@fjall/components-infrastructure 2.20.0 → 2.21.0

package/dist/lib/patterns/aws/database.d.ts

@@ -27,7 +27,6 @@ export declare const DATABASE_ENGINE_CONFIG: Record<DatabaseEngine, {
     };
     defaultUsername: string;
     sslParameters: Record<string, string>;
-    rotationAppName: string;
 }>;
 export declare function getAuroraClusterEngine(engine: DatabaseEngine): IClusterEngine;
 export declare function getInstanceEngine(engine: DatabaseEngine): IInstanceEngine;

package/dist/lib/patterns/aws/database.js

@@ -19,16 +19,14 @@ export const DATABASE_ENGINE_CONFIG = Object.freeze({
         aurora: { version: "16.6", majorVersion: "16" },
         instance: { version: "17.5", majorVersion: "17" },
         defaultUsername: "postgres",
-        sslParameters: { "rds.force_ssl": "1" },
-        rotationAppName: "SecretsManagerRDSPostgreSQLRotationMultiUser"
+        sslParameters: { "rds.force_ssl": "1" }
     },
     mysql: {
         // majorVersion must be Aurora version (3.08.0), NOT MySQL version (8.0)
         aurora: { version: "8.0.mysql_aurora.3.08.0", majorVersion: "3.08.0" },
         instance: { version: "8.4.4", majorVersion: "8.4" },
         defaultUsername: "admin",
-        sslParameters: { require_secure_transport: "ON" },
-        rotationAppName: "SecretsManagerRDSMySQLRotationMultiUser"
+        sslParameters: { require_secure_transport: "ON" }
     }
 });
 const AURORA_ENGINE_FACTORIES = {
@@ -70,8 +68,7 @@ export function getEngineConfig(engine) {
     return {
         family: engine,
         defaultUsername: config.defaultUsername,
-        sslParameters: config.sslParameters,
-        rotationAppName: config.rotationAppName
+        sslParameters: config.sslParameters
     };
 }
 /**

package/dist/lib/resources/aws/database/rdsDefaults.d.ts

@@ -6,8 +6,6 @@ export declare const RDS_DEFAULTS: Readonly<{
     readonly PREFERRED_MAINTENANCE_WINDOW: "Sat:12:30-Sat:20:30";
     /** 1 minute — balances monitoring granularity against CloudWatch costs */
     readonly MONITORING_INTERVAL: Duration;
-    /** SecretsManager rotation application version for multi-user rotation */
-    readonly ROTATION_APP_VERSION: "1.1.367";
     /** Default backup retention in days — applied uniformly across Aurora and RDS Instance */
     readonly BACKUP_RETENTION_DEFAULT_DAYS: 14;
     /** Default instance type — primary and read-replica must stay in lockstep */

package/dist/lib/resources/aws/database/rdsDefaults.js

@@ -6,8 +6,6 @@ export const RDS_DEFAULTS = Object.freeze({
     PREFERRED_MAINTENANCE_WINDOW: "Sat:12:30-Sat:20:30",
     /** 1 minute — balances monitoring granularity against CloudWatch costs */
     MONITORING_INTERVAL: Duration.minutes(1),
-    /** SecretsManager rotation application version for multi-user rotation */
-    ROTATION_APP_VERSION: "1.1.367",
     /** Default backup retention in days — applied uniformly across Aurora and RDS Instance */
     BACKUP_RETENTION_DEFAULT_DAYS: 14,
     /** Default instance type — primary and read-replica must stay in lockstep */

package/dist/lib/resources/aws/database/rdsHelpers.js

@@ -2,14 +2,27 @@ import { Duration } from "aws-cdk-lib";
 import { SecretRotation, SecretRotationApplication } from "aws-cdk-lib/aws-secretsmanager";
 import { CustomerManagedKey, Secret } from "../secrets/index.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
-import { RDS_DEFAULTS } from "./rdsDefaults.js";
 import { isAwsManagedKey, isCMKRequested } from "../../../utils/databaseTypes.js";
 /** Default PostgreSQL engine configuration used by both Aurora and Instance constructs. */
 export const DEFAULT_POSTGRES_ENGINE_CONFIG = {
     family: "postgresql",
     defaultUsername: "postgres",
-    sslParameters: { "rds.force_ssl": "1" },
-    rotationAppName: "SecretsManagerRDSPostgreSQLRotationMultiUser"
+    sslParameters: { "rds.force_ssl": "1" }
+};
+/**
+ * CDK's built-in multi-user rotation SAR applications, keyed by engine family.
+ *
+ * These MUST be the built-in static instances — never a hand-constructed
+ * `new SecretRotationApplication(name, version, …)`. CDK's `SecretRotation`
+ * eagerly builds a SAR mapping for all three partitions (aws / aws-cn /
+ * aws-us-gov) at synth time; a custom application only registers the `aws`
+ * partition's semantic version, so on aws-cdk-lib >= 2.258 synth throws
+ * `unsupported partition: aws-cn`. The built-ins carry every partition's
+ * version and AWS keeps them current.
+ */
+const MULTI_USER_ROTATION_APPLICATIONS = {
+    postgresql: SecretRotationApplication.POSTGRES_ROTATION_MULTI_USER,
+    mysql: SecretRotationApplication.MYSQL_ROTATION_MULTI_USER
 };
 /**
  * Resolve a storage encryption key spec into an IKey or undefined.
@@ -57,7 +70,7 @@ export function addMultiUserSecretRotation(params) {
         secretName: ResourceNaming.masterSecretName(params.constructId)
     });
     new SecretRotation(params.scope, `${params.databaseName}SecretRotation`, {
-        application: new SecretRotationApplication(params.engineConfig.rotationAppName, RDS_DEFAULTS.ROTATION_APP_VERSION, { isMultiUser: true }),
+        application: MULTI_USER_ROTATION_APPLICATIONS[params.engineConfig.family],
         secret: params.databaseSecret,
         masterSecret: masterSecret.secret,
         target: params.target,

package/dist/lib/utils/databaseTypes.d.ts

@@ -19,7 +19,6 @@ export interface EngineConfig {
     family: DatabaseEngine;
     defaultUsername: string;
     sslParameters: Record<string, string>;
-    rotationAppName: string;
 }
 export interface ProxyConfig {
     maxConnections?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.20.0",
+  "version": "2.21.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -63,20 +63,20 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.20.0",
-    "@fjall/util": "^2.20.0",
-    "constructs": "^10.0.0"
+    "@fjall/generator": "^2.21.0",
+    "@fjall/util": "^2.21.0",
+    "constructs": "^10.6.0"
   },
   "overrides": {
     "@smithy/core": "2.5.5"
   },
   "peerDependencies": {
-    "aws-cdk": "^2.239.0",
-    "aws-cdk-lib": "^2.239.0",
-    "constructs": "^10.0.0"
+    "aws-cdk": "^2.1128.1",
+    "aws-cdk-lib": "^2.260.0",
+    "constructs": "^10.6.0"
   },
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "ec556d44a8a32fbdc1a2e1ca3c1f22224b0d27c2"
+  "gitHead": "1b8902876c40697183ce8cbc25a0556b11d0ec38"
 }