rds-database-auto-start-preventer 0.3.5 → 0.4.0

package/.editorconfig

@@ -0,0 +1,12 @@
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
+
+root=true
+
+[*]
+end_of_line=lf
+charset=utf-8
+
+[*\.{js,ts}]
+indent_style=space
+indent_size=2
+max_line_length=120

package/.jsii

@@ -8440,7 +8440,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer.git",
-  "jsiiVersion": "6.0.14 (build 44649f3)",
+  "jsiiVersion": "6.0.15 (build 8b73573)",
   "keywords": [
     "aws",
     "aws-cdk",
@@ -8459,7 +8459,7 @@
   },
   "name": "rds-database-auto-start-preventer",
   "readme": {
-    "markdown": "# RDS Database Auto Start Preventer (AWS CDK v2)\n\n[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer?style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/blob/main/LICENSE)\n[![npm](https://img.shields.io/npm/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/actions/workflows/release.yml)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/releases)\n\n[![View on Construct Hub](https://constructs.dev/badge?package=rds-database-auto-start-preventer)](https://constructs.dev/packages/rds-database-auto-start-preventer)\n\nCDK construct library that stops RDS DB instances and clusters after they are auto-started by AWS (RDS-EVENT-0154 / RDS-EVENT-0153). It uses EventBridge rules and a Durable Lambda to detect auto-start events, filter resources by tags in the handler, stop matching resources when they are `available`, and post a Slack notification only when this Lambda invoked the stop API successfully.\n\n## Features\n\n- **EventBridge integration** – Listens for RDS DB Instance (RDS-EVENT-0154) and DB Cluster (RDS-EVENT-0153) auto-start events\n- **Handler-side tag filtering** – EventBridge rules match all auto-start events; the Lambda evaluates `TagList` from `rds:DescribeDBInstances` / `rds:DescribeDBClusters` and skips resources that do not match `tagKey` / `tagValues`\n- **Durable Lambda** – Uses AWS Lambda Durable Execution for reliable, long-running workflow (initial wait, status wait, stop, and post-stop wait)\n- **Least-privilege IAM** – Grants RDS describe and stop actions only (no Resource Groups Tagging API)\n- **Slack notifications** – Sends a message when this invocation called `StopDBInstance` / `StopDBCluster` and the resource reached `stopped` (no notification when the resource was already stopped or tags did not match)\n- **Optional rule toggle** – EventBridge rules can be enabled or disabled via `enableRule`\n\n## Installation\n\n**npm**\n\n```bash\nnpm install rds-database-auto-start-preventer\n```\n\n**yarn**\n\n```bash\nyarn add rds-database-auto-start-preventer\n```\n\n## Usage\n\n### How it works\n\n1. EventBridge invokes the Durable Lambda with the RDS auto-start event and tag filter parameters (`tagKey`, `tagValues`).\n2. The handler waits 1 minute, then waits on DescribeDB* until the resource leaves transitional statuses.\n3. If the resource tag does not match, the handler exits with no stop action.\n4. If the resource is `available` and tags match, the handler calls StopDB* and waits until `stopped`.\n5. If the resource is already `stopped` (for example, stopped by another process), the handler exits without calling StopDB* and without posting to Slack.\n6. Slack is notified only when StopDB* was invoked by this invocation and the resource reached `stopped`.\n\nTag the RDS instances or clusters you want to protect (for example, `AutoStartPrevent=YES`). Resources without a matching tag are left running.\n\n### Construct\n\nUse `RDSDatabaseAutoStartPreventer` when you want to add auto-start prevention to an existing stack or compose it with other constructs.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { RDSDatabaseAutoStartPreventer } from 'rds-database-auto-start-preventer';\n\nconst stack = new Stack(app, 'MyStack');\n\nnew RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  enableRule: true, // optional, defaults to true\n  secrets: {\n    slackSecretName: 'my-app/slack',\n  },\n});\n```\n\n### Stack\n\nUse `RDSDatabaseAutoStartPreventStack` when you want a dedicated stack that only deploys the RDS auto-start prevent resources.\n\n```typescript\nimport { RDSDatabaseAutoStartPreventStack } from 'rds-database-auto-start-preventer';\n\nnew RDSDatabaseAutoStartPreventStack(app, 'RDSDatabaseAutoStartPreventStack', {\n  stackName: 'rds-database-auto-start-prevent',\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  enableRule: true, // optional, defaults to true\n  secrets: {\n    slackSecretName: 'my-app/slack',\n  },\n});\n```\n\n### Slack secret (AWS Secrets Manager)\n\nStore a JSON object in AWS Secrets Manager with the Slack Bot Token and channel ID:\n\n| Key | Value |\n|-----|-------|\n| `token` | Slack Bot Token (e.g. `xoxb-...`) |\n| `channel` | Slack channel ID (e.g. `C01234ABCD`) |\n\nExample secret value:\n\n```json\n{\n  \"token\": \"xoxb-...\",\n  \"channel\": \"C01234ABCD\"\n}\n```\n\n## Options\n\n| Option | Type | Required | Description |\n|--------|------|----------|-------------|\n| `targetResource` | `TargetResource` | Yes | Tag-based criteria evaluated in the Lambda handler. |\n| `targetResource.tagKey` | `string` | Yes | Tag key to match (e.g. `AutoStartPrevent`, `Environment`). |\n| `targetResource.tagValues` | `string[]` | Yes | Tag values that indicate the resource should be stopped (e.g. `['YES']`, `['production']`). |\n| `enableRule` | `boolean` | No | Whether the EventBridge rules are enabled. Defaults to `true` if omitted. |\n| `secrets` | `Secrets` | Yes | External secrets for notifications. |\n| `secrets.slackSecretName` | `string` | Yes | Name of the Secrets Manager secret containing Slack `token` and `channel`. |\n\n## Requirements\n\n- **Node.js** >= 20.0.0 (for your CDK app)\n- **AWS CDK** ^2.232.0\n- **constructs** ^10.5.1\n- **AWS Lambda** runtime Node.js 24.x with Durable Execution (deployed by the construct)\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
+    "markdown": "# RDS Database Auto Start Preventer (CDK v2)\n\n[![npm version](https://img.shields.io/npm/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![license](https://img.shields.io/npm/l/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![Node.js](https://img.shields.io/node/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)\n[![build](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/build.yml?label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/actions/workflows/build.yml)\n\n[![View on Construct Hub](https://constructs.dev/badge?package=rds-database-auto-start-preventer)](https://constructs.dev/packages/rds-database-auto-start-preventer)\n\nCDK construct library that stops RDS DB instances and clusters after they are auto-started by AWS (RDS-EVENT-0154 / RDS-EVENT-0153). It uses EventBridge rules and a Durable Lambda to detect auto-start events, filter resources by tags in the handler, stop matching resources when they are `available`, and post a Slack notification only when this Lambda invoked the stop API successfully and a Slack secret name is set.\n\n## Features\n\n- **EventBridge integration** – Listens for RDS DB Instance (RDS-EVENT-0154) and DB Cluster (RDS-EVENT-0153) auto-start events\n- **Handler-side tag filtering** – EventBridge rules match all auto-start events; the Lambda evaluates `TagList` from `rds:DescribeDBInstances` / `rds:DescribeDBClusters` and skips resources that do not match `tagKey` / `tagValues`\n- **Durable Lambda** – Uses AWS Lambda Durable Execution for reliable, long-running workflow (initial wait, status wait, stop, and post-stop wait)\n- **Least-privilege IAM** – Grants RDS describe and stop actions only (no Resource Groups Tagging API)\n- **Slack notifications** – When `slackSecretName` is set, sends a message when this invocation called `StopDBInstance` / `StopDBCluster` and the resource reached `stopped` (no notification when the secret name is omitted, the resource was already stopped, or tags did not match)\n- **Optional rule toggle** – EventBridge rules can be enabled or disabled via `enableRule`\n\n## How it works\n\n1. EventBridge invokes the Durable Lambda with the RDS auto-start event and tag filter parameters (`tagKey`, `tagValues`).\n2. The handler waits 1 minute, then waits on DescribeDB* until the resource leaves transitional statuses.\n3. If the resource tag does not match, the handler exits with no stop action.\n4. If the resource is `available` and tags match, the handler calls StopDB* and waits until `stopped`.\n5. If the resource is already `stopped` (for example, stopped by another process), the handler exits without calling StopDB* and without posting to Slack.\n6. When `slackSecretName` is set, Slack is notified only when StopDB* was invoked by this invocation and the resource reached `stopped`. When it is omitted, the handler does not post to Slack.\n\nTag the RDS instances or clusters you want to protect (for example, `AutoStartPrevent=YES`). Resources without a matching tag are left running.\n\n## Installation\n\n### npm\n\n```bash\nnpm install rds-database-auto-start-preventer\n```\n\n### yarn\n\n```bash\nyarn add rds-database-auto-start-preventer\n```\n\n### pnpm\n\n```bash\npnpm add rds-database-auto-start-preventer\n```\n\n## Usage\n\nUse `RDSDatabaseAutoStartPreventer` when you want to add auto-start prevention to an existing stack or compose it with other constructs. Omit `slackSecretName` to stop matching resources without Slack.\n\n```typescript\nimport { App, Stack } from 'aws-cdk-lib';\nimport { RDSDatabaseAutoStartPreventer } from 'rds-database-auto-start-preventer';\n\nconst app = new App();\nconst stack = new Stack(app, 'MyStack');\n\nnew RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  secrets: {},\n});\n```\n\nPass `slackSecretName` when a successful stop should post to Slack. `enableRule` defaults to `true`.\n\n```typescript\nnew RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  enableRule: true,\n  secrets: {\n    slackSecretName: 'my-app/slack',\n  },\n});\n```\n\n### Stack\n\nUse `RDSDatabaseAutoStartPreventStack` when you want a dedicated stack that only deploys the RDS auto-start prevent resources.\n\n```typescript\nimport { App } from 'aws-cdk-lib';\nimport { RDSDatabaseAutoStartPreventStack } from 'rds-database-auto-start-preventer';\n\nconst app = new App();\n\nnew RDSDatabaseAutoStartPreventStack(app, 'RDSDatabaseAutoStartPreventStack', {\n  stackName: 'rds-database-auto-start-prevent',\n  targetResource: {\n    tagKey: 'AutoStartPrevent',\n    tagValues: ['YES'],\n  },\n  secrets: {\n    slackSecretName: 'my-app/slack',\n  },\n});\n```\n\n### Slack secret (AWS Secrets Manager)\n\nStore a JSON object in AWS Secrets Manager with the Slack Bot Token and channel ID:\n\n| Key | Value |\n|-----|-------|\n| `token` | Slack Bot Token (e.g. `xoxb-...`) |\n| `channel` | Slack channel ID (e.g. `C01234ABCD`) |\n\nExample secret value:\n\n```json\n{\n  \"token\": \"xoxb-...\",\n  \"channel\": \"C01234ABCD\"\n}\n```\n\n## Options\n\n| Option | Type | Required | Description |\n|--------|------|----------|-------------|\n| `targetResource` | `TargetResource` | Yes | Tag-based criteria evaluated in the Lambda handler. |\n| `targetResource.tagKey` | `string` | Yes | Tag key to match (e.g. `AutoStartPrevent`, `Environment`). |\n| `targetResource.tagValues` | `string[]` | Yes | Tag values that indicate the resource should be stopped (e.g. `['YES']`, `['production']`). |\n| `enableRule` | `boolean` | No | Whether the EventBridge rules are enabled. Defaults to `true` if omitted. |\n| `secrets` | `Secrets` | Yes | External secrets for notifications. |\n| `secrets.slackSecretName` | `string` | No | Name of the Secrets Manager secret containing Slack `token` and `channel`. Omit it to skip Slack notifications. |\n\nEmpty `tagKey`, an empty `tagValues` array (or blank entries), and a blank `slackSecretName` fail at synthesis. Omitting `slackSecretName` is allowed. Unresolved CDK tokens are not checked.\n\n## API\n\nSee [API.md](./API.md).\n\n## Requirements\n\n- **Node.js** >= 20.0.0 (for your CDK app)\n- **AWS CDK** ^2.232.0\n- **constructs** ^10.5.1\n- **AWS Lambda** runtime Node.js 24.x with Durable Execution (deployed by the construct)\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
   },
   "repository": {
     "type": "git",
@@ -8548,8 +8548,9 @@
         {
           "abstract": true,
           "docs": {
+            "remarks": "Omit slackSecretName to skip Slack.",
             "stability": "stable",
-            "summary": "Secrets (e.g. Slack) for notifications."
+            "summary": "Secrets for notifications."
           },
           "immutable": true,
           "locationInModule": {
@@ -8609,13 +8610,16 @@
       "fqn": "rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventer",
       "initializer": {
         "docs": {
+          "custom": {
+            "throws": "When tagKey or a tag value is blank, tagValues is empty, or slackSecretName is present but blank."
+          },
           "remarks": "The Lambda receives `{ event, params }` where `params` carries `tagKey` and `tagValues`\nfrom {@link RDSDatabaseAutoStartPreventerProps.targetResource}. Tag filters are passed\nonly via that payload (not via `TAG_KEY` / `TAG_VALUES` environment variables).",
           "stability": "stable",
           "summary": "Creates the Durable Lambda, EventBridge rules, and IAM policies."
         },
         "locationInModule": {
           "filename": "src/constructs/rds-database-auto-start-preventer.ts",
-          "line": 64
+          "line": 103
         },
         "parameters": [
           {
@@ -8650,7 +8654,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/constructs/rds-database-auto-start-preventer.ts",
-        "line": 51
+        "line": 89
       },
       "name": "RDSDatabaseAutoStartPreventer",
       "symbolId": "src/constructs/rds-database-auto-start-preventer:RDSDatabaseAutoStartPreventer"
@@ -8666,7 +8670,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/rds-database-auto-start-preventer.ts",
-        "line": 34
+        "line": 38
       },
       "name": "RDSDatabaseAutoStartPreventerProps",
       "properties": [
@@ -8679,7 +8683,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/rds-database-auto-start-preventer.ts",
-            "line": 40
+            "line": 44
           },
           "name": "secrets",
           "type": {
@@ -8695,7 +8699,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/rds-database-auto-start-preventer.ts",
-            "line": 36
+            "line": 40
           },
           "name": "targetResource",
           "type": {
@@ -8712,7 +8716,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/rds-database-auto-start-preventer.ts",
-            "line": 38
+            "line": 42
           },
           "name": "enableRule",
           "optional": true,
@@ -8728,28 +8732,30 @@
       "datatype": true,
       "docs": {
         "stability": "stable",
-        "summary": "External secrets required for notifications (e.g. Slack)."
+        "summary": "External secrets for notifications (e.g. Slack). Omit {@link Secrets.slackSecretName} to skip Slack notifications."
       },
       "fqn": "rds-database-auto-start-preventer.Secrets",
       "kind": "interface",
       "locationInModule": {
         "filename": "src/constructs/rds-database-auto-start-preventer.ts",
-        "line": 26
+        "line": 27
       },
       "name": "Secrets",
       "properties": [
         {
           "abstract": true,
           "docs": {
+            "remarks": "When omitted, the handler stops matching RDS resources and does not post to Slack.",
             "stability": "stable",
             "summary": "Name of the Secrets Manager secret containing Slack token and channel."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/constructs/rds-database-auto-start-preventer.ts",
-            "line": 28
+            "line": 32
           },
           "name": "slackSecretName",
+          "optional": true,
           "type": {
             "primitive": "string"
           }
@@ -8814,6 +8820,6 @@
       "symbolId": "src/constructs/rds-database-auto-start-preventer:TargetResource"
     }
   },
-  "version": "0.3.5",
-  "fingerprint": "8dp6LjjsnLUefJ9yzdPuvhAWsILiL/QgVG7Ef6T/66g="
+  "version": "0.4.0",
+  "fingerprint": "lHihG95VC2qiyCGzTr9eHerH7bSCZZVie3gc1cHgtN8="
 }

package/API.md

@@ -1196,7 +1196,7 @@ const rDSDatabaseAutoStartPreventStackProps: RDSDatabaseAutoStartPreventStackPro
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.synthesizer">synthesizer</a></code> | <code>aws-cdk-lib.IStackSynthesizer</code> | Synthesis method to use while deploying this stack. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.tags">tags</a></code> | <code>{[ key: string ]: string}</code> | Tags that will be applied to the Stack. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.terminationProtection">terminationProtection</a></code> | <code>boolean</code> | Whether to enable termination protection for this stack. |
-| <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.secrets">secrets</a></code> | <code><a href="#rds-database-auto-start-preventer.Secrets">Secrets</a></code> | Secrets (e.g. Slack) for notifications. |
+| <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.secrets">secrets</a></code> | <code><a href="#rds-database-auto-start-preventer.Secrets">Secrets</a></code> | Secrets for notifications. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.targetResource">targetResource</a></code> | <code><a href="#rds-database-auto-start-preventer.TargetResource">TargetResource</a></code> | Tag-based target resource criteria for RDS instances/clusters to protect. |
 | <code><a href="#rds-database-auto-start-preventer.RDSDatabaseAutoStartPreventStackProps.property.enableRule">enableRule</a></code> | <code>boolean</code> | Whether the EventBridge rules are enabled. |
 
@@ -1454,7 +1454,9 @@ public readonly secrets: Secrets;
 
 - *Type:* <a href="#rds-database-auto-start-preventer.Secrets">Secrets</a>
 
-Secrets (e.g. Slack) for notifications.
+Secrets for notifications.
+
+Omit slackSecretName to skip Slack.
 
 ---
 
@@ -1486,7 +1488,7 @@ Defaults to true if omitted.
 
 ### Secrets <a name="Secrets" id="rds-database-auto-start-preventer.Secrets"></a>
 
-External secrets required for notifications (e.g. Slack).
+External secrets for notifications (e.g. Slack). Omit {@link Secrets.slackSecretName} to skip Slack notifications.
 
 #### Initializer <a name="Initializer" id="rds-database-auto-start-preventer.Secrets.Initializer"></a>
 
@@ -1504,7 +1506,7 @@ const secrets: Secrets = { ... }
 
 ---
 
-##### `slackSecretName`<sup>Required</sup> <a name="slackSecretName" id="rds-database-auto-start-preventer.Secrets.property.slackSecretName"></a>
+##### `slackSecretName`<sup>Optional</sup> <a name="slackSecretName" id="rds-database-auto-start-preventer.Secrets.property.slackSecretName"></a>
 
 ```typescript
 public readonly slackSecretName: string;
@@ -1514,6 +1516,8 @@ public readonly slackSecretName: string;
 
 Name of the Secrets Manager secret containing Slack token and channel.
 
+When omitted, the handler stops matching RDS resources and does not post to Slack.
+
 ---
 
 ### TargetResource <a name="TargetResource" id="rds-database-auto-start-preventer.TargetResource"></a>

package/README.md

@@ -1,13 +1,13 @@
-# RDS Database Auto Start Preventer (AWS CDK v2)
+# RDS Database Auto Start Preventer (CDK v2)
 
-[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer?style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/blob/main/LICENSE)
-[![npm](https://img.shields.io/npm/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)
-[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/actions/workflows/release.yml)
-[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/releases)
+[![npm version](https://img.shields.io/npm/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)
+[![license](https://img.shields.io/npm/l/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)
+[![Node.js](https://img.shields.io/node/v/rds-database-auto-start-preventer?style=flat-square)](https://www.npmjs.com/package/rds-database-auto-start-preventer)
+[![build](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/build.yml?label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-constructs/rds-database-auto-start-preventer/actions/workflows/build.yml)
 
 [![View on Construct Hub](https://constructs.dev/badge?package=rds-database-auto-start-preventer)](https://constructs.dev/packages/rds-database-auto-start-preventer)
 
-CDK construct library that stops RDS DB instances and clusters after they are auto-started by AWS (RDS-EVENT-0154 / RDS-EVENT-0153). It uses EventBridge rules and a Durable Lambda to detect auto-start events, filter resources by tags in the handler, stop matching resources when they are `available`, and post a Slack notification only when this Lambda invoked the stop API successfully.
+CDK construct library that stops RDS DB instances and clusters after they are auto-started by AWS (RDS-EVENT-0154 / RDS-EVENT-0153). It uses EventBridge rules and a Durable Lambda to detect auto-start events, filter resources by tags in the handler, stop matching resources when they are `available`, and post a Slack notification only when this Lambda invoked the stop API successfully and a Slack secret name is set.
 
 ## Features
 
@@ -15,44 +15,49 @@ CDK construct library that stops RDS DB instances and clusters after they are au
 - **Handler-side tag filtering** – EventBridge rules match all auto-start events; the Lambda evaluates `TagList` from `rds:DescribeDBInstances` / `rds:DescribeDBClusters` and skips resources that do not match `tagKey` / `tagValues`
 - **Durable Lambda** – Uses AWS Lambda Durable Execution for reliable, long-running workflow (initial wait, status wait, stop, and post-stop wait)
 - **Least-privilege IAM** – Grants RDS describe and stop actions only (no Resource Groups Tagging API)
-- **Slack notifications** – Sends a message when this invocation called `StopDBInstance` / `StopDBCluster` and the resource reached `stopped` (no notification when the resource was already stopped or tags did not match)
+- **Slack notifications** – When `slackSecretName` is set, sends a message when this invocation called `StopDBInstance` / `StopDBCluster` and the resource reached `stopped` (no notification when the secret name is omitted, the resource was already stopped, or tags did not match)
 - **Optional rule toggle** – EventBridge rules can be enabled or disabled via `enableRule`
 
+## How it works
+
+1. EventBridge invokes the Durable Lambda with the RDS auto-start event and tag filter parameters (`tagKey`, `tagValues`).
+2. The handler waits 1 minute, then waits on DescribeDB* until the resource leaves transitional statuses.
+3. If the resource tag does not match, the handler exits with no stop action.
+4. If the resource is `available` and tags match, the handler calls StopDB* and waits until `stopped`.
+5. If the resource is already `stopped` (for example, stopped by another process), the handler exits without calling StopDB* and without posting to Slack.
+6. When `slackSecretName` is set, Slack is notified only when StopDB* was invoked by this invocation and the resource reached `stopped`. When it is omitted, the handler does not post to Slack.
+
+Tag the RDS instances or clusters you want to protect (for example, `AutoStartPrevent=YES`). Resources without a matching tag are left running.
+
 ## Installation
 
-**npm**
+### npm
 
 ```bash
 npm install rds-database-auto-start-preventer
 ```
 
-**yarn**
+### yarn
 
 ```bash
 yarn add rds-database-auto-start-preventer
 ```
 
-## Usage
-
-### How it works
+### pnpm
 
-1. EventBridge invokes the Durable Lambda with the RDS auto-start event and tag filter parameters (`tagKey`, `tagValues`).
-2. The handler waits 1 minute, then waits on DescribeDB* until the resource leaves transitional statuses.
-3. If the resource tag does not match, the handler exits with no stop action.
-4. If the resource is `available` and tags match, the handler calls StopDB* and waits until `stopped`.
-5. If the resource is already `stopped` (for example, stopped by another process), the handler exits without calling StopDB* and without posting to Slack.
-6. Slack is notified only when StopDB* was invoked by this invocation and the resource reached `stopped`.
-
-Tag the RDS instances or clusters you want to protect (for example, `AutoStartPrevent=YES`). Resources without a matching tag are left running.
+```bash
+pnpm add rds-database-auto-start-preventer
+```
 
-### Construct
+## Usage
 
-Use `RDSDatabaseAutoStartPreventer` when you want to add auto-start prevention to an existing stack or compose it with other constructs.
+Use `RDSDatabaseAutoStartPreventer` when you want to add auto-start prevention to an existing stack or compose it with other constructs. Omit `slackSecretName` to stop matching resources without Slack.
 
 ```typescript
-import { Stack } from 'aws-cdk-lib';
+import { App, Stack } from 'aws-cdk-lib';
 import { RDSDatabaseAutoStartPreventer } from 'rds-database-auto-start-preventer';
 
+const app = new App();
 const stack = new Stack(app, 'MyStack');
 
 new RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {
@@ -60,7 +65,19 @@ new RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {
     tagKey: 'AutoStartPrevent',
     tagValues: ['YES'],
   },
-  enableRule: true, // optional, defaults to true
+  secrets: {},
+});
+```
+
+Pass `slackSecretName` when a successful stop should post to Slack. `enableRule` defaults to `true`.
+
+```typescript
+new RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {
+  targetResource: {
+    tagKey: 'AutoStartPrevent',
+    tagValues: ['YES'],
+  },
+  enableRule: true,
   secrets: {
     slackSecretName: 'my-app/slack',
   },
@@ -72,15 +89,17 @@ new RDSDatabaseAutoStartPreventer(stack, 'RDSDatabaseAutoStartPreventer', {
 Use `RDSDatabaseAutoStartPreventStack` when you want a dedicated stack that only deploys the RDS auto-start prevent resources.
 
 ```typescript
+import { App } from 'aws-cdk-lib';
 import { RDSDatabaseAutoStartPreventStack } from 'rds-database-auto-start-preventer';
 
+const app = new App();
+
 new RDSDatabaseAutoStartPreventStack(app, 'RDSDatabaseAutoStartPreventStack', {
   stackName: 'rds-database-auto-start-prevent',
   targetResource: {
     tagKey: 'AutoStartPrevent',
     tagValues: ['YES'],
   },
-  enableRule: true, // optional, defaults to true
   secrets: {
     slackSecretName: 'my-app/slack',
   },
@@ -114,7 +133,13 @@ Example secret value:
 | `targetResource.tagValues` | `string[]` | Yes | Tag values that indicate the resource should be stopped (e.g. `['YES']`, `['production']`). |
 | `enableRule` | `boolean` | No | Whether the EventBridge rules are enabled. Defaults to `true` if omitted. |
 | `secrets` | `Secrets` | Yes | External secrets for notifications. |
-| `secrets.slackSecretName` | `string` | Yes | Name of the Secrets Manager secret containing Slack `token` and `channel`. |
+| `secrets.slackSecretName` | `string` | No | Name of the Secrets Manager secret containing Slack `token` and `channel`. Omit it to skip Slack notifications. |
+
+Empty `tagKey`, an empty `tagValues` array (or blank entries), and a blank `slackSecretName` fail at synthesis. Omitting `slackSecretName` is allowed. Unresolved CDK tokens are not checked.
+
+## API
+
+See [API.md](./API.md).
 
 ## Requirements