@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/py/rdb/__snapshots__/generator.spec.ts.snap

@@ -0,0 +1,2113 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`py#rdb generator > should generate MySQL dependencies and templates 1`] = `
+"import ssl
+from collections.abc import AsyncGenerator
+from contextlib import asynccontextmanager
+
+import boto3
+from sqlalchemy import event
+from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine
+
+from .utils import build_database_url, get_database_config, get_local_dev_config, is_local_dev
+
+# Generated: must match runtimeConfigKey in config.json
+_runtime_config_key = "Db"
+
+_engine = None
+
+
+def get_engine():
+    global _engine
+    if _engine is not None:
+        return _engine
+    if is_local_dev():
+        cfg = get_local_dev_config()
+        url = build_database_url(cfg["dbUser"], cfg["host"], cfg["port"], cfg["dbName"])
+        ssl_args: dict = {}
+    else:
+        config = get_database_config(_runtime_config_key)
+        url = build_database_url(
+            config["dbUser"],
+            config["hostname"],
+            config["port"],
+            config["database"],
+        )
+        ssl_args = {"ssl": ssl.create_default_context()}
+    _engine = create_async_engine(url, connect_args=ssl_args)
+
+    @event.listens_for(_engine.sync_engine, "do_connect")
+    def provide_password(_dialect, _connection_record, _cargs, connection_params):
+        if is_local_dev():
+            connection_params["password"] = get_local_dev_config()["dbPassword"]
+        else:
+            config = get_database_config(_runtime_config_key)
+            connection_params["password"] = boto3.client(
+                "rds",
+                region_name=config["region"],
+            ).generate_db_auth_token(
+                DBHostname=config["hostname"],
+                Port=config["port"],
+                DBUsername=config["dbUser"],
+            )
+
+    return _engine
+
+
+@asynccontextmanager
+async def session_context() -> AsyncGenerator[AsyncSession]:
+    async with AsyncSession(get_engine()) as session:
+        yield session
+"
+`;
+
+exports[`py#rdb generator > should generate MySQL dependencies and templates 2`] = `
+"import asyncio
+import ssl
+
+from alembic import command
+from alembic.config import Config
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlalchemy.pool import NullPool
+
+from .utils import build_database_url, get_database_secret, with_connection_retry
+
+
+def _apply_migrations(sync_conn, alembic_cfg: Config) -> None:
+    alembic_cfg.attributes["connection"] = sync_conn
+    command.upgrade(alembic_cfg, "head")
+
+
+async def _run_migrations() -> None:
+    secret = get_database_secret()
+    database_url = build_database_url(
+        secret["username"],
+        secret["host"],
+        secret["port"],
+        secret["dbname"],
+        password=secret["password"],
+    )
+    alembic_cfg = Config("alembic.ini")
+    engine = create_async_engine(
+        database_url,
+        poolclass=NullPool,
+        connect_args={"ssl": ssl.create_default_context()},
+    )
+    try:
+        async with engine.begin() as conn:
+            await conn.run_sync(lambda c: _apply_migrations(c, alembic_cfg))
+    finally:
+        await engine.dispose()
+
+
+def handler(_event, _context):
+    with_connection_retry(lambda: asyncio.run(_run_migrations()))
+"
+`;
+
+exports[`py#rdb generator > should generate MySQL dependencies and templates 3`] = `
+"import asyncio
+import secrets
+import ssl
+from typing import Any
+
+import aiomysql
+
+from .utils import get_database_secret, with_connection_retry
+
+
+async def _ensure_database_user(db_user: str) -> None:
+    secret = get_database_secret()
+    conn = await aiomysql.connect(
+        host=secret["host"],
+        port=int(secret["port"]),
+        db=secret["dbname"],
+        user=secret["username"],
+        password=secret["password"],
+        ssl=ssl.create_default_context(),
+    )
+    try:
+        async with conn.cursor() as cursor:
+            await cursor.execute(
+                "CREATE USER IF NOT EXISTS %s@'%%' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS'",
+                (db_user,),
+            )
+            await cursor.execute(
+                "ALTER USER %s@'%%' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS' REQUIRE SSL",
+                (db_user,),
+            )
+            await cursor.execute(
+                f"GRANT SELECT, INSERT, UPDATE, DELETE ON \`{secret['dbname']}\`.* TO %s@'%%'",
+                (db_user,),
+            )
+        await conn.commit()
+    finally:
+        conn.close()
+
+
+_PHYSICAL_RESOURCE_ID_PREFIX = "db-user:"
+
+
+def _resolve_db_user(physical_resource_id: str | None) -> str:
+    if physical_resource_id and physical_resource_id.startswith(_PHYSICAL_RESOURCE_ID_PREFIX):
+        return physical_resource_id[len(_PHYSICAL_RESOURCE_ID_PREFIX) :]
+    return f"db_{secrets.token_hex(8)}"
+
+
+def handler(event: dict[str, Any], _context: Any) -> dict[str, Any]:
+    db_user = _resolve_db_user(event.get("PhysicalResourceId"))
+
+    if event.get("RequestType") != "Delete":
+        with_connection_retry(lambda: asyncio.run(_ensure_database_user(db_user)))
+
+    return {
+        "PhysicalResourceId": f"{_PHYSICAL_RESOURCE_ID_PREFIX}{db_user}",
+        "Data": {"dbUser": db_user},
+    }
+"
+`;
+
+exports[`py#rdb generator > should generate MySQL dependencies and templates 4`] = `
+"FROM public.ecr.aws/lambda/python:3.14
+
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
+WORKDIR \${LAMBDA_TASK_ROOT}
+
+COPY . .
+
+ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem /etc/pki/ca-trust/source/anchors/global-bundle.pem
+RUN update-ca-trust
+
+CMD ["proj_db.migration_handler.handler"]
+"
+`;
+
+exports[`py#rdb generator > should generate MySQL dependencies and templates 5`] = `
+"FROM public.ecr.aws/lambda/python:3.14
+
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
+WORKDIR \${LAMBDA_TASK_ROOT}
+
+COPY . .
+
+ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem /etc/pki/ca-trust/source/anchors/global-bundle.pem
+RUN update-ca-trust
+
+CMD ["proj_db.create_db_user_handler.handler"]
+"
+`;
+
+exports[`py#rdb generator > should generate Terraform modules 1`] = `
+"terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    archive = {
+      source  = "hashicorp/archive"
+      version = "2.8.0"
+    }
+    aws = {
+      source  = "hashicorp/aws"
+      version = "6.62.0"
+    }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = "3.3.1"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.9.0"
+    }
+  }
+}
+
+variable "vpc_id" {
+  description = "VPC where the Aurora cluster will be deployed."
+  type        = string
+}
+
+variable "database_subnet_ids" {
+  description = "Subnet IDs for the Aurora cluster and RDS Proxy. Private isolated subnets are fine — no outbound egress required."
+  type        = list(string)
+}
+
+variable "lambda_subnet_ids" {
+  description = "Subnet IDs for the create-db-user and migration Lambda functions. Must have outbound egress to AWS service endpoints (e.g. Secrets Manager) — use private subnets with a NAT gateway."
+  type        = list(string)
+}
+
+variable "engine_version" {
+  description = "Aurora engine version."
+  type        = string
+  default     = null
+}
+
+variable "port" {
+  description = "Database port for the selected Aurora engine."
+  type        = number
+  default     = null
+}
+
+variable "serverless_min_capacity" {
+  description = "Minimum Aurora Serverless v2 ACUs."
+  type        = number
+  default     = 0.5
+}
+
+variable "serverless_max_capacity" {
+  description = "Maximum Aurora Serverless v2 ACUs."
+  type        = number
+  default     = 4
+}
+
+variable "instance_count" {
+  description = "Number of Aurora instances to create."
+  type        = number
+  default     = 1
+}
+
+variable "deletion_protection" {
+  description = "Whether deletion protection is enabled."
+  type        = bool
+  default     = true
+}
+
+variable "skip_final_snapshot" {
+  description = "Whether to skip the final snapshot on deletion."
+  type        = bool
+  default     = false
+}
+
+variable "enable_rds_proxy" {
+  description = "Whether to provision an RDS Proxy in front of the Aurora cluster."
+  type        = bool
+  default     = true
+}
+
+variable "enable_cloudwatch_logs" {
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
+  type        = bool
+  default     = true
+}
+
+variable "enable_performance_insights" {
+  description = "Whether to enable Performance Insights on Aurora cluster instances."
+  type        = bool
+  default     = true
+}
+
+variable "performance_insights_retention_period" {
+  description = "Retention period, in days, for Performance Insights data when enabled."
+  type        = number
+  default     = 7
+}
+
+variable "enable_backup" {
+  description = "Whether to provision an AWS Backup plan for the Aurora cluster."
+  type        = bool
+  default     = false
+}
+
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
+variable "tags" {
+  description = "Tags to apply to all resources."
+  type        = map(string)
+  default     = {}
+}
+
+variable "migration_docker_image_tag" {
+  description = "Docker image tag for the migration handler. Defaults to the tag built by the Nx docker target."
+  type        = string
+  default     = "proj-db-migration:latest"
+}
+
+variable "create_db_user_docker_image_tag" {
+  description = "Docker image tag for the Python create-db-user handler. Defaults to the tag built by the Nx docker target."
+  type        = string
+  default     = "proj-db-create-db-user:latest"
+}
+
+
+data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
+locals {
+  config                       = jsondecode(file("\${path.module}/../../../../../../../packages/db/config.json"))
+  runtime_config_key           = local.config.runtimeConfigKey
+  migration_function_name      = "db-migration-\${random_string.suffix.result}"
+  create_db_user_function_name = "db-create-db-user-\${random_string.suffix.result}"
+  database_runtime_user        = "db_\${random_string.suffix.result}"
+}
+
+module "aurora" {
+  source = "../../../core/rdb/aurora"
+  #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
+  name                                  = "db"
+  vpc_id                                = var.vpc_id
+  subnet_ids                            = var.database_subnet_ids
+  engine                                = "aurora-postgresql"
+  engine_version                        = var.engine_version
+  database_name                         = "database_name"
+  admin_user                            = "databaseUser"
+  port                                  = var.port
+  serverless_min_capacity               = var.serverless_min_capacity
+  serverless_max_capacity               = var.serverless_max_capacity
+  instance_count                        = var.instance_count
+  deletion_protection                   = var.deletion_protection
+  skip_final_snapshot                   = var.skip_final_snapshot
+  enable_rds_proxy                      = var.enable_rds_proxy
+  enable_cloudwatch_logs                = var.enable_cloudwatch_logs
+  enable_performance_insights           = var.enable_performance_insights
+  performance_insights_retention_period = var.performance_insights_retention_period
+  enable_backup                         = var.enable_backup
+  enable_key_rotation                   = var.enable_key_rotation
+  tags                                  = var.tags
+}
+
+resource "aws_iam_role_policy" "proxy_db_user_connect" {
+  count = var.enable_rds_proxy ? 1 : 0
+
+  role = module.aurora.proxy_role_name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["rds-db:connect"]
+        Resource = [
+          "arn:aws:rds-db:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:dbuser:\${module.aurora.cluster_resource_id}/\${local.database_runtime_user}"
+        ]
+      }
+    ]
+  })
+}
+
+
+module "add_rdb_to_runtime_config" {
+  source = "../../../core/runtime-config/entry"
+
+  namespace = "database"
+  key       = local.runtime_config_key
+  value = {
+    hostname  = module.aurora.cluster_endpoint
+    port      = module.aurora.cluster_port
+    database  = module.aurora.database_name
+    adminUser = module.aurora.admin_user
+    dbUser    = local.database_runtime_user
+    region    = data.aws_region.current.region
+  }
+}
+
+resource "aws_ecr_repository" "migration_handler" {
+  #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
+  name                 = "db-migration-\${random_string.suffix.result}"
+  image_tag_mutability = "IMMUTABLE"
+  force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+
+  tags = var.tags
+}
+
+resource "aws_ecr_repository_policy" "migration_handler" {
+  repository = aws_ecr_repository.migration_handler.name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "AllowPushPull"
+        Effect = "Allow"
+        Principal = {
+          AWS = "arn:aws:iam::\${data.aws_caller_identity.current.account_id}:root"
+        }
+        Action = [
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:CompleteLayerUpload",
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:InitiateLayerUpload",
+          "ecr:PutImage",
+          "ecr:UploadLayerPart"
+        ]
+      },
+      {
+        Sid    = "AllowLambdaPull"
+        Effect = "Allow"
+        Principal = {
+          Service = "lambda.amazonaws.com"
+        }
+        Action = [
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:BatchGetImage",
+          "ecr:GetDownloadUrlForLayer"
+        ]
+      }
+    ]
+  })
+}
+
+data "external" "docker_digest" {
+  program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.migration_docker_image_tag} --format '{{.Id}}')'\\"}' "]
+}
+
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
+}
+data "external" "create_db_user_docker_digest" {
+  program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.create_db_user_docker_image_tag} --format '{{.Id}}')'\\"}' "]
+}
+
+locals {
+  create_db_user_image_tag = replace(data.external.create_db_user_docker_digest.result.digest, "sha256:", "")
+}
+
+resource "null_resource" "docker_publish" {
+  triggers = {
+    docker_digest    = data.external.docker_digest.result.digest
+    repository_url   = aws_ecr_repository.migration_handler.repository_url
+    migration_docker_image_tag = var.migration_docker_image_tag
+    image_tag        = local.image_tag
+    create_db_user_docker_digest    = data.external.create_db_user_docker_digest.result.digest
+    create_db_user_docker_image_tag = var.create_db_user_docker_image_tag
+    create_db_user_image_tag        = local.create_db_user_image_tag
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
+      docker tag "$MIGRATION_DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
+      docker tag "$CREATE_DB_USER_DOCKER_IMAGE_TAG" "$REPOSITORY_URL:create-db-user-$CREATE_DB_USER_IMAGE_TAG"
+      docker push "$REPOSITORY_URL:create-db-user-$CREATE_DB_USER_IMAGE_TAG"
+    EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      MIGRATION_DOCKER_IMAGE_TAG = self.triggers.migration_docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+      CREATE_DB_USER_DOCKER_IMAGE_TAG = self.triggers.create_db_user_docker_image_tag
+      CREATE_DB_USER_IMAGE_TAG        = self.triggers.create_db_user_image_tag
+    }
+  }
+
+  depends_on = [aws_ecr_repository_policy.migration_handler]
+}
+
+resource "aws_iam_role" "migration_handler" {
+  name = "DbMigrationHandlerRole-\${random_string.suffix.result}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "lambda.amazonaws.com"
+        }
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_iam_role_policy_attachment" "migration_handler_basic_execution" {
+  role       = aws_iam_role.migration_handler.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "migration_handler_vpc_access" {
+  role       = aws_iam_role.migration_handler.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "migration_handler_xray" {
+  role       = aws_iam_role.migration_handler.name
+  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
+}
+
+resource "aws_iam_role_policy" "migration_handler_access" {
+  role = aws_iam_role.migration_handler.name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "secretsmanager:GetSecretValue"
+        ]
+        Resource = [module.aurora.secret_arn]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "kms:Decrypt"
+        ]
+        Resource = [module.aurora.kms_key_arn]
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role" "create_db_user" {
+  name = "DbCreateDbUserRole-\${random_string.suffix.result}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "lambda.amazonaws.com"
+        }
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+
+  tags = var.tags
+}
+
+resource "aws_iam_role_policy_attachment" "create_db_user_basic_execution" {
+  role       = aws_iam_role.create_db_user.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "create_db_user_vpc_access" {
+  role       = aws_iam_role.create_db_user.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "create_db_user_xray" {
+  role       = aws_iam_role.create_db_user.name
+  policy_arn = "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"
+}
+
+resource "aws_iam_role_policy" "create_db_user_secret_access" {
+  role = aws_iam_role.create_db_user.name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "secretsmanager:GetSecretValue"
+        ]
+        Resource = [module.aurora.secret_arn]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "kms:Decrypt"
+        ]
+        Resource = [module.aurora.kms_key_arn]
+      }
+    ]
+  })
+}
+
+resource "aws_cloudwatch_log_group" "migration_handler" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to forever
+  #checkov:skip=CKV_AWS_66:Log retention set to forever
+  name = "/aws/lambda/\${local.migration_function_name}"
+  tags = var.tags
+}
+
+resource "aws_cloudwatch_log_group" "create_db_user" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to forever
+  #checkov:skip=CKV_AWS_66:Log retention set to forever
+  name = "/aws/lambda/\${local.create_db_user_function_name}"
+  tags = var.tags
+}
+
+resource "aws_security_group" "migration_handler" {
+  name_prefix = "db-migration-"
+  description = "Security group for the migration Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "migration_handler_to_database" {
+  security_group_id            = aws_security_group.migration_handler.id
+  referenced_security_group_id = module.aurora.database_security_group_id
+  from_port   = module.aurora.cluster_port
+  to_port     = module.aurora.cluster_port
+  ip_protocol = "tcp"
+  description = "Allow outbound traffic to Aurora on database port"
+}
+
+resource "aws_vpc_security_group_egress_rule" "migration_handler_https" {
+  security_group_id = aws_security_group.migration_handler.id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
+resource "aws_security_group" "create_db_user" {
+  name_prefix = "db-create-db-user-"
+  description = "Security group for the create-db-user Lambda function"
+  vpc_id      = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_vpc_security_group_egress_rule" "create_db_user_to_database" {
+  security_group_id            = aws_security_group.create_db_user.id
+  referenced_security_group_id = module.aurora.database_security_group_id
+  from_port                    = module.aurora.cluster_port
+  to_port                      = module.aurora.cluster_port
+  ip_protocol                  = "tcp"
+  description                  = "Allow outbound traffic to Aurora on database port"
+}
+
+resource "aws_vpc_security_group_egress_rule" "create_db_user_https" {
+  security_group_id = aws_security_group.create_db_user.id
+  cidr_ipv4         = "0.0.0.0/0"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "Allow outbound HTTPS to AWS service endpoints"
+}
+
+resource "aws_vpc_security_group_ingress_rule" "migration_handler_to_database" {
+  security_group_id            = module.aurora.database_security_group_id
+  referenced_security_group_id = aws_security_group.migration_handler.id
+  from_port                    = module.aurora.cluster_port
+  to_port                      = module.aurora.cluster_port
+  ip_protocol                  = "tcp"
+  description                  = "Allow inbound traffic from migration Lambda on database port"
+}
+
+resource "aws_vpc_security_group_ingress_rule" "create_db_user_to_database" {
+  security_group_id            = module.aurora.database_security_group_id
+  referenced_security_group_id = aws_security_group.create_db_user.id
+  from_port                    = module.aurora.cluster_port
+  to_port                      = module.aurora.cluster_port
+  ip_protocol                  = "tcp"
+  description                  = "Allow inbound traffic from create-db-user Lambda on database port"
+}
+
+resource "aws_lambda_function" "create_db_user" {
+  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for the create-db-user handler
+  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for the create-db-user handler
+  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
+  #checkov:skip=CKV_AWS_272:Code signing not configured as deployment packages are built and deployed within the same pipeline
+  package_type  = "Image"
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:create-db-user-\${local.create_db_user_image_tag}"
+  function_name = local.create_db_user_function_name
+  role          = aws_iam_role.create_db_user.arn
+  timeout       = 300
+  architectures = ["arm64"]
+
+  image_config {
+    command = ["proj_db.create_db_user_handler.handler"]
+  }
+
+  tracing_config {
+    mode = "Active"
+  }
+
+  vpc_config {
+    subnet_ids         = var.lambda_subnet_ids
+    security_group_ids = [aws_security_group.create_db_user.id]
+  }
+
+  environment {
+    variables = {
+      DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
+    }
+  }
+
+  tags = var.tags
+
+  depends_on = [
+    null_resource.docker_publish,
+    aws_iam_role_policy_attachment.create_db_user_basic_execution,
+    aws_iam_role_policy_attachment.create_db_user_vpc_access,
+    aws_iam_role_policy_attachment.create_db_user_xray,
+    aws_iam_role_policy.create_db_user_secret_access,
+    aws_cloudwatch_log_group.create_db_user,
+    aws_vpc_security_group_ingress_rule.create_db_user_to_database
+  ]
+}
+
+resource "null_resource" "create_db_user_trigger" {
+  triggers = {
+    cluster_arn   = module.aurora.cluster_arn
+    function_name = aws_lambda_function.create_db_user.function_name
+    db_user       = local.database_runtime_user
+    bundle_hash   = data.external.create_db_user_docker_digest.result.digest
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      output_file=$(mktemp)
+      response=$(aws lambda invoke \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
+        --cli-binary-format raw-in-base64-out \\
+        --payload "{\\"RequestType\\":\\"Create\\",\\"PhysicalResourceId\\":\\"db-user:$DB_USER\\"}" \\
+        "$output_file")
+      cat "$output_file"
+      echo "$response"
+      if echo "$response" | grep -q '"FunctionError"'; then
+        rm -f "$output_file"
+        exit 1
+      fi
+      rm -f "$output_file"
+    EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
+  }
+
+  depends_on = [aws_lambda_function.create_db_user, module.aurora]
+}
+
+resource "aws_lambda_function" "migration_handler" {
+  #checkov:skip=CKV_AWS_116:Dead Letter Queue not required for the migration handler
+  #checkov:skip=CKV_AWS_115:Concurrent execution limit not required for the migration handler
+  #checkov:skip=CKV_AWS_173:Lambda environment variables encrypted by managed key
+  #checkov:skip=CKV_AWS_272:Code signing does not apply to container image Lambda functions
+  package_type  = "Image"
+  function_name = local.migration_function_name
+  role          = aws_iam_role.migration_handler.arn
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:\${local.image_tag}"
+  memory_size   = 1024
+  timeout       = 300
+  architectures = ["arm64"]
+
+  tracing_config {
+    mode = "Active"
+  }
+
+  vpc_config {
+    subnet_ids         = var.lambda_subnet_ids
+    security_group_ids = [aws_security_group.migration_handler.id]
+  }
+
+  environment {
+    variables = {
+      DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
+    }
+  }
+
+  tags = var.tags
+
+  depends_on = [
+    null_resource.docker_publish,
+    aws_iam_role_policy_attachment.migration_handler_basic_execution,
+    aws_iam_role_policy_attachment.migration_handler_vpc_access,
+    aws_iam_role_policy_attachment.migration_handler_xray,
+    aws_iam_role_policy.migration_handler_access,
+    aws_cloudwatch_log_group.migration_handler,
+    aws_vpc_security_group_ingress_rule.migration_handler_to_database
+  ]
+}
+
+resource "null_resource" "migration_trigger" {
+  triggers = {
+    docker_digest  = data.external.docker_digest.result.digest
+    cluster_arn    = module.aurora.cluster_arn
+    database_ready = module.aurora.database_ready
+    function_name  = aws_lambda_function.migration_handler.function_name
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      output_file=$(mktemp)
+      response=$(aws lambda invoke \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
+        --cli-binary-format raw-in-base64-out \\
+        "$output_file")
+      cat "$output_file"
+      echo "$response"
+      if echo "$response" | grep -q '"FunctionError"'; then
+        rm -f "$output_file"
+        exit 1
+      fi
+      rm -f "$output_file"
+    EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
+  }
+
+  depends_on = [
+    aws_lambda_function.migration_handler,
+    module.aurora,
+    null_resource.create_db_user_trigger,
+    aws_iam_role_policy.proxy_db_user_connect
+  ]
+}
+
+output "security_group_id" {
+  description = "Security group ID to allow inbound connections to the database (proxy SG if RDS Proxy is enabled, otherwise DB SG)."
+  value       = module.aurora.security_group_id
+}
+
+output "database_security_group_id" {
+  description = "Security group ID of the Aurora cluster directly, used for direct DB access rules (e.g. when RDS Proxy is disabled)."
+  value       = module.aurora.database_security_group_id
+}
+
+output "cluster_resource_id" {
+  description = "Resource ID of the Aurora cluster, used for IAM rds-db:connect policies."
+  value       = module.aurora.cluster_resource_id
+}
+
+output "proxy_resource_id" {
+  description = "Resource identifier of the RDS Proxy (prx-XXXX), used for IAM rds-db:connect policies when connecting through the proxy. Null if RDS Proxy is disabled."
+  value       = module.aurora.proxy_resource_id
+}
+
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = module.aurora.connect_resource_id
+}
+
+output "kms_key_arn" {
+  description = "ARN of the KMS key protecting Aurora and the admin credentials secret, used to grant decrypt access alongside secret_arn."
+  value       = module.aurora.kms_key_arn
+}
+
+output "cluster_arn" {
+  description = "ARN of the Aurora cluster."
+  value       = module.aurora.cluster_arn
+}
+
+output "cluster_endpoint" {
+  description = "Writer endpoint of the Aurora cluster."
+  value       = module.aurora.cluster_endpoint
+}
+
+output "reader_endpoint" {
+  description = "Reader endpoint of the Aurora cluster."
+  value       = module.aurora.reader_endpoint
+}
+
+output "cluster_port" {
+  description = "Port exposed by the Aurora cluster."
+  value       = module.aurora.cluster_port
+}
+
+output "secret_arn" {
+  description = "ARN of the generated admin credentials secret."
+  value       = module.aurora.secret_arn
+}
+
+output "database_runtime_user" {
+  description = "Application database user created for IAM-authenticated access."
+  value       = local.database_runtime_user
+}
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/migrations/env.py 1`] = `
+"import asyncio
+import json
+import os
+from logging.config import fileConfig
+
+from alembic import context
+from sqlalchemy import URL
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlmodel import SQLModel
+
+# Import all models to register them in SQLModel.metadata
+from proj_db.models import *  # noqa: F403
+
+config = context.config
+
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+target_metadata = SQLModel.metadata
+
+
+def _get_local_url():
+    if os.environ.get("LOCAL_DEV") == "true":
+        config_path = os.path.join(os.path.dirname(__file__), "..", "config.json")
+        with open(config_path) as f:
+            cfg = json.load(f)["localDev"]
+        engine = cfg["dbEngine"]
+        driver = "mysql+aiomysql" if engine == "mysql" else "postgresql+asyncpg"
+        return URL.create(
+            driver,
+            username=cfg["dbUser"],
+            password=cfg["dbPassword"],
+            host=cfg["host"],
+            port=cfg["port"],
+            database=cfg["dbName"],
+        )
+
+    raise RuntimeError("Run alembic via nx run <project>:alembic")
+
+
+# Generates SQL script without a live DB connection (alembic upgrade head --sql)
+def run_migrations_offline() -> None:
+    context.configure(
+        url=_get_local_url(),
+        target_metadata=target_metadata,
+        literal_binds=True,
+        dialect_opts={"paramstyle": "named"},
+    )
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def _run_migrations_sync(sync_conn) -> None:
+    context.configure(connection=sync_conn, target_metadata=target_metadata)
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+# Runs migrations against a live DB connection
+def run_migrations_online() -> None:
+    supplied_connection = config.attributes.get("connection")
+    # Connection injected by migration_handler.py (Lambda)
+    if supplied_connection is not None:
+        _run_migrations_sync(supplied_connection)
+        return
+
+    # Local alembic commands run via nx run <project>:alembic
+    async def _run_async() -> None:
+        engine = create_async_engine(_get_local_url())
+        async with engine.begin() as conn:
+            await conn.run_sync(_run_migrations_sync)
+        await engine.dispose()
+
+    asyncio.run(_run_async())
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/migrations/script.py.mako 1`] = `
+""""\${message}
+
+Revision ID: \${up_revision}
+Revises: \${down_revision | comma,n}
+Create Date: \${create_date}
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+\${imports if imports else ""}
+
+# revision identifiers, used by Alembic.
+revision: str = \${repr(up_revision)}
+down_revision: Union[str, Sequence[str], None] = \${repr(down_revision)}
+branch_labels: Union[str, Sequence[str], None] = \${repr(branch_labels)}
+depends_on: Union[str, Sequence[str], None] = \${repr(depends_on)}
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    \${upgrades if upgrades else "pass"}
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    \${downgrades if downgrades else "pass"}
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/migrations/versions/.gitkeep 1`] = `""`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/proj_db/__init__.py 1`] = `
+""""Automatically generated by Nx."""
+
+from .connection import get_engine, is_local_dev, session_context
+
+__all__ = ["get_engine", "is_local_dev", "session_context"]
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/proj_db/connection.py 1`] = `
+"import ssl
+from collections.abc import AsyncGenerator
+from contextlib import asynccontextmanager
+
+import boto3
+from sqlalchemy import event
+from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine
+
+from .utils import build_database_url, get_database_config, get_local_dev_config, is_local_dev
+
+# Generated: must match runtimeConfigKey in config.json
+_runtime_config_key = "Db"
+
+_engine = None
+
+
+def get_engine():
+    global _engine
+    if _engine is not None:
+        return _engine
+    if is_local_dev():
+        cfg = get_local_dev_config()
+        url = build_database_url(cfg["dbUser"], cfg["host"], cfg["port"], cfg["dbName"])
+        ssl_args: dict = {}
+    else:
+        config = get_database_config(_runtime_config_key)
+        url = build_database_url(
+            config["dbUser"],
+            config["hostname"],
+            config["port"],
+            config["database"],
+        )
+        ssl_args = {"ssl": ssl.create_default_context()}
+    _engine = create_async_engine(url, connect_args=ssl_args)
+
+    @event.listens_for(_engine.sync_engine, "do_connect")
+    def provide_password(_dialect, _connection_record, _cargs, connection_params):
+        if is_local_dev():
+            connection_params["password"] = get_local_dev_config()["dbPassword"]
+        else:
+            config = get_database_config(_runtime_config_key)
+            connection_params["password"] = boto3.client(
+                "rds",
+                region_name=config["region"],
+            ).generate_db_auth_token(
+                DBHostname=config["hostname"],
+                Port=config["port"],
+                DBUsername=config["dbUser"],
+            )
+
+    return _engine
+
+
+@asynccontextmanager
+async def session_context() -> AsyncGenerator[AsyncSession]:
+    async with AsyncSession(get_engine()) as session:
+        yield session
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/proj_db/create_db_user_handler.py 1`] = `
+"import asyncio
+import secrets
+import ssl
+from typing import Any
+
+import asyncpg
+
+from .utils import get_database_secret, with_connection_retry
+
+
+async def _ensure_database_user(db_user: str) -> None:
+    secret = get_database_secret()
+    conn = await asyncpg.connect(
+        host=secret["host"],
+        port=int(secret["port"]),
+        database=secret["dbname"],
+        user=secret["username"],
+        password=secret["password"],
+        ssl=ssl.create_default_context(),
+    )
+    try:
+        quoted = await conn.fetchrow(
+            "SELECT quote_ident($1) AS role_q, quote_ident($2) AS db_q",
+            db_user,
+            secret["dbname"],
+        )
+        role_q, db_q = quoted["role_q"], quoted["db_q"]
+        row = await conn.fetchrow("SELECT 1 FROM pg_roles WHERE rolname = $1", db_user)
+        if row is None:
+            await conn.execute(f"CREATE ROLE {role_q} WITH LOGIN")
+        await conn.execute(f"""
+            ALTER ROLE {role_q} WITH LOGIN;
+            GRANT CONNECT ON DATABASE {db_q} TO {role_q};
+            GRANT USAGE ON SCHEMA public TO {role_q};
+            GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO {role_q};
+            GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO {role_q};
+            ALTER DEFAULT PRIVILEGES IN SCHEMA public
+                GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO {role_q};
+            ALTER DEFAULT PRIVILEGES IN SCHEMA public
+                GRANT USAGE, SELECT ON SEQUENCES TO {role_q};
+            GRANT rds_iam TO {role_q};
+        """)
+    finally:
+        await conn.close()
+
+
+_PHYSICAL_RESOURCE_ID_PREFIX = "db-user:"
+
+
+def _resolve_db_user(physical_resource_id: str | None) -> str:
+    if physical_resource_id and physical_resource_id.startswith(_PHYSICAL_RESOURCE_ID_PREFIX):
+        return physical_resource_id[len(_PHYSICAL_RESOURCE_ID_PREFIX) :]
+    return f"db_{secrets.token_hex(8)}"
+
+
+def handler(event: dict[str, Any], _context: Any) -> dict[str, Any]:
+    db_user = _resolve_db_user(event.get("PhysicalResourceId"))
+
+    if event.get("RequestType") != "Delete":
+        with_connection_retry(lambda: asyncio.run(_ensure_database_user(db_user)))
+
+    return {
+        "PhysicalResourceId": f"{_PHYSICAL_RESOURCE_ID_PREFIX}{db_user}",
+        "Data": {"dbUser": db_user},
+    }
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/proj_db/migration_handler.py 1`] = `
+"import asyncio
+import ssl
+
+from alembic import command
+from alembic.config import Config
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlalchemy.pool import NullPool
+
+from .utils import build_database_url, get_database_secret, with_connection_retry
+
+
+def _apply_migrations(sync_conn, alembic_cfg: Config) -> None:
+    alembic_cfg.attributes["connection"] = sync_conn
+    command.upgrade(alembic_cfg, "head")
+
+
+async def _run_migrations() -> None:
+    secret = get_database_secret()
+    database_url = build_database_url(
+        secret["username"],
+        secret["host"],
+        secret["port"],
+        secret["dbname"],
+        password=secret["password"],
+    )
+    alembic_cfg = Config("alembic.ini")
+    engine = create_async_engine(
+        database_url,
+        poolclass=NullPool,
+        connect_args={"ssl": ssl.create_default_context()},
+    )
+    try:
+        async with engine.begin() as conn:
+            await conn.run_sync(lambda c: _apply_migrations(c, alembic_cfg))
+    finally:
+        await engine.dispose()
+
+
+def handler(_event, _context):
+    with_connection_retry(lambda: asyncio.run(_run_migrations()))
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/proj_db/models/__init__.py 1`] = `
+"from .example import ExampleModel
+
+__all__ = ["ExampleModel"]
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/proj_db/models/example.py 1`] = `
+"from sqlalchemy import Column, String
+from sqlmodel import Field, SQLModel
+
+
+class ExampleModel(SQLModel, table=True):
+    id: int | None = Field(default=None, primary_key=True)
+    name: str = Field(sa_column=Column(String(255), nullable=False))
+    description: str | None = Field(default=None, sa_column=Column(String(255), nullable=True))
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic > packages/db/proj_db/utils.py 1`] = `
+"import json
+import os
+import time
+from collections.abc import Callable
+from typing import Any
+
+import boto3
+from aws_lambda_powertools.utilities.parameters import AppConfigProvider
+from sqlalchemy import URL
+
+DatabaseConfig = dict[str, Any]
+DatabaseSecret = dict[str, Any]
+
+
+def build_database_url(
+    username: str,
+    host: str,
+    port: int,
+    database: str,
+    password: str | None = None,
+) -> URL:
+    return URL.create(
+        drivername="postgresql+asyncpg",
+        username=username,
+        password=password,
+        host=host,
+        port=port,
+        database=database,
+    )
+
+
+def is_local_dev() -> bool:
+    return os.environ.get("LOCAL_DEV") == "true"
+
+
+def get_local_dev_config() -> dict:
+    config_path = os.path.join(os.path.dirname(__file__), "..", "config.json")
+    with open(config_path) as f:
+        return json.load(f)["localDev"]
+
+
+def get_database_secret() -> DatabaseSecret:
+    """Read the admin credentials secret.
+
+    RDS-managed secrets hold only \`username\` and \`password\`, so the host, port
+    and database name are taken from the environment when the secret omits them.
+    """
+    secret_arn = os.environ.get("DATABASE_SECRET_ARN")
+    if not secret_arn:
+        raise ValueError("Missing required environment variable DATABASE_SECRET_ARN.")
+    client = boto3.client("secretsmanager")
+    response = client.get_secret_value(SecretId=secret_arn)
+    secret = json.loads(response["SecretString"])
+
+    for key, env_var in (("host", "DATABASE_HOST"), ("port", "DATABASE_PORT"), ("dbname", "DATABASE_NAME")):
+        value = os.environ.get(env_var)
+        if value:
+            secret[key] = value
+        if secret.get(key) is None:
+            raise ValueError(f"Database secret is missing {key} and no override was provided in {env_var}.")
+
+    return secret
+
+
+_database_config: dict[str, DatabaseConfig] = {}
+
+
+def get_database_config(runtime_config_key: str) -> DatabaseConfig:
+    if runtime_config_key not in _database_config:
+        app_id = os.environ.get("RUNTIME_CONFIG_APP_ID")
+        if not app_id:
+            raise ValueError("Missing required environment variable RUNTIME_CONFIG_APP_ID.")
+        provider = AppConfigProvider(application=app_id, environment="default")
+        config = provider.get("database", transform="json")
+        if not isinstance(config, dict):
+            raise ValueError("Unexpected RuntimeConfig format: expected JSON object.")
+        db_config = config.get(runtime_config_key)
+        if not db_config:
+            raise ValueError(f"RuntimeConfig is missing database.{runtime_config_key}.")
+        _database_config[runtime_config_key] = db_config
+    return _database_config[runtime_config_key]
+
+
+_TRANSIENT_ERROR_PATTERNS = [
+    "timeout",
+    "connection refused",
+    "could not connect",
+    "connection reset",
+    "connection timed out",
+    "operationalerror",
+    "password authentication failed",
+    "access denied",
+    "temporary failure",
+]
+
+
+def is_transient_connection_error(error: Exception) -> bool:
+    error_str = str(error).lower()
+    return any(p in error_str for p in _TRANSIENT_ERROR_PATTERNS)
+
+
+def with_connection_retry[T](
+    fn: Callable[[], T],
+    max_attempts: int = 6,
+    delay_seconds: float = 10.0,
+) -> T:
+    for attempt in range(1, max_attempts + 1):
+        try:
+            return fn()
+        except Exception as e:
+            if attempt == max_attempts or not is_transient_connection_error(e):
+                raise
+            wait = delay_seconds * attempt
+            print(f"Transient connection error (attempt {attempt}/{max_attempts}), retrying in {wait:.0f}s: {e}")
+            time.sleep(wait)
+    raise RuntimeError("unreachable")
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 1`] = `
+"[alembic]
+script_location = migrations
+file_template = %%(year)d%%(month).2d%%(day).2d_%%(hour).2d%%(minute).2d_%%(rev)s_%%(slug)s
+prepend_sys_path = .
+
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARN
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARN
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 2`] = `
+"FROM public.ecr.aws/lambda/python:3.14
+
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
+WORKDIR \${LAMBDA_TASK_ROOT}
+
+COPY . .
+
+ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem /etc/pki/ca-trust/source/anchors/global-bundle.pem
+RUN update-ca-trust
+
+CMD ["proj_db.migration_handler.handler"]
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 3`] = `
+"FROM public.ecr.aws/lambda/python:3.14
+
+# Patch OS packages beyond the base image's pinned release so the image is
+# free of known HIGH/CRITICAL vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all
+
+WORKDIR \${LAMBDA_TASK_ROOT}
+
+COPY . .
+
+ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem /etc/pki/ca-trust/source/anchors/global-bundle.pem
+RUN update-ca-trust
+
+CMD ["proj_db.create_db_user_handler.handler"]
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 4`] = `
+"{
+  "runtimeConfigKey": "Db",
+  "localDev": {
+    "containerEngine": "docker",
+    "containerName": "proj-database_name",
+    "image": "public.ecr.aws/docker/library/postgres:17.7",
+    "port": 5432,
+    "host": "localhost",
+    "dbName": "database_name",
+    "dbUser": "dbadmin",
+    "dbPassword": "password",
+    "dbEngine": "postgres"
+  }
+}
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 5`] = `
+"[tool.coverage.run]
+branch = true
+source = [ "proj_db" ]
+
+[tool.coverage.report]
+exclude_lines = [ "if TYPE_CHECKING:" ]
+show_missing = true
+
+[tool.pytest.ini_options]
+addopts = """
+ --cov
+ --cov-report html:'../../coverage/packages/db/html'
+ --cov-report xml:'../../coverage/packages/db/coverage.xml'
+ --html='../../reports/packages/db/unittests/html/index.html'
+ --junitxml='../../reports/packages/db/unittests/junit.xml'
+"""
+
+[tool.hatch.build.targets.wheel]
+packages = [ "proj_db" ]
+
+[tool.hatch.metadata]
+allow-direct-references = true
+
+[tool.ruff]
+exclude = [ ".ruff_cache", ".svn", ".tox", ".venv", "dist" ]
+line-length = 120
+indent-width = 4
+
+  [tool.ruff.lint]
+  select = [ "E", "F", "UP", "B", "SIM", "I" ]
+  ignore = [ ]
+  fixable = [ "ALL" ]
+  unfixable = [ ]
+
+[project]
+name = "proj-db"
+version = "1.0.0"
+description = "Automatically generated by Nx."
+requires-python = ">=3.14"
+readme = "README.md"
+dependencies = [
+  "sqlmodel==0.0.39",
+  "alembic==1.19.1",
+  "greenlet==3.5.5",
+  "asyncpg==0.31.0",
+  "boto3==1.43.82",
+  "aws-lambda-powertools==3.34.0"
+]
+
+[build-system]
+requires = [ "hatchling" ]
+build-backend = "hatchling.build"
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 6`] = `
+"import * as path from 'path';
+import * as url from 'url';
+import { readFileSync } from 'fs';
+import { Construct } from 'constructs';
+import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
+import {
+  DockerImageCode,
+  DockerImageFunction,
+  Function,
+  FunctionOptions,
+} from 'aws-cdk-lib/aws-lambda';
+import {
+  AuroraDatabase,
+  AuroraDatabaseEngines,
+  AuroraDatabaseProps,
+} from '../../core/rdb/aurora.js';
+import { findWorkspaceRoot } from '../../core/workspace.js';
+
+const { runtimeConfigKey } = JSON.parse(
+  readFileSync(
+    path.join(
+      findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+      'packages/db/config.json',
+    ),
+    'utf-8',
+  ),
+) as { runtimeConfigKey: string };
+
+const migrationBundleDir = path.join(
+  findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+  'dist/packages/db/docker/migration',
+);
+
+const createDbUserBundleDir = path.join(
+  findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+  'dist/packages/db/docker/create-db-user',
+);
+
+export type DbProps = Omit<
+  AuroraDatabaseProps,
+  'databaseName' | 'adminUser' | 'runtimeConfigKey' | 'engine'
+>;
+
+/**
+ * CDK construct that provisions an Aurora Serverless v2 cluster.
+ */
+export class Db extends AuroraDatabase {
+  constructor(scope: Construct, id: string, props: DbProps) {
+    super(scope, id, {
+      ...props,
+      databaseName: 'database_name',
+      adminUser: 'databaseUser',
+      runtimeConfigKey,
+      engine: AuroraDatabaseEngines.postgres({}),
+    });
+  }
+
+  protected override createDbUserHandler(baseProps: FunctionOptions): Function {
+    return new DockerImageFunction(this, 'CreateDbUserHandler', {
+      ...baseProps,
+      code: DockerImageCode.fromImageAsset(createDbUserBundleDir, {
+        platform: Platform.LINUX_ARM64,
+      }),
+    });
+  }
+
+  protected override createMigrationHandler(
+    baseProps: FunctionOptions,
+  ): Function {
+    return new DockerImageFunction(this, 'MigrationHandler', {
+      ...baseProps,
+      code: DockerImageCode.fromImageAsset(migrationBundleDir, {
+        platform: Platform.LINUX_ARM64,
+      }),
+    });
+  }
+}
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 7`] = `
+"import asyncio
+import secrets
+import ssl
+from typing import Any
+
+import asyncpg
+
+from .utils import get_database_secret, with_connection_retry
+
+
+async def _ensure_database_user(db_user: str) -> None:
+    secret = get_database_secret()
+    conn = await asyncpg.connect(
+        host=secret["host"],
+        port=int(secret["port"]),
+        database=secret["dbname"],
+        user=secret["username"],
+        password=secret["password"],
+        ssl=ssl.create_default_context(),
+    )
+    try:
+        quoted = await conn.fetchrow(
+            "SELECT quote_ident($1) AS role_q, quote_ident($2) AS db_q",
+            db_user,
+            secret["dbname"],
+        )
+        role_q, db_q = quoted["role_q"], quoted["db_q"]
+        row = await conn.fetchrow("SELECT 1 FROM pg_roles WHERE rolname = $1", db_user)
+        if row is None:
+            await conn.execute(f"CREATE ROLE {role_q} WITH LOGIN")
+        await conn.execute(f"""
+            ALTER ROLE {role_q} WITH LOGIN;
+            GRANT CONNECT ON DATABASE {db_q} TO {role_q};
+            GRANT USAGE ON SCHEMA public TO {role_q};
+            GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO {role_q};
+            GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO {role_q};
+            ALTER DEFAULT PRIVILEGES IN SCHEMA public
+                GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO {role_q};
+            ALTER DEFAULT PRIVILEGES IN SCHEMA public
+                GRANT USAGE, SELECT ON SEQUENCES TO {role_q};
+            GRANT rds_iam TO {role_q};
+        """)
+    finally:
+        await conn.close()
+
+
+_PHYSICAL_RESOURCE_ID_PREFIX = "db-user:"
+
+
+def _resolve_db_user(physical_resource_id: str | None) -> str:
+    if physical_resource_id and physical_resource_id.startswith(_PHYSICAL_RESOURCE_ID_PREFIX):
+        return physical_resource_id[len(_PHYSICAL_RESOURCE_ID_PREFIX) :]
+    return f"db_{secrets.token_hex(8)}"
+
+
+def handler(event: dict[str, Any], _context: Any) -> dict[str, Any]:
+    db_user = _resolve_db_user(event.get("PhysicalResourceId"))
+
+    if event.get("RequestType") != "Delete":
+        with_connection_retry(lambda: asyncio.run(_ensure_database_user(db_user)))
+
+    return {
+        "PhysicalResourceId": f"{_PHYSICAL_RESOURCE_ID_PREFIX}{db_user}",
+        "Data": {"dbUser": db_user},
+    }
+"
+`;
+
+exports[`py#rdb generator > should generate a PostgreSQL SQLModel project with Alembic 8`] = `
+"import { CfnOutput, Duration, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import { CustomResource } from 'aws-cdk-lib';
+import { IConnectable, IVpc, Port, SubnetType } from 'aws-cdk-lib/aws-ec2';
+import { IGrantable, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import {
+  Architecture,
+  Function,
+  FunctionOptions,
+  Tracing,
+} from 'aws-cdk-lib/aws-lambda';
+import {
+  AuroraMysqlEngineVersion,
+  AuroraPostgresEngineVersion,
+  ClusterInstance,
+  Credentials,
+  DatabaseCluster,
+  DatabaseClusterEngine,
+  DatabaseClusterProps,
+  DatabaseProxy,
+  DefaultAuthScheme,
+  IClusterEngine,
+} from 'aws-cdk-lib/aws-rds';
+import { Provider } from 'aws-cdk-lib/custom-resources';
+import { Trigger } from 'aws-cdk-lib/triggers';
+import { Construct } from 'constructs';
+import { RuntimeConfig } from '../runtime-config.js';
+
+export type AuroraDatabaseEngineVersion =
+  | AuroraMysqlEngineVersion
+  | AuroraPostgresEngineVersion;
+
+export interface AuroraDatabaseEngine {
+  /**
+   * Discriminant identifying the engine type.
+   */
+  readonly type: 'mysql' | 'postgres';
+
+  /**
+   * Default Aurora engine version used when one is not explicitly provided.
+   */
+  readonly defaultVersion: AuroraDatabaseEngineVersion;
+
+  /**
+   * Builds the CDK cluster engine for the provided engine version.
+   */
+  clusterEngine(version: AuroraDatabaseEngineVersion): IClusterEngine;
+}
+
+export class AuroraDatabaseEngines {
+  public static mysql({
+    defaultVersion = AuroraMysqlEngineVersion.VER_3_12_0,
+  }: {
+    defaultVersion?: AuroraMysqlEngineVersion;
+  }): AuroraDatabaseEngine {
+    return {
+      type: 'mysql',
+      defaultVersion,
+      clusterEngine: (version) =>
+        DatabaseClusterEngine.auroraMysql({
+          version: version as AuroraMysqlEngineVersion,
+        }),
+    };
+  }
+
+  public static postgres({
+    defaultVersion = AuroraPostgresEngineVersion.VER_17_7,
+  }: {
+    defaultVersion?: AuroraPostgresEngineVersion;
+  }): AuroraDatabaseEngine {
+    return {
+      type: 'postgres',
+      defaultVersion,
+      clusterEngine: (version) =>
+        DatabaseClusterEngine.auroraPostgres({
+          version: version as AuroraPostgresEngineVersion,
+        }),
+    };
+  }
+}
+
+type _AuroraDatabaseProps = Omit<
+  DatabaseClusterProps,
+  | 'credentials'
+  | 'defaultDatabaseName'
+  | 'engine'
+  | 'iamAuthentication'
+  | 'instanceProps'
+  | 'writer'
+>;
+
+export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
+  /**
+   * VPC where the Aurora cluster will be deployed.
+   */
+  readonly vpc: IVpc;
+
+  /**
+   * Aurora engine preset used to build the cluster.
+   */
+  readonly engine: AuroraDatabaseEngine;
+
+  /**
+   * The engine version to deploy.
+   *
+   * @default - engine.defaultVersion
+   */
+  readonly engineVersion?: AuroraDatabaseEngineVersion;
+
+  /**
+   * Admin username used when generating credentials.
+   */
+  readonly adminUser: string;
+
+  /**
+   * The initial database created in the cluster.
+   */
+  readonly databaseName: string;
+
+  /**
+   * RuntimeConfig key used under the \`database\` namespace.
+   */
+  readonly runtimeConfigKey: string;
+
+  /**
+   * Writer instance for the Aurora cluster.
+   */
+  readonly writer?: DatabaseClusterProps['writer'];
+
+  /**
+   * Whether to provision an RDS Proxy in front of the Aurora cluster.
+   *
+   * @default true
+   */
+  readonly enableRdsProxy?: boolean;
+
+  /**
+   * Whether to enable automatic credential rotation for the admin secret.
+   *
+   * @default true
+   */
+  readonly enableCredentialRotation?: boolean;
+
+  /**
+   * Whether to enable deletion protection on the Aurora cluster.
+   *
+   * @default true
+   */
+  readonly deletionProtection?: boolean;
+
+  /**
+   * Removal policy applied to the Aurora cluster.
+   *
+   * @default RemovalPolicy.RETAIN
+   */
+  readonly removalPolicy?: RemovalPolicy;
+
+  /**
+   * Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret.
+   *
+   * @default true
+   */
+  readonly enableKeyRotation?: boolean;
+
+  /**
+   * Whether to export Aurora engine logs to CloudWatch Logs.
+   * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
+   *
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
+   */
+  readonly enableCloudwatchLogs?: boolean;
+
+  /**
+   * Whether to enable Performance Insights on the Aurora writer instance.
+   *
+   * @default true
+   */
+  readonly enablePerformanceInsights?: boolean;
+
+  /**
+   * Minimum Aurora Serverless v2 ACUs.
+   *
+   * @default 0.5
+   */
+  readonly serverlessV2MinCapacity?: number;
+
+  /**
+   * Maximum Aurora Serverless v2 ACUs.
+   *
+   * @default 4
+   */
+  readonly serverlessV2MaxCapacity?: number;
+}
+
+/**
+ * Reusable Aurora database construct that supports different Aurora engines
+ * through typed engine presets.
+ */
+export abstract class AuroraDatabase extends Construct {
+  public readonly cluster: DatabaseCluster;
+  public readonly proxy?: DatabaseProxy;
+  private readonly adminUser: string;
+  private readonly dbUser: string;
+
+  constructor(
+    scope: Construct,
+    id: string,
+    {
+      vpc,
+      adminUser,
+      databaseName,
+      runtimeConfigKey,
+      vpcSubnets,
+      writer,
+      enableRdsProxy = true,
+      enableCredentialRotation = true,
+      deletionProtection = true,
+      removalPolicy = RemovalPolicy.RETAIN,
+      enableKeyRotation = true,
+      enableCloudwatchLogs = true,
+      enablePerformanceInsights = true,
+      serverlessV2MinCapacity = 0.5,
+      serverlessV2MaxCapacity = 4,
+      engine,
+      engineVersion,
+      ...clusterProps
+    }: AuroraDatabaseProps,
+  ) {
+    super(scope, id);
+
+    this.adminUser = adminUser;
+
+    const key = new Key(this, 'EncryptionKey', { enableKeyRotation });
+    this.cluster = new DatabaseCluster(this, 'DatabaseCluster', {
+      ...clusterProps,
+      vpc,
+      vpcSubnets,
+      engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
+      serverlessV2MinCapacity,
+      serverlessV2MaxCapacity,
+      writer:
+        writer ??
+        ClusterInstance.serverlessV2('writer', {
+          enablePerformanceInsights,
+          performanceInsightEncryptionKey: enablePerformanceInsights
+            ? key
+            : undefined,
+        }),
+      credentials: Credentials.fromGeneratedSecret(adminUser, {
+        encryptionKey: key,
+      }),
+      iamAuthentication: true,
+      monitoringInterval: Duration.seconds(5),
+      cloudwatchLogsExports: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? ['audit', 'error']
+          : ['postgresql']
+        : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? {
+              server_audit_logging: '1',
+              server_audit_events: 'CONNECT,QUERY_DDL',
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: 'ddl' }
+        : undefined,
+      defaultDatabaseName: databaseName,
+      storageEncrypted: true,
+      storageEncryptionKey: key,
+      deletionProtection,
+      removalPolicy,
+    });
+
+    if (enableCredentialRotation) {
+      this.cluster.addRotationSingleUser({
+        automaticallyAfter: Duration.days(30),
+        vpcSubnets: {
+          subnetType: SubnetType.PRIVATE_WITH_EGRESS,
+        },
+      });
+    }
+
+    const proxyRole = enableRdsProxy
+      ? new Role(this, 'DatabaseProxyRole', {
+          assumedBy: new ServicePrincipal('rds.amazonaws.com'),
+        })
+      : undefined;
+
+    if (enableRdsProxy) {
+      this.proxy = this.cluster.addProxy('DatabaseProxy', {
+        vpc,
+        vpcSubnets,
+        defaultAuthScheme: DefaultAuthScheme.IAM_AUTH,
+        role: proxyRole,
+      });
+    }
+
+    const databaseHostname =
+      this.proxy?.endpoint ?? this.cluster.clusterEndpoint.hostname;
+    const databasePort = this.cluster.clusterEndpoint.port;
+
+    const commonProps: FunctionOptions = {
+      vpc,
+      timeout: Duration.minutes(5),
+      tracing: Tracing.ACTIVE,
+      architecture: Architecture.ARM_64,
+    };
+
+    const createDbUserHandler = this.createDbUserHandler({
+      ...commonProps,
+      vpcSubnets: {
+        subnetType: SubnetType.PRIVATE_WITH_EGRESS,
+      },
+    });
+    createDbUserHandler.addEnvironment(
+      'DATABASE_SECRET_ARN',
+      this.cluster.secret!.secretArn,
+    );
+    this.cluster.connections.allowDefaultPortFrom(
+      createDbUserHandler,
+      'Allow the create-db-user handler to connect to the database',
+    );
+    this.grantSecretRead(createDbUserHandler);
+
+    const createDbUserProvider = new Provider(this, 'CreateDbUserProvider', {
+      onEventHandler: createDbUserHandler,
+    });
+
+    const createDbUserResource = new CustomResource(
+      this,
+      'CreateDbUserResource',
+      {
+        serviceToken: createDbUserProvider.serviceToken,
+        properties: {
+          clusterIdentifier: this.cluster.clusterIdentifier,
+        },
+      },
+    );
+    createDbUserResource.node.addDependency(this.cluster);
+    this.dbUser = createDbUserResource.getAttString('dbUser');
+    if (this.proxy && proxyRole) {
+      this.cluster.grantConnect(proxyRole, this.dbUser);
+    }
+
+    const rc = RuntimeConfig.ensure(this);
+    rc.set('database', runtimeConfigKey, {
+      hostname: databaseHostname,
+      port: databasePort,
+      database: databaseName,
+      adminUser: this.adminUser,
+      dbUser: this.dbUser,
+      region: Stack.of(this).region,
+    });
+
+    const migrationHandler = this.createMigrationHandler({
+      ...commonProps,
+      memorySize: 1024,
+    });
+    migrationHandler.addEnvironment(
+      'DATABASE_SECRET_ARN',
+      this.cluster.secret!.secretArn,
+    );
+    this.cluster.connections.allowDefaultPortFrom(migrationHandler);
+    this.grantSecretRead(migrationHandler);
+
+    const migrationTrigger = new Trigger(this, 'MigrationTrigger', {
+      handler: migrationHandler,
+    });
+    migrationTrigger.node.addDependency(createDbUserResource);
+
+    new CfnOutput(this, 'ClusterEndpoint', {
+      value: this.cluster.clusterEndpoint.hostname,
+    });
+
+    if (this.proxy?.endpoint) {
+      new CfnOutput(this, 'ProxyEndpoint', {
+        value: this.proxy?.endpoint,
+      });
+    }
+  }
+
+  /**
+   * Creates the Lambda handler used to create or reconcile the application database user.
+   */
+  protected abstract createDbUserHandler(baseProps: FunctionOptions): Function;
+
+  /**
+   * Creates the Lambda handler used to run database migrations.
+   */
+  protected abstract createMigrationHandler(
+    baseProps: FunctionOptions,
+  ): Function;
+
+  public allowDefaultPortFrom(other: IConnectable, description?: string): void {
+    if (this.proxy) {
+      this.proxy.connections.allowFrom(
+        other,
+        Port.tcp(this.cluster.clusterEndpoint.port),
+        description,
+      );
+    } else {
+      this.cluster.connections.allowDefaultPortFrom(other, description);
+    }
+  }
+
+  public grantSecretRead(grantee: IGrantable) {
+    return this.cluster.secret!.grantRead(grantee);
+  }
+
+  public grantConnect(grantee: IGrantable) {
+    return this.proxy
+      ? this.proxy.grantConnect(grantee, this.dbUser)
+      : this.cluster.grantConnect(grantee, this.dbUser);
+  }
+}
+"
+`;