@aws/nx-plugin 1.0.0-rc.3 → 1.0.0-rc.31

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -22,144 +22,6 @@ datasource db {
 "
 `;
 
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/scripts/docker-pull.ts 1`] = `
-"import { spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-const image = process.argv[2];
-
-const inspect = spawnSync(ENGINE, ['image', 'inspect', image], {
-  stdio: 'ignore',
-});
-
-if (inspect.status !== 0) {
-  const pull = spawnSync(ENGINE, ['pull', image], { stdio: 'inherit' });
-  if (pull.status !== 0) {
-    process.exit(pull.status ?? 1);
-  }
-}
-"
-`;
-
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/scripts/docker-start.ts 1`] = `
-"import { spawn, spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-
-const [containerName, image, hostPort, dbName, dbPassword] =
-  process.argv.slice(2);
-
-const containerExists = (): boolean =>
-  spawnSync(ENGINE, ['container', 'inspect', containerName], {
-    stdio: 'ignore',
-  }).status === 0;
-
-const isRunning = (): boolean => {
-  const result = spawnSync(
-    ENGINE,
-    ['container', 'inspect', '-f', '{{.State.Running}}', containerName],
-    { encoding: 'utf-8' },
-  );
-  return result.status === 0 && result.stdout.trim() === 'true';
-};
-
-if (containerExists()) {
-  if (!isRunning()) {
-    const start = spawnSync(ENGINE, ['start', containerName], {
-      stdio: 'inherit',
-    });
-    if (start.status !== 0) process.exit(start.status ?? 1);
-  }
-} else {
-  const runArgs = [
-    'run',
-    '--name',
-    containerName,
-    '-e',
-    \`MYSQL_DATABASE=\${dbName}\`,
-    '-e',
-    \`MYSQL_ROOT_PASSWORD=\${dbPassword}\`,
-    '-p',
-    \`\${hostPort}:3306\`,
-    '-v',
-    \`\${containerName}-data:/var/lib/mysql\`,
-    '-d',
-    image,
-  ];
-  const create = spawnSync(ENGINE, runArgs, { stdio: 'inherit' });
-  if (create.status !== 0) process.exit(create.status ?? 1);
-}
-
-const logs = spawn(ENGINE, ['logs', '-f', containerName], {
-  stdio: ['ignore', 'inherit', 'inherit'],
-});
-
-let exiting = false;
-
-const cleanup = () => {
-  if (exiting) return;
-  exiting = true;
-  spawnSync(ENGINE, ['stop', containerName], { stdio: 'ignore' });
-  logs.kill();
-  process.exit(0);
-};
-
-process.on('SIGTERM', cleanup);
-process.on('SIGINT', cleanup);
-process.on('SIGHUP', cleanup);
-
-logs.on('exit', (code) => {
-  if (!exiting) process.exit(code ?? 0);
-});
-"
-`;
-
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/scripts/wait-for-db.ts 1`] = `
-"import { createConnection, Connection } from 'mariadb';
-
-const noop = () => undefined;
-
-const [portArg, dbArg, userArg, passwordArg] = process.argv.slice(2);
-const timeoutAt = Date.now() + 60000;
-
-while (Date.now() < timeoutAt) {
-  let conn: Connection | undefined;
-  try {
-    conn = await createConnection({
-      host: 'localhost',
-      port: parseInt(portArg),
-      user: userArg,
-      password: passwordArg,
-      database: dbArg,
-      connectTimeout: 500,
-      allowPublicKeyRetrieval: true,
-    });
-    await conn.end();
-    console.log('Database is ready.');
-    process.exit(0);
-  } catch {
-    console.log('Database is not ready.');
-    await conn?.end().catch(noop);
-  }
-  await new Promise((r) => setTimeout(r, 200));
-}
-
-throw new Error(\`Timed out waiting for mysql on port \${portArg}\`);
-"
-`;
-
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/constants.ts 1`] = `
-"export const DB_PACKAGE_NAME = 'Db';
-
-// Local development connection details (used when SERVE_LOCAL=true, see serve-local Nx target)
-export const LOCAL_DB_PORT = 3306;
-export const LOCAL_DB_HOST = 'localhost';
-export const LOCAL_DB_NAME = 'database_name';
-export const LOCAL_DB_USER = 'root';
-export const LOCAL_DB_PASSWORD = 'password';
-"
-`;
-
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/create-db-user-handler.ts 1`] = `
 "import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
 import { randomBytes } from 'node:crypto';
@@ -206,7 +68,7 @@ const ensureDatabaseUser = async (dbUser: string): Promise<void> => {
       [
         \`CREATE USER IF NOT EXISTS \${quotedUser}@\${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS'\`,
         \`ALTER USER \${quotedUser}@\${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS' REQUIRE SSL\`,
-        \`GRANT ALL PRIVILEGES ON \${quotedDbName}.* TO \${quotedUser}@\${quotedHost}\`,
+        \`GRANT SELECT, INSERT, UPDATE, DELETE ON \${quotedDbName}.* TO \${quotedUser}@\${quotedHost}\`,
       ].join(';\\n'),
     );
   } finally {
@@ -237,8 +99,7 @@ export const handler = async (
 `;
 
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/index.ts 1`] = `
-"export { DB_PACKAGE_NAME } from './constants.js';
-export { getPrisma } from './prisma.js';
+"export { getPrisma } from './prisma.js';
 "
 `;
 
@@ -277,26 +138,30 @@ exports[`ts#rdb generator > should add mysql prisma dependencies when engine is
 "import { PrismaMariaDb } from '@prisma/adapter-mariadb';
 import { Signer } from '@aws-sdk/rds-signer';
 import { Prisma, PrismaClient } from '../generated/prisma/client.js';
-import {
-  DB_PACKAGE_NAME,
-  LOCAL_DB_HOST,
-  LOCAL_DB_NAME,
-  LOCAL_DB_PASSWORD,
-  LOCAL_DB_PORT,
-  LOCAL_DB_USER,
-} from './constants.js';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
 import { getDatabaseConfig } from './utils.js';
 
+// Generated: must match runtimeConfigKey in config.json
+const runtimeConfigKey = 'Db';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// config.json is only present in local dev (not included in the deployed bundle); guard with LOCAL_DEV check
+const localDev = () =>
+  JSON.parse(readFileSync(join(__dirname, '../config.json'), 'utf-8')).localDev;
+
 export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   log: LogOpts[] = ['warn', 'error'] as LogOpts[],
 ): Promise<PrismaClient<LogOpts>> => {
-  if (process.env.SERVE_LOCAL === 'true') {
+  if (process.env.LOCAL_DEV === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = localDev();
     const adapter = new PrismaMariaDb({
-      host: LOCAL_DB_HOST,
-      port: LOCAL_DB_PORT,
-      database: LOCAL_DB_NAME,
-      user: LOCAL_DB_USER,
-      password: LOCAL_DB_PASSWORD,
+      host,
+      port,
+      database: dbName,
+      user: dbUser,
+      password: dbPassword,
       allowPublicKeyRetrieval: true,
     });
     return new PrismaClient({
@@ -306,7 +171,7 @@ export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   }
 
   const { hostname, port, database, dbUser, region } =
-    await getDatabaseConfig(DB_PACKAGE_NAME);
+    await getDatabaseConfig(runtimeConfigKey);
   const iamAuthToken = await new Signer({
     hostname,
     port,
@@ -431,6 +296,9 @@ const transientErrorPatterns = [
   'ECONNREFUSED',
   'ENOTFOUND',
   'P1000', // Prisma: authentication failed
+  'P1001', // Prisma: can't reach database server
+  'P1002', // Prisma: database server reached but timed out
+  'P1010', // Prisma: user denied access (IAM auth grant not yet propagated)
   'ER_ACCESS_DENIED_ERROR', // MySQL: access denied
 ];
 
@@ -663,6 +531,21 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enableKeyRotation?: boolean;
+
+  /**
+   * Whether to export Aurora engine logs to CloudWatch Logs.
+   * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
+   *
+   * @default false
+   */
+  readonly enableCloudwatchLogs?: boolean;
+
+  /**
+   * Whether to enable Performance Insights on the Aurora writer instance.
+   *
+   * @default true
+   */
+  readonly enablePerformanceInsights?: boolean;
 }
 
 /**
@@ -692,6 +575,8 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
+      enableCloudwatchLogs = false,
+      enablePerformanceInsights = true,
       engine,
       engineVersion,
       ...clusterProps
@@ -707,12 +592,24 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
-      writer: writer ?? ClusterInstance.serverlessV2('writer'),
+      writer:
+        writer ??
+        ClusterInstance.serverlessV2('writer', {
+          enablePerformanceInsights,
+          performanceInsightEncryptionKey: enablePerformanceInsights
+            ? key
+            : undefined,
+        }),
       credentials: Credentials.fromGeneratedSecret(adminUser, {
         encryptionKey: key,
       }),
       iamAuthentication: true,
       monitoringInterval: Duration.seconds(5),
+      cloudwatchLogsExports: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? ['audit', 'error', 'general', 'slowquery']
+          : ['postgresql']
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,
@@ -809,32 +706,19 @@ export abstract class AuroraDatabase extends Construct {
       timeout: Duration.minutes(5),
       tracing: Tracing.ACTIVE,
       vpc,
-      environment:
-        engine.type === 'mysql'
-          ? {
-              DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-            }
-          : {
-              HOSTNAME: databaseHostname,
-              DATABASE: databaseName,
-              PORT: databasePort.toString(),
-              DBUSER: this.dbUser,
-            },
+      environment: {
+        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
+      },
       architecture: Architecture.ARM_64,
     });
 
-    if (engine.type === 'mysql') {
-      this.cluster.connections.allowDefaultPortFrom(migrationHandler);
-      this.grantSecretRead(migrationHandler);
-    } else {
-      this.allowDefaultPortFrom(migrationHandler);
-      this.grantConnect(migrationHandler);
-    }
+    this.cluster.connections.allowDefaultPortFrom(migrationHandler);
+    this.grantSecretRead(migrationHandler);
 
-    const trigger = new Trigger(this, 'MigrationTrigger', {
+    const migrationTrigger = new Trigger(this, 'MigrationTrigger', {
       handler: migrationHandler,
     });
-    trigger.node.addDependency(createDbUserResource);
+    migrationTrigger.node.addDependency(createDbUserResource);
 
     new CfnOutput(this, 'ClusterEndpoint', {
       value: this.cluster.clusterEndpoint.hostname,
@@ -874,17 +758,14 @@ export abstract class AuroraDatabase extends Construct {
 
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL 2`] = `
 "import { defineConfig } from 'prisma/config';
+import { readFileSync } from 'fs';
 
 const getDatabaseUrl = async () => {
-  if (process.env.SERVE_LOCAL === 'true') {
-    const {
-      LOCAL_DB_HOST,
-      LOCAL_DB_NAME,
-      LOCAL_DB_PASSWORD,
-      LOCAL_DB_PORT,
-      LOCAL_DB_USER,
-    } = await import('./src/constants.js');
-    return \`mysql://\${LOCAL_DB_USER}:\${LOCAL_DB_PASSWORD}@\${LOCAL_DB_HOST}:\${LOCAL_DB_PORT}/\${LOCAL_DB_NAME}\`;
+  if (process.env.LOCAL_DEV === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = JSON.parse(
+      readFileSync('config.json', 'utf-8'),
+    ).localDev;
+    return \`mysql://\${dbUser}:\${dbPassword}@\${host}:\${port}/\${dbName}\`;
   }
   return process.env.DATABASE_URL;
 };
@@ -911,15 +792,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "3.3.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "3.9.0"
     }
   }
 }
@@ -1063,10 +944,19 @@ variable "tags" {
   default     = {}
 }
 
+# Suffix appended to physical resource names so that multiple deployments
+# (e.g. separate environments in the same account and region) don't collide.
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 locals {
   default_port           = var.engine == "aurora-mysql" ? 3306 : 5432
   default_engine_version = var.engine == "aurora-mysql" ? "8.0.mysql_aurora.3.12.0" : "17.7"
   parameter_group_family = var.engine == "aurora-mysql" ? "aurora-mysql8.0" : "aurora-postgresql\${split(".", coalesce(var.engine_version, local.default_engine_version))[0]}"
+  cluster_name           = "\${var.name}-aurora-\${random_string.suffix.result}"
 }
 
 resource "aws_rds_cluster_parameter_group" "database" {
@@ -1164,7 +1054,7 @@ resource "aws_security_group" "database" {
 }
 
 resource "aws_db_subnet_group" "database" {
-  name       = "\${var.name}-aurora"
+  name       = local.cluster_name
   subnet_ids = var.subnet_ids
 
   tags = merge(var.tags, {
@@ -1204,7 +1094,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 resource "aws_rds_cluster" "database" {
   #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
-  cluster_identifier                  = "\${var.name}-aurora"
+  cluster_identifier                  = local.cluster_name
   engine                              = var.engine
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
@@ -1218,7 +1108,7 @@ resource "aws_rds_cluster" "database" {
   kms_key_id                          = aws_kms_key.database.arn
   deletion_protection                 = var.deletion_protection
   skip_final_snapshot                 = var.skip_final_snapshot
-  final_snapshot_identifier           = var.skip_final_snapshot ? null : "\${var.name}-aurora-final-snapshot"
+  final_snapshot_identifier           = var.skip_final_snapshot ? null : "\${local.cluster_name}-final-snapshot"
   iam_database_authentication_enabled = true
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
@@ -1238,7 +1128,7 @@ resource "aws_rds_cluster" "database" {
 resource "aws_rds_cluster_instance" "database" {
   count = var.instance_count
 
-  identifier           = "\${var.name}-aurora-\${count.index + 1}"
+  identifier           = "\${local.cluster_name}-\${count.index + 1}"
   cluster_identifier   = aws_rds_cluster.database.id
   instance_class       = "db.serverless"
   engine               = aws_rds_cluster.database.engine
@@ -1292,7 +1182,7 @@ resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
 resource "aws_cloudformation_stack" "credentials_rotation" {
   #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
   count = var.enable_credential_rotation ? 1 : 0
-  name  = "\${var.name}-aurora-credentials-rotation"
+  name  = "\${local.cluster_name}-credentials-rotation"
 
   capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
 
@@ -1306,7 +1196,7 @@ resource "aws_cloudformation_stack" "credentials_rotation" {
           SecretId = aws_secretsmanager_secret.credentials.arn
           HostedRotationLambda = {
             RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "\${var.name}-aurora-credentials-rotation"
+            RotationLambdaName  = "\${local.cluster_name}-credentials-rotation"
             VpcSecurityGroupIds = aws_security_group.rotation[0].id
             VpcSubnetIds        = join(",", var.lambda_subnet_ids)
           }
@@ -1386,7 +1276,7 @@ resource "aws_security_group" "proxy" {
 resource "aws_db_proxy" "aurora" {
   count = var.enable_rds_proxy ? 1 : 0
 
-  name                   = "\${var.name}-proxy"
+  name                   = "\${var.name}-proxy-\${random_string.suffix.result}"
   default_auth_scheme    = "IAM_AUTH"
   engine_family          = var.engine == "aurora-mysql" ? "MYSQL" : "POSTGRESQL"
   role_arn               = aws_iam_role.proxy[0].arn
@@ -1435,9 +1325,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \\
-          --region \${data.aws_region.current.region} \\
-          --db-proxy-name \${self.triggers.db_proxy_name} \\
-          --target-group-name \${self.triggers.target_group_name} \\
+          --region "$AWS_REGION" \\
+          --db-proxy-name "$DB_PROXY_NAME" \\
+          --target-group-name "$TARGET_GROUP_NAME" \\
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \\
           --output text)
 
@@ -1447,13 +1337,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target \${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -1532,7 +1428,7 @@ resource "aws_iam_role_policy_attachment" "backup" {
 resource "aws_backup_vault" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name        = "\${var.name}-aurora-backup"
+  name        = "\${local.cluster_name}-backup"
   kms_key_arn = aws_kms_key.database.arn
   tags        = var.tags
 }
@@ -1540,7 +1436,7 @@ resource "aws_backup_vault" "database" {
 resource "aws_backup_plan" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name = "\${var.name}-aurora-backup"
+  name = "\${local.cluster_name}-backup"
 
   rule {
     rule_name         = "daily-backup"
@@ -1654,19 +1550,19 @@ exports[`ts#rdb generator > should generate terraform modules when iac is Terraf
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "~> 2.5"
+      version = "2.8.0"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "3.3.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "3.9.0"
     }
   }
 }
@@ -1791,10 +1687,12 @@ resource "random_string" "suffix" {
 }
 
 locals {
-  create_db_user_bundle_path = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
-  migration_function_name = "db-migration-\${random_string.suffix.result}"
+  config                       = jsondecode(file("\${path.module}/../../../../../../../packages/db/config.json"))
+  runtime_config_key           = local.config.runtimeConfigKey
+  create_db_user_bundle_path   = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
+  migration_function_name      = "db-migration-\${random_string.suffix.result}"
   create_db_user_function_name = "db-create-db-user-\${random_string.suffix.result}"
-  database_runtime_user = "db_\${random_string.suffix.result}"
+  database_runtime_user        = "db_\${random_string.suffix.result}"
 }
 
 module "aurora" {
@@ -1860,7 +1758,7 @@ module "add_rdb_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
   namespace = "database"
-  key       = "Db"
+  key       = local.runtime_config_key
   value = {
     hostname  = module.aurora.cluster_endpoint
     port      = module.aurora.cluster_port
@@ -1873,9 +1771,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "db-migration-\${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -1926,19 +1823,31 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region \${data.aws_region.current.region} | docker login --username AWS --password-stdin \${self.triggers.repository_url}
-      docker tag \${self.triggers.docker_image_tag} \${self.triggers.repository_url}:latest
-      docker push \${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -1987,11 +1896,16 @@ resource "aws_iam_role_policy" "migration_handler_access" {
       {
         Effect = "Allow"
         Action = [
-          "rds-db:connect"
+          "secretsmanager:GetSecretValue"
         ]
-        Resource = [
-          "arn:aws:rds-db:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:dbuser:\${var.enable_rds_proxy ? module.aurora.proxy_resource_id : module.aurora.cluster_resource_id}/\${local.database_runtime_user}"
+        Resource = [module.aurora.secret_arn]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "kms:Decrypt"
         ]
+        Resource = [module.aurora.kms_key_arn]
       }
     ]
   })
@@ -2080,7 +1994,7 @@ resource "aws_security_group" "migration_handler" {
 
 resource "aws_vpc_security_group_egress_rule" "migration_handler_to_database" {
   security_group_id            = aws_security_group.migration_handler.id
-  referenced_security_group_id = module.aurora.security_group_id
+  referenced_security_group_id = module.aurora.database_security_group_id
   from_port   = module.aurora.cluster_port
   to_port     = module.aurora.cluster_port
   ip_protocol = "tcp"
@@ -2122,7 +2036,7 @@ resource "aws_vpc_security_group_egress_rule" "create_db_user_https" {
 }
 
 resource "aws_vpc_security_group_ingress_rule" "migration_handler_to_database" {
-  security_group_id            = module.aurora.security_group_id
+  security_group_id            = module.aurora.database_security_group_id
   referenced_security_group_id = aws_security_group.migration_handler.id
   from_port                    = module.aurora.cluster_port
   to_port                      = module.aurora.cluster_port
@@ -2196,10 +2110,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:\${self.triggers.db_user}"}' \\
+        --payload "{\\"RequestType\\":\\"Create\\",\\"PhysicalResourceId\\":\\"db-user:$DB_USER\\"}" \\
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -2209,6 +2123,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -2222,7 +2141,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:\${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]
@@ -2238,10 +2157,7 @@ resource "aws_lambda_function" "migration_handler" {
 
   environment {
     variables = {
-      HOSTNAME = module.aurora.cluster_endpoint
-      DATABASE = module.aurora.database_name
-      PORT     = tostring(module.aurora.cluster_port)
-      DBUSER   = local.database_runtime_user
+      DATABASE_SECRET_ARN = module.aurora.secret_arn
     }
   }
 
@@ -2271,8 +2187,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
         "$output_file")
       cat "$output_file"
@@ -2283,6 +2199,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [
@@ -2361,15 +2281,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "3.3.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "3.9.0"
     }
   }
 }
@@ -2513,10 +2433,19 @@ variable "tags" {
   default     = {}
 }
 
+# Suffix appended to physical resource names so that multiple deployments
+# (e.g. separate environments in the same account and region) don't collide.
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 locals {
   default_port           = var.engine == "aurora-mysql" ? 3306 : 5432
   default_engine_version = var.engine == "aurora-mysql" ? "8.0.mysql_aurora.3.12.0" : "17.7"
   parameter_group_family = var.engine == "aurora-mysql" ? "aurora-mysql8.0" : "aurora-postgresql\${split(".", coalesce(var.engine_version, local.default_engine_version))[0]}"
+  cluster_name           = "\${var.name}-aurora-\${random_string.suffix.result}"
 }
 
 resource "aws_rds_cluster_parameter_group" "database" {
@@ -2614,7 +2543,7 @@ resource "aws_security_group" "database" {
 }
 
 resource "aws_db_subnet_group" "database" {
-  name       = "\${var.name}-aurora"
+  name       = local.cluster_name
   subnet_ids = var.subnet_ids
 
   tags = merge(var.tags, {
@@ -2654,7 +2583,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 resource "aws_rds_cluster" "database" {
   #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
-  cluster_identifier                  = "\${var.name}-aurora"
+  cluster_identifier                  = local.cluster_name
   engine                              = var.engine
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
@@ -2668,7 +2597,7 @@ resource "aws_rds_cluster" "database" {
   kms_key_id                          = aws_kms_key.database.arn
   deletion_protection                 = var.deletion_protection
   skip_final_snapshot                 = var.skip_final_snapshot
-  final_snapshot_identifier           = var.skip_final_snapshot ? null : "\${var.name}-aurora-final-snapshot"
+  final_snapshot_identifier           = var.skip_final_snapshot ? null : "\${local.cluster_name}-final-snapshot"
   iam_database_authentication_enabled = true
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
@@ -2688,7 +2617,7 @@ resource "aws_rds_cluster" "database" {
 resource "aws_rds_cluster_instance" "database" {
   count = var.instance_count
 
-  identifier           = "\${var.name}-aurora-\${count.index + 1}"
+  identifier           = "\${local.cluster_name}-\${count.index + 1}"
   cluster_identifier   = aws_rds_cluster.database.id
   instance_class       = "db.serverless"
   engine               = aws_rds_cluster.database.engine
@@ -2742,7 +2671,7 @@ resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
 resource "aws_cloudformation_stack" "credentials_rotation" {
   #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
   count = var.enable_credential_rotation ? 1 : 0
-  name  = "\${var.name}-aurora-credentials-rotation"
+  name  = "\${local.cluster_name}-credentials-rotation"
 
   capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
 
@@ -2756,7 +2685,7 @@ resource "aws_cloudformation_stack" "credentials_rotation" {
           SecretId = aws_secretsmanager_secret.credentials.arn
           HostedRotationLambda = {
             RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "\${var.name}-aurora-credentials-rotation"
+            RotationLambdaName  = "\${local.cluster_name}-credentials-rotation"
             VpcSecurityGroupIds = aws_security_group.rotation[0].id
             VpcSubnetIds        = join(",", var.lambda_subnet_ids)
           }
@@ -2836,7 +2765,7 @@ resource "aws_security_group" "proxy" {
 resource "aws_db_proxy" "aurora" {
   count = var.enable_rds_proxy ? 1 : 0
 
-  name                   = "\${var.name}-proxy"
+  name                   = "\${var.name}-proxy-\${random_string.suffix.result}"
   default_auth_scheme    = "IAM_AUTH"
   engine_family          = var.engine == "aurora-mysql" ? "MYSQL" : "POSTGRESQL"
   role_arn               = aws_iam_role.proxy[0].arn
@@ -2885,9 +2814,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \\
-          --region \${data.aws_region.current.region} \\
-          --db-proxy-name \${self.triggers.db_proxy_name} \\
-          --target-group-name \${self.triggers.target_group_name} \\
+          --region "$AWS_REGION" \\
+          --db-proxy-name "$DB_PROXY_NAME" \\
+          --target-group-name "$TARGET_GROUP_NAME" \\
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \\
           --output text)
 
@@ -2897,13 +2826,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target \${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -2982,7 +2917,7 @@ resource "aws_iam_role_policy_attachment" "backup" {
 resource "aws_backup_vault" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name        = "\${var.name}-aurora-backup"
+  name        = "\${local.cluster_name}-backup"
   kms_key_arn = aws_kms_key.database.arn
   tags        = var.tags
 }
@@ -2990,7 +2925,7 @@ resource "aws_backup_vault" "database" {
 resource "aws_backup_plan" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name = "\${var.name}-aurora-backup"
+  name = "\${local.cluster_name}-backup"
 
   rule {
     rule_name         = "daily-backup"
@@ -3104,19 +3039,19 @@ exports[`ts#rdb generator > should generate terraform modules with MySQL engine
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "~> 2.5"
+      version = "2.8.0"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.52.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "3.3.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "3.9.0"
     }
   }
 }
@@ -3241,10 +3176,12 @@ resource "random_string" "suffix" {
 }
 
 locals {
-  create_db_user_bundle_path = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
-  migration_function_name = "db-migration-\${random_string.suffix.result}"
+  config                       = jsondecode(file("\${path.module}/../../../../../../../packages/db/config.json"))
+  runtime_config_key           = local.config.runtimeConfigKey
+  create_db_user_bundle_path   = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
+  migration_function_name      = "db-migration-\${random_string.suffix.result}"
   create_db_user_function_name = "db-create-db-user-\${random_string.suffix.result}"
-  database_runtime_user = "db_\${random_string.suffix.result}"
+  database_runtime_user        = "db_\${random_string.suffix.result}"
 }
 
 module "aurora" {
@@ -3310,7 +3247,7 @@ module "add_rdb_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
   namespace = "database"
-  key       = "Db"
+  key       = local.runtime_config_key
   value = {
     hostname  = module.aurora.cluster_endpoint
     port      = module.aurora.cluster_port
@@ -3323,9 +3260,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "db-migration-\${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -3376,19 +3312,31 @@ data "external" "docker_digest" {
   program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
 }
 
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
     docker_image_tag = var.docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region \${data.aws_region.current.region} | docker login --username AWS --password-stdin \${self.triggers.repository_url}
-      docker tag \${self.triggers.docker_image_tag} \${self.triggers.repository_url}:latest
-      docker push \${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
+      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -3651,10 +3599,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:\${self.triggers.db_user}"}' \\
+        --payload "{\\"RequestType\\":\\"Create\\",\\"PhysicalResourceId\\":\\"db-user:$DB_USER\\"}" \\
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -3664,6 +3612,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -3677,7 +3630,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:\${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]
@@ -3722,8 +3675,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
         "$output_file")
       cat "$output_file"
@@ -3734,6 +3687,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [
@@ -3824,148 +3781,6 @@ datasource db {
 "
 `;
 
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/scripts/docker-pull.ts 1`] = `
-"import { spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-const image = process.argv[2];
-
-const inspect = spawnSync(ENGINE, ['image', 'inspect', image], {
-  stdio: 'ignore',
-});
-
-if (inspect.status !== 0) {
-  const pull = spawnSync(ENGINE, ['pull', image], { stdio: 'inherit' });
-  if (pull.status !== 0) {
-    process.exit(pull.status ?? 1);
-  }
-}
-"
-`;
-
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/scripts/docker-start.ts 1`] = `
-"import { spawn, spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-
-const [containerName, image, hostPort, dbName, dbUser, dbPassword] =
-  process.argv.slice(2);
-
-const containerExists = (): boolean =>
-  spawnSync(ENGINE, ['container', 'inspect', containerName], {
-    stdio: 'ignore',
-  }).status === 0;
-
-const isRunning = (): boolean => {
-  const result = spawnSync(
-    ENGINE,
-    ['container', 'inspect', '-f', '{{.State.Running}}', containerName],
-    { encoding: 'utf-8' },
-  );
-  return result.status === 0 && result.stdout.trim() === 'true';
-};
-
-if (containerExists()) {
-  if (!isRunning()) {
-    const start = spawnSync(ENGINE, ['start', containerName], {
-      stdio: 'inherit',
-    });
-    if (start.status !== 0) process.exit(start.status ?? 1);
-  }
-} else {
-  const runArgs = [
-    'run',
-    '--name',
-    containerName,
-    '-e',
-    \`POSTGRES_DB=\${dbName}\`,
-    '-e',
-    \`POSTGRES_USER=\${dbUser}\`,
-    '-e',
-    \`POSTGRES_PASSWORD=\${dbPassword}\`,
-    '-e',
-    \`PGDATA=/var/lib/postgresql/17/docker\`,
-    '-p',
-    \`\${hostPort}:5432\`,
-    '-v',
-    \`\${containerName}-data:/var/lib/postgresql\`,
-    '-d',
-    image,
-  ];
-  const create = spawnSync(ENGINE, runArgs, { stdio: 'inherit' });
-  if (create.status !== 0) process.exit(create.status ?? 1);
-}
-
-const logs = spawn(ENGINE, ['logs', '-f', containerName], {
-  stdio: ['ignore', 'inherit', 'inherit'],
-});
-
-let exiting = false;
-
-const cleanup = () => {
-  if (exiting) return;
-  exiting = true;
-  spawnSync(ENGINE, ['stop', containerName], { stdio: 'ignore' });
-  logs.kill();
-  process.exit(0);
-};
-
-process.on('SIGTERM', cleanup);
-process.on('SIGINT', cleanup);
-process.on('SIGHUP', cleanup);
-
-logs.on('exit', (code) => {
-  if (!exiting) process.exit(code ?? 0);
-});
-"
-`;
-
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/scripts/wait-for-db.ts 1`] = `
-"import { Client } from 'pg';
-
-const noop = () => undefined;
-
-const [portArg, dbArg, userArg, passwordArg] = process.argv.slice(2);
-const timeoutAt = Date.now() + 60000;
-
-while (Date.now() < timeoutAt) {
-  const client = new Client({
-    host: 'localhost',
-    port: parseInt(portArg),
-    user: userArg,
-    password: passwordArg,
-    database: dbArg,
-    connectionTimeoutMillis: 500,
-  });
-  client.on('error', noop);
-  try {
-    await client.connect();
-    await client.end();
-    console.log('Database is ready.');
-    process.exit(0);
-  } catch {
-    console.log('Database is not ready.');
-    await client.end().catch(noop);
-  }
-  await new Promise((r) => setTimeout(r, 200));
-}
-
-throw new Error(\`Timed out waiting for postgres on port \${portArg}\`);
-"
-`;
-
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/constants.ts 1`] = `
-"export const DB_PACKAGE_NAME = 'Db';
-
-// Local development connection details (used when SERVE_LOCAL=true, see serve-local Nx target)
-export const LOCAL_DB_PORT = 5432;
-export const LOCAL_DB_HOST = 'localhost';
-export const LOCAL_DB_NAME = 'database_name';
-export const LOCAL_DB_USER = 'dbadmin';
-export const LOCAL_DB_PASSWORD = 'password';
-"
-`;
-
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/create-db-user-handler.ts 1`] = `
 "import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
 import { randomBytes } from 'node:crypto';
@@ -4015,14 +3830,12 @@ const ensureDatabaseUser = async (dbUser: string): Promise<void> => {
 
     await client.query(
       \`ALTER ROLE \${quotedDbUser} WITH LOGIN;
-      GRANT ALL PRIVILEGES ON DATABASE \${quotedDbName} TO \${quotedDbUser};
-      GRANT USAGE, CREATE ON SCHEMA public TO \${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO \${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO \${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public TO \${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO \${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON SEQUENCES TO \${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON FUNCTIONS TO \${quotedDbUser};
+      GRANT CONNECT ON DATABASE \${quotedDbName} TO \${quotedDbUser};
+      GRANT USAGE ON SCHEMA public TO \${quotedDbUser};
+      GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \${quotedDbUser};
+      GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO \${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO \${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO \${quotedDbUser};
       GRANT rds_iam TO \${quotedDbUser};\`,
     );
 
@@ -4057,36 +3870,23 @@ export const handler = async (
 `;
 
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/index.ts 1`] = `
-"export { DB_PACKAGE_NAME } from './constants.js';
-export { getPrisma } from './prisma.js';
+"export { getPrisma } from './prisma.js';
 "
 `;
 
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/migration-handler.ts 1`] = `
 "import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { Signer } from '@aws-sdk/rds-signer';
-import { withConnectionRetry } from './utils.js';
+import { getDatabaseSecret, withConnectionRetry } from './utils.js';
 
 const buildDatabaseUrl = async (): Promise<string> => {
-  const hostname = process.env.HOSTNAME!;
-  const port = process.env.PORT!;
-  const database = process.env.DATABASE!;
-  const dbUser = process.env.DBUSER!;
-  const region = process.env.AWS_REGION!;
-
-  const iamAuthToken = await new Signer({
-    hostname,
-    port: Number(port),
-    region,
-    username: dbUser,
-  }).getAuthToken();
+  const { host, port, dbname, username, password } = await getDatabaseSecret();
 
   return (
-    \`postgresql://\${encodeURIComponent(dbUser)}\` +
-    \`:\${encodeURIComponent(iamAuthToken)}\` +
-    \`@\${hostname}:\${port}/\${database}\` +
-    \`?sslaccept=strict\` // \`sslaccept\` is the correct parameter here for postgresql. The Prisma CLI Rust engine does not use the standard libpq \`sslmode\` option.
+    \`postgresql://\${encodeURIComponent(username)}\` +
+    \`:\${encodeURIComponent(password)}\` +
+    \`@\${host}:\${port}/\${dbname}\` +
+    \`?sslaccept=strict\`
   );
 };
 
@@ -4110,16 +3910,19 @@ exports[`ts#rdb generator > should generate the aurora shared construct > packag
 import { Signer } from '@aws-sdk/rds-signer';
 import { Prisma, PrismaClient } from '../generated/prisma/client.js';
 import { Pool } from 'pg';
-import {
-  DB_PACKAGE_NAME,
-  LOCAL_DB_HOST,
-  LOCAL_DB_NAME,
-  LOCAL_DB_PASSWORD,
-  LOCAL_DB_PORT,
-  LOCAL_DB_USER,
-} from './constants.js';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
 import { getDatabaseConfig } from './utils.js';
 
+// Generated: must match runtimeConfigKey in config.json
+const runtimeConfigKey = 'Db';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// config.json is only present in local dev (not included in the deployed bundle); guard with LOCAL_DEV check
+const localDev = () =>
+  JSON.parse(readFileSync(join(__dirname, '../config.json'), 'utf-8')).localDev;
+
 let prismaClient: PrismaClient<Prisma.LogLevel> | undefined;
 
 export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
@@ -4127,14 +3930,15 @@ export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
 ): Promise<PrismaClient<LogOpts>> => {
   if (prismaClient) return prismaClient;
 
-  if (process.env.SERVE_LOCAL === 'true') {
+  if (process.env.LOCAL_DEV === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = localDev();
     const adapter = new PrismaPg(
       new Pool({
-        host: LOCAL_DB_HOST,
-        port: LOCAL_DB_PORT,
-        database: LOCAL_DB_NAME,
-        user: LOCAL_DB_USER,
-        password: LOCAL_DB_PASSWORD,
+        host,
+        port,
+        database: dbName,
+        user: dbUser,
+        password: dbPassword,
         allowExitOnIdle: true,
       }),
     );
@@ -4146,7 +3950,7 @@ export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   }
 
   const { hostname, port, database, dbUser, region } =
-    await getDatabaseConfig(DB_PACKAGE_NAME);
+    await getDatabaseConfig(runtimeConfigKey);
   const adapter = new PrismaPg(
     new Pool({
       host: hostname,
@@ -4276,6 +4080,9 @@ const transientErrorPatterns = [
   'ECONNREFUSED',
   'ENOTFOUND',
   'P1000', // Prisma: authentication failed
+  'P1001', // Prisma: can't reach database server
+  'P1002', // Prisma: database server reached but timed out
+  'P1010', // Prisma: user denied access (IAM auth grant not yet propagated)
   'ER_ACCESS_DENIED_ERROR', // MySQL: access denied
 ];
 
@@ -4508,6 +4315,21 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enableKeyRotation?: boolean;
+
+  /**
+   * Whether to export Aurora engine logs to CloudWatch Logs.
+   * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
+   *
+   * @default false
+   */
+  readonly enableCloudwatchLogs?: boolean;
+
+  /**
+   * Whether to enable Performance Insights on the Aurora writer instance.
+   *
+   * @default true
+   */
+  readonly enablePerformanceInsights?: boolean;
 }
 
 /**
@@ -4537,6 +4359,8 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
+      enableCloudwatchLogs = false,
+      enablePerformanceInsights = true,
       engine,
       engineVersion,
       ...clusterProps
@@ -4552,12 +4376,24 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
-      writer: writer ?? ClusterInstance.serverlessV2('writer'),
+      writer:
+        writer ??
+        ClusterInstance.serverlessV2('writer', {
+          enablePerformanceInsights,
+          performanceInsightEncryptionKey: enablePerformanceInsights
+            ? key
+            : undefined,
+        }),
       credentials: Credentials.fromGeneratedSecret(adminUser, {
         encryptionKey: key,
       }),
       iamAuthentication: true,
       monitoringInterval: Duration.seconds(5),
+      cloudwatchLogsExports: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? ['audit', 'error', 'general', 'slowquery']
+          : ['postgresql']
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,
@@ -4654,32 +4490,19 @@ export abstract class AuroraDatabase extends Construct {
       timeout: Duration.minutes(5),
       tracing: Tracing.ACTIVE,
       vpc,
-      environment:
-        engine.type === 'mysql'
-          ? {
-              DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-            }
-          : {
-              HOSTNAME: databaseHostname,
-              DATABASE: databaseName,
-              PORT: databasePort.toString(),
-              DBUSER: this.dbUser,
-            },
+      environment: {
+        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
+      },
       architecture: Architecture.ARM_64,
     });
 
-    if (engine.type === 'mysql') {
-      this.cluster.connections.allowDefaultPortFrom(migrationHandler);
-      this.grantSecretRead(migrationHandler);
-    } else {
-      this.allowDefaultPortFrom(migrationHandler);
-      this.grantConnect(migrationHandler);
-    }
+    this.cluster.connections.allowDefaultPortFrom(migrationHandler);
+    this.grantSecretRead(migrationHandler);
 
-    const trigger = new Trigger(this, 'MigrationTrigger', {
+    const migrationTrigger = new Trigger(this, 'MigrationTrigger', {
       handler: migrationHandler,
     });
-    trigger.node.addDependency(createDbUserResource);
+    migrationTrigger.node.addDependency(createDbUserResource);
 
     new CfnOutput(this, 'ClusterEndpoint', {
       value: this.cluster.clusterEndpoint.hostname,
@@ -4720,8 +4543,8 @@ export abstract class AuroraDatabase extends Construct {
 exports[`ts#rdb generator > should generate the aurora shared construct 2`] = `
 "import * as path from 'path';
 import * as url from 'url';
+import { readFileSync } from 'fs';
 import { Construct } from 'constructs';
-import { DB_PACKAGE_NAME } from ':proj/db';
 import {
   AuroraDatabase,
   AuroraDatabaseEngines,
@@ -4729,6 +4552,16 @@ import {
 } from '../../core/rdb/aurora.js';
 import { findWorkspaceRoot } from '../../core/workspace.js';
 
+const { runtimeConfigKey } = JSON.parse(
+  readFileSync(
+    path.join(
+      findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+      'packages/db/config.json',
+    ),
+    'utf-8',
+  ),
+) as { runtimeConfigKey: string };
+
 export type DbProps = Omit<
   AuroraDatabaseProps,
   | 'databaseName'
@@ -4748,7 +4581,7 @@ export class Db extends AuroraDatabase {
       ...props,
       databaseName: 'database_name',
       adminUser: 'databaseUser',
-      runtimeConfigKey: DB_PACKAGE_NAME,
+      runtimeConfigKey,
       migrationBundleDir: path.join(
         findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
         'dist/packages/db/bundle/migration',
@@ -4766,17 +4599,14 @@ export class Db extends AuroraDatabase {
 
 exports[`ts#rdb generator > should generate the aurora shared construct 3`] = `
 "import { defineConfig } from 'prisma/config';
+import { readFileSync } from 'fs';
 
 const getDatabaseUrl = async () => {
-  if (process.env.SERVE_LOCAL === 'true') {
-    const {
-      LOCAL_DB_HOST,
-      LOCAL_DB_NAME,
-      LOCAL_DB_PASSWORD,
-      LOCAL_DB_PORT,
-      LOCAL_DB_USER,
-    } = await import('./src/constants.js');
-    return \`postgresql://\${LOCAL_DB_USER}:\${LOCAL_DB_PASSWORD}@\${LOCAL_DB_HOST}:\${LOCAL_DB_PORT}/\${LOCAL_DB_NAME}\`;
+  if (process.env.LOCAL_DEV === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = JSON.parse(
+      readFileSync('config.json', 'utf-8'),
+    ).localDev;
+    return \`postgresql://\${dbUser}:\${dbPassword}@\${host}:\${port}/\${dbName}\`;
   }
   return process.env.DATABASE_URL;
 };