@aws-amplify/graphql-api-construct 1.7.0-iam-auth.0 → 1.7.0

package/node_modules/graphql-mapping-template/CHANGELOG.md

@@ -3,10 +3,6 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
-## [4.20.16-iam-auth.0](https://github.com/aws-amplify/amplify-category-api/compare/graphql-mapping-template@4.20.15...graphql-mapping-template@4.20.16-iam-auth.0) (2024-03-15)
-
-**Note:** Version bump only for package graphql-mapping-template
-
 ## [4.20.15](https://github.com/aws-amplify/amplify-category-api/compare/graphql-mapping-template@4.20.14...graphql-mapping-template@4.20.15) (2024-02-28)
 
 **Note:** Version bump only for package graphql-mapping-template

package/node_modules/graphql-mapping-template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-mapping-template",
-  "version": "4.20.16-iam-auth.0",
+  "version": "4.20.15",
   "description": "An AST wrapper around AWS AppSync resolvers",
   "repository": {
     "type": "git",
@@ -57,6 +57,5 @@
     "coveragePathIgnorePatterns": [
       "/__tests__/"
     ]
-  },
-  "gitHead": "cb69f1ad3fae324674f3cc6db63495b4344c3fb5"
+  }
 }

package/node_modules/graphql-transformer-common/API.md

@@ -503,6 +503,8 @@ export const transformedArgsRef: ReferenceNode;
 // @public (undocumented)
 export const TYPESCRIPT_DATA_SCHEMA_CONSTANTS: {
     SCHEMA_PACKAGE: string;
+    SCHEMA_PACKAGE_INTERNALS: string;
+    BACKEND_PACKAGE: string;
     MODEL_METHOD: string;
     SCHEMA_METHOD: string;
     IDENTIFIER_METHOD: string;
@@ -512,6 +514,17 @@ export const TYPESCRIPT_DATA_SCHEMA_CONSTANTS: {
     ENUM_METHOD: string;
     REFERENCE_A: string;
     EXPORT_VARIABLE_NAME: string;
+    INTERNALS_CONFIGURE_METHOD: string;
+    BACKEND_SECRET_METHOD: string;
+    PROPERTY_VPC: string;
+    PROPERTY_VPC_ID: string;
+    PROPERTY_SECURITY_GROUP_IDS: string;
+    PROPERTY_AZ_CONFIG: string;
+    PROPERTY_SUBNET_ID: string;
+    PROPERTY_AZ: string;
+    PROPERTY_DATABASE: string;
+    PROPERTY_CONNECTION_URI: string;
+    PROPERTY_ENGINE: string;
 };
 
 // @public (undocumented)

package/node_modules/graphql-transformer-common/CHANGELOG.md

@@ -3,9 +3,11 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
-## [4.28.2-iam-auth.0](https://github.com/aws-amplify/amplify-category-api/compare/graphql-transformer-common@4.28.1...graphql-transformer-common@4.28.2-iam-auth.0) (2024-03-15)
+# [4.29.0](https://github.com/aws-amplify/amplify-category-api/compare/graphql-transformer-common@4.28.1...graphql-transformer-common@4.29.0) (2024-03-28)
 
-**Note:** Version bump only for package graphql-transformer-common
+### Features
+
+- **api:** auto detect vpc configuration on generate typescript database schema ([#2376](https://github.com/aws-amplify/amplify-category-api/issues/2376)) ([ef6f53c](https://github.com/aws-amplify/amplify-category-api/commit/ef6f53c04bbcc50921bf20a937d1332d4597a3fa))
 
 ## [4.28.1](https://github.com/aws-amplify/amplify-category-api/compare/graphql-transformer-common@4.28.0...graphql-transformer-common@4.28.1) (2024-02-28)
 

package/node_modules/graphql-transformer-common/lib/TypescriptSchemaConstants.d.ts

@@ -1,5 +1,7 @@
 export declare const TYPESCRIPT_DATA_SCHEMA_CONSTANTS: {
     SCHEMA_PACKAGE: string;
+    SCHEMA_PACKAGE_INTERNALS: string;
+    BACKEND_PACKAGE: string;
     MODEL_METHOD: string;
     SCHEMA_METHOD: string;
     IDENTIFIER_METHOD: string;
@@ -9,5 +11,16 @@ export declare const TYPESCRIPT_DATA_SCHEMA_CONSTANTS: {
     ENUM_METHOD: string;
     REFERENCE_A: string;
     EXPORT_VARIABLE_NAME: string;
+    INTERNALS_CONFIGURE_METHOD: string;
+    BACKEND_SECRET_METHOD: string;
+    PROPERTY_VPC: string;
+    PROPERTY_VPC_ID: string;
+    PROPERTY_SECURITY_GROUP_IDS: string;
+    PROPERTY_AZ_CONFIG: string;
+    PROPERTY_SUBNET_ID: string;
+    PROPERTY_AZ: string;
+    PROPERTY_DATABASE: string;
+    PROPERTY_CONNECTION_URI: string;
+    PROPERTY_ENGINE: string;
 };
 //# sourceMappingURL=TypescriptSchemaConstants.d.ts.map

package/node_modules/graphql-transformer-common/lib/TypescriptSchemaConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TypescriptSchemaConstants.d.ts","sourceRoot":"","sources":["../src/TypescriptSchemaConstants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC;;;;;;;;;;;CAW5C,CAAC"}
+{"version":3,"file":"TypescriptSchemaConstants.d.ts","sourceRoot":"","sources":["../src/TypescriptSchemaConstants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;CAwB5C,CAAC"}

package/node_modules/graphql-transformer-common/lib/TypescriptSchemaConstants.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TYPESCRIPT_DATA_SCHEMA_CONSTANTS = void 0;
 exports.TYPESCRIPT_DATA_SCHEMA_CONSTANTS = {
     SCHEMA_PACKAGE: '@aws-amplify/data-schema',
+    SCHEMA_PACKAGE_INTERNALS: '@aws-amplify/data-schema/internals',
+    BACKEND_PACKAGE: '@aws-amplify/backend',
     MODEL_METHOD: 'model',
     SCHEMA_METHOD: 'schema',
     IDENTIFIER_METHOD: 'identifier',
@@ -12,5 +14,16 @@ exports.TYPESCRIPT_DATA_SCHEMA_CONSTANTS = {
     ENUM_METHOD: 'enum',
     REFERENCE_A: 'a',
     EXPORT_VARIABLE_NAME: 'schema',
+    INTERNALS_CONFIGURE_METHOD: 'configure',
+    BACKEND_SECRET_METHOD: 'secret',
+    PROPERTY_VPC: 'vpcConfig',
+    PROPERTY_VPC_ID: 'vpcId',
+    PROPERTY_SECURITY_GROUP_IDS: 'securityGroupIds',
+    PROPERTY_AZ_CONFIG: 'subnetAvailabilityZones',
+    PROPERTY_SUBNET_ID: 'subnetId',
+    PROPERTY_AZ: 'availabilityZone',
+    PROPERTY_DATABASE: 'database',
+    PROPERTY_CONNECTION_URI: 'connectionUri',
+    PROPERTY_ENGINE: 'engine',
 };
 //# sourceMappingURL=TypescriptSchemaConstants.js.map

package/node_modules/graphql-transformer-common/lib/TypescriptSchemaConstants.js.map

@@ -1 +1 @@
-{"version":3,"file":"TypescriptSchemaConstants.js","sourceRoot":"","sources":["../src/TypescriptSchemaConstants.ts"],"names":[],"mappings":";;;AAAa,QAAA,gCAAgC,GAAG;IAC9C,cAAc,EAAE,0BAA0B;IAC1C,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,QAAQ;IACvB,iBAAiB,EAAE,YAAY;IAC/B,YAAY,EAAE,OAAO;IACrB,eAAe,EAAE,UAAU;IAC3B,aAAa,EAAE,QAAQ;IACvB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,GAAG;IAChB,oBAAoB,EAAE,QAAQ;CAC/B,CAAC"}
+{"version":3,"file":"TypescriptSchemaConstants.js","sourceRoot":"","sources":["../src/TypescriptSchemaConstants.ts"],"names":[],"mappings":";;;AAAa,QAAA,gCAAgC,GAAG;IAC9C,cAAc,EAAE,0BAA0B;IAC1C,wBAAwB,EAAE,oCAAoC;IAC9D,eAAe,EAAE,sBAAsB;IACvC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,QAAQ;IACvB,iBAAiB,EAAE,YAAY;IAC/B,YAAY,EAAE,OAAO;IACrB,eAAe,EAAE,UAAU;IAC3B,aAAa,EAAE,QAAQ;IACvB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,GAAG;IAChB,oBAAoB,EAAE,QAAQ;IAC9B,0BAA0B,EAAE,WAAW;IACvC,qBAAqB,EAAE,QAAQ;IAC/B,YAAY,EAAE,WAAW;IACzB,eAAe,EAAE,OAAO;IACxB,2BAA2B,EAAE,kBAAkB;IAC/C,kBAAkB,EAAE,yBAAyB;IAC7C,kBAAkB,EAAE,UAAU;IAC9B,WAAW,EAAE,kBAAkB;IAC/B,iBAAiB,EAAE,UAAU;IAC7B,uBAAuB,EAAE,eAAe;IACxC,eAAe,EAAE,QAAQ;CAC1B,CAAC"}

package/node_modules/graphql-transformer-common/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-transformer-common",
-  "version": "4.28.2-iam-auth.0",
+  "version": "4.29.0",
   "description": "Common code and constants for AppSync Transformers",
   "repository": {
     "type": "git",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "graphql": "^15.5.0",
-    "graphql-mapping-template": "4.20.16-iam-auth.0",
+    "graphql-mapping-template": "4.20.15",
     "md5": "^2.2.1",
     "pluralize": "8.0.0"
   },
@@ -66,5 +66,5 @@
       "/__tests__/"
     ]
   },
-  "gitHead": "cb69f1ad3fae324674f3cc6db63495b4344c3fb5"
+  "gitHead": "ac8990dd06d7b6a29c079e84a7c1e23ec5708fc1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws-amplify/graphql-api-construct",
-  "version": "1.7.0-iam-auth.0",
+  "version": "1.7.0",
   "description": "AppSync GraphQL Api Construct using Amplify GraphQL Transformer.",
   "repository": {
     "type": "git",
@@ -38,6 +38,7 @@
     "@aws-amplify/backend-output-storage",
     "@aws-amplify/graphql-auth-transformer",
     "@aws-amplify/graphql-default-value-transformer",
+    "@aws-amplify/graphql-directives",
     "@aws-amplify/graphql-function-transformer",
     "@aws-amplify/graphql-http-transformer",
     "@aws-amplify/graphql-index-transformer",
@@ -75,20 +76,21 @@
   "dependencies": {
     "@aws-amplify/backend-output-schemas": "^0.4.0",
     "@aws-amplify/backend-output-storage": "^0.2.2",
-    "@aws-amplify/graphql-auth-transformer": "3.4.2-iam-auth.0",
-    "@aws-amplify/graphql-default-value-transformer": "2.3.2-iam-auth.0",
-    "@aws-amplify/graphql-function-transformer": "2.1.19-iam-auth.0",
-    "@aws-amplify/graphql-http-transformer": "2.1.19-iam-auth.0",
-    "@aws-amplify/graphql-index-transformer": "2.3.8-iam-auth.0",
-    "@aws-amplify/graphql-maps-to-transformer": "3.4.9-iam-auth.0",
-    "@aws-amplify/graphql-model-transformer": "2.6.1-iam-auth.0",
-    "@aws-amplify/graphql-predictions-transformer": "2.1.19-iam-auth.0",
-    "@aws-amplify/graphql-relational-transformer": "2.4.2-iam-auth.0",
-    "@aws-amplify/graphql-searchable-transformer": "2.6.2-iam-auth.0",
-    "@aws-amplify/graphql-sql-transformer": "0.2.8-iam-auth.0",
-    "@aws-amplify/graphql-transformer": "1.3.13-iam-auth.0",
-    "@aws-amplify/graphql-transformer-core": "2.5.1-iam-auth.0",
-    "@aws-amplify/graphql-transformer-interfaces": "3.4.1-iam-auth.0",
+    "@aws-amplify/graphql-auth-transformer": "3.4.2",
+    "@aws-amplify/graphql-default-value-transformer": "2.3.2",
+    "@aws-amplify/graphql-directives": "1.0.1",
+    "@aws-amplify/graphql-function-transformer": "2.1.19",
+    "@aws-amplify/graphql-http-transformer": "2.1.19",
+    "@aws-amplify/graphql-index-transformer": "2.3.8",
+    "@aws-amplify/graphql-maps-to-transformer": "3.4.9",
+    "@aws-amplify/graphql-model-transformer": "2.7.0",
+    "@aws-amplify/graphql-predictions-transformer": "2.1.19",
+    "@aws-amplify/graphql-relational-transformer": "2.4.2",
+    "@aws-amplify/graphql-searchable-transformer": "2.6.2",
+    "@aws-amplify/graphql-sql-transformer": "0.2.8",
+    "@aws-amplify/graphql-transformer": "1.4.0",
+    "@aws-amplify/graphql-transformer-core": "2.5.1",
+    "@aws-amplify/graphql-transformer-interfaces": "3.5.0",
     "@aws-amplify/platform-core": "^0.2.0",
     "@aws-amplify/plugin-types": "^0.4.1",
     "charenc": "^0.0.2",
@@ -96,8 +98,8 @@
     "fs-extra": "^8.1.0",
     "graceful-fs": "^4.2.11",
     "graphql": "^15.5.0",
-    "graphql-mapping-template": "4.20.16-iam-auth.0",
-    "graphql-transformer-common": "4.28.2-iam-auth.0",
+    "graphql-mapping-template": "4.20.15",
+    "graphql-transformer-common": "4.29.0",
     "hjson": "^3.2.2",
     "immer": "^9.0.12",
     "is-buffer": "^2.0.5",
@@ -112,7 +114,7 @@
     "zod": "^3.22.3"
   },
   "devDependencies": {
-    "@aws-amplify/graphql-transformer-test-utils": "0.4.7-iam-auth.0",
+    "@aws-amplify/graphql-transformer-test-utils": "0.4.7",
     "@types/fs-extra": "^8.0.1",
     "@types/node": "^12.12.6",
     "aws-cdk-lib": "2.80.0",
@@ -177,5 +179,5 @@
       "/__tests__/"
     ]
   },
-  "gitHead": "cb69f1ad3fae324674f3cc6db63495b4344c3fb5"
+  "gitHead": "ac8990dd06d7b6a29c079e84a7c1e23ec5708fc1"
 }

package/src/amplify-graphql-api.ts

@@ -48,7 +48,6 @@ import {
   getGeneratedFunctionSlots,
   CodegenAssets,
   getAdditionalAuthenticationTypes,
-  validateAuthorizationModes,
 } from './internal';
 import { getStackForScope, walkAndProcessNodes } from './internal/construct-tree';
 import { getDataSourceStrategiesProvider } from './internal/data-source-config';
@@ -170,7 +169,6 @@ export class AmplifyGraphqlApi extends Construct {
       dataSources,
     });
 
-    validateAuthorizationModes(authorizationModes);
     const { authConfig, authSynthParameters } = convertAuthorizationModesToTransformerAuthConfig(authorizationModes);
 
     validateFunctionSlots(functionSlots ?? []);

package/src/index.ts

@@ -4,7 +4,6 @@
  */
 export type {
   IAMAuthorizationConfig,
-  IdentityPoolAuthorizationConfig,
   UserPoolAuthorizationConfig,
   OIDCAuthorizationConfig,
   ApiKeyAuthorizationConfig,

package/src/internal/authorization-modes.ts

@@ -5,51 +5,19 @@ import { IRole, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import {
   AuthorizationModes,
   ApiKeyAuthorizationConfig,
+  IAMAuthorizationConfig,
   LambdaAuthorizationConfig,
   OIDCAuthorizationConfig,
   UserPoolAuthorizationConfig,
 } from '../types';
 
 type AuthorizationConfigMode =
-  | { type: 'AWS_IAM' }
+  | (IAMAuthorizationConfig & { type: 'AWS_IAM' })
   | (UserPoolAuthorizationConfig & { type: 'AMAZON_COGNITO_USER_POOLS' })
   | (OIDCAuthorizationConfig & { type: 'OPENID_CONNECT' })
   | (ApiKeyAuthorizationConfig & { type: 'API_KEY' })
   | (LambdaAuthorizationConfig & { type: 'AWS_LAMBDA' });
 
-export const validateAuthorizationModes = (authorizationModes: AuthorizationModes) => {
-  const hasDeprecatedIdentityPoolSettings =
-    authorizationModes.iamConfig?.authenticatedUserRole ||
-    authorizationModes.iamConfig?.unauthenticatedUserRole ||
-    authorizationModes.iamConfig?.identityPoolId;
-  const hasAllDeprecatedIdentityPoolSettings =
-    authorizationModes.iamConfig?.authenticatedUserRole &&
-    authorizationModes.iamConfig?.unauthenticatedUserRole &&
-    authorizationModes.iamConfig?.identityPoolId;
-  const hasDeprecatedSettings =
-    authorizationModes.iamConfig?.authenticatedUserRole ||
-    authorizationModes.iamConfig?.unauthenticatedUserRole ||
-    authorizationModes.iamConfig?.identityPoolId ||
-    authorizationModes.iamConfig?.allowListedRoles ||
-    authorizationModes.adminRoles;
-  const hasUnDeprecatedSettings =
-    typeof authorizationModes.iamConfig?.enableIamAuthorizationMode !== 'undefined' || authorizationModes.identityPoolConfig;
-
-  if (hasDeprecatedSettings && hasUnDeprecatedSettings) {
-    throw new Error(
-      "Cannot use deprecated 'authorizationModes.iamConfig' options with 'authorizationModes.identityPoolConfig'" +
-        " or 'authorizationModes.iamConfig.enableIamAuthorizationMode'",
-    );
-  }
-
-  if (hasDeprecatedIdentityPoolSettings && !hasAllDeprecatedIdentityPoolSettings) {
-    throw new Error(
-      "'authorizationModes.iamConfig.authenticatedUserRole', 'authorizationModes.iamConfig.unauthenticatedUserRole' and" +
-        " 'authorizationModes.iamConfig.identityPoolId' must be provided.",
-    );
-  }
-};
-
 /**
  * Converts a single auth mode config into the amplify-internal representation.
  * @param authMode the auth mode to convert into the Appsync CDK representation.
@@ -111,7 +79,7 @@ const convertAuthConfigToAppSyncAuth = (authModes: AuthorizationModes): AppSyncA
     authModes.lambdaConfig ? { type: 'AWS_LAMBDA', ...authModes.lambdaConfig } : null,
     authModes.oidcConfig ? { type: 'OPENID_CONNECT', ...authModes.oidcConfig } : null,
     authModes.userPoolConfig ? { type: 'AMAZON_COGNITO_USER_POOLS', ...authModes.userPoolConfig } : null,
-    authModes.iamConfig || authModes.identityPoolConfig ? { type: 'AWS_IAM' } : null,
+    authModes.iamConfig ? { type: 'AWS_IAM', ...authModes.iamConfig } : null,
   ].filter((mode) => mode) as AuthorizationConfigMode[];
   const authProviders = authConfig.map(convertAuthModeToAuthProvider);
 
@@ -148,7 +116,7 @@ const convertAuthConfigToAppSyncAuth = (authModes: AuthorizationModes): AppSyncA
 
 type AuthSynthParameters = Pick<
   SynthParameters,
-  'userPoolId' | 'authenticatedUserRoleName' | 'unauthenticatedUserRoleName' | 'identityPoolId' | 'adminRoles' | 'enableIamAccess'
+  'userPoolId' | 'authenticatedUserRoleName' | 'unauthenticatedUserRoleName' | 'identityPoolId' | 'adminRoles'
 >;
 
 interface AuthConfig {
@@ -209,19 +177,12 @@ const getAllowListedRoles = (authModes: AuthorizationModes): string[] =>
  */
 const getSynthParameters = (authModes: AuthorizationModes): AuthSynthParameters => ({
   adminRoles: getAllowListedRoles(authModes),
-  identityPoolId: authModes.identityPoolConfig?.identityPoolId ?? authModes.iamConfig?.identityPoolId,
-  enableIamAccess: authModes.iamConfig?.enableIamAuthorizationMode,
+  identityPoolId: authModes.iamConfig?.identityPoolId,
   ...(authModes.userPoolConfig ? { userPoolId: authModes.userPoolConfig.userPool.userPoolId } : {}),
-  ...(authModes?.identityPoolConfig
-    ? {
-        authenticatedUserRoleName: authModes.identityPoolConfig.authenticatedUserRole.roleName,
-        unauthenticatedUserRoleName: authModes.identityPoolConfig.unauthenticatedUserRole.roleName,
-      }
-    : {}),
-  ...(authModes?.iamConfig && authModes?.iamConfig.authenticatedUserRole && authModes?.iamConfig.unauthenticatedUserRole
+  ...(authModes?.iamConfig
     ? {
-        authenticatedUserRoleName: authModes.iamConfig.authenticatedUserRole?.roleName,
-        unauthenticatedUserRoleName: authModes.iamConfig.unauthenticatedUserRole?.roleName,
+        authenticatedUserRoleName: authModes.iamConfig.authenticatedUserRole.roleName,
+        unauthenticatedUserRoleName: authModes.iamConfig.unauthenticatedUserRole.roleName,
       }
     : {}),
 });

package/src/internal/data-source-config.ts

@@ -6,7 +6,12 @@ import {
   isMutationNode,
   fieldsWithSqlDirective,
 } from '@aws-amplify/graphql-transformer-core';
-import { DataSourceStrategiesProvider } from '@aws-amplify/graphql-transformer-interfaces';
+import {
+  DataSourceStrategiesProvider,
+  isSqlModelDataSourceSsmDbConnectionConfig,
+  isSqlModelDataSourceSecretsManagerDbConnectionConfig,
+} from '@aws-amplify/graphql-transformer-interfaces';
+import { Token, Arn, ArnFormat } from 'aws-cdk-lib';
 import {
   CustomSqlDataSourceStrategy as ConstructCustomSqlDataSourceStrategy,
   ModelDataSourceStrategy as ConstructModelDataSourceStrategy,
@@ -184,19 +189,47 @@ export const schemaByMergingDefinitions = (definitions: IAmplifyGraphqlDefinitio
  * @param strategy user provided model data source strategy
  * @returns validates and throws an error if the strategy is invalid
  */
-export const validateDataSourceStrategy = (strategy: ConstructModelDataSourceStrategy) => {
+export const validateDataSourceStrategy = (strategy: ConstructModelDataSourceStrategy): void => {
   if (!isSqlStrategy(strategy)) {
     return;
   }
 
   const dbConnectionConfig = strategy.dbConnectionConfig;
-  const invalidSSMPaths = Object.values(dbConnectionConfig).filter((value) => typeof value === 'string' && !isValidSSMPath(value));
-  if (invalidSSMPaths.length > 0) {
-    throw new Error(
-      `Invalid data source strategy "${
-        strategy.name
-      }". Following SSM paths must start with '/' in dbConnectionConfig: ${invalidSSMPaths.join(', ')}.`,
-    );
+  if (isSqlModelDataSourceSsmDbConnectionConfig(dbConnectionConfig)) {
+    const invalidSSMPaths = Object.values(dbConnectionConfig).filter((value) => typeof value === 'string' && !isValidSSMPath(value));
+    if (invalidSSMPaths.length > 0) {
+      throw new Error(
+        `Invalid data source strategy "${
+          strategy.name
+        }". Following SSM paths must start with '/' in dbConnectionConfig: ${invalidSSMPaths.join(', ')}.`,
+      );
+    }
+  } else if (isSqlModelDataSourceSecretsManagerDbConnectionConfig(dbConnectionConfig)) {
+    if (!Token.isUnresolved(dbConnectionConfig.secretArn)) {
+      try {
+        const arnComponents = Arn.split(dbConnectionConfig.secretArn, ArnFormat.COLON_RESOURCE_NAME);
+        if (arnComponents.service !== 'secretsmanager' || arnComponents.resource !== 'secret') {
+          // error message does not matter because it inside try/catch
+          throw new Error();
+        }
+      } catch {
+        throw new Error(`Invalid data source strategy "${strategy.name}". The value of secretArn is not a valid Secrets Manager ARN.`);
+      }
+    }
+
+    if (dbConnectionConfig.keyArn && !Token.isUnresolved(dbConnectionConfig.keyArn)) {
+      try {
+        const arnComponents = Arn.split(dbConnectionConfig.keyArn, ArnFormat.SLASH_RESOURCE_NAME);
+        if (arnComponents.service !== 'kms' || arnComponents.resource !== 'key') {
+          // error message does not matter because it inside try/catch
+          throw new Error();
+        }
+      } catch {
+        throw new Error(`Invalid data source strategy "${strategy.name}". The value of keyArn is not a valid KMS ARN.`);
+      }
+    }
+  } else {
+    throw new Error(`Invalid data source strategy "${strategy.name}". dbConnectionConfig does not include SSM paths or Secret ARN.`);
   }
 };
 

package/src/model-datasource-strategy-types.ts

@@ -116,12 +116,44 @@ export interface SubnetAvailabilityZone {
   readonly availabilityZone: string;
 }
 
+/**
+ * The credentials the lambda data source will use to connect to the database.
+ *
+ * @experimental
+ */
+export type SqlModelDataSourceDbConnectionConfig =
+  | SqlModelDataSourceSecretsManagerDbConnectionConfig
+  | SqlModelDataSourceSsmDbConnectionConfig;
+
+/**
+ * The credentials stored in Secrets Manager that the lambda data source will use to connect to the database.
+ *
+ * The managed secret should be in the same region as the lambda.
+ * @experimental
+ */
+export interface SqlModelDataSourceSecretsManagerDbConnectionConfig {
+  /** The ARN of the managed secret with username, password, and hostname to use when connecting to the database. **/
+  readonly secretArn: string;
+
+  /** The ARN of the customer managed encryption key for the secret. If not supplied, the secret is expected to be encrypted with the default AWS-managed key. **/
+  readonly keyArn?: string;
+
+  /** The port number of the database proxy, cluster, or instance. */
+  readonly port: number;
+
+  /** The database name. */
+  readonly databaseName: string;
+
+  /** The hostame of the database. */
+  readonly hostname: string;
+}
+
 /**
  * The Secure Systems Manager parameter paths the Lambda data source will use to connect to the database.
  *
  * These parameters are retrieved from Secure Systems Manager in the same region as the Lambda.
  */
-export interface SqlModelDataSourceDbConnectionConfig {
+export interface SqlModelDataSourceSsmDbConnectionConfig {
   /** The Secure Systems Manager parameter containing the hostname of the database. For RDS-based SQL data sources, this can be the hostname
    * of a database proxy, cluster, or instance.
    */

package/src/sql-model-datasource-strategy.ts

@@ -1,7 +1,12 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { isSqlDbType } from '@aws-amplify/graphql-transformer-core';
-import { SQLLambdaModelDataSourceStrategy, SqlModelDataSourceDbConnectionConfig } from './model-datasource-strategy-types';
+import {
+  SQLLambdaModelDataSourceStrategy,
+  SqlModelDataSourceDbConnectionConfig,
+  SqlModelDataSourceSsmDbConnectionConfig,
+  SqlModelDataSourceSecretsManagerDbConnectionConfig,
+} from './model-datasource-strategy-types';
 
 /**
  * Type predicate that returns true if the object is a SQLLambdaModelDataSourceStrategy.
@@ -24,6 +29,15 @@ export const isSQLLambdaModelDataSourceStrategy = (obj: any): obj is SQLLambdaMo
  * @returns true if the object is shaped like a SqlModelDataSourceDbConnectionConfig
  */
 export const isSqlModelDataSourceDbConnectionConfig = (obj: any): obj is SqlModelDataSourceDbConnectionConfig => {
+  return isSqlModelDataSourceSsmDbConnectionConfig(obj) || isSqlModelDataSourceSecretsManagerDbConnectionConfig(obj);
+};
+
+/**
+ * Type predicate that returns true if the object is a SqlModelDataSourceSsmDbConnectionConfig.
+ * @param obj the object to inspect
+ * @returns true if the object is shaped like a SqlModelDataSourceSsmDbConnectionConfig
+ */
+export const isSqlModelDataSourceSsmDbConnectionConfig = (obj: any): obj is SqlModelDataSourceSsmDbConnectionConfig => {
   return (
     (typeof obj === 'object' || typeof obj === 'function') &&
     typeof obj.hostnameSsmPath === 'string' &&
@@ -34,6 +48,23 @@ export const isSqlModelDataSourceDbConnectionConfig = (obj: any): obj is SqlMode
   );
 };
 
+/**
+ * Type predicate that returns true if the object is a SqlModelDataSourceSecretsManagerDbConnectionConfig.
+ * @param obj the object to inspect
+ * @returns true if the object is shaped like a SqlModelDataSourceSecretsManagerDbConnectionConfig
+ */
+export const isSqlModelDataSourceSecretsManagerDbConnectionConfig = (
+  obj: any,
+): obj is SqlModelDataSourceSecretsManagerDbConnectionConfig => {
+  return (
+    (typeof obj === 'object' || typeof obj === 'function') &&
+    typeof obj.secretArn === 'string' &&
+    typeof obj.port === 'number' &&
+    typeof obj.databaseName === 'string' &&
+    typeof obj.hostname == 'string'
+  );
+};
+
 /**
  * Class exposing utilities to produce SQLLambdaModelDataSourceStrategy objects given various inputs.
  */

package/src/types.ts

@@ -28,68 +28,25 @@ export interface IAMAuthorizationConfig {
   /**
    * ID for the Cognito Identity Pool vending auth and unauth roles.
    * Format: `<region>:<id string>`
-   *
-   * @deprecated Use 'IdentityPoolAuthorizationConfig.identityPoolId' instead.
-   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
    */
-  readonly identityPoolId?: string;
+  readonly identityPoolId: string;
 
   /**
    * Authenticated user role, applies to { provider: iam, allow: private } access.
-   *
-   * @deprecated Use 'IdentityPoolAuthorizationConfig.authenticatedUserRole' instead.
-   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
    */
-  readonly authenticatedUserRole?: IRole;
+  readonly authenticatedUserRole: IRole;
 
   /**
    * Unauthenticated user role, applies to { provider: iam, allow: public } access.
-   *
-   * @deprecated Use 'IdentityPoolAuthorizationConfig.unauthenticatedUserRole' instead.
-   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
    */
-  readonly unauthenticatedUserRole?: IRole;
+  readonly unauthenticatedUserRole: IRole;
 
   /**
    * A list of IAM roles which will be granted full read/write access to the generated model if IAM auth is enabled.
    * If an IRole is provided, the role `name` will be used for matching.
    * If a string is provided, the raw value will be used for matching.
-   *
-   * @deprecated Use 'enableIamAuthorizationMode' and IAM Policy to control access for IAM principals.
-   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
    */
   readonly allowListedRoles?: (IRole | string)[];
-
-  /**
-   * Enables access for IAM principals. If enabled @auth directive rules are not applied.
-   * Instead, access should be defined by IAM Policy, see https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappsync.html.
-   *
-   * Does not apply to authenticated and unauthenticated IAM Roles attached to Cognito Identity Pool.
-   * Use IdentityPoolAuthorizationConfig to configure their access.
-   */
-  readonly enableIamAuthorizationMode?: boolean;
-}
-
-/**
- * Configuration for Cognito Identity Pool Authorization on the Graphql Api.
- * @struct - required since this interface begins with an 'I'
- */
-export interface IdentityPoolAuthorizationConfig {
-  /**
-   * ID for the Cognito Identity Pool vending auth and unauth roles.
-   * Format: `<region>:<id string>`
-   */
-  readonly identityPoolId: string;
-
-  /**
-   * Authenticated user role, applies to { provider: iam, allow: private } access.
-   */
-  readonly authenticatedUserRole: IRole;
-
-  /**
-   * Unauthenticated user role, applies to { provider: iam, allow: public } access.
-   */
-  readonly unauthenticatedUserRole: IRole;
 }
 
 /**
@@ -177,18 +134,10 @@ export interface AuthorizationModes {
   readonly defaultAuthorizationMode?: 'AWS_IAM' | 'AMAZON_COGNITO_USER_POOLS' | 'OPENID_CONNECT' | 'API_KEY' | 'AWS_LAMBDA';
 
   /**
-   * IAM Auth config, required to allow IAM-based access to this API.
-   * This applies to any IAM principal except Amazon Cognito identity pool's authenticated and unauthenticated roles.
-   * This behavior was has recently been improved.
-   * See https://docs.amplify.aws/cli/react/tools/cli/migration/iam-auth-updates-for-cdk-construct for details.
-   */
-  readonly iamConfig?: IAMAuthorizationConfig;
-
-  /**
-   * Cognito Identity Pool config, required if an 'identityPool' auth provider is specified in the Api.
+   * IAM Auth config, required if an 'iam' auth provider is specified in the Api.
    * Applies to 'public' and 'private' auth strategies.
    */
-  readonly identityPoolConfig?: IdentityPoolAuthorizationConfig;
+  readonly iamConfig?: IAMAuthorizationConfig;
 
   /**
    * Cognito UserPool config, required if a 'userPools' auth provider is specified in the Api.