@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -22,137 +22,6 @@ datasource db {
 "
 `;
 
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/scripts/pull-image.ts 1`] = `
-"import { spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-const image = process.argv[2];
-
-const inspect = spawnSync(ENGINE, ['image', 'inspect', image], {
-  stdio: 'ignore',
-});
-
-if (inspect.status !== 0) {
-  const pull = spawnSync(ENGINE, ['pull', image], { stdio: 'inherit' });
-  if (pull.status !== 0) {
-    process.exit(pull.status ?? 1);
-  }
-}
-"
-`;
-
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/scripts/start-container.ts 1`] = `
-"import { spawn, spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-
-const [containerName, image, hostPort, dbName, dbPassword] =
-  process.argv.slice(2);
-
-const containerExists = (): boolean =>
-  spawnSync(ENGINE, ['container', 'inspect', containerName], {
-    stdio: 'ignore',
-  }).status === 0;
-
-const isRunning = (): boolean => {
-  const result = spawnSync(
-    ENGINE,
-    ['container', 'inspect', '-f', '{{.State.Running}}', containerName],
-    { encoding: 'utf-8' },
-  );
-  return result.status === 0 && result.stdout.trim() === 'true';
-};
-
-if (containerExists()) {
-  if (!isRunning()) {
-    const start = spawnSync(ENGINE, ['start', containerName], {
-      stdio: 'inherit',
-    });
-    if (start.status !== 0) process.exit(start.status ?? 1);
-  }
-} else {
-  const runArgs = (
-    \`run --rm --name \${containerName}\` +
-    \` -e MYSQL_DATABASE=\${dbName}\` +
-    \` -e MYSQL_ROOT_PASSWORD=\${dbPassword}\` +
-    \` -p \${hostPort}:3306\` +
-    \` -v \${containerName}-data:/var/lib/mysql\` +
-    \` -d \${image}\`
-  ).split(' ');
-  const create = spawnSync(ENGINE, runArgs, { stdio: 'inherit' });
-  if (create.status !== 0) process.exit(create.status ?? 1);
-}
-
-const logs = spawn(ENGINE, ['logs', '-f', containerName], {
-  stdio: ['ignore', 'inherit', 'inherit'],
-});
-
-let exiting = false;
-
-const cleanup = () => {
-  if (exiting) return;
-  exiting = true;
-  spawnSync(ENGINE, ['stop', containerName], { stdio: 'ignore' });
-  logs.kill();
-  process.exit(0);
-};
-
-process.on('SIGTERM', cleanup);
-process.on('SIGINT', cleanup);
-process.on('SIGHUP', cleanup);
-
-logs.on('exit', (code) => {
-  if (!exiting) process.exit(code ?? 0);
-});
-"
-`;
-
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/scripts/wait-for-db.ts 1`] = `
-"import { createConnection, Connection } from 'mariadb';
-
-const noop = () => undefined;
-
-const [portArg, dbArg, userArg, passwordArg] = process.argv.slice(2);
-const timeoutAt = Date.now() + 60000;
-
-while (Date.now() < timeoutAt) {
-  let conn: Connection | undefined;
-  try {
-    conn = await createConnection({
-      host: 'localhost',
-      port: parseInt(portArg),
-      user: userArg,
-      password: passwordArg,
-      database: dbArg,
-      connectTimeout: 500,
-      allowPublicKeyRetrieval: true,
-    });
-    await conn.end();
-    console.log('Database is ready.');
-    process.exit(0);
-  } catch {
-    console.log('Database is not ready.');
-    await conn?.end().catch(noop);
-  }
-  await new Promise((r) => setTimeout(r, 200));
-}
-
-throw new Error(\`Timed out waiting for mysql on port \${portArg}\`);
-"
-`;
-
-exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/constants.ts 1`] = `
-"export const DB_PACKAGE_NAME = 'Db';
-
-// Local development connection details (used when SERVE_LOCAL=true, see serve-local Nx target)
-export const LOCAL_DB_PORT = 3306;
-export const LOCAL_DB_HOST = 'localhost';
-export const LOCAL_DB_NAME = 'database_name';
-export const LOCAL_DB_USER = 'root';
-export const LOCAL_DB_PASSWORD = 'password';
-"
-`;
-
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/create-db-user-handler.ts 1`] = `
 "import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
 import { randomBytes } from 'node:crypto';
@@ -199,7 +68,7 @@ const ensureDatabaseUser = async (dbUser: string): Promise<void> => {
       [
         \`CREATE USER IF NOT EXISTS \${quotedUser}@\${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS'\`,
         \`ALTER USER \${quotedUser}@\${quotedHost} IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS' REQUIRE SSL\`,
-        \`GRANT ALL PRIVILEGES ON \${quotedDbName}.* TO \${quotedUser}@\${quotedHost}\`,
+        \`GRANT SELECT, INSERT, UPDATE, DELETE ON \${quotedDbName}.* TO \${quotedUser}@\${quotedHost}\`,
       ].join(';\\n'),
     );
   } finally {
@@ -230,13 +99,14 @@ export const handler = async (
 `;
 
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/index.ts 1`] = `
-"export { DB_PACKAGE_NAME } from './constants.js';
-export { getPrisma } from './prisma.js';
+"export * from './prisma.js';
+// Export your library code here
 "
 `;
 
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL > packages/db/src/migration-handler.ts 1`] = `
 "import { execFile } from 'node:child_process';
+import { join } from 'node:path';
 import { promisify } from 'node:util';
 import { getDatabaseSecret, withConnectionRetry } from './utils.js';
 
@@ -254,7 +124,8 @@ const buildDatabaseUrl = async (): Promise<string> => {
 export const handler = async () => {
   await withConnectionRetry(async () => {
     const databaseUrl = await buildDatabaseUrl();
-    await promisify(execFile)('npx', ['prisma', 'migrate', 'deploy'], {
+    const prisma = join(__dirname, 'node_modules', '.bin', 'prisma');
+    await promisify(execFile)(prisma, ['migrate', 'deploy'], {
       cwd: __dirname,
       env: {
         ...process.env,
@@ -270,26 +141,30 @@ exports[`ts#rdb generator > should add mysql prisma dependencies when engine is
 "import { PrismaMariaDb } from '@prisma/adapter-mariadb';
 import { Signer } from '@aws-sdk/rds-signer';
 import { Prisma, PrismaClient } from '../generated/prisma/client.js';
-import {
-  DB_PACKAGE_NAME,
-  LOCAL_DB_HOST,
-  LOCAL_DB_NAME,
-  LOCAL_DB_PASSWORD,
-  LOCAL_DB_PORT,
-  LOCAL_DB_USER,
-} from './constants.js';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
 import { getDatabaseConfig } from './utils.js';
 
+// Generated: must match runtimeConfigKey in config.json
+const runtimeConfigKey = 'Db';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// config.json is only present in local dev (not included in the deployed bundle); guard with LOCAL_DEV check
+const localDev = () =>
+  JSON.parse(readFileSync(join(__dirname, '../config.json'), 'utf-8')).localDev;
+
 export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   log: LogOpts[] = ['warn', 'error'] as LogOpts[],
 ): Promise<PrismaClient<LogOpts>> => {
-  if (process.env.SERVE_LOCAL === 'true') {
+  if (process.env.LOCAL_DEV === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = localDev();
     const adapter = new PrismaMariaDb({
-      host: LOCAL_DB_HOST,
-      port: LOCAL_DB_PORT,
-      database: LOCAL_DB_NAME,
-      user: LOCAL_DB_USER,
-      password: LOCAL_DB_PASSWORD,
+      host,
+      port,
+      database: dbName,
+      user: dbUser,
+      password: dbPassword,
       allowPublicKeyRetrieval: true,
     });
     return new PrismaClient({
@@ -299,7 +174,7 @@ export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   }
 
   const { hostname, port, database, dbUser, region } =
-    await getDatabaseConfig(DB_PACKAGE_NAME);
+    await getDatabaseConfig(runtimeConfigKey);
   const iamAuthToken = await new Signer({
     hostname,
     port,
@@ -350,6 +225,24 @@ export type DatabaseSecret = {
   port: number;
 };
 
+/**
+ * Connection details for the admin credentials secret. RDS-managed secrets hold
+ * only \`username\` and \`password\`, so the host, port and database name are taken
+ * from the environment when the secret omits them.
+ */
+type SecretConnectionOverrides = Partial<
+  Omit<DatabaseSecret, 'username' | 'password'>
+>;
+
+const connectionOverridesFromEnv = (): SecretConnectionOverrides => {
+  const { DATABASE_HOST, DATABASE_PORT, DATABASE_NAME } = process.env;
+  return {
+    ...(DATABASE_HOST ? { host: DATABASE_HOST } : {}),
+    ...(DATABASE_PORT ? { port: Number(DATABASE_PORT) } : {}),
+    ...(DATABASE_NAME ? { dbname: DATABASE_NAME } : {}),
+  };
+};
+
 const databaseConfigPromises: Record<string, Promise<DatabaseConfig>> = {};
 
 const getSecretValue = async (secretArn: string): Promise<string> => {
@@ -376,7 +269,18 @@ export const getDatabaseSecret = async (): Promise<DatabaseSecret> => {
     );
   }
 
-  return JSON.parse(await getSecretValue(secretArn)) as DatabaseSecret;
+  const secret = JSON.parse(await getSecretValue(secretArn)) as DatabaseSecret;
+  const secretWithConnection = { ...secret, ...connectionOverridesFromEnv() };
+
+  for (const key of ['host', 'port', 'dbname'] as const) {
+    if (secretWithConnection[key] == null) {
+      throw new Error(
+        \`Database secret is missing \${key} and no override was provided in the environment.\`,
+      );
+    }
+  }
+
+  return secretWithConnection;
 };
 
 const loadDatabaseConfig = async (
@@ -424,6 +328,9 @@ const transientErrorPatterns = [
   'ECONNREFUSED',
   'ENOTFOUND',
   'P1000', // Prisma: authentication failed
+  'P1001', // Prisma: can't reach database server
+  'P1002', // Prisma: database server reached but timed out
+  'P1010', // Prisma: user denied access (IAM auth grant not yet propagated)
   'ER_ACCESS_DENIED_ERROR', // MySQL: access denied
 ];
 
@@ -484,14 +391,10 @@ import { CustomResource } from 'aws-cdk-lib';
 import { IConnectable, IVpc, Port, SubnetType } from 'aws-cdk-lib/aws-ec2';
 import { IGrantable, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { Key } from 'aws-cdk-lib/aws-kms';
-import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
 import {
   Architecture,
-  Code,
-  DockerImageCode,
-  DockerImageFunction,
   Function,
-  Runtime,
+  FunctionOptions,
   Tracing,
 } from 'aws-cdk-lib/aws-lambda';
 import {
@@ -607,16 +510,6 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    */
   readonly runtimeConfigKey: string;
 
-  /**
-   * Migration bundle used to create a migration handler Lambda.
-   */
-  readonly migrationBundleDir: string;
-
-  /**
-   * Bundle used to create or reconcile the application database user.
-   */
-  readonly createDbUserBundleDir: string;
-
   /**
    * Writer instance for the Aurora cluster.
    */
@@ -656,6 +549,39 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enableKeyRotation?: boolean;
+
+  /**
+   * Whether to export Aurora engine logs to CloudWatch Logs.
+   * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
+   *
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
+   */
+  readonly enableCloudwatchLogs?: boolean;
+
+  /**
+   * Whether to enable Performance Insights on the Aurora writer instance.
+   *
+   * @default true
+   */
+  readonly enablePerformanceInsights?: boolean;
+
+  /**
+   * Minimum Aurora Serverless v2 ACUs.
+   *
+   * @default 0.5
+   */
+  readonly serverlessV2MinCapacity?: number;
+
+  /**
+   * Maximum Aurora Serverless v2 ACUs.
+   *
+   * @default 4
+   */
+  readonly serverlessV2MaxCapacity?: number;
 }
 
 /**
@@ -676,8 +602,6 @@ export abstract class AuroraDatabase extends Construct {
       adminUser,
       databaseName,
       runtimeConfigKey,
-      migrationBundleDir,
-      createDbUserBundleDir,
       vpcSubnets,
       writer,
       enableRdsProxy = true,
@@ -685,6 +609,10 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
+      enableCloudwatchLogs = true,
+      enablePerformanceInsights = true,
+      serverlessV2MinCapacity = 0.5,
+      serverlessV2MaxCapacity = 4,
       engine,
       engineVersion,
       ...clusterProps
@@ -700,12 +628,37 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
-      writer: writer ?? ClusterInstance.serverlessV2('writer'),
+      serverlessV2MinCapacity,
+      serverlessV2MaxCapacity,
+      writer:
+        writer ??
+        ClusterInstance.serverlessV2('writer', {
+          enablePerformanceInsights,
+          performanceInsightEncryptionKey: enablePerformanceInsights
+            ? key
+            : undefined,
+        }),
       credentials: Credentials.fromGeneratedSecret(adminUser, {
         encryptionKey: key,
       }),
       iamAuthentication: true,
       monitoringInterval: Duration.seconds(5),
+      cloudwatchLogsExports: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? ['audit', 'error']
+          : ['postgresql']
+        : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? {
+              server_audit_logging: '1',
+              server_audit_events: 'CONNECT,QUERY_DDL',
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: 'ddl' }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,
@@ -741,23 +694,23 @@ export abstract class AuroraDatabase extends Construct {
       this.proxy?.endpoint ?? this.cluster.clusterEndpoint.hostname;
     const databasePort = this.cluster.clusterEndpoint.port;
 
-    const createDbUserHandler = new Function(this, 'CreateDbUserHandler', {
-      code: Code.fromAsset(createDbUserBundleDir),
-      handler: 'index.handler',
-      runtime: Runtime.NODEJS_LATEST,
+    const commonProps: FunctionOptions = {
+      vpc,
       timeout: Duration.minutes(5),
       tracing: Tracing.ACTIVE,
-      vpc,
+      architecture: Architecture.ARM_64,
+    };
+
+    const createDbUserHandler = this.createDbUserHandler({
+      ...commonProps,
       vpcSubnets: {
         subnetType: SubnetType.PRIVATE_WITH_EGRESS,
       },
-      environment: {
-        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-        NODE_EXTRA_CA_CERTS: '/var/runtime/ca-cert.pem',
-      },
-      architecture: Architecture.ARM_64,
     });
-
+    createDbUserHandler.addEnvironment(
+      'DATABASE_SECRET_ARN',
+      this.cluster.secret!.secretArn,
+    );
     this.cluster.connections.allowDefaultPortFrom(
       createDbUserHandler,
       'Allow the create-db-user handler to connect to the database',
@@ -794,40 +747,21 @@ export abstract class AuroraDatabase extends Construct {
       region: Stack.of(this).region,
     });
 
-    const migrationHandler = new DockerImageFunction(this, 'MigrationHandler', {
-      code: DockerImageCode.fromImageAsset(migrationBundleDir, {
-        platform: Platform.LINUX_ARM64,
-      }),
+    const migrationHandler = this.createMigrationHandler({
+      ...commonProps,
       memorySize: 1024,
-      timeout: Duration.minutes(5),
-      tracing: Tracing.ACTIVE,
-      vpc,
-      environment:
-        engine.type === 'mysql'
-          ? {
-              DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-            }
-          : {
-              HOSTNAME: databaseHostname,
-              DATABASE: databaseName,
-              PORT: databasePort.toString(),
-              DBUSER: this.dbUser,
-            },
-      architecture: Architecture.ARM_64,
     });
+    migrationHandler.addEnvironment(
+      'DATABASE_SECRET_ARN',
+      this.cluster.secret!.secretArn,
+    );
+    this.cluster.connections.allowDefaultPortFrom(migrationHandler);
+    this.grantSecretRead(migrationHandler);
 
-    if (engine.type === 'mysql') {
-      this.cluster.connections.allowDefaultPortFrom(migrationHandler);
-      this.grantSecretRead(migrationHandler);
-    } else {
-      this.allowDefaultPortFrom(migrationHandler);
-      this.grantConnect(migrationHandler);
-    }
-
-    const trigger = new Trigger(this, 'MigrationTrigger', {
+    const migrationTrigger = new Trigger(this, 'MigrationTrigger', {
       handler: migrationHandler,
     });
-    trigger.node.addDependency(createDbUserResource);
+    migrationTrigger.node.addDependency(createDbUserResource);
 
     new CfnOutput(this, 'ClusterEndpoint', {
       value: this.cluster.clusterEndpoint.hostname,
@@ -840,6 +774,18 @@ export abstract class AuroraDatabase extends Construct {
     }
   }
 
+  /**
+   * Creates the Lambda handler used to create or reconcile the application database user.
+   */
+  protected abstract createDbUserHandler(baseProps: FunctionOptions): Function;
+
+  /**
+   * Creates the Lambda handler used to run database migrations.
+   */
+  protected abstract createMigrationHandler(
+    baseProps: FunctionOptions,
+  ): Function;
+
   public allowDefaultPortFrom(other: IConnectable, description?: string): void {
     if (this.proxy) {
       this.proxy.connections.allowFrom(
@@ -867,17 +813,14 @@ export abstract class AuroraDatabase extends Construct {
 
 exports[`ts#rdb generator > should add mysql prisma dependencies when engine is MySQL 2`] = `
 "import { defineConfig } from 'prisma/config';
+import { readFileSync } from 'fs';
 
 const getDatabaseUrl = async () => {
-  if (process.env.SERVE_LOCAL === 'true') {
-    const {
-      LOCAL_DB_HOST,
-      LOCAL_DB_NAME,
-      LOCAL_DB_PASSWORD,
-      LOCAL_DB_PORT,
-      LOCAL_DB_USER,
-    } = await import('./src/constants.js');
-    return \`mysql://\${LOCAL_DB_USER}:\${LOCAL_DB_PASSWORD}@\${LOCAL_DB_HOST}:\${LOCAL_DB_PORT}/\${LOCAL_DB_NAME}\`;
+  if (process.env.LOCAL_DEV === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = JSON.parse(
+      readFileSync('config.json', 'utf-8'),
+    ).localDev;
+    return \`mysql://\${dbUser}:\${dbPassword}@\${host}:\${port}/\${dbName}\`;
   }
   return process.env.DATABASE_URL;
 };
@@ -896,7 +839,8 @@ export default defineConfig({
 
 exports[`ts#rdb generator > should generate terraform modules when iac is Terraform 1`] = `
 "# Core Aurora module
-# This module creates an Aurora cluster and a generated admin secret.
+# This module creates an Aurora cluster whose admin credentials are generated
+# and rotated by RDS in Secrets Manager.
 
 terraform {
   required_version = ">= 1.0"
@@ -904,15 +848,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "3.3.1"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "3.9.0"
     }
   }
 }
@@ -940,11 +884,6 @@ variable "subnet_ids" {
   type        = list(string)
 }
 
-variable "lambda_subnet_ids" {
-  description = "Subnet IDs for the credential-rotation Lambda. Must have outbound egress to AWS service endpoints (e.g. Secrets Manager) — use private subnets with a NAT gateway."
-  type        = list(string)
-}
-
 variable "engine" {
   description = "Aurora engine to use."
   type        = string
@@ -1014,16 +953,10 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -1078,11 +1011,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for \${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -1093,6 +1045,8 @@ resource "aws_kms_key" "database" {
   description         = "KMS key for Aurora cluster \${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
+  deletion_window_in_days = 30
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -1120,6 +1074,20 @@ resource "aws_kms_key" "database" {
           "kms:CreateGrant"
         ]
         Resource = "*"
+      },
+      {
+        Sid    = "AllowSecretsManagerService"
+        Effect = "Allow"
+        Principal = {
+          Service = "secretsmanager.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
       }
     ]
   })
@@ -1174,44 +1142,16 @@ resource "aws_db_subnet_group" "database" {
   })
 }
 
-resource "random_password" "master_password" {
-  length           = 32
-  special          = true
-  override_special = "!#$%&*()-_=+[]{}<>:?"
-}
-
-resource "aws_secretsmanager_secret" "credentials" {
-  #checkov:skip=CKV2_AWS_57:Rotation is configured via aws_cloudformation_stack.credentials_rotation using the AWS::SecretsManager-2024-09-16 transform; Checkov cannot resolve rotation schedules created by CloudFormation transforms
-  name_prefix = "\${var.name}-aurora-credentials-"
-  kms_key_id  = aws_kms_key.database.arn
-
-  tags = merge(var.tags, {
-    Name = "\${var.name}-aurora-credentials"
-  })
-}
-
-resource "aws_secretsmanager_secret_version" "credentials" {
-  secret_id = aws_secretsmanager_secret.credentials.id
-  secret_string = jsonencode({
-    engine              = var.engine == "aurora-mysql" ? "mysql" : "postgres"
-    username            = var.admin_user
-    password            = random_password.master_password.result
-    host                = aws_rds_cluster.database.endpoint
-    port                = aws_rds_cluster.database.port
-    dbname              = var.database_name
-    dbClusterIdentifier = aws_rds_cluster.database.cluster_identifier
-  })
-}
-
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
   cluster_identifier                  = local.cluster_name
   engine                              = var.engine
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
   master_username                     = var.admin_user
-  master_password                     = random_password.master_password.result
+  manage_master_user_password         = true
+  master_user_secret_kms_key_id       = aws_kms_key.database.arn
   db_subnet_group_name                = aws_db_subnet_group.database.name
   db_cluster_parameter_group_name     = var.enable_cloudwatch_logs ? aws_rds_cluster_parameter_group.database[0].name : null
   vpc_security_group_ids              = [aws_security_group.database.id]
@@ -1225,7 +1165,7 @@ resource "aws_rds_cluster" "database" {
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity
@@ -1235,6 +1175,10 @@ resource "aws_rds_cluster" "database" {
   tags = merge(var.tags, {
     Name = "\${var.name}-aurora"
   })
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 resource "aws_rds_cluster_instance" "database" {
@@ -1259,75 +1203,6 @@ resource "aws_rds_cluster_instance" "database" {
   })
 }
 
-resource "aws_security_group" "rotation" {
-  #checkov:skip=CKV2_AWS_5:Security group is attached to the hosted rotation Lambda created by AWS::SecretsManager::RotationSchedule; Checkov cannot resolve resources created by the CloudFormation transform
-  count       = var.enable_credential_rotation ? 1 : 0
-  name_prefix = "\${var.name}-aurora-rotation-"
-  description = "Security group for Aurora secret rotation \${var.name}"
-  vpc_id      = var.vpc_id
-
-  tags = merge(var.tags, {
-    Name = "\${var.name}-aurora-rotation"
-  })
-}
-
-resource "aws_vpc_security_group_egress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.rotation[0].id
-  referenced_security_group_id = aws_security_group.database.id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow outbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.database.id
-  referenced_security_group_id = aws_security_group.rotation[0].id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow inbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_cloudformation_stack" "credentials_rotation" {
-  #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
-  count = var.enable_credential_rotation ? 1 : 0
-  name  = "\${local.cluster_name}-credentials-rotation"
-
-  capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
-
-  template_body = jsonencode({
-    AWSTemplateFormatVersion = "2010-09-09"
-    Transform                = "AWS::SecretsManager-2024-09-16"
-    Resources = {
-      CredentialsRotationSchedule = {
-        Type = "AWS::SecretsManager::RotationSchedule"
-        Properties = {
-          SecretId = aws_secretsmanager_secret.credentials.arn
-          HostedRotationLambda = {
-            RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "\${local.cluster_name}-credentials-rotation"
-            VpcSecurityGroupIds = aws_security_group.rotation[0].id
-            VpcSubnetIds        = join(",", var.lambda_subnet_ids)
-          }
-          RotationRules = {
-            AutomaticallyAfterDays = 30
-          }
-        }
-      }
-    }
-  })
-
-  depends_on = [
-    aws_secretsmanager_secret_version.credentials,
-    aws_rds_cluster_instance.database,
-    aws_vpc_security_group_egress_rule.rotation_to_database,
-    aws_vpc_security_group_ingress_rule.rotation_to_database,
-  ]
-}
-
 resource "aws_iam_role" "proxy" {
   count = var.enable_rds_proxy ? 1 : 0
 
@@ -1351,27 +1226,6 @@ resource "aws_iam_role" "proxy" {
   })
 }
 
-resource "aws_iam_role_policy" "proxy_secret_access" {
-  count = var.enable_rds_proxy ? 1 : 0
-  role  = aws_iam_role.proxy[0].name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect   = "Allow"
-        Action   = ["secretsmanager:GetSecretValue"]
-        Resource = [aws_secretsmanager_secret.credentials.arn]
-      },
-      {
-        Effect   = "Allow"
-        Action   = ["kms:Decrypt"]
-        Resource = [aws_kms_key.database.arn]
-      }
-    ]
-  })
-}
-
 resource "aws_security_group" "proxy" {
   #checkov:skip=CKV2_AWS_5:Security group is attached to aws_db_proxy.aurora; Checkov cannot resolve count-conditional cross-resource references
   count = var.enable_rds_proxy ? 1 : 0
@@ -1395,17 +1249,6 @@ resource "aws_db_proxy" "aurora" {
   vpc_subnet_ids         = var.subnet_ids
   vpc_security_group_ids = [aws_security_group.proxy[0].id]
   require_tls            = true
-
-  auth {
-    auth_scheme = "SECRETS"
-    iam_auth    = "REQUIRED"
-    secret_arn  = aws_secretsmanager_secret.credentials.arn
-  }
-
-  depends_on = [
-    aws_iam_role_policy.proxy_secret_access,
-    aws_secretsmanager_secret_version.credentials,
-  ]
 }
 
 resource "aws_db_proxy_default_target_group" "default" {
@@ -1437,9 +1280,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \\
-          --region \${data.aws_region.current.region} \\
-          --db-proxy-name \${self.triggers.db_proxy_name} \\
-          --target-group-name \${self.triggers.target_group_name} \\
+          --region "$AWS_REGION" \\
+          --db-proxy-name "$DB_PROXY_NAME" \\
+          --target-group-name "$TARGET_GROUP_NAME" \\
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \\
           --output text)
 
@@ -1449,13 +1292,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target \${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -1582,11 +1431,21 @@ output "proxy_resource_id" {
   value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : null
 }
 
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : aws_rds_cluster.database.cluster_resource_id
+}
+
 output "cluster_endpoint" {
   description = "Writer endpoint of the Aurora cluster or proxy."
   value       = var.enable_rds_proxy ? aws_db_proxy.aurora[0].endpoint : aws_rds_cluster.database.endpoint
 }
 
+output "writer_endpoint" {
+  description = "Writer endpoint of the Aurora cluster itself, bypassing the RDS Proxy. Used by the admin-credentialled handlers, which connect directly to the cluster."
+  value       = aws_rds_cluster.database.endpoint
+}
+
 output "reader_endpoint" {
   description = "Reader endpoint of the Aurora cluster."
   value       = aws_rds_cluster.database.reader_endpoint
@@ -1613,12 +1472,12 @@ output "proxy_role_name" {
 }
 
 output "secret_arn" {
-  description = "ARN of the generated admin credentials secret."
-  value       = aws_secretsmanager_secret.credentials.arn
+  description = "ARN of the RDS-managed admin credentials secret. Its value is a JSON object with username and password only — connection details come from this module's other outputs."
+  value       = one(aws_rds_cluster.database.master_user_secret[*].secret_arn)
 }
 
 output "kms_key_arn" {
-  description = "ARN of the KMS key protecting Aurora and the generated secret."
+  description = "ARN of the KMS key protecting Aurora and its admin credentials secret."
   value       = aws_kms_key.database.arn
 }
 
@@ -1643,8 +1502,8 @@ output "database_name" {
 }
 
 output "admin_user" {
-  description = "Admin username stored in the generated secret."
-  value       = jsondecode(aws_secretsmanager_secret_version.credentials.secret_string).username
+  description = "Admin username stored in the RDS-managed credentials secret."
+  value       = aws_rds_cluster.database.master_username
 }
 "
 `;
@@ -1656,19 +1515,23 @@ exports[`ts#rdb generator > should generate terraform modules when iac is Terraf
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "~> 2.5"
+      version = "2.8.0"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
+    }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "3.3.1"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "3.9.0"
     }
   }
 }
@@ -1736,16 +1599,10 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -1766,18 +1623,25 @@ variable "enable_backup" {
   default     = false
 }
 
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
 variable "tags" {
   description = "Tags to apply to all resources."
   type        = map(string)
   default     = {}
 }
 
-variable "docker_image_tag" {
+variable "migration_docker_image_tag" {
   description = "Docker image tag for the migration handler. Defaults to the tag built by the Nx docker target."
   type        = string
   default     = "proj-db-migration:latest"
 }
 
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
@@ -1793,10 +1657,12 @@ resource "random_string" "suffix" {
 }
 
 locals {
-  create_db_user_bundle_path = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
-  migration_function_name = "db-migration-\${random_string.suffix.result}"
+  config                       = jsondecode(file("\${path.module}/../../../../../../../packages/db/config.json"))
+  runtime_config_key           = local.config.runtimeConfigKey
+  create_db_user_bundle_path   = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
+  migration_function_name      = "db-migration-\${random_string.suffix.result}"
   create_db_user_function_name = "db-create-db-user-\${random_string.suffix.result}"
-  database_runtime_user = "db_\${random_string.suffix.result}"
+  database_runtime_user        = "db_\${random_string.suffix.result}"
 }
 
 module "aurora" {
@@ -1805,7 +1671,6 @@ module "aurora" {
   name                                  = "db"
   vpc_id                                = var.vpc_id
   subnet_ids                            = var.database_subnet_ids
-  lambda_subnet_ids                     = var.lambda_subnet_ids
   engine                                = "aurora-postgresql"
   engine_version                        = var.engine_version
   database_name                         = "database_name"
@@ -1817,11 +1682,11 @@ module "aurora" {
   deletion_protection                   = var.deletion_protection
   skip_final_snapshot                   = var.skip_final_snapshot
   enable_rds_proxy                      = var.enable_rds_proxy
-  enable_credential_rotation            = var.enable_credential_rotation
   enable_cloudwatch_logs                = var.enable_cloudwatch_logs
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
   enable_backup                         = var.enable_backup
+  enable_key_rotation                   = var.enable_key_rotation
   tags                                  = var.tags
 }
 
@@ -1862,7 +1727,7 @@ module "add_rdb_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
   namespace = "database"
-  key       = "Db"
+  key       = local.runtime_config_key
   value = {
     hostname  = module.aurora.cluster_endpoint
     port      = module.aurora.cluster_port
@@ -1875,9 +1740,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "db-migration-\${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -1925,22 +1789,34 @@ resource "aws_ecr_repository_policy" "migration_handler" {
 }
 
 data "external" "docker_digest" {
-  program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
+  program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.migration_docker_image_tag} --format '{{.Id}}')'\\"}' "]
+}
+
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
 }
 
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
-    docker_image_tag = var.docker_image_tag
+    migration_docker_image_tag = var.migration_docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region \${data.aws_region.current.region} | docker login --username AWS --password-stdin \${self.triggers.repository_url}
-      docker tag \${self.triggers.docker_image_tag} \${self.triggers.repository_url}:latest
-      docker push \${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
+      docker tag "$MIGRATION_DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      MIGRATION_DOCKER_IMAGE_TAG = self.triggers.migration_docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -1989,11 +1865,16 @@ resource "aws_iam_role_policy" "migration_handler_access" {
       {
         Effect = "Allow"
         Action = [
-          "rds-db:connect"
+          "secretsmanager:GetSecretValue"
         ]
-        Resource = [
-          "arn:aws:rds-db:\${data.aws_region.current.region}:\${data.aws_caller_identity.current.account_id}:dbuser:\${var.enable_rds_proxy ? module.aurora.proxy_resource_id : module.aurora.cluster_resource_id}/\${local.database_runtime_user}"
+        Resource = [module.aurora.secret_arn]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "kms:Decrypt"
         ]
+        Resource = [module.aurora.kms_key_arn]
       }
     ]
   })
@@ -2082,7 +1963,7 @@ resource "aws_security_group" "migration_handler" {
 
 resource "aws_vpc_security_group_egress_rule" "migration_handler_to_database" {
   security_group_id            = aws_security_group.migration_handler.id
-  referenced_security_group_id = module.aurora.security_group_id
+  referenced_security_group_id = module.aurora.database_security_group_id
   from_port   = module.aurora.cluster_port
   to_port     = module.aurora.cluster_port
   ip_protocol = "tcp"
@@ -2124,7 +2005,7 @@ resource "aws_vpc_security_group_egress_rule" "create_db_user_https" {
 }
 
 resource "aws_vpc_security_group_ingress_rule" "migration_handler_to_database" {
-  security_group_id            = module.aurora.security_group_id
+  security_group_id            = module.aurora.database_security_group_id
   referenced_security_group_id = aws_security_group.migration_handler.id
   from_port                    = module.aurora.cluster_port
   to_port                      = module.aurora.cluster_port
@@ -2169,6 +2050,9 @@ resource "aws_lambda_function" "create_db_user" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
       NODE_EXTRA_CA_CERTS = "/var/runtime/ca-cert.pem"
     }
   }
@@ -2198,10 +2082,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:\${self.triggers.db_user}"}' \\
+        --payload "{\\"RequestType\\":\\"Create\\",\\"PhysicalResourceId\\":\\"db-user:$DB_USER\\"}" \\
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -2211,6 +2095,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -2224,7 +2113,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:\${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]
@@ -2240,10 +2129,10 @@ resource "aws_lambda_function" "migration_handler" {
 
   environment {
     variables = {
-      HOSTNAME = module.aurora.cluster_endpoint
-      DATABASE = module.aurora.database_name
-      PORT     = tostring(module.aurora.cluster_port)
-      DBUSER   = local.database_runtime_user
+      DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
     }
   }
 
@@ -2273,8 +2162,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
         "$output_file")
       cat "$output_file"
@@ -2285,6 +2174,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [
@@ -2315,6 +2208,11 @@ output "proxy_resource_id" {
   value       = module.aurora.proxy_resource_id
 }
 
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = module.aurora.connect_resource_id
+}
+
 output "kms_key_arn" {
   description = "ARN of the KMS key protecting Aurora and the admin credentials secret, used to grant decrypt access alongside secret_arn."
   value       = module.aurora.kms_key_arn
@@ -2349,13 +2247,13 @@ output "database_runtime_user" {
   description = "Application database user created for IAM-authenticated access."
   value       = local.database_runtime_user
 }
-
 "
 `;
 
 exports[`ts#rdb generator > should generate terraform modules with MySQL engine 1`] = `
 "# Core Aurora module
-# This module creates an Aurora cluster and a generated admin secret.
+# This module creates an Aurora cluster whose admin credentials are generated
+# and rotated by RDS in Secrets Manager.
 
 terraform {
   required_version = ">= 1.0"
@@ -2363,15 +2261,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "3.3.1"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "3.9.0"
     }
   }
 }
@@ -2399,11 +2297,6 @@ variable "subnet_ids" {
   type        = list(string)
 }
 
-variable "lambda_subnet_ids" {
-  description = "Subnet IDs for the credential-rotation Lambda. Must have outbound egress to AWS service endpoints (e.g. Secrets Manager) — use private subnets with a NAT gateway."
-  type        = list(string)
-}
-
 variable "engine" {
   description = "Aurora engine to use."
   type        = string
@@ -2473,16 +2366,10 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -2537,11 +2424,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for \${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -2552,6 +2458,8 @@ resource "aws_kms_key" "database" {
   description         = "KMS key for Aurora cluster \${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
+  deletion_window_in_days = 30
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -2579,6 +2487,20 @@ resource "aws_kms_key" "database" {
           "kms:CreateGrant"
         ]
         Resource = "*"
+      },
+      {
+        Sid    = "AllowSecretsManagerService"
+        Effect = "Allow"
+        Principal = {
+          Service = "secretsmanager.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
       }
     ]
   })
@@ -2633,44 +2555,16 @@ resource "aws_db_subnet_group" "database" {
   })
 }
 
-resource "random_password" "master_password" {
-  length           = 32
-  special          = true
-  override_special = "!#$%&*()-_=+[]{}<>:?"
-}
-
-resource "aws_secretsmanager_secret" "credentials" {
-  #checkov:skip=CKV2_AWS_57:Rotation is configured via aws_cloudformation_stack.credentials_rotation using the AWS::SecretsManager-2024-09-16 transform; Checkov cannot resolve rotation schedules created by CloudFormation transforms
-  name_prefix = "\${var.name}-aurora-credentials-"
-  kms_key_id  = aws_kms_key.database.arn
-
-  tags = merge(var.tags, {
-    Name = "\${var.name}-aurora-credentials"
-  })
-}
-
-resource "aws_secretsmanager_secret_version" "credentials" {
-  secret_id = aws_secretsmanager_secret.credentials.id
-  secret_string = jsonencode({
-    engine              = var.engine == "aurora-mysql" ? "mysql" : "postgres"
-    username            = var.admin_user
-    password            = random_password.master_password.result
-    host                = aws_rds_cluster.database.endpoint
-    port                = aws_rds_cluster.database.port
-    dbname              = var.database_name
-    dbClusterIdentifier = aws_rds_cluster.database.cluster_identifier
-  })
-}
-
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
   cluster_identifier                  = local.cluster_name
   engine                              = var.engine
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
   master_username                     = var.admin_user
-  master_password                     = random_password.master_password.result
+  manage_master_user_password         = true
+  master_user_secret_kms_key_id       = aws_kms_key.database.arn
   db_subnet_group_name                = aws_db_subnet_group.database.name
   db_cluster_parameter_group_name     = var.enable_cloudwatch_logs ? aws_rds_cluster_parameter_group.database[0].name : null
   vpc_security_group_ids              = [aws_security_group.database.id]
@@ -2684,7 +2578,7 @@ resource "aws_rds_cluster" "database" {
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity
@@ -2694,6 +2588,10 @@ resource "aws_rds_cluster" "database" {
   tags = merge(var.tags, {
     Name = "\${var.name}-aurora"
   })
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 resource "aws_rds_cluster_instance" "database" {
@@ -2718,75 +2616,6 @@ resource "aws_rds_cluster_instance" "database" {
   })
 }
 
-resource "aws_security_group" "rotation" {
-  #checkov:skip=CKV2_AWS_5:Security group is attached to the hosted rotation Lambda created by AWS::SecretsManager::RotationSchedule; Checkov cannot resolve resources created by the CloudFormation transform
-  count       = var.enable_credential_rotation ? 1 : 0
-  name_prefix = "\${var.name}-aurora-rotation-"
-  description = "Security group for Aurora secret rotation \${var.name}"
-  vpc_id      = var.vpc_id
-
-  tags = merge(var.tags, {
-    Name = "\${var.name}-aurora-rotation"
-  })
-}
-
-resource "aws_vpc_security_group_egress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.rotation[0].id
-  referenced_security_group_id = aws_security_group.database.id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow outbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.database.id
-  referenced_security_group_id = aws_security_group.rotation[0].id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow inbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_cloudformation_stack" "credentials_rotation" {
-  #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
-  count = var.enable_credential_rotation ? 1 : 0
-  name  = "\${local.cluster_name}-credentials-rotation"
-
-  capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
-
-  template_body = jsonencode({
-    AWSTemplateFormatVersion = "2010-09-09"
-    Transform                = "AWS::SecretsManager-2024-09-16"
-    Resources = {
-      CredentialsRotationSchedule = {
-        Type = "AWS::SecretsManager::RotationSchedule"
-        Properties = {
-          SecretId = aws_secretsmanager_secret.credentials.arn
-          HostedRotationLambda = {
-            RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "\${local.cluster_name}-credentials-rotation"
-            VpcSecurityGroupIds = aws_security_group.rotation[0].id
-            VpcSubnetIds        = join(",", var.lambda_subnet_ids)
-          }
-          RotationRules = {
-            AutomaticallyAfterDays = 30
-          }
-        }
-      }
-    }
-  })
-
-  depends_on = [
-    aws_secretsmanager_secret_version.credentials,
-    aws_rds_cluster_instance.database,
-    aws_vpc_security_group_egress_rule.rotation_to_database,
-    aws_vpc_security_group_ingress_rule.rotation_to_database,
-  ]
-}
-
 resource "aws_iam_role" "proxy" {
   count = var.enable_rds_proxy ? 1 : 0
 
@@ -2810,27 +2639,6 @@ resource "aws_iam_role" "proxy" {
   })
 }
 
-resource "aws_iam_role_policy" "proxy_secret_access" {
-  count = var.enable_rds_proxy ? 1 : 0
-  role  = aws_iam_role.proxy[0].name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect   = "Allow"
-        Action   = ["secretsmanager:GetSecretValue"]
-        Resource = [aws_secretsmanager_secret.credentials.arn]
-      },
-      {
-        Effect   = "Allow"
-        Action   = ["kms:Decrypt"]
-        Resource = [aws_kms_key.database.arn]
-      }
-    ]
-  })
-}
-
 resource "aws_security_group" "proxy" {
   #checkov:skip=CKV2_AWS_5:Security group is attached to aws_db_proxy.aurora; Checkov cannot resolve count-conditional cross-resource references
   count = var.enable_rds_proxy ? 1 : 0
@@ -2854,17 +2662,6 @@ resource "aws_db_proxy" "aurora" {
   vpc_subnet_ids         = var.subnet_ids
   vpc_security_group_ids = [aws_security_group.proxy[0].id]
   require_tls            = true
-
-  auth {
-    auth_scheme = "SECRETS"
-    iam_auth    = "REQUIRED"
-    secret_arn  = aws_secretsmanager_secret.credentials.arn
-  }
-
-  depends_on = [
-    aws_iam_role_policy.proxy_secret_access,
-    aws_secretsmanager_secret_version.credentials,
-  ]
 }
 
 resource "aws_db_proxy_default_target_group" "default" {
@@ -2896,9 +2693,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \\
-          --region \${data.aws_region.current.region} \\
-          --db-proxy-name \${self.triggers.db_proxy_name} \\
-          --target-group-name \${self.triggers.target_group_name} \\
+          --region "$AWS_REGION" \\
+          --db-proxy-name "$DB_PROXY_NAME" \\
+          --target-group-name "$TARGET_GROUP_NAME" \\
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \\
           --output text)
 
@@ -2908,13 +2705,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target \${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -3041,11 +2844,21 @@ output "proxy_resource_id" {
   value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : null
 }
 
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : aws_rds_cluster.database.cluster_resource_id
+}
+
 output "cluster_endpoint" {
   description = "Writer endpoint of the Aurora cluster or proxy."
   value       = var.enable_rds_proxy ? aws_db_proxy.aurora[0].endpoint : aws_rds_cluster.database.endpoint
 }
 
+output "writer_endpoint" {
+  description = "Writer endpoint of the Aurora cluster itself, bypassing the RDS Proxy. Used by the admin-credentialled handlers, which connect directly to the cluster."
+  value       = aws_rds_cluster.database.endpoint
+}
+
 output "reader_endpoint" {
   description = "Reader endpoint of the Aurora cluster."
   value       = aws_rds_cluster.database.reader_endpoint
@@ -3072,12 +2885,12 @@ output "proxy_role_name" {
 }
 
 output "secret_arn" {
-  description = "ARN of the generated admin credentials secret."
-  value       = aws_secretsmanager_secret.credentials.arn
+  description = "ARN of the RDS-managed admin credentials secret. Its value is a JSON object with username and password only — connection details come from this module's other outputs."
+  value       = one(aws_rds_cluster.database.master_user_secret[*].secret_arn)
 }
 
 output "kms_key_arn" {
-  description = "ARN of the KMS key protecting Aurora and the generated secret."
+  description = "ARN of the KMS key protecting Aurora and its admin credentials secret."
   value       = aws_kms_key.database.arn
 }
 
@@ -3102,8 +2915,8 @@ output "database_name" {
 }
 
 output "admin_user" {
-  description = "Admin username stored in the generated secret."
-  value       = jsondecode(aws_secretsmanager_secret_version.credentials.secret_string).username
+  description = "Admin username stored in the RDS-managed credentials secret."
+  value       = aws_rds_cluster.database.master_username
 }
 "
 `;
@@ -3115,19 +2928,23 @@ exports[`ts#rdb generator > should generate terraform modules with MySQL engine
   required_providers {
     archive = {
       source  = "hashicorp/archive"
-      version = "~> 2.5"
+      version = "2.8.0"
     }
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "6.62.0"
+    }
+    external = {
+      source  = "hashicorp/external"
+      version = "2.4.1"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "3.3.1"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "3.9.0"
     }
   }
 }
@@ -3195,16 +3012,10 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -3225,18 +3036,25 @@ variable "enable_backup" {
   default     = false
 }
 
+variable "enable_key_rotation" {
+  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."
+  type        = bool
+  default     = true
+}
+
 variable "tags" {
   description = "Tags to apply to all resources."
   type        = map(string)
   default     = {}
 }
 
-variable "docker_image_tag" {
+variable "migration_docker_image_tag" {
   description = "Docker image tag for the migration handler. Defaults to the tag built by the Nx docker target."
   type        = string
   default     = "proj-db-migration:latest"
 }
 
+
 variable "asset_bucket_name" {
   description = "Name of the shared asset S3 bucket used to stage the Lambda deployment zip. Instantiate the \`core/asset-bucket\` module once per deployment and pass its \`bucket_name\` output here."
   type        = string
@@ -3252,10 +3070,12 @@ resource "random_string" "suffix" {
 }
 
 locals {
-  create_db_user_bundle_path = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
-  migration_function_name = "db-migration-\${random_string.suffix.result}"
+  config                       = jsondecode(file("\${path.module}/../../../../../../../packages/db/config.json"))
+  runtime_config_key           = local.config.runtimeConfigKey
+  create_db_user_bundle_path   = "\${path.module}/../../../../../../../dist/packages/db/bundle/create-db-user"
+  migration_function_name      = "db-migration-\${random_string.suffix.result}"
   create_db_user_function_name = "db-create-db-user-\${random_string.suffix.result}"
-  database_runtime_user = "db_\${random_string.suffix.result}"
+  database_runtime_user        = "db_\${random_string.suffix.result}"
 }
 
 module "aurora" {
@@ -3264,7 +3084,6 @@ module "aurora" {
   name                                  = "db"
   vpc_id                                = var.vpc_id
   subnet_ids                            = var.database_subnet_ids
-  lambda_subnet_ids                     = var.lambda_subnet_ids
   engine                                = "aurora-mysql"
   engine_version                        = var.engine_version
   database_name                         = "database_name"
@@ -3276,11 +3095,11 @@ module "aurora" {
   deletion_protection                   = var.deletion_protection
   skip_final_snapshot                   = var.skip_final_snapshot
   enable_rds_proxy                      = var.enable_rds_proxy
-  enable_credential_rotation            = var.enable_credential_rotation
   enable_cloudwatch_logs                = var.enable_cloudwatch_logs
   enable_performance_insights           = var.enable_performance_insights
   performance_insights_retention_period = var.performance_insights_retention_period
   enable_backup                         = var.enable_backup
+  enable_key_rotation                   = var.enable_key_rotation
   tags                                  = var.tags
 }
 
@@ -3321,7 +3140,7 @@ module "add_rdb_to_runtime_config" {
   source = "../../../core/runtime-config/entry"
 
   namespace = "database"
-  key       = "Db"
+  key       = local.runtime_config_key
   value = {
     hostname  = module.aurora.cluster_endpoint
     port      = module.aurora.cluster_port
@@ -3334,9 +3153,8 @@ module "add_rdb_to_runtime_config" {
 
 resource "aws_ecr_repository" "migration_handler" {
   #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  #checkov:skip=CKV_AWS_51:Mutable tags are intentional; the migration handler is always pushed as latest and redeployment is gated on docker_digest changes in null_resource.docker_publish
   name                 = "db-migration-\${random_string.suffix.result}"
-  image_tag_mutability = "MUTABLE"
+  image_tag_mutability = "IMMUTABLE"
   force_delete         = true
 
   image_scanning_configuration {
@@ -3384,22 +3202,34 @@ resource "aws_ecr_repository_policy" "migration_handler" {
 }
 
 data "external" "docker_digest" {
-  program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
+  program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.migration_docker_image_tag} --format '{{.Id}}')'\\"}' "]
+}
+
+locals {
+  # Content-based, immutable image tag derived from the local image digest
+  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
 }
 
 resource "null_resource" "docker_publish" {
   triggers = {
     docker_digest    = data.external.docker_digest.result.digest
     repository_url   = aws_ecr_repository.migration_handler.repository_url
-    docker_image_tag = var.docker_image_tag
+    migration_docker_image_tag = var.migration_docker_image_tag
+    image_tag        = local.image_tag
   }
 
   provisioner "local-exec" {
     command = <<-EOT
-      aws ecr get-login-password --region \${data.aws_region.current.region} | docker login --username AWS --password-stdin \${self.triggers.repository_url}
-      docker tag \${self.triggers.docker_image_tag} \${self.triggers.repository_url}:latest
-      docker push \${self.triggers.repository_url}:latest
+      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
+      docker tag "$MIGRATION_DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
+      docker push "$REPOSITORY_URL:$IMAGE_TAG"
     EOT
+    environment = {
+      AWS_REGION       = data.aws_region.current.region
+      REPOSITORY_URL   = self.triggers.repository_url
+      MIGRATION_DOCKER_IMAGE_TAG = self.triggers.migration_docker_image_tag
+      IMAGE_TAG        = self.triggers.image_tag
+    }
   }
 
   depends_on = [aws_ecr_repository_policy.migration_handler]
@@ -3633,6 +3463,9 @@ resource "aws_lambda_function" "create_db_user" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
       NODE_EXTRA_CA_CERTS = "/var/runtime/ca-cert.pem"
     }
   }
@@ -3662,10 +3495,10 @@ resource "null_resource" "create_db_user_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
-        --payload '{"RequestType":"Create","PhysicalResourceId":"db-user:\${self.triggers.db_user}"}' \\
+        --payload "{\\"RequestType\\":\\"Create\\",\\"PhysicalResourceId\\":\\"db-user:$DB_USER\\"}" \\
         "$output_file")
       cat "$output_file"
       echo "$response"
@@ -3675,6 +3508,11 @@ resource "null_resource" "create_db_user_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+      DB_USER       = self.triggers.db_user
+    }
   }
 
   depends_on = [aws_lambda_function.create_db_user, module.aurora]
@@ -3688,7 +3526,7 @@ resource "aws_lambda_function" "migration_handler" {
   package_type  = "Image"
   function_name = local.migration_function_name
   role          = aws_iam_role.migration_handler.arn
-  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:latest"
+  image_uri     = "\${aws_ecr_repository.migration_handler.repository_url}:\${local.image_tag}"
   memory_size   = 1024
   timeout       = 300
   architectures = ["arm64"]
@@ -3705,6 +3543,9 @@ resource "aws_lambda_function" "migration_handler" {
   environment {
     variables = {
       DATABASE_SECRET_ARN = module.aurora.secret_arn
+      DATABASE_HOST       = module.aurora.writer_endpoint
+      DATABASE_PORT       = module.aurora.cluster_port
+      DATABASE_NAME       = module.aurora.database_name
     }
   }
 
@@ -3733,8 +3574,8 @@ resource "null_resource" "migration_trigger" {
     command = <<-EOT
       output_file=$(mktemp)
       response=$(aws lambda invoke \\
-        --region \${data.aws_region.current.region} \\
-        --function-name \${self.triggers.function_name} \\
+        --region "$AWS_REGION" \\
+        --function-name "$FUNCTION_NAME" \\
         --cli-binary-format raw-in-base64-out \\
         "$output_file")
       cat "$output_file"
@@ -3745,6 +3586,10 @@ resource "null_resource" "migration_trigger" {
       fi
       rm -f "$output_file"
     EOT
+    environment = {
+      AWS_REGION    = data.aws_region.current.region
+      FUNCTION_NAME = self.triggers.function_name
+    }
   }
 
   depends_on = [
@@ -3775,6 +3620,11 @@ output "proxy_resource_id" {
   value       = module.aurora.proxy_resource_id
 }
 
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = module.aurora.connect_resource_id
+}
+
 output "kms_key_arn" {
   description = "ARN of the KMS key protecting Aurora and the admin credentials secret, used to grant decrypt access alongside secret_arn."
   value       = module.aurora.kms_key_arn
@@ -3809,7 +3659,6 @@ output "database_runtime_user" {
   description = "Application database user created for IAM-authenticated access."
   value       = local.database_runtime_user
 }
-
 "
 `;
 
@@ -3835,139 +3684,6 @@ datasource db {
 "
 `;
 
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/scripts/pull-image.ts 1`] = `
-"import { spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-const image = process.argv[2];
-
-const inspect = spawnSync(ENGINE, ['image', 'inspect', image], {
-  stdio: 'ignore',
-});
-
-if (inspect.status !== 0) {
-  const pull = spawnSync(ENGINE, ['pull', image], { stdio: 'inherit' });
-  if (pull.status !== 0) {
-    process.exit(pull.status ?? 1);
-  }
-}
-"
-`;
-
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/scripts/start-container.ts 1`] = `
-"import { spawn, spawnSync } from 'child_process';
-
-const ENGINE = 'docker';
-
-const [containerName, image, hostPort, dbName, dbUser, dbPassword] =
-  process.argv.slice(2);
-
-const containerExists = (): boolean =>
-  spawnSync(ENGINE, ['container', 'inspect', containerName], {
-    stdio: 'ignore',
-  }).status === 0;
-
-const isRunning = (): boolean => {
-  const result = spawnSync(
-    ENGINE,
-    ['container', 'inspect', '-f', '{{.State.Running}}', containerName],
-    { encoding: 'utf-8' },
-  );
-  return result.status === 0 && result.stdout.trim() === 'true';
-};
-
-if (containerExists()) {
-  if (!isRunning()) {
-    const start = spawnSync(ENGINE, ['start', containerName], {
-      stdio: 'inherit',
-    });
-    if (start.status !== 0) process.exit(start.status ?? 1);
-  }
-} else {
-  const runArgs = (
-    \`run --rm --name \${containerName}\` +
-    \` -e POSTGRES_DB=\${dbName}\` +
-    \` -e POSTGRES_USER=\${dbUser}\` +
-    \` -e POSTGRES_PASSWORD=\${dbPassword}\` +
-    \` -e PGDATA=/var/lib/postgresql/17/docker\` +
-    \` -p \${hostPort}:5432\` +
-    \` -v \${containerName}-data:/var/lib/postgresql\` +
-    \` -d \${image}\`
-  ).split(' ');
-  const create = spawnSync(ENGINE, runArgs, { stdio: 'inherit' });
-  if (create.status !== 0) process.exit(create.status ?? 1);
-}
-
-const logs = spawn(ENGINE, ['logs', '-f', containerName], {
-  stdio: ['ignore', 'inherit', 'inherit'],
-});
-
-let exiting = false;
-
-const cleanup = () => {
-  if (exiting) return;
-  exiting = true;
-  spawnSync(ENGINE, ['stop', containerName], { stdio: 'ignore' });
-  logs.kill();
-  process.exit(0);
-};
-
-process.on('SIGTERM', cleanup);
-process.on('SIGINT', cleanup);
-process.on('SIGHUP', cleanup);
-
-logs.on('exit', (code) => {
-  if (!exiting) process.exit(code ?? 0);
-});
-"
-`;
-
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/scripts/wait-for-db.ts 1`] = `
-"import { Client } from 'pg';
-
-const noop = () => undefined;
-
-const [portArg, dbArg, userArg, passwordArg] = process.argv.slice(2);
-const timeoutAt = Date.now() + 60000;
-
-while (Date.now() < timeoutAt) {
-  const client = new Client({
-    host: 'localhost',
-    port: parseInt(portArg),
-    user: userArg,
-    password: passwordArg,
-    database: dbArg,
-    connectionTimeoutMillis: 500,
-  });
-  client.on('error', noop);
-  try {
-    await client.connect();
-    await client.end();
-    console.log('Database is ready.');
-    process.exit(0);
-  } catch {
-    console.log('Database is not ready.');
-    await client.end().catch(noop);
-  }
-  await new Promise((r) => setTimeout(r, 200));
-}
-
-throw new Error(\`Timed out waiting for postgres on port \${portArg}\`);
-"
-`;
-
-exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/constants.ts 1`] = `
-"export const DB_PACKAGE_NAME = 'Db';
-
-// Local development connection details (used when SERVE_LOCAL=true, see serve-local Nx target)
-export const LOCAL_DB_PORT = 5432;
-export const LOCAL_DB_HOST = 'localhost';
-export const LOCAL_DB_NAME = 'database_name';
-export const LOCAL_DB_USER = 'dbadmin';
-export const LOCAL_DB_PASSWORD = 'password';
-"
-`;
-
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/create-db-user-handler.ts 1`] = `
 "import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
 import { randomBytes } from 'node:crypto';
@@ -4017,14 +3733,12 @@ const ensureDatabaseUser = async (dbUser: string): Promise<void> => {
 
     await client.query(
       \`ALTER ROLE \${quotedDbUser} WITH LOGIN;
-      GRANT ALL PRIVILEGES ON DATABASE \${quotedDbName} TO \${quotedDbUser};
-      GRANT USAGE, CREATE ON SCHEMA public TO \${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO \${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO \${quotedDbUser};
-      GRANT ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public TO \${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO \${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON SEQUENCES TO \${quotedDbUser};
-      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL PRIVILEGES ON FUNCTIONS TO \${quotedDbUser};
+      GRANT CONNECT ON DATABASE \${quotedDbName} TO \${quotedDbUser};
+      GRANT USAGE ON SCHEMA public TO \${quotedDbUser};
+      GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \${quotedDbUser};
+      GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO \${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO \${quotedDbUser};
+      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO \${quotedDbUser};
       GRANT rds_iam TO \${quotedDbUser};\`,
     );
 
@@ -4059,43 +3773,33 @@ export const handler = async (
 `;
 
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/index.ts 1`] = `
-"export { DB_PACKAGE_NAME } from './constants.js';
-export { getPrisma } from './prisma.js';
+"export * from './prisma.js';
+// Export your library code here
 "
 `;
 
 exports[`ts#rdb generator > should generate the aurora shared construct > packages/db/src/migration-handler.ts 1`] = `
 "import { execFile } from 'node:child_process';
+import { join } from 'node:path';
 import { promisify } from 'node:util';
-import { Signer } from '@aws-sdk/rds-signer';
-import { withConnectionRetry } from './utils.js';
+import { getDatabaseSecret, withConnectionRetry } from './utils.js';
 
 const buildDatabaseUrl = async (): Promise<string> => {
-  const hostname = process.env.HOSTNAME!;
-  const port = process.env.PORT!;
-  const database = process.env.DATABASE!;
-  const dbUser = process.env.DBUSER!;
-  const region = process.env.AWS_REGION!;
-
-  const iamAuthToken = await new Signer({
-    hostname,
-    port: Number(port),
-    region,
-    username: dbUser,
-  }).getAuthToken();
+  const { host, port, dbname, username, password } = await getDatabaseSecret();
 
   return (
-    \`postgresql://\${encodeURIComponent(dbUser)}\` +
-    \`:\${encodeURIComponent(iamAuthToken)}\` +
-    \`@\${hostname}:\${port}/\${database}\` +
-    \`?sslaccept=strict\` // \`sslaccept\` is the correct parameter here for postgresql. The Prisma CLI Rust engine does not use the standard libpq \`sslmode\` option.
+    \`postgresql://\${encodeURIComponent(username)}\` +
+    \`:\${encodeURIComponent(password)}\` +
+    \`@\${host}:\${port}/\${dbname}\` +
+    \`?sslaccept=strict\`
   );
 };
 
 export const handler = async () => {
   await withConnectionRetry(async () => {
     const databaseUrl = await buildDatabaseUrl();
-    await promisify(execFile)('npx', ['prisma', 'migrate', 'deploy'], {
+    const prisma = join(__dirname, 'node_modules', '.bin', 'prisma');
+    await promisify(execFile)(prisma, ['migrate', 'deploy'], {
       cwd: __dirname,
       env: {
         ...process.env,
@@ -4112,16 +3816,19 @@ exports[`ts#rdb generator > should generate the aurora shared construct > packag
 import { Signer } from '@aws-sdk/rds-signer';
 import { Prisma, PrismaClient } from '../generated/prisma/client.js';
 import { Pool } from 'pg';
-import {
-  DB_PACKAGE_NAME,
-  LOCAL_DB_HOST,
-  LOCAL_DB_NAME,
-  LOCAL_DB_PASSWORD,
-  LOCAL_DB_PORT,
-  LOCAL_DB_USER,
-} from './constants.js';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
 import { getDatabaseConfig } from './utils.js';
 
+// Generated: must match runtimeConfigKey in config.json
+const runtimeConfigKey = 'Db';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// config.json is only present in local dev (not included in the deployed bundle); guard with LOCAL_DEV check
+const localDev = () =>
+  JSON.parse(readFileSync(join(__dirname, '../config.json'), 'utf-8')).localDev;
+
 let prismaClient: PrismaClient<Prisma.LogLevel> | undefined;
 
 export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
@@ -4129,14 +3836,15 @@ export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
 ): Promise<PrismaClient<LogOpts>> => {
   if (prismaClient) return prismaClient;
 
-  if (process.env.SERVE_LOCAL === 'true') {
+  if (process.env.LOCAL_DEV === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = localDev();
     const adapter = new PrismaPg(
       new Pool({
-        host: LOCAL_DB_HOST,
-        port: LOCAL_DB_PORT,
-        database: LOCAL_DB_NAME,
-        user: LOCAL_DB_USER,
-        password: LOCAL_DB_PASSWORD,
+        host,
+        port,
+        database: dbName,
+        user: dbUser,
+        password: dbPassword,
         allowExitOnIdle: true,
       }),
     );
@@ -4148,7 +3856,7 @@ export const getPrisma = async <LogOpts extends Prisma.LogLevel>(
   }
 
   const { hostname, port, database, dbUser, region } =
-    await getDatabaseConfig(DB_PACKAGE_NAME);
+    await getDatabaseConfig(runtimeConfigKey);
   const adapter = new PrismaPg(
     new Pool({
       host: hostname,
@@ -4204,6 +3912,24 @@ export type DatabaseSecret = {
   port: number;
 };
 
+/**
+ * Connection details for the admin credentials secret. RDS-managed secrets hold
+ * only \`username\` and \`password\`, so the host, port and database name are taken
+ * from the environment when the secret omits them.
+ */
+type SecretConnectionOverrides = Partial<
+  Omit<DatabaseSecret, 'username' | 'password'>
+>;
+
+const connectionOverridesFromEnv = (): SecretConnectionOverrides => {
+  const { DATABASE_HOST, DATABASE_PORT, DATABASE_NAME } = process.env;
+  return {
+    ...(DATABASE_HOST ? { host: DATABASE_HOST } : {}),
+    ...(DATABASE_PORT ? { port: Number(DATABASE_PORT) } : {}),
+    ...(DATABASE_NAME ? { dbname: DATABASE_NAME } : {}),
+  };
+};
+
 const databaseConfigPromises: Record<string, Promise<DatabaseConfig>> = {};
 
 const getSecretValue = async (secretArn: string): Promise<string> => {
@@ -4230,7 +3956,18 @@ export const getDatabaseSecret = async (): Promise<DatabaseSecret> => {
     );
   }
 
-  return JSON.parse(await getSecretValue(secretArn)) as DatabaseSecret;
+  const secret = JSON.parse(await getSecretValue(secretArn)) as DatabaseSecret;
+  const secretWithConnection = { ...secret, ...connectionOverridesFromEnv() };
+
+  for (const key of ['host', 'port', 'dbname'] as const) {
+    if (secretWithConnection[key] == null) {
+      throw new Error(
+        \`Database secret is missing \${key} and no override was provided in the environment.\`,
+      );
+    }
+  }
+
+  return secretWithConnection;
 };
 
 const loadDatabaseConfig = async (
@@ -4278,6 +4015,9 @@ const transientErrorPatterns = [
   'ECONNREFUSED',
   'ENOTFOUND',
   'P1000', // Prisma: authentication failed
+  'P1001', // Prisma: can't reach database server
+  'P1002', // Prisma: database server reached but timed out
+  'P1010', // Prisma: user denied access (IAM auth grant not yet propagated)
   'ER_ACCESS_DENIED_ERROR', // MySQL: access denied
 ];
 
@@ -4338,14 +4078,10 @@ import { CustomResource } from 'aws-cdk-lib';
 import { IConnectable, IVpc, Port, SubnetType } from 'aws-cdk-lib/aws-ec2';
 import { IGrantable, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
 import { Key } from 'aws-cdk-lib/aws-kms';
-import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
 import {
   Architecture,
-  Code,
-  DockerImageCode,
-  DockerImageFunction,
   Function,
-  Runtime,
+  FunctionOptions,
   Tracing,
 } from 'aws-cdk-lib/aws-lambda';
 import {
@@ -4461,16 +4197,6 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    */
   readonly runtimeConfigKey: string;
 
-  /**
-   * Migration bundle used to create a migration handler Lambda.
-   */
-  readonly migrationBundleDir: string;
-
-  /**
-   * Bundle used to create or reconcile the application database user.
-   */
-  readonly createDbUserBundleDir: string;
-
   /**
    * Writer instance for the Aurora cluster.
    */
@@ -4510,6 +4236,39 @@ export interface AuroraDatabaseProps extends _AuroraDatabaseProps {
    * @default true
    */
   readonly enableKeyRotation?: boolean;
+
+  /**
+   * Whether to export Aurora engine logs to CloudWatch Logs.
+   * See https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html
+   *
+   * PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables
+   * Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL).
+   * Neither logs statement parameter values, to avoid leaking PII into log data.
+   *
+   * @default true
+   */
+  readonly enableCloudwatchLogs?: boolean;
+
+  /**
+   * Whether to enable Performance Insights on the Aurora writer instance.
+   *
+   * @default true
+   */
+  readonly enablePerformanceInsights?: boolean;
+
+  /**
+   * Minimum Aurora Serverless v2 ACUs.
+   *
+   * @default 0.5
+   */
+  readonly serverlessV2MinCapacity?: number;
+
+  /**
+   * Maximum Aurora Serverless v2 ACUs.
+   *
+   * @default 4
+   */
+  readonly serverlessV2MaxCapacity?: number;
 }
 
 /**
@@ -4530,8 +4289,6 @@ export abstract class AuroraDatabase extends Construct {
       adminUser,
       databaseName,
       runtimeConfigKey,
-      migrationBundleDir,
-      createDbUserBundleDir,
       vpcSubnets,
       writer,
       enableRdsProxy = true,
@@ -4539,6 +4296,10 @@ export abstract class AuroraDatabase extends Construct {
       deletionProtection = true,
       removalPolicy = RemovalPolicy.RETAIN,
       enableKeyRotation = true,
+      enableCloudwatchLogs = true,
+      enablePerformanceInsights = true,
+      serverlessV2MinCapacity = 0.5,
+      serverlessV2MaxCapacity = 4,
       engine,
       engineVersion,
       ...clusterProps
@@ -4554,12 +4315,37 @@ export abstract class AuroraDatabase extends Construct {
       vpc,
       vpcSubnets,
       engine: engine.clusterEngine(engineVersion ?? engine.defaultVersion),
-      writer: writer ?? ClusterInstance.serverlessV2('writer'),
+      serverlessV2MinCapacity,
+      serverlessV2MaxCapacity,
+      writer:
+        writer ??
+        ClusterInstance.serverlessV2('writer', {
+          enablePerformanceInsights,
+          performanceInsightEncryptionKey: enablePerformanceInsights
+            ? key
+            : undefined,
+        }),
       credentials: Credentials.fromGeneratedSecret(adminUser, {
         encryptionKey: key,
       }),
       iamAuthentication: true,
       monitoringInterval: Duration.seconds(5),
+      cloudwatchLogsExports: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? ['audit', 'error']
+          : ['postgresql']
+        : undefined,
+      parameters: enableCloudwatchLogs
+        ? engine.type === 'mysql'
+          ? {
+              server_audit_logging: '1',
+              server_audit_events: 'CONNECT,QUERY_DDL',
+            }
+          : // Only safe statement-at-a-time; a multi-statement batch mixing
+            // DDL with DML (e.g. one \`psql -c "a;b;c"\` call) logs the whole
+            // raw text verbatim, including any literal DML values.
+            { log_statement: 'ddl' }
+        : undefined,
       defaultDatabaseName: databaseName,
       storageEncrypted: true,
       storageEncryptionKey: key,
@@ -4595,23 +4381,23 @@ export abstract class AuroraDatabase extends Construct {
       this.proxy?.endpoint ?? this.cluster.clusterEndpoint.hostname;
     const databasePort = this.cluster.clusterEndpoint.port;
 
-    const createDbUserHandler = new Function(this, 'CreateDbUserHandler', {
-      code: Code.fromAsset(createDbUserBundleDir),
-      handler: 'index.handler',
-      runtime: Runtime.NODEJS_LATEST,
+    const commonProps: FunctionOptions = {
+      vpc,
       timeout: Duration.minutes(5),
       tracing: Tracing.ACTIVE,
-      vpc,
+      architecture: Architecture.ARM_64,
+    };
+
+    const createDbUserHandler = this.createDbUserHandler({
+      ...commonProps,
       vpcSubnets: {
         subnetType: SubnetType.PRIVATE_WITH_EGRESS,
       },
-      environment: {
-        DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-        NODE_EXTRA_CA_CERTS: '/var/runtime/ca-cert.pem',
-      },
-      architecture: Architecture.ARM_64,
     });
-
+    createDbUserHandler.addEnvironment(
+      'DATABASE_SECRET_ARN',
+      this.cluster.secret!.secretArn,
+    );
     this.cluster.connections.allowDefaultPortFrom(
       createDbUserHandler,
       'Allow the create-db-user handler to connect to the database',
@@ -4648,40 +4434,21 @@ export abstract class AuroraDatabase extends Construct {
       region: Stack.of(this).region,
     });
 
-    const migrationHandler = new DockerImageFunction(this, 'MigrationHandler', {
-      code: DockerImageCode.fromImageAsset(migrationBundleDir, {
-        platform: Platform.LINUX_ARM64,
-      }),
+    const migrationHandler = this.createMigrationHandler({
+      ...commonProps,
       memorySize: 1024,
-      timeout: Duration.minutes(5),
-      tracing: Tracing.ACTIVE,
-      vpc,
-      environment:
-        engine.type === 'mysql'
-          ? {
-              DATABASE_SECRET_ARN: this.cluster.secret!.secretArn,
-            }
-          : {
-              HOSTNAME: databaseHostname,
-              DATABASE: databaseName,
-              PORT: databasePort.toString(),
-              DBUSER: this.dbUser,
-            },
-      architecture: Architecture.ARM_64,
     });
+    migrationHandler.addEnvironment(
+      'DATABASE_SECRET_ARN',
+      this.cluster.secret!.secretArn,
+    );
+    this.cluster.connections.allowDefaultPortFrom(migrationHandler);
+    this.grantSecretRead(migrationHandler);
 
-    if (engine.type === 'mysql') {
-      this.cluster.connections.allowDefaultPortFrom(migrationHandler);
-      this.grantSecretRead(migrationHandler);
-    } else {
-      this.allowDefaultPortFrom(migrationHandler);
-      this.grantConnect(migrationHandler);
-    }
-
-    const trigger = new Trigger(this, 'MigrationTrigger', {
+    const migrationTrigger = new Trigger(this, 'MigrationTrigger', {
       handler: migrationHandler,
     });
-    trigger.node.addDependency(createDbUserResource);
+    migrationTrigger.node.addDependency(createDbUserResource);
 
     new CfnOutput(this, 'ClusterEndpoint', {
       value: this.cluster.clusterEndpoint.hostname,
@@ -4694,6 +4461,18 @@ export abstract class AuroraDatabase extends Construct {
     }
   }
 
+  /**
+   * Creates the Lambda handler used to create or reconcile the application database user.
+   */
+  protected abstract createDbUserHandler(baseProps: FunctionOptions): Function;
+
+  /**
+   * Creates the Lambda handler used to run database migrations.
+   */
+  protected abstract createMigrationHandler(
+    baseProps: FunctionOptions,
+  ): Function;
+
   public allowDefaultPortFrom(other: IConnectable, description?: string): void {
     if (this.proxy) {
       this.proxy.connections.allowFrom(
@@ -4722,8 +4501,17 @@ export abstract class AuroraDatabase extends Construct {
 exports[`ts#rdb generator > should generate the aurora shared construct 2`] = `
 "import * as path from 'path';
 import * as url from 'url';
+import { readFileSync } from 'fs';
 import { Construct } from 'constructs';
-import { DB_PACKAGE_NAME } from ':proj/db';
+import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
+import {
+  Code,
+  DockerImageCode,
+  DockerImageFunction,
+  Function,
+  FunctionOptions,
+  Runtime,
+} from 'aws-cdk-lib/aws-lambda';
 import {
   AuroraDatabase,
   AuroraDatabaseEngines,
@@ -4731,14 +4519,29 @@ import {
 } from '../../core/rdb/aurora.js';
 import { findWorkspaceRoot } from '../../core/workspace.js';
 
+const { runtimeConfigKey } = JSON.parse(
+  readFileSync(
+    path.join(
+      findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+      'packages/db/config.json',
+    ),
+    'utf-8',
+  ),
+) as { runtimeConfigKey: string };
+
+const migrationBundleDir = path.join(
+  findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+  'dist/packages/db/bundle/migration',
+);
+
+const createDbUserBundleDir = path.join(
+  findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
+  'dist/packages/db/bundle/create-db-user',
+);
+
 export type DbProps = Omit<
   AuroraDatabaseProps,
-  | 'databaseName'
-  | 'adminUser'
-  | 'createDbUserBundleDir'
-  | 'engine'
-  | 'runtimeConfigKey'
-  | 'migrationBundleDir'
+  'databaseName' | 'adminUser' | 'runtimeConfigKey' | 'engine'
 >;
 
 /**
@@ -4750,35 +4553,47 @@ export class Db extends AuroraDatabase {
       ...props,
       databaseName: 'database_name',
       adminUser: 'databaseUser',
-      runtimeConfigKey: DB_PACKAGE_NAME,
-      migrationBundleDir: path.join(
-        findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
-        'dist/packages/db/bundle/migration',
-      ),
-      createDbUserBundleDir: path.join(
-        findWorkspaceRoot(url.fileURLToPath(new URL(import.meta.url))),
-        'dist/packages/db/bundle/create-db-user',
-      ),
+      runtimeConfigKey,
       engine: AuroraDatabaseEngines.postgres({}),
     });
   }
+
+  protected override createDbUserHandler(baseProps: FunctionOptions): Function {
+    return new Function(this, 'CreateDbUserHandler', {
+      ...baseProps,
+      code: Code.fromAsset(createDbUserBundleDir),
+      handler: 'index.handler',
+      runtime: Runtime.NODEJS_24_X,
+      environment: {
+        NODE_EXTRA_CA_CERTS: '/var/runtime/ca-cert.pem',
+      },
+    });
+  }
+
+  protected override createMigrationHandler(
+    baseProps: FunctionOptions,
+  ): Function {
+    return new DockerImageFunction(this, 'MigrationHandler', {
+      ...baseProps,
+      code: DockerImageCode.fromImageAsset(migrationBundleDir, {
+        platform: Platform.LINUX_ARM64,
+      }),
+    });
+  }
 }
 "
 `;
 
 exports[`ts#rdb generator > should generate the aurora shared construct 3`] = `
 "import { defineConfig } from 'prisma/config';
+import { readFileSync } from 'fs';
 
 const getDatabaseUrl = async () => {
-  if (process.env.SERVE_LOCAL === 'true') {
-    const {
-      LOCAL_DB_HOST,
-      LOCAL_DB_NAME,
-      LOCAL_DB_PASSWORD,
-      LOCAL_DB_PORT,
-      LOCAL_DB_USER,
-    } = await import('./src/constants.js');
-    return \`postgresql://\${LOCAL_DB_USER}:\${LOCAL_DB_PASSWORD}@\${LOCAL_DB_HOST}:\${LOCAL_DB_PORT}/\${LOCAL_DB_NAME}\`;
+  if (process.env.LOCAL_DEV === 'true') {
+    const { host, port, dbName, dbUser, dbPassword } = JSON.parse(
+      readFileSync('config.json', 'utf-8'),
+    ).localDev;
+    return \`postgresql://\${dbUser}:\${dbPassword}@\${host}:\${port}/\${dbName}\`;
   }
   return process.env.DATABASE_URL;
 };
@@ -4798,9 +4613,27 @@ export default defineConfig({
 exports[`ts#rdb generator > should generate the aurora shared construct 4`] = `
 "FROM public.ecr.aws/lambda/nodejs:24
 
+# Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
+RUN npm install -g npm@12.0.2
+
+# Patch OS packages beyond the base image's pinned release, and drop the
+# runtime's convenience copy of the AWS SDK (the handler bundle inlines its
+# own dependencies), keeping the image free of known HIGH/CRITICAL
+# vulnerabilities
+RUN microdnf upgrade -y --releasever latest && microdnf clean all \\
+    && rm -rf /var/runtime/node_modules/@aws-sdk
+
 WORKDIR \${LAMBDA_TASK_ROOT}
 
-RUN npm install prisma@7.8.0
+# npm blocks dependency install scripts by default; allow prisma's so its
+# postinstall downloads the schema-engine binary needed to run migrations.
+# npm is removed once prisma is installed — the handler runs prisma's own
+# binary directly, and npm's bundled dependencies would otherwise carry known
+# HIGH/CRITICAL vulnerabilities into the image.
+RUN printf 'allow-scripts[]=prisma\\nallow-scripts[]=@prisma/engines\\n' > .npmrc \\
+    && npm install prisma@7.10.0 \\
+    && rm .npmrc \\
+    && npm uninstall -g npm
 
 COPY index.js ./index.js
 COPY prisma ./prisma
@@ -4824,7 +4657,7 @@ export default defineConfig([
     output: {
       file: '../../dist/packages/db/bundle/migration/index.js',
       format: 'cjs',
-      inlineDynamicImports: true,
+      codeSplitting: false,
     },
     platform: 'node',
   },
@@ -4834,7 +4667,7 @@ export default defineConfig([
     output: {
       file: '../../dist/packages/db/bundle/create-db-user/index.js',
       format: 'cjs',
-      inlineDynamicImports: true,
+      codeSplitting: false,
     },
     platform: 'node',
   },
@@ -4846,6 +4679,7 @@ exports[`ts#rdb generator > should generate the aurora shared construct 6`] = `
 "export * from './rdb/aurora.js';
 export * from './app.js';
 export * from './checkov.js';
+export * from './cloudfront.js';
 export * from './runtime-config.js';
 export * from './workspace.js';
 "