@aws-amplify/graphql-api-construct 1.6.0-secrets-manager.0 → 1.7.0-iam-auth.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-amplify/graphql-api-construct",
-  "version": "1.6.0-secrets-manager.0",
+  "version": "1.7.0-iam-auth.0",
   "description": "AppSync GraphQL Api Construct using Amplify GraphQL Transformer.",
   "repository": {
     "type": "git",
@@ -75,20 +75,20 @@
   "dependencies": {
     "@aws-amplify/backend-output-schemas": "^0.4.0",
     "@aws-amplify/backend-output-storage": "^0.2.2",
-    "@aws-amplify/graphql-auth-transformer": "3.3.6-secrets-manager.0",
-    "@aws-amplify/graphql-default-value-transformer": "2.2.5-secrets-manager.0",
-    "@aws-amplify/graphql-function-transformer": "2.1.17-secrets-manager.0",
-    "@aws-amplify/graphql-http-transformer": "2.1.17-secrets-manager.0",
-    "@aws-amplify/graphql-index-transformer": "2.3.5-secrets-manager.0",
-    "@aws-amplify/graphql-maps-to-transformer": "3.4.6-secrets-manager.0",
-    "@aws-amplify/graphql-model-transformer": "2.5.0-secrets-manager.0",
-    "@aws-amplify/graphql-predictions-transformer": "2.1.17-secrets-manager.0",
-    "@aws-amplify/graphql-relational-transformer": "2.3.6-secrets-manager.0",
-    "@aws-amplify/graphql-searchable-transformer": "2.5.2-secrets-manager.0",
-    "@aws-amplify/graphql-sql-transformer": "0.2.5-secrets-manager.0",
-    "@aws-amplify/graphql-transformer": "1.4.0-secrets-manager.0",
-    "@aws-amplify/graphql-transformer-core": "2.4.5-secrets-manager.0",
-    "@aws-amplify/graphql-transformer-interfaces": "3.4.0-secrets-manager.0",
+    "@aws-amplify/graphql-auth-transformer": "3.4.2-iam-auth.0",
+    "@aws-amplify/graphql-default-value-transformer": "2.3.2-iam-auth.0",
+    "@aws-amplify/graphql-function-transformer": "2.1.19-iam-auth.0",
+    "@aws-amplify/graphql-http-transformer": "2.1.19-iam-auth.0",
+    "@aws-amplify/graphql-index-transformer": "2.3.8-iam-auth.0",
+    "@aws-amplify/graphql-maps-to-transformer": "3.4.9-iam-auth.0",
+    "@aws-amplify/graphql-model-transformer": "2.6.1-iam-auth.0",
+    "@aws-amplify/graphql-predictions-transformer": "2.1.19-iam-auth.0",
+    "@aws-amplify/graphql-relational-transformer": "2.4.2-iam-auth.0",
+    "@aws-amplify/graphql-searchable-transformer": "2.6.2-iam-auth.0",
+    "@aws-amplify/graphql-sql-transformer": "0.2.8-iam-auth.0",
+    "@aws-amplify/graphql-transformer": "1.3.13-iam-auth.0",
+    "@aws-amplify/graphql-transformer-core": "2.5.1-iam-auth.0",
+    "@aws-amplify/graphql-transformer-interfaces": "3.4.1-iam-auth.0",
     "@aws-amplify/platform-core": "^0.2.0",
     "@aws-amplify/plugin-types": "^0.4.1",
     "charenc": "^0.0.2",
@@ -96,8 +96,8 @@
     "fs-extra": "^8.1.0",
     "graceful-fs": "^4.2.11",
     "graphql": "^15.5.0",
-    "graphql-mapping-template": "4.20.14",
-    "graphql-transformer-common": "4.27.1",
+    "graphql-mapping-template": "4.20.16-iam-auth.0",
+    "graphql-transformer-common": "4.28.2-iam-auth.0",
     "hjson": "^3.2.2",
     "immer": "^9.0.12",
     "is-buffer": "^2.0.5",
@@ -112,7 +112,7 @@
     "zod": "^3.22.3"
   },
   "devDependencies": {
-    "@aws-amplify/graphql-transformer-test-utils": "0.4.5-secrets-manager.0",
+    "@aws-amplify/graphql-transformer-test-utils": "0.4.7-iam-auth.0",
     "@types/fs-extra": "^8.0.1",
     "@types/node": "^12.12.6",
     "aws-cdk-lib": "2.80.0",
@@ -162,14 +162,20 @@
       "global": {
         "branches": 90,
         "functions": 90,
-        "lines": 90
+        "lines": 60
       }
     },
     "coverageReporters": [
       "clover",
       "text"
     ],
-    "testEnvironment": "../../FixJestEnvironment.js"
+    "testEnvironment": "../../FixJestEnvironment.js",
+    "collectCoverageFrom": [
+      "src/**/*.ts"
+    ],
+    "coveragePathIgnorePatterns": [
+      "/__tests__/"
+    ]
   },
-  "gitHead": "1b45d39e2064522f7bce51bd8bf5135742d4ce14"
+  "gitHead": "cb69f1ad3fae324674f3cc6db63495b4344c3fb5"
 }

package/src/amplify-dynamodb-table-wrapper.ts

@@ -1,4 +1,4 @@
-import { CfnResource } from 'aws-cdk-lib';
+import { CfnResource, RemovalPolicy } from 'aws-cdk-lib';
 import { BillingMode, StreamViewType } from 'aws-cdk-lib/aws-dynamodb';
 
 const AMPLIFY_DYNAMODB_TABLE_RESOURCE_TYPE = 'Custom::AmplifyDynamoDBTable';
@@ -110,6 +110,14 @@ export class AmplifyDynamoDbTableWrapper {
     }
   }
 
+  /**
+   * Set the deletion policy of the resource based on the removal policy specified.
+   * @param policy removal policy to set
+   */
+  applyRemovalPolicy(policy: RemovalPolicy): void {
+    this.resource.applyRemovalPolicy(policy);
+  }
+
   /**
    * Specify how you are charged for read and write throughput and how you manage capacity.
    */

package/src/amplify-graphql-api.ts

@@ -36,7 +36,7 @@ import type {
   FunctionSlot,
   IBackendOutputStorageStrategy,
   AddFunctionProps,
-  ConflictResolution,
+  DataStoreConfiguration,
   IAmplifyGraphqlDefinition,
 } from './types';
 import {
@@ -48,6 +48,7 @@ import {
   getGeneratedFunctionSlots,
   CodegenAssets,
   getAdditionalAuthenticationTypes,
+  validateAuthorizationModes,
 } from './internal';
 import { getStackForScope, walkAndProcessNodes } from './internal/construct-tree';
 import { getDataSourceStrategiesProvider } from './internal/data-source-config';
@@ -120,9 +121,9 @@ export class AmplifyGraphqlApi extends Construct {
   public readonly apiId: string;
 
   /**
-   * Conflict resolution setting
+   * DataStore conflict resolution setting
    */
-  private readonly conflictResolution: ConflictResolution | undefined;
+  private readonly dataStoreConfiguration: DataStoreConfiguration | undefined;
 
   /**
    * Be very careful editing this value. This is the string that is used to identify graphql stacks in BI metrics
@@ -152,14 +153,24 @@ export class AmplifyGraphqlApi extends Construct {
       translationBehavior,
       functionNameMap,
       outputStorageStrategy,
+      dataStoreConfiguration,
     } = props;
 
+    if (conflictResolution && dataStoreConfiguration) {
+      throw new Error(
+        `conflictResolution is deprecated. conflictResolution and dataStoreConfiguration cannot be used together. Please use dataStoreConfiguration.`,
+      );
+    }
+
+    this.dataStoreConfiguration = dataStoreConfiguration || conflictResolution;
+
     const dataSources = getMetadataDataSources(definition);
 
     new AttributionMetadataStorage().storeAttributionMetadata(Stack.of(scope), this.stackType, path.join(__dirname, '..', 'package.json'), {
       dataSources,
     });
 
+    validateAuthorizationModes(authorizationModes);
     const { authConfig, authSynthParameters } = convertAuthorizationModesToTransformerAuthConfig(authorizationModes);
 
     validateFunctionSlots(functionSlots ?? []);
@@ -201,7 +212,7 @@ export class AmplifyGraphqlApi extends Construct {
       },
       authConfig,
       stackMapping: stackMappings ?? {},
-      resolverConfig: conflictResolution ? convertToResolverConfig(conflictResolution) : undefined,
+      resolverConfig: this.dataStoreConfiguration ? convertToResolverConfig(this.dataStoreConfiguration) : undefined,
       transformParameters: {
         ...defaultTranslationBehavior,
         ...(translationBehavior ?? {}),
@@ -217,7 +228,6 @@ export class AmplifyGraphqlApi extends Construct {
     this.codegenAssets = new CodegenAssets(this, 'AmplifyCodegenAssets', { modelSchema: definition.schema });
 
     this.resources = getGeneratedResources(this);
-    this.conflictResolution = conflictResolution;
     this.generatedFunctionSlots = getGeneratedFunctionSlots(assetManager.resolverAssets);
     this.storeOutput(outputStorageStrategy);
 
@@ -255,8 +265,8 @@ export class AmplifyGraphqlApi extends Construct {
       output.payload.awsAppsyncAdditionalAuthenticationTypes = additionalAuthTypes;
     }
 
-    if (this.conflictResolution?.project?.handlerType) {
-      output.payload.awsAppsyncConflictResolutionMode = this.conflictResolution?.project?.handlerType;
+    if (this.dataStoreConfiguration?.project?.handlerType) {
+      output.payload.awsAppsyncConflictResolutionMode = this.dataStoreConfiguration?.project?.handlerType;
     }
 
     outputStorageStrategy.addBackendOutputEntry(graphqlOutputKey, output);

package/src/index.ts

@@ -4,6 +4,7 @@
  */
 export type {
   IAMAuthorizationConfig,
+  IdentityPoolAuthorizationConfig,
   UserPoolAuthorizationConfig,
   OIDCAuthorizationConfig,
   ApiKeyAuthorizationConfig,
@@ -20,6 +21,7 @@ export type {
   FunctionSlot,
   FunctionSlotOverride,
   ConflictResolution,
+  DataStoreConfiguration,
   ConflictDetectionType,
   OptimisticConflictResolutionStrategy,
   CustomConflictResolutionStrategy,

package/src/internal/authorization-modes.ts

@@ -5,19 +5,51 @@ import { IRole, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import {
   AuthorizationModes,
   ApiKeyAuthorizationConfig,
-  IAMAuthorizationConfig,
   LambdaAuthorizationConfig,
   OIDCAuthorizationConfig,
   UserPoolAuthorizationConfig,
 } from '../types';
 
 type AuthorizationConfigMode =
-  | (IAMAuthorizationConfig & { type: 'AWS_IAM' })
+  | { type: 'AWS_IAM' }
   | (UserPoolAuthorizationConfig & { type: 'AMAZON_COGNITO_USER_POOLS' })
   | (OIDCAuthorizationConfig & { type: 'OPENID_CONNECT' })
   | (ApiKeyAuthorizationConfig & { type: 'API_KEY' })
   | (LambdaAuthorizationConfig & { type: 'AWS_LAMBDA' });
 
+export const validateAuthorizationModes = (authorizationModes: AuthorizationModes) => {
+  const hasDeprecatedIdentityPoolSettings =
+    authorizationModes.iamConfig?.authenticatedUserRole ||
+    authorizationModes.iamConfig?.unauthenticatedUserRole ||
+    authorizationModes.iamConfig?.identityPoolId;
+  const hasAllDeprecatedIdentityPoolSettings =
+    authorizationModes.iamConfig?.authenticatedUserRole &&
+    authorizationModes.iamConfig?.unauthenticatedUserRole &&
+    authorizationModes.iamConfig?.identityPoolId;
+  const hasDeprecatedSettings =
+    authorizationModes.iamConfig?.authenticatedUserRole ||
+    authorizationModes.iamConfig?.unauthenticatedUserRole ||
+    authorizationModes.iamConfig?.identityPoolId ||
+    authorizationModes.iamConfig?.allowListedRoles ||
+    authorizationModes.adminRoles;
+  const hasUnDeprecatedSettings =
+    typeof authorizationModes.iamConfig?.enableIamAuthorizationMode !== 'undefined' || authorizationModes.identityPoolConfig;
+
+  if (hasDeprecatedSettings && hasUnDeprecatedSettings) {
+    throw new Error(
+      "Cannot use deprecated 'authorizationModes.iamConfig' options with 'authorizationModes.identityPoolConfig'" +
+        " or 'authorizationModes.iamConfig.enableIamAuthorizationMode'",
+    );
+  }
+
+  if (hasDeprecatedIdentityPoolSettings && !hasAllDeprecatedIdentityPoolSettings) {
+    throw new Error(
+      "'authorizationModes.iamConfig.authenticatedUserRole', 'authorizationModes.iamConfig.unauthenticatedUserRole' and" +
+        " 'authorizationModes.iamConfig.identityPoolId' must be provided.",
+    );
+  }
+};
+
 /**
  * Converts a single auth mode config into the amplify-internal representation.
  * @param authMode the auth mode to convert into the Appsync CDK representation.
@@ -79,7 +111,7 @@ const convertAuthConfigToAppSyncAuth = (authModes: AuthorizationModes): AppSyncA
     authModes.lambdaConfig ? { type: 'AWS_LAMBDA', ...authModes.lambdaConfig } : null,
     authModes.oidcConfig ? { type: 'OPENID_CONNECT', ...authModes.oidcConfig } : null,
     authModes.userPoolConfig ? { type: 'AMAZON_COGNITO_USER_POOLS', ...authModes.userPoolConfig } : null,
-    authModes.iamConfig ? { type: 'AWS_IAM', ...authModes.iamConfig } : null,
+    authModes.iamConfig || authModes.identityPoolConfig ? { type: 'AWS_IAM' } : null,
   ].filter((mode) => mode) as AuthorizationConfigMode[];
   const authProviders = authConfig.map(convertAuthModeToAuthProvider);
 
@@ -116,7 +148,7 @@ const convertAuthConfigToAppSyncAuth = (authModes: AuthorizationModes): AppSyncA
 
 type AuthSynthParameters = Pick<
   SynthParameters,
-  'userPoolId' | 'authenticatedUserRoleName' | 'unauthenticatedUserRoleName' | 'identityPoolId' | 'adminRoles'
+  'userPoolId' | 'authenticatedUserRoleName' | 'unauthenticatedUserRoleName' | 'identityPoolId' | 'adminRoles' | 'enableIamAccess'
 >;
 
 interface AuthConfig {
@@ -177,12 +209,19 @@ const getAllowListedRoles = (authModes: AuthorizationModes): string[] =>
  */
 const getSynthParameters = (authModes: AuthorizationModes): AuthSynthParameters => ({
   adminRoles: getAllowListedRoles(authModes),
-  identityPoolId: authModes.iamConfig?.identityPoolId,
+  identityPoolId: authModes.identityPoolConfig?.identityPoolId ?? authModes.iamConfig?.identityPoolId,
+  enableIamAccess: authModes.iamConfig?.enableIamAuthorizationMode,
   ...(authModes.userPoolConfig ? { userPoolId: authModes.userPoolConfig.userPool.userPoolId } : {}),
-  ...(authModes?.iamConfig
+  ...(authModes?.identityPoolConfig
+    ? {
+        authenticatedUserRoleName: authModes.identityPoolConfig.authenticatedUserRole.roleName,
+        unauthenticatedUserRoleName: authModes.identityPoolConfig.unauthenticatedUserRole.roleName,
+      }
+    : {}),
+  ...(authModes?.iamConfig && authModes?.iamConfig.authenticatedUserRole && authModes?.iamConfig.unauthenticatedUserRole
     ? {
-        authenticatedUserRoleName: authModes.iamConfig.authenticatedUserRole.roleName,
-        unauthenticatedUserRoleName: authModes.iamConfig.unauthenticatedUserRole.roleName,
+        authenticatedUserRoleName: authModes.iamConfig.authenticatedUserRole?.roleName,
+        unauthenticatedUserRoleName: authModes.iamConfig.unauthenticatedUserRole?.roleName,
       }
     : {}),
 });

package/src/internal/construct-exports.ts

@@ -8,7 +8,7 @@ import {
   CfnDataSource,
   GraphqlApi,
 } from 'aws-cdk-lib/aws-appsync';
-import { CfnTable, Table } from 'aws-cdk-lib/aws-dynamodb';
+import { CfnTable, Table, ITable } from 'aws-cdk-lib/aws-dynamodb';
 import { CfnRole, Role } from 'aws-cdk-lib/aws-iam';
 import { CfnResource, NestedStack } from 'aws-cdk-lib';
 import { getResourceName } from '@aws-amplify/graphql-transformer-core';
@@ -17,6 +17,16 @@ import { AmplifyGraphqlApiResources, FunctionSlot } from '../types';
 import { AmplifyDynamoDbTableWrapper } from '../amplify-dynamodb-table-wrapper';
 import { walkAndProcessNodes } from './construct-tree';
 
+/**
+ * Check if a resource is implementing table interface
+ * The required properties need to be present in the input
+ * https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.ITable.html#properties
+ * @param table table resource
+ * @returns whether the resource is a ITable or not
+ */
+function isITable(table: any): table is ITable {
+  return 'env' in table && 'node' in table && 'stack' in table && 'tableArn' in table && 'tableName' in table;
+}
 /**
  * Everything below here is intended to help us gather the
  * output values and render out the L1 resources for access.
@@ -33,7 +43,7 @@ export const getGeneratedResources = (scope: Construct): AmplifyGraphqlApiResour
   const cfnResolvers: Record<string, CfnResolver> = {};
   const cfnFunctionConfigurations: Record<string, CfnFunctionConfiguration> = {};
   const cfnDataSources: Record<string, CfnDataSource> = {};
-  const tables: Record<string, Table> = {};
+  const tables: Record<string, ITable> = {};
   const cfnTables: Record<string, CfnTable> = {};
   const amplifyDynamoDbTables: Record<string, AmplifyDynamoDbTableWrapper> = {};
   const roles: Record<string, Role> = {};
@@ -72,7 +82,7 @@ export const getGeneratedResources = (scope: Construct): AmplifyGraphqlApiResour
       cfnFunctionConfigurations[resourceName] = currentScope;
       return;
     }
-    if (currentScope instanceof Table) {
+    if (currentScope instanceof Table || isITable(currentScope)) {
       tables[resourceName] = currentScope;
       return;
     }
@@ -123,7 +133,6 @@ export const getGeneratedResources = (scope: Construct): AmplifyGraphqlApiResour
   return {
     graphqlApi: GraphqlApi.fromGraphqlApiAttributes(scope, 'L2GraphqlApi', { graphqlApiId: cfnGraphqlApi.attrApiId }),
     tables,
-    amplifyDynamoDbTables,
     roles,
     functions,
     nestedStacks,
@@ -135,6 +144,7 @@ export const getGeneratedResources = (scope: Construct): AmplifyGraphqlApiResour
       cfnFunctionConfigurations,
       cfnDataSources,
       cfnTables,
+      amplifyDynamoDbTables,
       cfnRoles,
       cfnFunctions,
       additionalCfnResources,

package/src/internal/data-source-config.ts

@@ -6,12 +6,7 @@ import {
   isMutationNode,
   fieldsWithSqlDirective,
 } from '@aws-amplify/graphql-transformer-core';
-import {
-  DataSourceStrategiesProvider,
-  isSqlModelDataSourceSsmDbConnectionConfig,
-  isSqlModelDataSourceSecretsManagerDbConnectionConfig,
-} from '@aws-amplify/graphql-transformer-interfaces';
-import { Token, Arn, ArnFormat } from 'aws-cdk-lib';
+import { DataSourceStrategiesProvider } from '@aws-amplify/graphql-transformer-interfaces';
 import {
   CustomSqlDataSourceStrategy as ConstructCustomSqlDataSourceStrategy,
   ModelDataSourceStrategy as ConstructModelDataSourceStrategy,
@@ -189,47 +184,19 @@ export const schemaByMergingDefinitions = (definitions: IAmplifyGraphqlDefinitio
  * @param strategy user provided model data source strategy
  * @returns validates and throws an error if the strategy is invalid
  */
-export const validateDataSourceStrategy = (strategy: ConstructModelDataSourceStrategy): void => {
+export const validateDataSourceStrategy = (strategy: ConstructModelDataSourceStrategy) => {
   if (!isSqlStrategy(strategy)) {
     return;
   }
 
   const dbConnectionConfig = strategy.dbConnectionConfig;
-  if (isSqlModelDataSourceSsmDbConnectionConfig(dbConnectionConfig)) {
-    const invalidSSMPaths = Object.values(dbConnectionConfig).filter((value) => typeof value === 'string' && !isValidSSMPath(value));
-    if (invalidSSMPaths.length > 0) {
-      throw new Error(
-        `Invalid data source strategy "${
-          strategy.name
-        }". Following SSM paths must start with '/' in dbConnectionConfig: ${invalidSSMPaths.join(', ')}.`,
-      );
-    }
-  } else if (isSqlModelDataSourceSecretsManagerDbConnectionConfig(dbConnectionConfig)) {
-    if (!Token.isUnresolved(dbConnectionConfig.secretArn)) {
-      try {
-        const arnComponents = Arn.split(dbConnectionConfig.secretArn, ArnFormat.COLON_RESOURCE_NAME);
-        if (arnComponents.service !== 'secretsmanager' || arnComponents.resource !== 'secret') {
-          // error message does not matter because it inside try/catch
-          throw new Error();
-        }
-      } catch {
-        throw new Error(`Invalid data source strategy "${strategy.name}". The value of secretArn is not a valid Secrets Manager ARN.`);
-      }
-    }
-
-    if (dbConnectionConfig.keyArn && !Token.isUnresolved(dbConnectionConfig.keyArn)) {
-      try {
-        const arnComponents = Arn.split(dbConnectionConfig.keyArn, ArnFormat.SLASH_RESOURCE_NAME);
-        if (arnComponents.service !== 'kms' || arnComponents.resource !== 'key') {
-          // error message does not matter because it inside try/catch
-          throw new Error();
-        }
-      } catch {
-        throw new Error(`Invalid data source strategy "${strategy.name}". The value of keyArn is not a valid KMS ARN.`);
-      }
-    }
-  } else {
-    throw new Error(`Invalid data source strategy "${strategy.name}". dbConnectionConfig does not include SSM paths or Secret ARN.`);
+  const invalidSSMPaths = Object.values(dbConnectionConfig).filter((value) => typeof value === 'string' && !isValidSSMPath(value));
+  if (invalidSSMPaths.length > 0) {
+    throw new Error(
+      `Invalid data source strategy "${
+        strategy.name
+      }". Following SSM paths must start with '/' in dbConnectionConfig: ${invalidSSMPaths.join(', ')}.`,
+    );
   }
 };
 

package/src/model-datasource-strategy-types.ts

@@ -116,44 +116,12 @@ export interface SubnetAvailabilityZone {
   readonly availabilityZone: string;
 }
 
-/**
- * The credentials the lambda data source will use to connect to the database.
- *
- * @experimental
- */
-export type SqlModelDataSourceDbConnectionConfig =
-  | SqlModelDataSourceSecretsManagerDbConnectionConfig
-  | SqlModelDataSourceSsmDbConnectionConfig;
-
-/**
- * The credentials stored in Secrets Manager that the lambda data source will use to connect to the database.
- *
- * The managed secret should be in the same region as the lambda.
- * @experimental
- */
-export interface SqlModelDataSourceSecretsManagerDbConnectionConfig {
-  /** The ARN of the managed secret with username, password, and hostname to use when connecting to the database. **/
-  readonly secretArn: string;
-
-  /** The ARN of the customer managed encryption key for the secret. If not supplied, the secret is expected to be encrypted with the default AWS-managed key. **/
-  readonly keyArn?: string;
-
-  /** The port number of the database proxy, cluster, or instance. */
-  readonly port: number;
-
-  /** The database name. */
-  readonly databaseName: string;
-
-  /** The hostame of the database. */
-  readonly hostname: string;
-}
-
 /**
  * The Secure Systems Manager parameter paths the Lambda data source will use to connect to the database.
  *
  * These parameters are retrieved from Secure Systems Manager in the same region as the Lambda.
  */
-export interface SqlModelDataSourceSsmDbConnectionConfig {
+export interface SqlModelDataSourceDbConnectionConfig {
   /** The Secure Systems Manager parameter containing the hostname of the database. For RDS-based SQL data sources, this can be the hostname
    * of a database proxy, cluster, or instance.
    */

package/src/sql-model-datasource-strategy.ts

@@ -1,12 +1,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { isSqlDbType } from '@aws-amplify/graphql-transformer-core';
-import {
-  SQLLambdaModelDataSourceStrategy,
-  SqlModelDataSourceDbConnectionConfig,
-  SqlModelDataSourceSsmDbConnectionConfig,
-  SqlModelDataSourceSecretsManagerDbConnectionConfig,
-} from './model-datasource-strategy-types';
+import { SQLLambdaModelDataSourceStrategy, SqlModelDataSourceDbConnectionConfig } from './model-datasource-strategy-types';
 
 /**
  * Type predicate that returns true if the object is a SQLLambdaModelDataSourceStrategy.
@@ -29,15 +24,6 @@ export const isSQLLambdaModelDataSourceStrategy = (obj: any): obj is SQLLambdaMo
  * @returns true if the object is shaped like a SqlModelDataSourceDbConnectionConfig
  */
 export const isSqlModelDataSourceDbConnectionConfig = (obj: any): obj is SqlModelDataSourceDbConnectionConfig => {
-  return isSqlModelDataSourceSsmDbConnectionConfig(obj) || isSqlModelDataSourceSecretsManagerDbConnectionConfig(obj);
-};
-
-/**
- * Type predicate that returns true if the object is a SqlModelDataSourceSsmDbConnectionConfig.
- * @param obj the object to inspect
- * @returns true if the object is shaped like a SqlModelDataSourceSsmDbConnectionConfig
- */
-export const isSqlModelDataSourceSsmDbConnectionConfig = (obj: any): obj is SqlModelDataSourceSsmDbConnectionConfig => {
   return (
     (typeof obj === 'object' || typeof obj === 'function') &&
     typeof obj.hostnameSsmPath === 'string' &&
@@ -48,23 +34,6 @@ export const isSqlModelDataSourceSsmDbConnectionConfig = (obj: any): obj is SqlM
   );
 };
 
-/**
- * Type predicate that returns true if the object is a SqlModelDataSourceSecretsManagerDbConnectionConfig.
- * @param obj the object to inspect
- * @returns true if the object is shaped like a SqlModelDataSourceSecretsManagerDbConnectionConfig
- */
-export const isSqlModelDataSourceSecretsManagerDbConnectionConfig = (
-  obj: any,
-): obj is SqlModelDataSourceSecretsManagerDbConnectionConfig => {
-  return (
-    (typeof obj === 'object' || typeof obj === 'function') &&
-    typeof obj.secretArn === 'string' &&
-    typeof obj.port === 'number' &&
-    typeof obj.databaseName === 'string' &&
-    typeof obj.hostname == 'string'
-  );
-};
-
 /**
  * Class exposing utilities to produce SQLLambdaModelDataSourceStrategy objects given various inputs.
  */