@aws/nx-plugin 1.0.4 → 1.0.5

package/src/utils/api-constructs/files/cdk/core/api/http/http-api.ts.template

@@ -7,10 +7,12 @@ import {
 } from './utils<% if (esm) { %>.js<% } %>';
 import { CfnOutput, Stack } from 'aws-cdk-lib';
 import {
+  DomainMappingOptions,
   HttpApi as _HttpApi,
   HttpApiProps as _HttpApiProps,
   HttpMethod,
   HttpStage,
+  IDomainName,
   LogGroupLogDestination,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigatewayv2';
@@ -28,7 +30,7 @@ import { suppressRules } from '../checkov<% if (esm) { %>.js<% } %>';
 export interface HttpApiProps<
   TIntegrations extends ApiIntegrations<TOperation, HttpApiIntegration>,
   TOperation extends string,
-> extends _HttpApiProps {
+> extends Omit<_HttpApiProps, 'defaultDomainMapping'> {
   /**
    * Unique name for the API, used in runtime configuration
    */
@@ -47,6 +49,12 @@ export interface HttpApiProps<
    * @default { rateLimit: 10000, burstLimit: 5000 }
    */
   readonly throttle?: ThrottleSettings;
+  /**
+   * Custom domain mapped to the API's default stage
+   */
+  readonly defaultDomainMapping?: DomainMappingOptions & {
+    readonly domainName: IDomainName;
+  };
 }
 
 /**
@@ -70,6 +78,9 @@ export class HttpApi<
   /** Default auto-deployed stage */
   public readonly defaultStage: HttpStage;
 
+  /** The URL clients call: the custom domain's if one is mapped, otherwise the stage's */
+  private readonly apiUrl: string;
+
   /** Map of operation names to their API Gateway integrations */
   public readonly integrations: TIntegrations;
 
@@ -81,6 +92,7 @@ export class HttpApi<
       operations,
       integrations,
       throttle = { rateLimit: 10000, burstLimit: 5000 },
+      defaultDomainMapping,
       ...props
     }: HttpApiProps<TIntegrations, TOperation>,
   ) {
@@ -113,12 +125,16 @@ export class HttpApi<
 
     this.defaultStage = new HttpStage(this, 'DefaultStage', {
       httpApi: this.api,
+      domainMapping: defaultDomainMapping,
       autoDeploy: true,
       throttle,
       accessLogSettings: {
         destination: new LogGroupLogDestination(accessLogGroup),
       },
     });
+    this.apiUrl = defaultDomainMapping
+      ? this.defaultStage.domainUrl
+      : this.defaultStage.url!;
 
     // Resolve the integration for a given operation.
     // If the operation has a dedicated integration, use it; otherwise fall back to $router.
@@ -151,21 +167,35 @@ export class HttpApi<
     );
 
     new CfnOutput(this, `${apiName}Url`, {
-      value: this.defaultStage.url!,
+      value: this.apiUrl,
     });
 
     // Register the API URL in runtime configuration for client discovery
     const rc = RuntimeConfig.ensure(this);
     rc.set('connection', 'apis', {
       ...rc.get('connection').apis,
-      [apiName]: this.defaultStage.url!,
+      [apiName]: this.apiUrl,
     });
+
+    // Target for the custom domain's DNS record
+    if (defaultDomainMapping) {
+      new CfnOutput(this, `${apiName}DomainNameAlias`, {
+        value: defaultDomainMapping.domainName.regionalDomainName,
+        description:
+          'Regional domain name to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, `${apiName}DomainNameAliasHostedZoneId`, {
+        value: defaultDomainMapping.domainName.regionalHostedZoneId,
+        description:
+          'Hosted zone ID of the regional domain name, needed only for a Route 53 alias record',
+      });
+    }
   }
 
   /**
    * Return the API url
    */
   public get url() {
-    return this.defaultStage.url;
+    return this.apiUrl;
   }
 }

package/src/utils/api-constructs/files/cdk/core/api/rest/rest-api.ts.template

@@ -10,7 +10,7 @@ import {
   Stage,
   ThrottleSettings,
 } from 'aws-cdk-lib/aws-apigateway';
-import { IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { CfnOutput, IAspect, RemovalPolicy, Stack } from 'aws-cdk-lib';
 import {
   CfnLoggingConfiguration,
   CfnWebACL,
@@ -99,6 +99,7 @@ export class RestApi<
       integrations,
       enableWaf = true,
       throttle = { rateLimit: 10000, burstLimit: 5000 },
+      domainName,
       ...props
     }: RestApiProps<TIntegrations, TOperation>,
   ) {
@@ -124,6 +125,7 @@ export class RestApi<
     // Create the API Gateway REST API
     this.api = new _RestApi(this, 'Api', {
       ...props,
+      domainName,
       deployOptions: {
         accessLogDestination: new LogGroupLogDestination(accessLogs),
         accessLogFormat: AccessLogFormat.jsonWithStandardFields(),
@@ -265,8 +267,24 @@ export class RestApi<
     const rc = RuntimeConfig.ensure(this);
     rc.set('connection', 'apis', {
       ...rc.get('connection').apis,
-      [apiName]: this.api.url!,
+      [apiName]: domainName
+        ? `https://${domainName.domainName}/${domainName.basePath ? `${domainName.basePath}/` : ''}`
+        : this.api.url!,
     });
+
+    // Target for the custom domain's DNS record
+    if (domainName) {
+      new CfnOutput(this, `${apiName}DomainNameAlias`, {
+        value: this.api.domainName!.domainNameAliasDomainName,
+        description:
+          'Domain name of the API Gateway endpoint (regional or edge) to point a CNAME record at for the custom domain, with any DNS provider',
+      });
+      new CfnOutput(this, `${apiName}DomainNameAliasHostedZoneId`, {
+        value: this.api.domainName!.domainNameAliasHostedZoneId,
+        description:
+          'Hosted zone ID of that domain name, needed only for a Route 53 alias record',
+      });
+    }
   }
 
   /**

package/src/utils/api-constructs/files/terraform/app/apis/http/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -125,6 +125,19 @@ variable "tags" {
   default     = {}
 }
 
+# Custom domain configuration
+variable "custom_domain_name" {
+  description = "Custom domain name for the API. Requires acm_certificate_arn."
+  type        = string
+  default     = null
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in the API's region) for the custom domain name."
+  type        = string
+  default     = null
+}
+
 # Get current AWS region and account ID
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
@@ -431,6 +444,10 @@ locals {
 <%_ } _%>
 }
 
+locals {
+  api_url = var.custom_domain_name == null ? module.http_api.stage_invoke_url : "https://${var.custom_domain_name}/"
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -674,11 +691,41 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "<%- apiNameClassName %>" = module.http_api.stage_invoke_url }
+  value     = { "<%- apiNameClassName %>" = local.api_url }
 
   depends_on = [module.http_api]
 }
 
+# Custom domain for the API
+resource "aws_apigatewayv2_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name = var.custom_domain_name
+
+  domain_name_configuration {
+    certificate_arn = var.acm_certificate_arn
+    endpoint_type   = "REGIONAL"
+    security_policy = "TLS_1_2"
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_apigatewayv2_api_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.http_api.api_id
+  stage       = module.http_api.stage_id
+  domain_name = aws_apigatewayv2_domain_name.custom_domain[0].domain_name
+}
+
 # Lambda permission for API Gateway to invoke the function<% if (backend.type === 'fastapi') { %> via alias<% } %>
 resource "aws_lambda_permission" "api_gateway_invoke" {
   <%_ if (backend.integrationPattern === 'isolated') { _%>
@@ -738,6 +785,21 @@ output "stage_invoke_url" {
   value       = module.http_api.stage_invoke_url
 }
 
+output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].target_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_apigatewayv2_domain_name.custom_domain[0].domain_name_configuration[0].hosted_zone_id
+}
+
 output "stage_arn" {
   description = "ARN of the API Gateway stage"
   value       = module.http_api.stage_arn

package/src/utils/api-constructs/files/terraform/app/apis/rest/__apiNameKebabCase__/__apiNameKebabCase__.tf.template

@@ -121,6 +121,19 @@ variable "tags" {
   default     = {}
 }
 
+# Custom domain configuration
+variable "custom_domain_name" {
+  description = "Custom domain name for the API. Requires acm_certificate_arn."
+  type        = string
+  default     = null
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in the API's region) for the custom domain name."
+  type        = string
+  default     = null
+}
+
 # Get current AWS region and account ID
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
@@ -485,6 +498,10 @@ locals {
 <%_ } _%>
 }
 
+locals {
+  api_url = var.custom_domain_name == null ? "${aws_api_gateway_stage.api_stage.invoke_url}/" : "https://${var.custom_domain_name}/"
+}
+
 # CloudWatch Log Group for Lambda
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
@@ -1139,11 +1156,41 @@ module "add_url_to_runtime_config" {
 
   namespace = "connection"
   key       = "apis"
-  value     = { "<%- apiNameClassName %>" = "${aws_api_gateway_stage.api_stage.invoke_url}/" }
+  value     = { "<%- apiNameClassName %>" = local.api_url }
 
   depends_on = [aws_api_gateway_stage.api_stage]
 }
 
+# Custom domain for the API, served without the stage path prefix
+resource "aws_api_gateway_domain_name" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  domain_name              = var.custom_domain_name
+  regional_certificate_arn = var.acm_certificate_arn
+  security_policy          = "TLS_1_2"
+
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+
+  tags = var.tags
+
+  lifecycle {
+    precondition {
+      condition     = var.acm_certificate_arn != null
+      error_message = "acm_certificate_arn is required when custom_domain_name is set."
+    }
+  }
+}
+
+resource "aws_api_gateway_base_path_mapping" "custom_domain" {
+  count = var.custom_domain_name == null ? 0 : 1
+
+  api_id      = module.rest_api.api_id
+  stage_name  = aws_api_gateway_stage.api_stage.stage_name
+  domain_name = aws_api_gateway_domain_name.custom_domain[0].domain_name
+}
+
 # Outputs
 
 # API Gateway Outputs (from core module)
@@ -1172,6 +1219,21 @@ output "stage_invoke_url" {
   value       = aws_api_gateway_stage.api_stage.invoke_url
 }
 
+output "api_url" {
+  description = "URL clients should call: the custom domain if configured, otherwise the stage invoke URL"
+  value       = local.api_url
+}
+
+output "custom_domain_target_domain_name" {
+  description = "Target domain name to point a DNS alias or CNAME record at for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_domain_name
+}
+
+output "custom_domain_hosted_zone_id" {
+  description = "Hosted zone ID to use for a Route 53 alias record for the custom domain"
+  value       = var.custom_domain_name == null ? null : aws_api_gateway_domain_name.custom_domain[0].regional_zone_id
+}
+
 output "stage_arn" {
   description = "ARN of the API Gateway stage"
   value       = aws_api_gateway_stage.api_stage.arn