cdk-rds-sql 8.1.0__py3-none-any.whl

cdk_rds_sql/__init__.py

@@ -0,0 +1,2053 @@
+r'''
+# About
+
+This CDK construct library makes it possible to create databases,
+schemas, and roles in an Aurora Serverless v2, RDS Database Cluster,
+Database Instance, or AWS DSQL clusters. PostgreSQL, MySQL, and DSQL
+databases are supported.
+
+This construct library is intended to be used in enterprise
+environments, and works in isolated subnets.
+
+<p align="left">
+  <a href="https://github.com/semantic-release/semantic-release"><img src="https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release" alt=semantic-release: angular"></a>
+  <a href="https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml"><img src="https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml/badge.svg" alt="Release badge"></a>
+</p>
+
+# Requirements
+
+* CDK v2.
+
+# Installation
+
+```
+ npm i cdk-rds-sql
+```
+
+# Usage
+
+## Provider
+
+First setup your VPC and create your cluster:
+
+```python
+import { Duration, RemovalPolicy } from "aws-cdk-lib"
+import * as ec2 from "aws-cdk-lib/aws-ec2"
+import * as rds from "aws-cdk-lib/aws-rds"
+
+const vpc = ec2.Vpc.fromLookup(this, "Vpc", {
+  vpcId: this.node.tryGetContext("vpc-id"),
+})
+
+const cluster = new rds.ServerlessCluster(this, "Cluster", {
+  vpc: vpc,
+  vpcSubnets: {
+    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
+  },
+  engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,
+  parameterGroup: rds.ParameterGroup.fromParameterGroupName(
+    this,
+    "ParameterGroup",
+    "default.aurora-postgresql11"
+  ),
+  removalPolicy: RemovalPolicy.DESTROY,
+  scaling: {
+    autoPause: Duration.minutes(60),
+    minCapacity: rds.AuroraCapacityUnit.ACU_2,
+    maxCapacity: rds.AuroraCapacityUnit.ACU_2,
+  },
+})
+```
+
+Then create a provider which will connect to your database. For a cluster:
+
+```python
+import { Provider } from "cdk-rds-sql"
+
+const provider = new Provider(this, "Provider", {
+  vpc: vpc,
+  cluster: cluster,
+  secret: cluster.secret!,
+})
+```
+
+For an instance:
+
+```python
+import { Provider } from "cdk-rds-sql"
+
+const provider = new Provider(this, "Provider", {
+  vpc: vpc,
+  instance: instance,
+  secret: cluster.secret!,
+})
+```
+
+The provider will setup a lambda, which normally lives in the same VPC
+as the database. You can give a different VPC, as long as that VPC has
+access to the VPC of the database. Only the provider lambda will talk
+to your database.
+
+The provider will by default use the private isolated subnet of the
+VPC. Your isolated network must have a VPC endpoint to AWS Secrets Manager
+and possibly KMS as well. If you want to use a subnet with egress
+access in case you have no such VPC endpoints, specify the subnet as
+follows:
+
+```python
+import { Provider } from "cdk-rds-sql"
+
+const provider = new Provider(this, "Provider", {
+  vpc: vpc,
+  vpcSubnets: {
+    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
+  },
+  cluster: cluster,
+  secret: cluster.secret!,
+})
+```
+
+## Roles
+
+Create a postgres role (or mysql user) for a cluster as follows:
+
+```python
+import { Role } from "cdk-rds-sql"
+
+const role = new Role(this, "Role", {
+  provider: provider,
+  roleName: "myrole",
+  databaseName: "mydb",
+})
+```
+
+This will automatically create a secret just like `ServerlessCluster`
+does, with all the connection info needed for this user. It's secret
+value is a JSON like:
+
+```json
+{
+  "dbClusterIdentifier": "teststack-clustereb1186t9-sh4wpqfdyfvu",
+  "password": "very-long-and-boring",
+  "dbname": "mydb",
+  "engine": "postgres",
+  "port": 5432,
+  "host": "teststack-clustereb1186t9-sh4wpqfdyfvu.cluster-cgudolabssna.us-east-1.rds.amazonaws.com",
+  "username": "myrole"
+}
+```
+
+You can access the secret via `role.secret`.
+
+Instead of `databaseName` you can also specify `database` to reference
+an existing database. The role will not be created until the database
+has been created.
+
+If you want to make the role the owner of a new database, just specify
+the `databaseName` here, and create the database later.
+
+### IAM Authentication
+
+Instead of password-based authentication, you can create roles that
+use AWS IAM database authentication. This eliminates the need to store
+database passwords and provides enhanced security through AWS IAM
+policies.
+
+```python
+import { Role } from "cdk-rds-sql"
+
+const iamRole = new Role(this, "IamRole", {
+  provider: provider,
+  roleName: "myiamrole",
+  databaseName: "mydb",
+  enableIamAuth: true,
+})
+```
+
+When `enableIamAuth` is set to `true`:
+
+* **No secret is created** - the `role.secret` property will be `undefined`
+* The database role is created without a password
+* Your application must generate an IAM authentication token at runtime
+
+This is the same behavior as DSQL clusters, which always use IAM authentication.
+
+**Requirements for IAM Authentication:**
+
+* SSL connections are required (enabled by default in this library)
+* Your application must have IAM permissions to connect to the database
+* The database user/role name must match the IAM identity
+
+**IAM Policy Example:**
+
+Your application will need an IAM policy like this to connect:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["rds-db:connect"],
+      "Resource": [
+        "arn:aws:rds-db:region:account-id:dbuser:cluster-resource-id/myiamrole"
+      ]
+    }
+  ]
+}
+```
+
+**Generating an IAM Authentication Token:**
+
+At runtime, your application needs to generate an authentication token
+using the AWS SDK. Here's an example using the AWS SDK for JavaScript:
+
+```python
+import { Signer } from "@aws-sdk/rds-signer"
+import { Client } from "pg"
+
+const signer = new Signer({
+  hostname: "your-cluster.cluster-xxxxx.us-east-1.rds.amazonaws.com",
+  port: 5432,
+  username: "myiamrole",
+  region: "us-east-1",
+})
+
+const token = await signer.getAuthToken()
+
+const client = new Client({
+  host: "your-cluster.cluster-xxxxx.us-east-1.rds.amazonaws.com",
+  port: 5432,
+  user: "myiamrole",
+  database: "mydb",
+  password: token,
+  ssl: { rejectUnauthorized: true },
+})
+
+await client.connect()
+```
+
+Both PostgreSQL and MySQL databases support IAM authentication. For more details, see the [AWS RDS IAM Database Authentication documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html).
+
+### MySQL support
+
+In MySQL users are created with '%' as value for the host. It is hard
+to do this better:
+
+* Determine the CIDR blocks used by a VPC is not trivial.
+* For imported VPCs you cannot specify the IPv6 CIDR.
+* CIDRs might change without the system knowing, meaning applications
+  could lose access to the database at random times, such as when a
+  container is restarted.
+
+## Database
+
+Create a database as follows:
+
+```python
+import { Database } from "cdk-rds-sql"
+
+const database = new Database(this, "Database", {
+  provider: provider,
+  databaseName: "mydb",
+})
+```
+
+You can provide an owner, which makes it easy to create database owned
+by a new user:
+
+```python
+const database = new Database(this, "Database", {
+  provider: provider,
+  databaseName: "mydb",
+  owner: role,
+})
+```
+
+## Schema
+
+Create a schema in the default database as follows:
+
+```python
+import { Schema } from "cdk-rds-sql"
+
+new Schema(this, "Schema", {
+  provider: provider,
+  schemaName: "myschema",
+})
+```
+
+Or in another database:
+
+```python
+const database = new Database(this, "Database", {
+  provider: provider,
+  databaseName: "mydb",
+})
+
+new Schema(this, "Schema", {
+  provider: provider,
+  schemaName: "myschema",
+  databaseName: database.databaseName,
+})
+```
+
+One may need a role permitted for using schema:
+
+```python
+new Schema(this, "Schema", {
+  provider: provider,
+  schemaName: "myschema",
+  databaseName: database.databaseName,
+  role: role,
+})
+```
+
+## Sql
+
+You can insert arbitrary SQL into your database with the `Sql` construct:
+
+```python
+import { Sql } from "cdk-rds-sql"
+
+const sql = new Sql(this, "Sql", {
+  provider: provider,
+  database: database,
+  statement: "create table t (i int)",
+})
+```
+
+Create a table if it does not exist, and grant a role privileges:
+
+```python
+const sql = new Sql(this, "Sql", {
+  provider: provider,
+  database: database,
+  statement: `
+create table if not exists t (i int);
+grant select on t to myrole;
+`,
+})
+```
+
+Rollback sql on stack deletion:
+
+```python
+const sql = new Sql(this, "Sql", {
+  provider: provider,
+  database: database,
+  statement: `
+create table if not exists t (i int);
+grant select on t to myrole;
+`,
+  rollback: `
+DO $$BEGIN
+  IF EXISTS (select from pg_database WHERE datname = 't') THEN
+    IF EXISTS (select from pg_catalog.pg_roles WHERE rolname = 'myrole') THEN
+      revoke select t from myrole;
+    END IF;
+    drop table t;
+  END IF;
+END$$;
+`,
+})
+```
+
+Note that there is no synchronisation between various `Sql`
+constructs, in particular the order in your code does not determine
+the order in which your SQL is executed. This happens in parallel,
+unless you specify an explicit dependency via `sql.node.addDepency()`.
+
+There are a lot of concerns when using `Sql`:
+
+* When you update your Sql, your previous Sql is not "rolled back",
+  the new Sql is simply executed again.
+* When you delete your `Sql` construct the rollback is executed if specified
+* When permission are granted via `Sql` they must be removed via
+  rollback to succesfully remove the role
+* Currently the `Sql` constructs has less than 5 minutes to execute
+  its work.
+* It is unknown how large your SQL can be.
+
+# Parameters
+
+Some lambda constructs, in particular [Bref](https://bref.sh/), do not
+support secrets out of the box. Use the `parameterPrefix` property to
+create SSM parameters in addition to a secret:
+
+```python
+const role = new Role(this, "Role", {
+  provider: provider,
+  roleName: "myrole",
+  databaseName: "mydb",
+  parameterPrefix: "/my-app/",
+})
+```
+
+This will create `/my-app/username`, `/my-app/password` and such.
+
+To access parameters you will need IAM permissions such as:
+
+```python
+initialPolicy: [
+  new iam.PolicyStatement({
+	actions: ["ssm:GetParameter", "ssm:GetParameters"],
+	resources: [
+	  // Grant access to all parameters under the base path
+	  `arn:aws:ssm:${this.region}:${this.account}:parameter/my-app/*`,
+	],
+	effect: iam.Effect.ALLOW,
+  })
+],
+```
+
+Note that your VPC will need an SSM Parameters interface endpoint to support this.
+
+# AWS DSQL Support
+
+This construct also supports AWS DSQL. DSQL is a great number of
+limitations around it's postgresql support, so there is some learing
+curve. This library supports creating roles, schemas, and executing
+SQL on DSQL clusters. Creating databases is not supported by DSQL.
+
+## DSQL Provider Setup
+
+DSQL clusters don't require a VPC or secrets since they use IAM authentication:
+
+```python
+import * as dsql from "aws-cdk-lib/aws-dsql"
+import { Provider } from "cdk-rds-sql"
+
+const dsqlCluster = new dsql.CfnCluster(this, "DsqlCluster", {
+  deletionProtectionEnabled: false,
+})
+
+const provider = new Provider(this, "Provider", {
+  cluster: dsqlCluster,
+  // No VPC or secret needed for DSQL
+})
+```
+
+You can access DSQL from within a VPC, but cdk-rds-sql has not been
+specifically tested with that scenario.
+
+## DSQL Roles
+
+DSQL always uses IAM authentication, so the `enableIamAuth` property is ignored:
+
+```python
+import { Role } from "cdk-rds-sql"
+
+const role = new Role(this, "Role", {
+  provider: provider,
+  roleName: "myrole",
+})
+```
+
+## Using DSQL
+
+Connecting to DSQL requires a couple of things:
+
+1. Your IAM role needs the `dsql:DbConnect` IAM permission to connect to the cluster.
+2. You probably want a normal postgres role (not "admin") to use from your apps.
+3. Your IAM role needs to be connected to your postgres role: use the `IamGrant` construct for that:
+
+   ```python
+   new IamGrant(this, "LambdaIamGrant", {
+     provider: provider,
+     roleName: role.roleName,
+     resourceArn: queryLambda.role!.roleArn,
+   })
+   ```
+4. From your code use the Dsql signer to create the password:
+
+   ```python
+   import { DsqlSigner } from "@aws-sdk/dsql-signer"
+   import { Client } from "pg"
+
+   const region =
+     process.env["AWS_REGION"] || process.env["AWS_DEFAULT_REGION"] || "us-west-2"
+
+   // Generate DSQL auth token using AWS SDK
+   const signer = new DsqlSigner({
+     hostname: host,
+     region,
+   })
+
+   const authToken = await signer.getDbConnectAuthToken()
+
+   const client = new Client({
+     host,
+     port: 5432,
+     user: dbUser,
+     database: dbName,
+     password: authToken,
+     ssl: { rejectUnauthorized: false },
+   })
+
+   await client.connect()
+   ```
+
+# IPv6
+
+If you use the provider in an IPv6 subnet you probably need these settings:
+
+```python
+import { Provider } from "cdk-rds-sql"
+
+const provider = new Provider(this, "Provider", {
+  ...
+  functionProps: {
+	ipv6AllowedForDualStack: true,
+	allowAllIpv6Outbound: true,
+  },
+}
+```
+
+# Disabling SSL
+
+The default connection to RDS is ssl enabled. You can disable ssl by
+setting the `ssl` option to `false`:
+
+```python
+const provider = new Provider(this, "Provider", {
+  vpc: vpc,
+  instance: instance,
+  secret: cluster.secret!,
+  ssl: false, // default is true
+})
+```
+
+# Working on this code
+
+This code is managed by
+[projen](https://github.com/projen/projen/blob/main/README.md). In
+addition [pre-commit](https://pre-commit.com/) is used.
+
+So after git clone and `pnpm install` you would do:
+
+```
+pre-commit install --install-hooks --hook-type commit-msg --hook-type pre-commit
+```
+
+to install the pre-commit hooks.
+
+## Testing
+
+Test code via projen with:
+
+```
+pnpm exec projen test
+```
+
+You can run the PostgreSQL sample stack with:
+
+```
+pnpm exec projen integ:deploy:postgresql:serverless
+```
+
+If you want to use an existing vpc:
+
+```
+pnpm exec cdk deploy --context vpc-id=vpc-0123456789 TestRdsSqlServerlessV2Stack
+```
+
+You can also test DSQL support with:
+
+```
+pnpm exec projen integ:deploy:dsql
+```
+
+# To do
+
+* Update role: will not revoke connect to previous database if database name has changed.
+'''
+from pkgutil import extend_path
+__path__ = extend_path(__path__, __name__)
+
+import abc
+import builtins
+import datetime
+import enum
+import typing
+
+import jsii
+import publication
+import typing_extensions
+
+import typeguard
+from importlib.metadata import version as _metadata_package_version
+TYPEGUARD_MAJOR_VERSION = int(_metadata_package_version('typeguard').split('.')[0])
+
+def check_type(argname: str, value: object, expected_type: typing.Any) -> typing.Any:
+    if TYPEGUARD_MAJOR_VERSION <= 2:
+        return typeguard.check_type(argname=argname, value=value, expected_type=expected_type) # type:ignore
+    else:
+        if isinstance(value, jsii._reference_map.InterfaceDynamicProxy): # pyright: ignore [reportAttributeAccessIssue]
+           pass
+        else:
+            if TYPEGUARD_MAJOR_VERSION == 3:
+                typeguard.config.collection_check_strategy = typeguard.CollectionCheckStrategy.ALL_ITEMS # type:ignore
+                typeguard.check_type(value=value, expected_type=expected_type) # type:ignore
+            else:
+                typeguard.check_type(value=value, expected_type=expected_type, collection_check_strategy=typeguard.CollectionCheckStrategy.ALL_ITEMS) # type:ignore
+
+from ._jsii import *
+
+import aws_cdk as _aws_cdk_ceddda9d
+import aws_cdk.aws_dsql as _aws_cdk_aws_dsql_ceddda9d
+import aws_cdk.aws_ec2 as _aws_cdk_aws_ec2_ceddda9d
+import aws_cdk.aws_kms as _aws_cdk_aws_kms_ceddda9d
+import aws_cdk.aws_lambda as _aws_cdk_aws_lambda_ceddda9d
+import aws_cdk.aws_lambda_nodejs as _aws_cdk_aws_lambda_nodejs_ceddda9d
+import aws_cdk.aws_rds as _aws_cdk_aws_rds_ceddda9d
+import aws_cdk.aws_secretsmanager as _aws_cdk_aws_secretsmanager_ceddda9d
+import constructs as _constructs_77d1e7e8
+
+
+@jsii.enum(jsii_type="cdk-rds-sql.DatabaseEngine")
+class DatabaseEngine(enum.Enum):
+    '''Supported database engines.'''
+
+    POSTGRES = "POSTGRES"
+    MYSQL = "MYSQL"
+    DSQL = "DSQL"
+
+
+@jsii.data_type(
+    jsii_type="cdk-rds-sql.DatabaseProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "database_name": "databaseName",
+        "provider": "provider",
+        "owner": "owner",
+    },
+)
+class DatabaseProps:
+    def __init__(
+        self,
+        *,
+        database_name: builtins.str,
+        provider: "IProvider",
+        owner: typing.Optional["Role"] = None,
+    ) -> None:
+        '''
+        :param database_name: Name of database to create.
+        :param provider: Provider.
+        :param owner: Optional database owner.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__d02a87af93e26ceaf647662fc78818b2f43fe154b349df3c4f5752d22b61ea34)
+            check_type(argname="argument database_name", value=database_name, expected_type=type_hints["database_name"])
+            check_type(argname="argument provider", value=provider, expected_type=type_hints["provider"])
+            check_type(argname="argument owner", value=owner, expected_type=type_hints["owner"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "database_name": database_name,
+            "provider": provider,
+        }
+        if owner is not None:
+            self._values["owner"] = owner
+
+    @builtins.property
+    def database_name(self) -> builtins.str:
+        '''Name of database to create.'''
+        result = self._values.get("database_name")
+        assert result is not None, "Required property 'database_name' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def provider(self) -> "IProvider":
+        '''Provider.'''
+        result = self._values.get("provider")
+        assert result is not None, "Required property 'provider' is missing"
+        return typing.cast("IProvider", result)
+
+    @builtins.property
+    def owner(self) -> typing.Optional["Role"]:
+        '''Optional database owner.'''
+        result = self._values.get("owner")
+        return typing.cast(typing.Optional["Role"], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "DatabaseProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.interface(jsii_type="cdk-rds-sql.IDatabase")
+class IDatabase(typing_extensions.Protocol):
+    @builtins.property
+    @jsii.member(jsii_name="databaseName")
+    def database_name(self) -> builtins.str:
+        ...
+
+
+class _IDatabaseProxy:
+    __jsii_type__: typing.ClassVar[str] = "cdk-rds-sql.IDatabase"
+
+    @builtins.property
+    @jsii.member(jsii_name="databaseName")
+    def database_name(self) -> builtins.str:
+        return typing.cast(builtins.str, jsii.get(self, "databaseName"))
+
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
+typing.cast(typing.Any, IDatabase).__jsii_proxy_class__ = lambda : _IDatabaseProxy
+
+
+@jsii.interface(jsii_type="cdk-rds-sql.IProvider")
+class IProvider(typing_extensions.Protocol):
+    @builtins.property
+    @jsii.member(jsii_name="engine")
+    def engine(self) -> builtins.str:
+        ...
+
+    @builtins.property
+    @jsii.member(jsii_name="handler")
+    def handler(self) -> "_aws_cdk_aws_lambda_ceddda9d.IFunction":
+        ...
+
+    @builtins.property
+    @jsii.member(jsii_name="serviceToken")
+    def service_token(self) -> builtins.str:
+        ...
+
+    @builtins.property
+    @jsii.member(jsii_name="cluster")
+    def cluster(
+        self,
+    ) -> typing.Optional[typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]]:
+        ...
+
+    @builtins.property
+    @jsii.member(jsii_name="secret")
+    def secret(self) -> typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"]:
+        ...
+
+
+class _IProviderProxy:
+    __jsii_type__: typing.ClassVar[str] = "cdk-rds-sql.IProvider"
+
+    @builtins.property
+    @jsii.member(jsii_name="engine")
+    def engine(self) -> builtins.str:
+        return typing.cast(builtins.str, jsii.get(self, "engine"))
+
+    @builtins.property
+    @jsii.member(jsii_name="handler")
+    def handler(self) -> "_aws_cdk_aws_lambda_ceddda9d.IFunction":
+        return typing.cast("_aws_cdk_aws_lambda_ceddda9d.IFunction", jsii.get(self, "handler"))
+
+    @builtins.property
+    @jsii.member(jsii_name="serviceToken")
+    def service_token(self) -> builtins.str:
+        return typing.cast(builtins.str, jsii.get(self, "serviceToken"))
+
+    @builtins.property
+    @jsii.member(jsii_name="cluster")
+    def cluster(
+        self,
+    ) -> typing.Optional[typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]]:
+        return typing.cast(typing.Optional[typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]], jsii.get(self, "cluster"))
+
+    @builtins.property
+    @jsii.member(jsii_name="secret")
+    def secret(self) -> typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"]:
+        return typing.cast(typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"], jsii.get(self, "secret"))
+
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
+typing.cast(typing.Any, IProvider).__jsii_proxy_class__ = lambda : _IProviderProxy
+
+
+class IamGrant(
+    _aws_cdk_ceddda9d.CustomResource,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-rds-sql.IamGrant",
+):
+    def __init__(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        provider: "IProvider",
+        resource_arn: builtins.str,
+        role_name: builtins.str,
+    ) -> None:
+        '''
+        :param scope: -
+        :param id: -
+        :param provider: Provider.
+        :param resource_arn: IAM resource ARN (role, user, or other IAM principal).
+        :param role_name: Database role name to grant IAM access to.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__ddc8001ac6195e8fb417d17f2106bdcd50800e6da2afb84794113f44cc6c18c9)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = IamGrantProps(
+            provider=provider, resource_arn=resource_arn, role_name=role_name
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+
+@jsii.data_type(
+    jsii_type="cdk-rds-sql.IamGrantProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "provider": "provider",
+        "resource_arn": "resourceArn",
+        "role_name": "roleName",
+    },
+)
+class IamGrantProps:
+    def __init__(
+        self,
+        *,
+        provider: "IProvider",
+        resource_arn: builtins.str,
+        role_name: builtins.str,
+    ) -> None:
+        '''
+        :param provider: Provider.
+        :param resource_arn: IAM resource ARN (role, user, or other IAM principal).
+        :param role_name: Database role name to grant IAM access to.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__4887252bb5c41c89521a26b729d32055341e5bee89b4f65947a38d7c0aaf5dec)
+            check_type(argname="argument provider", value=provider, expected_type=type_hints["provider"])
+            check_type(argname="argument resource_arn", value=resource_arn, expected_type=type_hints["resource_arn"])
+            check_type(argname="argument role_name", value=role_name, expected_type=type_hints["role_name"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "provider": provider,
+            "resource_arn": resource_arn,
+            "role_name": role_name,
+        }
+
+    @builtins.property
+    def provider(self) -> "IProvider":
+        '''Provider.'''
+        result = self._values.get("provider")
+        assert result is not None, "Required property 'provider' is missing"
+        return typing.cast("IProvider", result)
+
+    @builtins.property
+    def resource_arn(self) -> builtins.str:
+        '''IAM resource ARN (role, user, or other IAM principal).'''
+        result = self._values.get("resource_arn")
+        assert result is not None, "Required property 'resource_arn' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def role_name(self) -> builtins.str:
+        '''Database role name to grant IAM access to.'''
+        result = self._values.get("role_name")
+        assert result is not None, "Required property 'role_name' is missing"
+        return typing.cast(builtins.str, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "IamGrantProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.implements(IProvider)
+class Provider(
+    _constructs_77d1e7e8.Construct,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-rds-sql.Provider",
+):
+    def __init__(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        cluster: typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"],
+        function_props: typing.Optional[typing.Union["_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunctionProps", typing.Dict[builtins.str, typing.Any]]] = None,
+        logger: typing.Optional[builtins.bool] = None,
+        secret: typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"] = None,
+        ssl: typing.Optional[builtins.bool] = None,
+        timeout: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        vpc: typing.Optional["_aws_cdk_aws_ec2_ceddda9d.IVpc"] = None,
+        vpc_subnets: typing.Optional[typing.Union["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection", typing.Dict[builtins.str, typing.Any]]] = None,
+    ) -> None:
+        '''
+        :param scope: -
+        :param id: -
+        :param cluster: Your database cluster or instance. Supports both traditional RDS/Aurora clusters and DSQL clusters. - For RDS/Aurora: security groups will be configured to allow access - For DSQL: IAM authentication will be used instead of secrets
+        :param function_props: Additional function customization. This enables additional function customization such as the log group. However, lambda function properties controlled by other {RdsSqlProps} parameters will trump opions set via this parameter. Default: - empty
+        :param logger: Log SQL statements. This includes passwords. Use only for debugging. Default: - false
+        :param secret: Secret that grants access to your database. Usually this is your cluster's master secret. Not required when relying on IAM authentication (such as DSQL). Default: - undefined for DSQL clusters using IAM authentication
+        :param ssl: Use SSL? Default: - true
+        :param timeout: Timeout for lambda to do its work. Default: - 5 minutes
+        :param vpc: VPC network to place the provider lambda. Normally this is the VPC of your database. Required when your database is only accessible in a VPC. Not required for DSQL as it uses public endpoints with IAM authentication. Default: - Function is not placed within a VPC.
+        :param vpc_subnets: Where to place the network provider lambda within the VPC. Default: - the isolated subnet if not specified
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__f569409e68b7292df1965d915629ef8c34532a3dcd05bea0032c564041e409e4)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = RdsSqlProps(
+            cluster=cluster,
+            function_props=function_props,
+            logger=logger,
+            secret=secret,
+            ssl=ssl,
+            timeout=timeout,
+            vpc=vpc,
+            vpc_subnets=vpc_subnets,
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+    @jsii.member(jsii_name="fromProviderAttributes")
+    @builtins.classmethod
+    def from_provider_attributes(
+        cls,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        engine: "DatabaseEngine",
+        cluster: typing.Optional[typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]] = None,
+        function_arn: typing.Optional[builtins.str] = None,
+        function_name: typing.Optional[builtins.str] = None,
+    ) -> "IProvider":
+        '''Import an existing provider Lambda function.
+
+        :param scope: -
+        :param id: -
+        :param engine: 
+        :param cluster: Optional cluster information for role creation. When importing a provider, cluster details are often not available. However, some operations like role creation require cluster endpoint information to build connection secrets. If you plan to create roles with the imported provider, you must provide the cluster reference. If you only plan to use existing roles, databases, schemas, or SQL operations, this can be omitted.
+        :param function_arn: Either the ARN or name of the Lambda function. Use functionArn for cross-account or cross-region scenarios. Use functionName for same-account, same-region scenarios.
+        :param function_name: 
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__6447e54f3866ee95542c4c6e6f57beb9f77e9508347c20f14c7bb52a36c8133c)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        attrs = ProviderAttributes(
+            engine=engine,
+            cluster=cluster,
+            function_arn=function_arn,
+            function_name=function_name,
+        )
+
+        return typing.cast("IProvider", jsii.sinvoke(cls, "fromProviderAttributes", [scope, id, attrs]))
+
+    @jsii.member(jsii_name="newCustomResourceHandler")
+    def _new_custom_resource_handler(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        cluster: typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"],
+        function_props: typing.Optional[typing.Union["_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunctionProps", typing.Dict[builtins.str, typing.Any]]] = None,
+        logger: typing.Optional[builtins.bool] = None,
+        secret: typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"] = None,
+        ssl: typing.Optional[builtins.bool] = None,
+        timeout: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        vpc: typing.Optional["_aws_cdk_aws_ec2_ceddda9d.IVpc"] = None,
+        vpc_subnets: typing.Optional[typing.Union["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection", typing.Dict[builtins.str, typing.Any]]] = None,
+    ) -> "_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunction":
+        '''
+        :param scope: -
+        :param id: -
+        :param cluster: Your database cluster or instance. Supports both traditional RDS/Aurora clusters and DSQL clusters. - For RDS/Aurora: security groups will be configured to allow access - For DSQL: IAM authentication will be used instead of secrets
+        :param function_props: Additional function customization. This enables additional function customization such as the log group. However, lambda function properties controlled by other {RdsSqlProps} parameters will trump opions set via this parameter. Default: - empty
+        :param logger: Log SQL statements. This includes passwords. Use only for debugging. Default: - false
+        :param secret: Secret that grants access to your database. Usually this is your cluster's master secret. Not required when relying on IAM authentication (such as DSQL). Default: - undefined for DSQL clusters using IAM authentication
+        :param ssl: Use SSL? Default: - true
+        :param timeout: Timeout for lambda to do its work. Default: - 5 minutes
+        :param vpc: VPC network to place the provider lambda. Normally this is the VPC of your database. Required when your database is only accessible in a VPC. Not required for DSQL as it uses public endpoints with IAM authentication. Default: - Function is not placed within a VPC.
+        :param vpc_subnets: Where to place the network provider lambda within the VPC. Default: - the isolated subnet if not specified
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__16aa0dc03b1ffdc1c49190bb39d545df3907972a07f344528a5a891c23d0f28c)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = RdsSqlProps(
+            cluster=cluster,
+            function_props=function_props,
+            logger=logger,
+            secret=secret,
+            ssl=ssl,
+            timeout=timeout,
+            vpc=vpc,
+            vpc_subnets=vpc_subnets,
+        )
+
+        return typing.cast("_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunction", jsii.invoke(self, "newCustomResourceHandler", [scope, id, props]))
+
+    @builtins.property
+    @jsii.member(jsii_name="engine")
+    def engine(self) -> builtins.str:
+        '''The engine like "postgres" or "mysql".
+
+        :default: - if we cannot determine this "postgres"
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "engine"))
+
+    @builtins.property
+    @jsii.member(jsii_name="handler")
+    def handler(self) -> "_aws_cdk_aws_lambda_ceddda9d.IFunction":
+        return typing.cast("_aws_cdk_aws_lambda_ceddda9d.IFunction", jsii.get(self, "handler"))
+
+    @builtins.property
+    @jsii.member(jsii_name="serviceToken")
+    def service_token(self) -> builtins.str:
+        return typing.cast(builtins.str, jsii.get(self, "serviceToken"))
+
+    @builtins.property
+    @jsii.member(jsii_name="cluster")
+    def cluster(
+        self,
+    ) -> typing.Optional[typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]]:
+        return typing.cast(typing.Optional[typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]], jsii.get(self, "cluster"))
+
+    @builtins.property
+    @jsii.member(jsii_name="secret")
+    def secret(self) -> typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"]:
+        return typing.cast(typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"], jsii.get(self, "secret"))
+
+
+@jsii.data_type(
+    jsii_type="cdk-rds-sql.ProviderAttributes",
+    jsii_struct_bases=[],
+    name_mapping={
+        "engine": "engine",
+        "cluster": "cluster",
+        "function_arn": "functionArn",
+        "function_name": "functionName",
+    },
+)
+class ProviderAttributes:
+    def __init__(
+        self,
+        *,
+        engine: "DatabaseEngine",
+        cluster: typing.Optional[typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]] = None,
+        function_arn: typing.Optional[builtins.str] = None,
+        function_name: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''
+        :param engine: 
+        :param cluster: Optional cluster information for role creation. When importing a provider, cluster details are often not available. However, some operations like role creation require cluster endpoint information to build connection secrets. If you plan to create roles with the imported provider, you must provide the cluster reference. If you only plan to use existing roles, databases, schemas, or SQL operations, this can be omitted.
+        :param function_arn: Either the ARN or name of the Lambda function. Use functionArn for cross-account or cross-region scenarios. Use functionName for same-account, same-region scenarios.
+        :param function_name: 
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__38638fb01c5b5c1e90a480e969bec755370ee72cad8844940b704cff73c8057c)
+            check_type(argname="argument engine", value=engine, expected_type=type_hints["engine"])
+            check_type(argname="argument cluster", value=cluster, expected_type=type_hints["cluster"])
+            check_type(argname="argument function_arn", value=function_arn, expected_type=type_hints["function_arn"])
+            check_type(argname="argument function_name", value=function_name, expected_type=type_hints["function_name"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "engine": engine,
+        }
+        if cluster is not None:
+            self._values["cluster"] = cluster
+        if function_arn is not None:
+            self._values["function_arn"] = function_arn
+        if function_name is not None:
+            self._values["function_name"] = function_name
+
+    @builtins.property
+    def engine(self) -> "DatabaseEngine":
+        result = self._values.get("engine")
+        assert result is not None, "Required property 'engine' is missing"
+        return typing.cast("DatabaseEngine", result)
+
+    @builtins.property
+    def cluster(
+        self,
+    ) -> typing.Optional[typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]]:
+        '''Optional cluster information for role creation.
+
+        When importing a provider, cluster details are often not available.
+        However, some operations like role creation require cluster endpoint
+        information to build connection secrets.
+
+        If you plan to create roles with the imported provider, you must
+        provide the cluster reference. If you only plan to use existing
+        roles, databases, schemas, or SQL operations, this can be omitted.
+        '''
+        result = self._values.get("cluster")
+        return typing.cast(typing.Optional[typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]], result)
+
+    @builtins.property
+    def function_arn(self) -> typing.Optional[builtins.str]:
+        '''Either the ARN or name of the Lambda function.
+
+        Use functionArn for cross-account or cross-region scenarios.
+        Use functionName for same-account, same-region scenarios.
+        '''
+        result = self._values.get("function_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def function_name(self) -> typing.Optional[builtins.str]:
+        result = self._values.get("function_name")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "ProviderAttributes(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.data_type(
+    jsii_type="cdk-rds-sql.RdsSqlProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "cluster": "cluster",
+        "function_props": "functionProps",
+        "logger": "logger",
+        "secret": "secret",
+        "ssl": "ssl",
+        "timeout": "timeout",
+        "vpc": "vpc",
+        "vpc_subnets": "vpcSubnets",
+    },
+)
+class RdsSqlProps:
+    def __init__(
+        self,
+        *,
+        cluster: typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"],
+        function_props: typing.Optional[typing.Union["_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunctionProps", typing.Dict[builtins.str, typing.Any]]] = None,
+        logger: typing.Optional[builtins.bool] = None,
+        secret: typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"] = None,
+        ssl: typing.Optional[builtins.bool] = None,
+        timeout: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        vpc: typing.Optional["_aws_cdk_aws_ec2_ceddda9d.IVpc"] = None,
+        vpc_subnets: typing.Optional[typing.Union["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection", typing.Dict[builtins.str, typing.Any]]] = None,
+    ) -> None:
+        '''
+        :param cluster: Your database cluster or instance. Supports both traditional RDS/Aurora clusters and DSQL clusters. - For RDS/Aurora: security groups will be configured to allow access - For DSQL: IAM authentication will be used instead of secrets
+        :param function_props: Additional function customization. This enables additional function customization such as the log group. However, lambda function properties controlled by other {RdsSqlProps} parameters will trump opions set via this parameter. Default: - empty
+        :param logger: Log SQL statements. This includes passwords. Use only for debugging. Default: - false
+        :param secret: Secret that grants access to your database. Usually this is your cluster's master secret. Not required when relying on IAM authentication (such as DSQL). Default: - undefined for DSQL clusters using IAM authentication
+        :param ssl: Use SSL? Default: - true
+        :param timeout: Timeout for lambda to do its work. Default: - 5 minutes
+        :param vpc: VPC network to place the provider lambda. Normally this is the VPC of your database. Required when your database is only accessible in a VPC. Not required for DSQL as it uses public endpoints with IAM authentication. Default: - Function is not placed within a VPC.
+        :param vpc_subnets: Where to place the network provider lambda within the VPC. Default: - the isolated subnet if not specified
+        '''
+        if isinstance(function_props, dict):
+            function_props = _aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunctionProps(**function_props)
+        if isinstance(vpc_subnets, dict):
+            vpc_subnets = _aws_cdk_aws_ec2_ceddda9d.SubnetSelection(**vpc_subnets)
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__1562dfb28e0e71a0b95785ddbc26511738019b8ab5c6885e0ff1f2050e6d045b)
+            check_type(argname="argument cluster", value=cluster, expected_type=type_hints["cluster"])
+            check_type(argname="argument function_props", value=function_props, expected_type=type_hints["function_props"])
+            check_type(argname="argument logger", value=logger, expected_type=type_hints["logger"])
+            check_type(argname="argument secret", value=secret, expected_type=type_hints["secret"])
+            check_type(argname="argument ssl", value=ssl, expected_type=type_hints["ssl"])
+            check_type(argname="argument timeout", value=timeout, expected_type=type_hints["timeout"])
+            check_type(argname="argument vpc", value=vpc, expected_type=type_hints["vpc"])
+            check_type(argname="argument vpc_subnets", value=vpc_subnets, expected_type=type_hints["vpc_subnets"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "cluster": cluster,
+        }
+        if function_props is not None:
+            self._values["function_props"] = function_props
+        if logger is not None:
+            self._values["logger"] = logger
+        if secret is not None:
+            self._values["secret"] = secret
+        if ssl is not None:
+            self._values["ssl"] = ssl
+        if timeout is not None:
+            self._values["timeout"] = timeout
+        if vpc is not None:
+            self._values["vpc"] = vpc
+        if vpc_subnets is not None:
+            self._values["vpc_subnets"] = vpc_subnets
+
+    @builtins.property
+    def cluster(
+        self,
+    ) -> typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"]:
+        '''Your database cluster or instance.
+
+        Supports both traditional RDS/Aurora clusters and DSQL clusters.
+
+        - For RDS/Aurora: security groups will be configured to allow access
+        - For DSQL: IAM authentication will be used instead of secrets
+        '''
+        result = self._values.get("cluster")
+        assert result is not None, "Required property 'cluster' is missing"
+        return typing.cast(typing.Union["_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster", "_aws_cdk_aws_rds_ceddda9d.IDatabaseInstance", "_aws_cdk_aws_dsql_ceddda9d.CfnCluster"], result)
+
+    @builtins.property
+    def function_props(
+        self,
+    ) -> typing.Optional["_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunctionProps"]:
+        '''Additional function customization.
+
+        This enables additional function customization such as the log group. However,
+        lambda function properties controlled by other {RdsSqlProps} parameters will trump
+        opions set via this parameter.
+
+        :default: - empty
+        '''
+        result = self._values.get("function_props")
+        return typing.cast(typing.Optional["_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunctionProps"], result)
+
+    @builtins.property
+    def logger(self) -> typing.Optional[builtins.bool]:
+        '''Log SQL statements.
+
+        This includes passwords. Use only for debugging.
+
+        :default: - false
+        '''
+        result = self._values.get("logger")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    @builtins.property
+    def secret(self) -> typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"]:
+        '''Secret that grants access to your database.
+
+        Usually this is your cluster's master secret.
+        Not required when relying on IAM authentication (such as DSQL).
+
+        :default: - undefined for DSQL clusters using IAM authentication
+        '''
+        result = self._values.get("secret")
+        return typing.cast(typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"], result)
+
+    @builtins.property
+    def ssl(self) -> typing.Optional[builtins.bool]:
+        '''Use SSL?
+
+        :default: - true
+        '''
+        result = self._values.get("ssl")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    @builtins.property
+    def timeout(self) -> typing.Optional["_aws_cdk_ceddda9d.Duration"]:
+        '''Timeout for lambda to do its work.
+
+        :default: - 5 minutes
+        '''
+        result = self._values.get("timeout")
+        return typing.cast(typing.Optional["_aws_cdk_ceddda9d.Duration"], result)
+
+    @builtins.property
+    def vpc(self) -> typing.Optional["_aws_cdk_aws_ec2_ceddda9d.IVpc"]:
+        '''VPC network to place the provider lambda.
+
+        Normally this is the VPC of your database.
+        Required when your database is only accessible in a VPC.
+        Not required for DSQL as it uses public endpoints with IAM authentication.
+
+        :default: - Function is not placed within a VPC.
+        '''
+        result = self._values.get("vpc")
+        return typing.cast(typing.Optional["_aws_cdk_aws_ec2_ceddda9d.IVpc"], result)
+
+    @builtins.property
+    def vpc_subnets(
+        self,
+    ) -> typing.Optional["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection"]:
+        '''Where to place the network provider lambda within the VPC.
+
+        :default: - the isolated subnet if not specified
+        '''
+        result = self._values.get("vpc_subnets")
+        return typing.cast(typing.Optional["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection"], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "RdsSqlProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.enum(jsii_type="cdk-rds-sql.RdsSqlResource")
+class RdsSqlResource(enum.Enum):
+    SCHEMA = "SCHEMA"
+    ROLE = "ROLE"
+    SQL = "SQL"
+    DATABASE = "DATABASE"
+    PARAMETER_PASSWORD = "PARAMETER_PASSWORD"
+    IAM_GRANT = "IAM_GRANT"
+
+
+class Role(
+    _constructs_77d1e7e8.Construct,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-rds-sql.Role",
+):
+    def __init__(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        provider: "IProvider",
+        role_name: builtins.str,
+        database: typing.Optional["IDatabase"] = None,
+        database_name: typing.Optional[builtins.str] = None,
+        enable_iam_auth: typing.Optional[builtins.bool] = None,
+        encryption_key: typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"] = None,
+        parameter_prefix: typing.Optional[builtins.str] = None,
+        secret_name: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''
+        :param scope: -
+        :param id: -
+        :param provider: Provider.
+        :param role_name: SQL.
+        :param database: Optional database this user is expected to use. If the database exists, connect privileges are granted. Specify one of ``database`` or ``databaseName``. This is the name that will be stored in the role's secret as the database name to use.
+        :param database_name: Optional database name this user is expected to use. If the database exists, connect privileges are granted. Specify one of ``database`` or ``databaseName``. This is the name that will be stored in the role's secret as the database name to use.
+        :param enable_iam_auth: Enable IAM authentication for this role. When enabled, the role will be created without a password and configured for AWS IAM database authentication. No secret will be created for this role. Note: For DSQL clusters, this property is ignored as DSQL always uses IAM authentication. Default: false - use password authentication
+        :param encryption_key: A new secret is created for this user. Optionally encrypt it with the given key.
+        :param parameter_prefix: Prefix for SSM parameters to store credentials in Parameter Store. When defined, credentials will also be stored as parameters. The parameter names such as "password" is simply appended to ``parameterPrefix``, so make sure the prefix ends with a slash if you have your parameter names slash separated. The password parameter is refreshed when CloudFormation updates the generated secret resource. Default: - credentials are only stored in Secrets Manager
+        :param secret_name: A new secret is created for this user. Optionally add secret name to the secret.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__062afab8717d46f6fc2a31188b28d9e663190b2080174cc7f1ddd691f699de7e)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = RoleProps(
+            provider=provider,
+            role_name=role_name,
+            database=database,
+            database_name=database_name,
+            enable_iam_auth=enable_iam_auth,
+            encryption_key=encryption_key,
+            parameter_prefix=parameter_prefix,
+            secret_name=secret_name,
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+    @builtins.property
+    @jsii.member(jsii_name="roleName")
+    def role_name(self) -> builtins.str:
+        '''The role name.'''
+        return typing.cast(builtins.str, jsii.get(self, "roleName"))
+
+    @builtins.property
+    @jsii.member(jsii_name="secret")
+    def secret(self) -> typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"]:
+        '''The generated secret containing connection information and password.
+
+        This is only available when:
+
+        - The provider is not a DSQL cluster (DSQL uses IAM authentication)
+        - ``enableIamAuth`` is not set to ``true``
+
+        When using IAM authentication, no secret is created as the password
+        is generated dynamically using IAM credentials.
+        '''
+        return typing.cast(typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"], jsii.get(self, "secret"))
+
+
+@jsii.data_type(
+    jsii_type="cdk-rds-sql.RoleProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "provider": "provider",
+        "role_name": "roleName",
+        "database": "database",
+        "database_name": "databaseName",
+        "enable_iam_auth": "enableIamAuth",
+        "encryption_key": "encryptionKey",
+        "parameter_prefix": "parameterPrefix",
+        "secret_name": "secretName",
+    },
+)
+class RoleProps:
+    def __init__(
+        self,
+        *,
+        provider: "IProvider",
+        role_name: builtins.str,
+        database: typing.Optional["IDatabase"] = None,
+        database_name: typing.Optional[builtins.str] = None,
+        enable_iam_auth: typing.Optional[builtins.bool] = None,
+        encryption_key: typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"] = None,
+        parameter_prefix: typing.Optional[builtins.str] = None,
+        secret_name: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''
+        :param provider: Provider.
+        :param role_name: SQL.
+        :param database: Optional database this user is expected to use. If the database exists, connect privileges are granted. Specify one of ``database`` or ``databaseName``. This is the name that will be stored in the role's secret as the database name to use.
+        :param database_name: Optional database name this user is expected to use. If the database exists, connect privileges are granted. Specify one of ``database`` or ``databaseName``. This is the name that will be stored in the role's secret as the database name to use.
+        :param enable_iam_auth: Enable IAM authentication for this role. When enabled, the role will be created without a password and configured for AWS IAM database authentication. No secret will be created for this role. Note: For DSQL clusters, this property is ignored as DSQL always uses IAM authentication. Default: false - use password authentication
+        :param encryption_key: A new secret is created for this user. Optionally encrypt it with the given key.
+        :param parameter_prefix: Prefix for SSM parameters to store credentials in Parameter Store. When defined, credentials will also be stored as parameters. The parameter names such as "password" is simply appended to ``parameterPrefix``, so make sure the prefix ends with a slash if you have your parameter names slash separated. The password parameter is refreshed when CloudFormation updates the generated secret resource. Default: - credentials are only stored in Secrets Manager
+        :param secret_name: A new secret is created for this user. Optionally add secret name to the secret.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a7ed79cdb7903207b3240698f6bcb0582905979c1519e2b49d66fa6fbdac11ee)
+            check_type(argname="argument provider", value=provider, expected_type=type_hints["provider"])
+            check_type(argname="argument role_name", value=role_name, expected_type=type_hints["role_name"])
+            check_type(argname="argument database", value=database, expected_type=type_hints["database"])
+            check_type(argname="argument database_name", value=database_name, expected_type=type_hints["database_name"])
+            check_type(argname="argument enable_iam_auth", value=enable_iam_auth, expected_type=type_hints["enable_iam_auth"])
+            check_type(argname="argument encryption_key", value=encryption_key, expected_type=type_hints["encryption_key"])
+            check_type(argname="argument parameter_prefix", value=parameter_prefix, expected_type=type_hints["parameter_prefix"])
+            check_type(argname="argument secret_name", value=secret_name, expected_type=type_hints["secret_name"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "provider": provider,
+            "role_name": role_name,
+        }
+        if database is not None:
+            self._values["database"] = database
+        if database_name is not None:
+            self._values["database_name"] = database_name
+        if enable_iam_auth is not None:
+            self._values["enable_iam_auth"] = enable_iam_auth
+        if encryption_key is not None:
+            self._values["encryption_key"] = encryption_key
+        if parameter_prefix is not None:
+            self._values["parameter_prefix"] = parameter_prefix
+        if secret_name is not None:
+            self._values["secret_name"] = secret_name
+
+    @builtins.property
+    def provider(self) -> "IProvider":
+        '''Provider.'''
+        result = self._values.get("provider")
+        assert result is not None, "Required property 'provider' is missing"
+        return typing.cast("IProvider", result)
+
+    @builtins.property
+    def role_name(self) -> builtins.str:
+        '''SQL.'''
+        result = self._values.get("role_name")
+        assert result is not None, "Required property 'role_name' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def database(self) -> typing.Optional["IDatabase"]:
+        '''Optional database this user is expected to use.
+
+        If the database exists, connect privileges are granted.
+
+        Specify one of ``database`` or ``databaseName``. This is the name
+        that will be stored in the role's secret as the database name to
+        use.
+        '''
+        result = self._values.get("database")
+        return typing.cast(typing.Optional["IDatabase"], result)
+
+    @builtins.property
+    def database_name(self) -> typing.Optional[builtins.str]:
+        '''Optional database name this user is expected to use.
+
+        If the database exists, connect privileges are granted.
+
+        Specify one of ``database`` or ``databaseName``. This is the name
+        that will be stored in the role's secret as the database name to
+        use.
+        '''
+        result = self._values.get("database_name")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def enable_iam_auth(self) -> typing.Optional[builtins.bool]:
+        '''Enable IAM authentication for this role.
+
+        When enabled, the role will be created without a password and
+        configured for AWS IAM database authentication. No secret will
+        be created for this role.
+
+        Note: For DSQL clusters, this property is ignored as DSQL always
+        uses IAM authentication.
+
+        :default: false - use password authentication
+        '''
+        result = self._values.get("enable_iam_auth")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    @builtins.property
+    def encryption_key(self) -> typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"]:
+        '''A new secret is created for this user.
+
+        Optionally encrypt it with the given key.
+        '''
+        result = self._values.get("encryption_key")
+        return typing.cast(typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"], result)
+
+    @builtins.property
+    def parameter_prefix(self) -> typing.Optional[builtins.str]:
+        '''Prefix for SSM parameters to store credentials in Parameter Store. When defined, credentials will also be stored as parameters.
+
+        The parameter names such as "password" is simply appended to
+        ``parameterPrefix``, so make sure the prefix ends with a slash if
+        you have your parameter names slash separated.
+
+        The password parameter is refreshed when CloudFormation updates the
+        generated secret resource.
+
+        :default: - credentials are only stored in Secrets Manager
+        '''
+        result = self._values.get("parameter_prefix")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def secret_name(self) -> typing.Optional[builtins.str]:
+        '''A new secret is created for this user.
+
+        Optionally add secret name to the secret.
+        '''
+        result = self._values.get("secret_name")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "RoleProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class Schema(
+    _aws_cdk_ceddda9d.CustomResource,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-rds-sql.Schema",
+):
+    def __init__(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        provider: "IProvider",
+        schema_name: builtins.str,
+        database: typing.Optional["IDatabase"] = None,
+        role: typing.Optional["Role"] = None,
+    ) -> None:
+        '''
+        :param scope: -
+        :param id: -
+        :param provider: Provider.
+        :param schema_name: Schema name.
+        :param database: Optional database. Default: - use default database
+        :param role: Optional role which will be granted usage and create permissions to this schema. This way the role can read its own tables, but cannot see or access tables created by others.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__23264d20ca42f56453469fb6eae1679bf4f901ace3ccab77b186aa28167779bf)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = SchemaProps(
+            provider=provider, schema_name=schema_name, database=database, role=role
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+    @builtins.property
+    @jsii.member(jsii_name="schemaName")
+    def schema_name(self) -> builtins.str:
+        return typing.cast(builtins.str, jsii.get(self, "schemaName"))
+
+
+@jsii.data_type(
+    jsii_type="cdk-rds-sql.SchemaProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "provider": "provider",
+        "schema_name": "schemaName",
+        "database": "database",
+        "role": "role",
+    },
+)
+class SchemaProps:
+    def __init__(
+        self,
+        *,
+        provider: "IProvider",
+        schema_name: builtins.str,
+        database: typing.Optional["IDatabase"] = None,
+        role: typing.Optional["Role"] = None,
+    ) -> None:
+        '''
+        :param provider: Provider.
+        :param schema_name: Schema name.
+        :param database: Optional database. Default: - use default database
+        :param role: Optional role which will be granted usage and create permissions to this schema. This way the role can read its own tables, but cannot see or access tables created by others.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__3e5c9257731fa92bb3b0a3fd8f4556888ed99294fcba1b14ade48e8d8d57c6b0)
+            check_type(argname="argument provider", value=provider, expected_type=type_hints["provider"])
+            check_type(argname="argument schema_name", value=schema_name, expected_type=type_hints["schema_name"])
+            check_type(argname="argument database", value=database, expected_type=type_hints["database"])
+            check_type(argname="argument role", value=role, expected_type=type_hints["role"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "provider": provider,
+            "schema_name": schema_name,
+        }
+        if database is not None:
+            self._values["database"] = database
+        if role is not None:
+            self._values["role"] = role
+
+    @builtins.property
+    def provider(self) -> "IProvider":
+        '''Provider.'''
+        result = self._values.get("provider")
+        assert result is not None, "Required property 'provider' is missing"
+        return typing.cast("IProvider", result)
+
+    @builtins.property
+    def schema_name(self) -> builtins.str:
+        '''Schema name.'''
+        result = self._values.get("schema_name")
+        assert result is not None, "Required property 'schema_name' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def database(self) -> typing.Optional["IDatabase"]:
+        '''Optional database.
+
+        :default: - use default database
+        '''
+        result = self._values.get("database")
+        return typing.cast(typing.Optional["IDatabase"], result)
+
+    @builtins.property
+    def role(self) -> typing.Optional["Role"]:
+        '''Optional role which will be granted usage and create permissions to this schema.
+
+        This way the role can read its own tables, but
+        cannot see or access tables created by others.
+        '''
+        result = self._values.get("role")
+        return typing.cast(typing.Optional["Role"], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "SchemaProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class Sql(
+    _aws_cdk_ceddda9d.CustomResource,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-rds-sql.Sql",
+):
+    def __init__(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        provider: "IProvider",
+        database: typing.Optional["IDatabase"] = None,
+        rollback: typing.Optional[builtins.str] = None,
+        statement: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''
+        :param scope: -
+        :param id: -
+        :param provider: Provider.
+        :param database: Optional database. Default: - use default database
+        :param rollback: Optional statment to be executed when the resource is deleted.
+        :param statement: SQL.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a34aa094d1e87a65ca4be0fe7c3fad7c2a9f986cfd40a3f07de15d3d6b0d2139)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = SqlProps(
+            provider=provider,
+            database=database,
+            rollback=rollback,
+            statement=statement,
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+
+@jsii.data_type(
+    jsii_type="cdk-rds-sql.SqlProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "provider": "provider",
+        "database": "database",
+        "rollback": "rollback",
+        "statement": "statement",
+    },
+)
+class SqlProps:
+    def __init__(
+        self,
+        *,
+        provider: "IProvider",
+        database: typing.Optional["IDatabase"] = None,
+        rollback: typing.Optional[builtins.str] = None,
+        statement: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''
+        :param provider: Provider.
+        :param database: Optional database. Default: - use default database
+        :param rollback: Optional statment to be executed when the resource is deleted.
+        :param statement: SQL.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__fee81de7736c28ed1e24db0db96a0f7084eb4dad448f37b2efdc59960daf7f24)
+            check_type(argname="argument provider", value=provider, expected_type=type_hints["provider"])
+            check_type(argname="argument database", value=database, expected_type=type_hints["database"])
+            check_type(argname="argument rollback", value=rollback, expected_type=type_hints["rollback"])
+            check_type(argname="argument statement", value=statement, expected_type=type_hints["statement"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "provider": provider,
+        }
+        if database is not None:
+            self._values["database"] = database
+        if rollback is not None:
+            self._values["rollback"] = rollback
+        if statement is not None:
+            self._values["statement"] = statement
+
+    @builtins.property
+    def provider(self) -> "IProvider":
+        '''Provider.'''
+        result = self._values.get("provider")
+        assert result is not None, "Required property 'provider' is missing"
+        return typing.cast("IProvider", result)
+
+    @builtins.property
+    def database(self) -> typing.Optional["IDatabase"]:
+        '''Optional database.
+
+        :default: - use default database
+        '''
+        result = self._values.get("database")
+        return typing.cast(typing.Optional["IDatabase"], result)
+
+    @builtins.property
+    def rollback(self) -> typing.Optional[builtins.str]:
+        '''Optional statment to be executed when the resource is deleted.'''
+        result = self._values.get("rollback")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def statement(self) -> typing.Optional[builtins.str]:
+        '''SQL.'''
+        result = self._values.get("statement")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "SqlProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.implements(IDatabase)
+class Database(
+    _aws_cdk_ceddda9d.CustomResource,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-rds-sql.Database",
+):
+    def __init__(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        database_name: builtins.str,
+        provider: "IProvider",
+        owner: typing.Optional["Role"] = None,
+    ) -> None:
+        '''
+        :param scope: -
+        :param id: -
+        :param database_name: Name of database to create.
+        :param provider: Provider.
+        :param owner: Optional database owner.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__9b0a129482abaf744a12ee5aabac9c0545bc3cdf8edcfb3dca83d0c1051326ed)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = DatabaseProps(
+            database_name=database_name, provider=provider, owner=owner
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+    @jsii.member(jsii_name="fromDatabaseName")
+    @builtins.classmethod
+    def from_database_name(
+        cls,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        database_name: builtins.str,
+    ) -> "IDatabase":
+        '''Return a Database based upon name only.
+
+        Use for importing existing databases.
+
+        :param scope: -
+        :param id: -
+        :param database_name: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__771fb1f62814ed88a15c2f9d4d948498f7416f30cd8e9d630b3ea09667333681)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument database_name", value=database_name, expected_type=type_hints["database_name"])
+        return typing.cast("IDatabase", jsii.sinvoke(cls, "fromDatabaseName", [scope, id, database_name]))
+
+    @builtins.property
+    @jsii.member(jsii_name="databaseName")
+    def database_name(self) -> builtins.str:
+        return typing.cast(builtins.str, jsii.get(self, "databaseName"))
+
+
+__all__ = [
+    "Database",
+    "DatabaseEngine",
+    "DatabaseProps",
+    "IDatabase",
+    "IProvider",
+    "IamGrant",
+    "IamGrantProps",
+    "Provider",
+    "ProviderAttributes",
+    "RdsSqlProps",
+    "RdsSqlResource",
+    "Role",
+    "RoleProps",
+    "Schema",
+    "SchemaProps",
+    "Sql",
+    "SqlProps",
+]
+
+publication.publish()
+
+def _typecheckingstub__d02a87af93e26ceaf647662fc78818b2f43fe154b349df3c4f5752d22b61ea34(
+    *,
+    database_name: builtins.str,
+    provider: IProvider,
+    owner: typing.Optional[Role] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__ddc8001ac6195e8fb417d17f2106bdcd50800e6da2afb84794113f44cc6c18c9(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    provider: IProvider,
+    resource_arn: builtins.str,
+    role_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__4887252bb5c41c89521a26b729d32055341e5bee89b4f65947a38d7c0aaf5dec(
+    *,
+    provider: IProvider,
+    resource_arn: builtins.str,
+    role_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__f569409e68b7292df1965d915629ef8c34532a3dcd05bea0032c564041e409e4(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    cluster: typing.Union[_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster, _aws_cdk_aws_rds_ceddda9d.IDatabaseInstance, _aws_cdk_aws_dsql_ceddda9d.CfnCluster],
+    function_props: typing.Optional[typing.Union[_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunctionProps, typing.Dict[builtins.str, typing.Any]]] = None,
+    logger: typing.Optional[builtins.bool] = None,
+    secret: typing.Optional[_aws_cdk_aws_secretsmanager_ceddda9d.ISecret] = None,
+    ssl: typing.Optional[builtins.bool] = None,
+    timeout: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
+    vpc_subnets: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__6447e54f3866ee95542c4c6e6f57beb9f77e9508347c20f14c7bb52a36c8133c(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    engine: DatabaseEngine,
+    cluster: typing.Optional[typing.Union[_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster, _aws_cdk_aws_rds_ceddda9d.IDatabaseInstance, _aws_cdk_aws_dsql_ceddda9d.CfnCluster]] = None,
+    function_arn: typing.Optional[builtins.str] = None,
+    function_name: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__16aa0dc03b1ffdc1c49190bb39d545df3907972a07f344528a5a891c23d0f28c(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    cluster: typing.Union[_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster, _aws_cdk_aws_rds_ceddda9d.IDatabaseInstance, _aws_cdk_aws_dsql_ceddda9d.CfnCluster],
+    function_props: typing.Optional[typing.Union[_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunctionProps, typing.Dict[builtins.str, typing.Any]]] = None,
+    logger: typing.Optional[builtins.bool] = None,
+    secret: typing.Optional[_aws_cdk_aws_secretsmanager_ceddda9d.ISecret] = None,
+    ssl: typing.Optional[builtins.bool] = None,
+    timeout: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
+    vpc_subnets: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__38638fb01c5b5c1e90a480e969bec755370ee72cad8844940b704cff73c8057c(
+    *,
+    engine: DatabaseEngine,
+    cluster: typing.Optional[typing.Union[_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster, _aws_cdk_aws_rds_ceddda9d.IDatabaseInstance, _aws_cdk_aws_dsql_ceddda9d.CfnCluster]] = None,
+    function_arn: typing.Optional[builtins.str] = None,
+    function_name: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__1562dfb28e0e71a0b95785ddbc26511738019b8ab5c6885e0ff1f2050e6d045b(
+    *,
+    cluster: typing.Union[_aws_cdk_aws_rds_ceddda9d.IDatabaseCluster, _aws_cdk_aws_rds_ceddda9d.IDatabaseInstance, _aws_cdk_aws_dsql_ceddda9d.CfnCluster],
+    function_props: typing.Optional[typing.Union[_aws_cdk_aws_lambda_nodejs_ceddda9d.NodejsFunctionProps, typing.Dict[builtins.str, typing.Any]]] = None,
+    logger: typing.Optional[builtins.bool] = None,
+    secret: typing.Optional[_aws_cdk_aws_secretsmanager_ceddda9d.ISecret] = None,
+    ssl: typing.Optional[builtins.bool] = None,
+    timeout: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
+    vpc_subnets: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__062afab8717d46f6fc2a31188b28d9e663190b2080174cc7f1ddd691f699de7e(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    provider: IProvider,
+    role_name: builtins.str,
+    database: typing.Optional[IDatabase] = None,
+    database_name: typing.Optional[builtins.str] = None,
+    enable_iam_auth: typing.Optional[builtins.bool] = None,
+    encryption_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
+    parameter_prefix: typing.Optional[builtins.str] = None,
+    secret_name: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__a7ed79cdb7903207b3240698f6bcb0582905979c1519e2b49d66fa6fbdac11ee(
+    *,
+    provider: IProvider,
+    role_name: builtins.str,
+    database: typing.Optional[IDatabase] = None,
+    database_name: typing.Optional[builtins.str] = None,
+    enable_iam_auth: typing.Optional[builtins.bool] = None,
+    encryption_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
+    parameter_prefix: typing.Optional[builtins.str] = None,
+    secret_name: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__23264d20ca42f56453469fb6eae1679bf4f901ace3ccab77b186aa28167779bf(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    provider: IProvider,
+    schema_name: builtins.str,
+    database: typing.Optional[IDatabase] = None,
+    role: typing.Optional[Role] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__3e5c9257731fa92bb3b0a3fd8f4556888ed99294fcba1b14ade48e8d8d57c6b0(
+    *,
+    provider: IProvider,
+    schema_name: builtins.str,
+    database: typing.Optional[IDatabase] = None,
+    role: typing.Optional[Role] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__a34aa094d1e87a65ca4be0fe7c3fad7c2a9f986cfd40a3f07de15d3d6b0d2139(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    provider: IProvider,
+    database: typing.Optional[IDatabase] = None,
+    rollback: typing.Optional[builtins.str] = None,
+    statement: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__fee81de7736c28ed1e24db0db96a0f7084eb4dad448f37b2efdc59960daf7f24(
+    *,
+    provider: IProvider,
+    database: typing.Optional[IDatabase] = None,
+    rollback: typing.Optional[builtins.str] = None,
+    statement: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__9b0a129482abaf744a12ee5aabac9c0545bc3cdf8edcfb3dca83d0c1051326ed(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    database_name: builtins.str,
+    provider: IProvider,
+    owner: typing.Optional[Role] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__771fb1f62814ed88a15c2f9d4d948498f7416f30cd8e9d630b3ea09667333681(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    database_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+for cls in [IDatabase, IProvider]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])