Skip to content

Commit f7d52c1

Browse files
aws-rafamsRafael Moscakrokoko
authored
fix(aurora): aurora security group CDK native syntax (#1045)
* fix(aurora): aurora security group CDK native syntax Signed-off-by: Rafael Mosca <rafams@amazon.com> --------- Signed-off-by: Rafael Mosca <rafams@amazon.com> Co-authored-by: Rafael Mosca <rafams@amazon.es> Co-authored-by: Alain Krok <alkrok@amazon.com>
1 parent a904686 commit f7d52c1

9 files changed

Lines changed: 88 additions & 50 deletions

File tree

‎apidocs/@cdklabs/namespaces/amazonaurora/classes/AmazonAuroraVectorStore.md‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -182,11 +182,11 @@ The VPC of your Amazon Aurora DB cluster.
182182

183183
##### lambdaSecurityGroup
184184

185-
`SecurityGroup`
185+
`ISecurityGroup`
186186

187187
##### auroraSecurityGroup
188188

189-
`SecurityGroup`
189+
`ISecurityGroup`
190190

191191
#### Returns
192192

@@ -288,7 +288,7 @@ The VPC of your Amazon Aurora DB cluster.
288288

289289
### setupDatabaseClusterResources()
290290

291-
> `protected` **setupDatabaseClusterResources**(`vpc`, `secret`, `clusterIdentifier`, `auroraSecurityGroupId`): [`DatabaseClusterResources`](../interfaces/DatabaseClusterResources.md)
291+
> `protected` **setupDatabaseClusterResources**(`vpc`, `secret`, `clusterIdentifier`, `auroraSecurityGroup`): [`DatabaseClusterResources`](../interfaces/DatabaseClusterResources.md)
292292
293293
#### Parameters
294294

@@ -304,9 +304,9 @@ The VPC of your Amazon Aurora DB cluster.
304304

305305
`string`
306306

307-
##### auroraSecurityGroupId
307+
##### auroraSecurityGroup
308308

309-
`string`
309+
`ISecurityGroup`
310310

311311
#### Returns
312312

@@ -342,8 +342,7 @@ Creates an instance of AmazonAuroraVectorStore using existing Aurora Vector Stor
342342
You need to provide your existing Aurora Vector Store properties
343343
such as `databaseName`, `clusterIdentifier`, `vpc` where database is deployed,
344344
`secret` containing username and password for authentication to database,
345-
and `auroraSecurityGroupId` with the value of a security group id that was
346-
used for the database.
345+
and `auroraSecurityGroup` with the ecurity group that was used for the database.
347346

348347
#### Parameters
349348

‎apidocs/@cdklabs/namespaces/amazonaurora/classes/ExistingAmazonAuroraVectorStore.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -182,11 +182,11 @@ The VPC of your Amazon Aurora DB cluster.
182182

183183
##### lambdaSecurityGroup
184184

185-
`SecurityGroup`
185+
`ISecurityGroup`
186186

187187
##### auroraSecurityGroup
188188

189-
`SecurityGroup`
189+
`ISecurityGroup`
190190

191191
#### Returns
192192

@@ -288,7 +288,7 @@ The VPC of your Amazon Aurora DB cluster.
288288

289289
### setupDatabaseClusterResources()
290290

291-
> `protected` **setupDatabaseClusterResources**(`vpc`, `secret`, `clusterIdentifier`, `auroraSecurityGroupId`): [`DatabaseClusterResources`](../interfaces/DatabaseClusterResources.md)
291+
> `protected` **setupDatabaseClusterResources**(`vpc`, `secret`, `clusterIdentifier`, `auroraSecurityGroup`): [`DatabaseClusterResources`](../interfaces/DatabaseClusterResources.md)
292292
293293
#### Parameters
294294

@@ -304,9 +304,9 @@ The VPC of your Amazon Aurora DB cluster.
304304

305305
`string`
306306

307-
##### auroraSecurityGroupId
307+
##### auroraSecurityGroup
308308

309-
`string`
309+
`ISecurityGroup`
310310

311311
#### Returns
312312

‎apidocs/@cdklabs/namespaces/amazonaurora/interfaces/DatabaseClusterResources.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ The Amazon Aurora RDS cluster.
2020

2121
### auroraSecurityGroup
2222

23-
> `readonly` **auroraSecurityGroup**: `SecurityGroup`
23+
> `readonly` **auroraSecurityGroup**: `ISecurityGroup`
2424
2525
The security group associated with the Aurora cluster.
2626

‎apidocs/@cdklabs/namespaces/amazonaurora/interfaces/ExistingAmazonAuroraVectorStoreProps.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,11 @@ set up for `5432`.
1717

1818
## Properties
1919

20-
### auroraSecurityGroupId
20+
### auroraSecurityGroup
2121

22-
> `readonly` **auroraSecurityGroupId**: `string`
22+
> `readonly` **auroraSecurityGroup**: `ISecurityGroup`
2323
24-
The id of the security group associated with the RDS Aurora instance.
24+
The Security group associated with the RDS Aurora instance.
2525
This security group allows access to the Aurora Vector Store from Lambda's
2626
custom resource running pgVector SQL commands.
2727

‎apidocs/@cdklabs/namespaces/bedrock/classes/BedrockFoundationModel.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -287,9 +287,9 @@ The ARN of the Bedrock invokable abstraction.
287287
288288
***
289289

290-
### META\_LLAMA\_4\_MAVERICK\_70B\_INSTRUCT\_V1
290+
### META\_LLAMA\_4\_MAVERICK\_17B\_INSTRUCT\_V1
291291

292-
> `readonly` `static` **META\_LLAMA\_4\_MAVERICK\_70B\_INSTRUCT\_V1**: `BedrockFoundationModel`
292+
> `readonly` `static` **META\_LLAMA\_4\_MAVERICK\_17B\_INSTRUCT\_V1**: `BedrockFoundationModel`
293293
294294
***
295295

‎src/cdk-lib/amazonaurora/README.md‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,15 @@ const auroraDb = amazonaurora.AmazonAuroraVectorStore.fromExistingAuroraVectorSt
7676
textField: 'chunks',
7777
metadataField: 'metadata',
7878
primaryKeyField: 'id',
79-
embeddingsModel: foundation_models.BedrockFoundationModel.COHERE_EMBED_ENGLISH_V3,
79+
embeddingsModelVectorDimension: bedrock.BedrockFoundationModel.COHERE_EMBED_ENGLISH_V3.vectorDimensions!,
8080
vpc: cdk.aws_ec2.Vpc.fromLookup(stack, 'VPC', {
8181
vpcId: 'vpc-0c1a234567ee8bc90',
8282
}),
83-
auroraSecurityGroupId: 'sg-012ef345678c98a76',
83+
auroraSecurityGroup: cdk.aws_ec2.SecurityGroup.fromSecurityGroupId(
84+
stack,
85+
'AuroraSecurityGroup',
86+
'sg-012456789'
87+
),
8488
secret: cdk.aws_rds.DatabaseSecret.fromSecretCompleteArn(
8589
stack,
8690
'Secret',
@@ -141,9 +145,13 @@ aurora_db = amazonaurora.AmazonAuroraVectorStore.from_existing_aurora_vector_sto
141145
text_field='chunks',
142146
metadata_field='metadata',
143147
primary_key_field='id',
144-
embeddings_model=foundation_models.BedrockFoundationModel.COHERE_EMBED_ENGLISH_V3,
148+
embeddings_model_vector_dimension=bedrock.BedrockFoundationModel.COHERE_EMBED_ENGLISH_V3.vectorDimensions!,
145149
vpc=ec2.Vpc.from_lookup(self, 'VPC', vpc_id='vpc-0c1a234567ee8bc90'),
146-
aurora_security_group_id='sg-012ef345678c98a76',,
150+
aurora_security_group=ec2.SecurityGroup.from_security_group_id(
151+
self,
152+
'AuroraSecurityGroup',
153+
'sg-01245678'
154+
),
147155
secret=rds.DatabaseSecret.from_secret_complete_arn(
148156
self,
149157
'Secret',

‎src/cdk-lib/amazonaurora/aurora-vector-store.ts‎

Lines changed: 51 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,15 @@ import { NagSuppressions } from 'cdk-nag';
2121
import { Construct } from 'constructs';
2222
import { buildCustomResourceProvider } from '../../common/helpers/custom-resource-provider-helper';
2323
import { generatePhysicalNameV2 } from '../../common/helpers/utils';
24-
import { AddAwsServiceEndpoint, buildVpc, ServiceEndpointTypeEnum } from '../../common/helpers/vpc-helper';
25-
24+
import {
25+
AddAwsServiceEndpoint,
26+
buildVpc,
27+
ServiceEndpointTypeEnum,
28+
} from '../../common/helpers/vpc-helper';
29+
30+
/******************************************************************************
31+
* ENUMS
32+
*****************************************************************************/
2633
/**
2734
* List of supported versions of PostgreSQL for Aurora cluster.
2835
*/
@@ -43,6 +50,9 @@ export const SupportedPostgreSQLVersions = {
4350
export type SupportedPostgreSQLVersions =
4451
(typeof SupportedPostgreSQLVersions)[keyof typeof SupportedPostgreSQLVersions];
4552

53+
/******************************************************************************
54+
* COMMON
55+
*****************************************************************************/
4656
/**
4757
* Base properties for an Aurora Vector Store.
4858
*/
@@ -141,11 +151,11 @@ export interface ExistingAmazonAuroraVectorStoreProps extends BaseAuroraVectorSt
141151
readonly secret: secretsmanager.ISecret;
142152

143153
/**
144-
* The id of the security group associated with the RDS Aurora instance.
154+
* The Security group associated with the RDS Aurora instance.
145155
* This security group allows access to the Aurora Vector Store from Lambda's
146156
* custom resource running pgVector SQL commands.
147157
*/
148-
readonly auroraSecurityGroupId: string;
158+
readonly auroraSecurityGroup: ec2.ISecurityGroup;
149159
}
150160

151161
/**
@@ -181,7 +191,7 @@ export interface DatabaseClusterResources {
181191
/**
182192
* The security group associated with the Aurora cluster.
183193
*/
184-
readonly auroraSecurityGroup: ec2.SecurityGroup;
194+
readonly auroraSecurityGroup: ec2.ISecurityGroup;
185195
}
186196

187197
/**
@@ -242,7 +252,8 @@ abstract class BaseAmazonAuroraVectorStore extends Construct {
242252
* Setup databaseName based on if it is provided in the props or not
243253
* and based on whether it is an existing Aurora Vector Store or not.
244254
*/
245-
this.databaseName = 'clusterIdentifier' in props ? props.databaseName : props.databaseName ?? 'bedrock_vector_db';
255+
this.databaseName =
256+
'clusterIdentifier' in props ? props.databaseName : props.databaseName ?? 'bedrock_vector_db';
246257

247258
this.schemaName = props.schemaName ?? 'bedrock_integration';
248259
this.vectorField = props.vectorField ?? 'embedding';
@@ -324,14 +335,9 @@ abstract class BaseAmazonAuroraVectorStore extends Construct {
324335
vpc: ec2.IVpc,
325336
secret: secretsmanager.ISecret,
326337
clusterIdentifier: string,
327-
auroraSecurityGroupId: string,
338+
auroraSecurityGroup: ec2.ISecurityGroup,
328339
): DatabaseClusterResources {
329340
const resourceArn = this.generateResourceArn(clusterIdentifier);
330-
const auroraSecurityGroup = ec2.SecurityGroup.fromLookupById(
331-
this,
332-
'ExistingSG',
333-
auroraSecurityGroupId,
334-
) as ec2.SecurityGroup;
335341

336342
return {
337343
vpc,
@@ -351,8 +357,8 @@ abstract class BaseAmazonAuroraVectorStore extends Construct {
351357
}
352358

353359
protected addIngressRuleToAuroraSecurityGroup(
354-
lambdaSecurityGroup: ec2.SecurityGroup,
355-
auroraSecurityGroup: ec2.SecurityGroup,
360+
lambdaSecurityGroup: ec2.ISecurityGroup,
361+
auroraSecurityGroup: ec2.ISecurityGroup,
356362
) {
357363
auroraSecurityGroup.addIngressRule(
358364
lambdaSecurityGroup,
@@ -424,12 +430,17 @@ export class ExistingAmazonAuroraVectorStore extends BaseAmazonAuroraVectorStore
424430
props.vpc,
425431
props.secret,
426432
props.clusterIdentifier,
427-
props.auroraSecurityGroupId,
433+
props.auroraSecurityGroup,
428434
);
429435

430-
const auroraPgCRPolicy = this.createAuroraPgCRPolicy(databaseClusterResources.clusterIdentifier);
436+
const auroraPgCRPolicy = this.createAuroraPgCRPolicy(
437+
databaseClusterResources.clusterIdentifier,
438+
);
431439
const lambdaSecurityGroup = this.createLambdaSecurityGroup(databaseClusterResources.vpc);
432-
this.addIngressRuleToAuroraSecurityGroup(lambdaSecurityGroup, databaseClusterResources.auroraSecurityGroup);
440+
this.addIngressRuleToAuroraSecurityGroup(
441+
lambdaSecurityGroup,
442+
databaseClusterResources.auroraSecurityGroup,
443+
);
433444

434445
this.resourceArn = this.generateResourceArn(databaseClusterResources.clusterIdentifier);
435446
this.credentialsSecretArn = databaseClusterResources.secret.secretArn;
@@ -450,8 +461,7 @@ export class AmazonAuroraVectorStore extends BaseAmazonAuroraVectorStore {
450461
* You need to provide your existing Aurora Vector Store properties
451462
* such as `databaseName`, `clusterIdentifier`, `vpc` where database is deployed,
452463
* `secret` containing username and password for authentication to database,
453-
* and `auroraSecurityGroupId` with the value of a security group id that was
454-
* used for the database.
464+
* and `auroraSecurityGroup` with the ecurity group that was used for the database.
455465
*
456466
* @param scope - The scope in which to define the construct.
457467
* @param id - The ID of the construct.
@@ -489,9 +499,14 @@ export class AmazonAuroraVectorStore extends BaseAmazonAuroraVectorStore {
489499
props.vpc,
490500
props.clusterId,
491501
);
492-
const auroraPgCRPolicy = this.createAuroraPgCRPolicy(databaseClusterResources.clusterIdentifier);
502+
const auroraPgCRPolicy = this.createAuroraPgCRPolicy(
503+
databaseClusterResources.clusterIdentifier,
504+
);
493505
const lambdaSecurityGroup = this.createLambdaSecurityGroup(databaseClusterResources.vpc);
494-
this.addIngressRuleToAuroraSecurityGroup(lambdaSecurityGroup, databaseClusterResources.auroraSecurityGroup);
506+
this.addIngressRuleToAuroraSecurityGroup(
507+
lambdaSecurityGroup,
508+
databaseClusterResources.auroraSecurityGroup,
509+
);
495510

496511
this.resourceArn = databaseClusterResources.resourceArn;
497512
this.credentialsSecretArn = databaseClusterResources.secret.secretArn;
@@ -502,7 +517,11 @@ export class AmazonAuroraVectorStore extends BaseAmazonAuroraVectorStore {
502517
ServiceEndpointTypeEnum.BEDROCK_RUNTIME,
503518
]);
504519

505-
const auroraPgVector = this.setupCustomResource(databaseClusterResources, lambdaSecurityGroup, auroraPgCRPolicy);
520+
const auroraPgVector = this.setupCustomResource(
521+
databaseClusterResources,
522+
lambdaSecurityGroup,
523+
auroraPgCRPolicy,
524+
);
506525

507526
auroraPgVector.node.addDependency(databaseClusterResources.auroraCluster!);
508527
}
@@ -531,7 +550,13 @@ export class AmazonAuroraVectorStore extends BaseAmazonAuroraVectorStore {
531550
version: postgreSQLVersion,
532551
}),
533552
credentials: rds.Credentials.fromGeneratedSecret('postgres'),
534-
clusterIdentifier: clusterIdentifier ?? generatePhysicalNameV2(this, 'aurora-serverless', { maxLength: 63, lower: true, separator: '-' }),
553+
clusterIdentifier:
554+
clusterIdentifier ??
555+
generatePhysicalNameV2(this, 'aurora-serverless', {
556+
maxLength: 63,
557+
lower: true,
558+
separator: '-',
559+
}),
535560
defaultDatabaseName: this.databaseName,
536561
vpc,
537562
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
@@ -541,7 +566,9 @@ export class AmazonAuroraVectorStore extends BaseAmazonAuroraVectorStore {
541566
serverlessV2MinCapacity: 0.5,
542567
serverlessV2MaxCapacity: 4,
543568
writer: rds.ClusterInstance.serverlessV2('AuroraServerlessWriter'),
544-
readers: [rds.ClusterInstance.serverlessV2('AuroraServerlessReader', { scaleWithWriter: true })],
569+
readers: [
570+
rds.ClusterInstance.serverlessV2('AuroraServerlessReader', { scaleWithWriter: true }),
571+
],
545572
removalPolicy: cdk.RemovalPolicy.DESTROY,
546573
});
547574
const resourceArn = cdk.Stack.of(this).formatArn({

‎src/cdk-lib/bedrock/models.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -343,8 +343,8 @@ export class BedrockFoundationModel implements IInvokable {
343343
},
344344
);
345345

346-
public static readonly META_LLAMA_4_MAVERICK_70B_INSTRUCT_V1 = new BedrockFoundationModel(
347-
'meta.llama4-maverick-70b-instruct-v1:0',
346+
public static readonly META_LLAMA_4_MAVERICK_17B_INSTRUCT_V1 = new BedrockFoundationModel(
347+
'meta.llama4-maverick-17b-instruct-v1:0',
348348
{
349349
supportsAgents: true,
350350
supportsCrossRegion: true,

‎test/cdk-lib/amazonaurora/aurora-vector-store.test.ts‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
import * as cdk from 'aws-cdk-lib';
1515
import { Annotations, Match, Template } from 'aws-cdk-lib/assertions';
16-
import { SubnetType, Vpc } from 'aws-cdk-lib/aws-ec2';
16+
import { SubnetType, Vpc, SecurityGroup } from 'aws-cdk-lib/aws-ec2';
1717
import { AwsSolutionsChecks, NagSuppressions } from 'cdk-nag';
1818
import { AmazonAuroraVectorStore, ExistingAmazonAuroraVectorStore } from '../../../src/cdk-lib/amazonaurora';
1919

@@ -144,7 +144,11 @@ describe('Amazon Aurora Vector Store', () => {
144144
embeddingsModelVectorDimension: modelVectorDimension,
145145
vpc: vpc,
146146
secret: secret,
147-
auroraSecurityGroupId: 'sg-12345678',
147+
auroraSecurityGroup: new SecurityGroup(stack, 'AuroraSecurityGroup', {
148+
vpc,
149+
securityGroupName: 'aurora-security-group',
150+
description: 'Security group for access to Aurora from Lambda',
151+
}),
148152
});
149153
});
150154

0 commit comments

Comments
 (0)