feat: scope minimizeRdsVpcEndpoints to the SQL data source strategy

Author: Simone319

packages/amplify-graphql-api-construct/.jsii

@@ -347,7 +347,6 @@ export interface PartialTranslationBehavior {
     readonly enableSearchEncryptionAtRest?: boolean;
     readonly enableSearchNodeToNodeEncryption?: boolean;
     readonly enableTransformerCfnOutputs?: boolean;
-    readonly minimizeRdsVpcEndpoints?: boolean;
     readonly populateOwnerFieldForStaticGroupAuth?: boolean;
     // @internal
     readonly _provisionHotswapFriendlyResources?: boolean;
@@ -391,6 +390,7 @@ export interface SQLLambdaModelDataSourceStrategy {
     readonly customSqlStatements?: Record<string, string>;
     readonly dbConnectionConfig: SqlModelDataSourceDbConnectionConfig;
     readonly dbType: ModelDataSourceStrategySqlDbType;
+    readonly minimizeRdsVpcEndpoints?: boolean;
     readonly name: string;
     readonly sqlLambdaProvisionedConcurrencyConfig?: ProvisionedConcurrencyConfig;
     readonly vpcConfiguration?: VpcConfig;
@@ -483,7 +483,6 @@ export interface TranslationBehavior {
     readonly enableSearchEncryptionAtRest: boolean;
     readonly enableSearchNodeToNodeEncryption: boolean;
     readonly enableTransformerCfnOutputs: boolean;
-    readonly minimizeRdsVpcEndpoints: boolean;
     readonly populateOwnerFieldForStaticGroupAuth: boolean;
     readonly replaceTableUponGsiUpdate: boolean;
     readonly respectPrimaryKeyAttributesOnConnectionField: boolean;

packages/amplify-graphql-api-construct/API.md

@@ -109,6 +109,7 @@ describe('sql-bound API generated resource access', () => {
               securityGroupIds: ['sg-123abc'],
               subnetAvailabilityZoneConfig: [{ subnetId: 'subnet-123abc', availabilityZone: 'us-east-1a' }],
             },
+            minimizeRdsVpcEndpoints: true,
           });
 
           const stack = new cdk.Stack();
@@ -118,9 +119,6 @@ describe('sql-bound API generated resource access', () => {
             authorizationModes: {
               userPoolConfig: { userPool },
             },
-            translationBehavior: {
-              minimizeRdsVpcEndpoints: true,
-            },
           });
 
           const {

packages/amplify-graphql-api-construct/src/__tests__/__functional__/sql-model-definition.test.ts

@@ -16,7 +16,6 @@ export const defaultTranslationBehavior: TranslationBehavior = {
   secondaryKeyAsGSI: true,
   enableAutoIndexQueryNames: true,
   respectPrimaryKeyAttributesOnConnectionField: true,
-  minimizeRdsVpcEndpoints: false,
   enableSearchNodeToNodeEncryption: false,
   enableSearchEncryptionAtRest: false,
   enableTransformerCfnOutputs: false,

packages/amplify-graphql-api-construct/src/internal/default-parameters.ts

@@ -86,6 +86,16 @@ export interface SQLLambdaModelDataSourceStrategy {
    */
   readonly vpcConfiguration?: VpcConfig;
 
+  /**
+   * Opt-in optimization that minimizes the interface VPC endpoints provisioned for this SQL data source's Lambda. When enabled, only the
+   * `ssm` interface VPC endpoint - the sole endpoint the SQL Lambda consumes at runtime to read the database connection secret - is
+   * provisioned. When disabled (the default), the full set of endpoints (`ssm`, `ssmmessages`, `ec2`, `ec2messages`, `kms`) is provisioned,
+   * preserving the existing behavior. This setting only takes effect when `vpcConfiguration` is set; it has no effect for SQL data sources
+   * that are not installed into a VPC.
+   * @default false
+   */
+  readonly minimizeRdsVpcEndpoints?: boolean;
+
   /**
    * Custom SQL statements. The key is the value of the `references` attribute of the `@sql` directive in the `schema`; the value is the SQL
    * to be executed.

packages/amplify-graphql-api-construct/src/model-datasource-strategy-types.ts

@@ -548,14 +548,6 @@ export interface TranslationBehavior {
    */
   readonly respectPrimaryKeyAttributesOnConnectionField: boolean;
 
-  /**
-   * Opt-in optimization for SQL data sources backed by an RDS instance in a VPC. When enabled, only the `ssm` interface VPC endpoint - the
-   * sole endpoint the SQL Lambda consumes at runtime to read the database connection secret - is provisioned for the SQL Lambda's VPC. When
-   * disabled, the full set (`ssm`, `ssmmessages`, `ec2`, `ec2messages`, `kms`) is provisioned. Only affects SQL APIs configured with a VPC.
-   * @default false
-   */
-  readonly minimizeRdsVpcEndpoints: boolean;
-
   /**
    * Whether Node to Node encryption is enabled on the ElasticSearch cluster
    *
@@ -675,14 +667,6 @@ export interface PartialTranslationBehavior {
    */
   readonly respectPrimaryKeyAttributesOnConnectionField?: boolean;
 
-  /**
-   * Opt-in optimization for SQL data sources backed by an RDS instance in a VPC. When enabled, only the `ssm` interface VPC endpoint - the
-   * sole endpoint the SQL Lambda consumes at runtime to read the database connection secret - is provisioned for the SQL Lambda's VPC. When
-   * disabled, the full set (`ssm`, `ssmmessages`, `ec2`, `ec2messages`, `kms`) is provisioned. Only affects SQL APIs configured with a VPC.
-   * @default false
-   */
-  readonly minimizeRdsVpcEndpoints?: boolean;
-
   /**
    * Whether Node to Node encryption is enabled on the ElasticSearch cluster
    *

packages/amplify-graphql-api-construct/src/types.ts

@@ -532,13 +532,14 @@ describe('ModelTransformer with SQL data sources:', () => {
     });
 
     it('provisions only the ssm VPC endpoint when minimizeRdsVpcEndpoints is enabled', () => {
+      const minimizedVpcStrategy: SQLLambdaModelDataSourceStrategy = {
+        ...mysqlVpcStrategy,
+        minimizeRdsVpcEndpoints: true,
+      };
       const out = testTransform({
         schema: validSchema,
         transformers: [new ModelTransformer(), new PrimaryKeyTransformer()],
-        dataSourceStrategies: constructDataSourceStrategies(validSchema, mysqlVpcStrategy),
-        transformParameters: {
-          minimizeRdsVpcEndpoints: true,
-        },
+        dataSourceStrategies: constructDataSourceStrategies(validSchema, minimizedVpcStrategy),
       });
       expect(out).toBeDefined();
       const endpoints = getVpcEndpointResources(out);

packages/amplify-graphql-model-transformer/src/__tests__/amplify-sql-resource-generator.test.ts

@@ -154,12 +154,7 @@ export class RdsModelResourceGenerator extends ModelResourceGenerator {
     // cert, even if the rest of the DB configuration is stored in Secrets Manager.
     if (sslCertSsmPath) {
       environment.SSL_CERT_SSM_PATH = JSON.stringify(sslCertSsmPath);
-      environment.SSM_ENDPOINT = getSsmEndpoint(
-        lambdaScope,
-        resourceNames,
-        strategy.vpcConfiguration,
-        context.transformParameters.minimizeRdsVpcEndpoints,
-      );
+      environment.SSM_ENDPOINT = getSsmEndpoint(lambdaScope, resourceNames, strategy.vpcConfiguration, strategy.minimizeRdsVpcEndpoints);
     }
 
     const lambda = createRdsLambda(
@@ -172,7 +167,7 @@ export class RdsModelResourceGenerator extends ModelResourceGenerator {
       environment,
       strategy.vpcConfiguration,
       strategy.sqlLambdaProvisionedConcurrencyConfig,
-      context.transformParameters.minimizeRdsVpcEndpoints,
+      strategy.minimizeRdsVpcEndpoints,
     );
 
     // Note that this tag will be added to either the bare function, or the alias created to handle provisioned concurrency

packages/amplify-graphql-model-transformer/src/resources/rds-model-resource-generator.ts

@@ -25,9 +25,6 @@ export const defaultTransformParameters: TransformParameters = {
   // Relational Params
   respectPrimaryKeyAttributesOnConnectionField: true,
 
-  // SQL Params
-  minimizeRdsVpcEndpoints: false,
-
   // Search Params
   enableSearchNodeToNodeEncryption: false,
   enableSearchEncryptionAtRest: false,

packages/amplify-graphql-transformer-core/src/transformer-context/transform-parameters.ts

@@ -80,6 +80,16 @@ export interface SQLLambdaModelDataSourceStrategy extends ModelDataSourceStrateg
    */
   readonly vpcConfiguration?: VpcConfig;
 
+  /**
+   * Opt-in optimization that minimizes the interface VPC endpoints provisioned for this SQL data source's Lambda. When enabled, only the
+   * `ssm` interface VPC endpoint - the sole endpoint the SQL Lambda consumes at runtime to read the database connection secret - is
+   * provisioned. When disabled (the default), the full set of endpoints (`ssm`, `ssmmessages`, `ec2`, `ec2messages`, `kms`) is provisioned,
+   * preserving the existing behavior. This setting only takes effect when `vpcConfiguration` is set; it has no effect for SQL data sources
+   * that are not installed into a VPC.
+   * @default false
+   */
+  readonly minimizeRdsVpcEndpoints?: boolean;
+
   /**
    * The configuration for the provisioned concurrency of the Lambda.
    */