@aws/nx-plugin 1.0.0-rc.26 → 1.0.0-rc.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.0-rc.26",
+  "version": "1.0.0-rc.28",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",

package/src/preset/generator.js

@@ -4,7 +4,7 @@
  */ import { addDependenciesToPackageJson, detectPackageManager, generateFiles, joinPathFragments, OverwriteStrategy, readNxJson, updateJson, updateNxJson } from "@nx/devkit";
 import { initGenerator } from "@nx/js";
 import { execSync } from "child_process";
-import * as enquirer from "enquirer";
+import enquirer from "enquirer";
 import { readFileSync } from "fs";
 import yaml from "js-yaml";
 import { readModulePackageJson } from "nx/src/utils/package-json";

package/src/preset/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../packages/nx-plugin/src/preset/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { execSync } from 'child_process';\nimport * as enquirer from 'enquirer';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from '../utils/config/utils';\nimport { inferContainers } from '../utils/containers';\nimport { DEFAULT_BIOME_CONFIG, formatFilesInSubtree } from '../utils/format';\nimport { installDependencies } from '../utils/install';\nimport { configureMcpServers } from '../utils/mcp';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics';\nimport { getNpmScope } from '../utils/npm-scope';\nimport { getGeneratorInfo, type NxGeneratorInfo } from '../utils/nx';\nimport { getPackageManagerDisplayCommands } from '../utils/pkg-manager';\nimport { withVersions } from '../utils/versions';\nimport type { PresetGeneratorSchema } from './schema';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nconst PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\nexport const PRESET_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nconst setUpWorkspaces = (tree: Tree) => {\n  if (detectPackageManager() === 'pnpm') {\n    tree.write(\n      'pnpm-workspace.yaml',\n      yaml.dump(\n        {\n          packages: WORKSPACES,\n          allowBuilds: Object.fromEntries(\n            PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true]),\n          ),\n          onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        },\n        { quotingType: \"'\" },\n      ),\n    );\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      json.workspaces = WORKSPACES;\n      return json;\n    });\n  }\n};\n\n/**\n * Determines if the current user is an Amazon employee based on their git configuration.\n *\n * This function checks the git user email configuration to identify Amazon employees\n * by looking for email addresses with Amazon domains (e.g., @amazon.com, @amazon.co.uk).\n *\n * @returns {boolean} True if the user's git email has an Amazon domain, false otherwise\n *\n * @example\n * // Returns true for Amazon employee emails\n * // git config user.email = \"john.doe@amazon.com\"\n * isAmazonian(); // true\n *\n * @example\n * // Returns false for non-Amazon emails\n * // git config user.email = \"user@example.com\"\n * isAmazonian(); // false\n *\n * @example\n * // Returns false when git config is not available or throws an error\n * isAmazonian(); // false\n */\nexport function isAmazonian(): boolean {\n  try {\n    // Execute git command to retrieve the user's configured email address\n    const gitEmail = execSync('git config user.email', {\n      encoding: 'utf8',\n    }).trim();\n\n    // Return false if no email is configured\n    if (!gitEmail) {\n      return false;\n    }\n\n    // Split email address to extract domain part\n    const emailParts = gitEmail.split('@');\n    if (emailParts.length < 2) {\n      return false;\n    }\n\n    // Extract domain and normalize to lowercase for comparison\n    const domain = emailParts[1].toLowerCase();\n\n    // Check if domain starts with 'amazon.' (covers amazon.com, amazon.co.uk, etc.)\n    return domain.startsWith('amazon.');\n  } catch (error) {\n    // Return false if git command fails or any other error occurs\n    // This handles cases where git is not installed or configured\n    return false;\n  }\n}\n\nconst setUpGitSecrets = (tree: Tree) => {\n  const gitSecretsDir = joinPathFragments(\n    import.meta.dirname,\n    'git-secrets-files',\n    'git-secrets-dir',\n  );\n  const huskyDir = joinPathFragments(\n    import.meta.dirname,\n    'git-secrets-files',\n    'husky-dir',\n  );\n\n  tree.write(\n    '.git-secrets/git-secrets',\n    readFileSync(joinPathFragments(gitSecretsDir, 'git-secrets'), 'utf-8'),\n  );\n  tree.write(\n    '.husky/pre-commit',\n    readFileSync(joinPathFragments(huskyDir, 'pre-commit'), 'utf-8'),\n  );\n  tree.write('.gitallowed', '\\\\.git-secrets/git-secrets:\\n');\n\n  updateJson(tree, 'package.json', (json) => ({\n    ...json,\n    scripts: {\n      ...json.scripts,\n      prepare: 'husky',\n    },\n  }));\n\n  addDependenciesToPackageJson(tree, {}, withVersions(['husky']));\n};\n\nexport const presetGenerator = async (\n  tree: Tree,\n  {\n    iac,\n    gitSecrets,\n    mcp,\n    containers,\n    preferInstallDependencies,\n  }: PresetGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n  if (\n    isAmazonian() &&\n    !process.env.VITEST &&\n    !process.env.CI &&\n    process.env.NX_DRY_RUN !== 'true' &&\n    process.env.NX_INTERACTIVE !== 'false'\n  ) {\n    const { engagementId } = await enquirer.prompt<{ engagementId?: string }>([\n      {\n        name: 'engagementId',\n        message: 'Please enter your engagementId (if known)',\n        type: 'input',\n        initial: 'None',\n      },\n    ]);\n\n    if (engagementId != 'None') {\n      await ensureAwsNxPluginConfig(tree);\n      await updateAwsNxPluginConfig(tree, { tags: [engagementId] });\n    }\n  }\n\n  // Write IaC provider and container engine to plugin config\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n  });\n\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  tree.delete('apps/.gitkeep');\n  tree.delete('libs/.gitkeep');\n  tree.write('packages/.gitkeep', '');\n\n  setUpWorkspaces(tree);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    analytics: false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: {\n        ...nxJson.targetDefaults?.compile,\n        syncGenerators: [\n          ...(nxJson.targetDefaults?.compile?.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      },\n    },\n  });\n\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    type: 'module',\n    scripts: {\n      ...packageJson.scripts,\n      dev: 'nx run-many --target dev',\n      build: 'nx run-many --target build',\n      lint: 'nx run-many --target lint --configuration=fix',\n      test: 'nx run-many --target test --all',\n      'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n      'build:all': 'nx run-many --target build --all',\n      'affected:all': 'nx affected --target build',\n    },\n  }));\n\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      '@nx/workspace': readModulePackageJson('@nx/js').packageJson.version,\n      ...withVersions(['typescript', '@biomejs/biome']),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write('biome.json', JSON.stringify(DEFAULT_BIOME_CONFIG, null, 2));\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  if (gitSecrets !== false) {\n    setUpGitSecrets(tree);\n  }\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default presetGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","execSync","enquirer","readFileSync","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","DEFAULT_BIOME_CONFIG","formatFilesInSubtree","installDependencies","configureMcpServers","getNpmScope","getGeneratorInfo","getPackageManagerDisplayCommands","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","PRESET_GENERATOR_INFO","filename","setUpWorkspaces","tree","write","dump","packages","allowBuilds","Object","fromEntries","map","dep","onlyBuiltDependencies","quotingType","json","workspaces","isAmazonian","gitEmail","encoding","trim","emailParts","split","length","domain","toLowerCase","startsWith","error","setUpGitSecrets","gitSecretsDir","dirname","huskyDir","scripts","prepare","presetGenerator","iac","gitSecrets","mcp","containers","preferInstallDependencies","resolvedContainers","process","env","VITEST","CI","NX_DRY_RUN","NX_INTERACTIVE","engagementId","prompt","name","message","initial","tags","provider","engine","formatter","addTsPlugin","delete","nxJson","analytics","targetDefaults","compile","syncGenerators","filter","g","includes","packageJson","dev","build","lint","test","version","exists","JSON","stringify","projectName","generators","entries","_","v","k","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy","Overwrite","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AACvC,SAASC,QAAQ,QAAQ,gBAAgB;AACzC,YAAYC,cAAc,WAAW;AACrC,SAASC,YAAY,QAAQ,KAAK;AAClC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,2BAAwB;AAC/B,SAASC,eAAe,QAAQ,yBAAsB;AACtD,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,qBAAkB;AAC7E,SAASC,mBAAmB,QAAQ,sBAAmB;AACvD,SAASC,mBAAmB,QAAQ,kBAAe;AAEnD,SAASC,WAAW,QAAQ,wBAAqB;AACjD,SAASC,gBAAgB,QAA8B,iBAAc;AACrE,SAASC,gCAAgC,QAAQ,0BAAuB;AACxE,SAASC,YAAY,QAAQ,uBAAoB;AAGjD,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ;AAEvE,OAAO,MAAMC,wBAAyCN,iBACpD,YAAYO,QAAQ,EACpB;AAEF,MAAMC,kBAAkB,CAACC;IACvB,IAAIlC,2BAA2B,QAAQ;QACrCkC,KAAKC,KAAK,CACR,uBACAxB,KAAKyB,IAAI,CACP;YACEC,UAAUT;YACVU,aAAaC,OAAOC,WAAW,CAC7BV,wBAAwBW,GAAG,CAAC,CAACC,MAAQ;oBAACA;oBAAK;iBAAK;YAElDC,uBAAuBb;QACzB,GACA;YAAEc,aAAa;QAAI;IAGzB,OAAO;QACLvC,WAAW6B,MAAM,gBAAgB,CAACW;YAChCA,KAAKC,UAAU,GAAGlB;YAClB,OAAOiB;QACT;IACF;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASE;IACd,IAAI;QACF,sEAAsE;QACtE,MAAMC,WAAWxC,SAAS,yBAAyB;YACjDyC,UAAU;QACZ,GAAGC,IAAI;QAEP,yCAAyC;QACzC,IAAI,CAACF,UAAU;YACb,OAAO;QACT;QAEA,6CAA6C;QAC7C,MAAMG,aAAaH,SAASI,KAAK,CAAC;QAClC,IAAID,WAAWE,MAAM,GAAG,GAAG;YACzB,OAAO;QACT;QAEA,2DAA2D;QAC3D,MAAMC,SAASH,UAAU,CAAC,EAAE,CAACI,WAAW;QAExC,gFAAgF;QAChF,OAAOD,OAAOE,UAAU,CAAC;IAC3B,EAAE,OAAOC,OAAO;QACd,8DAA8D;QAC9D,8DAA8D;QAC9D,OAAO;IACT;AACF;AAEA,MAAMC,kBAAkB,CAACxB;IACvB,MAAMyB,gBAAgBzD,kBACpB,YAAY0D,OAAO,EACnB,qBACA;IAEF,MAAMC,WAAW3D,kBACf,YAAY0D,OAAO,EACnB,qBACA;IAGF1B,KAAKC,KAAK,CACR,4BACAzB,aAAaR,kBAAkByD,eAAe,gBAAgB;IAEhEzB,KAAKC,KAAK,CACR,qBACAzB,aAAaR,kBAAkB2D,UAAU,eAAe;IAE1D3B,KAAKC,KAAK,CAAC,eAAe;IAE1B9B,WAAW6B,MAAM,gBAAgB,CAACW,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPiB,SAAS;gBACP,GAAGjB,KAAKiB,OAAO;gBACfC,SAAS;YACX;QACF,CAAA;IAEAhE,6BAA6BmC,MAAM,CAAC,GAAGP,aAAa;QAAC;KAAQ;AAC/D;AAEA,OAAO,MAAMqC,kBAAkB,OAC7B9B,MACA,EACE+B,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,UAAU,EACVC,yBAAyB,EACH;IAExB,MAAMC,qBACJ,CAACF,cAAcA,eAAe,UAAUjD,oBAAoBiD;IAC9D,IACErB,iBACA,CAACwB,QAAQC,GAAG,CAACC,MAAM,IACnB,CAACF,QAAQC,GAAG,CAACE,EAAE,IACfH,QAAQC,GAAG,CAACG,UAAU,KAAK,UAC3BJ,QAAQC,GAAG,CAACI,cAAc,KAAK,SAC/B;QACA,MAAM,EAAEC,YAAY,EAAE,GAAG,MAAMpE,SAASqE,MAAM,CAA4B;YACxE;gBACEC,MAAM;gBACNC,SAAS;gBACTlE,MAAM;gBACNmE,SAAS;YACX;SACD;QAED,IAAIJ,gBAAgB,QAAQ;YAC1B,MAAM5D,wBAAwBiB;YAC9B,MAAMhB,wBAAwBgB,MAAM;gBAAEgD,MAAM;oBAACL;iBAAa;YAAC;QAC7D;IACF;IAEA,2DAA2D;IAC3D,MAAM5D,wBAAwBiB;IAC9B,MAAMhB,wBAAwBgB,MAAM;QAClC+B,KAAK;YAAEkB,UAAUlB;QAAI;QACrBG,YAAY;YAAEgB,QAAQd;QAAmB;IAC3C;IAEA,MAAM/D,cAAc2B,MAAM;QACxBmD,WAAW;QACXC,aAAa;IACf;IAEApD,KAAKqD,MAAM,CAAC;IACZrD,KAAKqD,MAAM,CAAC;IACZrD,KAAKC,KAAK,CAAC,qBAAqB;IAEhCF,gBAAgBC;IAEhB,MAAMsD,SAASpF,WAAW8B;IAC1B5B,aAAa4B,MAAM;QACjB,GAAGsD,MAAM;QACTC,WAAW;QACXC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAAS;gBACP,GAAGH,OAAOE,cAAc,EAAEC,OAAO;gBACjCC,gBAAgB;uBACX,AAACJ,CAAAA,OAAOE,cAAc,EAAEC,SAASC,kBAAkB,EAAE,AAAD,EAAGC,MAAM,CAC9D,CAACC,IACC,CAAC;4BAAC9E;4BAAwBa;yBAA6B,CAACkE,QAAQ,CAC9DD;oBAGNjE;oBACAb;iBACD;YACH;QACF;IACF;IAEAX,WAAW6B,MAAM,gBAAgB,CAAC8D,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACdlF,MAAM;YACNgD,SAAS;gBACP,GAAGkC,YAAYlC,OAAO;gBACtBmC,KAAK;gBACLC,OAAO;gBACPC,MAAM;gBACNC,MAAM;gBACN,mBAAmB;gBACnB,aAAa;gBACb,gBAAgB;YAClB;QACF,CAAA;IAEArG,6BACEmC,MACA,CAAC,GACD;QACE,iBAAiBtB,sBAAsB,UAAUoF,WAAW,CAACK,OAAO;QACpE,GAAG1E,aAAa;YAAC;YAAc;SAAiB,CAAC;IACnD;IAGF,8CAA8C;IAC9C,IAAI,CAACO,KAAKoE,MAAM,CAAC,eAAe;QAC9BpE,KAAKC,KAAK,CAAC,cAAcoE,KAAKC,SAAS,CAACpF,sBAAsB,MAAM;IACtE;IAEAnB,cACEiC,MACAhC,kBAAkB,YAAY0D,OAAO,EAAE,UACvC,KACA;QACE6C,aAAajF,YAAYU;QACzBwE,YAAYnE,OAAOoE,OAAO,CAAC9F,eAAe6F,UAAU,EACjDb,MAAM,CAAC,CAAC,CAACe,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/BpE,GAAG,CAAC,CAAC,CAACqE,GAAGD,EAAE,GAAM,CAAA;gBAAE9B,MAAM+B;gBAAGC,aAAaF,EAAEE,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAOtF;YACb,OAAO;gBACLuF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmBnH,kBAAkBoH,SAAS;IAChD;IAGF,IAAIrD,eAAe,OAAO;QACxBR,gBAAgBxB;IAClB;IAEA,IAAIiC,QAAQ,OAAO;QACjB5C,oBAAoBW;IACtB;IAEA,MAAMb,qBAAqBa;IAC3B,OAAO,IACLZ,oBAAoBY,MAAMmC,2BAA2B;YACnDmD,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAexD,gBAAgB"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/preset/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  addDependenciesToPackageJson,\n  detectPackageManager,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  readNxJson,\n  type Tree,\n  updateJson,\n  updateNxJson,\n} from '@nx/devkit';\nimport { initGenerator } from '@nx/js';\nimport { execSync } from 'child_process';\nimport enquirer from 'enquirer';\nimport { readFileSync } from 'fs';\nimport yaml from 'js-yaml';\nimport { readModulePackageJson } from 'nx/src/utils/package-json';\nimport GeneratorsJson from '../../generators.json' with { type: 'json' };\nimport { SYNC_GENERATOR_NAME as TS_SYNC_GENERATOR_NAME } from '../ts/sync/generator';\nimport {\n  ensureAwsNxPluginConfig,\n  updateAwsNxPluginConfig,\n} from '../utils/config/utils';\nimport { inferContainers } from '../utils/containers';\nimport { DEFAULT_BIOME_CONFIG, formatFilesInSubtree } from '../utils/format';\nimport { installDependencies } from '../utils/install';\nimport { configureMcpServers } from '../utils/mcp';\nimport { addGeneratorMetricsIfApplicable } from '../utils/metrics';\nimport { getNpmScope } from '../utils/npm-scope';\nimport { getGeneratorInfo, type NxGeneratorInfo } from '../utils/nx';\nimport { getPackageManagerDisplayCommands } from '../utils/pkg-manager';\nimport { withVersions } from '../utils/versions';\nimport type { PresetGeneratorSchema } from './schema';\n\nconst WORKSPACES = ['packages/*'];\nconst NX_TYPESCRIPT_SYNC_GENERATOR = '@nx/js:typescript-sync';\n\n// Built dependencies whose install scripts the generated workspace trusts.\n// `onlyBuiltDependencies` is the pnpm 10 key (silently ignored by pnpm 11);\n// pnpm 11 reads `allowBuilds` instead. Any dep NOT in this allowlist will\n// have its install scripts skipped with a warning — matching pnpm 10's\n// default behaviour. The user can opt-in later via `pnpm approve-builds`.\nconst PNPM_BUILT_DEPENDENCIES = ['@swc/core', 'esbuild', 'nx', 'sharp'];\n\nexport const PRESET_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nconst setUpWorkspaces = (tree: Tree) => {\n  if (detectPackageManager() === 'pnpm') {\n    tree.write(\n      'pnpm-workspace.yaml',\n      yaml.dump(\n        {\n          packages: WORKSPACES,\n          allowBuilds: Object.fromEntries(\n            PNPM_BUILT_DEPENDENCIES.map((dep) => [dep, true]),\n          ),\n          onlyBuiltDependencies: PNPM_BUILT_DEPENDENCIES,\n        },\n        { quotingType: \"'\" },\n      ),\n    );\n  } else {\n    updateJson(tree, 'package.json', (json) => {\n      json.workspaces = WORKSPACES;\n      return json;\n    });\n  }\n};\n\n/**\n * Determines if the current user is an Amazon employee based on their git configuration.\n *\n * This function checks the git user email configuration to identify Amazon employees\n * by looking for email addresses with Amazon domains (e.g., @amazon.com, @amazon.co.uk).\n *\n * @returns {boolean} True if the user's git email has an Amazon domain, false otherwise\n *\n * @example\n * // Returns true for Amazon employee emails\n * // git config user.email = \"john.doe@amazon.com\"\n * isAmazonian(); // true\n *\n * @example\n * // Returns false for non-Amazon emails\n * // git config user.email = \"user@example.com\"\n * isAmazonian(); // false\n *\n * @example\n * // Returns false when git config is not available or throws an error\n * isAmazonian(); // false\n */\nexport function isAmazonian(): boolean {\n  try {\n    // Execute git command to retrieve the user's configured email address\n    const gitEmail = execSync('git config user.email', {\n      encoding: 'utf8',\n    }).trim();\n\n    // Return false if no email is configured\n    if (!gitEmail) {\n      return false;\n    }\n\n    // Split email address to extract domain part\n    const emailParts = gitEmail.split('@');\n    if (emailParts.length < 2) {\n      return false;\n    }\n\n    // Extract domain and normalize to lowercase for comparison\n    const domain = emailParts[1].toLowerCase();\n\n    // Check if domain starts with 'amazon.' (covers amazon.com, amazon.co.uk, etc.)\n    return domain.startsWith('amazon.');\n  } catch (error) {\n    // Return false if git command fails or any other error occurs\n    // This handles cases where git is not installed or configured\n    return false;\n  }\n}\n\nconst setUpGitSecrets = (tree: Tree) => {\n  const gitSecretsDir = joinPathFragments(\n    import.meta.dirname,\n    'git-secrets-files',\n    'git-secrets-dir',\n  );\n  const huskyDir = joinPathFragments(\n    import.meta.dirname,\n    'git-secrets-files',\n    'husky-dir',\n  );\n\n  tree.write(\n    '.git-secrets/git-secrets',\n    readFileSync(joinPathFragments(gitSecretsDir, 'git-secrets'), 'utf-8'),\n  );\n  tree.write(\n    '.husky/pre-commit',\n    readFileSync(joinPathFragments(huskyDir, 'pre-commit'), 'utf-8'),\n  );\n  tree.write('.gitallowed', '\\\\.git-secrets/git-secrets:\\n');\n\n  updateJson(tree, 'package.json', (json) => ({\n    ...json,\n    scripts: {\n      ...json.scripts,\n      prepare: 'husky',\n    },\n  }));\n\n  addDependenciesToPackageJson(tree, {}, withVersions(['husky']));\n};\n\nexport const presetGenerator = async (\n  tree: Tree,\n  {\n    iac,\n    gitSecrets,\n    mcp,\n    containers,\n    preferInstallDependencies,\n  }: PresetGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const resolvedContainers =\n    !containers || containers === 'infer' ? inferContainers() : containers;\n  if (\n    isAmazonian() &&\n    !process.env.VITEST &&\n    !process.env.CI &&\n    process.env.NX_DRY_RUN !== 'true' &&\n    process.env.NX_INTERACTIVE !== 'false'\n  ) {\n    const { engagementId } = await enquirer.prompt<{ engagementId?: string }>([\n      {\n        name: 'engagementId',\n        message: 'Please enter your engagementId (if known)',\n        type: 'input',\n        initial: 'None',\n      },\n    ]);\n\n    if (engagementId != 'None') {\n      await ensureAwsNxPluginConfig(tree);\n      await updateAwsNxPluginConfig(tree, { tags: [engagementId] });\n    }\n  }\n\n  // Write IaC provider and container engine to plugin config\n  await ensureAwsNxPluginConfig(tree);\n  await updateAwsNxPluginConfig(tree, {\n    iac: { provider: iac },\n    containers: { engine: resolvedContainers },\n  });\n\n  await initGenerator(tree, {\n    formatter: 'none',\n    addTsPlugin: true,\n  });\n\n  tree.delete('apps/.gitkeep');\n  tree.delete('libs/.gitkeep');\n  tree.write('packages/.gitkeep', '');\n\n  setUpWorkspaces(tree);\n\n  const nxJson = readNxJson(tree);\n  updateNxJson(tree, {\n    ...nxJson,\n    analytics: false,\n    targetDefaults: {\n      ...nxJson.targetDefaults,\n      compile: {\n        ...nxJson.targetDefaults?.compile,\n        syncGenerators: [\n          ...(nxJson.targetDefaults?.compile?.syncGenerators ?? []).filter(\n            (g) =>\n              ![TS_SYNC_GENERATOR_NAME, NX_TYPESCRIPT_SYNC_GENERATOR].includes(\n                g,\n              ),\n          ),\n          NX_TYPESCRIPT_SYNC_GENERATOR,\n          TS_SYNC_GENERATOR_NAME,\n        ],\n      },\n    },\n  });\n\n  updateJson(tree, 'package.json', (packageJson) => ({\n    ...packageJson,\n    type: 'module',\n    scripts: {\n      ...packageJson.scripts,\n      dev: 'nx run-many --target dev',\n      build: 'nx run-many --target build',\n      lint: 'nx run-many --target lint --configuration=fix',\n      test: 'nx run-many --target test --all',\n      'build:skip-lint': 'nx run-many --target build --configuration=skip-lint',\n      'build:all': 'nx run-many --target build --all',\n      'affected:all': 'nx affected --target build',\n    },\n  }));\n\n  addDependenciesToPackageJson(\n    tree,\n    {},\n    {\n      '@nx/workspace': readModulePackageJson('@nx/js').packageJson.version,\n      ...withVersions(['typescript', '@biomejs/biome']),\n    },\n  );\n\n  // Write biome.json for formatting and linting\n  if (!tree.exists('biome.json')) {\n    tree.write('biome.json', JSON.stringify(DEFAULT_BIOME_CONFIG, null, 2));\n  }\n\n  generateFiles(\n    tree, // the virtual file system\n    joinPathFragments(import.meta.dirname, 'files'),\n    '.',\n    {\n      projectName: getNpmScope(tree),\n      generators: Object.entries(GeneratorsJson.generators)\n        .filter(([_, v]) => !v['hidden'])\n        .map(([k, v]) => ({ name: k, description: v.description })),\n      ...(() => {\n        const cmds = getPackageManagerDisplayCommands();\n        return {\n          pkgMgrCmd: cmds.exec,\n          buildCmd: `${cmds.run} build`,\n          lintCmd: `${cmds.run} lint`,\n        };\n      })(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.Overwrite,\n    },\n  );\n\n  if (gitSecrets !== false) {\n    setUpGitSecrets(tree);\n  }\n\n  if (mcp !== false) {\n    configureMcpServers(tree);\n  }\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default presetGenerator;\n"],"names":["addDependenciesToPackageJson","detectPackageManager","generateFiles","joinPathFragments","OverwriteStrategy","readNxJson","updateJson","updateNxJson","initGenerator","execSync","enquirer","readFileSync","yaml","readModulePackageJson","GeneratorsJson","type","SYNC_GENERATOR_NAME","TS_SYNC_GENERATOR_NAME","ensureAwsNxPluginConfig","updateAwsNxPluginConfig","inferContainers","DEFAULT_BIOME_CONFIG","formatFilesInSubtree","installDependencies","configureMcpServers","getNpmScope","getGeneratorInfo","getPackageManagerDisplayCommands","withVersions","WORKSPACES","NX_TYPESCRIPT_SYNC_GENERATOR","PNPM_BUILT_DEPENDENCIES","PRESET_GENERATOR_INFO","filename","setUpWorkspaces","tree","write","dump","packages","allowBuilds","Object","fromEntries","map","dep","onlyBuiltDependencies","quotingType","json","workspaces","isAmazonian","gitEmail","encoding","trim","emailParts","split","length","domain","toLowerCase","startsWith","error","setUpGitSecrets","gitSecretsDir","dirname","huskyDir","scripts","prepare","presetGenerator","iac","gitSecrets","mcp","containers","preferInstallDependencies","resolvedContainers","process","env","VITEST","CI","NX_DRY_RUN","NX_INTERACTIVE","engagementId","prompt","name","message","initial","tags","provider","engine","formatter","addTsPlugin","delete","nxJson","analytics","targetDefaults","compile","syncGenerators","filter","g","includes","packageJson","dev","build","lint","test","version","exists","JSON","stringify","projectName","generators","entries","_","v","k","description","cmds","pkgMgrCmd","exec","buildCmd","run","lintCmd","overwriteStrategy","Overwrite","languages"],"mappings":"AAAA;;;CAGC,GACD,SACEA,4BAA4B,EAC5BC,oBAAoB,EAEpBC,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EACjBC,UAAU,EAEVC,UAAU,EACVC,YAAY,QACP,aAAa;AACpB,SAASC,aAAa,QAAQ,SAAS;AACvC,SAASC,QAAQ,QAAQ,gBAAgB;AACzC,OAAOC,cAAc,WAAW;AAChC,SAASC,YAAY,QAAQ,KAAK;AAClC,OAAOC,UAAU,UAAU;AAC3B,SAASC,qBAAqB,QAAQ,4BAA4B;AAClE,OAAOC,oBAAoB,6BAA6B;IAAEC,MAAM;AAAO,EAAE;AACzE,SAASC,uBAAuBC,sBAAsB,QAAQ,0BAAuB;AACrF,SACEC,uBAAuB,EACvBC,uBAAuB,QAClB,2BAAwB;AAC/B,SAASC,eAAe,QAAQ,yBAAsB;AACtD,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,qBAAkB;AAC7E,SAASC,mBAAmB,QAAQ,sBAAmB;AACvD,SAASC,mBAAmB,QAAQ,kBAAe;AAEnD,SAASC,WAAW,QAAQ,wBAAqB;AACjD,SAASC,gBAAgB,QAA8B,iBAAc;AACrE,SAASC,gCAAgC,QAAQ,0BAAuB;AACxE,SAASC,YAAY,QAAQ,uBAAoB;AAGjD,MAAMC,aAAa;IAAC;CAAa;AACjC,MAAMC,+BAA+B;AAErC,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,MAAMC,0BAA0B;IAAC;IAAa;IAAW;IAAM;CAAQ;AAEvE,OAAO,MAAMC,wBAAyCN,iBACpD,YAAYO,QAAQ,EACpB;AAEF,MAAMC,kBAAkB,CAACC;IACvB,IAAIlC,2BAA2B,QAAQ;QACrCkC,KAAKC,KAAK,CACR,uBACAxB,KAAKyB,IAAI,CACP;YACEC,UAAUT;YACVU,aAAaC,OAAOC,WAAW,CAC7BV,wBAAwBW,GAAG,CAAC,CAACC,MAAQ;oBAACA;oBAAK;iBAAK;YAElDC,uBAAuBb;QACzB,GACA;YAAEc,aAAa;QAAI;IAGzB,OAAO;QACLvC,WAAW6B,MAAM,gBAAgB,CAACW;YAChCA,KAAKC,UAAU,GAAGlB;YAClB,OAAOiB;QACT;IACF;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASE;IACd,IAAI;QACF,sEAAsE;QACtE,MAAMC,WAAWxC,SAAS,yBAAyB;YACjDyC,UAAU;QACZ,GAAGC,IAAI;QAEP,yCAAyC;QACzC,IAAI,CAACF,UAAU;YACb,OAAO;QACT;QAEA,6CAA6C;QAC7C,MAAMG,aAAaH,SAASI,KAAK,CAAC;QAClC,IAAID,WAAWE,MAAM,GAAG,GAAG;YACzB,OAAO;QACT;QAEA,2DAA2D;QAC3D,MAAMC,SAASH,UAAU,CAAC,EAAE,CAACI,WAAW;QAExC,gFAAgF;QAChF,OAAOD,OAAOE,UAAU,CAAC;IAC3B,EAAE,OAAOC,OAAO;QACd,8DAA8D;QAC9D,8DAA8D;QAC9D,OAAO;IACT;AACF;AAEA,MAAMC,kBAAkB,CAACxB;IACvB,MAAMyB,gBAAgBzD,kBACpB,YAAY0D,OAAO,EACnB,qBACA;IAEF,MAAMC,WAAW3D,kBACf,YAAY0D,OAAO,EACnB,qBACA;IAGF1B,KAAKC,KAAK,CACR,4BACAzB,aAAaR,kBAAkByD,eAAe,gBAAgB;IAEhEzB,KAAKC,KAAK,CACR,qBACAzB,aAAaR,kBAAkB2D,UAAU,eAAe;IAE1D3B,KAAKC,KAAK,CAAC,eAAe;IAE1B9B,WAAW6B,MAAM,gBAAgB,CAACW,OAAU,CAAA;YAC1C,GAAGA,IAAI;YACPiB,SAAS;gBACP,GAAGjB,KAAKiB,OAAO;gBACfC,SAAS;YACX;QACF,CAAA;IAEAhE,6BAA6BmC,MAAM,CAAC,GAAGP,aAAa;QAAC;KAAQ;AAC/D;AAEA,OAAO,MAAMqC,kBAAkB,OAC7B9B,MACA,EACE+B,GAAG,EACHC,UAAU,EACVC,GAAG,EACHC,UAAU,EACVC,yBAAyB,EACH;IAExB,MAAMC,qBACJ,CAACF,cAAcA,eAAe,UAAUjD,oBAAoBiD;IAC9D,IACErB,iBACA,CAACwB,QAAQC,GAAG,CAACC,MAAM,IACnB,CAACF,QAAQC,GAAG,CAACE,EAAE,IACfH,QAAQC,GAAG,CAACG,UAAU,KAAK,UAC3BJ,QAAQC,GAAG,CAACI,cAAc,KAAK,SAC/B;QACA,MAAM,EAAEC,YAAY,EAAE,GAAG,MAAMpE,SAASqE,MAAM,CAA4B;YACxE;gBACEC,MAAM;gBACNC,SAAS;gBACTlE,MAAM;gBACNmE,SAAS;YACX;SACD;QAED,IAAIJ,gBAAgB,QAAQ;YAC1B,MAAM5D,wBAAwBiB;YAC9B,MAAMhB,wBAAwBgB,MAAM;gBAAEgD,MAAM;oBAACL;iBAAa;YAAC;QAC7D;IACF;IAEA,2DAA2D;IAC3D,MAAM5D,wBAAwBiB;IAC9B,MAAMhB,wBAAwBgB,MAAM;QAClC+B,KAAK;YAAEkB,UAAUlB;QAAI;QACrBG,YAAY;YAAEgB,QAAQd;QAAmB;IAC3C;IAEA,MAAM/D,cAAc2B,MAAM;QACxBmD,WAAW;QACXC,aAAa;IACf;IAEApD,KAAKqD,MAAM,CAAC;IACZrD,KAAKqD,MAAM,CAAC;IACZrD,KAAKC,KAAK,CAAC,qBAAqB;IAEhCF,gBAAgBC;IAEhB,MAAMsD,SAASpF,WAAW8B;IAC1B5B,aAAa4B,MAAM;QACjB,GAAGsD,MAAM;QACTC,WAAW;QACXC,gBAAgB;YACd,GAAGF,OAAOE,cAAc;YACxBC,SAAS;gBACP,GAAGH,OAAOE,cAAc,EAAEC,OAAO;gBACjCC,gBAAgB;uBACX,AAACJ,CAAAA,OAAOE,cAAc,EAAEC,SAASC,kBAAkB,EAAE,AAAD,EAAGC,MAAM,CAC9D,CAACC,IACC,CAAC;4BAAC9E;4BAAwBa;yBAA6B,CAACkE,QAAQ,CAC9DD;oBAGNjE;oBACAb;iBACD;YACH;QACF;IACF;IAEAX,WAAW6B,MAAM,gBAAgB,CAAC8D,cAAiB,CAAA;YACjD,GAAGA,WAAW;YACdlF,MAAM;YACNgD,SAAS;gBACP,GAAGkC,YAAYlC,OAAO;gBACtBmC,KAAK;gBACLC,OAAO;gBACPC,MAAM;gBACNC,MAAM;gBACN,mBAAmB;gBACnB,aAAa;gBACb,gBAAgB;YAClB;QACF,CAAA;IAEArG,6BACEmC,MACA,CAAC,GACD;QACE,iBAAiBtB,sBAAsB,UAAUoF,WAAW,CAACK,OAAO;QACpE,GAAG1E,aAAa;YAAC;YAAc;SAAiB,CAAC;IACnD;IAGF,8CAA8C;IAC9C,IAAI,CAACO,KAAKoE,MAAM,CAAC,eAAe;QAC9BpE,KAAKC,KAAK,CAAC,cAAcoE,KAAKC,SAAS,CAACpF,sBAAsB,MAAM;IACtE;IAEAnB,cACEiC,MACAhC,kBAAkB,YAAY0D,OAAO,EAAE,UACvC,KACA;QACE6C,aAAajF,YAAYU;QACzBwE,YAAYnE,OAAOoE,OAAO,CAAC9F,eAAe6F,UAAU,EACjDb,MAAM,CAAC,CAAC,CAACe,GAAGC,EAAE,GAAK,CAACA,CAAC,CAAC,SAAS,EAC/BpE,GAAG,CAAC,CAAC,CAACqE,GAAGD,EAAE,GAAM,CAAA;gBAAE9B,MAAM+B;gBAAGC,aAAaF,EAAEE,WAAW;YAAC,CAAA;QAC1D,GAAG,AAAC,CAAA;YACF,MAAMC,OAAOtF;YACb,OAAO;gBACLuF,WAAWD,KAAKE,IAAI;gBACpBC,UAAU,GAAGH,KAAKI,GAAG,CAAC,MAAM,CAAC;gBAC7BC,SAAS,GAAGL,KAAKI,GAAG,CAAC,KAAK,CAAC;YAC7B;QACF,CAAA,GAAI;IACN,GACA;QACEE,mBAAmBnH,kBAAkBoH,SAAS;IAChD;IAGF,IAAIrD,eAAe,OAAO;QACxBR,gBAAgBxB;IAClB;IAEA,IAAIiC,QAAQ,OAAO;QACjB5C,oBAAoBW;IACtB;IAEA,MAAMb,qBAAqBa;IAC3B,OAAO,IACLZ,oBAAoBY,MAAMmC,2BAA2B;YACnDmD,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAexD,gBAAgB"}

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -68,7 +68,7 @@ const ensureDatabaseUser = async (dbUser: string): Promise<void> => {
       [
         \`CREATE USER IF NOT EXISTS \${quotedUser}@\${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS'\`,
         \`ALTER USER \${quotedUser}@\${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS' REQUIRE SSL\`,
-        \`GRANT ALL PRIVILEGES ON \${quotedDbName}.* TO \${quotedUser}@\${quotedHost}\`,
+        \`GRANT SELECT, INSERT, UPDATE, DELETE ON \${quotedDbName}.* TO \${quotedUser}@\${quotedHost}\`,
       ].join(';\\n'),
     );
   } finally {
@@ -706,32 +706,19 @@ export abstract class AuroraDatabase extends Construct {
       timeout: Duration.minutes(5),
       tracing: Tracing.ACTIVE,
       vpc,
-      environment:
-        engine.type === 'mysql'
-          ? {
-              DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-            }
-          : {
-              HOSTNAME: databaseHostname,
-              DATABASE: databaseName,
-              PORT: databasePort.toString(),
-              DBUSER: this.dbUser,
-            },
+      environment: {
+        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
+      },
       architecture: Architecture.ARM_64,
     });
 
-    if (engine.type === 'mysql') {
-      this.cluster.connections.allowDefaultPortFrom(migrationHandler);
-      this.grantSecretRead(migrationHandler);
-    } else {
-      this.allowDefaultPortFrom(migrationHandler);
-      this.grantConnect(migrationHandler);
-    }
+    this.cluster.connections.allowDefaultPortFrom(migrationHandler);
+    this.grantSecretRead(migrationHandler);
 
-    const trigger = new Trigger(this, 'MigrationTrigger', {
+    const migrationTrigger = new Trigger(this, 'MigrationTrigger', {
       handler: migrationHandler,
     });
-    trigger.node.addDependency(createDbUserResource);
+    migrationTrigger.node.addDependency(createDbUserResource);
 
     new CfnOutput(this, 'ClusterEndpoint', {
       value: this.cluster.clusterEndpoint.hostname,
@@ -1909,11 +1896,16 @@ resource "aws_iam_role_policy" "migration_handler_access" {
       {
         Effect = "Allow"
         Action = [
-          "rds-db:connect"
+          "secretsmanager:GetSecretValue"
         ]
-        Resource = [
-          "arn:aws:rds-db:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:dbuser:\${var.enable_rds_proxy ? module.aurora.proxy_resource_id : module.aurora.cluster_resource_id}/\${local.database_runtime_user}"
+        Resource = [module.aurora.secret_arn]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "kms:Decrypt"
         ]
+        Resource = [module.aurora.kms_key_arn]
       }
     ]
   })
@@ -2002,7 +1994,7 @@ resource "aws_security_group" "migration_handler" {
 
 resource "aws_vpc_security_group_egress_rule" "migration_handler_to_database" {
   security_group_id            = aws_security_group.migration_handler.id
-  referenced_security_group_id = module.aurora.security_group_id
+  referenced_security_group_id = module.aurora.database_security_group_id
   from_port   = module.aurora.cluster_port
   to_port     = module.aurora.cluster_port
   ip_protocol = "tcp"
@@ -2044,7 +2036,7 @@ resource "aws_vpc_security_group_egress_rule" "create_db_user_https" {
 }
 
 resource "aws_vpc_security_group_ingress_rule" "migration_handler_to_database" {
-  security_group_id            = module.aurora.security_group_id
+  security_group_id            = module.aurora.database_security_group_id
   referenced_security_group_id = aws_security_group.migration_handler.id
   from_port                    = module.aurora.cluster_port
   to_port                      = module.aurora.cluster_port
@@ -2165,10 +2157,7 @@ resource "aws_lambda_function" "migration_handler" {
 
   environment {
     variables = {
-      HOSTNAME = module.aurora.cluster_endpoint
-      DATABASE = module.aurora.database_name
-      PORT     = tostring(module.aurora.cluster_port)
-      DBUSER   = local.database_runtime_user
+      DATABASE_SECRET_ARN = module.aurora.secret_arn
     }
   }
 
@@ -3841,14 +3830,12 @@ const ensureDatabaseUser = async (dbUser: string): Promise<void> => {
 
     await client.query(
       \`ALTER ROLE \${quotedDbUser} WITH LOGIN;
-      GRANT ALL PRIVILEGES ON DATABASE \${quotedDbName} TO \${quotedDbUser};
-      GRANT USAGE, CREATE ON SCHEMA public TO \${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO \${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO \${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public TO \${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO \${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON SEQUENCES TO \${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON FUNCTIONS TO \${quotedDbUser};
+      GRANT CONNECT ON DATABASE \${quotedDbName} TO \${quotedDbUser};
+      GRANT USAGE ON SCHEMA public TO \${quotedDbUser};
+      GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \${quotedDbUser};
+      GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO \${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO \${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO \${quotedDbUser};
       GRANT rds_iam TO \${quotedDbUser};\`,
     );
 
@@ -3890,28 +3877,16 @@ exports[`ts#rdb generator > should generate the aurora shared construct > packag
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/migration-handler.ts 1`] = `
 "import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { Signer } from '@aws-sdk/rds-signer';
-import { withConnectionRetry } from './utils.js';
+import { getDatabaseSecret, withConnectionRetry } from './utils.js';
 
 const buildDatabaseUrl = async (): Promise<string> => {
-  const hostname = process.env.HOSTNAME!;
-  const port = process.env.PORT!;
-  const database = process.env.DATABASE!;
-  const dbUser = process.env.DBUSER!;
-  const region = process.env.AWS_REGION!;
-
-  const iamAuthToken = await new Signer({
-    hostname,
-    port: Number(port),
-    region,
-    username: dbUser,
-  }).getAuthToken();
+  const { host, port, dbname, username, password } = await getDatabaseSecret();
 
   return (
-    \`postgresql://\${encodeURIComponent(dbUser)}\` +
-    \`:\${encodeURIComponent(iamAuthToken)}\` +
-    \`@\${hostname}:\${port}/\${database}\` +
-    \`?sslaccept=strict\` // \`sslaccept\` is the correct parameter here for postgresql. The Prisma CLI Rust engine does not use the standard libpq \`sslmode\` option.
+    \`postgresql://\${encodeURIComponent(username)}\` +
+    \`:\${encodeURIComponent(password)}\` +
+    \`@\${host}:\${port}/\${dbname}\` +
+    \`?sslaccept=strict\`
   );
 };
 
@@ -4515,32 +4490,19 @@ export abstract class AuroraDatabase extends Construct {
       timeout: Duration.minutes(5),
       tracing: Tracing.ACTIVE,
       vpc,
-      environment:
-        engine.type === 'mysql'
-          ? {
-              DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-            }
-          : {
-              HOSTNAME: databaseHostname,
-              DATABASE: databaseName,
-              PORT: databasePort.toString(),
-              DBUSER: this.dbUser,
-            },
+      environment: {
+        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
+      },
       architecture: Architecture.ARM_64,
     });
 
-    if (engine.type === 'mysql') {
-      this.cluster.connections.allowDefaultPortFrom(migrationHandler);
-      this.grantSecretRead(migrationHandler);
-    } else {
-      this.allowDefaultPortFrom(migrationHandler);
-      this.grantConnect(migrationHandler);
-    }
+    this.cluster.connections.allowDefaultPortFrom(migrationHandler);
+    this.grantSecretRead(migrationHandler);
 
-    const trigger = new Trigger(this, 'MigrationTrigger', {
+    const migrationTrigger = new Trigger(this, 'MigrationTrigger', {
       handler: migrationHandler,
     });
-    trigger.node.addDependency(createDbUserResource);
+    migrationTrigger.node.addDependency(createDbUserResource);
 
     new CfnOutput(this, 'ClusterEndpoint', {
       value: this.cluster.clusterEndpoint.hostname,

package/src/ts/rdb/files/src/create-db-user-handler.ts.template

@@ -49,7 +49,7 @@ const ensureDatabaseUser = async (dbUser: string): Promise<void> => {
       [
         `CREATE USER IF NOT EXISTS ${quotedUser}@${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS'`,
         `ALTER USER ${quotedUser}@${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS' REQUIRE SSL`,
-        `GRANT ALL PRIVILEGES ON ${quotedDbName}.* TO ${quotedUser}@${quotedHost}`,
+        `GRANT SELECT, INSERT, UPDATE, DELETE ON ${quotedDbName}.* TO ${quotedUser}@${quotedHost}`,
       ].join(';\n'),
     );
   } finally {
@@ -87,14 +87,12 @@ const ensureDatabaseUser = async (dbUser: string): Promise<void> => {
 
     await client.query(
       `ALTER ROLE ${quotedDbUser} WITH LOGIN;
-      GRANT ALL PRIVILEGES ON DATABASE ${quotedDbName} TO ${quotedDbUser};
-      GRANT USAGE, CREATE ON SCHEMA public TO ${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public TO ${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO ${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON SEQUENCES TO ${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON FUNCTIONS TO ${quotedDbUser};
+      GRANT CONNECT ON DATABASE ${quotedDbName} TO ${quotedDbUser};
+      GRANT USAGE ON SCHEMA public TO ${quotedDbUser};
+      GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ${quotedDbUser};
+      GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${quotedDbUser};
       GRANT rds_iam TO ${quotedDbUser};`,
     );
 

package/src/ts/rdb/files/src/migration-handler.ts.template

@@ -1,43 +1,16 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-<%_ if (engine === 'mysql') { _%>
 import { getDatabaseSecret, withConnectionRetry } from './utils.js';
-<%_ } else { _%>
-import { Signer } from '@aws-sdk/rds-signer';
-import { withConnectionRetry } from './utils.js';
-<%_ } _%>
 
 const buildDatabaseUrl = async (): Promise<string> => {
-<%_ if (engine === 'mysql') { _%>
   const { host, port, dbname, username, password } = await getDatabaseSecret();
 
   return (
-    `mysql://${encodeURIComponent(username)}` +
+    `<%= engine === 'mysql' ? 'mysql' : 'postgresql' %>://${encodeURIComponent(username)}` +
     `:${encodeURIComponent(password)}` +
     `@${host}:${port}/${dbname}` +
     `?sslaccept=strict`
   );
-<%_ } else { _%>
-  const hostname = process.env.HOSTNAME!;
-  const port = process.env.PORT!;
-  const database = process.env.DATABASE!;
-  const dbUser = process.env.DBUSER!;
-  const region = process.env.AWS_REGION!;
-
-  const iamAuthToken = await new Signer({
-    hostname,
-    port: Number(port),
-    region,
-    username: dbUser,
-  }).getAuthToken();
-
-  return (
-    `postgresql://${encodeURIComponent(dbUser)}` +
-    `:${encodeURIComponent(iamAuthToken)}` +
-    `@${hostname}:${port}/${database}` +
-    `?sslaccept=strict` // `sslaccept` is the correct parameter here for postgresql. The Prisma CLI Rust engine does not use the standard libpq `sslmode` option.
-  );
-<%_ } _%>
 };
 
 export const handler = async () => {

package/src/ts/rdb/generator.js

@@ -85,7 +85,7 @@ export const tsRdbGenerator = async (tree, options)=>{
             ...patterns,
             'generated/prisma'
         ]);
-    await sharedRdbScriptsGenerator(tree, options.engine === 'mysql' ? 'mysql' : 'postgres');
+    await sharedRdbScriptsGenerator(tree, options.engine);
     const waitForDbScript = options.engine === 'mysql' ? 'wait-for-mysql-db.ts' : 'wait-for-postgres-db.ts';
     const scriptsDir = relative(dir, joinPathFragments(PACKAGES_DIR, SHARED_SCRIPTS_DIR, 'src', 'rdb'));
     const relativePathToRoot = getRelativePathToRootByDirectory(projectConfig.root);
@@ -207,7 +207,7 @@ export const tsRdbGenerator = async (tree, options)=>{
             databasePackageAlias: toScopeAlias(fullyQualifiedName),
             databaseName,
             adminUser: databaseUser,
-            engine: options.engine === 'mysql' ? 'mysql' : 'postgres',
+            engine: options.engine,
             migrationBundleDir,
             createDbUserBundleDir: joinPathFragments('dist', projectConfig.root, 'bundle', 'create-db-user'),
             dockerImageTag,

package/src/ts/rdb/generator.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/rdb/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { relative } from 'node:path';\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  readProjectConfiguration,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { updateGitIgnore } from '../../utils/git';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase, snakeCase, toClassName } from '../../utils/names';\nimport { getNpmScope, toScopeAlias } from '../../utils/npm-scope';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n} from '../../utils/nx';\nimport { getRelativePathToRootByDirectory } from '../../utils/paths';\nimport { registerPnpmBuiltDependencies } from '../../utils/pnpm-workspace';\nimport { assignPort } from '../../utils/port';\nimport { addRdbInfra } from '../../utils/rdb-constructs/rdb-constructs';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport {\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n} from '../../utils/shared-constructs-constants';\nimport { sharedRdbScriptsGenerator } from '../../utils/shared-rdb-scripts';\nimport { TS_VERSIONS, withVersions } from '../../utils/versions';\nimport tsProjectGenerator, { getTsLibDetails } from '../lib/generator';\nimport type { TsRdbGeneratorSchema } from './schema';\n\nexport const TS_RDB_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsRdbGenerator = async (\n  tree: Tree,\n  options: TsRdbGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const nameKebabCase = kebabCase(options.name);\n  const nameClassName = toClassName(options.name);\n  const databaseUser = options.databaseUser ?? 'dbadmin';\n  const databaseName = snakeCase(options.databaseName ?? options.name);\n  const containerEngine = await resolveContainers(tree, 'inherit');\n  const { fullyQualifiedName, dir } = getTsLibDetails(tree, {\n    name: options.name,\n    directory: options.directory,\n    subDirectory: options.subDirectory,\n  });\n\n  let projectExists: boolean;\n  try {\n    readProjectConfiguration(tree, fullyQualifiedName);\n    projectExists = true;\n  } catch {\n    projectExists = false;\n  }\n\n  if (!projectExists) {\n    await tsProjectGenerator(tree, {\n      name: options.name,\n      directory: options.directory,\n      preferInstallDependencies: false,\n    });\n  }\n\n  updateJson(tree, joinPathFragments(dir, 'tsconfig.lib.json'), (tsConfig) => ({\n    ...tsConfig,\n    include: ['src/**/*.ts', 'generated/prisma/**/*.ts'],\n  }));\n\n  const projectConfig = readProjectConfiguration(tree, fullyQualifiedName);\n  const localDbPort = assignPort(\n    tree,\n    projectConfig,\n    options.engine === 'mysql' ? 3306 : 5432,\n  );\n  const localDbHost = 'localhost';\n  const localDbUser = options.engine === 'mysql' ? 'root' : 'dbadmin';\n  const localDbPassword = 'password';\n  const containerName = `${getNpmScope(tree)}-${databaseName}`;\n  const dockerImage =\n    options.engine === 'mysql'\n      ? 'public.ecr.aws/docker/library/mysql:8.0.44'\n      : 'public.ecr.aws/docker/library/postgres:17.7';\n\n  const templateOptions = {\n    engine: options.engine,\n    runtimeConfigKey: nameClassName,\n    databasePackageAlias: toScopeAlias(fullyQualifiedName),\n    databaseProvider: options.engine === 'mysql' ? 'mysql' : 'postgresql',\n    prismaVersion: TS_VERSIONS.prisma,\n    prismaAdapterPackage:\n      options.engine === 'mysql'\n        ? '@prisma/adapter-mariadb'\n        : '@prisma/adapter-pg',\n    prismaAdapterClassName:\n      options.engine === 'mysql' ? 'PrismaMariaDb' : 'PrismaPg',\n    localDbPort,\n    localDbHost,\n    localDbName: databaseName,\n    localDbUser,\n    localDbPassword,\n    containerEngine,\n    containerName,\n    dockerImage,\n  };\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    dir,\n    templateOptions,\n  );\n  updateGitIgnore(tree, dir, (patterns) => [...patterns, 'generated/prisma']);\n  await sharedRdbScriptsGenerator(\n    tree,\n    options.engine === 'mysql' ? 'mysql' : 'postgres',\n  );\n  const waitForDbScript =\n    options.engine === 'mysql'\n      ? 'wait-for-mysql-db.ts'\n      : 'wait-for-postgres-db.ts';\n  const scriptsDir = relative(\n    dir,\n    joinPathFragments(PACKAGES_DIR, SHARED_SCRIPTS_DIR, 'src', 'rdb'),\n  );\n  const relativePathToRoot = getRelativePathToRootByDirectory(\n    projectConfig.root,\n  );\n  const fs = new FsCommands(tree);\n  const migrationBundleDir = joinPathFragments(\n    'dist',\n    projectConfig.root,\n    'bundle',\n    'migration',\n  );\n  const dockerImageTag = `${getNpmScope(tree)}-${kebabCase(options.name)}-migration:latest`;\n\n  if (options.infra !== 'none') {\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: 'src/migration-handler.ts',\n      bundleOutputDir: 'migration',\n    });\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: 'src/create-db-user-handler.ts',\n      bundleOutputDir: 'create-db-user',\n    });\n    const bundleTarget = projectConfig.targets['bundle'];\n    // The bundle target starts with a single rolldown `command`. Wrap it with\n    // the migration asset copy steps, unless it has already been transformed\n    // into a `commands` array on a previous run.\n    if (!bundleTarget.options.commands) {\n      const rolldownCommand = bundleTarget.options.command;\n      delete bundleTarget.options.command;\n      bundleTarget.options = {\n        ...bundleTarget.options,\n        commands: [\n          fs.rm(`${relativePathToRoot}dist/{projectRoot}/bundle/migration`),\n          fs.mkdir(`${relativePathToRoot}dist/{projectRoot}/bundle/migration`),\n          fs.cp(\n            'prisma',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/prisma`,\n          ),\n          fs.cp(\n            'prisma.config.ts',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/prisma.config.ts`,\n          ),\n          fs.cp(\n            'Dockerfile',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/Dockerfile`,\n          ),\n          rolldownCommand,\n        ],\n        parallel: false,\n      };\n    }\n  }\n\n  projectConfig.targets.generate = {\n    executor: 'nx:run-commands',\n    outputs: ['{projectRoot}/generated/prisma'],\n    options: {\n      command: 'prisma generate',\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets['pull-image'] = {\n    executor: 'nx:run-commands',\n    options: {\n      command: `tsx ${scriptsDir}/pull-image.ts`,\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets['dev'] = {\n    executor: 'nx:run-commands',\n    options: {\n      command: `tsx ${scriptsDir}/start-container.ts`,\n      cwd: '{projectRoot}',\n    },\n    continuous: true,\n  };\n  projectConfig.targets['wait-for-db'] = {\n    executor: 'nx:run-commands',\n    dependsOn: ['dev'],\n    options: {\n      command: `tsx ${scriptsDir}/${waitForDbScript}`,\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets.prisma = {\n    executor: 'nx:run-commands',\n    dependsOn: ['dev', 'wait-for-db'],\n    options: {\n      cwd: '{projectRoot}',\n      command: 'prisma',\n      env: {\n        LOCAL_DEV: 'true',\n      },\n    },\n  };\n  if (options.infra !== 'none') {\n    const iac = await resolveIac(tree, options.iac);\n    if (iac === 'terraform') {\n      projectConfig.targets['docker'] = {\n        cache: true,\n        executor: 'nx:run-commands',\n        options: {\n          command: `${containerEngine} build --platform linux/arm64 --provenance=false -t ${dockerImageTag} ${migrationBundleDir}`,\n        },\n        dependsOn: ['bundle'],\n      };\n      addDependencyToTargetIfNotPresent(projectConfig, 'build', 'docker');\n    }\n    addDependencyToTargetIfNotPresent(projectConfig, 'build', 'bundle');\n  }\n  addDependencyToTargetIfNotPresent(projectConfig, 'compile', 'generate');\n  updateProjectConfiguration(tree, fullyQualifiedName, projectConfig);\n  addGeneratorMetadata(tree, fullyQualifiedName, TS_RDB_GENERATOR_INFO, {\n    engine: options.engine,\n  });\n\n  if (options.infra !== 'none') {\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n    await addRdbInfra(tree, {\n      iac,\n      projectName: fullyQualifiedName,\n      projectRoot: dir,\n      nameClassName,\n      nameKebabCase,\n      databasePackageAlias: toScopeAlias(fullyQualifiedName),\n      databaseName,\n      adminUser: databaseUser,\n      engine: options.engine === 'mysql' ? 'mysql' : 'postgres',\n      migrationBundleDir,\n      createDbUserBundleDir: joinPathFragments(\n        'dist',\n        projectConfig.root,\n        'bundle',\n        'create-db-user',\n      ),\n      dockerImageTag,\n      containerEngine,\n    });\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      '@aws-sdk/client-secrets-manager',\n      '@aws-sdk/rds-signer',\n      '@prisma/client',\n      ...(options.engine === 'mysql'\n        ? (['@prisma/adapter-mariadb', 'mariadb'] as const)\n        : (['@prisma/adapter-pg', 'pg'] as const)),\n    ]),\n    withVersions([\n      'prisma',\n      'tsx',\n      '@types/aws-lambda',\n      ...(options.engine === 'mysql'\n        ? ([] as const)\n        : (['@types/pg'] as const)),\n    ]),\n  );\n\n  registerPnpmBuiltDependencies(tree, {\n    '@prisma/engines': false,\n    prisma: false,\n  });\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_RDB_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsRdbGenerator;\n"],"names":["relative","addDependenciesToPackageJson","generateFiles","joinPathFragments","readProjectConfiguration","updateJson","updateProjectConfiguration","addTypeScriptBundleTarget","resolveContainers","formatFilesInSubtree","FsCommands","updateGitIgnore","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","snakeCase","toClassName","getNpmScope","toScopeAlias","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","getRelativePathToRootByDirectory","registerPnpmBuiltDependencies","assignPort","addRdbInfra","sharedConstructsGenerator","PACKAGES_DIR","SHARED_SCRIPTS_DIR","sharedRdbScriptsGenerator","TS_VERSIONS","withVersions","tsProjectGenerator","getTsLibDetails","TS_RDB_GENERATOR_INFO","filename","tsRdbGenerator","tree","options","nameKebabCase","name","nameClassName","databaseUser","databaseName","containerEngine","fullyQualifiedName","dir","directory","subDirectory","projectExists","preferInstallDependencies","tsConfig","include","projectConfig","localDbPort","engine","localDbHost","localDbUser","localDbPassword","containerName","dockerImage","templateOptions","runtimeConfigKey","databasePackageAlias","databaseProvider","prismaVersion","prisma","prismaAdapterPackage","prismaAdapterClassName","localDbName","dirname","patterns","waitForDbScript","scriptsDir","relativePathToRoot","root","fs","migrationBundleDir","dockerImageTag","infra","targetFilePath","bundleOutputDir","bundleTarget","targets","commands","rolldownCommand","command","rm","mkdir","cp","parallel","generate","executor","outputs","cwd","continuous","dependsOn","env","LOCAL_DEV","iac","cache","projectName","projectRoot","adminUser","createDbUserBundleDir","languages"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,QAAQ,YAAY;AACrC,SACEC,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,wBAAwB,EAExBC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,eAAe,QAAQ,qBAAkB;AAClD,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,EAAEC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AACtE,SAASC,WAAW,EAAEC,YAAY,QAAQ,2BAAwB;AAClE,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,QAEX,oBAAiB;AACxB,SAASC,gCAAgC,QAAQ,uBAAoB;AACrE,SAASC,6BAA6B,QAAQ,gCAA6B;AAC3E,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,WAAW,QAAQ,+CAA4C;AACxE,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SACEC,YAAY,EACZC,kBAAkB,QACb,6CAA0C;AACjD,SAASC,yBAAyB,QAAQ,oCAAiC;AAC3E,SAASC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AACjE,OAAOC,sBAAsBC,eAAe,QAAQ,sBAAmB;AAGvE,OAAO,MAAMC,wBAAyCb,iBACpD,YAAYc,QAAQ,EACpB;AAEF,OAAO,MAAMC,iBAAiB,OAC5BC,MACAC;IAEA,MAAMC,gBAAgBzB,UAAUwB,QAAQE,IAAI;IAC5C,MAAMC,gBAAgBzB,YAAYsB,QAAQE,IAAI;IAC9C,MAAME,eAAeJ,QAAQI,YAAY,IAAI;IAC7C,MAAMC,eAAe5B,UAAUuB,QAAQK,YAAY,IAAIL,QAAQE,IAAI;IACnE,MAAMI,kBAAkB,MAAMrC,kBAAkB8B,MAAM;IACtD,MAAM,EAAEQ,kBAAkB,EAAEC,GAAG,EAAE,GAAGb,gBAAgBI,MAAM;QACxDG,MAAMF,QAAQE,IAAI;QAClBO,WAAWT,QAAQS,SAAS;QAC5BC,cAAcV,QAAQU,YAAY;IACpC;IAEA,IAAIC;IACJ,IAAI;QACF9C,yBAAyBkC,MAAMQ;QAC/BI,gBAAgB;IAClB,EAAE,OAAM;QACNA,gBAAgB;IAClB;IAEA,IAAI,CAACA,eAAe;QAClB,MAAMjB,mBAAmBK,MAAM;YAC7BG,MAAMF,QAAQE,IAAI;YAClBO,WAAWT,QAAQS,SAAS;YAC5BG,2BAA2B;QAC7B;IACF;IAEA9C,WAAWiC,MAAMnC,kBAAkB4C,KAAK,sBAAsB,CAACK,WAAc,CAAA;YAC3E,GAAGA,QAAQ;YACXC,SAAS;gBAAC;gBAAe;aAA2B;QACtD,CAAA;IAEA,MAAMC,gBAAgBlD,yBAAyBkC,MAAMQ;IACrD,MAAMS,cAAc9B,WAClBa,MACAgB,eACAf,QAAQiB,MAAM,KAAK,UAAU,OAAO;IAEtC,MAAMC,cAAc;IACpB,MAAMC,cAAcnB,QAAQiB,MAAM,KAAK,UAAU,SAAS;IAC1D,MAAMG,kBAAkB;IACxB,MAAMC,gBAAgB,GAAG1C,YAAYoB,MAAM,CAAC,EAAEM,cAAc;IAC5D,MAAMiB,cACJtB,QAAQiB,MAAM,KAAK,UACf,+CACA;IAEN,MAAMM,kBAAkB;QACtBN,QAAQjB,QAAQiB,MAAM;QACtBO,kBAAkBrB;QAClBsB,sBAAsB7C,aAAa2B;QACnCmB,kBAAkB1B,QAAQiB,MAAM,KAAK,UAAU,UAAU;QACzDU,eAAenC,YAAYoC,MAAM;QACjCC,sBACE7B,QAAQiB,MAAM,KAAK,UACf,4BACA;QACNa,wBACE9B,QAAQiB,MAAM,KAAK,UAAU,kBAAkB;QACjDD;QACAE;QACAa,aAAa1B;QACbc;QACAC;QACAd;QACAe;QACAC;IACF;IAEA3D,cACEoC,MACAnC,kBAAkB,YAAYoE,OAAO,EAAE,UACvCxB,KACAe;IAEFnD,gBAAgB2B,MAAMS,KAAK,CAACyB,WAAa;eAAIA;YAAU;SAAmB;IAC1E,MAAM1C,0BACJQ,MACAC,QAAQiB,MAAM,KAAK,UAAU,UAAU;IAEzC,MAAMiB,kBACJlC,QAAQiB,MAAM,KAAK,UACf,yBACA;IACN,MAAMkB,aAAa1E,SACjB+C,KACA5C,kBAAkByB,cAAcC,oBAAoB,OAAO;IAE7D,MAAM8C,qBAAqBpD,iCACzB+B,cAAcsB,IAAI;IAEpB,MAAMC,KAAK,IAAInE,WAAW4B;IAC1B,MAAMwC,qBAAqB3E,kBACzB,QACAmD,cAAcsB,IAAI,EAClB,UACA;IAEF,MAAMG,iBAAiB,GAAG7D,YAAYoB,MAAM,CAAC,EAAEvB,UAAUwB,QAAQE,IAAI,EAAE,iBAAiB,CAAC;IAEzF,IAAIF,QAAQyC,KAAK,KAAK,QAAQ;QAC5B,MAAMzE,0BAA0B+B,MAAMgB,eAAe;YACnD2B,gBAAgB;YAChBC,iBAAiB;QACnB;QACA,MAAM3E,0BAA0B+B,MAAMgB,eAAe;YACnD2B,gBAAgB;YAChBC,iBAAiB;QACnB;QACA,MAAMC,eAAe7B,cAAc8B,OAAO,CAAC,SAAS;QACpD,0EAA0E;QAC1E,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,CAACD,aAAa5C,OAAO,CAAC8C,QAAQ,EAAE;YAClC,MAAMC,kBAAkBH,aAAa5C,OAAO,CAACgD,OAAO;YACpD,OAAOJ,aAAa5C,OAAO,CAACgD,OAAO;YACnCJ,aAAa5C,OAAO,GAAG;gBACrB,GAAG4C,aAAa5C,OAAO;gBACvB8C,UAAU;oBACRR,GAAGW,EAAE,CAAC,GAAGb,mBAAmB,mCAAmC,CAAC;oBAChEE,GAAGY,KAAK,CAAC,GAAGd,mBAAmB,mCAAmC,CAAC;oBACnEE,GAAGa,EAAE,CACH,UACA,GAAGf,mBAAmB,0CAA0C,CAAC;oBAEnEE,GAAGa,EAAE,CACH,oBACA,GAAGf,mBAAmB,oDAAoD,CAAC;oBAE7EE,GAAGa,EAAE,CACH,cACA,GAAGf,mBAAmB,8CAA8C,CAAC;oBAEvEW;iBACD;gBACDK,UAAU;YACZ;QACF;IACF;IAEArC,cAAc8B,OAAO,CAACQ,QAAQ,GAAG;QAC/BC,UAAU;QACVC,SAAS;YAAC;SAAiC;QAC3CvD,SAAS;YACPgD,SAAS;YACTQ,KAAK;QACP;IACF;IACAzC,cAAc8B,OAAO,CAAC,aAAa,GAAG;QACpCS,UAAU;QACVtD,SAAS;YACPgD,SAAS,CAAC,IAAI,EAAEb,WAAW,cAAc,CAAC;YAC1CqB,KAAK;QACP;IACF;IACAzC,cAAc8B,OAAO,CAAC,MAAM,GAAG;QAC7BS,UAAU;QACVtD,SAAS;YACPgD,SAAS,CAAC,IAAI,EAAEb,WAAW,mBAAmB,CAAC;YAC/CqB,KAAK;QACP;QACAC,YAAY;IACd;IACA1C,cAAc8B,OAAO,CAAC,cAAc,GAAG;QACrCS,UAAU;QACVI,WAAW;YAAC;SAAM;QAClB1D,SAAS;YACPgD,SAAS,CAAC,IAAI,EAAEb,WAAW,CAAC,EAAED,iBAAiB;YAC/CsB,KAAK;QACP;IACF;IACAzC,cAAc8B,OAAO,CAACjB,MAAM,GAAG;QAC7B0B,UAAU;QACVI,WAAW;YAAC;YAAO;SAAc;QACjC1D,SAAS;YACPwD,KAAK;YACLR,SAAS;YACTW,KAAK;gBACHC,WAAW;YACb;QACF;IACF;IACA,IAAI5D,QAAQyC,KAAK,KAAK,QAAQ;QAC5B,MAAMoB,MAAM,MAAMxF,WAAW0B,MAAMC,QAAQ6D,GAAG;QAC9C,IAAIA,QAAQ,aAAa;YACvB9C,cAAc8B,OAAO,CAAC,SAAS,GAAG;gBAChCiB,OAAO;gBACPR,UAAU;gBACVtD,SAAS;oBACPgD,SAAS,GAAG1C,gBAAgB,oDAAoD,EAAEkC,eAAe,CAAC,EAAED,oBAAoB;gBAC1H;gBACAmB,WAAW;oBAAC;iBAAS;YACvB;YACA7E,kCAAkCkC,eAAe,SAAS;QAC5D;QACAlC,kCAAkCkC,eAAe,SAAS;IAC5D;IACAlC,kCAAkCkC,eAAe,WAAW;IAC5DhD,2BAA2BgC,MAAMQ,oBAAoBQ;IACrDjC,qBAAqBiB,MAAMQ,oBAAoBX,uBAAuB;QACpEqB,QAAQjB,QAAQiB,MAAM;IACxB;IAEA,IAAIjB,QAAQyC,KAAK,KAAK,QAAQ;QAC5B,MAAMoB,MAAM,MAAMxF,WAAW0B,MAAMC,QAAQ6D,GAAG;QAC9C,MAAMzE,0BAA0BW,MAAM;YAAE8D;QAAI;QAC5C,MAAM1E,YAAYY,MAAM;YACtB8D;YACAE,aAAaxD;YACbyD,aAAaxD;YACbL;YACAF;YACAwB,sBAAsB7C,aAAa2B;YACnCF;YACA4D,WAAW7D;YACXa,QAAQjB,QAAQiB,MAAM,KAAK,UAAU,UAAU;YAC/CsB;YACA2B,uBAAuBtG,kBACrB,QACAmD,cAAcsB,IAAI,EAClB,UACA;YAEFG;YACAlC;QACF;IACF;IAEA5C,6BACEqC,MACAN,aAAa;QACX;QACA;QACA;QACA;QACA;WACIO,QAAQiB,MAAM,KAAK,UAClB;YAAC;YAA2B;SAAU,GACtC;YAAC;YAAsB;SAAK;KAClC,GACDxB,aAAa;QACX;QACA;QACA;WACIO,QAAQiB,MAAM,KAAK,UAClB,EAAE,GACF;YAAC;SAAY;KACnB;IAGHhC,8BAA8Bc,MAAM;QAClC,mBAAmB;QACnB6B,QAAQ;IACV;IAEA,MAAMrD,gCAAgCwB,MAAM;QAACH;KAAsB;IAEnE,MAAM1B,qBAAqB6B;IAC3B,OAAO,IACLzB,oBAAoByB,MAAMC,QAAQY,yBAAyB,EAAE;YAC3DuD,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAerE,eAAe"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/ts/rdb/generator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { relative } from 'node:path';\nimport {\n  addDependenciesToPackageJson,\n  type GeneratorCallback,\n  generateFiles,\n  joinPathFragments,\n  readProjectConfiguration,\n  type Tree,\n  updateJson,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { addTypeScriptBundleTarget } from '../../utils/bundle/bundle';\nimport { resolveContainers } from '../../utils/containers';\nimport { formatFilesInSubtree } from '../../utils/format';\nimport { FsCommands } from '../../utils/fs';\nimport { updateGitIgnore } from '../../utils/git';\nimport { resolveIac } from '../../utils/iac';\nimport { installDependencies } from '../../utils/install';\nimport { addGeneratorMetricsIfApplicable } from '../../utils/metrics';\nimport { kebabCase, snakeCase, toClassName } from '../../utils/names';\nimport { getNpmScope, toScopeAlias } from '../../utils/npm-scope';\nimport {\n  addDependencyToTargetIfNotPresent,\n  addGeneratorMetadata,\n  getGeneratorInfo,\n  type NxGeneratorInfo,\n} from '../../utils/nx';\nimport { getRelativePathToRootByDirectory } from '../../utils/paths';\nimport { registerPnpmBuiltDependencies } from '../../utils/pnpm-workspace';\nimport { assignPort } from '../../utils/port';\nimport { addRdbInfra } from '../../utils/rdb-constructs/rdb-constructs';\nimport { sharedConstructsGenerator } from '../../utils/shared-constructs';\nimport {\n  PACKAGES_DIR,\n  SHARED_SCRIPTS_DIR,\n} from '../../utils/shared-constructs-constants';\nimport { sharedRdbScriptsGenerator } from '../../utils/shared-rdb-scripts';\nimport { TS_VERSIONS, withVersions } from '../../utils/versions';\nimport tsProjectGenerator, { getTsLibDetails } from '../lib/generator';\nimport type { TsRdbGeneratorSchema } from './schema';\n\nexport const TS_RDB_GENERATOR_INFO: NxGeneratorInfo = getGeneratorInfo(\n  import.meta.filename,\n);\n\nexport const tsRdbGenerator = async (\n  tree: Tree,\n  options: TsRdbGeneratorSchema,\n): Promise<GeneratorCallback> => {\n  const nameKebabCase = kebabCase(options.name);\n  const nameClassName = toClassName(options.name);\n  const databaseUser = options.databaseUser ?? 'dbadmin';\n  const databaseName = snakeCase(options.databaseName ?? options.name);\n  const containerEngine = await resolveContainers(tree, 'inherit');\n  const { fullyQualifiedName, dir } = getTsLibDetails(tree, {\n    name: options.name,\n    directory: options.directory,\n    subDirectory: options.subDirectory,\n  });\n\n  let projectExists: boolean;\n  try {\n    readProjectConfiguration(tree, fullyQualifiedName);\n    projectExists = true;\n  } catch {\n    projectExists = false;\n  }\n\n  if (!projectExists) {\n    await tsProjectGenerator(tree, {\n      name: options.name,\n      directory: options.directory,\n      preferInstallDependencies: false,\n    });\n  }\n\n  updateJson(tree, joinPathFragments(dir, 'tsconfig.lib.json'), (tsConfig) => ({\n    ...tsConfig,\n    include: ['src/**/*.ts', 'generated/prisma/**/*.ts'],\n  }));\n\n  const projectConfig = readProjectConfiguration(tree, fullyQualifiedName);\n  const localDbPort = assignPort(\n    tree,\n    projectConfig,\n    options.engine === 'mysql' ? 3306 : 5432,\n  );\n  const localDbHost = 'localhost';\n  const localDbUser = options.engine === 'mysql' ? 'root' : 'dbadmin';\n  const localDbPassword = 'password';\n  const containerName = `${getNpmScope(tree)}-${databaseName}`;\n  const dockerImage =\n    options.engine === 'mysql'\n      ? 'public.ecr.aws/docker/library/mysql:8.0.44'\n      : 'public.ecr.aws/docker/library/postgres:17.7';\n\n  const templateOptions = {\n    engine: options.engine,\n    runtimeConfigKey: nameClassName,\n    databasePackageAlias: toScopeAlias(fullyQualifiedName),\n    databaseProvider: options.engine === 'mysql' ? 'mysql' : 'postgresql',\n    prismaVersion: TS_VERSIONS.prisma,\n    prismaAdapterPackage:\n      options.engine === 'mysql'\n        ? '@prisma/adapter-mariadb'\n        : '@prisma/adapter-pg',\n    prismaAdapterClassName:\n      options.engine === 'mysql' ? 'PrismaMariaDb' : 'PrismaPg',\n    localDbPort,\n    localDbHost,\n    localDbName: databaseName,\n    localDbUser,\n    localDbPassword,\n    containerEngine,\n    containerName,\n    dockerImage,\n  };\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files'),\n    dir,\n    templateOptions,\n  );\n  updateGitIgnore(tree, dir, (patterns) => [...patterns, 'generated/prisma']);\n  await sharedRdbScriptsGenerator(tree, options.engine);\n  const waitForDbScript =\n    options.engine === 'mysql'\n      ? 'wait-for-mysql-db.ts'\n      : 'wait-for-postgres-db.ts';\n  const scriptsDir = relative(\n    dir,\n    joinPathFragments(PACKAGES_DIR, SHARED_SCRIPTS_DIR, 'src', 'rdb'),\n  );\n  const relativePathToRoot = getRelativePathToRootByDirectory(\n    projectConfig.root,\n  );\n  const fs = new FsCommands(tree);\n  const migrationBundleDir = joinPathFragments(\n    'dist',\n    projectConfig.root,\n    'bundle',\n    'migration',\n  );\n  const dockerImageTag = `${getNpmScope(tree)}-${kebabCase(options.name)}-migration:latest`;\n\n  if (options.infra !== 'none') {\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: 'src/migration-handler.ts',\n      bundleOutputDir: 'migration',\n    });\n    await addTypeScriptBundleTarget(tree, projectConfig, {\n      targetFilePath: 'src/create-db-user-handler.ts',\n      bundleOutputDir: 'create-db-user',\n    });\n    const bundleTarget = projectConfig.targets['bundle'];\n    // The bundle target starts with a single rolldown `command`. Wrap it with\n    // the migration asset copy steps, unless it has already been transformed\n    // into a `commands` array on a previous run.\n    if (!bundleTarget.options.commands) {\n      const rolldownCommand = bundleTarget.options.command;\n      delete bundleTarget.options.command;\n      bundleTarget.options = {\n        ...bundleTarget.options,\n        commands: [\n          fs.rm(`${relativePathToRoot}dist/{projectRoot}/bundle/migration`),\n          fs.mkdir(`${relativePathToRoot}dist/{projectRoot}/bundle/migration`),\n          fs.cp(\n            'prisma',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/prisma`,\n          ),\n          fs.cp(\n            'prisma.config.ts',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/prisma.config.ts`,\n          ),\n          fs.cp(\n            'Dockerfile',\n            `${relativePathToRoot}dist/{projectRoot}/bundle/migration/Dockerfile`,\n          ),\n          rolldownCommand,\n        ],\n        parallel: false,\n      };\n    }\n  }\n\n  projectConfig.targets.generate = {\n    executor: 'nx:run-commands',\n    outputs: ['{projectRoot}/generated/prisma'],\n    options: {\n      command: 'prisma generate',\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets['pull-image'] = {\n    executor: 'nx:run-commands',\n    options: {\n      command: `tsx ${scriptsDir}/pull-image.ts`,\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets['dev'] = {\n    executor: 'nx:run-commands',\n    options: {\n      command: `tsx ${scriptsDir}/start-container.ts`,\n      cwd: '{projectRoot}',\n    },\n    continuous: true,\n  };\n  projectConfig.targets['wait-for-db'] = {\n    executor: 'nx:run-commands',\n    dependsOn: ['dev'],\n    options: {\n      command: `tsx ${scriptsDir}/${waitForDbScript}`,\n      cwd: '{projectRoot}',\n    },\n  };\n  projectConfig.targets.prisma = {\n    executor: 'nx:run-commands',\n    dependsOn: ['dev', 'wait-for-db'],\n    options: {\n      cwd: '{projectRoot}',\n      command: 'prisma',\n      env: {\n        LOCAL_DEV: 'true',\n      },\n    },\n  };\n  if (options.infra !== 'none') {\n    const iac = await resolveIac(tree, options.iac);\n    if (iac === 'terraform') {\n      projectConfig.targets['docker'] = {\n        cache: true,\n        executor: 'nx:run-commands',\n        options: {\n          command: `${containerEngine} build --platform linux/arm64 --provenance=false -t ${dockerImageTag} ${migrationBundleDir}`,\n        },\n        dependsOn: ['bundle'],\n      };\n      addDependencyToTargetIfNotPresent(projectConfig, 'build', 'docker');\n    }\n    addDependencyToTargetIfNotPresent(projectConfig, 'build', 'bundle');\n  }\n  addDependencyToTargetIfNotPresent(projectConfig, 'compile', 'generate');\n  updateProjectConfiguration(tree, fullyQualifiedName, projectConfig);\n  addGeneratorMetadata(tree, fullyQualifiedName, TS_RDB_GENERATOR_INFO, {\n    engine: options.engine,\n  });\n\n  if (options.infra !== 'none') {\n    const iac = await resolveIac(tree, options.iac);\n    await sharedConstructsGenerator(tree, { iac });\n    await addRdbInfra(tree, {\n      iac,\n      projectName: fullyQualifiedName,\n      projectRoot: dir,\n      nameClassName,\n      nameKebabCase,\n      databasePackageAlias: toScopeAlias(fullyQualifiedName),\n      databaseName,\n      adminUser: databaseUser,\n      engine: options.engine,\n      migrationBundleDir,\n      createDbUserBundleDir: joinPathFragments(\n        'dist',\n        projectConfig.root,\n        'bundle',\n        'create-db-user',\n      ),\n      dockerImageTag,\n      containerEngine,\n    });\n  }\n\n  addDependenciesToPackageJson(\n    tree,\n    withVersions([\n      '@aws-lambda-powertools/parameters',\n      '@aws-sdk/client-appconfigdata',\n      '@aws-sdk/client-secrets-manager',\n      '@aws-sdk/rds-signer',\n      '@prisma/client',\n      ...(options.engine === 'mysql'\n        ? (['@prisma/adapter-mariadb', 'mariadb'] as const)\n        : (['@prisma/adapter-pg', 'pg'] as const)),\n    ]),\n    withVersions([\n      'prisma',\n      'tsx',\n      '@types/aws-lambda',\n      ...(options.engine === 'mysql'\n        ? ([] as const)\n        : (['@types/pg'] as const)),\n    ]),\n  );\n\n  registerPnpmBuiltDependencies(tree, {\n    '@prisma/engines': false,\n    prisma: false,\n  });\n\n  await addGeneratorMetricsIfApplicable(tree, [TS_RDB_GENERATOR_INFO]);\n\n  await formatFilesInSubtree(tree);\n  return () =>\n    installDependencies(tree, options.preferInstallDependencies, {\n      languages: ['typescript'],\n    });\n};\n\nexport default tsRdbGenerator;\n"],"names":["relative","addDependenciesToPackageJson","generateFiles","joinPathFragments","readProjectConfiguration","updateJson","updateProjectConfiguration","addTypeScriptBundleTarget","resolveContainers","formatFilesInSubtree","FsCommands","updateGitIgnore","resolveIac","installDependencies","addGeneratorMetricsIfApplicable","kebabCase","snakeCase","toClassName","getNpmScope","toScopeAlias","addDependencyToTargetIfNotPresent","addGeneratorMetadata","getGeneratorInfo","getRelativePathToRootByDirectory","registerPnpmBuiltDependencies","assignPort","addRdbInfra","sharedConstructsGenerator","PACKAGES_DIR","SHARED_SCRIPTS_DIR","sharedRdbScriptsGenerator","TS_VERSIONS","withVersions","tsProjectGenerator","getTsLibDetails","TS_RDB_GENERATOR_INFO","filename","tsRdbGenerator","tree","options","nameKebabCase","name","nameClassName","databaseUser","databaseName","containerEngine","fullyQualifiedName","dir","directory","subDirectory","projectExists","preferInstallDependencies","tsConfig","include","projectConfig","localDbPort","engine","localDbHost","localDbUser","localDbPassword","containerName","dockerImage","templateOptions","runtimeConfigKey","databasePackageAlias","databaseProvider","prismaVersion","prisma","prismaAdapterPackage","prismaAdapterClassName","localDbName","dirname","patterns","waitForDbScript","scriptsDir","relativePathToRoot","root","fs","migrationBundleDir","dockerImageTag","infra","targetFilePath","bundleOutputDir","bundleTarget","targets","commands","rolldownCommand","command","rm","mkdir","cp","parallel","generate","executor","outputs","cwd","continuous","dependsOn","env","LOCAL_DEV","iac","cache","projectName","projectRoot","adminUser","createDbUserBundleDir","languages"],"mappings":"AAAA;;;CAGC,GACD,SAASA,QAAQ,QAAQ,YAAY;AACrC,SACEC,4BAA4B,EAE5BC,aAAa,EACbC,iBAAiB,EACjBC,wBAAwB,EAExBC,UAAU,EACVC,0BAA0B,QACrB,aAAa;AACpB,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,iBAAiB,QAAQ,4BAAyB;AAC3D,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,UAAU,QAAQ,oBAAiB;AAC5C,SAASC,eAAe,QAAQ,qBAAkB;AAClD,SAASC,UAAU,QAAQ,qBAAkB;AAC7C,SAASC,mBAAmB,QAAQ,yBAAsB;AAC1D,SAASC,+BAA+B,QAAQ,yBAAsB;AACtE,SAASC,SAAS,EAAEC,SAAS,EAAEC,WAAW,QAAQ,uBAAoB;AACtE,SAASC,WAAW,EAAEC,YAAY,QAAQ,2BAAwB;AAClE,SACEC,iCAAiC,EACjCC,oBAAoB,EACpBC,gBAAgB,QAEX,oBAAiB;AACxB,SAASC,gCAAgC,QAAQ,uBAAoB;AACrE,SAASC,6BAA6B,QAAQ,gCAA6B;AAC3E,SAASC,UAAU,QAAQ,sBAAmB;AAC9C,SAASC,WAAW,QAAQ,+CAA4C;AACxE,SAASC,yBAAyB,QAAQ,mCAAgC;AAC1E,SACEC,YAAY,EACZC,kBAAkB,QACb,6CAA0C;AACjD,SAASC,yBAAyB,QAAQ,oCAAiC;AAC3E,SAASC,WAAW,EAAEC,YAAY,QAAQ,0BAAuB;AACjE,OAAOC,sBAAsBC,eAAe,QAAQ,sBAAmB;AAGvE,OAAO,MAAMC,wBAAyCb,iBACpD,YAAYc,QAAQ,EACpB;AAEF,OAAO,MAAMC,iBAAiB,OAC5BC,MACAC;IAEA,MAAMC,gBAAgBzB,UAAUwB,QAAQE,IAAI;IAC5C,MAAMC,gBAAgBzB,YAAYsB,QAAQE,IAAI;IAC9C,MAAME,eAAeJ,QAAQI,YAAY,IAAI;IAC7C,MAAMC,eAAe5B,UAAUuB,QAAQK,YAAY,IAAIL,QAAQE,IAAI;IACnE,MAAMI,kBAAkB,MAAMrC,kBAAkB8B,MAAM;IACtD,MAAM,EAAEQ,kBAAkB,EAAEC,GAAG,EAAE,GAAGb,gBAAgBI,MAAM;QACxDG,MAAMF,QAAQE,IAAI;QAClBO,WAAWT,QAAQS,SAAS;QAC5BC,cAAcV,QAAQU,YAAY;IACpC;IAEA,IAAIC;IACJ,IAAI;QACF9C,yBAAyBkC,MAAMQ;QAC/BI,gBAAgB;IAClB,EAAE,OAAM;QACNA,gBAAgB;IAClB;IAEA,IAAI,CAACA,eAAe;QAClB,MAAMjB,mBAAmBK,MAAM;YAC7BG,MAAMF,QAAQE,IAAI;YAClBO,WAAWT,QAAQS,SAAS;YAC5BG,2BAA2B;QAC7B;IACF;IAEA9C,WAAWiC,MAAMnC,kBAAkB4C,KAAK,sBAAsB,CAACK,WAAc,CAAA;YAC3E,GAAGA,QAAQ;YACXC,SAAS;gBAAC;gBAAe;aAA2B;QACtD,CAAA;IAEA,MAAMC,gBAAgBlD,yBAAyBkC,MAAMQ;IACrD,MAAMS,cAAc9B,WAClBa,MACAgB,eACAf,QAAQiB,MAAM,KAAK,UAAU,OAAO;IAEtC,MAAMC,cAAc;IACpB,MAAMC,cAAcnB,QAAQiB,MAAM,KAAK,UAAU,SAAS;IAC1D,MAAMG,kBAAkB;IACxB,MAAMC,gBAAgB,GAAG1C,YAAYoB,MAAM,CAAC,EAAEM,cAAc;IAC5D,MAAMiB,cACJtB,QAAQiB,MAAM,KAAK,UACf,+CACA;IAEN,MAAMM,kBAAkB;QACtBN,QAAQjB,QAAQiB,MAAM;QACtBO,kBAAkBrB;QAClBsB,sBAAsB7C,aAAa2B;QACnCmB,kBAAkB1B,QAAQiB,MAAM,KAAK,UAAU,UAAU;QACzDU,eAAenC,YAAYoC,MAAM;QACjCC,sBACE7B,QAAQiB,MAAM,KAAK,UACf,4BACA;QACNa,wBACE9B,QAAQiB,MAAM,KAAK,UAAU,kBAAkB;QACjDD;QACAE;QACAa,aAAa1B;QACbc;QACAC;QACAd;QACAe;QACAC;IACF;IAEA3D,cACEoC,MACAnC,kBAAkB,YAAYoE,OAAO,EAAE,UACvCxB,KACAe;IAEFnD,gBAAgB2B,MAAMS,KAAK,CAACyB,WAAa;eAAIA;YAAU;SAAmB;IAC1E,MAAM1C,0BAA0BQ,MAAMC,QAAQiB,MAAM;IACpD,MAAMiB,kBACJlC,QAAQiB,MAAM,KAAK,UACf,yBACA;IACN,MAAMkB,aAAa1E,SACjB+C,KACA5C,kBAAkByB,cAAcC,oBAAoB,OAAO;IAE7D,MAAM8C,qBAAqBpD,iCACzB+B,cAAcsB,IAAI;IAEpB,MAAMC,KAAK,IAAInE,WAAW4B;IAC1B,MAAMwC,qBAAqB3E,kBACzB,QACAmD,cAAcsB,IAAI,EAClB,UACA;IAEF,MAAMG,iBAAiB,GAAG7D,YAAYoB,MAAM,CAAC,EAAEvB,UAAUwB,QAAQE,IAAI,EAAE,iBAAiB,CAAC;IAEzF,IAAIF,QAAQyC,KAAK,KAAK,QAAQ;QAC5B,MAAMzE,0BAA0B+B,MAAMgB,eAAe;YACnD2B,gBAAgB;YAChBC,iBAAiB;QACnB;QACA,MAAM3E,0BAA0B+B,MAAMgB,eAAe;YACnD2B,gBAAgB;YAChBC,iBAAiB;QACnB;QACA,MAAMC,eAAe7B,cAAc8B,OAAO,CAAC,SAAS;QACpD,0EAA0E;QAC1E,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,CAACD,aAAa5C,OAAO,CAAC8C,QAAQ,EAAE;YAClC,MAAMC,kBAAkBH,aAAa5C,OAAO,CAACgD,OAAO;YACpD,OAAOJ,aAAa5C,OAAO,CAACgD,OAAO;YACnCJ,aAAa5C,OAAO,GAAG;gBACrB,GAAG4C,aAAa5C,OAAO;gBACvB8C,UAAU;oBACRR,GAAGW,EAAE,CAAC,GAAGb,mBAAmB,mCAAmC,CAAC;oBAChEE,GAAGY,KAAK,CAAC,GAAGd,mBAAmB,mCAAmC,CAAC;oBACnEE,GAAGa,EAAE,CACH,UACA,GAAGf,mBAAmB,0CAA0C,CAAC;oBAEnEE,GAAGa,EAAE,CACH,oBACA,GAAGf,mBAAmB,oDAAoD,CAAC;oBAE7EE,GAAGa,EAAE,CACH,cACA,GAAGf,mBAAmB,8CAA8C,CAAC;oBAEvEW;iBACD;gBACDK,UAAU;YACZ;QACF;IACF;IAEArC,cAAc8B,OAAO,CAACQ,QAAQ,GAAG;QAC/BC,UAAU;QACVC,SAAS;YAAC;SAAiC;QAC3CvD,SAAS;YACPgD,SAAS;YACTQ,KAAK;QACP;IACF;IACAzC,cAAc8B,OAAO,CAAC,aAAa,GAAG;QACpCS,UAAU;QACVtD,SAAS;YACPgD,SAAS,CAAC,IAAI,EAAEb,WAAW,cAAc,CAAC;YAC1CqB,KAAK;QACP;IACF;IACAzC,cAAc8B,OAAO,CAAC,MAAM,GAAG;QAC7BS,UAAU;QACVtD,SAAS;YACPgD,SAAS,CAAC,IAAI,EAAEb,WAAW,mBAAmB,CAAC;YAC/CqB,KAAK;QACP;QACAC,YAAY;IACd;IACA1C,cAAc8B,OAAO,CAAC,cAAc,GAAG;QACrCS,UAAU;QACVI,WAAW;YAAC;SAAM;QAClB1D,SAAS;YACPgD,SAAS,CAAC,IAAI,EAAEb,WAAW,CAAC,EAAED,iBAAiB;YAC/CsB,KAAK;QACP;IACF;IACAzC,cAAc8B,OAAO,CAACjB,MAAM,GAAG;QAC7B0B,UAAU;QACVI,WAAW;YAAC;YAAO;SAAc;QACjC1D,SAAS;YACPwD,KAAK;YACLR,SAAS;YACTW,KAAK;gBACHC,WAAW;YACb;QACF;IACF;IACA,IAAI5D,QAAQyC,KAAK,KAAK,QAAQ;QAC5B,MAAMoB,MAAM,MAAMxF,WAAW0B,MAAMC,QAAQ6D,GAAG;QAC9C,IAAIA,QAAQ,aAAa;YACvB9C,cAAc8B,OAAO,CAAC,SAAS,GAAG;gBAChCiB,OAAO;gBACPR,UAAU;gBACVtD,SAAS;oBACPgD,SAAS,GAAG1C,gBAAgB,oDAAoD,EAAEkC,eAAe,CAAC,EAAED,oBAAoB;gBAC1H;gBACAmB,WAAW;oBAAC;iBAAS;YACvB;YACA7E,kCAAkCkC,eAAe,SAAS;QAC5D;QACAlC,kCAAkCkC,eAAe,SAAS;IAC5D;IACAlC,kCAAkCkC,eAAe,WAAW;IAC5DhD,2BAA2BgC,MAAMQ,oBAAoBQ;IACrDjC,qBAAqBiB,MAAMQ,oBAAoBX,uBAAuB;QACpEqB,QAAQjB,QAAQiB,MAAM;IACxB;IAEA,IAAIjB,QAAQyC,KAAK,KAAK,QAAQ;QAC5B,MAAMoB,MAAM,MAAMxF,WAAW0B,MAAMC,QAAQ6D,GAAG;QAC9C,MAAMzE,0BAA0BW,MAAM;YAAE8D;QAAI;QAC5C,MAAM1E,YAAYY,MAAM;YACtB8D;YACAE,aAAaxD;YACbyD,aAAaxD;YACbL;YACAF;YACAwB,sBAAsB7C,aAAa2B;YACnCF;YACA4D,WAAW7D;YACXa,QAAQjB,QAAQiB,MAAM;YACtBsB;YACA2B,uBAAuBtG,kBACrB,QACAmD,cAAcsB,IAAI,EAClB,UACA;YAEFG;YACAlC;QACF;IACF;IAEA5C,6BACEqC,MACAN,aAAa;QACX;QACA;QACA;QACA;QACA;WACIO,QAAQiB,MAAM,KAAK,UAClB;YAAC;YAA2B;SAAU,GACtC;YAAC;YAAsB;SAAK;KAClC,GACDxB,aAAa;QACX;QACA;QACA;WACIO,QAAQiB,MAAM,KAAK,UAClB,EAAE,GACF;YAAC;SAAY;KACnB;IAGHhC,8BAA8Bc,MAAM;QAClC,mBAAmB;QACnB6B,QAAQ;IACV;IAEA,MAAMrD,gCAAgCwB,MAAM;QAACH;KAAsB;IAEnE,MAAM1B,qBAAqB6B;IAC3B,OAAO,IACLzB,oBAAoByB,MAAMC,QAAQY,yBAAyB,EAAE;YAC3DuD,WAAW;gBAAC;aAAa;QAC3B;AACJ,EAAE;AAEF,eAAerE,eAAe"}

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -552,6 +552,7 @@ resource "aws_cloudfront_response_headers_policy" "website" {
 
 # CloudFront Distribution
 resource "aws_cloudfront_distribution" "website" {
+  # See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
   #checkov:skip=CKV_AWS_174:Using CloudFront default certificate which does not support TLS v1.2
   #checkov:skip=CKV_AWS_310:Origin failover not required for single S3 origin static website
   #checkov:skip=CKV_AWS_374:Geo restrictions not required for global web application
@@ -1731,6 +1732,7 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
+    // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
     suppressRules(
       this.cloudFrontDistribution,
       ['CKV_AWS_174'],
@@ -3306,6 +3308,7 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
+    // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
     suppressRules(
       this.cloudFrontDistribution,
       ['CKV_AWS_174'],
@@ -4808,6 +4811,7 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
+    // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
     suppressRules(
       this.cloudFrontDistribution,
       ['CKV_AWS_174'],

package/src/utils/agent-core-constructs/files/cdk/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.ts.template

@@ -3,12 +3,21 @@ import { Construct } from 'constructs';
 import * as path from 'node:path';
 import * as url from 'node:url';
 <%_ } _%>
-import { AgentCoreGateway } from '../../../core/agentcore-gateway/agentcore-gateway.js';
+import {
+  AgentCoreGateway,
+  AgentCoreGatewayProps,
+} from '../../../core/agentcore-gateway/agentcore-gateway.js';
 import { RuntimeConfig } from '../../../core/runtime-config.js';
 <%_ if (cedarPolicy) { _%>
 import { findWorkspaceRoot } from '../../../core/workspace.js';
 <%_ } _%>
 
+<%_ if (cedarPolicy) { _%>
+export type <%- nameClassName %>Props = Omit<AgentCoreGatewayProps, 'cedarPolicyPath'>;
+<%_ } else { _%>
+export type <%- nameClassName %>Props = AgentCoreGatewayProps;
+<%_ } _%>
+
 /**
  * AgentCore Gateway wired for MCP protocol with IAM inbound auth.
 <%_ if (cedarPolicy) { _%>
@@ -21,7 +30,7 @@ export class <%- nameClassName %> extends AgentCoreGateway {
   /** Default Gateway target name when added to another Gateway. */
   public readonly gatewayName = '<%- nameKebabCase %>';
 
-  constructor(scope: Construct, id: string) {
+  constructor(scope: Construct, id: string, props?: <%- nameClassName %>Props) {
     super(scope, id, {
 <%_ if (cedarPolicy) { _%>
       cedarPolicyPath: path.join(
@@ -29,6 +38,7 @@ export class <%- nameClassName %> extends AgentCoreGateway {
         '<%- projectDirectory %>/policies',
       ),
 <%_ } _%>
+      ...props,
     });
 
     const rc = RuntimeConfig.ensure(this);

package/src/utils/agent-core-constructs/files/cdk/core/agentcore-gateway/agentcore-gateway.ts.template

@@ -1,8 +1,11 @@
 import * as cdk from 'aws-cdk-lib';
 import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';
 import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as logs from 'aws-cdk-lib/aws-logs';
 import * as triggers from 'aws-cdk-lib/triggers';
+import * as wafv2 from 'aws-cdk-lib/aws-wafv2';
 import { Construct } from 'constructs';
 import ejs from 'ejs';
 import * as fs from 'node:fs';
@@ -24,6 +27,13 @@ export interface AgentCoreGatewayProps {
    * Additional variables available to the Cedar policy EJS templates.
    */
   readonly cedarPolicyVariables?: Record<string, string>;
+  /**
+   * Associate a regional WAFv2 web ACL (default AWS managed rule groups) with
+   * the gateway to inspect inbound requests.
+   *
+   * @default true
+   */
+  readonly enableWaf?: boolean;
 }
 
 /**
@@ -33,6 +43,8 @@ export interface AgentCoreGatewayProps {
 export class AgentCoreGateway extends Construct implements iam.IGrantable {
   public readonly gateway: agentcore.Gateway;
   public readonly policyEngine?: agentcore.CfnPolicyEngine;
+  /** The WAFv2 web ACL associated with the gateway, if WAF is enabled. */
+  public readonly webAcl?: wafv2.CfnWebACL;
   private readonly policies: agentcore.CfnPolicy[] = [];
   private targetReadinessProbe?: triggers.TriggerFunction;
   private readonly targetRuntimeArns: string[] = [];
@@ -41,6 +53,9 @@ export class AgentCoreGateway extends Construct implements iam.IGrantable {
     super(scope, id);
 
     this.gateway = new agentcore.Gateway(this, 'Gateway', {
+      // Cap at 39 chars so the 11-char service suffix keeps the gateway id
+      // within its 50-char limit.
+      gatewayName: cdk.Names.uniqueResourceName(this, { maxLength: 39 }),
       protocolConfiguration: new agentcore.McpProtocolConfiguration({
         searchType: agentcore.McpGatewaySearchType.SEMANTIC,
         supportedVersions: [agentcore.MCPProtocolVersion.MCP_2025_03_26],
@@ -128,6 +143,103 @@ export class AgentCoreGateway extends Construct implements iam.IGrantable {
         }
       }
     }
+
+    if (props?.enableWaf ?? true) {
+      this.webAcl = this.createWebAcl();
+    }
+  }
+
+  /**
+   * Create a regional WAFv2 web ACL with the default AWS managed rule groups,
+   * associate it with the gateway, and log requests to CloudWatch.
+   */
+  private createWebAcl(): wafv2.CfnWebACL {
+    const metricPrefix = cdk.Names.uniqueResourceName(this, { maxLength: 40 });
+
+    const webAcl = new wafv2.CfnWebACL(this, 'WebAcl', {
+      defaultAction: { allow: {} },
+      // AgentCore Gateway requires a REGIONAL web ACL; CloudFront (global) is
+      // not supported.
+      scope: 'REGIONAL',
+      visibilityConfig: {
+        cloudWatchMetricsEnabled: true,
+        metricName: `${metricPrefix}WebAcl`,
+        sampledRequestsEnabled: true,
+      },
+      rules: [
+        {
+          name: 'CRSRule',
+          priority: 0,
+          statement: {
+            managedRuleGroupStatement: {
+              name: 'AWSManagedRulesCommonRuleSet',
+              vendorName: 'AWS',
+              // Count instead of Block: the CRS 8 KB body limit is too
+              // restrictive for typical MCP tool payloads.
+              ruleActionOverrides: [
+                {
+                  name: 'SizeRestrictions_BODY',
+                  actionToUse: { count: {} },
+                },
+              ],
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: `${metricPrefix}WebAcl-CRS`,
+            sampledRequestsEnabled: true,
+          },
+          overrideAction: {
+            none: {},
+          },
+        },
+        {
+          name: 'KnownBadInputsRule',
+          priority: 1,
+          statement: {
+            managedRuleGroupStatement: {
+              name: 'AWSManagedRulesKnownBadInputsRuleSet',
+              vendorName: 'AWS',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: `${metricPrefix}WebAcl-KnownBadInputs`,
+            sampledRequestsEnabled: true,
+          },
+          overrideAction: {
+            none: {},
+          },
+        },
+      ],
+    });
+
+    new wafv2.CfnWebACLAssociation(this, 'WebAclAssociation', {
+      resourceArn: this.gateway.gatewayArn,
+      webAclArn: webAcl.attrArn,
+    });
+
+    // WAFv2 logging destination requires the `aws-waf-logs-` name prefix.
+    const logsKey = new kms.Key(this, 'WebAclLogsKey', {
+      enableKeyRotation: true,
+    });
+    logsKey.grantEncryptDecrypt(
+      new iam.ServicePrincipal(
+        `logs.${cdk.Stack.of(this).region}.amazonaws.com`,
+      ),
+    );
+    const wafLogGroup = new logs.LogGroup(this, 'WebAclLogs', {
+      logGroupName: `aws-waf-logs-${metricPrefix}-${this.node.addr.slice(-8)}`,
+      retention: logs.RetentionDays.ONE_YEAR,
+      encryptionKey: logsKey,
+    });
+
+    new wafv2.CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
+      resourceArn: webAcl.attrArn,
+      logDestinationConfigs: [wafLogGroup.logGroupArn],
+    });
+
+    return webAcl;
   }
 
   /**

package/src/utils/agent-core-constructs/files/terraform/app/agentcore-gateway/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -34,6 +34,12 @@ variable "tool_dependencies" {
   type        = list(string)
   default     = []
 }
+
+variable "enable_waf" {
+  description = "Associate a regional WAFv2 web ACL (default AWS managed rule groups) with the gateway to inspect inbound requests."
+  type        = bool
+  default     = true
+}
 <%_ if (cedarPolicy) { _%>
 
 variable "policy_dependencies" {
@@ -141,7 +147,9 @@ resource "aws_bedrockagentcore_policy_engine" "this" {
 <%_ } _%>
 
 resource "aws_bedrockagentcore_gateway" "this" {
-  name        = "<%- nameClassName %>-${random_id.unique_suffix.hex}"
+  # Cap the name so the 11-char service suffix keeps the gateway id within its
+  # 50-char limit (30 prefix + "-<8 hex>" + 11 = 50).
+  name        = "${substr("<%- nameClassName %>", 0, 30)}-${random_id.unique_suffix.hex}"
   description = "AgentCore Gateway for <%- nameClassName %>"
   role_arn    = aws_iam_role.gateway_role.arn
 
@@ -164,6 +172,107 @@ resource "aws_bedrockagentcore_gateway" "this" {
   depends_on = [aws_iam_role_policy.gateway_role_policy]
 <%_ } _%>
 }
+
+# WAFv2 protection for the gateway. AgentCore Gateway requires a REGIONAL web
+# ACL; CloudFront (global) is not supported.
+resource "aws_wafv2_web_acl" "gateway_waf" {
+  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.gateway_waf_logging; Checkov does not resolve the separate resource
+  count = var.enable_waf ? 1 : 0
+
+  name  = "<%- nameClassName %>-waf-${random_id.unique_suffix.hex}"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "CRSRule"
+    priority = 0
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+
+        # Count instead of Block: the CRS 8 KB body limit is too restrictive
+        # for typical MCP tool payloads.
+        rule_action_override {
+          name = "SizeRestrictions_BODY"
+          action_to_use {
+            count {}
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "<%- nameClassName %>WebAcl-CRS"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "KnownBadInputsRule"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "<%- nameClassName %>WebAcl-KnownBadInputs"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "<%- nameClassName %>WebAcl"
+    sampled_requests_enabled   = true
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_wafv2_web_acl_association" "gateway_waf" {
+  count = var.enable_waf ? 1 : 0
+
+  resource_arn = aws_bedrockagentcore_gateway.this.gateway_arn
+  web_acl_arn  = aws_wafv2_web_acl.gateway_waf[0].arn
+}
+
+# WAF request logs. WAFv2 requires the `aws-waf-logs-` name prefix.
+resource "aws_cloudwatch_log_group" "gateway_waf_logs" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to one year which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = "aws-waf-logs-<%- nameKebabCase %>-${random_id.unique_suffix.hex}"
+  retention_in_days = 365
+}
+
+resource "aws_wafv2_web_acl_logging_configuration" "gateway_waf_logging" {
+  count = var.enable_waf ? 1 : 0
+
+  log_destination_configs = [aws_cloudwatch_log_group.gateway_waf_logs[0].arn]
+  resource_arn            = aws_wafv2_web_acl.gateway_waf[0].arn
+}
 <%_ if (cedarPolicy) { _%>
 
 # Anchor for the policy_dependencies variable — depends_on only accepts
@@ -333,3 +442,8 @@ output "gateway_role_arn" {
   description = "ARN of the IAM role assumed by the gateway service"
   value       = aws_iam_role.gateway_role.arn
 }
+
+output "waf_web_acl_arn" {
+  description = "ARN of the WAFv2 web ACL associated with the gateway, or null if WAF is disabled"
+  value       = var.enable_waf ? aws_wafv2_web_acl.gateway_waf[0].arn : null
+}

package/src/utils/files/common/scripts/src/rdb/shared/start-container.ts.template

@@ -112,6 +112,6 @@ process.on("SIGTERM", cleanup);
 process.on("SIGINT", cleanup);
 process.on("SIGHUP", cleanup);
 
-logs.on("exit", (code) => {
-  if (!exiting) process.exit(code ?? 0);
+logs.on("exit", () => {
+  if (!exiting) cleanup();
 });

package/src/utils/rdb-constructs/files/cdk/core/rdb/aurora.ts.template

@@ -350,29 +350,19 @@ export abstract class AuroraDatabase extends Construct {
       timeout: Duration.minutes(5),
       tracing: Tracing.ACTIVE,
       vpc,
-      environment: engine.type === 'mysql' ? {
+      environment: {
         DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-      } : {
-        HOSTNAME: databaseHostname,
-        DATABASE: databaseName,
-        PORT: databasePort.toString(),
-        DBUSER: this.dbUser,
       },
       architecture: Architecture.ARM_64,
     });
 
-    if (engine.type === 'mysql') {
-      this.cluster.connections.allowDefaultPortFrom(migrationHandler);
-      this.grantSecretRead(migrationHandler);
-    } else {
-      this.allowDefaultPortFrom(migrationHandler);
-      this.grantConnect(migrationHandler);
-    }
+    this.cluster.connections.allowDefaultPortFrom(migrationHandler);
+    this.grantSecretRead(migrationHandler);
 
-    const trigger = new Trigger(this, 'MigrationTrigger', {
+    const migrationTrigger = new Trigger(this, 'MigrationTrigger', {
       handler: migrationHandler,
     });
-    trigger.node.addDependency(createDbUserResource);
+    migrationTrigger.node.addDependency(createDbUserResource);
 
     new CfnOutput(this, 'ClusterEndpoint', {
       value: this.cluster.clusterEndpoint.hostname,

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -347,7 +347,6 @@ resource "aws_iam_role_policy" "migration_handler_access" {
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
-<%_ if (engine === 'mysql') { _%>
       {
         Effect = "Allow"
         Action = [
@@ -362,17 +361,6 @@ resource "aws_iam_role_policy" "migration_handler_access" {
         ]
         Resource = [module.aurora.kms_key_arn]
       }
-<%_ } else { _%>
-      {
-        Effect = "Allow"
-        Action = [
-          "rds-db:connect"
-        ]
-        Resource = [
-          "arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${var.enable_rds_proxy ? module.aurora.proxy_resource_id : module.aurora.cluster_resource_id}/${local.database_runtime_user}"
-        ]
-      }
-<%_ } _%>
     ]
   })
 }
@@ -459,13 +447,8 @@ resource "aws_security_group" "migration_handler" {
 }
 
 resource "aws_vpc_security_group_egress_rule" "migration_handler_to_database" {
-<%_ if (engine === 'mysql') { _%>
   security_group_id            = aws_security_group.migration_handler.id
   referenced_security_group_id = module.aurora.database_security_group_id
-<%_ } else { _%>
-  security_group_id            = aws_security_group.migration_handler.id
-  referenced_security_group_id = module.aurora.security_group_id
-<%_ } _%>
   from_port   = module.aurora.cluster_port
   to_port     = module.aurora.cluster_port
   ip_protocol = "tcp"
@@ -507,11 +490,7 @@ resource "aws_vpc_security_group_egress_rule" "create_db_user_https" {
 }
 
 resource "aws_vpc_security_group_ingress_rule" "migration_handler_to_database" {
-<%_ if (engine === 'mysql') { _%>
   security_group_id            = module.aurora.database_security_group_id
-<%_ } else { _%>
-  security_group_id            = module.aurora.security_group_id
-<%_ } _%>
   referenced_security_group_id = aws_security_group.migration_handler.id
   from_port                    = module.aurora.cluster_port
   to_port                      = module.aurora.cluster_port
@@ -632,14 +611,7 @@ resource "aws_lambda_function" "migration_handler" {
 
   environment {
     variables = {
-<%_ if (engine === 'mysql') { _%>
       DATABASE_SECRET_ARN = module.aurora.secret_arn
-<%_ } else { _%>
-      HOSTNAME = module.aurora.cluster_endpoint
-      DATABASE = module.aurora.database_name
-      PORT     = tostring(module.aurora.cluster_port)
-      DBUSER   = local.database_runtime_user
-<%_ } _%>
     }
   }
 

package/src/utils/website-constructs/files/cdk/core/static-website.ts.template

@@ -192,6 +192,7 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
+    // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
     suppressRules(
       this.cloudFrontDistribution,
       ['CKV_AWS_174'],

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -423,6 +423,7 @@ resource "aws_cloudfront_response_headers_policy" "website" {
 
 # CloudFront Distribution
 resource "aws_cloudfront_distribution" "website" {
+  # See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
   #checkov:skip=CKV_AWS_174:Using CloudFront default certificate which does not support TLS v1.2
   #checkov:skip=CKV_AWS_310:Origin failover not required for single S3 origin static website
   #checkov:skip=CKV_AWS_374:Geo restrictions not required for global web application