cdk-rds-sql 6.0.2 → 6.1.0

package/.jsii

@@ -3910,7 +3910,7 @@
   },
   "name": "cdk-rds-sql",
   "readme": {
-    "markdown": "# About\n\nThis CDK construct library makes it possible to create databases,\nschemas, and roles in an Aurora Serverless v2, RDS Database Cluster or\nDatabase Instance. Both PostgreSQL and MySQL databases are supported.\n\nThis construct library is intended to be used in enterprise\nenvironments, and works in isolated subnets.\n\n<p align=\"left\">\n  <a href=\"https://github.com/semantic-release/semantic-release\"><img src=\"https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release\" alt=semantic-release: angular\"></a>\n  <a href=\"https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml\"><img src=\"https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml/badge.svg\" alt=\"Release badge\"></a>\n</p>\n\n# Requirements\n\n- CDK v2.\n\n# Installation\n\n     npm i cdk-rds-sql\n\n# Usage\n\n## Provider\n\nFirst setup your VPC and create your cluster:\n\n```ts\nimport { Duration, RemovalPolicy } from \"aws-cdk-lib\"\nimport * as ec2 from \"aws-cdk-lib/aws-ec2\"\nimport * as rds from \"aws-cdk-lib/aws-rds\"\n\nconst vpc = ec2.Vpc.fromLookup(this, \"Vpc\", {\n  vpcId: this.node.tryGetContext(\"vpc-id\"),\n})\n\nconst cluster = new rds.ServerlessCluster(this, \"Cluster\", {\n  vpc: vpc,\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,\n  },\n  engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,\n  parameterGroup: rds.ParameterGroup.fromParameterGroupName(\n    this,\n    \"ParameterGroup\",\n    \"default.aurora-postgresql11\"\n  ),\n  removalPolicy: RemovalPolicy.DESTROY,\n  scaling: {\n    autoPause: Duration.minutes(60),\n    minCapacity: rds.AuroraCapacityUnit.ACU_2,\n    maxCapacity: rds.AuroraCapacityUnit.ACU_2,\n  },\n})\n```\n\nThen create a provider which will connect to your database. For a cluster:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  cluster: cluster,\n  secret: cluster.secret!,\n})\n```\n\nFor an instance:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  instance: instance,\n  secret: cluster.secret!,\n})\n```\n\nThe provider will setup a lambda, which normally lives in the same VPC\nas the database. You can give a different VPC, as long as that VPC has\naccess to the VPC of the database. Only the provider lambda will talk\nto your database.\n\nThe provider will by default use the private isolated subnet of the\nVPC. Your isolated network must have a VPC endpoint to AWS Secrets Manager\nand possibly KMS as well. If you want to use a subnet with egress\naccess in case you have no such VPC endpoints, specify the subnet as\nfollows:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,\n  },\n  cluster: cluster,\n  secret: cluster.secret!,\n})\n```\n\n### Disabling SSL\n\nThe default connection to RDS is ssl enabled (this used to be disabled\nin versions below 4).\n\nYou can disable ssl by setting the `ssl` option to `false`:\n\n```ts\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  instance: instance,\n  secret: cluster.secret!,\n  ssl: false, // default is true\n})\n```\n\n## Roles\n\nCreate a postgres role (or mysql user) for a cluster as follows:\n\n```ts\nimport { Role } from \"cdk-rds-sql\"\n\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n  databaseName: \"mydb\",\n})\n```\n\nThis will automatically create a secret just like `ServerlessCluster`\ndoes, with all the connection info needed for this user. It's secret value is a JSON like:\n\n```json\n{\n  \"dbClusterIdentifier\": \"teststack-clustereb1186t9-sh4wpqfdyfvu\",\n  \"password\": \"very-long-and-boring\",\n  \"dbname\": \"mydb\",\n  \"engine\": \"postgres\",\n  \"port\": 5432,\n  \"host\": \"teststack-clustereb1186t9-sh4wpqfdyfvu.cluster-cgudolabssna.us-east-1.rds.amazonaws.com\",\n  \"username\": \"myrole\"\n}\n```\n\nYou can access the secret via `role.secret`.\n\nInstead of `databaseName` you can also specify `database` to reference\nan existing database. The role will not be created until the database\nhas been created.\n\nIf you want to make the role the owner of a new database, just specify\nthe `databaseName` here, and create the database later.\n\n### MySQL support\n\nIn MySQL users are created with '%' as value for the host. It is hard\nto do this better:\n\n- Determine the CIDR blocks used by a VPC is not trivial.\n- For imported VPCs you cannot specify the IPv6 CIDR.\n- CIDRs might change without the system knowing, meaning applications\n  could lose access to the database at random times, such as when a\n  container is restarted.\n\n## Database\n\nCreate a database as follows:\n\n```ts\nimport { Database } from \"cdk-rds-sql\"\n\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n})\n```\n\nYou can provide an owner, which makes it easy to create database owned\nby a new user:\n\n```ts\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n  owner: role,\n})\n```\n\n## Schema\n\nCreate a schema in the default database as follows:\n\n```ts\nimport { Schema } from \"cdk-rds-sql\"\n\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n})\n```\n\nOr in another database:\n\n```ts\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n})\n\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n  databaseName: database.databaseName,\n})\n```\n\nOne may need a role permitted for using schema:\n\n```ts\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n  databaseName: database.databaseName,\n  role: role,\n})\n```\n\n## Sql\n\nYou can insert arbitrary SQL into your database with the `Sql` construct:\n\n```ts\nimport { Sql } from \"cdk-rds-sql\"\n\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: \"create table t (i int)\",\n})\n```\n\nCreate a table if it does not exist, and grant a role privileges:\n\n```ts\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: `\ncreate table if not exists t (i int);\ngrant select on t to myrole;\n`,\n})\n```\n\nRollback sql on stack deletion:\n\n```ts\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: `\ncreate table if not exists t (i int);\ngrant select on t to myrole;\n`,\n  rollback: `\nDO $$BEGIN\n  IF EXISTS (select from pg_database WHERE datname = 't') THEN\n    IF EXISTS (select from pg_catalog.pg_roles WHERE rolname = 'myrole') THEN\n      revoke select t from myrole;\n    END IF;\n    drop table t;\n  END IF;\nEND$$;\n`,\n})\n```\n\nNote that there is no synchronisation between various `Sql`\nconstructs, in particular the order in your code does not determine\nthe order in which your SQL is executed. This happens in parallel,\nunless you specify an explicit dependency via `sql.node.addDepency()`.\n\nThere are a lot of concerns when using `Sql`:\n\n- When you update your Sql, your previous Sql is not \"rolled back\",\n  the new Sql is simply executed again.\n- When you delete your `Sql` construct the rollback is executed if specified\n- When permission are granted via `Sql` they must be removed via rollback to succesfully remove the role\n- Currently the `Sql` constructs has less than 5 minutes to execute\n  its work.\n- It is unknown how large your SQL can be.\n\n# Parameters\n\nSome lambda constructs, in particular [Bref](https://bref.sh/), do not\nsupport secrets out of the box. This construct allows you to create\nSSM parameters in addition to a secret:\n\n```ts\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n  databaseName: \"mydb\",\n  parameterPrefix: \"/my-app/\",\n})\n```\n\nThis will create `/my-app/username`, `/my-app/password` and such.\n\nTo access parameters you will need IAM permissions such as:\n\n```ts\ninitialPolicy: [\n  new iam.PolicyStatement({\n\tactions: [\"ssm:GetParameter\", \"ssm:GetParameters\"],\n\tresources: [\n\t  // Grant access to all parameters under the base path\n\t  `arn:aws:ssm:${this.region}:${this.account}:parameter/my-app/*`,\n\t],\n\teffect: iam.Effect.ALLOW,\n  })\n],\n```\n\nNote that your VPC will need an SSM Parameters interface endpoint to support this.\n\n# IPv6\n\nIf you use the provider in an IPv6 subnet you probably need these settings:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  ...\n  functionProps: {\n\tipv6AllowedForDualStack: true,\n\tallowAllIpv6Outbound: true,\n  },\n}\n```\n\n# Working on this code\n\nThis code is managed by\n[projen](https://github.com/projen/projen/blob/main/README.md). In\naddition [pre-commit](https://pre-commit.com/) is used.\n\nSo after git clone and `npm ci` you would do:\n\n```\npre-commit install --install-hooks --hook-type commit-msg --hook-type pre-commit\n```\n\nto install the pre-commit hooks.\n\n## Testing\n\nTest code via projen with:\n\n    npx projen test\n\nYou can run the sample stack with:\n\n    npx projen integ:deploy:serverless\n\nIf you want to use an existing vpc:\n\n    npx cdk deploy --context vpc-id=vpc-0123456789 TestServerlessV2Stack\n\n# To do\n\n- Update role: will not revoke connect to previous database if database name has changed.\n- If the cluster is configured for autopausing, wake cluster up before doing any SQL operations.\n- We rename roles and database on update: is that actually the best\n  thing? More change to get us into an irrecoverable situation??\n"
+    "markdown": "# About\n\nThis CDK construct library makes it possible to create databases,\nschemas, and roles in an Aurora Serverless v2, RDS Database Cluster or\nDatabase Instance. Both PostgreSQL and MySQL databases are supported.\n\nThis construct library is intended to be used in enterprise\nenvironments, and works in isolated subnets.\n\n<p align=\"left\">\n  <a href=\"https://github.com/semantic-release/semantic-release\"><img src=\"https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release\" alt=semantic-release: angular\"></a>\n  <a href=\"https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml\"><img src=\"https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml/badge.svg\" alt=\"Release badge\"></a>\n</p>\n\n# Requirements\n\n- CDK v2.\n\n# Installation\n\n     npm i cdk-rds-sql\n\n# Usage\n\n## Provider\n\nFirst setup your VPC and create your cluster:\n\n```ts\nimport { Duration, RemovalPolicy } from \"aws-cdk-lib\"\nimport * as ec2 from \"aws-cdk-lib/aws-ec2\"\nimport * as rds from \"aws-cdk-lib/aws-rds\"\n\nconst vpc = ec2.Vpc.fromLookup(this, \"Vpc\", {\n  vpcId: this.node.tryGetContext(\"vpc-id\"),\n})\n\nconst cluster = new rds.ServerlessCluster(this, \"Cluster\", {\n  vpc: vpc,\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,\n  },\n  engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,\n  parameterGroup: rds.ParameterGroup.fromParameterGroupName(\n    this,\n    \"ParameterGroup\",\n    \"default.aurora-postgresql11\"\n  ),\n  removalPolicy: RemovalPolicy.DESTROY,\n  scaling: {\n    autoPause: Duration.minutes(60),\n    minCapacity: rds.AuroraCapacityUnit.ACU_2,\n    maxCapacity: rds.AuroraCapacityUnit.ACU_2,\n  },\n})\n```\n\nThen create a provider which will connect to your database. For a cluster:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  cluster: cluster,\n  secret: cluster.secret!,\n})\n```\n\nFor an instance:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  instance: instance,\n  secret: cluster.secret!,\n})\n```\n\nThe provider will setup a lambda, which normally lives in the same VPC\nas the database. You can give a different VPC, as long as that VPC has\naccess to the VPC of the database. Only the provider lambda will talk\nto your database.\n\nThe provider will by default use the private isolated subnet of the\nVPC. Your isolated network must have a VPC endpoint to AWS Secrets Manager\nand possibly KMS as well. If you want to use a subnet with egress\naccess in case you have no such VPC endpoints, specify the subnet as\nfollows:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,\n  },\n  cluster: cluster,\n  secret: cluster.secret!,\n})\n```\n\n### Disabling SSL\n\nThe default connection to RDS is ssl enabled (this used to be disabled\nin versions below 4).\n\nYou can disable ssl by setting the `ssl` option to `false`:\n\n```ts\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  instance: instance,\n  secret: cluster.secret!,\n  ssl: false, // default is true\n})\n```\n\n## Roles\n\nCreate a postgres role (or mysql user) for a cluster as follows:\n\n```ts\nimport { Role } from \"cdk-rds-sql\"\n\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n  databaseName: \"mydb\",\n})\n```\n\nThis will automatically create a secret just like `ServerlessCluster`\ndoes, with all the connection info needed for this user. It's secret value is a JSON like:\n\n```json\n{\n  \"dbClusterIdentifier\": \"teststack-clustereb1186t9-sh4wpqfdyfvu\",\n  \"password\": \"very-long-and-boring\",\n  \"dbname\": \"mydb\",\n  \"engine\": \"postgres\",\n  \"port\": 5432,\n  \"host\": \"teststack-clustereb1186t9-sh4wpqfdyfvu.cluster-cgudolabssna.us-east-1.rds.amazonaws.com\",\n  \"username\": \"myrole\"\n}\n```\n\nYou can access the secret via `role.secret`.\n\nInstead of `databaseName` you can also specify `database` to reference\nan existing database. The role will not be created until the database\nhas been created.\n\nIf you want to make the role the owner of a new database, just specify\nthe `databaseName` here, and create the database later.\n\n### IAM Authentication\n\nInstead of password-based authentication, you can create roles that use AWS IAM database authentication. This eliminates the need to store database passwords and provides enhanced security through AWS IAM policies.\n\n```ts\nimport { Role } from \"cdk-rds-sql\"\n\nconst iamRole = new Role(this, \"IamRole\", {\n  provider: provider,\n  roleName: \"myiamrole\",\n  databaseName: \"mydb\",\n  enableIamAuth: true,\n})\n```\n\nFor IAM-authenticated roles, the secret will not contain a password field:\n\n```json\n{\n  \"dbClusterIdentifier\": \"teststack-clustereb1186t9-sh4wpqfdyfvu\",\n  \"dbname\": \"mydb\",\n  \"engine\": \"postgres\",\n  \"port\": 5432,\n  \"host\": \"teststack-clustereb1186t9-sh4wpqfdyfvu.cluster-cgudolabssna.us-east-1.rds.amazonaws.com\",\n  \"username\": \"myiamrole\"\n}\n```\n\n**Requirements for IAM Authentication:**\n\n- SSL connections are required (enabled by default in this library)\n- Your application must have IAM permissions to connect to the database\n- The database user/role name must match the IAM identity\n\n**IAM Policy Example:**\n\nYour application will need an IAM policy like this to connect:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"rds-db:connect\"\n      ],\n      \"Resource\": [\n        \"arn:aws:rds-db:region:account-id:dbuser:cluster-resource-id/myiamrole\"\n      ]\n    }\n  ]\n}\n```\n\nBoth PostgreSQL and MySQL databases support IAM authentication. For more details, see the [AWS RDS IAM Database Authentication documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html).\n\n### MySQL support\n\nIn MySQL users are created with '%' as value for the host. It is hard\nto do this better:\n\n- Determine the CIDR blocks used by a VPC is not trivial.\n- For imported VPCs you cannot specify the IPv6 CIDR.\n- CIDRs might change without the system knowing, meaning applications\n  could lose access to the database at random times, such as when a\n  container is restarted.\n\n## Database\n\nCreate a database as follows:\n\n```ts\nimport { Database } from \"cdk-rds-sql\"\n\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n})\n```\n\nYou can provide an owner, which makes it easy to create database owned\nby a new user:\n\n```ts\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n  owner: role,\n})\n```\n\n## Schema\n\nCreate a schema in the default database as follows:\n\n```ts\nimport { Schema } from \"cdk-rds-sql\"\n\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n})\n```\n\nOr in another database:\n\n```ts\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n})\n\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n  databaseName: database.databaseName,\n})\n```\n\nOne may need a role permitted for using schema:\n\n```ts\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n  databaseName: database.databaseName,\n  role: role,\n})\n```\n\n## Sql\n\nYou can insert arbitrary SQL into your database with the `Sql` construct:\n\n```ts\nimport { Sql } from \"cdk-rds-sql\"\n\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: \"create table t (i int)\",\n})\n```\n\nCreate a table if it does not exist, and grant a role privileges:\n\n```ts\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: `\ncreate table if not exists t (i int);\ngrant select on t to myrole;\n`,\n})\n```\n\nRollback sql on stack deletion:\n\n```ts\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: `\ncreate table if not exists t (i int);\ngrant select on t to myrole;\n`,\n  rollback: `\nDO $$BEGIN\n  IF EXISTS (select from pg_database WHERE datname = 't') THEN\n    IF EXISTS (select from pg_catalog.pg_roles WHERE rolname = 'myrole') THEN\n      revoke select t from myrole;\n    END IF;\n    drop table t;\n  END IF;\nEND$$;\n`,\n})\n```\n\nNote that there is no synchronisation between various `Sql`\nconstructs, in particular the order in your code does not determine\nthe order in which your SQL is executed. This happens in parallel,\nunless you specify an explicit dependency via `sql.node.addDepency()`.\n\nThere are a lot of concerns when using `Sql`:\n\n- When you update your Sql, your previous Sql is not \"rolled back\",\n  the new Sql is simply executed again.\n- When you delete your `Sql` construct the rollback is executed if specified\n- When permission are granted via `Sql` they must be removed via rollback to succesfully remove the role\n- Currently the `Sql` constructs has less than 5 minutes to execute\n  its work.\n- It is unknown how large your SQL can be.\n\n# Parameters\n\nSome lambda constructs, in particular [Bref](https://bref.sh/), do not\nsupport secrets out of the box. This construct allows you to create\nSSM parameters in addition to a secret:\n\n```ts\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n  databaseName: \"mydb\",\n  parameterPrefix: \"/my-app/\",\n})\n```\n\nThis will create `/my-app/username`, `/my-app/password` and such.\n\nTo access parameters you will need IAM permissions such as:\n\n```ts\ninitialPolicy: [\n  new iam.PolicyStatement({\n\tactions: [\"ssm:GetParameter\", \"ssm:GetParameters\"],\n\tresources: [\n\t  // Grant access to all parameters under the base path\n\t  `arn:aws:ssm:${this.region}:${this.account}:parameter/my-app/*`,\n\t],\n\teffect: iam.Effect.ALLOW,\n  })\n],\n```\n\nNote that your VPC will need an SSM Parameters interface endpoint to support this.\n\n# IPv6\n\nIf you use the provider in an IPv6 subnet you probably need these settings:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  ...\n  functionProps: {\n\tipv6AllowedForDualStack: true,\n\tallowAllIpv6Outbound: true,\n  },\n}\n```\n\n# Working on this code\n\nThis code is managed by\n[projen](https://github.com/projen/projen/blob/main/README.md). In\naddition [pre-commit](https://pre-commit.com/) is used.\n\nSo after git clone and `npm ci` you would do:\n\n```\npre-commit install --install-hooks --hook-type commit-msg --hook-type pre-commit\n```\n\nto install the pre-commit hooks.\n\n## Testing\n\nTest code via projen with:\n\n    npx projen test\n\nYou can run the sample stack with:\n\n    npx projen integ:deploy:serverless\n\nIf you want to use an existing vpc:\n\n    npx cdk deploy --context vpc-id=vpc-0123456789 TestServerlessV2Stack\n\n# To do\n\n- Update role: will not revoke connect to previous database if database name has changed.\n- If the cluster is configured for autopausing, wake cluster up before doing any SQL operations.\n- We rename roles and database on update: is that actually the best\n  thing? More change to get us into an irrecoverable situation??\n"
   },
   "repository": {
     "type": "git",
@@ -4517,7 +4517,7 @@
         },
         "locationInModule": {
           "filename": "src/role.ts",
-          "line": 141
+          "line": 152
         },
         "parameters": [
           {
@@ -4543,7 +4543,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/role.ts",
-        "line": 130
+        "line": 141
       },
       "name": "Role",
       "properties": [
@@ -4555,7 +4555,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/role.ts",
-            "line": 134
+            "line": 145
           },
           "name": "roleName",
           "type": {
@@ -4570,7 +4570,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/role.ts",
-            "line": 139
+            "line": 150
           },
           "name": "secret",
           "type": {
@@ -4662,6 +4662,25 @@
             "primitive": "string"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "false - use password authentication",
+            "remarks": "When enabled, the role will be created without a password and\nconfigured for AWS IAM database authentication. The secret\nwill not contain a password field.",
+            "stability": "stable",
+            "summary": "Enable IAM authentication for this role."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/role.ts",
+            "line": 84
+          },
+          "name": "enableIamAuth",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -4994,6 +5013,6 @@
       "symbolId": "src/sql:SqlProps"
     }
   },
-  "version": "6.0.2",
-  "fingerprint": "l3mVrC+C/4qgFUXkeDLbgiPEVu/xD/n4TNI8UfB0qnc="
+  "version": "6.1.0",
+  "fingerprint": "Jr9mtiVWj8E4ZRwDqRC2WebFyv8Fd/9WJUVkePMxpv8="
 }

package/README.md

@@ -157,6 +157,63 @@ has been created.
 If you want to make the role the owner of a new database, just specify
 the `databaseName` here, and create the database later.
 
+### IAM Authentication
+
+Instead of password-based authentication, you can create roles that use AWS IAM database authentication. This eliminates the need to store database passwords and provides enhanced security through AWS IAM policies.
+
+```ts
+import { Role } from "cdk-rds-sql"
+
+const iamRole = new Role(this, "IamRole", {
+  provider: provider,
+  roleName: "myiamrole",
+  databaseName: "mydb",
+  enableIamAuth: true,
+})
+```
+
+For IAM-authenticated roles, the secret will not contain a password field:
+
+```json
+{
+  "dbClusterIdentifier": "teststack-clustereb1186t9-sh4wpqfdyfvu",
+  "dbname": "mydb",
+  "engine": "postgres",
+  "port": 5432,
+  "host": "teststack-clustereb1186t9-sh4wpqfdyfvu.cluster-cgudolabssna.us-east-1.rds.amazonaws.com",
+  "username": "myiamrole"
+}
+```
+
+**Requirements for IAM Authentication:**
+
+- SSL connections are required (enabled by default in this library)
+- Your application must have IAM permissions to connect to the database
+- The database user/role name must match the IAM identity
+
+**IAM Policy Example:**
+
+Your application will need an IAM policy like this to connect:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "rds-db:connect"
+      ],
+      "Resource": [
+        "arn:aws:rds-db:region:account-id:dbuser:cluster-resource-id/myiamrole"
+      ]
+    }
+  ]
+}
+```
+
+Both PostgreSQL and MySQL databases support IAM authentication. For more details, see the [AWS RDS IAM Database Authentication documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html).
+
 ### MySQL support
 
 In MySQL users are created with '%' as value for the host. It is hard

package/lambda/engine.abstract.ts

@@ -62,9 +62,10 @@ export abstract class AbstractEngine {
   ): Promise<any>
 
   /**
-   * Parse password field from secret. Returns void on error.
+   * Parse password field from secret. Returns void on error or if no password field exists.
    */
   protected async getPassword(arn: string): Promise<string | void> {
+    if (!arn) return
     const secrets_client = new SecretsManagerClient({})
     const command = new GetSecretValueCommand({
       SecretId: arn,

package/lambda/engine.mysql.test.ts

@@ -88,6 +88,81 @@ describe("MySQL Engine", () => {
       )
       expect(grantStatement).toBeDefined()
     })
+
+    describe("IAM Authentication", () => {
+      it("should create user with IAM authentication", async () => {
+        const props = {
+          EnableIamAuth: true,
+          DatabaseName: "testdb",
+        }
+
+        const sql = await engine.createRole("iamuser", props)
+
+        expect(Array.isArray(sql)).toBe(true)
+        expect(sql[0]).toContain("CREATE USER IF NOT EXISTS 'iamuser'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'")
+        expect(sql[1]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'iamuser'@'%'")
+        expect(sql[2]).toBe("FLUSH PRIVILEGES")
+      })
+
+      it("should create user without IAM authentication", async () => {
+        jest.spyOn(engine as any, "getPassword").mockResolvedValue("test-password")
+
+        const props = {
+          EnableIamAuth: false,
+          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
+          DatabaseName: "testdb",
+        }
+
+        const sql = await engine.createRole("passworduser", props)
+
+        expect(Array.isArray(sql)).toBe(true)
+        expect(sql[0]).toContain("CREATE USER IF NOT EXISTS 'passworduser'@'%' IDENTIFIED BY 'test-password'")
+        expect(sql[1]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'passworduser'@'%'")
+        expect(sql[2]).toBe("FLUSH PRIVILEGES")
+      })
+
+      it("should switch from password to IAM authentication", async () => {
+        const oldProps = {
+          EnableIamAuth: false,
+          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
+        }
+
+        const newProps = {
+          EnableIamAuth: true,
+          DatabaseName: "testdb",
+        }
+
+        const sql = await engine.updateRole("switchuser", "switchuser", newProps, oldProps)
+
+        expect(Array.isArray(sql)).toBe(true)
+        expect(sql[0]).toContain("DROP USER IF EXISTS 'switchuser'@'%'")
+        expect(sql[1]).toContain("CREATE USER 'switchuser'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'")
+        expect(sql[2]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'switchuser'@'%'")
+        expect(sql[3]).toBe("FLUSH PRIVILEGES")
+      })
+
+      it("should switch from IAM to password authentication", async () => {
+        jest.spyOn(engine as any, "getPassword").mockResolvedValue("new-password")
+
+        const oldProps = {
+          EnableIamAuth: true,
+        }
+
+        const newProps = {
+          EnableIamAuth: false,
+          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
+          DatabaseName: "testdb",
+        }
+
+        const sql = await engine.updateRole("switchuser", "switchuser", newProps, oldProps)
+
+        expect(Array.isArray(sql)).toBe(true)
+        expect(sql[0]).toContain("DROP USER IF EXISTS 'switchuser'@'%'")
+        expect(sql[1]).toContain("CREATE USER 'switchuser'@'%' IDENTIFIED BY 'new-password'")
+        expect(sql[2]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'switchuser'@'%'")
+        expect(sql[3]).toBe("FLUSH PRIVILEGES")
+      })
+    })
   })
 
   describe("Schema", () => {

package/lambda/engine.mysql.ts

@@ -22,21 +22,31 @@ export class MysqlEngine extends AbstractEngine {
   }
 
   async createRole(resourceId: string, props?: any): Promise<string[]> {
-    if (!props.PasswordArn) throw new Error("No PasswordArn provided")
-    const password = await this.getPassword(props.PasswordArn)
-    if (!password) throw `Cannot parse password from ${props.PasswordArn}`
-
-    const sql = [
-      `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY '${password}'`,
-    ]
+    const sql: string[] = []
+    
+    if (props.EnableIamAuth) {
+      // Create user for IAM authentication
+      sql.push(
+        `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
+      )
+    } else {
+      // Create user with password authentication
+      if (!props.PasswordArn) throw new Error("No PasswordArn provided")
+      const password = await this.getPassword(props.PasswordArn)
+      if (!password) throw `Cannot parse password from ${props.PasswordArn}`
+      
+      sql.push(
+        `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY '${password}'`
+      )
+    }
 
     if (props.DatabaseName) {
       sql.push(
         `GRANT ALL PRIVILEGES ON \`${props.DatabaseName}\`.* TO '${resourceId}'@'%'`
       )
-      sql.push(`FLUSH PRIVILEGES`)
     }
-
+    
+    sql.push(`FLUSH PRIVILEGES`)
     return sql
   }
 
@@ -50,7 +60,13 @@ export class MysqlEngine extends AbstractEngine {
 
     if (oldResourceId !== resourceId) {
       // MySQL doesn't allow renaming users directly, we need to create a new one and drop the old one
-      if (props?.PasswordArn) {
+      if (props?.EnableIamAuth) {
+        // Create new user with IAM auth
+        sql.push(
+          `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
+        )
+      } else if (props?.PasswordArn) {
+        // Create new user with password auth
         const password = await this.getPassword(props.PasswordArn)
         if (!password) throw `Cannot parse password from ${props.PasswordArn}`
 
@@ -65,12 +81,28 @@ export class MysqlEngine extends AbstractEngine {
 
       // Drop the old user
       sql.push(`DROP USER IF EXISTS '${oldResourceId}'@'%'`)
-    } else if (props?.PasswordArn) {
-      // Just update the password
-      const password = await this.getPassword(props.PasswordArn)
-      if (!password) throw `Cannot parse password from ${props.PasswordArn}`
-
-      sql.push(`ALTER USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`)
+    } else {
+      // Handle authentication method changes for existing user
+      if (props?.EnableIamAuth && !oldProps?.EnableIamAuth) {
+        // Switching from password to IAM auth - need to recreate user
+        sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`)
+        sql.push(
+          `CREATE USER '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
+        )
+      } else if (!props?.EnableIamAuth && oldProps?.EnableIamAuth) {
+        // Switching from IAM to password auth - need to recreate user
+        sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`)
+        if (props?.PasswordArn) {
+          const password = await this.getPassword(props.PasswordArn)
+          if (!password) throw `Cannot parse password from ${props.PasswordArn}`
+          sql.push(`CREATE USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`)
+        }
+      } else if (!props?.EnableIamAuth && props?.PasswordArn) {
+        // Just update the password for password auth
+        const password = await this.getPassword(props.PasswordArn)
+        if (!password) throw `Cannot parse password from ${props.PasswordArn}`
+        sql.push(`ALTER USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`)
+      }
     }
 
     // Check if database name has changed

package/lambda/engine.postgresql.test.ts

@@ -46,13 +46,86 @@ describe("PostgreSQL Engine", () => {
       // Check for transaction commit
       expect(sql[sql.length - 1]).toBe("commit")
     })
+
+    describe("IAM Authentication", () => {
+      it("should create role with IAM authentication", async () => {
+        const props = {
+          EnableIamAuth: true,
+          DatabaseName: "testdb",
+        }
+
+        const sql = await engine.createRole("iamrole", props)
+
+        expect(Array.isArray(sql)).toBe(true)
+        expect(sql[0]).toBe("start transaction")
+        expect(sql).toContain('create role iamrole with login')
+        expect(sql).toContain('grant rds_iam to iamrole')
+        expect(sql[sql.length - 1]).toBe("commit")
+      })
+
+      it("should create role without IAM authentication", async () => {
+        jest.spyOn(engine as any, "getPassword").mockResolvedValue("test-password")
+
+        const props = {
+          EnableIamAuth: false,
+          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
+          DatabaseName: "testdb",
+        }
+
+        const sql = await engine.createRole("passwordrole", props)
+
+        expect(Array.isArray(sql)).toBe(true)
+        expect(sql[0]).toBe("start transaction")
+        expect(sql).toContain('create role passwordrole with login password \'test-password\'')
+        expect(sql[sql.length - 1]).toBe("commit")
+      })
+
+      it("should switch from password to IAM authentication", async () => {
+        const oldProps = {
+          EnableIamAuth: false,
+          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
+        }
+
+        const newProps = {
+          EnableIamAuth: true,
+        }
+
+        const sql = await engine.updateRole("switchrole", "switchrole", newProps, oldProps)
+
+        expect(Array.isArray(sql)).toBe(true)
+        expect(sql[0]).toBe("start transaction")
+        expect(sql).toContain('grant rds_iam to switchrole')
+        expect(sql[sql.length - 1]).toBe("commit")
+      })
+
+      it("should switch from IAM to password authentication", async () => {
+        jest.spyOn(engine as any, "getPassword").mockResolvedValue("new-password")
+
+        const oldProps = {
+          EnableIamAuth: true,
+        }
+
+        const newProps = {
+          EnableIamAuth: false,
+          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
+        }
+
+        const sql = await engine.updateRole("switchrole", "switchrole", newProps, oldProps)
+
+        expect(Array.isArray(sql)).toBe(true)
+        expect(sql[0]).toBe("start transaction")
+        expect(sql).toContain('revoke rds_iam from switchrole')
+        expect(sql).toContain('alter role switchrole with password \'new-password\'')
+        expect(sql[sql.length - 1]).toBe("commit")
+      })
+    })
   })
 
   // Add basic tests for other PostgreSQL functionality
   describe("Database", () => {
     it("should generate correct SQL for creating a database", () => {
       const sql = engine.createDatabase("testdb", {})
-      expect(sql).toContain('create database "testdb"')
+      expect(sql).toContain('create database testdb')
     })
   })
 

package/lambda/engine.postgresql.ts

@@ -53,33 +53,40 @@ export class PostgresqlEngine extends AbstractEngine {
   }
 
   async createRole(resourceId: string, props?: any): Promise<string[]> {
-    if (!props.PasswordArn) throw "No PasswordArn provided"
-    const password = await this.getPassword(props.PasswordArn)
-    if (password) {
-      const sql = [
-        "start transaction",
-        pgFormat("create role %I with login password %L", resourceId, password),
-      ]
-      if (props.DatabaseName) {
-        sql.push(
-          pgFormat(
-            `DO $$
+    const sql = ["start transaction"]
+    
+    if (props.EnableIamAuth) {
+      // Create role for IAM authentication
+      sql.push(pgFormat("create role %I with login", resourceId))
+      sql.push(pgFormat("grant rds_iam to %I", resourceId))
+    } else {
+      // Create role with password authentication
+      if (!props.PasswordArn) throw "No PasswordArn provided"
+      const password = await this.getPassword(props.PasswordArn)
+      if (!password) {
+        throw `Cannot parse password from ${props.PasswordArn}`
+      }
+      sql.push(pgFormat("create role %I with login password %L", resourceId, password))
+    }
+    
+    if (props.DatabaseName) {
+      sql.push(
+        pgFormat(
+          `DO $$
 BEGIN
   IF EXISTS (select from pg_database where datname = '%s' and datistemplate = false) THEN
     grant connect on database %I to %I;
   END IF;
 END$$;`,
-            props.DatabaseName,
-            props.DatabaseName,
-            resourceId
-          )
+          props.DatabaseName,
+          props.DatabaseName,
+          resourceId
         )
-      }
-      sql.push("commit")
-      return sql
-    } else {
-      throw `Cannot parse password from ${props.PasswordArn}`
+      )
     }
+    
+    sql.push("commit")
+    return sql
   }
 
   async updateRole(
@@ -88,72 +95,58 @@ END$$;`,
     props?: any,
     oldProps?: any
   ): Promise<string[]> {
-    if (props?.PasswordArn) {
-      const password = await this.getPassword(props.PasswordArn)
-      if (password) {
-        const sql = ["start transaction"]
-        if (oldResourceId !== resourceId) {
-          sql.push(pgFormat("alter role %I rename to %I", oldResourceId, resourceId))
+    const sql = ["start transaction"]
+    
+    if (oldResourceId !== resourceId) {
+      sql.push(pgFormat("alter role %I rename to %I", oldResourceId, resourceId))
+    }
+    
+    // Handle authentication method changes
+    if (props?.EnableIamAuth && !oldProps?.EnableIamAuth) {
+      // Switching from password to IAM auth
+      sql.push(pgFormat("grant rds_iam to %I", resourceId))
+    } else if (!props?.EnableIamAuth && oldProps?.EnableIamAuth) {
+      // Switching from IAM to password auth
+      sql.push(pgFormat("revoke rds_iam from %I", resourceId))
+      if (props?.PasswordArn) {
+        const password = await this.getPassword(props.PasswordArn)
+        if (!password) {
+          throw `Cannot parse password from ${props.PasswordArn}`
         }
         sql.push(pgFormat("alter role %I with password %L", resourceId, password))
-        // Check if database name has changed
-        if (
-          oldProps?.DatabaseName &&
-          props.DatabaseName &&
-          oldProps.DatabaseName !== props.DatabaseName
-        ) {
-          // Revoke from old database
-          sql.push(
-            pgFormat(
-              `DO $$
-  BEGIN
-    IF EXISTS (select from pg_database where datname = '%s' and datistemplate = false) THEN
-      revoke connect on database %I from %I;
-    END IF;
-  END$$;`,
-              oldProps.DatabaseName,
-              oldProps.DatabaseName,
-              resourceId
-            )
-          )
-        }
-
-        if (props.DatabaseName) {
-          sql.push(
-            pgFormat("grant connect on database %I to %I", props.DatabaseName, resourceId)
-          )
-        }
-        sql.push("commit")
-        return sql
-      } else {
-        throw `Cannot parse password from ${props.PasswordArn}`
       }
-    } else {
-      const sql = ["start transaction"]
-      if (oldResourceId !== resourceId) {
-        sql.push(pgFormat("alter role %I rename to %I", oldResourceId, resourceId))
+    } else if (!props?.EnableIamAuth && props?.PasswordArn) {
+      // Update password for password auth
+      const password = await this.getPassword(props.PasswordArn)
+      if (!password) {
+        throw `Cannot parse password from ${props.PasswordArn}`
       }
-      // Check if database name has changed
-      if (
-        oldProps?.DatabaseName &&
-        props.DatabaseName &&
-        oldProps.DatabaseName !== props.DatabaseName
-      ) {
-        // Revoke from old database
-        sql.push(
-          pgFormat(
-            `DO $$
+      sql.push(pgFormat("alter role %I with password %L", resourceId, password))
+    }
+    
+    // Check if database name has changed
+    if (
+      oldProps?.DatabaseName &&
+      props?.DatabaseName &&
+      oldProps.DatabaseName !== props.DatabaseName
+    ) {
+      // Revoke from old database
+      sql.push(
+        pgFormat(
+          `DO $$
 BEGIN
   IF EXISTS (select from pg_database where datname = '%s' and datistemplate = false) THEN
-  revoke connect on database %I from %I;
+    revoke connect on database %I from %I;
   END IF;
 END$$;`,
-            oldProps.DatabaseName,
-            oldProps.DatabaseName,
-            resourceId
-          )
+          oldProps.DatabaseName,
+          oldProps.DatabaseName,
+          resourceId
         )
-      }
+      )
+    }
+
+    if (props?.DatabaseName) {
       sql.push(
         pgFormat(
           `DO $$
@@ -167,9 +160,10 @@ END$$;`,
           resourceId
         )
       )
-      sql.push("commit")
-      return sql
     }
+    
+    sql.push("commit")
+    return sql
   }
 
   deleteRole(resourceId: string, props?: any): string[] {

package/lib/database.js

@@ -40,5 +40,5 @@ class Database extends aws_cdk_lib_1.CustomResource {
 }
 exports.Database = Database;
 _a = JSII_RTTI_SYMBOL_1;
-Database[_a] = { fqn: "cdk-rds-sql.Database", version: "6.0.2" };
+Database[_a] = { fqn: "cdk-rds-sql.Database", version: "6.1.0" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGF0YWJhc2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvZGF0YWJhc2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2Q0FBNEM7QUFDNUMsMkNBQXNDO0FBQ3RDLGlDQUF1QztBQTJCdkMsTUFBTSxnQkFBaUIsU0FBUSxzQkFBUztJQUd0QyxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQXlCO1FBQ2pFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUE7UUFDaEIsSUFBSSxDQUFDLFlBQVksR0FBRyxLQUFLLENBQUMsWUFBWSxDQUFBO0lBQ3hDLENBQUM7Q0FDRjtBQUVELE1BQWEsUUFBUyxTQUFRLDRCQUFjO0lBQzFDOztPQUVHO0lBQ0gsTUFBTSxDQUFDLGdCQUFnQixDQUFDLEtBQWdCLEVBQUUsRUFBVSxFQUFFLFlBQW9CO1FBQ3hFLE9BQU8sSUFBSSxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ3JDLFlBQVksRUFBRSxZQUFZO1NBQzNCLENBQUMsQ0FBQTtJQUNKLENBQUM7SUFJRCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQW9CO1FBQzVELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsWUFBWSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWTtZQUN6QyxVQUFVLEVBQUU7Z0JBQ1YsUUFBUSxFQUFFLHFCQUFjLENBQUMsUUFBUTtnQkFDakMsVUFBVSxFQUFFLEtBQUssQ0FBQyxZQUFZO2dCQUM5QixTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUztnQkFDMUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsUUFBUTthQUM3QjtTQUNGLENBQUMsQ0FBQTtRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN2QyxJQUFJLENBQUMsWUFBWSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUE7UUFDdEMsSUFBSSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDaEIsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBQ3RDLENBQUM7SUFDSCxDQUFDOztBQTNCSCw0QkE0QkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSB9IGZyb20gXCJhd3MtY2RrLWxpYlwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgUHJvdmlkZXIgfSBmcm9tIFwiLi9wcm92aWRlclwiXG5pbXBvcnQgeyBSb2xlIH0gZnJvbSBcIi4vcm9sZVwiXG5cbmludGVyZmFjZSBEYXRhYmFzZUF0dHJpYnV0ZXMge1xuICAvKipcbiAgICogTmFtZSBvZiBkYXRhYmFzZSB0byBjcmVhdGUuXG4gICAqL1xuICByZWFkb25seSBkYXRhYmFzZU5hbWU6IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZSBvd25lci5cbiAgICovXG4gIHJlYWRvbmx5IG93bmVyPzogUm9sZVxufVxuXG5leHBvcnQgaW50ZXJmYWNlIERhdGFiYXNlUHJvcHMgZXh0ZW5kcyBEYXRhYmFzZUF0dHJpYnV0ZXMge1xuICAvKipcbiAgICogUHJvdmlkZXIuXG4gICAqL1xuICByZWFkb25seSBwcm92aWRlcjogUHJvdmlkZXJcbn1cblxuZXhwb3J0IGludGVyZmFjZSBJRGF0YWJhc2Uge1xuICByZWFkb25seSBkYXRhYmFzZU5hbWU6IHN0cmluZ1xufVxuXG5jbGFzcyBJbXBvcnRlZERhdGFiYXNlIGV4dGVuZHMgQ29uc3RydWN0IGltcGxlbWVudHMgSURhdGFiYXNlIHtcbiAgcHVibGljIHJlYWRvbmx5IGRhdGFiYXNlTmFtZTogc3RyaW5nXG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IERhdGFiYXNlQXR0cmlidXRlcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZClcbiAgICB0aGlzLmRhdGFiYXNlTmFtZSA9IHByb3BzLmRhdGFiYXNlTmFtZVxuICB9XG59XG5cbmV4cG9ydCBjbGFzcyBEYXRhYmFzZSBleHRlbmRzIEN1c3RvbVJlc291cmNlIGltcGxlbWVudHMgSURhdGFiYXNlIHtcbiAgLyoqXG4gICAqIFJldHVybiBhIERhdGFiYXNlIGJhc2VkIHVwb24gbmFtZSBvbmx5LiBVc2UgZm9yIGltcG9ydGluZyBleGlzdGluZyBkYXRhYmFzZXMuXG4gICAqL1xuICBzdGF0aWMgZnJvbURhdGFiYXNlTmFtZShzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBkYXRhYmFzZU5hbWU6IHN0cmluZyk6IElEYXRhYmFzZSB7XG4gICAgcmV0dXJuIG5ldyBJbXBvcnRlZERhdGFiYXNlKHNjb3BlLCBpZCwge1xuICAgICAgZGF0YWJhc2VOYW1lOiBkYXRhYmFzZU5hbWUsXG4gICAgfSlcbiAgfVxuXG4gIHB1YmxpYyByZWFkb25seSBkYXRhYmFzZU5hbWU6IHN0cmluZ1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBEYXRhYmFzZVByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICBzZXJ2aWNlVG9rZW46IHByb3BzLnByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICAgIHByb3BlcnRpZXM6IHtcbiAgICAgICAgUmVzb3VyY2U6IFJkc1NxbFJlc291cmNlLkRBVEFCQVNFLFxuICAgICAgICBSZXNvdXJjZUlkOiBwcm9wcy5kYXRhYmFzZU5hbWUsXG4gICAgICAgIFNlY3JldEFybjogcHJvcHMucHJvdmlkZXIuc2VjcmV0LnNlY3JldEFybixcbiAgICAgICAgT3duZXI6IHByb3BzLm93bmVyPy5yb2xlTmFtZSxcbiAgICAgIH0sXG4gICAgfSlcbiAgICB0aGlzLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5wcm92aWRlcilcbiAgICB0aGlzLmRhdGFiYXNlTmFtZSA9IHByb3BzLmRhdGFiYXNlTmFtZVxuICAgIGlmIChwcm9wcy5vd25lcikge1xuICAgICAgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMub3duZXIpXG4gICAgfVxuICB9XG59XG4iXX0=

package/lib/handler/handler.js

@@ -25124,9 +25124,10 @@ var AbstractEngine = class {
     };
   }
   /**
-   * Parse password field from secret. Returns void on error.
+   * Parse password field from secret. Returns void on error or if no password field exists.
    */
   async getPassword(arn) {
+    if (!arn) return;
     const secrets_client2 = new import_client_secrets_manager.SecretsManagerClient({});
     const command = new import_client_secrets_manager.GetSecretValueCommand({
       SecretId: arn
@@ -25186,88 +25187,75 @@ var PostgresqlEngine = class extends AbstractEngine {
     ];
   }
   async createRole(resourceId, props) {
-    if (!props.PasswordArn) throw "No PasswordArn provided";
-    const password = await this.getPassword(props.PasswordArn);
-    if (password) {
-      const sql = [
-        "start transaction",
-        (0, import_node_pg_format.format)("create role %I with login password %L", resourceId, password)
-      ];
-      if (props.DatabaseName) {
-        sql.push(
-          (0, import_node_pg_format.format)(
-            `DO $$
+    const sql = ["start transaction"];
+    if (props.EnableIamAuth) {
+      sql.push((0, import_node_pg_format.format)("create role %I with login", resourceId));
+      sql.push((0, import_node_pg_format.format)("grant rds_iam to %I", resourceId));
+    } else {
+      if (!props.PasswordArn) throw "No PasswordArn provided";
+      const password = await this.getPassword(props.PasswordArn);
+      if (!password) {
+        throw `Cannot parse password from ${props.PasswordArn}`;
+      }
+      sql.push((0, import_node_pg_format.format)("create role %I with login password %L", resourceId, password));
+    }
+    if (props.DatabaseName) {
+      sql.push(
+        (0, import_node_pg_format.format)(
+          `DO $$
 BEGIN
   IF EXISTS (select from pg_database where datname = '%s' and datistemplate = false) THEN
     grant connect on database %I to %I;
   END IF;
 END$$;`,
-            props.DatabaseName,
-            props.DatabaseName,
-            resourceId
-          )
-        );
-      }
-      sql.push("commit");
-      return sql;
-    } else {
-      throw `Cannot parse password from ${props.PasswordArn}`;
+          props.DatabaseName,
+          props.DatabaseName,
+          resourceId
+        )
+      );
     }
+    sql.push("commit");
+    return sql;
   }
   async updateRole(resourceId, oldResourceId, props, oldProps) {
-    if (props?.PasswordArn) {
-      const password = await this.getPassword(props.PasswordArn);
-      if (password) {
-        const sql = ["start transaction"];
-        if (oldResourceId !== resourceId) {
-          sql.push((0, import_node_pg_format.format)("alter role %I rename to %I", oldResourceId, resourceId));
+    const sql = ["start transaction"];
+    if (oldResourceId !== resourceId) {
+      sql.push((0, import_node_pg_format.format)("alter role %I rename to %I", oldResourceId, resourceId));
+    }
+    if (props?.EnableIamAuth && !oldProps?.EnableIamAuth) {
+      sql.push((0, import_node_pg_format.format)("grant rds_iam to %I", resourceId));
+    } else if (!props?.EnableIamAuth && oldProps?.EnableIamAuth) {
+      sql.push((0, import_node_pg_format.format)("revoke rds_iam from %I", resourceId));
+      if (props?.PasswordArn) {
+        const password = await this.getPassword(props.PasswordArn);
+        if (!password) {
+          throw `Cannot parse password from ${props.PasswordArn}`;
         }
         sql.push((0, import_node_pg_format.format)("alter role %I with password %L", resourceId, password));
-        if (oldProps?.DatabaseName && props.DatabaseName && oldProps.DatabaseName !== props.DatabaseName) {
-          sql.push(
-            (0, import_node_pg_format.format)(
-              `DO $$
-  BEGIN
-    IF EXISTS (select from pg_database where datname = '%s' and datistemplate = false) THEN
-      revoke connect on database %I from %I;
-    END IF;
-  END$$;`,
-              oldProps.DatabaseName,
-              oldProps.DatabaseName,
-              resourceId
-            )
-          );
-        }
-        if (props.DatabaseName) {
-          sql.push(
-            (0, import_node_pg_format.format)("grant connect on database %I to %I", props.DatabaseName, resourceId)
-          );
-        }
-        sql.push("commit");
-        return sql;
-      } else {
-        throw `Cannot parse password from ${props.PasswordArn}`;
       }
-    } else {
-      const sql = ["start transaction"];
-      if (oldResourceId !== resourceId) {
-        sql.push((0, import_node_pg_format.format)("alter role %I rename to %I", oldResourceId, resourceId));
+    } else if (!props?.EnableIamAuth && props?.PasswordArn) {
+      const password = await this.getPassword(props.PasswordArn);
+      if (!password) {
+        throw `Cannot parse password from ${props.PasswordArn}`;
       }
-      if (oldProps?.DatabaseName && props.DatabaseName && oldProps.DatabaseName !== props.DatabaseName) {
-        sql.push(
-          (0, import_node_pg_format.format)(
-            `DO $$
+      sql.push((0, import_node_pg_format.format)("alter role %I with password %L", resourceId, password));
+    }
+    if (oldProps?.DatabaseName && props?.DatabaseName && oldProps.DatabaseName !== props.DatabaseName) {
+      sql.push(
+        (0, import_node_pg_format.format)(
+          `DO $$
 BEGIN
   IF EXISTS (select from pg_database where datname = '%s' and datistemplate = false) THEN
-  revoke connect on database %I from %I;
+    revoke connect on database %I from %I;
   END IF;
 END$$;`,
-            oldProps.DatabaseName,
-            oldProps.DatabaseName,
-            resourceId
-          )
-        );
-      }
+          oldProps.DatabaseName,
+          oldProps.DatabaseName,
+          resourceId
+        )
+      );
+    }
+    if (props?.DatabaseName) {
       sql.push(
         (0, import_node_pg_format.format)(
           `DO $$
@@ -25281,9 +25269,9 @@ END$$;`,
           resourceId
         )
       );
-      sql.push("commit");
-      return sql;
     }
+    sql.push("commit");
+    return sql;
   }
   deleteRole(resourceId, props) {
     return [
@@ -25414,24 +25402,35 @@ var MysqlEngine = class extends AbstractEngine {
     return [`DROP DATABASE IF EXISTS \`${resourceId}\``];
   }
   async createRole(resourceId, props) {
-    if (!props.PasswordArn) throw new Error("No PasswordArn provided");
-    const password = await this.getPassword(props.PasswordArn);
-    if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
-    const sql = [
-      `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY '${password}'`
-    ];
+    const sql = [];
+    if (props.EnableIamAuth) {
+      sql.push(
+        `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
+      );
+    } else {
+      if (!props.PasswordArn) throw new Error("No PasswordArn provided");
+      const password = await this.getPassword(props.PasswordArn);
+      if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
+      sql.push(
+        `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY '${password}'`
+      );
+    }
     if (props.DatabaseName) {
       sql.push(
         `GRANT ALL PRIVILEGES ON \`${props.DatabaseName}\`.* TO '${resourceId}'@'%'`
       );
-      sql.push(`FLUSH PRIVILEGES`);
     }
+    sql.push(`FLUSH PRIVILEGES`);
     return sql;
   }
   async updateRole(resourceId, oldResourceId, props, oldProps) {
     const sql = [];
     if (oldResourceId !== resourceId) {
-      if (props?.PasswordArn) {
+      if (props?.EnableIamAuth) {
+        sql.push(
+          `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
+        );
+      } else if (props?.PasswordArn) {
         const password = await this.getPassword(props.PasswordArn);
         if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
         sql.push(
@@ -25442,10 +25441,24 @@ var MysqlEngine = class extends AbstractEngine {
         sql.push(`ALTER USER '${resourceId}'@'%' PASSWORD EXPIRE`);
       }
       sql.push(`DROP USER IF EXISTS '${oldResourceId}'@'%'`);
-    } else if (props?.PasswordArn) {
-      const password = await this.getPassword(props.PasswordArn);
-      if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
-      sql.push(`ALTER USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`);
+    } else {
+      if (props?.EnableIamAuth && !oldProps?.EnableIamAuth) {
+        sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`);
+        sql.push(
+          `CREATE USER '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
+        );
+      } else if (!props?.EnableIamAuth && oldProps?.EnableIamAuth) {
+        sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`);
+        if (props?.PasswordArn) {
+          const password = await this.getPassword(props.PasswordArn);
+          if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
+          sql.push(`CREATE USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`);
+        }
+      } else if (!props?.EnableIamAuth && props?.PasswordArn) {
+        const password = await this.getPassword(props.PasswordArn);
+        if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
+        sql.push(`ALTER USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`);
+      }
     }
     if (oldProps?.DatabaseName && props?.DatabaseName && oldProps.DatabaseName !== props.DatabaseName) {
       sql.push(

package/lib/provider.js

@@ -131,7 +131,7 @@ class Provider extends constructs_1.Construct {
 }
 exports.Provider = Provider;
 _a = JSII_RTTI_SYMBOL_1;
-Provider[_a] = { fqn: "cdk-rds-sql.Provider", version: "6.0.2" };
+Provider[_a] = { fqn: "cdk-rds-sql.Provider", version: "6.1.0" };
 function slugify(x) {
     return x.replace(/[^a-zA-Z0-9]/g, "");
 }

package/lib/role.custom-resource.d.ts

@@ -33,6 +33,12 @@ export interface RoleProps {
      * @default no connection to any database is granted
      */
     readonly databaseName?: string;
+    /**
+     * Enable IAM authentication for this role.
+     *
+     * @default false - use password authentication
+     */
+    readonly enableIamAuth?: boolean;
 }
 export declare class Role extends CustomResource {
     constructor(scope: Construct, id: string, props: RoleProps);

package/lib/role.custom-resource.js

@@ -15,6 +15,7 @@ class Role extends aws_cdk_lib_1.CustomResource {
                 SecretArn: props.provider.secret.secretArn,
                 PasswordArn: props.passwordArn,
                 DatabaseName: props.database ? props.database.databaseName : props.databaseName,
+                EnableIamAuth: props.enableIamAuth || false,
             },
         });
         this.node.addDependency(props.provider);
@@ -23,4 +24,4 @@ class Role extends aws_cdk_lib_1.CustomResource {
     }
 }
 exports.Role = Role;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5jdXN0b20tcmVzb3VyY2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcm9sZS5jdXN0b20tcmVzb3VyY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsNkNBQTRDO0FBRzVDLGlDQUF1QztBQXdDdkMsTUFBYSxJQUFLLFNBQVEsNEJBQWM7SUFDdEMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFnQjtRQUN4RCxJQUFJLEtBQUssQ0FBQyxRQUFRLElBQUksS0FBSyxDQUFDLFlBQVk7WUFDdEMsTUFBTSx5Q0FBeUMsQ0FBQTtRQUNqRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLFlBQVksRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7WUFDekMsVUFBVSxFQUFFO2dCQUNWLFFBQVEsRUFBRSxxQkFBYyxDQUFDLElBQUk7Z0JBQzdCLFVBQVUsRUFBRSxLQUFLLENBQUMsUUFBUTtnQkFDMUIsU0FBUyxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFNBQVM7Z0JBQzFDLFdBQVcsRUFBRSxLQUFLLENBQUMsV0FBVztnQkFDOUIsWUFBWSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWTthQUNoRjtTQUNGLENBQUMsQ0FBQTtRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN2QyxJQUFJLEtBQUssQ0FBQyxRQUFRO1lBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQzdELENBQUM7Q0FDRjtBQWpCRCxvQkFpQkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSB9IGZyb20gXCJhd3MtY2RrLWxpYlwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBJRGF0YWJhc2UgfSBmcm9tIFwiLi9kYXRhYmFzZVwiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgUHJvdmlkZXIgfSBmcm9tIFwiLi9wcm92aWRlclwiXG5cbmV4cG9ydCBpbnRlcmZhY2UgUm9sZVByb3BzIHtcbiAgLyoqXG4gICAqIFByb3ZpZGVyLlxuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXI6IFByb3ZpZGVyXG5cbiAgLyoqXG4gICAqIFNRTC5cbiAgICovXG4gIHJlYWRvbmx5IHJvbGVOYW1lOiBzdHJpbmdcblxuICAvKipcbiAgICogQSBuZXcgc2VjcmV0IGlzIGNyZWF0ZWQgZm9yIHRoaXMgdXNlci5cbiAgICpcbiAgICogT3B0aW9uYWxseSBlbmNyeXB0IGl0IHdpdGggdGhlIGdpdmVuIGtleS5cbiAgICovXG4gIHJlYWRvbmx5IHBhc3N3b3JkQXJuOiBzdHJpbmdcblxuICAvKipcbiAgICogT3B0aW9uYWwgZGF0YWJhc2UgdGhpcyB1c2VyIGlzIGV4cGVjdGVkIHRvIHVzZS5cbiAgICpcbiAgICogU3BlY2lmeSBub25lIG9mIGBkYXRhYmFzZWAgb3IgYGRhdGFiYXNlTmFtZWAgb3Igb25seSBvbmUgb2YgdGhlbS5cbiAgICpcbiAgICogQGRlZmF1bHQgbm8gY29ubmVjdGlvbiB0byBhbnkgZGF0YWJhc2UgaXMgZ3JhbnRlZFxuICAgKi9cbiAgcmVhZG9ubHkgZGF0YWJhc2U/OiBJRGF0YWJhc2VcblxuICAvKipcbiAgICogT3B0aW9uYWwgZGF0YWJhc2UgbmFtZSB0aGlzIHVzZXIgaXMgZXhwZWN0ZWQgdG8gdXNlLlxuICAgKlxuICAgKiBTcGVjaWZ5IG5vbmUgb2YgYGRhdGFiYXNlYCBvciBgZGF0YWJhc2VOYW1lYCBvciBvbmx5IG9uZSBvZiB0aGVtLlxuICAgKlxuICAgKiBAZGVmYXVsdCBubyBjb25uZWN0aW9uIHRvIGFueSBkYXRhYmFzZSBpcyBncmFudGVkXG4gICAqL1xuICByZWFkb25seSBkYXRhYmFzZU5hbWU/OiBzdHJpbmdcbn1cblxuZXhwb3J0IGNsYXNzIFJvbGUgZXh0ZW5kcyBDdXN0b21SZXNvdXJjZSB7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBSb2xlUHJvcHMpIHtcbiAgICBpZiAocHJvcHMuZGF0YWJhc2UgJiYgcHJvcHMuZGF0YWJhc2VOYW1lKVxuICAgICAgdGhyb3cgXCJTcGVjaWZ5IGVpdGhlciBkYXRhYmFzZSBvciBkYXRhYmFzZU5hbWVcIlxuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgc2VydmljZVRva2VuOiBwcm9wcy5wcm92aWRlci5zZXJ2aWNlVG9rZW4sXG4gICAgICBwcm9wZXJ0aWVzOiB7XG4gICAgICAgIFJlc291cmNlOiBSZHNTcWxSZXNvdXJjZS5ST0xFLFxuICAgICAgICBSZXNvdXJjZUlkOiBwcm9wcy5yb2xlTmFtZSxcbiAgICAgICAgU2VjcmV0QXJuOiBwcm9wcy5wcm92aWRlci5zZWNyZXQuc2VjcmV0QXJuLFxuICAgICAgICBQYXNzd29yZEFybjogcHJvcHMucGFzc3dvcmRBcm4sXG4gICAgICAgIERhdGFiYXNlTmFtZTogcHJvcHMuZGF0YWJhc2UgPyBwcm9wcy5kYXRhYmFzZS5kYXRhYmFzZU5hbWUgOiBwcm9wcy5kYXRhYmFzZU5hbWUsXG4gICAgICB9LFxuICAgIH0pXG4gICAgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMucHJvdmlkZXIpXG4gICAgaWYgKHByb3BzLmRhdGFiYXNlKSB0aGlzLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5kYXRhYmFzZSlcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5jdXN0b20tcmVzb3VyY2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvcm9sZS5jdXN0b20tcmVzb3VyY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsNkNBQTRDO0FBRzVDLGlDQUF1QztBQStDdkMsTUFBYSxJQUFLLFNBQVEsNEJBQWM7SUFDdEMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFnQjtRQUN4RCxJQUFJLEtBQUssQ0FBQyxRQUFRLElBQUksS0FBSyxDQUFDLFlBQVk7WUFDdEMsTUFBTSx5Q0FBeUMsQ0FBQTtRQUNqRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLFlBQVksRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7WUFDekMsVUFBVSxFQUFFO2dCQUNWLFFBQVEsRUFBRSxxQkFBYyxDQUFDLElBQUk7Z0JBQzdCLFVBQVUsRUFBRSxLQUFLLENBQUMsUUFBUTtnQkFDMUIsU0FBUyxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFNBQVM7Z0JBQzFDLFdBQVcsRUFBRSxLQUFLLENBQUMsV0FBVztnQkFDOUIsWUFBWSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWTtnQkFDL0UsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhLElBQUksS0FBSzthQUM1QztTQUNGLENBQUMsQ0FBQTtRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN2QyxJQUFJLEtBQUssQ0FBQyxRQUFRO1lBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQzdELENBQUM7Q0FDRjtBQWxCRCxvQkFrQkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSB9IGZyb20gXCJhd3MtY2RrLWxpYlwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBJRGF0YWJhc2UgfSBmcm9tIFwiLi9kYXRhYmFzZVwiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgUHJvdmlkZXIgfSBmcm9tIFwiLi9wcm92aWRlclwiXG5cbmV4cG9ydCBpbnRlcmZhY2UgUm9sZVByb3BzIHtcbiAgLyoqXG4gICAqIFByb3ZpZGVyLlxuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXI6IFByb3ZpZGVyXG5cbiAgLyoqXG4gICAqIFNRTC5cbiAgICovXG4gIHJlYWRvbmx5IHJvbGVOYW1lOiBzdHJpbmdcblxuICAvKipcbiAgICogQSBuZXcgc2VjcmV0IGlzIGNyZWF0ZWQgZm9yIHRoaXMgdXNlci5cbiAgICpcbiAgICogT3B0aW9uYWxseSBlbmNyeXB0IGl0IHdpdGggdGhlIGdpdmVuIGtleS5cbiAgICovXG4gIHJlYWRvbmx5IHBhc3N3b3JkQXJuOiBzdHJpbmdcblxuICAvKipcbiAgICogT3B0aW9uYWwgZGF0YWJhc2UgdGhpcyB1c2VyIGlzIGV4cGVjdGVkIHRvIHVzZS5cbiAgICpcbiAgICogU3BlY2lmeSBub25lIG9mIGBkYXRhYmFzZWAgb3IgYGRhdGFiYXNlTmFtZWAgb3Igb25seSBvbmUgb2YgdGhlbS5cbiAgICpcbiAgICogQGRlZmF1bHQgbm8gY29ubmVjdGlvbiB0byBhbnkgZGF0YWJhc2UgaXMgZ3JhbnRlZFxuICAgKi9cbiAgcmVhZG9ubHkgZGF0YWJhc2U/OiBJRGF0YWJhc2VcblxuICAvKipcbiAgICogT3B0aW9uYWwgZGF0YWJhc2UgbmFtZSB0aGlzIHVzZXIgaXMgZXhwZWN0ZWQgdG8gdXNlLlxuICAgKlxuICAgKiBTcGVjaWZ5IG5vbmUgb2YgYGRhdGFiYXNlYCBvciBgZGF0YWJhc2VOYW1lYCBvciBvbmx5IG9uZSBvZiB0aGVtLlxuICAgKlxuICAgKiBAZGVmYXVsdCBubyBjb25uZWN0aW9uIHRvIGFueSBkYXRhYmFzZSBpcyBncmFudGVkXG4gICAqL1xuICByZWFkb25seSBkYXRhYmFzZU5hbWU/OiBzdHJpbmdcblxuICAvKipcbiAgICogRW5hYmxlIElBTSBhdXRoZW50aWNhdGlvbiBmb3IgdGhpcyByb2xlLlxuICAgKlxuICAgKiBAZGVmYXVsdCBmYWxzZSAtIHVzZSBwYXNzd29yZCBhdXRoZW50aWNhdGlvblxuICAgKi9cbiAgcmVhZG9ubHkgZW5hYmxlSWFtQXV0aD86IGJvb2xlYW5cbn1cblxuZXhwb3J0IGNsYXNzIFJvbGUgZXh0ZW5kcyBDdXN0b21SZXNvdXJjZSB7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBSb2xlUHJvcHMpIHtcbiAgICBpZiAocHJvcHMuZGF0YWJhc2UgJiYgcHJvcHMuZGF0YWJhc2VOYW1lKVxuICAgICAgdGhyb3cgXCJTcGVjaWZ5IGVpdGhlciBkYXRhYmFzZSBvciBkYXRhYmFzZU5hbWVcIlxuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgc2VydmljZVRva2VuOiBwcm9wcy5wcm92aWRlci5zZXJ2aWNlVG9rZW4sXG4gICAgICBwcm9wZXJ0aWVzOiB7XG4gICAgICAgIFJlc291cmNlOiBSZHNTcWxSZXNvdXJjZS5ST0xFLFxuICAgICAgICBSZXNvdXJjZUlkOiBwcm9wcy5yb2xlTmFtZSxcbiAgICAgICAgU2VjcmV0QXJuOiBwcm9wcy5wcm92aWRlci5zZWNyZXQuc2VjcmV0QXJuLFxuICAgICAgICBQYXNzd29yZEFybjogcHJvcHMucGFzc3dvcmRBcm4sXG4gICAgICAgIERhdGFiYXNlTmFtZTogcHJvcHMuZGF0YWJhc2UgPyBwcm9wcy5kYXRhYmFzZS5kYXRhYmFzZU5hbWUgOiBwcm9wcy5kYXRhYmFzZU5hbWUsXG4gICAgICAgIEVuYWJsZUlhbUF1dGg6IHByb3BzLmVuYWJsZUlhbUF1dGggfHwgZmFsc2UsXG4gICAgICB9LFxuICAgIH0pXG4gICAgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMucHJvdmlkZXIpXG4gICAgaWYgKHByb3BzLmRhdGFiYXNlKSB0aGlzLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5kYXRhYmFzZSlcbiAgfVxufVxuIl19

package/lib/role.d.ts

@@ -58,6 +58,16 @@ export interface RoleProps {
      * @default - credentials are only stored in Secrets Manager
      */
     readonly parameterPrefix?: string;
+    /**
+     * Enable IAM authentication for this role.
+     *
+     * When enabled, the role will be created without a password and
+     * configured for AWS IAM database authentication. The secret
+     * will not contain a password field.
+     *
+     * @default false - use password authentication
+     */
+    readonly enableIamAuth?: boolean;
 }
 export declare class Role extends Construct {
     /**

package/lib/role.js

@@ -63,23 +63,32 @@ class Role extends constructs_1.Construct {
         const identifier = props.provider.cluster.clusterIdentifier
             ? props.provider.cluster.clusterIdentifier
             : props.provider.cluster.instanceIdentifier;
+        const secretTemplate = {
+            dbClusterIdentifier: identifier,
+            engine: props.provider.engine,
+            host: host,
+            port: port,
+            username: props.roleName,
+            dbname: props.database ? props.database.databaseName : props.databaseName,
+        };
         this.secret = new aws_secretsmanager_1.Secret(this, "Secret", {
             secretName: props.secretName,
             encryptionKey: props.encryptionKey,
-            description: `Generated secret for postgres role ${props.roleName}`,
-            generateSecretString: {
-                passwordLength: 30, // Oracle password cannot have more than 30 characters
-                secretStringTemplate: JSON.stringify({
-                    dbClusterIdentifier: identifier,
-                    engine: props.provider.engine,
-                    host: host,
-                    port: port,
-                    username: props.roleName,
-                    dbname: props.database ? props.database.databaseName : props.databaseName,
+            description: `Generated secret for ${props.provider.engine} role ${props.roleName}`,
+            ...(props.enableIamAuth
+                ? {
+                    // For IAM auth, create secret without password generation
+                    secretStringTemplate: JSON.stringify(secretTemplate),
+                }
+                : {
+                    // For password auth, generate password
+                    generateSecretString: {
+                        passwordLength: 30, // Oracle password cannot have more than 30 characters
+                        secretStringTemplate: JSON.stringify(secretTemplate),
+                        generateStringKey: "password",
+                        excludeCharacters: " %+~`#$&*()|[]{}:;<>?!'/@\"\\",
+                    },
                 }),
-                generateStringKey: "password",
-                excludeCharacters: " %+~`#$&*()|[]{}:;<>?!'/@\"\\",
-            },
             removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY,
         });
         // Create Parameters if parameterPrefix is provided
@@ -95,7 +104,7 @@ class Role extends constructs_1.Construct {
             new Parameters(this, "Parameters", {
                 secretArn: props.provider.secret.secretArn,
                 parameterPrefix: props.parameterPrefix,
-                passwordArn: this.secret.secretArn,
+                passwordArn: props.enableIamAuth ? "" : this.secret.secretArn,
                 providerServiceToken: props.provider.serviceToken,
                 provider: props.provider,
                 paramData,
@@ -104,9 +113,10 @@ class Role extends constructs_1.Construct {
         const role = new role_custom_resource_1.Role(this, "PostgresRole", {
             provider: props.provider,
             roleName: props.roleName,
-            passwordArn: this.secret.secretArn,
+            passwordArn: props.enableIamAuth ? "" : this.secret.secretArn,
             database: props.database,
             databaseName: props.databaseName,
+            enableIamAuth: props.enableIamAuth,
         });
         role.node.addDependency(this.secret);
         this.roleName = props.roleName;
@@ -119,5 +129,5 @@ class Role extends constructs_1.Construct {
 }
 exports.Role = Role;
 _a = JSII_RTTI_SYMBOL_1;
-Role[_a] = { fqn: "cdk-rds-sql.Role", version: "6.0.2" };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsNkNBQWtFO0FBQ2xFLDJDQUEwQztBQUcxQyx1RUFBZ0U7QUFDaEUsMkNBQTBDO0FBQzFDLDJDQUFzQztBQUV0QyxpQ0FBdUM7QUFFdkMsaUVBQW1FO0FBaUVuRSw4Q0FBOEM7QUFDOUMsTUFBTSxVQUFXLFNBQVEsc0JBQVM7SUFDaEMsWUFDRSxLQUFnQixFQUNoQixFQUFVLEVBQ1YsS0FPQztRQUVELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUE7UUFFaEIsNENBQTRDO1FBQzVDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7WUFDdkQsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3hCLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQyxJQUFJLEVBQUUsYUFBYSxHQUFHLEVBQUUsRUFBRTtvQkFDaEQsYUFBYSxFQUFFLEdBQUcsS0FBSyxDQUFDLGVBQWUsR0FBRyxHQUFHLEVBQUU7b0JBQy9DLFdBQVcsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFO2lCQUM5QixDQUFDLENBQUE7WUFDSixDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUE7UUFFRiw2REFBNkQ7UUFDN0QsTUFBTSxxQkFBcUIsR0FBRyxHQUFHLEtBQUssQ0FBQyxlQUFlLFVBQVUsQ0FBQTtRQUNoRSxNQUFNLGtCQUFrQixHQUFHLElBQUksNEJBQWMsQ0FBQyxJQUFJLEVBQUUsbUJBQW1CLEVBQUU7WUFDdkUsWUFBWSxFQUFFLEtBQUssQ0FBQyxvQkFBb0I7WUFDeEMsVUFBVSxFQUFFO2dCQUNWLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUztnQkFDMUIsUUFBUSxFQUFFLHFCQUFjLENBQUMsa0JBQWtCO2dCQUMzQyxXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7Z0JBQzlCLGFBQWEsRUFBRSxxQkFBcUI7YUFDckM7U0FDRixDQUFDLENBQUE7UUFDRixrQkFBa0IsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUVyRCxNQUFNLFFBQVEsR0FBRyxlQUFlLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sSUFDbkQsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsT0FDakIsYUFDRSxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FDL0MsR0FBRyxxQkFBcUIsRUFBRSxDQUFBO1FBRTFCLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FDcEMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO1lBQ3RCLE9BQU8sRUFBRSxDQUFDLGtCQUFrQixFQUFFLHVCQUF1QixFQUFFLG1CQUFtQixDQUFDO1lBQzNFLFNBQVMsRUFBRSxDQUFDLFFBQVEsQ0FBQztTQUN0QixDQUFDLENBQ0gsQ0FBQTtJQUNILENBQUM7Q0FDRjtBQUVELE1BQWEsSUFBSyxTQUFRLHNCQUFTO0lBV2pDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBZ0I7UUFDeEQsSUFBSSxLQUFLLENBQUMsUUFBUSxJQUFJLEtBQUssQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN6QyxNQUFNLHlDQUF5QyxDQUFBO1FBQ2pELENBQUM7UUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUMzQyxvR0FBb0c7WUFDcEcseUVBQXlFO1lBQ3pFLHNEQUFzRDtZQUN0RCxNQUFNLHlDQUF5QyxDQUFBO1FBQ2pELENBQUM7UUFDRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBRWhCLE1BQU0sSUFBSSxHQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNEIsQ0FBQyxlQUFlO1lBQ3ZFLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsZUFBZSxDQUFDLFFBQVE7WUFDdkUsQ0FBQyxDQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUE7UUFFM0UsTUFBTSxJQUFJLEdBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUE0QixDQUFDLGVBQWU7WUFDdkUsQ0FBQyxDQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNEIsQ0FBQyxlQUFlLENBQUMsSUFBSTtZQUNuRSxDQUFDLENBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUE2QixDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQTtRQUV2RSxNQUFNLFVBQVUsR0FBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsaUJBQWlCO1lBQy9FLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsaUJBQWlCO1lBQ2hFLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTZCLENBQUMsa0JBQWtCLENBQUE7UUFFcEUsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLDJCQUFNLENBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRTtZQUN2QyxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7WUFDNUIsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhO1lBQ2xDLFdBQVcsRUFBRSxzQ0FBc0MsS0FBSyxDQUFDLFFBQVEsRUFBRTtZQUNuRSxvQkFBb0IsRUFBRTtnQkFDcEIsY0FBYyxFQUFFLEVBQUUsRUFBRSxzREFBc0Q7Z0JBQzFFLG9CQUFvQixFQUFFLElBQUksQ0FBQyxTQUFTLENBQUM7b0JBQ25DLG1CQUFtQixFQUFFLFVBQVU7b0JBQy9CLE1BQU0sRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU07b0JBQzdCLElBQUksRUFBRSxJQUFJO29CQUNWLElBQUksRUFBRSxJQUFJO29CQUNWLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtvQkFDeEIsTUFBTSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWTtpQkFDMUUsQ0FBQztnQkFDRixpQkFBaUIsRUFBRSxVQUFVO2dCQUM3QixpQkFBaUIsRUFBRSwrQkFBK0I7YUFDbkQ7WUFDRCxhQUFhLEVBQUUsMkJBQWEsQ0FBQyxPQUFPO1NBQ3JDLENBQUMsQ0FBQTtRQUVGLG1EQUFtRDtRQUNuRCxJQUFJLEtBQUssQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUMxQixNQUFNLFNBQVMsR0FBRztnQkFDaEIsbUJBQW1CLEVBQUUsVUFBVTtnQkFDL0IsTUFBTSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTTtnQkFDN0IsSUFBSSxFQUFFLElBQUk7Z0JBQ1YsSUFBSSxFQUFFLElBQUk7Z0JBQ1YsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO2dCQUN4QixNQUFNLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxZQUFZO2FBQzFFLENBQUE7WUFFRCxJQUFJLFVBQVUsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFO2dCQUNqQyxTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUztnQkFDMUMsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO2dCQUN0QyxXQUFXLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTO2dCQUNsQyxvQkFBb0IsRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7Z0JBQ2pELFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtnQkFDeEIsU0FBUzthQUNWLENBQUMsQ0FBQTtRQUNKLENBQUM7UUFFRCxNQUFNLElBQUksR0FBRyxJQUFJLDJCQUFrQixDQUFDLElBQUksRUFBRSxjQUFjLEVBQUU7WUFDeEQsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixXQUFXLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTO1lBQ2xDLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixZQUFZLEVBQUUsS0FBSyxDQUFDLFlBQVk7U0FDakMsQ0FBQyxDQUFBO1FBQ0YsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFBO1FBQ3BDLElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDLFFBQVEsQ0FBQTtRQUM5QixJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFBO1FBQzdDLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUM5QixnREFBZ0Q7WUFDaEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUE7UUFDaEUsQ0FBQztJQUNILENBQUM7O0FBMUZILG9CQTJGQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEN1c3RvbVJlc291cmNlLCBSZW1vdmFsUG9saWN5LCBTdGFjayB9IGZyb20gXCJhd3MtY2RrLWxpYlwiXG5pbXBvcnQgKiBhcyBpYW0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1pYW1cIlxuaW1wb3J0ICogYXMga21zIGZyb20gXCJhd3MtY2RrLWxpYi9hd3Mta21zXCJcbmltcG9ydCB7IElEYXRhYmFzZUNsdXN0ZXIsIElEYXRhYmFzZUluc3RhbmNlIH0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1yZHNcIlxuaW1wb3J0IHsgSVNlY3JldCwgU2VjcmV0IH0gZnJvbSBcImF3cy1jZGstbGliL2F3cy1zZWNyZXRzbWFuYWdlclwiXG5pbXBvcnQgKiBhcyBzc20gZnJvbSBcImF3cy1jZGstbGliL2F3cy1zc21cIlxuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIlxuaW1wb3J0IHsgSURhdGFiYXNlIH0gZnJvbSBcIi4vZGF0YWJhc2VcIlxuaW1wb3J0IHsgUmRzU3FsUmVzb3VyY2UgfSBmcm9tIFwiLi9lbnVtXCJcbmltcG9ydCB7IFByb3ZpZGVyIH0gZnJvbSBcIi4vcHJvdmlkZXJcIlxuaW1wb3J0IHsgUm9sZSBhcyBDdXN0b21SZXNvdXJjZVJvbGUgfSBmcm9tIFwiLi9yb2xlLmN1c3RvbS1yZXNvdXJjZVwiXG5cbmV4cG9ydCBpbnRlcmZhY2UgUm9sZVByb3BzIHtcbiAgLyoqXG4gICAqIFByb3ZpZGVyLlxuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXI6IFByb3ZpZGVyXG5cbiAgLyoqXG4gICAqIFNRTC5cbiAgICovXG4gIHJlYWRvbmx5IHJvbGVOYW1lOiBzdHJpbmdcblxuICAvKipcbiAgICogT3B0aW9uYWwgZGF0YWJhc2UgdGhpcyB1c2VyIGlzIGV4cGVjdGVkIHRvIHVzZS5cbiAgICpcbiAgICogSWYgdGhlIGRhdGFiYXNlIGV4aXN0cywgY29ubmVjdCBwcml2aWxlZ2VzIGFyZSBncmFudGVkLlxuICAgKlxuICAgKiBTcGVjaWZ5IG9uZSBvZiBgZGF0YWJhc2VgIG9yIGBkYXRhYmFzZU5hbWVgLiBUaGlzIGlzIHRoZSBuYW1lXG4gICAqIHRoYXQgd2lsbCBiZSBzdG9yZWQgaW4gdGhlIHJvbGUncyBzZWNyZXQgYXMgdGhlIGRhdGFiYXNlIG5hbWUgdG9cbiAgICogdXNlLlxuICAgKi9cbiAgcmVhZG9ubHkgZGF0YWJhc2U/OiBJRGF0YWJhc2VcblxuICAvKipcbiAgICogT3B0aW9uYWwgZGF0YWJhc2UgbmFtZSB0aGlzIHVzZXIgaXMgZXhwZWN0ZWQgdG8gdXNlLlxuICAgKlxuICAgKiBJZiB0aGUgZGF0YWJhc2UgZXhpc3RzLCBjb25uZWN0IHByaXZpbGVnZXMgYXJlIGdyYW50ZWQuXG4gICAqXG4gICAqIFNwZWNpZnkgb25lIG9mIGBkYXRhYmFzZWAgb3IgYGRhdGFiYXNlTmFtZWAuIFRoaXMgaXMgdGhlIG5hbWVcbiAgICogdGhhdCB3aWxsIGJlIHN0b3JlZCBpbiB0aGUgcm9sZSdzIHNlY3JldCBhcyB0aGUgZGF0YWJhc2UgbmFtZSB0b1xuICAgKiB1c2UuXG4gICAqL1xuICByZWFkb25seSBkYXRhYmFzZU5hbWU/OiBzdHJpbmdcblxuICAvKipcbiAgICogQSBuZXcgc2VjcmV0IGlzIGNyZWF0ZWQgZm9yIHRoaXMgdXNlci5cbiAgICpcbiAgICogT3B0aW9uYWxseSBlbmNyeXB0IGl0IHdpdGggdGhlIGdpdmVuIGtleS5cbiAgICovXG4gIHJlYWRvbmx5IGVuY3J5cHRpb25LZXk/OiBrbXMuSUtleVxuXG4gIC8qKlxuICAgKiBBIG5ldyBzZWNyZXQgaXMgY3JlYXRlZCBmb3IgdGhpcyB1c2VyLlxuICAgKlxuICAgKiBPcHRpb25hbGx5IGFkZCBzZWNyZXQgbmFtZSB0byB0aGUgc2VjcmV0LlxuICAgKi9cbiAgcmVhZG9ubHkgc2VjcmV0TmFtZT86IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBQcmVmaXggZm9yIFNTTSBwYXJhbWV0ZXJzIHRvIHN0b3JlIGNyZWRlbnRpYWxzIGluIFBhcmFtZXRlciBTdG9yZS5cbiAgICogV2hlbiBkZWZpbmVkLCBjcmVkZW50aWFscyB3aWxsIGFsc28gYmUgc3RvcmVkIGFzIHBhcmFtZXRlcnMuXG4gICAqXG4gICAqIFRoZSBwYXJhbWV0ZXIgbmFtZXMgc3VjaCBhcyBcInBhc3N3b3JkXCIgaXMgc2ltcGx5IGFwcGVuZGVkIHRvXG4gICAqIGBwYXJhbWV0ZXJQcmVmaXhgLCBzbyBtYWtlIHN1cmUgdGhlIHByZWZpeCBlbmRzIHdpdGggYSBzbGFzaCBpZlxuICAgKiAgeW91IGhhdmUgeW91ciBwYXJhbWV0ZXIgbmFtZXMgc2xhc2ggc2VwYXJhdGVkLlxuICAgKlxuICAgKiBOb3RlIHRoYXQgdGhlIHBhc3N3b3JkIGZyb20gdGhlIHNlY3JldCBpcyBjb3BpZWQganVzdCBvbmNlLCB0aGV5XG4gICAqIGFyZSBub3Qga2VwdCBpbiBzeW5jLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIGNyZWRlbnRpYWxzIGFyZSBvbmx5IHN0b3JlZCBpbiBTZWNyZXRzIE1hbmFnZXJcbiAgICovXG4gIHJlYWRvbmx5IHBhcmFtZXRlclByZWZpeD86IHN0cmluZ1xufVxuXG4vLyBQcml2YXRlIFBhcmFtZXRlcnMgY29uc3RydWN0IChub3QgZXhwb3J0ZWQpXG5jbGFzcyBQYXJhbWV0ZXJzIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgY29uc3RydWN0b3IoXG4gICAgc2NvcGU6IENvbnN0cnVjdCxcbiAgICBpZDogc3RyaW5nLFxuICAgIHByb3BzOiB7XG4gICAgICBwcm92aWRlcjogUHJvdmlkZXJcbiAgICAgIHNlY3JldEFybjogc3RyaW5nXG4gICAgICBwYXJhbWV0ZXJQcmVmaXg6IHN0cmluZ1xuICAgICAgcGFzc3dvcmRBcm46IHN0cmluZ1xuICAgICAgcHJvdmlkZXJTZXJ2aWNlVG9rZW46IHN0cmluZ1xuICAgICAgcGFyYW1EYXRhOiBSZWNvcmQ8c3RyaW5nLCBhbnk+XG4gICAgfVxuICApIHtcbiAgICBzdXBlcihzY29wZSwgaWQpXG5cbiAgICAvLyBDcmVhdGUgcGFyYW1ldGVycyBmb3IgZWFjaCBrZXktdmFsdWUgcGFpclxuICAgIE9iamVjdC5lbnRyaWVzKHByb3BzLnBhcmFtRGF0YSkuZm9yRWFjaCgoW2tleSwgdmFsdWVdKSA9PiB7XG4gICAgICBpZiAodmFsdWUgIT09IHVuZGVmaW5lZCkge1xuICAgICAgICBuZXcgc3NtLlN0cmluZ1BhcmFtZXRlcih0aGlzLCBgUGFyYW1ldGVyLSR7a2V5fWAsIHtcbiAgICAgICAgICBwYXJhbWV0ZXJOYW1lOiBgJHtwcm9wcy5wYXJhbWV0ZXJQcmVmaXh9JHtrZXl9YCxcbiAgICAgICAgICBzdHJpbmdWYWx1ZTogdmFsdWUudG9TdHJpbmcoKSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9KVxuXG4gICAgLy8gRm9yIHBhc3N3b3JkLCB1c2UgdGhlIGV4aXN0aW5nIHByb3ZpZGVyIHRvIHN0b3JlIGl0IGluIFNTTVxuICAgIGNvbnN0IHBhc3N3b3JkUGFyYW1ldGVyTmFtZSA9IGAke3Byb3BzLnBhcmFtZXRlclByZWZpeH1wYXNzd29yZGBcbiAgICBjb25zdCBwYXNzd29yZF9wYXJhbWV0ZXIgPSBuZXcgQ3VzdG9tUmVzb3VyY2UodGhpcywgXCJQYXNzd29yZFBhcmFtZXRlclwiLCB7XG4gICAgICBzZXJ2aWNlVG9rZW46IHByb3BzLnByb3ZpZGVyU2VydmljZVRva2VuLFxuICAgICAgcHJvcGVydGllczoge1xuICAgICAgICBTZWNyZXRBcm46IHByb3BzLnNlY3JldEFybixcbiAgICAgICAgUmVzb3VyY2U6IFJkc1NxbFJlc291cmNlLlBBUkFNRVRFUl9QQVNTV09SRCxcbiAgICAgICAgUGFzc3dvcmRBcm46IHByb3BzLnBhc3N3b3JkQXJuLFxuICAgICAgICBQYXJhbWV0ZXJOYW1lOiBwYXNzd29yZFBhcmFtZXRlck5hbWUsXG4gICAgICB9LFxuICAgIH0pXG4gICAgcGFzc3dvcmRfcGFyYW1ldGVyLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5wcm92aWRlcilcblxuICAgIGNvbnN0IHBhcmFtQXJuID0gYGFybjphd3M6c3NtOiR7U3RhY2sub2YodGhpcykucmVnaW9ufToke1xuICAgICAgU3RhY2sub2YodGhpcykuYWNjb3VudFxuICAgIH06cGFyYW1ldGVyJHtcbiAgICAgIHBhc3N3b3JkUGFyYW1ldGVyTmFtZS5zdGFydHNXaXRoKFwiL1wiKSA/IFwiXCIgOiBcIi9cIlxuICAgIH0ke3Bhc3N3b3JkUGFyYW1ldGVyTmFtZX1gXG5cbiAgICBwcm9wcy5wcm92aWRlci5oYW5kbGVyLmFkZFRvUm9sZVBvbGljeShcbiAgICAgIG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgYWN0aW9uczogW1wic3NtOlB1dFBhcmFtZXRlclwiLCBcInNzbTpBZGRUYWdzVG9SZXNvdXJjZVwiLCBcInNzbTpHZXRQYXJhbWV0ZXJzXCJdLFxuICAgICAgICByZXNvdXJjZXM6IFtwYXJhbUFybl0sXG4gICAgICB9KVxuICAgIClcbiAgfVxufVxuXG5leHBvcnQgY2xhc3MgUm9sZSBleHRlbmRzIENvbnN0cnVjdCB7XG4gIC8qKlxuICAgKiBUaGUgcm9sZSBuYW1lLlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHJvbGVOYW1lOiBzdHJpbmdcblxuICAvKipcbiAgICogVGhlIGdlbmVyYXRlZCBzZWNyZXQuXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgc2VjcmV0OiBJU2VjcmV0XG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IFJvbGVQcm9wcykge1xuICAgIGlmIChwcm9wcy5kYXRhYmFzZSAmJiBwcm9wcy5kYXRhYmFzZU5hbWUpIHtcbiAgICAgIHRocm93IFwiU3BlY2lmeSBlaXRoZXIgZGF0YWJhc2Ugb3IgZGF0YWJhc2VOYW1lXCJcbiAgICB9XG4gICAgaWYgKCFwcm9wcy5kYXRhYmFzZSAmJiAhcHJvcHMuZGF0YWJhc2VOYW1lKSB7XG4gICAgICAvLyBJZiBuZWl0aGVyIGlzIHNwZWNpZmllZCwgd2UgbWlnaHQgbmVlZCBhIGRlZmF1bHQgb3IgdGhyb3cgYW4gZXJyb3IgZGVwZW5kaW5nIG9uIGRlc2lyZWQgYmVoYXZpb3IuXG4gICAgICAvLyBGb3Igbm93LCBsZXQncyBhc3N1bWUgaXQncyBhbGxvd2VkIGJ1dCB0aGUgc2VjcmV0IHdvbid0IGhhdmUgYSBkYm5hbWUuXG4gICAgICAvLyBJZiBpdCBzaG91bGQgYmUgcmVxdWlyZWQsIHVuY29tbWVudCB0aGUgbGluZSBiZWxvdzpcbiAgICAgIHRocm93IFwiU3BlY2lmeSBlaXRoZXIgZGF0YWJhc2Ugb3IgZGF0YWJhc2VOYW1lXCJcbiAgICB9XG4gICAgc3VwZXIoc2NvcGUsIGlkKVxuXG4gICAgY29uc3QgaG9zdCA9IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUNsdXN0ZXIpLmNsdXN0ZXJFbmRwb2ludFxuICAgICAgPyAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VDbHVzdGVyKS5jbHVzdGVyRW5kcG9pbnQuaG9zdG5hbWVcbiAgICAgIDogKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlSW5zdGFuY2UpLmluc3RhbmNlRW5kcG9pbnQuaG9zdG5hbWVcblxuICAgIGNvbnN0IHBvcnQgPSAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VDbHVzdGVyKS5jbHVzdGVyRW5kcG9pbnRcbiAgICAgID8gKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlQ2x1c3RlcikuY2x1c3RlckVuZHBvaW50LnBvcnRcbiAgICAgIDogKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlSW5zdGFuY2UpLmluc3RhbmNlRW5kcG9pbnQucG9ydFxuXG4gICAgY29uc3QgaWRlbnRpZmllciA9IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUNsdXN0ZXIpLmNsdXN0ZXJJZGVudGlmaWVyXG4gICAgICA/IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUNsdXN0ZXIpLmNsdXN0ZXJJZGVudGlmaWVyXG4gICAgICA6IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUluc3RhbmNlKS5pbnN0YW5jZUlkZW50aWZpZXJcblxuICAgIHRoaXMuc2VjcmV0ID0gbmV3IFNlY3JldCh0aGlzLCBcIlNlY3JldFwiLCB7XG4gICAgICBzZWNyZXROYW1lOiBwcm9wcy5zZWNyZXROYW1lLFxuICAgICAgZW5jcnlwdGlvbktleTogcHJvcHMuZW5jcnlwdGlvbktleSxcbiAgICAgIGRlc2NyaXB0aW9uOiBgR2VuZXJhdGVkIHNlY3JldCBmb3IgcG9zdGdyZXMgcm9sZSAke3Byb3BzLnJvbGVOYW1lfWAsXG4gICAgICBnZW5lcmF0ZVNlY3JldFN0cmluZzoge1xuICAgICAgICBwYXNzd29yZExlbmd0aDogMzAsIC8vIE9yYWNsZSBwYXNzd29yZCBjYW5ub3QgaGF2ZSBtb3JlIHRoYW4gMzAgY2hhcmFjdGVyc1xuICAgICAgICBzZWNyZXRTdHJpbmdUZW1wbGF0ZTogSlNPTi5zdHJpbmdpZnkoe1xuICAgICAgICAgIGRiQ2x1c3RlcklkZW50aWZpZXI6IGlkZW50aWZpZXIsXG4gICAgICAgICAgZW5naW5lOiBwcm9wcy5wcm92aWRlci5lbmdpbmUsXG4gICAgICAgICAgaG9zdDogaG9zdCxcbiAgICAgICAgICBwb3J0OiBwb3J0LFxuICAgICAgICAgIHVzZXJuYW1lOiBwcm9wcy5yb2xlTmFtZSxcbiAgICAgICAgICBkYm5hbWU6IHByb3BzLmRhdGFiYXNlID8gcHJvcHMuZGF0YWJhc2UuZGF0YWJhc2VOYW1lIDogcHJvcHMuZGF0YWJhc2VOYW1lLFxuICAgICAgICB9KSxcbiAgICAgICAgZ2VuZXJhdGVTdHJpbmdLZXk6IFwicGFzc3dvcmRcIixcbiAgICAgICAgZXhjbHVkZUNoYXJhY3RlcnM6IFwiICUrfmAjJCYqKCl8W117fTo7PD4/IScvQFxcXCJcXFxcXCIsXG4gICAgICB9LFxuICAgICAgcmVtb3ZhbFBvbGljeTogUmVtb3ZhbFBvbGljeS5ERVNUUk9ZLFxuICAgIH0pXG5cbiAgICAvLyBDcmVhdGUgUGFyYW1ldGVycyBpZiBwYXJhbWV0ZXJQcmVmaXggaXMgcHJvdmlkZWRcbiAgICBpZiAocHJvcHMucGFyYW1ldGVyUHJlZml4KSB7XG4gICAgICBjb25zdCBwYXJhbURhdGEgPSB7XG4gICAgICAgIGRiQ2x1c3RlcklkZW50aWZpZXI6IGlkZW50aWZpZXIsXG4gICAgICAgIGVuZ2luZTogcHJvcHMucHJvdmlkZXIuZW5naW5lLFxuICAgICAgICBob3N0OiBob3N0LFxuICAgICAgICBwb3J0OiBwb3J0LFxuICAgICAgICB1c2VybmFtZTogcHJvcHMucm9sZU5hbWUsXG4gICAgICAgIGRibmFtZTogcHJvcHMuZGF0YWJhc2UgPyBwcm9wcy5kYXRhYmFzZS5kYXRhYmFzZU5hbWUgOiBwcm9wcy5kYXRhYmFzZU5hbWUsXG4gICAgICB9XG5cbiAgICAgIG5ldyBQYXJhbWV0ZXJzKHRoaXMsIFwiUGFyYW1ldGVyc1wiLCB7XG4gICAgICAgIHNlY3JldEFybjogcHJvcHMucHJvdmlkZXIuc2VjcmV0LnNlY3JldEFybixcbiAgICAgICAgcGFyYW1ldGVyUHJlZml4OiBwcm9wcy5wYXJhbWV0ZXJQcmVmaXgsXG4gICAgICAgIHBhc3N3b3JkQXJuOiB0aGlzLnNlY3JldC5zZWNyZXRBcm4sXG4gICAgICAgIHByb3ZpZGVyU2VydmljZVRva2VuOiBwcm9wcy5wcm92aWRlci5zZXJ2aWNlVG9rZW4sXG4gICAgICAgIHByb3ZpZGVyOiBwcm9wcy5wcm92aWRlcixcbiAgICAgICAgcGFyYW1EYXRhLFxuICAgICAgfSlcbiAgICB9XG5cbiAgICBjb25zdCByb2xlID0gbmV3IEN1c3RvbVJlc291cmNlUm9sZSh0aGlzLCBcIlBvc3RncmVzUm9sZVwiLCB7XG4gICAgICBwcm92aWRlcjogcHJvcHMucHJvdmlkZXIsXG4gICAgICByb2xlTmFtZTogcHJvcHMucm9sZU5hbWUsXG4gICAgICBwYXNzd29yZEFybjogdGhpcy5zZWNyZXQuc2VjcmV0QXJuLFxuICAgICAgZGF0YWJhc2U6IHByb3BzLmRhdGFiYXNlLFxuICAgICAgZGF0YWJhc2VOYW1lOiBwcm9wcy5kYXRhYmFzZU5hbWUsXG4gICAgfSlcbiAgICByb2xlLm5vZGUuYWRkRGVwZW5kZW5jeSh0aGlzLnNlY3JldClcbiAgICB0aGlzLnJvbGVOYW1lID0gcHJvcHMucm9sZU5hbWVcbiAgICB0aGlzLnNlY3JldC5ncmFudFJlYWQocHJvcHMucHJvdmlkZXIuaGFuZGxlcilcbiAgICBpZiAodGhpcy5zZWNyZXQuZW5jcnlwdGlvbktleSkge1xuICAgICAgLy8gSXQgc2VlbXMgd2UgbmVlZCB0byBncmFudCBleHBsaWNpdCBwZXJtaXNzaW9uXG4gICAgICB0aGlzLnNlY3JldC5lbmNyeXB0aW9uS2V5LmdyYW50RGVjcnlwdChwcm9wcy5wcm92aWRlci5oYW5kbGVyKVxuICAgIH1cbiAgfVxufVxuIl19
+Role[_a] = { fqn: "cdk-rds-sql.Role", version: "6.1.0" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsNkNBQWtFO0FBQ2xFLDJDQUEwQztBQUcxQyx1RUFBZ0U7QUFDaEUsMkNBQTBDO0FBQzFDLDJDQUFzQztBQUV0QyxpQ0FBdUM7QUFFdkMsaUVBQW1FO0FBNEVuRSw4Q0FBOEM7QUFDOUMsTUFBTSxVQUFXLFNBQVEsc0JBQVM7SUFDaEMsWUFDRSxLQUFnQixFQUNoQixFQUFVLEVBQ1YsS0FPQztRQUVELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUE7UUFFaEIsNENBQTRDO1FBQzVDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7WUFDdkQsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3hCLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQyxJQUFJLEVBQUUsYUFBYSxHQUFHLEVBQUUsRUFBRTtvQkFDaEQsYUFBYSxFQUFFLEdBQUcsS0FBSyxDQUFDLGVBQWUsR0FBRyxHQUFHLEVBQUU7b0JBQy9DLFdBQVcsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFO2lCQUM5QixDQUFDLENBQUE7WUFDSixDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUE7UUFFRiw2REFBNkQ7UUFDN0QsTUFBTSxxQkFBcUIsR0FBRyxHQUFHLEtBQUssQ0FBQyxlQUFlLFVBQVUsQ0FBQTtRQUNoRSxNQUFNLGtCQUFrQixHQUFHLElBQUksNEJBQWMsQ0FBQyxJQUFJLEVBQUUsbUJBQW1CLEVBQUU7WUFDdkUsWUFBWSxFQUFFLEtBQUssQ0FBQyxvQkFBb0I7WUFDeEMsVUFBVSxFQUFFO2dCQUNWLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUztnQkFDMUIsUUFBUSxFQUFFLHFCQUFjLENBQUMsa0JBQWtCO2dCQUMzQyxXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7Z0JBQzlCLGFBQWEsRUFBRSxxQkFBcUI7YUFDckM7U0FDRixDQUFDLENBQUE7UUFDRixrQkFBa0IsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUVyRCxNQUFNLFFBQVEsR0FBRyxlQUFlLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sSUFDbkQsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsT0FDakIsYUFDRSxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FDL0MsR0FBRyxxQkFBcUIsRUFBRSxDQUFBO1FBRTFCLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FDcEMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO1lBQ3RCLE9BQU8sRUFBRSxDQUFDLGtCQUFrQixFQUFFLHVCQUF1QixFQUFFLG1CQUFtQixDQUFDO1lBQzNFLFNBQVMsRUFBRSxDQUFDLFFBQVEsQ0FBQztTQUN0QixDQUFDLENBQ0gsQ0FBQTtJQUNILENBQUM7Q0FDRjtBQUVELE1BQWEsSUFBSyxTQUFRLHNCQUFTO0lBV2pDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBZ0I7UUFDeEQsSUFBSSxLQUFLLENBQUMsUUFBUSxJQUFJLEtBQUssQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN6QyxNQUFNLHlDQUF5QyxDQUFBO1FBQ2pELENBQUM7UUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUMzQyxvR0FBb0c7WUFDcEcseUVBQXlFO1lBQ3pFLHNEQUFzRDtZQUN0RCxNQUFNLHlDQUF5QyxDQUFBO1FBQ2pELENBQUM7UUFDRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBRWhCLE1BQU0sSUFBSSxHQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNEIsQ0FBQyxlQUFlO1lBQ3ZFLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsZUFBZSxDQUFDLFFBQVE7WUFDdkUsQ0FBQyxDQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUE7UUFFM0UsTUFBTSxJQUFJLEdBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUE0QixDQUFDLGVBQWU7WUFDdkUsQ0FBQyxDQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNEIsQ0FBQyxlQUFlLENBQUMsSUFBSTtZQUNuRSxDQUFDLENBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUE2QixDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQTtRQUV2RSxNQUFNLFVBQVUsR0FBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsaUJBQWlCO1lBQy9FLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsaUJBQWlCO1lBQ2hFLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTZCLENBQUMsa0JBQWtCLENBQUE7UUFFcEUsTUFBTSxjQUFjLEdBQUc7WUFDckIsbUJBQW1CLEVBQUUsVUFBVTtZQUMvQixNQUFNLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNO1lBQzdCLElBQUksRUFBRSxJQUFJO1lBQ1YsSUFBSSxFQUFFLElBQUk7WUFDVixRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7WUFDeEIsTUFBTSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWTtTQUMxRSxDQUFBO1FBRUQsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLDJCQUFNLENBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRTtZQUN2QyxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7WUFDNUIsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhO1lBQ2xDLFdBQVcsRUFBRSx3QkFBd0IsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLFNBQVMsS0FBSyxDQUFDLFFBQVEsRUFBRTtZQUNuRixHQUFHLENBQUMsS0FBSyxDQUFDLGFBQWE7Z0JBQ3JCLENBQUMsQ0FBQztvQkFDRSwwREFBMEQ7b0JBQzFELG9CQUFvQixFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDO2lCQUNyRDtnQkFDSCxDQUFDLENBQUM7b0JBQ0UsdUNBQXVDO29CQUN2QyxvQkFBb0IsRUFBRTt3QkFDcEIsY0FBYyxFQUFFLEVBQUUsRUFBRSxzREFBc0Q7d0JBQzFFLG9CQUFvQixFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDO3dCQUNwRCxpQkFBaUIsRUFBRSxVQUFVO3dCQUM3QixpQkFBaUIsRUFBRSwrQkFBK0I7cUJBQ25EO2lCQUNGLENBQUM7WUFDTixhQUFhLEVBQUUsMkJBQWEsQ0FBQyxPQUFPO1NBQ3JDLENBQUMsQ0FBQTtRQUVGLG1EQUFtRDtRQUNuRCxJQUFJLEtBQUssQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUMxQixNQUFNLFNBQVMsR0FBRztnQkFDaEIsbUJBQW1CLEVBQUUsVUFBVTtnQkFDL0IsTUFBTSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTTtnQkFDN0IsSUFBSSxFQUFFLElBQUk7Z0JBQ1YsSUFBSSxFQUFFLElBQUk7Z0JBQ1YsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO2dCQUN4QixNQUFNLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxZQUFZO2FBQzFFLENBQUE7WUFFRCxJQUFJLFVBQVUsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFO2dCQUNqQyxTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUztnQkFDMUMsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO2dCQUN0QyxXQUFXLEVBQUUsS0FBSyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVM7Z0JBQzdELG9CQUFvQixFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWTtnQkFDakQsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO2dCQUN4QixTQUFTO2FBQ1YsQ0FBQyxDQUFBO1FBQ0osQ0FBQztRQUVELE1BQU0sSUFBSSxHQUFHLElBQUksMkJBQWtCLENBQUMsSUFBSSxFQUFFLGNBQWMsRUFBRTtZQUN4RCxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7WUFDeEIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLFdBQVcsRUFBRSxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUztZQUM3RCxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7WUFDeEIsWUFBWSxFQUFFLEtBQUssQ0FBQyxZQUFZO1lBQ2hDLGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBYTtTQUNuQyxDQUFDLENBQUE7UUFDRixJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUE7UUFDcEMsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFBO1FBQzlCLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUE7UUFDN0MsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQzlCLGdEQUFnRDtZQUNoRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQTtRQUNoRSxDQUFDO0lBQ0gsQ0FBQzs7QUFyR0gsb0JBc0dDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ3VzdG9tUmVzb3VyY2UsIFJlbW92YWxQb2xpY3ksIFN0YWNrIH0gZnJvbSBcImF3cy1jZGstbGliXCJcbmltcG9ydCAqIGFzIGlhbSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLWlhbVwiXG5pbXBvcnQgKiBhcyBrbXMgZnJvbSBcImF3cy1jZGstbGliL2F3cy1rbXNcIlxuaW1wb3J0IHsgSURhdGFiYXNlQ2x1c3RlciwgSURhdGFiYXNlSW5zdGFuY2UgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXJkc1wiXG5pbXBvcnQgeyBJU2VjcmV0LCBTZWNyZXQgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXNlY3JldHNtYW5hZ2VyXCJcbmltcG9ydCAqIGFzIHNzbSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXNzbVwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBJRGF0YWJhc2UgfSBmcm9tIFwiLi9kYXRhYmFzZVwiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgUHJvdmlkZXIgfSBmcm9tIFwiLi9wcm92aWRlclwiXG5pbXBvcnQgeyBSb2xlIGFzIEN1c3RvbVJlc291cmNlUm9sZSB9IGZyb20gXCIuL3JvbGUuY3VzdG9tLXJlc291cmNlXCJcblxuZXhwb3J0IGludGVyZmFjZSBSb2xlUHJvcHMge1xuICAvKipcbiAgICogUHJvdmlkZXIuXG4gICAqL1xuICByZWFkb25seSBwcm92aWRlcjogUHJvdmlkZXJcblxuICAvKipcbiAgICogU1FMLlxuICAgKi9cbiAgcmVhZG9ubHkgcm9sZU5hbWU6IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZSB0aGlzIHVzZXIgaXMgZXhwZWN0ZWQgdG8gdXNlLlxuICAgKlxuICAgKiBJZiB0aGUgZGF0YWJhc2UgZXhpc3RzLCBjb25uZWN0IHByaXZpbGVnZXMgYXJlIGdyYW50ZWQuXG4gICAqXG4gICAqIFNwZWNpZnkgb25lIG9mIGBkYXRhYmFzZWAgb3IgYGRhdGFiYXNlTmFtZWAuIFRoaXMgaXMgdGhlIG5hbWVcbiAgICogdGhhdCB3aWxsIGJlIHN0b3JlZCBpbiB0aGUgcm9sZSdzIHNlY3JldCBhcyB0aGUgZGF0YWJhc2UgbmFtZSB0b1xuICAgKiB1c2UuXG4gICAqL1xuICByZWFkb25seSBkYXRhYmFzZT86IElEYXRhYmFzZVxuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZSBuYW1lIHRoaXMgdXNlciBpcyBleHBlY3RlZCB0byB1c2UuXG4gICAqXG4gICAqIElmIHRoZSBkYXRhYmFzZSBleGlzdHMsIGNvbm5lY3QgcHJpdmlsZWdlcyBhcmUgZ3JhbnRlZC5cbiAgICpcbiAgICogU3BlY2lmeSBvbmUgb2YgYGRhdGFiYXNlYCBvciBgZGF0YWJhc2VOYW1lYC4gVGhpcyBpcyB0aGUgbmFtZVxuICAgKiB0aGF0IHdpbGwgYmUgc3RvcmVkIGluIHRoZSByb2xlJ3Mgc2VjcmV0IGFzIHRoZSBkYXRhYmFzZSBuYW1lIHRvXG4gICAqIHVzZS5cbiAgICovXG4gIHJlYWRvbmx5IGRhdGFiYXNlTmFtZT86IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBBIG5ldyBzZWNyZXQgaXMgY3JlYXRlZCBmb3IgdGhpcyB1c2VyLlxuICAgKlxuICAgKiBPcHRpb25hbGx5IGVuY3J5cHQgaXQgd2l0aCB0aGUgZ2l2ZW4ga2V5LlxuICAgKi9cbiAgcmVhZG9ubHkgZW5jcnlwdGlvbktleT86IGttcy5JS2V5XG5cbiAgLyoqXG4gICAqIEEgbmV3IHNlY3JldCBpcyBjcmVhdGVkIGZvciB0aGlzIHVzZXIuXG4gICAqXG4gICAqIE9wdGlvbmFsbHkgYWRkIHNlY3JldCBuYW1lIHRvIHRoZSBzZWNyZXQuXG4gICAqL1xuICByZWFkb25seSBzZWNyZXROYW1lPzogc3RyaW5nXG5cbiAgLyoqXG4gICAqIFByZWZpeCBmb3IgU1NNIHBhcmFtZXRlcnMgdG8gc3RvcmUgY3JlZGVudGlhbHMgaW4gUGFyYW1ldGVyIFN0b3JlLlxuICAgKiBXaGVuIGRlZmluZWQsIGNyZWRlbnRpYWxzIHdpbGwgYWxzbyBiZSBzdG9yZWQgYXMgcGFyYW1ldGVycy5cbiAgICpcbiAgICogVGhlIHBhcmFtZXRlciBuYW1lcyBzdWNoIGFzIFwicGFzc3dvcmRcIiBpcyBzaW1wbHkgYXBwZW5kZWQgdG9cbiAgICogYHBhcmFtZXRlclByZWZpeGAsIHNvIG1ha2Ugc3VyZSB0aGUgcHJlZml4IGVuZHMgd2l0aCBhIHNsYXNoIGlmXG4gICAqICB5b3UgaGF2ZSB5b3VyIHBhcmFtZXRlciBuYW1lcyBzbGFzaCBzZXBhcmF0ZWQuXG4gICAqXG4gICAqIE5vdGUgdGhhdCB0aGUgcGFzc3dvcmQgZnJvbSB0aGUgc2VjcmV0IGlzIGNvcGllZCBqdXN0IG9uY2UsIHRoZXlcbiAgICogYXJlIG5vdCBrZXB0IGluIHN5bmMuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gY3JlZGVudGlhbHMgYXJlIG9ubHkgc3RvcmVkIGluIFNlY3JldHMgTWFuYWdlclxuICAgKi9cbiAgcmVhZG9ubHkgcGFyYW1ldGVyUHJlZml4Pzogc3RyaW5nXG5cbiAgLyoqXG4gICAqIEVuYWJsZSBJQU0gYXV0aGVudGljYXRpb24gZm9yIHRoaXMgcm9sZS5cbiAgICpcbiAgICogV2hlbiBlbmFibGVkLCB0aGUgcm9sZSB3aWxsIGJlIGNyZWF0ZWQgd2l0aG91dCBhIHBhc3N3b3JkIGFuZFxuICAgKiBjb25maWd1cmVkIGZvciBBV1MgSUFNIGRhdGFiYXNlIGF1dGhlbnRpY2F0aW9uLiBUaGUgc2VjcmV0XG4gICAqIHdpbGwgbm90IGNvbnRhaW4gYSBwYXNzd29yZCBmaWVsZC5cbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2UgLSB1c2UgcGFzc3dvcmQgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGVuYWJsZUlhbUF1dGg/OiBib29sZWFuXG59XG5cbi8vIFByaXZhdGUgUGFyYW1ldGVycyBjb25zdHJ1Y3QgKG5vdCBleHBvcnRlZClcbmNsYXNzIFBhcmFtZXRlcnMgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBjb25zdHJ1Y3RvcihcbiAgICBzY29wZTogQ29uc3RydWN0LFxuICAgIGlkOiBzdHJpbmcsXG4gICAgcHJvcHM6IHtcbiAgICAgIHByb3ZpZGVyOiBQcm92aWRlclxuICAgICAgc2VjcmV0QXJuOiBzdHJpbmdcbiAgICAgIHBhcmFtZXRlclByZWZpeDogc3RyaW5nXG4gICAgICBwYXNzd29yZEFybjogc3RyaW5nXG4gICAgICBwcm92aWRlclNlcnZpY2VUb2tlbjogc3RyaW5nXG4gICAgICBwYXJhbURhdGE6IFJlY29yZDxzdHJpbmcsIGFueT5cbiAgICB9XG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCBpZClcblxuICAgIC8vIENyZWF0ZSBwYXJhbWV0ZXJzIGZvciBlYWNoIGtleS12YWx1ZSBwYWlyXG4gICAgT2JqZWN0LmVudHJpZXMocHJvcHMucGFyYW1EYXRhKS5mb3JFYWNoKChba2V5LCB2YWx1ZV0pID0+IHtcbiAgICAgIGlmICh2YWx1ZSAhPT0gdW5kZWZpbmVkKSB7XG4gICAgICAgIG5ldyBzc20uU3RyaW5nUGFyYW1ldGVyKHRoaXMsIGBQYXJhbWV0ZXItJHtrZXl9YCwge1xuICAgICAgICAgIHBhcmFtZXRlck5hbWU6IGAke3Byb3BzLnBhcmFtZXRlclByZWZpeH0ke2tleX1gLFxuICAgICAgICAgIHN0cmluZ1ZhbHVlOiB2YWx1ZS50b1N0cmluZygpLFxuICAgICAgICB9KVxuICAgICAgfVxuICAgIH0pXG5cbiAgICAvLyBGb3IgcGFzc3dvcmQsIHVzZSB0aGUgZXhpc3RpbmcgcHJvdmlkZXIgdG8gc3RvcmUgaXQgaW4gU1NNXG4gICAgY29uc3QgcGFzc3dvcmRQYXJhbWV0ZXJOYW1lID0gYCR7cHJvcHMucGFyYW1ldGVyUHJlZml4fXBhc3N3b3JkYFxuICAgIGNvbnN0IHBhc3N3b3JkX3BhcmFtZXRlciA9IG5ldyBDdXN0b21SZXNvdXJjZSh0aGlzLCBcIlBhc3N3b3JkUGFyYW1ldGVyXCIsIHtcbiAgICAgIHNlcnZpY2VUb2tlbjogcHJvcHMucHJvdmlkZXJTZXJ2aWNlVG9rZW4sXG4gICAgICBwcm9wZXJ0aWVzOiB7XG4gICAgICAgIFNlY3JldEFybjogcHJvcHMuc2VjcmV0QXJuLFxuICAgICAgICBSZXNvdXJjZTogUmRzU3FsUmVzb3VyY2UuUEFSQU1FVEVSX1BBU1NXT1JELFxuICAgICAgICBQYXNzd29yZEFybjogcHJvcHMucGFzc3dvcmRBcm4sXG4gICAgICAgIFBhcmFtZXRlck5hbWU6IHBhc3N3b3JkUGFyYW1ldGVyTmFtZSxcbiAgICAgIH0sXG4gICAgfSlcbiAgICBwYXNzd29yZF9wYXJhbWV0ZXIubm9kZS5hZGREZXBlbmRlbmN5KHByb3BzLnByb3ZpZGVyKVxuXG4gICAgY29uc3QgcGFyYW1Bcm4gPSBgYXJuOmF3czpzc206JHtTdGFjay5vZih0aGlzKS5yZWdpb259OiR7XG4gICAgICBTdGFjay5vZih0aGlzKS5hY2NvdW50XG4gICAgfTpwYXJhbWV0ZXIke1xuICAgICAgcGFzc3dvcmRQYXJhbWV0ZXJOYW1lLnN0YXJ0c1dpdGgoXCIvXCIpID8gXCJcIiA6IFwiL1wiXG4gICAgfSR7cGFzc3dvcmRQYXJhbWV0ZXJOYW1lfWBcblxuICAgIHByb3BzLnByb3ZpZGVyLmhhbmRsZXIuYWRkVG9Sb2xlUG9saWN5KFxuICAgICAgbmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBhY3Rpb25zOiBbXCJzc206UHV0UGFyYW1ldGVyXCIsIFwic3NtOkFkZFRhZ3NUb1Jlc291cmNlXCIsIFwic3NtOkdldFBhcmFtZXRlcnNcIl0sXG4gICAgICAgIHJlc291cmNlczogW3BhcmFtQXJuXSxcbiAgICAgIH0pXG4gICAgKVxuICB9XG59XG5cbmV4cG9ydCBjbGFzcyBSb2xlIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgLyoqXG4gICAqIFRoZSByb2xlIG5hbWUuXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgcm9sZU5hbWU6IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBUaGUgZ2VuZXJhdGVkIHNlY3JldC5cbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBzZWNyZXQ6IElTZWNyZXRcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogUm9sZVByb3BzKSB7XG4gICAgaWYgKHByb3BzLmRhdGFiYXNlICYmIHByb3BzLmRhdGFiYXNlTmFtZSkge1xuICAgICAgdGhyb3cgXCJTcGVjaWZ5IGVpdGhlciBkYXRhYmFzZSBvciBkYXRhYmFzZU5hbWVcIlxuICAgIH1cbiAgICBpZiAoIXByb3BzLmRhdGFiYXNlICYmICFwcm9wcy5kYXRhYmFzZU5hbWUpIHtcbiAgICAgIC8vIElmIG5laXRoZXIgaXMgc3BlY2lmaWVkLCB3ZSBtaWdodCBuZWVkIGEgZGVmYXVsdCBvciB0aHJvdyBhbiBlcnJvciBkZXBlbmRpbmcgb24gZGVzaXJlZCBiZWhhdmlvci5cbiAgICAgIC8vIEZvciBub3csIGxldCdzIGFzc3VtZSBpdCdzIGFsbG93ZWQgYnV0IHRoZSBzZWNyZXQgd29uJ3QgaGF2ZSBhIGRibmFtZS5cbiAgICAgIC8vIElmIGl0IHNob3VsZCBiZSByZXF1aXJlZCwgdW5jb21tZW50IHRoZSBsaW5lIGJlbG93OlxuICAgICAgdGhyb3cgXCJTcGVjaWZ5IGVpdGhlciBkYXRhYmFzZSBvciBkYXRhYmFzZU5hbWVcIlxuICAgIH1cbiAgICBzdXBlcihzY29wZSwgaWQpXG5cbiAgICBjb25zdCBob3N0ID0gKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlQ2x1c3RlcikuY2x1c3RlckVuZHBvaW50XG4gICAgICA/IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUNsdXN0ZXIpLmNsdXN0ZXJFbmRwb2ludC5ob3N0bmFtZVxuICAgICAgOiAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VJbnN0YW5jZSkuaW5zdGFuY2VFbmRwb2ludC5ob3N0bmFtZVxuXG4gICAgY29uc3QgcG9ydCA9IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUNsdXN0ZXIpLmNsdXN0ZXJFbmRwb2ludFxuICAgICAgPyAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VDbHVzdGVyKS5jbHVzdGVyRW5kcG9pbnQucG9ydFxuICAgICAgOiAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VJbnN0YW5jZSkuaW5zdGFuY2VFbmRwb2ludC5wb3J0XG5cbiAgICBjb25zdCBpZGVudGlmaWVyID0gKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlQ2x1c3RlcikuY2x1c3RlcklkZW50aWZpZXJcbiAgICAgID8gKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlQ2x1c3RlcikuY2x1c3RlcklkZW50aWZpZXJcbiAgICAgIDogKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlSW5zdGFuY2UpLmluc3RhbmNlSWRlbnRpZmllclxuXG4gICAgY29uc3Qgc2VjcmV0VGVtcGxhdGUgPSB7XG4gICAgICBkYkNsdXN0ZXJJZGVudGlmaWVyOiBpZGVudGlmaWVyLFxuICAgICAgZW5naW5lOiBwcm9wcy5wcm92aWRlci5lbmdpbmUsXG4gICAgICBob3N0OiBob3N0LFxuICAgICAgcG9ydDogcG9ydCxcbiAgICAgIHVzZXJuYW1lOiBwcm9wcy5yb2xlTmFtZSxcbiAgICAgIGRibmFtZTogcHJvcHMuZGF0YWJhc2UgPyBwcm9wcy5kYXRhYmFzZS5kYXRhYmFzZU5hbWUgOiBwcm9wcy5kYXRhYmFzZU5hbWUsXG4gICAgfVxuXG4gICAgdGhpcy5zZWNyZXQgPSBuZXcgU2VjcmV0KHRoaXMsIFwiU2VjcmV0XCIsIHtcbiAgICAgIHNlY3JldE5hbWU6IHByb3BzLnNlY3JldE5hbWUsXG4gICAgICBlbmNyeXB0aW9uS2V5OiBwcm9wcy5lbmNyeXB0aW9uS2V5LFxuICAgICAgZGVzY3JpcHRpb246IGBHZW5lcmF0ZWQgc2VjcmV0IGZvciAke3Byb3BzLnByb3ZpZGVyLmVuZ2luZX0gcm9sZSAke3Byb3BzLnJvbGVOYW1lfWAsXG4gICAgICAuLi4ocHJvcHMuZW5hYmxlSWFtQXV0aFxuICAgICAgICA/IHtcbiAgICAgICAgICAgIC8vIEZvciBJQU0gYXV0aCwgY3JlYXRlIHNlY3JldCB3aXRob3V0IHBhc3N3b3JkIGdlbmVyYXRpb25cbiAgICAgICAgICAgIHNlY3JldFN0cmluZ1RlbXBsYXRlOiBKU09OLnN0cmluZ2lmeShzZWNyZXRUZW1wbGF0ZSksXG4gICAgICAgICAgfVxuICAgICAgICA6IHtcbiAgICAgICAgICAgIC8vIEZvciBwYXNzd29yZCBhdXRoLCBnZW5lcmF0ZSBwYXNzd29yZFxuICAgICAgICAgICAgZ2VuZXJhdGVTZWNyZXRTdHJpbmc6IHtcbiAgICAgICAgICAgICAgcGFzc3dvcmRMZW5ndGg6IDMwLCAvLyBPcmFjbGUgcGFzc3dvcmQgY2Fubm90IGhhdmUgbW9yZSB0aGFuIDMwIGNoYXJhY3RlcnNcbiAgICAgICAgICAgICAgc2VjcmV0U3RyaW5nVGVtcGxhdGU6IEpTT04uc3RyaW5naWZ5KHNlY3JldFRlbXBsYXRlKSxcbiAgICAgICAgICAgICAgZ2VuZXJhdGVTdHJpbmdLZXk6IFwicGFzc3dvcmRcIixcbiAgICAgICAgICAgICAgZXhjbHVkZUNoYXJhY3RlcnM6IFwiICUrfmAjJCYqKCl8W117fTo7PD4/IScvQFxcXCJcXFxcXCIsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0pLFxuICAgICAgcmVtb3ZhbFBvbGljeTogUmVtb3ZhbFBvbGljeS5ERVNUUk9ZLFxuICAgIH0pXG5cbiAgICAvLyBDcmVhdGUgUGFyYW1ldGVycyBpZiBwYXJhbWV0ZXJQcmVmaXggaXMgcHJvdmlkZWRcbiAgICBpZiAocHJvcHMucGFyYW1ldGVyUHJlZml4KSB7XG4gICAgICBjb25zdCBwYXJhbURhdGEgPSB7XG4gICAgICAgIGRiQ2x1c3RlcklkZW50aWZpZXI6IGlkZW50aWZpZXIsXG4gICAgICAgIGVuZ2luZTogcHJvcHMucHJvdmlkZXIuZW5naW5lLFxuICAgICAgICBob3N0OiBob3N0LFxuICAgICAgICBwb3J0OiBwb3J0LFxuICAgICAgICB1c2VybmFtZTogcHJvcHMucm9sZU5hbWUsXG4gICAgICAgIGRibmFtZTogcHJvcHMuZGF0YWJhc2UgPyBwcm9wcy5kYXRhYmFzZS5kYXRhYmFzZU5hbWUgOiBwcm9wcy5kYXRhYmFzZU5hbWUsXG4gICAgICB9XG5cbiAgICAgIG5ldyBQYXJhbWV0ZXJzKHRoaXMsIFwiUGFyYW1ldGVyc1wiLCB7XG4gICAgICAgIHNlY3JldEFybjogcHJvcHMucHJvdmlkZXIuc2VjcmV0LnNlY3JldEFybixcbiAgICAgICAgcGFyYW1ldGVyUHJlZml4OiBwcm9wcy5wYXJhbWV0ZXJQcmVmaXgsXG4gICAgICAgIHBhc3N3b3JkQXJuOiBwcm9wcy5lbmFibGVJYW1BdXRoID8gXCJcIiA6IHRoaXMuc2VjcmV0LnNlY3JldEFybixcbiAgICAgICAgcHJvdmlkZXJTZXJ2aWNlVG9rZW46IHByb3BzLnByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICAgICAgcHJvdmlkZXI6IHByb3BzLnByb3ZpZGVyLFxuICAgICAgICBwYXJhbURhdGEsXG4gICAgICB9KVxuICAgIH1cblxuICAgIGNvbnN0IHJvbGUgPSBuZXcgQ3VzdG9tUmVzb3VyY2VSb2xlKHRoaXMsIFwiUG9zdGdyZXNSb2xlXCIsIHtcbiAgICAgIHByb3ZpZGVyOiBwcm9wcy5wcm92aWRlcixcbiAgICAgIHJvbGVOYW1lOiBwcm9wcy5yb2xlTmFtZSxcbiAgICAgIHBhc3N3b3JkQXJuOiBwcm9wcy5lbmFibGVJYW1BdXRoID8gXCJcIiA6IHRoaXMuc2VjcmV0LnNlY3JldEFybixcbiAgICAgIGRhdGFiYXNlOiBwcm9wcy5kYXRhYmFzZSxcbiAgICAgIGRhdGFiYXNlTmFtZTogcHJvcHMuZGF0YWJhc2VOYW1lLFxuICAgICAgZW5hYmxlSWFtQXV0aDogcHJvcHMuZW5hYmxlSWFtQXV0aCxcbiAgICB9KVxuICAgIHJvbGUubm9kZS5hZGREZXBlbmRlbmN5KHRoaXMuc2VjcmV0KVxuICAgIHRoaXMucm9sZU5hbWUgPSBwcm9wcy5yb2xlTmFtZVxuICAgIHRoaXMuc2VjcmV0LmdyYW50UmVhZChwcm9wcy5wcm92aWRlci5oYW5kbGVyKVxuICAgIGlmICh0aGlzLnNlY3JldC5lbmNyeXB0aW9uS2V5KSB7XG4gICAgICAvLyBJdCBzZWVtcyB3ZSBuZWVkIHRvIGdyYW50IGV4cGxpY2l0IHBlcm1pc3Npb25cbiAgICAgIHRoaXMuc2VjcmV0LmVuY3J5cHRpb25LZXkuZ3JhbnREZWNyeXB0KHByb3BzLnByb3ZpZGVyLmhhbmRsZXIpXG4gICAgfVxuICB9XG59XG4iXX0=

package/lib/schema.js

@@ -27,5 +27,5 @@ class Schema extends aws_cdk_lib_1.CustomResource {
 }
 exports.Schema = Schema;
 _a = JSII_RTTI_SYMBOL_1;
-Schema[_a] = { fqn: "cdk-rds-sql.Schema", version: "6.0.2" };
+Schema[_a] = { fqn: "cdk-rds-sql.Schema", version: "6.1.0" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3NjaGVtYS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLDZDQUE0QztBQUc1QyxpQ0FBdUM7QUE0QnZDLE1BQWEsTUFBTyxTQUFRLDRCQUFjO0lBR3hDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBa0I7UUFDMUQsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixZQUFZLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxZQUFZO1lBQ3pDLFVBQVUsRUFBRTtnQkFDVixRQUFRLEVBQUUscUJBQWMsQ0FBQyxNQUFNO2dCQUMvQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7Z0JBQzVCLFNBQVMsRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxTQUFTO2dCQUMxQyxZQUFZLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLFNBQVM7Z0JBQ3RFLFFBQVEsRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUzthQUN2RDtTQUNGLENBQUMsQ0FBQTtRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN2QyxJQUFJLENBQUMsVUFBVSxHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUE7UUFDbEMsSUFBSSxLQUFLLENBQUMsUUFBUTtZQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUMzRCxJQUFJLEtBQUssQ0FBQyxJQUFJO1lBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFBO0lBQ3JELENBQUM7O0FBbEJILHdCQW1CQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEN1c3RvbVJlc291cmNlIH0gZnJvbSBcImF3cy1jZGstbGliXCJcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCJcbmltcG9ydCB7IElEYXRhYmFzZSB9IGZyb20gXCIuL2RhdGFiYXNlXCJcbmltcG9ydCB7IFJkc1NxbFJlc291cmNlIH0gZnJvbSBcIi4vZW51bVwiXG5pbXBvcnQgeyBQcm92aWRlciB9IGZyb20gXCIuL3Byb3ZpZGVyXCJcbmltcG9ydCB7IFJvbGUgfSBmcm9tIFwiLi9yb2xlXCJcblxuZXhwb3J0IGludGVyZmFjZSBTY2hlbWFQcm9wcyB7XG4gIC8qKlxuICAgKiBQcm92aWRlci5cbiAgICovXG4gIHJlYWRvbmx5IHByb3ZpZGVyOiBQcm92aWRlclxuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSB1c2UgZGVmYXVsdCBkYXRhYmFzZVxuICAgKi9cbiAgcmVhZG9ubHkgZGF0YWJhc2U/OiBJRGF0YWJhc2VcblxuICAvKipcbiAgICogU2NoZW1hIG5hbWUuXG4gICAqL1xuICByZWFkb25seSBzY2hlbWFOYW1lOiBzdHJpbmdcblxuICAvKipcbiAgICogT3B0aW9uYWwgcm9sZSB0byBiZSBncmFudGVkIGZvciBtYW5hZ2luZyB0YWJsZXMgaW4gc2NoZW1hXG4gICAqL1xuICByZWFkb25seSByb2xlPzogUm9sZVxufVxuXG5leHBvcnQgY2xhc3MgU2NoZW1hIGV4dGVuZHMgQ3VzdG9tUmVzb3VyY2Uge1xuICBwdWJsaWMgcmVhZG9ubHkgc2NoZW1hTmFtZTogc3RyaW5nXG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IFNjaGVtYVByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICBzZXJ2aWNlVG9rZW46IHByb3BzLnByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICAgIHByb3BlcnRpZXM6IHtcbiAgICAgICAgUmVzb3VyY2U6IFJkc1NxbFJlc291cmNlLlNDSEVNQSxcbiAgICAgICAgUmVzb3VyY2VJZDogcHJvcHMuc2NoZW1hTmFtZSxcbiAgICAgICAgU2VjcmV0QXJuOiBwcm9wcy5wcm92aWRlci5zZWNyZXQuc2VjcmV0QXJuLFxuICAgICAgICBEYXRhYmFzZU5hbWU6IHByb3BzLmRhdGFiYXNlID8gcHJvcHMuZGF0YWJhc2UuZGF0YWJhc2VOYW1lIDogdW5kZWZpbmVkLFxuICAgICAgICBSb2xlTmFtZTogcHJvcHMucm9sZSA/IHByb3BzLnJvbGUucm9sZU5hbWUgOiB1bmRlZmluZWQsXG4gICAgICB9LFxuICAgIH0pXG4gICAgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMucHJvdmlkZXIpXG4gICAgdGhpcy5zY2hlbWFOYW1lID0gcHJvcHMuc2NoZW1hTmFtZVxuICAgIGlmIChwcm9wcy5kYXRhYmFzZSkgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMuZGF0YWJhc2UpXG4gICAgaWYgKHByb3BzLnJvbGUpIHRoaXMubm9kZS5hZGREZXBlbmRlbmN5KHByb3BzLnJvbGUpXG4gIH1cbn1cbiJdfQ==

package/lib/sql.js

@@ -24,5 +24,5 @@ class Sql extends aws_cdk_lib_1.CustomResource {
 }
 exports.Sql = Sql;
 _a = JSII_RTTI_SYMBOL_1;
-Sql[_a] = { fqn: "cdk-rds-sql.Sql", version: "6.0.2" };
+Sql[_a] = { fqn: "cdk-rds-sql.Sql", version: "6.1.0" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3FsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3NxbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLDZDQUE0QztBQUc1QyxpQ0FBdUM7QUEyQnZDLE1BQWEsR0FBSSxTQUFRLDRCQUFjO0lBQ3JDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBZTtRQUN2RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLFlBQVksRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7WUFDekMsVUFBVSxFQUFFO2dCQUNWLFFBQVEsRUFBRSxxQkFBYyxDQUFDLEdBQUc7Z0JBQzVCLFNBQVMsRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxTQUFTO2dCQUMxQyxZQUFZLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLFNBQVM7Z0JBQ3RFLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUztnQkFDMUIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO2FBQ3pCO1NBQ0YsQ0FBQyxDQUFBO1FBQ0YsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFBO1FBQ3ZDLElBQUksS0FBSyxDQUFDLFFBQVE7WUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUE7SUFDN0QsQ0FBQzs7QUFkSCxrQkFlQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEN1c3RvbVJlc291cmNlIH0gZnJvbSBcImF3cy1jZGstbGliXCJcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCJcbmltcG9ydCB7IElEYXRhYmFzZSB9IGZyb20gXCIuL2RhdGFiYXNlXCJcbmltcG9ydCB7IFJkc1NxbFJlc291cmNlIH0gZnJvbSBcIi4vZW51bVwiXG5pbXBvcnQgeyBQcm92aWRlciB9IGZyb20gXCIuL3Byb3ZpZGVyXCJcblxuZXhwb3J0IGludGVyZmFjZSBTcWxQcm9wcyB7XG4gIC8qKlxuICAgKiBQcm92aWRlci5cbiAgICovXG4gIHJlYWRvbmx5IHByb3ZpZGVyOiBQcm92aWRlclxuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSB1c2UgZGVmYXVsdCBkYXRhYmFzZVxuICAgKi9cbiAgcmVhZG9ubHkgZGF0YWJhc2U/OiBJRGF0YWJhc2VcblxuICAvKipcbiAgICogU1FMLlxuICAgKi9cbiAgcmVhZG9ubHkgc3RhdGVtZW50Pzogc3RyaW5nXG5cbiAgLyoqXG4gICAqIE9wdGlvbmFsIHN0YXRtZW50IHRvIGJlIGV4ZWN1dGVkIHdoZW4gdGhlIHJlc291cmNlIGlzIGRlbGV0ZWRcbiAgICovXG4gIHJlYWRvbmx5IHJvbGxiYWNrPzogc3RyaW5nXG59XG5cbmV4cG9ydCBjbGFzcyBTcWwgZXh0ZW5kcyBDdXN0b21SZXNvdXJjZSB7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBTcWxQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgc2VydmljZVRva2VuOiBwcm9wcy5wcm92aWRlci5zZXJ2aWNlVG9rZW4sXG4gICAgICBwcm9wZXJ0aWVzOiB7XG4gICAgICAgIFJlc291cmNlOiBSZHNTcWxSZXNvdXJjZS5TUUwsXG4gICAgICAgIFNlY3JldEFybjogcHJvcHMucHJvdmlkZXIuc2VjcmV0LnNlY3JldEFybixcbiAgICAgICAgRGF0YWJhc2VOYW1lOiBwcm9wcy5kYXRhYmFzZSA/IHByb3BzLmRhdGFiYXNlLmRhdGFiYXNlTmFtZSA6IHVuZGVmaW5lZCxcbiAgICAgICAgU3RhdGVtZW50OiBwcm9wcy5zdGF0ZW1lbnQsXG4gICAgICAgIFJvbGxiYWNrOiBwcm9wcy5yb2xsYmFjayxcbiAgICAgIH0sXG4gICAgfSlcbiAgICB0aGlzLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5wcm92aWRlcilcbiAgICBpZiAocHJvcHMuZGF0YWJhc2UpIHRoaXMubm9kZS5hZGREZXBlbmRlbmN5KHByb3BzLmRhdGFiYXNlKVxuICB9XG59XG4iXX0=

package/package.json

@@ -100,7 +100,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "6.0.2",
+  "version": "6.1.0",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [