@aws/nx-plugin-mcp 1.0.0-rc.82 → 1.0.0-rc.84

package/docs/guides/agentcore-harness.mdx

@@ -94,7 +94,7 @@ const harness = new MyHarness(this, 'MyHarness', {
 
 The construct also accepts:
 
-- `allowedTools` — the tools the Harness may use. The Harness deploys with none unless you supply them, see <a href="#configuring-tools">Configuring tools</a>.
+- `allowedTools` — the tools the Harness may use. Defaults to none, see <a href="#configuring-tools">Configuring tools</a>.
 - `executionRole` — an existing IAM role to use instead of the generated role. A supplied role is used as-is: the baseline permissions are not added to it, and its ARN always feeds the Harness (the raw `executionRoleArn` string cannot be overridden).
 - `modelResourceArns` — the Bedrock model and inference-profile ARNs the generated execution role may invoke, replacing the default list.
 - `vpc`, `vpcSubnets` and `securityGroups` — run the Harness in a VPC so it can reach private resources, see <a href="#running-in-a-vpc">Running in a VPC</a>.
@@ -112,15 +112,21 @@ module "my_harness" {
 }
 ```
 
-The module exposes three variables:
+The module exposes the following variables:
 
 - `model_id` — the Bedrock model or inference profile the Harness uses by default.
-- `model_resource_arns` — the Bedrock model and inference-profile ARNs the execution role may invoke, replacing the default list.
-- `additional_execution_role_policy_statements` — a list of IAM statement objects (`Effect`, `Action`, `Resource`, optional `Sid` and `Condition`) appended to the execution role policy.
+- `allowed_tools` — the tools the Harness may use. Defaults to none, see <a href="#configuring-tools">Configuring tools</a>.
+- `memory` — the Harness memory configuration, see <a href="#configuring-memory">Configuring memory</a>.
+- `environment_variables`, `max_iterations`, `timeout_seconds` — the corresponding native Harness fields.
+- `execution_role_arn` — an existing IAM role to use instead of the generated role. A supplied role is used as-is: neither the role nor its baseline policy is created, so `model_resource_arns` and `additional_execution_role_policy_statements` cannot be combined with it.
+- `model_resource_arns` — the Bedrock model and inference-profile ARNs the generated execution role may invoke, replacing the default list.
+- `additional_execution_role_policy_statements` — a list of IAM statement objects (`Effect`, `Action`, `Resource`, optional `Sid` and `Condition`) appended to the generated execution role policy.
+- `enable_vpc`, `vpc_id`, `subnet_ids` — run the Harness in a VPC so it can reach private resources, see <a href="#running-in-a-vpc">Running in a VPC</a>.
+- `tags` — tags applied to the resources the module creates.
 
-Everything else is configured on the generated `aws_bedrockagentcore_harness` resource in the module itself.
+Other provider-native fields are configured by editing the generated `aws_bedrockagentcore_harness` resource in the module itself, see <a href="#customizing-your-harness">Customizing your Harness</a>.
 
-The module outputs `harness_id`, `harness_arn`, and `execution_role_arn`.
+The module outputs `harness_id`, `harness_arn`, `execution_role_arn` and `security_group_id`.
 
 Deploy with your Terraform project's plan/apply workflow as usual — see the <Link path="guides/terraform-project">Terraform project guide</Link>.
   </Fragment>
@@ -196,7 +202,7 @@ With neither set, the script fails with an error naming both options.
 Every native Harness property of the pinned `aws-cdk-lib/aws-bedrockagentcore` module is available through the construct's props — alternate model providers, tool definitions, memory, skills, environment configuration, truncation, custom JWT authorization, and execution limits — and explicit props take precedence over the generated defaults. Alternatively, edit the generated construct in `packages/common/constructs/src/app/harnesses/<name>/<name>.ts`.
   </Fragment>
   <Fragment slot="terraform">
-The generated module keeps the native `aws_bedrockagentcore_harness` resource directly editable, so provider-native fields — alternate model providers (`gemini_model_config`, `openai_model_config`), `tool` blocks, `memory`, `skill` blocks, environments (`environment`, `environment_variables`, `environment_artifact`), `truncation`, and `authorizer_configuration` with a `custom_jwt_authorizer` — are configured by editing `packages/common/terraform/src/app/harnesses/<name>/<name>.tf`.
+The module's variables cover the fields most deployments configure — `model_id`, `allowed_tools`, `memory`, `environment_variables`, `max_iterations`, `timeout_seconds` — plus the execution role and VPC placement. Terraform has no equivalent of the CDK construct's prop spread, so the remaining provider-native fields are configured by editing the `aws_bedrockagentcore_harness` resource in `packages/common/terraform/src/app/harnesses/<name>/<name>.tf`: alternate model providers (`gemini_model_config`, `openai_model_config`), `tool` blocks, `skill` blocks, `environment_artifact`, filesystem and lifecycle configuration under `environment`, `truncation`, and `authorizer_configuration` with a `custom_jwt_authorizer`.
   </Fragment>
 </Infrastructure>
 
@@ -213,19 +219,47 @@ new MyHarness(this, 'Harness', { allowedTools: ['@builtin'] });
 ```
   </Fragment>
   <Fragment slot="terraform">
-```hcl title="packages/common/terraform/src/app/harnesses/my-harness/my-harness.tf"
-resource "aws_bedrockagentcore_harness" "this" {
-  # ...
+```hcl title="packages/infra/src/main.tf"
+module "my_harness" {
+  source        = "../../common/terraform/src/app/harnesses/my-harness"
   allowed_tools = ["@builtin"]
 }
 ```
-
-Add an `allowed_tools` variable to the module if you would rather set it as a module argument where you reference the module.
   </Fragment>
 </Infrastructure>
 
 Narrow `@builtin` to specific patterns such as `@builtin/file_operations` to restrict what the agent loop can do. See [Harness tools](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/harness-tools.html) for the built-in tools you can add.
 
+### Configuring memory
+
+The service provisions managed memory for the Harness by default, and the generated execution role is granted access to it — scoped to the memory ARN the service assigns, and only granted while the Harness uses managed memory the infrastructure created. Configure memory explicitly to tune that managed memory, point the Harness at a memory resource you own, or turn memory off:
+
+<Infrastructure>
+  <Fragment slot="cdk">
+```ts
+new MyHarness(this, 'MyHarness', {
+  memory: { managedMemoryConfiguration: { strategies: ['SUMMARIZATION'] } },
+});
+```
+
+Supplying `memory` at all replaces the default managed memory, so the construct leaves the memory grant off the execution role: add whatever the configuration needs with `addToRolePolicy`.
+  </Fragment>
+  <Fragment slot="terraform">
+```hcl
+module "my_harness" {
+  source = "../../common/terraform/src/app/harnesses/my-harness"
+  memory = {
+    managed_memory_configuration = {
+      strategies = ["SUMMARIZATION"]
+    }
+  }
+}
+```
+
+Set exactly one of `managed_memory_configuration` (tune the service's managed memory), `agentcore_memory_configuration` (use a memory resource you own, by ARN) or `disabled` (no memory). Choosing `agentcore_memory_configuration` or `disabled` drops the managed-memory grant from the execution role; for your own memory resource, grant access through `additional_execution_role_policy_statements`.
+  </Fragment>
+</Infrastructure>
+
 ### Running in a VPC
 
 <Infrastructure>
@@ -241,28 +275,31 @@ database.connections.allowDefaultPortFrom(harness, 'Harness to database');
 The Harness is placed in the VPC's private subnets with egress, in a security group created for it. Override either with `vpcSubnets` and `securityGroups`. Both require `vpc`, and `connections` is only available when the Harness runs in a VPC.
   </Fragment>
   <Fragment slot="terraform">
-Add a `network_configuration` block to the generated `aws_bedrockagentcore_harness` resource's `environment.agent_core_runtime_environment`, then reference the security group you place it in from your other resources' rules:
+Set `enable_vpc` alongside `vpc_id` and `subnet_ids` to run the Harness inside a VPC, so it can reach private resources such as a database:
 
-```hcl title="packages/common/terraform/src/app/harnesses/my-harness/my-harness.tf"
-resource "aws_security_group" "harness" {
-  vpc_id = var.vpc_id
+```hcl
+module "my_harness" {
+  source     = "../../common/terraform/src/app/harnesses/my-harness"
+  enable_vpc = true
+  vpc_id     = var.vpc_id
+  subnet_ids = var.private_subnet_ids
 }
+```
 
-resource "aws_bedrockagentcore_harness" "this" {
-  # ...
-  environment {
-    agent_core_runtime_environment {
-      network_configuration {
-        network_mode = "VPC"
-        network_mode_config {
-          security_groups = [aws_security_group.harness.id]
-          subnets         = var.subnet_ids
-        }
-      }
-    }
-  }
+The module creates a security group for the Harness, allowing outbound HTTPS only. Its `security_group_id` output is what resources the Harness must reach reference in their own ingress rules:
+
+```hcl
+resource "aws_vpc_security_group_ingress_rule" "harness_to_database" {
+  security_group_id            = aws_security_group.database.id
+  referenced_security_group_id = module.my_harness.security_group_id
+  from_port                    = 5432
+  to_port                      = 5432
+  ip_protocol                  = "tcp"
+  description                  = "Harness to database"
 }
 ```
+
+`security_group_id` is null unless `enable_vpc` is true, and `vpc_id` and `subnet_ids` are both required when it is.
   </Fragment>
 </Infrastructure>
 

package/docs/guides/connection/py-agent-dynamodb.mdx

@@ -70,42 +70,41 @@ table.grantReadWriteData(myAgent);
 </Fragment>
 <Fragment slot="terraform">
 
+Grant the agent's runtime role access to the table and its KMS encryption key via `additional_iam_policy_statements`:
+
 ```hcl title="packages/infra/src/main.tf"
 module "my_table" {
   source = "../../common/terraform/src/app/dynamodb/my-table"
 }
 
-resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_agent.lambda_role_name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
-          "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
-        ]
-        Resource = [
-          module.my_table.table_arn,
-          "${module.my_table.table_arn}/index/*",
-        ]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey"
-        ]
-        Resource = [module.my_table.kms_key_arn]
-      },
-    ]
-  })
+module "my_agent" {
+  source = "../../common/terraform/src/app/agents/my-agent"
+
+  additional_iam_policy_statements = [
+    {
+      Effect = "Allow"
+      Action = [
+        "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
+        "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
+      ]
+      Resource = [
+        module.my_table.table_arn,
+        "${module.my_table.table_arn}/index/*",
+      ]
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey",
+      ]
+      Resource = [module.my_table.kms_key_arn]
+    },
+  ]
 }
 ```
 </Fragment>

package/docs/guides/connection/py-mcp-server-dynamodb.mdx

@@ -70,42 +70,41 @@ table.grantReadWriteData(myMcpServer);
 </Fragment>
 <Fragment slot="terraform">
 
+Grant the MCP server's runtime role access to the table and its KMS encryption key via `additional_iam_policy_statements`:
+
 ```hcl title="packages/infra/src/main.tf"
 module "my_table" {
   source = "../../common/terraform/src/app/dynamodb/my-table"
 }
 
-resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_mcp_server.lambda_role_name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
-          "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
-        ]
-        Resource = [
-          module.my_table.table_arn,
-          "${module.my_table.table_arn}/index/*",
-        ]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey"
-        ]
-        Resource = [module.my_table.kms_key_arn]
-      },
-    ]
-  })
+module "my_mcp_server" {
+  source = "../../common/terraform/src/app/mcp-servers/my-mcp-server"
+
+  additional_iam_policy_statements = [
+    {
+      Effect = "Allow"
+      Action = [
+        "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
+        "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
+      ]
+      Resource = [
+        module.my_table.table_arn,
+        "${module.my_table.table_arn}/index/*",
+      ]
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey",
+      ]
+      Resource = [module.my_table.kms_key_arn]
+    },
+  ]
 }
 ```
 </Fragment>

package/docs/guides/connection/ts-agent-dynamodb.mdx

@@ -82,42 +82,41 @@ table.grantReadWriteData(myAgent);
 </Fragment>
 <Fragment slot="terraform">
 
+Grant the agent's runtime role access to the table and its KMS encryption key via `additional_iam_policy_statements`:
+
 ```hcl title="packages/infra/src/main.tf"
 module "my_table" {
   source = "../../common/terraform/src/app/dynamodb/my-table"
 }
 
-resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_agent.lambda_role_name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
-          "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
-        ]
-        Resource = [
-          module.my_table.table_arn,
-          "${module.my_table.table_arn}/index/*",
-        ]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey"
-        ]
-        Resource = [module.my_table.kms_key_arn]
-      },
-    ]
-  })
+module "my_agent" {
+  source = "../../common/terraform/src/app/agents/my-agent"
+
+  additional_iam_policy_statements = [
+    {
+      Effect = "Allow"
+      Action = [
+        "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
+        "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
+      ]
+      Resource = [
+        module.my_table.table_arn,
+        "${module.my_table.table_arn}/index/*",
+      ]
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey",
+      ]
+      Resource = [module.my_table.kms_key_arn]
+    },
+  ]
 }
 ```
 </Fragment>

package/docs/guides/connection/ts-mcp-server-dynamodb.mdx

@@ -79,42 +79,41 @@ table.grantReadWriteData(myMcpServer);
 </Fragment>
 <Fragment slot="terraform">
 
+Grant the MCP server's runtime role access to the table and its KMS encryption key via `additional_iam_policy_statements`:
+
 ```hcl title="packages/infra/src/main.tf"
 module "my_table" {
   source = "../../common/terraform/src/app/dynamodb/my-table"
 }
 
-resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_mcp_server.lambda_role_name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
-          "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
-          "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
-        ]
-        Resource = [
-          module.my_table.table_arn,
-          "${module.my_table.table_arn}/index/*",
-        ]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Encrypt",
-          "kms:Decrypt",
-          "kms:ReEncrypt*",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey",
-        ]
-        Resource = [module.my_table.kms_key_arn]
-      },
-    ]
-  })
+module "my_mcp_server" {
+  source = "../../common/terraform/src/app/mcp-servers/my-mcp-server"
+
+  additional_iam_policy_statements = [
+    {
+      Effect = "Allow"
+      Action = [
+        "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem",
+        "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan",
+        "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem",
+      ]
+      Resource = [
+        module.my_table.table_arn,
+        "${module.my_table.table_arn}/index/*",
+      ]
+    },
+    {
+      Effect = "Allow"
+      Action = [
+        "kms:Encrypt",
+        "kms:Decrypt",
+        "kms:ReEncrypt*",
+        "kms:GenerateDataKey*",
+        "kms:DescribeKey",
+      ]
+      Resource = [module.my_table.kms_key_arn]
+    },
+  ]
 }
 ```
 </Fragment>

package/docs/snippets/connection/lambda-dynamodb-access.mdx

@@ -38,7 +38,7 @@ module "my_table" {
 }
 
 resource "aws_iam_role_policy" "dynamodb_access" {
-  role = module.my_api.lambda_role_name
+  role = module.my_api.lambda_execution_role_name
 
   policy = jsonencode({
     Version = "2012-10-17"

package/docs/snippets/dynamodb/deploying-table.mdx

@@ -46,7 +46,7 @@ This provisions a DynamoDB table with:
 - On-demand (`PAY_PER_REQUEST`) billing
 - Customer-managed KMS encryption with automatic key rotation
 - Point-in-time recovery enabled
-- Deletion protection enabled
+- Deletion protection enabled, plus a `prevent_destroy` lifecycle guard
 - Table name registered in Runtime Config under the `dynamodb` namespace in AWS AppConfig
 
 The `core/runtime-config/appconfig` module exposes the `dynamodb` namespace by default, so the table name is deployed without further configuration. If you pass `namespaces` to that module explicitly, keep `dynamodb` in the list — otherwise no configuration profile is created for it and the generated table client cannot resolve the table name.
@@ -55,20 +55,33 @@ The `core/runtime-config/appconfig` module exposes the `dynamodb` namespace by d
 
 ### Deletion Protection
 
-Deletion protection is enabled by default to prevent accidental table deletion.
+The table is protected by two independent guards, so that turning off either one alone cannot delete your data:
+
+<Infrastructure>
+<Fragment slot="cdk">
+- `deletionProtection`, enforced by DynamoDB.
+- `RemovalPolicy.RETAIN`, enforced by CloudFormation, which leaves the table in place when it is removed from the stack.
+</Fragment>
+<Fragment slot="terraform">
+- `deletion_protection_enabled`, enforced by DynamoDB.
+- `lifecycle { prevent_destroy = true }` on the table in `common/terraform/src/core/dynamodb/dynamodb.tf`, enforced by Terraform, which fails any plan that would destroy the table.
+</Fragment>
+</Infrastructure>
 
-#### Disable Deletion Protection
+#### Deleting the Table
 
-Disable it for environments where table deletion is expected, such as short-lived development or preview stacks.
+Disable protection for environments where table deletion is expected, such as short-lived development or preview stacks.
 
 <Infrastructure>
 <Fragment slot="cdk">
 
 ```ts title="packages/infra/src/stacks/application-stack.ts"
+import { RemovalPolicy } from 'aws-cdk-lib';
 import { MyTable } from '@my-scope/common-constructs';
 
 const table = new MyTable(this, 'Table', {
   deletionProtection: false,
+  removalPolicy: RemovalPolicy.DESTROY,
 });
 ```
 </Fragment>
@@ -80,6 +93,22 @@ module "my_table" {
   deletion_protection_enabled = false
 }
 ```
+
+`prevent_destroy` must be a literal — Terraform does not allow it to reference a variable — so it cannot be turned off from `main.tf`. Also remove the `lifecycle` block from the table in `common/terraform/src/core/dynamodb/dynamodb.tf`:
+
+```hcl title="packages/common/terraform/src/core/dynamodb/dynamodb.tf" del={4-6}
+resource "aws_dynamodb_table" "table" {
+  # ...
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+```
+
+:::caution
+This module is shared by every table in your workspace, so removing the block removes that guard for all of them.
+:::
 </Fragment>
 </Infrastructure>
 

package/docs/snippets/rdb/deletion-protection.mdx

@@ -3,21 +3,34 @@ title: Deletion Protection
 ---
 import Infrastructure from '@components/infrastructure.astro';
 
-Deletion protection is enabled by default (`deletionProtection: true` in CDK, `deletion_protection = true` in Terraform) to protect the Aurora cluster from accidental deletion.
+The Aurora cluster is protected by two independent guards, so that turning off either one alone cannot delete your data:
 
-#### Disable Deletion Protection
+<Infrastructure>
+<Fragment slot="cdk">
+- `deletionProtection`, enforced by RDS.
+- `RemovalPolicy.RETAIN`, enforced by CloudFormation, which leaves the cluster in place when it is removed from the stack.
+</Fragment>
+<Fragment slot="terraform">
+- `deletion_protection`, enforced by RDS.
+- `lifecycle { prevent_destroy = true }` on the cluster in `common/terraform/src/core/rdb/aurora/aurora.tf`, enforced by Terraform, which fails any plan that would destroy the cluster.
+</Fragment>
+</Infrastructure>
+
+#### Deleting the Database
 
-You can disable deletion protection for environments where database deletion is expected, such as short-lived development or preview stacks.
+You can disable protection for environments where database deletion is expected, such as short-lived development or preview stacks.
 
 <Infrastructure>
 <Fragment slot="cdk">
 
 ```ts title="packages/infra/src/stacks/application-stack.ts"
+import { RemovalPolicy } from 'aws-cdk-lib';
 import { MyDatabase } from '@my-scope/common-constructs';
 
 const db = new MyDatabase(this, 'Db', {
   ...
   deletionProtection: false,
+  removalPolicy: RemovalPolicy.DESTROY,
 });
 ```
 </Fragment>
@@ -28,7 +41,24 @@ module "my_database" {
   source = "../../common/terraform/src/app/dbs/my-database"
   ...
   deletion_protection = false
+  skip_final_snapshot = true
 }
 ```
+
+`prevent_destroy` must be a literal — Terraform does not allow it to reference a variable — so it cannot be turned off from `main.tf`. Also remove the `lifecycle` block from the cluster in `common/terraform/src/core/rdb/aurora/aurora.tf`:
+
+```hcl title="packages/common/terraform/src/core/rdb/aurora/aurora.tf" del={4-6}
+resource "aws_rds_cluster" "database" {
+  # ...
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+```
+
+:::caution
+This module is shared by every database in your workspace, so removing the block removes that guard for all of them.
+:::
 </Fragment>
 </Infrastructure>

package/docs/snippets/rdb/performance-insights.mdx

@@ -5,6 +5,8 @@ import Infrastructure from '@components/infrastructure.astro';
 
 Performance Insights is enabled on the Aurora writer instance by default (encrypted with the cluster's KMS key). Aurora engine logs are also exported to [CloudWatch Logs](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html) by default, configured to surface schema-level activity without leaking row data.
 
+Exported log volume — and so [CloudWatch Logs ingestion cost](https://aws.amazon.com/cloudwatch/pricing/) — scales with schema changes and connections rather than query traffic, since the log types that carry full statement text are excluded. On Aurora MySQL the `CONNECT` audit event is emitted per connection, so workloads that open a connection per request produce more than ones that pool.
+
 Disable log export per database if not required:
 
 <Infrastructure>

package/docs/snippets/rdb/serverless-capacity.mdx

@@ -3,7 +3,7 @@ title: Serverless Capacity
 ---
 import Infrastructure from '@components/infrastructure.astro';
 
-Control Aurora Serverless v2 scaling limits to match your workload.
+Control Aurora Serverless v2 scaling limits to match your workload. Both providers default to a minimum of 0.5 ACUs and a maximum of 4.
 
 <Infrastructure>
 <Fragment slot="cdk">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin-mcp",
-  "version": "1.0.0-rc.82",
+  "version": "1.0.0-rc.84",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",