@guardian/cdk 56.0.3 → 57.1.0

package/lib/constructs/dynamodb/dynamodb.d.ts

@@ -0,0 +1,31 @@
+import { Table } from "aws-cdk-lib/aws-dynamodb";
+import type { TableProps } from "aws-cdk-lib/aws-dynamodb";
+import type { GuStack } from "../core";
+export interface OptIn {
+    enabled: true;
+}
+export interface OptOut {
+    enabled: false;
+    /**
+     * We recommend using DevX Backups where possible. If it is not suitable for your use-case please document
+     * this here so that we can understand why this is switched off when performing security audits.
+     */
+    optOutReason: string;
+}
+export interface GuDynamoTableProps extends TableProps {
+    /**
+     * We recommend using DevX Backups to protect your DynamoDB table's backups.
+     * For more details on this feature, see the
+     * [documentation](https://docs.google.com/document/d/11EZtuVHCnjavE9AYLroiuDUsMzbp2ulFBtj4VkyCKNc/edit?usp=sharing).
+     */
+    devXBackups: OptIn | OptOut;
+}
+/**
+ * DeletionProtection is enabled by default for this Table.
+ * We recommend enabling this enabled for all active DynamoDB tables.
+ * The default can be overridden in the GuDynamoTable instantiation if needed eg: for table deletion.
+ */
+export declare class GuDynamoTable extends Table {
+    constructor(scope: GuStack, id: string, props: GuDynamoTableProps);
+}
+//# sourceMappingURL=dynamodb.d.ts.map

package/lib/constructs/dynamodb/dynamodb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamodb.d.ts","sourceRoot":"","sources":["../../../src/constructs/dynamodb/dynamodb.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD;;;;OAIG;IACH,WAAW,EAAE,KAAK,GAAG,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB;CAIlE"}

package/lib/constructs/dynamodb/dynamodb.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuDynamoTable = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_dynamodb_1 = require("aws-cdk-lib/aws-dynamodb");
+/**
+ * DeletionProtection is enabled by default for this Table.
+ * We recommend enabling this enabled for all active DynamoDB tables.
+ * The default can be overridden in the GuDynamoTable instantiation if needed eg: for table deletion.
+ */
+class GuDynamoTable extends aws_dynamodb_1.Table {
+    constructor(scope, id, props) {
+        super(scope, id, { deletionProtection: true, ...props });
+        aws_cdk_lib_1.Tags.of(this).add("devx-backup-enabled", String(props.devXBackups.enabled));
+    }
+}
+exports.GuDynamoTable = GuDynamoTable;
+//# sourceMappingURL=dynamodb.js.map

package/lib/constructs/dynamodb/dynamodb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamodb.js","sourceRoot":"","sources":["../../../src/constructs/dynamodb/dynamodb.ts"],"names":[],"mappings":";;;AAAA,6CAAmC;AACnC,2DAAiD;AA0BjD;;;;GAIG;AACH,MAAa,aAAc,SAAQ,oBAAK;IACtC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAyB;QAC/D,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACzD,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;CACF;AALD,sCAKC","sourcesContent":["import { Tags } from \"aws-cdk-lib\";\nimport { Table } from \"aws-cdk-lib/aws-dynamodb\";\nimport type { TableProps } from \"aws-cdk-lib/aws-dynamodb\";\nimport type { GuStack } from \"../core\";\n\nexport interface OptIn {\n  enabled: true;\n}\n\nexport interface OptOut {\n  enabled: false;\n  /**\n   * We recommend using DevX Backups where possible. If it is not suitable for your use-case please document\n   * this here so that we can understand why this is switched off when performing security audits.\n   */\n  optOutReason: string;\n}\n\nexport interface GuDynamoTableProps extends TableProps {\n  /**\n   * We recommend using DevX Backups to protect your DynamoDB table's backups.\n   * For more details on this feature, see the\n   * [documentation](https://docs.google.com/document/d/11EZtuVHCnjavE9AYLroiuDUsMzbp2ulFBtj4VkyCKNc/edit?usp=sharing).\n   */\n  devXBackups: OptIn | OptOut;\n}\n\n/**\n * DeletionProtection is enabled by default for this Table.\n * We recommend enabling this enabled for all active DynamoDB tables.\n * The default can be overridden in the GuDynamoTable instantiation if needed eg: for table deletion.\n */\nexport class GuDynamoTable extends Table {\n  constructor(scope: GuStack, id: string, props: GuDynamoTableProps) {\n    super(scope, id, { deletionProtection: true, ...props });\n    Tags.of(this).add(\"devx-backup-enabled\", String(props.devXBackups.enabled));\n  }\n}\n"]}

package/lib/constructs/dynamodb/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./dynamodb";
+//# sourceMappingURL=index.d.ts.map

package/lib/constructs/dynamodb/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constructs/dynamodb/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/lib/constructs/dynamodb/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./dynamodb"), exports);
+//# sourceMappingURL=index.js.map

package/lib/constructs/dynamodb/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constructs/dynamodb/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B","sourcesContent":["export * from \"./dynamodb\";\n"]}

package/lib/constructs/lambda/lambda.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lambda.d.ts","sourceRoot":"","sources":["../../../src/constructs/lambda/lambda.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAW,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAQ,QAAQ,EAAiB,MAAM,wBAAwB,CAAC;AAG9E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,sCAAsC,EAAE,iCAAiC,EAAE,MAAM,eAAe,CAAC;AAE/G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAiC,MAAM,SAAS,CAAC;AAGrE,MAAM,WAAW,eAAgB,SAAQ,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW;IAChG;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;OAEG;IACH,yBAAyB,CAAC,EAAE,sCAAsC,CAAC;IACnE;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;IACzD;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,SAAgB,qBAAqB,EAAE,OAAO,CAAC;IAC/C,SAAgB,iBAAiB,EAAE,OAAO,CAAC;IAC3C,SAAgB,KAAK,CAAC,EAAE,KAAK,CAAC;gBAElB,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe;CA0E/D"}
+{"version":3,"file":"lambda.d.ts","sourceRoot":"","sources":["../../../src/constructs/lambda/lambda.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAW,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAQ,QAAQ,EAAgC,MAAM,wBAAwB,CAAC;AAG7F,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,sCAAsC,EAAE,iCAAiC,EAAE,MAAM,eAAe,CAAC;AAE/G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAiC,MAAM,SAAS,CAAC;AAGrE,MAAM,WAAW,eAAgB,SAAQ,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW;IAChG;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;OAEG;IACH,yBAAyB,CAAC,EAAE,sCAAsC,CAAC;IACnE;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,iCAAiC,CAAC;IACzD;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,SAAgB,qBAAqB,EAAE,OAAO,CAAC;IAC/C,SAAgB,iBAAiB,EAAE,OAAO,CAAC;IAC3C,SAAgB,KAAK,CAAC,EAAE,KAAK,CAAC;gBAElB,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe;CA4E/D"}

package/lib/constructs/lambda/lambda.js

@@ -56,7 +56,7 @@ function defaultMemorySize(runtime, memorySize) {
  */
 class GuLambdaFunction extends aws_lambda_1.Function {
     constructor(scope, id, props) {
-        const { app, fileName, runtime, memorySize, timeout, bucketNamePath, withoutFilePrefix = false, withoutArtifactUpload = false, } = props;
+        const { app, fileName, runtime, memorySize, timeout, bucketNamePath, withoutFilePrefix = false, withoutArtifactUpload = false, logFormat = aws_lambda_1.LoggingFormat.JSON, } = props;
         const bucketName = bucketNamePath
             ? aws_ssm_1.StringParameter.fromStringParameterName(scope, "bucketoverride", bucketNamePath).stringValue
             : core_1.GuDistributionBucketParameter.getInstance(scope).valueAsString;
@@ -70,6 +70,7 @@ class GuLambdaFunction extends aws_lambda_1.Function {
         const code = aws_lambda_1.Code.fromBucket(bucket, objectKey);
         super(scope, id, {
             ...props,
+            logFormat,
             environment: {
                 ...props.environment,
                 ...defaultEnvironmentVariables,

package/lib/constructs/lambda/lambda.js.map

@@ -1 +1 @@
-{"version":3,"file":"lambda.js","sourceRoot":"","sources":["../../../src/constructs/lambda/lambda.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAAuC;AAGvC,uDAA8E;AAC9E,+CAA4C;AAC5C,iDAAsD;AACtD,uCAA8C;AAE9C,8CAAsF;AAEtF,kCAAqE;AACrE,gCAAoE;AAoDpE,SAAS,iBAAiB,CAAC,OAAgB,EAAE,UAAmB;IAC9D,IAAI,UAAU,EAAE;QACd,OAAO,UAAU,CAAC;KACnB;SAAM;QACL,QAAQ,OAAO,CAAC,MAAM,EAAE;YACtB,KAAK,0BAAa,CAAC,IAAI;gBACrB,OAAO,IAAI,CAAC;YACd;gBACE,OAAO,GAAG,CAAC;SACd;KACF;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAa,gBAAiB,SAAQ,qBAAQ;IAQ5C,YAAY,KAAc,EAAE,EAAU,EAAE,KAAsB;QAC5D,MAAM,EACJ,GAAG,EACH,QAAQ,EACR,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,iBAAiB,GAAG,KAAK,EACzB,qBAAqB,GAAG,KAAK,GAC9B,GAAG,KAAK,CAAC;QAEV,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,yBAAe,CAAC,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,WAAW;YAC9F,CAAC,CAAC,oCAA6B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;QAEnE,MAAM,2BAA2B,GAAG;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,GAAG;SACT,CAAC;QAEF,MAAM,MAAM,GAAG,eAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAe,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,iBAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChD,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,GAAG,KAAK;YACR,WAAW,EAAE;gBACX,GAAG,KAAK,CAAC,WAAW;gBACpB,GAAG,2BAA2B;aAC/B;YACD,UAAU,EAAE,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC;YAClD,OAAO,EAAE,OAAO,IAAI,sBAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAE3C,IAAI,KAAK,CAAC,gBAAgB,EAAE;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,kBAAK,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE;gBACpD,SAAS,EAAE,KAAK,CAAC,KAAK;gBACtB,OAAO,EAAE,IAAI,CAAC,cAAc;aAC7B,CAAC,CAAC;SACJ;QAED,IAAI,KAAK,CAAC,yBAAyB,EAAE;YACnC,IAAI,yCAA4B,CAAC,KAAK,EAAE,GAAG,EAAE,gCAAgC,EAAE;gBAC7E,GAAG,KAAK,CAAC,yBAAyB;gBAClC,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;SACJ;QAED,IAAI,KAAK,CAAC,oBAAoB,EAAE;YAC9B,IAAI,oCAAuB,CAAC,KAAK,EAAE,GAAG,EAAE,2BAA2B,EAAE;gBACnE,GAAG,KAAK,CAAC,oBAAoB;gBAC7B,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;SACJ;QAED,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,oBAAoB,GAAsB;YAC9C,IAAI,0BAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;YACtC,IAAI,0BAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;SACvC,CAAC;QAEF,oBAAoB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAEnE,kBAAW,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;CACF;AAlFD,4CAkFC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport { Duration } from \"aws-cdk-lib\";\nimport type { PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport type { FunctionProps, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { Alias, Code, Function, RuntimeFamily } from \"aws-cdk-lib/aws-lambda\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { GuDistributable } from \"../../types\";\nimport type { GuLambdaErrorPercentageMonitoringProps, GuLambdaThrottlingMonitoringProps } from \"../cloudwatch\";\nimport { GuLambdaErrorPercentageAlarm, GuLambdaThrottlingAlarm } from \"../cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity, GuDistributionBucketParameter } from \"../core\";\nimport { ReadParametersByName, ReadParametersByPath } from \"../iam\";\n\nexport interface GuFunctionProps extends GuDistributable, Omit<FunctionProps, \"code\">, AppIdentity {\n  /**\n   * Create a new Lambda version and alias. This is only necessary if you want to use features which rely\n   * on versioning (e.g. SnapStart or Provisioned Concurrency).\n   *\n   * If you enable versioning you must ensure that your Lambda function is updated whenever a new build is deployed via\n   * CloudFormation. The simplest way to do this is to include the build number in the `fileName` prop.\n   */\n  enableVersioning?: boolean;\n\n  /**\n   * Alarm if error percentage exceeds a threshold.\n   */\n  errorPercentageMonitoring?: GuLambdaErrorPercentageMonitoringProps;\n  /**\n   * Alarm if throttling occurs. Note, it is also worth considering a\n   * concurrency limit (the `reservedConcurrentExecutions` prop) if you are\n   * concerned about throttling.\n   *\n   * @see https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html\n   */\n  throttlingMonitoring?: GuLambdaThrottlingMonitoringProps;\n  /**\n   * SSM parameter for the S3 bucket that contains your lambda file.\n   *\n   * Typically you should not override this but you may need to if, for example,\n   * you are referencing a file that is shared across many apps and/or AWS\n   * accounts.\n   *\n   * @defaultValue  [[`GuDistributionBucketParameter`]]\n   */\n  bucketNamePath?: string;\n  /**\n   * Set to `true` to use the filename *without* the stage/stack/app prefix.\n   *\n   * Typically you should not override this but you may need to if, for example,\n   * you are referencing a file that is shared across many apps and/or AWS\n   * accounts.\n   */\n  withoutFilePrefix?: boolean;\n  /**\n   * Set to `true` this informs consumers of this function that upload is\n   * managed elsewhere by DevX.\n   *\n   * This is used by RiffRaffYamlFileExperimental to skip generating\n   * an uploadLambda step.\n   */\n  withoutArtifactUpload?: boolean;\n}\n\nfunction defaultMemorySize(runtime: Runtime, memorySize?: number): number {\n  if (memorySize) {\n    return memorySize;\n  } else {\n    switch (runtime.family) {\n      case RuntimeFamily.JAVA:\n        return 1024;\n      default:\n        return 512;\n    }\n  }\n}\n\n/**\n * Construct which creates a Lambda function.\n *\n * This Lambda relies on the code artifact residing in a standard location in\n * S3. For more details on the bucket used, see\n * [[`GuDistributionBucketParameter`]]. By default, the path used will be\n * `<stack>/<stage>/<app</<fileName>`. If required, e.g. if you are sharing\n * lambda code across apps or accounts, override the source bucket using the\n * `bucketNamePath` prop.\n *\n * The default memory size of this Lambda will vary depending on the runtime\n * chosen. For Java runtimes (i.e. resource hungry Scala Lambdas!), 1024MB will\n * be used. For all other runtimes, the memory size defaults to 512MB. This can\n * be overridden via the `memorySize` prop.\n *\n * By default, the timeout for this Lambda is 30 seconds. This can be overridden\n * via the `timeout` prop.\n *\n * By default the Lambda is granted permission to read from the SSM parameter\n * store subtree specific to this Lambda (i.e. it can read all keys under\n * `/<stage>/<stack>/<app>/`). If you need to add additional permissions, you\n * can use\n * [`addToRolePolicy`](`https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-lambda.FunctionBase.html#addwbrtowbrrolewbrpolicystatement`).\n *\n * The Lambda has `STACK`, `STAGE` and `APP` environment variables which can be\n * used to determine its identity.\n *\n * Note that this construct creates a Lambda without an event source. Depending\n * on your use-case, you may wish to consider using a pattern which instantiates\n * a Lambda with an event source e.g. [[`GuScheduledLambda`]].\n */\nexport class GuLambdaFunction extends Function {\n  public readonly app: string;\n  public readonly fileName: string;\n  public readonly bucketNamePath: string | undefined;\n  public readonly withoutArtifactUpload: boolean;\n  public readonly withoutFilePrefix: boolean;\n  public readonly alias?: Alias;\n\n  constructor(scope: GuStack, id: string, props: GuFunctionProps) {\n    const {\n      app,\n      fileName,\n      runtime,\n      memorySize,\n      timeout,\n      bucketNamePath,\n      withoutFilePrefix = false,\n      withoutArtifactUpload = false,\n    } = props;\n\n    const bucketName = bucketNamePath\n      ? StringParameter.fromStringParameterName(scope, \"bucketoverride\", bucketNamePath).stringValue\n      : GuDistributionBucketParameter.getInstance(scope).valueAsString;\n\n    const defaultEnvironmentVariables = {\n      STACK: scope.stack,\n      STAGE: scope.stage,\n      APP: app,\n    };\n\n    const bucket = Bucket.fromBucketName(scope, `${id}-bucket`, bucketName);\n    const objectKey = withoutFilePrefix ? fileName : GuDistributable.getObjectKey(scope, { app }, { fileName });\n    const code = Code.fromBucket(bucket, objectKey);\n    super(scope, id, {\n      ...props,\n      environment: {\n        ...props.environment,\n        ...defaultEnvironmentVariables,\n      },\n      memorySize: defaultMemorySize(runtime, memorySize),\n      timeout: timeout ?? Duration.seconds(30),\n      code,\n    });\n\n    this.app = app;\n    this.fileName = fileName;\n    this.bucketNamePath = bucketNamePath;\n    this.withoutArtifactUpload = withoutArtifactUpload;\n    this.withoutFilePrefix = withoutFilePrefix;\n\n    if (props.enableVersioning) {\n      this.alias = new Alias(scope, `${id}-AliasForLambda`, {\n        aliasName: scope.stage,\n        version: this.currentVersion,\n      });\n    }\n\n    if (props.errorPercentageMonitoring) {\n      new GuLambdaErrorPercentageAlarm(scope, `${id}-ErrorPercentageAlarmForLambda`, {\n        ...props.errorPercentageMonitoring,\n        lambda: this,\n      });\n    }\n\n    if (props.throttlingMonitoring) {\n      new GuLambdaThrottlingAlarm(scope, `${id}-ThrottlingAlarmForLambda`, {\n        ...props.throttlingMonitoring,\n        lambda: this,\n      });\n    }\n\n    bucket.grantRead(this, objectKey);\n\n    const ssmParamReadPolicies: PolicyStatement[] = [\n      new ReadParametersByPath(scope, props),\n      new ReadParametersByName(scope, props),\n    ];\n\n    ssmParamReadPolicies.map((policy) => this.addToRolePolicy(policy));\n\n    AppIdentity.taggedConstruct(props, this);\n  }\n}\n"]}
+{"version":3,"file":"lambda.js","sourceRoot":"","sources":["../../../src/constructs/lambda/lambda.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAAuC;AAGvC,uDAA6F;AAC7F,+CAA4C;AAC5C,iDAAsD;AACtD,uCAA8C;AAE9C,8CAAsF;AAEtF,kCAAqE;AACrE,gCAAoE;AAoDpE,SAAS,iBAAiB,CAAC,OAAgB,EAAE,UAAmB;IAC9D,IAAI,UAAU,EAAE;QACd,OAAO,UAAU,CAAC;KACnB;SAAM;QACL,QAAQ,OAAO,CAAC,MAAM,EAAE;YACtB,KAAK,0BAAa,CAAC,IAAI;gBACrB,OAAO,IAAI,CAAC;YACd;gBACE,OAAO,GAAG,CAAC;SACd;KACF;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAa,gBAAiB,SAAQ,qBAAQ;IAQ5C,YAAY,KAAc,EAAE,EAAU,EAAE,KAAsB;QAC5D,MAAM,EACJ,GAAG,EACH,QAAQ,EACR,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,iBAAiB,GAAG,KAAK,EACzB,qBAAqB,GAAG,KAAK,EAC7B,SAAS,GAAG,0BAAa,CAAC,IAAI,GAC/B,GAAG,KAAK,CAAC;QAEV,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,yBAAe,CAAC,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,WAAW;YAC9F,CAAC,CAAC,oCAA6B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;QAEnE,MAAM,2BAA2B,GAAG;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,GAAG;SACT,CAAC;QAEF,MAAM,MAAM,GAAG,eAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAe,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,iBAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChD,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,GAAG,KAAK;YACR,SAAS;YACT,WAAW,EAAE;gBACX,GAAG,KAAK,CAAC,WAAW;gBACpB,GAAG,2BAA2B;aAC/B;YACD,UAAU,EAAE,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC;YAClD,OAAO,EAAE,OAAO,IAAI,sBAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAE3C,IAAI,KAAK,CAAC,gBAAgB,EAAE;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,kBAAK,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE;gBACpD,SAAS,EAAE,KAAK,CAAC,KAAK;gBACtB,OAAO,EAAE,IAAI,CAAC,cAAc;aAC7B,CAAC,CAAC;SACJ;QAED,IAAI,KAAK,CAAC,yBAAyB,EAAE;YACnC,IAAI,yCAA4B,CAAC,KAAK,EAAE,GAAG,EAAE,gCAAgC,EAAE;gBAC7E,GAAG,KAAK,CAAC,yBAAyB;gBAClC,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;SACJ;QAED,IAAI,KAAK,CAAC,oBAAoB,EAAE;YAC9B,IAAI,oCAAuB,CAAC,KAAK,EAAE,GAAG,EAAE,2BAA2B,EAAE;gBACnE,GAAG,KAAK,CAAC,oBAAoB;gBAC7B,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;SACJ;QAED,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,oBAAoB,GAAsB;YAC9C,IAAI,0BAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;YACtC,IAAI,0BAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;SACvC,CAAC;QAEF,oBAAoB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QAEnE,kBAAW,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;CACF;AApFD,4CAoFC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport { Duration } from \"aws-cdk-lib\";\nimport type { PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport type { FunctionProps, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { Alias, Code, Function, LoggingFormat, RuntimeFamily } from \"aws-cdk-lib/aws-lambda\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { GuDistributable } from \"../../types\";\nimport type { GuLambdaErrorPercentageMonitoringProps, GuLambdaThrottlingMonitoringProps } from \"../cloudwatch\";\nimport { GuLambdaErrorPercentageAlarm, GuLambdaThrottlingAlarm } from \"../cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity, GuDistributionBucketParameter } from \"../core\";\nimport { ReadParametersByName, ReadParametersByPath } from \"../iam\";\n\nexport interface GuFunctionProps extends GuDistributable, Omit<FunctionProps, \"code\">, AppIdentity {\n  /**\n   * Create a new Lambda version and alias. This is only necessary if you want to use features which rely\n   * on versioning (e.g. SnapStart or Provisioned Concurrency).\n   *\n   * If you enable versioning you must ensure that your Lambda function is updated whenever a new build is deployed via\n   * CloudFormation. The simplest way to do this is to include the build number in the `fileName` prop.\n   */\n  enableVersioning?: boolean;\n\n  /**\n   * Alarm if error percentage exceeds a threshold.\n   */\n  errorPercentageMonitoring?: GuLambdaErrorPercentageMonitoringProps;\n  /**\n   * Alarm if throttling occurs. Note, it is also worth considering a\n   * concurrency limit (the `reservedConcurrentExecutions` prop) if you are\n   * concerned about throttling.\n   *\n   * @see https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html\n   */\n  throttlingMonitoring?: GuLambdaThrottlingMonitoringProps;\n  /**\n   * SSM parameter for the S3 bucket that contains your lambda file.\n   *\n   * Typically you should not override this but you may need to if, for example,\n   * you are referencing a file that is shared across many apps and/or AWS\n   * accounts.\n   *\n   * @defaultValue  [[`GuDistributionBucketParameter`]]\n   */\n  bucketNamePath?: string;\n  /**\n   * Set to `true` to use the filename *without* the stage/stack/app prefix.\n   *\n   * Typically you should not override this but you may need to if, for example,\n   * you are referencing a file that is shared across many apps and/or AWS\n   * accounts.\n   */\n  withoutFilePrefix?: boolean;\n  /**\n   * Set to `true` this informs consumers of this function that upload is\n   * managed elsewhere by DevX.\n   *\n   * This is used by RiffRaffYamlFileExperimental to skip generating\n   * an uploadLambda step.\n   */\n  withoutArtifactUpload?: boolean;\n}\n\nfunction defaultMemorySize(runtime: Runtime, memorySize?: number): number {\n  if (memorySize) {\n    return memorySize;\n  } else {\n    switch (runtime.family) {\n      case RuntimeFamily.JAVA:\n        return 1024;\n      default:\n        return 512;\n    }\n  }\n}\n\n/**\n * Construct which creates a Lambda function.\n *\n * This Lambda relies on the code artifact residing in a standard location in\n * S3. For more details on the bucket used, see\n * [[`GuDistributionBucketParameter`]]. By default, the path used will be\n * `<stack>/<stage>/<app</<fileName>`. If required, e.g. if you are sharing\n * lambda code across apps or accounts, override the source bucket using the\n * `bucketNamePath` prop.\n *\n * The default memory size of this Lambda will vary depending on the runtime\n * chosen. For Java runtimes (i.e. resource hungry Scala Lambdas!), 1024MB will\n * be used. For all other runtimes, the memory size defaults to 512MB. This can\n * be overridden via the `memorySize` prop.\n *\n * By default, the timeout for this Lambda is 30 seconds. This can be overridden\n * via the `timeout` prop.\n *\n * By default the Lambda is granted permission to read from the SSM parameter\n * store subtree specific to this Lambda (i.e. it can read all keys under\n * `/<stage>/<stack>/<app>/`). If you need to add additional permissions, you\n * can use\n * [`addToRolePolicy`](`https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-lambda.FunctionBase.html#addwbrtowbrrolewbrpolicystatement`).\n *\n * The Lambda has `STACK`, `STAGE` and `APP` environment variables which can be\n * used to determine its identity.\n *\n * Note that this construct creates a Lambda without an event source. Depending\n * on your use-case, you may wish to consider using a pattern which instantiates\n * a Lambda with an event source e.g. [[`GuScheduledLambda`]].\n */\nexport class GuLambdaFunction extends Function {\n  public readonly app: string;\n  public readonly fileName: string;\n  public readonly bucketNamePath: string | undefined;\n  public readonly withoutArtifactUpload: boolean;\n  public readonly withoutFilePrefix: boolean;\n  public readonly alias?: Alias;\n\n  constructor(scope: GuStack, id: string, props: GuFunctionProps) {\n    const {\n      app,\n      fileName,\n      runtime,\n      memorySize,\n      timeout,\n      bucketNamePath,\n      withoutFilePrefix = false,\n      withoutArtifactUpload = false,\n      logFormat = LoggingFormat.JSON,\n    } = props;\n\n    const bucketName = bucketNamePath\n      ? StringParameter.fromStringParameterName(scope, \"bucketoverride\", bucketNamePath).stringValue\n      : GuDistributionBucketParameter.getInstance(scope).valueAsString;\n\n    const defaultEnvironmentVariables = {\n      STACK: scope.stack,\n      STAGE: scope.stage,\n      APP: app,\n    };\n\n    const bucket = Bucket.fromBucketName(scope, `${id}-bucket`, bucketName);\n    const objectKey = withoutFilePrefix ? fileName : GuDistributable.getObjectKey(scope, { app }, { fileName });\n    const code = Code.fromBucket(bucket, objectKey);\n    super(scope, id, {\n      ...props,\n      logFormat,\n      environment: {\n        ...props.environment,\n        ...defaultEnvironmentVariables,\n      },\n      memorySize: defaultMemorySize(runtime, memorySize),\n      timeout: timeout ?? Duration.seconds(30),\n      code,\n    });\n\n    this.app = app;\n    this.fileName = fileName;\n    this.bucketNamePath = bucketNamePath;\n    this.withoutArtifactUpload = withoutArtifactUpload;\n    this.withoutFilePrefix = withoutFilePrefix;\n\n    if (props.enableVersioning) {\n      this.alias = new Alias(scope, `${id}-AliasForLambda`, {\n        aliasName: scope.stage,\n        version: this.currentVersion,\n      });\n    }\n\n    if (props.errorPercentageMonitoring) {\n      new GuLambdaErrorPercentageAlarm(scope, `${id}-ErrorPercentageAlarmForLambda`, {\n        ...props.errorPercentageMonitoring,\n        lambda: this,\n      });\n    }\n\n    if (props.throttlingMonitoring) {\n      new GuLambdaThrottlingAlarm(scope, `${id}-ThrottlingAlarmForLambda`, {\n        ...props.throttlingMonitoring,\n        lambda: this,\n      });\n    }\n\n    bucket.grantRead(this, objectKey);\n\n    const ssmParamReadPolicies: PolicyStatement[] = [\n      new ReadParametersByPath(scope, props),\n      new ReadParametersByName(scope, props),\n    ];\n\n    ssmParamReadPolicies.map((policy) => this.addToRolePolicy(policy));\n\n    AppIdentity.taggedConstruct(props, this);\n  }\n}\n"]}

package/lib/constructs/rds/instance.d.ts

@@ -1,8 +1,25 @@
 import { DatabaseInstance } from "aws-cdk-lib/aws-rds";
 import type { DatabaseInstanceProps } from "aws-cdk-lib/aws-rds";
 import type { AppIdentity, GuStack } from "../core";
-export interface GuDatabaseInstanceProps extends Omit<DatabaseInstanceProps, "instanceType">, AppIdentity {
+export interface OptIn {
+    enabled: true;
+}
+export interface OptOut extends Pick<DatabaseInstanceProps, "backupRetention" | "preferredBackupWindow"> {
+    enabled: false;
+    /**
+     * We recommend using DevX Backups where possible. If it is not suitable for your use-case please document
+     * this here so that we can understand why this is switched off when performing security audits.
+     */
+    optOutReason: string;
+}
+export interface GuDatabaseInstanceProps extends Omit<DatabaseInstanceProps, "instanceType" | "backupRetention" | "preferredBackupWindow">, AppIdentity {
     instanceType: string;
+    /**
+     * We recommend using DevX Backups to protect your RDS instance's backups.
+     * For more details on this feature, see the
+     * [documentation](https://docs.google.com/document/d/1VDCSxYFlWs4R6g0Waa6OmmfytV60AROyHxfIGho7cLA/edit#heading=h.vwt7syo8ng40).
+     */
+    devXBackups: OptIn | OptOut;
 }
 declare const GuDatabaseInstance_base: {
     new (...args: any[]): {

package/lib/constructs/rds/instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,uBAAwB,SAAQ,IAAI,CAAC,qBAAqB,EAAE,cAAc,CAAC,EAAE,WAAW;IACvG,YAAY,EAAE,MAAM,CAAC;CACtB;;;;;;AAED,qBAAa,kBAAmB,SAAQ,uBAAqC;gBAC/D,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAYvE"}
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,IAAI,CAAC;CACf;AAGD,MAAM,WAAW,MAAO,SAAQ,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,uBAAuB,CAAC;IACtG,OAAO,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,iBAAiB,GAAG,uBAAuB,CAAC,EAC/F,WAAW;IACb,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,EAAE,KAAK,GAAG,MAAM,CAAC;CAC7B;;;;;;AAED,qBAAa,kBAAmB,SAAQ,uBAAqC;gBAC/D,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAgBvE"}

package/lib/constructs/rds/instance.js

@@ -13,9 +13,13 @@ class GuDatabaseInstance extends (0, app_aware_construct_1.GuAppAwareConstruct)(
         const instanceType = new aws_ec2_1.InstanceType(aws_cdk_lib_1.Fn.join("", aws_cdk_lib_1.Fn.split("db.", props.instanceType)));
         super(scope, id, {
             deletionProtection: true,
+            deleteAutomatedBackups: false,
+            backupRetention: props.devXBackups.enabled ? undefined : props.devXBackups.backupRetention,
+            preferredBackupWindow: props.devXBackups.enabled ? undefined : props.devXBackups.preferredBackupWindow,
             ...props,
             instanceType,
         });
+        aws_cdk_lib_1.Tags.of(this).add("devx-backup-enabled", String(props.devXBackups.enabled));
     }
 }
 exports.GuDatabaseInstance = GuDatabaseInstance;

package/lib/constructs/rds/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AACjC,iDAAmD;AACnD,iDAAuD;AAEvD,+EAA4E;AAO5E,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,0BAAgB,CAAC;IAC3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,4CAA4C;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,YAAY,GAAG,IAAI,sBAAY,CAAC,gBAAE,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,kBAAkB,EAAE,IAAI;YACxB,GAAG,KAAK;YACR,YAAY;SACb,CAAC,CAAC;IACL,CAAC;CACF;AAbD,gDAaC","sourcesContent":["import { Fn } from \"aws-cdk-lib\";\nimport { InstanceType } from \"aws-cdk-lib/aws-ec2\";\nimport { DatabaseInstance } from \"aws-cdk-lib/aws-rds\";\nimport type { DatabaseInstanceProps } from \"aws-cdk-lib/aws-rds\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface GuDatabaseInstanceProps extends Omit<DatabaseInstanceProps, \"instanceType\">, AppIdentity {\n  instanceType: string;\n}\n\nexport class GuDatabaseInstance extends GuAppAwareConstruct(DatabaseInstance) {\n  constructor(scope: GuStack, id: string, props: GuDatabaseInstanceProps) {\n    // CDK just wants \"t3.micro\" format, whereas\n    // some CFN yaml might have the older \"db.t3.micro\" with the \"db.\" prefix\n    // This logic ensures the \"db.\" prefix is removed before applying the CFN\n    const instanceType = new InstanceType(Fn.join(\"\", Fn.split(\"db.\", props.instanceType)));\n\n    super(scope, id, {\n      deletionProtection: true,\n      ...props,\n      instanceType,\n    });\n  }\n}\n"]}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,iDAAmD;AACnD,iDAAuD;AAEvD,+EAA4E;AA6B5E,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,0BAAgB,CAAC;IAC3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,4CAA4C;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,YAAY,GAAG,IAAI,sBAAY,CAAC,gBAAE,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,KAAK;YAC7B,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;YAC1F,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,qBAAqB;YACtG,GAAG,KAAK;YACR,YAAY;SACb,CAAC,CAAC;QACH,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;CACF;AAjBD,gDAiBC","sourcesContent":["import { Fn, Tags } from \"aws-cdk-lib\";\nimport { InstanceType } from \"aws-cdk-lib/aws-ec2\";\nimport { DatabaseInstance } from \"aws-cdk-lib/aws-rds\";\nimport type { DatabaseInstanceProps } from \"aws-cdk-lib/aws-rds\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface OptIn {\n  enabled: true;\n}\n\n// Using Pick here means that we get the AWS documentation for these properties rather than needing to define it ourselves\nexport interface OptOut extends Pick<DatabaseInstanceProps, \"backupRetention\" | \"preferredBackupWindow\"> {\n  enabled: false;\n  /**\n   * We recommend using DevX Backups where possible. If it is not suitable for your use-case please document\n   * this here so that we can understand why this is switched off when performing security audits.\n   */\n  optOutReason: string;\n}\n\nexport interface GuDatabaseInstanceProps\n  extends Omit<DatabaseInstanceProps, \"instanceType\" | \"backupRetention\" | \"preferredBackupWindow\">,\n    AppIdentity {\n  instanceType: string;\n  /**\n   * We recommend using DevX Backups to protect your RDS instance's backups.\n   * For more details on this feature, see the\n   * [documentation](https://docs.google.com/document/d/1VDCSxYFlWs4R6g0Waa6OmmfytV60AROyHxfIGho7cLA/edit#heading=h.vwt7syo8ng40).\n   */\n  devXBackups: OptIn | OptOut;\n}\n\nexport class GuDatabaseInstance extends GuAppAwareConstruct(DatabaseInstance) {\n  constructor(scope: GuStack, id: string, props: GuDatabaseInstanceProps) {\n    // CDK just wants \"t3.micro\" format, whereas\n    // some CFN yaml might have the older \"db.t3.micro\" with the \"db.\" prefix\n    // This logic ensures the \"db.\" prefix is removed before applying the CFN\n    const instanceType = new InstanceType(Fn.join(\"\", Fn.split(\"db.\", props.instanceType)));\n\n    super(scope, id, {\n      deletionProtection: true,\n      deleteAutomatedBackups: false,\n      backupRetention: props.devXBackups.enabled ? undefined : props.devXBackups.backupRetention,\n      preferredBackupWindow: props.devXBackups.enabled ? undefined : props.devXBackups.preferredBackupWindow,\n      ...props,\n      instanceType,\n    });\n    Tags.of(this).add(\"devx-backup-enabled\", String(props.devXBackups.enabled));\n  }\n}\n"]}