@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/migrations/v1.0.0-rc.84/0004-waf-log-group-cmk-encryption/migration.js

@@ -0,0 +1,238 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { addDestructuredImport, applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * WAF request logs carry full request metadata - URIs, headers and client IPs -
+ * so the vended WAF log groups are encrypted with a customer-managed KMS key,
+ * matching how the vended access log groups beside them already are. Three were
+ * plaintext: the Terraform REST API and user-pool WAF log groups, the Terraform
+ * AgentCore gateway WAF log group, and the CDK user-pool WAF log group. Each now
+ * gets a key whose policy grants CloudWatch Logs use of it, scoped by
+ * `kms:EncryptionContext:aws:logs:arn` to that log group alone.
+ *
+ * CloudWatch Logs cannot encrypt a log group that already exists in place, so
+ * this only rewrites the vended templates. On the next deploy Terraform sets
+ * `kms_key_id` on the existing group (an in-place update) and CloudFormation
+ * replaces the CDK one, which the vended `RemovalPolicy.DESTROY` already allows.
+ * Events written before then stay unencrypted; the `nextSteps` note says so.
+ */ const CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;
+const TERRAFORM_SRC = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src`;
+const CDK_USER_IDENTITY_FILE = `${CONSTRUCTS_SRC}/core/user-identity.ts`;
+const TERRAFORM_REST_API_FILE = `${TERRAFORM_SRC}/core/api/rest-api/rest-api.tf`;
+const TERRAFORM_USER_IDENTITY_FILE = `${TERRAFORM_SRC}/core/user-identity/identity/identity.tf`;
+const TERRAFORM_GATEWAYS_DIR = `${TERRAFORM_SRC}/app/gateways`;
+const divergedMessage = (file)=>`${file}: the WAF log group has diverged from the generated shape - left untouched. Its request logs stay unencrypted. To encrypt them, add a customer-managed KMS key granting the \`logs.<region>.amazonaws.com\` service principal kms:Encrypt/Decrypt/ReEncrypt*/GenerateDataKey*/DescribeKey, conditioned on \`kms:EncryptionContext:aws:logs:arn\` matching the log group, and point the log group at it (see the vended WAF log group template).`;
+const ALREADY_ENCRYPTED_TERRAFORM = 'aws_kms_key.';
+// Terraform (HCL) patterns are built from plain strings rather than JS template
+// literals, since the HCL text itself is full of `${...}` interpolations that
+// would otherwise be parsed as JS interpolation.
+const hcl = (pattern)=>'language hcl\n' + pattern;
+const REST_API_LOG_GROUP = {
+    logGroupLabel: 'api_waf_logs',
+    keyLabel: 'waf_logs',
+    nameLocal: 'waf_log_group_name',
+    nameExpression: 'var.enable_waf ? "aws-waf-logs-${var.api_name}-${random_id.waf_log_suffix[0].hex}" : null',
+    keyDescription: '"${var.api_name} API WAF log encryption"',
+    aliasName: '"alias/${var.api_name}-${random_id.waf_log_suffix[0].hex}-waf-logs"',
+    accountId: 'data.aws_caller_identity.current.account_id',
+    region: 'data.aws_region.current.region',
+    tagged: true
+};
+const USER_IDENTITY_LOG_GROUP = {
+    logGroupLabel: 'user_pool_waf_logs',
+    keyLabel: 'user_pool_waf_logs',
+    nameLocal: 'user_pool_waf_log_group_name',
+    nameExpression: 'var.enable_waf ? "aws-waf-logs-UserPool-${random_id.unique_suffix.hex}" : null',
+    keyDescription: '"User pool WAF log encryption"',
+    aliasName: '"alias/user-pool-${random_id.unique_suffix.hex}-waf-logs"',
+    accountId: 'data.aws_caller_identity.current.account_id',
+    region: 'data.aws_region.current.region',
+    tagged: false
+};
+const gatewayLogGroup = (nameKebabCase)=>({
+        logGroupLabel: 'gateway_waf_logs',
+        keyLabel: 'gateway_waf_logs',
+        nameLocal: 'gateway_waf_log_group_name',
+        nameExpression: `var.enable_waf ? "aws-waf-logs-${nameKebabCase}-\${random_id.unique_suffix.hex}" : null`,
+        keyDescription: `"${nameKebabCase} gateway WAF log encryption"`,
+        aliasName: `"alias/${nameKebabCase}-\${random_id.unique_suffix.hex}-waf-logs"`,
+        accountId: 'local.aws_account_id',
+        region: 'local.aws_region',
+        tagged: false
+    });
+/** The KMS key and alias resources, as the templates now vend them. */ const keyResourcesText = (group)=>[
+        '# KMS key for encrypting WAF request logs at rest',
+        `resource "aws_kms_key" "${group.keyLabel}" {`,
+        '  count = var.enable_waf ? 1 : 0',
+        '',
+        `  description             = ${group.keyDescription}`,
+        '  deletion_window_in_days = 7',
+        '  enable_key_rotation     = true',
+        '',
+        '  policy = jsonencode({',
+        '    Version = "2012-10-17"',
+        '    Statement = [',
+        '      {',
+        '        Sid       = "Enable IAM User Permissions"',
+        '        Effect    = "Allow"',
+        `        Principal = { AWS = "arn:aws:iam::\${${group.accountId}}:root" }`,
+        '        Action    = "kms:*"',
+        '        Resource  = "*"',
+        '      },',
+        '      {',
+        '        Sid       = "Allow CloudWatch Logs"',
+        '        Effect    = "Allow"',
+        `        Principal = { Service = "logs.\${${group.region}}.amazonaws.com" }`,
+        '        Action = [',
+        '          "kms:Encrypt",',
+        '          "kms:Decrypt",',
+        '          "kms:ReEncrypt*",',
+        '          "kms:GenerateDataKey*",',
+        '          "kms:DescribeKey"',
+        '        ]',
+        '        Resource = "*"',
+        '        Condition = {',
+        '          ArnEquals = {',
+        `            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:\${${group.region}}:\${${group.accountId}}:log-group:\${local.${group.nameLocal}}"`,
+        '          }',
+        '        }',
+        '      }',
+        '    ]',
+        '  })',
+        ...group.tagged ? [
+            '',
+            '  tags = var.tags'
+        ] : [],
+        '}',
+        '',
+        `resource "aws_kms_alias" "${group.keyLabel}" {`,
+        '  count = var.enable_waf ? 1 : 0',
+        '',
+        `  name          = ${group.aliasName}`,
+        `  target_key_id = aws_kms_key.${group.keyLabel}[0].key_id`,
+        '}'
+    ].join('\n');
+const migrateTerraformLogGroup = async (tree, file, group, nextSteps)=>{
+    const contents = tree.read(file, 'utf-8') ?? '';
+    // The WAF log group is only vended when WAF is enabled, so it may be absent.
+    if (!contents.includes(`"aws_cloudwatch_log_group" "${group.logGroupLabel}"`)) {
+        return;
+    }
+    const LOG_GROUP_BLOCK = hcl(`\`resource "aws_cloudwatch_log_group" "${group.logGroupLabel}" { $body }\``);
+    const NAME_LINE = hcl(`\`name = ${group.nameExpression.replace(/^var\.enable_waf \? /, '').replace(/ : null$/, '')}\` as $line where {\n` + `  $line <: within \`resource "aws_cloudwatch_log_group" "${group.logGroupLabel}" { $_ }\`\n` + '}');
+    const SUPPRESSION_LINE = '#checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption';
+    const LOCALS_BLOCK = hcl('`locals { $body }`');
+    if (contents.includes(ALREADY_ENCRYPTED_TERRAFORM + group.keyLabel)) {
+        return; // Already migrated.
+    }
+    const ready = await matchGritQL(tree, file, LOG_GROUP_BLOCK) && await matchGritQL(tree, file, NAME_LINE) && await matchGritQL(tree, file, LOCALS_BLOCK) && contents.includes(SUPPRESSION_LINE);
+    if (!ready) {
+        nextSteps.push(divergedMessage(file));
+        return;
+    }
+    // 1. Route the log group name through a local, so the key policy's encryption
+    //    context condition can name the same log group.
+    await insertViaGritQL(tree, file, LOCALS_BLOCK + ` as $l => \`locals {\n  $body\n  ${GRIT_INSERT_PLACEHOLDER}\n}\``, `${group.nameLocal} = ${group.nameExpression}`);
+    await applyGritQL(tree, file, NAME_LINE + ` => \`name              = local.${group.nameLocal}\``);
+    // 2. Point the log group at a new key, added after it so the log group keeps
+    //    the comment above it.
+    await insertViaGritQL(tree, file, hcl(`\`name = local.${group.nameLocal}\` as $line where {\n` + `  $line <: within \`resource "aws_cloudwatch_log_group" "${group.logGroupLabel}" { $_ }\`\n` + '}') + ` => \`$line\n  ${GRIT_INSERT_PLACEHOLDER}\``, `kms_key_id        = aws_kms_key.${group.keyLabel}[0].arn`);
+    await insertViaGritQL(tree, file, LOG_GROUP_BLOCK + ` as $lg => \`$lg\n\n${GRIT_INSERT_PLACEHOLDER}\``, keyResourcesText(group));
+    // 3. Drop the suppression the encryption makes redundant.
+    const updated = (tree.read(file, 'utf-8') ?? '').split('\n').filter((line)=>line.trim() !== SUPPRESSION_LINE).join('\n');
+    tree.write(file, updated);
+};
+/**
+ * The vended CDK user-pool WAF log group gains an `encryptionKey`, matching the
+ * eight sibling CDK WAF log groups which already pass one.
+ */ const migrateCdkUserIdentity = async (tree, nextSteps)=>{
+    if (!tree.exists(CDK_USER_IDENTITY_FILE)) {
+        return; // This workspace has no CDK user identity construct.
+    }
+    const contents = tree.read(CDK_USER_IDENTITY_FILE, 'utf-8') ?? '';
+    // The WAF web ACL (and its log group) is optional, so it may be absent.
+    if (!contents.includes(`new LogGroup(this, 'WebAclLogs'`)) {
+        return;
+    }
+    if (contents.includes('WebAclLogsKey')) {
+        return; // Already migrated.
+    }
+    // Already encrypted, whether by this migration or by the user's own key.
+    if (await matchGritQL(tree, CDK_USER_IDENTITY_FILE, "`new LogGroup(this, 'WebAclLogs', { $props })` where { $props <: contains `encryptionKey` }")) {
+        return;
+    }
+    const LOG_GROUP = "`new LogGroup(this, 'WebAclLogs', { $props })` as $lg where { $props <: contains `logGroupName: $name` }";
+    const SUPPRESS_CALL = "`suppressRules(wafLogGroup, ['CKV_AWS_158'], $reason)` as $call";
+    const ready = await matchGritQL(tree, CDK_USER_IDENTITY_FILE, LOG_GROUP) && await matchGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL);
+    if (!ready) {
+        nextSteps.push(divergedMessage(CDK_USER_IDENTITY_FILE));
+        return;
+    }
+    await addDestructuredImport(tree, CDK_USER_IDENTITY_FILE, [
+        'Key'
+    ], 'aws-cdk-lib/aws-kms');
+    await addDestructuredImport(tree, CDK_USER_IDENTITY_FILE, [
+        'Effect',
+        'PolicyStatement',
+        'ServicePrincipal'
+    ], 'aws-cdk-lib/aws-iam');
+    // Hoist the log group name into a const so the key policy's encryption context
+    // condition can name the same log group, then create the key above the group.
+    await insertViaGritQL(tree, CDK_USER_IDENTITY_FILE, "`const wafLogGroup = new LogGroup(this, 'WebAclLogs', { $props })` as $decl => " + `\`${GRIT_INSERT_PLACEHOLDER}\n\n$decl\``, `const stack = Stack.of(this);
+    const wafLogGroupName = \`aws-waf-logs-\${id}-\${this.node.addr.slice(-8)}\`;
+
+    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs
+    const logsKey = new Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.addToResourcePolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        principals: [new ServicePrincipal(\`logs.\${stack.region}.amazonaws.com\`)],
+        actions: [
+          'kms:Encrypt',
+          'kms:Decrypt',
+          'kms:ReEncrypt*',
+          'kms:GenerateDataKey*',
+          'kms:DescribeKey',
+        ],
+        resources: ['*'],
+        conditions: {
+          ArnEquals: {
+            'kms:EncryptionContext:aws:logs:arn': \`arn:aws:logs:\${stack.region}:\${stack.account}:log-group:\${wafLogGroupName}\`,
+          },
+        },
+      }),
+    );`);
+    await applyGritQL(tree, CDK_USER_IDENTITY_FILE, "`logGroupName: $name` as $prop where { $prop <: within `new LogGroup(this, 'WebAclLogs', $_)` } => `logGroupName: wafLogGroupName,\n      encryptionKey: logsKey`");
+    // Drop the suppression the encryption makes redundant.
+    await applyGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL + ' => ``');
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (tree.exists(TERRAFORM_REST_API_FILE)) {
+        await migrateTerraformLogGroup(tree, TERRAFORM_REST_API_FILE, REST_API_LOG_GROUP, nextSteps);
+    }
+    if (tree.exists(TERRAFORM_USER_IDENTITY_FILE)) {
+        await migrateTerraformLogGroup(tree, TERRAFORM_USER_IDENTITY_FILE, USER_IDENTITY_LOG_GROUP, nextSteps);
+    }
+    if (tree.exists(TERRAFORM_GATEWAYS_DIR)) {
+        for (const dirName of tree.children(TERRAFORM_GATEWAYS_DIR)){
+            const file = joinPathFragments(TERRAFORM_GATEWAYS_DIR, dirName, `${dirName}.tf`);
+            if (tree.exists(file)) {
+                await migrateTerraformLogGroup(tree, file, gatewayLogGroup(dirName), nextSteps);
+            }
+        }
+    }
+    await migrateCdkUserIdentity(tree, nextSteps);
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/v1.0.0-rc.84/0004-waf-log-group-cmk-encryption/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.0-rc.84/0004-waf-log-group-cmk-encryption/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  addDestructuredImport,\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * WAF request logs carry full request metadata - URIs, headers and client IPs -\n * so the vended WAF log groups are encrypted with a customer-managed KMS key,\n * matching how the vended access log groups beside them already are. Three were\n * plaintext: the Terraform REST API and user-pool WAF log groups, the Terraform\n * AgentCore gateway WAF log group, and the CDK user-pool WAF log group. Each now\n * gets a key whose policy grants CloudWatch Logs use of it, scoped by\n * `kms:EncryptionContext:aws:logs:arn` to that log group alone.\n *\n * CloudWatch Logs cannot encrypt a log group that already exists in place, so\n * this only rewrites the vended templates. On the next deploy Terraform sets\n * `kms_key_id` on the existing group (an in-place update) and CloudFormation\n * replaces the CDK one, which the vended `RemovalPolicy.DESTROY` already allows.\n * Events written before then stay unencrypted; the `nextSteps` note says so.\n */\n\nconst CONSTRUCTS_SRC = `${PACKAGES_DIR}/${SHARED_CONSTRUCTS_DIR}/src`;\nconst TERRAFORM_SRC = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src`;\n\nconst CDK_USER_IDENTITY_FILE = `${CONSTRUCTS_SRC}/core/user-identity.ts`;\nconst TERRAFORM_REST_API_FILE = `${TERRAFORM_SRC}/core/api/rest-api/rest-api.tf`;\nconst TERRAFORM_USER_IDENTITY_FILE = `${TERRAFORM_SRC}/core/user-identity/identity/identity.tf`;\nconst TERRAFORM_GATEWAYS_DIR = `${TERRAFORM_SRC}/app/gateways`;\n\nconst divergedMessage = (file: string) =>\n  `${file}: the WAF log group has diverged from the generated shape - left untouched. Its request logs stay unencrypted. To encrypt them, add a customer-managed KMS key granting the \\`logs.<region>.amazonaws.com\\` service principal kms:Encrypt/Decrypt/ReEncrypt*/GenerateDataKey*/DescribeKey, conditioned on \\`kms:EncryptionContext:aws:logs:arn\\` matching the log group, and point the log group at it (see the vended WAF log group template).`;\n\nconst ALREADY_ENCRYPTED_TERRAFORM = 'aws_kms_key.';\n\n// Terraform (HCL) patterns are built from plain strings rather than JS template\n// literals, since the HCL text itself is full of `${...}` interpolations that\n// would otherwise be parsed as JS interpolation.\nconst hcl = (pattern: string) => 'language hcl\\n' + pattern;\n\n/** A vended Terraform WAF log group and the key this migration gives it. */\ninterface TerraformWafLogGroup {\n  /** The `aws_cloudwatch_log_group` resource label. */\n  readonly logGroupLabel: string;\n  /** The `aws_kms_key` / `aws_kms_alias` label to create. */\n  readonly keyLabel: string;\n  /** The `locals` entry the log group name moves into. */\n  readonly nameLocal: string;\n  /** The log group's name expression, which becomes the local's value. */\n  readonly nameExpression: string;\n  /** The KMS key description. */\n  readonly keyDescription: string;\n  /** The KMS alias name expression. */\n  readonly aliasName: string;\n  /** How the account id is referenced in this module. */\n  readonly accountId: string;\n  /** How the region is referenced in this module. */\n  readonly region: string;\n  /** Whether the module tags its resources. */\n  readonly tagged: boolean;\n}\n\nconst REST_API_LOG_GROUP: TerraformWafLogGroup = {\n  logGroupLabel: 'api_waf_logs',\n  keyLabel: 'waf_logs',\n  nameLocal: 'waf_log_group_name',\n  nameExpression:\n    'var.enable_waf ? \"aws-waf-logs-${var.api_name}-${random_id.waf_log_suffix[0].hex}\" : null',\n  keyDescription: '\"${var.api_name} API WAF log encryption\"',\n  aliasName:\n    '\"alias/${var.api_name}-${random_id.waf_log_suffix[0].hex}-waf-logs\"',\n  accountId: 'data.aws_caller_identity.current.account_id',\n  region: 'data.aws_region.current.region',\n  tagged: true,\n};\n\nconst USER_IDENTITY_LOG_GROUP: TerraformWafLogGroup = {\n  logGroupLabel: 'user_pool_waf_logs',\n  keyLabel: 'user_pool_waf_logs',\n  nameLocal: 'user_pool_waf_log_group_name',\n  nameExpression:\n    'var.enable_waf ? \"aws-waf-logs-UserPool-${random_id.unique_suffix.hex}\" : null',\n  keyDescription: '\"User pool WAF log encryption\"',\n  aliasName: '\"alias/user-pool-${random_id.unique_suffix.hex}-waf-logs\"',\n  accountId: 'data.aws_caller_identity.current.account_id',\n  region: 'data.aws_region.current.region',\n  tagged: false,\n};\n\nconst gatewayLogGroup = (nameKebabCase: string): TerraformWafLogGroup => ({\n  logGroupLabel: 'gateway_waf_logs',\n  keyLabel: 'gateway_waf_logs',\n  nameLocal: 'gateway_waf_log_group_name',\n  nameExpression: `var.enable_waf ? \"aws-waf-logs-${nameKebabCase}-\\${random_id.unique_suffix.hex}\" : null`,\n  keyDescription: `\"${nameKebabCase} gateway WAF log encryption\"`,\n  aliasName: `\"alias/${nameKebabCase}-\\${random_id.unique_suffix.hex}-waf-logs\"`,\n  accountId: 'local.aws_account_id',\n  region: 'local.aws_region',\n  tagged: false,\n});\n\n/** The KMS key and alias resources, as the templates now vend them. */\nconst keyResourcesText = (group: TerraformWafLogGroup): string =>\n  [\n    '# KMS key for encrypting WAF request logs at rest',\n    `resource \"aws_kms_key\" \"${group.keyLabel}\" {`,\n    '  count = var.enable_waf ? 1 : 0',\n    '',\n    `  description             = ${group.keyDescription}`,\n    '  deletion_window_in_days = 7',\n    '  enable_key_rotation     = true',\n    '',\n    '  policy = jsonencode({',\n    '    Version = \"2012-10-17\"',\n    '    Statement = [',\n    '      {',\n    '        Sid       = \"Enable IAM User Permissions\"',\n    '        Effect    = \"Allow\"',\n    `        Principal = { AWS = \"arn:aws:iam::\\${${group.accountId}}:root\" }`,\n    '        Action    = \"kms:*\"',\n    '        Resource  = \"*\"',\n    '      },',\n    '      {',\n    '        Sid       = \"Allow CloudWatch Logs\"',\n    '        Effect    = \"Allow\"',\n    `        Principal = { Service = \"logs.\\${${group.region}}.amazonaws.com\" }`,\n    '        Action = [',\n    '          \"kms:Encrypt\",',\n    '          \"kms:Decrypt\",',\n    '          \"kms:ReEncrypt*\",',\n    '          \"kms:GenerateDataKey*\",',\n    '          \"kms:DescribeKey\"',\n    '        ]',\n    '        Resource = \"*\"',\n    '        Condition = {',\n    '          ArnEquals = {',\n    `            \"kms:EncryptionContext:aws:logs:arn\" = \"arn:aws:logs:\\${${group.region}}:\\${${group.accountId}}:log-group:\\${local.${group.nameLocal}}\"`,\n    '          }',\n    '        }',\n    '      }',\n    '    ]',\n    '  })',\n    ...(group.tagged ? ['', '  tags = var.tags'] : []),\n    '}',\n    '',\n    `resource \"aws_kms_alias\" \"${group.keyLabel}\" {`,\n    '  count = var.enable_waf ? 1 : 0',\n    '',\n    `  name          = ${group.aliasName}`,\n    `  target_key_id = aws_kms_key.${group.keyLabel}[0].key_id`,\n    '}',\n  ].join('\\n');\n\nconst migrateTerraformLogGroup = async (\n  tree: Tree,\n  file: string,\n  group: TerraformWafLogGroup,\n  nextSteps: string[],\n): Promise<void> => {\n  const contents = tree.read(file, 'utf-8') ?? '';\n\n  // The WAF log group is only vended when WAF is enabled, so it may be absent.\n  if (\n    !contents.includes(`\"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\"`)\n  ) {\n    return;\n  }\n\n  const LOG_GROUP_BLOCK = hcl(\n    `\\`resource \"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\" { $body }\\``,\n  );\n  const NAME_LINE = hcl(\n    `\\`name = ${group.nameExpression.replace(/^var\\.enable_waf \\? /, '').replace(/ : null$/, '')}\\` as $line where {\\n` +\n      `  $line <: within \\`resource \"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\" { $_ }\\`\\n` +\n      '}',\n  );\n  const SUPPRESSION_LINE =\n    '#checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption';\n  const LOCALS_BLOCK = hcl('`locals { $body }`');\n\n  if (contents.includes(ALREADY_ENCRYPTED_TERRAFORM + group.keyLabel)) {\n    return; // Already migrated.\n  }\n\n  const ready =\n    (await matchGritQL(tree, file, LOG_GROUP_BLOCK)) &&\n    (await matchGritQL(tree, file, NAME_LINE)) &&\n    (await matchGritQL(tree, file, LOCALS_BLOCK)) &&\n    contents.includes(SUPPRESSION_LINE);\n\n  if (!ready) {\n    nextSteps.push(divergedMessage(file));\n    return;\n  }\n\n  // 1. Route the log group name through a local, so the key policy's encryption\n  //    context condition can name the same log group.\n  await insertViaGritQL(\n    tree,\n    file,\n    LOCALS_BLOCK +\n      ` as $l => \\`locals {\\n  $body\\n  ${GRIT_INSERT_PLACEHOLDER}\\n}\\``,\n    `${group.nameLocal} = ${group.nameExpression}`,\n  );\n  await applyGritQL(\n    tree,\n    file,\n    NAME_LINE + ` => \\`name              = local.${group.nameLocal}\\``,\n  );\n\n  // 2. Point the log group at a new key, added after it so the log group keeps\n  //    the comment above it.\n  await insertViaGritQL(\n    tree,\n    file,\n    hcl(\n      `\\`name = local.${group.nameLocal}\\` as $line where {\\n` +\n        `  $line <: within \\`resource \"aws_cloudwatch_log_group\" \"${group.logGroupLabel}\" { $_ }\\`\\n` +\n        '}',\n    ) + ` => \\`$line\\n  ${GRIT_INSERT_PLACEHOLDER}\\``,\n    `kms_key_id        = aws_kms_key.${group.keyLabel}[0].arn`,\n  );\n  await insertViaGritQL(\n    tree,\n    file,\n    LOG_GROUP_BLOCK + ` as $lg => \\`$lg\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    keyResourcesText(group),\n  );\n\n  // 3. Drop the suppression the encryption makes redundant.\n  const updated = (tree.read(file, 'utf-8') ?? '')\n    .split('\\n')\n    .filter((line) => line.trim() !== SUPPRESSION_LINE)\n    .join('\\n');\n  tree.write(file, updated);\n};\n\n/**\n * The vended CDK user-pool WAF log group gains an `encryptionKey`, matching the\n * eight sibling CDK WAF log groups which already pass one.\n */\nconst migrateCdkUserIdentity = async (\n  tree: Tree,\n  nextSteps: string[],\n): Promise<void> => {\n  if (!tree.exists(CDK_USER_IDENTITY_FILE)) {\n    return; // This workspace has no CDK user identity construct.\n  }\n\n  const contents = tree.read(CDK_USER_IDENTITY_FILE, 'utf-8') ?? '';\n\n  // The WAF web ACL (and its log group) is optional, so it may be absent.\n  if (!contents.includes(`new LogGroup(this, 'WebAclLogs'`)) {\n    return;\n  }\n\n  if (contents.includes('WebAclLogsKey')) {\n    return; // Already migrated.\n  }\n\n  // Already encrypted, whether by this migration or by the user's own key.\n  if (\n    await matchGritQL(\n      tree,\n      CDK_USER_IDENTITY_FILE,\n      \"`new LogGroup(this, 'WebAclLogs', { $props })` where { $props <: contains `encryptionKey` }\",\n    )\n  ) {\n    return;\n  }\n\n  const LOG_GROUP =\n    \"`new LogGroup(this, 'WebAclLogs', { $props })` as $lg where { $props <: contains `logGroupName: $name` }\";\n  const SUPPRESS_CALL =\n    \"`suppressRules(wafLogGroup, ['CKV_AWS_158'], $reason)` as $call\";\n\n  const ready =\n    (await matchGritQL(tree, CDK_USER_IDENTITY_FILE, LOG_GROUP)) &&\n    (await matchGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL));\n\n  if (!ready) {\n    nextSteps.push(divergedMessage(CDK_USER_IDENTITY_FILE));\n    return;\n  }\n\n  await addDestructuredImport(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    ['Key'],\n    'aws-cdk-lib/aws-kms',\n  );\n  await addDestructuredImport(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    ['Effect', 'PolicyStatement', 'ServicePrincipal'],\n    'aws-cdk-lib/aws-iam',\n  );\n\n  // Hoist the log group name into a const so the key policy's encryption context\n  // condition can name the same log group, then create the key above the group.\n  await insertViaGritQL(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    \"`const wafLogGroup = new LogGroup(this, 'WebAclLogs', { $props })` as $decl => \" +\n      `\\`${GRIT_INSERT_PLACEHOLDER}\\n\\n$decl\\``,\n    `const stack = Stack.of(this);\n    const wafLogGroupName = \\`aws-waf-logs-\\${id}-\\${this.node.addr.slice(-8)}\\`;\n\n    // KMS key for encrypting WAF logs at rest, usable by CloudWatch Logs\n    const logsKey = new Key(this, 'WebAclLogsKey', {\n      enableKeyRotation: true,\n    });\n    logsKey.addToResourcePolicy(\n      new PolicyStatement({\n        effect: Effect.ALLOW,\n        principals: [new ServicePrincipal(\\`logs.\\${stack.region}.amazonaws.com\\`)],\n        actions: [\n          'kms:Encrypt',\n          'kms:Decrypt',\n          'kms:ReEncrypt*',\n          'kms:GenerateDataKey*',\n          'kms:DescribeKey',\n        ],\n        resources: ['*'],\n        conditions: {\n          ArnEquals: {\n            'kms:EncryptionContext:aws:logs:arn': \\`arn:aws:logs:\\${stack.region}:\\${stack.account}:log-group:\\${wafLogGroupName}\\`,\n          },\n        },\n      }),\n    );`,\n  );\n\n  await applyGritQL(\n    tree,\n    CDK_USER_IDENTITY_FILE,\n    \"`logGroupName: $name` as $prop where { $prop <: within `new LogGroup(this, 'WebAclLogs', $_)` } => `logGroupName: wafLogGroupName,\\n      encryptionKey: logsKey`\",\n  );\n\n  // Drop the suppression the encryption makes redundant.\n  await applyGritQL(tree, CDK_USER_IDENTITY_FILE, SUPPRESS_CALL + ' => ``');\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (tree.exists(TERRAFORM_REST_API_FILE)) {\n    await migrateTerraformLogGroup(\n      tree,\n      TERRAFORM_REST_API_FILE,\n      REST_API_LOG_GROUP,\n      nextSteps,\n    );\n  }\n  if (tree.exists(TERRAFORM_USER_IDENTITY_FILE)) {\n    await migrateTerraformLogGroup(\n      tree,\n      TERRAFORM_USER_IDENTITY_FILE,\n      USER_IDENTITY_LOG_GROUP,\n      nextSteps,\n    );\n  }\n  if (tree.exists(TERRAFORM_GATEWAYS_DIR)) {\n    for (const dirName of tree.children(TERRAFORM_GATEWAYS_DIR)) {\n      const file = joinPathFragments(\n        TERRAFORM_GATEWAYS_DIR,\n        dirName,\n        `${dirName}.tf`,\n      );\n      if (tree.exists(file)) {\n        await migrateTerraformLogGroup(\n          tree,\n          file,\n          gatewayLogGroup(dirName),\n          nextSteps,\n        );\n      }\n    }\n  }\n\n  await migrateCdkUserIdentity(tree, nextSteps);\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","addDestructuredImport","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","CONSTRUCTS_SRC","TERRAFORM_SRC","CDK_USER_IDENTITY_FILE","TERRAFORM_REST_API_FILE","TERRAFORM_USER_IDENTITY_FILE","TERRAFORM_GATEWAYS_DIR","divergedMessage","file","ALREADY_ENCRYPTED_TERRAFORM","hcl","pattern","REST_API_LOG_GROUP","logGroupLabel","keyLabel","nameLocal","nameExpression","keyDescription","aliasName","accountId","region","tagged","USER_IDENTITY_LOG_GROUP","gatewayLogGroup","nameKebabCase","keyResourcesText","group","join","migrateTerraformLogGroup","tree","nextSteps","contents","read","includes","LOG_GROUP_BLOCK","NAME_LINE","replace","SUPPRESSION_LINE","LOCALS_BLOCK","ready","push","updated","split","filter","line","trim","write","migrateCdkUserIdentity","exists","LOG_GROUP","SUPPRESS_CALL","migration","dirName","children"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,qBAAqB,EACrBC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;CAcC,GAED,MAAMC,iBAAiB,GAAGH,aAAa,CAAC,EAAEC,sBAAsB,IAAI,CAAC;AACrE,MAAMG,gBAAgB,GAAGJ,aAAa,CAAC,EAAEE,qBAAqB,IAAI,CAAC;AAEnE,MAAMG,yBAAyB,GAAGF,eAAe,sBAAsB,CAAC;AACxE,MAAMG,0BAA0B,GAAGF,cAAc,8BAA8B,CAAC;AAChF,MAAMG,+BAA+B,GAAGH,cAAc,wCAAwC,CAAC;AAC/F,MAAMI,yBAAyB,GAAGJ,cAAc,aAAa,CAAC;AAE9D,MAAMK,kBAAkB,CAACC,OACvB,GAAGA,KAAK,+aAA+a,CAAC;AAE1b,MAAMC,8BAA8B;AAEpC,gFAAgF;AAChF,8EAA8E;AAC9E,iDAAiD;AACjD,MAAMC,MAAM,CAACC,UAAoB,mBAAmBA;AAwBpD,MAAMC,qBAA2C;IAC/CC,eAAe;IACfC,UAAU;IACVC,WAAW;IACXC,gBACE;IACFC,gBAAgB;IAChBC,WACE;IACFC,WAAW;IACXC,QAAQ;IACRC,QAAQ;AACV;AAEA,MAAMC,0BAAgD;IACpDT,eAAe;IACfC,UAAU;IACVC,WAAW;IACXC,gBACE;IACFC,gBAAgB;IAChBC,WAAW;IACXC,WAAW;IACXC,QAAQ;IACRC,QAAQ;AACV;AAEA,MAAME,kBAAkB,CAACC,gBAAiD,CAAA;QACxEX,eAAe;QACfC,UAAU;QACVC,WAAW;QACXC,gBAAgB,CAAC,+BAA+B,EAAEQ,cAAc,wCAAwC,CAAC;QACzGP,gBAAgB,CAAC,CAAC,EAAEO,cAAc,4BAA4B,CAAC;QAC/DN,WAAW,CAAC,OAAO,EAAEM,cAAc,0CAA0C,CAAC;QAC9EL,WAAW;QACXC,QAAQ;QACRC,QAAQ;IACV,CAAA;AAEA,qEAAqE,GACrE,MAAMI,mBAAmB,CAACC,QACxB;QACE;QACA,CAAC,wBAAwB,EAAEA,MAAMZ,QAAQ,CAAC,GAAG,CAAC;QAC9C;QACA;QACA,CAAC,4BAA4B,EAAEY,MAAMT,cAAc,EAAE;QACrD;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,CAAC,6CAA6C,EAAES,MAAMP,SAAS,CAAC,SAAS,CAAC;QAC1E;QACA;QACA;QACA;QACA;QACA;QACA,CAAC,yCAAyC,EAAEO,MAAMN,MAAM,CAAC,kBAAkB,CAAC;QAC5E;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,CAAC,oEAAoE,EAAEM,MAAMN,MAAM,CAAC,KAAK,EAAEM,MAAMP,SAAS,CAAC,qBAAqB,EAAEO,MAAMX,SAAS,CAAC,EAAE,CAAC;QACrJ;QACA;QACA;QACA;QACA;WACIW,MAAML,MAAM,GAAG;YAAC;YAAI;SAAoB,GAAG,EAAE;QACjD;QACA;QACA,CAAC,0BAA0B,EAAEK,MAAMZ,QAAQ,CAAC,GAAG,CAAC;QAChD;QACA;QACA,CAAC,kBAAkB,EAAEY,MAAMR,SAAS,EAAE;QACtC,CAAC,8BAA8B,EAAEQ,MAAMZ,QAAQ,CAAC,UAAU,CAAC;QAC3D;KACD,CAACa,IAAI,CAAC;AAET,MAAMC,2BAA2B,OAC/BC,MACArB,MACAkB,OACAI;IAEA,MAAMC,WAAWF,KAAKG,IAAI,CAACxB,MAAM,YAAY;IAE7C,6EAA6E;IAC7E,IACE,CAACuB,SAASE,QAAQ,CAAC,CAAC,4BAA4B,EAAEP,MAAMb,aAAa,CAAC,CAAC,CAAC,GACxE;QACA;IACF;IAEA,MAAMqB,kBAAkBxB,IACtB,CAAC,uCAAuC,EAAEgB,MAAMb,aAAa,CAAC,aAAa,CAAC;IAE9E,MAAMsB,YAAYzB,IAChB,CAAC,SAAS,EAAEgB,MAAMV,cAAc,CAACoB,OAAO,CAAC,wBAAwB,IAAIA,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,GACjH,CAAC,yDAAyD,EAAEV,MAAMb,aAAa,CAAC,YAAY,CAAC,GAC7F;IAEJ,MAAMwB,mBACJ;IACF,MAAMC,eAAe5B,IAAI;IAEzB,IAAIqB,SAASE,QAAQ,CAACxB,8BAA8BiB,MAAMZ,QAAQ,GAAG;QACnE,QAAQ,oBAAoB;IAC9B;IAEA,MAAMyB,QACJ,AAAC,MAAM3C,YAAYiC,MAAMrB,MAAM0B,oBAC9B,MAAMtC,YAAYiC,MAAMrB,MAAM2B,cAC9B,MAAMvC,YAAYiC,MAAMrB,MAAM8B,iBAC/BP,SAASE,QAAQ,CAACI;IAEpB,IAAI,CAACE,OAAO;QACVT,UAAUU,IAAI,CAACjC,gBAAgBC;QAC/B;IACF;IAEA,8EAA8E;IAC9E,oDAAoD;IACpD,MAAMb,gBACJkC,MACArB,MACA8B,eACE,CAAC,iCAAiC,EAAE5C,wBAAwB,KAAK,CAAC,EACpE,GAAGgC,MAAMX,SAAS,CAAC,GAAG,EAAEW,MAAMV,cAAc,EAAE;IAEhD,MAAMvB,YACJoC,MACArB,MACA2B,YAAY,CAAC,gCAAgC,EAAET,MAAMX,SAAS,CAAC,EAAE,CAAC;IAGpE,6EAA6E;IAC7E,2BAA2B;IAC3B,MAAMpB,gBACJkC,MACArB,MACAE,IACE,CAAC,eAAe,EAAEgB,MAAMX,SAAS,CAAC,qBAAqB,CAAC,GACtD,CAAC,yDAAyD,EAAEW,MAAMb,aAAa,CAAC,YAAY,CAAC,GAC7F,OACA,CAAC,eAAe,EAAEnB,wBAAwB,EAAE,CAAC,EACjD,CAAC,gCAAgC,EAAEgC,MAAMZ,QAAQ,CAAC,OAAO,CAAC;IAE5D,MAAMnB,gBACJkC,MACArB,MACA0B,kBAAkB,CAAC,oBAAoB,EAAExC,wBAAwB,EAAE,CAAC,EACpE+B,iBAAiBC;IAGnB,0DAA0D;IAC1D,MAAMe,UAAU,AAACZ,CAAAA,KAAKG,IAAI,CAACxB,MAAM,YAAY,EAAC,EAC3CkC,KAAK,CAAC,MACNC,MAAM,CAAC,CAACC,OAASA,KAAKC,IAAI,OAAOR,kBACjCV,IAAI,CAAC;IACRE,KAAKiB,KAAK,CAACtC,MAAMiC;AACnB;AAEA;;;CAGC,GACD,MAAMM,yBAAyB,OAC7BlB,MACAC;IAEA,IAAI,CAACD,KAAKmB,MAAM,CAAC7C,yBAAyB;QACxC,QAAQ,qDAAqD;IAC/D;IAEA,MAAM4B,WAAWF,KAAKG,IAAI,CAAC7B,wBAAwB,YAAY;IAE/D,wEAAwE;IACxE,IAAI,CAAC4B,SAASE,QAAQ,CAAC,CAAC,+BAA+B,CAAC,GAAG;QACzD;IACF;IAEA,IAAIF,SAASE,QAAQ,CAAC,kBAAkB;QACtC,QAAQ,oBAAoB;IAC9B;IAEA,yEAAyE;IACzE,IACE,MAAMrC,YACJiC,MACA1B,wBACA,gGAEF;QACA;IACF;IAEA,MAAM8C,YACJ;IACF,MAAMC,gBACJ;IAEF,MAAMX,QACJ,AAAC,MAAM3C,YAAYiC,MAAM1B,wBAAwB8C,cAChD,MAAMrD,YAAYiC,MAAM1B,wBAAwB+C;IAEnD,IAAI,CAACX,OAAO;QACVT,UAAUU,IAAI,CAACjC,gBAAgBJ;QAC/B;IACF;IAEA,MAAMX,sBACJqC,MACA1B,wBACA;QAAC;KAAM,EACP;IAEF,MAAMX,sBACJqC,MACA1B,wBACA;QAAC;QAAU;QAAmB;KAAmB,EACjD;IAGF,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAMR,gBACJkC,MACA1B,wBACA,oFACE,CAAC,EAAE,EAAET,wBAAwB,WAAW,CAAC,EAC3C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;MAyBC,CAAC;IAGL,MAAMD,YACJoC,MACA1B,wBACA;IAGF,uDAAuD;IACvD,MAAMV,YAAYoC,MAAM1B,wBAAwB+C,gBAAgB;AAClE;AAEA,eAAe,eAAeC,UAC5BtB,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,IAAID,KAAKmB,MAAM,CAAC5C,0BAA0B;QACxC,MAAMwB,yBACJC,MACAzB,yBACAQ,oBACAkB;IAEJ;IACA,IAAID,KAAKmB,MAAM,CAAC3C,+BAA+B;QAC7C,MAAMuB,yBACJC,MACAxB,8BACAiB,yBACAQ;IAEJ;IACA,IAAID,KAAKmB,MAAM,CAAC1C,yBAAyB;QACvC,KAAK,MAAM8C,WAAWvB,KAAKwB,QAAQ,CAAC/C,wBAAyB;YAC3D,MAAME,OAAOjB,kBACXe,wBACA8C,SACA,GAAGA,QAAQ,GAAG,CAAC;YAEjB,IAAIvB,KAAKmB,MAAM,CAACxC,OAAO;gBACrB,MAAMoB,yBACJC,MACArB,MACAe,gBAAgB6B,UAChBtB;YAEJ;QACF;IACF;IAEA,MAAMiB,uBAAuBlB,MAAMC;IAEnC,MAAMjC,qBAAqBgC;IAE3B,OAAO;QAAEC;IAAU;AACrB"}