@aws/nx-plugin 1.0.0-rc.42 → 1.0.0-rc.44

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -522,7 +522,11 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * Whether to export Aurora engine logs to CloudWatch Logs.
    * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
    *
-   * @default false
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
    */
   readonly enableCloudwatchLogs?: boolean;
 
@@ -559,7 +563,7 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
-      enableCloudwatchLogs = false,
+      enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
       engine,
       engineVersion,
@@ -591,9 +595,20 @@ export abstract class AuroraDatabase extends Construct {
       monitoringInterval: Duration.seconds(5),
       cloudwatchLogsExports: enableCloudwatchLogs
         ? engine.type === 'mysql'
-          ? ['audit', 'error', 'general', 'slowquery']
+          ? ['audit', 'error']
           : ['postgresql']
         : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? {
+              server_audit_logging: '1',
+              server_audit_events: 'CONNECT,QUERY_DDL',
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: 'ddl' }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,
@@ -782,7 +797,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.54.0"
+      version = "6.55.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -899,9 +914,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -956,11 +971,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for \${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -1082,7 +1116,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 }
 
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
   cluster_identifier                  = local.cluster_name
   engine                              = var.engine
@@ -1103,7 +1137,7 @@ resource "aws_rds_cluster" "database" {
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity
@@ -1517,7 +1551,7 @@ exports[`ts#rdb generator > should generate terraform modules when iac is Terraf
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.54.0"
+      version = "6.55.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -2249,7 +2283,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.54.0"
+      version = "6.55.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -2366,9 +2400,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -2423,11 +2457,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for \${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -2549,7 +2602,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 }
 
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
   cluster_identifier                  = local.cluster_name
   engine                              = var.engine
@@ -2570,7 +2623,7 @@ resource "aws_rds_cluster" "database" {
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity
@@ -2984,7 +3037,7 @@ exports[`ts#rdb generator > should generate terraform modules with MySQL engine
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "6.54.0"
+      version = "6.55.0"
     }
     null = {
       source  = "hashicorp/null"
@@ -4259,7 +4312,11 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * Whether to export Aurora engine logs to CloudWatch Logs.
    * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
    *
-   * @default false
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
    */
   readonly enableCloudwatchLogs?: boolean;
 
@@ -4296,7 +4353,7 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
-      enableCloudwatchLogs = false,
+      enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
       engine,
       engineVersion,
@@ -4328,9 +4385,20 @@ export abstract class AuroraDatabase extends Construct {
       monitoringInterval: Duration.seconds(5),
       cloudwatchLogsExports: enableCloudwatchLogs
         ? engine.type === 'mysql'
-          ? ['audit', 'error', 'general', 'slowquery']
+          ? ['audit', 'error']
           : ['postgresql']
         : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? {
+              server_audit_logging: '1',
+              server_audit_events: 'CONNECT,QUERY_DDL',
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: 'ddl' }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -131,7 +131,7 @@ exports[`react-website generator > TailwindCSS integration > terraform iac > sho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.54.0"
+      version = "6.55.0"
       configuration_aliases = [aws.us_east_1]
     }
     random = {
@@ -699,7 +699,7 @@ resource "null_resource" "upload_website_files" {
   provisioner "local-exec" {
     command = <<-EOT
       cd "$ROOT_PATH"
-      uv run --with boto3==1.43.46 python3 -c "
+      uv run --with boto3==1.43.51 python3 -c "
 import os
 import sys
 import boto3
@@ -822,7 +822,7 @@ resource "null_resource" "cloudfront_invalidation" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.46 python3 -c "
+      uv run --with boto3==1.43.51 python3 -c "
 import boto3
 import os
 import sys
@@ -908,7 +908,7 @@ output "waf_web_acl_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.54.0"
+      version = "6.55.0"
       configuration_aliases = [aws.us_east_1]
     }
   }
@@ -1119,14 +1119,14 @@ exports[`react-website generator > Tanstack router integration > should generate
 "{
   "name": "@proj/source",
   "dependencies": {
-    "@cloudscape-design/board-components": "3.0.201",
-    "@cloudscape-design/components": "3.0.1325",
+    "@cloudscape-design/board-components": "3.0.205",
+    "@cloudscape-design/components": "3.0.1330",
     "@cloudscape-design/global-styles": "1.0.62",
     "aws-cdk-lib": "2.261.0",
-    "constructs": "10.6.0",
+    "constructs": "10.7.0",
     "react": "19.2.7",
     "react-dom": "19.2.7",
-    "tailwindcss": "4.3.2"
+    "tailwindcss": "4.3.3"
   },
   "devDependencies": {
     "@nx/js": "23.1.0",
@@ -1135,7 +1135,7 @@ exports[`react-website generator > Tanstack router integration > should generate
     "@nx/vitest": "23.1.0",
     "@nx/web": "23.1.0",
     "@swc/helpers": "~0.5.18",
-    "@tailwindcss/vite": "4.3.2",
+    "@tailwindcss/vite": "4.3.3",
     "@testing-library/dom": "10.4.0",
     "@testing-library/react": "16.3.0",
     "@types/node": "26.1.1",
@@ -1147,7 +1147,7 @@ exports[`react-website generator > Tanstack router integration > should generate
     "jiti": "2.4.2",
     "jsdom": "^27.1.0",
     "typescript": "~6.0.3",
-    "vite": "8.1.4",
+    "vite": "8.1.5",
     "vitest": "4.1.10"
   },
   "type": "module"
@@ -2832,15 +2832,15 @@ exports[`react-website generator > Tanstack router integration > should generate
 "{
   "name": "@proj/source",
   "dependencies": {
-    "@cloudscape-design/board-components": "3.0.201",
-    "@cloudscape-design/components": "3.0.1325",
+    "@cloudscape-design/board-components": "3.0.205",
+    "@cloudscape-design/components": "3.0.1330",
     "@cloudscape-design/global-styles": "1.0.62",
-    "@tanstack/react-router": "1.170.17",
+    "@tanstack/react-router": "1.170.18",
     "aws-cdk-lib": "2.261.0",
-    "constructs": "10.6.0",
+    "constructs": "10.7.0",
     "react": "19.2.7",
     "react-dom": "19.2.7",
-    "tailwindcss": "4.3.2"
+    "tailwindcss": "4.3.3"
   },
   "devDependencies": {
     "@nx/js": "23.1.0",
@@ -2849,9 +2849,9 @@ exports[`react-website generator > Tanstack router integration > should generate
     "@nx/vitest": "23.1.0",
     "@nx/web": "23.1.0",
     "@swc/helpers": "~0.5.18",
-    "@tailwindcss/vite": "4.3.2",
-    "@tanstack/router-generator": "1.167.18",
-    "@tanstack/router-plugin": "1.168.19",
+    "@tailwindcss/vite": "4.3.3",
+    "@tanstack/router-generator": "1.167.21",
+    "@tanstack/router-plugin": "1.168.22",
     "@tanstack/router-utils": "1.162.2",
     "@tanstack/virtual-file-routes": "1.162.0",
     "@testing-library/dom": "10.4.0",
@@ -2865,7 +2865,7 @@ exports[`react-website generator > Tanstack router integration > should generate
     "jiti": "2.4.2",
     "jsdom": "^27.1.0",
     "typescript": "~6.0.3",
-    "vite": "8.1.4",
+    "vite": "8.1.5",
     "vitest": "4.1.10"
   },
   "type": "module"
@@ -5367,15 +5367,15 @@ root &&
 
 exports[`react-website generator > should handle npm scope prefix correctly > scoped-dependencies 1`] = `
 {
-  "@cloudscape-design/board-components": "3.0.201",
-  "@cloudscape-design/components": "3.0.1325",
+  "@cloudscape-design/board-components": "3.0.205",
+  "@cloudscape-design/components": "3.0.1330",
   "@cloudscape-design/global-styles": "1.0.62",
-  "@tanstack/react-router": "1.170.17",
+  "@tanstack/react-router": "1.170.18",
   "aws-cdk-lib": "2.261.0",
-  "constructs": "10.6.0",
+  "constructs": "10.7.0",
   "react": "19.2.7",
   "react-dom": "19.2.7",
-  "tailwindcss": "4.3.2",
+  "tailwindcss": "4.3.3",
 }
 `;
 

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -6,7 +6,7 @@ exports[`cognito-auth generator terraform iac > should generate terraform files
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "6.54.0"
+      version = "6.55.0"
     }
   }
 }
@@ -63,7 +63,7 @@ resource "null_resource" "add_callback_url" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.46 python -c "
+      uv run --with boto3==1.43.51 python -c "
 import boto3
 import os
 import sys

package/src/utils/files/common/scripts/src/dynamodb/start-container.ts.template

@@ -101,6 +101,4 @@ process.on('SIGTERM', cleanup);
 process.on('SIGINT', cleanup);
 process.on('SIGHUP', cleanup);
 
-logs.on('exit', (code) => {
-  if (!exiting) process.exit(code ?? 0);
-});
+logs.on('exit', cleanup);

package/src/utils/files/common/scripts/src/rdb/shared/start-container.ts.template

@@ -112,6 +112,4 @@ process.on("SIGTERM", cleanup);
 process.on("SIGINT", cleanup);
 process.on("SIGHUP", cleanup);
 
-logs.on("exit", () => {
-  if (!exiting) cleanup();
-});
+logs.on("exit", cleanup);

package/src/utils/rdb-constructs/files/cdk/core/rdb/aurora.ts.template

@@ -166,7 +166,11 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * Whether to export Aurora engine logs to CloudWatch Logs.
    * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
    *
-   * @default false
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
    */
   readonly enableCloudwatchLogs?: boolean;
 
@@ -203,7 +207,7 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
-      enableCloudwatchLogs = false,
+      enableCloudwatchLogs = true,
       enablePerformanceInsights = true,
       engine,
       engineVersion,
@@ -235,9 +239,20 @@ export abstract class AuroraDatabase extends Construct {
       monitoringInterval: Duration.seconds(5),
       cloudwatchLogsExports: enableCloudwatchLogs
         ? engine.type === "mysql"
-          ? ["audit", "error", "general", "slowquery"]
+          ? ["audit", "error"]
           : ["postgresql"]
         : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === "mysql"
+          ? {
+              server_audit_logging: "1",
+              server_audit_events: "CONNECT,QUERY_DDL",
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one `psql -c "a;b;c"` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: "ddl" }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -124,9 +124,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -181,11 +181,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for ${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one `psql -c "a;b;c"` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -307,7 +326,7 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 }
 
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
   cluster_identifier                  = local.cluster_name
   engine                              = var.engine
@@ -328,7 +347,7 @@ resource "aws_rds_cluster" "database" {
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity