@aws/nx-plugin 1.0.0-rc.32 → 1.0.0-rc.34

package/src/utils/rdb-constructs/files/cdk/core/rdb/aurora.ts.template

@@ -1,18 +1,14 @@
-import { CfnOutput, Duration, RemovalPolicy, Stack } from 'aws-cdk-lib';
-import { CustomResource } from 'aws-cdk-lib';
-import { IConnectable, IVpc, Port, SubnetType } from 'aws-cdk-lib/aws-ec2';
-import { IGrantable, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
-import { Key } from 'aws-cdk-lib/aws-kms';
-import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
+import { CfnOutput, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
+import { CustomResource } from "aws-cdk-lib";
+import { IConnectable, IVpc, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
+import { IGrantable, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Key } from "aws-cdk-lib/aws-kms";
 import {
   Architecture,
-  Code,
-  DockerImageCode,
-  DockerImageFunction,
   Function,
-  Runtime,
+  FunctionOptions,
   Tracing,
-} from 'aws-cdk-lib/aws-lambda';
+} from "aws-cdk-lib/aws-lambda";
 import {
   AuroraMysqlEngineVersion,
   AuroraPostgresEngineVersion,
@@ -24,11 +20,11 @@ import {
   DatabaseProxy,
   DefaultAuthScheme,
   IClusterEngine,
-} from 'aws-cdk-lib/aws-rds';
-import { Provider } from 'aws-cdk-lib/custom-resources';
-import { Trigger } from 'aws-cdk-lib/triggers';
-import { Construct } from 'constructs';
-import { RuntimeConfig } from '../runtime-config.js';
+} from "aws-cdk-lib/aws-rds";
+import { Provider } from "aws-cdk-lib/custom-resources";
+import { Trigger } from "aws-cdk-lib/triggers";
+import { Construct } from "constructs";
+import { RuntimeConfig } from "../runtime-config<% if (esm) { %>.js<% } %>";
 
 export type AuroraDatabaseEngineVersion =
   | AuroraMysqlEngineVersion
@@ -38,7 +34,7 @@ export interface AuroraDatabaseEngine {
   /**
    * Discriminant identifying the engine type.
    */
-  readonly type: 'mysql' | 'postgres';
+  readonly type: "mysql" | "postgres";
 
   /**
    * Default Aurora engine version used when one is not explicitly provided.
@@ -58,7 +54,7 @@ export class AuroraDatabaseEngines {
     defaultVersion?: AuroraMysqlEngineVersion;
   }): AuroraDatabaseEngine {
     return {
-      type: 'mysql',
+      type: "mysql",
       defaultVersion,
       clusterEngine: (version) =>
         DatabaseClusterEngine.auroraMysql({
@@ -73,7 +69,7 @@ export class AuroraDatabaseEngines {
     defaultVersion?: AuroraPostgresEngineVersion;
   }): AuroraDatabaseEngine {
     return {
-      type: 'postgres',
+      type: "postgres",
       defaultVersion,
       clusterEngine: (version) =>
         DatabaseClusterEngine.auroraPostgres({
@@ -85,12 +81,12 @@ export class AuroraDatabaseEngines {
 
 type _AuroraDatabaseProps = Omit<
   DatabaseClusterProps,
-  | 'credentials'
-  | 'defaultDatabaseName'
-  | 'engine'
-  | 'iamAuthentication'
-  | 'instanceProps'
-  | 'writer'
+  | "credentials"
+  | "defaultDatabaseName"
+  | "engine"
+  | "iamAuthentication"
+  | "instanceProps"
+  | "writer"
 >;
 
 export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
@@ -126,20 +122,10 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    */
   readonly runtimeConfigKey: string;
 
-  /**
-   * Migration bundle used to create a migration handler Lambda.
-   */
-  readonly migrationBundleDir: string;
-
-  /**
-   * Bundle used to create or reconcile the application database user.
-   */
-  readonly createDbUserBundleDir: string;
-
   /**
    * Writer instance for the Aurora cluster.
    */
-  readonly writer?: DatabaseClusterProps['writer'];
+  readonly writer?: DatabaseClusterProps["writer"];
 
   /**
    * Whether to provision an RDS Proxy in front of the Aurora cluster.
@@ -210,8 +196,6 @@ export abstract class AuroraDatabase extends Construct {
       adminUser,
       databaseName,
       runtimeConfigKey,
-      migrationBundleDir,
-      createDbUserBundleDir,
       vpcSubnets,
       writer,
       enableRdsProxy = true,
@@ -230,15 +214,15 @@ export abstract class AuroraDatabase extends Construct {
 
     this.adminUser = adminUser;
 
-    const key = new Key(this, 'EncryptionKey', { enableKeyRotation });
-    this.cluster = new DatabaseCluster(this, 'DatabaseCluster', {
+    const key = new Key(this, "EncryptionKey", { enableKeyRotation });
+    this.cluster = new DatabaseCluster(this, "DatabaseCluster", {
       ...clusterProps,
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
       writer:
         writer ??
-        ClusterInstance.serverlessV2('writer', {
+        ClusterInstance.serverlessV2("writer", {
           enablePerformanceInsights,
           performanceInsightEncryptionKey: enablePerformanceInsights
             ? key
@@ -250,9 +234,9 @@ export abstract class AuroraDatabase extends Construct {
       iamAuthentication: true,
       monitoringInterval: Duration.seconds(5),
       cloudwatchLogsExports: enableCloudwatchLogs
-        ? engine.type === 'mysql'
-          ? ['audit', 'error', 'general', 'slowquery']
-          : ['postgresql']
+        ? engine.type === "mysql"
+          ? ["audit", "error", "general", "slowquery"]
+          : ["postgresql"]
         : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
@@ -271,13 +255,13 @@ export abstract class AuroraDatabase extends Construct {
     }
 
     const proxyRole = enableRdsProxy
-      ? new Role(this, 'DatabaseProxyRole', {
-          assumedBy: new ServicePrincipal('rds.amazonaws.com'),
+      ? new Role(this, "DatabaseProxyRole", {
+          assumedBy: new ServicePrincipal("rds.amazonaws.com"),
         })
       : undefined;
 
     if (enableRdsProxy) {
-      this.proxy = this.cluster.addProxy('DatabaseProxy', {
+      this.proxy = this.cluster.addProxy("DatabaseProxy", {
         vpc,
         vpcSubnets,
         defaultAuthScheme: DefaultAuthScheme.IAM_AUTH,
@@ -289,36 +273,36 @@ export abstract class AuroraDatabase extends Construct {
       this.proxy?.endpoint ?? this.cluster.clusterEndpoint.hostname;
     const databasePort = this.cluster.clusterEndpoint.port;
 
-    const createDbUserHandler = new Function(this, 'CreateDbUserHandler', {
-      code: Code.fromAsset(createDbUserBundleDir),
-      handler: 'index.handler',
-      runtime: Runtime.NODEJS_LATEST,
+    const commonProps: FunctionOptions = {
+      vpc,
       timeout: Duration.minutes(5),
       tracing: Tracing.ACTIVE,
-      vpc,
+      architecture: Architecture.ARM_64,
+    };
+
+    const createDbUserHandler = this.createDbUserHandler({
+      ...commonProps,
       vpcSubnets: {
         subnetType: SubnetType.PRIVATE_WITH_EGRESS,
       },
-      environment: {
-        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-        NODE_EXTRA_CA_CERTS: '/var/runtime/ca-cert.pem',
-      },
-      architecture: Architecture.ARM_64,
     });
-
+    createDbUserHandler.addEnvironment(
+      "DATABASE_SECRET_ARN",
+      this.cluster.secret!.secretArn,
+    );
     this.cluster.connections.allowDefaultPortFrom(
       createDbUserHandler,
-      'Allow the create-db-user handler to connect to the database',
+      "Allow the create-db-user handler to connect to the database",
     );
     this.grantSecretRead(createDbUserHandler);
 
-    const createDbUserProvider = new Provider(this, 'CreateDbUserProvider', {
+    const createDbUserProvider = new Provider(this, "CreateDbUserProvider", {
       onEventHandler: createDbUserHandler,
     });
 
     const createDbUserResource = new CustomResource(
       this,
-      'CreateDbUserResource',
+      "CreateDbUserResource",
       {
         serviceToken: createDbUserProvider.serviceToken,
         properties: {
@@ -327,13 +311,13 @@ export abstract class AuroraDatabase extends Construct {
       },
     );
     createDbUserResource.node.addDependency(this.cluster);
-    this.dbUser = createDbUserResource.getAttString('dbUser');
+    this.dbUser = createDbUserResource.getAttString("dbUser");
     if (this.proxy && proxyRole) {
       this.cluster.grantConnect(proxyRole, this.dbUser);
     }
 
     const rc = RuntimeConfig.ensure(this);
-    rc.set('database', runtimeConfigKey, {
+    rc.set("database", runtimeConfigKey, {
       hostname: databaseHostname,
       port: databasePort,
       database: databaseName,
@@ -342,39 +326,45 @@ export abstract class AuroraDatabase extends Construct {
       region: Stack.of(this).region,
     });
 
-    const migrationHandler = new DockerImageFunction(this, 'MigrationHandler', {
-      code: DockerImageCode.fromImageAsset(migrationBundleDir, {
-        platform: Platform.LINUX_ARM64,
-      }),
+    const migrationHandler = this.createMigrationHandler({
+      ...commonProps,
       memorySize: 1024,
-      timeout: Duration.minutes(5),
-      tracing: Tracing.ACTIVE,
-      vpc,
-      environment: {
-        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-      },
-      architecture: Architecture.ARM_64,
     });
-
+    migrationHandler.addEnvironment(
+      "DATABASE_SECRET_ARN",
+      this.cluster.secret!.secretArn,
+    );
     this.cluster.connections.allowDefaultPortFrom(migrationHandler);
     this.grantSecretRead(migrationHandler);
 
-    const migrationTrigger = new Trigger(this, 'MigrationTrigger', {
+    const migrationTrigger = new Trigger(this, "MigrationTrigger", {
       handler: migrationHandler,
     });
     migrationTrigger.node.addDependency(createDbUserResource);
 
-    new CfnOutput(this, 'ClusterEndpoint', {
+    new CfnOutput(this, "ClusterEndpoint", {
       value: this.cluster.clusterEndpoint.hostname,
     });
 
     if (this.proxy?.endpoint) {
-      new CfnOutput(this, 'ProxyEndpoint', {
+      new CfnOutput(this, "ProxyEndpoint", {
         value: this.proxy?.endpoint,
       });
     }
   }
 
+  /**
+   * Creates the Lambda handler used to create or reconcile the application database user.
+   */
+  protected abstract createDbUserHandler(baseProps: FunctionOptions): Function;
+
+  /**
+   * Creates the Lambda handler used to run database migrations.
+   */
+  protected abstract createMigrationHandler(
+    baseProps: FunctionOptions,
+  ): Function;
+
   public allowDefaultPortFrom(other: IConnectable, description?: string): void {
     if (this.proxy) {
       this.proxy.connections.allowFrom(

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -120,16 +120,26 @@ variable "tags" {
   default     = {}
 }
 
-variable "docker_image_tag" {
+variable "migration_docker_image_tag" {
   description = "Docker image tag for the migration handler. Defaults to the tag built by the Nx docker target."
   type        = string
-  default     = "<%= dockerImageTag %>"
+  default     = "<%= migrationDockerImageTag %>"
 }
 
+<%_ if (framework === 'sqlmodel') { _%>
+variable "create_db_user_docker_image_tag" {
+  description = "Docker image tag for the Python create-db-user handler. Defaults to the tag built by the Nx docker target."
+  type        = string
+  default     = "<%= createDbUserDockerImageTag %>"
+}
+<%_ } _%>
+
+<%_ if (framework !== 'sqlmodel') { _%>
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
   type        = string
 }
+<%_ } _%>
 
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
@@ -143,7 +153,9 @@ resource "random_string" "suffix" {
 locals {
   config                       = jsondecode(file("${path.module}/../../../../../../../<%= projectRoot %>/config.json"))
   runtime_config_key           = local.config.runtimeConfigKey
+<%_ if (framework !== 'sqlmodel') { _%>
   create_db_user_bundle_path   = "${path.module}/../../../../../../../<%- createDbUserBundleDir %>"
+<%_ } _%>
   migration_function_name      = "<%= nameKebabCase %>-migration-${random_string.suffix.result}"
   create_db_user_function_name = "<%= nameKebabCase %>-create-db-user-${random_string.suffix.result}"
   database_runtime_user        = "db_${random_string.suffix.result}"
@@ -183,6 +195,22 @@ resource "aws_iam_role_policy" "proxy_db_user_connect" {
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
+<%_ if (engine === 'mysql' && framework !== 'sqlmodel') { _%>
+      {
+        Effect = "Allow"
+        Action = [
+          "secretsmanager:GetSecretValue"
+        ]
+        Resource = [module.aurora.secret_arn]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "kms:Decrypt"
+        ]
+        Resource = [module.aurora.kms_key_arn]
+      }
+<%_ } else { _%>
       {
         Effect = "Allow"
         Action = ["rds-db:connect"]
@@ -190,10 +218,12 @@ resource "aws_iam_role_policy" "proxy_db_user_connect" {
           "arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}"
         ]
       }
+<%_ } _%>
     ]
   })
 }
 
+<%_ if (framework !== 'sqlmodel') { _%>
 data "archive_file" "create_db_user_zip" {
   type        = "zip"
   source_dir  = local.create_db_user_bundle_path
@@ -207,6 +237,7 @@ resource "aws_s3_object" "create_db_user_zip" {
   source_hash = data.archive_file.create_db_user_zip.output_base64sha256
   etag        = data.archive_file.create_db_user_zip.output_md5
 }
+<%_ } _%>
 
 module "add_rdb_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
@@ -274,33 +305,55 @@ resource "aws_ecr_repository_policy" "migration_handler" {
 }
 
 data "external" "docker_digest" {
-  program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containerEngine %> inspect ${var.docker_image_tag} --format '{{.Id}}')'\"}' "]
+  program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containerEngine %> inspect ${var.migration_docker_image_tag} --format '{{.Id}}')'\"}' "]
 }
 
 locals {
   # Content-based, immutable image tag derived from the local image digest
   image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
 }
+<%_ if (framework === 'sqlmodel') { _%>
+data "external" "create_db_user_docker_digest" {
+  program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containerEngine %> inspect ${var.create_db_user_docker_image_tag} --format '{{.Id}}')'\"}' "]
+}
+
+locals {
+  create_db_user_image_tag = replace(data.external.create_db_user_docker_digest.result.digest, "sha256:", "")
+}
+<%_ } _%>
 
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
-    docker_image_tag = var.docker_image_tag
+    migration_docker_image_tag = var.migration_docker_image_tag
     image_tag        = local.image_tag
+<%_ if (framework === 'sqlmodel') { _%>
+    create_db_user_docker_digest    = data.external.create_db_user_docker_digest.result.digest
+    create_db_user_docker_image_tag = var.create_db_user_docker_image_tag
+    create_db_user_image_tag        = local.create_db_user_image_tag
+<%_ } _%>
   }
 
   provisioner "local-exec" {
     command = <<-EOT
       aws ecr get-login-password --region "$AWS_REGION" | <%= containerEngine %> login --username AWS --password-stdin "$REPOSITORY_URL"
-      <%= containerEngine %> tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      <%= containerEngine %> tag "$MIGRATION_DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
       <%= containerEngine %> push "$REPOSITORY_URL:$IMAGE_TAG"
+<%_ if (framework === 'sqlmodel') { _%>
+      <%= containerEngine %> tag "$CREATE_DB_USER_DOCKER_IMAGE_TAG" "$REPOSITORY_URL:create-db-user-$CREATE_DB_USER_IMAGE_TAG"
+      <%= containerEngine %> push "$REPOSITORY_URL:create-db-user-$CREATE_DB_USER_IMAGE_TAG"
+<%_ } _%>
     EOT
     environment = {
       AWS_REGION       = data.aws_region.current.region
       REPOSITORY_URL   = self.triggers.repository_url
-      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
+      MIGRATION_DOCKER_IMAGE_TAG = self.triggers.migration_docker_image_tag
       IMAGE_TAG        = self.triggers.image_tag
+<%_ if (framework === 'sqlmodel') { _%>
+      CREATE_DB_USER_DOCKER_IMAGE_TAG = self.triggers.create_db_user_docker_image_tag
+      CREATE_DB_USER_IMAGE_TAG        = self.triggers.create_db_user_image_tag
+<%_ } _%>
     }
   }
 
@@ -512,6 +565,18 @@ resource "aws_lambda_function" "create_db_user" {
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for the create-db-user handler
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
   #checkov:skip=CKV_AWS_272:Code signing not configured as deployment packages are built and deployed within the same pipeline
+<%_ if (framework === 'sqlmodel') { _%>
+  package_type  = "Image"
+  image_uri     = "${aws_ecr_repository.migration_handler.repository_url}:create-db-user-${local.create_db_user_image_tag}"
+  function_name = local.create_db_user_function_name
+  role          = aws_iam_role.create_db_user.arn
+  timeout       = 300
+  architectures = ["arm64"]
+
+  image_config {
+    command = ["<%= databasePackageAlias %>.create_db_user_handler.handler"]
+  }
+<%_ } else { _%>
   s3_bucket         = aws_s3_object.create_db_user_zip.bucket
   s3_key            = aws_s3_object.create_db_user_zip.key
   s3_object_version = aws_s3_object.create_db_user_zip.version_id
@@ -522,6 +587,7 @@ resource "aws_lambda_function" "create_db_user" {
   runtime           = "nodejs24.x"
   timeout          = 300
   architectures    = ["arm64"]
+<%_ } _%>
 
   tracing_config {
     mode = "Active"
@@ -535,14 +601,20 @@ resource "aws_lambda_function" "create_db_user" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+<%_ if (framework === 'prisma') { _%>
       NODE_EXTRA_CA_CERTS = "/var/runtime/ca-cert.pem"
+<%_ } _%>
     }
   }
 
   tags = var.tags
 
   depends_on = [
+<%_ if (framework === 'sqlmodel') { _%>
+    null_resource.docker_publish,
+<%_ } else { _%>
     aws_s3_object.create_db_user_zip,
+<%_ } _%>
     aws_iam_role_policy_attachment.create_db_user_basic_execution,
     aws_iam_role_policy_attachment.create_db_user_vpc_access,
     aws_iam_role_policy_attachment.create_db_user_xray,
@@ -557,7 +629,11 @@ resource "null_resource" "create_db_user_trigger" {
     cluster_arn   = module.aurora.cluster_arn
     function_name = aws_lambda_function.create_db_user.function_name
     db_user       = local.database_runtime_user
+<%_ if (framework === 'sqlmodel') { _%>
+    bundle_hash   = data.external.create_db_user_docker_digest.result.digest
+<%_ } else { _%>
     bundle_hash   = data.archive_file.create_db_user_zip.output_base64sha256
+<%_ } _%>
   }
 
   provisioner "local-exec" {
@@ -634,7 +710,7 @@ resource "null_resource" "migration_trigger" {
     cluster_arn    = module.aurora.cluster_arn
     database_ready = module.aurora.database_ready
     function_name  = aws_lambda_function.migration_handler.function_name
-<%_ if (engine !== 'mysql') { _%>
+<%_ if (engine !== 'mysql' && framework !== 'sqlmodel') { _%>
     db_user        = local.database_runtime_user
 <%_ } _%>
   }
@@ -689,6 +765,11 @@ output "proxy_resource_id" {
   value       = module.aurora.proxy_resource_id
 }
 
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = module.aurora.connect_resource_id
+}
+
 output "kms_key_arn" {
   description = "ARN of the KMS key protecting Aurora and the admin credentials secret, used to grant decrypt access alongside secret_arn."
   value       = module.aurora.kms_key_arn
@@ -723,4 +804,3 @@ output "database_runtime_user" {
   description = "Application database user created for IAM-authenticated access."
   value       = local.database_runtime_user
 }
-

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -454,27 +454,6 @@ resource "aws_iam_role" "proxy" {
   })
 }
 
-resource "aws_iam_role_policy" "proxy_secret_access" {
-  count = var.enable_rds_proxy ? 1 : 0
-  role  = aws_iam_role.proxy[0].name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect   = "Allow"
-        Action   = ["secretsmanager:GetSecretValue"]
-        Resource = [aws_secretsmanager_secret.credentials.arn]
-      },
-      {
-        Effect   = "Allow"
-        Action   = ["kms:Decrypt"]
-        Resource = [aws_kms_key.database.arn]
-      }
-    ]
-  })
-}
-
 resource "aws_security_group" "proxy" {
   #checkov:skip=CKV2_AWS_5:Security group is attached to aws_db_proxy.aurora; Checkov cannot resolve count-conditional cross-resource references
   count = var.enable_rds_proxy ? 1 : 0
@@ -498,17 +477,6 @@ resource "aws_db_proxy" "aurora" {
   vpc_subnet_ids         = var.subnet_ids
   vpc_security_group_ids = [aws_security_group.proxy[0].id]
   require_tls            = true
-
-  auth {
-    auth_scheme = "SECRETS"
-    iam_auth    = "REQUIRED"
-    secret_arn  = aws_secretsmanager_secret.credentials.arn
-  }
-
-  depends_on = [
-    aws_iam_role_policy.proxy_secret_access,
-    aws_secretsmanager_secret_version.credentials,
-  ]
 }
 
 resource "aws_db_proxy_default_target_group" "default" {
@@ -691,6 +659,11 @@ output "proxy_resource_id" {
   value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : null
 }
 
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : aws_rds_cluster.database.cluster_resource_id
+}
+
 output "cluster_endpoint" {
   description = "Writer endpoint of the Aurora cluster or proxy."
   value       = var.enable_rds_proxy ? aws_db_proxy.aurora[0].endpoint : aws_rds_cluster.database.endpoint

package/src/utils/rdb-constructs/rdb-constructs.d.ts

@@ -15,8 +15,18 @@ export interface AddRdbConstructOptions {
     adminUser: string;
     engine: 'postgres' | 'mysql';
     migrationBundleDir: string;
+    /**
+     * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).
+     * When absent the migration Docker image is reused with the
+     * `create_db_user_handler.handler` command (py#rdb).
+     */
     createDbUserBundleDir: string;
-    dockerImageTag: string;
+    /** ORM framework used by the create-db-user Lambda. */
+    framework: 'prisma' | 'sqlmodel';
+    /** Local Docker tag for the Python create-db-user Lambda image. */
+    createDbUserDockerImageTag?: string;
+    /** Local Docker tag for the migration Lambda image. */
+    migrationDockerImageTag: string;
     containerEngine: Containers;
 }
 export declare const addRdbInfra: (tree: Tree, options: AddRdbConstructOptions & {

package/src/utils/rdb-constructs/rdb-constructs.js

@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
 import { addStarExport } from "../ast.js";
+import { esmVars } from "../module-format.js";
 import { addDependencyToTargetIfNotPresent } from "../nx.js";
 import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
 import { terraformProviderVersions } from "../versions.js";
@@ -20,10 +21,16 @@ export const addRdbInfra = async (tree, options)=>{
     });
 };
 export const addRdbCdkConstructs = async (tree, options)=>{
-    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'rdb'), options, {
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'rdb'), {
+        ...options,
+        ...esmVars(tree)
+    }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'), options, {
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'), {
+        ...options,
+        ...esmVars(tree)
+    }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
     await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './rdb/aurora.js');

package/src/utils/rdb-constructs/rdb-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport type { Iac } from '../iac';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { terraformProviderVersions } from '../versions';\n\nexport interface AddRdbConstructOptions {\n  projectName: string;\n  projectRoot: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  databasePackageAlias: string;\n  databaseName: string;\n  adminUser: string;\n  engine: 'postgres' | 'mysql';\n  migrationBundleDir: string;\n  createDbUserBundleDir: string;\n  dockerImageTag: string;\n  containerEngine: Containers;\n}\n\nexport const addRdbInfra = async (\n  tree: Tree,\n  options: AddRdbConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addRdbCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addRdbTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nexport const addRdbCdkConstructs = async (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'rdb',\n    ),\n    options,\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'),\n    options,\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './rdb/aurora.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dbs',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dbs/index.js',\n  );\n};\n\nexport const addRdbTerraformModules = (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","terraformProviderVersions","addRdbInfra","tree","options","iac","addRdbCdkConstructs","addRdbTerraformModules","Error","config","projectName","dirname","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAGvC,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,yBAAyB,QAAQ,iBAAc;AAiBxD,OAAO,MAAMC,cAAc,OACzBC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,oBAAoBH,MAAMC;IAClC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,uBAAuBJ,MAAMC;IAC/B,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAV,WACEQ,MACAV,kBACEK,cACAM,QAAQC,GAAG,KAAK,QAAQN,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGL,QAAQM,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,OAAO,MAAMH,sBAAsB,OACjCH,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYkB,OAAO,EAAE,SAAS,OAAO,QAAQ,QAC/DlB,kBACEK,cACAC,uBACA,OACA,QACA,QAEFK,SACA;QACEQ,mBAAmBlB,kBAAkBmB,YAAY;IACnD;IAGFrB,cACEW,MACAV,kBAAkB,YAAYkB,OAAO,EAAE,SAAS,OAAO,OAAO,QAC9DlB,kBAAkBK,cAAcC,uBAAuB,OAAO,OAAO,QACrEK,SACA;QACEQ,mBAAmBlB,kBAAkBmB,YAAY;IACnD;IAGF,MAAMjB,cACJO,MACAV,kBACEK,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMH,cACJO,MACAV,kBACEK,cACAC,uBACA,OACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEK,QAAQU,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAMlB,cACJO,MACAV,kBACEK,cACAC,uBACA,OACA,OACA,aAEF;AAEJ,EAAE;AAEF,OAAO,MAAMQ,yBAAyB,CACpCJ,MACAC;IAEAZ,cACEW,MACAV,kBAAkB,YAAYkB,OAAO,EAAE,SAAS,aAAa,QAAQ,QACrElB,kBAAkBK,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGC,2BAA2B;IAAC,GACjC;QACEW,mBAAmBlB,kBAAkBmB,YAAY;IACnD;IAGFrB,cACEW,MACAV,kBAAkB,YAAYkB,OAAO,EAAE,SAAS,aAAa,OAAO,QACpElB,kBAAkBK,cAAcE,sBAAsB,OAAO,OAAO,QACpE;QAAE,GAAGI,OAAO;QAAE,GAAGH,2BAA2B;IAAC,GAC7C;QACEW,mBAAmBlB,kBAAkBmB,YAAY;IACnD;AAEJ,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast';\nimport type { Containers } from '../containers';\nimport type { Iac } from '../iac';\nimport { esmVars } from '../module-format';\nimport { addDependencyToTargetIfNotPresent } from '../nx';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants';\nimport { terraformProviderVersions } from '../versions';\n\nexport interface AddRdbConstructOptions {\n  projectName: string;\n  projectRoot: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  databasePackageAlias: string;\n  databaseName: string;\n  adminUser: string;\n  engine: 'postgres' | 'mysql';\n  migrationBundleDir: string;\n  /**\n   * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).\n   * When absent the migration Docker image is reused with the\n   * `create_db_user_handler.handler` command (py#rdb).\n   */\n  createDbUserBundleDir: string;\n  /** ORM framework used by the create-db-user Lambda. */\n  framework: 'prisma' | 'sqlmodel';\n  /** Local Docker tag for the Python create-db-user Lambda image. */\n  createDbUserDockerImageTag?: string;\n  /** Local Docker tag for the migration Lambda image. */\n  migrationDockerImageTag: string;\n  containerEngine: Containers;\n}\n\nexport const addRdbInfra = async (\n  tree: Tree,\n  options: AddRdbConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addRdbCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addRdbTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nexport const addRdbCdkConstructs = async (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'rdb',\n    ),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './rdb/aurora.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dbs',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dbs/index.js',\n  );\n};\n\nexport const addRdbTerraformModules = (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'),\n    { ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...terraformProviderVersions() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","terraformProviderVersions","addRdbInfra","tree","options","iac","addRdbCdkConstructs","addRdbTerraformModules","Error","config","projectName","dirname","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAS;AAGvC,SAASC,OAAO,QAAQ,sBAAmB;AAC3C,SAASC,iCAAiC,QAAQ,WAAQ;AAC1D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAiC;AACxC,SAASC,yBAAyB,QAAQ,iBAAc;AA2BxD,OAAO,MAAMC,cAAc,OACzBC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,oBAAoBH,MAAMC;IAClC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,uBAAuBJ,MAAMC;IAC/B,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAX,WACES,MACAX,kBACEM,cACAM,QAAQC,GAAG,KAAK,QAAQN,wBAAwBC,sBAChD,iBAEF,CAACS;QACCZ,kCACEY,QACA,SACA,GAAGL,QAAQM,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,OAAO,MAAMH,sBAAsB,OACjCH,MACAC;IAEAb,cACEY,MACAX,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,OAAO,QAAQ,QAC/DnB,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;QAAE,GAAGK,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACES,mBAAmBnB,kBAAkBoB,YAAY;IACnD;IAGFtB,cACEY,MACAX,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,OAAO,OAAO,QAC9DnB,kBAAkBM,cAAcC,uBAAuB,OAAO,OAAO,QACrE;QAAE,GAAGK,OAAO;QAAE,GAAGR,QAAQO,KAAK;IAAC,GAC/B;QACES,mBAAmBnB,kBAAkBoB,YAAY;IACnD;IAGF,MAAMlB,cACJQ,MACAX,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJQ,MACAX,kBACEM,cACAC,uBACA,OACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEK,QAAQU,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAMnB,cACJQ,MACAX,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ,EAAE;AAEF,OAAO,MAAMQ,yBAAyB,CACpCJ,MACAC;IAEAb,cACEY,MACAX,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,aAAa,QAAQ,QACrEnB,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGC,2BAA2B;IAAC,GACjC;QACEW,mBAAmBnB,kBAAkBoB,YAAY;IACnD;IAGFtB,cACEY,MACAX,kBAAkB,YAAYmB,OAAO,EAAE,SAAS,aAAa,OAAO,QACpEnB,kBAAkBM,cAAcE,sBAAsB,OAAO,OAAO,QACpE;QAAE,GAAGI,OAAO;QAAE,GAAGH,2BAA2B;IAAC,GAC7C;QACEW,mBAAmBnB,kBAAkBoB,YAAY;IACnD;AAEJ,EAAE"}