@aws/nx-plugin 1.0.0-rc.85 → 1.0.0-rc.87

package/src/utils/lambda-runtime-resolution.js

@@ -0,0 +1,97 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { LAMBDA_RUNTIME_VERSIONS } from "./versions.js";
+/**
+ * Resolution of the Lambda runtimes and the CPython patch the version update
+ * pins.
+ *
+ * Lives here rather than beside the script so it is covered by the plugin's test
+ * suite; the script supplies the runtime list and the uv output.
+ */ /** Compare two dotted numeric versions (`24`, `3.14`) ascending. */ export const compareRuntimeVersions = (a, b)=>{
+    const left = a.split('.').map(Number);
+    const right = b.split('.').map(Number);
+    for(let i = 0; i < Math.max(left.length, right.length); i++){
+        const diff = (left[i] ?? 0) - (right[i] ?? 0);
+        if (diff !== 0) {
+            return diff;
+        }
+    }
+    return 0;
+};
+/**
+ * The version a managed runtime identifier names, or undefined for one that isn't
+ * a versioned `nodejs`/`python` runtime.
+ *
+ * `nodejs24.x` -> `24`, `python3.14` -> `3.14`. The bare `nodejs` and
+ * `nodejs4.3-edge` style identifiers carry no comparable version and are skipped.
+ */ export const runtimeIdentifierVersion = (identifier)=>{
+    const node = /^nodejs(\d+)\.x$/.exec(identifier);
+    if (node) {
+        return {
+            language: 'node',
+            version: node[1]
+        };
+    }
+    const python = /^python(\d+\.\d+)$/.exec(identifier);
+    return python ? {
+        language: 'python',
+        version: python[1]
+    } : undefined;
+};
+/**
+ * The latest managed runtime for each language in {@link LAMBDA_RUNTIME_VERSIONS},
+ * from the runtime identifiers `aws-cdk-lib` publishes.
+ *
+ * `Runtime.ALL` is a curated list of the runtimes CDK supports, so a runtime still
+ * in public preview does not appear — which is what makes it a usable source for a
+ * generally-available runtime. Never moves a runtime backwards: a pin ahead of
+ * what CDK offers stays.
+ *
+ * A language the list says nothing about keeps its current pin and is reported
+ * through `unresolved`, so a failure costs this bump alone rather than the whole
+ * version update.
+ */ export const resolveLambdaRuntimes = (identifiers)=>{
+    const unresolved = [];
+    const versions = Object.fromEntries(Object.keys(LAMBDA_RUNTIME_VERSIONS).map((language)=>{
+        const current = LAMBDA_RUNTIME_VERSIONS[language];
+        const available = identifiers.map(runtimeIdentifierVersion).filter((parsed)=>parsed?.language === language).map((parsed)=>parsed.version);
+        if (available.length === 0) {
+            unresolved.push({
+                language,
+                kept: current,
+                reason: 'no-runtimes-listed'
+            });
+            return [
+                language,
+                current
+            ];
+        }
+        const latest = available.reduce((best, version)=>compareRuntimeVersions(version, best) > 0 ? version : best);
+        return [
+            language,
+            compareRuntimeVersions(latest, current) > 0 ? latest : current
+        ];
+    }));
+    return {
+        versions,
+        unresolved
+    };
+};
+/** The warning a language's unresolved runtime reports. */ export const unresolvedRuntimeWarning = (entry)=>`Found no ${entry.language} runtime in the aws-cdk-lib runtime list, so it keeps its pinned runtime (${entry.kept})`;
+/**
+ * The latest CPython patch uv can install for a `major.minor`, or undefined when
+ * it lists none.
+ *
+ * Lambda names only `major.minor` and patches the interpreter itself, but uv pins
+ * an exact `major.minor.patch`, so the patch is resolved from what uv can actually
+ * install for the runtime's minor. Pre-releases and the free-threaded variant are
+ * excluded: a generated project needs the default build of a final release.
+ */ export const resolveLatestPythonPatch = (entries, minor = LAMBDA_RUNTIME_VERSIONS.python)=>{
+    const [major, wanted] = minor.split('.').map(Number);
+    const patches = entries.filter((entry)=>entry.implementation === 'cpython' && entry.variant !== 'freethreaded' && entry.version_parts.major === major && entry.version_parts.minor === wanted && // A final release only; `3.15.0rc1` carries a suffix.
+        /^\d+\.\d+\.\d+$/.test(entry.version)).map((entry)=>entry.version_parts.patch);
+    return patches.length > 0 ? String(Math.max(...patches)) : undefined;
+};
+
+//# sourceMappingURL=lambda-runtime-resolution.js.map

package/src/utils/lambda-runtime-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/lambda-runtime-resolution.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { type ILambdaRuntime, LAMBDA_RUNTIME_VERSIONS } from './versions.js';\n\n/**\n * Resolution of the Lambda runtimes and the CPython patch the version update\n * pins.\n *\n * Lives here rather than beside the script so it is covered by the plugin's test\n * suite; the script supplies the runtime list and the uv output.\n */\n\n/** Compare two dotted numeric versions (`24`, `3.14`) ascending. */\nexport const compareRuntimeVersions = (a: string, b: string): number => {\n  const left = a.split('.').map(Number);\n  const right = b.split('.').map(Number);\n  for (let i = 0; i < Math.max(left.length, right.length); i++) {\n    const diff = (left[i] ?? 0) - (right[i] ?? 0);\n    if (diff !== 0) {\n      return diff;\n    }\n  }\n  return 0;\n};\n\n/**\n * The version a managed runtime identifier names, or undefined for one that isn't\n * a versioned `nodejs`/`python` runtime.\n *\n * `nodejs24.x` -> `24`, `python3.14` -> `3.14`. The bare `nodejs` and\n * `nodejs4.3-edge` style identifiers carry no comparable version and are skipped.\n */\nexport const runtimeIdentifierVersion = (\n  identifier: string,\n): { language: ILambdaRuntime; version: string } | undefined => {\n  const node = /^nodejs(\\d+)\\.x$/.exec(identifier);\n  if (node) {\n    return { language: 'node', version: node[1] };\n  }\n  const python = /^python(\\d+\\.\\d+)$/.exec(identifier);\n  return python ? { language: 'python', version: python[1] } : undefined;\n};\n\n/** Why a language's runtime could not be resolved. */\nexport type UnresolvedReason = 'no-runtimes-listed';\n\nexport interface RuntimeResolution {\n  /** Runtime version per language, holding the current pin where unresolved. */\n  readonly versions: Record<string, string>;\n  /** Languages left on their current pin, and why. */\n  readonly unresolved: {\n    readonly language: string;\n    readonly kept: string;\n    readonly reason: UnresolvedReason;\n  }[];\n}\n\n/**\n * The latest managed runtime for each language in {@link LAMBDA_RUNTIME_VERSIONS},\n * from the runtime identifiers `aws-cdk-lib` publishes.\n *\n * `Runtime.ALL` is a curated list of the runtimes CDK supports, so a runtime still\n * in public preview does not appear — which is what makes it a usable source for a\n * generally-available runtime. Never moves a runtime backwards: a pin ahead of\n * what CDK offers stays.\n *\n * A language the list says nothing about keeps its current pin and is reported\n * through `unresolved`, so a failure costs this bump alone rather than the whole\n * version update.\n */\nexport const resolveLambdaRuntimes = (\n  identifiers: readonly string[],\n): RuntimeResolution => {\n  const unresolved: RuntimeResolution['unresolved'][number][] = [];\n\n  const versions = Object.fromEntries(\n    (Object.keys(LAMBDA_RUNTIME_VERSIONS) as ILambdaRuntime[]).map(\n      (language) => {\n        const current = LAMBDA_RUNTIME_VERSIONS[language];\n        const available = identifiers\n          .map(runtimeIdentifierVersion)\n          .filter((parsed) => parsed?.language === language)\n          .map((parsed) => parsed!.version);\n\n        if (available.length === 0) {\n          unresolved.push({\n            language,\n            kept: current,\n            reason: 'no-runtimes-listed',\n          });\n          return [language, current];\n        }\n\n        const latest = available.reduce((best, version) =>\n          compareRuntimeVersions(version, best) > 0 ? version : best,\n        );\n\n        return [\n          language,\n          compareRuntimeVersions(latest, current) > 0 ? latest : current,\n        ];\n      },\n    ),\n  );\n\n  return { versions, unresolved };\n};\n\n/** The warning a language's unresolved runtime reports. */\nexport const unresolvedRuntimeWarning = (\n  entry: RuntimeResolution['unresolved'][number],\n): string =>\n  `Found no ${entry.language} runtime in the aws-cdk-lib runtime list, so it keeps its pinned runtime (${entry.kept})`;\n\n/** A CPython build as `uv python list --output-format json` reports it. */\nexport interface UvPythonEntry {\n  readonly version: string;\n  readonly version_parts: {\n    readonly major: number;\n    readonly minor: number;\n    readonly patch: number;\n  };\n  readonly implementation: string;\n  readonly variant?: string;\n}\n\n/**\n * The latest CPython patch uv can install for a `major.minor`, or undefined when\n * it lists none.\n *\n * Lambda names only `major.minor` and patches the interpreter itself, but uv pins\n * an exact `major.minor.patch`, so the patch is resolved from what uv can actually\n * install for the runtime's minor. Pre-releases and the free-threaded variant are\n * excluded: a generated project needs the default build of a final release.\n */\nexport const resolveLatestPythonPatch = (\n  entries: readonly UvPythonEntry[],\n  minor: string = LAMBDA_RUNTIME_VERSIONS.python,\n): string | undefined => {\n  const [major, wanted] = minor.split('.').map(Number);\n  const patches = entries\n    .filter(\n      (entry) =>\n        entry.implementation === 'cpython' &&\n        entry.variant !== 'freethreaded' &&\n        entry.version_parts.major === major &&\n        entry.version_parts.minor === wanted &&\n        // A final release only; `3.15.0rc1` carries a suffix.\n        /^\\d+\\.\\d+\\.\\d+$/.test(entry.version),\n    )\n    .map((entry) => entry.version_parts.patch);\n\n  return patches.length > 0 ? String(Math.max(...patches)) : undefined;\n};\n"],"names":["LAMBDA_RUNTIME_VERSIONS","compareRuntimeVersions","a","b","left","split","map","Number","right","i","Math","max","length","diff","runtimeIdentifierVersion","identifier","node","exec","language","version","python","undefined","resolveLambdaRuntimes","identifiers","unresolved","versions","Object","fromEntries","keys","current","available","filter","parsed","push","kept","reason","latest","reduce","best","unresolvedRuntimeWarning","entry","resolveLatestPythonPatch","entries","minor","major","wanted","patches","implementation","variant","version_parts","test","patch","String"],"mappings":"AAAA;;;CAGC,GACD,SAA8BA,uBAAuB,QAAQ,gBAAgB;AAE7E;;;;;;CAMC,GAED,kEAAkE,GAClE,OAAO,MAAMC,yBAAyB,CAACC,GAAWC;IAChD,MAAMC,OAAOF,EAAEG,KAAK,CAAC,KAAKC,GAAG,CAACC;IAC9B,MAAMC,QAAQL,EAAEE,KAAK,CAAC,KAAKC,GAAG,CAACC;IAC/B,IAAK,IAAIE,IAAI,GAAGA,IAAIC,KAAKC,GAAG,CAACP,KAAKQ,MAAM,EAAEJ,MAAMI,MAAM,GAAGH,IAAK;QAC5D,MAAMI,OAAO,AAACT,CAAAA,IAAI,CAACK,EAAE,IAAI,CAAA,IAAMD,CAAAA,KAAK,CAACC,EAAE,IAAI,CAAA;QAC3C,IAAII,SAAS,GAAG;YACd,OAAOA;QACT;IACF;IACA,OAAO;AACT,EAAE;AAEF;;;;;;CAMC,GACD,OAAO,MAAMC,2BAA2B,CACtCC;IAEA,MAAMC,OAAO,mBAAmBC,IAAI,CAACF;IACrC,IAAIC,MAAM;QACR,OAAO;YAAEE,UAAU;YAAQC,SAASH,IAAI,CAAC,EAAE;QAAC;IAC9C;IACA,MAAMI,SAAS,qBAAqBH,IAAI,CAACF;IACzC,OAAOK,SAAS;QAAEF,UAAU;QAAUC,SAASC,MAAM,CAAC,EAAE;IAAC,IAAIC;AAC/D,EAAE;AAgBF;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,wBAAwB,CACnCC;IAEA,MAAMC,aAAwD,EAAE;IAEhE,MAAMC,WAAWC,OAAOC,WAAW,CACjC,AAACD,OAAOE,IAAI,CAAC5B,yBAA8CM,GAAG,CAC5D,CAACY;QACC,MAAMW,UAAU7B,uBAAuB,CAACkB,SAAS;QACjD,MAAMY,YAAYP,YACfjB,GAAG,CAACQ,0BACJiB,MAAM,CAAC,CAACC,SAAWA,QAAQd,aAAaA,UACxCZ,GAAG,CAAC,CAAC0B,SAAWA,OAAQb,OAAO;QAElC,IAAIW,UAAUlB,MAAM,KAAK,GAAG;YAC1BY,WAAWS,IAAI,CAAC;gBACdf;gBACAgB,MAAML;gBACNM,QAAQ;YACV;YACA,OAAO;gBAACjB;gBAAUW;aAAQ;QAC5B;QAEA,MAAMO,SAASN,UAAUO,MAAM,CAAC,CAACC,MAAMnB,UACrClB,uBAAuBkB,SAASmB,QAAQ,IAAInB,UAAUmB;QAGxD,OAAO;YACLpB;YACAjB,uBAAuBmC,QAAQP,WAAW,IAAIO,SAASP;SACxD;IACH;IAIJ,OAAO;QAAEJ;QAAUD;IAAW;AAChC,EAAE;AAEF,yDAAyD,GACzD,OAAO,MAAMe,2BAA2B,CACtCC,QAEA,CAAC,SAAS,EAAEA,MAAMtB,QAAQ,CAAC,0EAA0E,EAAEsB,MAAMN,IAAI,CAAC,CAAC,CAAC,CAAC;AAcvH;;;;;;;;CAQC,GACD,OAAO,MAAMO,2BAA2B,CACtCC,SACAC,QAAgB3C,wBAAwBoB,MAAM;IAE9C,MAAM,CAACwB,OAAOC,OAAO,GAAGF,MAAMtC,KAAK,CAAC,KAAKC,GAAG,CAACC;IAC7C,MAAMuC,UAAUJ,QACbX,MAAM,CACL,CAACS,QACCA,MAAMO,cAAc,KAAK,aACzBP,MAAMQ,OAAO,KAAK,kBAClBR,MAAMS,aAAa,CAACL,KAAK,KAAKA,SAC9BJ,MAAMS,aAAa,CAACN,KAAK,KAAKE,UAC9B,sDAAsD;QACtD,kBAAkBK,IAAI,CAACV,MAAMrB,OAAO,GAEvCb,GAAG,CAAC,CAACkC,QAAUA,MAAMS,aAAa,CAACE,KAAK;IAE3C,OAAOL,QAAQlC,MAAM,GAAG,IAAIwC,OAAO1C,KAAKC,GAAG,IAAImC,YAAYzB;AAC7D,EAAE"}

package/src/utils/rdb-constructs/files/cdk/app/dbs/__nameKebabCase__.ts.template

@@ -4,14 +4,14 @@ import { readFileSync } from 'fs';
 import { Construct } from 'constructs';
 import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
 import {
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
   Code,
 <%_ } _%>
   DockerImageCode,
   DockerImageFunction,
   Function,
   FunctionOptions,
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
   Runtime,
 <%_ } _%>
 } from 'aws-cdk-lib/aws-lambda';
@@ -76,7 +76,7 @@ export class <%= nameClassName %> extends AuroraDatabase {
       ...baseProps,
       code: Code.fromAsset(createDbUserBundleDir),
       handler: 'index.handler',
-      runtime: Runtime.NODEJS_LATEST,
+      runtime: <%- nodeRuntime %>,
       environment: {
         NODE_EXTRA_CA_CERTS: '/var/runtime/ca-cert.pem',
       },

package/src/utils/rdb-constructs/files/terraform/app/dbs/__nameKebabCase__/__nameKebabCase__.tf.template

@@ -88,12 +88,6 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
   description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
@@ -144,7 +138,7 @@ variable "create_db_user_docker_image_tag" {
 }
 <%_ } _%>
 
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the `core/asset-bucket` module once per deployment and pass its `bucket_name` output here."
   type        = string
@@ -163,7 +157,7 @@ resource "random_string" "suffix" {
 locals {
   config                       = jsondecode(file("${path.module}/../../../../../../../<%= projectRoot %>/config.json"))
   runtime_config_key           = local.config.runtimeConfigKey
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
   create_db_user_bundle_path   = "${path.module}/../../../../../../../<%- createDbUserBundleDir %>"
 <%_ } _%>
   migration_function_name      = "<%= nameKebabCase %>-migration-${random_string.suffix.result}"
@@ -177,7 +171,6 @@ module "aurora" {
   name                                  = "<%= nameKebabCase %>"
   vpc_id                                = var.vpc_id
   subnet_ids                            = var.database_subnet_ids
-  lambda_subnet_ids                     = var.lambda_subnet_ids
   engine                                = "<%= engine === 'mysql' ? 'aurora-mysql' : 'aurora-postgresql' %>"
   engine_version                        = var.engine_version
   database_name                         = "<%= databaseName %>"
@@ -189,7 +182,6 @@ module "aurora" {
   deletion_protection                   = var.deletion_protection
   skip_final_snapshot                   = var.skip_final_snapshot
   enable_rds_proxy                      = var.enable_rds_proxy
-  enable_credential_rotation            = var.enable_credential_rotation
   enable_cloudwatch_logs                = var.enable_cloudwatch_logs
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
@@ -206,22 +198,6 @@ resource "aws_iam_role_policy" "proxy_db_user_connect" {
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
-<%_ if (engine === 'mysql' && framework !== 'sqlmodel') { _%>
-      {
-        Effect = "Allow"
-        Action = [
-          "secretsmanager:GetSecretValue"
-        ]
-        Resource = [module.aurora.secret_arn]
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "kms:Decrypt"
-        ]
-        Resource = [module.aurora.kms_key_arn]
-      }
-<%_ } else { _%>
       {
         Effect = "Allow"
         Action = ["rds-db:connect"]
@@ -229,12 +205,11 @@ resource "aws_iam_role_policy" "proxy_db_user_connect" {
           "arn:aws:rds-db:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:dbuser:${module.aurora.cluster_resource_id}/${local.database_runtime_user}"
         ]
       }
-<%_ } _%>
     ]
   })
 }
 
-<%_ if (framework !== 'sqlmodel') { _%>
+<%_ if (framework === 'prisma') { _%>
 data "archive_file" "create_db_user_zip" {
   type        = "zip"
   source_dir  = local.create_db_user_bundle_path
@@ -595,7 +570,7 @@ resource "aws_lambda_function" "create_db_user" {
   role              = aws_iam_role.create_db_user.arn
   handler           = "index.handler"
   source_code_hash  = data.archive_file.create_db_user_zip.output_base64sha256
-  runtime           = "nodejs24.x"
+  runtime           = "<%- nodeRuntime %>"
   timeout          = 300
   architectures    = ["arm64"]
 <%_ } _%>
@@ -612,6 +587,9 @@ resource "aws_lambda_function" "create_db_user" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
 <%_ if (framework === 'prisma') { _%>
       NODE_EXTRA_CA_CERTS = "/var/runtime/ca-cert.pem"
 <%_ } _%>
@@ -699,6 +677,9 @@ resource "aws_lambda_function" "migration_handler" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
     }
   }
 

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -1,5 +1,6 @@
 # Core Aurora module
-# This module creates an Aurora cluster and a generated admin secret.
+# This module creates an Aurora cluster whose admin credentials are generated
+# and rotated by RDS in Secrets Manager.
 
 terraform {
   required_version = ">= 1.0"
@@ -43,11 +44,6 @@ variable "subnet_ids" {
   type        = list(string)
 }
 
-variable "lambda_subnet_ids" {
-  description = "Subnet IDs for the credential-rotation Lambda. Must have outbound egress to AWS service endpoints (e.g. Secrets Manager) — use private subnets with a NAT gateway."
-  type        = list(string)
-}
-
 variable "engine" {
   description = "Aurora engine to use."
   type        = string
@@ -117,12 +113,6 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
   description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
@@ -244,6 +234,20 @@ resource "aws_kms_key" "database" {
           "kms:CreateGrant"
         ]
         Resource = "*"
+      },
+      {
+        Sid    = "AllowSecretsManagerService"
+        Effect = "Allow"
+        Principal = {
+          Service = "secretsmanager.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
       }
     ]
   })
@@ -298,35 +302,6 @@ resource "aws_db_subnet_group" "database" {
   })
 }
 
-resource "random_password" "master_password" {
-  length           = 32
-  special          = true
-  override_special = "!#$%&*()-_=+[]{}<>:?"
-}
-
-resource "aws_secretsmanager_secret" "credentials" {
-  #checkov:skip=CKV2_AWS_57:Rotation is configured via aws_cloudformation_stack.credentials_rotation using the AWS::SecretsManager-2024-09-16 transform; Checkov cannot resolve rotation schedules created by CloudFormation transforms
-  name_prefix = "${var.name}-aurora-credentials-"
-  kms_key_id  = aws_kms_key.database.arn
-
-  tags = merge(var.tags, {
-    Name = "${var.name}-aurora-credentials"
-  })
-}
-
-resource "aws_secretsmanager_secret_version" "credentials" {
-  secret_id = aws_secretsmanager_secret.credentials.id
-  secret_string = jsonencode({
-    engine              = var.engine == "aurora-mysql" ? "mysql" : "postgres"
-    username            = var.admin_user
-    password            = random_password.master_password.result
-    host                = aws_rds_cluster.database.endpoint
-    port                = aws_rds_cluster.database.port
-    dbname              = var.database_name
-    dbClusterIdentifier = aws_rds_cluster.database.cluster_identifier
-  })
-}
-
 resource "aws_rds_cluster" "database" {
   #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
@@ -335,7 +310,8 @@ resource "aws_rds_cluster" "database" {
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
   master_username                     = var.admin_user
-  master_password                     = random_password.master_password.result
+  manage_master_user_password         = true
+  master_user_secret_kms_key_id       = aws_kms_key.database.arn
   db_subnet_group_name                = aws_db_subnet_group.database.name
   db_cluster_parameter_group_name     = var.enable_cloudwatch_logs ? aws_rds_cluster_parameter_group.database[0].name : null
   vpc_security_group_ids              = [aws_security_group.database.id]
@@ -387,75 +363,6 @@ resource "aws_rds_cluster_instance" "database" {
   })
 }
 
-resource "aws_security_group" "rotation" {
-  #checkov:skip=CKV2_AWS_5:Security group is attached to the hosted rotation Lambda created by AWS::SecretsManager::RotationSchedule; Checkov cannot resolve resources created by the CloudFormation transform
-  count       = var.enable_credential_rotation ? 1 : 0
-  name_prefix = "${var.name}-aurora-rotation-"
-  description = "Security group for Aurora secret rotation ${var.name}"
-  vpc_id      = var.vpc_id
-
-  tags = merge(var.tags, {
-    Name = "${var.name}-aurora-rotation"
-  })
-}
-
-resource "aws_vpc_security_group_egress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.rotation[0].id
-  referenced_security_group_id = aws_security_group.database.id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow outbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.database.id
-  referenced_security_group_id = aws_security_group.rotation[0].id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow inbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_cloudformation_stack" "credentials_rotation" {
-  #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
-  count = var.enable_credential_rotation ? 1 : 0
-  name  = "${local.cluster_name}-credentials-rotation"
-
-  capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
-
-  template_body = jsonencode({
-    AWSTemplateFormatVersion = "2010-09-09"
-    Transform                = "AWS::SecretsManager-2024-09-16"
-    Resources = {
-      CredentialsRotationSchedule = {
-        Type = "AWS::SecretsManager::RotationSchedule"
-        Properties = {
-          SecretId = aws_secretsmanager_secret.credentials.arn
-          HostedRotationLambda = {
-            RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "${local.cluster_name}-credentials-rotation"
-            VpcSecurityGroupIds = aws_security_group.rotation[0].id
-            VpcSubnetIds        = join(",", var.lambda_subnet_ids)
-          }
-          RotationRules = {
-            AutomaticallyAfterDays = 30
-          }
-        }
-      }
-    }
-  })
-
-  depends_on = [
-    aws_secretsmanager_secret_version.credentials,
-    aws_rds_cluster_instance.database,
-    aws_vpc_security_group_egress_rule.rotation_to_database,
-    aws_vpc_security_group_ingress_rule.rotation_to_database,
-  ]
-}
-
 resource "aws_iam_role" "proxy" {
   count = var.enable_rds_proxy ? 1 : 0
 
@@ -694,6 +601,11 @@ output "cluster_endpoint" {
   value       = var.enable_rds_proxy ? aws_db_proxy.aurora[0].endpoint : aws_rds_cluster.database.endpoint
 }
 
+output "writer_endpoint" {
+  description = "Writer endpoint of the Aurora cluster itself, bypassing the RDS Proxy. Used by the admin-credentialled handlers, which connect directly to the cluster."
+  value       = aws_rds_cluster.database.endpoint
+}
+
 output "reader_endpoint" {
   description = "Reader endpoint of the Aurora cluster."
   value       = aws_rds_cluster.database.reader_endpoint
@@ -720,12 +632,12 @@ output "proxy_role_name" {
 }
 
 output "secret_arn" {
-  description = "ARN of the generated admin credentials secret."
-  value       = aws_secretsmanager_secret.credentials.arn
+  description = "ARN of the RDS-managed admin credentials secret. Its value is a JSON object with username and password only — connection details come from this module's other outputs."
+  value       = one(aws_rds_cluster.database.master_user_secret[*].secret_arn)
 }
 
 output "kms_key_arn" {
-  description = "ARN of the KMS key protecting Aurora and the generated secret."
+  description = "ARN of the KMS key protecting Aurora and its admin credentials secret."
   value       = aws_kms_key.database.arn
 }
 
@@ -750,6 +662,6 @@ output "database_name" {
 }
 
 output "admin_user" {
-  description = "Admin username stored in the generated secret."
-  value       = jsondecode(aws_secretsmanager_secret_version.credentials.secret_string).username
+  description = "Admin username stored in the RDS-managed credentials secret."
+  value       = aws_rds_cluster.database.master_username
 }

package/src/utils/rdb-constructs/rdb-constructs.js

@@ -6,7 +6,7 @@ import { addStarExport } from "../ast.js";
 import { esmVars } from "../module-format.js";
 import { addDependencyToTargetIfNotPresent } from "../nx.js";
 import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
-import { terraformProviderVersions } from "../versions.js";
+import { cdkLambdaRuntimeVars, terraformLambdaRuntimeVars, terraformProviderVersions } from "../versions.js";
 /**
  * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive
  * from so the same generator options vend the same ceiling regardless of `--iac`.
@@ -48,7 +48,8 @@ export const addRdbCdkConstructs = async (tree, options)=>{
     });
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'), {
         ...options,
-        ...esmVars(tree)
+        ...esmVars(tree),
+        ...cdkLambdaRuntimeVars()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
@@ -66,7 +67,8 @@ export const addRdbTerraformModules = (tree, options)=>{
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'), {
         ...options,
         ...terraformProviderVersions(),
-        ...auroraServerlessV2Capacity()
+        ...auroraServerlessV2Capacity(),
+        ...terraformLambdaRuntimeVars()
     }, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });

package/src/utils/rdb-constructs/rdb-constructs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Containers } from '../containers.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport { terraformProviderVersions } from '../versions.js';\n\n/**\n * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive\n * from so the same generator options vend the same ceiling regardless of `--iac`.\n *\n * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose\n * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on\n * the ceiling, so the maximum is headroom rather than a cost commitment.\n */\nexport const AURORA_SERVERLESS_V2_CAPACITY = {\n  min: 0.5,\n  max: 4,\n} as const;\n\n/**\n * Substitution variables exposing the Aurora Serverless v2 scaling bounds to\n * generated CDK and Terraform templates.\n */\nconst auroraServerlessV2Capacity = () => ({\n  serverlessMinCapacity: AURORA_SERVERLESS_V2_CAPACITY.min,\n  serverlessMaxCapacity: AURORA_SERVERLESS_V2_CAPACITY.max,\n});\n\nexport interface AddRdbConstructOptions {\n  projectName: string;\n  projectRoot: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  databasePackageAlias: string;\n  databaseName: string;\n  adminUser: string;\n  engine: 'postgres' | 'mysql';\n  migrationBundleDir: string;\n  /**\n   * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).\n   * When absent the migration Docker image is reused with the\n   * `create_db_user_handler.handler` command (py#rdb).\n   */\n  createDbUserBundleDir: string;\n  /** ORM framework used by the create-db-user Lambda. */\n  framework: 'prisma' | 'sqlmodel';\n  /** Local Docker tag for the Python create-db-user Lambda image. */\n  createDbUserDockerImageTag?: string;\n  /** Local Docker tag for the migration Lambda image. */\n  migrationDockerImageTag: string;\n  containerEngine: Containers;\n}\n\nexport const addRdbInfra = async (\n  tree: Tree,\n  options: AddRdbConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addRdbCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addRdbTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nexport const addRdbCdkConstructs = async (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'rdb',\n    ),\n    { ...options, ...esmVars(tree), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...esmVars(tree) },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './rdb/aurora.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dbs',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dbs/index.js',\n  );\n};\n\nexport const addRdbTerraformModules = (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'),\n    { ...terraformProviderVersions(), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'),\n    {\n      ...options,\n      ...terraformProviderVersions(),\n      ...auroraServerlessV2Capacity(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","terraformProviderVersions","AURORA_SERVERLESS_V2_CAPACITY","min","max","auroraServerlessV2Capacity","serverlessMinCapacity","serverlessMaxCapacity","addRdbInfra","tree","options","iac","addRdbCdkConstructs","addRdbTerraformModules","Error","config","projectName","dirname","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SAASC,yBAAyB,QAAQ,iBAAiB;AAE3D;;;;;;;CAOC,GACD,OAAO,MAAMC,gCAAgC;IAC3CC,KAAK;IACLC,KAAK;AACP,EAAW;AAEX;;;CAGC,GACD,MAAMC,6BAA6B,IAAO,CAAA;QACxCC,uBAAuBJ,8BAA8BC,GAAG;QACxDI,uBAAuBL,8BAA8BE,GAAG;IAC1D,CAAA;AA2BA,OAAO,MAAMI,cAAc,OACzBC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,oBAAoBH,MAAMC;IAClC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,uBAAuBJ,MAAMC;IAC/B,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAjB,WACEe,MACAjB,kBACEM,cACAY,QAAQC,GAAG,KAAK,QAAQZ,wBAAwBC,sBAChD,iBAEF,CAACe;QACClB,kCACEkB,QACA,SACA,GAAGL,QAAQM,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,OAAO,MAAMH,sBAAsB,OACjCH,MACAC;IAEAnB,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,OAAO,QAAQ,QAC/DzB,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;QAAE,GAAGW,OAAO;QAAE,GAAGd,QAAQa,KAAK;QAAE,GAAGJ,4BAA4B;IAAC,GAChE;QACEa,mBAAmBzB,kBAAkB0B,YAAY;IACnD;IAGF5B,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,OAAO,OAAO,QAC9DzB,kBAAkBM,cAAcC,uBAAuB,OAAO,OAAO,QACrE;QAAE,GAAGW,OAAO;QAAE,GAAGd,QAAQa,KAAK;IAAC,GAC/B;QACES,mBAAmBzB,kBAAkB0B,YAAY;IACnD;IAGF,MAAMxB,cACJc,MACAjB,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJc,MACAjB,kBACEM,cACAC,uBACA,OACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEW,QAAQU,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAMzB,cACJc,MACAjB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ,EAAE;AAEF,OAAO,MAAMc,yBAAyB,CACpCJ,MACAC;IAEAnB,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,aAAa,QAAQ,QACrEzB,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGC,2BAA2B;QAAE,GAAGI,4BAA4B;IAAC,GAClE;QACEa,mBAAmBzB,kBAAkB0B,YAAY;IACnD;IAGF5B,cACEkB,MACAjB,kBAAkB,YAAYyB,OAAO,EAAE,SAAS,aAAa,OAAO,QACpEzB,kBAAkBM,cAAcE,sBAAsB,OAAO,OAAO,QACpE;QACE,GAAGU,OAAO;QACV,GAAGT,2BAA2B;QAC9B,GAAGI,4BAA4B;IACjC,GACA;QACEa,mBAAmBzB,kBAAkB0B,YAAY;IACnD;AAEJ,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Containers } from '../containers.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addDependencyToTargetIfNotPresent } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  cdkLambdaRuntimeVars,\n  terraformLambdaRuntimeVars,\n  terraformProviderVersions,\n} from '../versions.js';\n\n/**\n * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive\n * from so the same generator options vend the same ceiling regardless of `--iac`.\n *\n * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose\n * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on\n * the ceiling, so the maximum is headroom rather than a cost commitment.\n */\nexport const AURORA_SERVERLESS_V2_CAPACITY = {\n  min: 0.5,\n  max: 4,\n} as const;\n\n/**\n * Substitution variables exposing the Aurora Serverless v2 scaling bounds to\n * generated CDK and Terraform templates.\n */\nconst auroraServerlessV2Capacity = () => ({\n  serverlessMinCapacity: AURORA_SERVERLESS_V2_CAPACITY.min,\n  serverlessMaxCapacity: AURORA_SERVERLESS_V2_CAPACITY.max,\n});\n\nexport interface AddRdbConstructOptions {\n  projectName: string;\n  projectRoot: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  databasePackageAlias: string;\n  databaseName: string;\n  adminUser: string;\n  engine: 'postgres' | 'mysql';\n  migrationBundleDir: string;\n  /**\n   * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).\n   * When absent the migration Docker image is reused with the\n   * `create_db_user_handler.handler` command (py#rdb).\n   */\n  createDbUserBundleDir: string;\n  /** ORM framework used by the create-db-user Lambda. */\n  framework: 'prisma' | 'sqlmodel';\n  /** Local Docker tag for the Python create-db-user Lambda image. */\n  createDbUserDockerImageTag?: string;\n  /** Local Docker tag for the migration Lambda image. */\n  migrationDockerImageTag: string;\n  containerEngine: Containers;\n}\n\nexport const addRdbInfra = async (\n  tree: Tree,\n  options: AddRdbConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addRdbCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addRdbTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addDependencyToTargetIfNotPresent(\n        config,\n        'build',\n        `${options.projectName}:build`,\n      );\n      return config;\n    },\n  );\n};\n\nexport const addRdbCdkConstructs = async (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'rdb',\n    ),\n    { ...options, ...esmVars(tree), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...esmVars(tree), ...cdkLambdaRuntimeVars() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './rdb/aurora.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dbs',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dbs/index.js',\n  );\n};\n\nexport const addRdbTerraformModules = (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'),\n    { ...terraformProviderVersions(), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'),\n    {\n      ...options,\n      ...terraformProviderVersions(),\n      ...auroraServerlessV2Capacity(),\n      ...terraformLambdaRuntimeVars(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addDependencyToTargetIfNotPresent","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","cdkLambdaRuntimeVars","terraformLambdaRuntimeVars","terraformProviderVersions","AURORA_SERVERLESS_V2_CAPACITY","min","max","auroraServerlessV2Capacity","serverlessMinCapacity","serverlessMaxCapacity","addRdbInfra","tree","options","iac","addRdbCdkConstructs","addRdbTerraformModules","Error","config","projectName","dirname","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,iCAAiC,QAAQ,WAAW;AAC7D,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SACEC,oBAAoB,EACpBC,0BAA0B,EAC1BC,yBAAyB,QACpB,iBAAiB;AAExB;;;;;;;CAOC,GACD,OAAO,MAAMC,gCAAgC;IAC3CC,KAAK;IACLC,KAAK;AACP,EAAW;AAEX;;;CAGC,GACD,MAAMC,6BAA6B,IAAO,CAAA;QACxCC,uBAAuBJ,8BAA8BC,GAAG;QACxDI,uBAAuBL,8BAA8BE,GAAG;IAC1D,CAAA;AA2BA,OAAO,MAAMI,cAAc,OACzBC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,oBAAoBH,MAAMC;IAClC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,uBAAuBJ,MAAMC;IAC/B,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAnB,WACEiB,MACAnB,kBACEM,cACAc,QAAQC,GAAG,KAAK,QAAQd,wBAAwBC,sBAChD,iBAEF,CAACiB;QACCpB,kCACEoB,QACA,SACA,GAAGL,QAAQM,WAAW,CAAC,MAAM,CAAC;QAEhC,OAAOD;IACT;AAEJ,EAAE;AAEF,OAAO,MAAMH,sBAAsB,OACjCH,MACAC;IAEArB,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,OAAO,QAAQ,QAC/D3B,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;QAAE,GAAGa,OAAO;QAAE,GAAGhB,QAAQe,KAAK;QAAE,GAAGJ,4BAA4B;IAAC,GAChE;QACEa,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF9B,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,OAAO,OAAO,QAC9D3B,kBAAkBM,cAAcC,uBAAuB,OAAO,OAAO,QACrE;QAAE,GAAGa,OAAO;QAAE,GAAGhB,QAAQe,KAAK;QAAE,GAAGV,sBAAsB;IAAC,GAC1D;QACEmB,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF,MAAM1B,cACJgB,MACAnB,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJgB,MACAnB,kBACEM,cACAC,uBACA,OACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEa,QAAQU,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAM3B,cACJgB,MACAnB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ,EAAE;AAEF,OAAO,MAAMgB,yBAAyB,CACpCJ,MACAC;IAEArB,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,aAAa,QAAQ,QACrE3B,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGG,2BAA2B;QAAE,GAAGI,4BAA4B;IAAC,GAClE;QACEa,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF9B,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,aAAa,OAAO,QACpE3B,kBAAkBM,cAAcE,sBAAsB,OAAO,OAAO,QACpE;QACE,GAAGY,OAAO;QACV,GAAGT,2BAA2B;QAC9B,GAAGI,4BAA4B;QAC/B,GAAGL,4BAA4B;IACjC,GACA;QACEkB,mBAAmB3B,kBAAkB4B,YAAY;IACnD;AAEJ,EAAE"}

package/src/utils/version-upgrade-migration/sync-lambda-runtimes.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+/**
+ * Sync the Lambda runtimes vended into the projects this plugin owns.
+ *
+ * The runtimes present are read from each file rather than compared against a
+ * list of what past releases vended, which would need maintaining by hand for the
+ * same reason the pin itself does.
+ */
+/** The IaC provider a vended file belongs to, decided by the directory it sits in. */
+export type VendedIac = 'cdk' | 'terraform';
+/**
+ * Sync the Lambda runtimes in the directories this plugin owns.
+ *
+ * A runtime below the pin is ours to move, as is a `_LATEST` alias — its value is
+ * decided by `aws-cdk-lib`, which is the drift this closes. A runtime at or ahead
+ * of the pin is the user's and is left, as is any Lambda outside these
+ * directories. One the rewrite cannot reach is reported instead.
+ *
+ * @returns the files changed, and the owned files still holding an older runtime
+ */
+export declare const syncLambdaRuntimes: (tree: Tree, dirs: Readonly<Record<VendedIac, string>>) => Promise<{
+    updated: string[];
+    diverged: string[];
+}>;