Interface WorkloadDataAccessArgs

Defaults to caller identity.

Also grant rds-db:connect on the CLUSTER dbuser ARN, not just the proxy one. Requires clusterResourceId.

Off by default and it must stay off for services: they reach Aurora through the RDS Proxy, and a cluster grant would let one bypass the pooler.

On for human operator roles. They reach Aurora over the cloudflared tunnel, whose ingress terminates on the CLUSTER endpoint rather than the proxy (see tunnel_ingress in cfx-self-hosted-services projects/bastion), so a proxy-only grant leaves them with no working path at all — the token is signed for a host that never serves the connection and Postgres answers PAM authentication failed.

The grant does not choose the path; the network does. A service still only has a route to the proxy endpoint.

Aurora cluster resource id (cluster-XXXXXXXX). Required with allowDirectClusterConnect.

Environment suffix, typically pulumi.getStack().

Postgres role this workload authenticates as (e.g. backoffice_api_rw), matching the workloadName of its AuroraWorkloadUser in packages/db/pulumi/workloadIdentities.ts. Omit for a workload that holds no Postgres identity.

RDS Proxy resource ID (prx-XXXXXXXX), from cfx-db's auroraProxyResourceId output. Required with pgRole.

The PROXY's resource id, not the cluster's: an IAM auth token is validated against the resource it was signed for, and services only ever reach Aurora through the proxy. A cluster-scoped grant here would let a service bypass the pooler.

Defaults to the current provider region.

Name of the IAM role to grant. MUST be a role created by the calling stack — pass the resource's .name, not a string literal, so Pulumi orders the grant after the role.

Valkey replication group ID, from cfx-valkey's valkeyReplicationGroupId. Required with valkeyWorkloadName.

Valkey workload identifier (e.g. backoffice-api), matching the workloadName of its ValkeyWorkloadUser. The AUTH username is ${valkeyWorkloadName}-${env}. Omit for a workload that holds no cache identity.