@aws/nx-plugin 1.0.0-rc.7 → 1.0.0-rc.71

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -4,19 +4,19 @@ terraform {
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "~> 2.5"
+      version = "<%- archiveProviderVersion %>"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "<%- awsProviderVersion %>"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "<%- nullProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -120,16 +120,26 @@ variable "tags" {
   default     = {}
 }
 
-variable "docker_image_tag" {
+variable "migration_docker_image_tag" {
   description = "Docker image tag for the migration handler. Defaults to the tag built by the Nx docker target."
   type        = string
-  default     = "<%= dockerImageTag %>"
+  default     = "<%= migrationDockerImageTag %>"
 }
 
+<%_ if (framework === 'sqlmodel') { _%>
+variable "create_db_user_docker_image_tag" {
+  description = "Docker image tag for the Python create-db-user handler. Defaults to the tag built by the Nx docker target."
+  type        = string
+  default     = "<%= createDbUserDockerImageTag %>"
+}
+<%_ } _%>
+
+<%_ if (framework !== 'sqlmodel') { _%>
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
   type        = string
 }
+<%_ } _%>
 
 data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
@@ -141,10 +151,14 @@ resource "random_string" "suffix" {
 }
 
 locals {
-  create_db_user_bundle_path = "${path.module}/../../../../../../../<%- createDbUserBundleDir %>"
-  migration_function_name = "<%= nameKebabCase %>-migration-${random_string.suffix.result}"
+  config                       = jsondecode(file("${path.module}/../../../../../../../<%= projectRoot %>/config.json"))
+  runtime_config_key           = local.config.runtimeConfigKey
+<%_ if (framework !== 'sqlmodel') { _%>
+  create_db_user_bundle_path   = "${path.module}/../../../../../../../<%- createDbUserBundleDir %>"
+<%_ } _%>
+  migration_function_name      = "<%= nameKebabCase %>-migration-${random_string.suffix.result}"
   create_db_user_function_name = "<%= nameKebabCase %>-create-db-user-${random_string.suffix.result}"
-  database_runtime_user = "db_${random_string.suffix.result}"
+  database_runtime_user        = "db_${random_string.suffix.result}"
 }
 
 module "aurora" {
@@ -181,6 +195,22 @@ resource "aws_iam_role_policy" "proxy_db_user_connect" {
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
+<%_ if (engine === 'mysql' && framework !== 'sqlmodel') { _%>
+      {
+        Effect = "Allow"
+        Action = [
+          "secretsmanager:GetSecretValue"
+        ]
+        Resource = [module.aurora.secret_arn]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "kms:Decrypt"
+        ]
+        Resource = [module.aurora.kms_key_arn]
+      }
+<%_ } else { _%>
       {
         Effect = "Allow"
         Action = ["rds-db:connect"]
@@ -188,10 +218,12 @@ resource "aws_iam_role_policy" "proxy_db_user_connect" {
           "arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}"
         ]
       }
+<%_ } _%>
     ]
   })
 }
 
+<%_ if (framework !== 'sqlmodel') { _%>
 data "archive_file" "create_db_user_zip" {
   type        = "zip"
   source_dir  = local.create_db_user_bundle_path
@@ -205,12 +237,13 @@ resource "aws_s3_object" "create_db_user_zip" {
   source_hash = data.archive_file.create_db_user_zip.output_base64sha256
   etag        = data.archive_file.create_db_user_zip.output_md5
 }
+<%_ } _%>
 
 module "add_rdb_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
   namespace = "database"
-  key       = "<%= nameClassName %>"
+  key       = local.runtime_config_key
   value = {
     hostname  = module.aurora.cluster_endpoint
     port      = module.aurora.cluster_port
@@ -223,9 +256,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "<%= nameKebabCase %>-migration-${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -273,22 +305,56 @@ resource "aws_ecr_repository_policy" "migration_handler" {
 }
 
 data "external" "docker_digest" {
-  program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containerEngine %> inspect ${var.docker_image_tag} --format '{{.Id}}')'\"}' "]
+  program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containerEngine %> inspect ${var.migration_docker_image_tag} --format '{{.Id}}')'\"}' "]
+}
+
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+<%_ if (framework === 'sqlmodel') { _%>
+data "external" "create_db_user_docker_digest" {
+  program = ["sh", "-c", "echo '{\"digest\":\"'$(<%= containerEngine %> inspect ${var.create_db_user_docker_image_tag} --format '{{.Id}}')'\"}' "]
 }
 
+locals {
+  create_db_user_image_tag = replace(data.external.create_db_user_docker_digest.result.digest, "sha256:", "")
+}
+<%_ } _%>
+
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
-    docker_image_tag = var.docker_image_tag
+    migration_docker_image_tag = var.migration_docker_image_tag
+    image_tag        = local.image_tag
+<%_ if (framework === 'sqlmodel') { _%>
+    create_db_user_docker_digest    = data.external.create_db_user_docker_digest.result.digest
+    create_db_user_docker_image_tag = var.create_db_user_docker_image_tag
+    create_db_user_image_tag        = local.create_db_user_image_tag
+<%_ } _%>
   }
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region ${data.aws_region.current.region} | <%= containerEngine %> login --username AWS --password-stdin ${self.triggers.repository_url}
-      <%= containerEngine %> tag ${self.triggers.docker_image_tag} ${self.triggers.repository_url}:latest
-      <%= containerEngine %> push ${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | <%= containerEngine %> login --username AWS --password-stdin "$REPOSITORY_URL"
+      <%= containerEngine %> tag "$MIGRATION_DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      <%= containerEngine %> push "$REPOSITORY_URL:$IMAGE_TAG"
+<%_ if (framework === 'sqlmodel') { _%>
+      <%= containerEngine %> tag "$CREATE_DB_USER_DOCKER_IMAGE_TAG" "$REPOSITORY_URL:create-db-user-$CREATE_DB_USER_IMAGE_TAG"
+      <%= containerEngine %> push "$REPOSITORY_URL:create-db-user-$CREATE_DB_USER_IMAGE_TAG"
+<%_ } _%>
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      MIGRATION_DOCKER_IMAGE_TAG = self.triggers.migration_docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+<%_ if (framework === 'sqlmodel') { _%>
+      CREATE_DB_USER_DOCKER_IMAGE_TAG = self.triggers.create_db_user_docker_image_tag
+      CREATE_DB_USER_IMAGE_TAG        = self.triggers.create_db_user_image_tag
+<%_ } _%>
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -334,7 +400,6 @@ resource "aws_iam_role_policy" "migration_handler_access" {
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
-<%_ if (engine === 'mysql') { _%>
       {
         Effect = "Allow"
         Action = [
@@ -349,17 +414,6 @@ resource "aws_iam_role_policy" "migration_handler_access" {
         ]
         Resource = [module.aurora.kms_key_arn]
       }
-<%_ } else { _%>
-      {
-        Effect = "Allow"
-        Action = [
-          "rds-db:connect"
-        ]
-        Resource = [
-          "arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${var.enable_rds_proxy ? module.aurora.proxy_resource_id : module.aurora.cluster_resource_id}/${local.database_runtime_user}"
-        ]
-      }
-<%_ } _%>
     ]
   })
 }
@@ -446,13 +500,8 @@ resource "aws_security_group" "migration_handler" {
 }
 
 resource "aws_vpc_security_group_egress_rule" "migration_handler_to_database" {
-<%_ if (engine === 'mysql') { _%>
   security_group_id            = aws_security_group.migration_handler.id
   referenced_security_group_id = module.aurora.database_security_group_id
-<%_ } else { _%>
-  security_group_id            = aws_security_group.migration_handler.id
-  referenced_security_group_id = module.aurora.security_group_id
-<%_ } _%>
   from_port   = module.aurora.cluster_port
   to_port     = module.aurora.cluster_port
   ip_protocol = "tcp"
@@ -494,11 +543,7 @@ resource "aws_vpc_security_group_egress_rule" "create_db_user_https" {
 }
 
 resource "aws_vpc_security_group_ingress_rule" "migration_handler_to_database" {
-<%_ if (engine === 'mysql') { _%>
   security_group_id            = module.aurora.database_security_group_id
-<%_ } else { _%>
-  security_group_id            = module.aurora.security_group_id
-<%_ } _%>
   referenced_security_group_id = aws_security_group.migration_handler.id
   from_port                    = module.aurora.cluster_port
   to_port                      = module.aurora.cluster_port
@@ -520,6 +565,18 @@ resource "aws_lambda_function" "create_db_user" {
   #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for the create-db-user handler
   #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
   #checkov:skip=CKV_AWS_272:Code signing not configured as deployment packages are built and deployed within the same pipeline
+<%_ if (framework === 'sqlmodel') { _%>
+  package_type  = "Image"
+  image_uri     = "${aws_ecr_repository.migration_handler.repository_url}:create-db-user-${local.create_db_user_image_tag}"
+  function_name = local.create_db_user_function_name
+  role          = aws_iam_role.create_db_user.arn
+  timeout       = 300
+  architectures = ["arm64"]
+
+  image_config {
+    command = ["<%= databasePackageAlias %>.create_db_user_handler.handler"]
+  }
+<%_ } else { _%>
   s3_bucket         = aws_s3_object.create_db_user_zip.bucket
   s3_key            = aws_s3_object.create_db_user_zip.key
   s3_object_version = aws_s3_object.create_db_user_zip.version_id
@@ -530,6 +587,7 @@ resource "aws_lambda_function" "create_db_user" {
   runtime           = "nodejs24.x"
   timeout          = 300
   architectures    = ["arm64"]
+<%_ } _%>
 
   tracing_config {
     mode = "Active"
@@ -543,14 +601,20 @@ resource "aws_lambda_function" "create_db_user" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+<%_ if (framework === 'prisma') { _%>
       NODE_EXTRA_CA_CERTS = "/var/runtime/ca-cert.pem"
+<%_ } _%>
     }
   }
 
   tags = var.tags
 
   depends_on = [
+<%_ if (framework === 'sqlmodel') { _%>
+    null_resource.docker_publish,
+<%_ } else { _%>
     aws_s3_object.create_db_user_zip,
+<%_ } _%>
     aws_iam_role_policy_attachment.create_db_user_basic_execution,
     aws_iam_role_policy_attachment.create_db_user_vpc_access,
     aws_iam_role_policy_attachment.create_db_user_xray,
@@ -565,17 +629,21 @@ resource "null_resource" "create_db_user_trigger" {
     cluster_arn   = module.aurora.cluster_arn
     function_name = aws_lambda_function.create_db_user.function_name
     db_user       = local.database_runtime_user
+<%_ if (framework === 'sqlmodel') { _%>
+    bundle_hash   = data.external.create_db_user_docker_digest.result.digest
+<%_ } else { _%>
     bundle_hash   = data.archive_file.create_db_user_zip.output_base64sha256
+<%_ } _%>
   }
 
   provisioner "local-exec" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \
-        --region ${data.aws_region.current.region} \
-        --function-name ${self.triggers.function_name} \
+        --region "$AWS_REGION" \
+        --function-name "$FUNCTION_NAME" \
         --cli-binary-format raw-in-base64-out \
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:${self.triggers.db_user}"}' \
+        --payload "{\"RequestType\":\"Create\",\"PhysicalResourceId\":\"db-user:$DB_USER\"}" \
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -585,6 +653,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -598,7 +671,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "${aws_ecr_repository.migration_handler.repository_url}:${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]
@@ -614,14 +687,7 @@ resource "aws_lambda_function" "migration_handler" {
 
   environment {
     variables = {
-<%_ if (engine === 'mysql') { _%>
       DATABASE_SECRET_ARN = module.aurora.secret_arn
-<%_ } else { _%>
-      HOSTNAME = module.aurora.cluster_endpoint
-      DATABASE = module.aurora.database_name
-      PORT     = tostring(module.aurora.cluster_port)
-      DBUSER   = local.database_runtime_user
-<%_ } _%>
     }
   }
 
@@ -644,7 +710,7 @@ resource "null_resource" "migration_trigger" {
     cluster_arn    = module.aurora.cluster_arn
     database_ready = module.aurora.database_ready
     function_name  = aws_lambda_function.migration_handler.function_name
-<%_ if (engine !== 'mysql') { _%>
+<%_ if (engine !== 'mysql' && framework !== 'sqlmodel') { _%>
     db_user        = local.database_runtime_user
 <%_ } _%>
   }
@@ -653,8 +719,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \
-        --region ${data.aws_region.current.region} \
-        --function-name ${self.triggers.function_name} \
+        --region "$AWS_REGION" \
+        --function-name "$FUNCTION_NAME" \
         --cli-binary-format raw-in-base64-out \
         "$output_file")
       cat "$output_file"
@@ -665,6 +731,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [
@@ -695,6 +765,11 @@ output "proxy_resource_id" {
   value       = module.aurora.proxy_resource_id
 }
 
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = module.aurora.connect_resource_id
+}
+
 output "kms_key_arn" {
   description = "ARN of the KMS key protecting Aurora and the admin credentials secret, used to grant decrypt access alongside secret_arn."
   value       = module.aurora.kms_key_arn
@@ -729,4 +804,3 @@ output "database_runtime_user" {
   description = "Application database user created for IAM-authenticated access."
   value       = local.database_runtime_user
 }
-

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -7,15 +7,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "<%- awsProviderVersion %>"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "<%- nullProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -124,9 +124,9 @@ variable "enable_credential_rotation" {
 }
 
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -159,10 +159,19 @@ variable "tags" {
   default     = {}
 }
 
+# Suffix appended to physical resource names so that multiple deployments
+# (e.g. separate environments in the same account and region) don't collide.
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
 locals {
   default_port           = var.engine == "aurora-mysql" ? 3306 : 5432
   default_engine_version = var.engine == "aurora-mysql" ? "8.0.mysql_aurora.3.12.0" : "17.7"
   parameter_group_family = var.engine == "aurora-mysql" ? "aurora-mysql8.0" : "aurora-postgresql${split(".", coalesce(var.engine_version, local.default_engine_version))[0]}"
+  cluster_name           = "${var.name}-aurora-${random_string.suffix.result}"
 }
 
 resource "aws_rds_cluster_parameter_group" "database" {
@@ -172,11 +181,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for ${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one `psql -c "a;b;c"` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -260,7 +288,7 @@ resource "aws_security_group" "database" {
 }
 
 resource "aws_db_subnet_group" "database" {
-  name       = "${var.name}-aurora"
+  name       = local.cluster_name
   subnet_ids = var.subnet_ids
 
   tags = merge(var.tags, {
@@ -298,9 +326,9 @@ resource "aws_secretsmanager_secret_version" "credentials" {
 }
 
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
-  cluster_identifier                  = "${var.name}-aurora"
+  cluster_identifier                  = local.cluster_name
   engine                              = var.engine
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
@@ -314,12 +342,12 @@ resource "aws_rds_cluster" "database" {
   kms_key_id                          = aws_kms_key.database.arn
   deletion_protection                 = var.deletion_protection
   skip_final_snapshot                 = var.skip_final_snapshot
-  final_snapshot_identifier           = var.skip_final_snapshot ? null : "${var.name}-aurora-final-snapshot"
+  final_snapshot_identifier           = var.skip_final_snapshot ? null : "${local.cluster_name}-final-snapshot"
   iam_database_authentication_enabled = true
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity
@@ -334,7 +362,7 @@ resource "aws_rds_cluster" "database" {
 resource "aws_rds_cluster_instance" "database" {
   count = var.instance_count
 
-  identifier           = "${var.name}-aurora-${count.index + 1}"
+  identifier           = "${local.cluster_name}-${count.index + 1}"
   cluster_identifier   = aws_rds_cluster.database.id
   instance_class       = "db.serverless"
   engine               = aws_rds_cluster.database.engine
@@ -388,7 +416,7 @@ resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
 resource "aws_cloudformation_stack" "credentials_rotation" {
   #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
   count = var.enable_credential_rotation ? 1 : 0
-  name  = "${var.name}-aurora-credentials-rotation"
+  name  = "${local.cluster_name}-credentials-rotation"
 
   capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
 
@@ -402,7 +430,7 @@ resource "aws_cloudformation_stack" "credentials_rotation" {
           SecretId = aws_secretsmanager_secret.credentials.arn
           HostedRotationLambda = {
             RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "${var.name}-aurora-credentials-rotation"
+            RotationLambdaName  = "${local.cluster_name}-credentials-rotation"
             VpcSecurityGroupIds = aws_security_group.rotation[0].id
             VpcSubnetIds        = join(",", var.lambda_subnet_ids)
           }
@@ -445,27 +473,6 @@ resource "aws_iam_role" "proxy" {
   })
 }
 
-resource "aws_iam_role_policy" "proxy_secret_access" {
-  count = var.enable_rds_proxy ? 1 : 0
-  role  = aws_iam_role.proxy[0].name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect   = "Allow"
-        Action   = ["secretsmanager:GetSecretValue"]
-        Resource = [aws_secretsmanager_secret.credentials.arn]
-      },
-      {
-        Effect   = "Allow"
-        Action   = ["kms:Decrypt"]
-        Resource = [aws_kms_key.database.arn]
-      }
-    ]
-  })
-}
-
 resource "aws_security_group" "proxy" {
   #checkov:skip=CKV2_AWS_5:Security group is attached to aws_db_proxy.aurora; Checkov cannot resolve count-conditional cross-resource references
   count = var.enable_rds_proxy ? 1 : 0
@@ -482,24 +489,13 @@ resource "aws_security_group" "proxy" {
 resource "aws_db_proxy" "aurora" {
   count = var.enable_rds_proxy ? 1 : 0
 
-  name                   = "${var.name}-proxy"
+  name                   = "${var.name}-proxy-${random_string.suffix.result}"
   default_auth_scheme    = "IAM_AUTH"
   engine_family          = var.engine == "aurora-mysql" ? "MYSQL" : "POSTGRESQL"
   role_arn               = aws_iam_role.proxy[0].arn
   vpc_subnet_ids         = var.subnet_ids
   vpc_security_group_ids = [aws_security_group.proxy[0].id]
   require_tls            = true
-
-  auth {
-    auth_scheme = "SECRETS"
-    iam_auth    = "REQUIRED"
-    secret_arn  = aws_secretsmanager_secret.credentials.arn
-  }
-
-  depends_on = [
-    aws_iam_role_policy.proxy_secret_access,
-    aws_secretsmanager_secret_version.credentials,
-  ]
 }
 
 resource "aws_db_proxy_default_target_group" "default" {
@@ -531,9 +527,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \
-          --region ${data.aws_region.current.region} \
-          --db-proxy-name ${self.triggers.db_proxy_name} \
-          --target-group-name ${self.triggers.target_group_name} \
+          --region "$AWS_REGION" \
+          --db-proxy-name "$DB_PROXY_NAME" \
+          --target-group-name "$TARGET_GROUP_NAME" \
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \
           --output text)
 
@@ -543,13 +539,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target ${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -628,7 +630,7 @@ resource "aws_iam_role_policy_attachment" "backup" {
 resource "aws_backup_vault" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name        = "${var.name}-aurora-backup"
+  name        = "${local.cluster_name}-backup"
   kms_key_arn = aws_kms_key.database.arn
   tags        = var.tags
 }
@@ -636,7 +638,7 @@ resource "aws_backup_vault" "database" {
 resource "aws_backup_plan" "database" {
   count = var.enable_backup ? 1 : 0
 
-  name = "${var.name}-aurora-backup"
+  name = "${local.cluster_name}-backup"
 
   rule {
     rule_name         = "daily-backup"
@@ -676,6 +678,11 @@ output "proxy_resource_id" {
   value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : null
 }
 
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : aws_rds_cluster.database.cluster_resource_id
+}
+
 output "cluster_endpoint" {
   description = "Writer endpoint of the Aurora cluster or proxy."
   value       = var.enable_rds_proxy ? aws_db_proxy.aurora[0].endpoint : aws_rds_cluster.database.endpoint