@reventlessdev/rescript-pulumi-aws 2.4.0-alpha.43 → 2.4.0-alpha.45

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 2.4.0-alpha.45 (2026-07-05)
+
+### Features
+
+* **rescript-pulumi-aws:** add RDS, Secrets Manager, and Lambda VPC bindings ([9b4fb3d](https://github.com/ReventlessDev/reventless-core/commit/9b4fb3d0b4173cc6f645a903801e59901dbbdeb2))
+* **reventless-aws:** add PgConnection component + wire reventless-postgres dep ([a403a62](https://github.com/ReventlessDev/reventless-core/commit/a403a6292381513cfe679a2f7a967fda0ab00c0e))
+
+
+# 2.4.0-alpha.44 (2026-06-27)
+
+**Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws
+
+
+
+
+
 # 2.4.0-alpha.43 (2026-06-21)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "2.4.0-alpha.43",
+  "version": "2.4.0-alpha.45",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {
@@ -22,8 +22,8 @@
     "@pulumi/aws": "~7.19.0",
     "@pulumi/aws-native": "^1.62.0",
     "sury": "11.0.0-alpha.4",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.13",
-    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.19"
+    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.20",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.14"
   },
   "devDependencies": {
     "esbuild": "^0.25.12",

package/src/EC2/EC2_SecurityGroup.res

@@ -4,7 +4,18 @@
 type t = {id: Pulumi.Output.t<string>}
 
 module Ingress = {
-  type t = {fromPort: int, protocol: string, toPort: int, cidrBlocks: array<string>}
+  type t = {
+    fromPort: int,
+    protocol: string,
+    toPort: int,
+    cidrBlocks: array<string>,
+    /** Allow traffic from other members of this same security group. The
+      idiomatic RDS+Lambda pattern: the DB and its client Lambdas share one SG
+      and this rule lets them reach the DB port without a separate client SG. */
+    self?: bool,
+    /** Allow traffic from the given source security group IDs. */
+    securityGroups?: array<Pulumi.Input.t<string>>,
+  }
   let allowAll = {fromPort: 0, protocol: "-1", toPort: 0, cidrBlocks: ["0.0.0.0/0"]}
 }
 

package/src/Lambda/Lambda.res

@@ -206,6 +206,15 @@ module Function = {
 
   type ephemeralStorage = {size: Pulumi.Input.t<int>}
 
+  /** Places the function inside a VPC so it can reach private resources such as
+    RDS/Aurora. Adds ENIs to the given subnets and attaches the security
+    groups; the execution role then needs `ec2:CreateNetworkInterface`,
+    `ec2:DescribeNetworkInterfaces`, `ec2:DeleteNetworkInterface`. */
+  type vpcConfig = {
+    subnetIds: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+    securityGroupIds: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  }
+
   type args = {
     handler?: Pulumi.Input.t<string>,
     runtime?: Pulumi.Input.t<string>,
@@ -219,6 +228,7 @@ module Function = {
     sourceCodeHash?: Pulumi.Input.t<string>,
     reservedConcurrentExecutions?: Pulumi.Input.t<int>,
     ephemeralStorage?: Pulumi.Input.t<ephemeralStorage>,
+    vpcConfig?: Pulumi.Input.t<vpcConfig>,
   }
 
   type t = {

package/src/Rds/Rds.res

@@ -0,0 +1,8 @@
+/** @pulumi/aws/rds
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds
+*/
+module Instance = Rds_Instance
+module Cluster = Rds_Cluster
+module ClusterInstance = Rds_ClusterInstance
+module SubnetGroup = Rds_SubnetGroup
+module Proxy = Rds_Proxy

package/src/Rds/Rds.res.mjs

@@ -0,0 +1,21 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let Instance;
+
+let Cluster;
+
+let ClusterInstance;
+
+let SubnetGroup;
+
+let $$Proxy;
+
+export {
+  Instance,
+  Cluster,
+  ClusterInstance,
+  SubnetGroup,
+  $$Proxy,
+}
+/* No side effect */

package/src/Rds/Rds_Cluster.res

@@ -0,0 +1,59 @@
+/** @pulumi/aws/rds/cluster
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/cluster
+
+  Aurora (incl. Aurora Serverless v2) Postgres cluster. Pair with one or more
+  `Rds_ClusterInstance` — a cluster has no compute of its own.
+*/
+
+/** See `Rds_Instance.masterUserSecret`. */
+type masterUserSecret = {
+  kmsKeyId: string,
+  secretArn: string,
+  secretStatus: string,
+}
+
+/** Aurora Serverless v2 autoscaling bounds, in ACUs (0.5-increment floats). */
+type serverlessv2ScalingConfiguration = {
+  maxCapacity: float,
+  minCapacity: float,
+}
+
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  clusterIdentifier: Pulumi.Output.t<string>,
+  /** Writer endpoint hostname. */
+  endpoint: Pulumi.Output.t<string>,
+  /** Load-balanced reader endpoint hostname. */
+  readerEndpoint: Pulumi.Output.t<string>,
+  port: Pulumi.Output.t<int>,
+  databaseName: Pulumi.Output.t<string>,
+  masterUsername: Pulumi.Output.t<string>,
+  masterUserSecrets: Pulumi.Output.t<array<masterUserSecret>>,
+}
+
+type args = {
+  engine: Pulumi.Input.t<string>,
+  engineMode?: Pulumi.Input.t<string>,
+  engineVersion?: Pulumi.Input.t<string>,
+  clusterIdentifier?: Pulumi.Input.t<string>,
+  databaseName?: Pulumi.Input.t<string>,
+  masterUsername?: Pulumi.Input.t<string>,
+  masterPassword?: Pulumi.Input.t<string>,
+  manageMasterUserPassword?: Pulumi.Input.t<bool>,
+  dbSubnetGroupName?: Pulumi.Input.t<string>,
+  vpcSecurityGroupIds?: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  port?: Pulumi.Input.t<int>,
+  serverlessv2ScalingConfiguration?: Pulumi.Input.t<serverlessv2ScalingConfiguration>,
+  storageEncrypted?: Pulumi.Input.t<bool>,
+  backupRetentionPeriod?: Pulumi.Input.t<int>,
+  deletionProtection?: Pulumi.Input.t<bool>,
+  skipFinalSnapshot?: Pulumi.Input.t<bool>,
+  finalSnapshotIdentifier?: Pulumi.Input.t<string>,
+  applyImmediately?: Pulumi.Input.t<bool>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "Cluster"

package/src/Rds/Rds_Cluster.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/Rds/Rds_ClusterInstance.res

@@ -0,0 +1,29 @@
+/** @pulumi/aws/rds/clusterinstance
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/clusterinstance
+
+  A compute node attached to an `Rds_Cluster`. Use `instanceClass =
+  "db.serverless"` for Aurora Serverless v2.
+*/
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  /** This node's own endpoint hostname (prefer the cluster writer endpoint). */
+  endpoint: Pulumi.Output.t<string>,
+  port: Pulumi.Output.t<int>,
+}
+
+type args = {
+  clusterIdentifier: Pulumi.Input.t<string>,
+  instanceClass: Pulumi.Input.t<string>,
+  engine: Pulumi.Input.t<string>,
+  engineVersion?: Pulumi.Input.t<string>,
+  identifier?: Pulumi.Input.t<string>,
+  dbSubnetGroupName?: Pulumi.Input.t<string>,
+  publiclyAccessible?: Pulumi.Input.t<bool>,
+  applyImmediately?: Pulumi.Input.t<bool>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "ClusterInstance"

package/src/Rds/Rds_ClusterInstance.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/Rds/Rds_Instance.res

@@ -0,0 +1,59 @@
+/** @pulumi/aws/rds/instance
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/instance
+*/
+
+/** One entry of `masterUserSecrets`, populated when `manageMasterUserPassword`
+  is true — RDS creates and rotates the master password in Secrets Manager and
+  reports the secret ARN here. */
+type masterUserSecret = {
+  kmsKeyId: string,
+  secretArn: string,
+  secretStatus: string,
+}
+
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  /** Hostname of the instance (no port). */
+  address: Pulumi.Output.t<string>,
+  /** `address:port`. */
+  endpoint: Pulumi.Output.t<string>,
+  port: Pulumi.Output.t<int>,
+  dbName: Pulumi.Output.t<string>,
+  username: Pulumi.Output.t<string>,
+  /** Present when `manageMasterUserPassword=true`. */
+  masterUserSecrets: Pulumi.Output.t<array<masterUserSecret>>,
+}
+
+type args = {
+  allocatedStorage?: Pulumi.Input.t<int>,
+  maxAllocatedStorage?: Pulumi.Input.t<int>,
+  engine: Pulumi.Input.t<string>,
+  engineVersion?: Pulumi.Input.t<string>,
+  instanceClass: Pulumi.Input.t<string>,
+  /** Name of the initial database created inside the instance. */
+  dbName?: Pulumi.Input.t<string>,
+  identifier?: Pulumi.Input.t<string>,
+  username?: Pulumi.Input.t<string>,
+  password?: Pulumi.Input.t<string>,
+  /** Let RDS manage the master password in Secrets Manager (mutually
+    exclusive with `password`). Secret ARN surfaces on `masterUserSecrets`. */
+  manageMasterUserPassword?: Pulumi.Input.t<bool>,
+  dbSubnetGroupName?: Pulumi.Input.t<string>,
+  vpcSecurityGroupIds?: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  port?: Pulumi.Input.t<int>,
+  multiAz?: Pulumi.Input.t<bool>,
+  publiclyAccessible?: Pulumi.Input.t<bool>,
+  storageEncrypted?: Pulumi.Input.t<bool>,
+  backupRetentionPeriod?: Pulumi.Input.t<int>,
+  deletionProtection?: Pulumi.Input.t<bool>,
+  skipFinalSnapshot?: Pulumi.Input.t<bool>,
+  finalSnapshotIdentifier?: Pulumi.Input.t<string>,
+  applyImmediately?: Pulumi.Input.t<bool>,
+  parameterGroupName?: Pulumi.Input.t<string>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "Instance"

package/src/Rds/Rds_Instance.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/Rds/Rds_Proxy.res

@@ -0,0 +1,38 @@
+/** @pulumi/aws/rds/proxy
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/proxy
+
+  RDS Proxy multiplexes many Lambda-container connections onto a small pool of
+  DB connections. At Lambda fan-out scale this is the recommended fronting for
+  RDS/Aurora; pair with the `#RowLocks` DCB strategy (advisory locks pin
+  connections and defeat the proxy — see the AWS-deployment guide).
+*/
+type auth = {
+  authScheme?: string,
+  iamAuth?: string,
+  secretArn?: Pulumi.Input.t<string>,
+  description?: string,
+}
+
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  /** Proxy endpoint hostname — Lambdas connect here instead of the DB. */
+  endpoint: Pulumi.Output.t<string>,
+}
+
+type args = {
+  name?: Pulumi.Input.t<string>,
+  engineFamily: Pulumi.Input.t<string>,
+  auths: Pulumi.Input.t<array<Pulumi.Input.t<auth>>>,
+  roleArn: Pulumi.Input.t<string>,
+  vpcSubnetIds: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  vpcSecurityGroupIds?: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  requireTls?: Pulumi.Input.t<bool>,
+  idleClientTimeout?: Pulumi.Input.t<int>,
+  debugLogging?: Pulumi.Input.t<bool>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "Proxy"

package/src/Rds/Rds_Proxy.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/Rds/Rds_SubnetGroup.res

@@ -0,0 +1,18 @@
+/** @pulumi/aws/rds/subnetgroup
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/rds/subnetgroup
+*/
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  name: Pulumi.Output.t<string>,
+}
+
+type args = {
+  name?: Pulumi.Input.t<string>,
+  subnetIds: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("rds") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "SubnetGroup"

package/src/Rds/Rds_SubnetGroup.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/SecretsManager/SecretsManager.res

@@ -0,0 +1,6 @@
+/** @pulumi/aws/secretsmanager
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/secretsmanager
+*/
+module Secret = SecretsManager_Secret
+module SecretVersion = SecretsManager_SecretVersion
+module GetSecretVersion = GetSecretVersion

package/src/SecretsManager/SecretsManager.res.mjs

@@ -0,0 +1,15 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let Secret;
+
+let SecretVersion;
+
+let GetSecretVersion;
+
+export {
+  Secret,
+  SecretVersion,
+  GetSecretVersion,
+}
+/* No side effect */

package/src/SecretsManager/SecretsManager_Secret.res

@@ -0,0 +1,23 @@
+/** @pulumi/aws/secretsmanager/secret
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/secretsmanager/secret
+*/
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  name: Pulumi.Output.t<string>,
+}
+
+type args = {
+  name?: Pulumi.Input.t<string>,
+  namePrefix?: Pulumi.Input.t<string>,
+  description?: Pulumi.Input.t<string>,
+  kmsKeyId?: Pulumi.Input.t<string>,
+  /** Days before a deleted secret is irrecoverably purged. Set `0` to delete
+    immediately (handy for throwaway CI/dev stacks). */
+  recoveryWindowInDays?: Pulumi.Input.t<int>,
+  tags?: Pulumi.Input.t<Aws.tags>,
+}
+
+@module("@pulumi/aws") @scope("secretsmanager") @new
+external make: (~name: string, ~args: args=?, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "Secret"

package/src/SecretsManager/SecretsManager_Secret.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/SecretsManager/SecretsManager_SecretVersion.res

@@ -0,0 +1,21 @@
+/** @pulumi/aws/secretsmanager/secretversion
+  see: https://www.pulumi.com/registry/packages/aws/api-docs/secretsmanager/secretversion
+*/
+type t = {
+  arn: Pulumi.Output.t<string>,
+  id: Pulumi.Output.t<string>,
+  versionId: Pulumi.Output.t<string>,
+}
+
+type args = {
+  secretId: Pulumi.Input.t<string>,
+  /** Plaintext secret payload (typically a JSON connection blob). Prefer
+    `secretString` over `secretBinary`. */
+  secretString?: Pulumi.Input.t<string>,
+  secretBinary?: Pulumi.Input.t<string>,
+  versionStages?: Pulumi.Input.t<array<Pulumi.Input.t<string>>>,
+}
+
+@module("@pulumi/aws") @scope("secretsmanager") @new
+external make: (~name: string, ~args: args, ~opts: Pulumi.CustomResourceOptions.t=?) => t =
+  "SecretVersion"

package/src/SecretsManager/SecretsManager_SecretVersion.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */