@friggframework/devtools 2.0.0--canary.461.9483dbe.0 → 2.0.0--canary.461.637e5e4.0

package/infrastructure/domains/database/aurora-builder.js

@@ -281,6 +281,22 @@ class AuroraBuilder extends InfrastructureBuilder {
             });
         }
 
+        // Add security group ingress rule to allow Lambda to connect to Aurora
+        if (discoveredResources.auroraSecurityGroupId) {
+            result.resources.FriggAuroraIngressRule = {
+                Type: 'AWS::EC2::SecurityGroupIngress',
+                Properties: {
+                    GroupId: discoveredResources.auroraSecurityGroupId,
+                    IpProtocol: 'tcp',
+                    FromPort: discoveredResources.auroraPort || 5432,
+                    ToPort: discoveredResources.auroraPort || 5432,
+                    SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' },
+                    Description: 'Allow Lambda functions to connect to Aurora PostgreSQL',
+                },
+            };
+            console.log(`  ✅ Added security group ingress rule for Lambda → Aurora connectivity`);
+        }
+
         console.log(`  ✅ Discovered cluster configuration complete`);
     }
 

package/infrastructure/domains/database/aurora-builder.test.js

@@ -316,6 +316,33 @@ describe('AuroraBuilder', () => {
             expect(secretPermission).toBeDefined();
             expect(secretPermission.Resource).toBe('arn:aws:secretsmanager:us-east-1:123:secret:db');
         });
+
+        it('should add security group ingress rule for Lambda to Aurora connectivity', async () => {
+            const appDefinition = {
+                database: {
+                    postgres: {
+                        enable: true,
+                        management: 'discover',
+                    },
+                },
+            };
+
+            const discoveredResources = {
+                auroraClusterEndpoint: 'cluster.abc.us-east-1.rds.amazonaws.com',
+                auroraPort: 5432,
+                auroraSecurityGroupId: 'sg-aurora123',
+            };
+
+            const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+            expect(result.resources.FriggAuroraIngressRule).toBeDefined();
+            expect(result.resources.FriggAuroraIngressRule.Type).toBe('AWS::EC2::SecurityGroupIngress');
+            expect(result.resources.FriggAuroraIngressRule.Properties.GroupId).toBe('sg-aurora123');
+            expect(result.resources.FriggAuroraIngressRule.Properties.IpProtocol).toBe('tcp');
+            expect(result.resources.FriggAuroraIngressRule.Properties.FromPort).toBe(5432);
+            expect(result.resources.FriggAuroraIngressRule.Properties.ToPort).toBe(5432);
+            expect(result.resources.FriggAuroraIngressRule.Properties.SourceSecurityGroupId).toEqual({ Ref: 'FriggLambdaSecurityGroup' });
+        });
     });
 
     describe('build() - create-new mode', () => {

package/infrastructure/domains/database/aurora-discovery.js

@@ -49,6 +49,12 @@ class AuroraDiscovery {
                 result.databasePort = rawResources.port || 5432;
                 result.auroraEngine = rawResources.engine || 'aurora-postgresql';
                 result.databaseEngine = rawResources.engine || 'aurora-postgresql';
+                
+                // Capture security group IDs
+                if (rawResources.securityGroupIds && rawResources.securityGroupIds.length > 0) {
+                    result.auroraSecurityGroupId = rawResources.securityGroupIds[0]; // Use first security group
+                    console.log(`  ✓ Found security group: ${result.auroraSecurityGroupId}`);
+                }
 
                 console.log(`  ✓ Found database: ${result.auroraClusterEndpoint}:${result.auroraPort}`);
                 console.log(`  ✓ Engine: ${result.auroraEngine}`);

package/infrastructure/domains/shared/providers/aws-provider-adapter.js

@@ -343,6 +343,7 @@ class AWSProviderAdapter extends CloudProviderAdapter {
             endpoint: null,
             port: null,
             engine: null,
+            securityGroupIds: [],
         };
 
         try {
@@ -361,6 +362,7 @@ class AWSProviderAdapter extends CloudProviderAdapter {
                         result.endpoint = cluster.Endpoint;
                         result.port = cluster.Port;
                         result.engine = cluster.Engine;
+                        result.securityGroupIds = (cluster.VpcSecurityGroups || []).map(sg => sg.VpcSecurityGroupId);
                     }
                 } else if (result.clusters.length > 0) {
                     // Use first available cluster
@@ -368,6 +370,7 @@ class AWSProviderAdapter extends CloudProviderAdapter {
                     result.endpoint = cluster.Endpoint;
                     result.port = cluster.Port;
                     result.engine = cluster.Engine;
+                    result.securityGroupIds = (cluster.VpcSecurityGroups || []).map(sg => sg.VpcSecurityGroupId);
                 }
             }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.9483dbe.0",
+  "version": "2.0.0--canary.461.637e5e4.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.9483dbe.0",
-    "@friggframework/test": "2.0.0--canary.461.9483dbe.0",
+    "@friggframework/schemas": "2.0.0--canary.461.637e5e4.0",
+    "@friggframework/test": "2.0.0--canary.461.637e5e4.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.9483dbe.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.9483dbe.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.637e5e4.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.637e5e4.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "9483dbe2bfd6479f5b6fc24c59b0aa646689f887"
+  "gitHead": "637e5e421b5de0794ae99dc8a6578726dfd97f27"
 }