@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/migrations/v1.0.0-rc.84/0003-terraform-declare-used-providers/migration.js

@@ -0,0 +1,147 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments, visitNotIgnoredFiles } from "@nx/devkit";
+import { captureAllGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+import { TERRAFORM_VERSIONS } from "../../../utils/versions.js";
+/**
+ * Declare every provider each vended Terraform module uses in its own
+ * `required_providers`.
+ *
+ * A provider a module uses but never declares is resolved by implicit
+ * inheritance from the root module, unpinned — so `terraform init` on that
+ * module takes whatever the registry serves, bypassing the version pinning the
+ * generators vend. Several vended modules referenced `random`, `archive`,
+ * `null`, `external` and `aws` without declaring them.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the unpinned shape until this runs. Each missing provider is added to the
+ * module's existing `required_providers`; a module with no `terraform` block at
+ * all is reported via `nextSteps` rather than having one inserted, since where
+ * it belongs depends on how the user has arranged the file.
+ */ const TERRAFORM_SRC = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src');
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+/** Providers built in to Terraform, which have no entry and no version. */ const BUILTIN_TYPES = new Set([
+    'terraform_data',
+    'terraform_remote_state'
+]);
+/**
+ * The provider a resource or data source type resolves to. Terraform derives
+ * this from the type's first underscore-delimited word; a type it can't
+ * attribute to a provider the plugin vends is not this migration's to touch.
+ */ const providerOf = (type)=>{
+    // `null_resource` and `external` are the whole type, not a prefixed one.
+    if (type === 'null_resource') {
+        return 'null';
+    }
+    if (type === 'external') {
+        return 'external';
+    }
+    const [prefix] = type.split('_');
+    return prefix in TERRAFORM_VERSIONS ? prefix : undefined;
+};
+/**
+ * The providers a module requires, read from its `resource` and `data` blocks.
+ *
+ * Only declarations are read, because Terraform resolves a resource reference
+ * within the module that declares it — so a provider a module references is one
+ * it also declares a block for, and the blocks alone are complete. Matching the
+ * syntax tree also means a type named in a comment, in string prose or inside a
+ * `local-exec` heredoc's embedded Python is not a use, since none of those parse
+ * as a block.
+ */ const usedProviders = async (tree, filePath)=>{
+    const used = new Set();
+    for (const kind of [
+        'resource',
+        'data'
+    ]){
+        for (const block of (await captureAllGritQL(tree, filePath, hcl(`\`${kind} $type $name { $_ }\``)))){
+            // The block's own type, e.g. `resource "random_string" "suffix" {`.
+            const type = /"([A-Za-z0-9_]+)"/.exec(block)?.[1];
+            if (!type || BUILTIN_TYPES.has(type)) {
+                continue;
+            }
+            const provider = providerOf(type);
+            if (provider) {
+                used.add(provider);
+            }
+        }
+    }
+    return used;
+};
+/** Every `.tf` file in the workspace's shared terraform library, by directory. */ const terraformModules = (tree)=>{
+    const modules = new Map();
+    if (!tree.exists(TERRAFORM_SRC)) {
+        return modules;
+    }
+    visitNotIgnoredFiles(tree, TERRAFORM_SRC, (filePath)=>{
+        if (!filePath.endsWith('.tf')) {
+            return;
+        }
+        const dir = filePath.slice(0, filePath.lastIndexOf('/'));
+        modules.set(dir, [
+            ...modules.get(dir) ?? [],
+            filePath
+        ]);
+    });
+    return modules;
+};
+/** The provider entry to vend, at the version this release pins. */ const providerEntry = (provider)=>[
+        `${provider} = {`,
+        `  source  = "hashicorp/${provider}"`,
+        `  version = "${TERRAFORM_VERSIONS[provider]}"`,
+        '}'
+    ].join('\n');
+/**
+ * Add a provider to a file's `required_providers`. Appended after the block's
+ * existing body, so an entry the user has customised is left as it is.
+ */ const declareProvider = (tree, filePath, provider)=>insertViaGritQL(tree, filePath, hcl(`\`required_providers { $body }\` => \`required_providers {\n  $body\n\n  ${GRIT_INSERT_PLACEHOLDER}\n}\`` + ` where { $body <: not contains \`${provider} = { $_ }\` }`), providerEntry(provider));
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [dir, filePaths] of terraformModules(tree)){
+        const used = new Set();
+        // The file holding the module's `required_providers`, which is where the
+        // missing declarations are added — Terraform merges every `.tf` in a
+        // directory, so one block covers the module.
+        let blockFile;
+        const declared = new Set();
+        for (const filePath of filePaths){
+            for (const provider of (await usedProviders(tree, filePath))){
+                used.add(provider);
+            }
+            const contents = tree.read(filePath, 'utf-8') ?? '';
+            if (!contents.includes('required_providers')) {
+                continue;
+            }
+            blockFile ??= filePath;
+            for (const provider of Object.keys(TERRAFORM_VERSIONS)){
+                if (await matchGritQL(tree, filePath, hcl(`\`required_providers { $body }\` where { $body <: contains \`${provider} = { $_ }\` }`))) {
+                    declared.add(provider);
+                }
+            }
+        }
+        const missing = [
+            ...used
+        ].filter((p)=>!declared.has(p)).sort();
+        if (missing.length === 0) {
+            continue;
+        }
+        if (!blockFile) {
+            nextSteps.push(`${dir}: has no terraform required_providers block - left untouched. Add one declaring ${missing.join(', ')}, so the module pins the providers it uses rather than inheriting them unpinned from the root module.`);
+            continue;
+        }
+        for (const provider of missing){
+            if (!await declareProvider(tree, blockFile, provider)) {
+                nextSteps.push(`${blockFile}: its required_providers block has diverged from the generated shape - left untouched. Add a ${provider} entry to it, sourced from hashicorp/${provider}.`);
+            }
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.84/0003-terraform-declare-used-providers/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.84/0003-terraform-declare-used-providers/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport {\n  captureAllGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TERRAFORM_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Declare every provider each vended Terraform module uses in its own\n * `required_providers`.\n *\n * A provider a module uses but never declares is resolved by implicit\n * inheritance from the root module, unpinned — so `terraform init` on that\n * module takes whatever the registry serves, bypassing the version pinning the\n * generators vend. Several vended modules referenced `random`, `archive`,\n * `null`, `external` and `aws` without declaring them.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the unpinned shape until this runs. Each missing provider is added to the\n * module's existing `required_providers`; a module with no `terraform` block at\n * all is reported via `nextSteps` rather than having one inserted, since where\n * it belongs depends on how the user has arranged the file.\n */\n\nconst TERRAFORM_SRC = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n  'src',\n);\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/** Providers built in to Terraform, which have no entry and no version. */\nconst BUILTIN_TYPES = new Set(['terraform_data', 'terraform_remote_state']);\n\n/**\n * The provider a resource or data source type resolves to. Terraform derives\n * this from the type's first underscore-delimited word; a type it can't\n * attribute to a provider the plugin vends is not this migration's to touch.\n */\nconst providerOf = (type: string): string | undefined => {\n  // `null_resource` and `external` are the whole type, not a prefixed one.\n  if (type === 'null_resource') {\n    return 'null';\n  }\n  if (type === 'external') {\n    return 'external';\n  }\n  const [prefix] = type.split('_');\n  return prefix in TERRAFORM_VERSIONS ? prefix : undefined;\n};\n\n/**\n * The providers a module requires, read from its `resource` and `data` blocks.\n *\n * Only declarations are read, because Terraform resolves a resource reference\n * within the module that declares it — so a provider a module references is one\n * it also declares a block for, and the blocks alone are complete. Matching the\n * syntax tree also means a type named in a comment, in string prose or inside a\n * `local-exec` heredoc's embedded Python is not a use, since none of those parse\n * as a block.\n */\nconst usedProviders = async (\n  tree: Tree,\n  filePath: string,\n): Promise<Set<string>> => {\n  const used = new Set<string>();\n  for (const kind of ['resource', 'data']) {\n    for (const block of await captureAllGritQL(\n      tree,\n      filePath,\n      hcl(`\\`${kind} $type $name { $_ }\\``),\n    )) {\n      // The block's own type, e.g. `resource \"random_string\" \"suffix\" {`.\n      const type = /\"([A-Za-z0-9_]+)\"/.exec(block)?.[1];\n      if (!type || BUILTIN_TYPES.has(type)) {\n        continue;\n      }\n      const provider = providerOf(type);\n      if (provider) {\n        used.add(provider);\n      }\n    }\n  }\n  return used;\n};\n\n/** Every `.tf` file in the workspace's shared terraform library, by directory. */\nconst terraformModules = (tree: Tree): Map<string, string[]> => {\n  const modules = new Map<string, string[]>();\n  if (!tree.exists(TERRAFORM_SRC)) {\n    return modules;\n  }\n  visitNotIgnoredFiles(tree, TERRAFORM_SRC, (filePath) => {\n    if (!filePath.endsWith('.tf')) {\n      return;\n    }\n    const dir = filePath.slice(0, filePath.lastIndexOf('/'));\n    modules.set(dir, [...(modules.get(dir) ?? []), filePath]);\n  });\n  return modules;\n};\n\n/** The provider entry to vend, at the version this release pins. */\nconst providerEntry = (provider: string) =>\n  [\n    `${provider} = {`,\n    `  source  = \"hashicorp/${provider}\"`,\n    `  version = \"${TERRAFORM_VERSIONS[provider as keyof typeof TERRAFORM_VERSIONS]}\"`,\n    '}',\n  ].join('\\n');\n\n/**\n * Add a provider to a file's `required_providers`. Appended after the block's\n * existing body, so an entry the user has customised is left as it is.\n */\nconst declareProvider = (tree: Tree, filePath: string, provider: string) =>\n  insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`required_providers { $body }\\` => \\`required_providers {\\n  $body\\n\\n  ${GRIT_INSERT_PLACEHOLDER}\\n}\\`` +\n        ` where { $body <: not contains \\`${provider} = { $_ }\\` }`,\n    ),\n    providerEntry(provider),\n  );\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [dir, filePaths] of terraformModules(tree)) {\n    const used = new Set<string>();\n    // The file holding the module's `required_providers`, which is where the\n    // missing declarations are added — Terraform merges every `.tf` in a\n    // directory, so one block covers the module.\n    let blockFile: string | undefined;\n    const declared = new Set<string>();\n\n    for (const filePath of filePaths) {\n      for (const provider of await usedProviders(tree, filePath)) {\n        used.add(provider);\n      }\n      const contents = tree.read(filePath, 'utf-8') ?? '';\n      if (!contents.includes('required_providers')) {\n        continue;\n      }\n      blockFile ??= filePath;\n      for (const provider of Object.keys(TERRAFORM_VERSIONS)) {\n        if (\n          await matchGritQL(\n            tree,\n            filePath,\n            hcl(\n              `\\`required_providers { $body }\\` where { $body <: contains \\`${provider} = { $_ }\\` }`,\n            ),\n          )\n        ) {\n          declared.add(provider);\n        }\n      }\n    }\n\n    const missing = [...used].filter((p) => !declared.has(p)).sort();\n    if (missing.length === 0) {\n      continue;\n    }\n\n    if (!blockFile) {\n      nextSteps.push(\n        `${dir}: has no terraform required_providers block - left untouched. Add one declaring ${missing.join(', ')}, so the module pins the providers it uses rather than inheriting them unpinned from the root module.`,\n      );\n      continue;\n    }\n\n    for (const provider of missing) {\n      if (!(await declareProvider(tree, blockFile, provider))) {\n        nextSteps.push(\n          `${blockFile}: its required_providers block has diverged from the generated shape - left untouched. Add a ${provider} entry to it, sourced from hashicorp/${provider}.`,\n        );\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","visitNotIgnoredFiles","captureAllGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_VERSIONS","TERRAFORM_SRC","hcl","pattern","BUILTIN_TYPES","Set","providerOf","type","prefix","split","undefined","usedProviders","tree","filePath","used","kind","block","exec","has","provider","add","terraformModules","modules","Map","exists","endsWith","dir","slice","lastIndexOf","set","get","providerEntry","join","declareProvider","migration","nextSteps","filePaths","blockFile","declared","contents","read","includes","Object","keys","missing","filter","p","sort","length","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAGjBC,oBAAoB,QACf,aAAa;AACpB,SACEC,gBAAgB,EAChBC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AACvD,SAASC,kBAAkB,QAAQ,6BAA6B;AAEhE;;;;;;;;;;;;;;;CAeC,GAED,MAAMC,gBAAgBV,kBACpBO,cACAC,sBACA;AAGF,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,yEAAyE,GACzE,MAAMC,gBAAgB,IAAIC,IAAI;IAAC;IAAkB;CAAyB;AAE1E;;;;CAIC,GACD,MAAMC,aAAa,CAACC;IAClB,yEAAyE;IACzE,IAAIA,SAAS,iBAAiB;QAC5B,OAAO;IACT;IACA,IAAIA,SAAS,YAAY;QACvB,OAAO;IACT;IACA,MAAM,CAACC,OAAO,GAAGD,KAAKE,KAAK,CAAC;IAC5B,OAAOD,UAAUR,qBAAqBQ,SAASE;AACjD;AAEA;;;;;;;;;CASC,GACD,MAAMC,gBAAgB,OACpBC,MACAC;IAEA,MAAMC,OAAO,IAAIT;IACjB,KAAK,MAAMU,QAAQ;QAAC;QAAY;KAAO,CAAE;QACvC,KAAK,MAAMC,SAAS,CAAA,MAAMvB,iBACxBmB,MACAC,UACAX,IAAI,CAAC,EAAE,EAAEa,KAAK,qBAAqB,CAAC,EACtC,EAAG;YACD,oEAAoE;YACpE,MAAMR,OAAO,oBAAoBU,IAAI,CAACD,QAAQ,CAAC,EAAE;YACjD,IAAI,CAACT,QAAQH,cAAcc,GAAG,CAACX,OAAO;gBACpC;YACF;YACA,MAAMY,WAAWb,WAAWC;YAC5B,IAAIY,UAAU;gBACZL,KAAKM,GAAG,CAACD;YACX;QACF;IACF;IACA,OAAOL;AACT;AAEA,gFAAgF,GAChF,MAAMO,mBAAmB,CAACT;IACxB,MAAMU,UAAU,IAAIC;IACpB,IAAI,CAACX,KAAKY,MAAM,CAACvB,gBAAgB;QAC/B,OAAOqB;IACT;IACA9B,qBAAqBoB,MAAMX,eAAe,CAACY;QACzC,IAAI,CAACA,SAASY,QAAQ,CAAC,QAAQ;YAC7B;QACF;QACA,MAAMC,MAAMb,SAASc,KAAK,CAAC,GAAGd,SAASe,WAAW,CAAC;QACnDN,QAAQO,GAAG,CAACH,KAAK;eAAKJ,QAAQQ,GAAG,CAACJ,QAAQ,EAAE;YAAGb;SAAS;IAC1D;IACA,OAAOS;AACT;AAEA,kEAAkE,GAClE,MAAMS,gBAAgB,CAACZ,WACrB;QACE,GAAGA,SAAS,IAAI,CAAC;QACjB,CAAC,uBAAuB,EAAEA,SAAS,CAAC,CAAC;QACrC,CAAC,aAAa,EAAEnB,kBAAkB,CAACmB,SAA4C,CAAC,CAAC,CAAC;QAClF;KACD,CAACa,IAAI,CAAC;AAET;;;CAGC,GACD,MAAMC,kBAAkB,CAACrB,MAAYC,UAAkBM,WACrDxB,gBACEiB,MACAC,UACAX,IACE,CAAC,yEAAyE,EAAER,wBAAwB,KAAK,CAAC,GACxG,CAAC,iCAAiC,EAAEyB,SAAS,aAAa,CAAC,GAE/DY,cAAcZ;AAGlB,eAAe,eAAee,UAC5BtB,IAAU;IAEV,MAAMuB,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACT,KAAKU,UAAU,IAAIf,iBAAiBT,MAAO;QACrD,MAAME,OAAO,IAAIT;QACjB,yEAAyE;QACzE,qEAAqE;QACrE,6CAA6C;QAC7C,IAAIgC;QACJ,MAAMC,WAAW,IAAIjC;QAErB,KAAK,MAAMQ,YAAYuB,UAAW;YAChC,KAAK,MAAMjB,YAAY,CAAA,MAAMR,cAAcC,MAAMC,SAAQ,EAAG;gBAC1DC,KAAKM,GAAG,CAACD;YACX;YACA,MAAMoB,WAAW3B,KAAK4B,IAAI,CAAC3B,UAAU,YAAY;YACjD,IAAI,CAAC0B,SAASE,QAAQ,CAAC,uBAAuB;gBAC5C;YACF;YACAJ,cAAcxB;YACd,KAAK,MAAMM,YAAYuB,OAAOC,IAAI,CAAC3C,oBAAqB;gBACtD,IACE,MAAMJ,YACJgB,MACAC,UACAX,IACE,CAAC,6DAA6D,EAAEiB,SAAS,aAAa,CAAC,IAG3F;oBACAmB,SAASlB,GAAG,CAACD;gBACf;YACF;QACF;QAEA,MAAMyB,UAAU;eAAI9B;SAAK,CAAC+B,MAAM,CAAC,CAACC,IAAM,CAACR,SAASpB,GAAG,CAAC4B,IAAIC,IAAI;QAC9D,IAAIH,QAAQI,MAAM,KAAK,GAAG;YACxB;QACF;QAEA,IAAI,CAACX,WAAW;YACdF,UAAUc,IAAI,CACZ,GAAGvB,IAAI,gFAAgF,EAAEkB,QAAQZ,IAAI,CAAC,MAAM,qGAAqG,CAAC;YAEpN;QACF;QAEA,KAAK,MAAMb,YAAYyB,QAAS;YAC9B,IAAI,CAAE,MAAMX,gBAAgBrB,MAAMyB,WAAWlB,WAAY;gBACvDgB,UAAUc,IAAI,CACZ,GAAGZ,UAAU,6FAA6F,EAAElB,SAAS,qCAAqC,EAAEA,SAAS,CAAC,CAAC;YAE3K;QACF;IACF;IAEA,MAAMtB,qBAAqBe;IAE3B,OAAO;QAAEuB;IAAU;AACrB"}

package/src/migrations/v1.0.0-rc.84/0004-waf-log-group-cmk-encryption/__snapshots__/migration.spec.ts.snap

@@ -0,0 +1,286 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`waf-log-group-cmk-encryption migration > should encrypt the cdk user identity WAF log group 1`] = `
+"import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { CfnLoggingConfiguration, CfnWebACL } from 'aws-cdk-lib/aws-wafv2';
+import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { Construct } from 'constructs';
+import { suppressRules } from './checkov.js';
+
+export class UserIdentity extends Construct {
+  private createWebAcl = (id: string) => {
+    const webAcl = new CfnWebACL(this, 'WebAcl', {});
+
+    // Send WAF request logs to CloudWatch. The log group name must start with
+    // \`aws-waf-logs-\` to satisfy the WAFv2 logging destination requirement.
+    const stack = Stack.of(this);
+    const wafLogGroupName = \`aws-waf-logs-\${id}-\${this.node.addr.slice(-8)}\`;
+
+    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [
+          new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`),
+        ],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnEquals: {
+            'kms:EncryptionContext:aws:logs:arn': \`arn:aws:logs:\${stack.region}:\${stack.account}:log-group:\${wafLogGroupName}\`,
+          },
+        },
+      }),
+    );
+
+    const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
+      logGroupName: wafLogGroupName,
+      encryptionKey: logsKey,
+      retention: RetentionDays.ONE_MONTH,
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+
+    new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
+      resourceArn: webAcl.attrArn,
+      logDestinationConfigs: [wafLogGroup.logGroupArn],
+    });
+
+    return webAcl;
+  };
+}
+"
+`;
+
+exports[`waf-log-group-cmk-encryption migration > should encrypt the terraform gateway WAF log group via the module locals 1`] = `
+"data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+locals {
+  aws_account_id = data.aws_caller_identity.current.account_id
+  aws_region     = data.aws_region.current.id
+  gateway_waf_log_group_name = var.enable_waf ? "aws-waf-logs-my-gateway-\${random_id.unique_suffix.hex}" : null
+}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+# WAF request logs. WAFv2 requires the \`aws-waf-logs-\` name prefix.
+resource "aws_cloudwatch_log_group" "gateway_waf_logs" {
+  #checkov:skip=CKV_AWS_338:Log retention set to one year which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = local.gateway_waf_log_group_name
+  kms_key_id        = aws_kms_key.gateway_waf_logs[0].arn
+  retention_in_days = 365
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "my-gateway gateway WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${local.aws_account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${local.aws_region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${local.aws_region}:\${local.aws_account_id}:log-group:\${local.gateway_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "gateway_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/my-gateway-\${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.gateway_waf_logs[0].key_id
+}
+"
+`;
+
+exports[`waf-log-group-cmk-encryption migration > should encrypt the terraform rest api WAF log group 1`] = `
+"data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+locals {
+  existing = "untouched"
+  waf_log_group_name = var.enable_waf ? "aws-waf-logs-\${var.api_name}-\${random_id.waf_log_suffix[0].hex}" : null
+}
+
+# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
+resource "aws_cloudwatch_log_group" "api_waf_logs" {
+  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = local.waf_log_group_name
+  kms_key_id        = aws_kms_key.waf_logs[0].arn
+  retention_in_days = 30
+  tags              = var.tags
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "\${var.api_name} API WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_kms_alias" "waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/\${var.api_name}-\${random_id.waf_log_suffix[0].hex}-waf-logs"
+  target_key_id = aws_kms_key.waf_logs[0].key_id
+}
+
+resource "random_id" "waf_log_suffix" {
+  count       = var.enable_waf ? 1 : 0
+  byte_length = 4
+}
+"
+`;
+
+exports[`waf-log-group-cmk-encryption migration > should encrypt the terraform user identity WAF log group 1`] = `
+"data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+locals {
+  local_callback_urls = [
+    "http://localhost:4200"
+  ]
+  user_pool_waf_log_group_name = var.enable_waf ? "aws-waf-logs-UserPool-\${random_id.unique_suffix.hex}" : null
+}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+# CloudWatch Log Group for WAF request logs. Name must start with \`aws-waf-logs-\`.
+resource "aws_cloudwatch_log_group" "user_pool_waf_logs" {
+  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = local.user_pool_waf_log_group_name
+  kms_key_id        = aws_kms_key.user_pool_waf_logs[0].arn
+  retention_in_days = 30
+}
+
+# KMS key for encrypting WAF request logs at rest
+resource "aws_kms_key" "user_pool_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  description             = "User pool WAF log encryption"
+  deletion_window_in_days = 7
+  enable_key_rotation     = true
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "Enable IAM User Permissions"
+        Effect    = "Allow"
+        Principal = { AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root" }
+        Action    = "kms:*"
+        Resource  = "*"
+      },
+      {
+        Sid       = "Allow CloudWatch Logs"
+        Effect    = "Allow"
+        Principal = { Service = "logs.\${data.aws_region.current.region}.amazonaws.com" }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnEquals = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:log-group:\${local.user_pool_waf_log_group_name}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_kms_alias" "user_pool_waf_logs" {
+  count = var.enable_waf ? 1 : 0
+
+  name          = "alias/user-pool-\${random_id.unique_suffix.hex}-waf-logs"
+  target_key_id = aws_kms_key.user_pool_waf_logs[0].key_id
+}
+"
+`;

package/src/migrations/v1.0.0-rc.84/0004-waf-log-group-cmk-encryption/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Encrypt vended WAF log groups with a customer-managed KMS key"
+}

package/src/migrations/v1.0.0-rc.84/0004-waf-log-group-cmk-encryption/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;