cdk-dms-replication 0.0.16 → 0.1.1

package/.jsii

@@ -3580,7 +3580,7 @@
   },
   "name": "cdk-dms-replication",
   "readme": {
-    "markdown": "# cdk-dms-replication\n\n[![npm version](https://badge.fury.io/js/cdk-dms-replication.svg)](https://badge.fury.io/js/cdk-dms-replication)\n[![PyPI version](https://badge.fury.io/py/cdk-dms-replication.svg)](https://badge.fury.io/py/cdk-dms-replication)\n[![build](https://github.com/kckempf/cdk-dms-replication/actions/workflows/build.yml/badge.svg)](https://github.com/kckempf/cdk-dms-replication/actions/workflows/build.yml)\n\nL3 CDK constructs for [Amazon Database Migration Service (DMS)](https://aws.amazon.com/dms/). Provision a complete migration pipeline — replication instance, endpoints, and task — in a few lines of code, with secure defaults and full support for all DMS-supported engines and migration patterns.\n\n## Features\n\n- **All migration patterns** — full load, CDC, and full-load-and-CDC\n- **Classic and Serverless** — `DmsMigrationPipeline` (fixed instance) or `DmsServerlessPipeline` (auto-scales DCUs)\n- **All DMS engines** — MySQL, PostgreSQL, Oracle, SQL Server, SAP ASE, IBM Db2, MongoDB, DocumentDB, S3, DynamoDB, Redshift, Kinesis, Kafka, OpenSearch, Neptune, Redis\n- **Secure defaults** — replication instance placed in private subnets, KMS encryption at rest, security group auto-created\n- **Fluent builders** — `TableMappings` and `TaskSettings` builders produce the JSON DMS expects without hand-crafting strings\n- **Multi-language** — TypeScript, Python, Java, .NET, Go (via JSII)\n- **Escape hatches** — pass existing endpoints or a pre-existing replication instance\n\n## Installation\n\n### TypeScript / JavaScript\n\n```bash\nnpm install cdk-dms-replication\n```\n\n### Python\n\n```bash\npip install cdk-dms-replication\n```\n\n### Java\n\n```xml\n<dependency>\n  <groupId>io.github.kckempf</groupId>\n  <artifactId>cdk-dms-replication</artifactId>\n  <version>VERSION</version>\n</dependency>\n```\n\n### .NET\n\n```bash\ndotnet add package KcKempf.CdkDmsReplication\n```\n\n### Go\n\n```bash\ngo get github.com/kckempf/cdk-dms-replication-go\n```\n\n---\n\n## Quick start\n\n### Classic pipeline (fixed replication instance)\n\n`DmsMigrationPipeline` provisions a replication instance, both endpoints, and a replication task in one construct.\n\n```typescript\nimport * as cdk from 'aws-cdk-lib';\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport {\n  DmsMigrationPipeline,\n  EndpointEngine,\n  MigrationType,\n  TableMappings,\n} from 'cdk-dms-replication';\n\nconst app = new cdk.App();\nconst stack = new cdk.Stack(app, 'MigrationStack');\n\nconst vpc = ec2.Vpc.fromLookup(stack, 'Vpc', { isDefault: false });\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n\n  sourceEndpoint: {\n    engine: EndpointEngine.MYSQL,\n    serverName: 'mysql.internal.example.com',\n    port: 3306,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('mysql-dms-password'),\n    databaseName: 'orders',\n  },\n\n  targetEndpoint: {\n    engine: EndpointEngine.AURORA_POSTGRESQL,\n    serverName: cluster.clusterEndpoint.hostname,\n    port: 5432,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('aurora-dms-password'),\n    databaseName: 'orders',\n  },\n\n  tableMappings: new TableMappings()\n    .includeSchema('public')\n    .excludeTable('public', 'audit_log')\n    .toJson(),\n});\n```\n\n> **Note:** The `tableMappings` default (when omitted) is to include all tables in all schemas.\n\n### Serverless pipeline (auto-scaling)\n\n`DmsServerlessPipeline` uses DMS Serverless, which automatically scales capacity (measured in DMS Capacity Units — DCUs) between a configurable minimum and maximum. There is no replication instance to size or manage.\n\n```typescript\nimport {\n  DmsServerlessPipeline,\n  EndpointEngine,\n  MigrationType,\n} from 'cdk-dms-replication';\n\nnew DmsServerlessPipeline(stack, 'Pipeline', {\n  vpc,\n  maxCapacityUnits: 16,           // required; valid values: 1,2,4,8,16,32,64,128,192,256,384\n  minCapacityUnits: 2,            // optional; DMS auto-determines if omitted\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n\n  sourceEndpoint: {\n    engine: EndpointEngine.MYSQL,\n    serverName: 'mysql.internal.example.com',\n    port: 3306,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('mysql-dms-password'),\n    databaseName: 'orders',\n  },\n\n  targetEndpoint: {\n    engine: EndpointEngine.AURORA_POSTGRESQL,\n    serverName: cluster.clusterEndpoint.hostname,\n    port: 5432,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('aurora-dms-password'),\n    databaseName: 'orders',\n  },\n});\n```\n\n> **CDC start/stop position limitation:** `DmsServerlessPipeline` does not support `cdcStartPosition` or `cdcStartTime` at the CloudFormation level. To start replication from a specific LSN or timestamp, call the [`StartReplication` API](https://docs.aws.amazon.com/dms/latest/APIReference/API_StartReplication.html) after the config is created.\n\n---\n\n## Migration patterns\n\n### Full load\n\nMigrates all existing data once, then stops.\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n### CDC only\n\nReplicates ongoing changes starting from a specific position or time. The target must already be seeded with data.\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.CDC,\n  cdcStartPosition: 'mysql-bin-changelog.000024:373',  // binlog position\n  // — or —\n  cdcStartTime: '2024-01-01T00:00:00Z',                // ISO-8601 timestamp\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n### Full load then CDC\n\nMigrates existing data, then automatically switches to continuous replication.\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n---\n\n## Endpoint examples\n\n### MySQL / MariaDB / Aurora MySQL\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.MYSQL,          // or MARIADB, AURORA_MYSQL\n  serverName: 'mysql.example.com',\n  port: 3306,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('db-secret'),\n  databaseName: 'mydb',\n  mySqlSettings: {\n    parallelLoadThreads: 4,\n    serverTimezone: 'UTC',\n  },\n},\n```\n\n### PostgreSQL / Aurora PostgreSQL\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.POSTGRES,       // or AURORA_POSTGRESQL\n  serverName: 'pg.example.com',\n  port: 5432,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('db-secret'),\n  databaseName: 'appdb',\n  postgreSqlSettings: {\n    captureDdls: true,\n    slotName: 'dms_replication_slot',\n    pluginName: PostgresCdcPlugin.PG_LOGICAL,\n    heartbeatEnable: true,\n  },\n},\n```\n\n### Oracle\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.ORACLE,\n  serverName: 'oracle.example.com',\n  port: 1521,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('oracle-secret'),\n  databaseName: 'ORCL',\n  oracleSettings: {\n    addSupplementalLogging: true,\n    useLogminerReader: true,   // true = LogMiner, false = BinaryReader\n  },\n},\n```\n\n### SQL Server\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.SQLSERVER,\n  serverName: 'sqlserver.example.com',\n  port: 1433,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('sqlserver-secret'),\n  databaseName: 'AdventureWorks',\n  sqlServerSettings: {\n    readBackupOnly: false,\n    safeguardPolicy: SqlServerSafeguardPolicy.RELY_ON_SQL_SERVER_REPLICATION_AGENT,\n  },\n},\n```\n\n### MongoDB / DocumentDB\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.MONGODB,        // or DOCDB\n  serverName: 'mongo.example.com',\n  port: 27017,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('mongo-secret'),\n  mongoDbSettings: {\n    authType: MongoAuthType.PASSWORD,\n    authMechanism: MongoAuthMechanism.SCRAM_SHA_1,\n    nestingLevel: MongoNestingLevel.ONE,\n  },\n},\n```\n\n### Amazon S3 (source or target)\n\n```typescript\n// As a target\ntargetEndpoint: {\n  engine: EndpointEngine.S3,\n  s3Settings: {\n    bucketName: 'my-migration-data',\n    bucketFolder: 'dms-output',\n    serviceAccessRoleArn: s3Role.roleArn,\n    dataFormat: S3DataFormat.PARQUET,\n    parquetVersion: ParquetVersion.PARQUET_2_0,\n    datePartitionEnabled: true,\n    datePartitionSequence: DatePartitionSequence.YYYYMMDD,\n    encryptionMode: EncryptionMode.SSE_KMS,\n    serverSideEncryptionKmsKeyId: myKey.keyArn,\n  },\n},\n```\n\n### Amazon Redshift\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.REDSHIFT,\n  serverName: 'my-cluster.abc123.us-east-1.redshift.amazonaws.com',\n  port: 5439,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('redshift-secret'),\n  databaseName: 'dev',\n  redshiftSettings: {\n    bucketName: 'my-redshift-staging',\n    serviceAccessRoleArn: redshiftRole.roleArn,\n    encryptionMode: EncryptionMode.SSE_KMS,\n    serverSideEncryptionKmsKeyId: myKey.keyArn,\n    truncateColumns: true,\n    emptyAsNull: true,\n  },\n},\n```\n\n### Amazon Kinesis Data Streams\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.KINESIS,\n  kinesisSettings: {\n    streamArn: stream.streamArn,\n    serviceAccessRoleArn: kinesisRole.roleArn,\n    messageFormat: MessageFormat.JSON,\n    includeTransactionDetails: true,\n    includeTableAlterOperations: true,\n  },\n},\n```\n\n### Apache Kafka / Amazon MSK\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.KAFKA,\n  kafkaSettings: {\n    broker: 'b-1.my-cluster.abc123.kafka.us-east-1.amazonaws.com:9092',\n    topic: 'dms-changes',\n    messageFormat: MessageFormat.JSON,\n    securityProtocol: KafkaSecurityProtocol.SASL_SSL,\n    saslUsername: 'dms_user',\n    saslPassword: cdk.SecretValue.secretsManager('kafka-sasl-password'),\n  },\n},\n```\n\n### Amazon OpenSearch Service\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.OPENSEARCH,\n  openSearchSettings: {\n    endpointUri: 'https://search-my-domain.us-east-1.es.amazonaws.com',\n    serviceAccessRoleArn: openSearchRole.roleArn,\n    fullLoadErrorPercentage: 10,\n    errorRetryDuration: 300,\n  },\n},\n```\n\n### Amazon Neptune\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.NEPTUNE,\n  neptuneSettings: {\n    s3BucketName: 'my-neptune-staging',\n    s3BucketFolder: 'dms',\n    serviceAccessRoleArn: neptuneRole.roleArn,\n    iamAuthEnabled: true,\n  },\n},\n```\n\n### Amazon DynamoDB\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.DYNAMODB,\n  dynamoDbSettings: {\n    serviceAccessRoleArn: dynamoRole.roleArn,\n  },\n},\n```\n\n---\n\n## Table mappings\n\nUse the `TableMappings` fluent builder to control which tables are migrated and how they are named on the target.\n\n### Selection rules\n\n```typescript\nnew TableMappings()\n  .includeSchema('public')               // include all tables in 'public'\n  .includeSchema('%')                    // include all schemas (wildcard)\n  .excludeTable('public', 'audit_log')  // exclude a specific table\n  .excludeSchema('internal')            // exclude an entire schema\n  .explicitTable('public', 'orders')    // migrate only this one table\n  .toJson()\n```\n\n### Transformation rules\n\n```typescript\nnew TableMappings()\n  .includeSchema('%')\n  .renameSchema('legacy', 'v2')          // rename schema on target\n  .toLowerCaseTable('public', '%')       // lowercase all table names\n  .toUpperCaseSchema('%')                // uppercase all schema names\n  .addPrefixToTable('public', '%', 'migrated_')\n  .renameTable('public', 'usr', 'users') // rename a specific table\n  .renameColumn('public', 'orders', 'cust_id', 'customer_id')\n  .removeColumn('public', 'orders', 'internal_notes')\n  .toJson()\n```\n\n### Adding columns\n\n```typescript\nnew TableMappings()\n  .includeSchema('public')\n  .addColumn('public', 'orders', {\n    columnName: 'migrated_at',\n    columnType: ColumnDataType.DATETIME,\n    expression: '$timestamp',       // DMS built-in expression\n  })\n  .addColumn('public', 'orders', {\n    columnName: 'migration_version',\n    columnType: ColumnDataType.STRING,\n    columnLength: 10,\n    columnValue: 'v2.0',           // constant value\n  })\n  .toJson()\n```\n\n---\n\n## Task settings\n\nUse `TaskSettings` to tune LOB handling, error behaviour, full-load parallelism, and CDC batching.\n\n```typescript\nimport { TaskSettings, LobMode, ErrorAction, LoggingLevel } from 'cdk-dms-replication';\n\nconst settings = new TaskSettings()\n  // LOB handling\n  .withLobMode(LobMode.LIMITED_LOB, 64)   // truncate LOBs at 64 KB\n\n  // Full load tuning\n  .withFullLoadSubTasks(16)                // 16 parallel table loads\n  .withTargetTablePrepMode('DROP_AND_CREATE')\n  .withCommitRate(50000)                   // commit every 50k rows\n\n  // CDC batch apply\n  .withBatchApply(true, 5, 60)            // batch changes, 5–60 second window\n\n  // Error handling\n  .withDataErrorPolicy(ErrorAction.IGNORE_RECORD, 1000)\n  .withRecovery(-1, 5)                    // unlimited retries, 5s interval\n\n  // Logging\n  .withLogging('SOURCE_UNLOAD', LoggingLevel.LOGGER_SEVERITY_DEBUG)\n  .withLogging('TARGET_LOAD', LoggingLevel.LOGGER_SEVERITY_DEFAULT)\n  .toJson();\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  taskSettings: settings,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n---\n\n## Replication instance options\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n\n  // Instance sizing (default: R6I_LARGE)\n  replicationInstanceClass: ReplicationInstanceClass.R6I_4XLARGE,\n  allocatedStorage: 500,        // GB\n\n  // High availability\n  multiAz: true,\n\n  // Encryption — bring your own KMS key\n  encryptionKey: myKmsKey,\n\n  // Subnet placement\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,\n  },\n\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n---\n\n## Using lower-level constructs directly\n\nIf you need more control, use the individual constructs and wire them together yourself.\n\n```typescript\nimport {\n  DmsReplicationInstance,\n  DmsEndpoint,\n  DmsReplicationTask,\n  EndpointType,\n  EndpointEngine,\n  MigrationType,\n  TableMappings,\n} from 'cdk-dms-replication';\n\n// 1. Replication instance\nconst instance = new DmsReplicationInstance(stack, 'Instance', {\n  vpc,\n  replicationInstanceClass: ReplicationInstanceClass.R6I_LARGE,\n  multiAz: true,\n});\n\n// Allow the source DB security group to accept connections from DMS\ninstance.allowInboundFrom(\n  ec2.Peer.securityGroupId(myDbSg.securityGroupId),\n  ec2.Port.tcp(3306),\n);\n\n// 2. Endpoints\nconst source = new DmsEndpoint(stack, 'Source', {\n  endpointType: EndpointType.SOURCE,\n  engine: EndpointEngine.MYSQL,\n  serverName: 'mysql.example.com',\n  port: 3306,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('db-secret'),\n  databaseName: 'mydb',\n});\n\nconst target = new DmsEndpoint(stack, 'Target', {\n  endpointType: EndpointType.TARGET,\n  engine: EndpointEngine.S3,\n  s3Settings: {\n    bucketName: 'my-bucket',\n    serviceAccessRoleArn: s3Role.roleArn,\n  },\n});\n\n// 3. Replication task\nnew DmsReplicationTask(stack, 'Task', {\n  replicationInstanceArn: instance.replicationInstanceArn,\n  sourceEndpoint: source,\n  targetEndpoint: target,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  tableMappings: new TableMappings().includeSchema('public').toJson(),\n});\n```\n\n---\n\n## Using existing endpoints\n\nBring your own endpoints if they already exist (e.g., created outside CDK or in a different stack):\n\n```typescript\nimport { IDmsEndpoint } from 'cdk-dms-replication';\n\n// Reference an existing endpoint by ARN\nconst existingSource: IDmsEndpoint = {\n  endpointArn: 'arn:aws:dms:us-east-1:123456789012:endpoint:ABCDEF',\n};\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.CDC,\n  existingSourceEndpoint: existingSource,\n  targetEndpoint: {\n    engine: EndpointEngine.S3,\n    s3Settings: { ... },\n  },\n});\n```\n\n---\n\n## Secrets Manager integration\n\nFor production workloads, store credentials in AWS Secrets Manager and let DMS retrieve them directly (no plaintext in CloudFormation):\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.MYSQL,\n  serverName: 'mysql.example.com',\n  port: 3306,\n  mySqlSettings: {\n    secretsManagerSecretId: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:dms/mysql-abc123',\n    secretsManagerAccessRoleArn: dmsSecretsRole.roleArn,\n  },\n},\n```\n\nThe secret must contain `username` and `password` keys. See [Using AWS Secrets Manager to access database credentials](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html#security-iam-secretsmanager) for the required secret format and IAM permissions.\n\n---\n\n## Cross-account migrations\n\nDMS supports migrating data between AWS accounts. The replication instance always lives in one account (the **DMS account**) and connects to source and target databases over the network, regardless of which account owns them.\n\n### Prerequisites\n\nTwo things must be true before the construct can help:\n\n1. **Network connectivity** — The replication instance's VPC must be able to reach both endpoints. Establish this with [VPC peering](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html), [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html), or [AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) before deploying. The construct has no visibility into routing — it will synthesise correctly regardless, but the task will fail at runtime if the endpoints are unreachable.\n\n2. **IAM cross-account trust** — For AWS-managed targets (S3, Kinesis, Redshift, DynamoDB, etc.) owned by a different account, DMS needs an IAM role in the **target account** that trusts the DMS service principal in the **DMS account**.\n\n### CDK stack setup\n\nCDK cannot pass constructs like `ec2.IVpc` across account boundaries. Use `Vpc.fromLookup` in the DMS account stack to reference the VPC by ID:\n\n```typescript\n// DMS account stack (e.g. account 111111111111)\nconst vpc = ec2.Vpc.fromLookup(stack, 'Vpc', {\n  vpcId: 'vpc-0abc1234def567890',\n});\n```\n\n### Database endpoints (any engine)\n\nFor source or target databases running in another account, provide the hostname that is reachable from the replication instance's VPC (private IP, private DNS name, or VPC peering DNS). No special construct configuration is needed beyond what you would use for a same-account migration.\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n\n  // Source DB in account 222222222222, reachable via Transit Gateway\n  sourceEndpoint: {\n    engine: EndpointEngine.ORACLE,\n    serverName: '10.1.2.3',           // private IP from peered VPC\n    port: 1521,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('oracle-dms-secret'),\n    databaseName: 'ORCL',\n  },\n\n  // Target in the same DMS account — normal config\n  targetEndpoint: {\n    engine: EndpointEngine.AURORA_POSTGRESQL,\n    serverName: cluster.clusterEndpoint.hostname,\n    port: 5432,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('aurora-dms-secret'),\n    databaseName: 'mydb',\n  },\n});\n```\n\n### AWS-managed targets in another account (S3, Kinesis, Redshift, etc.)\n\nWhen the target service lives in a different account, create an IAM role in the **target account** that DMS (running in the DMS account) can assume. Pass its ARN via `serviceAccessRoleArn`.\n\n**Step 1 — Create the cross-account role in the target account (222222222222):**\n\n```typescript\n// In a stack deployed to the TARGET account (222222222222)\nconst crossAccountDmsRole = new iam.Role(targetStack, 'DmsCrossAccountRole', {\n  assumedBy: new iam.CompositePrincipal(\n    // Allow DMS in the DMS account to assume this role\n    new iam.ArnPrincipal(`arn:aws:iam::111111111111:role/dms-vpc-role`),\n    new iam.ServicePrincipal('dms.amazonaws.com'),\n  ),\n  inlinePolicies: {\n    S3Access: new iam.PolicyDocument({\n      statements: [\n        new iam.PolicyStatement({\n          actions: ['s3:PutObject', 's3:DeleteObject', 's3:ListBucket'],\n          resources: [\n            targetBucket.bucketArn,\n            `${targetBucket.bucketArn}/*`,\n          ],\n        }),\n      ],\n    }),\n  },\n});\n```\n\n**Step 2 — Reference the role ARN in the DMS account stack:**\n\n```typescript\n// In the DMS account stack (111111111111)\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD,\n  sourceEndpoint: {\n    engine: EndpointEngine.MYSQL,\n    serverName: 'mysql.internal.example.com',\n    port: 3306,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('mysql-dms-secret'),\n    databaseName: 'orders',\n  },\n  targetEndpoint: {\n    engine: EndpointEngine.S3,\n    s3Settings: {\n      bucketName: 'target-account-bucket',   // bucket in account 222222222222\n      serviceAccessRoleArn: 'arn:aws:iam::222222222222:role/DmsCrossAccountRole',\n    },\n  },\n});\n```\n\nThe same pattern applies to Kinesis, Redshift, DynamoDB, and other AWS-managed targets — create the role in the target account, grant it the permissions that service needs, and pass its ARN to the relevant `serviceAccessRoleArn` field.\n\n### Cross-account Secrets Manager\n\nIf the database credentials are stored in Secrets Manager in the source account (222222222222) but DMS runs in a different account (111111111111):\n\n1. Add a [resource-based policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html) to the secret in account 222222222222 that allows the DMS account's role to call `secretsmanager:GetSecretValue`.\n2. Pass the full secret ARN and the cross-account access role ARN to the endpoint settings:\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.MYSQL,\n  serverName: 'mysql.internal.example.com',\n  port: 3306,\n  mySqlSettings: {\n    secretsManagerSecretId:\n      'arn:aws:secretsmanager:us-east-1:222222222222:secret:dms/mysql-abc123',\n    secretsManagerAccessRoleArn:\n      'arn:aws:iam::111111111111:role/DmsSecretsManagerRole',\n  },\n},\n```\n\n### Cross-account KMS encryption\n\nThe construct creates a KMS key in the DMS account for replication instance storage. If you need the replication instance to write to a KMS-encrypted target in another account, bring your own key and add a cross-account statement to its key policy:\n\n```typescript\n// Key in the DMS account (111111111111), with cross-account decrypt permission\nconst encryptionKey = new kms.Key(stack, 'ReplicationKey', {\n  enableKeyRotation: true,\n  policy: new iam.PolicyDocument({\n    statements: [\n      // Standard key admin/use permissions ...\n      new iam.PolicyStatement({\n        principals: [new iam.AccountPrincipal('222222222222')],\n        actions: ['kms:Decrypt', 'kms:GenerateDataKey'],\n        resources: ['*'],\n      }),\n    ],\n  }),\n});\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  encryptionKey,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n### Summary of cross-account responsibilities\n\n| Concern | Who sets it up | How to configure |\n|---------|---------------|-----------------|\n| Network connectivity | You (VPC peering / TGW / PrivateLink) | Prerequisite — no construct prop |\n| Database endpoint hostname | You | `serverName` — use private IP or private DNS |\n| Cross-account service role (S3, Kinesis, etc.) | You (role in target account) | `serviceAccessRoleArn` |\n| Cross-account Secrets Manager | You (resource policy on secret) | `secretsManagerSecretId` + `secretsManagerAccessRoleArn` |\n| Cross-account KMS | You (key policy) | `encryptionKey` (bring your own) |\n| Replication instance, subnet group, task | This construct | Fully managed |\n\n---\n\n## Observability\n\nA CloudWatch Logs log group is created by default. Customise the retention period or disable it:\n\n```typescript\nimport * as logs from 'aws-cdk-lib/aws-logs';\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  enableCloudWatchLogs: true,\n  logRetention: logs.RetentionDays.THREE_MONTHS,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n---\n\n## API reference\n\nFull API documentation is available in [API.md](https://github.com/kckempf/cdk-dms-replication/blob/main/API.md) and on [Construct Hub](https://constructs.dev/packages/cdk-dms-replication).\n\n---\n\n## Supported source engines\n\n| Engine | `EndpointEngine` value |\n|--------|----------------------|\n| MySQL | `MYSQL` |\n| Amazon Aurora (MySQL) | `AURORA_MYSQL` |\n| PostgreSQL | `POSTGRES` |\n| Amazon Aurora (PostgreSQL) | `AURORA_POSTGRESQL` |\n| Oracle | `ORACLE` |\n| Microsoft SQL Server | `SQLSERVER` |\n| MariaDB | `MARIADB` |\n| SAP ASE (Sybase) | `SAP_ASE` |\n| IBM Db2 LUW | `IBM_DB2` |\n| IBM Db2 for z/OS | `IBM_DB2_ZOS` |\n| MongoDB | `MONGODB` |\n| Amazon DocumentDB | `DOCDB` |\n| Amazon S3 | `S3` |\n\n## Supported target engines\n\nAll source engines above, plus:\n\n| Engine | `EndpointEngine` value |\n|--------|----------------------|\n| Amazon S3 | `S3` |\n| Amazon DynamoDB | `DYNAMODB` |\n| Amazon Redshift | `REDSHIFT` |\n| Amazon Kinesis Data Streams | `KINESIS` |\n| Apache Kafka / Amazon MSK | `KAFKA` |\n| Amazon OpenSearch Service | `OPENSEARCH` |\n| Amazon Neptune | `NEPTUNE` |\n| Amazon ElastiCache for Redis | `REDIS` |\n\n---\n\n## Security considerations\n\n- The replication instance is placed in **private subnets** by default. Set `publiclyAccessible: true` only if required.\n- Storage is encrypted at rest using a **KMS customer-managed key** (auto-created if you don't provide one).\n- **Do not use the `password` prop in production.** The resolved value is written as plaintext into the CloudFormation template and state file. Use Secrets Manager instead: set `secretsManagerSecretId` and `secretsManagerAccessRoleArn` in the engine-specific settings and omit `password` entirely.\n- Grant DMS only the minimum IAM permissions required for each target engine.\n- For CDC with PostgreSQL, the replication user needs the `rds_replication` role (RDS) or `REPLICATION` privilege (self-managed).\n- For CDC with Oracle, supplemental logging must be enabled on the source database.\n- **`dms-vpc-role` and `dms-cloudwatch-logs-role`** are account-level IAM roles created automatically by this construct the first time a pipeline is deployed. Subsequent pipelines in the same account reuse the existing roles. If you manage these roles outside of CDK, import them via your stack before deploying.\n\n---\n\n## Contributing\n\nBug reports and pull requests are welcome. Please open an issue at [github.com/kckempf/cdk-dms-replication/issues](https://github.com/kckempf/cdk-dms-replication/issues) before starting significant work.\n\n---\n\n## Author\n\n[Kevin Kempf](https://github.com/kckempf)\n\n---\n\n## License\n\nApache-2.0 — see [LICENSE](https://github.com/kckempf/cdk-dms-replication/blob/main/LICENSE)\n"
+    "markdown": "# cdk-dms-replication\n\n[![npm version](https://badge.fury.io/js/cdk-dms-replication.svg)](https://badge.fury.io/js/cdk-dms-replication)\n[![PyPI version](https://badge.fury.io/py/cdk-dms-replication.svg)](https://badge.fury.io/py/cdk-dms-replication)\n[![build](https://github.com/kckempf/cdk-dms-replication/actions/workflows/build.yml/badge.svg)](https://github.com/kckempf/cdk-dms-replication/actions/workflows/build.yml)\n\nL3 CDK constructs for [Amazon Database Migration Service (DMS)](https://aws.amazon.com/dms/). Provision a complete migration pipeline — replication instance, endpoints, and task — in a few lines of code, with secure defaults and full support for all DMS-supported engines and migration patterns.\n\n## Features\n\n- **All migration patterns** — full load, CDC, and full-load-and-CDC\n- **Classic and Serverless** — `DmsMigrationPipeline` (fixed instance) or `DmsServerlessPipeline` (auto-scales DCUs)\n- **All DMS engines** — MySQL, PostgreSQL, Oracle, SQL Server, SAP ASE, IBM Db2, MongoDB, DocumentDB, S3, DynamoDB, Redshift, Kinesis, Kafka, OpenSearch, Neptune, Redis\n- **Secure defaults** — replication instance placed in private subnets, KMS encryption at rest, security group auto-created\n- **Fluent builders** — `TableMappings` and `TaskSettings` builders produce the JSON DMS expects without hand-crafting strings\n- **Multi-language** — TypeScript, Python, Java, .NET, Go (via JSII)\n- **Escape hatches** — pass existing endpoints or a pre-existing replication instance\n\n## Installation\n\n### TypeScript / JavaScript\n\n```bash\nnpm install cdk-dms-replication\n```\n\n### Python\n\n```bash\npip install cdk-dms-replication\n```\n\n### Java\n\n```xml\n<dependency>\n  <groupId>io.github.kckempf</groupId>\n  <artifactId>cdk-dms-replication</artifactId>\n  <version>VERSION</version>\n</dependency>\n```\n\n### .NET\n\n```bash\ndotnet add package KcKempf.CdkDmsReplication\n```\n\n### Go\n\n```bash\ngo get github.com/kckempf/cdk-dms-replication-go\n```\n\n---\n\n## Quick start\n\n### Classic pipeline (fixed replication instance)\n\n`DmsMigrationPipeline` provisions a replication instance, both endpoints, and a replication task in one construct.\n\n```typescript\nimport * as cdk from 'aws-cdk-lib';\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport {\n  DmsMigrationPipeline,\n  EndpointEngine,\n  MigrationType,\n  TableMappings,\n} from 'cdk-dms-replication';\n\nconst app = new cdk.App();\nconst stack = new cdk.Stack(app, 'MigrationStack');\n\nconst vpc = ec2.Vpc.fromLookup(stack, 'Vpc', { isDefault: false });\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n\n  sourceEndpoint: {\n    engine: EndpointEngine.MYSQL,\n    serverName: 'mysql.internal.example.com',\n    port: 3306,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('mysql-dms-password'),\n    databaseName: 'orders',\n  },\n\n  targetEndpoint: {\n    engine: EndpointEngine.AURORA_POSTGRESQL,\n    serverName: cluster.clusterEndpoint.hostname,\n    port: 5432,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('aurora-dms-password'),\n    databaseName: 'orders',\n  },\n\n  tableMappings: new TableMappings()\n    .includeSchema('public')\n    .excludeTable('public', 'audit_log')\n    .toJson(),\n});\n```\n\n> **Note:** The `tableMappings` default (when omitted) is to include all tables in all schemas.\n\n### Serverless pipeline (auto-scaling)\n\n`DmsServerlessPipeline` uses DMS Serverless, which automatically scales capacity (measured in DMS Capacity Units — DCUs) between a configurable minimum and maximum. There is no replication instance to size or manage.\n\n```typescript\nimport {\n  DmsServerlessPipeline,\n  EndpointEngine,\n  MigrationType,\n} from 'cdk-dms-replication';\n\nnew DmsServerlessPipeline(stack, 'Pipeline', {\n  vpc,\n  maxCapacityUnits: 16,           // required; valid values: 1,2,4,8,16,32,64,128,192,256,384\n  minCapacityUnits: 2,            // optional; DMS auto-determines if omitted\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n\n  sourceEndpoint: {\n    engine: EndpointEngine.MYSQL,\n    serverName: 'mysql.internal.example.com',\n    port: 3306,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('mysql-dms-password'),\n    databaseName: 'orders',\n  },\n\n  targetEndpoint: {\n    engine: EndpointEngine.AURORA_POSTGRESQL,\n    serverName: cluster.clusterEndpoint.hostname,\n    port: 5432,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('aurora-dms-password'),\n    databaseName: 'orders',\n  },\n});\n```\n\n> **CDC start/stop position limitation:** `DmsServerlessPipeline` does not support `cdcStartPosition` or `cdcStartTime` at the CloudFormation level. To start replication from a specific LSN or timestamp, call the [`StartReplication` API](https://docs.aws.amazon.com/dms/latest/APIReference/API_StartReplication.html) after the config is created.\n\n---\n\n## Migration patterns\n\n### Full load\n\nMigrates all existing data once, then stops.\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n### CDC only\n\nReplicates ongoing changes starting from a specific position or time. The target must already be seeded with data.\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.CDC,\n  cdcStartPosition: 'mysql-bin-changelog.000024:373',  // binlog position\n  // — or —\n  cdcStartTime: '2024-01-01T00:00:00Z',                // ISO-8601 timestamp\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n### Full load then CDC\n\nMigrates existing data, then automatically switches to continuous replication.\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n---\n\n## Endpoint examples\n\n### MySQL / MariaDB / Aurora MySQL\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.MYSQL,          // or MARIADB, AURORA_MYSQL\n  serverName: 'mysql.example.com',\n  port: 3306,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('db-secret'),\n  databaseName: 'mydb',\n  mySqlSettings: {\n    parallelLoadThreads: 4,\n    serverTimezone: 'UTC',\n  },\n},\n```\n\n### PostgreSQL / Aurora PostgreSQL\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.POSTGRES,       // or AURORA_POSTGRESQL\n  serverName: 'pg.example.com',\n  port: 5432,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('db-secret'),\n  databaseName: 'appdb',\n  postgreSqlSettings: {\n    captureDdls: true,\n    slotName: 'dms_replication_slot',\n    pluginName: PostgresCdcPlugin.PG_LOGICAL,\n    heartbeatEnable: true,\n  },\n},\n```\n\n### Oracle\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.ORACLE,\n  serverName: 'oracle.example.com',\n  port: 1521,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('oracle-secret'),\n  databaseName: 'ORCL',\n  oracleSettings: {\n    addSupplementalLogging: true,\n    useLogminerReader: true,   // true = LogMiner, false = BinaryReader\n  },\n},\n```\n\n### SQL Server\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.SQLSERVER,\n  serverName: 'sqlserver.example.com',\n  port: 1433,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('sqlserver-secret'),\n  databaseName: 'AdventureWorks',\n  sqlServerSettings: {\n    readBackupOnly: false,\n    safeguardPolicy: SqlServerSafeguardPolicy.RELY_ON_SQL_SERVER_REPLICATION_AGENT,\n  },\n},\n```\n\n### MongoDB / DocumentDB\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.MONGODB,        // or DOCDB\n  serverName: 'mongo.example.com',\n  port: 27017,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('mongo-secret'),\n  mongoDbSettings: {\n    authType: MongoAuthType.PASSWORD,\n    authMechanism: MongoAuthMechanism.SCRAM_SHA_1,\n    nestingLevel: MongoNestingLevel.ONE,\n  },\n},\n```\n\n### Amazon S3 (source or target)\n\n```typescript\n// As a target\ntargetEndpoint: {\n  engine: EndpointEngine.S3,\n  s3Settings: {\n    bucketName: 'my-migration-data',\n    bucketFolder: 'dms-output',\n    serviceAccessRoleArn: s3Role.roleArn,\n    dataFormat: S3DataFormat.PARQUET,\n    parquetVersion: ParquetVersion.PARQUET_2_0,\n    datePartitionEnabled: true,\n    datePartitionSequence: DatePartitionSequence.YYYYMMDD,\n    encryptionMode: EncryptionMode.SSE_KMS,\n    serverSideEncryptionKmsKeyId: myKey.keyArn,\n  },\n},\n```\n\n### Amazon Redshift\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.REDSHIFT,\n  serverName: 'my-cluster.abc123.us-east-1.redshift.amazonaws.com',\n  port: 5439,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('redshift-secret'),\n  databaseName: 'dev',\n  redshiftSettings: {\n    bucketName: 'my-redshift-staging',\n    serviceAccessRoleArn: redshiftRole.roleArn,\n    encryptionMode: EncryptionMode.SSE_KMS,\n    serverSideEncryptionKmsKeyId: myKey.keyArn,\n    truncateColumns: true,\n    emptyAsNull: true,\n  },\n},\n```\n\n### Amazon Kinesis Data Streams\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.KINESIS,\n  kinesisSettings: {\n    streamArn: stream.streamArn,\n    serviceAccessRoleArn: kinesisRole.roleArn,\n    messageFormat: MessageFormat.JSON,\n    includeTransactionDetails: true,\n    includeTableAlterOperations: true,\n  },\n},\n```\n\n### Apache Kafka / Amazon MSK\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.KAFKA,\n  kafkaSettings: {\n    broker: 'b-1.my-cluster.abc123.kafka.us-east-1.amazonaws.com:9092',\n    topic: 'dms-changes',\n    messageFormat: MessageFormat.JSON,\n    securityProtocol: KafkaSecurityProtocol.SASL_SSL,\n    saslUsername: 'dms_user',\n    saslPassword: cdk.SecretValue.secretsManager('kafka-sasl-password'),\n  },\n},\n```\n\n### Amazon OpenSearch Service\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.OPENSEARCH,\n  openSearchSettings: {\n    endpointUri: 'https://search-my-domain.us-east-1.es.amazonaws.com',\n    serviceAccessRoleArn: openSearchRole.roleArn,\n    fullLoadErrorPercentage: 10,\n    errorRetryDuration: 300,\n  },\n},\n```\n\n### Amazon Neptune\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.NEPTUNE,\n  neptuneSettings: {\n    s3BucketName: 'my-neptune-staging',\n    s3BucketFolder: 'dms',\n    serviceAccessRoleArn: neptuneRole.roleArn,\n    iamAuthEnabled: true,\n  },\n},\n```\n\n### Amazon DynamoDB\n\n```typescript\ntargetEndpoint: {\n  engine: EndpointEngine.DYNAMODB,\n  dynamoDbSettings: {\n    serviceAccessRoleArn: dynamoRole.roleArn,\n  },\n},\n```\n\n---\n\n## Table mappings\n\nUse the `TableMappings` fluent builder to control which tables are migrated and how they are named on the target.\n\n### Selection rules\n\n```typescript\nnew TableMappings()\n  .includeSchema('public')               // include all tables in 'public'\n  .includeSchema('%')                    // include all schemas (wildcard)\n  .excludeTable('public', 'audit_log')  // exclude a specific table\n  .excludeSchema('internal')            // exclude an entire schema\n  .explicitTable('public', 'orders')    // migrate only this one table\n  .toJson()\n```\n\n### Transformation rules\n\n```typescript\nnew TableMappings()\n  .includeSchema('%')\n  .renameSchema('legacy', 'v2')          // rename schema on target\n  .toLowerCaseTable('public', '%')       // lowercase all table names\n  .toUpperCaseSchema('%')                // uppercase all schema names\n  .addPrefixToTable('public', '%', 'migrated_')\n  .renameTable('public', 'usr', 'users') // rename a specific table\n  .renameColumn('public', 'orders', 'cust_id', 'customer_id')\n  .removeColumn('public', 'orders', 'internal_notes')\n  .toJson()\n```\n\n### Adding columns\n\n```typescript\nnew TableMappings()\n  .includeSchema('public')\n  .addColumn('public', 'orders', {\n    columnName: 'migrated_at',\n    columnType: ColumnDataType.DATETIME,\n    expression: '$timestamp',       // DMS built-in expression\n  })\n  .addColumn('public', 'orders', {\n    columnName: 'migration_version',\n    columnType: ColumnDataType.STRING,\n    columnLength: 10,\n    columnValue: 'v2.0',           // constant value\n  })\n  .toJson()\n```\n\n---\n\n## Task settings\n\nUse `TaskSettings` to tune LOB handling, error behaviour, full-load parallelism, and CDC batching.\n\n```typescript\nimport { TaskSettings, LobMode, ErrorAction, LoggingLevel } from 'cdk-dms-replication';\n\nconst settings = new TaskSettings()\n  // LOB handling\n  .withLobMode(LobMode.LIMITED_LOB, 64)   // truncate LOBs at 64 KB\n\n  // Full load tuning\n  .withFullLoadSubTasks(16)                // 16 parallel table loads\n  .withTargetTablePrepMode('DROP_AND_CREATE')\n  .withCommitRate(50000)                   // commit every 50k rows\n\n  // CDC batch apply\n  .withBatchApply(true, 5, 60)            // batch changes, 5–60 second window\n\n  // Error handling\n  .withDataErrorPolicy(ErrorAction.IGNORE_RECORD, 1000)\n  .withRecovery(-1, 5)                    // unlimited retries, 5s interval\n\n  // Logging\n  .withLogging('SOURCE_UNLOAD', LoggingLevel.LOGGER_SEVERITY_DEBUG)\n  .withLogging('TARGET_LOAD', LoggingLevel.LOGGER_SEVERITY_DEFAULT)\n  .toJson();\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  taskSettings: settings,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n---\n\n## Replication instance options\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n\n  // Instance sizing (default: R6I_LARGE)\n  replicationInstanceClass: ReplicationInstanceClass.R6I_4XLARGE,\n  allocatedStorage: 500,        // GB\n\n  // High availability\n  multiAz: true,\n\n  // Encryption — bring your own KMS key\n  encryptionKey: myKmsKey,\n\n  // Subnet placement\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,\n  },\n\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n---\n\n## Using lower-level constructs directly\n\nIf you need more control, use the individual constructs and wire them together yourself.\n\n```typescript\nimport {\n  DmsReplicationInstance,\n  DmsEndpoint,\n  DmsReplicationTask,\n  EndpointType,\n  EndpointEngine,\n  MigrationType,\n  TableMappings,\n} from 'cdk-dms-replication';\n\n// 1. Replication instance\nconst instance = new DmsReplicationInstance(stack, 'Instance', {\n  vpc,\n  replicationInstanceClass: ReplicationInstanceClass.R6I_LARGE,\n  multiAz: true,\n});\n\n// Allow the source DB security group to accept connections from DMS\ninstance.allowInboundFrom(\n  ec2.Peer.securityGroupId(myDbSg.securityGroupId),\n  ec2.Port.tcp(3306),\n);\n\n// 2. Endpoints\nconst source = new DmsEndpoint(stack, 'Source', {\n  endpointType: EndpointType.SOURCE,\n  engine: EndpointEngine.MYSQL,\n  serverName: 'mysql.example.com',\n  port: 3306,\n  username: 'dms_user',\n  password: cdk.SecretValue.secretsManager('db-secret'),\n  databaseName: 'mydb',\n});\n\nconst target = new DmsEndpoint(stack, 'Target', {\n  endpointType: EndpointType.TARGET,\n  engine: EndpointEngine.S3,\n  s3Settings: {\n    bucketName: 'my-bucket',\n    serviceAccessRoleArn: s3Role.roleArn,\n  },\n});\n\n// 3. Replication task\nnew DmsReplicationTask(stack, 'Task', {\n  replicationInstanceArn: instance.replicationInstanceArn,\n  sourceEndpoint: source,\n  targetEndpoint: target,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  tableMappings: new TableMappings().includeSchema('public').toJson(),\n});\n```\n\n---\n\n## Using existing endpoints\n\nBring your own endpoints if they already exist (e.g., created outside CDK or in a different stack):\n\n```typescript\nimport { IDmsEndpoint } from 'cdk-dms-replication';\n\n// Reference an existing endpoint by ARN\nconst existingSource: IDmsEndpoint = {\n  endpointArn: 'arn:aws:dms:us-east-1:123456789012:endpoint:ABCDEF',\n};\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.CDC,\n  existingSourceEndpoint: existingSource,\n  targetEndpoint: {\n    engine: EndpointEngine.S3,\n    s3Settings: { ... },\n  },\n});\n```\n\n---\n\n## Secrets Manager integration\n\nFor production workloads, store credentials in AWS Secrets Manager and let DMS retrieve them directly (no plaintext in CloudFormation):\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.MYSQL,\n  serverName: 'mysql.example.com',\n  port: 3306,\n  mySqlSettings: {\n    secretsManagerSecretId: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:dms/mysql-abc123',\n    secretsManagerAccessRoleArn: dmsSecretsRole.roleArn,\n  },\n},\n```\n\nThe secret must contain `username` and `password` keys. See [Using AWS Secrets Manager to access database credentials](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html#security-iam-secretsmanager) for the required secret format and IAM permissions.\n\n---\n\n## Cross-account migrations\n\nDMS supports migrating data between AWS accounts. The replication instance always lives in one account (the **DMS account**) and connects to source and target databases over the network, regardless of which account owns them.\n\n### Prerequisites\n\nTwo things must be true before the construct can help:\n\n1. **Network connectivity** — The replication instance's VPC must be able to reach both endpoints. Establish this with [VPC peering](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html), [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html), or [AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) before deploying. The construct has no visibility into routing — it will synthesise correctly regardless, but the task will fail at runtime if the endpoints are unreachable.\n\n2. **IAM cross-account trust** — For AWS-managed targets (S3, Kinesis, Redshift, DynamoDB, etc.) owned by a different account, DMS needs an IAM role in the **target account** that trusts the DMS service principal in the **DMS account**.\n\n### CDK stack setup\n\nCDK cannot pass constructs like `ec2.IVpc` across account boundaries. Use `Vpc.fromLookup` in the DMS account stack to reference the VPC by ID:\n\n```typescript\n// DMS account stack (e.g. account 111111111111)\nconst vpc = ec2.Vpc.fromLookup(stack, 'Vpc', {\n  vpcId: 'vpc-0abc1234def567890',\n});\n```\n\n### Database endpoints (any engine)\n\nFor source or target databases running in another account, provide the hostname that is reachable from the replication instance's VPC (private IP, private DNS name, or VPC peering DNS). No special construct configuration is needed beyond what you would use for a same-account migration.\n\n```typescript\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n\n  // Source DB in account 222222222222, reachable via Transit Gateway\n  sourceEndpoint: {\n    engine: EndpointEngine.ORACLE,\n    serverName: '10.1.2.3',           // private IP from peered VPC\n    port: 1521,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('oracle-dms-secret'),\n    databaseName: 'ORCL',\n  },\n\n  // Target in the same DMS account — normal config\n  targetEndpoint: {\n    engine: EndpointEngine.AURORA_POSTGRESQL,\n    serverName: cluster.clusterEndpoint.hostname,\n    port: 5432,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('aurora-dms-secret'),\n    databaseName: 'mydb',\n  },\n});\n```\n\n### AWS-managed targets in another account (S3, Kinesis, Redshift, etc.)\n\nWhen the target service lives in a different account, create an IAM role in the **target account** that DMS (running in the DMS account) can assume. Pass its ARN via `serviceAccessRoleArn`.\n\n**Step 1 — Create the cross-account role in the target account (222222222222):**\n\n```typescript\n// In a stack deployed to the TARGET account (222222222222)\nconst crossAccountDmsRole = new iam.Role(targetStack, 'DmsCrossAccountRole', {\n  assumedBy: new iam.CompositePrincipal(\n    // Allow DMS in the DMS account to assume this role\n    new iam.ArnPrincipal(`arn:aws:iam::111111111111:role/dms-vpc-role`),\n    new iam.ServicePrincipal('dms.amazonaws.com'),\n  ),\n  inlinePolicies: {\n    S3Access: new iam.PolicyDocument({\n      statements: [\n        new iam.PolicyStatement({\n          actions: ['s3:PutObject', 's3:DeleteObject', 's3:ListBucket'],\n          resources: [\n            targetBucket.bucketArn,\n            `${targetBucket.bucketArn}/*`,\n          ],\n        }),\n      ],\n    }),\n  },\n});\n```\n\n**Step 2 — Reference the role ARN in the DMS account stack:**\n\n```typescript\n// In the DMS account stack (111111111111)\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD,\n  sourceEndpoint: {\n    engine: EndpointEngine.MYSQL,\n    serverName: 'mysql.internal.example.com',\n    port: 3306,\n    username: 'dms_user',\n    password: cdk.SecretValue.secretsManager('mysql-dms-secret'),\n    databaseName: 'orders',\n  },\n  targetEndpoint: {\n    engine: EndpointEngine.S3,\n    s3Settings: {\n      bucketName: 'target-account-bucket',   // bucket in account 222222222222\n      serviceAccessRoleArn: 'arn:aws:iam::222222222222:role/DmsCrossAccountRole',\n    },\n  },\n});\n```\n\nThe same pattern applies to Kinesis, Redshift, DynamoDB, and other AWS-managed targets — create the role in the target account, grant it the permissions that service needs, and pass its ARN to the relevant `serviceAccessRoleArn` field.\n\n### Cross-account Secrets Manager\n\nIf the database credentials are stored in Secrets Manager in the source account (222222222222) but DMS runs in a different account (111111111111):\n\n1. Add a [resource-based policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html) to the secret in account 222222222222 that allows the DMS account's role to call `secretsmanager:GetSecretValue`.\n2. Pass the full secret ARN and the cross-account access role ARN to the endpoint settings:\n\n```typescript\nsourceEndpoint: {\n  engine: EndpointEngine.MYSQL,\n  serverName: 'mysql.internal.example.com',\n  port: 3306,\n  mySqlSettings: {\n    secretsManagerSecretId:\n      'arn:aws:secretsmanager:us-east-1:222222222222:secret:dms/mysql-abc123',\n    secretsManagerAccessRoleArn:\n      'arn:aws:iam::111111111111:role/DmsSecretsManagerRole',\n  },\n},\n```\n\n### Cross-account KMS encryption\n\nThe construct creates a KMS key in the DMS account for replication instance storage. If you need the replication instance to write to a KMS-encrypted target in another account, bring your own key and add a cross-account statement to its key policy:\n\n```typescript\n// Key in the DMS account (111111111111), with cross-account decrypt permission\nconst encryptionKey = new kms.Key(stack, 'ReplicationKey', {\n  enableKeyRotation: true,\n  policy: new iam.PolicyDocument({\n    statements: [\n      // Standard key admin/use permissions ...\n      new iam.PolicyStatement({\n        principals: [new iam.AccountPrincipal('222222222222')],\n        actions: ['kms:Decrypt', 'kms:GenerateDataKey'],\n        resources: ['*'],\n      }),\n    ],\n  }),\n});\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  encryptionKey,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n### Summary of cross-account responsibilities\n\n| Concern | Who sets it up | How to configure |\n|---------|---------------|-----------------|\n| Network connectivity | You (VPC peering / TGW / PrivateLink) | Prerequisite — no construct prop |\n| Database endpoint hostname | You | `serverName` — use private IP or private DNS |\n| Cross-account service role (S3, Kinesis, etc.) | You (role in target account) | `serviceAccessRoleArn` |\n| Cross-account Secrets Manager | You (resource policy on secret) | `secretsManagerSecretId` + `secretsManagerAccessRoleArn` |\n| Cross-account KMS | You (key policy) | `encryptionKey` (bring your own) |\n| Replication instance, subnet group, task | This construct | Fully managed |\n\n---\n\n## Observability\n\nA CloudWatch Logs log group is created by default. Customise the retention period or disable it:\n\n```typescript\nimport * as logs from 'aws-cdk-lib/aws-logs';\n\nnew DmsMigrationPipeline(stack, 'Pipeline', {\n  vpc,\n  migrationType: MigrationType.FULL_LOAD_AND_CDC,\n  enableCloudWatchLogs: true,\n  logRetention: logs.RetentionDays.THREE_MONTHS,\n  sourceEndpoint: { ... },\n  targetEndpoint: { ... },\n});\n```\n\n---\n\n## API reference\n\nFull API documentation is available in [API.md](https://github.com/kckempf/cdk-dms-replication/blob/main/API.md) and on [Construct Hub](https://constructs.dev/packages/cdk-dms-replication).\n\n---\n\n## Supported source engines\n\n| Engine | `EndpointEngine` value |\n|--------|----------------------|\n| MySQL | `MYSQL` |\n| Amazon Aurora (MySQL) | `AURORA_MYSQL` |\n| PostgreSQL | `POSTGRES` |\n| Amazon Aurora (PostgreSQL) | `AURORA_POSTGRESQL` |\n| Oracle | `ORACLE` |\n| Microsoft SQL Server | `SQLSERVER` |\n| MariaDB | `MARIADB` |\n| SAP ASE (Sybase) | `SAP_ASE` |\n| IBM Db2 LUW | `IBM_DB2` |\n| IBM Db2 for z/OS | `IBM_DB2_ZOS` |\n| MongoDB | `MONGODB` |\n| Amazon DocumentDB | `DOCDB` |\n| Amazon S3 | `S3` |\n\n## Supported target engines\n\nAll source engines above, plus:\n\n| Engine | `EndpointEngine` value |\n|--------|----------------------|\n| Amazon S3 | `S3` |\n| Amazon DynamoDB | `DYNAMODB` |\n| Amazon Redshift | `REDSHIFT` |\n| Amazon Kinesis Data Streams | `KINESIS` |\n| Apache Kafka / Amazon MSK | `KAFKA` |\n| Amazon OpenSearch Service | `OPENSEARCH` |\n| Amazon Neptune | `NEPTUNE` |\n| Amazon ElastiCache for Redis | `REDIS` |\n\n---\n\n## Security considerations\n\n- The replication instance is placed in **private subnets** by default. Set `publiclyAccessible: true` only if required.\n- Storage is encrypted at rest using a **KMS customer-managed key** (auto-created if you don't provide one).\n- **Do not use the `password` prop in production.** The resolved value is written as plaintext into the CloudFormation template and state file. Use Secrets Manager instead: set `secretsManagerSecretId` and `secretsManagerAccessRoleArn` in the engine-specific settings and omit `password` entirely.\n- Grant DMS only the minimum IAM permissions required for each target engine.\n- For CDC with PostgreSQL, the replication user needs the `rds_replication` role (RDS) or `REPLICATION` privilege (self-managed).\n- For CDC with Oracle, supplemental logging must be enabled on the source database.\n- **`dms-vpc-role` and `dms-cloudwatch-logs-role`** are account-level IAM roles required by DMS. When `createDmsServiceRoles` is `true` (the default), they are created idempotently via a custom resource — if they already exist in the account (created by another stack or manually), the existing roles are silently reused and their trust policies corrected if necessary. The roles are created with `RemovalPolicy.RETAIN` and are **not** lifecycle-managed by the deploying stack; they will not be deleted when the stack is destroyed. If you require the roles to be lifecycle-managed, create them in a dedicated stack and set `createDmsServiceRoles: false`.\n\n---\n\n## Contributing\n\nBug reports and pull requests are welcome. Please open an issue at [github.com/kckempf/cdk-dms-replication/issues](https://github.com/kckempf/cdk-dms-replication/issues) before starting significant work.\n\n---\n\n## Author\n\n[Kevin Kempf](https://github.com/kckempf)\n\n---\n\n## License\n\nApache-2.0 — see [LICENSE](https://github.com/kckempf/cdk-dms-replication/blob/main/LICENSE)\n"
   },
   "repository": {
     "type": "git",
@@ -4719,7 +4719,7 @@
         },
         "locationInModule": {
           "filename": "src/migration-pipeline.ts",
-          "line": 321
+          "line": 324
         },
         "parameters": [
           {
@@ -4745,7 +4745,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/migration-pipeline.ts",
-        "line": 289
+        "line": 292
       },
       "name": "DmsMigrationPipeline",
       "properties": [
@@ -4757,7 +4757,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 295
+            "line": 298
           },
           "name": "replicationInstance",
           "type": {
@@ -4772,7 +4772,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 304
+            "line": 307
           },
           "name": "replicationTask",
           "type": {
@@ -4787,7 +4787,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 298
+            "line": 301
           },
           "name": "source",
           "type": {
@@ -4802,7 +4802,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 301
+            "line": 304
           },
           "name": "target",
           "type": {
@@ -4813,34 +4813,34 @@
           "docs": {
             "remarks": "`undefined` when `createDmsServiceRoles` is `false`.",
             "stability": "stable",
-            "summary": "IAM role that allows DMS to write to CloudWatch Logs."
+            "summary": "Construct wrapping the custom resources that created the `dms-cloudwatch-logs-role`."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 313
+            "line": 316
           },
           "name": "dmsCloudWatchRole",
           "optional": true,
           "type": {
-            "fqn": "aws-cdk-lib.aws_iam.Role"
+            "fqn": "constructs.Construct"
           }
         },
         {
           "docs": {
             "remarks": "`undefined` when `createDmsServiceRoles` is `false`.",
             "stability": "stable",
-            "summary": "IAM role that allows DMS to manage VPC resources (dms-vpc-role)."
+            "summary": "Construct wrapping the custom resources that created the `dms-vpc-role`."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 319
+            "line": 322
           },
           "name": "dmsVpcRole",
           "optional": true,
           "type": {
-            "fqn": "aws-cdk-lib.aws_iam.Role"
+            "fqn": "constructs.Construct"
           }
         },
         {
@@ -4851,7 +4851,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 307
+            "line": 310
           },
           "name": "logGroup",
           "optional": true,
@@ -4873,7 +4873,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/migration-pipeline.ts",
-        "line": 87
+        "line": 86
       },
       "name": "DmsMigrationPipelineProps",
       "properties": [
@@ -4886,7 +4886,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 167
+            "line": 166
           },
           "name": "migrationType",
           "type": {
@@ -4903,7 +4903,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 96
+            "line": 95
           },
           "name": "vpc",
           "type": {
@@ -4920,7 +4920,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 114
+            "line": 113
           },
           "name": "allocatedStorage",
           "optional": true,
@@ -4938,7 +4938,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 193
+            "line": 192
           },
           "name": "cdcStartPosition",
           "optional": true,
@@ -4956,7 +4956,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 187
+            "line": 186
           },
           "name": "cdcStartTime",
           "optional": true,
@@ -4974,7 +4974,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 199
+            "line": 198
           },
           "name": "cdcStopPosition",
           "optional": true,
@@ -4986,14 +4986,14 @@
           "abstract": true,
           "docs": {
             "default": "true",
-            "remarks": "Set this to `false` if the roles already exist in the AWS account — for\nexample, because another CDK stack (or a manual deployment) already\ncreated them. Attempting to create roles with the same name twice in the\nsame account causes a CloudFormation `EntityAlreadyExists` error.\n\nWhen `false`, the construct expects the roles to already be present and\nskips creating them. The `dmsVpcRole` and `dmsCloudWatchRole` properties\nwill be `undefined`.",
+            "remarks": "When `true`, the roles are created idempotently via a custom resource: if\neither role already exists in the account (created by another stack or\nmanually), the existing role is silently reused and its trust policy is\ncorrected if necessary. The roles are created with `RemovalPolicy.RETAIN`\nand are **not** lifecycle-managed by this stack — they will not be deleted\nwhen the stack is destroyed. If you require the roles to be\nlifecycle-managed, create them in a dedicated stack and set this to\n`false`, then pass cross-stack references as needed.\n\nWhen `false`, the construct expects the roles to already be present and\nskips creating them. The `dmsVpcRole` and `dmsCloudWatchRole` properties\nwill be `undefined`.",
             "stability": "stable",
             "summary": "Whether to create the two account-level DMS service roles (`dms-vpc-role` and `dms-cloudwatch-logs-role`) required by DMS."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 236
+            "line": 239
           },
           "name": "createDmsServiceRoles",
           "optional": true,
@@ -5011,7 +5011,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 209
+            "line": 208
           },
           "name": "enableCloudWatchLogs",
           "optional": true,
@@ -5029,7 +5029,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 132
+            "line": 131
           },
           "name": "encryptionKey",
           "optional": true,
@@ -5047,7 +5047,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 126
+            "line": 125
           },
           "name": "engineVersion",
           "optional": true,
@@ -5065,7 +5065,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 148
+            "line": 147
           },
           "name": "existingSourceEndpoint",
           "optional": true,
@@ -5083,7 +5083,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 160
+            "line": 159
           },
           "name": "existingTargetEndpoint",
           "optional": true,
@@ -5101,7 +5101,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 215
+            "line": 214
           },
           "name": "logRetention",
           "optional": true,
@@ -5119,7 +5119,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 120
+            "line": 119
           },
           "name": "multiAz",
           "optional": true,
@@ -5137,7 +5137,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 246
+            "line": 249
           },
           "name": "removalPolicy",
           "optional": true,
@@ -5155,7 +5155,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 108
+            "line": 107
           },
           "name": "replicationInstanceClass",
           "optional": true,
@@ -5173,7 +5173,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 142
+            "line": 141
           },
           "name": "sourceEndpoint",
           "optional": true,
@@ -5191,7 +5191,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 174
+            "line": 173
           },
           "name": "tableMappings",
           "optional": true,
@@ -5209,7 +5209,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 154
+            "line": 153
           },
           "name": "targetEndpoint",
           "optional": true,
@@ -5227,7 +5227,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 181
+            "line": 180
           },
           "name": "taskSettings",
           "optional": true,
@@ -5245,7 +5245,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 102
+            "line": 101
           },
           "name": "vpcSubnets",
           "optional": true,
@@ -5993,7 +5993,7 @@
         },
         "locationInModule": {
           "filename": "src/serverless-pipeline.ts",
-          "line": 272
+          "line": 279
         },
         "parameters": [
           {
@@ -6019,7 +6019,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/serverless-pipeline.ts",
-        "line": 235
+        "line": 242
       },
       "name": "DmsServerlessPipeline",
       "properties": [
@@ -6031,7 +6031,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 237
+            "line": 244
           },
           "name": "cfnReplicationConfig",
           "type": {
@@ -6046,7 +6046,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 252
+            "line": 259
           },
           "name": "encryptionKey",
           "type": {
@@ -6061,7 +6061,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 240
+            "line": 247
           },
           "name": "replicationConfigArn",
           "type": {
@@ -6076,7 +6076,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 255
+            "line": 262
           },
           "name": "securityGroup",
           "type": {
@@ -6091,7 +6091,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 243
+            "line": 250
           },
           "name": "source",
           "type": {
@@ -6106,7 +6106,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 249
+            "line": 256
           },
           "name": "subnetGroup",
           "type": {
@@ -6121,7 +6121,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 246
+            "line": 253
           },
           "name": "target",
           "type": {
@@ -6132,34 +6132,34 @@
           "docs": {
             "remarks": "`undefined` when `createDmsServiceRoles` is `false`.",
             "stability": "stable",
-            "summary": "IAM role that allows DMS to write to CloudWatch Logs."
+            "summary": "Construct wrapping the custom resources that created the `dms-cloudwatch-logs-role`."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 264
+            "line": 271
           },
           "name": "dmsCloudWatchRole",
           "optional": true,
           "type": {
-            "fqn": "aws-cdk-lib.aws_iam.Role"
+            "fqn": "constructs.Construct"
           }
         },
         {
           "docs": {
             "remarks": "`undefined` when `createDmsServiceRoles` is `false`.",
             "stability": "stable",
-            "summary": "IAM role that allows DMS to manage VPC resources (dms-vpc-role)."
+            "summary": "Construct wrapping the custom resources that created the `dms-vpc-role`."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 270
+            "line": 277
           },
           "name": "dmsVpcRole",
           "optional": true,
           "type": {
-            "fqn": "aws-cdk-lib.aws_iam.Role"
+            "fqn": "constructs.Construct"
           }
         },
         {
@@ -6170,7 +6170,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 258
+            "line": 265
           },
           "name": "logGroup",
           "optional": true,
@@ -6192,7 +6192,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/serverless-pipeline.ts",
-        "line": 24
+        "line": 23
       },
       "name": "DmsServerlessPipelineProps",
       "properties": [
@@ -6206,7 +6206,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 57
+            "line": 56
           },
           "name": "maxCapacityUnits",
           "type": {
@@ -6222,7 +6222,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 119
+            "line": 118
           },
           "name": "migrationType",
           "type": {
@@ -6239,7 +6239,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 33
+            "line": 32
           },
           "name": "vpc",
           "type": {
@@ -6250,14 +6250,14 @@
           "abstract": true,
           "docs": {
             "default": "true",
-            "remarks": "Set to `false` if the roles already exist — for example, because a\n`DmsMigrationPipeline` or a prior manual deployment already created them.\nAttempting to create roles with the same name twice causes a CloudFormation\n`EntityAlreadyExists` error.",
+            "remarks": "When `true`, the roles are created idempotently via a custom resource: if\neither role already exists in the account (created by another stack or\nmanually), the existing role is silently reused and its trust policy is\ncorrected if necessary. The roles are created with `RemovalPolicy.RETAIN`\nand are **not** lifecycle-managed by this stack — they will not be deleted\nwhen the stack is destroyed. If you require the roles to be\nlifecycle-managed, create them in a dedicated stack and set this to\n`false`, then pass cross-stack references as needed.\n\nWhen `false`, the construct expects the roles to already be present and\nskips creating them. The `dmsVpcRole` and `dmsCloudWatchRole` properties\nwill be `undefined`.",
             "stability": "stable",
             "summary": "Whether to create the two account-level DMS service roles (`dms-vpc-role` and `dms-cloudwatch-logs-role`) required by DMS."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 172
+            "line": 179
           },
           "name": "createDmsServiceRoles",
           "optional": true,
@@ -6275,7 +6275,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 149
+            "line": 148
           },
           "name": "enableCloudWatchLogs",
           "optional": true,
@@ -6293,7 +6293,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 100
+            "line": 99
           },
           "name": "existingSourceEndpoint",
           "optional": true,
@@ -6311,7 +6311,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 112
+            "line": 111
           },
           "name": "existingTargetEndpoint",
           "optional": true,
@@ -6329,7 +6329,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 84
+            "line": 83
           },
           "name": "kmsKey",
           "optional": true,
@@ -6347,7 +6347,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 155
+            "line": 154
           },
           "name": "logRetention",
           "optional": true,
@@ -6365,7 +6365,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 63
+            "line": 62
           },
           "name": "minCapacityUnits",
           "optional": true,
@@ -6383,7 +6383,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 69
+            "line": 68
           },
           "name": "multiAz",
           "optional": true,
@@ -6400,7 +6400,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 74
+            "line": 73
           },
           "name": "preferredMaintenanceWindow",
           "optional": true,
@@ -6418,7 +6418,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 188
+            "line": 195
           },
           "name": "removalPolicy",
           "optional": true,
@@ -6436,7 +6436,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 182
+            "line": 189
           },
           "name": "replicationConfigIdentifier",
           "optional": true,
@@ -6454,7 +6454,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 45
+            "line": 44
           },
           "name": "securityGroups",
           "optional": true,
@@ -6477,7 +6477,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 94
+            "line": 93
           },
           "name": "sourceEndpoint",
           "optional": true,
@@ -6495,7 +6495,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 126
+            "line": 125
           },
           "name": "tableMappings",
           "optional": true,
@@ -6513,7 +6513,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 106
+            "line": 105
           },
           "name": "targetEndpoint",
           "optional": true,
@@ -6534,7 +6534,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 139
+            "line": 138
           },
           "name": "taskSettings",
           "optional": true,
@@ -6552,7 +6552,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/serverless-pipeline.ts",
-            "line": 39
+            "line": 38
           },
           "name": "vpcSubnets",
           "optional": true,
@@ -11296,7 +11296,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/migration-pipeline.ts",
-        "line": 23
+        "line": 22
       },
       "name": "SourceEndpointOptions",
       "properties": [
@@ -11308,7 +11308,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 24
+            "line": 23
           },
           "name": "engine",
           "type": {
@@ -11323,7 +11323,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 37
+            "line": 36
           },
           "name": "certificateArn",
           "optional": true,
@@ -11339,7 +11339,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 35
+            "line": 34
           },
           "name": "databaseName",
           "optional": true,
@@ -11355,7 +11355,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 44
+            "line": 43
           },
           "name": "db2Settings",
           "optional": true,
@@ -11371,7 +11371,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 25
+            "line": 24
           },
           "name": "endpointIdentifier",
           "optional": true,
@@ -11387,7 +11387,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 36
+            "line": 35
           },
           "name": "extraConnectionAttributes",
           "optional": true,
@@ -11403,7 +11403,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 45
+            "line": 44
           },
           "name": "mongoDbSettings",
           "optional": true,
@@ -11419,7 +11419,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 39
+            "line": 38
           },
           "name": "mySqlSettings",
           "optional": true,
@@ -11435,7 +11435,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 41
+            "line": 40
           },
           "name": "oracleSettings",
           "optional": true,
@@ -11453,7 +11453,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 34
+            "line": 33
           },
           "name": "password",
           "optional": true,
@@ -11469,7 +11469,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 27
+            "line": 26
           },
           "name": "port",
           "optional": true,
@@ -11485,7 +11485,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 40
+            "line": 39
           },
           "name": "postgreSqlSettings",
           "optional": true,
@@ -11501,7 +11501,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 46
+            "line": 45
           },
           "name": "s3Settings",
           "optional": true,
@@ -11517,7 +11517,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 43
+            "line": 42
           },
           "name": "sapAseSettings",
           "optional": true,
@@ -11533,7 +11533,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 26
+            "line": 25
           },
           "name": "serverName",
           "optional": true,
@@ -11549,7 +11549,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 42
+            "line": 41
           },
           "name": "sqlServerSettings",
           "optional": true,
@@ -11565,7 +11565,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 38
+            "line": 37
           },
           "name": "sslMode",
           "optional": true,
@@ -11581,7 +11581,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 28
+            "line": 27
           },
           "name": "username",
           "optional": true,
@@ -12644,7 +12644,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/migration-pipeline.ts",
-        "line": 53
+        "line": 52
       },
       "name": "TargetEndpointOptions",
       "properties": [
@@ -12656,7 +12656,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 54
+            "line": 53
           },
           "name": "engine",
           "type": {
@@ -12671,7 +12671,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 67
+            "line": 66
           },
           "name": "certificateArn",
           "optional": true,
@@ -12687,7 +12687,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 65
+            "line": 64
           },
           "name": "databaseName",
           "optional": true,
@@ -12703,7 +12703,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 74
+            "line": 73
           },
           "name": "db2Settings",
           "optional": true,
@@ -12719,7 +12719,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 77
+            "line": 76
           },
           "name": "dynamoDbSettings",
           "optional": true,
@@ -12735,7 +12735,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 55
+            "line": 54
           },
           "name": "endpointIdentifier",
           "optional": true,
@@ -12751,7 +12751,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 66
+            "line": 65
           },
           "name": "extraConnectionAttributes",
           "optional": true,
@@ -12767,7 +12767,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 80
+            "line": 79
           },
           "name": "kafkaSettings",
           "optional": true,
@@ -12783,7 +12783,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 79
+            "line": 78
           },
           "name": "kinesisSettings",
           "optional": true,
@@ -12799,7 +12799,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 75
+            "line": 74
           },
           "name": "mongoDbSettings",
           "optional": true,
@@ -12815,7 +12815,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 69
+            "line": 68
           },
           "name": "mySqlSettings",
           "optional": true,
@@ -12831,7 +12831,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 82
+            "line": 81
           },
           "name": "neptuneSettings",
           "optional": true,
@@ -12847,7 +12847,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 81
+            "line": 80
           },
           "name": "openSearchSettings",
           "optional": true,
@@ -12863,7 +12863,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 71
+            "line": 70
           },
           "name": "oracleSettings",
           "optional": true,
@@ -12881,7 +12881,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 64
+            "line": 63
           },
           "name": "password",
           "optional": true,
@@ -12897,7 +12897,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 57
+            "line": 56
           },
           "name": "port",
           "optional": true,
@@ -12913,7 +12913,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 70
+            "line": 69
           },
           "name": "postgreSqlSettings",
           "optional": true,
@@ -12929,7 +12929,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 83
+            "line": 82
           },
           "name": "redisSettings",
           "optional": true,
@@ -12945,7 +12945,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 78
+            "line": 77
           },
           "name": "redshiftSettings",
           "optional": true,
@@ -12961,7 +12961,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 76
+            "line": 75
           },
           "name": "s3Settings",
           "optional": true,
@@ -12977,7 +12977,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 73
+            "line": 72
           },
           "name": "sapAseSettings",
           "optional": true,
@@ -12993,7 +12993,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 56
+            "line": 55
           },
           "name": "serverName",
           "optional": true,
@@ -13009,7 +13009,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 72
+            "line": 71
           },
           "name": "sqlServerSettings",
           "optional": true,
@@ -13025,7 +13025,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 68
+            "line": 67
           },
           "name": "sslMode",
           "optional": true,
@@ -13041,7 +13041,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/migration-pipeline.ts",
-            "line": 58
+            "line": 57
           },
           "name": "username",
           "optional": true,
@@ -13480,6 +13480,6 @@
       "symbolId": "src/table-mappings:TransformationAction"
     }
   },
-  "version": "0.0.16",
-  "fingerprint": "Gshn4bKO1FkK30PscmwCnsRuxSsYSVq1pQ7pwiZFmO8="
+  "version": "0.1.1",
+  "fingerprint": "OZkzjYKUjTnfAqrI/5Izuussehn0mdV6yZffGyhWQKs="
 }