cdk-rds-sql 6.1.1 → 6.1.3

package/lambda/handler.mysql.test.ts

@@ -1,26 +1,13 @@
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"
 import { createConnection } from "mysql2/promise"
 import { GenericContainer, StartedTestContainer } from "testcontainers"
-import { createRequest, updateRequest, deleteRequest } from "./util"
 import { handler } from "./handler"
+import { createRequest, updateRequest, deleteRequest } from "./util"
 
 jest.mock("@aws-sdk/client-secrets-manager")
 const SecretsManagerClientMock = SecretsManagerClient as jest.MockedClass<
   typeof SecretsManagerClient
 >
-SecretsManagerClientMock.prototype.send.mockImplementation(() => {
-  return {
-    SecretString: JSON.stringify({
-      host: mysqlHost,
-      port: mysqlPort,
-      username: DB_MASTER_USERNAME,
-      password: DB_MASTER_PASSWORD,
-      dbname: DB_DEFAULT_DB,
-      engine: "mysql",
-      dbClusterIdentifier: "dummy",
-    }),
-  }
-})
 
 const DB_PORT = 3306
 const DB_MASTER_USERNAME = "root"
@@ -31,7 +18,7 @@ let mysqlContainer: StartedTestContainer
 let mysqlHost: string
 let mysqlPort: number
 
-beforeEach(async () => {
+beforeAll(async () => {
   process.env.LOGGER = "true"
   process.env.SSL = "false"
   process.env.CONNECTION_TIMEOUT = "5000"
@@ -45,26 +32,70 @@ beforeEach(async () => {
     .start()
   mysqlHost = mysqlContainer.getHost()
   mysqlPort = mysqlContainer.getMappedPort(DB_PORT)
-}, 30000)
 
-afterEach(async () => {
-  jest.clearAllMocks()
+  // Set up the mock after we have the host and port values
+  SecretsManagerClientMock.prototype.send.mockImplementation(() => {
+    return {
+      SecretString: JSON.stringify({
+        host: mysqlHost,
+        port: mysqlPort,
+        username: DB_MASTER_USERNAME,
+        password: DB_MASTER_PASSWORD,
+        dbname: DB_DEFAULT_DB,
+        engine: "mysql",
+        dbClusterIdentifier: "dummy",
+      }),
+    }
+  })
+}, 60000)
+
+afterAll(async () => {
   if (mysqlContainer) {
     await mysqlContainer.stop()
   }
 })
 
+beforeEach(async () => {
+  jest.clearAllMocks()
+
+  // Clean up databases and users created by tests
+  const connection = await newConnection()
+
+  try {
+    // Drop all databases except system ones and default
+    const [databases] = await connection.query(
+      "SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys', ?)",
+      [DB_DEFAULT_DB]
+    )
+
+    for (const db of databases) {
+      await connection.query(`DROP DATABASE IF EXISTS \`${db.SCHEMA_NAME}\``)
+    }
+
+    // Drop all users except system ones
+    const [users] = await connection.query(
+      "SELECT User FROM mysql.user WHERE User NOT IN ('mysql.sys', 'mysql.session', 'mysql.infoschema', 'root')"
+    )
+
+    for (const user of users) {
+      await connection.query(`DROP USER IF EXISTS '${user.User}'@'%'`)
+    }
+  } finally {
+    await connection.end()
+  }
+})
+
 // Helper functions for MySQL tests
 async function databaseExists(connection: any, dbName: string): Promise<boolean> {
   const [rows] = await connection.query(
-    `SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = ?`,
+    "SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME = ?",
     [dbName]
   )
   return rows.length > 0
 }
 
 async function userExists(connection: any, username: string): Promise<boolean> {
-  const [rows] = await connection.query(`SELECT User FROM mysql.user WHERE User = ?`, [
+  const [rows] = await connection.query("SELECT User FROM mysql.user WHERE User = ?", [
     username,
   ])
   return rows.length > 0
@@ -76,7 +107,7 @@ async function tableExists(
   tableName: string
 ): Promise<boolean> {
   const [rows] = await connection.query(
-    `SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = ? AND TABLE_NAME = ?`,
+    "SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = ? AND TABLE_NAME = ?",
     [dbName, tableName]
   )
   return rows.length > 0
@@ -103,7 +134,7 @@ test("database", async () => {
   const newDatabaseName = "mydb2"
   const create = createRequest("database", oldDatabaseName)
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(1)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(1)
   const connection = await newConnection()
   try {
     expect(await databaseExists(connection, oldDatabaseName)).toEqual(true)
@@ -188,7 +219,7 @@ describe("User creation", () => {
       DatabaseName: DB_DEFAULT_DB,
     })
     await handler(create)
-    expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+    expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
 
     const connection = await newConnection()
     try {
@@ -227,7 +258,7 @@ describe("User creation", () => {
       DatabaseName: DB_DEFAULT_DB,
     })
     await handler(create)
-    expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+    expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
 
     const connection = await newConnection()
     try {

package/lambda/handler.postgresql.test.ts

@@ -1,6 +1,7 @@
 import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"
 import { Client, ClientConfig } from "pg"
 import { GenericContainer, StartedTestContainer } from "testcontainers"
+import { handler } from "./handler"
 import {
   createRequest,
   updateRequest,
@@ -12,7 +13,6 @@ import {
   rowCount,
   roleGrantedForSchema,
 } from "./util"
-import { handler } from "./handler"
 
 jest.mock("@aws-sdk/client-secrets-manager")
 const SecretsManagerClientMock = SecretsManagerClient as jest.MockedClass<
@@ -41,7 +41,7 @@ let pgContainer: StartedTestContainer
 let pgHost: string
 let pgPort: number
 
-beforeEach(async () => {
+beforeAll(async () => {
   process.env.LOGGER = "true"
   process.env.SSL = "false"
   process.env.CONNECTION_TIMEOUT = "5000"
@@ -55,15 +55,62 @@ beforeEach(async () => {
     .start()
   pgHost = pgContainer.getHost()
   pgPort = pgContainer.getMappedPort(DB_PORT)
-}, 30000)
+}, 60000)
 
-afterEach(async () => {
-  jest.clearAllMocks()
+afterAll(async () => {
   if (pgContainer) {
     await pgContainer.stop()
   }
 })
 
+beforeEach(async () => {
+  jest.clearAllMocks()
+
+  // Clean up databases, schemas, and roles created by tests
+  const client = new Client({
+    host: pgHost,
+    port: pgPort,
+    database: DB_DEFAULT_DB,
+    user: DB_MASTER_USERNAME,
+    password: DB_MASTER_PASSWORD,
+  })
+
+  await client.connect()
+
+  try {
+    // Drop all databases except system ones and default
+    const databases = await client.query(
+      "SELECT datname FROM pg_database WHERE datistemplate = false AND datname != $1",
+      [DB_DEFAULT_DB]
+    )
+
+    for (const db of databases.rows) {
+      await client.query(`DROP DATABASE IF EXISTS "${db.datname}"`)
+    }
+
+    // Drop all schemas except system ones
+    const schemas = await client.query(
+      "SELECT schema_name FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema', 'pg_catalog', 'pg_toast', 'public')"
+    )
+
+    for (const schema of schemas.rows) {
+      await client.query(`DROP SCHEMA IF EXISTS "${schema.schema_name}" CASCADE`)
+    }
+
+    // Drop all roles except system ones
+    const roles = await client.query(
+      "SELECT rolname FROM pg_roles WHERE rolname NOT LIKE 'pg_%' AND rolname != $1",
+      [DB_MASTER_USERNAME]
+    )
+
+    for (const role of roles.rows) {
+      await client.query(`DROP ROLE IF EXISTS "${role.rolname}"`)
+    }
+  } finally {
+    await client.end()
+  }
+})
+
 //jest.setTimeout(ms("15s"))
 
 test("schema", async () => {
@@ -71,7 +118,7 @@ test("schema", async () => {
   const newSchemaName = "test2"
   const create = createRequest("schema", oldSchemaName)
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(1)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(1)
 
   const client = await newClient()
   try {
@@ -128,7 +175,7 @@ test("role with existing database", async () => {
     DatabaseName: "postgres",
   })
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
   const client = await newClient()
   try {
     expect(await roleExists(client, oldRoleName)).toEqual(true)
@@ -165,7 +212,7 @@ test("role without database", async () => {
     PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
   })
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
   const client = await newClient()
   try {
     expect(await roleExists(client, roleName)).toEqual(true)
@@ -180,7 +227,7 @@ test("change role password", async () => {
     PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
   })
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(2)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(2)
   const client = await newClient()
   try {
     expect(await roleExists(client, roleName)).toEqual(true)
@@ -198,7 +245,7 @@ test("database", async () => {
   const newDatabaseName = "mydb2"
   const create = createRequest("database", oldDatabaseName)
   await handler(create)
-  expect(SecretsManagerClientMock).toHaveBeenCalledTimes(1)
+  expect(SecretsManagerClientMock.prototype.send).toHaveBeenCalledTimes(1)
   const client = await newClient()
   try {
     expect(await databaseExists(client, oldDatabaseName)).toEqual(true)

package/lambda/handler.test.ts

@@ -0,0 +1,164 @@
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"
+import { MysqlEngine } from "./engine.mysql"
+import { PostgresqlEngine } from "./engine.postgresql"
+import { handler } from "./handler"
+import { createRequest } from "./util"
+
+// Mock the secrets manager client
+jest.mock("@aws-sdk/client-secrets-manager")
+const SecretsManagerClientMock = SecretsManagerClient as jest.MockedClass<
+  typeof SecretsManagerClient
+>
+
+// Mock the database engines
+jest.mock("./engine.mysql")
+jest.mock("./engine.postgresql")
+
+const MockedMysqlEngine = MysqlEngine as jest.MockedClass<typeof MysqlEngine>
+const MockedPostgresqlEngine = PostgresqlEngine as jest.MockedClass<
+  typeof PostgresqlEngine
+>
+
+describe("Handler CloudFormation Property Conversion", () => {
+  let mockMysqlEngine: jest.Mocked<MysqlEngine>
+  let mockPostgresqlEngine: jest.Mocked<PostgresqlEngine>
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+
+    // Mock the engine instances
+    mockMysqlEngine = {
+      createRole: jest.fn(),
+      executeSQL: jest.fn(),
+    } as any
+
+    mockPostgresqlEngine = {
+      createRole: jest.fn(),
+      executeSQL: jest.fn(),
+    } as any
+
+    MockedMysqlEngine.mockImplementation(() => mockMysqlEngine)
+    MockedPostgresqlEngine.mockImplementation(() => mockPostgresqlEngine)
+
+    // Mock secrets manager to return MySQL engine
+    SecretsManagerClientMock.prototype.send.mockImplementation(() => {
+      return Promise.resolve({
+        SecretString: JSON.stringify({
+          host: "localhost",
+          port: 3306,
+          username: "root",
+          password: "password",
+          dbname: "test",
+          engine: "mysql",
+        }),
+      })
+    })
+  })
+
+  describe("EnableIamAuth property conversion", () => {
+    it("should convert string 'false' to boolean false", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request with EnableIamAuth as string 'false' (simulating CloudFormation)
+      const request = createRequest("role", "testuser", {
+        EnableIamAuth: "false",
+        PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called with boolean false, not string 'false'
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          EnableIamAuth: false, // Should be converted to boolean false
+          PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+        })
+      )
+    })
+
+    it("should convert string 'true' to boolean true", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request with EnableIamAuth as string 'true' (simulating CloudFormation)
+      const request = createRequest("role", "testuser", {
+        EnableIamAuth: "true", // CloudFormation passes boolean as string
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called with boolean true, not string 'true'
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          EnableIamAuth: true, // Should be converted to boolean true
+        })
+      )
+    })
+
+    it("should handle number 0 correctly", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request with EnableIamAuth as actual boolean false
+      const request = createRequest("role", "testuser", {
+        EnableIamAuth: "0",
+        PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called with boolean false
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          EnableIamAuth: false,
+          PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+        })
+      )
+    })
+
+    it("should handle number 1 correctly", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request with EnableIamAuth as actual boolean true
+      const request = createRequest("role", "testuser", {
+        EnableIamAuth: "1",
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called with boolean true
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          EnableIamAuth: true,
+        })
+      )
+    })
+
+    it("should handle undefined EnableIamAuth correctly", async () => {
+      mockMysqlEngine.createRole.mockResolvedValue(["CREATE USER test"])
+      mockMysqlEngine.executeSQL.mockResolvedValue({})
+
+      // Create a request without EnableIamAuth property
+      const request = createRequest("role", "testuser", {
+        PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+      })
+
+      await handler(request)
+
+      // Verify that createRole was called without EnableIamAuth
+      expect(mockMysqlEngine.createRole).toHaveBeenCalledWith(
+        "testuser",
+        expect.objectContaining({
+          PasswordArn: "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
+          EnableIamAuth: false,
+        })
+      )
+    })
+  })
+})

package/lambda/handler.ts

@@ -15,10 +15,17 @@ import {
   CloudFormationCustomResourceDeleteEvent,
 } from "aws-lambda"
 import { backOff } from "exponential-backoff"
-import { EngineFactory } from "./engine.factory"
 import { EngineConnectionConfig } from "./engine.abstract"
+import { EngineFactory } from "./engine.factory"
+import {
+  ResourceProperties,
+  CustomResourceResponse,
+  EngineDatabaseProperties,
+  EngineRoleProperties,
+  EngineSchemaProperties,
+  EngineSqlProperties,
+} from "./types"
 import { RdsSqlResource } from "../src/enum"
-import { ResourceProperties, CustomResourceResponse } from "./types"
 
 const maxAttempts = 20
 
@@ -29,6 +36,40 @@ const log =
 
 const secrets_client = new SecretsManagerClient({})
 
+// Helper functions to extract engine properties from CloudFormation properties
+// These functions throw if the resource type doesn't match the expected type
+function toDatabaseEngineProps(props: ResourceProperties): EngineDatabaseProperties {
+  if (props.Resource !== RdsSqlResource.DATABASE) {
+    throw new Error(`Expected DATABASE resource, got ${props.Resource}`)
+  }
+  return props
+}
+
+function toRoleEngineProps(props: ResourceProperties): EngineRoleProperties {
+  if (props.Resource !== RdsSqlResource.ROLE) {
+    throw new Error(`Expected ROLE resource, got ${props.Resource}`)
+  }
+  // Convert string 'true'/'false' to boolean for EnableIamAuth
+  return {
+    ...props,
+    EnableIamAuth: props.EnableIamAuth === "true" || props.EnableIamAuth === "1",
+  }
+}
+
+function toSchemaEngineProps(props: ResourceProperties): EngineSchemaProperties {
+  if (props.Resource !== RdsSqlResource.SCHEMA) {
+    throw new Error(`Expected SCHEMA resource, got ${props.Resource}`)
+  }
+  return props
+}
+
+function toSqlEngineProps(props: ResourceProperties): EngineSqlProperties {
+  if (props.Resource !== RdsSqlResource.SQL) {
+    throw new Error(`Expected SQL resource, got ${props.Resource}`)
+  }
+  return props
+}
+
 export const handler = async (
   event:
     | CloudFormationCustomResourceCreateEvent<ResourceProperties>
@@ -82,16 +123,25 @@ export const handler = async (
     case "Create": {
       switch (resource) {
         case RdsSqlResource.DATABASE:
-          sql = dbEngine.createDatabase(resourceId, event.ResourceProperties)
+          sql = dbEngine.createDatabase(
+            resourceId,
+            toDatabaseEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.ROLE:
-          sql = await dbEngine.createRole(resourceId, event.ResourceProperties)
+          sql = await dbEngine.createRole(
+            resourceId,
+            toRoleEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SCHEMA:
-          sql = dbEngine.createSchema(resourceId, event.ResourceProperties)
+          sql = dbEngine.createSchema(
+            resourceId,
+            toSchemaEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SQL:
-          sql = dbEngine.createSql(resourceId, event.ResourceProperties)
+          sql = dbEngine.createSql(resourceId, toSqlEngineProps(event.ResourceProperties))
           break
         case RdsSqlResource.PARAMETER_PASSWORD:
           await handleParameterPassword(event.ResourceProperties)
@@ -104,24 +154,35 @@ export const handler = async (
         .PhysicalResourceId
       switch (resource) {
         case RdsSqlResource.DATABASE:
+          const dbProps = toDatabaseEngineProps(event.ResourceProperties)
           sql = dbEngine.updateDatabase(resourceId, oldResourceId, {
-            ...event.ResourceProperties,
+            ...dbProps,
             MasterOwner: secretValues.username,
           })
           break
         case RdsSqlResource.ROLE:
+          const updateEvent =
+            event as CloudFormationCustomResourceUpdateEvent<ResourceProperties>
           sql = await dbEngine.updateRole(
             resourceId,
             oldResourceId,
-            event.ResourceProperties,
-            (event as CloudFormationCustomResourceUpdateEvent).OldResourceProperties
+            toRoleEngineProps(event.ResourceProperties),
+            toRoleEngineProps(updateEvent.OldResourceProperties)
           )
           break
         case RdsSqlResource.SCHEMA:
-          sql = dbEngine.updateSchema(resourceId, oldResourceId, event.ResourceProperties)
+          sql = dbEngine.updateSchema(
+            resourceId,
+            oldResourceId,
+            toSchemaEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SQL:
-          sql = dbEngine.updateSql(resourceId, oldResourceId, event.ResourceProperties)
+          sql = dbEngine.updateSql(
+            resourceId,
+            oldResourceId,
+            toSqlEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.PARAMETER_PASSWORD:
           await handleParameterPassword(event.ResourceProperties)
@@ -136,13 +197,19 @@ export const handler = async (
           sql = dbEngine.deleteDatabase(resourceId, secretValues.username)
           break
         case RdsSqlResource.ROLE:
-          sql = dbEngine.deleteRole(resourceId, event.ResourceProperties)
+          sql = dbEngine.deleteRole(
+            resourceId,
+            toRoleEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SCHEMA:
-          sql = dbEngine.deleteSchema(resourceId, event.ResourceProperties)
+          sql = dbEngine.deleteSchema(
+            resourceId,
+            toSchemaEngineProps(event.ResourceProperties)
+          )
           break
         case RdsSqlResource.SQL:
-          sql = dbEngine.deleteSql(resourceId, event.ResourceProperties)
+          sql = dbEngine.deleteSql(resourceId, toSqlEngineProps(event.ResourceProperties))
           break
         case RdsSqlResource.PARAMETER_PASSWORD:
           await deleteParameterPassword(event.ResourceProperties)

package/lambda/types.ts

@@ -1,7 +1,30 @@
 import { CloudFormationCustomResourceResourcePropertiesCommon } from "aws-lambda"
 import { RdsSqlResource } from "../src/enum"
 
-// Common properties shared by all resources
+// Engine-specific interfaces (business logic properties only)
+export interface EngineDatabaseProperties {
+  readonly Owner?: string
+  readonly MasterOwner?: string
+}
+
+export interface EngineRoleProperties {
+  readonly PasswordArn?: string
+  readonly DatabaseName?: string
+  readonly EnableIamAuth?: boolean
+}
+
+export interface EngineSchemaProperties {
+  readonly DatabaseName?: string
+  readonly RoleName?: string
+}
+
+export interface EngineSqlProperties {
+  readonly DatabaseName?: string
+  readonly Statement?: string
+  readonly Rollback?: string
+}
+
+// Common CloudFormation properties shared by all resources
 export interface CommonProperties
   extends CloudFormationCustomResourceResourcePropertiesCommon {
   readonly Resource: RdsSqlResource
@@ -9,32 +32,24 @@ export interface CommonProperties
   readonly SecretArn: string
 }
 
-// Database specific properties
-export interface DatabaseProperties extends CommonProperties {
+// CloudFormation-specific properties (engine properties + CloudFormation metadata)
+export interface DatabaseProperties extends CommonProperties, EngineDatabaseProperties {
   readonly Resource: RdsSqlResource.DATABASE
-  readonly Owner?: string
 }
 
-// Role specific properties
 export interface RoleProperties extends CommonProperties {
   readonly Resource: RdsSqlResource.ROLE
   readonly PasswordArn?: string
   readonly DatabaseName?: string
+  readonly EnableIamAuth?: string // CloudFormation passes boolean as string
 }
 
-// Schema specific properties
-export interface SchemaProperties extends CommonProperties {
+export interface SchemaProperties extends CommonProperties, EngineSchemaProperties {
   readonly Resource: RdsSqlResource.SCHEMA
-  readonly DatabaseName?: string
-  readonly RoleName?: string
 }
 
-// SQL specific properties
-export interface SqlProperties extends CommonProperties {
+export interface SqlProperties extends CommonProperties, EngineSqlProperties {
   readonly Resource: RdsSqlResource.SQL
-  readonly DatabaseName?: string
-  readonly Statement?: string
-  readonly Rollback?: string
 }
 
 // Parameter password specific properties

package/lambda/util.ts

@@ -25,7 +25,7 @@ export interface ResourcePropertiesInput {
 export const createRequest = (
   resource: string,
   resourceId: string,
-  props?: ResourcePropertiesInput
+  props?: Partial<ResourceProperties>
 ): CloudFormationCustomResourceCreateEvent<ResourceProperties> => {
   return {
     ServiceToken: "",
@@ -41,7 +41,7 @@ export const createRequest = (
       SecretArn:
         props?.SecretArn || "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
       ...props,
-    } as unknown as ResourceProperties,
+    },
     RequestType: "Create",
   }
 }