@takumi-stack/core 1.0.0 → 1.0.1

package/prefab/compute/function/queue-function/index.ts

@@ -0,0 +1,67 @@
+import { Duration } from 'aws-cdk-lib';
+import { SqsEventSource } from 'aws-cdk-lib/aws-lambda-event-sources';
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import { Construct } from 'constructs';
+
+import { ServiceStack, getLogicalName, SynthError } from '../../../../common';
+import { QueuePrefab, QueuePrefabParams } from '../../../integration';
+import { BaseAggregateParams } from '../base-function';
+import { BaseFunction, BaseHandlerParams, FUNCTION_DEFAULT_TIMEOUT } from '../base-function';
+
+export type QueueHandlerParams = BaseHandlerParams & {
+  queuePrefab?: QueuePrefab;
+  queuePrefabParams?: Partial<QueuePrefabParams>;
+  maxConcurrency?: number;
+  batchSize?: number;
+  batchWindow?: Duration;
+  visibilityTimeoutRatio?: number;
+};
+
+export type QueueFunctionParams = BaseAggregateParams;
+
+export class QueueFunction extends Construct {
+  public readonly lambdaFunction: NodejsFunction;
+  public readonly queuePrefab: QueuePrefab;
+
+  constructor(service: ServiceStack, params: QueueFunctionParams & QueueHandlerParams) {
+    super(service, getLogicalName(QueueFunction.name, params.name));
+
+    if (params.visibilityTimeoutRatio && params.visibilityTimeoutRatio < 1) {
+      throw new SynthError('Visibility timeout ratio must be greater than or equal to 1', service.props);
+    }
+
+    // Visibility timeout is declared, must be greater than or equal to the timeout
+    if (
+      params.queuePrefabParams?.visibilityTimeout &&
+      (params.timeout?.toSeconds() || FUNCTION_DEFAULT_TIMEOUT) > params.queuePrefabParams?.visibilityTimeout.toSeconds()
+    ) {
+      throw new SynthError('Visibility timeout must be greater than or equal to the function timeout', service.props);
+    }
+
+    this.queuePrefab =
+      params.queuePrefab ||
+      new QueuePrefab(service, {
+        name: params.name,
+        visibilityTimeout: Duration.seconds((params.timeout?.toSeconds() || 6) * (params.visibilityTimeoutRatio || 2)),
+        ...params.queuePrefabParams,
+      });
+
+    this.lambdaFunction = new BaseFunction(service, {
+      ...params,
+      environment: { ...params.environment, CC_FUNCTION_TYPE: 'QUEUE' },
+    }).lambdaFunction;
+
+    this.lambdaFunction.addEventSource(
+      new SqsEventSource(this.queuePrefab.queue, {
+        ...(params.maxConcurrency ? { maxConcurrency: params.maxConcurrency } : {}),
+        batchSize: params.batchSize || 10,
+        maxBatchingWindow: params.batchWindow,
+        reportBatchItemFailures: true,
+      })
+    );
+
+    // In case the lambda function needs to operate on the queue manually
+    this.lambdaFunction.addEnvironment('ORIGIN_QUEUE', this.queuePrefab.queue.queueUrl);
+    this.queuePrefab.queue.grantConsumeMessages(this.lambdaFunction);
+  }
+}

package/prefab/compute/function/topic-function/index.ts

@@ -0,0 +1,36 @@
+import { Duration } from 'aws-cdk-lib';
+import { SnsEventSource } from 'aws-cdk-lib/aws-lambda-event-sources';
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import { Construct } from 'constructs';
+
+import { ServiceStack, getLogicalName } from '../../../../common';
+import { CustomTopicParams, TopicPrefab } from '../../../integration';
+import { BaseAggregateParams } from '../base-function';
+import { BaseHandlerParams, BaseFunction } from '../base-function';
+
+export type TopicHandlerParams = BaseHandlerParams & {
+  topic?: TopicPrefab;
+  customTopicParams?: CustomTopicParams;
+  batchSize?: number;
+  batchWindow?: Duration;
+};
+
+export type TopicFunctionParams = BaseAggregateParams;
+
+export class TopicFunction extends Construct {
+  public readonly lambdaFunction: NodejsFunction;
+  public readonly customTopic: TopicPrefab;
+
+  constructor(service: ServiceStack, params: TopicFunctionParams & TopicHandlerParams) {
+    super(service, getLogicalName(TopicFunction.name, params.name));
+
+    this.customTopic = params.topic || new TopicPrefab(service, { name: params.name, ...params.customTopicParams });
+
+    this.lambdaFunction = new BaseFunction(service, {
+      ...params,
+      environment: { ...params.environment, CC_FUNCTION_TYPE: 'TOPIC' },
+    }).lambdaFunction;
+
+    this.lambdaFunction.addEventSource(new SnsEventSource(this.customTopic.topic));
+  }
+}

package/prefab/compute/index.ts

@@ -0,0 +1,2 @@
+export * from './fargate';
+export * from './function';

package/prefab/database/dynamo/index.ts

@@ -0,0 +1,113 @@
+import { RemovalPolicy } from 'aws-cdk-lib';
+import { AttributeType, BillingMode, Table } from 'aws-cdk-lib/aws-dynamodb';
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import { Construct } from 'constructs';
+
+import { TableStoreBuilder, TablePermission } from '@takumi-stack/sdk';
+
+import { ServiceStack, SynthError, getLogicalName, getResourceName } from '../../../common';
+
+export class DynamoTablePrefab extends Construct {
+  public readonly table: Table;
+  public readonly tableName: string;
+  public readonly dynamoTableNameEnvVar: string;
+
+  constructor(service: ServiceStack, params: typeof TableStoreBuilder<any>) {
+    super(service, getLogicalName(DynamoTablePrefab.name, new params().tableName));
+
+    const definition = new params();
+    if (!definition.tableName)
+      throw new SynthError('Bad implementation of TableStoreBuilder (remember use implements instead of extends in you class)', service.props);
+
+    this.dynamoTableNameEnvVar = definition.dynamoTableNameEnvVar || parseTableName(definition.tableName);
+    this.tableName = definition.tableName;
+
+    if (definition.keyMapping.PK !== 'PK') {
+      throw new SynthError('Bad implementation of TableStoreBuilder (PK must be PK)', service.props);
+    }
+    if (definition.keyMapping.SK && definition.keyMapping.SK !== 'SK') {
+      throw new SynthError('Bad implementation of TableStoreBuilder (SK must be SK)', service.props);
+    }
+    this.table = new Table(this, definition.tableName, {
+      tableName: getResourceName(definition.tableName, service.props),
+      billingMode: BillingMode.PAY_PER_REQUEST,
+      partitionKey: { name: 'PK', type: AttributeType.STRING },
+      timeToLiveAttribute: 'deleteTTL',
+      ...(definition.keyMapping.SK ? { sortKey: { name: 'SK', type: AttributeType.STRING } } : {}),
+      // stream: params.stream,
+    });
+
+    const indexes = { ...definition.attIndexes, ...definition.genericIndexes };
+    if (indexes) {
+      const indexKeys = Object.keys(indexes);
+      indexKeys.forEach((indexKey) => {
+        const index = indexes[indexKey];
+        if (index) {
+          this.table.addGlobalSecondaryIndex({
+            indexName: indexKey,
+            partitionKey: { name: index.PK, type: AttributeType.STRING },
+            ...(index.SK ? { sortKey: { name: index.SK, type: AttributeType.STRING } } : {}),
+          });
+        }
+      });
+    }
+
+    this.table.applyRemovalPolicy(RemovalPolicy.DESTROY);
+    if (service.props.envName === 'prod') this.table.applyRemovalPolicy(RemovalPolicy.RETAIN);
+  }
+
+  // public useMod(variableName = 'TABLE', mods: ((table: Table) => any)[]): Modifier {
+  //   return (lambda: NodejsFunction): void => {
+  //     lambda.addEnvironment(variableName, this.table.tableName);
+  //     mods.map((fn) => fn(this.table)(lambda));
+  //   };
+  // }
+
+  // public useModPermission(variableName = 'TABLE', tablePermission: TablePermission): Modifier {
+  //   return (lambda: NodejsFunction): void => {
+  //     lambda.addEnvironment(variableName, this.table.tableName);
+  //     DynamoTablePrefab.modifier.permission(this.table, tablePermission)(lambda);
+  //   };
+  // }
+
+  // public static modifier = {
+  //   permission: (table: Table, tablePermission: TablePermission): ((lambda: NodejsFunction) => void) => {
+  //     return (lambda: NodejsFunction): void => {
+  //       if (tablePermission === 'none') return;
+  //       const permissionMapper = {
+  //         read: () => table.grantReadData(lambda),
+  //         write: () => table.grantWriteData(lambda),
+  //         readWrite: () => table.grantReadWriteData(lambda),
+  //       };
+  //       permissionMapper[tablePermission]();
+  //     };
+  //   },
+  //   writer: (table: Table): ((lambda: NodejsFunction) => void) => {
+  //     return (lambda: NodejsFunction): void => {
+  //       table.grantWriteData(lambda);
+  //     };
+  //   },
+  //   reader: (table: Table): ((lambda: NodejsFunction) => void) => {
+  //     return (lambda: NodejsFunction): void => {
+  //       table.grantReadData(lambda);
+  //     };
+  //   },
+  // };
+
+  public static addTable(lambdaFunction: NodejsFunction, tablePrefab?: DynamoTablePrefab, tablePermission?: TablePermission): void {
+    if (tablePrefab instanceof DynamoTablePrefab) {
+      if (!tablePermission) throw new Error('tablePermission is required when table is used');
+      lambdaFunction.addEnvironment(tablePrefab.dynamoTableNameEnvVar, tablePrefab.table.tableName);
+      if (tablePermission === 'none') return;
+      const permissionMapper = {
+        read: () => tablePrefab.table.grantReadData(lambdaFunction),
+        write: () => tablePrefab.table.grantWriteData(lambdaFunction),
+        readWrite: () => tablePrefab.table.grantReadWriteData(lambdaFunction),
+      };
+      permissionMapper[tablePermission]();
+    }
+  }
+}
+function parseTableName(tableName: any): string {
+  throw new Error('Function not implemented.');
+}

package/prefab/database/index.ts

@@ -0,0 +1,3 @@
+export * from './dynamo';
+export * from './rds';
+export * from './timestream';

package/prefab/database/rds/handlers/start-cluster/handler.ts

@@ -0,0 +1,7 @@
+import { RDSClient, StartDBClusterCommand } from '@aws-sdk/client-rds';
+
+const client = new RDSClient({ region: process.env.REGION });
+
+export const handler = async (): Promise<any> => {
+  await client.send(new StartDBClusterCommand({ DBClusterIdentifier: process.env.DB_CLUSTER_NAME! }));
+};

package/prefab/database/rds/handlers/stop-cluster/handler.ts

@@ -0,0 +1,7 @@
+import { RDSClient, StopDBClusterCommand } from '@aws-sdk/client-rds';
+
+const client = new RDSClient({ region: process.env.REGION });
+
+export const handler = async (): Promise<any> => {
+  await client.send(new StopDBClusterCommand({ DBClusterIdentifier: process.env.DB_CLUSTER_NAME! }));
+};

package/prefab/database/rds/index.ts

@@ -0,0 +1,248 @@
+import * as awsEc2 from 'aws-cdk-lib/aws-ec2';
+import * as awsRds from 'aws-cdk-lib/aws-rds';
+import { Fn, RemovalPolicy } from 'aws-cdk-lib';
+import { CronOptions } from 'aws-cdk-lib/aws-events';
+import { ManagedPolicy, PolicyStatement, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { ISecret } from 'aws-cdk-lib/aws-secretsmanager';
+import { StringParameter } from 'aws-cdk-lib/aws-ssm';
+import { Construct } from 'constructs';
+
+import { Modifier, ServiceStack, SynthError, getLogicalName, getResourceName, getShortResourceName } from '../../../common';
+import { CronAggregate, BaseAggregateParams } from '../../compute';
+import { VpcPrefab } from '../../networking';
+
+export type AuroraPerformanceTuning = {
+  writeInstanceProps?: awsRds.ServerlessV2ClusterInstanceProps;
+  readInstanceProps?: awsRds.ServerlessV2ClusterInstanceProps;
+  readInstances?: number;
+  readers?: awsRds.IClusterInstance[];
+  minCapacity?: number;
+  maxCapacity?: number;
+};
+
+export type AuroraServerlessV2PrefabParams = {
+  clusterName: string;
+  vpcPrefab: VpcPrefab;
+  performanceTuning: AuroraPerformanceTuning;
+  port?: number;
+  engine?: awsRds.IClusterEngine;
+  publicAccess: boolean;
+  baseDir?: string;
+  scheduledPause?: {
+    startCron: CronOptions;
+    stopCron: CronOptions;
+  };
+  vpcSubnets?: awsEc2.SubnetSelection;
+  securityGroupProps?: Partial<awsEc2.SecurityGroupProps>;
+  databaseClusterProps?: Partial<awsRds.DatabaseClusterProps>;
+  databaseProxyProps?: Partial<awsRds.DatabaseProxyProps>;
+};
+
+export class RdsClusterPrefab extends Construct {
+  public readonly cluster: awsRds.DatabaseCluster;
+  public readonly securityGroupForLambda: awsEc2.SecurityGroup;
+  public readonly securityGroup: awsEc2.SecurityGroup;
+  public readonly securityGroupBastion!: awsEc2.SecurityGroup;
+  public readonly roleBastion!: Role;
+  public readonly ec2Bastion!: awsEc2.Instance;
+  public readonly vpcSubnets?: awsEc2.SubnetSelection;
+  public readonly proxy: awsRds.DatabaseProxy;
+  public readonly secret: ISecret;
+  public readonly cronAggregate!: CronAggregate;
+  public readonly readonlyRdsProxyEndpoint!: awsRds.CfnDBProxyEndpoint;
+
+  constructor(service: ServiceStack, params: AuroraServerlessV2PrefabParams) {
+    super(service, getLogicalName(RdsClusterPrefab.name, params.clusterName));
+
+    if (!params.publicAccess) {
+      // Create SG for EC2 Bastion
+      this.securityGroupBastion = new awsEc2.SecurityGroup(this, 'BastionSecurityGroup', {
+        securityGroupName: getResourceName('ec2Bastion', service.props),
+        vpc: params.vpcPrefab.vpc,
+        allowAllOutbound: false,
+      });
+      this.securityGroupBastion.addEgressRule(awsEc2.Peer.anyIpv4(), awsEc2.Port.tcp(params.port || 5432), 'RdsBastionPort');
+      this.securityGroupBastion.addEgressRule(awsEc2.Peer.anyIpv4(), awsEc2.Port.tcp(params.port || 443), 'HttpsBastionPort');
+
+      // Create Role for EC2 to allow use SSMManagedInstance
+      this.roleBastion = new Role(this, getLogicalName('role', 'ec2Bastion'), {
+        assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
+        roleName: getShortResourceName('ec2BastionSSM', service.props),
+      });
+      this.roleBastion.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'));
+    }
+
+    this.securityGroupForLambda = new awsEc2.SecurityGroup(this, 'LambdaSecurityGroup', {
+      securityGroupName: getResourceName(`LambdaToCluster${params.clusterName}`, service.props),
+      vpc: params.vpcPrefab.vpc,
+      allowAllOutbound: true,
+    });
+
+    this.securityGroup = new awsEc2.SecurityGroup(this, 'ClusterSecurityGroup', {
+      securityGroupName: getResourceName(params.clusterName, service.props),
+      vpc: params.vpcPrefab.vpc,
+      allowAllOutbound: true,
+      ...params.securityGroupProps,
+    });
+    this.securityGroup.addIngressRule(awsEc2.Peer.anyIpv4(), awsEc2.Port.tcp(params.port || 5432), 'DefaultClusterPort');
+    // Allow SG EC2 in Inbound Rules SG RDS
+    if (!params.publicAccess)
+      this.securityGroup.connections.allowFrom(this.securityGroupBastion, awsEc2.Port.tcp(params.port || 5432), 'BastionInboundRule');
+
+    this.cluster = new awsRds.DatabaseCluster(this, 'Cluster', {
+      port: params.port || 5432, // Default port for postgres
+      clusterIdentifier: getResourceName(params.clusterName, service.props),
+      vpc: params.vpcPrefab.vpc,
+      ...(params.vpcSubnets || params.publicAccess ? { vpcSubnets: { subnetType: awsEc2.SubnetType.PUBLIC } } : {}),
+      securityGroups: [this.securityGroup],
+      engine:
+        params.engine ||
+        awsRds.DatabaseClusterEngine.auroraPostgres({
+          version: awsRds.AuroraPostgresEngineVersion.VER_15_2,
+        }),
+      credentials: awsRds.Credentials.fromGeneratedSecret('postgres', {
+        secretName: getResourceName(params.clusterName, service.props),
+      }),
+      writer: awsRds.ClusterInstance.serverlessV2('writer', {
+        instanceIdentifier: getResourceName('writer-master', service.props),
+        publiclyAccessible: params.publicAccess,
+        caCertificate: awsRds.CaCertificate.RDS_CA_RDS2048_G1,
+        ...params.performanceTuning.writeInstanceProps,
+      }),
+      readers:
+        params.performanceTuning.readers ||
+        [...Array(params.performanceTuning.readInstances).keys()].map((i) =>
+          awsRds.ClusterInstance.serverlessV2(`reader-${i}`, {
+            instanceIdentifier: getResourceName(`reader-${i}`, service.props),
+            publiclyAccessible: params.publicAccess,
+            caCertificate: awsRds.CaCertificate.RDS_CA_RDS2048_G1,
+            ...params.performanceTuning.readInstanceProps,
+            ...(params.performanceTuning.readInstanceProps?.scaleWithWriter === undefined
+              ? { scaleWithWriter: true }
+              : { scaleWithWriter: params.performanceTuning.readInstanceProps?.scaleWithWriter }),
+          })
+        ),
+      serverlessV2MinCapacity: params.performanceTuning.minCapacity,
+      serverlessV2MaxCapacity: params.performanceTuning.maxCapacity,
+      ...params.databaseClusterProps,
+    });
+    if (!params.publicAccess) {
+      // Create EC2 Instance
+      this.ec2Bastion = new awsEc2.Instance(this, 'EC2BastionInstance', {
+        vpc: params.vpcPrefab.vpc,
+        vpcSubnets: this.cluster.vpcSubnets,
+        role: this.roleBastion,
+        securityGroup: this.securityGroupBastion,
+        instanceType: awsEc2.InstanceType.of(awsEc2.InstanceClass.T2, awsEc2.InstanceSize.MICRO),
+        machineImage: new awsEc2.AmazonLinuxImage({
+          generation: awsEc2.AmazonLinuxGeneration.AMAZON_LINUX_2,
+        }),
+      });
+    }
+
+    this.vpcSubnets = this.cluster.vpcSubnets;
+
+    // RDS Proxy
+    const rdsRole = new Role(this, 'ProxyRole', {
+      roleName: getResourceName('proxy', service.props),
+      assumedBy: new ServicePrincipal('rds.amazonaws.com'),
+    });
+    this.proxy = new awsRds.DatabaseProxy(this, 'Proxy', {
+      dbProxyName: getResourceName('proxy', service.props),
+      proxyTarget: awsRds.ProxyTarget.fromCluster(this.cluster),
+      secrets: [this.cluster.secret!],
+      iamAuth: true,
+      vpc: params.vpcPrefab.vpc,
+      securityGroups: [this.securityGroup],
+      role: rdsRole,
+      ...params.databaseProxyProps,
+    });
+
+    // Read-only endpoint
+    if ((params.performanceTuning?.readInstances || params.performanceTuning?.readers?.length || 0) > 0) {
+      this.readonlyRdsProxyEndpoint = new awsRds.CfnDBProxyEndpoint(this, 'ReadReplicaEndpoint', {
+        dbProxyName: this.proxy.dbProxyName,
+        dbProxyEndpointName: this.proxy.dbProxyName + '-read-replica',
+        vpcSubnetIds: params.vpcPrefab.vpc.selectSubnets(this.cluster.vpcSubnets).subnetIds,
+        vpcSecurityGroupIds: [this.securityGroup.securityGroupId],
+        targetRole: 'READ_ONLY',
+      });
+      this.readonlyRdsProxyEndpoint.node.addDependency(this.proxy);
+    }
+
+    // Command Execution Parameter
+    this.secret = this.cluster.secret!;
+    new StringParameter(this, 'Config', {
+      simpleName: true,
+      parameterName: getResourceName('config', service.props),
+      stringValue: JSON.stringify({
+        baseDir: params.baseDir || `support/${service.props.serviceName}`.toLowerCase(),
+        clusterSecretArn: this.cluster.secret?.secretArn,
+        publicAccess: params.publicAccess,
+        ...(!params.publicAccess ? { ec2InstanceId: this.ec2Bastion.instanceId } : {}),
+      }),
+    });
+
+    this.cluster.applyRemovalPolicy(RemovalPolicy.DESTROY);
+    if (service.props.envName === 'prod') this.cluster.applyRemovalPolicy(RemovalPolicy.RETAIN);
+
+    // Scheduled Pause
+    if (params.scheduledPause) {
+      this.cronAggregate = new CronAggregate(service, {
+        baseFunctionFolder: __dirname,
+        ...(service.props.isDemoProject ? {} : { compiled: true }),
+        handlers: {
+          start: {
+            name: 'start-cluster',
+            cronOptions: params.scheduledPause.startCron,
+            environment: { DB_CLUSTER_NAME: this.cluster.clusterIdentifier },
+          },
+          stop: {
+            name: 'stop-cluster',
+            cronOptions: params.scheduledPause.stopCron,
+            environment: { DB_CLUSTER_NAME: this.cluster.clusterIdentifier },
+          },
+        },
+      });
+      if (this.cronAggregate.handlers?.start?.role) {
+        this.cronAggregate.handlers.start.role.addToPrincipalPolicy(
+          new PolicyStatement({
+            actions: ['rds:StartDBCluster'],
+            resources: [Fn.join('', [`arn:aws:rds:${service.props.regionName}:${service.account}:cluster:`, this.cluster.clusterIdentifier])],
+          })
+        );
+      }
+      if (this.cronAggregate.handlers.stop?.role) {
+        this.cronAggregate.handlers.stop.role.addToPrincipalPolicy(
+          new PolicyStatement({
+            actions: ['rds:StopDBCluster'],
+            resources: [Fn.join('', [`arn:aws:rds:${service.props.regionName}:${service.account}:cluster:`, this.cluster.clusterIdentifier])],
+          })
+        );
+      }
+    }
+  }
+
+  public useClusterVpcGlobalConfigs(): BaseAggregateParams['globalConfigs'] {
+    return {
+      vpc: this.cluster.vpc,
+      securityGroups: [this.securityGroupForLambda],
+    };
+  }
+
+  public useModAccess(access: 'readWrite' | 'readOnly' = 'readWrite', variableName = 'DB'): Modifier {
+    return (lambda) => {
+      if (!lambda.isBoundToVpc) {
+        throw new SynthError('Your lambda must run in the same VPC you passed to this RDSClusterPrefab');
+      }
+      this.proxy.grantConnect(lambda);
+      this.secret.grantRead(lambda);
+
+      if (access === 'readOnly' && this.readonlyRdsProxyEndpoint) {
+        lambda.addEnvironment(variableName, this.readonlyRdsProxyEndpoint.attrEndpoint);
+      } else {
+        lambda.addEnvironment(variableName, this.proxy.endpoint);
+      }
+    };
+  }
+}

package/prefab/database/timestream/index.ts

@@ -0,0 +1,2 @@
+export * from './timestream-database';
+export * from './timestream-table';

package/prefab/database/timestream/timestream-database.ts

@@ -0,0 +1,24 @@
+import { RemovalPolicy } from 'aws-cdk-lib';
+import { CfnDatabase } from 'aws-cdk-lib/aws-timestream';
+import { Construct } from 'constructs';
+
+import { ServiceStack, getLogicalName, getResourceName } from '../../../common';
+
+export type TimeStreamDBParams = {
+  databaseName: string;
+};
+
+export class TimestreamDatabasePrefab extends Construct {
+  public readonly database: CfnDatabase;
+
+  constructor(service: ServiceStack, params: TimeStreamDBParams) {
+    super(service, getLogicalName(TimestreamDatabasePrefab.name, params.databaseName));
+
+    this.database = new CfnDatabase(this, 'Database', {
+      databaseName: getResourceName(params.databaseName, service.props),
+    });
+
+    this.database.applyRemovalPolicy(RemovalPolicy.DESTROY);
+    if (service.props.envName === 'prod') this.database.applyRemovalPolicy(RemovalPolicy.RETAIN);
+  }
+}

package/prefab/database/timestream/timestream-table.ts

@@ -0,0 +1,76 @@
+import { RemovalPolicy } from 'aws-cdk-lib';
+import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
+import { CfnDatabase, CfnTable } from 'aws-cdk-lib/aws-timestream';
+import { Construct } from 'constructs';
+
+import { ServiceStack, getLogicalName, getResourceName } from '../../../common';
+
+export type TimestreamTableParams = {
+  tableName: string;
+  database: CfnDatabase;
+  memoryHoursRetention?: string;
+  diskDaysRetention?: string;
+};
+
+export class TimestreamTablePrefab extends Construct {
+  public readonly table: CfnTable;
+  public readonly database: CfnDatabase;
+
+  constructor(service: ServiceStack, params: TimestreamTableParams) {
+    super(service, getLogicalName(TimestreamTablePrefab.name, params.tableName));
+
+    this.database = params.database;
+
+    this.table = new CfnTable(this, getLogicalName('TimestreamTable', params.tableName), {
+      tableName: getResourceName(params.tableName, service.props),
+      databaseName: params.database.databaseName!,
+      magneticStoreWriteProperties: {
+        enableMagneticStoreWrites: true,
+      },
+      retentionProperties: {
+        MemoryStoreRetentionPeriodInHours: params.memoryHoursRetention || '24',
+        MagneticStoreRetentionPeriodInDays: params.diskDaysRetention || '365',
+      },
+    });
+
+    this.table.addDependency(this.database);
+    this.table.applyRemovalPolicy(RemovalPolicy.DESTROY);
+    if (service.props.envName === 'prod') this.table.applyRemovalPolicy(RemovalPolicy.RETAIN);
+  }
+
+  public useMod(mods: ((table: CfnTable) => any)[]): (lambda: NodejsFunction) => void {
+    return (lambda: NodejsFunction): void => {
+      lambda.addEnvironment('TIMESTREAM_TABLE', this.table.tableName!);
+      lambda.addEnvironment('TIMESTREAM_DB', this.database.databaseName!);
+      mods.map((fn) => fn(this.table)(lambda));
+    };
+  }
+
+  public static modifier = {
+    writer: (table: CfnTable): ((lambda: NodejsFunction) => void) => {
+      return (lambda: NodejsFunction): void => {
+        lambda.addToRolePolicy(
+          new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: ['timestream:WriteRecords'],
+            resources: [table.attrArn],
+          })
+        );
+        lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ['timestream:DescribeEndpoints'], resources: ['*'] }));
+      };
+    },
+    reader: (table: CfnTable): ((lambda: NodejsFunction) => void) => {
+      return (lambda: NodejsFunction): void => {
+        lambda.addToRolePolicy(
+          new PolicyStatement({
+            effect: Effect.ALLOW,
+            actions: ['timestream:Select', 'timestream:SelectValues'],
+            resources: [table.attrArn],
+          })
+        );
+        lambda.addToRolePolicy(new PolicyStatement({ effect: Effect.ALLOW, actions: ['timestream:DescribeEndpoints'], resources: ['*'] }));
+      };
+    },
+  };
+}