@fjall/components-infrastructure 27.0.0 → 27.1.0

package/dist/lib/patterns/aws/database.js

@@ -12,7 +12,7 @@ import { Port } from "aws-cdk-lib/aws-ec2";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { MIGRATION_SNAPSHOT_NAME_PREFIX } from "./interfaces/database.js";
 import { pickLatestPrismaMigration } from "../../utils/migrationVersionResolvers.js";
-import { SCHEMA_GATE_DB_PASSWORD_ENV, SCHEMA_GATE_DB_URL_BASE_ENV, SCHEMA_GATE_DB_USER_ENV } from "@fjall/util/migration";
+import { MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV, SCHEMA_GATE_DB_PASSWORD_ENV, SCHEMA_GATE_DB_URL_BASE_ENV, SCHEMA_GATE_DB_USER_ENV } from "@fjall/util/migration";
 import { DatabaseClusterEngine, DatabaseInstanceEngine, AuroraPostgresEngineVersion, AuroraMysqlEngineVersion, PostgresEngineVersion, MysqlEngineVersion } from "aws-cdk-lib/aws-rds";
 import { Duration } from "aws-cdk-lib";
 export { isAwsManagedKey, isCMKRequested, AWS_MANAGED, USE_CMK } from "../../utils/databaseTypes.js";
@@ -296,11 +296,13 @@ const SNAPSHOT_ACTION_TABLE = {
     instance: {
         createAction: "rds:CreateDBSnapshot",
         describeAction: "rds:DescribeDBSnapshots",
+        deleteAction: "rds:DeleteDBSnapshot",
         resourceArnSegment: "snapshot"
     },
     cluster: {
         createAction: "rds:CreateDBClusterSnapshot",
         describeAction: "rds:DescribeDBClusterSnapshots",
+        deleteAction: "rds:DeleteDBClusterSnapshot",
         resourceArnSegment: "cluster-snapshot"
     }
 };
@@ -540,6 +542,10 @@ export class RelationalDatabase extends Construct {
             actions: [
                 triple.createAction,
                 triple.describeAction,
+                // Delete is confined to fjall-premigrate-* by IAM: a Delete request's
+                // resource is always a snapshot ARN, which only the prefix glob below
+                // can match — never the instance/cluster ARN.
+                triple.deleteAction,
                 "rds:AddTagsToResource"
             ],
             resources: [
@@ -605,6 +611,7 @@ export class RelationalDatabase extends Construct {
             const target = this.getSnapshotTarget();
             environment.SNAPSHOT_TARGET_KIND = target.kind;
             environment.SNAPSHOT_TARGET_ARN = target.arn;
+            environment[MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV] = String(this.database.getBackupRetentionDays());
         }
         const credentials = this.getCredentials();
         const secretsImport = {

package/dist/lib/patterns/aws/interfaces/database.d.ts

@@ -127,9 +127,12 @@ export interface IRelationalDatabaseBase extends IDatabase, IConnectable, IMigra
     getSnapshotTarget(): SnapshotTarget;
     /**
      * Returns the IAM PolicyStatement granting the migration runner the rights
-     * needed to take and tag a pre-migration snapshot of this database. Action
-     * triple and resource ARN segment derive from `this.getSnapshotTarget().kind`.
-     * Snapshot name glob is bound to `MIGRATION_SNAPSHOT_NAME_PREFIX`.
+     * needed to take, tag, describe, and prune pre-migration snapshots of this
+     * database. Actions and resource ARN segment derive from
+     * `this.getSnapshotTarget().kind`. Snapshot name glob is bound to
+     * `MIGRATION_SNAPSHOT_NAME_PREFIX`; the delete action can only ever match
+     * that glob (a Delete request's resource is a snapshot ARN, never the
+     * database ARN), confining pruning to premigrate snapshots.
      */
     getMigrationSnapshotPolicy(): PolicyStatement;
     /**

package/dist/lib/resources/aws/database/rdsAurora.d.ts

@@ -97,6 +97,7 @@ export declare class RdsAurora extends Construct implements IConnectable {
     private databaseCredentials;
     private cfnCluster?;
     private databaseNameValue;
+    private backupRetentionDaysValue;
     constructor(scope: Construct, id: string, props: RdsProps);
     private buildReaders;
     private addProxy;
@@ -108,6 +109,13 @@ export declare class RdsAurora extends Construct implements IConnectable {
     getSnapshotTarget(): Extract<SnapshotTarget, {
         kind: "cluster";
     }>;
+    /**
+     * Effective automated-backup retention in whole days (the applied
+     * `backupRetention`, defaulted). Feeds `MIGRATION_SNAPSHOT_RETENTION_DAYS`
+     * so the migration runner prunes pre-migration snapshots against the same
+     * window the cluster's PITR actually covers.
+     */
+    getBackupRetentionDays(): number;
     getDatabaseName(): string;
     getConnectionString(): string;
     getCfnCluster(): CfnDBCluster | undefined;

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -62,6 +62,7 @@ export class RdsAurora extends Construct {
     databaseCredentials;
     cfnCluster;
     databaseNameValue;
+    backupRetentionDaysValue;
     constructor(scope, id, props) {
         super(scope, id);
         validateServerlessV2DevKnobs(props);
@@ -163,6 +164,8 @@ export class RdsAurora extends Construct {
         const vpcSubnets = props.publiclyAccessible
             ? { subnetType: SubnetType.PUBLIC }
             : { subnetType: SubnetType.PRIVATE_WITH_EGRESS };
+        this.backupRetentionDaysValue =
+            props.backupRetention ?? RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS;
         // Common props shared across all cluster creation paths
         const baseClusterProps = {
             vpc: props.vpc,
@@ -171,7 +174,7 @@ export class RdsAurora extends Construct {
             engine,
             parameterGroup,
             backup: {
-                retention: Duration.days(props.backupRetention ?? RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS)
+                retention: Duration.days(this.backupRetentionDaysValue)
             },
             storageEncrypted: true,
             ...(storageEncryptionKey && { storageEncryptionKey }),
@@ -361,6 +364,15 @@ export class RdsAurora extends Construct {
     getSnapshotTarget() {
         return { kind: "cluster", arn: this.databaseCluster.clusterArn };
     }
+    /**
+     * Effective automated-backup retention in whole days (the applied
+     * `backupRetention`, defaulted). Feeds `MIGRATION_SNAPSHOT_RETENTION_DAYS`
+     * so the migration runner prunes pre-migration snapshots against the same
+     * window the cluster's PITR actually covers.
+     */
+    getBackupRetentionDays() {
+        return this.backupRetentionDaysValue;
+    }
     getDatabaseName() {
         return this.databaseNameValue;
     }

package/dist/lib/resources/aws/database/rdsAuroraGlobal.d.ts

@@ -81,6 +81,13 @@ export declare class RdsAuroraGlobal extends Construct implements IConnectable {
         kind: "cluster";
     }>;
     getDatabaseName(): string;
+    /**
+     * Effective automated-backup retention in whole days, delegated to the
+     * regional cluster that actually applies the default. Feeds
+     * `MIGRATION_SNAPSHOT_RETENTION_DAYS` so the migration runner prunes
+     * pre-migration snapshots against the same window PITR actually covers.
+     */
+    getBackupRetentionDays(): number;
     getConnectionString(): string;
 }
 export {};

package/dist/lib/resources/aws/database/rdsAuroraGlobal.js

@@ -182,6 +182,21 @@ export class RdsAuroraGlobal extends Construct {
             return this.regionalCluster.getDatabaseName();
         throw new Error("No Aurora cluster available to return database name from");
     }
+    /**
+     * Effective automated-backup retention in whole days, delegated to the
+     * regional cluster that actually applies the default. Feeds
+     * `MIGRATION_SNAPSHOT_RETENTION_DAYS` so the migration runner prunes
+     * pre-migration snapshots against the same window PITR actually covers.
+     */
+    getBackupRetentionDays() {
+        if (this.primaryCluster) {
+            return this.primaryCluster.getBackupRetentionDays();
+        }
+        if (this.regionalCluster) {
+            return this.regionalCluster.getBackupRetentionDays();
+        }
+        throw new Error("No Aurora cluster available to return backup retention from");
+    }
     getConnectionString() {
         if (this.primaryCluster)
             return this.primaryCluster.getConnectionString();

package/dist/lib/resources/aws/database/rdsInstance.d.ts

@@ -71,6 +71,7 @@ export declare class RdsInstance extends Construct implements IConnectable {
     private databaseProxySecurityGroup?;
     private readReplicaSecurityGroup?;
     private databaseNameValue;
+    private backupRetentionDaysValue;
     private readonly constructId;
     constructor(scope: Construct, id: string, props: RdsProps);
     private addDatabase;
@@ -84,6 +85,13 @@ export declare class RdsInstance extends Construct implements IConnectable {
     getSnapshotTarget(): Extract<SnapshotTarget, {
         kind: "instance";
     }>;
+    /**
+     * Effective automated-backup retention in whole days (the applied
+     * `backupRetention`, defaulted). Feeds `MIGRATION_SNAPSHOT_RETENTION_DAYS`
+     * so the migration runner prunes pre-migration snapshots against the same
+     * window the instance's PITR actually covers.
+     */
+    getBackupRetentionDays(): number;
     getDatabaseName(): string;
     getConnectionString(): string;
     /**

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -29,6 +29,7 @@ export class RdsInstance extends Construct {
     databaseProxySecurityGroup;
     readReplicaSecurityGroup;
     databaseNameValue;
+    backupRetentionDaysValue;
     constructId;
     constructor(scope, id, props) {
         super(scope, id);
@@ -121,6 +122,11 @@ export class RdsInstance extends Construct {
         const subnetType = props.publiclyAccessible
             ? SubnetType.PUBLIC
             : SubnetType.PRIVATE_WITH_EGRESS;
+        const backupRetention = props.backupRetention ??
+            Duration.days(RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS);
+        // toDays() throws on a fractional Duration — same whole-days contract the
+        // L2 DatabaseInstance enforces, surfaced at synth either way.
+        this.backupRetentionDaysValue = backupRetention.toDays();
         const commonInstanceProps = {
             vpc: this.vpc,
             vpcSubnets: {
@@ -130,8 +136,7 @@ export class RdsInstance extends Construct {
             engine,
             parameterGroup,
             allocatedStorage: props.allocatedStorage,
-            backupRetention: props.backupRetention ??
-                Duration.days(RDS_DEFAULTS.BACKUP_RETENTION_DEFAULT_DAYS),
+            backupRetention,
             preferredBackupWindow: props.preferredBackupWindow ?? "02:00-03:00",
             storageEncrypted: true,
             storageEncryptionKey,
@@ -357,6 +362,15 @@ exports.handler = async (event) => {
     getSnapshotTarget() {
         return { kind: "instance", arn: this.database.instanceArn };
     }
+    /**
+     * Effective automated-backup retention in whole days (the applied
+     * `backupRetention`, defaulted). Feeds `MIGRATION_SNAPSHOT_RETENTION_DAYS`
+     * so the migration runner prunes pre-migration snapshots against the same
+     * window the instance's PITR actually covers.
+     */
+    getBackupRetentionDays() {
+        return this.backupRetentionDaysValue;
+    }
     getDatabaseName() {
         return this.databaseNameValue;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "27.0.0",
+  "version": "27.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -78,8 +78,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^27.0.0",
-    "@fjall/util": "^27.0.0",
+    "@fjall/generator": "^27.1.0",
+    "@fjall/util": "^27.1.0",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },