@pwrdrvr/microapps-cdk 0.2.10 → 0.2.11

package/.jsii

@@ -9,6 +9,7 @@
   },
   "dependencies": {
     "@aws-cdk/aws-apigatewayv2-alpha": "^2.24.1-alpha.0",
+    "@aws-cdk/aws-apigatewayv2-authorizers-alpha": "^2.24.1-alpha.0",
     "@aws-cdk/aws-apigatewayv2-integrations-alpha": "^2.24.1-alpha.0",
     "aws-cdk-lib": "^2.24.1",
     "constructs": "^10.0.5"
@@ -45,6 +46,39 @@
         }
       }
     },
+    "@aws-cdk/aws-apigatewayv2-authorizers-alpha": {
+      "targets": {
+        "dotnet": {
+          "assemblyOriginatorKeyFile": "../../key.snk",
+          "iconUrl": "https://raw.githubusercontent.com/aws/aws-cdk/master/logo/default-256-dark.png",
+          "namespace": "Amazon.CDK.AWS.Apigatewayv2.Authorizers.Alpha",
+          "packageId": "Amazon.CDK.AWS.APIGatewayv2.Authorizers.Alpha",
+          "signAssembly": true
+        },
+        "go": {
+          "moduleName": "github.com/aws/aws-cdk-go",
+          "packageName": "awscdkapigatewayv2authorizersalpha"
+        },
+        "java": {
+          "maven": {
+            "artifactId": "apigatewayv2-authorizers-alpha",
+            "groupId": "software.amazon.awscdk"
+          },
+          "package": "software.amazon.awscdk.services.apigatewayv2.authorizers.alpha"
+        },
+        "js": {
+          "npm": "@aws-cdk/aws-apigatewayv2-authorizers-alpha"
+        },
+        "python": {
+          "classifiers": [
+            "Framework :: AWS CDK",
+            "Framework :: AWS CDK :: 2"
+          ],
+          "distName": "aws-cdk.aws-apigatewayv2-authorizers-alpha",
+          "module": "aws_cdk.aws_apigatewayv2_authorizers_alpha"
+        }
+      }
+    },
     "@aws-cdk/aws-apigatewayv2-integrations-alpha": {
       "targets": {
         "dotnet": {
@@ -3066,7 +3100,7 @@
   },
   "name": "@pwrdrvr/microapps-cdk",
   "readme": {
-    "markdown": "![Build/Deploy CI](https://github.com/pwrdrvr/microapps-core/actions/workflows/ci.yml/badge.svg) ![Main Build](https://github.com/pwrdrvr/microapps-core/actions/workflows/main-build.yml/badge.svg) ![Release](https://github.com/pwrdrvr/microapps-core/actions/workflows/release.yml/badge.svg)\n\n# Overview\n\nThe MicroApps project enables rapidly deploying many web apps to AWS on a single shared host name, fronted by a CloudFront Distribution, serving static assets from an S3 Bucket, and routing application requests via API Gateway. MicroApps is delivered as a CDK Construct for deployment, although alternative deployment methods can be used if desired and implemented.\n\nMicroApps allows many versions of an application to be deployed either as ephemeral deploys (e.g. for pull request builds) or as semi-permanent deploys. The `microapps-router` Lambda function handled routing requests to apps to the current version targeted for a particular application start request using rules as complex as one is interested in implementing (e.g. A/B testing integration, canary releases, per-user rules for logged in users, per-group, per-deparment, and default rules).\n\nUsers start applications via a URL such as `[/{prefix}]/{appname}/`, which hits the `microapps-router` that looks up the version of the application to be run, then renders a transparent `iframe` with a link to that version. The URL seen by the user in the browser (and available for bookmarking) has no version in it, so subsequent launches (e.g. the next day or just in another tab) will lookup the version again. All relative URL API requests (e.g. `some/api/path`) will go to the corresponding API version that matches the version of the loaded static files, eliminating issues of incompatibility between static files and API deployments.\n\nFor development / testing purposes only, each version of an applicaton can be accessed directly via a URL of the pattern `[/{prefix}]/{appname}/{semver}/`. These \"versioned\" URLs are not intended to be advertised to end users as they would cause a user to be stuck on a particular version of the app if the URL was bookmarked. Note that the system does not limit access to particular versions of an application, as of 2022-01-26, but that can be added as a feature.\n\n# Table of Contents <!-- omit in toc -->\n\n- [Overview](#overview)\n- [Video Preview of the Deploying CDK Construct](#video-preview-of-the-deploying-cdk-construct)\n- [Installation / CDK Constructs](#installation--cdk-constructs)\n- [Tutorial - Bootstrapping a Deploy](#tutorial---bootstrapping-a-deploy)\n- [Why MicroApps](#why-microapps)\n- [Limitations / Future Development](#limitations--future-development)\n- [Related Projects / Components](#related-projects--components)\n- [Architecure Diagram](#architecure-diagram)\n- [Project Layout](#project-layout)\n- [Creating a MicroApp Using Zip Lambda Functions](#creating-a-microapp-using-zip-lambda-functions)\n- [Creating a MicroApp Using Docker Lambda Functions](#creating-a-microapp-using-docker-lambda-functions)\n  - [Next.js Apps](#nextjs-apps)\n    - [Modify package.json](#modify-packagejson)\n    - [Install Dependencies](#install-dependencies)\n    - [Dockerfile](#dockerfile)\n    - [next.config.js](#nextconfigjs)\n    - [deploy.json](#deployjson)\n    - [serverless.yaml](#serverlessyaml)\n\n# Video Preview of the Deploying CDK Construct\n\n![Video Preview of Deploying](https://raw.githubusercontent.com/pwrdrvr/microapps-core/main/assets/videos/microapps-core-demo-deploy.gif)\n\n# Installation / CDK Constructs\n\n- `npm i --save-dev @pwrdrvr/microapps-cdk`\n- Add `MicroApps` construct to your stack\n- The `MicroApps` construct does a \"turn-key\" deployment complete with the Release app\n- [Construct Hub](https://constructs.dev/packages/@pwrdrvr/microapps-cdk/)\n  - CDK API docs\n  - Python, DotNet, Java, JS/TS installation instructions\n\n# Tutorial - Bootstrapping a Deploy\n\n- `git clone https://github.com/pwrdrvr/microapps-core.git`\n  - Note: the repo is only being for the example CDK Stack, it is not necessary to clone the repo when used in a custom CDK Stack\n- `cd microapps-core`\n- `npm i -g aws-cdk`\n  - Install AWS CDK v2 CLI\n- `asp [my-sso-profile-name]`\n  - Using the `aws` plugin from `oh-my-zsh` for AWS SSO\n  - Of course, there are other methods of setting env vars\n- `aws sso login`\n  - Establish an AWS SSO session\n- `cdk-sso-sync`\n  - Using `npm i -g cdk-sso-sync`\n  - Sets AWS SSO credentials in a way that CDK can use them\n  - Not necessary if not using AWS SSO\n- `export AWS_REGION=us-east-2`\n  - Region needs to be set for the Lambda invoke - This can be done other ways in `~/.aws/config` as well\n- `./deploy.sh`\n  - Deploys the CDK Stack\n  - Essentially runs two commands along with extraction of outputs:\n    - `npx cdk deploy --context @pwrdrvr/microapps:stackName=microapps-demo-deploy --context @pwrdrvr/microapps:deployReleaseApp=true microapps-basic`\n    - `npx microapps-publish publish -a release -n ${RELEASE_APP_PACKAGE_VERSION} -d ${DEPLOYER_LAMBDA_NAME} -l ${RELEASE_APP_LAMBDA_NAME} -s node_modules/@pwrdrvr/microapps-app-release-cdk/lib/.static_files/release/${RELEASE_APP_PACKAGE_VERSION}/ --overwrite --noCache`\n  - URL will be printed as last output\n\n# Why MicroApps\n\nMicroApps are like micro services, but for Web UIs. A MicroApp allows a single functional site to be developed by many independent teams within an organization. Teams must coordinate deployments and agree upon one implementation technology and framework when building a monolithic, or even a monorepo, web application.\n\nTeams using MicroApps can deploy independently of each other with coordination being required only at points of intentional integration (e.g. adding a feature to pass context from one MicroApp to another or coordination of a major feature release to users) and sharing UI styles, if desired (it is possible to build styles that look the same across many different UI frameworks).\n\nMicroApps also allow each team to use a UI framework and backend language that is most appropriate for their solving their business problem. Not every app has to use React or Next.js or even Node on the backend, but instead they can use whatever framework they want and Java, Go, C#, Python, etc. for UI API calls.\n\nFor internal sites, or logged-in-customer sites, different tools or products can be hosted in entirely independent MicroApps. A menuing system / toolbar application can be created as a MicroApp and that menu app can open the apps in the system within a transparent iframe. For externally facing sites, such as for an e-commerce site, it is possible to have a MicroApp serving `/product/...`, another serving `/search/...`, another serving `/`, etc.\n\n# Limitations / Future Development\n\n- `iframes`\n  - Yeah, yeah: `iframes` are not framesets and most of the hate about iframes is probably better directed at framesets\n  - The iframe serves a purpose but it stinks that it is there, primarily because it will cause issues with search bot indexing (SEO)\n  - There are other options available to implement that have their own drabacks:\n    - Using the `microapps-router` to proxy the \"app start\" request to a particular version of an app that then renders all of it's API resource requests to versioned URLs\n      - Works only with frameworks that support hashing filenams for each deploy to unique names\n      - This page would need to be marked as non-cachable\n      - This may work well with Next.js which wants to know the explicit path that it will be running at (it writes that path into all resource and API requests)\n      - Possible issue: the app would need to work ok being displayed at `[/{prefix}]/{appname}` when it may think that it's being displayed at `[/{prefix}]/{appname}/{semver}`\n      - Disadvantage: requires some level of UI framework features (e.g. writing the absolute resource paths) to work correctly - may not work as easily for all UI frameworks\n    - HTML5 added features to allow setting the relative path of all subsequent requests to be different than that displayed in the address bar\n      - Gotta see if this works in modern browsers\n    - Option to ditch the multiple-versions feature\n      - Works only with frameworks that support hashing filenams for each deploy to unique names\n      - Allows usage of the deploy and routing tooling without advantages and disadvantages of multiple-versions support\n- AWS Only\n  - For the time being this has only been implemented for AWS technologies and APIs\n  - It is possible that Azure and GCP have sufficient support to enable porting the framework\n  - CDK would have to be replaced as well (unless it's made available for Azure and GCP in the near future)\n- `microapps-publish` only supports Lambda function apps\n  - There is no technical reason for the apps to only run as Lambda functions\n  - Web apps could just as easily run on EC2, Kubernetes, EKS, ECS, etc\n  - Anything that API Gateway can route to can work for serving a MicroApp\n  - The publish tool needs to provide additional options for setting up the API Gateway route to the app\n- Authentication\n  - Authentication requires rolling your own API Gateway and CloudFront deployment at the moment\n  - The \"turn key\" CDK Construct should provide options to show an example of how authentication can be integrated\n- Release Rules\n  - Currently only a Default rule is supported\n  - Need to evaluate if a generic implementation can be made, possibly allowing plugins or webhooks to support arbitrary rules\n  - If not possible to make it perfectly generic, consider providing a more complete reference implementation of examples\n\n# Related Projects / Components\n\n- Release App\n  - The Release app is an initial, rudimentary, release control console for setting the default version of an application\n  - Built with Next.js\n  - [pwrdrvr/microapps-app-release](https://github.com/pwrdrvr/microapps-app-release)\n- Next.js Demo App\n  - The Next.js Tutorial application deployed as a MicroApp\n  - [pwrdrvr/serverless-nextjs-demo](https://github.com/pwrdrvr/serverless-nextjs-demo)\n- Serverless Next.js Router\n  - [pwrdrvr/serverless-nextjs-router](https://github.com/pwrdrvr/serverless-nextjs-router)\n  - Complementary to [@sls-next/serverless-component](https://github.com/serverless-nextjs/serverless-next.js)\n  - Allows Next.js apps to run as Lambda @ Origin for speed and cost improvements vs Lambda@Edge\n  - Essentially the router translates CloudFront Lambda events to API Gateway Lambda events and vice versa for responses\n  - The `serverless-nextjs` project allows Next.js apps to run as Lambda functions without Express, but there was a design change to make the Lambda functions run at Edge (note: need to recheck if this changed after early 2021)\n    - Lambda@Edge is _at least_ 3x more expensive than Lambda at the origin:\n      - In US East 1, the price per GB-Second is $0.00005001 for Lambda@Edge vs $0.0000166667 for Lambda at the origin\n    - Additionally, any DB or services calls from Lambda@Edge back to the origin will pay that 3x higher per GB-Second cost for any time spent waiting to send the request and get a response. Example:\n      - Lambda@Edge\n        - 0.250s Round Trip Time (RTT) for EU-zone edge request to hit US-East 1 Origin\n        - 0.200s DB lookup time\n        - 0.050s CPU usage to process the DB response\n        - 0.500s total billed time @ $0.00005001 @ 128 MB\n        - $0.000003125625 total charge\n      - Lambda at Origin\n        - RTT does not apply (it's effectively 1-2 ms to hit a DB in the same region)\n        - 0.200s DB lookup time\n        - 0.050s CPU usage to process the DB response\n        - 0.250s total billed time @ $0.0000166667 @ 128 MB\n        - Half the billed time of running on Lambda@Edge\n        - 1/6th the cost of running on Lambda@Edge:\n          - $0.000000520834375 total charge (assuming no CPU time to process the response)\n          - $0.000003125625 / $0.000000520834375 = 6x more expensive in Lambda@Edge\n\n# Architecure Diagram\n\n![Architecure Diagram](https://raw.githubusercontent.com/pwrdrvr/microapps-core/main/assets/images/architecture-diagram.png)\n\n# Project Layout\n\n- [packages/cdk](https://github.com/pwrdrvr/microapps-core/tree/main/packages/cdk)\n  - Example CDK Stack\n  - Deploys MicroApps CDK stack for the GitHub Workflows\n  - Can be used as an example of how to use the MicroApps CDK Construct\n- [packages/demo-app](https://github.com/pwrdrvr/microapps-core/tree/main/packages/demo-app)\n  - Example app with static resources and a Lambda function\n  - Does not use any Web UI framework at all\n- [packages/microapps-cdk](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-cdk)\n  - MicroApps\n    - \"Turn key\" CDK Construct that creates all assets needed for a working MicroApps deployment\n  - MicroAppsAPIGwy\n    - Create APIGateway HTTP API\n    - Creates domain names to point to the edge (Cloudfront) and origin (API Gateway)\n  - MicroAppsCF\n    - Creates Cloudfront distribution\n  - MicroAppsS3\n    - Creates S3 buckets\n  - MicroAppsSvcs\n    - Create DynamoDB table\n    - Create Deployer Lambda function\n    - Create Router Lambda function\n- [packages/microapps-datalib](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-datalib)\n  - Installed from `npm`:\n    - `npm i -g @pwrdrvr/microapps-datalib`\n  - APIs for access to the DynamoDB Table used by `microapps-publish`, `microapps-deployer`, and `@pwrdrvr/microapps-app-release-cdk`\n- [packages/microapps-deployer](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-deployer)\n  - Lambda service invoked by `microapps-publish` to record new app/version in the DynamoDB table, create API Gateway integrations, copy S3 assets from staging to prod bucket, etc.\n  - Returns a temporary S3 token with restricted access to the staging S3 bucket for upload of the static files for one app/semver\n- [packages/microapps-publish](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-publish)\n  - Installed from `npm`:\n    - `npm i -g @pwrdrvr/microapps-publish`\n  - Node executable that updates versions in config files, deploys static assets to the S3 staging bucket, optionally compiles and deploys a new Lambda function version, and invokes `microapps-deployer`\n  - AWS IAM permissions required:\n    - `lambda:InvokeFunction`\n- [packages/microapps-router](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-router)\n  - Lambda function that determines which version of an app to point a user to on a particular invocation\n\n# Creating a MicroApp Using Zip Lambda Functions\n\n[TBC]\n\n# Creating a MicroApp Using Docker Lambda Functions\n\nNote: semi-deprecated as of 2022-01-27. Zip Lambda functions are better supported.\n\n## Next.js Apps\n\nCreate a Next.js app then follow the steps in this section to set it up for publishing to AWS Lambda @ Origin as a MicroApp. To publish new versions of the app use `npx microapps-publish --new-version x.y.z` when logged in to the target AWS account.\n\n### Modify package.json\n\nReplace the version with `0.0.0` so it can be modified by the `microapps-publish` tool.\n\n### Install Dependencies\n\n```\nnpm i --save-dev @sls-next/serverless-component@1.19.0 @pwrdrvr/serverless-nextjs-router @pwrdrvr/microapps-publish\n```\n\n### Dockerfile\n\nAdd this file to the root of the app.\n\n```Dockerfile\nFROM node:15-slim as base\n\nWORKDIR /app\n\n# Download the sharp libs once to save time\n# Do this before copying anything else in\nRUN mkdir -p image-lambda-npms && \\\n  cd image-lambda-npms && npm i sharp && \\\n  rm -rf node_modules/sharp/vendor/*/include/\n\n# Copy in the build output from `npx serverless`\nCOPY .serverless_nextjs .\nCOPY config.json .\n\n# Move the sharp libs into place\nRUN rm -rf image-lambda/node_modules/ && \\\n  mv image-lambda-npms/node_modules image-labmda/ && \\\n  rm -rf image-lambda-npms\n\nFROM public.ecr.aws/lambda/nodejs:14 AS final\n\n# Copy in the munged code\nCOPY --from=base /app .\n\nCMD [ \"./index.handler\" ]\n```\n\n### next.config.js\n\nAdd this file to the root of the app.\n\nReplace `appname` with your URL path-compatible application name.\n\n```js\nconst appRoot = '/appname/0.0.0';\n\n// eslint-disable-next-line no-undef\nmodule.exports = {\n  target: 'serverless',\n  webpack: (config, _options) => {\n    return config;\n  },\n  basePath: appRoot,\n  publicRuntimeConfig: {\n    // Will be available on both server and client\n    staticFolder: appRoot,\n  },\n};\n```\n\n### deploy.json\n\nAdd this file to the root of the app.\n\nReplace `appname` with your URL path-compatible application name.\n\n```json\n{\n  \"AppName\": \"appname\",\n  \"SemVer\": \"0.0.0\",\n  \"DefaultFile\": \"\",\n  \"StaticAssetsPath\": \"./.serverless_nextjs/assets/appname/0.0.0/\",\n  \"LambdaARN\": \"arn:aws:lambda:us-east-1:123456789012:function:appname:v0_0_0\",\n  \"AWSAccountID\": \"123456789012\",\n  \"AWSRegion\": \"us-east-2\",\n  \"ServerlessNextRouterPath\": \"./node_modules/@pwrdrvr/serverless-nextjs-router/dist/index.js\"\n}\n```\n\n### serverless.yaml\n\nAdd this file to the root of the app.\n\n```yaml\nnextApp:\n  component: './node_modules/@sls-next/serverless-component'\n  inputs:\n    deploy: false\n    uploadStaticAssetsFromBuild: false\n```\n"
+    "markdown": "![Build/Deploy CI](https://github.com/pwrdrvr/microapps-core/actions/workflows/ci.yml/badge.svg) ![Main Build](https://github.com/pwrdrvr/microapps-core/actions/workflows/main-build.yml/badge.svg) ![Release](https://github.com/pwrdrvr/microapps-core/actions/workflows/release.yml/badge.svg)\n\n# Overview\n\nThe MicroApps project enables rapidly deploying many web apps to AWS on a single shared host name, fronted by a CloudFront Distribution, serving static assets from an S3 Bucket, and routing application requests via API Gateway. MicroApps is delivered as a CDK Construct for deployment, although alternative deployment methods can be used if desired and implemented.\n\nMicroApps allows many versions of an application to be deployed either as ephemeral deploys (e.g. for pull request builds) or as semi-permanent deploys. The `microapps-router` Lambda function handled routing requests to apps to the current version targeted for a particular application start request using rules as complex as one is interested in implementing (e.g. A/B testing integration, canary releases, per-user rules for logged in users, per-group, per-deparment, and default rules).\n\nUsers start applications via a URL such as `[/{prefix}]/{appname}/`, which hits the `microapps-router` that looks up the version of the application to be run, then renders a transparent `iframe` with a link to that version. The URL seen by the user in the browser (and available for bookmarking) has no version in it, so subsequent launches (e.g. the next day or just in another tab) will lookup the version again. All relative URL API requests (e.g. `some/api/path`) will go to the corresponding API version that matches the version of the loaded static files, eliminating issues of incompatibility between static files and API deployments.\n\nFor development / testing purposes only, each version of an applicaton can be accessed directly via a URL of the pattern `[/{prefix}]/{appname}/{semver}/`. These \"versioned\" URLs are not intended to be advertised to end users as they would cause a user to be stuck on a particular version of the app if the URL was bookmarked. Note that the system does not limit access to particular versions of an application, as of 2022-01-26, but that can be added as a feature.\n\n# Table of Contents <!-- omit in toc -->\n\n- [Overview](#overview)\n- [Video Preview of the Deploying CDK Construct](#video-preview-of-the-deploying-cdk-construct)\n- [Installation / CDK Constructs](#installation--cdk-constructs)\n- [Tutorial - Bootstrapping a Deploy](#tutorial---bootstrapping-a-deploy)\n- [Why MicroApps](#why-microapps)\n- [Limitations / Future Development](#limitations--future-development)\n- [Related Projects / Components](#related-projects--components)\n- [Architecure Diagram](#architecure-diagram)\n- [Project Layout](#project-layout)\n- [Creating a MicroApp Using Zip Lambda Functions](#creating-a-microapp-using-zip-lambda-functions)\n- [Creating a MicroApp Using Docker Lambda Functions](#creating-a-microapp-using-docker-lambda-functions)\n  - [Next.js Apps](#nextjs-apps)\n    - [Modify package.json](#modify-packagejson)\n    - [Install Dependencies](#install-dependencies)\n    - [Dockerfile](#dockerfile)\n    - [next.config.js](#nextconfigjs)\n    - [deploy.json](#deployjson)\n    - [serverless.yaml](#serverlessyaml)\n- [Troubleshooting](#troubleshooting)\n  - [CloudFront Requests to API Gateway are Rejected with 403 Forbidden](#cloudfront-requests-to-api-gateway-are-rejected-with-403-forbidden)\n    - [SignatureV4 Headers](#signaturev4-headers)\n\n# Video Preview of the Deploying CDK Construct\n\n![Video Preview of Deploying](https://raw.githubusercontent.com/pwrdrvr/microapps-core/main/assets/videos/microapps-core-demo-deploy.gif)\n\n# Installation / CDK Constructs\n\n- `npm i --save-dev @pwrdrvr/microapps-cdk`\n- Add `MicroApps` construct to your stack\n- The `MicroApps` construct does a \"turn-key\" deployment complete with the Release app\n- [Construct Hub](https://constructs.dev/packages/@pwrdrvr/microapps-cdk/)\n  - CDK API docs\n  - Python, DotNet, Java, JS/TS installation instructions\n\n# Tutorial - Bootstrapping a Deploy\n\n- `git clone https://github.com/pwrdrvr/microapps-core.git`\n  - Note: the repo is only being for the example CDK Stack, it is not necessary to clone the repo when used in a custom CDK Stack\n- `cd microapps-core`\n- `npm i -g aws-cdk`\n  - Install AWS CDK v2 CLI\n- `asp [my-sso-profile-name]`\n  - Using the `aws` plugin from `oh-my-zsh` for AWS SSO\n  - Of course, there are other methods of setting env vars\n- `aws sso login`\n  - Establish an AWS SSO session\n- `cdk-sso-sync`\n  - Using `npm i -g cdk-sso-sync`\n  - Sets AWS SSO credentials in a way that CDK can use them\n  - Not necessary if not using AWS SSO\n- `export AWS_REGION=us-east-2`\n  - Region needs to be set for the Lambda invoke - This can be done other ways in `~/.aws/config` as well\n- `./deploy.sh`\n  - Deploys the CDK Stack\n  - Essentially runs two commands along with extraction of outputs:\n    - `npx cdk deploy --context @pwrdrvr/microapps:stackName=microapps-demo-deploy --context @pwrdrvr/microapps:deployReleaseApp=true microapps-basic`\n    - `npx microapps-publish publish -a release -n ${RELEASE_APP_PACKAGE_VERSION} -d ${DEPLOYER_LAMBDA_NAME} -l ${RELEASE_APP_LAMBDA_NAME} -s node_modules/@pwrdrvr/microapps-app-release-cdk/lib/.static_files/release/${RELEASE_APP_PACKAGE_VERSION}/ --overwrite --noCache`\n  - URL will be printed as last output\n\n# Why MicroApps\n\nMicroApps are like micro services, but for Web UIs. A MicroApp allows a single functional site to be developed by many independent teams within an organization. Teams must coordinate deployments and agree upon one implementation technology and framework when building a monolithic, or even a monorepo, web application.\n\nTeams using MicroApps can deploy independently of each other with coordination being required only at points of intentional integration (e.g. adding a feature to pass context from one MicroApp to another or coordination of a major feature release to users) and sharing UI styles, if desired (it is possible to build styles that look the same across many different UI frameworks).\n\nMicroApps also allow each team to use a UI framework and backend language that is most appropriate for their solving their business problem. Not every app has to use React or Next.js or even Node on the backend, but instead they can use whatever framework they want and Java, Go, C#, Python, etc. for UI API calls.\n\nFor internal sites, or logged-in-customer sites, different tools or products can be hosted in entirely independent MicroApps. A menuing system / toolbar application can be created as a MicroApp and that menu app can open the apps in the system within a transparent iframe. For externally facing sites, such as for an e-commerce site, it is possible to have a MicroApp serving `/product/...`, another serving `/search/...`, another serving `/`, etc.\n\n# Limitations / Future Development\n\n- `iframes`\n  - Yeah, yeah: `iframes` are not framesets and most of the hate about iframes is probably better directed at framesets\n  - The iframe serves a purpose but it stinks that it is there, primarily because it will cause issues with search bot indexing (SEO)\n  - There are other options available to implement that have their own drabacks:\n    - Using the `microapps-router` to proxy the \"app start\" request to a particular version of an app that then renders all of it's API resource requests to versioned URLs\n      - Works only with frameworks that support hashing filenams for each deploy to unique names\n      - This page would need to be marked as non-cachable\n      - This may work well with Next.js which wants to know the explicit path that it will be running at (it writes that path into all resource and API requests)\n      - Possible issue: the app would need to work ok being displayed at `[/{prefix}]/{appname}` when it may think that it's being displayed at `[/{prefix}]/{appname}/{semver}`\n      - Disadvantage: requires some level of UI framework features (e.g. writing the absolute resource paths) to work correctly - may not work as easily for all UI frameworks\n    - HTML5 added features to allow setting the relative path of all subsequent requests to be different than that displayed in the address bar\n      - Gotta see if this works in modern browsers\n    - Option to ditch the multiple-versions feature\n      - Works only with frameworks that support hashing filenams for each deploy to unique names\n      - Allows usage of the deploy and routing tooling without advantages and disadvantages of multiple-versions support\n- AWS Only\n  - For the time being this has only been implemented for AWS technologies and APIs\n  - It is possible that Azure and GCP have sufficient support to enable porting the framework\n  - CDK would have to be replaced as well (unless it's made available for Azure and GCP in the near future)\n- `microapps-publish` only supports Lambda function apps\n  - There is no technical reason for the apps to only run as Lambda functions\n  - Web apps could just as easily run on EC2, Kubernetes, EKS, ECS, etc\n  - Anything that API Gateway can route to can work for serving a MicroApp\n  - The publish tool needs to provide additional options for setting up the API Gateway route to the app\n- Authentication\n  - Authentication requires rolling your own API Gateway and CloudFront deployment at the moment\n  - The \"turn key\" CDK Construct should provide options to show an example of how authentication can be integrated\n- Release Rules\n  - Currently only a Default rule is supported\n  - Need to evaluate if a generic implementation can be made, possibly allowing plugins or webhooks to support arbitrary rules\n  - If not possible to make it perfectly generic, consider providing a more complete reference implementation of examples\n\n# Related Projects / Components\n\n- Release App\n  - The Release app is an initial, rudimentary, release control console for setting the default version of an application\n  - Built with Next.js\n  - [pwrdrvr/microapps-app-release](https://github.com/pwrdrvr/microapps-app-release)\n- Next.js Demo App\n  - The Next.js Tutorial application deployed as a MicroApp\n  - [pwrdrvr/serverless-nextjs-demo](https://github.com/pwrdrvr/serverless-nextjs-demo)\n- Serverless Next.js Router\n  - [pwrdrvr/serverless-nextjs-router](https://github.com/pwrdrvr/serverless-nextjs-router)\n  - Complementary to [@sls-next/serverless-component](https://github.com/serverless-nextjs/serverless-next.js)\n  - Allows Next.js apps to run as Lambda @ Origin for speed and cost improvements vs Lambda@Edge\n  - Essentially the router translates CloudFront Lambda events to API Gateway Lambda events and vice versa for responses\n  - The `serverless-nextjs` project allows Next.js apps to run as Lambda functions without Express, but there was a design change to make the Lambda functions run at Edge (note: need to recheck if this changed after early 2021)\n    - Lambda@Edge is _at least_ 3x more expensive than Lambda at the origin:\n      - In US East 1, the price per GB-Second is $0.00005001 for Lambda@Edge vs $0.0000166667 for Lambda at the origin\n    - Additionally, any DB or services calls from Lambda@Edge back to the origin will pay that 3x higher per GB-Second cost for any time spent waiting to send the request and get a response. Example:\n      - Lambda@Edge\n        - 0.250s Round Trip Time (RTT) for EU-zone edge request to hit US-East 1 Origin\n        - 0.200s DB lookup time\n        - 0.050s CPU usage to process the DB response\n        - 0.500s total billed time @ $0.00005001 @ 128 MB\n        - $0.000003125625 total charge\n      - Lambda at Origin\n        - RTT does not apply (it's effectively 1-2 ms to hit a DB in the same region)\n        - 0.200s DB lookup time\n        - 0.050s CPU usage to process the DB response\n        - 0.250s total billed time @ $0.0000166667 @ 128 MB\n        - Half the billed time of running on Lambda@Edge\n        - 1/6th the cost of running on Lambda@Edge:\n          - $0.000000520834375 total charge (assuming no CPU time to process the response)\n          - $0.000003125625 / $0.000000520834375 = 6x more expensive in Lambda@Edge\n\n# Architecure Diagram\n\n![Architecure Diagram](https://raw.githubusercontent.com/pwrdrvr/microapps-core/main/assets/images/architecture-diagram.png)\n\n# Project Layout\n\n- [packages/cdk](https://github.com/pwrdrvr/microapps-core/tree/main/packages/cdk)\n  - Example CDK Stack\n  - Deploys MicroApps CDK stack for the GitHub Workflows\n  - Can be used as an example of how to use the MicroApps CDK Construct\n- [packages/demo-app](https://github.com/pwrdrvr/microapps-core/tree/main/packages/demo-app)\n  - Example app with static resources and a Lambda function\n  - Does not use any Web UI framework at all\n- [packages/microapps-cdk](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-cdk)\n  - MicroApps\n    - \"Turn key\" CDK Construct that creates all assets needed for a working MicroApps deployment\n  - MicroAppsAPIGwy\n    - Create APIGateway HTTP API\n    - Creates domain names to point to the edge (Cloudfront) and origin (API Gateway)\n  - MicroAppsCF\n    - Creates Cloudfront distribution\n  - MicroAppsS3\n    - Creates S3 buckets\n  - MicroAppsSvcs\n    - Create DynamoDB table\n    - Create Deployer Lambda function\n    - Create Router Lambda function\n- [packages/microapps-datalib](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-datalib)\n  - Installed from `npm`:\n    - `npm i -g @pwrdrvr/microapps-datalib`\n  - APIs for access to the DynamoDB Table used by `microapps-publish`, `microapps-deployer`, and `@pwrdrvr/microapps-app-release-cdk`\n- [packages/microapps-deployer](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-deployer)\n  - Lambda service invoked by `microapps-publish` to record new app/version in the DynamoDB table, create API Gateway integrations, copy S3 assets from staging to prod bucket, etc.\n  - Returns a temporary S3 token with restricted access to the staging S3 bucket for upload of the static files for one app/semver\n- [packages/microapps-publish](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-publish)\n  - Installed from `npm`:\n    - `npm i -g @pwrdrvr/microapps-publish`\n  - Node executable that updates versions in config files, deploys static assets to the S3 staging bucket, optionally compiles and deploys a new Lambda function version, and invokes `microapps-deployer`\n  - AWS IAM permissions required:\n    - `lambda:InvokeFunction`\n- [packages/microapps-router](https://github.com/pwrdrvr/microapps-core/tree/main/packages/microapps-router)\n  - Lambda function that determines which version of an app to point a user to on a particular invocation\n\n# Creating a MicroApp Using Zip Lambda Functions\n\n[TBC]\n\n# Creating a MicroApp Using Docker Lambda Functions\n\nNote: semi-deprecated as of 2022-01-27. Zip Lambda functions are better supported.\n\n## Next.js Apps\n\nCreate a Next.js app then follow the steps in this section to set it up for publishing to AWS Lambda @ Origin as a MicroApp. To publish new versions of the app use `npx microapps-publish --new-version x.y.z` when logged in to the target AWS account.\n\n### Modify package.json\n\nReplace the version with `0.0.0` so it can be modified by the `microapps-publish` tool.\n\n### Install Dependencies\n\n```\nnpm i --save-dev @sls-next/serverless-component@1.19.0 @pwrdrvr/serverless-nextjs-router @pwrdrvr/microapps-publish\n```\n\n### Dockerfile\n\nAdd this file to the root of the app.\n\n```Dockerfile\nFROM node:15-slim as base\n\nWORKDIR /app\n\n# Download the sharp libs once to save time\n# Do this before copying anything else in\nRUN mkdir -p image-lambda-npms && \\\n  cd image-lambda-npms && npm i sharp && \\\n  rm -rf node_modules/sharp/vendor/*/include/\n\n# Copy in the build output from `npx serverless`\nCOPY .serverless_nextjs .\nCOPY config.json .\n\n# Move the sharp libs into place\nRUN rm -rf image-lambda/node_modules/ && \\\n  mv image-lambda-npms/node_modules image-labmda/ && \\\n  rm -rf image-lambda-npms\n\nFROM public.ecr.aws/lambda/nodejs:14 AS final\n\n# Copy in the munged code\nCOPY --from=base /app .\n\nCMD [ \"./index.handler\" ]\n```\n\n### next.config.js\n\nAdd this file to the root of the app.\n\nReplace `appname` with your URL path-compatible application name.\n\n```js\nconst appRoot = '/appname/0.0.0';\n\n// eslint-disable-next-line no-undef\nmodule.exports = {\n  target: 'serverless',\n  webpack: (config, _options) => {\n    return config;\n  },\n  basePath: appRoot,\n  publicRuntimeConfig: {\n    // Will be available on both server and client\n    staticFolder: appRoot,\n  },\n};\n```\n\n### deploy.json\n\nAdd this file to the root of the app.\n\nReplace `appname` with your URL path-compatible application name.\n\n```json\n{\n  \"AppName\": \"appname\",\n  \"SemVer\": \"0.0.0\",\n  \"DefaultFile\": \"\",\n  \"StaticAssetsPath\": \"./.serverless_nextjs/assets/appname/0.0.0/\",\n  \"LambdaARN\": \"arn:aws:lambda:us-east-1:123456789012:function:appname:v0_0_0\",\n  \"AWSAccountID\": \"123456789012\",\n  \"AWSRegion\": \"us-east-2\",\n  \"ServerlessNextRouterPath\": \"./node_modules/@pwrdrvr/serverless-nextjs-router/dist/index.js\"\n}\n```\n\n### serverless.yaml\n\nAdd this file to the root of the app.\n\n```yaml\nnextApp:\n  component: './node_modules/@sls-next/serverless-component'\n  inputs:\n    deploy: false\n    uploadStaticAssetsFromBuild: false\n```\n\n# Troubleshooting\n\n## CloudFront Requests to API Gateway are Rejected with 403 Forbidden\n\nRequests to the API Gateway origin can be rejected with a 403 Forbidden error if the signed request headers are not sent to the origin by CloudFront.\n\nThe error in the API Gateway CloudWatch logs will show up as:\n\n```log\n\"authorizerError\": \"The request for the IAM Authorizer doesn't match the format that API Gateway expects.\"\n```\n\nThis can be simulated by simply running `curl [api-gateway-url]`, with no headers.\n\nTo confirm that API Gateway is allowing signed requests when the IAM Authorizer is configured, establish credentials as a user that is allowed to execute the API Gateay, install `awscurl` with `pip3 install awscurl`, then then use `awscurl --service execute-api --region [api-gateway-region] [api-gateway-url]`.\n\nSignature headers will not be sent from CloudFront to API Gateway unless the `OriginRequestPolicy` is set to specifically include those headers on requests to the origin, or the `headersBehavior` is set to `cfront.OriginRequestHeaderBehavior.all()`.\n\nSimilarly, if `presign` is used, the `OriginRequestPolicy` must be set to `cfront.OriginRequestQueryStringBehavior.all()` or to specifically forward the query string parameters used by the presigned URL.\n\n### SignatureV4 Headers\n- `authorization`\n- `x-amz-date`\n- `x-amz-security-token`\n- `x-amz-content-sha256`"
   },
   "repository": {
     "type": "git",
@@ -3105,7 +3139,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsCF.ts",
-        "line": 143
+        "line": 167
       },
       "name": "AddRoutesOptions",
       "properties": [
@@ -3118,7 +3152,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 147
+            "line": 171
           },
           "name": "apiGwyOrigin",
           "type": {
@@ -3134,7 +3168,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 162
+            "line": 186
           },
           "name": "apigwyOriginRequestPolicy",
           "type": {
@@ -3150,7 +3184,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 152
+            "line": 176
           },
           "name": "bucketAppsOrigin",
           "type": {
@@ -3166,13 +3200,35 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 157
+            "line": 181
           },
           "name": "distro",
           "type": {
             "fqn": "aws-cdk-lib.aws_cloudfront.Distribution"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Edge lambdas to associate with the API Gateway routes."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsCF.ts",
+            "line": 226
+          },
+          "name": "apigwyEdgeFunctions",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "aws-cdk-lib.aws_cloudfront.EdgeLambda"
+              },
+              "kind": "array"
+            }
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -3184,7 +3240,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 182
+            "line": 206
           },
           "name": "createAPIPathRoute",
           "optional": true,
@@ -3192,6 +3248,25 @@
             "primitive": "boolean"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "remarks": "When false API routes with a period in the path will get routed to S3.\n\nWhen true API routes that contain /_next/data/ in the path will get routed to API Gateway\neven if they have a period in the path.",
+            "stability": "experimental",
+            "summary": "Create an extra Behavior (Route) for /_next/data/ This route is used by Next.js to load data from the API Gateway on `getServerSideProps` calls.  The requests can end in `.json`, which would cause them to be routed to S3 if this route is not created."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsCF.ts",
+            "line": 221
+          },
+          "name": "createNextDataPathRoute",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -3202,7 +3277,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 169
+            "line": 193
           },
           "name": "rootPathPrefix",
           "optional": true,
@@ -3224,7 +3299,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsCF.ts",
-        "line": 115
+        "line": 139
       },
       "name": "CreateAPIOriginPolicyOptions",
       "properties": [
@@ -3239,7 +3314,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 122
+            "line": 146
           },
           "name": "assetNameRoot",
           "optional": true,
@@ -3258,7 +3333,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 130
+            "line": 154
           },
           "name": "assetNameSuffix",
           "optional": true,
@@ -3275,7 +3350,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 137
+            "line": 161
           },
           "name": "domainNameEdge",
           "optional": true,
@@ -3286,6 +3361,83 @@
       ],
       "symbolId": "src/MicroAppsCF:CreateAPIOriginPolicyOptions"
     },
+    "@pwrdrvr/microapps-cdk.GenerateEdgeToOriginConfigOptions": {
+      "assembly": "@pwrdrvr/microapps-cdk",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@pwrdrvr/microapps-cdk.GenerateEdgeToOriginConfigOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/MicroAppsEdgeToOrigin.ts",
+        "line": 102
+      },
+      "name": "GenerateEdgeToOriginConfigOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 105
+          },
+          "name": "addXForwardedHostHeader",
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 103
+          },
+          "name": "originRegion",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 106
+          },
+          "name": "replaceHostHeader",
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental"
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 104
+          },
+          "name": "signingMode",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/MicroAppsEdgeToOrigin:GenerateEdgeToOriginConfigOptions"
+    },
     "@pwrdrvr/microapps-cdk.IMicroApps": {
       "assembly": "@pwrdrvr/microapps-cdk",
       "docs": {
@@ -3296,7 +3448,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroApps.ts",
-        "line": 195
+        "line": 258
       },
       "name": "IMicroApps",
       "properties": [
@@ -3309,7 +3461,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 206
+            "line": 272
           },
           "name": "apigwy",
           "type": {
@@ -3325,7 +3477,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 197
+            "line": 260
           },
           "name": "cf",
           "type": {
@@ -3341,7 +3493,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 200
+            "line": 266
           },
           "name": "s3",
           "type": {
@@ -3357,12 +3509,29 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 203
+            "line": 269
           },
           "name": "svcs",
           "type": {
             "fqn": "@pwrdrvr/microapps-cdk.IMicroAppsSvcs"
           }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "{@inheritdoc IMicroAppsEdgeToOrigin}."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroApps.ts",
+            "line": 263
+          },
+          "name": "edgeToOrigin",
+          "optional": true,
+          "type": {
+            "fqn": "@pwrdrvr/microapps-cdk.IMicroAppsEdgeToOrigin"
+          }
         }
       ],
       "symbolId": "src/MicroApps:IMicroApps"
@@ -3377,7 +3546,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsAPIGwy.ts",
-        "line": 81
+        "line": 89
       },
       "name": "IMicroAppsAPIGwy",
       "properties": [
@@ -3390,7 +3559,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 90
+            "line": 98
           },
           "name": "httpApi",
           "type": {
@@ -3406,7 +3575,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 85
+            "line": 93
           },
           "name": "dnAppsOrigin",
           "optional": true,
@@ -3427,19 +3596,20 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsCF.ts",
-        "line": 17
+        "line": 16
       },
       "name": "IMicroAppsCF",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "The CloudFront distribution."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 18
+            "line": 20
           },
           "name": "cloudFrontDistro",
           "type": {
@@ -3449,6 +3619,70 @@
       ],
       "symbolId": "src/MicroAppsCF:IMicroAppsCF"
     },
+    "@pwrdrvr/microapps-cdk.IMicroAppsEdgeToOrigin": {
+      "assembly": "@pwrdrvr/microapps-cdk",
+      "docs": {
+        "stability": "experimental",
+        "summary": "Represents a MicroApps Edge to Origin Function."
+      },
+      "fqn": "@pwrdrvr/microapps-cdk.IMicroAppsEdgeToOrigin",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/MicroAppsEdgeToOrigin.ts",
+        "line": 15
+      },
+      "name": "IMicroAppsEdgeToOrigin",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "The generated `config.yml` is included in the Lambda's code.",
+            "stability": "experimental",
+            "summary": "The edge to origin function for API Gateway Request Origin Edge Lambda."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 21
+          },
+          "name": "edgeToOriginFunction",
+          "type": {
+            "union": {
+              "types": [
+                {
+                  "fqn": "aws-cdk-lib.aws_cloudfront.experimental.EdgeFunction"
+                },
+                {
+                  "fqn": "aws-cdk-lib.aws_lambda.Function"
+                }
+              ]
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Configuration of the edge to origin lambda functions."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 26
+          },
+          "name": "edgeToOriginLambdas",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "aws-cdk-lib.aws_cloudfront.EdgeLambda"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/MicroAppsEdgeToOrigin:IMicroAppsEdgeToOrigin"
+    },
     "@pwrdrvr/microapps-cdk.IMicroAppsS3": {
       "assembly": "@pwrdrvr/microapps-cdk",
       "docs": {
@@ -3556,7 +3790,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsSvcs.ts",
-        "line": 153
+        "line": 177
       },
       "name": "IMicroAppsSvcs",
       "properties": [
@@ -3569,7 +3803,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 162
+            "line": 186
           },
           "name": "deployerFunc",
           "type": {
@@ -3585,7 +3819,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 167
+            "line": 191
           },
           "name": "routerFunc",
           "type": {
@@ -3601,7 +3835,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 157
+            "line": 181
           },
           "name": "table",
           "type": {
@@ -3611,11 +3845,47 @@
       ],
       "symbolId": "src/MicroAppsSvcs:IMicroAppsSvcs"
     },
+    "@pwrdrvr/microapps-cdk.IMicroAppsTable": {
+      "assembly": "@pwrdrvr/microapps-cdk",
+      "docs": {
+        "stability": "experimental",
+        "summary": "Represents a MicroAppsTable."
+      },
+      "fqn": "@pwrdrvr/microapps-cdk.IMicroAppsTable",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/MicroAppsTable.ts",
+        "line": 52
+      },
+      "name": "IMicroAppsTable",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "DynamoDB table used by Router, Deployer, and Release console app."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsTable.ts",
+            "line": 56
+          },
+          "name": "table",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_dynamodb.Table"
+          }
+        }
+      ],
+      "symbolId": "src/MicroAppsTable:IMicroAppsTable"
+    },
     "@pwrdrvr/microapps-cdk.MicroApps": {
       "assembly": "@pwrdrvr/microapps-cdk",
       "base": "constructs.Construct",
       "docs": {
-        "remarks": "Use this construct to create a working entire stack.\n\nDo not use this construct when adding MicroApps to an existing\nCloudFront, API Gateway, S3 Bucket, etc. or where access\nto all features of the AWS Resources are needed (e.g. to\nadd additional Behaviors to the CloudFront distribution, set authorizors\non API Gateway, etc.).",
+        "custom": {
+          "warning": "This construct is not intended for production use.\nIn a production stack the DynamoDB Table, API Gateway, S3 Buckets,\netc. should be created in a \"durable\" stack where the IDs will not\nchange and where changes to the MicroApps construct will not\ncause failures to deploy or data to be deleted."
+        },
+        "remarks": "Use this construct to create a PoC working entire stack.\n\nDo not use this construct when adding MicroApps to an existing\nCloudFront, API Gateway, S3 Bucket, etc. or where access\nto all features of the AWS Resources are needed (e.g. to\nadd additional Behaviors to the CloudFront distribution, set authorizors\non API Gateway, etc.).",
         "see": "{@link https://github.com/pwrdrvr/microapps-core/blob/main/packages/cdk/lib/MicroApps.ts | example usage in a CDK Stack }",
         "stability": "experimental",
         "summary": "Create a new MicroApps \"turnkey\" construct for simple deployments and for initial evaulation of the MicroApps framework."
@@ -3627,7 +3897,7 @@
         },
         "locationInModule": {
           "filename": "src/MicroApps.ts",
-          "line": 244
+          "line": 321
         },
         "parameters": [
           {
@@ -3657,7 +3927,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/MicroApps.ts",
-        "line": 223
+        "line": 295
       },
       "name": "MicroApps",
       "properties": [
@@ -3669,7 +3939,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 235
+            "line": 312
           },
           "name": "apigwy",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroApps",
@@ -3685,7 +3955,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 225
+            "line": 297
           },
           "name": "cf",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroApps",
@@ -3701,7 +3971,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 230
+            "line": 307
           },
           "name": "s3",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroApps",
@@ -3717,13 +3987,30 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 240
+            "line": 317
           },
           "name": "svcs",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroApps",
           "type": {
             "fqn": "@pwrdrvr/microapps-cdk.IMicroAppsSvcs"
           }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "{@inheritdoc IMicroAppsEdgeToOrigin}."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroApps.ts",
+            "line": 302
+          },
+          "name": "edgeToOrigin",
+          "optional": true,
+          "overrides": "@pwrdrvr/microapps-cdk.IMicroApps",
+          "type": {
+            "fqn": "@pwrdrvr/microapps-cdk.IMicroAppsEdgeToOrigin"
+          }
         }
       ],
       "symbolId": "src/MicroApps:MicroApps"
@@ -3733,7 +4020,7 @@
       "base": "constructs.Construct",
       "docs": {
         "stability": "experimental",
-        "summary": "Create a new MicroApps API Gateway HTTP API endpoint."
+        "summary": "Create a new MicroApps API Gateway HTTP API endpoint, optionally requiring IAM authorization."
       },
       "fqn": "@pwrdrvr/microapps-cdk.MicroAppsAPIGwy",
       "initializer": {
@@ -3742,7 +4029,7 @@
         },
         "locationInModule": {
           "filename": "src/MicroAppsAPIGwy.ts",
-          "line": 107
+          "line": 116
         },
         "parameters": [
           {
@@ -3759,7 +4046,6 @@
           },
           {
             "name": "props",
-            "optional": true,
             "type": {
               "fqn": "@pwrdrvr/microapps-cdk.MicroAppsAPIGwyProps"
             }
@@ -3772,7 +4058,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/MicroAppsAPIGwy.ts",
-        "line": 96
+        "line": 105
       },
       "name": "MicroAppsAPIGwy",
       "properties": [
@@ -3784,7 +4070,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 103
+            "line": 112
           },
           "name": "httpApi",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsAPIGwy",
@@ -3800,7 +4086,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 98
+            "line": 107
           },
           "name": "dnAppsOrigin",
           "optional": true,
@@ -3823,7 +4109,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsAPIGwy.ts",
-        "line": 14
+        "line": 15
       },
       "name": "MicroAppsAPIGwyProps",
       "properties": [
@@ -3838,7 +4124,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 46
+            "line": 47
           },
           "name": "assetNameRoot",
           "optional": true,
@@ -3857,7 +4143,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 54
+            "line": 55
           },
           "name": "assetNameSuffix",
           "optional": true,
@@ -3875,7 +4161,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 62
+            "line": 63
           },
           "name": "certOrigin",
           "optional": true,
@@ -3894,7 +4180,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 30
+            "line": 31
           },
           "name": "domainNameEdge",
           "optional": true,
@@ -3913,7 +4199,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 38
+            "line": 39
           },
           "name": "domainNameOrigin",
           "optional": true,
@@ -3930,7 +4216,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 67
+            "line": 68
           },
           "name": "r53Zone",
           "optional": true,
@@ -3949,7 +4235,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 22
+            "line": 23
           },
           "name": "removalPolicy",
           "optional": true,
@@ -3957,6 +4243,24 @@
             "fqn": "aws-cdk-lib.RemovalPolicy"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "experimental",
+            "summary": "Require IAM auth on API Gateway."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsAPIGwy.ts",
+            "line": 83
+          },
+          "name": "requireIAMAuthorization",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -3968,7 +4272,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsAPIGwy.ts",
-            "line": 75
+            "line": 76
           },
           "name": "rootPathPrefix",
           "optional": true,
@@ -3993,7 +4297,7 @@
         },
         "locationInModule": {
           "filename": "src/MicroAppsCF.ts",
-          "line": 306
+          "line": 370
         },
         "parameters": [
           {
@@ -4022,7 +4326,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/MicroAppsCF.ts",
-        "line": 188
+        "line": 232
       },
       "methods": [
         {
@@ -4032,7 +4336,7 @@
           },
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 242
+            "line": 291
           },
           "name": "addRoutes",
           "parameters": [
@@ -4059,18 +4363,18 @@
           },
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 202
+            "line": 246
           },
           "name": "createAPIOriginPolicy",
           "parameters": [
             {
-              "name": "scope",
+              "name": "_scope",
               "type": {
                 "fqn": "constructs.Construct"
               }
             },
             {
-              "name": "props",
+              "name": "_props",
               "type": {
                 "fqn": "@pwrdrvr/microapps-cdk.CreateAPIOriginPolicyOptions"
               }
@@ -4088,12 +4392,13 @@
       "properties": [
         {
           "docs": {
-            "stability": "experimental"
+            "stability": "experimental",
+            "summary": "The CloudFront distribution."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 302
+            "line": 366
           },
           "name": "cloudFrontDistro",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsCF",
@@ -4115,7 +4420,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsCF.ts",
-        "line": 24
+        "line": 26
       },
       "name": "MicroAppsCFProps",
       "properties": [
@@ -4128,7 +4433,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 37
+            "line": 39
           },
           "name": "bucketAppsOrigin",
           "type": {
@@ -4144,7 +4449,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 63
+            "line": 65
           },
           "name": "httpApi",
           "type": {
@@ -4162,7 +4467,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 71
+            "line": 73
           },
           "name": "assetNameRoot",
           "optional": true,
@@ -4181,7 +4486,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 79
+            "line": 81
           },
           "name": "assetNameSuffix",
           "optional": true,
@@ -4198,7 +4503,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 42
+            "line": 44
           },
           "name": "bucketLogs",
           "optional": true,
@@ -4215,7 +4520,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 84
+            "line": 86
           },
           "name": "certEdge",
           "optional": true,
@@ -4234,7 +4539,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 109
+            "line": 111
           },
           "name": "createAPIPathRoute",
           "optional": true,
@@ -4242,6 +4547,25 @@
             "primitive": "boolean"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "remarks": "When false API routes with a period in the path will get routed to S3.\n\nWhen true API routes that contain /_next/data/ in the path will get routed to API Gateway\neven if they have a period in the path.",
+            "stability": "experimental",
+            "summary": "Create an extra Behavior (Route) for /_next/data/ This route is used by Next.js to load data from the API Gateway on `getServerSideProps` calls.  The requests can end in `.json`, which would cause them to be routed to S3 if this route is not created."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsCF.ts",
+            "line": 126
+          },
+          "name": "createNextDataPathRoute",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -4253,7 +4577,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 50
+            "line": 52
           },
           "name": "domainNameEdge",
           "optional": true,
@@ -4272,7 +4596,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 58
+            "line": 60
           },
           "name": "domainNameOrigin",
           "optional": true,
@@ -4280,6 +4604,31 @@
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "custom": {
+              "defaunt": "- no edge to API Gateway origin functions added"
+            },
+            "stability": "experimental",
+            "summary": "Configuration of the edge to origin lambda functions."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsCF.ts",
+            "line": 133
+          },
+          "name": "edgeToOriginLambdas",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "aws-cdk-lib.aws_cloudfront.EdgeLambda"
+              },
+              "kind": "array"
+            }
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -4289,7 +4638,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 89
+            "line": 91
           },
           "name": "r53Zone",
           "optional": true,
@@ -4308,7 +4657,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 32
+            "line": 34
           },
           "name": "removalPolicy",
           "optional": true,
@@ -4326,7 +4675,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsCF.ts",
-            "line": 96
+            "line": 98
           },
           "name": "rootPathPrefix",
           "optional": true,
@@ -4337,6 +4686,280 @@
       ],
       "symbolId": "src/MicroAppsCF:MicroAppsCFProps"
     },
+    "@pwrdrvr/microapps-cdk.MicroAppsEdgeToOrigin": {
+      "assembly": "@pwrdrvr/microapps-cdk",
+      "base": "constructs.Construct",
+      "docs": {
+        "stability": "experimental",
+        "summary": "Create a new MicroApps Edge to Origin Function w/ `config.yml`."
+      },
+      "fqn": "@pwrdrvr/microapps-cdk.MicroAppsEdgeToOrigin",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/MicroAppsEdgeToOrigin.ts",
+          "line": 135
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "type": {
+              "fqn": "@pwrdrvr/microapps-cdk.MicroAppsEdgeToOriginProps"
+            }
+          }
+        ]
+      },
+      "interfaces": [
+        "@pwrdrvr/microapps-cdk.IMicroAppsEdgeToOrigin"
+      ],
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/MicroAppsEdgeToOrigin.ts",
+        "line": 112
+      },
+      "methods": [
+        {
+          "docs": {
+            "returns": "",
+            "stability": "experimental",
+            "summary": "Generate the yaml config for the edge lambda."
+          },
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 118
+          },
+          "name": "generateEdgeToOriginConfig",
+          "parameters": [
+            {
+              "name": "props",
+              "type": {
+                "fqn": "@pwrdrvr/microapps-cdk.GenerateEdgeToOriginConfigOptions"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "primitive": "string"
+            }
+          },
+          "static": true
+        }
+      ],
+      "name": "MicroAppsEdgeToOrigin",
+      "properties": [
+        {
+          "docs": {
+            "remarks": "The generated `config.yml` is included in the Lambda's code.",
+            "stability": "experimental",
+            "summary": "The edge to origin function for API Gateway Request Origin Edge Lambda."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 126
+          },
+          "name": "edgeToOriginFunction",
+          "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsEdgeToOrigin",
+          "type": {
+            "union": {
+              "types": [
+                {
+                  "fqn": "aws-cdk-lib.aws_cloudfront.experimental.EdgeFunction"
+                },
+                {
+                  "fqn": "aws-cdk-lib.aws_lambda.Function"
+                }
+              ]
+            }
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Configuration of the edge to origin lambda functions."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 131
+          },
+          "name": "edgeToOriginLambdas",
+          "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsEdgeToOrigin",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "aws-cdk-lib.aws_cloudfront.EdgeLambda"
+              },
+              "kind": "array"
+            }
+          }
+        }
+      ],
+      "symbolId": "src/MicroAppsEdgeToOrigin:MicroAppsEdgeToOrigin"
+    },
+    "@pwrdrvr/microapps-cdk.MicroAppsEdgeToOriginProps": {
+      "assembly": "@pwrdrvr/microapps-cdk",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Properties to initialize an instance of `MicroAppsEdgeToOrigin`."
+      },
+      "fqn": "@pwrdrvr/microapps-cdk.MicroAppsEdgeToOriginProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/MicroAppsEdgeToOrigin.ts",
+        "line": 32
+      },
+      "name": "MicroAppsEdgeToOriginProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "remarks": "Can only be trusted if `signingMode` is enabled, which restricts\naccess to API Gateway to only IAM signed requests.\n\nNote: if true, creates OriginRequest Lambda @ Edge function for API Gateway Origin",
+            "stability": "experimental",
+            "summary": "Adds an X-Forwarded-Host-Header when calling API Gateway."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 65
+          },
+          "name": "addXForwardedHostHeader",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- resource names auto assigned",
+            "example": "microapps",
+            "stability": "experimental",
+            "summary": "Optional asset name root."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 46
+          },
+          "name": "assetNameRoot",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "none",
+            "example": "-dev-pr-12",
+            "stability": "experimental",
+            "summary": "Optional asset name suffix."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 54
+          },
+          "name": "assetNameSuffix",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "undefined",
+            "stability": "experimental",
+            "summary": "Origin region that API Gateway will be deployed to, used for the config.yml on the Edge function to sign requests for the correct region."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 99
+          },
+          "name": "originRegion",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- per resource default",
+            "stability": "experimental",
+            "summary": "RemovalPolicy override for child resources."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 38
+          },
+          "name": "removalPolicy",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.RemovalPolicy"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "remarks": "This is necessary when API Gateway has not been configured\nwith a custom domain name that matches the exact domain name used by the CloudFront\nDistribution AND when the OriginRequestPolicy.HeadersBehavior is set\nto pass all headers to the origin.\n\nNote: if true, creates OriginRequest Lambda @ Edge function for API Gateway Origin",
+            "stability": "experimental",
+            "summary": "Replaces Host header (which will be the Edge domain name) with the Origin domain name when enabled."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 77
+          },
+          "name": "replaceHostHeader",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "'sign'",
+            "remarks": "'sign' - Uses request headers for auth.\n'presign' - Uses query string for auth.\n\nIf enabled,\n\nNote: if 'sign' or 'presign', creates OriginRequest Lambda @ Edge function for API Gateway Origin",
+            "stability": "experimental",
+            "summary": "Requires IAM auth on the API Gateway origin if not set to 'none'."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsEdgeToOrigin.ts",
+            "line": 90
+          },
+          "name": "signingMode",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/MicroAppsEdgeToOrigin:MicroAppsEdgeToOriginProps"
+    },
     "@pwrdrvr/microapps-cdk.MicroAppsProps": {
       "assembly": "@pwrdrvr/microapps-cdk",
       "datatype": true,
@@ -4348,7 +4971,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroApps.ts",
-        "line": 36
+        "line": 38
       },
       "name": "MicroAppsProps",
       "properties": [
@@ -4362,13 +4985,32 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 51
+            "line": 53
           },
           "name": "appEnv",
           "type": {
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "remarks": "Can only be trusted if `signingMode` is enabled, which restricts\naccess to API Gateway to only IAM signed requests.\n\nNote: if true, creates OriginRequest Lambda @ Edge function for API Gateway Origin",
+            "stability": "experimental",
+            "summary": "Adds an X-Forwarded-Host-Header when calling API Gateway."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroApps.ts",
+            "line": 202
+          },
+          "name": "addXForwardedHostHeader",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -4380,7 +5022,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 59
+            "line": 61
           },
           "name": "assetNameRoot",
           "optional": true,
@@ -4399,7 +5041,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 67
+            "line": 69
           },
           "name": "assetNameSuffix",
           "optional": true,
@@ -4416,7 +5058,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 77
+            "line": 79
           },
           "name": "certEdge",
           "optional": true,
@@ -4433,7 +5075,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 82
+            "line": 84
           },
           "name": "certOrigin",
           "optional": true,
@@ -4452,7 +5094,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 189
+            "line": 191
           },
           "name": "createAPIPathRoute",
           "optional": true,
@@ -4471,9 +5113,28 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 161
+            "line": 163
+          },
+          "name": "domainNameEdge",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "auto-assigned",
+            "example": "apps-origin.pwrdrvr.com",
+            "stability": "experimental",
+            "summary": "Optional custom domain name for the API Gateway HTTPv2 API."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroApps.ts",
+            "line": 171
           },
-          "name": "domainNameEdge",
+          "name": "domainNameOrigin",
           "optional": true,
           "type": {
             "primitive": "string"
@@ -4482,17 +5143,16 @@
         {
           "abstract": true,
           "docs": {
-            "default": "auto-assigned",
-            "example": "apps-origin.pwrdrvr.com",
+            "default": "undefined",
             "stability": "experimental",
-            "summary": "Optional custom domain name for the API Gateway HTTPv2 API."
+            "summary": "Origin region that API Gateway will be deployed to, used for the config.yml on the Edge function to sign requests for the correct region."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 169
+            "line": 236
           },
-          "name": "domainNameOrigin",
+          "name": "originRegion",
           "optional": true,
           "type": {
             "primitive": "string"
@@ -4507,7 +5167,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 72
+            "line": 74
           },
           "name": "r53Zone",
           "optional": true,
@@ -4526,7 +5186,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 44
+            "line": 46
           },
           "name": "removalPolicy",
           "optional": true,
@@ -4534,6 +5194,25 @@
             "fqn": "aws-cdk-lib.RemovalPolicy"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "remarks": "This is necessary when API Gateway has not been configured\nwith a custom domain name that matches the exact domain name used by the CloudFront\nDistribution AND when the OriginRequestPolicy.HeadersBehavior is set\nto pass all headers to the origin.\n\nNote: if true, creates OriginRequest Lambda @ Edge function for API Gateway Origin",
+            "stability": "experimental",
+            "summary": "Replaces Host header (which will be the Edge domain name) with the Origin domain name when enabled."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroApps.ts",
+            "line": 214
+          },
+          "name": "replaceHostHeader",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -4544,7 +5223,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 176
+            "line": 178
           },
           "name": "rootPathPrefix",
           "optional": true,
@@ -4564,7 +5243,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 153
+            "line": 155
           },
           "name": "s3PolicyBypassAROAs",
           "optional": true,
@@ -4589,7 +5268,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 110
+            "line": 112
           },
           "name": "s3PolicyBypassPrincipalARNs",
           "optional": true,
@@ -4613,13 +5292,53 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroApps.ts",
-            "line": 94
+            "line": 96
           },
           "name": "s3StrictBucketPolicy",
           "optional": true,
           "type": {
             "primitive": "boolean"
           }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "'sign'",
+            "remarks": "'sign' - Uses request headers for auth.\n'presign' - Uses query string for auth.\n\nIf enabled,\n\nNote: if 'sign' or 'presign', creates OriginRequest Lambda @ Edge function for API Gateway Origin",
+            "stability": "experimental",
+            "summary": "Requires IAM auth on the API Gateway origin if not set to 'none'."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroApps.ts",
+            "line": 227
+          },
+          "name": "signingMode",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "custom": {
+              "warning": "- It is *strongly* suggested that production stacks create\ntheir own DynamoDB Table and pass it into this construct, for protection\nagainst data loss due to logical ID changes, the ability to configure\nProvisioned capacity with Auto Scaling, the ability to add additional indices, etc.\n\nRequirements:\n- Hash Key: `PK`\n- Sort Key: `SK`"
+            },
+            "default": "created by construct",
+            "stability": "experimental",
+            "summary": "Existing table for apps/versions/rules."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroApps.ts",
+            "line": 252
+          },
+          "name": "table",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_dynamodb.ITable"
+          }
         }
       ],
       "symbolId": "src/MicroApps:MicroAppsProps"
@@ -4628,8 +5347,9 @@
       "assembly": "@pwrdrvr/microapps-cdk",
       "base": "constructs.Construct",
       "docs": {
+        "remarks": "These should be created in a stack that will not be deleted if\nthere are breaking changes to MicroApps in the future.",
         "stability": "experimental",
-        "summary": "Create a new MicroApps S3 Bucket."
+        "summary": "Create the durable MicroApps S3 Buckets."
       },
       "fqn": "@pwrdrvr/microapps-cdk.MicroAppsS3",
       "initializer": {
@@ -4638,7 +5358,7 @@
         },
         "locationInModule": {
           "filename": "src/MicroAppsS3.ts",
-          "line": 117
+          "line": 120
         },
         "parameters": [
           {
@@ -4668,7 +5388,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/MicroAppsS3.ts",
-        "line": 91
+        "line": 94
       },
       "name": "MicroAppsS3",
       "properties": [
@@ -4680,7 +5400,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsS3.ts",
-            "line": 93
+            "line": 96
           },
           "name": "bucketApps",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsS3",
@@ -4696,7 +5416,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsS3.ts",
-            "line": 98
+            "line": 101
           },
           "name": "bucketAppsOAI",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsS3",
@@ -4712,7 +5432,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsS3.ts",
-            "line": 103
+            "line": 106
           },
           "name": "bucketAppsOrigin",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsS3",
@@ -4728,7 +5448,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsS3.ts",
-            "line": 108
+            "line": 111
           },
           "name": "bucketAppsStaging",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsS3",
@@ -4744,7 +5464,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsS3.ts",
-            "line": 113
+            "line": 116
           },
           "name": "bucketLogs",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsS3",
@@ -4898,7 +5618,7 @@
         },
         "locationInModule": {
           "filename": "src/MicroAppsSvcs.ts",
-          "line": 190
+          "line": 215
         },
         "parameters": [
           {
@@ -4928,7 +5648,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/MicroAppsSvcs.ts",
-        "line": 174
+        "line": 198
       },
       "name": "MicroAppsSvcs",
       "properties": [
@@ -4940,7 +5660,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 181
+            "line": 206
           },
           "name": "deployerFunc",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsSvcs",
@@ -4956,7 +5676,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 186
+            "line": 211
           },
           "name": "routerFunc",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsSvcs",
@@ -4972,7 +5692,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 176
+            "line": 201
           },
           "name": "table",
           "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsSvcs",
@@ -4994,7 +5714,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/MicroAppsSvcs.ts",
-        "line": 18
+        "line": 19
       },
       "name": "MicroAppsSvcsProps",
       "properties": [
@@ -5007,7 +5727,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 52
+            "line": 53
           },
           "name": "appEnv",
           "type": {
@@ -5023,7 +5743,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 31
+            "line": 32
           },
           "name": "bucketApps",
           "type": {
@@ -5039,7 +5759,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 36
+            "line": 37
           },
           "name": "bucketAppsOAI",
           "type": {
@@ -5055,7 +5775,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 41
+            "line": 42
           },
           "name": "bucketAppsStaging",
           "type": {
@@ -5071,7 +5791,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 46
+            "line": 47
           },
           "name": "httpApi",
           "type": {
@@ -5089,7 +5809,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 60
+            "line": 61
           },
           "name": "assetNameRoot",
           "optional": true,
@@ -5108,7 +5828,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 68
+            "line": 69
           },
           "name": "assetNameSuffix",
           "optional": true,
@@ -5127,7 +5847,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 26
+            "line": 27
           },
           "name": "removalPolicy",
           "optional": true,
@@ -5135,6 +5855,24 @@
             "fqn": "aws-cdk-lib.RemovalPolicy"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "stability": "experimental",
+            "summary": "Require IAM auth on API Gateway."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsSvcs.ts",
+            "line": 155
+          },
+          "name": "requireIAMAuthorization",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -5146,7 +5884,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 147
+            "line": 148
           },
           "name": "rootPathPrefix",
           "optional": true,
@@ -5166,7 +5904,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 139
+            "line": 140
           },
           "name": "s3PolicyBypassAROAs",
           "optional": true,
@@ -5191,7 +5929,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 96
+            "line": 97
           },
           "name": "s3PolicyBypassPrincipalARNs",
           "optional": true,
@@ -5215,18 +5953,216 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/MicroAppsSvcs.ts",
-            "line": 80
+            "line": 81
           },
           "name": "s3StrictBucketPolicy",
           "optional": true,
           "type": {
             "primitive": "boolean"
           }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "custom": {
+              "warning": "- It is *strongly* suggested that production stacks create\ntheir own DynamoDB Table and pass it into this construct, for protection\nagainst data loss due to logical ID changes, the ability to configure\nProvisioned capacity with Auto Scaling, the ability to add additional indices, etc.\n\nRequirements:\n- Hash Key: `PK`\n- Sort Key: `SK`"
+            },
+            "default": "created by construct",
+            "stability": "experimental",
+            "summary": "Existing table for apps/versions/rules."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsSvcs.ts",
+            "line": 171
+          },
+          "name": "table",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_dynamodb.ITable"
+          }
         }
       ],
       "symbolId": "src/MicroAppsSvcs:MicroAppsSvcsProps"
+    },
+    "@pwrdrvr/microapps-cdk.MicroAppsTable": {
+      "assembly": "@pwrdrvr/microapps-cdk",
+      "base": "constructs.Construct",
+      "docs": {
+        "stability": "experimental",
+        "summary": "Create a new MicroApps Table for apps / versions / rules."
+      },
+      "fqn": "@pwrdrvr/microapps-cdk.MicroAppsTable",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/MicroAppsTable.ts",
+          "line": 68
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "optional": true,
+            "type": {
+              "fqn": "@pwrdrvr/microapps-cdk.MicroAppsTableProps"
+            }
+          }
+        ]
+      },
+      "interfaces": [
+        "@pwrdrvr/microapps-cdk.IMicroAppsTable"
+      ],
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/MicroAppsTable.ts",
+        "line": 62
+      },
+      "name": "MicroAppsTable",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "DynamoDB table used by Router, Deployer, and Release console app."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsTable.ts",
+            "line": 64
+          },
+          "name": "table",
+          "overrides": "@pwrdrvr/microapps-cdk.IMicroAppsTable",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_dynamodb.Table"
+          }
+        }
+      ],
+      "symbolId": "src/MicroAppsTable:MicroAppsTable"
+    },
+    "@pwrdrvr/microapps-cdk.MicroAppsTableProps": {
+      "assembly": "@pwrdrvr/microapps-cdk",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Properties to initialize an instance of `MicroAppsTable`."
+      },
+      "fqn": "@pwrdrvr/microapps-cdk.MicroAppsTableProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/MicroAppsTable.ts",
+        "line": 8
+      },
+      "name": "MicroAppsTableProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Application environment, passed as `NODE_ENV` to the Router and Deployer Lambda functions."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsTable.ts",
+            "line": 22
+          },
+          "name": "appEnv",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- resource names auto assigned",
+            "example": "microapps",
+            "stability": "experimental",
+            "summary": "Optional asset name root."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsTable.ts",
+            "line": 30
+          },
+          "name": "assetNameRoot",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "none",
+            "example": "-dev-pr-12",
+            "stability": "experimental",
+            "summary": "Optional asset name suffix."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsTable.ts",
+            "line": 38
+          },
+          "name": "assetNameSuffix",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- per resource default",
+            "remarks": "Note: if set to DESTROY the S3 buckes will have `autoDeleteObjects` set to `true`",
+            "stability": "experimental",
+            "summary": "RemovalPolicy override for child resources."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsTable.ts",
+            "line": 16
+          },
+          "name": "removalPolicy",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.RemovalPolicy"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "none",
+            "example": "dev/",
+            "stability": "experimental",
+            "summary": "Path prefix on the root of the deployment."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/MicroAppsTable.ts",
+            "line": 46
+          },
+          "name": "rootPathPrefix",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/MicroAppsTable:MicroAppsTableProps"
     }
   },
-  "version": "0.2.10",
-  "fingerprint": "cf+x3bDx5LxzTnbJaUgh6qyjhyDT8VAtswrEHtMJhqk="
+  "version": "0.2.11",
+  "fingerprint": "2pfJZCKSJIr9Tun1hbwzpkcAtPzke8YGGzasGMSQ+F4="
 }