serverless-simple-middleware 0.0.69 → 0.0.71

package/dist/internal/oncePromise.d.ts

@@ -0,0 +1,7 @@
+export declare class OncePromise<T> {
+    private promise?;
+    private factory?;
+    constructor(factory?: () => Promise<T>);
+    run(factory?: () => Promise<T>): Promise<T>;
+    reset(): void;
+}

package/dist/internal/oncePromise.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OncePromise = void 0;
+class OncePromise {
+    promise;
+    factory;
+    constructor(factory) {
+        this.factory = factory;
+    }
+    async run(factory) {
+        if (!this.promise) {
+            const f = factory || this.factory;
+            if (!f) {
+                throw new Error('OncePromise requires a factory');
+            }
+            this.promise = f();
+            try {
+                return await this.promise;
+            }
+            catch (err) {
+                this.promise = undefined;
+                throw err;
+            }
+        }
+        return this.promise;
+    }
+    reset() {
+        this.promise = undefined;
+    }
+}
+exports.OncePromise = OncePromise;

package/dist/middleware/database/connectionProxy.d.ts

@@ -1,10 +1,14 @@
 import { MySQLPluginOptions } from '../mysql';
 export declare class ConnectionProxy {
-    private pluginConfig;
+    private readonly options;
     private connection?;
+    private connectionConfig;
+    private secretsCache;
+    private configInitOnce;
+    private connectionInitOnce;
     private initialized;
     private dbName?;
-    constructor(config: MySQLPluginOptions);
+    constructor(options: MySQLPluginOptions);
     query: <T>(sql: string, params?: any[]) => Promise<T | undefined>;
     fetch: <T>(sql: string, params?: any[]) => Promise<T[]>;
     fetchOne: <T>(sql: string, params?: any[], defaultValue?: T) => Promise<T>;
@@ -19,6 +23,7 @@ export declare class ConnectionProxy {
     destroyConnection: () => void;
     onPluginCreated: () => Promise<void>;
     private prepareConnection;
+    private ensureConnectionConfig;
     private changeDatabase;
     private tryToInitializeSchema;
 }

package/dist/middleware/database/connectionProxy.js

@@ -1,28 +1,35 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConnectionProxy = void 0;
-const mysql_1 = require("mysql");
+const mysql2_1 = require("mysql2");
+const oncePromise_1 = require("../../internal/oncePromise");
 const utils_1 = require("../../utils");
+const secretsManager_1 = require("../../utils/secretsManager");
 const logger = (0, utils_1.getLogger)(__filename);
 class ConnectionProxy {
-    pluginConfig;
+    options;
     connection;
+    connectionConfig;
+    secretsCache;
+    configInitOnce = new oncePromise_1.OncePromise();
+    connectionInitOnce = new oncePromise_1.OncePromise();
     initialized;
     dbName;
-    constructor(config) {
-        this.pluginConfig = config;
-        if (config.schema && config.schema.database) {
-            this.dbName = config.config.database;
-            config.config.database = undefined;
+    constructor(options) {
+        this.options = options;
+        if (options.schema && options.schema.database) {
+            this.dbName = options.config.database;
+            options.config.database = undefined;
         }
+        this.secretsCache = secretsManager_1.SecretsManagerCache.getInstance();
     }
     query = (sql, params) => new Promise(async (resolve, reject) => {
-        const connection = this.prepareConnection();
+        const connection = await this.prepareConnection();
         await this.tryToInitializeSchema(false);
         if (process.env.NODE_ENV !== 'test') {
             logger.silly(`Execute query[${sql}] with params[${params}]`);
         }
-        connection.query(sql, params, (err, result) => {
+        connection.query(sql, params, (err, result, _fields) => {
             if (err) {
                 logger.error(`error occurred in database query=${sql}, error=${err}`);
                 reject(err);
@@ -44,7 +51,7 @@ class ConnectionProxy {
         return res[0];
     });
     beginTransaction = () => new Promise(async (resolve, reject) => {
-        const connection = this.prepareConnection();
+        const connection = await this.prepareConnection();
         await this.tryToInitializeSchema(false);
         connection.beginTransaction((err) => {
             if (err) {
@@ -55,7 +62,7 @@ class ConnectionProxy {
         });
     });
     commit = () => new Promise(async (resolve, reject) => {
-        const connection = this.prepareConnection();
+        const connection = await this.prepareConnection();
         await this.tryToInitializeSchema(false);
         connection.commit((err) => {
             if (err) {
@@ -66,7 +73,7 @@ class ConnectionProxy {
         });
     });
     rollback = () => new Promise(async (resolve, reject) => {
-        const connection = this.prepareConnection();
+        const connection = await this.prepareConnection();
         await this.tryToInitializeSchema(false);
         connection.rollback((err) => {
             if (err) {
@@ -80,6 +87,7 @@ class ConnectionProxy {
         if (this.connection) {
             this.connection.end();
             this.connection = undefined;
+            this.connectionInitOnce.reset();
             logger.verbose('Connection is end');
         }
     };
@@ -91,23 +99,48 @@ class ConnectionProxy {
         if (this.connection) {
             this.connection.destroy();
             this.connection = undefined;
+            this.connectionInitOnce.reset();
             logger.verbose('Connection is destroyed');
         }
     };
     onPluginCreated = async () => this.tryToInitializeSchema(true);
-    prepareConnection = () => {
+    prepareConnection = async () => {
         if (this.connection) {
             return this.connection;
         }
-        this.connection = (0, mysql_1.createConnection)(this.pluginConfig.config);
-        this.connection.connect();
-        return this.connection;
+        return await this.connectionInitOnce.run(async () => {
+            await this.ensureConnectionConfig();
+            const conn = (0, mysql2_1.createConnection)(this.connectionConfig);
+            conn.connect();
+            this.connection = conn;
+            return this.connection;
+        });
+    };
+    ensureConnectionConfig = async () => {
+        if (this.connectionConfig) {
+            return;
+        }
+        await this.configInitOnce.run(async () => {
+            const baseConfig = this.options.config;
+            if (!this.options.secretId) {
+                this.connectionConfig = baseConfig;
+                return;
+            }
+            const credentials = await this.secretsCache.getDatabaseCredentials(this.options.secretId);
+            this.connectionConfig = {
+                ...baseConfig,
+                user: credentials.username,
+                password: credentials.password,
+            };
+        });
     };
-    changeDatabase = (dbName) => new Promise((resolve, reject) => this.prepareConnection().changeUser({
+    changeDatabase = async (dbName) => new Promise((resolve, reject) => this.prepareConnection()
+        .then((connection) => connection.changeUser({
         database: dbName,
-    }, (err) => (err ? reject(err) : resolve(undefined))));
+    }, (err) => (err ? reject(err) : resolve(undefined))))
+        .catch(reject));
     tryToInitializeSchema = async (initial) => {
-        const { eager = false, ignoreError = false, database = '', tables = {}, } = this.pluginConfig.schema || {};
+        const { eager = false, ignoreError = false, database = '', tables = {}, } = this.options.schema || {};
         if (initial && !eager) {
             return;
         }

package/dist/middleware/database/sqlClient.d.ts

@@ -1,8 +1,8 @@
 import { Kysely } from 'kysely';
-import { type ConnectionOptions } from 'mysql2';
+import { MySQLPluginOptions } from '../mysql';
 export declare class SQLClient<T = unknown> extends Kysely<T> {
     private pool;
-    constructor(config: ConnectionOptions);
+    constructor(config: MySQLPluginOptions);
     clearConnection: () => Promise<void>;
     /**
      * Destroy the connection socket immediately. No further events or callbacks will be triggered.

package/dist/middleware/database/sqlClient.js

@@ -3,31 +3,66 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sql = exports.expressionBuilder = exports.SQLClient = void 0;
 const kysely_1 = require("kysely");
 const mysql2_1 = require("mysql2");
+const oncePromise_1 = require("../../internal/oncePromise");
+const secretsManager_1 = require("../../utils/secretsManager");
 class LazyConnectionPool {
-    config;
+    options;
     connection = null;
-    constructor(config) {
-        this.config = config;
+    connectionConfig;
+    secretsCache;
+    configInitOnce = new oncePromise_1.OncePromise();
+    connectionInitOnce = new oncePromise_1.OncePromise();
+    constructor(options) {
+        this.options = options;
+        this.secretsCache = secretsManager_1.SecretsManagerCache.getInstance();
     }
-    getConnection = (callback) => {
-        if (this.connection) {
-            callback(null, this.connection);
+    ensureConnectionConfig = async () => {
+        if (this.connectionConfig) {
             return;
         }
-        const conn = (0, mysql2_1.createConnection)(this.config);
-        conn.connect((err) => {
-            if (err) {
-                callback(err, {});
+        await this.configInitOnce.run(async () => {
+            const baseConfig = this.options.config;
+            if (!this.options.secretId) {
+                this.connectionConfig = baseConfig;
                 return;
             }
-            this.connection = this._addRelease(conn);
-            callback(null, this.connection);
+            const credentials = await this.secretsCache.getDatabaseCredentials(this.options.secretId);
+            this.connectionConfig = {
+                ...baseConfig,
+                user: credentials.username,
+                password: credentials.password,
+            };
         });
     };
+    getConnection = (callback) => {
+        if (this.connection) {
+            callback(null, this.connection);
+            return;
+        }
+        this.connectionInitOnce
+            .run(async () => {
+            await this.ensureConnectionConfig();
+            const conn = (0, mysql2_1.createConnection)(this.connectionConfig);
+            return await new Promise((resolve, reject) => {
+                conn.connect((err) => {
+                    if (err) {
+                        reject(err);
+                        return;
+                    }
+                    const wrapped = this._addRelease(conn);
+                    this.connection = wrapped;
+                    resolve(wrapped);
+                });
+            });
+        })
+            .then((conn) => callback(null, conn))
+            .catch((err) => callback(err, {}));
+    };
     end = (callback) => {
         if (this.connection) {
             this.connection.end((err) => {
                 this.connection = null;
+                this.connectionInitOnce.reset();
                 callback(err);
             });
         }
@@ -39,6 +74,7 @@ class LazyConnectionPool {
         if (this.connection) {
             this.connection.destroy();
             this.connection = null;
+            this.connectionInitOnce.reset();
         }
     };
     _addRelease = (connection) => Object.assign(connection, {
@@ -49,7 +85,7 @@ class SQLClient extends kysely_1.Kysely {
     pool;
     constructor(config) {
         const pool = new LazyConnectionPool(config);
-        super({
+        const kyselyConfig = {
             dialect: new kysely_1.MysqlDialect({
                 pool,
             }),
@@ -58,7 +94,8 @@ class SQLClient extends kysely_1.Kysely {
                     strategy: kysely_1.replaceWithNoncontingentExpression,
                 }),
             ],
-        });
+        };
+        super(kyselyConfig);
         this.pool = pool;
     }
     clearConnection = () => new Promise((resolve) => {

package/dist/middleware/mysql.d.ts

@@ -1,10 +1,17 @@
-import type { ConnectionConfig } from 'mysql';
-import type { PoolOptions } from 'mysql2';
+import type { ConnectionOptions, PoolOptions } from 'mysql2';
 import { HandlerAuxBase, HandlerPluginBase } from './base';
 import { ConnectionProxy } from './database/connectionProxy';
 import { SQLClient } from './database/sqlClient';
+export interface DatabaseCredentials {
+    username: string;
+    password: string;
+}
 export interface MySQLPluginOptions {
-    config: ConnectionConfig & PoolOptions;
+    config: ConnectionOptions & PoolOptions;
+    /**
+     * AWS Secrets Manager secret ID containing {@link DatabaseCredentials}
+     */
+    secretId?: string;
     schema?: {
         eager?: boolean;
         ignoreError?: boolean;

package/dist/middleware/mysql.js

@@ -10,7 +10,7 @@ class MySQLPlugin extends base_1.HandlerPluginBase {
     constructor(options) {
         super();
         this.proxy = new connectionProxy_1.ConnectionProxy(options);
-        this.sqlClient = new sqlClient_1.SQLClient(options.config);
+        this.sqlClient = new sqlClient_1.SQLClient(options);
     }
     create = async () => {
         await this.proxy.onPluginCreated();

package/dist/utils/secretsManager.d.ts

@@ -0,0 +1,11 @@
+import type { DatabaseCredentials } from '../middleware/mysql';
+export declare class SecretsManagerCache {
+    private static instance;
+    private client;
+    private cache;
+    private constructor();
+    static getInstance(): SecretsManagerCache;
+    private getClient;
+    getSecret<T = any>(secretId: string): Promise<T>;
+    getDatabaseCredentials(secretId: string): Promise<DatabaseCredentials>;
+}

package/dist/utils/secretsManager.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsManagerCache = void 0;
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const logger_1 = require("./logger");
+const misc_1 = require("./misc");
+const logger = (0, logger_1.getLogger)(__filename);
+class SecretsManagerCache {
+    static instance;
+    client;
+    cache = new Map();
+    constructor() { }
+    static getInstance() {
+        if (!SecretsManagerCache.instance) {
+            SecretsManagerCache.instance = new SecretsManagerCache();
+        }
+        return SecretsManagerCache.instance;
+    }
+    getClient() {
+        if (!this.client) {
+            this.client = new client_secrets_manager_1.SecretsManagerClient({});
+            logger.debug('SecretsManager client initialized');
+        }
+        return this.client;
+    }
+    async getSecret(secretId) {
+        if (this.cache.has(secretId)) {
+            logger.debug(`Secret ${secretId} found in cache`);
+            return this.cache.get(secretId);
+        }
+        try {
+            const command = new client_secrets_manager_1.GetSecretValueCommand({ SecretId: secretId });
+            const response = await this.getClient().send(command);
+            if (!response.SecretString) {
+                throw new Error(`Secret ${secretId} has no SecretString value`);
+            }
+            const secretValue = JSON.parse(response.SecretString);
+            this.cache.set(secretId, secretValue);
+            return secretValue;
+        }
+        catch (error) {
+            logger.error(`Failed to fetch secret ${secretId}: ${(0, misc_1.stringifyError)(error)}`);
+            throw error;
+        }
+    }
+    async getDatabaseCredentials(secretId) {
+        const secret = await this.getSecret(secretId);
+        if (!secret.username || !secret.password) {
+            throw new Error(`Secret ${secretId} does not contain required database credentials (username, password)`);
+        }
+        return secret;
+    }
+}
+exports.SecretsManagerCache = SecretsManagerCache;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "serverless-simple-middleware",
   "description": "Simple middleware to translate the interface of lambda's handler to request => response",
-  "version": "0.0.69",
+  "version": "0.0.71",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "author": "VoyagerX",
@@ -32,19 +32,17 @@
   "dependencies": {
     "@aws-sdk/client-dynamodb": "^3.828.0",
     "@aws-sdk/client-s3": "^3.828.0",
+    "@aws-sdk/client-secrets-manager": "3.828.0",
     "@aws-sdk/client-sqs": "^3.828.0",
     "@aws-sdk/cloudfront-signer": "^3.821.0",
     "@aws-sdk/lib-dynamodb": "^3.828.0",
     "@aws-sdk/lib-storage": "^3.828.0",
     "@aws-sdk/s3-request-presigner": "^3.828.0",
     "@types/aws-lambda": "8",
-    "@types/mysql": "^2.15.5",
     "cross-fetch": "^2.2.2",
     "kysely": "^0.28.2",
-    "mysql": "^2.16.0",
     "mysql2": "^3.14.1",
     "nanoid": "4.0.2",
-    "p-limit": "^2.0.0",
     "simple-staging": "^0.0.12",
     "ts-enum-util": "^3.1.0",
     "uuid": "^3.3.2"

package/src/internal/oncePromise.ts

@@ -0,0 +1,29 @@
+export class OncePromise<T> {
+  private promise?: Promise<T>;
+  private factory?: () => Promise<T>;
+
+  constructor(factory?: () => Promise<T>) {
+    this.factory = factory;
+  }
+
+  public async run(factory?: () => Promise<T>): Promise<T> {
+    if (!this.promise) {
+      const f = factory || this.factory;
+      if (!f) {
+        throw new Error('OncePromise requires a factory');
+      }
+      this.promise = f();
+      try {
+        return await this.promise;
+      } catch (err) {
+        this.promise = undefined;
+        throw err;
+      }
+    }
+    return this.promise;
+  }
+
+  public reset(): void {
+    this.promise = undefined;
+  }
+}

package/src/middleware/database/connectionProxy.ts

@@ -1,43 +1,61 @@
-import { createConnection, type Connection, type MysqlError } from 'mysql';
+import {
+  createConnection,
+  type Connection,
+  type ConnectionOptions,
+  type FieldPacket,
+  type QueryError,
+  type QueryResult,
+} from 'mysql2';
+import { OncePromise } from '../../internal/oncePromise';
 import { getLogger } from '../../utils';
+import { SecretsManagerCache } from '../../utils/secretsManager';
 import { MySQLPluginOptions } from '../mysql';
 
 const logger = getLogger(__filename);
 
 export class ConnectionProxy {
-  private pluginConfig: MySQLPluginOptions;
   private connection?: Connection;
+  private connectionConfig: ConnectionOptions;
+  private secretsCache: SecretsManagerCache;
+  private configInitOnce = new OncePromise<void>();
+  private connectionInitOnce = new OncePromise<Connection>();
 
   private initialized: boolean;
   private dbName?: string;
 
-  public constructor(config: MySQLPluginOptions) {
-    this.pluginConfig = config;
-    if (config.schema && config.schema.database) {
-      this.dbName = config.config.database;
-      config.config.database = undefined;
+  public constructor(private readonly options: MySQLPluginOptions) {
+    if (options.schema && options.schema.database) {
+      this.dbName = options.config.database;
+      options.config.database = undefined;
     }
+    this.secretsCache = SecretsManagerCache.getInstance();
   }
 
   public query = <T>(sql: string, params?: any[]) =>
     new Promise<T | undefined>(async (resolve, reject) => {
-      const connection = this.prepareConnection();
+      const connection = await this.prepareConnection();
       await this.tryToInitializeSchema(false);
 
       if (process.env.NODE_ENV !== 'test') {
         logger.silly(`Execute query[${sql}] with params[${params}]`);
       }
-      connection.query(sql, params, (err: MysqlError, result?: T) => {
-        if (err) {
-          logger.error(`error occurred in database query=${sql}, error=${err}`);
-          reject(err);
-        } else {
-          resolve(result);
-          if (process.env.NODE_ENV !== 'test') {
-            logger.silly(`DB result is ${JSON.stringify(result)}`);
+      connection.query(
+        sql,
+        params,
+        (err: QueryError, result: QueryResult, _fields?: FieldPacket[]) => {
+          if (err) {
+            logger.error(
+              `error occurred in database query=${sql}, error=${err}`,
+            );
+            reject(err);
+          } else {
+            resolve(result as T);
+            if (process.env.NODE_ENV !== 'test') {
+              logger.silly(`DB result is ${JSON.stringify(result)}`);
+            }
           }
-        }
-      });
+        },
+      );
     });
 
   public fetch = <T>(sql: string, params?: any[]) =>
@@ -54,10 +72,10 @@ export class ConnectionProxy {
 
   public beginTransaction = () =>
     new Promise<void>(async (resolve, reject) => {
-      const connection = this.prepareConnection();
+      const connection = await this.prepareConnection();
       await this.tryToInitializeSchema(false);
 
-      connection.beginTransaction((err: MysqlError) => {
+      connection.beginTransaction((err: QueryError) => {
         if (err) {
           reject(err);
           return;
@@ -68,10 +86,10 @@ export class ConnectionProxy {
 
   public commit = () =>
     new Promise<void>(async (resolve, reject) => {
-      const connection = this.prepareConnection();
+      const connection = await this.prepareConnection();
       await this.tryToInitializeSchema(false);
 
-      connection.commit((err: MysqlError) => {
+      connection.commit((err: QueryError) => {
         if (err) {
           reject(err);
           return;
@@ -82,10 +100,10 @@ export class ConnectionProxy {
 
   public rollback = () =>
     new Promise<void>(async (resolve, reject) => {
-      const connection = this.prepareConnection();
+      const connection = await this.prepareConnection();
       await this.tryToInitializeSchema(false);
 
-      connection.rollback((err: MysqlError) => {
+      connection.rollback((err: QueryError) => {
         if (err) {
           reject(err);
           return;
@@ -98,6 +116,7 @@ export class ConnectionProxy {
     if (this.connection) {
       this.connection.end();
       this.connection = undefined;
+      this.connectionInitOnce.reset();
       logger.verbose('Connection is end');
     }
   };
@@ -110,29 +129,61 @@ export class ConnectionProxy {
     if (this.connection) {
       this.connection.destroy();
       this.connection = undefined;
+      this.connectionInitOnce.reset();
       logger.verbose('Connection is destroyed');
     }
   };
 
   public onPluginCreated = async () => this.tryToInitializeSchema(true);
 
-  private prepareConnection = () => {
+  private prepareConnection = async (): Promise<Connection> => {
     if (this.connection) {
       return this.connection;
     }
-    this.connection = createConnection(this.pluginConfig.config);
-    this.connection.connect();
-    return this.connection;
+
+    return await this.connectionInitOnce.run(async () => {
+      await this.ensureConnectionConfig();
+      const conn = createConnection(this.connectionConfig);
+      conn.connect();
+      this.connection = conn;
+      return this.connection;
+    });
+  };
+
+  private ensureConnectionConfig = async (): Promise<void> => {
+    if (this.connectionConfig) {
+      return;
+    }
+
+    await this.configInitOnce.run(async () => {
+      const baseConfig = this.options.config;
+      if (!this.options.secretId) {
+        this.connectionConfig = baseConfig;
+        return;
+      }
+      const credentials = await this.secretsCache.getDatabaseCredentials(
+        this.options.secretId,
+      );
+      this.connectionConfig = {
+        ...baseConfig,
+        user: credentials.username,
+        password: credentials.password,
+      };
+    });
   };
 
-  private changeDatabase = (dbName: string) =>
+  private changeDatabase = async (dbName: string) =>
     new Promise<void>((resolve, reject) =>
-      this.prepareConnection().changeUser(
-        {
-          database: dbName,
-        },
-        (err) => (err ? reject(err) : resolve(undefined)),
-      ),
+      this.prepareConnection()
+        .then((connection) =>
+          connection.changeUser(
+            {
+              database: dbName,
+            },
+            (err) => (err ? reject(err) : resolve(undefined)),
+          ),
+        )
+        .catch(reject),
     );
 
   private tryToInitializeSchema = async (initial: boolean) => {
@@ -141,7 +192,7 @@ export class ConnectionProxy {
       ignoreError = false,
       database = '',
       tables = {},
-    } = this.pluginConfig.schema || {};
+    } = this.options.schema || {};
     if (initial && !eager) {
       return;
     }

package/src/middleware/database/sqlClient.ts

@@ -1,16 +1,20 @@
 import {
   HandleEmptyInListsPlugin,
   Kysely,
+  type KyselyConfig,
   MysqlDialect,
-  MysqlPool,
+  type MysqlPool,
   replaceWithNoncontingentExpression,
 } from 'kysely';
 import {
-  createConnection,
   type Connection,
   type ConnectionOptions,
+  createConnection,
   type QueryError,
 } from 'mysql2';
+import { OncePromise } from '../../internal/oncePromise';
+import { SecretsManagerCache } from '../../utils/secretsManager';
+import { MySQLPluginOptions } from '../mysql';
 
 interface LazyMysqlPoolConnection extends Connection {
   release: () => void;
@@ -18,8 +22,37 @@ interface LazyMysqlPoolConnection extends Connection {
 
 class LazyConnectionPool implements MysqlPool {
   private connection: LazyMysqlPoolConnection | null = null;
+  private connectionConfig: ConnectionOptions;
+  private secretsCache: SecretsManagerCache;
+  private configInitOnce = new OncePromise<void>();
+  private connectionInitOnce = new OncePromise<LazyMysqlPoolConnection>();
+
+  constructor(private readonly options: MySQLPluginOptions) {
+    this.secretsCache = SecretsManagerCache.getInstance();
+  }
+
+  private ensureConnectionConfig = async (): Promise<void> => {
+    if (this.connectionConfig) {
+      return;
+    }
+
+    await this.configInitOnce.run(async () => {
+      const baseConfig = this.options.config;
+      if (!this.options.secretId) {
+        this.connectionConfig = baseConfig;
+        return;
+      }
+      const credentials = await this.secretsCache.getDatabaseCredentials(
+        this.options.secretId,
+      );
 
-  constructor(private config: ConnectionOptions) {}
+      this.connectionConfig = {
+        ...baseConfig,
+        user: credentials.username,
+        password: credentials.password,
+      };
+    });
+  };
 
   public getConnection = (
     callback: (error: unknown, connection: LazyMysqlPoolConnection) => void,
@@ -28,21 +61,32 @@ class LazyConnectionPool implements MysqlPool {
       callback(null, this.connection);
       return;
     }
-    const conn = createConnection(this.config);
-    conn.connect((err: QueryError) => {
-      if (err) {
-        callback(err, {} as LazyMysqlPoolConnection);
-        return;
-      }
-      this.connection = this._addRelease(conn);
-      callback(null, this.connection);
-    });
+
+    this.connectionInitOnce
+      .run(async () => {
+        await this.ensureConnectionConfig();
+        const conn = createConnection(this.connectionConfig);
+        return await new Promise<LazyMysqlPoolConnection>((resolve, reject) => {
+          conn.connect((err: QueryError) => {
+            if (err) {
+              reject(err);
+              return;
+            }
+            const wrapped = this._addRelease(conn);
+            this.connection = wrapped;
+            resolve(wrapped);
+          });
+        });
+      })
+      .then((conn) => callback(null, conn))
+      .catch((err) => callback(err, {} as LazyMysqlPoolConnection));
   };
 
   public end = (callback: (error: unknown) => void): void => {
     if (this.connection) {
       this.connection.end((err: QueryError) => {
         this.connection = null;
+        this.connectionInitOnce.reset();
         callback(err);
       });
     } else {
@@ -54,6 +98,7 @@ class LazyConnectionPool implements MysqlPool {
     if (this.connection) {
       this.connection.destroy();
       this.connection = null;
+      this.connectionInitOnce.reset();
     }
   };
 
@@ -66,9 +111,9 @@ class LazyConnectionPool implements MysqlPool {
 export class SQLClient<T = unknown> extends Kysely<T> {
   private pool: LazyConnectionPool;
 
-  constructor(config: ConnectionOptions) {
+  constructor(config: MySQLPluginOptions) {
     const pool = new LazyConnectionPool(config);
-    super({
+    const kyselyConfig: KyselyConfig = {
       dialect: new MysqlDialect({
         pool,
       }),
@@ -77,7 +122,8 @@ export class SQLClient<T = unknown> extends Kysely<T> {
           strategy: replaceWithNoncontingentExpression,
         }),
       ],
-    });
+    };
+    super(kyselyConfig);
     this.pool = pool;
   }
 

package/src/middleware/mysql.ts

@@ -1,11 +1,19 @@
-import type { ConnectionConfig } from 'mysql';
-import type { PoolOptions } from 'mysql2';
+import type { ConnectionOptions, PoolOptions } from 'mysql2';
 import { HandlerAuxBase, HandlerPluginBase } from './base';
 import { ConnectionProxy } from './database/connectionProxy';
 import { SQLClient } from './database/sqlClient';
 
+export interface DatabaseCredentials {
+  username: string;
+  password: string;
+}
+
 export interface MySQLPluginOptions {
-  config: ConnectionConfig & PoolOptions;
+  config: ConnectionOptions & PoolOptions;
+  /**
+   * AWS Secrets Manager secret ID containing {@link DatabaseCredentials}
+   */
+  secretId?: string;
   schema?: {
     eager?: boolean;
     ignoreError?: boolean;
@@ -30,7 +38,7 @@ export class MySQLPlugin<T = unknown> extends HandlerPluginBase<
   constructor(options: MySQLPluginOptions) {
     super();
     this.proxy = new ConnectionProxy(options);
-    this.sqlClient = new SQLClient(options.config);
+    this.sqlClient = new SQLClient(options);
   }
 
   public create = async () => {

package/src/utils/secretsManager.ts

@@ -0,0 +1,73 @@
+import {
+  GetSecretValueCommand,
+  SecretsManagerClient,
+} from '@aws-sdk/client-secrets-manager';
+import type { DatabaseCredentials } from '../middleware/mysql';
+import { getLogger } from './logger';
+import { stringifyError } from './misc';
+
+const logger = getLogger(__filename);
+
+export class SecretsManagerCache {
+  private static instance: SecretsManagerCache;
+  private client: SecretsManagerClient | undefined;
+  private cache = new Map<string, any>();
+
+  private constructor() {}
+
+  public static getInstance(): SecretsManagerCache {
+    if (!SecretsManagerCache.instance) {
+      SecretsManagerCache.instance = new SecretsManagerCache();
+    }
+    return SecretsManagerCache.instance;
+  }
+
+  private getClient(): SecretsManagerClient {
+    if (!this.client) {
+      this.client = new SecretsManagerClient({});
+      logger.debug('SecretsManager client initialized');
+    }
+    return this.client;
+  }
+
+  public async getSecret<T = any>(secretId: string): Promise<T> {
+    if (this.cache.has(secretId)) {
+      logger.debug(`Secret ${secretId} found in cache`);
+      return this.cache.get(secretId);
+    }
+
+    try {
+      const command = new GetSecretValueCommand({ SecretId: secretId });
+      const response = await this.getClient().send(command);
+
+      if (!response.SecretString) {
+        throw new Error(`Secret ${secretId} has no SecretString value`);
+      }
+
+      const secretValue = JSON.parse(response.SecretString);
+
+      this.cache.set(secretId, secretValue);
+
+      return secretValue;
+    } catch (error) {
+      logger.error(
+        `Failed to fetch secret ${secretId}: ${stringifyError(error)}`,
+      );
+      throw error;
+    }
+  }
+
+  public async getDatabaseCredentials(
+    secretId: string,
+  ): Promise<DatabaseCredentials> {
+    const secret = await this.getSecret<DatabaseCredentials>(secretId);
+
+    if (!secret.username || !secret.password) {
+      throw new Error(
+        `Secret ${secretId} does not contain required database credentials (username, password)`,
+      );
+    }
+
+    return secret;
+  }
+}