feat(gen2-migration): generate per-table stacks for multiple DDB tables (#14688)

* feat: avatar s3 feature for discussions app

* feat(cli): generate per-table stacks for multiple DDB tables

Previously, all DynamoDB tables were placed in a single shared storage
stack, causing conflicts when multiple tables existed. Each DDB table
now gets its own nested stack via backend.createStack('storage<name>'),
matching the Gen1 nested stack naming convention.

Also fixes resolveOutputs() crash when a Gen2 storage stack has no
Outputs section (happens when no cross-stack references exist for a
table).

Closes #14608, #14597

* fix(discussions): replace hand-crafted snapshots with real infrastructure data

Recapture discussions app snapshots from live deployments:
- Gen1: amplify-discussionsblade-blade-4edfd (activity + bookmarks tables)
- Gen2: amplify-d1skq8aomhb772-e2etest-branch (per-table stacks)

Pre-generate inputs use real amplify-pull data for bookmarks resource.
Pre-refactor templates fetched from deployed CloudFormation stacks.
Post-generate and post-refactor regenerated by test framework.

Also adds bookmarks to migration-config.json and fixes snapshot.ts
to use TemplateStage: Original for unprocessed templates.

* docs(discussions): add bookmarks table setup instructions to README

* fix(discussions): sanitize Amplify App ID in Gen2 snapshot files

Replace raw app ID d1skq8aomhb772 with sanitized name 'discussions'
in all snapshot file contents and filenames.

* docs(discussions): add S3 avatars bucket to migration config

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* test(discussions): update snapshots with S3 avatars + bookmarks DDB

Re-deployed discussions app with 3 storage types (activity DDB,
bookmarks DDB, avatars S3) and captured fresh snapshots for all 4
stages. Per-table stacks refactor verified working for both DDB tables.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(cli): disambiguate S3 nested stack from DDB per-table stacks

The S3 forward/rollback refactorers used findNestedStack with a bare
'storage' prefix, which matched DDB per-table stacks (e.g.
'storageactivity') before the S3 stack ('storage0EC3F24A'). Fixed by
using 'storage' + resourceName for Gen1 lookup and a new
findS3NestedStack method that distinguishes the CDK-hashed S3 stack
from lowercase-prefixed DDB stacks for Gen2 lookup.

Also refreshes discussions snapshots from a clean main/gen2-main deploy.

* fix(cli): address PR review comments for per-table stacks

- Replace fragile char-based findS3NestedStack with template-based S3
  detection (fetch template, check for AWS::S3::Bucket resource)
- Export findS3NestedStack from storage-forward.ts, import in rollback
- Remove dead STORAGE_RESOURCE_TYPES export
- Remove storage:S3 from validateSingleResourcePerStack (only one
  defineStorage() possible)
- Make scopeVarName required (no default) in DynamoDBRenderer
- Set Outputs default empty object in cfn-output-resolver, use
  templateOutputs consistently
- Add comments for optional Outputs in cfn-template.ts and resolver

* fix(cli): restore storage:S3 case in validateSingleResourcePerStack

Keep S3 validation as a defensive spot check even though the collision
can't happen in practice (JSON key uniqueness prevents same-name
resources within a category).

* feat(cli): add S3 avatars and bookmarks DDB tests to discussions test script

Extends the discussions gen1 test script to cover all stateful resources
that get refactored during migration: S3 avatars bucket (upload/getUrl/remove)
and bookmarks DynamoDB table (put/get/delete via AWS SDK). Verified with
full forward→rollback→forward round-trip on live app.

* refactor(cli): clean up bookmarks test - shared DDB client, config-based table lookup

Remove ListTablesCommand discovery in favor of reading table name from
amplifyconfiguration.json. Share a single DynamoDBDocumentClient across
all bookmark test functions instead of creating one per call.

* chore(cli): remove dev-only .gitignore from amplify-cli package

Remove .gitignore that ignored local dev helper scripts
(add-bookmarks.ts, deploy-gen1.ts) that no longer exist.

* fix(cli): add typescript devDep to fix typecheck for bundler moduleResolution

backend-only and discussions were missing typescript as a
devDependency, causing npx tsc to fall back to the root
tsc v4.9.5 which doesn't support moduleResolution:"bundler".
Also restores monorepo metadata in discussions snapshot
package.json files.

* fix: use README-specified emailVerificationMessage in discussions snapshots

Replace "Your verification code is {####}" with "Here is your verification code
{####}" to match the discussions README instructions, preventing drift when
snapshots are regenerated.

* fix: replace remaining old verification message in discussions snapshots

* fix: align gen2 branch verification messages with README

* fix: revert SMS verification messages to original values

Only email verification fields should use the README-specified message.
SMS fields should retain their original values.

* fix: remove trailing newlines from parameters files

* fix: remove unnecessary typescript devDependency from migration apps

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

amplify-migration-apps/discussions/README.md

@@ -2,7 +2,7 @@
 
 ![](./images/app.png)
 
-A discussion application built featuring authentication, GraphQL API, Lambda functions, and DynamoDB storage.
+A discussion application built featuring authentication, GraphQL API, Lambda functions, multiple DynamoDB storage tables (activity + bookmarks), and S3.
 
 > [!NOTICE]
 > Since amplify operations add files to your local directory, its better not to operate within this repo.
@@ -116,8 +116,9 @@ amplify add api
 
 ### Storage
 
-DynamoDB table for storing user activity logs with partition key, sort key,
-and global secondary index for querying by activity type.
+Two DynamoDB tables: `activity` for storing user activity logs, and `bookmarks` for storing user bookmarks on posts.
+
+#### Activity Table
 
 ```console
 amplify add storage
@@ -169,6 +170,59 @@ https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.Core
 ✔ Do you want to add a Lambda Trigger for your Table? (y/N) · no
 ```
 
+#### Bookmarks Table
+
+```console
+amplify add storage
+```
+
+```console
+? Select from one of the below mentioned services: NoSQL Database
+
+Welcome to the NoSQL DynamoDB database wizard
+This wizard asks you a series of questions to help determine how to set up your NoSQL database table.
+
+✔ Provide a friendly name · bookmarks
+✔ Provide table name · bookmarks
+
+You can now add columns to the table.
+
+✔ What would you like to name this column · userId
+✔ Choose the data type · string
+✔ Would you like to add another column? (Y/n) · yes
+✔ What would you like to name this column · postId
+✔ Choose the data type · string
+✔ Would you like to add another column? (Y/n) · no
+
+✔ Choose partition key for the table · userId
+✔ Do you want to add a sort key to your table? (Y/n) · yes
+✔ Choose sort key for the table · postId
+
+✔ Do you want to add global secondary indexes to your table? (Y/n) · yes
+✔ Provide the GSI name · byPost
+✔ Choose partition key for the GSI · postId
+✔ Do you want to add a sort key to your global secondary index? (Y/n) · no
+✔ Do you want to add more global secondary indexes to your table? (Y/n) · no
+✔ Do you want to add a Lambda Trigger for your Table? (y/N) · no
+```
+
+### Storage (S3 Avatars)
+
+S3 bucket for storing user profile pictures.
+
+```console
+amplify add storage
+```
+
+```console
+? Select from one of the below mentioned services: Content (Images, audio, video, etc.)
+✔ Provide a friendly name for your resource that will be used to label this category in the project: · avatars
+✔ Provide bucket name: · discus-avatars
+✔ Who should have access: · Auth users only
+✔ What kind of access do you want for Authenticated users? · create/update, read, delete
+✔ Do you want to add a Lambda Trigger for your S3 Bucket? (y/N) · no
+```
+
 ### Function
 
 **Node.js Lambda function that retrieves user activity from DynamoDB storage.**
@@ -280,6 +334,10 @@ amplify push
 ├──────────┼─────────────────────────────┼───────────┼───────────────────┤
 │ Storage  │ activity                    │ Create    │ awscloudformation │
 ├──────────┼─────────────────────────────┼───────────┼───────────────────┤
+│ Storage  │ bookmarks                   │ Create    │ awscloudformation │
+├──────────┼─────────────────────────────┼───────────┼───────────────────┤
+│ Storage  │ avatars                     │ Create    │ awscloudformation │
+├──────────┼─────────────────────────────┼───────────┼───────────────────┤
 │ Function │ fetchuseractivity           │ Create    │ awscloudformation │
 ├──────────┼─────────────────────────────┼───────────┼───────────────────┤
 │ Function │ recorduseractivity          │ Create    │ awscloudformation │
@@ -332,7 +390,7 @@ this process for any number of users.
 
 > Based on https://github.com/aws-amplify/amplify-cli/blob/gen2-migration/GEN2_MIGRATION_GUIDE.md
 
-First and install the experimental CLI package the provides the new commands:
+First install the experimental amplify CLI package that provides the migration commands.
 
 ```console
 npm install --no-save @aws-amplify/cli-internal-gen2-migration-experimental-alpha
@@ -419,4 +477,3 @@ git push origin gen2-main
 ```
 
 Wait for the deployment to finish successfully.
-

amplify-migration-apps/discussions/_snapshot.post.generate/amplify/backend.ts

@@ -1,26 +1,28 @@
 import { auth } from './auth/resource';
 import { data } from './data/resource';
+import { storage } from './storage/resource';
 import { fetchuseractivity } from './storage/fetchuseractivity/resource';
 import { recorduseractivity } from './storage/recorduseractivity/resource';
+import { DynamoEventSource } from 'aws-cdk-lib/aws-lambda-event-sources';
+import { StartingPosition } from 'aws-cdk-lib/aws-lambda';
 import {
   Table,
   AttributeType,
   BillingMode,
   StreamViewType,
 } from 'aws-cdk-lib/aws-dynamodb';
-import { DynamoEventSource } from 'aws-cdk-lib/aws-lambda-event-sources';
-import { StartingPosition } from 'aws-cdk-lib/aws-lambda';
 import { defineBackend } from '@aws-amplify/backend';
 import { Duration } from 'aws-cdk-lib';
 
 const backend = defineBackend({
   auth,
   data,
+  storage,
   fetchuseractivity,
   recorduseractivity,
 });
-const storageStack = backend.createStack('storage');
-const activity = new Table(storageStack, 'activity', {
+const storageActivityStack = backend.createStack('storageactivity');
+const activity = new Table(storageActivityStack, 'activity', {
   partitionKey: { name: 'id', type: AttributeType.STRING },
   billingMode: BillingMode.PROVISIONED,
   readCapacity: 5,
@@ -36,6 +38,22 @@ activity.addGlobalSecondaryIndex({
   readCapacity: 5,
   writeCapacity: 5,
 });
+const storageBookmarksStack = backend.createStack('storagebookmarks');
+const bookmarks = new Table(storageBookmarksStack, 'bookmarks', {
+  partitionKey: { name: 'userId', type: AttributeType.STRING },
+  billingMode: BillingMode.PROVISIONED,
+  readCapacity: 5,
+  writeCapacity: 5,
+  stream: StreamViewType.NEW_IMAGE,
+  sortKey: { name: 'postId', type: AttributeType.STRING },
+});
+// Add this property to the Table above post refactor: tableName: 'bookmarks-main'
+bookmarks.addGlobalSecondaryIndex({
+  indexName: 'byPost',
+  partitionKey: { name: 'postId', type: AttributeType.STRING },
+  readCapacity: 5,
+  writeCapacity: 5,
+});
 const cfnUserPool = backend.auth.resources.cfnResources.cfnUserPool;
 cfnUserPool.usernameAttributes = ['phone_number'];
 cfnUserPool.policies = {
@@ -125,3 +143,16 @@ for (const model of ['Topic', 'Post', 'Comment']) {
     backend.recorduseractivity.resources.lambda.role!
   );
 }
+const s3Bucket = backend.storage.resources.cfnResources.cfnBucket;
+// Use this bucket name post refactor
+// s3Bucket.bucketName = 'discus-avatarsc39a5-main';
+s3Bucket.bucketEncryption = {
+  serverSideEncryptionConfiguration: [
+    {
+      serverSideEncryptionByDefault: {
+        sseAlgorithm: 'AES256',
+      },
+      bucketKeyEnabled: false,
+    },
+  ],
+};

amplify-migration-apps/discussions/_snapshot.post.generate/amplify/data/resource.ts

@@ -41,9 +41,9 @@ export const data = defineData({
       //The "branchname" variable needs to be the same as your deployment branch if you want to reuse your Gen1 app tables
       branchName: 'main',
       modelNameToTableNameMapping: {
-        Topic: 'Topic-ruiylk7rjnb4ziygno3jh4wrsq-main',
-        Post: 'Post-ruiylk7rjnb4ziygno3jh4wrsq-main',
-        Comment: 'Comment-ruiylk7rjnb4ziygno3jh4wrsq-main',
+        Topic: 'Topic-u3jn2qbupzbyhc3h53673wdvim-main',
+        Post: 'Post-u3jn2qbupzbyhc3h53673wdvim-main',
+        Comment: 'Comment-u3jn2qbupzbyhc3h53673wdvim-main',
       },
     },
   ],

amplify-migration-apps/discussions/_snapshot.post.generate/amplify/storage/resource.ts

@@ -0,0 +1,16 @@
+import { defineStorage } from '@aws-amplify/backend';
+
+const branchName = process.env.AWS_BRANCH ?? 'sandbox';
+
+export const storage = defineStorage({
+  name: `discus-avatarsc39a5-${branchName}`,
+  access: (allow) => ({
+    'public/*': [allow.authenticated.to(['write', 'read', 'delete'])],
+    'protected/{entity_id}/*': [
+      allow.authenticated.to(['write', 'read', 'delete']),
+    ],
+    'private/{entity_id}/*': [
+      allow.authenticated.to(['write', 'read', 'delete']),
+    ],
+  }),
+});

amplify-migration-apps/discussions/_snapshot.post.refactor/refactor.__from__.amplify-discussions-gen2main-branch-96dfd1dc44-auth179371D7-DAPL7YOMHRB4.__to__.amplify-discussions-gen2main-branch-96dfd1dc44-auth179371D7-DAPL7YOMHRB4-holding.mappings.json

@@ -0,0 +1,52 @@
+[
+  {
+    "Source": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX",
+      "LogicalResourceId": "amplifyAuthUserPool4BA7F805"
+    },
+    "Destination": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX-holding",
+      "LogicalResourceId": "amplifyAuthUserPool4BA7F805"
+    }
+  },
+  {
+    "Source": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX",
+      "LogicalResourceId": "amplifyAuthUserPoolNativeAppClient79534448"
+    },
+    "Destination": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX-holding",
+      "LogicalResourceId": "amplifyAuthUserPoolNativeAppClient79534448"
+    }
+  },
+  {
+    "Source": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX",
+      "LogicalResourceId": "amplifyAuthUserPoolAppClient2626C6F8"
+    },
+    "Destination": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX-holding",
+      "LogicalResourceId": "amplifyAuthUserPoolAppClient2626C6F8"
+    }
+  },
+  {
+    "Source": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX",
+      "LogicalResourceId": "amplifyAuthIdentityPool3FDE84CC"
+    },
+    "Destination": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX-holding",
+      "LogicalResourceId": "amplifyAuthIdentityPool3FDE84CC"
+    }
+  },
+  {
+    "Source": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX",
+      "LogicalResourceId": "amplifyAuthIdentityPoolRoleAttachment045F17C8"
+    },
+    "Destination": {
+      "StackName": "amplify-discussions-gen2main-branch-a27e51c30a-auth179371D7-6NIMXK30VQKX-holding",
+      "LogicalResourceId": "amplifyAuthIdentityPoolRoleAttachment045F17C8"
+    }
+  }
+]