By ByteBot
Every AI-scaffolded AWS app looks production-ready until you check whether WAF is configured. It isn’t. Neither is Cognito threat protection, API access logging, or Trivy image scanning. AWS’s own internal prototyping team — the PACE team — hit this gap on every customer engagement. Their response is now stable: the Nx Plugin for AWS 1.0, an open-source collection of generators that scaffold full-stack AWS applications with security defaults you actually want.
What It Is
The @aws/nx-plugin extends the Nx monorepo build system with AWS-specific generators. Each generator writes application code and the infrastructure to run it — CDK constructs or Terraform modules, your choice. TypeScript and Python stacks are supported; React handles the frontend.
Generators available at v1.0:
ts#api/py#api— Serverless REST APIts#website— React frontendts#dynamodb/py#dynamodb— DynamoDB single-table designts#rdb/py#rdb— Aurora RDS relational database- AgentCore Gateway — AI agents and MCP servers on Bedrock AgentCore Runtime
connection— Type-safe wiring between any two generated projects
Security Is the Default, Not a Checklist
This is the point that separates the plugin from ad hoc scaffolding. Every generated project ships with AWS WAF, Cognito threat protection, enforced Content Security Policy, CloudWatch API access logging, Trivy container image scanning, license allowlists, and git-secrets pre-commit hooks. You don’t check boxes to enable these — you would have to actively remove them. That’s the correct default posture for anything that reaches production.
The Connection Generator: Where It Gets Interesting
The connection generator wires two projects together with a type-safe client. The practical consequence: rename a field in your API schema and the React frontend stops compiling until you update the call site. Breaking changes surface at build time, not at 2 AM in production logs.
Under the hood, it generates a tRPC client (TypeScript stacks) and uses Runtime Configuration to pass deploy-time values — API URLs, Cognito pool IDs, Bedrock agent ARNs — between components without hard-coding anything.
Agents and MCP Servers Ship Out of the Box
The v1.0 milestone adds the AgentCore Gateway generator, which deploys AI agents and MCP servers directly to Amazon Bedrock AgentCore Runtime. AgentCore Observability is configured automatically. The workspace also includes a built-in MCP server, so AI coding assistants that understand MCP can invoke the generators directly — a practical detail for teams already using agent-driven development workflows.
CDK and Terraform at Parity
Before v1.0, Terraform support was partial. As of 1.0, every generator produces either CDK constructs or Terraform modules — no compromises. Switch at workspace creation:
pnpm create @aws/nx-workspace my-project --iac terraformCDK remains the default. Terraform users are no longer second-class citizens.
Getting Started
pnpm create @aws/nx-workspace my-projectFor existing repos, the init generator adds the plugin to any Nx or non-Nx project. Generators are idempotent — re-running them after adding custom code won’t overwrite your changes, which was a sharp edge in pre-1.0 builds.
Documentation, guides, and the quick-start walkthrough are at awslabs.github.io/nx-plugin-for-aws. The source is on GitHub.
Who Should Use This
The plugin is a strong fit for teams already building on AWS that want a monorepo structure with enforced security defaults. It doesn’t replace knowledge of CDK or Terraform — you still need to understand what gets generated. What it removes is the repetitive scaffolding work and the risk that security configuration gets deferred to “right before launch” and then not done at all.
If your team reaches for cdk init or writes project scaffolding from scratch, this is worth evaluating. The AWS Open Source Blog post and the official announcement have the full feature breakdown.
