@aws/nx-plugin 1.0.0-rc.85 → 1.0.0-rc.87

package/src/ts/lambda-function/__snapshots__/generator.spec.ts.snap

@@ -10,7 +10,7 @@ export class TestProjectTestFunction extends Function {
   constructor(scope: Construct, id: string) {
     super(scope, id, {
       timeout: Duration.seconds(30),
-      runtime: Runtime.NODEJS_LATEST,
+      runtime: Runtime.NODEJS_24_X,
       handler: 'index.handler',
       code: Code.fromAsset(
         url.fileURLToPath(
@@ -282,7 +282,7 @@ resource "aws_lambda_function" "lambda_function" {
   role              = aws_iam_role.lambda_role.arn
   handler           = "index.handler"
   source_code_hash  = data.archive_file.lambda_zip.output_base64sha256
-  runtime           = "nodejs22.x"
+  runtime           = "nodejs24.x"
   timeout           = 30
 
   tracing_config {
@@ -467,7 +467,7 @@ resource "aws_lambda_function" "lambda_function" {
   role              = aws_iam_role.lambda_role.arn
   handler           = "index.handler"
   source_code_hash  = data.archive_file.lambda_zip.output_base64sha256
-  runtime           = "nodejs22.x"
+  runtime           = "nodejs24.x"
   timeout           = 30
 
   tracing_config {

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -225,6 +225,24 @@ export type DatabaseSecret = {
   port: number;
 };
 
+/**
+ * Connection details for the admin credentials secret. RDS-managed secrets hold
+ * only \`username\` and \`password\`, so the host, port and database name are taken
+ * from the environment when the secret omits them.
+ */
+type SecretConnectionOverrides = Partial<
+  Omit<DatabaseSecret, 'username' | 'password'>
+>;
+
+const connectionOverridesFromEnv = (): SecretConnectionOverrides => {
+  const { DATABASE_HOST, DATABASE_PORT, DATABASE_NAME } = process.env;
+  return {
+    ...(DATABASE_HOST ? { host: DATABASE_HOST } : {}),
+    ...(DATABASE_PORT ? { port: Number(DATABASE_PORT) } : {}),
+    ...(DATABASE_NAME ? { dbname: DATABASE_NAME } : {}),
+  };
+};
+
 const databaseConfigPromises: Record<string, Promise<DatabaseConfig>> = {};
 
 const getSecretValue = async (secretArn: string): Promise<string> => {
@@ -251,7 +269,18 @@ export const getDatabaseSecret = async (): Promise<DatabaseSecret> => {
     );
   }
 
-  return JSON.parse(await getSecretValue(secretArn)) as DatabaseSecret;
+  const secret = JSON.parse(await getSecretValue(secretArn)) as DatabaseSecret;
+  const secretWithConnection = { ...secret, ...connectionOverridesFromEnv() };
+
+  for (const key of ['host', 'port', 'dbname'] as const) {
+    if (secretWithConnection[key] == null) {
+      throw new Error(
+        \`Database secret is missing \${key} and no override was provided in the environment.\`,
+      );
+    }
+  }
+
+  return secretWithConnection;
 };
 
 const loadDatabaseConfig = async (
@@ -810,7 +839,8 @@ export default defineConfig({
 
 exports[`ts#rdb generator > should generate terraform modules when iac is Terraform 1`] = `
 "# Core Aurora module
-# This module creates an Aurora cluster and a generated admin secret.
+# This module creates an Aurora cluster whose admin credentials are generated
+# and rotated by RDS in Secrets Manager.
 
 terraform {
   required_version = ">= 1.0"
@@ -854,11 +884,6 @@ variable "subnet_ids" {
   type        = list(string)
 }
 
-variable "lambda_subnet_ids" {
-  description = "Subnet IDs for the credential-rotation Lambda. Must have outbound egress to AWS service endpoints (e.g. Secrets Manager) — use private subnets with a NAT gateway."
-  type        = list(string)
-}
-
 variable "engine" {
   description = "Aurora engine to use."
   type        = string
@@ -928,12 +953,6 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
   description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
@@ -1055,6 +1074,20 @@ resource "aws_kms_key" "database" {
           "kms:CreateGrant"
         ]
         Resource = "*"
+      },
+      {
+        Sid    = "AllowSecretsManagerService"
+        Effect = "Allow"
+        Principal = {
+          Service = "secretsmanager.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
       }
     ]
   })
@@ -1109,35 +1142,6 @@ resource "aws_db_subnet_group" "database" {
   })
 }
 
-resource "random_password" "master_password" {
-  length           = 32
-  special          = true
-  override_special = "!#$%&*()-_=+[]{}<>:?"
-}
-
-resource "aws_secretsmanager_secret" "credentials" {
-  #checkov:skip=CKV2_AWS_57:Rotation is configured via aws_cloudformation_stack.credentials_rotation using the AWS::SecretsManager-2024-09-16 transform; Checkov cannot resolve rotation schedules created by CloudFormation transforms
-  name_prefix = "\${var.name}-aurora-credentials-"
-  kms_key_id  = aws_kms_key.database.arn
-
-  tags = merge(var.tags, {
-    Name = "\${var.name}-aurora-credentials"
-  })
-}
-
-resource "aws_secretsmanager_secret_version" "credentials" {
-  secret_id = aws_secretsmanager_secret.credentials.id
-  secret_string = jsonencode({
-    engine              = var.engine == "aurora-mysql" ? "mysql" : "postgres"
-    username            = var.admin_user
-    password            = random_password.master_password.result
-    host                = aws_rds_cluster.database.endpoint
-    port                = aws_rds_cluster.database.port
-    dbname              = var.database_name
-    dbClusterIdentifier = aws_rds_cluster.database.cluster_identifier
-  })
-}
-
 resource "aws_rds_cluster" "database" {
   #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
@@ -1146,7 +1150,8 @@ resource "aws_rds_cluster" "database" {
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
   master_username                     = var.admin_user
-  master_password                     = random_password.master_password.result
+  manage_master_user_password         = true
+  master_user_secret_kms_key_id       = aws_kms_key.database.arn
   db_subnet_group_name                = aws_db_subnet_group.database.name
   db_cluster_parameter_group_name     = var.enable_cloudwatch_logs ? aws_rds_cluster_parameter_group.database[0].name : null
   vpc_security_group_ids              = [aws_security_group.database.id]
@@ -1198,75 +1203,6 @@ resource "aws_rds_cluster_instance" "database" {
   })
 }
 
-resource "aws_security_group" "rotation" {
-  #checkov:skip=CKV2_AWS_5:Security group is attached to the hosted rotation Lambda created by AWS::SecretsManager::RotationSchedule; Checkov cannot resolve resources created by the CloudFormation transform
-  count       = var.enable_credential_rotation ? 1 : 0
-  name_prefix = "\${var.name}-aurora-rotation-"
-  description = "Security group for Aurora secret rotation \${var.name}"
-  vpc_id      = var.vpc_id
-
-  tags = merge(var.tags, {
-    Name = "\${var.name}-aurora-rotation"
-  })
-}
-
-resource "aws_vpc_security_group_egress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.rotation[0].id
-  referenced_security_group_id = aws_security_group.database.id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow outbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.database.id
-  referenced_security_group_id = aws_security_group.rotation[0].id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow inbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_cloudformation_stack" "credentials_rotation" {
-  #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
-  count = var.enable_credential_rotation ? 1 : 0
-  name  = "\${local.cluster_name}-credentials-rotation"
-
-  capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
-
-  template_body = jsonencode({
-    AWSTemplateFormatVersion = "2010-09-09"
-    Transform                = "AWS::SecretsManager-2024-09-16"
-    Resources = {
-      CredentialsRotationSchedule = {
-        Type = "AWS::SecretsManager::RotationSchedule"
-        Properties = {
-          SecretId = aws_secretsmanager_secret.credentials.arn
-          HostedRotationLambda = {
-            RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "\${local.cluster_name}-credentials-rotation"
-            VpcSecurityGroupIds = aws_security_group.rotation[0].id
-            VpcSubnetIds        = join(",", var.lambda_subnet_ids)
-          }
-          RotationRules = {
-            AutomaticallyAfterDays = 30
-          }
-        }
-      }
-    }
-  })
-
-  depends_on = [
-    aws_secretsmanager_secret_version.credentials,
-    aws_rds_cluster_instance.database,
-    aws_vpc_security_group_egress_rule.rotation_to_database,
-    aws_vpc_security_group_ingress_rule.rotation_to_database,
-  ]
-}
-
 resource "aws_iam_role" "proxy" {
   count = var.enable_rds_proxy ? 1 : 0
 
@@ -1505,6 +1441,11 @@ output "cluster_endpoint" {
   value       = var.enable_rds_proxy ? aws_db_proxy.aurora[0].endpoint : aws_rds_cluster.database.endpoint
 }
 
+output "writer_endpoint" {
+  description = "Writer endpoint of the Aurora cluster itself, bypassing the RDS Proxy. Used by the admin-credentialled handlers, which connect directly to the cluster."
+  value       = aws_rds_cluster.database.endpoint
+}
+
 output "reader_endpoint" {
   description = "Reader endpoint of the Aurora cluster."
   value       = aws_rds_cluster.database.reader_endpoint
@@ -1531,12 +1472,12 @@ output "proxy_role_name" {
 }
 
 output "secret_arn" {
-  description = "ARN of the generated admin credentials secret."
-  value       = aws_secretsmanager_secret.credentials.arn
+  description = "ARN of the RDS-managed admin credentials secret. Its value is a JSON object with username and password only — connection details come from this module's other outputs."
+  value       = one(aws_rds_cluster.database.master_user_secret[*].secret_arn)
 }
 
 output "kms_key_arn" {
-  description = "ARN of the KMS key protecting Aurora and the generated secret."
+  description = "ARN of the KMS key protecting Aurora and its admin credentials secret."
   value       = aws_kms_key.database.arn
 }
 
@@ -1561,8 +1502,8 @@ output "database_name" {
 }
 
 output "admin_user" {
-  description = "Admin username stored in the generated secret."
-  value       = jsondecode(aws_secretsmanager_secret_version.credentials.secret_string).username
+  description = "Admin username stored in the RDS-managed credentials secret."
+  value       = aws_rds_cluster.database.master_username
 }
 "
 `;
@@ -1658,12 +1599,6 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
   description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
@@ -1736,7 +1671,6 @@ module "aurora" {
   name                                  = "db"
   vpc_id                                = var.vpc_id
   subnet_ids                            = var.database_subnet_ids
-  lambda_subnet_ids                     = var.lambda_subnet_ids
   engine                                = "aurora-postgresql"
   engine_version                        = var.engine_version
   database_name                         = "database_name"
@@ -1748,7 +1682,6 @@ module "aurora" {
   deletion_protection                   = var.deletion_protection
   skip_final_snapshot                   = var.skip_final_snapshot
   enable_rds_proxy                      = var.enable_rds_proxy
-  enable_credential_rotation            = var.enable_credential_rotation
   enable_cloudwatch_logs                = var.enable_cloudwatch_logs
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
@@ -2117,6 +2050,9 @@ resource "aws_lambda_function" "create_db_user" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
       NODE_EXTRA_CA_CERTS = "/var/runtime/ca-cert.pem"
     }
   }
@@ -2194,6 +2130,9 @@ resource "aws_lambda_function" "migration_handler" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
     }
   }
 
@@ -2313,7 +2252,8 @@ output "database_runtime_user" {
 
 exports[`ts#rdb generator > should generate terraform modules with MySQL engine 1`] = `
 "# Core Aurora module
-# This module creates an Aurora cluster and a generated admin secret.
+# This module creates an Aurora cluster whose admin credentials are generated
+# and rotated by RDS in Secrets Manager.
 
 terraform {
   required_version = ">= 1.0"
@@ -2357,11 +2297,6 @@ variable "subnet_ids" {
   type        = list(string)
 }
 
-variable "lambda_subnet_ids" {
-  description = "Subnet IDs for the credential-rotation Lambda. Must have outbound egress to AWS service endpoints (e.g. Secrets Manager) — use private subnets with a NAT gateway."
-  type        = list(string)
-}
-
 variable "engine" {
   description = "Aurora engine to use."
   type        = string
@@ -2431,12 +2366,6 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
   description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
@@ -2558,6 +2487,20 @@ resource "aws_kms_key" "database" {
           "kms:CreateGrant"
         ]
         Resource = "*"
+      },
+      {
+        Sid    = "AllowSecretsManagerService"
+        Effect = "Allow"
+        Principal = {
+          Service = "secretsmanager.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
       }
     ]
   })
@@ -2612,35 +2555,6 @@ resource "aws_db_subnet_group" "database" {
   })
 }
 
-resource "random_password" "master_password" {
-  length           = 32
-  special          = true
-  override_special = "!#$%&*()-_=+[]{}<>:?"
-}
-
-resource "aws_secretsmanager_secret" "credentials" {
-  #checkov:skip=CKV2_AWS_57:Rotation is configured via aws_cloudformation_stack.credentials_rotation using the AWS::SecretsManager-2024-09-16 transform; Checkov cannot resolve rotation schedules created by CloudFormation transforms
-  name_prefix = "\${var.name}-aurora-credentials-"
-  kms_key_id  = aws_kms_key.database.arn
-
-  tags = merge(var.tags, {
-    Name = "\${var.name}-aurora-credentials"
-  })
-}
-
-resource "aws_secretsmanager_secret_version" "credentials" {
-  secret_id = aws_secretsmanager_secret.credentials.id
-  secret_string = jsonencode({
-    engine              = var.engine == "aurora-mysql" ? "mysql" : "postgres"
-    username            = var.admin_user
-    password            = random_password.master_password.result
-    host                = aws_rds_cluster.database.endpoint
-    port                = aws_rds_cluster.database.port
-    dbname              = var.database_name
-    dbClusterIdentifier = aws_rds_cluster.database.cluster_identifier
-  })
-}
-
 resource "aws_rds_cluster" "database" {
   #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
@@ -2649,7 +2563,8 @@ resource "aws_rds_cluster" "database" {
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
   master_username                     = var.admin_user
-  master_password                     = random_password.master_password.result
+  manage_master_user_password         = true
+  master_user_secret_kms_key_id       = aws_kms_key.database.arn
   db_subnet_group_name                = aws_db_subnet_group.database.name
   db_cluster_parameter_group_name     = var.enable_cloudwatch_logs ? aws_rds_cluster_parameter_group.database[0].name : null
   vpc_security_group_ids              = [aws_security_group.database.id]
@@ -2701,75 +2616,6 @@ resource "aws_rds_cluster_instance" "database" {
   })
 }
 
-resource "aws_security_group" "rotation" {
-  #checkov:skip=CKV2_AWS_5:Security group is attached to the hosted rotation Lambda created by AWS::SecretsManager::RotationSchedule; Checkov cannot resolve resources created by the CloudFormation transform
-  count       = var.enable_credential_rotation ? 1 : 0
-  name_prefix = "\${var.name}-aurora-rotation-"
-  description = "Security group for Aurora secret rotation \${var.name}"
-  vpc_id      = var.vpc_id
-
-  tags = merge(var.tags, {
-    Name = "\${var.name}-aurora-rotation"
-  })
-}
-
-resource "aws_vpc_security_group_egress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.rotation[0].id
-  referenced_security_group_id = aws_security_group.database.id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow outbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.database.id
-  referenced_security_group_id = aws_security_group.rotation[0].id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow inbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_cloudformation_stack" "credentials_rotation" {
-  #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
-  count = var.enable_credential_rotation ? 1 : 0
-  name  = "\${local.cluster_name}-credentials-rotation"
-
-  capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
-
-  template_body = jsonencode({
-    AWSTemplateFormatVersion = "2010-09-09"
-    Transform                = "AWS::SecretsManager-2024-09-16"
-    Resources = {
-      CredentialsRotationSchedule = {
-        Type = "AWS::SecretsManager::RotationSchedule"
-        Properties = {
-          SecretId = aws_secretsmanager_secret.credentials.arn
-          HostedRotationLambda = {
-            RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "\${local.cluster_name}-credentials-rotation"
-            VpcSecurityGroupIds = aws_security_group.rotation[0].id
-            VpcSubnetIds        = join(",", var.lambda_subnet_ids)
-          }
-          RotationRules = {
-            AutomaticallyAfterDays = 30
-          }
-        }
-      }
-    }
-  })
-
-  depends_on = [
-    aws_secretsmanager_secret_version.credentials,
-    aws_rds_cluster_instance.database,
-    aws_vpc_security_group_egress_rule.rotation_to_database,
-    aws_vpc_security_group_ingress_rule.rotation_to_database,
-  ]
-}
-
 resource "aws_iam_role" "proxy" {
   count = var.enable_rds_proxy ? 1 : 0
 
@@ -3008,6 +2854,11 @@ output "cluster_endpoint" {
   value       = var.enable_rds_proxy ? aws_db_proxy.aurora[0].endpoint : aws_rds_cluster.database.endpoint
 }
 
+output "writer_endpoint" {
+  description = "Writer endpoint of the Aurora cluster itself, bypassing the RDS Proxy. Used by the admin-credentialled handlers, which connect directly to the cluster."
+  value       = aws_rds_cluster.database.endpoint
+}
+
 output "reader_endpoint" {
   description = "Reader endpoint of the Aurora cluster."
   value       = aws_rds_cluster.database.reader_endpoint
@@ -3034,12 +2885,12 @@ output "proxy_role_name" {
 }
 
 output "secret_arn" {
-  description = "ARN of the generated admin credentials secret."
-  value       = aws_secretsmanager_secret.credentials.arn
+  description = "ARN of the RDS-managed admin credentials secret. Its value is a JSON object with username and password only — connection details come from this module's other outputs."
+  value       = one(aws_rds_cluster.database.master_user_secret[*].secret_arn)
 }
 
 output "kms_key_arn" {
-  description = "ARN of the KMS key protecting Aurora and the generated secret."
+  description = "ARN of the KMS key protecting Aurora and its admin credentials secret."
   value       = aws_kms_key.database.arn
 }
 
@@ -3064,8 +2915,8 @@ output "database_name" {
 }
 
 output "admin_user" {
-  description = "Admin username stored in the generated secret."
-  value       = jsondecode(aws_secretsmanager_secret_version.credentials.secret_string).username
+  description = "Admin username stored in the RDS-managed credentials secret."
+  value       = aws_rds_cluster.database.master_username
 }
 "
 `;
@@ -3161,12 +3012,6 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
   description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
@@ -3239,7 +3084,6 @@ module "aurora" {
   name                                  = "db"
   vpc_id                                = var.vpc_id
   subnet_ids                            = var.database_subnet_ids
-  lambda_subnet_ids                     = var.lambda_subnet_ids
   engine                                = "aurora-mysql"
   engine_version                        = var.engine_version
   database_name                         = "database_name"
@@ -3251,7 +3095,6 @@ module "aurora" {
   deletion_protection                   = var.deletion_protection
   skip_final_snapshot                   = var.skip_final_snapshot
   enable_rds_proxy                      = var.enable_rds_proxy
-  enable_credential_rotation            = var.enable_credential_rotation
   enable_cloudwatch_logs                = var.enable_cloudwatch_logs
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
@@ -3270,17 +3113,10 @@ resource "aws_iam_role_policy" "proxy_db_user_connect" {
     Statement = [
       {
         Effect = "Allow"
-        Action = [
-          "secretsmanager:GetSecretValue"
-        ]
-        Resource = [module.aurora.secret_arn]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Decrypt"
+        Action = ["rds-db:connect"]
+        Resource = [
+          "arn:aws:rds-db:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:dbuser:\${module.aurora.cluster_resource_id}/\${local.database_runtime_user}"
         ]
-        Resource = [module.aurora.kms_key_arn]
       }
     ]
   })
@@ -3627,6 +3463,9 @@ resource "aws_lambda_function" "create_db_user" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
       NODE_EXTRA_CA_CERTS = "/var/runtime/ca-cert.pem"
     }
   }
@@ -3704,6 +3543,9 @@ resource "aws_lambda_function" "migration_handler" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
     }
   }
 
@@ -4070,6 +3912,24 @@ export type DatabaseSecret = {
   port: number;
 };
 
+/**
+ * Connection details for the admin credentials secret. RDS-managed secrets hold
+ * only \`username\` and \`password\`, so the host, port and database name are taken
+ * from the environment when the secret omits them.
+ */
+type SecretConnectionOverrides = Partial<
+  Omit<DatabaseSecret, 'username' | 'password'>
+>;
+
+const connectionOverridesFromEnv = (): SecretConnectionOverrides => {
+  const { DATABASE_HOST, DATABASE_PORT, DATABASE_NAME } = process.env;
+  return {
+    ...(DATABASE_HOST ? { host: DATABASE_HOST } : {}),
+    ...(DATABASE_PORT ? { port: Number(DATABASE_PORT) } : {}),
+    ...(DATABASE_NAME ? { dbname: DATABASE_NAME } : {}),
+  };
+};
+
 const databaseConfigPromises: Record<string, Promise<DatabaseConfig>> = {};
 
 const getSecretValue = async (secretArn: string): Promise<string> => {
@@ -4096,7 +3956,18 @@ export const getDatabaseSecret = async (): Promise<DatabaseSecret> => {
     );
   }
 
-  return JSON.parse(await getSecretValue(secretArn)) as DatabaseSecret;
+  const secret = JSON.parse(await getSecretValue(secretArn)) as DatabaseSecret;
+  const secretWithConnection = { ...secret, ...connectionOverridesFromEnv() };
+
+  for (const key of ['host', 'port', 'dbname'] as const) {
+    if (secretWithConnection[key] == null) {
+      throw new Error(
+        \`Database secret is missing \${key} and no override was provided in the environment.\`,
+      );
+    }
+  }
+
+  return secretWithConnection;
 };
 
 const loadDatabaseConfig = async (
@@ -4692,7 +4563,7 @@ export class Db extends AuroraDatabase {
       ...baseProps,
       code: Code.fromAsset(createDbUserBundleDir),
       handler: 'index.handler',
-      runtime: Runtime.NODEJS_LATEST,
+      runtime: Runtime.NODEJS_24_X,
       environment: {
         NODE_EXTRA_CA_CERTS: '/var/runtime/ca-cert.pem',
       },