cdk-rds-sql 7.1.0 → 7.2.1

package/AGENTS.md

@@ -1,20 +1,117 @@
-AGENTS Guide for cdk-rds-sql (Projen-managed; edit `.projenrc.ts` and run `npx projen`.)
-
-- Build: `npx projen build` (full), `npx projen run build:handler` (Lambda only).
-- Test: `npx projen test`; watch: `npx projen test:watch`; typecheck: `npx projen typecheck`.
-- Single test file: `npx projen test -- lambda/engine.postgresql.test.ts`.
-- Single test by name: `npx projen test -- -t "creates schema"` (Jest 29).
-- Lint: `npx projen eslint`; format via Prettier pre-commit; fix: `npx eslint . --fix`.
-- Node: `>=22.14`; module: CommonJS; TS strict mode enabled.
-- Imports: use ES `import` (no `require`); order builtin→external; alphabetize A→Z.
-- Formatting: Prettier—no semicolons; double quotes; width 90; arrow-parens always; trailing commas es5; 2-space indent.
-- Types: enable `strict`; no implicit any; no unused locals/params; explicit types on public APIs.
-- Promises: no floating promises; use `await`; enforce `return-await`.
-- Naming: classes/interfaces PascalCase; functions/vars camelCase; constants UPPER_SNAKE only when truly constant.
-- Errors: throw `Error` with clear message; avoid silent catches; use narrow catches and rethrow with context.
-- Import hygiene: no duplicate imports; no unresolved or extraneous deps (tests/projen files allowed).
-- Member order: static first, then fields, constructor, methods (ESLint member-ordering).
-- CDK constructs: keep immutable props; avoid side effects in constructors.
-- Lambda handler: keep engine-specific logic in `lambda/engine.*`; handler orchestrates only.
-- Git hooks: pre-commit runs Prettier, `tsc --noEmit`, `projen compile`, and `jest` (coverage off).
-- Integration: deploy via `npx projen integ:deploy:postgresql:serverless` / `npx projen integ:deploy:mysql:serverless`; destroy: `npx projen integ:destroy:serverless`.
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+This is a projen managed project. It contains a CDK construct library for creating databases, schemas, and roles in Aurora Serverless v2, RDS Database Cluster, or Database Instance. It supports both PostgreSQL and MySQL databases and is designed for enterprise environments with isolated subnets.
+
+## Key Architecture
+
+### Core Components
+
+- **Provider**: Main construct that creates a Lambda function handler to execute database operations
+- **Role**: Creates database users/roles with optional IAM authentication
+- **Database**: Creates databases with optional ownership assignment
+- **Schema**: Creates database schemas with role permissions
+- **Sql**: Executes arbitrary SQL statements
+
+### Lambda Handler Architecture
+
+- **Engine Factory Pattern**: `lambda/engine.factory.ts` creates database-specific engines
+- **Abstract Engine**: `lambda/engine.abstract.ts` defines common interface
+- **Concrete Engines**: `lambda/engine.postgresql.ts` and `lambda/engine.mysql.ts`
+- **Main Handler**: `lambda/handler.ts` orchestrates CloudFormation custom resource operations
+
+The Lambda handler supports both PostgreSQL and MySQL databases, auto-detecting the engine type from the cluster/instance configuration.
+
+## Development Commands
+
+### Build and Test
+
+```bash
+# After changing .projenrc.ts
+npx projen
+
+# Build the project
+npx projen build
+
+# Run all tests
+npx projen test
+
+# Run tests in watch mode
+npx projen test:watch
+
+# Run linting
+npx projen eslint
+
+# Build only the Lambda handler
+npx projen build:handler
+```
+
+### Integration Testing
+
+```bash
+# Deploy PostgreSQL serverless test stack
+npx projen integ:deploy:postgresql:serverless
+
+# Deploy MySQL serverless test stack
+npx projen integ:deploy:mysql:serverless
+
+# Destroy test stack
+npx projen integ:destroy:serverless
+```
+
+## Testing Setup
+
+- **Framework**: Jest with TypeScript support
+- **Test Files**: Located in `test/` and `lambda/` directories
+- **Configuration**: See `jestOptions` in `.projenrc.ts`.
+- **Coverage**: Enabled with multiple reporters (json, lcov, clover, cobertura, text)
+
+## Database Engine Support
+
+### PostgreSQL
+
+- Uses `pg` library for connections
+- Supports schemas, roles, and databases
+- IAM authentication supported
+
+### MySQL
+
+- Uses `mysql2` library for connections
+- Creates users with '%' host for VPC compatibility
+- IAM authentication supported
+
+## Build Process
+
+The project uses projen for build management. Do not change files
+managed by projen, but instead change `.projenrc.ts`. After changing
+`.projenrc.ts` run `npx projen`.
+
+In particular:
+
+1. Do not change `package.json`.
+2. Do not change any of the github workflow files.
+
+Projen tasks:
+
+1. `pre-compile`: Transpiles Lambda handler using esbuild
+2. `compile`: TypeScript compilation
+3. `post-compile`: Copies handler to lib directory
+4. `eslint`: Runs linter
+5. `typecheck`: Runs typecheck
+
+## SSL/TLS Configuration
+
+- SSL is enabled by default
+- Global RDS certificate bundle is automatically downloaded during build
+- Can be disabled via `ssl: false` in Provider props
+
+## Key Dependencies
+
+- **AWS CDK**: v2.171.1
+- **Node.js**: >= 22.14
+- **TypeScript**: ~5.8
+- **Database Drivers**: pg (PostgreSQL), mysql2 (MySQL)
+- **AWS SDKs**: secrets-manager, ssm clients

package/lambda/engine.dsql.ts

@@ -61,40 +61,63 @@ export class DsqlEngine extends AbstractEngine {
     const sql = ["BEGIN"]
 
     if (oldResourceId !== resourceId) {
-      sql.push(pgFormat("ALTER ROLE %I RENAME TO %I", oldResourceId, resourceId))
+      // DSQL doesn't support RENAME, so we need to create new role and drop old one
+      // First create the new role
+      sql.push(pgFormat("CREATE ROLE %I WITH LOGIN", resourceId))
+
+      // Transfer database permissions from old to new role
+      if (oldProps?.DatabaseName) {
+        sql.push(
+          pgFormat(
+            "GRANT CONNECT ON DATABASE %I TO %I",
+            oldProps.DatabaseName,
+            resourceId
+          )
+        )
+      }
+
+      // Drop the old role
+      sql.push(pgFormat("DROP ROLE IF EXISTS %I", oldResourceId))
     }
 
-    // Handle database permission changes
-    if (
-      oldProps?.DatabaseName &&
-      props?.DatabaseName &&
-      oldProps.DatabaseName !== props.DatabaseName
-    ) {
-      // Revoke from old database and grant to new
-      sql.push(
-        pgFormat(
-          "REVOKE CONNECT ON DATABASE %I FROM %I",
-          oldProps.DatabaseName,
-          resourceId
+    // Handle database permission changes (only if role wasn't renamed, otherwise already handled above)
+    if (oldResourceId === resourceId) {
+      if (
+        oldProps?.DatabaseName &&
+        props?.DatabaseName &&
+        oldProps.DatabaseName !== props.DatabaseName
+      ) {
+        // Revoke from old database and grant to new
+        sql.push(
+          pgFormat(
+            "REVOKE CONNECT ON DATABASE %I FROM %I",
+            oldProps.DatabaseName,
+            resourceId
+          )
         )
-      )
-      sql.push(
-        pgFormat("GRANT CONNECT ON DATABASE %I TO %I", props.DatabaseName, resourceId)
-      )
-    } else if (props?.DatabaseName && !oldProps?.DatabaseName) {
-      // Grant to new database
+        sql.push(
+          pgFormat("GRANT CONNECT ON DATABASE %I TO %I", props.DatabaseName, resourceId)
+        )
+      } else if (props?.DatabaseName && !oldProps?.DatabaseName) {
+        // Grant to new database
+        sql.push(
+          pgFormat("GRANT CONNECT ON DATABASE %I TO %I", props.DatabaseName, resourceId)
+        )
+      } else if (!props?.DatabaseName && oldProps?.DatabaseName) {
+        // Revoke from old database
+        sql.push(
+          pgFormat(
+            "REVOKE CONNECT ON DATABASE %I FROM %I",
+            oldProps.DatabaseName,
+            resourceId
+          )
+        )
+      }
+    } else if (props?.DatabaseName && props.DatabaseName !== oldProps?.DatabaseName) {
+      // If role was renamed AND database changed, grant to new database
       sql.push(
         pgFormat("GRANT CONNECT ON DATABASE %I TO %I", props.DatabaseName, resourceId)
       )
-    } else if (!props?.DatabaseName && oldProps?.DatabaseName) {
-      // Revoke from old database
-      sql.push(
-        pgFormat(
-          "REVOKE CONNECT ON DATABASE %I FROM %I",
-          oldProps.DatabaseName,
-          resourceId
-        )
-      )
     }
 
     sql.push("COMMIT")

package/lambda/handler.ts

@@ -113,15 +113,17 @@ export const handler = async (
     }
   } else {
     // Traditional RDS configuration - use secrets
-    if (!event.ResourceProperties.SecretArn) {
-      throw "SecretArn is a required property"
+    // Use SecretArn from event properties, fallback to environment variable
+    const secretArn = event.ResourceProperties.SecretArn || process.env.SECRET_ARN
+    if (!secretArn) {
+      throw "SecretArn is required (not in event properties or environment)"
     }
 
     const command = new GetSecretValueCommand({
-      SecretId: event.ResourceProperties.SecretArn,
+      SecretId: secretArn,
     })
 
-    log(`Fetching secret ${event.ResourceProperties.SecretArn}`)
+    log(`Fetching secret ${secretArn}`)
     const secret: GetSecretValueCommandOutput = await backOff(
       async () => {
         try {
@@ -138,7 +140,7 @@ export const handler = async (
       }
     )
     if (!secret.SecretString) {
-      throw `No secret string in ${event.ResourceProperties.SecretArn}`
+      throw `No secret string in ${secretArn}`
     }
     secretValues = JSON.parse(secret.SecretString)
 

package/lib/database.d.ts

@@ -1,6 +1,6 @@
 import { CustomResource } from "aws-cdk-lib";
 import { Construct } from "constructs";
-import { Provider } from "./provider";
+import { IProvider } from "./provider";
 import { Role } from "./role";
 interface DatabaseAttributes {
     /**
@@ -16,7 +16,7 @@ export interface DatabaseProps extends DatabaseAttributes {
     /**
      * Provider.
      */
-    readonly provider: Provider;
+    readonly provider: IProvider;
 }
 export interface IDatabase {
     readonly databaseName: string;

package/lib/database.js

@@ -4,15 +4,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Database = void 0;
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
-const dsql = require("aws-cdk-lib/aws-dsql");
 const constructs_1 = require("constructs");
 const enum_1 = require("./enum");
-/**
- * Helper function to determine if a cluster is a DSQL cluster
- */
-function isDsqlCluster(cluster) {
-    return cluster instanceof dsql.CfnCluster;
-}
+const provider_1 = require("./provider");
 class ImportedDatabase extends constructs_1.Construct {
     constructor(scope, id, props) {
         super(scope, id);
@@ -30,7 +24,7 @@ class Database extends aws_cdk_lib_1.CustomResource {
     }
     constructor(scope, id, props) {
         // Check if using DSQL provider and forbid database creation
-        if (isDsqlCluster(props.provider.cluster)) {
+        if (props.provider.engine === provider_1.DatabaseEngine.DSQL) {
             throw new Error("Database creation is not supported with DSQL. DSQL always uses 'postgres' database.");
         }
         super(scope, id, {
@@ -51,5 +45,5 @@ class Database extends aws_cdk_lib_1.CustomResource {
 }
 exports.Database = Database;
 _a = JSII_RTTI_SYMBOL_1;
-Database[_a] = { fqn: "cdk-rds-sql.Database", version: "7.1.0" };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGF0YWJhc2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvZGF0YWJhc2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2Q0FBNEM7QUFDNUMsNkNBQTRDO0FBRTVDLDJDQUFzQztBQUN0QyxpQ0FBdUM7QUFJdkM7O0dBRUc7QUFDSCxTQUFTLGFBQWEsQ0FDcEIsT0FBK0Q7SUFFL0QsT0FBTyxPQUFPLFlBQVksSUFBSSxDQUFDLFVBQVUsQ0FBQTtBQUMzQyxDQUFDO0FBeUJELE1BQU0sZ0JBQWlCLFNBQVEsc0JBQVM7SUFHdEMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUF5QjtRQUNqRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBQ2hCLElBQUksQ0FBQyxZQUFZLEdBQUcsS0FBSyxDQUFDLFlBQVksQ0FBQTtJQUN4QyxDQUFDO0NBQ0Y7QUFFRCxNQUFhLFFBQVMsU0FBUSw0QkFBYztJQUMxQzs7T0FFRztJQUNILE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFnQixFQUFFLEVBQVUsRUFBRSxZQUFvQjtRQUN4RSxPQUFPLElBQUksZ0JBQWdCLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNyQyxZQUFZLEVBQUUsWUFBWTtTQUMzQixDQUFDLENBQUE7SUFDSixDQUFDO0lBSUQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFvQjtRQUM1RCw0REFBNEQ7UUFDNUQsSUFBSSxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzFDLE1BQU0sSUFBSSxLQUFLLENBQ2IscUZBQXFGLENBQ3RGLENBQUE7UUFDSCxDQUFDO1FBRUQsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixZQUFZLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxZQUFZO1lBQ3pDLFVBQVUsRUFBRTtnQkFDVixRQUFRLEVBQUUscUJBQWMsQ0FBQyxRQUFRO2dCQUNqQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFlBQVk7Z0JBQzlCLEdBQUcsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDaEYsS0FBSyxFQUFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsUUFBUTthQUM3QjtTQUNGLENBQUMsQ0FBQTtRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN2QyxJQUFJLENBQUMsWUFBWSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUE7UUFDdEMsSUFBSSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDaEIsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBQ3RDLENBQUM7SUFDSCxDQUFDOztBQWxDSCw0QkFtQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSB9IGZyb20gXCJhd3MtY2RrLWxpYlwiXG5pbXBvcnQgKiBhcyBkc3FsIGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtZHNxbFwiXG5pbXBvcnQgeyBJRGF0YWJhc2VDbHVzdGVyLCBJRGF0YWJhc2VJbnN0YW5jZSB9IGZyb20gXCJhd3MtY2RrLWxpYi9hd3MtcmRzXCJcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCJcbmltcG9ydCB7IFJkc1NxbFJlc291cmNlIH0gZnJvbSBcIi4vZW51bVwiXG5pbXBvcnQgeyBQcm92aWRlciB9IGZyb20gXCIuL3Byb3ZpZGVyXCJcbmltcG9ydCB7IFJvbGUgfSBmcm9tIFwiLi9yb2xlXCJcblxuLyoqXG4gKiBIZWxwZXIgZnVuY3Rpb24gdG8gZGV0ZXJtaW5lIGlmIGEgY2x1c3RlciBpcyBhIERTUUwgY2x1c3RlclxuICovXG5mdW5jdGlvbiBpc0RzcWxDbHVzdGVyKFxuICBjbHVzdGVyOiBJRGF0YWJhc2VDbHVzdGVyIHwgSURhdGFiYXNlSW5zdGFuY2UgfCBkc3FsLkNmbkNsdXN0ZXJcbik6IGNsdXN0ZXIgaXMgZHNxbC5DZm5DbHVzdGVyIHtcbiAgcmV0dXJuIGNsdXN0ZXIgaW5zdGFuY2VvZiBkc3FsLkNmbkNsdXN0ZXJcbn1cblxuaW50ZXJmYWNlIERhdGFiYXNlQXR0cmlidXRlcyB7XG4gIC8qKlxuICAgKiBOYW1lIG9mIGRhdGFiYXNlIHRvIGNyZWF0ZS5cbiAgICovXG4gIHJlYWRvbmx5IGRhdGFiYXNlTmFtZTogc3RyaW5nXG5cbiAgLyoqXG4gICAqIE9wdGlvbmFsIGRhdGFiYXNlIG93bmVyLlxuICAgKi9cbiAgcmVhZG9ubHkgb3duZXI/OiBSb2xlXG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgRGF0YWJhc2VQcm9wcyBleHRlbmRzIERhdGFiYXNlQXR0cmlidXRlcyB7XG4gIC8qKlxuICAgKiBQcm92aWRlci5cbiAgICovXG4gIHJlYWRvbmx5IHByb3ZpZGVyOiBQcm92aWRlclxufVxuXG5leHBvcnQgaW50ZXJmYWNlIElEYXRhYmFzZSB7XG4gIHJlYWRvbmx5IGRhdGFiYXNlTmFtZTogc3RyaW5nXG59XG5cbmNsYXNzIEltcG9ydGVkRGF0YWJhc2UgZXh0ZW5kcyBDb25zdHJ1Y3QgaW1wbGVtZW50cyBJRGF0YWJhc2Uge1xuICBwdWJsaWMgcmVhZG9ubHkgZGF0YWJhc2VOYW1lOiBzdHJpbmdcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogRGF0YWJhc2VBdHRyaWJ1dGVzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKVxuICAgIHRoaXMuZGF0YWJhc2VOYW1lID0gcHJvcHMuZGF0YWJhc2VOYW1lXG4gIH1cbn1cblxuZXhwb3J0IGNsYXNzIERhdGFiYXNlIGV4dGVuZHMgQ3VzdG9tUmVzb3VyY2UgaW1wbGVtZW50cyBJRGF0YWJhc2Uge1xuICAvKipcbiAgICogUmV0dXJuIGEgRGF0YWJhc2UgYmFzZWQgdXBvbiBuYW1lIG9ubHkuIFVzZSBmb3IgaW1wb3J0aW5nIGV4aXN0aW5nIGRhdGFiYXNlcy5cbiAgICovXG4gIHN0YXRpYyBmcm9tRGF0YWJhc2VOYW1lKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIGRhdGFiYXNlTmFtZTogc3RyaW5nKTogSURhdGFiYXNlIHtcbiAgICByZXR1cm4gbmV3IEltcG9ydGVkRGF0YWJhc2Uoc2NvcGUsIGlkLCB7XG4gICAgICBkYXRhYmFzZU5hbWU6IGRhdGFiYXNlTmFtZSxcbiAgICB9KVxuICB9XG5cbiAgcHVibGljIHJlYWRvbmx5IGRhdGFiYXNlTmFtZTogc3RyaW5nXG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IERhdGFiYXNlUHJvcHMpIHtcbiAgICAvLyBDaGVjayBpZiB1c2luZyBEU1FMIHByb3ZpZGVyIGFuZCBmb3JiaWQgZGF0YWJhc2UgY3JlYXRpb25cbiAgICBpZiAoaXNEc3FsQ2x1c3Rlcihwcm9wcy5wcm92aWRlci5jbHVzdGVyKSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICBcIkRhdGFiYXNlIGNyZWF0aW9uIGlzIG5vdCBzdXBwb3J0ZWQgd2l0aCBEU1FMLiBEU1FMIGFsd2F5cyB1c2VzICdwb3N0Z3JlcycgZGF0YWJhc2UuXCJcbiAgICAgIClcbiAgICB9XG5cbiAgICBzdXBlcihzY29wZSwgaWQsIHtcbiAgICAgIHNlcnZpY2VUb2tlbjogcHJvcHMucHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgcHJvcGVydGllczoge1xuICAgICAgICBSZXNvdXJjZTogUmRzU3FsUmVzb3VyY2UuREFUQUJBU0UsXG4gICAgICAgIFJlc291cmNlSWQ6IHByb3BzLmRhdGFiYXNlTmFtZSxcbiAgICAgICAgLi4uKHByb3BzLnByb3ZpZGVyLnNlY3JldCA/IHsgU2VjcmV0QXJuOiBwcm9wcy5wcm92aWRlci5zZWNyZXQuc2VjcmV0QXJuIH0gOiB7fSksXG4gICAgICAgIE93bmVyOiBwcm9wcy5vd25lcj8ucm9sZU5hbWUsXG4gICAgICB9LFxuICAgIH0pXG4gICAgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMucHJvdmlkZXIpXG4gICAgdGhpcy5kYXRhYmFzZU5hbWUgPSBwcm9wcy5kYXRhYmFzZU5hbWVcbiAgICBpZiAocHJvcHMub3duZXIpIHtcbiAgICAgIHRoaXMubm9kZS5hZGREZXBlbmRlbmN5KHByb3BzLm93bmVyKVxuICAgIH1cbiAgfVxufVxuIl19
+Database[_a] = { fqn: "cdk-rds-sql.Database", version: "7.2.1" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGF0YWJhc2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvZGF0YWJhc2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2Q0FBNEM7QUFDNUMsMkNBQXNDO0FBQ3RDLGlDQUF1QztBQUN2Qyx5Q0FBc0Q7QUEwQnRELE1BQU0sZ0JBQWlCLFNBQVEsc0JBQVM7SUFHdEMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUF5QjtRQUNqRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBQ2hCLElBQUksQ0FBQyxZQUFZLEdBQUcsS0FBSyxDQUFDLFlBQVksQ0FBQTtJQUN4QyxDQUFDO0NBQ0Y7QUFFRCxNQUFhLFFBQVMsU0FBUSw0QkFBYztJQUMxQzs7T0FFRztJQUNILE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFnQixFQUFFLEVBQVUsRUFBRSxZQUFvQjtRQUN4RSxPQUFPLElBQUksZ0JBQWdCLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNyQyxZQUFZLEVBQUUsWUFBWTtTQUMzQixDQUFDLENBQUE7SUFDSixDQUFDO0lBSUQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFvQjtRQUM1RCw0REFBNEQ7UUFDNUQsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyx5QkFBYyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2xELE1BQU0sSUFBSSxLQUFLLENBQ2IscUZBQXFGLENBQ3RGLENBQUE7UUFDSCxDQUFDO1FBRUQsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixZQUFZLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxZQUFZO1lBQ3pDLFVBQVUsRUFBRTtnQkFDVixRQUFRLEVBQUUscUJBQWMsQ0FBQyxRQUFRO2dCQUNqQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFlBQVk7Z0JBQzlCLEdBQUcsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDaEYsS0FBSyxFQUFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsUUFBUTthQUM3QjtTQUNGLENBQUMsQ0FBQTtRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN2QyxJQUFJLENBQUMsWUFBWSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUE7UUFDdEMsSUFBSSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDaEIsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBQ3RDLENBQUM7SUFDSCxDQUFDOztBQWxDSCw0QkFtQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSB9IGZyb20gXCJhd3MtY2RrLWxpYlwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgSVByb3ZpZGVyLCBEYXRhYmFzZUVuZ2luZSB9IGZyb20gXCIuL3Byb3ZpZGVyXCJcbmltcG9ydCB7IFJvbGUgfSBmcm9tIFwiLi9yb2xlXCJcblxuaW50ZXJmYWNlIERhdGFiYXNlQXR0cmlidXRlcyB7XG4gIC8qKlxuICAgKiBOYW1lIG9mIGRhdGFiYXNlIHRvIGNyZWF0ZS5cbiAgICovXG4gIHJlYWRvbmx5IGRhdGFiYXNlTmFtZTogc3RyaW5nXG5cbiAgLyoqXG4gICAqIE9wdGlvbmFsIGRhdGFiYXNlIG93bmVyLlxuICAgKi9cbiAgcmVhZG9ubHkgb3duZXI/OiBSb2xlXG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgRGF0YWJhc2VQcm9wcyBleHRlbmRzIERhdGFiYXNlQXR0cmlidXRlcyB7XG4gIC8qKlxuICAgKiBQcm92aWRlci5cbiAgICovXG4gIHJlYWRvbmx5IHByb3ZpZGVyOiBJUHJvdmlkZXJcbn1cblxuZXhwb3J0IGludGVyZmFjZSBJRGF0YWJhc2Uge1xuICByZWFkb25seSBkYXRhYmFzZU5hbWU6IHN0cmluZ1xufVxuXG5jbGFzcyBJbXBvcnRlZERhdGFiYXNlIGV4dGVuZHMgQ29uc3RydWN0IGltcGxlbWVudHMgSURhdGFiYXNlIHtcbiAgcHVibGljIHJlYWRvbmx5IGRhdGFiYXNlTmFtZTogc3RyaW5nXG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IERhdGFiYXNlQXR0cmlidXRlcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZClcbiAgICB0aGlzLmRhdGFiYXNlTmFtZSA9IHByb3BzLmRhdGFiYXNlTmFtZVxuICB9XG59XG5cbmV4cG9ydCBjbGFzcyBEYXRhYmFzZSBleHRlbmRzIEN1c3RvbVJlc291cmNlIGltcGxlbWVudHMgSURhdGFiYXNlIHtcbiAgLyoqXG4gICAqIFJldHVybiBhIERhdGFiYXNlIGJhc2VkIHVwb24gbmFtZSBvbmx5LiBVc2UgZm9yIGltcG9ydGluZyBleGlzdGluZyBkYXRhYmFzZXMuXG4gICAqL1xuICBzdGF0aWMgZnJvbURhdGFiYXNlTmFtZShzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBkYXRhYmFzZU5hbWU6IHN0cmluZyk6IElEYXRhYmFzZSB7XG4gICAgcmV0dXJuIG5ldyBJbXBvcnRlZERhdGFiYXNlKHNjb3BlLCBpZCwge1xuICAgICAgZGF0YWJhc2VOYW1lOiBkYXRhYmFzZU5hbWUsXG4gICAgfSlcbiAgfVxuXG4gIHB1YmxpYyByZWFkb25seSBkYXRhYmFzZU5hbWU6IHN0cmluZ1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBEYXRhYmFzZVByb3BzKSB7XG4gICAgLy8gQ2hlY2sgaWYgdXNpbmcgRFNRTCBwcm92aWRlciBhbmQgZm9yYmlkIGRhdGFiYXNlIGNyZWF0aW9uXG4gICAgaWYgKHByb3BzLnByb3ZpZGVyLmVuZ2luZSA9PT0gRGF0YWJhc2VFbmdpbmUuRFNRTCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICBcIkRhdGFiYXNlIGNyZWF0aW9uIGlzIG5vdCBzdXBwb3J0ZWQgd2l0aCBEU1FMLiBEU1FMIGFsd2F5cyB1c2VzICdwb3N0Z3JlcycgZGF0YWJhc2UuXCJcbiAgICAgIClcbiAgICB9XG5cbiAgICBzdXBlcihzY29wZSwgaWQsIHtcbiAgICAgIHNlcnZpY2VUb2tlbjogcHJvcHMucHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgcHJvcGVydGllczoge1xuICAgICAgICBSZXNvdXJjZTogUmRzU3FsUmVzb3VyY2UuREFUQUJBU0UsXG4gICAgICAgIFJlc291cmNlSWQ6IHByb3BzLmRhdGFiYXNlTmFtZSxcbiAgICAgICAgLi4uKHByb3BzLnByb3ZpZGVyLnNlY3JldCA/IHsgU2VjcmV0QXJuOiBwcm9wcy5wcm92aWRlci5zZWNyZXQuc2VjcmV0QXJuIH0gOiB7fSksXG4gICAgICAgIE93bmVyOiBwcm9wcy5vd25lcj8ucm9sZU5hbWUsXG4gICAgICB9LFxuICAgIH0pXG4gICAgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMucHJvdmlkZXIpXG4gICAgdGhpcy5kYXRhYmFzZU5hbWUgPSBwcm9wcy5kYXRhYmFzZU5hbWVcbiAgICBpZiAocHJvcHMub3duZXIpIHtcbiAgICAgIHRoaXMubm9kZS5hZGREZXBlbmRlbmN5KHByb3BzLm93bmVyKVxuICAgIH1cbiAgfVxufVxuIl19

package/lib/handler/handler.js

@@ -25465,31 +25465,47 @@ var DsqlEngine = class extends AbstractEngine {
   async updateRole(resourceId, oldResourceId, props, oldProps) {
     const sql = ["BEGIN"];
     if (oldResourceId !== resourceId) {
-      sql.push((0, import_node_pg_format.format)("ALTER ROLE %I RENAME TO %I", oldResourceId, resourceId));
+      sql.push((0, import_node_pg_format.format)("CREATE ROLE %I WITH LOGIN", resourceId));
+      if (oldProps?.DatabaseName) {
+        sql.push(
+          (0, import_node_pg_format.format)(
+            "GRANT CONNECT ON DATABASE %I TO %I",
+            oldProps.DatabaseName,
+            resourceId
+          )
+        );
+      }
+      sql.push((0, import_node_pg_format.format)("DROP ROLE IF EXISTS %I", oldResourceId));
     }
-    if (oldProps?.DatabaseName && props?.DatabaseName && oldProps.DatabaseName !== props.DatabaseName) {
-      sql.push(
-        (0, import_node_pg_format.format)(
-          "REVOKE CONNECT ON DATABASE %I FROM %I",
-          oldProps.DatabaseName,
-          resourceId
-        )
-      );
-      sql.push(
-        (0, import_node_pg_format.format)("GRANT CONNECT ON DATABASE %I TO %I", props.DatabaseName, resourceId)
-      );
-    } else if (props?.DatabaseName && !oldProps?.DatabaseName) {
+    if (oldResourceId === resourceId) {
+      if (oldProps?.DatabaseName && props?.DatabaseName && oldProps.DatabaseName !== props.DatabaseName) {
+        sql.push(
+          (0, import_node_pg_format.format)(
+            "REVOKE CONNECT ON DATABASE %I FROM %I",
+            oldProps.DatabaseName,
+            resourceId
+          )
+        );
+        sql.push(
+          (0, import_node_pg_format.format)("GRANT CONNECT ON DATABASE %I TO %I", props.DatabaseName, resourceId)
+        );
+      } else if (props?.DatabaseName && !oldProps?.DatabaseName) {
+        sql.push(
+          (0, import_node_pg_format.format)("GRANT CONNECT ON DATABASE %I TO %I", props.DatabaseName, resourceId)
+        );
+      } else if (!props?.DatabaseName && oldProps?.DatabaseName) {
+        sql.push(
+          (0, import_node_pg_format.format)(
+            "REVOKE CONNECT ON DATABASE %I FROM %I",
+            oldProps.DatabaseName,
+            resourceId
+          )
+        );
+      }
+    } else if (props?.DatabaseName && props.DatabaseName !== oldProps?.DatabaseName) {
       sql.push(
         (0, import_node_pg_format.format)("GRANT CONNECT ON DATABASE %I TO %I", props.DatabaseName, resourceId)
       );
-    } else if (!props?.DatabaseName && oldProps?.DatabaseName) {
-      sql.push(
-        (0, import_node_pg_format.format)(
-          "REVOKE CONNECT ON DATABASE %I FROM %I",
-          oldProps.DatabaseName,
-          resourceId
-        )
-      );
     }
     sql.push("COMMIT");
     return sql;
@@ -26169,13 +26185,14 @@ var handler = async (event) => {
       engine: "dsql"
     };
   } else {
-    if (!event.ResourceProperties.SecretArn) {
-      throw "SecretArn is a required property";
+    const secretArn = event.ResourceProperties.SecretArn || process.env.SECRET_ARN;
+    if (!secretArn) {
+      throw "SecretArn is required (not in event properties or environment)";
     }
     const command = new import_client_secrets_manager2.GetSecretValueCommand({
-      SecretId: event.ResourceProperties.SecretArn
+      SecretId: secretArn
     });
-    log(`Fetching secret ${event.ResourceProperties.SecretArn}`);
+    log(`Fetching secret ${secretArn}`);
     const secret = await (0, import_exponential_backoff.backOff)(
       async () => {
         try {
@@ -26192,7 +26209,7 @@ var handler = async (event) => {
       }
     );
     if (!secret.SecretString) {
-      throw `No secret string in ${event.ResourceProperties.SecretArn}`;
+      throw `No secret string in ${secretArn}`;
     }
     secretValues = JSON.parse(secret.SecretString);
     engine = secretValues.engine || "postgresql";

package/lib/iam-grant.d.ts

@@ -1,11 +1,11 @@
 import { CustomResource } from "aws-cdk-lib";
 import { Construct } from "constructs";
-import { Provider } from "./provider";
+import { IProvider } from "./provider";
 export interface IamGrantProps {
     /**
      * Provider.
      */
-    readonly provider: Provider;
+    readonly provider: IProvider;
     /**
      * Database role name to grant IAM access to.
      */

package/lib/iam-grant.js

@@ -4,18 +4,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.IamGrant = void 0;
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
-const dsql = require("aws-cdk-lib/aws-dsql");
 const enum_1 = require("./enum");
-/**
- * Helper function to determine if a cluster is a DSQL cluster
- */
-function isDsqlCluster(cluster) {
-    return cluster instanceof dsql.CfnCluster;
-}
+const provider_1 = require("./provider");
 class IamGrant extends aws_cdk_lib_1.CustomResource {
     constructor(scope, id, props) {
         // IAM grants are only supported on DSQL
-        if (!isDsqlCluster(props.provider.cluster)) {
+        if (props.provider.engine !== provider_1.DatabaseEngine.DSQL) {
             throw new Error("IAM grants are only supported with DSQL clusters. Use regular database authentication for RDS/Aurora clusters.");
         }
         super(scope, id, {
@@ -31,5 +25,5 @@ class IamGrant extends aws_cdk_lib_1.CustomResource {
 }
 exports.IamGrant = IamGrant;
 _a = JSII_RTTI_SYMBOL_1;
-IamGrant[_a] = { fqn: "cdk-rds-sql.IamGrant", version: "7.1.0" };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWFtLWdyYW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2lhbS1ncmFudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLDZDQUE0QztBQUM1Qyw2Q0FBNEM7QUFFNUMsaUNBQXVDO0FBb0J2Qzs7R0FFRztBQUNILFNBQVMsYUFBYSxDQUFDLE9BQVk7SUFDakMsT0FBTyxPQUFPLFlBQVksSUFBSSxDQUFDLFVBQVUsQ0FBQTtBQUMzQyxDQUFDO0FBRUQsTUFBYSxRQUFTLFNBQVEsNEJBQWM7SUFDMUMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFvQjtRQUM1RCx3Q0FBd0M7UUFDeEMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDM0MsTUFBTSxJQUFJLEtBQUssQ0FDYixnSEFBZ0gsQ0FDakgsQ0FBQTtRQUNILENBQUM7UUFFRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLFlBQVksRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7WUFDekMsVUFBVSxFQUFFO2dCQUNWLFFBQVEsRUFBRSxxQkFBYyxDQUFDLFNBQVM7Z0JBQ2xDLFVBQVUsRUFBRSxLQUFLLENBQUMsUUFBUTtnQkFDMUIsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO2FBQy9CO1NBQ0YsQ0FBQyxDQUFBO1FBQ0YsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQ3pDLENBQUM7O0FBbEJILDRCQW1CQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEN1c3RvbVJlc291cmNlIH0gZnJvbSBcImF3cy1jZGstbGliXCJcbmltcG9ydCAqIGFzIGRzcWwgZnJvbSBcImF3cy1jZGstbGliL2F3cy1kc3FsXCJcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCJcbmltcG9ydCB7IFJkc1NxbFJlc291cmNlIH0gZnJvbSBcIi4vZW51bVwiXG5pbXBvcnQgeyBQcm92aWRlciB9IGZyb20gXCIuL3Byb3ZpZGVyXCJcblxuZXhwb3J0IGludGVyZmFjZSBJYW1HcmFudFByb3BzIHtcbiAgLyoqXG4gICAqIFByb3ZpZGVyLlxuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXI6IFByb3ZpZGVyXG5cbiAgLyoqXG4gICAqIERhdGFiYXNlIHJvbGUgbmFtZSB0byBncmFudCBJQU0gYWNjZXNzIHRvLlxuICAgKi9cbiAgcmVhZG9ubHkgcm9sZU5hbWU6IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBJQU0gcmVzb3VyY2UgQVJOIChyb2xlLCB1c2VyLCBvciBvdGhlciBJQU0gcHJpbmNpcGFsKS5cbiAgICovXG4gIHJlYWRvbmx5IHJlc291cmNlQXJuOiBzdHJpbmdcbn1cblxuLyoqXG4gKiBIZWxwZXIgZnVuY3Rpb24gdG8gZGV0ZXJtaW5lIGlmIGEgY2x1c3RlciBpcyBhIERTUUwgY2x1c3RlclxuICovXG5mdW5jdGlvbiBpc0RzcWxDbHVzdGVyKGNsdXN0ZXI6IGFueSk6IGNsdXN0ZXIgaXMgZHNxbC5DZm5DbHVzdGVyIHtcbiAgcmV0dXJuIGNsdXN0ZXIgaW5zdGFuY2VvZiBkc3FsLkNmbkNsdXN0ZXJcbn1cblxuZXhwb3J0IGNsYXNzIElhbUdyYW50IGV4dGVuZHMgQ3VzdG9tUmVzb3VyY2Uge1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogSWFtR3JhbnRQcm9wcykge1xuICAgIC8vIElBTSBncmFudHMgYXJlIG9ubHkgc3VwcG9ydGVkIG9uIERTUUxcbiAgICBpZiAoIWlzRHNxbENsdXN0ZXIocHJvcHMucHJvdmlkZXIuY2x1c3RlcikpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgXCJJQU0gZ3JhbnRzIGFyZSBvbmx5IHN1cHBvcnRlZCB3aXRoIERTUUwgY2x1c3RlcnMuIFVzZSByZWd1bGFyIGRhdGFiYXNlIGF1dGhlbnRpY2F0aW9uIGZvciBSRFMvQXVyb3JhIGNsdXN0ZXJzLlwiXG4gICAgICApXG4gICAgfVxuXG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICBzZXJ2aWNlVG9rZW46IHByb3BzLnByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICAgIHByb3BlcnRpZXM6IHtcbiAgICAgICAgUmVzb3VyY2U6IFJkc1NxbFJlc291cmNlLklBTV9HUkFOVCxcbiAgICAgICAgUmVzb3VyY2VJZDogcHJvcHMucm9sZU5hbWUsXG4gICAgICAgIFJlc291cmNlQXJuOiBwcm9wcy5yZXNvdXJjZUFybixcbiAgICAgIH0sXG4gICAgfSlcbiAgICB0aGlzLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5wcm92aWRlcilcbiAgfVxufVxuIl19
+IamGrant[_a] = { fqn: "cdk-rds-sql.IamGrant", version: "7.2.1" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWFtLWdyYW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2lhbS1ncmFudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLDZDQUE0QztBQUU1QyxpQ0FBdUM7QUFDdkMseUNBQXNEO0FBbUJ0RCxNQUFhLFFBQVMsU0FBUSw0QkFBYztJQUMxQyxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQW9CO1FBQzVELHdDQUF3QztRQUN4QyxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLHlCQUFjLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDbEQsTUFBTSxJQUFJLEtBQUssQ0FDYixnSEFBZ0gsQ0FDakgsQ0FBQTtRQUNILENBQUM7UUFFRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLFlBQVksRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7WUFDekMsVUFBVSxFQUFFO2dCQUNWLFFBQVEsRUFBRSxxQkFBYyxDQUFDLFNBQVM7Z0JBQ2xDLFVBQVUsRUFBRSxLQUFLLENBQUMsUUFBUTtnQkFDMUIsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO2FBQy9CO1NBQ0YsQ0FBQyxDQUFBO1FBQ0YsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQ3pDLENBQUM7O0FBbEJILDRCQW1CQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEN1c3RvbVJlc291cmNlIH0gZnJvbSBcImF3cy1jZGstbGliXCJcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gXCJjb25zdHJ1Y3RzXCJcbmltcG9ydCB7IFJkc1NxbFJlc291cmNlIH0gZnJvbSBcIi4vZW51bVwiXG5pbXBvcnQgeyBJUHJvdmlkZXIsIERhdGFiYXNlRW5naW5lIH0gZnJvbSBcIi4vcHJvdmlkZXJcIlxuXG5leHBvcnQgaW50ZXJmYWNlIElhbUdyYW50UHJvcHMge1xuICAvKipcbiAgICogUHJvdmlkZXIuXG4gICAqL1xuICByZWFkb25seSBwcm92aWRlcjogSVByb3ZpZGVyXG5cbiAgLyoqXG4gICAqIERhdGFiYXNlIHJvbGUgbmFtZSB0byBncmFudCBJQU0gYWNjZXNzIHRvLlxuICAgKi9cbiAgcmVhZG9ubHkgcm9sZU5hbWU6IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBJQU0gcmVzb3VyY2UgQVJOIChyb2xlLCB1c2VyLCBvciBvdGhlciBJQU0gcHJpbmNpcGFsKS5cbiAgICovXG4gIHJlYWRvbmx5IHJlc291cmNlQXJuOiBzdHJpbmdcbn1cblxuZXhwb3J0IGNsYXNzIElhbUdyYW50IGV4dGVuZHMgQ3VzdG9tUmVzb3VyY2Uge1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogSWFtR3JhbnRQcm9wcykge1xuICAgIC8vIElBTSBncmFudHMgYXJlIG9ubHkgc3VwcG9ydGVkIG9uIERTUUxcbiAgICBpZiAocHJvcHMucHJvdmlkZXIuZW5naW5lICE9PSBEYXRhYmFzZUVuZ2luZS5EU1FMKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgIFwiSUFNIGdyYW50cyBhcmUgb25seSBzdXBwb3J0ZWQgd2l0aCBEU1FMIGNsdXN0ZXJzLiBVc2UgcmVndWxhciBkYXRhYmFzZSBhdXRoZW50aWNhdGlvbiBmb3IgUkRTL0F1cm9yYSBjbHVzdGVycy5cIlxuICAgICAgKVxuICAgIH1cblxuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgc2VydmljZVRva2VuOiBwcm9wcy5wcm92aWRlci5zZXJ2aWNlVG9rZW4sXG4gICAgICBwcm9wZXJ0aWVzOiB7XG4gICAgICAgIFJlc291cmNlOiBSZHNTcWxSZXNvdXJjZS5JQU1fR1JBTlQsXG4gICAgICAgIFJlc291cmNlSWQ6IHByb3BzLnJvbGVOYW1lLFxuICAgICAgICBSZXNvdXJjZUFybjogcHJvcHMucmVzb3VyY2VBcm4sXG4gICAgICB9LFxuICAgIH0pXG4gICAgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMucHJvdmlkZXIpXG4gIH1cbn1cbiJdfQ==

package/lib/provider.d.ts

@@ -69,11 +69,52 @@ export interface RdsSqlProps {
      */
     readonly ssl?: boolean;
 }
-export declare class Provider extends Construct {
+/**
+ * Supported database engines
+ */
+export declare enum DatabaseEngine {
+    POSTGRES = "postgres",
+    MYSQL = "mysql",
+    DSQL = "dsql"
+}
+export interface IProvider {
+    readonly serviceToken: string;
+    readonly handler: IFunction;
+    readonly secret?: ISecret;
+    readonly engine: string;
+    readonly cluster?: IDatabaseCluster | IDatabaseInstance | dsql.CfnCluster;
+}
+export interface ProviderAttributes {
+    /**
+     * Either the ARN or name of the Lambda function.
+     * Use functionArn for cross-account or cross-region scenarios.
+     * Use functionName for same-account, same-region scenarios.
+     */
+    readonly functionArn?: string;
+    readonly functionName?: string;
+    readonly engine: DatabaseEngine;
+    /**
+     * Optional cluster information for role creation.
+     *
+     * When importing a provider, cluster details are often not available.
+     * However, some operations like role creation require cluster endpoint
+     * information to build connection secrets.
+     *
+     * If you plan to create roles with the imported provider, you must
+     * provide the cluster reference. If you only plan to use existing
+     * roles, databases, schemas, or SQL operations, this can be omitted.
+     */
+    readonly cluster?: IDatabaseCluster | IDatabaseInstance | dsql.CfnCluster;
+}
+export declare class Provider extends Construct implements IProvider {
+    /**
+     * Import an existing provider Lambda function
+     */
+    static fromProviderAttributes(scope: Construct, id: string, attrs: ProviderAttributes): IProvider;
     readonly serviceToken: string;
     readonly secret?: ISecret;
     readonly handler: IFunction;
-    readonly cluster: IDatabaseCluster | IDatabaseInstance | dsql.CfnCluster;
+    readonly cluster?: IDatabaseCluster | IDatabaseInstance | dsql.CfnCluster;
     /**
      * The engine like "postgres" or "mysql"
      *