@aws-amplify/graphql-api-construct 1.7.0-iam-auth-with-identityPool-provider-1.0 → 1.7.1-gen2-release.0

package/node_modules/graphql-mapping-template/CHANGELOG.md

@@ -3,10 +3,6 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
-## [4.20.16-iam-auth-with-identityPool-provider-1.0](https://github.com/aws-amplify/amplify-category-api/compare/graphql-mapping-template@4.20.15...graphql-mapping-template@4.20.16-iam-auth-with-identityPool-provider-1.0) (2024-03-15)
-
-**Note:** Version bump only for package graphql-mapping-template
-
 ## [4.20.15](https://github.com/aws-amplify/amplify-category-api/compare/graphql-mapping-template@4.20.14...graphql-mapping-template@4.20.15) (2024-02-28)
 
 **Note:** Version bump only for package graphql-mapping-template

package/node_modules/graphql-mapping-template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-mapping-template",
-  "version": "4.20.16-iam-auth-with-identityPool-provider-1.0",
+  "version": "4.20.15",
   "description": "An AST wrapper around AWS AppSync resolvers",
   "repository": {
     "type": "git",
@@ -57,6 +57,5 @@
     "coveragePathIgnorePatterns": [
       "/__tests__/"
     ]
-  },
-  "gitHead": "dafa4bb5ea5cec5dc90b722bf138064897f4f24a"
+  }
 }

package/node_modules/graphql-transformer-common/API.md

@@ -503,6 +503,8 @@ export const transformedArgsRef: ReferenceNode;
 // @public (undocumented)
 export const TYPESCRIPT_DATA_SCHEMA_CONSTANTS: {
     SCHEMA_PACKAGE: string;
+    SCHEMA_PACKAGE_INTERNALS: string;
+    BACKEND_PACKAGE: string;
     MODEL_METHOD: string;
     SCHEMA_METHOD: string;
     IDENTIFIER_METHOD: string;
@@ -512,6 +514,17 @@ export const TYPESCRIPT_DATA_SCHEMA_CONSTANTS: {
     ENUM_METHOD: string;
     REFERENCE_A: string;
     EXPORT_VARIABLE_NAME: string;
+    INTERNALS_CONFIGURE_METHOD: string;
+    BACKEND_SECRET_METHOD: string;
+    PROPERTY_VPC: string;
+    PROPERTY_VPC_ID: string;
+    PROPERTY_SECURITY_GROUP_IDS: string;
+    PROPERTY_AZ_CONFIG: string;
+    PROPERTY_SUBNET_ID: string;
+    PROPERTY_AZ: string;
+    PROPERTY_DATABASE: string;
+    PROPERTY_CONNECTION_URI: string;
+    PROPERTY_ENGINE: string;
 };
 
 // @public (undocumented)

package/node_modules/graphql-transformer-common/CHANGELOG.md

@@ -3,10 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
-## [4.28.2-iam-auth-with-identityPool-provider-1.0](https://github.com/aws-amplify/amplify-category-api/compare/graphql-transformer-common@4.28.1...graphql-transformer-common@4.28.2-iam-auth-with-identityPool-provider-1.0) (2024-03-15)
+## [4.29.1-gen2-release.0](https://github.com/aws-amplify/amplify-category-api/compare/graphql-transformer-common@4.29.0...graphql-transformer-common@4.29.1-gen2-release.0) (2024-03-29)
 
 **Note:** Version bump only for package graphql-transformer-common
 
+# [4.29.0](https://github.com/aws-amplify/amplify-category-api/compare/graphql-transformer-common@4.28.1...graphql-transformer-common@4.29.0) (2024-03-28)
+
+### Features
+
+- **api:** auto detect vpc configuration on generate typescript database schema ([#2376](https://github.com/aws-amplify/amplify-category-api/issues/2376)) ([ef6f53c](https://github.com/aws-amplify/amplify-category-api/commit/ef6f53c04bbcc50921bf20a937d1332d4597a3fa))
+
 ## [4.28.1](https://github.com/aws-amplify/amplify-category-api/compare/graphql-transformer-common@4.28.0...graphql-transformer-common@4.28.1) (2024-02-28)
 
 **Note:** Version bump only for package graphql-transformer-common

package/node_modules/graphql-transformer-common/lib/TypescriptSchemaConstants.d.ts

@@ -1,5 +1,7 @@
 export declare const TYPESCRIPT_DATA_SCHEMA_CONSTANTS: {
     SCHEMA_PACKAGE: string;
+    SCHEMA_PACKAGE_INTERNALS: string;
+    BACKEND_PACKAGE: string;
     MODEL_METHOD: string;
     SCHEMA_METHOD: string;
     IDENTIFIER_METHOD: string;
@@ -9,5 +11,16 @@ export declare const TYPESCRIPT_DATA_SCHEMA_CONSTANTS: {
     ENUM_METHOD: string;
     REFERENCE_A: string;
     EXPORT_VARIABLE_NAME: string;
+    INTERNALS_CONFIGURE_METHOD: string;
+    BACKEND_SECRET_METHOD: string;
+    PROPERTY_VPC: string;
+    PROPERTY_VPC_ID: string;
+    PROPERTY_SECURITY_GROUP_IDS: string;
+    PROPERTY_AZ_CONFIG: string;
+    PROPERTY_SUBNET_ID: string;
+    PROPERTY_AZ: string;
+    PROPERTY_DATABASE: string;
+    PROPERTY_CONNECTION_URI: string;
+    PROPERTY_ENGINE: string;
 };
 //# sourceMappingURL=TypescriptSchemaConstants.d.ts.map

package/node_modules/graphql-transformer-common/lib/TypescriptSchemaConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TypescriptSchemaConstants.d.ts","sourceRoot":"","sources":["../src/TypescriptSchemaConstants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC;;;;;;;;;;;CAW5C,CAAC"}
+{"version":3,"file":"TypescriptSchemaConstants.d.ts","sourceRoot":"","sources":["../src/TypescriptSchemaConstants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAC"}

package/node_modules/graphql-transformer-common/lib/TypescriptSchemaConstants.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TYPESCRIPT_DATA_SCHEMA_CONSTANTS = void 0;
 exports.TYPESCRIPT_DATA_SCHEMA_CONSTANTS = {
     SCHEMA_PACKAGE: '@aws-amplify/data-schema',
+    SCHEMA_PACKAGE_INTERNALS: '@aws-amplify/data-schema/internals',
+    BACKEND_PACKAGE: '@aws-amplify/backend',
     MODEL_METHOD: 'model',
     SCHEMA_METHOD: 'schema',
     IDENTIFIER_METHOD: 'identifier',
@@ -12,5 +14,16 @@ exports.TYPESCRIPT_DATA_SCHEMA_CONSTANTS = {
     ENUM_METHOD: 'enum',
     REFERENCE_A: 'a',
     EXPORT_VARIABLE_NAME: 'schema',
+    INTERNALS_CONFIGURE_METHOD: 'configure',
+    BACKEND_SECRET_METHOD: 'secret',
+    PROPERTY_VPC: 'vpcConfig',
+    PROPERTY_VPC_ID: 'vpcId',
+    PROPERTY_SECURITY_GROUP_IDS: 'securityGroupIds',
+    PROPERTY_AZ_CONFIG: 'subnetAvailabilityZones',
+    PROPERTY_SUBNET_ID: 'subnetId',
+    PROPERTY_AZ: 'availabilityZone',
+    PROPERTY_DATABASE: 'database',
+    PROPERTY_CONNECTION_URI: 'connectionUri',
+    PROPERTY_ENGINE: 'engine',
 };
 //# sourceMappingURL=TypescriptSchemaConstants.js.map

package/node_modules/graphql-transformer-common/lib/TypescriptSchemaConstants.js.map

@@ -1 +1 @@
-{"version":3,"file":"TypescriptSchemaConstants.js","sourceRoot":"","sources":["../src/TypescriptSchemaConstants.ts"],"names":[],"mappings":";;;AAAa,QAAA,gCAAgC,GAAG;IAC9C,cAAc,EAAE,0BAA0B;IAC1C,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,QAAQ;IACvB,iBAAiB,EAAE,YAAY;IAC/B,YAAY,EAAE,OAAO;IACrB,eAAe,EAAE,UAAU;IAC3B,aAAa,EAAE,QAAQ;IACvB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,GAAG;IAChB,oBAAoB,EAAE,QAAQ;CAC/B,CAAC"}
+{"version":3,"file":"TypescriptSchemaConstants.js","sourceRoot":"","sources":["../src/TypescriptSchemaConstants.ts"],"names":[],"mappings":";;;AAAa,QAAA,gCAAgC,GAAG;IAC9C,cAAc,EAAE,0BAA0B;IAC1C,wBAAwB,EAAE,oCAAoC;IAC9D,eAAe,EAAE,sBAAsB;IACvC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,QAAQ;IACvB,iBAAiB,EAAE,YAAY;IAC/B,YAAY,EAAE,OAAO;IACrB,eAAe,EAAE,UAAU;IAC3B,aAAa,EAAE,QAAQ;IACvB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,GAAG;IAChB,oBAAoB,EAAE,QAAQ;IAC9B,0BAA0B,EAAE,WAAW;IACvC,qBAAqB,EAAE,QAAQ;IAC/B,YAAY,EAAE,WAAW;IACzB,eAAe,EAAE,OAAO;IACxB,2BAA2B,EAAE,kBAAkB;IAC/C,kBAAkB,EAAE,yBAAyB;IAC7C,kBAAkB,EAAE,UAAU;IAC9B,WAAW,EAAE,kBAAkB;IAC/B,iBAAiB,EAAE,UAAU;IAC7B,uBAAuB,EAAE,eAAe;IACxC,eAAe,EAAE,QAAQ;CAC1B,CAAC"}

package/node_modules/graphql-transformer-common/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-transformer-common",
-  "version": "4.28.2-iam-auth-with-identityPool-provider-1.0",
+  "version": "4.29.1-gen2-release.0",
   "description": "Common code and constants for AppSync Transformers",
   "repository": {
     "type": "git",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "graphql": "^15.5.0",
-    "graphql-mapping-template": "4.20.16-iam-auth-with-identityPool-provider-1.0",
+    "graphql-mapping-template": "4.20.15",
     "md5": "^2.2.1",
     "pluralize": "8.0.0"
   },
@@ -66,5 +66,5 @@
       "/__tests__/"
     ]
   },
-  "gitHead": "dafa4bb5ea5cec5dc90b722bf138064897f4f24a"
+  "gitHead": "a550843921e81b923214a9038b0725ac5e6b2b67"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-amplify/graphql-api-construct",
-  "version": "1.7.0-iam-auth-with-identityPool-provider-1.0",
+  "version": "1.7.1-gen2-release.0",
   "description": "AppSync GraphQL Api Construct using Amplify GraphQL Transformer.",
   "repository": {
     "type": "git",
@@ -38,6 +38,7 @@
     "@aws-amplify/backend-output-storage",
     "@aws-amplify/graphql-auth-transformer",
     "@aws-amplify/graphql-default-value-transformer",
+    "@aws-amplify/graphql-directives",
     "@aws-amplify/graphql-function-transformer",
     "@aws-amplify/graphql-http-transformer",
     "@aws-amplify/graphql-index-transformer",
@@ -75,20 +76,21 @@
   "dependencies": {
     "@aws-amplify/backend-output-schemas": "^0.4.0",
     "@aws-amplify/backend-output-storage": "^0.2.2",
-    "@aws-amplify/graphql-auth-transformer": "3.5.0-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-default-value-transformer": "2.3.2-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-function-transformer": "2.1.19-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-http-transformer": "2.1.19-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-index-transformer": "2.3.8-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-maps-to-transformer": "3.4.9-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-model-transformer": "2.6.1-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-predictions-transformer": "2.1.19-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-relational-transformer": "2.4.2-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-searchable-transformer": "2.6.2-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-sql-transformer": "0.2.8-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-transformer": "1.3.13-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-transformer-core": "2.5.1-iam-auth-with-identityPool-provider-1.0",
-    "@aws-amplify/graphql-transformer-interfaces": "3.4.1-iam-auth-with-identityPool-provider-1.0",
+    "@aws-amplify/graphql-auth-transformer": "3.4.3-gen2-release.0",
+    "@aws-amplify/graphql-default-value-transformer": "2.3.3-gen2-release.0",
+    "@aws-amplify/graphql-directives": "1.1.0-gen2-release.0",
+    "@aws-amplify/graphql-function-transformer": "2.1.20-gen2-release.0",
+    "@aws-amplify/graphql-http-transformer": "2.1.20-gen2-release.0",
+    "@aws-amplify/graphql-index-transformer": "2.3.9-gen2-release.0",
+    "@aws-amplify/graphql-maps-to-transformer": "3.4.10-gen2-release.0",
+    "@aws-amplify/graphql-model-transformer": "2.7.1-gen2-release.0",
+    "@aws-amplify/graphql-predictions-transformer": "2.1.20-gen2-release.0",
+    "@aws-amplify/graphql-relational-transformer": "2.5.0-gen2-release.0",
+    "@aws-amplify/graphql-searchable-transformer": "2.6.3-gen2-release.0",
+    "@aws-amplify/graphql-sql-transformer": "0.2.9-gen2-release.0",
+    "@aws-amplify/graphql-transformer": "1.4.1-gen2-release.0",
+    "@aws-amplify/graphql-transformer-core": "2.5.2-gen2-release.0",
+    "@aws-amplify/graphql-transformer-interfaces": "3.5.1-gen2-release.0",
     "@aws-amplify/platform-core": "^0.2.0",
     "@aws-amplify/plugin-types": "^0.4.1",
     "charenc": "^0.0.2",
@@ -96,8 +98,8 @@
     "fs-extra": "^8.1.0",
     "graceful-fs": "^4.2.11",
     "graphql": "^15.5.0",
-    "graphql-mapping-template": "4.20.16-iam-auth-with-identityPool-provider-1.0",
-    "graphql-transformer-common": "4.28.2-iam-auth-with-identityPool-provider-1.0",
+    "graphql-mapping-template": "4.20.15",
+    "graphql-transformer-common": "4.29.1-gen2-release.0",
     "hjson": "^3.2.2",
     "immer": "^9.0.12",
     "is-buffer": "^2.0.5",
@@ -112,7 +114,7 @@
     "zod": "^3.22.3"
   },
   "devDependencies": {
-    "@aws-amplify/graphql-transformer-test-utils": "0.4.7-iam-auth-with-identityPool-provider-1.0",
+    "@aws-amplify/graphql-transformer-test-utils": "0.4.8-gen2-release.0",
     "@types/fs-extra": "^8.0.1",
     "@types/node": "^12.12.6",
     "aws-cdk-lib": "2.80.0",
@@ -177,5 +179,5 @@
       "/__tests__/"
     ]
   },
-  "gitHead": "dafa4bb5ea5cec5dc90b722bf138064897f4f24a"
+  "gitHead": "a550843921e81b923214a9038b0725ac5e6b2b67"
 }

package/src/internal/authorization-modes.ts

@@ -17,8 +17,18 @@ type AuthorizationConfigMode =
   | (ApiKeyAuthorizationConfig & { type: 'API_KEY' })
   | (LambdaAuthorizationConfig & { type: 'AWS_LAMBDA' });
 
-export const validateAuthorizationModes = (authorizationModes: AuthorizationModes) => {
-  const hasDeprecatedIdentityPoolSettings =
+/**
+ * Validates authorization modes.
+ *
+ * Rules:
+ * 1. Validates that deprecated settings ('iamConfig.authenticatedUserRole', 'iamConfig.unauthenticatedUserRole',
+ *    'iamConfig.identityPoolId', 'iamConfig.allowListedRoles' and 'adminRoles') are mutually exclusive with new settings that
+ *    replaced them ('iamConfig.enableIamAuthorizationMode' and any of 'authorizationModes.identityPoolConfig')
+ * 2. If deprecated identity pool settings are used ('iamConfig.authenticatedUserRole', 'iamConfig.unauthenticatedUserRole',
+ *    and 'iamConfig.identityPoolId') validate that all are provided.
+ */
+export const validateAuthorizationModes = (authorizationModes: AuthorizationModes): void => {
+  const hasAnyDeprecatedIdentityPoolSetting =
     authorizationModes.iamConfig?.authenticatedUserRole ||
     authorizationModes.iamConfig?.unauthenticatedUserRole ||
     authorizationModes.iamConfig?.identityPoolId;
@@ -26,23 +36,23 @@ export const validateAuthorizationModes = (authorizationModes: AuthorizationMode
     authorizationModes.iamConfig?.authenticatedUserRole &&
     authorizationModes.iamConfig?.unauthenticatedUserRole &&
     authorizationModes.iamConfig?.identityPoolId;
-  const hasDeprecatedSettings =
+  const hasDeprecatedIamSettings =
     authorizationModes.iamConfig?.authenticatedUserRole ||
     authorizationModes.iamConfig?.unauthenticatedUserRole ||
     authorizationModes.iamConfig?.identityPoolId ||
     authorizationModes.iamConfig?.allowListedRoles ||
     authorizationModes.adminRoles;
-  const hasUnDeprecatedSettings =
+  const hasUnDeprecatedIamSettings =
     typeof authorizationModes.iamConfig?.enableIamAuthorizationMode !== 'undefined' || authorizationModes.identityPoolConfig;
 
-  if (hasDeprecatedSettings && hasUnDeprecatedSettings) {
+  if (hasDeprecatedIamSettings && hasUnDeprecatedIamSettings) {
     throw new Error(
-      "Cannot use deprecated 'authorizationModes.iamConfig' options with 'authorizationModes.identityPoolConfig'" +
-        " or 'authorizationModes.iamConfig.enableIamAuthorizationMode'",
+      'Invalid authorization modes configuration provided. ' +
+        "Deprecated IAM configuration cannot be used with identity pool configuration or when 'enableIamAuthorizationMode' is specified.",
     );
   }
 
-  if (hasDeprecatedIdentityPoolSettings && !hasAllDeprecatedIdentityPoolSettings) {
+  if (hasAnyDeprecatedIdentityPoolSetting && !hasAllDeprecatedIdentityPoolSettings) {
     throw new Error(
       "'authorizationModes.iamConfig.authenticatedUserRole', 'authorizationModes.iamConfig.unauthenticatedUserRole' and" +
         " 'authorizationModes.iamConfig.identityPoolId' must be provided.",

package/src/internal/codegen-assets.ts

@@ -1,5 +1,5 @@
-import { RemovalPolicy } from 'aws-cdk-lib';
-import { Bucket, IBucket } from 'aws-cdk-lib/aws-s3';
+import { RemovalPolicy, Fn } from 'aws-cdk-lib';
+import { Bucket, HttpMethods, IBucket } from 'aws-cdk-lib/aws-s3';
 import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 
@@ -8,6 +8,7 @@ export type CodegenAssetsProps = {
 };
 
 const MODEL_SCHEMA_KEY = 'model-schema.graphql';
+const CONSOLE_SERVICE_ENDPOINT = Fn.join('', ['https://', Fn.ref('AWS::Region'), '.console.aws.amazon.com/amplify']);
 
 /**
  * Construct an S3 URI string for a given bucket and key.
@@ -30,6 +31,14 @@ export class CodegenAssets extends Construct {
     const bucket = new Bucket(this, `${id}Bucket`, {
       removalPolicy: RemovalPolicy.DESTROY,
       autoDeleteObjects: true,
+      // Enabling CORS to allow console to access the codegen assets.
+      cors: [
+        {
+          allowedMethods: [HttpMethods.GET, HttpMethods.HEAD],
+          allowedHeaders: ['*'],
+          allowedOrigins: [CONSOLE_SERVICE_ENDPOINT],
+        },
+      ],
     });
 
     const deployment = new BucketDeployment(this, `${id}Deployment`, {

package/src/internal/data-source-config.ts

@@ -6,7 +6,12 @@ import {
   isMutationNode,
   fieldsWithSqlDirective,
 } from '@aws-amplify/graphql-transformer-core';
-import { DataSourceStrategiesProvider } from '@aws-amplify/graphql-transformer-interfaces';
+import {
+  DataSourceStrategiesProvider,
+  isSqlModelDataSourceSsmDbConnectionConfig,
+  isSqlModelDataSourceSecretsManagerDbConnectionConfig,
+} from '@aws-amplify/graphql-transformer-interfaces';
+import { Token, Arn, ArnFormat } from 'aws-cdk-lib';
 import {
   CustomSqlDataSourceStrategy as ConstructCustomSqlDataSourceStrategy,
   ModelDataSourceStrategy as ConstructModelDataSourceStrategy,
@@ -184,19 +189,47 @@ export const schemaByMergingDefinitions = (definitions: IAmplifyGraphqlDefinitio
  * @param strategy user provided model data source strategy
  * @returns validates and throws an error if the strategy is invalid
  */
-export const validateDataSourceStrategy = (strategy: ConstructModelDataSourceStrategy) => {
+export const validateDataSourceStrategy = (strategy: ConstructModelDataSourceStrategy): void => {
   if (!isSqlStrategy(strategy)) {
     return;
   }
 
   const dbConnectionConfig = strategy.dbConnectionConfig;
-  const invalidSSMPaths = Object.values(dbConnectionConfig).filter((value) => typeof value === 'string' && !isValidSSMPath(value));
-  if (invalidSSMPaths.length > 0) {
-    throw new Error(
-      `Invalid data source strategy "${
-        strategy.name
-      }". Following SSM paths must start with '/' in dbConnectionConfig: ${invalidSSMPaths.join(', ')}.`,
-    );
+  if (isSqlModelDataSourceSsmDbConnectionConfig(dbConnectionConfig)) {
+    const invalidSSMPaths = Object.values(dbConnectionConfig).filter((value) => typeof value === 'string' && !isValidSSMPath(value));
+    if (invalidSSMPaths.length > 0) {
+      throw new Error(
+        `Invalid data source strategy "${
+          strategy.name
+        }". Following SSM paths must start with '/' in dbConnectionConfig: ${invalidSSMPaths.join(', ')}.`,
+      );
+    }
+  } else if (isSqlModelDataSourceSecretsManagerDbConnectionConfig(dbConnectionConfig)) {
+    if (!Token.isUnresolved(dbConnectionConfig.secretArn)) {
+      try {
+        const arnComponents = Arn.split(dbConnectionConfig.secretArn, ArnFormat.COLON_RESOURCE_NAME);
+        if (arnComponents.service !== 'secretsmanager' || arnComponents.resource !== 'secret') {
+          // error message does not matter because it inside try/catch
+          throw new Error();
+        }
+      } catch {
+        throw new Error(`Invalid data source strategy "${strategy.name}". The value of secretArn is not a valid Secrets Manager ARN.`);
+      }
+    }
+
+    if (dbConnectionConfig.keyArn && !Token.isUnresolved(dbConnectionConfig.keyArn)) {
+      try {
+        const arnComponents = Arn.split(dbConnectionConfig.keyArn, ArnFormat.SLASH_RESOURCE_NAME);
+        if (arnComponents.service !== 'kms' || arnComponents.resource !== 'key') {
+          // error message does not matter because it inside try/catch
+          throw new Error();
+        }
+      } catch {
+        throw new Error(`Invalid data source strategy "${strategy.name}". The value of keyArn is not a valid KMS ARN.`);
+      }
+    }
+  } else {
+    throw new Error(`Invalid data source strategy "${strategy.name}". dbConnectionConfig does not include SSM paths or Secret ARN.`);
   }
 };
 

package/src/model-datasource-strategy-types.ts

@@ -116,12 +116,44 @@ export interface SubnetAvailabilityZone {
   readonly availabilityZone: string;
 }
 
+/**
+ * The credentials the lambda data source will use to connect to the database.
+ *
+ * @experimental
+ */
+export type SqlModelDataSourceDbConnectionConfig =
+  | SqlModelDataSourceSecretsManagerDbConnectionConfig
+  | SqlModelDataSourceSsmDbConnectionConfig;
+
+/**
+ * The credentials stored in Secrets Manager that the lambda data source will use to connect to the database.
+ *
+ * The managed secret should be in the same region as the lambda.
+ * @experimental
+ */
+export interface SqlModelDataSourceSecretsManagerDbConnectionConfig {
+  /** The ARN of the managed secret with username, password, and hostname to use when connecting to the database. **/
+  readonly secretArn: string;
+
+  /** The ARN of the customer managed encryption key for the secret. If not supplied, the secret is expected to be encrypted with the default AWS-managed key. **/
+  readonly keyArn?: string;
+
+  /** The port number of the database proxy, cluster, or instance. */
+  readonly port: number;
+
+  /** The database name. */
+  readonly databaseName: string;
+
+  /** The hostame of the database. */
+  readonly hostname: string;
+}
+
 /**
  * The Secure Systems Manager parameter paths the Lambda data source will use to connect to the database.
  *
  * These parameters are retrieved from Secure Systems Manager in the same region as the Lambda.
  */
-export interface SqlModelDataSourceDbConnectionConfig {
+export interface SqlModelDataSourceSsmDbConnectionConfig {
   /** The Secure Systems Manager parameter containing the hostname of the database. For RDS-based SQL data sources, this can be the hostname
    * of a database proxy, cluster, or instance.
    */

package/src/sql-model-datasource-strategy.ts

@@ -1,7 +1,12 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { isSqlDbType } from '@aws-amplify/graphql-transformer-core';
-import { SQLLambdaModelDataSourceStrategy, SqlModelDataSourceDbConnectionConfig } from './model-datasource-strategy-types';
+import {
+  SQLLambdaModelDataSourceStrategy,
+  SqlModelDataSourceDbConnectionConfig,
+  SqlModelDataSourceSsmDbConnectionConfig,
+  SqlModelDataSourceSecretsManagerDbConnectionConfig,
+} from './model-datasource-strategy-types';
 
 /**
  * Type predicate that returns true if the object is a SQLLambdaModelDataSourceStrategy.
@@ -24,6 +29,15 @@ export const isSQLLambdaModelDataSourceStrategy = (obj: any): obj is SQLLambdaMo
  * @returns true if the object is shaped like a SqlModelDataSourceDbConnectionConfig
  */
 export const isSqlModelDataSourceDbConnectionConfig = (obj: any): obj is SqlModelDataSourceDbConnectionConfig => {
+  return isSqlModelDataSourceSsmDbConnectionConfig(obj) || isSqlModelDataSourceSecretsManagerDbConnectionConfig(obj);
+};
+
+/**
+ * Type predicate that returns true if the object is a SqlModelDataSourceSsmDbConnectionConfig.
+ * @param obj the object to inspect
+ * @returns true if the object is shaped like a SqlModelDataSourceSsmDbConnectionConfig
+ */
+export const isSqlModelDataSourceSsmDbConnectionConfig = (obj: any): obj is SqlModelDataSourceSsmDbConnectionConfig => {
   return (
     (typeof obj === 'object' || typeof obj === 'function') &&
     typeof obj.hostnameSsmPath === 'string' &&
@@ -34,6 +48,23 @@ export const isSqlModelDataSourceDbConnectionConfig = (obj: any): obj is SqlMode
   );
 };
 
+/**
+ * Type predicate that returns true if the object is a SqlModelDataSourceSecretsManagerDbConnectionConfig.
+ * @param obj the object to inspect
+ * @returns true if the object is shaped like a SqlModelDataSourceSecretsManagerDbConnectionConfig
+ */
+export const isSqlModelDataSourceSecretsManagerDbConnectionConfig = (
+  obj: any,
+): obj is SqlModelDataSourceSecretsManagerDbConnectionConfig => {
+  return (
+    (typeof obj === 'object' || typeof obj === 'function') &&
+    typeof obj.secretArn === 'string' &&
+    typeof obj.port === 'number' &&
+    typeof obj.databaseName === 'string' &&
+    typeof obj.hostname == 'string'
+  );
+};
+
 /**
  * Class exposing utilities to produce SQLLambdaModelDataSourceStrategy objects given various inputs.
  */