@aws-amplify/graphql-model-transformer 1.3.4-alpha.0 → 1.4.0-rds.0

package/src/resolvers/rds/resolver.ts

@@ -1,28 +1,26 @@
-// TODO: Split this file into seperated query, mutations and subscriptions files.
-
 import {
-  str,
+  CfnMapping,
+  Duration,
+  Fn,
+  Stack,
+} from 'aws-cdk-lib';
+import {
   Expression,
-  ref,
+  compoundExpression,
+  ifElse,
+  list,
   methodCall,
   obj,
-  qref,
-  ifElse,
-  compoundExpression,
-  iff,
-  toJson,
   printBlock,
-  and,
-  not,
-  equals,
-  int,
-  nul,
+  qref,
+  ref,
   set,
-  list,
+  str,
+  toJson,
 } from 'graphql-mapping-template';
 import { ResourceConstants } from 'graphql-transformer-common';
-import { Stack } from 'aws-cdk-lib';
-import { Construct } from 'constructs';
+import { RDSConnectionSecrets } from '@aws-amplify/graphql-transformer-core';
+import { GraphQLAPIProvider } from '@aws-amplify/graphql-transformer-interfaces';
 import {
   Effect,
   IRole,
@@ -31,39 +29,176 @@ import {
   Role,
   ServicePrincipal,
 } from 'aws-cdk-lib/aws-iam';
-import { IFunction, Runtime } from 'aws-cdk-lib/aws-lambda';
-import { GraphQLAPIProvider } from '@aws-amplify/graphql-transformer-interfaces';
+import { IFunction, LayerVersion, Runtime } from 'aws-cdk-lib/aws-lambda';
+import { Construct } from 'constructs';
 import path from 'path';
-import {RDSConnectionSecrets} from '@aws-amplify/graphql-transformer-core';
+import { VpcConfig } from '@aws-amplify/graphql-transformer-interfaces/src';
 
+/**
+ * Define RDS Lambda operations
+ */
 export type OPERATIONS = 'CREATE' | 'UPDATE' | 'DELETE' | 'GET' | 'LIST' | 'SYNC';
 
 const OPERATION_KEY = '__operation';
 
+const RDSLayerMappingID = 'RDSLayerResourceMapping';
+// TODO: This is temporary state, we need to modify this to a production layer
+/**
+ * Define RDS Lambda Layer region mappings
+ * @param scope Construct
+ */
+export const setRDSLayerMappings = (scope: Construct): CfnMapping => new CfnMapping(
+  scope,
+  // For beta use account '956468067974', layer name 'AmplifyRDSLayerBeta' and layer version '12' as of 2023-06-20
+  // For prod use account '582037449441', layer name 'AmplifyRDSLayer' and layer version '3' as of 2023-06-20
+  RDSLayerMappingID,
+  {
+    mapping: {
+      'ap-northeast-1': {
+        layerRegion: 'arn:aws:lambda:ap-northeast-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'us-east-1': {
+        layerRegion: 'arn:aws:lambda:us-east-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'ap-southeast-1': {
+        layerRegion: 'arn:aws:lambda:ap-southeast-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'eu-west-1': {
+        layerRegion: 'arn:aws:lambda:eu-west-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'us-west-1': {
+        layerRegion: 'arn:aws:lambda:us-west-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'ap-east-1': {
+        layerRegion: 'arn:aws:lambda:ap-east-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'ap-northeast-2': {
+        layerRegion: 'arn:aws:lambda:ap-northeast-2:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'ap-northeast-3': {
+        layerRegion: 'arn:aws:lambda:ap-northeast-3:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'ap-south-1': {
+        layerRegion: 'arn:aws:lambda:ap-south-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'ap-southeast-2': {
+        layerRegion: 'arn:aws:lambda:ap-southeast-2:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'ca-central-1': {
+        layerRegion: 'arn:aws:lambda:ca-central-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'eu-central-1': {
+        layerRegion: 'arn:aws:lambda:eu-central-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'eu-north-1': {
+        layerRegion: 'arn:aws:lambda:eu-north-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'eu-west-2': {
+        layerRegion: 'arn:aws:lambda:eu-west-2:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'eu-west-3': {
+        layerRegion: 'arn:aws:lambda:eu-west-3:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'sa-east-1': {
+        layerRegion: 'arn:aws:lambda:sa-east-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'us-east-2': {
+        layerRegion: 'arn:aws:lambda:us-east-2:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'us-west-2': {
+        layerRegion: 'arn:aws:lambda:us-west-2:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'cn-north-1': {
+        layerRegion: 'arn:aws:lambda:cn-north-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'cn-northwest-1': {
+        layerRegion: 'arn:aws:lambda:cn-northwest-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'us-gov-west-1': {
+        layerRegion: 'arn:aws:lambda:us-gov-west-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'us-gov-east-1': {
+        layerRegion: 'arn:aws:lambda:us-gov-east-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+      'me-south-1': {
+        layerRegion: 'arn:aws:lambda:me-south-1:582037449441:layer:AmplifyRDSLayer:3',
+      },
+    },
+  },
+);
+
+/**
+ * Create RDS Lambda function
+ * @param stack Construct
+ * @param apiGraphql GraphQLAPIProvider
+ * @param lambdaRole IRole
+ */
 export const createRdsLambda = (
   stack: Stack,
   apiGraphql: GraphQLAPIProvider,
   lambdaRole: IRole,
   environment?: { [key: string]: string },
+  sqlLambdaVpcConfig?: VpcConfig,
 ): IFunction => {
   const { RDSLambdaLogicalID } = ResourceConstants.RESOURCES;
-
   return apiGraphql.host.addLambdaFunction(
     RDSLambdaLogicalID,
     `functions/${RDSLambdaLogicalID}.zip`,
     'handler.run',
     path.resolve(__dirname, '..', '..', '..', 'lib', 'rds-lambda.zip'),
-    Runtime.NODEJS_16_X,
+    Runtime.NODEJS_18_X,
+    [
+      LayerVersion.fromLayerVersionArn(
+        stack,
+        'SQLLambdaLayerVersion',
+        Fn.findInMap(RDSLayerMappingID, Fn.ref('AWS::Region'), 'layerRegion'),
+      ),
+    ],
+    lambdaRole,
+    environment,
+    Duration.seconds(30),
+    stack,
+    sqlLambdaVpcConfig,
+  );
+};
+
+/**
+ * Create RDS Patching Lambda function
+ * @param stack Construct
+ * @param apiGraphql GraphQLAPIProvider
+ * @param lambdaRole IRole
+ */
+export const createRdsPatchingLambda = (
+  stack: Stack,
+  apiGraphql: GraphQLAPIProvider,
+  lambdaRole: IRole,
+  environment?: { [key: string]: string },
+  sqlLambdaVpcConfig?: VpcConfig,
+): IFunction => {
+  const { RDSPatchingLambdaLogicalID } = ResourceConstants.RESOURCES;
+  return apiGraphql.host.addLambdaFunction(
+    RDSPatchingLambdaLogicalID,
+    `functions/${RDSPatchingLambdaLogicalID}.zip`,
+    'index.handler',
+    path.resolve(__dirname, '..', '..', '..', 'lib', 'rds-patching-lambda.zip'),
+    Runtime.NODEJS_18_X,
     [],
     lambdaRole,
     environment,
-    undefined,
+    Duration.seconds(60),
     stack,
+    sqlLambdaVpcConfig,
   );
 };
 
+/**
+ * Create RDS Lambda IAM role
+ * @param roleName string
+ * @param stack Construct
+ * @param secretEntry RDSConnectionSecrets
+ */
 export const createRdsLambdaRole = (roleName: string, stack: Construct, secretEntry: RDSConnectionSecrets): IRole => {
-  const { RDSLambdaIAMRoleLogicalID } = ResourceConstants.RESOURCES;
+  const { RDSLambdaIAMRoleLogicalID, RDSLambdaLogAccessPolicy } = ResourceConstants.RESOURCES;
   const role = new Role(stack, RDSLambdaIAMRoleLogicalID, {
     assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
     roleName,
@@ -73,48 +208,124 @@ export const createRdsLambdaRole = (roleName: string, stack: Construct, secretEn
       actions: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
       effect: Effect.ALLOW,
       resources: ['arn:aws:logs:*:*:*'],
-    })
+    }),
   ];
   if (secretEntry) {
     policyStatements.push(
       new PolicyStatement({
         actions: ['ssm:GetParameter', 'ssm:GetParameters'],
         effect: Effect.ALLOW,
-        resources: [`arn:aws:ssm:*:*:parameter${secretEntry.username}`, `arn:aws:ssm:*:*:parameter${secretEntry.password}`],
-      })
-    )
+        resources: [
+          `arn:aws:ssm:*:*:parameter${secretEntry.username}`,
+          `arn:aws:ssm:*:*:parameter${secretEntry.password}`,
+          `arn:aws:ssm:*:*:parameter${secretEntry.host}`,
+          `arn:aws:ssm:*:*:parameter${secretEntry.database}`,
+          `arn:aws:ssm:*:*:parameter${secretEntry.port}`,
+        ],
+      }),
+    );
   }
-  role.attachInlinePolicy(
-    new Policy(stack, 'CloudwatchLogsAccess', {
-      statements: policyStatements,
+
+  role.attachInlinePolicy(new Policy(stack, RDSLambdaLogAccessPolicy, {
+    statements: policyStatements,
+    policyName: `${roleName}Policy`,
+  }));
+
+  role.addToPolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      resources: ['*'],
+      actions: [
+        'ec2:CreateNetworkInterface',
+        'ec2:DescribeNetworkInterfaces',
+        'ec2:DeleteNetworkInterface',
+      ],
     }),
   );
 
   return role;
 };
 
-export const generateLambdaRequestTemplate = (tableName: string, operation: string, operationName: string): string => {
-  return printBlock('Invoke RDS Lambda data source')(
-    compoundExpression([
-      set(ref('lambdaInput'), obj({})),
-      set(ref('lambdaInput.args'), obj({})),
-      set(ref('lambdaInput.table'), str(tableName)),
-      set(ref('lambdaInput.operation'), str(operation)),
-      set(ref('lambdaInput.operationName'), str(operationName)),
-      set(ref('lambdaInput.args.metadata'), obj({})),
-      set(ref('lambdaInput.args.metadata.keys'), list([])),
-      qref(methodCall(ref('lambdaInput.args.metadata.keys.addAll'), methodCall(ref('util.defaultIfNull'), ref('ctx.stash.keys'), list([])))),
-      set(ref('lambdaInput.args.input'), methodCall(ref('util.defaultIfNull'), ref('ctx.stash.defaultValues'), obj({}))),
-      qref(methodCall(ref('lambdaInput.args.input.putAll'), methodCall(ref('util.defaultIfNull'), ref('context.arguments'), obj({})))),
-      obj({
-        version: str('2018-05-29'),
-        operation: str('Invoke'),
-        payload: methodCall(ref('util.toJson'), ref('lambdaInput')),
-      }),
-    ]),
+/**
+ * Create RDS Patching Lambda IAM role
+ * @param roleName string
+ * @param stack Construct
+ * @param functionArn FunctionArn
+ */
+export const createRdsPatchingLambdaRole = (roleName: string, stack: Construct, functionArn: string): IRole => {
+  const { RDSPatchingLambdaIAMRoleLogicalID, RDSPatchingLambdaLogAccessPolicy } = ResourceConstants.RESOURCES;
+  const role = new Role(stack, RDSPatchingLambdaIAMRoleLogicalID, {
+    assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
+    roleName,
+  });
+  const policyStatements = [
+    new PolicyStatement({
+      actions: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
+      effect: Effect.ALLOW,
+      resources: ['arn:aws:logs:*:*:*'],
+    }),
+    new PolicyStatement({
+      actions: ['lambda:UpdateFunctionConfiguration'],
+      effect: Effect.ALLOW,
+      resources: [functionArn],
+    }),
+    new PolicyStatement({
+      actions: ['lambda:GetLayerVersion', 'lambda:GetLayerVersionPolicy'],
+      effect: Effect.ALLOW,
+      resources: ['*'],
+    }),
+  ];
+
+  role.attachInlinePolicy(new Policy(stack, RDSPatchingLambdaLogAccessPolicy, {
+    statements: policyStatements,
+    policyName: `${roleName}Policy`,
+  }));
+
+  role.addToPolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      resources: ['*'],
+      actions: [
+        'ec2:CreateNetworkInterface',
+        'ec2:DescribeNetworkInterfaces',
+        'ec2:DeleteNetworkInterface',
+      ],
+    }),
   );
+
+  return role;
 };
 
+/**
+ * Generate RDS Lambda request template
+ * @param tableName string
+ * @param operation string
+ * @param operationName string
+ */
+export const generateLambdaRequestTemplate = (tableName: string, operation: string, operationName: string): string => printBlock('Invoke RDS Lambda data source')(
+  compoundExpression([
+    set(ref('lambdaInput'), obj({})),
+    set(ref('lambdaInput.args'), obj({})),
+    set(ref('lambdaInput.table'), str(tableName)),
+    set(ref('lambdaInput.operation'), str(operation)),
+    set(ref('lambdaInput.operationName'), str(operationName)),
+    set(ref('lambdaInput.args.metadata'), obj({})),
+    set(ref('lambdaInput.args.metadata.keys'), list([])),
+    qref(methodCall(ref('lambdaInput.args.metadata.keys.addAll'), methodCall(ref('util.defaultIfNull'), ref('ctx.stash.keys'), list([])))),
+    set(ref('lambdaInput.args.input'), methodCall(ref('util.defaultIfNull'), ref('ctx.stash.defaultValues'), obj({}))),
+    qref(methodCall(ref('lambdaInput.args.input.putAll'), methodCall(ref('util.defaultIfNull'), ref('context.arguments'), obj({})))),
+    obj({
+      version: str('2018-05-29'),
+      operation: str('Invoke'),
+      payload: methodCall(ref('util.toJson'), ref('lambdaInput')),
+    }),
+  ]),
+);
+
+/**
+ * Generate RDS Lambda response template
+ * @param isSyncEnabled boolean
+ */
 export const generateGetLambdaResponseTemplate = (isSyncEnabled: boolean): string => {
   const statements: Expression[] = [];
   if (isSyncEnabled) {
@@ -137,6 +348,8 @@ export const generateGetLambdaResponseTemplate = (isSyncEnabled: boolean): strin
 /**
  * Generate common response template used by most of the resolvers.
  * Append operation if response is coming from a mutation, this is to protect field resolver for subscriptions
+ * @param isSyncEnabled boolean
+ * @param mutation boolean
  */
 export const generateDefaultLambdaResponseMappingTemplate = (isSyncEnabled: boolean, mutation = false): string => {
   const statements: Expression[] = [];

package/src/resources/model-resource-generator.ts

@@ -333,10 +333,11 @@ export abstract class ModelResourceGenerator {
         operationName: fieldName,
         modelConfig: this.modelDirectiveMap.get(type.name.value)!,
       };
+      const initializeIdField = !!type.fields!.find((field) => field.name.value === 'id');
       resolver.addToSlot(
         'init',
         MappingTemplate.s3MappingTemplateFromString(
-          vtlGenerator.generateCreateInitSlotTemplate(initSlotConfig),
+          vtlGenerator.generateCreateInitSlotTemplate(initSlotConfig, initializeIdField),
           `${typeName}.${fieldName}.{slotName}.{slotIndex}.req.vtl`,
         ),
       );

package/src/resources/rds-model-resource-generator.ts

@@ -1,12 +1,24 @@
+import { MYSQL_DB_TYPE, RDSConnectionSecrets } from '@aws-amplify/graphql-transformer-core';
 import { TransformerContextProvider } from '@aws-amplify/graphql-transformer-interfaces';
+import { Topic } from 'aws-cdk-lib/aws-sns';
+import { LambdaSubscription } from 'aws-cdk-lib/aws-sns-subscriptions';
 import { ResourceConstants } from 'graphql-transformer-common';
-import { MYSQL_DB_TYPE, RDSConnectionSecrets } from '@aws-amplify/graphql-transformer-core';
-import { ModelResourceGenerator } from './model-resource-generator';
 import { ModelVTLGenerator, RDSModelVTLGenerator } from '../resolvers';
-import { createRdsLambda, createRdsLambdaRole } from '../resolvers/rds';
+import {
+  createRdsLambda,
+  createRdsLambdaRole,
+  createRdsPatchingLambda,
+  createRdsPatchingLambdaRole,
+  setRDSLayerMappings,
+} from '../resolvers/rds';
+import { ModelResourceGenerator } from './model-resource-generator';
+import { Fn } from 'aws-cdk-lib';
+import { SubscriptionFilter } from 'aws-cdk-lib/aws-sns';
 
 export const RDS_STACK_NAME = 'RdsApiStack';
-
+// Beta SNS topic - 'arn:aws:sns:us-east-1:956468067974:AmplifyRDSLayerNotification'
+// PROD SNS topic - 'arn:aws:sns:us-east-1:582037449441:AmplifyRDSLayerNotification'
+const RDS_PATCHING_SNS_TOPIC_ARN = 'arn:aws:sns:us-east-1:582037449441:AmplifyRDSLayerNotification';
 /**
  * An implementation of ModelResourceGenerator responsible for generated CloudFormation resources
  * for models backed by an RDS data source
@@ -19,16 +31,21 @@ export class RdsModelResourceGenerator extends ModelResourceGenerator {
       const secretEntry = context.datasourceSecretParameterLocations.get(MYSQL_DB_TYPE);
       const {
         RDSLambdaIAMRoleLogicalID,
+        RDSPatchingLambdaIAMRoleLogicalID,
         RDSLambdaLogicalID,
+        RDSPatchingLambdaLogicalID,
         RDSLambdaDataSourceLogicalID,
+        RDSPatchingSubscriptionLogicalID,
       } = ResourceConstants.RESOURCES;
       const lambdaRoleStack = context.stackManager.getStackFor(RDSLambdaIAMRoleLogicalID, RDS_STACK_NAME);
       const lambdaStack = context.stackManager.getStackFor(RDSLambdaLogicalID, RDS_STACK_NAME);
+      setRDSLayerMappings(lambdaStack);
       const role = createRdsLambdaRole(
         context.resourceHelper.generateIAMRoleName(RDSLambdaIAMRoleLogicalID),
         lambdaRoleStack,
         secretEntry as RDSConnectionSecrets,
       );
+
       const lambda = createRdsLambda(
         lambdaStack,
         context.api,
@@ -40,8 +57,39 @@ export class RdsModelResourceGenerator extends ModelResourceGenerator {
           port: secretEntry?.port ?? '',
           database: secretEntry?.database ?? '',
         },
+        context.sqlLambdaVpcConfig,
+      );
+
+      const patchingLambdaRoleStack = context.stackManager.getStackFor(RDSPatchingLambdaIAMRoleLogicalID, RDS_STACK_NAME);
+      const patchingLambdaStack = context.stackManager.getStackFor(RDSPatchingLambdaLogicalID, RDS_STACK_NAME);
+      const patchingLambdaRole = createRdsPatchingLambdaRole(
+        context.resourceHelper.generateIAMRoleName(RDSPatchingLambdaIAMRoleLogicalID),
+        patchingLambdaRoleStack,
+        lambda.functionArn,
+      );
+
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      const patchingLambda = createRdsPatchingLambda(
+        patchingLambdaStack,
+        context.api,
+        patchingLambdaRole,
+        {
+          LAMBDA_FUNCTION_ARN: lambda.functionArn,
+        },
       );
 
+      // Add SNS subscription for patching notifications
+      const patchingSubscriptionStack = context.stackManager.getStackFor(RDSPatchingSubscriptionLogicalID, RDS_STACK_NAME);
+      const snsTopic = Topic.fromTopicArn(patchingSubscriptionStack, 'RDSPatchingTopic', RDS_PATCHING_SNS_TOPIC_ARN);
+      const subscription = new LambdaSubscription(patchingLambda, {
+        filterPolicy: {
+          Region: SubscriptionFilter.stringFilter({
+            allowlist: [Fn.ref('AWS::Region')],
+          }),
+        },
+      });
+      snsTopic.addSubscription(subscription);
+
       const lambdaDataSourceStack = context.stackManager.getStackFor(RDSLambdaDataSourceLogicalID, RDS_STACK_NAME);
       const rdsDatasource = context.api.host.addLambdaDataSource(
         `${RDSLambdaDataSourceLogicalID}`,