AwsRds

Service-level Aurora RDS component.

Remarks

Creates either one fresh or restored managed Aurora MySQL/PostgreSQL cluster and its instances, an independently managed Aurora parameter group, or an RDS Proxy for an externally referenced Aurora cluster. Clusters are private and encrypted. Fresh clusters enable RDS-managed Secrets Manager credentials by default; consumers can explicitly use a supplied 1Password-backed password during rollover or maintenance. Restored clusters retain source credentials and do not send credential inputs during creation. Proxies require TLS and disable SQL debug logging. The fresh-cluster databaseUsers option directly manages Aurora PostgreSQL login roles or host-qualified Aurora MySQL accounts and their grants. Every Pulumi preview, update, and destroy runner must reach the private writer endpoint. Management connections always use TLS: PostgreSQL verifies the endpoint with the packaged AWS RDS regional CA bundle; MySQL requires encrypted TLS using the provider runtime's system certificate trust because the MySQL provider cannot accept a custom CA bundle. Every managed MySQL account also requires SSL. With RDS-managed credentials, its AWS identity requires secretsmanager:GetSecretValue and any relevant KMS decrypt permission for the generated master secret. Directly supplied master and database-user passwords are type-restricted to onePasswordSecret results. PostgreSQL retains its password as a Pulumi-secret state input; the MySQL provider stores an unsalted password hash.

Naming:

• This root uses ${env}-${projectHash}-<capability>-<sanitised identity> and type token ${namespace}:aws:AwsRds. cluster.identity and clusterRestore.identity are logical-only; parameter-group and proxy identities reuse their names. The capability is rds-cluster, rds-cluster-restore, rds-cluster-parameter-group, rds-instance-parameter-group, or rds-proxy as selected by the active capability.
• Child component roots use their own matching capability and identity. Their provider children use the parent identity; RDS instances additionally use their two-digit instance key and role associations use args.*.iamRoles[].featureName.
• Aurora cluster AWS names use stackOnly: ${env}-${projectHash}.
• Restored Aurora cluster AWS names use stackOnly: ${env}-${projectHash}.
• Aurora instance AWS names use stackAndIndex: ${env}-${projectHash}-${index}.
• Parameter-group AWS names use lowercased stackAndPurpose: ${env}-${projectHash}-${purpose}.
• RDS Proxy AWS names use stackAndPurpose: ${env}-${projectHash}-${purpose}.
• Exception: final snapshot identifiers use the full cluster identifier with a -final suffix: ${env}-${projectHash}-final; snapshots do not use an AWS resource naming style. Intentional.

Example

const database = new AwsRds({
  cluster: {
    identity: 'primaryDatabase',
    engine: 'aurora-postgresql',
    engineVersion: '15.7',
    dbSubnetGroup: 'shared-rds',
    securityGroups: ['sg-123'],
    instanceClass: 'db.t4g.medium',
  },
});

Constructors

new AwsRds( args: AwsRdsArgs, options?: ComponentResourceOptions, ): AwsRds

Parameters

• args (AwsRdsArgs)
• options (ComponentResourceOptions, optional)

Returns

AwsRds

Hierarchy

• ComponentResource
• AwsRds

Properties

cluster: Cluster

Managed Aurora cluster when the cluster or cluster restore capability is selected.

clusterParameterGroup: ClusterParameterGroup

Independently managed cluster parameter group when the parameter-group capability uses scope: 'cluster'.

databaseUsers: Record<string, AwsRdsDatabaseUserReference>

Directly managed Aurora PostgreSQL roles or host-qualified Aurora MySQL accounts and grants keyed by input map key.

iamRoleAssociations: Record<string, ClusterRoleAssociation>

Aurora PostgreSQL role associations keyed by feature name.

instanceParameterGroup: ParameterGroup

Independently managed instance parameter group when the parameter-group capability uses scope: 'instance'.

instances: Record<string, ClusterInstance>

Aurora instances keyed by two-digit stack index.

parameterGroup: ClusterParameterGroup | ParameterGroup

Independently managed parameter group when the parameter-group capability is selected.

proxy: Proxy

RDS Proxy resource when the proxy capability is selected.

proxyDefaultTargetGroup: ProxyDefaultTargetGroup

Default target group created for the RDS Proxy.

proxyEndpoint: Output<string>

DNS endpoint clients use to connect through the RDS Proxy.

proxyTarget: ProxyTarget

Aurora cluster attachment created for the RDS Proxy.

proxyTargetReference: AwsRdsProxyTargetReference

Reference for wiring the managed cluster into the proxy capability.

readerEndpoint: Output<string>

Reader endpoint of the managed Aurora cluster.

urn: Output<string>

Inherited from urn

The stable logical URN used to distinctly address a resource, both before and after deployments.

writerEndpoint: Output<string>

Writer endpoint of the managed Aurora cluster.

Methods

getData(): Promise<any>

Inherited from getData

Retrieves the data produces by initialize. The data is immediately available in a derived class's constructor after the super(...) call to ComponentResource.

Returns

• Promise<any>

getProvider(moduleMember: string): ProviderResource | undefined

Inherited from getProvider

Returns the provider for the given module member, if one exists.

Parameters

• moduleMember (string)

Returns

• ProviderResource | undefined

initialize( args: Inputs, opts?: ComponentResourceOptions, name?: string, type?: string, ): Promise<any>

Inherited from initialize

Can be overridden by a subclass to asynchronously initialize data for this component automatically when constructed. The data will be available immediately for subclass constructors to use. To access the data use getData.

Parameters

• args (Inputs)
• opts (ComponentResourceOptions, optional)
• name (string, optional)
• type (string, optional)

Returns

• Promise<any>

registerOutputs( outputs?: Inputs | Promise<Inputs> | Output<Inputs>, ): void

Inherited from registerOutputs

Registers synthetic outputs that a component has initialized, usually by allocating other child sub-resources and propagating their resulting property values.

Component resources can call this at the end of their constructor to indicate that they are done creating child resources. This is not strictly necessary as this will automatically be called after the initialize method completes.

Parameters

• outputs (Inputs | Promise<Inputs> | Output<Inputs>, optional)

Returns

• void

Static Methods

isInstance(obj: any): obj is ComponentResource<any>

Inherited from isInstance

Returns true if the given object is a CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

Parameters

• obj (any)

Returns

• obj is ComponentResource<any>