@digitraffic/common 2023.9.11-1 → 2023.9.14-1

package/dist/aws/infra/import-util.js

@@ -6,7 +6,7 @@ const aws_cdk_lib_1 = require("aws-cdk-lib");
 class OldStackImports {
 }
 exports.OldStackImports = OldStackImports;
-OldStackImports.AURORAINSTANCE_SG_IMPORT_NAME = "AuroraInstanceSG";
+OldStackImports.AURORAINSTANCE_SG_IMPORT_NAME = "AuroraSG";
 OldStackImports.RDSPROXY_SG_IMPORT_NAME = "RDSProxySG";
 /**
  * Import VPC from other stack outputs

package/dist/aws/infra/stack/parameters.d.ts

@@ -0,0 +1,40 @@
+import { StringParameter } from "aws-cdk-lib/aws-ssm";
+import { Construct } from "constructs/lib/construct";
+declare const PARAMETERS: {
+    readonly "topic.alarm": {
+        readonly parameterName: "/digitraffic/monitoring/alarm-topic";
+    };
+    readonly "topic.warning": {
+        readonly parameterName: "/digitraffic/monitoring/warning-topic";
+    };
+    readonly "cluster.reader": {
+        readonly id: "ClusterReaderEndpointParameter";
+        readonly parameterName: "/digitraffic/db/reader-endpoint";
+        readonly description: "Cluster reader endpoint";
+    };
+    readonly "cluster.writer": {
+        readonly id: "ClusterWriterEndpointParameter";
+        readonly parameterName: "/digitraffic/db/writer-endpoint";
+        readonly description: "Cluster writer endpoint";
+    };
+    readonly "cluster.identifier": {
+        readonly id: "ClusterIdentifierParameter";
+        readonly parameterName: "/digitraffic/db/identifier";
+        readonly description: "Cluster identifier";
+    };
+    readonly "proxy.reader": {
+        readonly id: "ProxyReaderEndpointParameter";
+        readonly parameterName: "/digitraffic/db/proxy-reader-endpoint";
+        readonly description: "Proxy reader endpoint";
+    };
+    readonly "proxy.writer": {
+        readonly id: "ProxyWriterEndpointParameter";
+        readonly parameterName: "/digitraffic/db/proxy-writer-endpoint";
+        readonly description: "Proxy writer endpoint";
+    };
+};
+export type ReadParameterType = keyof typeof PARAMETERS;
+export type WriteParameterType = Exclude<Exclude<ReadParameterType, "topic.alarm">, "topic.warning">;
+export declare function getParameterValue(scope: Construct, parameterType: ReadParameterType): string;
+export declare function createParameter(scope: Construct, parameterType: WriteParameterType, stringValue: string): StringParameter;
+export {};

package/dist/aws/infra/stack/parameters.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createParameter = exports.getParameterValue = void 0;
+const aws_ssm_1 = require("aws-cdk-lib/aws-ssm");
+const SSM_ROOT = "/digitraffic";
+const MONITORING_ROOT = "/monitoring";
+const DB_ROOT = "/db";
+const PARAMETERS = {
+    "topic.alarm": {
+        parameterName: `${SSM_ROOT}${MONITORING_ROOT}/alarm-topic`,
+    },
+    "topic.warning": {
+        parameterName: `${SSM_ROOT}${MONITORING_ROOT}/warning-topic`,
+    },
+    "cluster.reader": {
+        id: "ClusterReaderEndpointParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/reader-endpoint`,
+        description: "Cluster reader endpoint",
+    },
+    "cluster.writer": {
+        id: "ClusterWriterEndpointParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/writer-endpoint`,
+        description: "Cluster writer endpoint",
+    },
+    "cluster.identifier": {
+        id: "ClusterIdentifierParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/identifier`,
+        description: "Cluster identifier",
+    },
+    "proxy.reader": {
+        id: "ProxyReaderEndpointParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/proxy-reader-endpoint`,
+        description: "Proxy reader endpoint",
+    },
+    "proxy.writer": {
+        id: "ProxyWriterEndpointParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/proxy-writer-endpoint`,
+        description: "Proxy writer endpoint",
+    },
+};
+function getParameterValue(scope, parameterType) {
+    const parameterName = PARAMETERS[parameterType].parameterName;
+    return aws_ssm_1.StringParameter.valueForStringParameter(scope, parameterName);
+}
+exports.getParameterValue = getParameterValue;
+function createParameter(scope, parameterType, stringValue) {
+    const { id, parameterName, description } = PARAMETERS[parameterType];
+    return new aws_ssm_1.StringParameter(scope, id, {
+        parameterName,
+        description,
+        stringValue,
+    });
+}
+exports.createParameter = createParameter;
+//# sourceMappingURL=parameters.js.map

package/dist/aws/infra/stacks/db-dns-stack.d.ts

@@ -1,5 +1,5 @@
 import { Stack } from "aws-cdk-lib";
-import { Construct } from "constructs";
+import { Construct } from "constructs/lib/construct";
 import { InfraStackConfiguration } from "./intra-stack-configuration";
 /**
  * Creates a dns local zone and creates records for cluster endpoints and proxy endpoints.

package/dist/aws/infra/stacks/db-dns-stack.js

@@ -4,8 +4,7 @@ exports.DbDnsStack = void 0;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_route53_1 = require("aws-cdk-lib/aws-route53");
 const import_util_1 = require("../import-util");
-const db_stack_1 = require("./db-stack");
-const db_proxy_stack_1 = require("./db-proxy-stack");
+const parameters_1 = require("../stack/parameters");
 const DEFAULT_RECORD_TTL = aws_cdk_lib_1.Duration.seconds(30);
 /**
  * Creates a dns local zone and creates records for cluster endpoints and proxy endpoints.
@@ -27,10 +26,10 @@ class DbDnsStack extends aws_cdk_lib_1.Stack {
             vpc,
         });
         zone.applyRemovalPolicy(aws_cdk_lib_1.RemovalPolicy.RETAIN);
-        const clusterReaderEndpoint = (0, import_util_1.importValue)(isc.environmentName, db_stack_1.DbStack.CLUSTER_READ_ENDPOINT_EXPORT_NAME);
-        const clusterWriterEndpoint = (0, import_util_1.importValue)(isc.environmentName, db_stack_1.DbStack.CLUSTER_WRITE_ENDPOINT_EXPORT_NAME);
-        const proxyReaderEndpoint = (0, import_util_1.importValue)(isc.environmentName, db_proxy_stack_1.DbProxyStack.PROXY_READER_EXPORT_NAME);
-        const proxyWriterEndpoint = (0, import_util_1.importValue)(isc.environmentName, db_proxy_stack_1.DbProxyStack.PROXY_WRITER_EXPORT_NAME);
+        const clusterReaderEndpoint = (0, parameters_1.getParameterValue)(this, "cluster.reader");
+        const clusterWriterEndpoint = (0, parameters_1.getParameterValue)(this, "cluster.writer");
+        const proxyReaderEndpoint = (0, parameters_1.getParameterValue)(this, "proxy.reader");
+        const proxyWriterEndpoint = (0, parameters_1.getParameterValue)(this, "proxy.writer");
         new aws_route53_1.RecordSet(this, "ReaderRecord", {
             recordType: aws_route53_1.RecordType.CNAME,
             recordName: `db-ro.${isc.environmentName}.local`,

package/dist/aws/infra/stacks/db-proxy-stack.d.ts

@@ -1,19 +1,24 @@
-import { Stack } from "aws-cdk-lib";
-import { Construct } from "constructs";
 import { CfnDBProxyEndpoint, DatabaseProxy } from "aws-cdk-lib/aws-rds";
 import { ISecret } from "aws-cdk-lib/aws-secretsmanager";
 import { IVpc } from "aws-cdk-lib/aws-ec2";
 import { InfraStackConfiguration } from "./intra-stack-configuration";
-import { DbConfiguration } from "./db-stack";
+import { Stack } from "aws-cdk-lib/core";
+import { Construct } from "constructs/lib/construct";
+export interface ProxyConfiguration {
+    readonly secretArn: string;
+    readonly name?: string;
+    readonly securityGroupId: string;
+    readonly clusterIdentifier: string;
+}
 /**
  * A stack that creates a Database proxy.
  */
 export declare class DbProxyStack extends Stack {
+    readonly isc: InfraStackConfiguration;
     static PROXY_READER_EXPORT_NAME: string;
     static PROXY_WRITER_EXPORT_NAME: string;
-    readonly isc: InfraStackConfiguration;
-    constructor(scope: Construct, id: string, isc: InfraStackConfiguration, configuration: DbConfiguration);
-    createProxy(vpc: IVpc, secret: ISecret, configuration: DbConfiguration): DatabaseProxy;
+    constructor(scope: Construct, id: string, isc: InfraStackConfiguration, configuration: ProxyConfiguration);
+    setOutputs(proxy: DatabaseProxy): void;
+    createProxy(vpc: IVpc, secret: ISecret, configuration: ProxyConfiguration): DatabaseProxy;
     createProxyEndpoints(vpc: IVpc, proxy: DatabaseProxy, securityGroupId: string): CfnDBProxyEndpoint;
-    setOutputs(configuration: DbConfiguration, proxy: DatabaseProxy, proxyEndpoint: CfnDBProxyEndpoint): void;
 }

package/dist/aws/infra/stacks/db-proxy-stack.js

@@ -1,34 +1,45 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DbProxyStack = void 0;
-const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_rds_1 = require("aws-cdk-lib/aws-rds");
 const aws_secretsmanager_1 = require("aws-cdk-lib/aws-secretsmanager");
 const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
 const db_stack_1 = require("./db-stack");
 const import_util_1 = require("../import-util");
+const parameters_1 = require("../stack/parameters");
+const core_1 = require("aws-cdk-lib/core");
 /**
  * A stack that creates a Database proxy.
  */
-class DbProxyStack extends aws_cdk_lib_1.Stack {
+class DbProxyStack extends core_1.Stack {
     constructor(scope, id, isc, configuration) {
         super(scope, id, {
             env: isc.env,
         });
         this.isc = isc;
+        if (configuration.clusterIdentifier === "") {
+            throw new Error("Empty cluster identifier!");
+        }
         const vpc = (0, import_util_1.importVpc)(this, isc.environmentName);
         const secret = aws_secretsmanager_1.Secret.fromSecretAttributes(this, "proxy-secret", {
             secretCompleteArn: configuration.secretArn,
         });
         const proxy = this.createProxy(vpc, secret, configuration);
-        const readerEndpoint = this.createProxyEndpoints(vpc, proxy, configuration.proxy.securityGroupId);
-        this.setOutputs(configuration, proxy, readerEndpoint);
+        const readerEndpoint = this.createProxyEndpoints(vpc, proxy, configuration.securityGroupId);
+        (0, parameters_1.createParameter)(this, "proxy.reader", readerEndpoint.attrEndpoint);
+        (0, parameters_1.createParameter)(this, "proxy.writer", proxy.endpoint);
+        this.setOutputs(proxy);
+    }
+    setOutputs(proxy) {
+        // if only one instance, then there is no reader-endpoint
+        (0, import_util_1.exportValue)(this, this.isc.environmentName, DbProxyStack.PROXY_READER_EXPORT_NAME, proxy.endpoint);
+        (0, import_util_1.exportValue)(this, this.isc.environmentName, DbProxyStack.PROXY_WRITER_EXPORT_NAME, proxy.endpoint);
     }
     createProxy(vpc, secret, configuration) {
         const proxyId = `${this.isc.environmentName}-proxy`;
-        const securityGroup = aws_ec2_1.SecurityGroup.fromSecurityGroupId(this, "securitygroup", configuration.proxy.securityGroupId);
+        const securityGroup = aws_ec2_1.SecurityGroup.fromSecurityGroupId(this, "securitygroup", configuration.securityGroupId);
         const cluster = aws_rds_1.DatabaseCluster.fromDatabaseClusterAttributes(this, "db-cluster", {
-            clusterIdentifier: (0, import_util_1.importValue)(this.isc.environmentName, db_stack_1.DbStack.CLUSTER_IDENTIFIER_EXPORT_NAME),
+            clusterIdentifier: configuration.clusterIdentifier,
             engine: aws_rds_1.DatabaseClusterEngine.AURORA_POSTGRESQL,
             port: db_stack_1.DbStack.CLUSTER_PORT,
         });
@@ -38,13 +49,13 @@ class DbProxyStack extends aws_cdk_lib_1.Stack {
             /* nothing */
         };
         return new aws_rds_1.DatabaseProxy(this, proxyId, {
-            dbProxyName: configuration.proxy.name ?? "AuroraProxy",
+            dbProxyName: configuration.name ?? "AuroraProxy",
             securityGroups: [securityGroup],
             proxyTarget: aws_rds_1.ProxyTarget.fromCluster(cluster),
-            idleClientTimeout: aws_cdk_lib_1.Duration.seconds(1800),
+            idleClientTimeout: core_1.Duration.seconds(1800),
             maxConnectionsPercent: 50,
             maxIdleConnectionsPercent: 25,
-            borrowTimeout: aws_cdk_lib_1.Duration.seconds(120),
+            borrowTimeout: core_1.Duration.seconds(120),
             requireTLS: false,
             secrets: [secret],
             vpc: vpc,
@@ -59,14 +70,6 @@ class DbProxyStack extends aws_cdk_lib_1.Stack {
             targetRole: "READ_ONLY",
         });
     }
-    setOutputs(configuration, proxy, proxyEndpoint) {
-        const readerEndpoint = configuration.instances > 1
-            ? proxyEndpoint.attrEndpoint
-            : proxy.endpoint;
-        // if only one instance, then there is no reader-endpoint
-        (0, import_util_1.exportValue)(this, this.isc.environmentName, DbProxyStack.PROXY_READER_EXPORT_NAME, readerEndpoint);
-        (0, import_util_1.exportValue)(this, this.isc.environmentName, DbProxyStack.PROXY_WRITER_EXPORT_NAME, proxy.endpoint);
-    }
 }
 exports.DbProxyStack = DbProxyStack;
 DbProxyStack.PROXY_READER_EXPORT_NAME = "db-reader-endpoint";

package/dist/aws/infra/stacks/db-stack.d.ts

@@ -1,26 +1,32 @@
-import { Stack } from "aws-cdk-lib";
 import { InstanceType, IVpc } from "aws-cdk-lib/aws-ec2";
 import { ISecurityGroup } from "aws-cdk-lib/aws-ec2/lib/security-group";
 import { AuroraPostgresEngineVersion, DatabaseCluster, DatabaseClusterProps, IParameterGroup } from "aws-cdk-lib/aws-rds";
-import { Construct } from "constructs";
+import { Construct } from "constructs/lib/construct";
 import { InfraStackConfiguration } from "./intra-stack-configuration";
+import { Stack } from "aws-cdk-lib/core";
 export interface DbConfiguration {
+    readonly cluster?: ClusterConfiguration;
+    readonly clusterImport?: ClusterImportConfiguration;
+    readonly customParameterGroups: AuroraPostgresEngineVersion[];
+    readonly workmem?: number;
     /** superuser username and password are fetched from this secret, using keys
      * db.superuser and db.superuser.password
      */
     readonly secretArn: string;
-    readonly dbVersion: AuroraPostgresEngineVersion;
+    /** If this is not specified, import default vpc */
+    readonly vpc?: IVpc;
+}
+export interface ClusterConfiguration {
+    readonly securityGroupId: string;
     readonly dbInstanceType: InstanceType;
     readonly snapshotIdentifier?: string;
     readonly instances: number;
-    readonly customParameterGroup: boolean;
-    readonly securityGroupId: string;
-    /** If this is not specified, import default vpc */
-    readonly vpc?: IVpc;
-    readonly proxy: {
-        readonly name?: string;
-        readonly securityGroupId: string;
-    };
+    readonly dbVersion: AuroraPostgresEngineVersion;
+    readonly storageEncrypted?: boolean;
+}
+export interface ClusterImportConfiguration {
+    readonly clusterReadEndpoint: string;
+    readonly clusterWriteEndpoint: string;
 }
 /**
  * Stack that creates DatabaseCluster.
@@ -28,20 +34,17 @@ export interface DbConfiguration {
  * Please not, that created Cluster has RETAIL removalPolicy, so if you want to delete the stack,
  * you must first deploy without parameter group, then delete stack and manually delete cluster.
  *
- * How to upgrade major version?
- * 0. Set correct SG for db-stack and db-proxy-stack(this step will be removed in the future)
- * 1. Update db-stack WITHOUT parameter group
- * 2. Upgrade extensions by hand
- * 3. Upgrade database from the AWS console
- * 4. Update db-stack with the upgraded version and custom parameter group
+ * You should deploy once with cluster and then without.  This way you can create the cluster with this
+ * stack, but cluster is not part of the stack after that.
  */
 export declare class DbStack extends Stack {
+    static CLUSTER_PORT: number;
     static CLUSTER_IDENTIFIER_EXPORT_NAME: string;
     static CLUSTER_READ_ENDPOINT_EXPORT_NAME: string;
     static CLUSTER_WRITE_ENDPOINT_EXPORT_NAME: string;
-    static CLUSTER_PORT: number;
+    clusterIdentifier: string;
     constructor(scope: Construct, id: string, isc: InfraStackConfiguration, configuration: DbConfiguration);
-    createParamaterGroup(configuration: DbConfiguration): IParameterGroup;
-    createClusterParameters(configuration: DbConfiguration, instanceName: string, vpc: IVpc, securityGroup: ISecurityGroup, parameterGroup: IParameterGroup): DatabaseClusterProps;
-    createAuroraCluster(isc: InfraStackConfiguration, configuration: DbConfiguration): DatabaseCluster;
+    createParameterGroups(customVersions: AuroraPostgresEngineVersion[], workmem: number): IParameterGroup[];
+    createClusterParameters(secretArn: string, clusterConfiguration: ClusterConfiguration, instanceName: string, vpc: IVpc, securityGroup: ISecurityGroup, parameterGroup: IParameterGroup): DatabaseClusterProps;
+    createAuroraCluster(isc: InfraStackConfiguration, configuration: DbConfiguration, clusterConfiguration: ClusterConfiguration, parameterGroups: IParameterGroup[]): DatabaseCluster;
 }

package/dist/aws/infra/stacks/db-stack.js

@@ -1,65 +1,83 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DbStack = void 0;
-const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
 const aws_rds_1 = require("aws-cdk-lib/aws-rds");
 const aws_secretsmanager_1 = require("aws-cdk-lib/aws-secretsmanager");
 const import_util_1 = require("../import-util");
+const core_1 = require("aws-cdk-lib/core");
+const parameters_1 = require("../stack/parameters");
 /**
  * Stack that creates DatabaseCluster.
  *
  * Please not, that created Cluster has RETAIL removalPolicy, so if you want to delete the stack,
  * you must first deploy without parameter group, then delete stack and manually delete cluster.
  *
- * How to upgrade major version?
- * 0. Set correct SG for db-stack and db-proxy-stack(this step will be removed in the future)
- * 1. Update db-stack WITHOUT parameter group
- * 2. Upgrade extensions by hand
- * 3. Upgrade database from the AWS console
- * 4. Update db-stack with the upgraded version and custom parameter group
+ * You should deploy once with cluster and then without.  This way you can create the cluster with this
+ * stack, but cluster is not part of the stack after that.
  */
-class DbStack extends aws_cdk_lib_1.Stack {
+class DbStack extends core_1.Stack {
     constructor(scope, id, isc, configuration) {
         super(scope, id, {
             env: isc.env,
         });
-        const cluster = this.createAuroraCluster(isc, configuration);
-        (0, import_util_1.exportValue)(this, isc.environmentName, DbStack.CLUSTER_IDENTIFIER_EXPORT_NAME, cluster.clusterIdentifier);
-        (0, import_util_1.exportValue)(this, isc.environmentName, DbStack.CLUSTER_WRITE_ENDPOINT_EXPORT_NAME, cluster.clusterEndpoint.hostname);
-        (0, import_util_1.exportValue)(this, isc.environmentName, DbStack.CLUSTER_READ_ENDPOINT_EXPORT_NAME, cluster.clusterReadEndpoint.hostname);
+        this.clusterIdentifier = "";
+        const parameterGroups = this.createParameterGroups(configuration.customParameterGroups, configuration.workmem ?? 524288);
+        if ((configuration.cluster && configuration.clusterImport) ||
+            (!configuration.cluster && !configuration.clusterImport)) {
+            throw new Error("Configure either cluster or clusterImport");
+        }
+        // create cluster if this is wanted, should do it only once
+        if (configuration.cluster) {
+            const cluster = this.createAuroraCluster(isc, configuration, configuration.cluster, parameterGroups);
+            (0, import_util_1.exportValue)(this, isc.environmentName, DbStack.CLUSTER_IDENTIFIER_EXPORT_NAME, cluster.clusterIdentifier);
+            (0, import_util_1.exportValue)(this, isc.environmentName, DbStack.CLUSTER_WRITE_ENDPOINT_EXPORT_NAME, cluster.clusterEndpoint.hostname);
+            (0, import_util_1.exportValue)(this, isc.environmentName, DbStack.CLUSTER_READ_ENDPOINT_EXPORT_NAME, cluster.clusterReadEndpoint.hostname);
+            (0, parameters_1.createParameter)(this, "cluster.reader", cluster.clusterReadEndpoint.hostname);
+            (0, parameters_1.createParameter)(this, "cluster.writer", cluster.clusterEndpoint.hostname);
+            (0, parameters_1.createParameter)(this, "cluster.identifier", cluster.clusterIdentifier);
+            this.clusterIdentifier = cluster.clusterIdentifier;
+        }
+        if (configuration.clusterImport) {
+            (0, parameters_1.createParameter)(this, "cluster.reader", configuration.clusterImport.clusterReadEndpoint);
+            (0, parameters_1.createParameter)(this, "cluster.writer", configuration.clusterImport.clusterWriteEndpoint);
+        }
     }
-    createParamaterGroup(configuration) {
-        return configuration.customParameterGroup
-            ? new aws_rds_1.ParameterGroup(this, `parameter-group-${configuration.dbVersion.auroraPostgresMajorVersion}`, {
+    createParameterGroups(customVersions, workmem) {
+        return customVersions.map((version) => {
+            const pg = new aws_rds_1.ParameterGroup(this, `parameter-group-${version.auroraPostgresMajorVersion}`, {
                 engine: aws_rds_1.DatabaseClusterEngine.auroraPostgres({
-                    version: configuration.dbVersion,
+                    version,
                 }),
                 parameters: {
                     "pg_stat_statements.track": "ALL",
                     random_page_cost: "1",
-                    work_mem: "524288", // 512 MiB
+                    work_mem: workmem.toString(),
                 },
-            })
-            : aws_rds_1.ParameterGroup.fromParameterGroupName(this, "ParameterGroup", `default.aurora-postgresql${configuration.dbVersion.auroraPostgresMajorVersion}`);
+            });
+            // create both cluster parameter group and instance parameter group
+            pg.bindToCluster({});
+            pg.bindToInstance({});
+            return pg;
+        });
     }
-    createClusterParameters(configuration, instanceName, vpc, securityGroup, parameterGroup) {
-        const secret = aws_secretsmanager_1.Secret.fromSecretCompleteArn(this, "DBSecret", configuration.secretArn);
+    createClusterParameters(secretArn, clusterConfiguration, instanceName, vpc, securityGroup, parameterGroup) {
+        const secret = aws_secretsmanager_1.Secret.fromSecretCompleteArn(this, "DBSecret", secretArn);
         return {
             engine: aws_rds_1.DatabaseClusterEngine.auroraPostgres({
-                version: configuration.dbVersion,
+                version: clusterConfiguration.dbVersion,
             }),
-            instances: configuration.instances,
+            instances: clusterConfiguration.instances,
             instanceUpdateBehaviour: aws_rds_1.InstanceUpdateBehaviour.ROLLING,
             instanceIdentifierBase: instanceName + "-",
             cloudwatchLogsExports: ["postgresql"],
             backup: {
-                retention: aws_cdk_lib_1.Duration.days(35),
+                retention: core_1.Duration.days(35),
                 preferredWindow: "01:00-02:00",
             },
             preferredMaintenanceWindow: "mon:03:00-mon:04:00",
             deletionProtection: true,
-            removalPolicy: aws_cdk_lib_1.RemovalPolicy.RETAIN,
+            removalPolicy: core_1.RemovalPolicy.RETAIN,
             port: DbStack.CLUSTER_PORT,
             instanceProps: {
                 autoMinorVersionUpgrade: true,
@@ -70,28 +88,29 @@ class DbStack extends aws_cdk_lib_1.Stack {
                 vpcSubnets: {
                     subnetType: aws_ec2_1.SubnetType.PRIVATE_WITH_EGRESS,
                 },
-                instanceType: configuration.dbInstanceType,
+                instanceType: clusterConfiguration.dbInstanceType,
                 parameterGroup,
             },
             credentials: aws_rds_1.Credentials.fromPassword(secret.secretValueFromJson("db.superuser").unsafeUnwrap(), secret.secretValueFromJson("db.superuser.password")),
             parameterGroup,
-            storageEncrypted: true,
-            monitoringInterval: aws_cdk_lib_1.Duration.seconds(30),
+            //            storageEncrypted: clusterConfiguration.storageEncrypted ?? true,
+            monitoringInterval: core_1.Duration.seconds(30),
         };
     }
-    createAuroraCluster(isc, configuration) {
+    createAuroraCluster(isc, configuration, clusterConfiguration, parameterGroups) {
         const instanceName = isc.environmentName + "-db";
-        const securityGroup = aws_ec2_1.SecurityGroup.fromSecurityGroupId(this, "securitygroup", configuration.securityGroupId);
-        const parameterGroup = this.createParamaterGroup(configuration);
+        const securityGroup = aws_ec2_1.SecurityGroup.fromSecurityGroupId(this, "securitygroup", clusterConfiguration.securityGroupId);
         const vpc = configuration.vpc
             ? configuration.vpc
             : (0, import_util_1.importVpc)(this, isc.environmentName);
-        const parameters = this.createClusterParameters(configuration, instanceName, vpc, securityGroup, parameterGroup);
+        const parameters = this.createClusterParameters(configuration.secretArn, clusterConfiguration, instanceName, vpc, securityGroup, parameterGroups[0]);
         // create cluster from the snapshot or from the scratch
-        const cluster = configuration.snapshotIdentifier
+        const cluster = clusterConfiguration.snapshotIdentifier
             ? new aws_rds_1.DatabaseClusterFromSnapshot(this, instanceName, {
                 ...parameters,
-                ...{ snapshotIdentifier: configuration.snapshotIdentifier },
+                ...{
+                    snapshotIdentifier: clusterConfiguration.snapshotIdentifier,
+                },
             })
             : new aws_rds_1.DatabaseCluster(this, instanceName, parameters);
         // this workaround should prevent stack failing on version upgrade
@@ -100,13 +119,12 @@ class DbStack extends aws_cdk_lib_1.Stack {
             throw new Error("Couldn't pull CfnDBInstances from the L1 constructs!");
         }
         cfnInstances.forEach((cfnInstance) => delete cfnInstance.engineVersion);
-        cluster.node.addDependency(parameterGroup);
         return cluster;
     }
 }
 exports.DbStack = DbStack;
+DbStack.CLUSTER_PORT = 5432;
 DbStack.CLUSTER_IDENTIFIER_EXPORT_NAME = "db-cluster";
 DbStack.CLUSTER_READ_ENDPOINT_EXPORT_NAME = "db-cluster-reader-endpoint";
 DbStack.CLUSTER_WRITE_ENDPOINT_EXPORT_NAME = "db-cluster-writer-endpoint";
-DbStack.CLUSTER_PORT = 5432;
 //# sourceMappingURL=db-stack.js.map

package/dist/aws/infra/stacks/intra-stack-configuration.d.ts

@@ -1,4 +1,4 @@
-import { Environment } from "aws-cdk-lib";
+import { Environment } from "aws-cdk-lib/core";
 export interface InfraStackConfiguration {
     readonly env: Environment;
     readonly environmentName: string;

package/dist/aws/infra/stacks/network-stack.d.ts

@@ -1,7 +1,7 @@
-import { Stack } from "aws-cdk-lib";
-import { Construct } from "constructs";
 import { IVpc, Vpc } from "aws-cdk-lib/aws-ec2";
 import { InfraStackConfiguration } from "./intra-stack-configuration";
+import { Stack } from "aws-cdk-lib/core";
+import { Construct } from "constructs/lib/construct";
 export interface NetworkConfiguration {
     readonly vpcName: string;
     readonly cidr: string;

package/dist/aws/infra/stacks/network-stack.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NetworkStack = void 0;
-const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
 const import_util_1 = require("../import-util");
-class NetworkStack extends aws_cdk_lib_1.Stack {
+const core_1 = require("aws-cdk-lib/core");
+class NetworkStack extends core_1.Stack {
     constructor(scope, id, isc, configuration) {
         super(scope, id, {
             env: isc.env,
@@ -19,7 +19,7 @@ class NetworkStack extends aws_cdk_lib_1.Stack {
     createVpc(configuration) {
         return new aws_ec2_1.Vpc(this, "DigitrafficVPC", {
             vpcName: configuration.vpcName,
-            availabilityZones: aws_cdk_lib_1.Stack.of(this)
+            availabilityZones: core_1.Stack.of(this)
                 .availabilityZones.sort()
                 .slice(0, 2),
             enableDnsHostnames: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digitraffic/common",
-  "version": "2023.9.11-1",
+  "version": "2023.9.14-1",
   "description": "",
   "repository": {
     "type": "git",

package/src/aws/infra/import-util.ts

@@ -3,7 +3,7 @@ import { CfnOutput, Fn, Stack } from "aws-cdk-lib";
 import { Construct } from "constructs";
 
 export class OldStackImports {
-    public static AURORAINSTANCE_SG_IMPORT_NAME = "AuroraInstanceSG";
+    public static AURORAINSTANCE_SG_IMPORT_NAME = "AuroraSG";
     public static RDSPROXY_SG_IMPORT_NAME = "RDSProxySG";
 }
 

package/src/aws/infra/stack/parameters.ts

@@ -0,0 +1,74 @@
+import { StringParameter } from "aws-cdk-lib/aws-ssm";
+import { Construct } from "constructs/lib/construct";
+
+const SSM_ROOT = "/digitraffic" as const;
+const MONITORING_ROOT = "/monitoring" as const;
+const DB_ROOT = "/db" as const;
+
+interface Parameter {
+    readonly id?: string;
+    readonly parameterName: string;
+    readonly description?: string;
+}
+
+const PARAMETERS = {
+    "topic.alarm": {
+        parameterName: `${SSM_ROOT}${MONITORING_ROOT}/alarm-topic`,
+    },
+    "topic.warning": {
+        parameterName: `${SSM_ROOT}${MONITORING_ROOT}/warning-topic`,
+    },
+    "cluster.reader": {
+        id: "ClusterReaderEndpointParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/reader-endpoint`,
+        description: "Cluster reader endpoint",
+    },
+    "cluster.writer": {
+        id: "ClusterWriterEndpointParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/writer-endpoint`,
+        description: "Cluster writer endpoint",
+    },
+    "cluster.identifier": {
+        id: "ClusterIdentifierParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/identifier`,
+        description: "Cluster identifier",
+    },
+    "proxy.reader": {
+        id: "ProxyReaderEndpointParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/proxy-reader-endpoint`,
+        description: "Proxy reader endpoint",
+    },
+    "proxy.writer": {
+        id: "ProxyWriterEndpointParameter",
+        parameterName: `${SSM_ROOT}${DB_ROOT}/proxy-writer-endpoint`,
+        description: "Proxy writer endpoint",
+    },
+} as const satisfies Record<string, Parameter>;
+
+export type ReadParameterType = keyof typeof PARAMETERS;
+export type WriteParameterType = Exclude<
+    Exclude<ReadParameterType, "topic.alarm">,
+    "topic.warning"
+>;
+
+export function getParameterValue(
+    scope: Construct,
+    parameterType: ReadParameterType
+) {
+    const parameterName = PARAMETERS[parameterType].parameterName;
+    return StringParameter.valueForStringParameter(scope, parameterName);
+}
+
+export function createParameter(
+    scope: Construct,
+    parameterType: WriteParameterType,
+    stringValue: string
+): StringParameter {
+    const { id, parameterName, description } = PARAMETERS[parameterType];
+
+    return new StringParameter(scope, id, {
+        parameterName,
+        description,
+        stringValue,
+    });
+}

package/src/aws/infra/stacks/db-dns-stack.ts

@@ -1,5 +1,5 @@
 import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
-import { Construct } from "constructs";
+import { Construct } from "constructs/lib/construct";
 import {
     PrivateHostedZone,
     RecordSet,
@@ -7,9 +7,8 @@ import {
     RecordType,
 } from "aws-cdk-lib/aws-route53";
 import { InfraStackConfiguration } from "./intra-stack-configuration";
-import { importValue, importVpc } from "../import-util";
-import { DbStack } from "./db-stack";
-import { DbProxyStack } from "./db-proxy-stack";
+import { importVpc } from "../import-util";
+import { getParameterValue } from "../stack/parameters";
 
 const DEFAULT_RECORD_TTL = Duration.seconds(30);
 
@@ -37,23 +36,11 @@ export class DbDnsStack extends Stack {
 
         zone.applyRemovalPolicy(RemovalPolicy.RETAIN);
 
-        const clusterReaderEndpoint = importValue(
-            isc.environmentName,
-            DbStack.CLUSTER_READ_ENDPOINT_EXPORT_NAME
-        );
-        const clusterWriterEndpoint = importValue(
-            isc.environmentName,
-            DbStack.CLUSTER_WRITE_ENDPOINT_EXPORT_NAME
-        );
+        const clusterReaderEndpoint = getParameterValue(this, "cluster.reader");
+        const clusterWriterEndpoint = getParameterValue(this, "cluster.writer");
 
-        const proxyReaderEndpoint = importValue(
-            isc.environmentName,
-            DbProxyStack.PROXY_READER_EXPORT_NAME
-        );
-        const proxyWriterEndpoint = importValue(
-            isc.environmentName,
-            DbProxyStack.PROXY_WRITER_EXPORT_NAME
-        );
+        const proxyReaderEndpoint = getParameterValue(this, "proxy.reader");
+        const proxyWriterEndpoint = getParameterValue(this, "proxy.writer");
 
         new RecordSet(this, "ReaderRecord", {
             recordType: RecordType.CNAME,

package/src/aws/infra/stacks/db-proxy-stack.ts

@@ -1,5 +1,3 @@
-import { Duration, Stack } from "aws-cdk-lib";
-import { Construct } from "constructs";
 import {
     CfnDBProxyEndpoint,
     DatabaseCluster,
@@ -10,23 +8,33 @@ import {
 import { ISecret, Secret } from "aws-cdk-lib/aws-secretsmanager";
 import { IVpc, SecurityGroup } from "aws-cdk-lib/aws-ec2";
 import { InfraStackConfiguration } from "./intra-stack-configuration";
-import { DbConfiguration, DbStack } from "./db-stack";
-import { exportValue, importValue, importVpc } from "../import-util";
+import { DbStack } from "./db-stack";
+import { exportValue, importVpc } from "../import-util";
+import { createParameter } from "../stack/parameters";
+import { Stack, Duration } from "aws-cdk-lib/core";
+import { Construct } from "constructs/lib/construct";
+
+export interface ProxyConfiguration {
+    readonly secretArn: string;
+    readonly name?: string;
+    readonly securityGroupId: string;
+    readonly clusterIdentifier: string;
+}
 
 /**
  * A stack that creates a Database proxy.
  */
 export class DbProxyStack extends Stack {
+    readonly isc: InfraStackConfiguration;
+
     public static PROXY_READER_EXPORT_NAME = "db-reader-endpoint";
     public static PROXY_WRITER_EXPORT_NAME = "db-writer-endpoint";
 
-    readonly isc: InfraStackConfiguration;
-
     constructor(
         scope: Construct,
         id: string,
         isc: InfraStackConfiguration,
-        configuration: DbConfiguration
+        configuration: ProxyConfiguration
     ) {
         super(scope, id, {
             env: isc.env,
@@ -34,6 +42,10 @@ export class DbProxyStack extends Stack {
 
         this.isc = isc;
 
+        if (configuration.clusterIdentifier === "") {
+            throw new Error("Empty cluster identifier!");
+        }
+
         const vpc = importVpc(this, isc.environmentName);
         const secret = Secret.fromSecretAttributes(this, "proxy-secret", {
             secretCompleteArn: configuration.secretArn,
@@ -43,27 +55,44 @@ export class DbProxyStack extends Stack {
         const readerEndpoint = this.createProxyEndpoints(
             vpc,
             proxy,
-            configuration.proxy.securityGroupId
+            configuration.securityGroupId
         );
-        this.setOutputs(configuration, proxy, readerEndpoint);
+
+        createParameter(this, "proxy.reader", readerEndpoint.attrEndpoint);
+        createParameter(this, "proxy.writer", proxy.endpoint);
+
+        this.setOutputs(proxy);
     }
 
-    createProxy(vpc: IVpc, secret: ISecret, configuration: DbConfiguration) {
+    setOutputs(proxy: DatabaseProxy) {
+        // if only one instance, then there is no reader-endpoint
+        exportValue(
+            this,
+            this.isc.environmentName,
+            DbProxyStack.PROXY_READER_EXPORT_NAME,
+            proxy.endpoint
+        );
+        exportValue(
+            this,
+            this.isc.environmentName,
+            DbProxyStack.PROXY_WRITER_EXPORT_NAME,
+            proxy.endpoint
+        );
+    }
+
+    createProxy(vpc: IVpc, secret: ISecret, configuration: ProxyConfiguration) {
         const proxyId = `${this.isc.environmentName}-proxy`;
         const securityGroup = SecurityGroup.fromSecurityGroupId(
             this,
             "securitygroup",
-            configuration.proxy.securityGroupId
+            configuration.securityGroupId
         );
 
         const cluster = DatabaseCluster.fromDatabaseClusterAttributes(
             this,
             "db-cluster",
             {
-                clusterIdentifier: importValue(
-                    this.isc.environmentName,
-                    DbStack.CLUSTER_IDENTIFIER_EXPORT_NAME
-                ),
+                clusterIdentifier: configuration.clusterIdentifier,
                 engine: DatabaseClusterEngine.AURORA_POSTGRESQL,
                 port: DbStack.CLUSTER_PORT,
             }
@@ -76,7 +105,7 @@ export class DbProxyStack extends Stack {
         };
 
         return new DatabaseProxy(this, proxyId, {
-            dbProxyName: configuration.proxy.name ?? "AuroraProxy",
+            dbProxyName: configuration.name ?? "AuroraProxy",
             securityGroups: [securityGroup],
             proxyTarget: ProxyTarget.fromCluster(cluster),
             idleClientTimeout: Duration.seconds(1800),
@@ -102,29 +131,4 @@ export class DbProxyStack extends Stack {
             targetRole: "READ_ONLY",
         });
     }
-
-    setOutputs(
-        configuration: DbConfiguration,
-        proxy: DatabaseProxy,
-        proxyEndpoint: CfnDBProxyEndpoint
-    ) {
-        const readerEndpoint =
-            configuration.instances > 1
-                ? proxyEndpoint.attrEndpoint
-                : proxy.endpoint;
-
-        // if only one instance, then there is no reader-endpoint
-        exportValue(
-            this,
-            this.isc.environmentName,
-            DbProxyStack.PROXY_READER_EXPORT_NAME,
-            readerEndpoint
-        );
-        exportValue(
-            this,
-            this.isc.environmentName,
-            DbProxyStack.PROXY_WRITER_EXPORT_NAME,
-            proxy.endpoint
-        );
-    }
 }

package/src/aws/infra/stacks/db-stack.ts

@@ -1,10 +1,8 @@
-import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
 import {
     InstanceType,
     IVpc,
     SecurityGroup,
     SubnetType,
-    Vpc,
 } from "aws-cdk-lib/aws-ec2";
 import { ISecurityGroup } from "aws-cdk-lib/aws-ec2/lib/security-group";
 import {
@@ -19,30 +17,41 @@ import {
     IParameterGroup,
     ParameterGroup,
 } from "aws-cdk-lib/aws-rds";
-import { Construct } from "constructs";
+import { Construct } from "constructs/lib/construct";
 import { Secret } from "aws-cdk-lib/aws-secretsmanager";
 import { InfraStackConfiguration } from "./intra-stack-configuration";
 import { exportValue, importVpc } from "../import-util";
+import { Duration, RemovalPolicy, Stack } from "aws-cdk-lib/core";
+import { createParameter } from "../stack/parameters";
 
 export interface DbConfiguration {
+    readonly cluster?: ClusterConfiguration;
+    readonly clusterImport?: ClusterImportConfiguration;
+
+    readonly customParameterGroups: AuroraPostgresEngineVersion[];
+    readonly workmem?: number; // default 524288, 512MiB
+
     /** superuser username and password are fetched from this secret, using keys
      * db.superuser and db.superuser.password
      */
     readonly secretArn: string;
 
-    readonly dbVersion: AuroraPostgresEngineVersion;
+    /** If this is not specified, import default vpc */
+    readonly vpc?: IVpc;
+}
+
+export interface ClusterConfiguration {
+    readonly securityGroupId: string;
     readonly dbInstanceType: InstanceType;
     readonly snapshotIdentifier?: string;
     readonly instances: number;
-    readonly customParameterGroup: boolean;
-    readonly securityGroupId: string;
-    /** If this is not specified, import default vpc */
-    readonly vpc?: IVpc;
+    readonly dbVersion: AuroraPostgresEngineVersion;
+    readonly storageEncrypted?: boolean; /// default true
+}
 
-    readonly proxy: {
-        readonly name?: string;
-        readonly securityGroupId: string;
-    };
+export interface ClusterImportConfiguration {
+    readonly clusterReadEndpoint: string;
+    readonly clusterWriteEndpoint: string;
 }
 
 /**
@@ -51,22 +60,20 @@ export interface DbConfiguration {
  * Please not, that created Cluster has RETAIL removalPolicy, so if you want to delete the stack,
  * you must first deploy without parameter group, then delete stack and manually delete cluster.
  *
- * How to upgrade major version?
- * 0. Set correct SG for db-stack and db-proxy-stack(this step will be removed in the future)
- * 1. Update db-stack WITHOUT parameter group
- * 2. Upgrade extensions by hand
- * 3. Upgrade database from the AWS console
- * 4. Update db-stack with the upgraded version and custom parameter group
+ * You should deploy once with cluster and then without.  This way you can create the cluster with this
+ * stack, but cluster is not part of the stack after that.
  */
 
 export class DbStack extends Stack {
+    public static CLUSTER_PORT = 5432;
+
     public static CLUSTER_IDENTIFIER_EXPORT_NAME = "db-cluster";
     public static CLUSTER_READ_ENDPOINT_EXPORT_NAME =
         "db-cluster-reader-endpoint";
     public static CLUSTER_WRITE_ENDPOINT_EXPORT_NAME =
         "db-cluster-writer-endpoint";
 
-    public static CLUSTER_PORT = 5432;
+    public clusterIdentifier = "";
 
     constructor(
         scope: Construct,
@@ -78,53 +85,112 @@ export class DbStack extends Stack {
             env: isc.env,
         });
 
-        const cluster = this.createAuroraCluster(isc, configuration);
-
-        exportValue(
-            this,
-            isc.environmentName,
-            DbStack.CLUSTER_IDENTIFIER_EXPORT_NAME,
-            cluster.clusterIdentifier
-        );
-        exportValue(
-            this,
-            isc.environmentName,
-            DbStack.CLUSTER_WRITE_ENDPOINT_EXPORT_NAME,
-            cluster.clusterEndpoint.hostname
-        );
-        exportValue(
-            this,
-            isc.environmentName,
-            DbStack.CLUSTER_READ_ENDPOINT_EXPORT_NAME,
-            cluster.clusterReadEndpoint.hostname
+        const parameterGroups = this.createParameterGroups(
+            configuration.customParameterGroups,
+            configuration.workmem ?? 524288
         );
+
+        if (
+            (configuration.cluster && configuration.clusterImport) ||
+            (!configuration.cluster && !configuration.clusterImport)
+        ) {
+            throw new Error("Configure either cluster or clusterImport");
+        }
+
+        // create cluster if this is wanted, should do it only once
+        if (configuration.cluster) {
+            const cluster = this.createAuroraCluster(
+                isc,
+                configuration,
+                configuration.cluster,
+                parameterGroups
+            );
+
+            exportValue(
+                this,
+                isc.environmentName,
+                DbStack.CLUSTER_IDENTIFIER_EXPORT_NAME,
+                cluster.clusterIdentifier
+            );
+
+            exportValue(
+                this,
+                isc.environmentName,
+                DbStack.CLUSTER_WRITE_ENDPOINT_EXPORT_NAME,
+                cluster.clusterEndpoint.hostname
+            );
+
+            exportValue(
+                this,
+                isc.environmentName,
+                DbStack.CLUSTER_READ_ENDPOINT_EXPORT_NAME,
+                cluster.clusterReadEndpoint.hostname
+            );
+
+            createParameter(
+                this,
+                "cluster.reader",
+                cluster.clusterReadEndpoint.hostname
+            );
+            createParameter(
+                this,
+                "cluster.writer",
+                cluster.clusterEndpoint.hostname
+            );
+            createParameter(
+                this,
+                "cluster.identifier",
+                cluster.clusterIdentifier
+            );
+
+            this.clusterIdentifier = cluster.clusterIdentifier;
+        }
+
+        if (configuration.clusterImport) {
+            createParameter(
+                this,
+                "cluster.reader",
+                configuration.clusterImport.clusterReadEndpoint
+            );
+            createParameter(
+                this,
+                "cluster.writer",
+                configuration.clusterImport.clusterWriteEndpoint
+            );
+        }
     }
 
-    createParamaterGroup(configuration: DbConfiguration) {
-        return configuration.customParameterGroup
-            ? new ParameterGroup(
-                  this,
-                  `parameter-group-${configuration.dbVersion.auroraPostgresMajorVersion}`,
-                  {
-                      engine: DatabaseClusterEngine.auroraPostgres({
-                          version: configuration.dbVersion,
-                      }),
-                      parameters: {
-                          "pg_stat_statements.track": "ALL",
-                          random_page_cost: "1",
-                          work_mem: "524288", // 512 MiB
-                      },
-                  }
-              )
-            : ParameterGroup.fromParameterGroupName(
-                  this,
-                  "ParameterGroup",
-                  `default.aurora-postgresql${configuration.dbVersion.auroraPostgresMajorVersion}`
-              );
+    createParameterGroups(
+        customVersions: AuroraPostgresEngineVersion[],
+        workmem: number
+    ): IParameterGroup[] {
+        return customVersions.map((version: AuroraPostgresEngineVersion) => {
+            const pg = new ParameterGroup(
+                this,
+                `parameter-group-${version.auroraPostgresMajorVersion}`,
+                {
+                    engine: DatabaseClusterEngine.auroraPostgres({
+                        version,
+                    }),
+                    parameters: {
+                        "pg_stat_statements.track": "ALL",
+                        random_page_cost: "1",
+                        work_mem: workmem.toString(),
+                    },
+                }
+            );
+
+            // create both cluster parameter group and instance parameter group
+            pg.bindToCluster({});
+            pg.bindToInstance({});
+
+            return pg;
+        });
     }
 
     createClusterParameters(
-        configuration: DbConfiguration,
+        secretArn: string,
+        clusterConfiguration: ClusterConfiguration,
         instanceName: string,
         vpc: IVpc,
         securityGroup: ISecurityGroup,
@@ -133,14 +199,14 @@ export class DbStack extends Stack {
         const secret = Secret.fromSecretCompleteArn(
             this,
             "DBSecret",
-            configuration.secretArn
+            secretArn
         );
 
         return {
             engine: DatabaseClusterEngine.auroraPostgres({
-                version: configuration.dbVersion,
+                version: clusterConfiguration.dbVersion,
             }),
-            instances: configuration.instances,
+            instances: clusterConfiguration.instances,
             instanceUpdateBehaviour: InstanceUpdateBehaviour.ROLLING,
             instanceIdentifierBase: instanceName + "-",
             cloudwatchLogsExports: ["postgresql"],
@@ -161,7 +227,7 @@ export class DbStack extends Stack {
                 vpcSubnets: {
                     subnetType: SubnetType.PRIVATE_WITH_EGRESS,
                 },
-                instanceType: configuration.dbInstanceType,
+                instanceType: clusterConfiguration.dbInstanceType,
                 parameterGroup,
             },
             credentials: Credentials.fromPassword(
@@ -169,39 +235,44 @@ export class DbStack extends Stack {
                 secret.secretValueFromJson("db.superuser.password")
             ),
             parameterGroup,
-            storageEncrypted: true,
+            //            storageEncrypted: clusterConfiguration.storageEncrypted ?? true,
             monitoringInterval: Duration.seconds(30),
         };
     }
 
     createAuroraCluster(
         isc: InfraStackConfiguration,
-        configuration: DbConfiguration
+        configuration: DbConfiguration,
+        clusterConfiguration: ClusterConfiguration,
+        parameterGroups: IParameterGroup[]
     ): DatabaseCluster {
         const instanceName = isc.environmentName + "-db";
         const securityGroup = SecurityGroup.fromSecurityGroupId(
             this,
             "securitygroup",
-            configuration.securityGroupId
+            clusterConfiguration.securityGroupId
         );
-        const parameterGroup = this.createParamaterGroup(configuration);
         const vpc = configuration.vpc
             ? configuration.vpc
             : importVpc(this, isc.environmentName);
 
         const parameters = this.createClusterParameters(
-            configuration,
+            configuration.secretArn,
+            clusterConfiguration,
             instanceName,
             vpc,
             securityGroup,
-            parameterGroup
+            parameterGroups[0]
         );
 
         // create cluster from the snapshot or from the scratch
-        const cluster = configuration.snapshotIdentifier
+        const cluster = clusterConfiguration.snapshotIdentifier
             ? new DatabaseClusterFromSnapshot(this, instanceName, {
                   ...parameters,
-                  ...{ snapshotIdentifier: configuration.snapshotIdentifier },
+                  ...{
+                      snapshotIdentifier:
+                          clusterConfiguration.snapshotIdentifier,
+                  },
               })
             : new DatabaseCluster(this, instanceName, parameters);
 
@@ -216,8 +287,6 @@ export class DbStack extends Stack {
         }
         cfnInstances.forEach((cfnInstance) => delete cfnInstance.engineVersion);
 
-        cluster.node.addDependency(parameterGroup);
-
         return cluster;
     }
 }

package/src/aws/infra/stacks/intra-stack-configuration.ts

@@ -1,4 +1,4 @@
-import { Environment } from "aws-cdk-lib";
+import { Environment } from "aws-cdk-lib/core";
 
 export interface InfraStackConfiguration {
     readonly env: Environment;

package/src/aws/infra/stacks/network-stack.ts

@@ -1,8 +1,8 @@
-import { Stack } from "aws-cdk-lib";
-import { Construct } from "constructs";
 import { IpAddresses, IVpc, SubnetType, Vpc } from "aws-cdk-lib/aws-ec2";
 import { InfraStackConfiguration } from "./intra-stack-configuration";
 import { exportValue } from "../import-util";
+import { Stack } from "aws-cdk-lib/core";
+import { Construct } from "constructs/lib/construct";
 
 export interface NetworkConfiguration {
     readonly vpcName: string;