@aws/nx-plugin-mcp 1.0.0-rc.81 → 1.0.0-rc.83

package/docs/guides/connection/py-agent-dynamodb.mdx

@@ -70,42 +70,41 @@ table.grantReadWriteData(myAgent);
 </Fragment>
 <Fragment slot="terraform">
 
+Grant the agent's runtime role access to the table and its KMS encryption key via `additional_iam_policy_statements`:
+
 ```hcl title="packages/infra/src/main.tf"
 module "my_table" {
   source = "../../common/terraform/src/app/dynamodb/my-table"
 }
 
-resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_agent.lambda_role_name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
-          "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
-        ]
-        Resource = [
-          module.my_table.table_arn,
-          "${module.my_table.table_arn}/index/*",
-        ]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey"
-        ]
-        Resource = [module.my_table.kms_key_arn]
-      },
-    ]
-  })
+module "my_agent" {
+  source = "../../common/terraform/src/app/agents/my-agent"
+
+  additional_iam_policy_statements = [
+    {
+      Effect = "Allow"
+      Action = [
+        "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
+        "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
+      ]
+      Resource = [
+        module.my_table.table_arn,
+        "${module.my_table.table_arn}/index/*",
+      ]
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey",
+      ]
+      Resource = [module.my_table.kms_key_arn]
+    },
+  ]
 }
 ```
 </Fragment>

package/docs/guides/connection/py-agent-rdb.mdx

@@ -146,16 +146,7 @@ resource "aws_vpc_security_group_egress_rule" "agent_to_database" {
 }
 ```
 
-`appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module. Include the `database` namespace when instantiating it so the database module's runtime configuration entry is deployed:
-
-```hcl title="packages/infra/src/main.tf"
-module "runtime_config_appconfig" {
-  source = "../../common/terraform/src/core/runtime-config/appconfig"
-
-  application_name = "my-app-runtime-config"
-  namespaces       = ["connection", "agentcore", "database"]
-}
-```
+`appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module. That application exposes the `database` namespace by default, so the database module's runtime configuration entry is deployed without further configuration.
 
 </Fragment>
 </Infrastructure>

package/docs/guides/connection/py-fast-api-rdb.mdx

@@ -163,16 +163,7 @@ resource "aws_vpc_security_group_egress_rule" "api_to_database" {
 
 Deploy the API Lambda functions into **private subnets with egress**, not private isolated subnets. `appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module — passing them sets `RUNTIME_CONFIG_APP_ID` on the Lambda functions and grants them read access to the application.
 
-The AppConfig application must expose the `database` namespace so the database module's runtime configuration entry is deployed. Include it in the `namespaces` when instantiating the `runtime-config/appconfig` module:
-
-```hcl title="packages/infra/src/main.tf"
-module "runtime_config_appconfig" {
-  source = "../../common/terraform/src/core/runtime-config/appconfig"
-
-  application_name = "my-app-runtime-config"
-  namespaces       = ["connection", "agentcore", "database"]
-}
-```
+The AppConfig application exposes the `database` namespace by default, so the database module's runtime configuration entry is deployed without further configuration.
 
 </Fragment>
 </Infrastructure>

package/docs/guides/connection/py-mcp-server-dynamodb.mdx

@@ -70,42 +70,41 @@ table.grantReadWriteData(myMcpServer);
 </Fragment>
 <Fragment slot="terraform">
 
+Grant the MCP server's runtime role access to the table and its KMS encryption key via `additional_iam_policy_statements`:
+
 ```hcl title="packages/infra/src/main.tf"
 module "my_table" {
   source = "../../common/terraform/src/app/dynamodb/my-table"
 }
 
-resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_mcp_server.lambda_role_name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
-          "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
-        ]
-        Resource = [
-          module.my_table.table_arn,
-          "${module.my_table.table_arn}/index/*",
-        ]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey"
-        ]
-        Resource = [module.my_table.kms_key_arn]
-      },
-    ]
-  })
+module "my_mcp_server" {
+  source = "../../common/terraform/src/app/mcp-servers/my-mcp-server"
+
+  additional_iam_policy_statements = [
+    {
+      Effect = "Allow"
+      Action = [
+        "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
+        "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
+      ]
+      Resource = [
+        module.my_table.table_arn,
+        "${module.my_table.table_arn}/index/*",
+      ]
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey",
+      ]
+      Resource = [module.my_table.kms_key_arn]
+    },
+  ]
 }
 ```
 </Fragment>

package/docs/guides/connection/py-mcp-server-rdb.mdx

@@ -155,16 +155,7 @@ resource "aws_vpc_security_group_egress_rule" "mcp_server_to_database" {
 }
 ```
 
-`appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module. Include the `database` namespace when instantiating it so the database module's runtime configuration entry is deployed:
-
-```hcl title="packages/infra/src/main.tf"
-module "runtime_config_appconfig" {
-  source = "../../common/terraform/src/core/runtime-config/appconfig"
-
-  application_name = "my-app-runtime-config"
-  namespaces       = ["connection", "agentcore", "database"]
-}
-```
+`appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module. That application exposes the `database` namespace by default, so the database module's runtime configuration entry is deployed without further configuration.
 
 </Fragment>
 </Infrastructure>

package/docs/guides/connection/ts-agent-dynamodb.mdx

@@ -82,42 +82,41 @@ table.grantReadWriteData(myAgent);
 </Fragment>
 <Fragment slot="terraform">
 
+Grant the agent's runtime role access to the table and its KMS encryption key via `additional_iam_policy_statements`:
+
 ```hcl title="packages/infra/src/main.tf"
 module "my_table" {
   source = "../../common/terraform/src/app/dynamodb/my-table"
 }
 
-resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_agent.lambda_role_name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
-          "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
-        ]
-        Resource = [
-          module.my_table.table_arn,
-          "${module.my_table.table_arn}/index/*",
-        ]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey"
-        ]
-        Resource = [module.my_table.kms_key_arn]
-      },
-    ]
-  })
+module "my_agent" {
+  source = "../../common/terraform/src/app/agents/my-agent"
+
+  additional_iam_policy_statements = [
+    {
+      Effect = "Allow"
+      Action = [
+        "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
+        "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
+      ]
+      Resource = [
+        module.my_table.table_arn,
+        "${module.my_table.table_arn}/index/*",
+      ]
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey",
+      ]
+      Resource = [module.my_table.kms_key_arn]
+    },
+  ]
 }
 ```
 </Fragment>

package/docs/guides/connection/ts-agent-rdb.mdx

@@ -161,16 +161,7 @@ resource "aws_vpc_security_group_egress_rule" "agent_to_database" {
 }
 ```
 
-`appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module. Include the `database` namespace when instantiating it so the database module's runtime configuration entry is deployed:
-
-```hcl title="packages/infra/src/main.tf"
-module "runtime_config_appconfig" {
-  source = "../../common/terraform/src/core/runtime-config/appconfig"
-
-  application_name = "my-app-runtime-config"
-  namespaces       = ["connection", "agentcore", "database"]
-}
-```
+`appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module. That application exposes the `database` namespace by default, so the database module's runtime configuration entry is deployed without further configuration.
 
 </Fragment>
 </Infrastructure>

package/docs/guides/connection/ts-mcp-server-dynamodb.mdx

@@ -79,42 +79,41 @@ table.grantReadWriteData(myMcpServer);
 </Fragment>
 <Fragment slot="terraform">
 
+Grant the MCP server's runtime role access to the table and its KMS encryption key via `additional_iam_policy_statements`:
+
 ```hcl title="packages/infra/src/main.tf"
 module "my_table" {
   source = "../../common/terraform/src/app/dynamodb/my-table"
 }
 
-resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_mcp_server.lambda_role_name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
-          "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
-        ]
-        Resource = [
-          module.my_table.table_arn,
-          "${module.my_table.table_arn}/index/*",
-        ]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey",
-        ]
-        Resource = [module.my_table.kms_key_arn]
-      },
-    ]
-  })
+module "my_mcp_server" {
+  source = "../../common/terraform/src/app/mcp-servers/my-mcp-server"
+
+  additional_iam_policy_statements = [
+    {
+      Effect = "Allow"
+      Action = [
+        "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
+        "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
+      ]
+      Resource = [
+        module.my_table.table_arn,
+        "${module.my_table.table_arn}/index/*",
+      ]
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey",
+      ]
+      Resource = [module.my_table.kms_key_arn]
+    },
+  ]
 }
 ```
 </Fragment>

package/docs/guides/connection/ts-mcp-server-rdb.mdx

@@ -160,16 +160,7 @@ resource "aws_vpc_security_group_egress_rule" "mcp_server_to_database" {
 }
 ```
 
-`appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module. Include the `database` namespace when instantiating it so the database module's runtime configuration entry is deployed:
-
-```hcl title="packages/infra/src/main.tf"
-module "runtime_config_appconfig" {
-  source = "../../common/terraform/src/core/runtime-config/appconfig"
-
-  application_name = "my-app-runtime-config"
-  namespaces       = ["connection", "agentcore", "database"]
-}
-```
+`appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module. That application exposes the `database` namespace by default, so the database module's runtime configuration entry is deployed without further configuration.
 
 </Fragment>
 </Infrastructure>

package/docs/guides/react-website.mdx

@@ -602,7 +602,7 @@ If you change the prefix for your stage names in your infrastructure project's `
 Additionally it's worth noting that the `load-runtime-config` target assumes a single stage of your application is deployed to the environment you have AWS credentials for. You will need to adjust the command if you deploy multiple stages to the same account and region.
 </Fragment>
 <Fragment slot="terraform">
-For Terraform projects, the `load-runtime-config` target copies the `runtime-config.json` file that was created after your most recent local `terraform apply`.
+For Terraform projects, the `load-runtime-config` target copies the runtime config your most recent local `terraform apply` aggregated, from `dist/packages/common/terraform/runtime-config/connection.json`.
 </Fragment>
 </Infrastructure>
 :::

package/docs/guides/runtime-config.mdx

@@ -12,17 +12,19 @@ Runtime configuration is the mechanism used by Nx Plugin for AWS to pass deploy-
 
 Runtime configuration is organised into **namespaces**. Each namespace is a logical grouping of related configuration values. At deploy time, all namespaces are stored in **AWS AppConfig** as Configuration Profiles.
 
-Two built-in namespaces are used by generated constructs:
+Four built-in namespaces are used by generated constructs:
 
 - **`connection`** — configuration that enables generated projects to connect to each other:
   - **API URLs** — registered automatically by API constructs
   - **Cognito settings** — registered automatically by the UserIdentity construct
   - **Agent runtime ARNs** — added by the connection generator when you connect a React website to an Agent
 - **`agentcore`** — AgentCore runtime ARNs for agents and MCP servers. Registered automatically by the agent/MCP constructs and used for server-side discovery (agent → agent via A2A, agent → MCP server).
+- **`dynamodb`** — table names, registered automatically by DynamoDB table constructs and read by the generated table client.
+- **`database`** — Aurora connection details, registered automatically by relational database constructs and read by the generated database client.
 
-The `connection` namespace is also deployed as a `runtime-config.json` file to your website's S3 bucket, enabling client-side discovery of backend resources. The `agentcore` namespace is server-side only (via AppConfig) so agent runtime ARNs are not exposed to the frontend unless you explicitly connect a website to an agent.
+The `connection` namespace is also deployed as a `runtime-config.json` file to your website's S3 bucket, enabling client-side discovery of backend resources. The other namespaces are server-side only (via AppConfig), so values such as agent runtime ARNs and table names are not exposed to the frontend unless you explicitly connect a website to them.
 
-You can define as many additional namespaces as you like, providing a convenient alternative to environment variables for passing deploy-time values such as DynamoDB table names to your Lambda functions or other compute resources.
+You can define as many additional namespaces as you like, providing a convenient alternative to environment variables for passing deploy-time values to your Lambda functions or other compute resources.
 
 ```d2
 direction: down
@@ -107,6 +109,17 @@ Terraform wires runtime configuration across three `core/runtime-config/*` modul
    }
    ```
 
+   The `namespaces` variable defaults to every built-in namespace, so generated modules work without configuring it. To add namespaces of your own, list them alongside the built-in ones:
+
+   ```hcl title="packages/infra/src/main.tf"
+   module "runtime_config_appconfig" {
+     source = "../../common/terraform/src/core/runtime-config/appconfig"
+
+     application_name = "my-app-runtime-config"
+     namespaces       = ["connection", "agentcore", "database", "dynamodb", "tables"]
+   }
+   ```
+
 2. **`core/runtime-config/entry`** — one invocation per contribution. Generated API, agent and MCP modules call this internally to publish their URLs and ARNs. Call it directly to publish custom configuration.
 
    ```hcl title="packages/infra/src/main.tf"

package/docs/snippets/connection/lambda-dynamodb-access.mdx

@@ -38,7 +38,7 @@ module "my_table" {
 }
 
 resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_api.lambda_role_name
+  role = module.my_api.lambda_execution_role_name
 
   policy = jsonencode({
     Version = "2012-10-17"

package/docs/snippets/connection/rdb-api-infrastructure.mdx

@@ -89,16 +89,7 @@ resource "aws_vpc_security_group_egress_rule" "api_to_database" {
 }
 ```
 
-Deploy the API Lambda functions into **private subnets with egress**, not private isolated subnets. `appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module — passing them sets `RUNTIME_CONFIG_APP_ID` on the Lambda functions and grants them read access to the application. Include the `database` namespace when instantiating it so the database module's runtime configuration entry is deployed:
-
-```hcl title="packages/infra/src/main.tf"
-module "runtime_config_appconfig" {
-  source = "../../common/terraform/src/core/runtime-config/appconfig"
-
-  application_name = "my-app-runtime-config"
-  namespaces       = ["connection", "agentcore", "database"]
-}
-```
+Deploy the API Lambda functions into **private subnets with egress**, not private isolated subnets. `appconfig_application_id`/`appconfig_application_arn` come from the shared <Link path="guides/runtime-config">runtime configuration</Link> AppConfig application declared once in your root module, not from the database module — passing them sets `RUNTIME_CONFIG_APP_ID` on the Lambda functions and grants them read access to the application. That application exposes the `database` namespace by default, so the database module's runtime configuration entry is deployed without further configuration.
 
 </Fragment>
 </Infrastructure>

package/docs/snippets/dynamodb/deploying-table.mdx

@@ -46,27 +46,42 @@ This provisions a DynamoDB table with:
 - On-demand (`PAY_PER_REQUEST`) billing
 - Customer-managed KMS encryption with automatic key rotation
 - Point-in-time recovery enabled
-- Deletion protection enabled
-- Table name registered in Runtime Config
+- Deletion protection enabled, plus a `prevent_destroy` lifecycle guard
+- Table name registered in Runtime Config under the `dynamodb` namespace in AWS AppConfig
+
+The `core/runtime-config/appconfig` module exposes the `dynamodb` namespace by default, so the table name is deployed without further configuration. If you pass `namespaces` to that module explicitly, keep `dynamodb` in the list — otherwise no configuration profile is created for it and the generated table client cannot resolve the table name.
 </Fragment>
 </Infrastructure>
 
 ### Deletion Protection
 
-Deletion protection is enabled by default to prevent accidental table deletion.
+The table is protected by two independent guards, so that turning off either one alone cannot delete your data:
 
-#### Disable Deletion Protection
+<Infrastructure>
+<Fragment slot="cdk">
+- `deletionProtection`, enforced by DynamoDB.
+- `RemovalPolicy.RETAIN`, enforced by CloudFormation, which leaves the table in place when it is removed from the stack.
+</Fragment>
+<Fragment slot="terraform">
+- `deletion_protection_enabled`, enforced by DynamoDB.
+- `lifecycle { prevent_destroy = true }` on the table in `common/terraform/src/core/dynamodb/dynamodb.tf`, enforced by Terraform, which fails any plan that would destroy the table.
+</Fragment>
+</Infrastructure>
 
-Disable it for environments where table deletion is expected, such as short-lived development or preview stacks.
+#### Deleting the Table
+
+Disable protection for environments where table deletion is expected, such as short-lived development or preview stacks.
 
 <Infrastructure>
 <Fragment slot="cdk">
 
 ```ts title="packages/infra/src/stacks/application-stack.ts"
+import { RemovalPolicy } from 'aws-cdk-lib';
 import { MyTable } from '@my-scope/common-constructs';
 
 const table = new MyTable(this, 'Table', {
   deletionProtection: false,
+  removalPolicy: RemovalPolicy.DESTROY,
 });
 ```
 </Fragment>
@@ -78,6 +93,22 @@ module "my_table" {
   deletion_protection_enabled = false
 }
 ```
+
+`prevent_destroy` must be a literal — Terraform does not allow it to reference a variable — so it cannot be turned off from `main.tf`. Also remove the `lifecycle` block from the table in `common/terraform/src/core/dynamodb/dynamodb.tf`:
+
+```hcl title="packages/common/terraform/src/core/dynamodb/dynamodb.tf" del={4-6}
+resource "aws_dynamodb_table" "table" {
+  # ...
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+```
+
+:::caution
+This module is shared by every table in your workspace, so removing the block removes that guard for all of them.
+:::
 </Fragment>
 </Infrastructure>
 

package/docs/snippets/rdb/deletion-protection.mdx

@@ -3,21 +3,34 @@ title: Deletion Protection
 ---
 import Infrastructure from '@components/infrastructure.astro';
 
-Deletion protection is enabled by default (`deletionProtection: true` in CDK, `deletion_protection = true` in Terraform) to protect the Aurora cluster from accidental deletion.
+The Aurora cluster is protected by two independent guards, so that turning off either one alone cannot delete your data:
 
-#### Disable Deletion Protection
+<Infrastructure>
+<Fragment slot="cdk">
+- `deletionProtection`, enforced by RDS.
+- `RemovalPolicy.RETAIN`, enforced by CloudFormation, which leaves the cluster in place when it is removed from the stack.
+</Fragment>
+<Fragment slot="terraform">
+- `deletion_protection`, enforced by RDS.
+- `lifecycle { prevent_destroy = true }` on the cluster in `common/terraform/src/core/rdb/aurora/aurora.tf`, enforced by Terraform, which fails any plan that would destroy the cluster.
+</Fragment>
+</Infrastructure>
+
+#### Deleting the Database
 
-You can disable deletion protection for environments where database deletion is expected, such as short-lived development or preview stacks.
+You can disable protection for environments where database deletion is expected, such as short-lived development or preview stacks.
 
 <Infrastructure>
 <Fragment slot="cdk">
 
 ```ts title="packages/infra/src/stacks/application-stack.ts"
+import { RemovalPolicy } from 'aws-cdk-lib';
 import { MyDatabase } from '@my-scope/common-constructs';
 
 const db = new MyDatabase(this, 'Db', {
   ...
   deletionProtection: false,
+  removalPolicy: RemovalPolicy.DESTROY,
 });
 ```
 </Fragment>
@@ -28,7 +41,24 @@ module "my_database" {
   source = "../../common/terraform/src/app/dbs/my-database"
   ...
   deletion_protection = false
+  skip_final_snapshot = true
 }
 ```
+
+`prevent_destroy` must be a literal — Terraform does not allow it to reference a variable — so it cannot be turned off from `main.tf`. Also remove the `lifecycle` block from the cluster in `common/terraform/src/core/rdb/aurora/aurora.tf`:
+
+```hcl title="packages/common/terraform/src/core/rdb/aurora/aurora.tf" del={4-6}
+resource "aws_rds_cluster" "database" {
+  # ...
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+```
+
+:::caution
+This module is shared by every database in your workspace, so removing the block removes that guard for all of them.
+:::
 </Fragment>
 </Infrastructure>

package/docs/snippets/rdb/deploying.mdx

@@ -52,16 +52,7 @@ module "my_database" {
 
 This provisions an Aurora cluster with RDS Proxy, admin credentials, create-db-user Lambda, runtime config registration, migration Lambda, and container registry resources.
 
-The database module registers its connection details under the `database` runtime configuration namespace. Include this namespace when instantiating the shared runtime configuration AppConfig application:
-
-```hcl title="packages/infra/src/main.tf"
-module "runtime_config_appconfig" {
-  source = "../../common/terraform/src/core/runtime-config/appconfig"
-
-  application_name = "my-app-runtime-config"
-  namespaces       = ["connection", "agentcore", "database"]
-}
-```
+The database module registers its connection details under the `database` <Link path="guides/runtime-config">runtime configuration</Link> namespace, which the shared runtime configuration AppConfig application exposes by default.
 
 The generated infrastructure creates two database users:
 - **Admin user** - Created during cluster provisioning with credentials stored in AWS Secrets Manager

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin-mcp",
-  "version": "1.0.0-rc.81",
+  "version": "1.0.0-rc.83",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",