cdk-rds-sql 7.3.1 → 8.0.0

package/lambda/handler.ts

@@ -1,388 +0,0 @@
-import {
-  SecretsManagerClient,
-  GetSecretValueCommand,
-  GetSecretValueCommandOutput,
-} from "@aws-sdk/client-secrets-manager"
-import {
-  SSMClient,
-  PutParameterCommand,
-  DeleteParameterCommand,
-  AddTagsToResourceCommand,
-} from "@aws-sdk/client-ssm"
-import {
-  CloudFormationCustomResourceCreateEvent,
-  CloudFormationCustomResourceUpdateEvent,
-  CloudFormationCustomResourceDeleteEvent,
-} from "aws-lambda"
-import { backOff } from "exponential-backoff"
-import { EngineConnectionConfig } from "./engine.abstract"
-import { EngineFactory } from "./engine.factory"
-import {
-  ResourceProperties,
-  CustomResourceResponse,
-  EngineDatabaseProperties,
-  EngineRoleProperties,
-  EngineSchemaProperties,
-  EngineSqlProperties,
-  EngineIamGrantProperties,
-} from "./types"
-import { RdsSqlResource } from "../src/enum"
-
-const maxAttempts = 20
-
-const log =
-  process.env.LOGGER === "true"
-    ? console.debug
-    : (_message?: any, ..._optionalParams: any[]) => {}
-
-const secrets_client = new SecretsManagerClient({})
-
-// Helper functions to extract engine properties from CloudFormation properties
-// These functions throw if the resource type doesn't match the expected type
-function toDatabaseEngineProps(props: ResourceProperties): EngineDatabaseProperties {
-  if (props.Resource !== RdsSqlResource.DATABASE) {
-    throw new Error(`Expected DATABASE resource, got ${props.Resource}`)
-  }
-  return props
-}
-
-function toRoleEngineProps(props: ResourceProperties): EngineRoleProperties {
-  if (props.Resource !== RdsSqlResource.ROLE) {
-    throw new Error(`Expected ROLE resource, got ${props.Resource}`)
-  }
-  // Convert string 'true'/'false' to boolean for EnableIamAuth
-  return {
-    ...props,
-    EnableIamAuth: props.EnableIamAuth === "true" || props.EnableIamAuth === "1",
-  }
-}
-
-function toSchemaEngineProps(props: ResourceProperties): EngineSchemaProperties {
-  if (props.Resource !== RdsSqlResource.SCHEMA) {
-    throw new Error(`Expected SCHEMA resource, got ${props.Resource}`)
-  }
-  return props
-}
-
-function toSqlEngineProps(props: ResourceProperties): EngineSqlProperties {
-  if (props.Resource !== RdsSqlResource.SQL) {
-    throw new Error(`Expected SQL resource, got ${props.Resource}`)
-  }
-  return props
-}
-
-function toIamGrantEngineProps(props: ResourceProperties): EngineIamGrantProperties {
-  if (props.Resource !== RdsSqlResource.IAM_GRANT) {
-    throw new Error(`Expected IAM_GRANT resource, got ${props.Resource}`)
-  }
-  return props
-}
-
-export const handler = async (
-  event:
-    | CloudFormationCustomResourceCreateEvent<ResourceProperties>
-    | CloudFormationCustomResourceUpdateEvent<ResourceProperties>
-    | CloudFormationCustomResourceDeleteEvent<ResourceProperties>
-): Promise<CustomResourceResponse> => {
-  log(event)
-
-  const requestType = event.RequestType
-  const resource: RdsSqlResource = event.ResourceProperties.Resource
-  const resourceId = event.ResourceProperties.ResourceId
-  const databaseName = event.ResourceProperties.DatabaseName
-
-  if (!Object.values(RdsSqlResource).includes(resource)) {
-    throw `Resource type '${resource}' not recognised.`
-  }
-  // Check if we're dealing with DSQL based on environment variables
-  const dsqlEndpoint = process.env.DSQL_ENDPOINT
-  const dsqlPort = process.env.DSQL_PORT
-
-  let engine: string
-  let secretValues: any = {}
-
-  if (dsqlEndpoint) {
-    // DSQL configuration - use environment variables
-    log(`Using DSQL endpoint: ${dsqlEndpoint}`)
-    engine = "dsql"
-    secretValues = {
-      host: dsqlEndpoint,
-      port: parseInt(dsqlPort || "5432", 10),
-      username: "admin", // DSQL always uses admin user
-      engine: "dsql",
-    }
-  } else {
-    // Traditional RDS configuration - use secrets
-    // Use SecretArn from event properties, fallback to environment variable
-    const secretArn = event.ResourceProperties.SecretArn || process.env.SECRET_ARN
-    if (!secretArn) {
-      throw "SecretArn is required (not in event properties or environment)"
-    }
-
-    const command = new GetSecretValueCommand({
-      SecretId: secretArn,
-    })
-
-    log(`Fetching secret ${secretArn}`)
-    const secret: GetSecretValueCommandOutput = await backOff(
-      async () => {
-        try {
-          const result = await secrets_client.send(command)
-          return result
-        } catch (e) {
-          log("Error fetching secret %o", e)
-          throw e
-        }
-      },
-      {
-        numOfAttempts: 10,
-        startingDelay: 500,
-      }
-    )
-    if (!secret.SecretString) {
-      throw `No secret string in ${secretArn}`
-    }
-    secretValues = JSON.parse(secret.SecretString)
-
-    // Determine the database engine type
-    engine = secretValues.engine || "postgresql" // Default to postgresql if not specified
-  }
-
-  const dbEngine = EngineFactory.createEngine(engine)
-
-  let sql: string | string[] | undefined
-  switch (requestType) {
-    case "Create": {
-      switch (resource) {
-        case RdsSqlResource.DATABASE:
-          sql = dbEngine.createDatabase(
-            resourceId,
-            toDatabaseEngineProps(event.ResourceProperties)
-          )
-          break
-        case RdsSqlResource.ROLE:
-          sql = await dbEngine.createRole(
-            resourceId,
-            toRoleEngineProps(event.ResourceProperties)
-          )
-          break
-        case RdsSqlResource.SCHEMA:
-          sql = dbEngine.createSchema(
-            resourceId,
-            toSchemaEngineProps(event.ResourceProperties)
-          )
-          break
-        case RdsSqlResource.SQL:
-          sql = dbEngine.createSql(resourceId, toSqlEngineProps(event.ResourceProperties))
-          break
-        case RdsSqlResource.IAM_GRANT:
-          const createIam = toIamGrantEngineProps(event.ResourceProperties)
-          sql = dbEngine.createIamGrant(createIam.RoleName, createIam.ResourceArn)
-          break
-        case RdsSqlResource.PARAMETER_PASSWORD:
-          await handleParameterPassword(event.ResourceProperties)
-          break
-      }
-      break
-    }
-    case "Update": {
-      const oldResourceId = (event as CloudFormationCustomResourceUpdateEvent)
-        .PhysicalResourceId
-      switch (resource) {
-        case RdsSqlResource.DATABASE:
-          const dbProps = toDatabaseEngineProps(event.ResourceProperties)
-          sql = dbEngine.updateDatabase(resourceId, oldResourceId, {
-            ...dbProps,
-            MasterOwner: secretValues.username,
-          })
-          break
-        case RdsSqlResource.ROLE:
-          const updateEvent =
-            event as CloudFormationCustomResourceUpdateEvent<ResourceProperties>
-          sql = await dbEngine.updateRole(
-            resourceId,
-            oldResourceId,
-            toRoleEngineProps(event.ResourceProperties),
-            toRoleEngineProps(updateEvent.OldResourceProperties)
-          )
-          break
-        case RdsSqlResource.SCHEMA:
-          sql = dbEngine.updateSchema(
-            resourceId,
-            oldResourceId,
-            toSchemaEngineProps(event.ResourceProperties)
-          )
-          break
-        case RdsSqlResource.SQL:
-          sql = dbEngine.updateSql(
-            resourceId,
-            oldResourceId,
-            toSqlEngineProps(event.ResourceProperties)
-          )
-          break
-        case RdsSqlResource.IAM_GRANT:
-          const iamUpdateEvent =
-            event as CloudFormationCustomResourceUpdateEvent<ResourceProperties>
-          const newIam = toIamGrantEngineProps(event.ResourceProperties)
-          const oldIam = toIamGrantEngineProps(iamUpdateEvent.OldResourceProperties)
-          sql = dbEngine.updateIamGrant(
-            newIam.RoleName,
-            oldIam.RoleName,
-            newIam.ResourceArn,
-            oldIam.ResourceArn
-          )
-          break
-        case RdsSqlResource.PARAMETER_PASSWORD:
-          await handleParameterPassword(event.ResourceProperties)
-          sql = undefined // No SQL to execute
-          break
-      }
-      break
-    }
-    case "Delete": {
-      switch (resource) {
-        case RdsSqlResource.DATABASE:
-          sql = dbEngine.deleteDatabase(resourceId, secretValues.username)
-          break
-        case RdsSqlResource.ROLE:
-          sql = await dbEngine.deleteRole(
-            resourceId,
-            toRoleEngineProps(event.ResourceProperties)
-          )
-          break
-        case RdsSqlResource.SCHEMA:
-          sql = dbEngine.deleteSchema(
-            resourceId,
-            toSchemaEngineProps(event.ResourceProperties)
-          )
-          break
-        case RdsSqlResource.SQL:
-          sql = dbEngine.deleteSql(resourceId, toSqlEngineProps(event.ResourceProperties))
-          break
-        case RdsSqlResource.IAM_GRANT:
-          const delIam = toIamGrantEngineProps(event.ResourceProperties)
-          sql = dbEngine.deleteIamGrant(delIam.RoleName, delIam.ResourceArn)
-          break
-        case RdsSqlResource.PARAMETER_PASSWORD:
-          await deleteParameterPassword(event.ResourceProperties)
-          break
-      }
-      break
-    }
-  }
-
-  if (sql) {
-    let database: string
-    if (engine === "dsql") {
-      // DSQL always uses 'postgres' database
-      database = "postgres"
-    } else if (resource === RdsSqlResource.ROLE) {
-      database = secretValues.dbname
-    } else {
-      database = databaseName ?? secretValues.dbname // connect to given database if possible, else to database mentioned in secret
-    }
-
-    const config: EngineConnectionConfig = {
-      host: secretValues.host,
-      port: secretValues.port,
-      user: secretValues.username,
-      password: secretValues.password || "", // DSQL will generate token in engine
-      database: database,
-    }
-
-    try {
-      await backOff(
-        async () => {
-          return dbEngine.executeSQL(sql as string | string[], config)
-        },
-        {
-          retry: errorFilter,
-          numOfAttempts: maxAttempts,
-        }
-      )
-    } catch (error) {
-      log("Error executing SQL: %o", error)
-      throw error
-    }
-  }
-
-  let response: CustomResourceResponse = {}
-  // Except for the SQL resource, return the new resource id. This
-  // will cause a delete to be sent for the old resource.
-  if (resource !== RdsSqlResource.SQL) {
-    response.PhysicalResourceId = resourceId
-  }
-
-  return response
-}
-
-// Custom error filter, mainly to retry role creation.
-const errorFilter = (error: any, nextAttemptNumber: number) => {
-  // Retry only if the error message includes "tuple concurrently"
-  // This will cover concurrent updates and deletes
-  const willRetry = error.message && error.message.includes("tuple concurrently")
-  log(
-    "Encountered an error on attempt %d/%d retry=%s error=[%o]",
-    nextAttemptNumber - 1,
-    maxAttempts,
-    willRetry,
-    error
-  )
-  return willRetry
-}
-
-/**
- * Copy password generated in secret to our password parameter.
- */
-async function handleParameterPassword(props: any): Promise<void> {
-  const secretArn = props.PasswordArn
-  const parameterName = props.ParameterName
-
-  // Get the secret
-  const secretData = await secrets_client.send(
-    new GetSecretValueCommand({ SecretId: secretArn })
-  )
-
-  if (!secretData.SecretString) throw "No secret string for parameter"
-  const secretObj = JSON.parse(secretData.SecretString)
-
-  // Put the password in SSM – retry while IAM perms propagate
-  const ssmClient = new SSMClient({})
-  await backOff(
-    () =>
-      ssmClient.send(
-        new PutParameterCommand({
-          Name: parameterName,
-          Value: secretObj.password,
-          Type: "SecureString",
-          Overwrite: true,
-        })
-      ),
-    {
-      numOfAttempts: maxAttempts,
-      startingDelay: 1000,
-    }
-  )
-
-  // Tag the parameter so that only parameters created by this construct can be deleted
-  await ssmClient.send(
-    new AddTagsToResourceCommand({
-      ResourceType: "Parameter",
-      ResourceId: parameterName,
-      Tags: [{ Key: "created-by", Value: "cdk-rds-sql" }],
-    })
-  )
-}
-
-/**
- * Cleanup: remove generated password parameter.
- */
-async function deleteParameterPassword(props: any): Promise<void> {
-  const parameterName = props.ParameterName
-  const ssmClient = new SSMClient({})
-  await ssmClient.send(
-    new DeleteParameterCommand({
-      Name: parameterName,
-    })
-  )
-}

package/lambda/types.ts

@@ -1,86 +0,0 @@
-import { CloudFormationCustomResourceResourcePropertiesCommon } from "aws-lambda"
-import { RdsSqlResource } from "../src/enum"
-
-// Engine-specific interfaces (business logic properties only)
-export interface EngineDatabaseProperties {
-  readonly Owner?: string
-  readonly MasterOwner?: string
-}
-
-export interface EngineRoleProperties {
-  readonly PasswordArn?: string
-  readonly DatabaseName?: string
-  readonly EnableIamAuth?: boolean
-}
-
-export interface EngineSchemaProperties {
-  readonly DatabaseName?: string
-  readonly RoleName?: string
-}
-
-export interface EngineSqlProperties {
-  readonly DatabaseName?: string
-  readonly Statement?: string
-  readonly Rollback?: string
-}
-
-export interface EngineIamGrantProperties {
-  readonly RoleName: string
-  readonly ResourceArn: string
-}
-
-// Common CloudFormation properties shared by all resources
-export interface CommonProperties
-  extends CloudFormationCustomResourceResourcePropertiesCommon {
-  readonly Resource: RdsSqlResource
-  readonly ResourceId: string
-  readonly SecretArn?: string // SecretArn is not set for DSQL
-}
-
-// CloudFormation-specific properties (engine properties + CloudFormation metadata)
-export interface DatabaseProperties extends CommonProperties, EngineDatabaseProperties {
-  readonly Resource: RdsSqlResource.DATABASE
-}
-
-export interface RoleProperties extends CommonProperties {
-  readonly Resource: RdsSqlResource.ROLE
-  readonly PasswordArn?: string
-  readonly DatabaseName?: string
-  readonly EnableIamAuth?: string // CloudFormation passes boolean as string
-}
-
-export interface SchemaProperties extends CommonProperties, EngineSchemaProperties {
-  readonly Resource: RdsSqlResource.SCHEMA
-}
-
-export interface SqlProperties extends CommonProperties, EngineSqlProperties {
-  readonly Resource: RdsSqlResource.SQL
-}
-
-export interface IamGrantProperties extends CommonProperties, EngineIamGrantProperties {
-  readonly Resource: RdsSqlResource.IAM_GRANT
-  readonly ResourceArn: string
-}
-
-// Parameter password specific properties
-export interface ParameterPasswordProperties extends CommonProperties {
-  readonly Resource: RdsSqlResource.PARAMETER_PASSWORD
-  readonly PasswordArn: string
-  readonly ParameterName: string
-}
-
-// Union type of all resource properties
-export type ResourceProperties =
-  | DatabaseProperties
-  | RoleProperties
-  | SchemaProperties
-  | SqlProperties
-  | IamGrantProperties
-  | ParameterPasswordProperties
-
-// Custom resource response interface
-export interface CustomResourceResponse {
-  PhysicalResourceId?: string
-  Data?: any
-  NoEcho?: boolean
-}

package/lambda/util.ts

@@ -1,186 +0,0 @@
-import {
-  CloudFormationCustomResourceCreateEvent,
-  CloudFormationCustomResourceUpdateEvent,
-  CloudFormationCustomResourceDeleteEvent,
-} from "aws-lambda"
-import { Client } from "pg"
-import { ResourceProperties } from "./types"
-
-// Helper interface to simplify test request creation
-export interface ResourcePropertiesInput {
-  readonly SecretArn?: string
-  readonly PasswordArn?: string
-  readonly DatabaseName?: string
-  readonly Owner?: string
-  readonly Statement?: string
-  readonly Rollback?: string
-  readonly RoleName?: string
-  readonly ParameterName?: string
-  [key: string]: any
-}
-
-/**
- * Helpers to create CloudFormation requests.
- */
-export const createRequest = (
-  resource: string,
-  resourceId: string,
-  props?: Partial<ResourceProperties>
-): CloudFormationCustomResourceCreateEvent<ResourceProperties> => {
-  return {
-    ServiceToken: "",
-    ResponseURL: "",
-    StackId: "",
-    RequestId: "",
-    LogicalResourceId: "",
-    ResourceType: "",
-    ResourceProperties: {
-      ServiceToken: "",
-      Resource: resource as any, // Needed for backward compatibility with tests
-      ResourceId: resourceId,
-      SecretArn:
-        props?.SecretArn || "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
-      ...props,
-    },
-    RequestType: "Create",
-  }
-}
-
-export const updateRequest = (
-  resource: string,
-  oldResourceId: string,
-  newResourceId: string,
-  props?: ResourcePropertiesInput
-): CloudFormationCustomResourceUpdateEvent<ResourceProperties> => {
-  return {
-    ServiceToken: "",
-    ResponseURL: "",
-    StackId: "",
-    RequestId: "",
-    LogicalResourceId: "",
-    ResourceType: "",
-    ResourceProperties: {
-      ServiceToken: "",
-      Resource: resource as any, // Needed for backward compatibility with tests
-      ResourceId: newResourceId,
-      SecretArn:
-        props?.SecretArn || "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
-      ...props,
-    } as unknown as ResourceProperties,
-    RequestType: "Update",
-    PhysicalResourceId: oldResourceId,
-    OldResourceProperties: {
-      ServiceToken: "",
-      Resource: resource as any,
-      ResourceId: oldResourceId,
-      SecretArn:
-        props?.SecretArn || "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
-    } as unknown as ResourceProperties,
-  }
-}
-
-export const deleteRequest = (
-  resource: string,
-  resourceId: string,
-  props?: ResourcePropertiesInput
-): CloudFormationCustomResourceDeleteEvent<ResourceProperties> => {
-  return {
-    ServiceToken: "",
-    ResponseURL: "",
-    StackId: "",
-    RequestId: "",
-    LogicalResourceId: "",
-    ResourceType: "",
-    ResourceProperties: {
-      ServiceToken: "",
-      Resource: resource as any, // Needed for backward compatibility with tests
-      ResourceId: resourceId,
-      SecretArn:
-        props?.SecretArn || "arn:aws:secretsmanager:us-east-1:123456789:secret:dummy",
-      ...props,
-    } as unknown as ResourceProperties,
-    RequestType: "Delete",
-    PhysicalResourceId: resourceId,
-  }
-}
-
-/**
- * Database helpers.
- */
-export const schemaExists = async (client: Client, schema: string): Promise<boolean> => {
-  const schemas = await getSchemas(client)
-  return schemas.find((s) => s === schema) !== undefined
-}
-
-export const roleGrantedForSchema = async (
-  client: Client,
-  schema: string,
-  role: string
-): Promise<boolean> => {
-  const sql = `select nspname as schema_name, r.rolname as role_name,\
-                      pg_catalog.has_schema_privilege(r.rolname, nspname, 'CREATE') as create_grant,\
-                      pg_catalog.has_schema_privilege(r.rolname, nspname, 'USAGE') as usage_grant\
-                      from pg_namespace pn,pg_catalog.pg_roles r \
-                      where array_to_string(nspacl,',') like '%'||r.rolname||'%' and nspowner > 1 \
-                      and nspname = '${schema}' and r.rolname = '${role}'`
-  const { rows } = await client.query(sql)
-  return (
-    rows.length === 1 && rows[0].create_grant === true && rows[0].usage_grant === true
-  )
-}
-
-const getSchemas = async (client: Client): Promise<string[]> => {
-  const { rows } = await client.query(
-    "select schema_name from information_schema.schemata"
-  )
-  return rows.map((r) => r.schema_name)
-}
-
-export const roleExists = async (client: Client, role: string): Promise<boolean> => {
-  const roles = await getRoles(client)
-  return roles.find((r) => r === role) !== undefined
-}
-
-const getRoles = async (client: Client): Promise<string[]> => {
-  const { rows } = await client.query("select rolname from pg_roles")
-  return rows.map((r) => r.rolname)
-}
-
-export const databaseExists = async (
-  client: Client,
-  database: string
-): Promise<boolean> => {
-  const databases = await getDatabases(client)
-  return databases.find((r) => r === database) !== undefined
-}
-
-const getDatabases = async (client: Client): Promise<string[]> => {
-  const { rows } = await client.query(
-    "select datname from pg_database where datistemplate = false"
-  )
-  return rows.map((r) => r.datname)
-}
-
-export const databaseOwnerIs = async (
-  client: Client,
-  database: string,
-  user_name: string
-): Promise<boolean> => {
-  const databases = await getDatabasesWithOwner(client, user_name)
-  return databases.find((r) => r === database) !== undefined
-}
-
-const getDatabasesWithOwner = async (
-  client: Client,
-  user_name: string
-): Promise<string[]> => {
-  const { rows } = await client.query(
-    `select datname from pg_database where datistemplate = false and pg_catalog.pg_get_userbyid(datdba) = '${user_name}'`
-  )
-  return rows.map((r) => r.datname)
-}
-
-export const rowCount = async (client: Client, table_name: string): Promise<number> => {
-  const { rows } = await client.query(`select count(*) from ${table_name}`)
-  return parseInt(rows[0].count)
-}