@aws/nx-plugin 1.0.0-rc.2 → 1.0.0-rc.21

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -22,144 +22,6 @@ datasource db {
 "
 `;
 
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/scripts/docker-pull.ts 1`] = `
-"import { spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-const image = process.argv[2];
-
-const inspect = spawnSync(ENGINE, ['image', 'inspect', image], {
-  stdio: 'ignore',
-});
-
-if (inspect.status !== 0) {
-  const pull = spawnSync(ENGINE, ['pull', image], { stdio: 'inherit' });
-  if (pull.status !== 0) {
-    process.exit(pull.status ?? 1);
-  }
-}
-"
-`;
-
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/scripts/docker-start.ts 1`] = `
-"import { spawn, spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-
-const [containerName, image, hostPort, dbName, dbPassword] =
-  process.argv.slice(2);
-
-const containerExists = (): boolean =>
-  spawnSync(ENGINE, ['container', 'inspect', containerName], {
-    stdio: 'ignore',
-  }).status === 0;
-
-const isRunning = (): boolean => {
-  const result = spawnSync(
-    ENGINE,
-    ['container', 'inspect', '-f', '{{.State.Running}}', containerName],
-    { encoding: 'utf-8' },
-  );
-  return result.status === 0 && result.stdout.trim() === 'true';
-};
-
-if (containerExists()) {
-  if (!isRunning()) {
-    const start = spawnSync(ENGINE, ['start', containerName], {
-      stdio: 'inherit',
-    });
-    if (start.status !== 0) process.exit(start.status ?? 1);
-  }
-} else {
-  const runArgs = [
-    'run',
-    '--name',
-    containerName,
-    '-e',
-    \`MYSQL_DATABASE=\${dbName}\`,
-    '-e',
-    \`MYSQL_ROOT_PASSWORD=\${dbPassword}\`,
-    '-p',
-    \`\${hostPort}:3306\`,
-    '-v',
-    \`\${containerName}-data:/var/lib/mysql\`,
-    '-d',
-    image,
-  ];
-  const create = spawnSync(ENGINE, runArgs, { stdio: 'inherit' });
-  if (create.status !== 0) process.exit(create.status ?? 1);
-}
-
-const logs = spawn(ENGINE, ['logs', '-f', containerName], {
-  stdio: ['ignore', 'inherit', 'inherit'],
-});
-
-let exiting = false;
-
-const cleanup = () => {
-  if (exiting) return;
-  exiting = true;
-  spawnSync(ENGINE, ['stop', containerName], { stdio: 'ignore' });
-  logs.kill();
-  process.exit(0);
-};
-
-process.on('SIGTERM', cleanup);
-process.on('SIGINT', cleanup);
-process.on('SIGHUP', cleanup);
-
-logs.on('exit', (code) => {
-  if (!exiting) process.exit(code ?? 0);
-});
-"
-`;
-
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/scripts/wait-for-db.ts 1`] = `
-"import { createConnection, Connection } from 'mariadb';
-
-const noop = () => undefined;
-
-const [portArg, dbArg, userArg, passwordArg] = process.argv.slice(2);
-const timeoutAt = Date.now() + 60000;
-
-while (Date.now() < timeoutAt) {
-  let conn: Connection | undefined;
-  try {
-    conn = await createConnection({
-      host: 'localhost',
-      port: parseInt(portArg),
-      user: userArg,
-      password: passwordArg,
-      database: dbArg,
-      connectTimeout: 500,
-      allowPublicKeyRetrieval: true,
-    });
-    await conn.end();
-    console.log('Database is ready.');
-    process.exit(0);
-  } catch {
-    console.log('Database is not ready.');
-    await conn?.end().catch(noop);
-  }
-  await new Promise((r) => setTimeout(r, 200));
-}
-
-throw new Error(\`Timed out waiting for mysql on port \${portArg}\`);
-"
-`;
-
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/constants.ts 1`] = `
-"export const DB_PACKAGE_NAME = 'Db';
-
-// Local development connection details (used when SERVE_LOCAL=true, see serve-local Nx target)
-export const LOCAL_DB_PORT = 3306;
-export const LOCAL_DB_HOST = 'localhost';
-export const LOCAL_DB_NAME = 'database_name';
-export const LOCAL_DB_USER = 'root';
-export const LOCAL_DB_PASSWORD = 'password';
-"
-`;
-
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/create-db-user-handler.ts 1`] = `
 "import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
 import { randomBytes } from 'node:crypto';
@@ -237,8 +99,7 @@ export const handler = async (
 `;
 
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/index.ts 1`] = `
-"export { DB_PACKAGE_NAME } from './constants.js';
-export { getPrisma } from './prisma.js';
+"export { getPrisma } from './prisma.js';
 "
 `;
 
@@ -277,26 +138,31 @@ exports[`ts#rdb generator > should add mysql prisma dependencies when engine is
 "import { PrismaMariaDb } from '@prisma/adapter-mariadb';
 import { Signer } from '@aws-sdk/rds-signer';
 import { Prisma, PrismaClient } from '../generated/prisma/client.js';
-import {
-  DB_PACKAGE_NAME,
-  LOCAL_DB_HOST,
-  LOCAL_DB_NAME,
-  LOCAL_DB_PASSWORD,
-  LOCAL_DB_PORT,
-  LOCAL_DB_USER,
-} from './constants.js';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
 import { getDatabaseConfig } from './utils.js';
 
+// Generated: must match runtimeConfigKey in config.json
+const runtimeConfigKey = 'Db';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// config.json is only present in local dev (not included in the deployed bundle); guard with SERVE_LOCAL check
+const serveLocal = () =>
+  JSON.parse(readFileSync(join(__dirname, '../config.json'), 'utf-8'))
+    .serveLocal;
+
 export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   log: LogOpts[] = ['warn', 'error'] as LogOpts[],
 ): Promise<PrismaClient<LogOpts>> => {
   if (process.env.SERVE_LOCAL === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = serveLocal();
     const adapter = new PrismaMariaDb({
-      host: LOCAL_DB_HOST,
-      port: LOCAL_DB_PORT,
-      database: LOCAL_DB_NAME,
-      user: LOCAL_DB_USER,
-      password: LOCAL_DB_PASSWORD,
+      host,
+      port,
+      database: dbName,
+      user: dbUser,
+      password: dbPassword,
       allowPublicKeyRetrieval: true,
     });
     return new PrismaClient({
@@ -306,7 +172,7 @@ export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   }
 
   const { hostname, port, database, dbUser, region } =
-    await getDatabaseConfig(DB_PACKAGE_NAME);
+    await getDatabaseConfig(runtimeConfigKey);
   const iamAuthToken = await new Signer({
     hostname,
     port,
@@ -663,6 +529,21 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enableKeyRotation?: boolean;
+
+  /**
+   * Whether to export Aurora engine logs to CloudWatch Logs.
+   * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
+   *
+   * @default false
+   */
+  readonly enableCloudwatchLogs?: boolean;
+
+  /**
+   * Whether to enable Performance Insights on the Aurora writer instance.
+   *
+   * @default true
+   */
+  readonly enablePerformanceInsights?: boolean;
 }
 
 /**
@@ -692,6 +573,8 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
+      enableCloudwatchLogs = false,
+      enablePerformanceInsights = true,
       engine,
       engineVersion,
       ...clusterProps
@@ -707,12 +590,24 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
-      writer: writer ?? ClusterInstance.serverlessV2('writer'),
+      writer:
+        writer ??
+        ClusterInstance.serverlessV2('writer', {
+          enablePerformanceInsights,
+          performanceInsightEncryptionKey: enablePerformanceInsights
+            ? key
+            : undefined,
+        }),
       credentials: Credentials.fromGeneratedSecret(adminUser, {
         encryptionKey: key,
       }),
       iamAuthentication: true,
       monitoringInterval: Duration.seconds(5),
+      cloudwatchLogsExports: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? ['audit', 'error', 'general', 'slowquery']
+          : ['postgresql']
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,
@@ -874,17 +769,14 @@ export abstract class AuroraDatabase extends Construct {
 
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL 2`] = `
 "import { defineConfig } from 'prisma/config';
+import { readFileSync } from 'fs';
 
 const getDatabaseUrl = async () => {
   if (process.env.SERVE_LOCAL === 'true') {
-    const {
-      LOCAL_DB_HOST,
-      LOCAL_DB_NAME,
-      LOCAL_DB_PASSWORD,
-      LOCAL_DB_PORT,
-      LOCAL_DB_USER,
-    } = await import('./src/constants.js');
-    return \`mysql://\${LOCAL_DB_USER}:\${LOCAL_DB_PASSWORD}@\${LOCAL_DB_HOST}:\${LOCAL_DB_PORT}/\${LOCAL_DB_NAME}\`;
+    const { host, port, dbName, dbUser, dbPassword } = JSON.parse(
+      readFileSync('config.json', 'utf-8'),
+    ).serveLocal;
+    return \`mysql://\${dbUser}:\${dbPassword}@\${host}:\${port}/\${dbName}\`;
   }
   return process.env.DATABASE_URL;
 };
@@ -1063,10 +955,19 @@ variable "tags" {
   default     = {}
 }
 
+# Suffix appended to physical resource names so that multiple deployments
+# (e.g. separate environments in the same account and region) don't collide.
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 locals {
   default_port           = var.engine == "aurora-mysql" ? 3306 : 5432
   default_engine_version = var.engine == "aurora-mysql" ? "8.0.mysql_aurora.3.12.0" : "17.7"
   parameter_group_family = var.engine == "aurora-mysql" ? "aurora-mysql8.0" : "aurora-postgresql\${split(".", coalesce(var.engine_version, local.default_engine_version))[0]}"
+  cluster_name           = "\${var.name}-aurora-\${random_string.suffix.result}"
 }
 
 resource "aws_rds_cluster_parameter_group" "database" {
@@ -1164,7 +1065,7 @@ resource "aws_security_group" "database" {
 }
 
 resource "aws_db_subnet_group" "database" {
-  name       = "\${var.name}-aurora"
+  name       = local.cluster_name
   subnet_ids = var.subnet_ids
 
   tags = merge(var.tags, {
@@ -1204,7 +1105,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 resource "aws_rds_cluster" "database" {
   #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
-  cluster_identifier                  = "\${var.name}-aurora"
+  cluster_identifier                  = local.cluster_name
   engine                              = var.engine
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
@@ -1218,7 +1119,7 @@ resource "aws_rds_cluster" "database" {
   kms_key_id                          = aws_kms_key.database.arn
   deletion_protection                 = var.deletion_protection
   skip_final_snapshot                 = var.skip_final_snapshot
-  final_snapshot_identifier           = var.skip_final_snapshot ? null : "\${var.name}-aurora-final-snapshot"
+  final_snapshot_identifier           = var.skip_final_snapshot ? null : "\${local.cluster_name}-final-snapshot"
   iam_database_authentication_enabled = true
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
@@ -1238,7 +1139,7 @@ resource "aws_rds_cluster" "database" {
 resource "aws_rds_cluster_instance" "database" {
   count = var.instance_count
 
-  identifier           = "\${var.name}-aurora-\${count.index + 1}"
+  identifier           = "\${local.cluster_name}-\${count.index + 1}"
   cluster_identifier   = aws_rds_cluster.database.id
   instance_class       = "db.serverless"
   engine               = aws_rds_cluster.database.engine
@@ -1292,7 +1193,7 @@ resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
 resource "aws_cloudformation_stack" "credentials_rotation" {
   #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
   count = var.enable_credential_rotation ? 1 : 0
-  name  = "\${var.name}-aurora-credentials-rotation"
+  name  = "\${local.cluster_name}-credentials-rotation"
 
   capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
 
@@ -1306,7 +1207,7 @@ resource "aws_cloudformation_stack" "credentials_rotation" {
           SecretId = aws_secretsmanager_secret.credentials.arn
           HostedRotationLambda = {
             RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "\${var.name}-aurora-credentials-rotation"
+            RotationLambdaName  = "\${local.cluster_name}-credentials-rotation"
             VpcSecurityGroupIds = aws_security_group.rotation[0].id
             VpcSubnetIds        = join(",", var.lambda_subnet_ids)
           }
@@ -1386,7 +1287,7 @@ resource "aws_security_group" "proxy" {
 resource "aws_db_proxy" "aurora" {
   count = var.enable_rds_proxy ? 1 : 0
 
-  name                   = "\${var.name}-proxy"
+  name                   = "\${var.name}-proxy-\${random_string.suffix.result}"
   default_auth_scheme    = "IAM_AUTH"
   engine_family          = var.engine == "aurora-mysql" ? "MYSQL" : "POSTGRESQL"
   role_arn               = aws_iam_role.proxy[0].arn
@@ -1435,9 +1336,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \\
-          --region \${data.aws_region.current.region} \\
-          --db-proxy-name \${self.triggers.db_proxy_name} \\
-          --target-group-name \${self.triggers.target_group_name} \\
+          --region "$AWS_REGION" \\
+          --db-proxy-name "$DB_PROXY_NAME" \\
+          --target-group-name "$TARGET_GROUP_NAME" \\
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \\
           --output text)
 
@@ -1447,13 +1348,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target \${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -1532,7 +1439,7 @@ resource "aws_iam_role_policy_attachment" "backup" {
 resource "aws_backup_vault" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name        = "\${var.name}-aurora-backup"
+  name        = "\${local.cluster_name}-backup"
   kms_key_arn = aws_kms_key.database.arn
   tags        = var.tags
 }
@@ -1540,7 +1447,7 @@ resource "aws_backup_vault" "database" {
 resource "aws_backup_plan" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name = "\${var.name}-aurora-backup"
+  name = "\${local.cluster_name}-backup"
 
   rule {
     rule_name         = "daily-backup"
@@ -1791,10 +1698,12 @@ resource "random_string" "suffix" {
 }
 
 locals {
-  create_db_user_bundle_path = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
-  migration_function_name = "db-migration-\${random_string.suffix.result}"
+  config                       = jsondecode(file("\${path.module}/../../../../../../../packages/db/config.json"))
+  runtime_config_key           = local.config.runtimeConfigKey
+  create_db_user_bundle_path   = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
+  migration_function_name      = "db-migration-\${random_string.suffix.result}"
   create_db_user_function_name = "db-create-db-user-\${random_string.suffix.result}"
-  database_runtime_user = "db_\${random_string.suffix.result}"
+  database_runtime_user        = "db_\${random_string.suffix.result}"
 }
 
 module "aurora" {
@@ -1860,7 +1769,7 @@ module "add_rdb_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
   namespace = "database"
-  key       = "Db"
+  key       = local.runtime_config_key
   value = {
     hostname  = module.aurora.cluster_endpoint
     port      = module.aurora.cluster_port
@@ -1873,9 +1782,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "db-migration-\${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -1926,19 +1834,31 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region \${data.aws_region.current.region} | docker login --username AWS --password-stdin \${self.triggers.repository_url}
-      docker tag \${self.triggers.docker_image_tag} \${self.triggers.repository_url}:latest
-      docker push \${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -2196,10 +2116,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:\${self.triggers.db_user}"}' \\
+        --payload "{\\"RequestType\\":\\"Create\\",\\"PhysicalResourceId\\":\\"db-user:$DB_USER\\"}" \\
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -2209,6 +2129,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -2222,7 +2147,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:\${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]
@@ -2271,8 +2196,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
         "$output_file")
       cat "$output_file"
@@ -2283,6 +2208,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [
@@ -2513,10 +2442,19 @@ variable "tags" {
   default     = {}
 }
 
+# Suffix appended to physical resource names so that multiple deployments
+# (e.g. separate environments in the same account and region) don't collide.
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 locals {
   default_port           = var.engine == "aurora-mysql" ? 3306 : 5432
   default_engine_version = var.engine == "aurora-mysql" ? "8.0.mysql_aurora.3.12.0" : "17.7"
   parameter_group_family = var.engine == "aurora-mysql" ? "aurora-mysql8.0" : "aurora-postgresql\${split(".", coalesce(var.engine_version, local.default_engine_version))[0]}"
+  cluster_name           = "\${var.name}-aurora-\${random_string.suffix.result}"
 }
 
 resource "aws_rds_cluster_parameter_group" "database" {
@@ -2614,7 +2552,7 @@ resource "aws_security_group" "database" {
 }
 
 resource "aws_db_subnet_group" "database" {
-  name       = "\${var.name}-aurora"
+  name       = local.cluster_name
   subnet_ids = var.subnet_ids
 
   tags = merge(var.tags, {
@@ -2654,7 +2592,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 resource "aws_rds_cluster" "database" {
   #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
-  cluster_identifier                  = "\${var.name}-aurora"
+  cluster_identifier                  = local.cluster_name
   engine                              = var.engine
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
@@ -2668,7 +2606,7 @@ resource "aws_rds_cluster" "database" {
   kms_key_id                          = aws_kms_key.database.arn
   deletion_protection                 = var.deletion_protection
   skip_final_snapshot                 = var.skip_final_snapshot
-  final_snapshot_identifier           = var.skip_final_snapshot ? null : "\${var.name}-aurora-final-snapshot"
+  final_snapshot_identifier           = var.skip_final_snapshot ? null : "\${local.cluster_name}-final-snapshot"
   iam_database_authentication_enabled = true
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
@@ -2688,7 +2626,7 @@ resource "aws_rds_cluster" "database" {
 resource "aws_rds_cluster_instance" "database" {
   count = var.instance_count
 
-  identifier           = "\${var.name}-aurora-\${count.index + 1}"
+  identifier           = "\${local.cluster_name}-\${count.index + 1}"
   cluster_identifier   = aws_rds_cluster.database.id
   instance_class       = "db.serverless"
   engine               = aws_rds_cluster.database.engine
@@ -2742,7 +2680,7 @@ resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
 resource "aws_cloudformation_stack" "credentials_rotation" {
   #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
   count = var.enable_credential_rotation ? 1 : 0
-  name  = "\${var.name}-aurora-credentials-rotation"
+  name  = "\${local.cluster_name}-credentials-rotation"
 
   capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
 
@@ -2756,7 +2694,7 @@ resource "aws_cloudformation_stack" "credentials_rotation" {
           SecretId = aws_secretsmanager_secret.credentials.arn
           HostedRotationLambda = {
             RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "\${var.name}-aurora-credentials-rotation"
+            RotationLambdaName  = "\${local.cluster_name}-credentials-rotation"
             VpcSecurityGroupIds = aws_security_group.rotation[0].id
             VpcSubnetIds        = join(",", var.lambda_subnet_ids)
           }
@@ -2836,7 +2774,7 @@ resource "aws_security_group" "proxy" {
 resource "aws_db_proxy" "aurora" {
   count = var.enable_rds_proxy ? 1 : 0
 
-  name                   = "\${var.name}-proxy"
+  name                   = "\${var.name}-proxy-\${random_string.suffix.result}"
   default_auth_scheme    = "IAM_AUTH"
   engine_family          = var.engine == "aurora-mysql" ? "MYSQL" : "POSTGRESQL"
   role_arn               = aws_iam_role.proxy[0].arn
@@ -2885,9 +2823,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \\
-          --region \${data.aws_region.current.region} \\
-          --db-proxy-name \${self.triggers.db_proxy_name} \\
-          --target-group-name \${self.triggers.target_group_name} \\
+          --region "$AWS_REGION" \\
+          --db-proxy-name "$DB_PROXY_NAME" \\
+          --target-group-name "$TARGET_GROUP_NAME" \\
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \\
           --output text)
 
@@ -2897,13 +2835,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target \${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -2982,7 +2926,7 @@ resource "aws_iam_role_policy_attachment" "backup" {
 resource "aws_backup_vault" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name        = "\${var.name}-aurora-backup"
+  name        = "\${local.cluster_name}-backup"
   kms_key_arn = aws_kms_key.database.arn
   tags        = var.tags
 }
@@ -2990,7 +2934,7 @@ resource "aws_backup_vault" "database" {
 resource "aws_backup_plan" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name = "\${var.name}-aurora-backup"
+  name = "\${local.cluster_name}-backup"
 
   rule {
     rule_name         = "daily-backup"
@@ -3241,10 +3185,12 @@ resource "random_string" "suffix" {
 }
 
 locals {
-  create_db_user_bundle_path = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
-  migration_function_name = "db-migration-\${random_string.suffix.result}"
+  config                       = jsondecode(file("\${path.module}/../../../../../../../packages/db/config.json"))
+  runtime_config_key           = local.config.runtimeConfigKey
+  create_db_user_bundle_path   = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
+  migration_function_name      = "db-migration-\${random_string.suffix.result}"
   create_db_user_function_name = "db-create-db-user-\${random_string.suffix.result}"
-  database_runtime_user = "db_\${random_string.suffix.result}"
+  database_runtime_user        = "db_\${random_string.suffix.result}"
 }
 
 module "aurora" {
@@ -3310,7 +3256,7 @@ module "add_rdb_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
   namespace = "database"
-  key       = "Db"
+  key       = local.runtime_config_key
   value = {
     hostname  = module.aurora.cluster_endpoint
     port      = module.aurora.cluster_port
@@ -3323,9 +3269,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "db-migration-\${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -3376,19 +3321,31 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region \${data.aws_region.current.region} | docker login --username AWS --password-stdin \${self.triggers.repository_url}
-      docker tag \${self.triggers.docker_image_tag} \${self.triggers.repository_url}:latest
-      docker push \${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -3651,10 +3608,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:\${self.triggers.db_user}"}' \\
+        --payload "{\\"RequestType\\":\\"Create\\",\\"PhysicalResourceId\\":\\"db-user:$DB_USER\\"}" \\
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -3664,6 +3621,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -3677,7 +3639,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:\${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]
@@ -3722,8 +3684,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
         "$output_file")
       cat "$output_file"
@@ -3734,6 +3696,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [
@@ -3824,148 +3790,6 @@ datasource db {
 "
 `;
 
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/scripts/docker-pull.ts 1`] = `
-"import { spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-const image = process.argv[2];
-
-const inspect = spawnSync(ENGINE, ['image', 'inspect', image], {
-  stdio: 'ignore',
-});
-
-if (inspect.status !== 0) {
-  const pull = spawnSync(ENGINE, ['pull', image], { stdio: 'inherit' });
-  if (pull.status !== 0) {
-    process.exit(pull.status ?? 1);
-  }
-}
-"
-`;
-
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/scripts/docker-start.ts 1`] = `
-"import { spawn, spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-
-const [containerName, image, hostPort, dbName, dbUser, dbPassword] =
-  process.argv.slice(2);
-
-const containerExists = (): boolean =>
-  spawnSync(ENGINE, ['container', 'inspect', containerName], {
-    stdio: 'ignore',
-  }).status === 0;
-
-const isRunning = (): boolean => {
-  const result = spawnSync(
-    ENGINE,
-    ['container', 'inspect', '-f', '{{.State.Running}}', containerName],
-    { encoding: 'utf-8' },
-  );
-  return result.status === 0 && result.stdout.trim() === 'true';
-};
-
-if (containerExists()) {
-  if (!isRunning()) {
-    const start = spawnSync(ENGINE, ['start', containerName], {
-      stdio: 'inherit',
-    });
-    if (start.status !== 0) process.exit(start.status ?? 1);
-  }
-} else {
-  const runArgs = [
-    'run',
-    '--name',
-    containerName,
-    '-e',
-    \`POSTGRES_DB=\${dbName}\`,
-    '-e',
-    \`POSTGRES_USER=\${dbUser}\`,
-    '-e',
-    \`POSTGRES_PASSWORD=\${dbPassword}\`,
-    '-e',
-    \`PGDATA=/var/lib/postgresql/17/docker\`,
-    '-p',
-    \`\${hostPort}:5432\`,
-    '-v',
-    \`\${containerName}-data:/var/lib/postgresql\`,
-    '-d',
-    image,
-  ];
-  const create = spawnSync(ENGINE, runArgs, { stdio: 'inherit' });
-  if (create.status !== 0) process.exit(create.status ?? 1);
-}
-
-const logs = spawn(ENGINE, ['logs', '-f', containerName], {
-  stdio: ['ignore', 'inherit', 'inherit'],
-});
-
-let exiting = false;
-
-const cleanup = () => {
-  if (exiting) return;
-  exiting = true;
-  spawnSync(ENGINE, ['stop', containerName], { stdio: 'ignore' });
-  logs.kill();
-  process.exit(0);
-};
-
-process.on('SIGTERM', cleanup);
-process.on('SIGINT', cleanup);
-process.on('SIGHUP', cleanup);
-
-logs.on('exit', (code) => {
-  if (!exiting) process.exit(code ?? 0);
-});
-"
-`;
-
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/scripts/wait-for-db.ts 1`] = `
-"import { Client } from 'pg';
-
-const noop = () => undefined;
-
-const [portArg, dbArg, userArg, passwordArg] = process.argv.slice(2);
-const timeoutAt = Date.now() + 60000;
-
-while (Date.now() < timeoutAt) {
-  const client = new Client({
-    host: 'localhost',
-    port: parseInt(portArg),
-    user: userArg,
-    password: passwordArg,
-    database: dbArg,
-    connectionTimeoutMillis: 500,
-  });
-  client.on('error', noop);
-  try {
-    await client.connect();
-    await client.end();
-    console.log('Database is ready.');
-    process.exit(0);
-  } catch {
-    console.log('Database is not ready.');
-    await client.end().catch(noop);
-  }
-  await new Promise((r) => setTimeout(r, 200));
-}
-
-throw new Error(\`Timed out waiting for postgres on port \${portArg}\`);
-"
-`;
-
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/constants.ts 1`] = `
-"export const DB_PACKAGE_NAME = 'Db';
-
-// Local development connection details (used when SERVE_LOCAL=true, see serve-local Nx target)
-export const LOCAL_DB_PORT = 5432;
-export const LOCAL_DB_HOST = 'localhost';
-export const LOCAL_DB_NAME = 'database_name';
-export const LOCAL_DB_USER = 'dbadmin';
-export const LOCAL_DB_PASSWORD = 'password';
-"
-`;
-
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/create-db-user-handler.ts 1`] = `
 "import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
 import { randomBytes } from 'node:crypto';
@@ -4057,8 +3881,7 @@ export const handler = async (
 `;
 
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/index.ts 1`] = `
-"export { DB_PACKAGE_NAME } from './constants.js';
-export { getPrisma } from './prisma.js';
+"export { getPrisma } from './prisma.js';
 "
 `;
 
@@ -4110,16 +3933,20 @@ exports[`ts#rdb generator > should generate the aurora shared construct > packag
 import { Signer } from '@aws-sdk/rds-signer';
 import { Prisma, PrismaClient } from '../generated/prisma/client.js';
 import { Pool } from 'pg';
-import {
-  DB_PACKAGE_NAME,
-  LOCAL_DB_HOST,
-  LOCAL_DB_NAME,
-  LOCAL_DB_PASSWORD,
-  LOCAL_DB_PORT,
-  LOCAL_DB_USER,
-} from './constants.js';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
 import { getDatabaseConfig } from './utils.js';
 
+// Generated: must match runtimeConfigKey in config.json
+const runtimeConfigKey = 'Db';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// config.json is only present in local dev (not included in the deployed bundle); guard with SERVE_LOCAL check
+const serveLocal = () =>
+  JSON.parse(readFileSync(join(__dirname, '../config.json'), 'utf-8'))
+    .serveLocal;
+
 let prismaClient: PrismaClient<Prisma.LogLevel> | undefined;
 
 export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
@@ -4128,13 +3955,14 @@ export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   if (prismaClient) return prismaClient;
 
   if (process.env.SERVE_LOCAL === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = serveLocal();
     const adapter = new PrismaPg(
       new Pool({
-        host: LOCAL_DB_HOST,
-        port: LOCAL_DB_PORT,
-        database: LOCAL_DB_NAME,
-        user: LOCAL_DB_USER,
-        password: LOCAL_DB_PASSWORD,
+        host,
+        port,
+        database: dbName,
+        user: dbUser,
+        password: dbPassword,
         allowExitOnIdle: true,
       }),
     );
@@ -4146,7 +3974,7 @@ export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   }
 
   const { hostname, port, database, dbUser, region } =
-    await getDatabaseConfig(DB_PACKAGE_NAME);
+    await getDatabaseConfig(runtimeConfigKey);
   const adapter = new PrismaPg(
     new Pool({
       host: hostname,
@@ -4508,6 +4336,21 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enableKeyRotation?: boolean;
+
+  /**
+   * Whether to export Aurora engine logs to CloudWatch Logs.
+   * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
+   *
+   * @default false
+   */
+  readonly enableCloudwatchLogs?: boolean;
+
+  /**
+   * Whether to enable Performance Insights on the Aurora writer instance.
+   *
+   * @default true
+   */
+  readonly enablePerformanceInsights?: boolean;
 }
 
 /**
@@ -4537,6 +4380,8 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
+      enableCloudwatchLogs = false,
+      enablePerformanceInsights = true,
       engine,
       engineVersion,
       ...clusterProps
@@ -4552,12 +4397,24 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
-      writer: writer ?? ClusterInstance.serverlessV2('writer'),
+      writer:
+        writer ??
+        ClusterInstance.serverlessV2('writer', {
+          enablePerformanceInsights,
+          performanceInsightEncryptionKey: enablePerformanceInsights
+            ? key
+            : undefined,
+        }),
       credentials: Credentials.fromGeneratedSecret(adminUser, {
         encryptionKey: key,
       }),
       iamAuthentication: true,
       monitoringInterval: Duration.seconds(5),
+      cloudwatchLogsExports: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? ['audit', 'error', 'general', 'slowquery']
+          : ['postgresql']
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,
@@ -4720,8 +4577,8 @@ export abstract class AuroraDatabase extends Construct {
 exports[`ts#rdb generator > should generate the aurora shared construct 2`] = `
 "import * as path from 'path';
 import * as url from 'url';
+import { readFileSync } from 'fs';
 import { Construct } from 'constructs';
-import { DB_PACKAGE_NAME } from ':proj/db';
 import {
   AuroraDatabase,
   AuroraDatabaseEngines,
@@ -4729,6 +4586,16 @@ import {
 } from '../../core/rdb/aurora.js';
 import { findWorkspaceRoot } from '../../core/workspace.js';
 
+const { runtimeConfigKey } = JSON.parse(
+  readFileSync(
+    path.join(
+      findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+      'packages/db/config.json',
+    ),
+    'utf-8',
+  ),
+) as { runtimeConfigKey: string };
+
 export type DbProps = Omit<
   AuroraDatabaseProps,
   | 'databaseName'
@@ -4748,7 +4615,7 @@ export class Db extends AuroraDatabase {
       ...props,
       databaseName: 'database_name',
       adminUser: 'databaseUser',
-      runtimeConfigKey: DB_PACKAGE_NAME,
+      runtimeConfigKey,
       migrationBundleDir: path.join(
         findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
         'dist/packages/db/bundle/migration',
@@ -4766,17 +4633,14 @@ export class Db extends AuroraDatabase {
 
 exports[`ts#rdb generator > should generate the aurora shared construct 3`] = `
 "import { defineConfig } from 'prisma/config';
+import { readFileSync } from 'fs';
 
 const getDatabaseUrl = async () => {
   if (process.env.SERVE_LOCAL === 'true') {
-    const {
-      LOCAL_DB_HOST,
-      LOCAL_DB_NAME,
-      LOCAL_DB_PASSWORD,
-      LOCAL_DB_PORT,
-      LOCAL_DB_USER,
-    } = await import('./src/constants.js');
-    return \`postgresql://\${LOCAL_DB_USER}:\${LOCAL_DB_PASSWORD}@\${LOCAL_DB_HOST}:\${LOCAL_DB_PORT}/\${LOCAL_DB_NAME}\`;
+    const { host, port, dbName, dbUser, dbPassword } = JSON.parse(
+      readFileSync('config.json', 'utf-8'),
+    ).serveLocal;
+    return \`postgresql://\${dbUser}:\${dbPassword}@\${host}:\${port}/\${dbName}\`;
   }
   return process.env.DATABASE_URL;
 };