cdk-rds-sql 6.1.0 → 6.1.2

package/.jsii

@@ -4172,7 +4172,7 @@
           },
           "locationInModule": {
             "filename": "src/provider.ts",
-            "line": 134
+            "line": 133
           },
           "name": "newCustomResourceHandler",
           "parameters": [
@@ -5013,6 +5013,6 @@
       "symbolId": "src/sql:SqlProps"
     }
   },
-  "version": "6.1.0",
-  "fingerprint": "Jr9mtiVWj8E4ZRwDqRC2WebFyv8Fd/9WJUVkePMxpv8="
+  "version": "6.1.2",
+  "fingerprint": "FQIXsw6jGjZF4hbnqoBdGnn4gH67Zc1OmM9Xs2QqDoQ="
 }

package/.pre-commit-config.yaml

@@ -56,5 +56,5 @@ repos:
         exclude: .projenrc.ts
         name: test
         language: system
-        entry: sh -c 'npx projen test'
+        entry: sh -c 'npx projen test --coverage=false'
         files: \.ts$

package/CLAUDE.md

@@ -0,0 +1,117 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+This is a CDK construct library for creating databases, schemas, and roles in Aurora Serverless v2, RDS Database Cluster, or Database Instance. It supports both PostgreSQL and MySQL databases and is designed for enterprise environments with isolated subnets.
+
+## Key Architecture
+
+### Core Components
+
+- **Provider**: Main construct that creates a Lambda function handler to execute database operations
+- **Role**: Creates database users/roles with optional IAM authentication
+- **Database**: Creates databases with optional ownership assignment
+- **Schema**: Creates database schemas with role permissions
+- **Sql**: Executes arbitrary SQL statements
+
+### Lambda Handler Architecture
+
+- **Engine Factory Pattern**: `lambda/engine.factory.ts` creates database-specific engines
+- **Abstract Engine**: `lambda/engine.abstract.ts` defines common interface
+- **Concrete Engines**: `lambda/engine.postgresql.ts` and `lambda/engine.mysql.ts`
+- **Main Handler**: `lambda/handler.ts` orchestrates CloudFormation custom resource operations
+
+The Lambda handler supports both PostgreSQL and MySQL databases, auto-detecting the engine type from the cluster/instance configuration.
+
+## Development Commands
+
+### Build and Test
+
+```bash
+# Build the project
+npm run build
+
+# Run all tests
+npm run test
+
+# Run tests in watch mode
+npm run test:watch
+
+# Run linting
+npm run eslint
+
+# Build only the Lambda handler
+npm run build:handler
+```
+
+### Integration Testing
+
+```bash
+# Deploy PostgreSQL serverless test stack
+npm run integ:deploy:postgresql:serverless
+
+# Deploy MySQL serverless test stack
+npm run integ:deploy:mysql:serverless
+
+# Destroy test stack
+npm run integ:destroy:serverless
+```
+
+### Package Management
+
+```bash
+# Package for distribution
+npm run package
+
+# Build all packages
+npm run package-all
+```
+
+## Testing Setup
+
+- **Framework**: Jest with TypeScript support
+- **Test Files**: Located in `test/` and `lambda/` directories
+- **Configuration**: Max 2 concurrent workers for database tests
+- **Coverage**: Enabled with multiple reporters (json, lcov, clover, cobertura, text)
+
+## Database Engine Support
+
+### PostgreSQL
+
+- Uses `pg` library for connections
+- Supports schemas, roles, and databases
+- IAM authentication supported
+
+### MySQL
+
+- Uses `mysql2` library for connections
+- Creates users with '%' host for VPC compatibility
+- IAM authentication supported
+
+## Build Process
+
+The project uses projen for build management. Do not change files managed by projen, but instead change `.projenrc.ts`
+
+Projen tasks:
+
+1. `pre-compile`: Transpiles Lambda handler using esbuild
+2. `compile`: TypeScript compilation
+3. `post-compile`: Copies handler to lib directory
+4. `eslint`: Runs linter
+5. `typecheck`: Runs typecheck
+
+## SSL/TLS Configuration
+
+- SSL is enabled by default
+- Global RDS certificate bundle is automatically downloaded during build
+- Can be disabled via `ssl: false` in Provider props
+
+## Key Dependencies
+
+- **AWS CDK**: v2.171.1
+- **Node.js**: >= 22.14
+- **TypeScript**: ~5.8
+- **Database Drivers**: pg (PostgreSQL), mysql2 (MySQL)
+- **AWS SDKs**: secrets-manager, ssm clients

package/lambda/engine.abstract.ts

@@ -3,6 +3,12 @@ import {
   SecretsManagerClient,
   GetSecretValueCommand,
 } from "@aws-sdk/client-secrets-manager"
+import {
+  EngineDatabaseProperties,
+  EngineRoleProperties,
+  EngineSchemaProperties,
+  EngineSqlProperties,
+} from "./types"
 
 export interface EngineConnectionConfig {
   host: string
@@ -23,38 +29,50 @@ export abstract class AbstractEngine {
         : (_message?: any, ..._optionalParams: any[]) => {}
   }
 
-  abstract createDatabase(resourceId: string, props?: any): string | string[]
+  abstract createDatabase(
+    resourceId: string,
+    props: EngineDatabaseProperties
+  ): string | string[]
   abstract updateDatabase(
     resourceId: string,
     oldResourceId: string,
-    props?: any
+    props: EngineDatabaseProperties
   ): string | string[]
   abstract deleteDatabase(resourceId: string, masterUser: string): string | string[]
 
-  abstract createRole(resourceId: string, props?: any): Promise<string | string[]>
+  abstract createRole(
+    resourceId: string,
+    props: EngineRoleProperties
+  ): Promise<string | string[]>
   abstract updateRole(
     resourceId: string,
     oldResourceId: string,
-    props?: any,
-    oldProps?: any
+    props: EngineRoleProperties,
+    oldProps: EngineRoleProperties
   ): Promise<string | string[]>
-  abstract deleteRole(resourceId: string, props?: any): string | string[]
+  abstract deleteRole(resourceId: string, props: EngineRoleProperties): string | string[]
 
-  abstract createSchema(resourceId: string, props?: any): string | string[]
+  abstract createSchema(
+    resourceId: string,
+    props: EngineSchemaProperties
+  ): string | string[]
   abstract updateSchema(
     resourceId: string,
     oldResourceId: string,
-    props?: any
+    props: EngineSchemaProperties
+  ): string | string[]
+  abstract deleteSchema(
+    resourceId: string,
+    props: EngineSchemaProperties
   ): string | string[]
-  abstract deleteSchema(resourceId: string, props?: any): string | string[]
 
-  abstract createSql(resourceId: string, props?: any): string | string[]
+  abstract createSql(resourceId: string, props: EngineSqlProperties): string | string[]
   abstract updateSql(
     resourceId: string,
     oldResourceId: string,
-    props?: any
+    props: EngineSqlProperties
   ): string | string[]
-  abstract deleteSql(resourceId: string, props?: any): string | string[]
+  abstract deleteSql(resourceId: string, props: EngineSqlProperties): string | string[]
 
   abstract executeSQL(
     sql: string | string[],

package/lambda/engine.factory.ts

@@ -1,6 +1,6 @@
 import { AbstractEngine } from "./engine.abstract"
-import { PostgresqlEngine } from "./engine.postgresql"
 import { MysqlEngine } from "./engine.mysql"
+import { PostgresqlEngine } from "./engine.postgresql"
 
 export class EngineFactory {
   static createEngine(engine: string): AbstractEngine {

package/lambda/engine.mysql.test.ts

@@ -39,9 +39,14 @@ describe("MySQL Engine", () => {
       // Mock getPassword implementation
       jest.spyOn(engine as any, "getPassword").mockResolvedValue("test-password")
 
-      const sql = await engine.updateRole("newrole", "oldrole", {
-        PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
-      })
+      const sql = await engine.updateRole(
+        "newrole",
+        "oldrole",
+        {
+          PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
+        },
+        {}
+      )
 
       expect(Array.isArray(sql)).toBe(true)
       expect(sql[0]).toContain("CREATE USER IF NOT EXISTS")
@@ -99,7 +104,9 @@ describe("MySQL Engine", () => {
         const sql = await engine.createRole("iamuser", props)
 
         expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toContain("CREATE USER IF NOT EXISTS 'iamuser'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'")
+        expect(sql[0]).toContain(
+          "CREATE USER IF NOT EXISTS 'iamuser'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'"
+        )
         expect(sql[1]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'iamuser'@'%'")
         expect(sql[2]).toBe("FLUSH PRIVILEGES")
       })
@@ -116,8 +123,12 @@ describe("MySQL Engine", () => {
         const sql = await engine.createRole("passworduser", props)
 
         expect(Array.isArray(sql)).toBe(true)
-        expect(sql[0]).toContain("CREATE USER IF NOT EXISTS 'passworduser'@'%' IDENTIFIED BY 'test-password'")
-        expect(sql[1]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'passworduser'@'%'")
+        expect(sql[0]).toContain(
+          "CREATE USER IF NOT EXISTS 'passworduser'@'%' IDENTIFIED BY 'test-password'"
+        )
+        expect(sql[1]).toContain(
+          "GRANT ALL PRIVILEGES ON `testdb`.* TO 'passworduser'@'%'"
+        )
         expect(sql[2]).toBe("FLUSH PRIVILEGES")
       })
 
@@ -132,11 +143,18 @@ describe("MySQL Engine", () => {
           DatabaseName: "testdb",
         }
 
-        const sql = await engine.updateRole("switchuser", "switchuser", newProps, oldProps)
+        const sql = await engine.updateRole(
+          "switchuser",
+          "switchuser",
+          newProps,
+          oldProps
+        )
 
         expect(Array.isArray(sql)).toBe(true)
         expect(sql[0]).toContain("DROP USER IF EXISTS 'switchuser'@'%'")
-        expect(sql[1]).toContain("CREATE USER 'switchuser'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'")
+        expect(sql[1]).toContain(
+          "CREATE USER 'switchuser'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'"
+        )
         expect(sql[2]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'switchuser'@'%'")
         expect(sql[3]).toBe("FLUSH PRIVILEGES")
       })
@@ -154,11 +172,18 @@ describe("MySQL Engine", () => {
           DatabaseName: "testdb",
         }
 
-        const sql = await engine.updateRole("switchuser", "switchuser", newProps, oldProps)
+        const sql = await engine.updateRole(
+          "switchuser",
+          "switchuser",
+          newProps,
+          oldProps
+        )
 
         expect(Array.isArray(sql)).toBe(true)
         expect(sql[0]).toContain("DROP USER IF EXISTS 'switchuser'@'%'")
-        expect(sql[1]).toContain("CREATE USER 'switchuser'@'%' IDENTIFIED BY 'new-password'")
+        expect(sql[1]).toContain(
+          "CREATE USER 'switchuser'@'%' IDENTIFIED BY 'new-password'"
+        )
         expect(sql[2]).toContain("GRANT ALL PRIVILEGES ON `testdb`.* TO 'switchuser'@'%'")
         expect(sql[3]).toBe("FLUSH PRIVILEGES")
       })

package/lambda/engine.mysql.ts

@@ -1,13 +1,19 @@
 import * as fs from "fs"
 import { AbstractEngine, EngineConnectionConfig } from "./engine.abstract"
+import {
+  EngineDatabaseProperties,
+  EngineRoleProperties,
+  EngineSchemaProperties,
+  EngineSqlProperties,
+} from "./types"
 
 export class MysqlEngine extends AbstractEngine {
-  createDatabase(resourceId: string, props?: any): string[] {
+  createDatabase(resourceId: string, props: EngineDatabaseProperties): string[] {
     const sql = [`CREATE DATABASE IF NOT EXISTS \`${resourceId}\``]
 
-    if (props?.Owner) {
+    if (props.Owner) {
       sql.push(`GRANT ALL PRIVILEGES ON \`${resourceId}\`.* TO '${props.Owner}'@'%'`)
-      sql.push(`FLUSH PRIVILEGES`)
+      sql.push("FLUSH PRIVILEGES")
     }
 
     return sql
@@ -21,9 +27,9 @@ export class MysqlEngine extends AbstractEngine {
     return [`DROP DATABASE IF EXISTS \`${resourceId}\``]
   }
 
-  async createRole(resourceId: string, props?: any): Promise<string[]> {
+  async createRole(resourceId: string, props: EngineRoleProperties): Promise<string[]> {
     const sql: string[] = []
-    
+
     if (props.EnableIamAuth) {
       // Create user for IAM authentication
       sql.push(
@@ -34,7 +40,7 @@ export class MysqlEngine extends AbstractEngine {
       if (!props.PasswordArn) throw new Error("No PasswordArn provided")
       const password = await this.getPassword(props.PasswordArn)
       if (!password) throw `Cannot parse password from ${props.PasswordArn}`
-      
+
       sql.push(
         `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY '${password}'`
       )
@@ -45,22 +51,22 @@ export class MysqlEngine extends AbstractEngine {
         `GRANT ALL PRIVILEGES ON \`${props.DatabaseName}\`.* TO '${resourceId}'@'%'`
       )
     }
-    
-    sql.push(`FLUSH PRIVILEGES`)
+
+    sql.push("FLUSH PRIVILEGES")
     return sql
   }
 
   async updateRole(
     resourceId: string,
     oldResourceId: string,
-    props?: any,
-    oldProps?: any
+    props: EngineRoleProperties,
+    oldProps: EngineRoleProperties
   ): Promise<string[]> {
     const sql: string[] = []
 
     if (oldResourceId !== resourceId) {
       // MySQL doesn't allow renaming users directly, we need to create a new one and drop the old one
-      if (props?.EnableIamAuth) {
+      if (props.EnableIamAuth) {
         // Create new user with IAM auth
         sql.push(
           `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
@@ -124,13 +130,13 @@ export class MysqlEngine extends AbstractEngine {
     }
 
     if (sql.length > 0) {
-      sql.push(`FLUSH PRIVILEGES`)
+      sql.push("FLUSH PRIVILEGES")
     }
 
     return sql
   }
 
-  deleteRole(resourceId: string, props?: any): string[] {
+  deleteRole(resourceId: string, props: EngineRoleProperties): string[] {
     const sql: string[] = []
 
     if (props?.DatabaseName) {
@@ -140,33 +146,41 @@ export class MysqlEngine extends AbstractEngine {
     }
 
     sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`)
-    sql.push(`FLUSH PRIVILEGES`)
+    sql.push("FLUSH PRIVILEGES")
 
     return sql
   }
 
-  createSchema(_resourceId: string, _props?: any): string[] {
+  createSchema(_resourceId: string, _props: EngineSchemaProperties): string[] {
     throw new Error("Schemas are not supported in MySQL/MariaDB")
   }
 
-  updateSchema(_resourceId: string, _oldResourceId: string, _props?: any): string[] {
+  updateSchema(
+    _resourceId: string,
+    _oldResourceId: string,
+    _props: EngineSchemaProperties
+  ): string[] {
     throw new Error("Schemas are not supported in MySQL/MariaDB")
   }
 
-  deleteSchema(_resourceId: string, _props?: any): string[] {
+  deleteSchema(_resourceId: string, _props: EngineSchemaProperties): string[] {
     throw new Error("Schemas are not supported in MySQL/MariaDB")
   }
 
-  createSql(_resourceId: string, props?: any): string {
-    return props.Statement
+  createSql(_resourceId: string, props: EngineSqlProperties): string {
+    return props?.Statement || ""
   }
 
-  updateSql(_resourceId: string, _oldResourceId: string, props?: any): string {
-    return props.Statement
+  updateSql(
+    _resourceId: string,
+    _oldResourceId: string,
+    props: EngineSqlProperties
+  ): string {
+    return props?.Statement || ""
   }
 
-  deleteSql(_resourceId: string, props?: any): string {
-    return props.Rollback
+  deleteSql(_resourceId: string, props: EngineSqlProperties): string {
+    return props?.Rollback || ""
   }
 
   async executeSQL(sql: string | string[], config: EngineConnectionConfig): Promise<any> {
@@ -207,9 +221,9 @@ export class MysqlEngine extends AbstractEngine {
     const connection = await createConnection(connectionConfig)
     try {
       if (typeof sql === "string") {
-        return connection.query(sql)
+        return await connection.query(sql)
       } else if (sql) {
-        return Promise.all(sql.map((statement) => connection.query(statement)))
+        return await Promise.all(sql.map((statement) => connection.query(statement)))
       }
     } finally {
       await connection.end()

package/lambda/engine.postgresql.test.ts

@@ -58,8 +58,8 @@ describe("PostgreSQL Engine", () => {
 
         expect(Array.isArray(sql)).toBe(true)
         expect(sql[0]).toBe("start transaction")
-        expect(sql).toContain('create role iamrole with login')
-        expect(sql).toContain('grant rds_iam to iamrole')
+        expect(sql).toContain("create role iamrole with login")
+        expect(sql).toContain("grant rds_iam to iamrole")
         expect(sql[sql.length - 1]).toBe("commit")
       })
 
@@ -76,7 +76,9 @@ describe("PostgreSQL Engine", () => {
 
         expect(Array.isArray(sql)).toBe(true)
         expect(sql[0]).toBe("start transaction")
-        expect(sql).toContain('create role passwordrole with login password \'test-password\'')
+        expect(sql).toContain(
+          "create role passwordrole with login password 'test-password'"
+        )
         expect(sql[sql.length - 1]).toBe("commit")
       })
 
@@ -90,11 +92,16 @@ describe("PostgreSQL Engine", () => {
           EnableIamAuth: true,
         }
 
-        const sql = await engine.updateRole("switchrole", "switchrole", newProps, oldProps)
+        const sql = await engine.updateRole(
+          "switchrole",
+          "switchrole",
+          newProps,
+          oldProps
+        )
 
         expect(Array.isArray(sql)).toBe(true)
         expect(sql[0]).toBe("start transaction")
-        expect(sql).toContain('grant rds_iam to switchrole')
+        expect(sql).toContain("grant rds_iam to switchrole")
         expect(sql[sql.length - 1]).toBe("commit")
       })
 
@@ -110,12 +117,17 @@ describe("PostgreSQL Engine", () => {
           PasswordArn: "arn:aws:secretsmanager:region:account:secret:name",
         }
 
-        const sql = await engine.updateRole("switchrole", "switchrole", newProps, oldProps)
+        const sql = await engine.updateRole(
+          "switchrole",
+          "switchrole",
+          newProps,
+          oldProps
+        )
 
         expect(Array.isArray(sql)).toBe(true)
         expect(sql[0]).toBe("start transaction")
-        expect(sql).toContain('revoke rds_iam from switchrole')
-        expect(sql).toContain('alter role switchrole with password \'new-password\'')
+        expect(sql).toContain("revoke rds_iam from switchrole")
+        expect(sql).toContain("alter role switchrole with password 'new-password'")
         expect(sql[sql.length - 1]).toBe("commit")
       })
     })
@@ -125,7 +137,7 @@ describe("PostgreSQL Engine", () => {
   describe("Database", () => {
     it("should generate correct SQL for creating a database", () => {
       const sql = engine.createDatabase("testdb", {})
-      expect(sql).toContain('create database testdb')
+      expect(sql).toContain("create database testdb")
     })
   })