@fjall/components-infrastructure 2.24.0 → 2.25.0

package/dist/lib/resources/aws/database/rdsAurora.d.ts

@@ -56,6 +56,7 @@ export declare class RdsAurora extends Construct implements IConnectable {
     connections: Connections;
     private readonly constructId;
     private port;
+    private clientPort;
     private engineConfig;
     private databaseCluster;
     private databaseProxy?;

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -1,4 +1,5 @@
-import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import { Annotations, Duration, RemovalPolicy } from "aws-cdk-lib";
+import { ENGINE_DEFAULT_DATABASE_PORTS } from "@fjall/generator";
 import { Connections, Peer, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { AuroraPostgresEngineVersion, CaCertificate, ClusterInstance, Credentials, DatabaseCluster, DatabaseClusterFromSnapshot, DatabaseClusterEngine, DatabaseProxy, ParameterGroup, ProxyTarget, SnapshotCredentials } from "aws-cdk-lib/aws-rds";
 import { Construct } from "constructs";
@@ -14,6 +15,7 @@ export class RdsAurora extends Construct {
     connections;
     constructId;
     port;
+    clientPort;
     engineConfig;
     databaseCluster;
     databaseProxy;
@@ -23,10 +25,16 @@ export class RdsAurora extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.constructId = id;
-        this.port = props.port ?? RDS_DEFAULTS.DEFAULT_PORT;
         this.databaseNameValue = props.databaseName ?? id;
         // PostgreSQL fallback for direct usage - ensure engine and engineConfig match
         this.engineConfig = props.engineConfig ?? DEFAULT_POSTGRES_ENGINE_CONFIG;
+        const engineDefaultPort = ENGINE_DEFAULT_DATABASE_PORTS[this.engineConfig.family];
+        this.port = props.port ?? engineDefaultPort;
+        // RDS Proxy listens exclusively on the engine-default port (CreateDBProxy
+        // has no port parameter), so the client-facing surface must advertise it
+        // whenever a proxy fronts the cluster.
+        const proxyEnabled = props.proxy !== undefined && props.proxy !== false;
+        this.clientPort = proxyEnabled ? engineDefaultPort : this.port;
         const { piEnabled, piConfig } = resolveDatabaseInsights(props.databaseInsights);
         // Username priority: snapshotUsername > credentials.username > engine default
         const username = props.snapshotIdentifier && props.snapshotUsername
@@ -158,7 +166,6 @@ export class RdsAurora extends Construct {
             this.cfnCluster.masterUserPassword = undefined;
             this.cfnCluster.databaseName = undefined;
         }
-        const proxyEnabled = props.proxy !== undefined && props.proxy !== false;
         if (proxyEnabled) {
             this.addProxy(props, clusterSecurityGroup);
         }
@@ -214,18 +221,26 @@ export class RdsAurora extends Construct {
             });
         });
     }
-    addProxy(props, securityGroup) {
+    addProxy(props, clusterSecurityGroup) {
         if (!props.proxy)
             return;
         const proxyConfig = props.proxy;
         const vpcSubnets = proxyConfig.vpcSubnets ?? {
             subnetType: SubnetType.PRIVATE_WITH_EGRESS
         };
+        const proxySecurityGroup = new SecurityGroup(this, `${this.databaseNameValue}ProxySecurityGroup`, {
+            vpc: props.vpc,
+            description: `Security group for RDS Proxy ${this.databaseNameValue}`
+        });
+        clusterSecurityGroup.addIngressRule(proxySecurityGroup, Port.tcp(this.port), "Allow RDS Proxy to connect to Aurora cluster");
+        if (props.allowVpcAccess) {
+            proxySecurityGroup.addIngressRule(Peer.ipv4(props.vpc.vpcCidrBlock), Port.tcp(this.clientPort), "Allow access from VPC CIDR");
+        }
         this.databaseProxy = new DatabaseProxy(this, `${this.databaseNameValue}DatabaseProxy`, {
             dbProxyName: ResourceNaming.proxyName(this.constructId),
             proxyTarget: ProxyTarget.fromCluster(this.databaseCluster),
             secrets: [this.databaseCredentials.secret],
-            securityGroups: [securityGroup],
+            securityGroups: [proxySecurityGroup],
             vpc: props.vpc,
             vpcSubnets,
             requireTLS: proxyConfig.requireTLS ?? true,
@@ -235,6 +250,19 @@ export class RdsAurora extends Construct {
             maxConnectionsPercent: proxyConfig.maxConnections,
             maxIdleConnectionsPercent: proxyConfig.maxIdleConnections
         });
+        // The proxy is now the client-facing surface: grantConnect /
+        // allowDefaultPortFrom must open the PROXY security group on the proxy's
+        // fixed engine-default listener port, not the cluster SG on the DB port.
+        this.connections = new Connections({
+            securityGroups: [proxySecurityGroup],
+            defaultPort: Port.tcp(this.clientPort)
+        });
+        if (this.port !== this.clientPort) {
+            Annotations.of(this).addWarning(`Database '${this.databaseNameValue}' listens on port ${this.port}, but its ` +
+                `RDS Proxy accepts client connections only on ${this.clientPort} (the engine ` +
+                `default — AWS does not allow configuring the proxy listener port). Fjall ` +
+                `advertises ${this.clientPort}; direct-to-database access uses ${this.port}.`);
+        }
         addProxyCfnOutput(this, this.constructId, this.databaseNameValue, this.databaseProxy);
     }
     addSecretRotation(props) {
@@ -257,7 +285,7 @@ export class RdsAurora extends Construct {
         return this.databaseCluster.clusterEndpoint.hostname;
     }
     getHostPort() {
-        return String(this.port);
+        return String(this.clientPort);
     }
     getCredentials() {
         return this.databaseCredentials;

package/dist/lib/resources/aws/database/rdsAuroraGlobal.d.ts

@@ -43,7 +43,7 @@ interface RdsAuroraGlobalProps {
     monitoringInterval?: Duration;
     /** Preferred maintenance window. Default: "Sat:12:30-Sat:20:30" */
     preferredMaintenanceWindow?: string;
-    /** Database port. Default: RDS_DEFAULTS.DEFAULT_PORT */
+    /** Database port. Default: engine default (5432 postgresql / 3306 mysql) */
     port?: number;
     databaseInsights?: DatabaseInsightsConfig | false;
     deletionProtection?: boolean;

package/dist/lib/resources/aws/database/rdsDefaults.d.ts

@@ -1,7 +1,5 @@
 import { Duration } from "aws-cdk-lib";
 export declare const RDS_DEFAULTS: Readonly<{
-    /** Default database port: FJALL on phone keypad */
-    readonly DEFAULT_PORT: 35255;
     /** Saturday window in UTC — minimises weekday impact for scheduled maintenance */
     readonly PREFERRED_MAINTENANCE_WINDOW: "Sat:12:30-Sat:20:30";
     /** 1 minute — balances monitoring granularity against CloudWatch costs */

package/dist/lib/resources/aws/database/rdsDefaults.js

@@ -1,7 +1,5 @@
 import { Duration } from "aws-cdk-lib";
 export const RDS_DEFAULTS = Object.freeze({
-    /** Default database port: FJALL on phone keypad */
-    DEFAULT_PORT: 35255,
     /** Saturday window in UTC — minimises weekday impact for scheduled maintenance */
     PREFERRED_MAINTENANCE_WINDOW: "Sat:12:30-Sat:20:30",
     /** 1 minute — balances monitoring granularity against CloudWatch costs */

package/dist/lib/resources/aws/database/rdsInstance.d.ts

@@ -57,6 +57,7 @@ export declare class RdsInstance extends Construct implements IConnectable {
     databaseSecurityGroup: SecurityGroup;
     vpc: IVpc;
     private port;
+    private clientPort;
     private engineConfig;
     private databaseCredentials;
     private database;

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -1,4 +1,5 @@
-import { Duration, RemovalPolicy } from "aws-cdk-lib";
+import { Annotations, Duration, RemovalPolicy } from "aws-cdk-lib";
+import { ENGINE_DEFAULT_DATABASE_PORTS } from "@fjall/generator";
 import { Connections, InstanceType, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { CaCertificate, Credentials, DatabaseInstance, DatabaseInstanceFromSnapshot, DatabaseInstanceEngine, DatabaseInstanceReadReplica, DatabaseProxy, ParameterGroup, PostgresEngineVersion, ProxyTarget, SnapshotCredentials, StorageType } from "aws-cdk-lib/aws-rds";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
@@ -19,6 +20,7 @@ export class RdsInstance extends Construct {
     databaseSecurityGroup;
     vpc;
     port;
+    clientPort;
     engineConfig;
     databaseCredentials;
     database;
@@ -31,11 +33,17 @@ export class RdsInstance extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.constructId = id;
-        this.port = props.port ?? RDS_DEFAULTS.DEFAULT_PORT;
         this.vpc = props.vpc;
         this.databaseNameValue = props.databaseName ?? id.replace("Rds", "");
         // PostgreSQL fallback for direct usage - ensure engine and engineConfig match
         this.engineConfig = props.engineConfig ?? DEFAULT_POSTGRES_ENGINE_CONFIG;
+        const engineDefaultPort = ENGINE_DEFAULT_DATABASE_PORTS[this.engineConfig.family];
+        this.port = props.port ?? engineDefaultPort;
+        // RDS Proxy listens exclusively on the engine-default port (CreateDBProxy
+        // has no port parameter), so the client-facing surface must advertise it
+        // whenever a proxy fronts the database.
+        const proxyEnabled = props.proxy !== undefined && props.proxy !== false;
+        this.clientPort = proxyEnabled ? engineDefaultPort : this.port;
         this.addDatabase(props);
         // Secret rotation enabled by default (opt-out with secretRotation: false)
         const secretRotationDisabled = props.credentials?.secretRotation === false;
@@ -196,6 +204,19 @@ export class RdsInstance extends Construct {
             maxConnectionsPercent: proxyConfig.maxConnections,
             maxIdleConnectionsPercent: proxyConfig.maxIdleConnections
         });
+        // The proxy is now the client-facing surface: grantConnect /
+        // allowDefaultPortFrom must open the PROXY security group on the proxy's
+        // fixed engine-default listener port, not the database SG on the DB port.
+        this.connections = new Connections({
+            securityGroups: [this.databaseProxySecurityGroup],
+            defaultPort: Port.tcp(this.clientPort)
+        });
+        if (this.port !== this.clientPort) {
+            Annotations.of(this).addWarning(`Database '${this.databaseNameValue}' listens on port ${this.port}, but its ` +
+                `RDS Proxy accepts client connections only on ${this.clientPort} (the engine ` +
+                `default — AWS does not allow configuring the proxy listener port). Fjall ` +
+                `advertises ${this.clientPort}; direct-to-database access uses ${this.port}.`);
+        }
         addProxyCfnOutput(this, this.constructId, this.databaseNameValue, this.databaseProxy);
     }
     addReadReplica(props) {
@@ -312,7 +333,7 @@ exports.handler = async (event) => {
         }
     }
     getHostPort() {
-        return String(this.port);
+        return String(this.clientPort);
     }
     getCredentials() {
         return this.databaseCredentials;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.24.0",
+  "version": "2.25.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -64,8 +64,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.24.0",
-    "@fjall/util": "^2.24.0",
+    "@fjall/generator": "^2.25.0",
+    "@fjall/util": "^2.25.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -79,5 +79,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "616d7af846f0eebfa3409f5f47c98fbee836bad9"
+  "gitHead": "7c1a329184064aefa557c2c09de0965c4f8cd4fb"
 }