@certenza/aws-cdk-infrastructure-commons 1.1.1 → 1.1.3

package/dist/src/apigateway.js

@@ -67,38 +67,71 @@ const createApiGateway = (scope, apiName, domainName, hostedZoneId, zoneName) =>
     const hostedZone = (0, route53_1.getHostedZone)(scope, "HostedZone", hostedZoneId, zoneName);
     // Create a certificate for the API Gateway domain
     const certificate = (0, acm_1.createCertificate)(scope, `ApiGatewayCertificate`, domainName, hostedZone);
+    // Create access log group
+    const accessLogGroup = new logs.LogGroup(scope, `${apiName}-AccessLogs`, {
+        retention: logs.RetentionDays.ONE_WEEK,
+    });
+    // Create RestApi without auto-deployment so we can control the order of resource creation
     const api = new apigateway.RestApi(scope, apiName, {
         description: `Public API Gateway for ${apiName}`,
         endpointTypes: [apigateway.EndpointType.REGIONAL],
-        domainName: {
-            domainName: domainName,
-            certificate: certificate,
-            securityPolicy: apigateway.SecurityPolicy.TLS_1_2,
-            endpointType: apigateway.EndpointType.REGIONAL,
-        },
-        deployOptions: {
-            loggingLevel: apigateway.MethodLoggingLevel.INFO,
-            dataTraceEnabled: false,
-            accessLogDestination: new apigateway.LogGroupLogDestination(new logs.LogGroup(scope, `${apiName}-AccessLogs`, {
-                retention: logs.RetentionDays.ONE_WEEK,
-            })),
-        },
+        deploy: false, // Don't auto-deploy - we'll create deployment and stage manually
     });
-    // Set retention for execution log group that API Gateway creates automatically
+    // Create execution log group with the exact name API Gateway expects
     // API Gateway creates execution logs in the format: API-Gateway-Execution-Logs_{api-id}/{stage-name}
-    // We use LogRetention to set the retention policy after API Gateway creates the log group
-    new logs.LogRetention(scope, `${apiName}-ExecutionLogRetention`, {
+    // By creating it first, API Gateway will use our log group instead of creating a new one
+    // Note: The log group name depends on api.restApiId (a token), so CloudFormation will
+    // create the API first to resolve the token, then create the log group with the resolved name
+    const executionLogGroup = new logs.LogGroup(scope, `${apiName}-ExecutionLogs`, {
         logGroupName: cdk.Token.asString(cdk.Fn.join("/", [
-            cdk.Fn.join("_", ["API-Gateway-Execution-Logs", api.restApiId]),
-            api.deploymentStage.stageName,
+            cdk.Fn.join("_", [
+                "API-Gateway-Execution-Logs",
+                api.restApiId,
+            ]),
+            "prod", // Default stage name
         ])),
         retention: logs.RetentionDays.ONE_MONTH, // Budget-friendly: 1 month retention
+        removalPolicy: cdk.RemovalPolicy.DESTROY, // Destroy log group when API is deleted
+    });
+    // Create deployment
+    const deployment = new apigateway.Deployment(scope, `${apiName}-Deployment`, {
+        api: api,
+    });
+    // Create stage with logging configuration
+    // The execution log group must exist before the stage is created so API Gateway uses it
+    const stage = new apigateway.Stage(scope, `${apiName}-Stage`, {
+        deployment: deployment,
+        stageName: "prod",
+        loggingLevel: apigateway.MethodLoggingLevel.INFO,
+        dataTraceEnabled: false,
+        accessLogDestination: new apigateway.LogGroupLogDestination(accessLogGroup),
+    });
+    // Ensure the execution log group is created before the stage
+    // This is necessary because the stage doesn't reference the log group directly,
+    // but API Gateway needs it to exist when the stage is created
+    stage.node.addDependency(executionLogGroup);
+    // Create custom domain name with TLS 1.2 security policy
+    // CDK automatically ensures the certificate is validated before creating the domain
+    const apiDomain = new apigateway.DomainName(scope, `${apiName}-Domain`, {
+        domainName: domainName,
+        certificate: certificate,
+        securityPolicy: apigateway.SecurityPolicy.TLS_1_2, // Enforce TLS 1.2 minimum
+        endpointType: apigateway.EndpointType.REGIONAL,
+    });
+    // Map the custom domain to the API stage
+    // CDK automatically handles dependencies: BasePathMapping depends on apiDomain, api, and stage
+    new apigateway.BasePathMapping(scope, `${apiName}-BasePathMapping`, {
+        domainName: apiDomain,
+        restApi: api,
+        stage: stage,
     });
-    // Create Route53 A record pointing to the API Gateway
+    // Create Route53 A record pointing to the API Gateway custom domain
+    // CDK automatically handles dependency: Route53 record waits for domain to be created
+    // via the alias target (ApiGatewayDomain)
     new route53.ARecord(scope, `${apiName}-AliasRecord`, {
         zone: hostedZone,
         recordName: domainName.replace(`${hostedZone.zoneName}.`, ""),
-        target: route53.RecordTarget.fromAlias(new route53targets.ApiGateway(api)),
+        target: route53.RecordTarget.fromAlias(new route53targets.ApiGatewayDomain(apiDomain)),
     });
     // Return the API Gateway
     return api;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@certenza/aws-cdk-infrastructure-commons",
-    "version": "1.1.1",
+    "version": "1.1.3",
     "description": "Common infrastructure reusable utilities and resources for Certenza projects",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",