Interface WorkloadDataAccessArgs

Defaults to caller identity.

Also grant rds-db:connect on the CLUSTER dbuser ARN, not just the proxy one. Requires clusterResourceId.

Off by default and it must stay off for services: they reach Aurora through the RDS Proxy, and a cluster grant would let one bypass the pooler.

On for human operator roles. They reach Aurora over WARP by the CLUSTER endpoint rather than the proxy (see docs/WARP.md), so a proxy-only grant leaves them with no working path at all — the token is signed for a host that never serves the connection and Postgres answers PAM authentication failed.

The grant does not choose the path; the network does. A service still only has a route to the proxy endpoint.

Aurora cluster resource id (cluster-XXXXXXXX). Required with allowDirectClusterConnect.

Environment suffix, typically pulumi.getStack().

Postgres role this workload authenticates as (e.g. backoffice_api_rw), matching the workloadName of its AuroraWorkloadUser in packages/aurora/pulumi/workloadIdentities.ts. Omit for a workload that holds no Postgres identity.

RDS Proxy resource ID (prx-XXXXXXXX) of the cfx-db proxy. Required with pgRole.

The PROXY's resource id, not the cluster's: an IAM auth token is validated against the resource it was signed for, and services only ever reach Aurora through the proxy. A cluster-scoped grant here would let a service bypass the pooler.

Defaults to the current provider region.

Name of the IAM role to grant. MUST be a role created by the calling stack — pass the resource's .name, not a string literal, so Pulumi orders the grant after the role.

Valkey replication group ID, from cfx-valkey's valkeyReplicationGroupId. Required with valkeyWorkloadName.

Valkey workload identifier (e.g. backoffice-api), matching the workloadName of its ValkeyWorkloadUser. The AUTH username is ${valkeyWorkloadName}-${env}. Omit for a workload that holds no cache identity.