@aws/nx-plugin 1.0.0-rc.9 → 1.0.0-rc.90

package/src/utils/rdb-constructs/files/terraform/core/rdb/aurora/aurora.tf.template

@@ -1,5 +1,6 @@
 # Core Aurora module
-# This module creates an Aurora cluster and a generated admin secret.
+# This module creates an Aurora cluster whose admin credentials are generated
+# and rotated by RDS in Secrets Manager.
 
 terraform {
   required_version = ">= 1.0"
@@ -7,15 +8,15 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.33"
+      version = "<%- awsProviderVersion %>"
     }
     null = {
       source  = "hashicorp/null"
-      version = ">= 3.0"
+      version = "<%- nullProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = ">= 3.0"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -43,11 +44,6 @@ variable "subnet_ids" {
   type        = list(string)
 }
 
-variable "lambda_subnet_ids" {
-  description = "Subnet IDs for the credential-rotation Lambda. Must have outbound egress to AWS service endpoints (e.g. Secrets Manager) — use private subnets with a NAT gateway."
-  type        = list(string)
-}
-
 variable "engine" {
   description = "Aurora engine to use."
   type        = string
@@ -84,13 +80,13 @@ variable "port" {
 variable "serverless_min_capacity" {
   description = "Minimum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 0.5
+  default     = <%= serverlessMinCapacity %>
 }
 
 variable "serverless_max_capacity" {
   description = "Maximum Aurora Serverless v2 ACUs."
   type        = number
-  default     = 4
+  default     = <%= serverlessMaxCapacity %>
 }
 
 variable "instance_count" {
@@ -117,16 +113,10 @@ variable "enable_rds_proxy" {
   default     = true
 }
 
-variable "enable_credential_rotation" {
-  description = "Whether to enable automatic credential rotation for the admin secret."
-  type        = bool
-  default     = true
-}
-
 variable "enable_cloudwatch_logs" {
-  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging."
+  description = "Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "enable_performance_insights" {
@@ -181,11 +171,30 @@ resource "aws_rds_cluster_parameter_group" "database" {
   family      = local.parameter_group_family
   description = "Parameter group for ${var.name} Aurora cluster"
 
+  # Only safe statement-at-a-time; a multi-statement batch mixing DDL with
+  # DML (e.g. one `psql -c "a;b;c"` call) logs the whole raw text verbatim,
+  # including any literal DML values.
   dynamic "parameter" {
     for_each = var.engine == "aurora-postgresql" ? [1] : []
     content {
       name  = "log_statement"
-      value = "all"
+      value = "ddl"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_logging"
+      value = "1"
+    }
+  }
+
+  dynamic "parameter" {
+    for_each = var.engine == "aurora-mysql" ? [1] : []
+    content {
+      name  = "server_audit_events"
+      value = "CONNECT,QUERY_DDL"
     }
   }
 
@@ -196,6 +205,8 @@ resource "aws_kms_key" "database" {
   description         = "KMS key for Aurora cluster ${var.name}"
   enable_key_rotation = var.enable_key_rotation
 
+  deletion_window_in_days = 30
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -223,6 +234,20 @@ resource "aws_kms_key" "database" {
           "kms:CreateGrant"
         ]
         Resource = "*"
+      },
+      {
+        Sid    = "AllowSecretsManagerService"
+        Effect = "Allow"
+        Principal = {
+          Service = "secretsmanager.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
       }
     ]
   })
@@ -277,44 +302,16 @@ resource "aws_db_subnet_group" "database" {
   })
 }
 
-resource "random_password" "master_password" {
-  length           = 32
-  special          = true
-  override_special = "!#$%&*()-_=+[]{}<>:?"
-}
-
-resource "aws_secretsmanager_secret" "credentials" {
-  #checkov:skip=CKV2_AWS_57:Rotation is configured via aws_cloudformation_stack.credentials_rotation using the AWS::SecretsManager-2024-09-16 transform; Checkov cannot resolve rotation schedules created by CloudFormation transforms
-  name_prefix = "${var.name}-aurora-credentials-"
-  kms_key_id  = aws_kms_key.database.arn
-
-  tags = merge(var.tags, {
-    Name = "${var.name}-aurora-credentials"
-  })
-}
-
-resource "aws_secretsmanager_secret_version" "credentials" {
-  secret_id = aws_secretsmanager_secret.credentials.id
-  secret_string = jsonencode({
-    engine              = var.engine == "aurora-mysql" ? "mysql" : "postgres"
-    username            = var.admin_user
-    password            = random_password.master_password.result
-    host                = aws_rds_cluster.database.endpoint
-    port                = aws_rds_cluster.database.port
-    dbname              = var.database_name
-    dbClusterIdentifier = aws_rds_cluster.database.cluster_identifier
-  })
-}
-
 resource "aws_rds_cluster" "database" {
-  #checkov:skip=CKV2_AWS_27:Query logging can be enabled with enable_cloudwatch_logs; this module defaults to CDK-equivalent behavior unless logging is requested
+  #checkov:skip=CKV2_AWS_27:Query logging is enabled by default via enable_cloudwatch_logs; checkov cannot resolve the conditional count expression on aws_rds_cluster_parameter_group.database
   #checkov:skip=CKV_AWS_139:Deletion protection is enabled but checkov is unable to detect it correctly
   cluster_identifier                  = local.cluster_name
   engine                              = var.engine
   engine_version                      = coalesce(var.engine_version, local.default_engine_version)
   database_name                       = var.database_name
   master_username                     = var.admin_user
-  master_password                     = random_password.master_password.result
+  manage_master_user_password         = true
+  master_user_secret_kms_key_id       = aws_kms_key.database.arn
   db_subnet_group_name                = aws_db_subnet_group.database.name
   db_cluster_parameter_group_name     = var.enable_cloudwatch_logs ? aws_rds_cluster_parameter_group.database[0].name : null
   vpc_security_group_ids              = [aws_security_group.database.id]
@@ -328,7 +325,7 @@ resource "aws_rds_cluster" "database" {
   monitoring_interval                 = 5
   monitoring_role_arn                 = aws_iam_role.enhanced_monitoring.arn
   copy_tags_to_snapshot               = true
-  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error", "general", "slowquery"] : ["postgresql"]) : null
+  enabled_cloudwatch_logs_exports     = var.enable_cloudwatch_logs ? (var.engine == "aurora-mysql" ? ["audit", "error"] : ["postgresql"]) : null
 
   serverlessv2_scaling_configuration {
     min_capacity = var.serverless_min_capacity
@@ -338,6 +335,10 @@ resource "aws_rds_cluster" "database" {
   tags = merge(var.tags, {
     Name = "${var.name}-aurora"
   })
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 resource "aws_rds_cluster_instance" "database" {
@@ -362,75 +363,6 @@ resource "aws_rds_cluster_instance" "database" {
   })
 }
 
-resource "aws_security_group" "rotation" {
-  #checkov:skip=CKV2_AWS_5:Security group is attached to the hosted rotation Lambda created by AWS::SecretsManager::RotationSchedule; Checkov cannot resolve resources created by the CloudFormation transform
-  count       = var.enable_credential_rotation ? 1 : 0
-  name_prefix = "${var.name}-aurora-rotation-"
-  description = "Security group for Aurora secret rotation ${var.name}"
-  vpc_id      = var.vpc_id
-
-  tags = merge(var.tags, {
-    Name = "${var.name}-aurora-rotation"
-  })
-}
-
-resource "aws_vpc_security_group_egress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.rotation[0].id
-  referenced_security_group_id = aws_security_group.database.id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow outbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_vpc_security_group_ingress_rule" "rotation_to_database" {
-  count                        = var.enable_credential_rotation ? 1 : 0
-  security_group_id            = aws_security_group.database.id
-  referenced_security_group_id = aws_security_group.rotation[0].id
-  from_port                    = coalesce(var.port, local.default_port)
-  to_port                      = coalesce(var.port, local.default_port)
-  ip_protocol                  = "tcp"
-  description                  = "Allow inbound database traffic from secret rotation Lambda"
-}
-
-resource "aws_cloudformation_stack" "credentials_rotation" {
-  #checkov:skip=CKV_AWS_124:SNS event notifications are not required for the credentials rotation stack
-  count = var.enable_credential_rotation ? 1 : 0
-  name  = "${local.cluster_name}-credentials-rotation"
-
-  capabilities = ["CAPABILITY_IAM", "CAPABILITY_AUTO_EXPAND"]
-
-  template_body = jsonencode({
-    AWSTemplateFormatVersion = "2010-09-09"
-    Transform                = "AWS::SecretsManager-2024-09-16"
-    Resources = {
-      CredentialsRotationSchedule = {
-        Type = "AWS::SecretsManager::RotationSchedule"
-        Properties = {
-          SecretId = aws_secretsmanager_secret.credentials.arn
-          HostedRotationLambda = {
-            RotationType        = var.engine == "aurora-mysql" ? "MySQLSingleUser" : "PostgreSQLSingleUser"
-            RotationLambdaName  = "${local.cluster_name}-credentials-rotation"
-            VpcSecurityGroupIds = aws_security_group.rotation[0].id
-            VpcSubnetIds        = join(",", var.lambda_subnet_ids)
-          }
-          RotationRules = {
-            AutomaticallyAfterDays = 30
-          }
-        }
-      }
-    }
-  })
-
-  depends_on = [
-    aws_secretsmanager_secret_version.credentials,
-    aws_rds_cluster_instance.database,
-    aws_vpc_security_group_egress_rule.rotation_to_database,
-    aws_vpc_security_group_ingress_rule.rotation_to_database,
-  ]
-}
-
 resource "aws_iam_role" "proxy" {
   count = var.enable_rds_proxy ? 1 : 0
 
@@ -454,27 +386,6 @@ resource "aws_iam_role" "proxy" {
   })
 }
 
-resource "aws_iam_role_policy" "proxy_secret_access" {
-  count = var.enable_rds_proxy ? 1 : 0
-  role  = aws_iam_role.proxy[0].name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect   = "Allow"
-        Action   = ["secretsmanager:GetSecretValue"]
-        Resource = [aws_secretsmanager_secret.credentials.arn]
-      },
-      {
-        Effect   = "Allow"
-        Action   = ["kms:Decrypt"]
-        Resource = [aws_kms_key.database.arn]
-      }
-    ]
-  })
-}
-
 resource "aws_security_group" "proxy" {
   #checkov:skip=CKV2_AWS_5:Security group is attached to aws_db_proxy.aurora; Checkov cannot resolve count-conditional cross-resource references
   count = var.enable_rds_proxy ? 1 : 0
@@ -498,17 +409,6 @@ resource "aws_db_proxy" "aurora" {
   vpc_subnet_ids         = var.subnet_ids
   vpc_security_group_ids = [aws_security_group.proxy[0].id]
   require_tls            = true
-
-  auth {
-    auth_scheme = "SECRETS"
-    iam_auth    = "REQUIRED"
-    secret_arn  = aws_secretsmanager_secret.credentials.arn
-  }
-
-  depends_on = [
-    aws_iam_role_policy.proxy_secret_access,
-    aws_secretsmanager_secret_version.credentials,
-  ]
 }
 
 resource "aws_db_proxy_default_target_group" "default" {
@@ -540,9 +440,9 @@ resource "null_resource" "proxy_target_ready" {
       deadline=$((start_time + 600))
       while true; do
         target_state=$(aws rds describe-db-proxy-targets \
-          --region ${data.aws_region.current.region} \
-          --db-proxy-name ${self.triggers.db_proxy_name} \
-          --target-group-name ${self.triggers.target_group_name} \
+          --region "$AWS_REGION" \
+          --db-proxy-name "$DB_PROXY_NAME" \
+          --target-group-name "$TARGET_GROUP_NAME" \
           --query "Targets[?Type=='RDS_INSTANCE'] | [0].TargetHealth.State" \
           --output text)
 
@@ -552,13 +452,19 @@ resource "null_resource" "proxy_target_ready" {
 
         current_time=$(date +%s)
         if [ "$current_time" -ge "$deadline" ]; then
-          echo "RDS Proxy target ${self.triggers.db_cluster_identifier} did not become AVAILABLE within 10 minutes. Last state: $target_state"
+          echo "RDS Proxy target $DB_CLUSTER_IDENTIFIER did not become AVAILABLE within 10 minutes. Last state: $target_state"
           exit 1
         fi
 
         sleep 10
       done
     EOT
+    environment = {
+      AWS_REGION            = data.aws_region.current.region
+      DB_PROXY_NAME         = self.triggers.db_proxy_name
+      TARGET_GROUP_NAME     = self.triggers.target_group_name
+      DB_CLUSTER_IDENTIFIER = self.triggers.db_cluster_identifier
+    }
   }
 
   depends_on = [
@@ -685,11 +591,21 @@ output "proxy_resource_id" {
   value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : null
 }
 
+output "connect_resource_id" {
+  description = "Resource ID to use in IAM rds-db:connect policies for the application database user. Resolves to the RDS Proxy resource ID when the proxy is enabled (the default), or the Aurora cluster resource ID when it is disabled — connecting through the proxy and connecting directly to the cluster are different IAM permission boundaries."
+  value       = var.enable_rds_proxy ? split(":", aws_db_proxy.aurora[0].arn)[6] : aws_rds_cluster.database.cluster_resource_id
+}
+
 output "cluster_endpoint" {
   description = "Writer endpoint of the Aurora cluster or proxy."
   value       = var.enable_rds_proxy ? aws_db_proxy.aurora[0].endpoint : aws_rds_cluster.database.endpoint
 }
 
+output "writer_endpoint" {
+  description = "Writer endpoint of the Aurora cluster itself, bypassing the RDS Proxy. Used by the admin-credentialled handlers, which connect directly to the cluster."
+  value       = aws_rds_cluster.database.endpoint
+}
+
 output "reader_endpoint" {
   description = "Reader endpoint of the Aurora cluster."
   value       = aws_rds_cluster.database.reader_endpoint
@@ -716,12 +632,12 @@ output "proxy_role_name" {
 }
 
 output "secret_arn" {
-  description = "ARN of the generated admin credentials secret."
-  value       = aws_secretsmanager_secret.credentials.arn
+  description = "ARN of the RDS-managed admin credentials secret. Its value is a JSON object with username and password only — connection details come from this module's other outputs."
+  value       = one(aws_rds_cluster.database.master_user_secret[*].secret_arn)
 }
 
 output "kms_key_arn" {
-  description = "ARN of the KMS key protecting Aurora and the generated secret."
+  description = "ARN of the KMS key protecting Aurora and its admin credentials secret."
   value       = aws_kms_key.database.arn
 }
 
@@ -746,6 +662,6 @@ output "database_name" {
 }
 
 output "admin_user" {
-  description = "Admin username stored in the generated secret."
-  value       = jsondecode(aws_secretsmanager_secret_version.credentials.secret_string).username
+  description = "Admin username stored in the RDS-managed credentials secret."
+  value       = aws_rds_cluster.database.master_username
 }

package/src/utils/rdb-constructs/rdb-constructs.d.ts

@@ -3,10 +3,23 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { type Tree } from '@nx/devkit';
-import type { Containers } from '../containers';
-import type { Iac } from '../iac';
+import type { Containers } from '../containers.js';
+import type { Iac } from '../iac.js';
+/**
+ * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive
+ * from so the same generator options vend the same ceiling regardless of `--iac`.
+ *
+ * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose
+ * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on
+ * the ceiling, so the maximum is headroom rather than a cost commitment.
+ */
+export declare const AURORA_SERVERLESS_V2_CAPACITY: {
+    readonly min: 0.5;
+    readonly max: 4;
+};
 export interface AddRdbConstructOptions {
     projectName: string;
+    projectRoot: string;
     nameClassName: string;
     nameKebabCase: string;
     databasePackageAlias: string;
@@ -14,8 +27,18 @@ export interface AddRdbConstructOptions {
     adminUser: string;
     engine: 'postgres' | 'mysql';
     migrationBundleDir: string;
+    /**
+     * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).
+     * When absent the migration Docker image is reused with the
+     * `create_db_user_handler.handler` command (py#rdb).
+     */
     createDbUserBundleDir: string;
-    dockerImageTag: string;
+    /** ORM framework used by the create-db-user Lambda. */
+    framework: 'prisma' | 'sqlmodel';
+    /** Local Docker tag for the Python create-db-user Lambda image. */
+    createDbUserDockerImageTag?: string;
+    /** Local Docker tag for the migration Lambda image. */
+    migrationDockerImageTag: string;
     containerEngine: Containers;
 }
 export declare const addRdbInfra: (tree: Tree, options: AddRdbConstructOptions & {

package/src/utils/rdb-constructs/rdb-constructs.js

@@ -1,49 +1,77 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addRdbTerraformModules = exports.addRdbCdkConstructs = exports.addRdbInfra = void 0;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const ast_1 = require("../ast");
-const nx_1 = require("../nx");
-const shared_constructs_constants_1 = require("../shared-constructs-constants");
-const addRdbInfra = async (tree, options) => {
+ */ import { generateFiles, joinPathFragments, OverwriteStrategy, updateJson } from "@nx/devkit";
+import { addStarExport } from "../ast.js";
+import { esmVars } from "../module-format.js";
+import { addArtifactProjectToTargets } from "../nx.js";
+import { PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, SHARED_TERRAFORM_DIR } from "../shared-constructs-constants.js";
+import { cdkLambdaRuntimeVars, terraformLambdaRuntimeVars, terraformProviderVersions } from "../versions.js";
+/**
+ * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive
+ * from so the same generator options vend the same ceiling regardless of `--iac`.
+ *
+ * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose
+ * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on
+ * the ceiling, so the maximum is headroom rather than a cost commitment.
+ */ export const AURORA_SERVERLESS_V2_CAPACITY = {
+    min: 0.5,
+    max: 4
+};
+/**
+ * Substitution variables exposing the Aurora Serverless v2 scaling bounds to
+ * generated CDK and Terraform templates.
+ */ const auroraServerlessV2Capacity = ()=>({
+        serverlessMinCapacity: AURORA_SERVERLESS_V2_CAPACITY.min,
+        serverlessMaxCapacity: AURORA_SERVERLESS_V2_CAPACITY.max
+    });
+export const addRdbInfra = async (tree, options)=>{
     if (options.iac === 'cdk') {
-        await (0, exports.addRdbCdkConstructs)(tree, options);
-    }
-    else if (options.iac === 'terraform') {
-        (0, exports.addRdbTerraformModules)(tree, options);
-    }
-    else {
+        await addRdbCdkConstructs(tree, options);
+    } else if (options.iac === 'terraform') {
+        addRdbTerraformModules(tree, options);
+    } else {
         throw new Error(`Unsupported iac ${options.iac}`);
     }
-    (0, devkit_1.updateJson)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, options.iac === 'cdk' ? shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR : shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'project.json'), (config) => {
-        (0, nx_1.addDependencyToTargetIfNotPresent)(config, 'build', `${options.projectName}:build`);
+    updateJson(tree, joinPathFragments(PACKAGES_DIR, options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR, 'project.json'), (config)=>{
+        addArtifactProjectToTargets(config, options.projectName);
         return config;
     });
 };
-exports.addRdbInfra = addRdbInfra;
-const addRdbCdkConstructs = async (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'core', 'rdb'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core', 'rdb'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+export const addRdbCdkConstructs = async (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'rdb'), {
+        ...options,
+        ...esmVars(tree),
+        ...auroraServerlessV2Capacity()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'cdk', 'app', 'dbs'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'), {
+        ...options,
+        ...esmVars(tree),
+        ...cdkLambdaRuntimeVars()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './rdb/aurora.js');
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs', 'index.ts'), `./${options.nameKebabCase}.js`);
-    await (0, ast_1.addStarExport)(tree, (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './dbs/index.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'core', 'index.ts'), './rdb/aurora.js');
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs', 'index.ts'), `./${options.nameKebabCase}.js`);
+    await addStarExport(tree, joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'index.ts'), './dbs/index.js');
 };
-exports.addRdbCdkConstructs = addRdbCdkConstructs;
-const addRdbTerraformModules = (tree, options) => {
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'core', 'rdb'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'), {}, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+export const addRdbTerraformModules = (tree, options)=>{
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'), {
+        ...terraformProviderVersions(),
+        ...auroraServerlessV2Capacity()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    (0, devkit_1.generateFiles)(tree, (0, devkit_1.joinPathFragments)(__dirname, 'files', 'terraform', 'app', 'dbs'), (0, devkit_1.joinPathFragments)(shared_constructs_constants_1.PACKAGES_DIR, shared_constructs_constants_1.SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'), options, {
-        overwriteStrategy: devkit_1.OverwriteStrategy.KeepExisting,
+    generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'), joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'), {
+        ...options,
+        ...terraformProviderVersions(),
+        ...auroraServerlessV2Capacity(),
+        ...terraformLambdaRuntimeVars()
+    }, {
+        overwriteStrategy: OverwriteStrategy.KeepExisting
     });
 };
-exports.addRdbTerraformModules = addRdbTerraformModules;
+
 //# sourceMappingURL=rdb-constructs.js.map

package/src/utils/rdb-constructs/rdb-constructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"rdb-constructs.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,uCAOoB;AACpB,gCAAuC;AAGvC,8BAA0D;AAC1D,gFAIwC;AAgBjC,MAAM,WAAW,GAAG,KAAK,EAC9B,IAAU,EACV,OAA8C,EAC9C,EAAE;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAA,2BAAmB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QACvC,IAAA,8BAAsB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAA,mBAAU,EACR,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,mDAAqB,CAAC,CAAC,CAAC,kDAAoB,EACpE,cAAc,CACf,EACD,CAAC,MAA4B,EAAE,EAAE;QAC/B,IAAA,sCAAiC,EAC/B,MAAM,EACN,OAAO,EACP,GAAG,OAAO,CAAC,WAAW,QAAQ,CAC/B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,WAAW,eA4BtB;AAEK,MAAM,mBAAmB,GAAG,KAAK,EACtC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAC3D,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,KAAK,CACN,EACD,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAC1D,IAAA,0BAAiB,EAAC,0CAAY,EAAE,mDAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAC3E,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,MAAM,EACN,UAAU,CACX,EACD,iBAAiB,CAClB,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,KAAK,OAAO,CAAC,aAAa,KAAK,CAChC,CAAC;IACF,MAAM,IAAA,mBAAa,EACjB,IAAI,EACJ,IAAA,0BAAiB,EACf,0CAAY,EACZ,mDAAqB,EACrB,KAAK,EACL,KAAK,EACL,UAAU,CACX,EACD,gBAAgB,CACjB,CAAC;AACJ,CAAC,CAAC;AAhEW,QAAA,mBAAmB,uBAgE9B;AAEK,MAAM,sBAAsB,GAAG,CACpC,IAAU,EACV,OAA+B,EAC/B,EAAE;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EACjE,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAC3E,EAAE,EACF;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;IAEF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAA,0BAAiB,EAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,EAChE,IAAA,0BAAiB,EAAC,0CAAY,EAAE,kDAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAC1E,OAAO,EACP;QACE,iBAAiB,EAAE,0BAAiB,CAAC,YAAY;KAClD,CACF,CAAC;AACJ,CAAC,CAAC;AAvBW,QAAA,sBAAsB,0BAuBjC"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/rdb-constructs/rdb-constructs.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  generateFiles,\n  joinPathFragments,\n  OverwriteStrategy,\n  type ProjectConfiguration,\n  type Tree,\n  updateJson,\n} from '@nx/devkit';\nimport { addStarExport } from '../ast.js';\nimport type { Containers } from '../containers.js';\nimport type { Iac } from '../iac.js';\nimport { esmVars } from '../module-format.js';\nimport { addArtifactProjectToTargets } from '../nx.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_CONSTRUCTS_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../shared-constructs-constants.js';\nimport {\n  cdkLambdaRuntimeVars,\n  terraformLambdaRuntimeVars,\n  terraformProviderVersions,\n} from '../versions.js';\n\n/**\n * Aurora Serverless v2 scaling bounds, in ACUs, that both IaC providers derive\n * from so the same generator options vend the same ceiling regardless of `--iac`.\n *\n * Set explicitly on CDK rather than inheriting `DatabaseClusterProps`, whose\n * default moves with `aws-cdk-lib`. Serverless v2 bills on ACUs consumed, not on\n * the ceiling, so the maximum is headroom rather than a cost commitment.\n */\nexport const AURORA_SERVERLESS_V2_CAPACITY = {\n  min: 0.5,\n  max: 4,\n} as const;\n\n/**\n * Substitution variables exposing the Aurora Serverless v2 scaling bounds to\n * generated CDK and Terraform templates.\n */\nconst auroraServerlessV2Capacity = () => ({\n  serverlessMinCapacity: AURORA_SERVERLESS_V2_CAPACITY.min,\n  serverlessMaxCapacity: AURORA_SERVERLESS_V2_CAPACITY.max,\n});\n\nexport interface AddRdbConstructOptions {\n  projectName: string;\n  projectRoot: string;\n  nameClassName: string;\n  nameKebabCase: string;\n  databasePackageAlias: string;\n  databaseName: string;\n  adminUser: string;\n  engine: 'postgres' | 'mysql';\n  migrationBundleDir: string;\n  /**\n   * Node.js zip bundle directory for the create-db-user Lambda (ts#rdb).\n   * When absent the migration Docker image is reused with the\n   * `create_db_user_handler.handler` command (py#rdb).\n   */\n  createDbUserBundleDir: string;\n  /** ORM framework used by the create-db-user Lambda. */\n  framework: 'prisma' | 'sqlmodel';\n  /** Local Docker tag for the Python create-db-user Lambda image. */\n  createDbUserDockerImageTag?: string;\n  /** Local Docker tag for the migration Lambda image. */\n  migrationDockerImageTag: string;\n  containerEngine: Containers;\n}\n\nexport const addRdbInfra = async (\n  tree: Tree,\n  options: AddRdbConstructOptions & { iac: Iac },\n) => {\n  if (options.iac === 'cdk') {\n    await addRdbCdkConstructs(tree, options);\n  } else if (options.iac === 'terraform') {\n    addRdbTerraformModules(tree, options);\n  } else {\n    throw new Error(`Unsupported iac ${options.iac}`);\n  }\n\n  updateJson(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      options.iac === 'cdk' ? SHARED_CONSTRUCTS_DIR : SHARED_TERRAFORM_DIR,\n      'project.json',\n    ),\n    (config: ProjectConfiguration) => {\n      addArtifactProjectToTargets(config, options.projectName);\n      return config;\n    },\n  );\n};\n\nexport const addRdbCdkConstructs = async (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'core', 'rdb'),\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'rdb',\n    ),\n    { ...options, ...esmVars(tree), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'cdk', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_CONSTRUCTS_DIR, 'src', 'app', 'dbs'),\n    { ...options, ...esmVars(tree), ...cdkLambdaRuntimeVars() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'core',\n      'index.ts',\n    ),\n    './rdb/aurora.js',\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'dbs',\n      'index.ts',\n    ),\n    `./${options.nameKebabCase}.js`,\n  );\n  await addStarExport(\n    tree,\n    joinPathFragments(\n      PACKAGES_DIR,\n      SHARED_CONSTRUCTS_DIR,\n      'src',\n      'app',\n      'index.ts',\n    ),\n    './dbs/index.js',\n  );\n};\n\nexport const addRdbTerraformModules = (\n  tree: Tree,\n  options: AddRdbConstructOptions,\n) => {\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'core', 'rdb'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'core', 'rdb'),\n    { ...terraformProviderVersions(), ...auroraServerlessV2Capacity() },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n\n  generateFiles(\n    tree,\n    joinPathFragments(import.meta.dirname, 'files', 'terraform', 'app', 'dbs'),\n    joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src', 'app', 'dbs'),\n    {\n      ...options,\n      ...terraformProviderVersions(),\n      ...auroraServerlessV2Capacity(),\n      ...terraformLambdaRuntimeVars(),\n    },\n    {\n      overwriteStrategy: OverwriteStrategy.KeepExisting,\n    },\n  );\n};\n"],"names":["generateFiles","joinPathFragments","OverwriteStrategy","updateJson","addStarExport","esmVars","addArtifactProjectToTargets","PACKAGES_DIR","SHARED_CONSTRUCTS_DIR","SHARED_TERRAFORM_DIR","cdkLambdaRuntimeVars","terraformLambdaRuntimeVars","terraformProviderVersions","AURORA_SERVERLESS_V2_CAPACITY","min","max","auroraServerlessV2Capacity","serverlessMinCapacity","serverlessMaxCapacity","addRdbInfra","tree","options","iac","addRdbCdkConstructs","addRdbTerraformModules","Error","config","projectName","dirname","overwriteStrategy","KeepExisting","nameKebabCase"],"mappings":"AAAA;;;CAGC,GACD,SACEA,aAAa,EACbC,iBAAiB,EACjBC,iBAAiB,EAGjBC,UAAU,QACL,aAAa;AACpB,SAASC,aAAa,QAAQ,YAAY;AAG1C,SAASC,OAAO,QAAQ,sBAAsB;AAC9C,SAASC,2BAA2B,QAAQ,WAAW;AACvD,SACEC,YAAY,EACZC,qBAAqB,EACrBC,oBAAoB,QACf,oCAAoC;AAC3C,SACEC,oBAAoB,EACpBC,0BAA0B,EAC1BC,yBAAyB,QACpB,iBAAiB;AAExB;;;;;;;CAOC,GACD,OAAO,MAAMC,gCAAgC;IAC3CC,KAAK;IACLC,KAAK;AACP,EAAW;AAEX;;;CAGC,GACD,MAAMC,6BAA6B,IAAO,CAAA;QACxCC,uBAAuBJ,8BAA8BC,GAAG;QACxDI,uBAAuBL,8BAA8BE,GAAG;IAC1D,CAAA;AA2BA,OAAO,MAAMI,cAAc,OACzBC,MACAC;IAEA,IAAIA,QAAQC,GAAG,KAAK,OAAO;QACzB,MAAMC,oBAAoBH,MAAMC;IAClC,OAAO,IAAIA,QAAQC,GAAG,KAAK,aAAa;QACtCE,uBAAuBJ,MAAMC;IAC/B,OAAO;QACL,MAAM,IAAII,MAAM,CAAC,gBAAgB,EAAEJ,QAAQC,GAAG,EAAE;IAClD;IAEAnB,WACEiB,MACAnB,kBACEM,cACAc,QAAQC,GAAG,KAAK,QAAQd,wBAAwBC,sBAChD,iBAEF,CAACiB;QACCpB,4BAA4BoB,QAAQL,QAAQM,WAAW;QACvD,OAAOD;IACT;AAEJ,EAAE;AAEF,OAAO,MAAMH,sBAAsB,OACjCH,MACAC;IAEArB,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,OAAO,QAAQ,QAC/D3B,kBACEM,cACAC,uBACA,OACA,QACA,QAEF;QAAE,GAAGa,OAAO;QAAE,GAAGhB,QAAQe,KAAK;QAAE,GAAGJ,4BAA4B;IAAC,GAChE;QACEa,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF9B,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,OAAO,OAAO,QAC9D3B,kBAAkBM,cAAcC,uBAAuB,OAAO,OAAO,QACrE;QAAE,GAAGa,OAAO;QAAE,GAAGhB,QAAQe,KAAK;QAAE,GAAGV,sBAAsB;IAAC,GAC1D;QACEmB,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF,MAAM1B,cACJgB,MACAnB,kBACEM,cACAC,uBACA,OACA,QACA,aAEF;IAEF,MAAMJ,cACJgB,MACAnB,kBACEM,cACAC,uBACA,OACA,OACA,OACA,aAEF,CAAC,EAAE,EAAEa,QAAQU,aAAa,CAAC,GAAG,CAAC;IAEjC,MAAM3B,cACJgB,MACAnB,kBACEM,cACAC,uBACA,OACA,OACA,aAEF;AAEJ,EAAE;AAEF,OAAO,MAAMgB,yBAAyB,CACpCJ,MACAC;IAEArB,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,aAAa,QAAQ,QACrE3B,kBAAkBM,cAAcE,sBAAsB,OAAO,QAAQ,QACrE;QAAE,GAAGG,2BAA2B;QAAE,GAAGI,4BAA4B;IAAC,GAClE;QACEa,mBAAmB3B,kBAAkB4B,YAAY;IACnD;IAGF9B,cACEoB,MACAnB,kBAAkB,YAAY2B,OAAO,EAAE,SAAS,aAAa,OAAO,QACpE3B,kBAAkBM,cAAcE,sBAAsB,OAAO,OAAO,QACpE;QACE,GAAGY,OAAO;QACV,GAAGT,2BAA2B;QAC9B,GAAGI,4BAA4B;QAC/B,GAAGL,4BAA4B;IACjC,GACA;QACEkB,mBAAmB3B,kBAAkB4B,YAAY;IACnD;AAEJ,EAAE"}