(filePath, description));
+        return false;
+    }
+    // Already guarded - keep the user's block, whatever it is set to.
+    if (await matchGritQL(tree, filePath, hcl(`\`resource "${resourceType}" "${resourceLabel}" { $props }\` where { $props <: contains \`prevent_destroy = $_\` }`))) {
+        return true;
+    }
+    await applyGritQL(tree, filePath, hcl(`\`resource "${resourceType}" "${resourceLabel}" { $props }\` => \`resource "${resourceType}" "${resourceLabel}" {\n  $props\n\n  lifecycle {\n    prevent_destroy = true\n  }\n}\``));
+    return true;
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (tree.exists(TERRAFORM_DYNAMODB_FILE)) {
+        if (await migrateDataResource(tree, TERRAFORM_DYNAMODB_FILE, 'aws_dynamodb_table', 'table', nextSteps, 'DynamoDB table')) {
+            await migrateKmsKey(tree, TERRAFORM_DYNAMODB_FILE, 'table');
+        }
+    }
+    if (tree.exists(TERRAFORM_AURORA_FILE)) {
+        if (await migrateDataResource(tree, TERRAFORM_AURORA_FILE, 'aws_rds_cluster', 'database', nextSteps, 'Aurora cluster')) {
+            await migrateKmsKey(tree, TERRAFORM_AURORA_FILE, 'database');
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.83/0002-terraform-data-resource-destroy-protection/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.83/0002-terraform-data-resource-destroy-protection/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport { applyGritQL, matchGritQL } from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Bring existing workspaces up to the destroy protection the generators now\n * vend on the data-bearing Terraform resources:\n *\n * - The DynamoDB table and the Aurora cluster gain\n *   `lifecycle { prevent_destroy = true }`. This is a second, independent layer\n *   on top of the service-side `deletion_protection_enabled` /\n *   `deletion_protection` flags, matching the two guards the CDK constructs\n *   already have (`deletionProtection` plus `RemovalPolicy.RETAIN`). Without it,\n *   clearing the service-side flag destroys the data in the same apply.\n *   `prevent_destroy` cannot reference a variable, so it is vended as a literal\n *   and removed to tear down.\n * - Their KMS keys pin `deletion_window_in_days = 30`, the provider maximum and\n *   the CDK default. Restoring either resource from a point-in-time backup or\n *   snapshot requires its key, so the window in which a scheduled key deletion\n *   can still be cancelled matters as much as the backup itself.\n *\n * These files are generated with `KeepExisting`, so without this an upgraded\n * workspace keeps the weaker single-layer protection. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst TERRAFORM_DYNAMODB_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/dynamodb/dynamodb.tf`;\nconst TERRAFORM_AURORA_FILE = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/core/rdb/aurora/aurora.tf`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst divergedMessage = (filePath: string, resource: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To protect the ${resource} from being destroyed when the service-side deletion protection flag is cleared, add \\`lifecycle { prevent_destroy = true }\\` to it, and set \\`deletion_window_in_days = 30\\` on its KMS key.`;\n\n/**\n * Add the maximum KMS pending window to a key that omits it, so a scheduled\n * deletion stays cancellable for as long as the provider allows.\n */\nconst migrateKmsKey = async (\n  tree: Tree,\n  filePath: string,\n  keyLabel: string,\n): Promise<void> => {\n  const keyBlock = hcl(`\\`resource \"aws_kms_key\" \"${keyLabel}\" { $props }\\``);\n\n  // Already pinned - nothing to do.\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`resource \"aws_kms_key\" \"${keyLabel}\" { $props }\\` where { $props <: contains \\`deletion_window_in_days = $_\\` }`,\n      ),\n    )\n  ) {\n    return;\n  }\n\n  if (!(await matchGritQL(tree, filePath, keyBlock))) {\n    return; // Reported by the caller, which matches the data resource too.\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`resource \"aws_kms_key\" \"${keyLabel}\" { $props }\\` where { $props <: contains \\`enable_key_rotation = $rotation\\` => \\`enable_key_rotation = $rotation\\n\\n  deletion_window_in_days = 30\\` }`,\n    ),\n  );\n};\n\n/**\n * Add `lifecycle { prevent_destroy = true }` to a data-bearing resource.\n */\nconst migrateDataResource = async (\n  tree: Tree,\n  filePath: string,\n  resourceType: string,\n  resourceLabel: string,\n  nextSteps: string[],\n  description: string,\n): Promise<boolean> => {\n  const resourceBlock = hcl(\n    `\\`resource \"${resourceType}\" \"${resourceLabel}\" { $props }\\``,\n  );\n\n  if (!(await matchGritQL(tree, filePath, resourceBlock))) {\n    nextSteps.push(divergedMessage(filePath, description));\n    return false;\n  }\n\n  // Already guarded - keep the user's block, whatever it is set to.\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      hcl(\n        `\\`resource \"${resourceType}\" \"${resourceLabel}\" { $props }\\` where { $props <: contains \\`prevent_destroy = $_\\` }`,\n      ),\n    )\n  ) {\n    return true;\n  }\n\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`resource \"${resourceType}\" \"${resourceLabel}\" { $props }\\` => \\`resource \"${resourceType}\" \"${resourceLabel}\" {\\n  $props\\n\\n  lifecycle {\\n    prevent_destroy = true\\n  }\\n}\\``,\n    ),\n  );\n\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (tree.exists(TERRAFORM_DYNAMODB_FILE)) {\n    if (\n      await migrateDataResource(\n        tree,\n        TERRAFORM_DYNAMODB_FILE,\n        'aws_dynamodb_table',\n        'table',\n        nextSteps,\n        'DynamoDB table',\n      )\n    ) {\n      await migrateKmsKey(tree, TERRAFORM_DYNAMODB_FILE, 'table');\n    }\n  }\n\n  if (tree.exists(TERRAFORM_AURORA_FILE)) {\n    if (\n      await migrateDataResource(\n        tree,\n        TERRAFORM_AURORA_FILE,\n        'aws_rds_cluster',\n        'database',\n        nextSteps,\n        'Aurora cluster',\n      )\n    ) {\n      await migrateKmsKey(tree, TERRAFORM_AURORA_FILE, 'database');\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["applyGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DYNAMODB_FILE","TERRAFORM_AURORA_FILE","hcl","pattern","divergedMessage","filePath","resource","migrateKmsKey","tree","keyLabel","keyBlock","migrateDataResource","resourceType","resourceLabel","nextSteps","description","resourceBlock","push","migration","exists"],"mappings":"AAAA;;;CAGC,GAED,SAASA,WAAW,EAAEC,WAAW,QAAQ,wBAAwB;AACjE,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,0BAA0B,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,8BAA8B,CAAC;AACvG,MAAME,wBAAwB,GAAGH,aAAa,CAAC,EAAEC,qBAAqB,8BAA8B,CAAC;AAErG,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,kBAAkB,CAACC,UAAkBC,WACzC,GAAGD,SAAS,yEAAyE,EAAEC,SAAS,6LAA6L,CAAC;AAEhS;;;CAGC,GACD,MAAMC,gBAAgB,OACpBC,MACAH,UACAI;IAEA,MAAMC,WAAWR,IAAI,CAAC,0BAA0B,EAAEO,SAAS,cAAc,CAAC;IAE1E,kCAAkC;IAClC,IACE,MAAMb,YACJY,MACAH,UACAH,IACE,CAAC,0BAA0B,EAAEO,SAAS,4EAA4E,CAAC,IAGvH;QACA;IACF;IAEA,IAAI,CAAE,MAAMb,YAAYY,MAAMH,UAAUK,WAAY;QAClD,QAAQ,+DAA+D;IACzE;IAEA,MAAMf,YACJa,MACAH,UACAH,IACE,CAAC,0BAA0B,EAAEO,SAAS,wJAAwJ,CAAC;AAGrM;AAEA;;CAEC,GACD,MAAME,sBAAsB,OAC1BH,MACAH,UACAO,cACAC,eACAC,WACAC;IAEA,MAAMC,gBAAgBd,IACpB,CAAC,YAAY,EAAEU,aAAa,GAAG,EAAEC,cAAc,cAAc,CAAC;IAGhE,IAAI,CAAE,MAAMjB,YAAYY,MAAMH,UAAUW,gBAAiB;QACvDF,UAAUG,IAAI,CAACb,gBAAgBC,UAAUU;QACzC,OAAO;IACT;IAEA,kEAAkE;IAClE,IACE,MAAMnB,YACJY,MACAH,UACAH,IACE,CAAC,YAAY,EAAEU,aAAa,GAAG,EAAEC,cAAc,oEAAoE,CAAC,IAGxH;QACA,OAAO;IACT;IAEA,MAAMlB,YACJa,MACAH,UACAH,IACE,CAAC,YAAY,EAAEU,aAAa,GAAG,EAAEC,cAAc,8BAA8B,EAAED,aAAa,GAAG,EAAEC,cAAc,oEAAoE,CAAC;IAIxL,OAAO;AACT;AAEA,eAAe,eAAeK,UAC5BV,IAAU;IAEV,MAAMM,YAAsB,EAAE;IAE9B,IAAIN,KAAKW,MAAM,CAACnB,0BAA0B;QACxC,IACE,MAAMW,oBACJH,MACAR,yBACA,sBACA,SACAc,WACA,mBAEF;YACA,MAAMP,cAAcC,MAAMR,yBAAyB;QACrD;IACF;IAEA,IAAIQ,KAAKW,MAAM,CAAClB,wBAAwB;QACtC,IACE,MAAMU,oBACJH,MACAP,uBACA,mBACA,YACAa,WACA,mBAEF;YACA,MAAMP,cAAcC,MAAMP,uBAAuB;QACnD;IACF;IAEA,MAAMJ,qBAAqBW;IAE3B,OAAO;QAAEM;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.83/0003-terraform-gateway-cedar-render-root-ejs/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare ejs at the workspace root so the Terraform gateway's Cedar render script resolves it"
+}

package/src/migrations/v1.0.0-rc.83/0003-terraform-gateway-cedar-render-root-ejs/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.83/0003-terraform-gateway-cedar-render-root-ejs/migration.js

@@ -0,0 +1,38 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { getProjects, joinPathFragments } from "@nx/devkit";
+import { AGENTCORE_GATEWAY_GENERATOR_INFO } from "../../../agentcore-gateway/generator.js";
+import { addDependenciesToPackageJson } from "../../../utils/dependencies.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+import { TS_VERSIONS } from "../../../utils/versions.js";
+/**
+ * Declare `ejs` at the workspace root for Terraform gateways with Cedar
+ * policies, which is where `render-cedar.cjs` resolves it from: the script runs
+ * in the shared terraform project, which has no `package.json` of its own.
+ */ const RENDER_SCRIPT = 'render-cedar.cjs';
+export default async function migration(tree) {
+    const gatewaysDir = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'gateways');
+    let needsRootEjs = false;
+    for (const project of getProjects(tree).values()){
+        const metadata = project.metadata;
+        if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {
+            continue;
+        }
+        // Only a Terraform gateway with Cedar policies vends the render script; a
+        // CDK one resolves ejs from the shared constructs project instead.
+        if (tree.exists(joinPathFragments(gatewaysDir, metadata.name ?? '', RENDER_SCRIPT))) {
+            needsRootEjs = true;
+        }
+    }
+    if (needsRootEjs) {
+        addDependenciesToPackageJson(tree, {}, {
+            ejs: TS_VERSIONS.ejs
+        });
+    }
+    await formatFilesInSubtree(tree);
+    return {};
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.83/0003-terraform-gateway-cedar-render-root-ejs/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.83/0003-terraform-gateway-cedar-render-root-ejs/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { AGENTCORE_GATEWAY_GENERATOR_INFO } from '../../../agentcore-gateway/generator.js';\nimport { addDependenciesToPackageJson } from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Declare `ejs` at the workspace root for Terraform gateways with Cedar\n * policies, which is where `render-cedar.cjs` resolves it from: the script runs\n * in the shared terraform project, which has no `package.json` of its own.\n */\n\nconst RENDER_SCRIPT = 'render-cedar.cjs';\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const gatewaysDir = joinPathFragments(\n    PACKAGES_DIR,\n    SHARED_TERRAFORM_DIR,\n    'src',\n    'app',\n    'gateways',\n  );\n  let needsRootEjs = false;\n\n  for (const project of getProjects(tree).values()) {\n    const metadata = project.metadata as\n      | { generator?: string; name?: string }\n      | undefined;\n    if (metadata?.generator !== AGENTCORE_GATEWAY_GENERATOR_INFO.id) {\n      continue;\n    }\n\n    // Only a Terraform gateway with Cedar policies vends the render script; a\n    // CDK one resolves ejs from the shared constructs project instead.\n    if (\n      tree.exists(\n        joinPathFragments(gatewaysDir, metadata.name ?? '', RENDER_SCRIPT),\n      )\n    ) {\n      needsRootEjs = true;\n    }\n  }\n\n  if (needsRootEjs) {\n    addDependenciesToPackageJson(tree, {}, { ejs: TS_VERSIONS.ejs });\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return {};\n}\n"],"names":["getProjects","joinPathFragments","AGENTCORE_GATEWAY_GENERATOR_INFO","addDependenciesToPackageJson","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TS_VERSIONS","RENDER_SCRIPT","migration","tree","gatewaysDir","needsRootEjs","project","values","metadata","generator","id","exists","name","ejs"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SAASC,4BAA4B,QAAQ,iCAAiC;AAC9E,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AACvD,SAASC,WAAW,QAAQ,6BAA6B;AAEzD;;;;CAIC,GAED,MAAMC,gBAAgB;AAEtB,eAAe,eAAeC,UAC5BC,IAAU;IAEV,MAAMC,cAAcV,kBAClBI,cACAC,sBACA,OACA,OACA;IAEF,IAAIM,eAAe;IAEnB,KAAK,MAAMC,WAAWb,YAAYU,MAAMI,MAAM,GAAI;QAChD,MAAMC,WAAWF,QAAQE,QAAQ;QAGjC,IAAIA,UAAUC,cAAcd,iCAAiCe,EAAE,EAAE;YAC/D;QACF;QAEA,0EAA0E;QAC1E,mEAAmE;QACnE,IACEP,KAAKQ,MAAM,CACTjB,kBAAkBU,aAAaI,SAASI,IAAI,IAAI,IAAIX,iBAEtD;YACAI,eAAe;QACjB;IACF;IAEA,IAAIA,cAAc;QAChBT,6BAA6BO,MAAM,CAAC,GAAG;YAAEU,KAAKb,YAAYa,GAAG;QAAC;IAChE;IAEA,MAAMhB,qBAAqBM;IAE3B,OAAO,CAAC;AACV"}

package/src/migrations/v1.0.0-rc.84/0001-rdb-terraform-aurora-app-module-defaults/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,54 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`rdb-terraform-aurora-app-module-defaults migration > should align the app module defaults with the core module 1`] = `
+"variable "enable_credential_rotation" {
+  description = "Whether to enable automatic credential rotation for the admin secret."
+  type        = bool
+  default     = true
+}
+
+variable "enable_cloudwatch_logs" {
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
+  type        = bool
+  default = true
+}
+
+variable "enable_performance_insights" {
+  description = "Whether to enable Performance Insights on Aurora cluster instances."
+  type        = bool
+  default     = true
+}
+
+variable "enable_backup" {
+  description = "Whether to provision an AWS Backup plan for the Aurora cluster."
+  type        = bool
+  default     = false
+}
+
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
+variable "tags" {
+  description = "Tags to apply to all resources."
+  type        = map(string)
+  default     = {}
+}
+
+module "aurora" {
+  source = "../../../core/rdb/aurora"
+
+  name                        = "my-db"
+  engine                      = "aurora-postgresql"
+  enable_credential_rotation  = var.enable_credential_rotation
+  enable_cloudwatch_logs      = var.enable_cloudwatch_logs
+  enable_performance_insights = var.enable_performance_insights
+  enable_backup               = var.enable_backup
+  tags                        = var.tags
+
+  enable_key_rotation = var.enable_key_rotation
+}
+"
+`;

package/src/migrations/v1.0.0-rc.84/0001-rdb-terraform-aurora-app-module-defaults/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Align the vended Terraform Aurora app module variable defaults with the core module, enabling CloudWatch engine log export and exposing enable_key_rotation"
+}

package/src/migrations/v1.0.0-rc.84/0001-rdb-terraform-aurora-app-module-defaults/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.84/0001-rdb-terraform-aurora-app-module-defaults/migration.js

@@ -0,0 +1,86 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Align each vended per-database Terraform app module
+ * (`app/dbs/<name>/<name>.tf`) with the core Aurora module it wraps.
+ *
+ * The app module is what a root configuration instantiates and it forwards its
+ * own value down, so its default is the one that takes effect:
+ *
+ * - `enable_cloudwatch_logs` defaulted to `false` against the core module's
+ *   `true`, so Aurora exported no engine logs and the cluster parameter group
+ *   that configures them (`log_statement=ddl` on PostgreSQL,
+ *   `server_audit_events=CONNECT,QUERY_DDL` on MySQL) was never created —
+ *   the CDK construct enabled both.
+ * - `enable_key_rotation` was never declared, leaving the core module's
+ *   variable unreachable from a root configuration.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the diverged defaults until this runs. Diverged files are left untouched and
+ * reported via `nextSteps`.
+ */ const TERRAFORM_DBS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const KEY_ROTATION_VARIABLE = [
+    'variable "enable_key_rotation" {',
+    '  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."',
+    '  type        = bool',
+    '  default     = true',
+    '}'
+].join('\n');
+const divergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To export Aurora engine logs to CloudWatch as the CDK construct and the core Terraform module do, default \`enable_cloudwatch_logs\` to true here, and declare an \`enable_key_rotation\` variable (bool, default true) forwarded to the aurora module (see the ts#rdb generator's dbs app template).`;
+const OLD_LOGS_DESCRIPTION = 'Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging.';
+const NEW_LOGS_DESCRIPTION = 'Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data.';
+/**
+ * Flip the app module's `enable_cloudwatch_logs` default to match the core
+ * module, and replace the description that documented the old behaviour.
+ *
+ * Keyed on that description, which is the only thing distinguishing the vended
+ * `default = false` from a user who deliberately turned log export off.
+ */ const migrateCloudwatchLogsDefault = (tree, filePath)=>applyGritQL(tree, filePath, hcl(`\`variable "enable_cloudwatch_logs" { $props }\` where {` + ` $props <: contains \`description = "${OLD_LOGS_DESCRIPTION}"\` => \`description = "${NEW_LOGS_DESCRIPTION}"\`,` + ` $props <: contains \`default = false\` => \`default = true\`` + ` }`));
+/**
+ * Declare `enable_key_rotation` and forward it to the core aurora module, so a
+ * root configuration can reach the variable the core module already exposes.
+ */ const migrateKeyRotationVariable = async (tree, filePath)=>{
+    if (await matchGritQL(tree, filePath, hcl('`variable "enable_key_rotation" { $_ }`'))) {
+        return; // Already declared.
+    }
+    const declared = await insertViaGritQL(tree, filePath, hcl(`\`variable "enable_backup" { $props }\` => \`variable "enable_backup" {\n  $props\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), KEY_ROTATION_VARIABLE);
+    if (!declared) return;
+    // Appended after the existing arguments so their alignment is preserved;
+    // `terraform fmt` re-aligns the block.
+    await applyGritQL(tree, filePath, hcl(`\`module "aurora" { $props }\` => \`module "aurora" {\n  $props\n\n  enable_key_rotation = var.enable_key_rotation\n}\``));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(TERRAFORM_DBS_APP_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform database modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_DBS_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_DBS_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a database app module directory.
+        }
+        // Both edits hang off the shape the generator produces: the two variables
+        // and the module call that forwards them.
+        const recognised = await matchGritQL(tree, filePath, hcl('`variable "enable_cloudwatch_logs" { $_ }`')) && await matchGritQL(tree, filePath, hcl('`variable "enable_backup" { $_ }`')) && await matchGritQL(tree, filePath, hcl('`module "aurora" { $props }` where { $props <: contains `enable_cloudwatch_logs = var.enable_cloudwatch_logs` }'));
+        if (!recognised) {
+            nextSteps.push(divergedMessage(filePath));
+            continue;
+        }
+        await migrateCloudwatchLogsDefault(tree, filePath);
+        await migrateKeyRotationVariable(tree, filePath);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.84/0001-rdb-terraform-aurora-app-module-defaults/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.84/0001-rdb-terraform-aurora-app-module-defaults/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Align each vended per-database Terraform app module\n * (`app/dbs/<name>/<name>.tf`) with the core Aurora module it wraps.\n *\n * The app module is what a root configuration instantiates and it forwards its\n * own value down, so its default is the one that takes effect:\n *\n * - `enable_cloudwatch_logs` defaulted to `false` against the core module's\n *   `true`, so Aurora exported no engine logs and the cluster parameter group\n *   that configures them (`log_statement=ddl` on PostgreSQL,\n *   `server_audit_events=CONNECT,QUERY_DDL` on MySQL) was never created —\n *   the CDK construct enabled both.\n * - `enable_key_rotation` was never declared, leaving the core module's\n *   variable unreachable from a root configuration.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the diverged defaults until this runs. Diverged files are left untouched and\n * reported via `nextSteps`.\n */\n\nconst TERRAFORM_DBS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst KEY_ROTATION_VARIABLE = [\n  'variable \"enable_key_rotation\" {',\n  '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n].join('\\n');\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To export Aurora engine logs to CloudWatch as the CDK construct and the core Terraform module do, default \\`enable_cloudwatch_logs\\` to true here, and declare an \\`enable_key_rotation\\` variable (bool, default true) forwarded to the aurora module (see the ts#rdb generator's dbs app template).`;\n\nconst OLD_LOGS_DESCRIPTION =\n  'Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging.';\nconst NEW_LOGS_DESCRIPTION =\n  'Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data.';\n\n/**\n * Flip the app module's `enable_cloudwatch_logs` default to match the core\n * module, and replace the description that documented the old behaviour.\n *\n * Keyed on that description, which is the only thing distinguishing the vended\n * `default = false` from a user who deliberately turned log export off.\n */\nconst migrateCloudwatchLogsDefault = (tree: Tree, filePath: string) =>\n  applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`variable \"enable_cloudwatch_logs\" { $props }\\` where {` +\n        ` $props <: contains \\`description = \"${OLD_LOGS_DESCRIPTION}\"\\` => \\`description = \"${NEW_LOGS_DESCRIPTION}\"\\`,` +\n        ` $props <: contains \\`default = false\\` => \\`default = true\\`` +\n        ` }`,\n    ),\n  );\n\n/**\n * Declare `enable_key_rotation` and forward it to the core aurora module, so a\n * root configuration can reach the variable the core module already exposes.\n */\nconst migrateKeyRotationVariable = async (\n  tree: Tree,\n  filePath: string,\n): Promise<void> => {\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      hcl('`variable \"enable_key_rotation\" { $_ }`'),\n    )\n  ) {\n    return; // Already declared.\n  }\n\n  const declared = await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`variable \"enable_backup\" { $props }\\` => \\`variable \"enable_backup\" {\\n  $props\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    ),\n    KEY_ROTATION_VARIABLE,\n  );\n  if (!declared) return;\n\n  // Appended after the existing arguments so their alignment is preserved;\n  // `terraform fmt` re-aligns the block.\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`module \"aurora\" { $props }\\` => \\`module \"aurora\" {\\n  $props\\n\\n  enable_key_rotation = var.enable_key_rotation\\n}\\``,\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_DBS_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform database modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DBS_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DBS_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a database app module directory.\n    }\n\n    // Both edits hang off the shape the generator produces: the two variables\n    // and the module call that forwards them.\n    const recognised =\n      (await matchGritQL(\n        tree,\n        filePath,\n        hcl('`variable \"enable_cloudwatch_logs\" { $_ }`'),\n      )) &&\n      (await matchGritQL(\n        tree,\n        filePath,\n        hcl('`variable \"enable_backup\" { $_ }`'),\n      )) &&\n      (await matchGritQL(\n        tree,\n        filePath,\n        hcl(\n          '`module \"aurora\" { $props }` where { $props <: contains `enable_cloudwatch_logs = var.enable_cloudwatch_logs` }',\n        ),\n      ));\n\n    if (!recognised) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    await migrateCloudwatchLogsDefault(tree, filePath);\n    await migrateKeyRotationVariable(tree, filePath);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DBS_APP_DIR","hcl","pattern","KEY_ROTATION_VARIABLE","join","divergedMessage","filePath","OLD_LOGS_DESCRIPTION","NEW_LOGS_DESCRIPTION","migrateCloudwatchLogsDefault","tree","migrateKeyRotationVariable","declared","migration","nextSteps","exists","dirName","children","recognised","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,wBAAwB,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,YAAY,CAAC;AAEnF,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,wBAAwB;IAC5B;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,+VAA+V,CAAC;AAE9W,MAAMC,uBACJ;AACF,MAAMC,uBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,+BAA+B,CAACC,MAAYJ,WAChDb,YACEiB,MACAJ,UACAL,IACE,CAAC,wDAAwD,CAAC,GACxD,CAAC,qCAAqC,EAAEM,qBAAqB,wBAAwB,EAAEC,qBAAqB,IAAI,CAAC,GACjH,CAAC,6DAA6D,CAAC,GAC/D,CAAC,EAAE,CAAC;AAIZ;;;CAGC,GACD,MAAMG,6BAA6B,OACjCD,MACAJ;IAEA,IACE,MAAMV,YACJc,MACAJ,UACAL,IAAI,6CAEN;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,WAAW,MAAMjB,gBACrBe,MACAJ,UACAL,IACE,CAAC,wFAAwF,EAAEP,wBAAwB,EAAE,CAAC,GAExHS;IAEF,IAAI,CAACS,UAAU;IAEf,yEAAyE;IACzE,uCAAuC;IACvC,MAAMnB,YACJiB,MACAJ,UACAL,IACE,CAAC,uHAAuH,CAAC;AAG/H;AAEA,eAAe,eAAeY,UAC5BH,IAAU;IAEV,MAAMI,YAAsB,EAAE;IAE9B,IAAI,CAACJ,KAAKK,MAAM,CAACf,wBAAwB;QACvC,OAAO;YAAEc;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAME,WAAWN,KAAKO,QAAQ,CAACjB,uBAAwB;QAC1D,MAAMM,WAAWd,kBACfQ,uBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKK,MAAM,CAACT,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAMY,aACJ,AAAC,MAAMtB,YACLc,MACAJ,UACAL,IAAI,kDAEL,MAAML,YACLc,MACAJ,UACAL,IAAI,yCAEL,MAAML,YACLc,MACAJ,UACAL,IACE;QAIN,IAAI,CAACiB,YAAY;YACfJ,UAAUK,IAAI,CAACd,gBAAgBC;YAC/B;QACF;QAEA,MAAMG,6BAA6BC,MAAMJ;QACzC,MAAMK,2BAA2BD,MAAMJ;IACzC;IAEA,MAAMT,qBAAqBa;IAE3B,OAAO;QAAEI;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.84/0002-agentcore-harness-no-tools-by-default/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,79 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`agentcore-harness-no-tools-by-default migration > cdk > defaults allowedTools to none and passes it explicitly 1`] = `
+"import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
+import { Construct } from 'constructs';
+
+export class MyHarness extends Construct {
+  public readonly harness: agentcore.CfnHarness;
+
+  constructor(scope: Construct, id: string, props?: MyHarnessProps) {
+    super(scope, id);
+
+    const stack = Stack.of(this);
+    const {
+      // The service treats an absent allowedTools as every tool, so this
+      // defaults to none and is always passed explicitly.
+      allowedTools = [],
+      executionRole,
+      modelResourceArns = [
+        \`arn:\${stack.partition}:bedrock:*::foundation-model/*\`,
+      ],
+      vpc,
+      vpcSubnets,
+      securityGroups,
+      ...harnessProps
+    } = props ?? {};
+
+    this.harness = new agentcore.CfnHarness(this, 'Harness', {
+      model: {
+        bedrockModelConfig: {
+          modelId: 'global.anthropic.claude-sonnet-4-6',
+        },
+      },
+      systemPrompt: [{ text: systemPrompt }],
+      ...harnessProps,
+      allowedTools,
+      // Set after harnessProps so the deployed name always matches the
+      // execution role's workload-identity resource pattern.
+      harnessName,
+      executionRoleArn: this.executionRole.roleArn,
+      environment,
+    });
+  }
+}
+"
+`;
+
+exports[`agentcore-harness-no-tools-by-default migration > terraform > declares allowed_tools defaulting to none and assigns it 1`] = `
+"variable "model_id" {
+  description = "Amazon Bedrock model or inference profile used by default."
+  type        = string
+  default     = "global.anthropic.claude-sonnet-4-6"
+}
+
+variable "allowed_tools" {
+  description = "Tools the Harness may use. Defaults to none; set [\\"@builtin\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool."
+  type        = list(string)
+  default     = []
+}
+
+variable "model_resource_arns" {
+  description = "Bedrock model and inference-profile ARNs the execution role may invoke."
+  type        = set(string)
+  default     = null
+}
+
+resource "aws_bedrockagentcore_harness" "this" {
+  harness_name       = local.harness_name
+  execution_role_arn = aws_iam_role.execution_role.arn
+  allowed_tools      = var.allowed_tools
+
+  model {
+    bedrock_model_config {
+      model_id = var.model_id
+    }
+  }
+}
+"
+`;

package/src/migrations/v1.0.0-rc.84/0002-agentcore-harness-no-tools-by-default/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Pin the vended AgentCore Harness construct/module to no tools by default, since AgentCore treats an absent allowedTools as every tool"
+}

package/src/migrations/v1.0.0-rc.84/0002-agentcore-harness-no-tools-by-default/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/v1.0.0-rc.84/0002-agentcore-harness-no-tools-by-default/migration.js

@@ -0,0 +1,87 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Pin each vended Harness to no tools by default.
+ *
+ * AgentCore treats an absent `allowedTools` as every tool, so a Harness that
+ * never set it deployed with `allowedTools: ["*"]` — shell execution and file
+ * read/write included. Both providers now send the field explicitly, defaulting
+ * to none.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the implicit every-tool default until this runs. Diverged files are left
+ * untouched and reported via `nextSteps`.
+ */ const CDK_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/harnesses`;
+const TERRAFORM_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const ALLOWED_TOOLS_VARIABLE = [
+    'variable "allowed_tools" {',
+    '  description = "Tools the Harness may use. Defaults to none; set [\\"@builtin\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool."',
+    '  type        = list(string)',
+    '  default     = []',
+    '}'
+].join('\n');
+const divergedMessage = (filePath, remedy)=>`${filePath}: has diverged from the generated shape - left untouched. AgentCore treats an absent allowedTools as every tool, so this Harness deploys with all built-in tools (including shell and file access). ${remedy}`;
+/**
+ * Default the construct's `allowedTools` to none and pass it to the resource
+ * after the props spread, so an undefined caller value cannot reinstate the
+ * service's every-tool default.
+ */ const migrateCdkConstruct = async (tree, filePath)=>{
+    const destructured = await insertViaGritQL(tree, filePath, `\`const { $fields } = props ?? {};\` => \`const {\n      ${GRIT_INSERT_PLACEHOLDER}\n      $fields\n    } = props ?? {};\``, [
+        '// The service treats an absent allowedTools as every tool, so this',
+        '// defaults to none and is always passed explicitly.',
+        'allowedTools = [],'
+    ].join('\n      '));
+    if (!destructured) return false;
+    return await applyGritQL(tree, filePath, '`new agentcore.CfnHarness($scope, $id, { $props })` where {' + ' $props <: contains spread_element() as $spread,' + ' $spread => `$spread,\n      allowedTools`' + ' }');
+};
+/**
+ * Declare `allowed_tools` and assign it to the Harness resource, so the module
+ * always sends the field.
+ */ const migrateTerraformModule = async (tree, filePath)=>{
+    const declared = await insertViaGritQL(tree, filePath, hcl(`\`variable "model_resource_arns" { $props }\` => \`${GRIT_INSERT_PLACEHOLDER}\n\nvariable "model_resource_arns" {\n  $props\n}\``), ALLOWED_TOOLS_VARIABLE);
+    if (!declared) return false;
+    // Appended after the existing arguments so their alignment is preserved;
+    // `terraform fmt` re-aligns the block.
+    return await applyGritQL(tree, filePath, hcl('`execution_role_arn = aws_iam_role.execution_role.arn` => `execution_role_arn = aws_iam_role.execution_role.arn\n  allowed_tools      = var.allowed_tools`'));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const dirName of tree.exists(CDK_HARNESSES_DIR) ? tree.children(CDK_HARNESSES_DIR) : []){
+        const filePath = joinPathFragments(CDK_HARNESSES_DIR, dirName, `${dirName}.ts`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a Harness construct directory.
+        }
+        // Already pinned, by this migration or by hand.
+        if (tree.read(filePath, 'utf-8')?.includes('allowedTools = [],')) {
+            continue;
+        }
+        if (!await migrateCdkConstruct(tree, filePath)) {
+            nextSteps.push(divergedMessage(filePath, 'Default `allowedTools` to `[]` when destructuring props, and pass `allowedTools` to the CfnHarness after the `...harnessProps` spread.'));
+        }
+    }
+    for (const dirName of tree.exists(TERRAFORM_HARNESSES_DIR) ? tree.children(TERRAFORM_HARNESSES_DIR) : []){
+        const filePath = joinPathFragments(TERRAFORM_HARNESSES_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a Harness module directory.
+        }
+        // Already assigned, by this migration or by hand.
+        if (await matchGritQL(tree, filePath, hcl('`allowed_tools = $_`'))) {
+            continue;
+        }
+        if (!await migrateTerraformModule(tree, filePath)) {
+            nextSteps.push(divergedMessage(filePath, 'Declare an `allowed_tools` variable (list(string), default []) and assign `allowed_tools = var.allowed_tools` on the `aws_bedrockagentcore_harness` resource.'));
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.84/0002-agentcore-harness-no-tools-by-default/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.84/0002-agentcore-harness-no-tools-by-default/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Pin each vended Harness to no tools by default.\n *\n * AgentCore treats an absent `allowedTools` as every tool, so a Harness that\n * never set it deployed with `allowedTools: [\"*\"]` — shell execution and file\n * read/write included. Both providers now send the field explicitly, defaulting\n * to none.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the implicit every-tool default until this runs. Diverged files are left\n * untouched and reported via `nextSteps`.\n */\n\nconst CDK_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src/app/harnesses`;\nconst TERRAFORM_HARNESSES_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/harnesses`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst ALLOWED_TOOLS_VARIABLE = [\n  'variable \"allowed_tools\" {',\n  '  description = \"Tools the Harness may use. Defaults to none; set [\\\\\"@builtin\\\\\"] for every built-in tool, or name individual tools. Always sent explicitly, since the service treats an absent value as every tool.\"',\n  '  type        = list(string)',\n  '  default     = []',\n  '}',\n].join('\\n');\n\nconst divergedMessage = (filePath: string, remedy: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. AgentCore treats an absent allowedTools as every tool, so this Harness deploys with all built-in tools (including shell and file access). ${remedy}`;\n\n/**\n * Default the construct's `allowedTools` to none and pass it to the resource\n * after the props spread, so an undefined caller value cannot reinstate the\n * service's every-tool default.\n */\nconst migrateCdkConstruct = async (\n  tree: Tree,\n  filePath: string,\n): Promise<boolean> => {\n  const destructured = await insertViaGritQL(\n    tree,\n    filePath,\n    `\\`const { $fields } = props ?? {};\\` => \\`const {\\n      ${GRIT_INSERT_PLACEHOLDER}\\n      $fields\\n    } = props ?? {};\\``,\n    [\n      '// The service treats an absent allowedTools as every tool, so this',\n      '// defaults to none and is always passed explicitly.',\n      'allowedTools = [],',\n    ].join('\\n      '),\n  );\n  if (!destructured) return false;\n\n  return await applyGritQL(\n    tree,\n    filePath,\n    '`new agentcore.CfnHarness($scope, $id, { $props })` where {' +\n      ' $props <: contains spread_element() as $spread,' +\n      ' $spread => `$spread,\\n      allowedTools`' +\n      ' }',\n  );\n};\n\n/**\n * Declare `allowed_tools` and assign it to the Harness resource, so the module\n * always sends the field.\n */\nconst migrateTerraformModule = async (\n  tree: Tree,\n  filePath: string,\n): Promise<boolean> => {\n  const declared = await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`variable \"model_resource_arns\" { $props }\\` => \\`${GRIT_INSERT_PLACEHOLDER}\\n\\nvariable \"model_resource_arns\" {\\n  $props\\n}\\``,\n    ),\n    ALLOWED_TOOLS_VARIABLE,\n  );\n  if (!declared) return false;\n\n  // Appended after the existing arguments so their alignment is preserved;\n  // `terraform fmt` re-aligns the block.\n  return await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      '`execution_role_arn = aws_iam_role.execution_role.arn` => `execution_role_arn = aws_iam_role.execution_role.arn\\n  allowed_tools      = var.allowed_tools`',\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const dirName of tree.exists(CDK_HARNESSES_DIR)\n    ? tree.children(CDK_HARNESSES_DIR)\n    : []) {\n    const filePath = joinPathFragments(\n      CDK_HARNESSES_DIR,\n      dirName,\n      `${dirName}.ts`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a Harness construct directory.\n    }\n\n    // Already pinned, by this migration or by hand.\n    if (tree.read(filePath, 'utf-8')?.includes('allowedTools = [],')) {\n      continue;\n    }\n\n    if (!(await migrateCdkConstruct(tree, filePath))) {\n      nextSteps.push(\n        divergedMessage(\n          filePath,\n          'Default `allowedTools` to `[]` when destructuring props, and pass `allowedTools` to the CfnHarness after the `...harnessProps` spread.',\n        ),\n      );\n    }\n  }\n\n  for (const dirName of tree.exists(TERRAFORM_HARNESSES_DIR)\n    ? tree.children(TERRAFORM_HARNESSES_DIR)\n    : []) {\n    const filePath = joinPathFragments(\n      TERRAFORM_HARNESSES_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a Harness module directory.\n    }\n\n    // Already assigned, by this migration or by hand.\n    if (await matchGritQL(tree, filePath, hcl('`allowed_tools = $_`'))) {\n      continue;\n    }\n\n    if (!(await migrateTerraformModule(tree, filePath))) {\n      nextSteps.push(\n        divergedMessage(\n          filePath,\n          'Declare an `allowed_tools` variable (list(string), default []) and assign `allowed_tools = var.allowed_tools` on the `aws_bedrockagentcore_harness` resource.',\n        ),\n      );\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CDK_HARNESSES_DIR","TERRAFORM_HARNESSES_DIR","hcl","pattern","ALLOWED_TOOLS_VARIABLE","join","divergedMessage","filePath","remedy","migrateCdkConstruct","tree","destructured","migrateTerraformModule","declared","migration","nextSteps","dirName","exists","children","read","includes","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;CAWC,GAED,MAAMC,oBAAoB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,kBAAkB,CAAC;AACtF,MAAMG,0BAA0B,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,kBAAkB,CAAC;AAE3F,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,yBAAyB;IAC7B;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,UAAkBC,SACzC,GAAGD,SAAS,oMAAoM,EAAEC,QAAQ;AAE5N;;;;CAIC,GACD,MAAMC,sBAAsB,OAC1BC,MACAH;IAEA,MAAMI,eAAe,MAAMjB,gBACzBgB,MACAH,UACA,CAAC,yDAAyD,EAAEd,wBAAwB,uCAAuC,CAAC,EAC5H;QACE;QACA;QACA;KACD,CAACY,IAAI,CAAC;IAET,IAAI,CAACM,cAAc,OAAO;IAE1B,OAAO,MAAMnB,YACXkB,MACAH,UACA,gEACE,qDACA,+CACA;AAEN;AAEA;;;CAGC,GACD,MAAMK,yBAAyB,OAC7BF,MACAH;IAEA,MAAMM,WAAW,MAAMnB,gBACrBgB,MACAH,UACAL,IACE,CAAC,mDAAmD,EAAET,wBAAwB,mDAAmD,CAAC,GAEpIW;IAEF,IAAI,CAACS,UAAU,OAAO;IAEtB,yEAAyE;IACzE,uCAAuC;IACvC,OAAO,MAAMrB,YACXkB,MACAH,UACAL,IACE;AAGN;AAEA,eAAe,eAAeY,UAC5BJ,IAAU;IAEV,MAAMK,YAAsB,EAAE;IAE9B,KAAK,MAAMC,WAAWN,KAAKO,MAAM,CAACjB,qBAC9BU,KAAKQ,QAAQ,CAAClB,qBACd,EAAE,CAAE;QACN,MAAMO,WAAWhB,kBACfS,mBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKO,MAAM,CAACV,WAAW;YAC1B,UAAU,qCAAqC;QACjD;QAEA,gDAAgD;QAChD,IAAIG,KAAKS,IAAI,CAACZ,UAAU,UAAUa,SAAS,uBAAuB;YAChE;QACF;QAEA,IAAI,CAAE,MAAMX,oBAAoBC,MAAMH,WAAY;YAChDQ,UAAUM,IAAI,CACZf,gBACEC,UACA;QAGN;IACF;IAEA,KAAK,MAAMS,WAAWN,KAAKO,MAAM,CAAChB,2BAC9BS,KAAKQ,QAAQ,CAACjB,2BACd,EAAE,CAAE;QACN,MAAMM,WAAWhB,kBACfU,yBACAe,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKO,MAAM,CAACV,WAAW;YAC1B,UAAU,kCAAkC;QAC9C;QAEA,kDAAkD;QAClD,IAAI,MAAMZ,YAAYe,MAAMH,UAAUL,IAAI,0BAA0B;YAClE;QACF;QAEA,IAAI,CAAE,MAAMU,uBAAuBF,MAAMH,WAAY;YACnDQ,UAAUM,IAAI,CACZf,gBACEC,UACA;QAGN;IACF;IAEA,MAAMX,qBAAqBc;IAE3B,OAAO;QAAEK;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.84/0003-terraform-declare-used-providers/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare every provider each vended Terraform module uses in its own required_providers"
+}

package/src/migrations/v1.0.0-rc.84/0003-terraform-declare-used-providers/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;