Optionalopts: ComponentResourceOptionsReadonlyauroraReadonlydatabaseReadonlyurnThe stable logical URN used to distinctly address a resource, both before and after deployments.
ReadonlyusernameProtectedgetRetrieves the data produces by initialize. The data is
immediately available in a derived class's constructor after the
super(...) call to ComponentResource.
Returns the provider for the given module member, if one exists.
ProtectedinitializeCan be overridden by a subclass to asynchronously initialize data for this component automatically when constructed. The data will be available immediately for subclass constructors to use. To access the data use getData.
Optionalopts: ComponentResourceOptionsOptionalname: stringOptionaltype: stringProtectedregisterRegisters synthetic outputs that a component has initialized, usually by allocating other child sub-resources and propagating their resulting property values.
Component resources can call this at the end of their constructor to indicate that they are done creating child resources. This is not strictly necessary as this will automatically be called after the initialize method completes.
Optionaloutputs: Inputs | Promise<Inputs> | Output<Inputs>StaticisReturns true if the given object is a CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.
A workload's Aurora IDENTITY, and only that:
LOGIN+rds_iam(no password)CONNECTgrant on the target databaserds-db:connecton the shared PROXY role, scoped to this user's cluster dbuser ARN — the proxy's upstream leg, needed so it can authenticate to Aurora on the caller's behalf. The proxy role is created by the same stack as this component, so this grant is in-bounds.The CALLER-side grant is not here. It lands on a workload's execution or task role, which this component's stack (
cfx-db) does not create — attaching it from here meant naming those roles as string literals, which hid the dependency from Pulumi and madecfx-dbfail withNoSuchEntitywhenever a workload had not deployed yet. UsegrantWorkloadDataAccessfrom the stack that owns the role. SeeworkloadDataAccess.ts.The proxy is configured with
defaultAuthScheme: "IAM_AUTH", so client → proxy → Aurora all uses IAM tokens — no Secrets Manager password hop. Schema/table grants live in dbmate migrations or group roles owned by the per-DB stack.