cdk-rds-sql 6.1.0 → 6.1.2

package/lambda/engine.postgresql.ts

@@ -3,9 +3,15 @@ import { ConnectionOptions } from "tls"
 import { format as pgFormat } from "node-pg-format"
 import { Client, ClientConfig } from "pg"
 import { AbstractEngine, EngineConnectionConfig } from "./engine.abstract"
+import {
+  EngineDatabaseProperties,
+  EngineRoleProperties,
+  EngineSchemaProperties,
+  EngineSqlProperties,
+} from "./types"
 
 export class PostgresqlEngine extends AbstractEngine {
-  createDatabase(resourceId: string, props?: any): string | string[] {
+  createDatabase(resourceId: string, props: EngineDatabaseProperties): string | string[] {
     const owner = props?.Owner
     if (owner) {
       return [
@@ -17,7 +23,11 @@ export class PostgresqlEngine extends AbstractEngine {
     }
   }
 
-  updateDatabase(resourceId: string, oldResourceId: string, props?: any): string[] {
+  updateDatabase(
+    resourceId: string,
+    oldResourceId: string,
+    props: EngineDatabaseProperties
+  ): string[] {
     const statements: string[] = []
     if (resourceId !== oldResourceId) {
       if (props?.MasterOwner) {
@@ -52,24 +62,24 @@ export class PostgresqlEngine extends AbstractEngine {
     ]
   }
 
-  async createRole(resourceId: string, props?: any): Promise<string[]> {
+  async createRole(resourceId: string, props: EngineRoleProperties): Promise<string[]> {
     const sql = ["start transaction"]
-    
-    if (props.EnableIamAuth) {
+
+    if (props?.EnableIamAuth) {
       // Create role for IAM authentication
       sql.push(pgFormat("create role %I with login", resourceId))
       sql.push(pgFormat("grant rds_iam to %I", resourceId))
     } else {
       // Create role with password authentication
-      if (!props.PasswordArn) throw "No PasswordArn provided"
+      if (!props?.PasswordArn) throw "No PasswordArn provided"
       const password = await this.getPassword(props.PasswordArn)
       if (!password) {
         throw `Cannot parse password from ${props.PasswordArn}`
       }
       sql.push(pgFormat("create role %I with login password %L", resourceId, password))
     }
-    
-    if (props.DatabaseName) {
+
+    if (props?.DatabaseName) {
       sql.push(
         pgFormat(
           `DO $$
@@ -84,7 +94,7 @@ END$$;`,
         )
       )
     }
-    
+
     sql.push("commit")
     return sql
   }
@@ -92,15 +102,15 @@ END$$;`,
   async updateRole(
     resourceId: string,
     oldResourceId: string,
-    props?: any,
-    oldProps?: any
+    props: EngineRoleProperties,
+    oldProps: EngineRoleProperties
   ): Promise<string[]> {
     const sql = ["start transaction"]
-    
+
     if (oldResourceId !== resourceId) {
       sql.push(pgFormat("alter role %I rename to %I", oldResourceId, resourceId))
     }
-    
+
     // Handle authentication method changes
     if (props?.EnableIamAuth && !oldProps?.EnableIamAuth) {
       // Switching from password to IAM auth
@@ -123,7 +133,7 @@ END$$;`,
       }
       sql.push(pgFormat("alter role %I with password %L", resourceId, password))
     }
-    
+
     // Check if database name has changed
     if (
       oldProps?.DatabaseName &&
@@ -161,12 +171,12 @@ END$$;`,
         )
       )
     }
-    
+
     sql.push("commit")
     return sql
   }
 
-  deleteRole(resourceId: string, props?: any): string[] {
+  deleteRole(resourceId: string, props: EngineRoleProperties): string[] {
     return [
       "start transaction",
       pgFormat(
@@ -186,7 +196,7 @@ END$$;`,
     ]
   }
 
-  createSchema(resourceId: string, props?: any): string[] {
+  createSchema(resourceId: string, props: EngineSchemaProperties): string[] {
     const sql: string[] = [pgFormat("create schema if not exists %I", resourceId)]
     if (props?.RoleName) {
       this.grantRoleForSchema(resourceId, props.RoleName).forEach((stmt) =>
@@ -196,7 +206,11 @@ END$$;`,
     return sql
   }
 
-  updateSchema(resourceId: string, oldResourceId: string, props?: any): string[] {
+  updateSchema(
+    resourceId: string,
+    oldResourceId: string,
+    props: EngineSchemaProperties
+  ): string[] {
     const sql: string[] = []
     if (props?.RoleName) {
       this.revokeRoleFromSchema(oldResourceId, props.RoleName).forEach((stmt) =>
@@ -212,7 +226,7 @@ END$$;`,
     return sql
   }
 
-  deleteSchema(resourceId: string, props?: any): string[] {
+  deleteSchema(resourceId: string, props: EngineSchemaProperties): string[] {
     const sql: string[] = []
     if (props?.RoleName) {
       this.revokeRoleFromSchema(resourceId, props.RoleName).forEach((stmt) =>
@@ -223,16 +237,20 @@ END$$;`,
     return sql
   }
 
-  createSql(_resourceId: string, props?: any): string {
-    return props.Statement
+  createSql(_resourceId: string, props: EngineSqlProperties): string {
+    return props?.Statement || ""
   }
 
-  updateSql(_resourceId: string, _oldResourceId: string, props?: any): string {
-    return props.Statement
+  updateSql(
+    _resourceId: string,
+    _oldResourceId: string,
+    props: EngineSqlProperties
+  ): string {
+    return props?.Statement || ""
   }
 
-  deleteSql(_resourceId: string, props?: any): string {
-    return props.Rollback
+  deleteSql(_resourceId: string, props: EngineSqlProperties): string {
+    return props?.Rollback || ""
   }
 
   private grantRoleForSchema(schema: string, roleName: string): string[] {

package/lambda/handler.mysql.test.ts

@@ -1,26 +1,13 @@
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"
 import { createConnection } from "mysql2/promise"
 import { GenericContainer, StartedTestContainer } from "testcontainers"
-import { createRequest, updateRequest, deleteRequest } from "./util"
 import { handler } from "./handler"
+import { createRequest, updateRequest, deleteRequest } from "./util"
 
 jest.mock("@aws-sdk/client-secrets-manager")
 const SecretsManagerClientMock = SecretsManagerClient as jest.MockedClass<
   typeof SecretsManagerClient
 >
-SecretsManagerClientMock.prototype.send.mockImplementation(() => {
-  return {
-    SecretString: JSON.stringify({
-      host: mysqlHost,
-      port: mysqlPort,
-      username: DB_MASTER_USERNAME,
-      password: DB_MASTER_PASSWORD,
-      dbname: DB_DEFAULT_DB,
-      engine: "mysql",
-      dbClusterIdentifier: "dummy",
-    }),
-  }
-})
 
 const DB_PORT = 3306
 const DB_MASTER_USERNAME = "root"
@@ -45,6 +32,21 @@ beforeEach(async () => {
     .start()
   mysqlHost = mysqlContainer.getHost()
   mysqlPort = mysqlContainer.getMappedPort(DB_PORT)
+
+  // Set up the mock after we have the host and port values
+  SecretsManagerClientMock.prototype.send.mockImplementation(() => {
+    return {
+      SecretString: JSON.stringify({
+        host: mysqlHost,
+        port: mysqlPort,
+        username: DB_MASTER_USERNAME,
+        password: DB_MASTER_PASSWORD,
+        dbname: DB_DEFAULT_DB,
+        engine: "mysql",
+        dbClusterIdentifier: "dummy",
+      }),
+    }
+  })
 }, 30000)
 
 afterEach(async () => {
@@ -57,14 +59,14 @@ afterEach(async () => {
 // Helper functions for MySQL tests
 async function databaseExists(connection: any, dbName: string): Promise<boolean> {
   const [rows] = await connection.query(
-    `SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = ?`,
+    "SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = ?",
     [dbName]
   )
   return rows.length > 0
 }
 
 async function userExists(connection: any, username: string): Promise<boolean> {
-  const [rows] = await connection.query(`SELECT User FROM mysql.user WHERE User = ?`, [
+  const [rows] = await connection.query("SELECT User FROM mysql.user WHERE User = ?", [
     username,
   ])
   return rows.length > 0
@@ -76,7 +78,7 @@ async function tableExists(
   tableName: string
 ): Promise<boolean> {
   const [rows] = await connection.query(
-    `SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = ? AND TABLE_NAME = ?`,
+    "SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = ? AND TABLE_NAME = ?",
     [dbName, tableName]
   )
   return rows.length > 0
@@ -103,7 +105,7 @@ test("database", async () => {
   const newDatabaseName = "mydb2"
   const create = createRequest("database", oldDatabaseName)
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(1)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(1)
   const connection = await newConnection()
   try {
     expect(await databaseExists(connection, oldDatabaseName)).toEqual(true)
@@ -188,7 +190,7 @@ describe("User creation", () => {
       DatabaseName: DB_DEFAULT_DB,
     })
     await handler(create)
-    expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+    expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
 
     const connection = await newConnection()
     try {
@@ -227,7 +229,7 @@ describe("User creation", () => {
       DatabaseName: DB_DEFAULT_DB,
     })
     await handler(create)
-    expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+    expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
 
     const connection = await newConnection()
     try {

package/lambda/handler.postgresql.test.ts

@@ -1,6 +1,7 @@
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"
 import { Client, ClientConfig } from "pg"
 import { GenericContainer, StartedTestContainer } from "testcontainers"
+import { handler } from "./handler"
 import {
   createRequest,
   updateRequest,
@@ -12,7 +13,6 @@ import {
   rowCount,
   roleGrantedForSchema,
 } from "./util"
-import { handler } from "./handler"
 
 jest.mock("@aws-sdk/client-secrets-manager")
 const SecretsManagerClientMock = SecretsManagerClient as jest.MockedClass<
@@ -71,7 +71,7 @@ test("schema", async () => {
   const newSchemaName = "test2"
   const create = createRequest("schema", oldSchemaName)
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(1)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(1)
 
   const client = await newClient()
   try {
@@ -128,7 +128,7 @@ test("role with existing database", async () => {
     DatabaseName: "postgres",
   })
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
   const client = await newClient()
   try {
     expect(await roleExists(client, oldRoleName)).toEqual(true)
@@ -165,7 +165,7 @@ test("role without database", async () => {
     PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
   })
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
   const client = await newClient()
   try {
     expect(await roleExists(client, roleName)).toEqual(true)
@@ -180,7 +180,7 @@ test("change role password", async () => {
     PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
   })
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
   const client = await newClient()
   try {
     expect(await roleExists(client, roleName)).toEqual(true)
@@ -198,7 +198,7 @@ test("database", async () => {
   const newDatabaseName = "mydb2"
   const create = createRequest("database", oldDatabaseName)
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(1)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(1)
   const client = await newClient()
   try {
     expect(await databaseExists(client, oldDatabaseName)).toEqual(true)

package/lambda/handler.test.ts

@@ -0,0 +1,164 @@
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"
+import { MysqlEngine } from "./engine.mysql"
+import { PostgresqlEngine } from "./engine.postgresql"
+import { handler } from "./handler"
+import { createRequest } from "./util"
+
+// Mock the secrets manager client
+jest.mock("@aws-sdk/client-secrets-manager")
+const SecretsManagerClientMock = SecretsManagerClient as jest.MockedClass<
+  typeof SecretsManagerClient
+>
+
+// Mock the database engines
+jest.mock("./engine.mysql")
+jest.mock("./engine.postgresql")
+
+const MockedMysqlEngine = MysqlEngine as jest.MockedClass<typeof MysqlEngine>
+const MockedPostgresqlEngine = PostgresqlEngine as jest.MockedClass<
+  typeof PostgresqlEngine
+>
+
+describe("Handler CloudFormation Property Conversion", () => {
+  let mockMysqlEngine: jest.Mocked<MysqlEngine>
+  let mockPostgresqlEngine: jest.Mocked<PostgresqlEngine>
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+
+    // Mock the engine instances
+    mockMysqlEngine = {
+      createRole: jest.fn(),
+      executeSQL: jest.fn(),
+    } as any
+
+    mockPostgresqlEngine = {
+      createRole: jest.fn(),
+      executeSQL: jest.fn(),
+    } as any
+
+    MockedMysqlEngine.mockImplementation(() => mockMysqlEngine)
+    MockedPostgresqlEngine.mockImplementation(() => mockPostgresqlEngine)
+
+    // Mock secrets manager to return MySQL engine
+    SecretsManagerClientMock.prototype.send.mockImplementation(() => {
+      return Promise.resolve({
+        SecretString: JSON.stringify({
+          host: "localhost",
+          port: 3306,
+          username: "root",
+          password: "password",
+          dbname: "test",
+          engine: "mysql",
+        }),
+      })
+    })
+  })
+
+  describe("EnableIamAuth property conversion", () => {
+    it("should convert string 'false' to boolean false", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request with EnableIamAuth as string 'false' (simulating CloudFormation)
+      const request = createRequest("role", "testuser", {
+        EnableIamAuth: "false",
+        PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called with boolean false, not string 'false'
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          EnableIamAuth: false, // Should be converted to boolean false
+          PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+        })
+      )
+    })
+
+    it("should convert string 'true' to boolean true", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request with EnableIamAuth as string 'true' (simulating CloudFormation)
+      const request = createRequest("role", "testuser", {
+        EnableIamAuth: "true", // CloudFormation passes boolean as string
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called with boolean true, not string 'true'
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          EnableIamAuth: true, // Should be converted to boolean true
+        })
+      )
+    })
+
+    it("should handle number 0 correctly", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request with EnableIamAuth as actual boolean false
+      const request = createRequest("role", "testuser", {
+        EnableIamAuth: "0",
+        PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called with boolean false
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          EnableIamAuth: false,
+          PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+        })
+      )
+    })
+
+    it("should handle number 1 correctly", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request with EnableIamAuth as actual boolean true
+      const request = createRequest("role", "testuser", {
+        EnableIamAuth: "1",
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called with boolean true
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          EnableIamAuth: true,
+        })
+      )
+    })
+
+    it("should handle undefined EnableIamAuth correctly", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request without EnableIamAuth property
+      const request = createRequest("role", "testuser", {
+        PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called without EnableIamAuth
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+          EnableIamAuth: false,
+        })
+      )
+    })
+  })
+})

package/lambda/handler.ts

@@ -15,10 +15,17 @@ import {
   CloudFormationCustomResourceDeleteEvent,
 } from "aws-lambda"
 import { backOff } from "exponential-backoff"
-import { EngineFactory } from "./engine.factory"
 import { EngineConnectionConfig } from "./engine.abstract"
+import { EngineFactory } from "./engine.factory"
+import {
+  ResourceProperties,
+  CustomResourceResponse,
+  EngineDatabaseProperties,
+  EngineRoleProperties,
+  EngineSchemaProperties,
+  EngineSqlProperties,
+} from "./types"
 import { RdsSqlResource } from "../src/enum"
-import { ResourceProperties, CustomResourceResponse } from "./types"
 
 const maxAttempts = 20
 
@@ -29,6 +36,40 @@ const log =
 
 const secrets_client = new SecretsManagerClient({})
 
+// Helper functions to extract engine properties from CloudFormation properties
+// These functions throw if the resource type doesn't match the expected type
+function toDatabaseEngineProps(props: ResourceProperties): EngineDatabaseProperties {
+  if (props.Resource !== RdsSqlResource.DATABASE) {
+    throw new Error(`Expected DATABASE resource, got ${props.Resource}`)
+  }
+  return props
+}
+
+function toRoleEngineProps(props: ResourceProperties): EngineRoleProperties {
+  if (props.Resource !== RdsSqlResource.ROLE) {
+    throw new Error(`Expected ROLE resource, got ${props.Resource}`)
+  }
+  // Convert string 'true'/'false' to boolean for EnableIamAuth
+  return {
+    ...props,
+    EnableIamAuth: props.EnableIamAuth === "true" || props.EnableIamAuth === "1",
+  }
+}
+
+function toSchemaEngineProps(props: ResourceProperties): EngineSchemaProperties {
+  if (props.Resource !== RdsSqlResource.SCHEMA) {
+    throw new Error(`Expected SCHEMA resource, got ${props.Resource}`)
+  }
+  return props
+}
+
+function toSqlEngineProps(props: ResourceProperties): EngineSqlProperties {
+  if (props.Resource !== RdsSqlResource.SQL) {
+    throw new Error(`Expected SQL resource, got ${props.Resource}`)
+  }
+  return props
+}
+
 export const handler = async (
   event:
     | CloudFormationCustomResourceCreateEvent<ResourceProperties>
@@ -82,16 +123,25 @@ export const handler = async (
     case "Create": {
       switch (resource) {
         case RdsSqlResource.DATABASE:
-          sql = dbEngine.createDatabase(resourceId, event.ResourceProperties)
+          sql = dbEngine.createDatabase(
+            resourceId,
+            toDatabaseEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.ROLE:
-          sql = await dbEngine.createRole(resourceId, event.ResourceProperties)
+          sql = await dbEngine.createRole(
+            resourceId,
+            toRoleEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SCHEMA:
-          sql = dbEngine.createSchema(resourceId, event.ResourceProperties)
+          sql = dbEngine.createSchema(
+            resourceId,
+            toSchemaEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SQL:
-          sql = dbEngine.createSql(resourceId, event.ResourceProperties)
+          sql = dbEngine.createSql(resourceId, toSqlEngineProps(event.ResourceProperties))
           break
         case RdsSqlResource.PARAMETER_PASSWORD:
           await handleParameterPassword(event.ResourceProperties)
@@ -104,24 +154,35 @@ export const handler = async (
         .PhysicalResourceId
       switch (resource) {
         case RdsSqlResource.DATABASE:
+          const dbProps = toDatabaseEngineProps(event.ResourceProperties)
           sql = dbEngine.updateDatabase(resourceId, oldResourceId, {
-            ...event.ResourceProperties,
+            ...dbProps,
             MasterOwner: secretValues.username,
           })
           break
         case RdsSqlResource.ROLE:
+          const updateEvent =
+            event as CloudFormationCustomResourceUpdateEvent<ResourceProperties>
           sql = await dbEngine.updateRole(
             resourceId,
             oldResourceId,
-            event.ResourceProperties,
-            (event as CloudFormationCustomResourceUpdateEvent).OldResourceProperties
+            toRoleEngineProps(event.ResourceProperties),
+            toRoleEngineProps(updateEvent.OldResourceProperties)
           )
           break
         case RdsSqlResource.SCHEMA:
-          sql = dbEngine.updateSchema(resourceId, oldResourceId, event.ResourceProperties)
+          sql = dbEngine.updateSchema(
+            resourceId,
+            oldResourceId,
+            toSchemaEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SQL:
-          sql = dbEngine.updateSql(resourceId, oldResourceId, event.ResourceProperties)
+          sql = dbEngine.updateSql(
+            resourceId,
+            oldResourceId,
+            toSqlEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.PARAMETER_PASSWORD:
           await handleParameterPassword(event.ResourceProperties)
@@ -136,13 +197,19 @@ export const handler = async (
           sql = dbEngine.deleteDatabase(resourceId, secretValues.username)
           break
         case RdsSqlResource.ROLE:
-          sql = dbEngine.deleteRole(resourceId, event.ResourceProperties)
+          sql = dbEngine.deleteRole(
+            resourceId,
+            toRoleEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SCHEMA:
-          sql = dbEngine.deleteSchema(resourceId, event.ResourceProperties)
+          sql = dbEngine.deleteSchema(
+            resourceId,
+            toSchemaEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SQL:
-          sql = dbEngine.deleteSql(resourceId, event.ResourceProperties)
+          sql = dbEngine.deleteSql(resourceId, toSqlEngineProps(event.ResourceProperties))
           break
         case RdsSqlResource.PARAMETER_PASSWORD:
           await deleteParameterPassword(event.ResourceProperties)