AWS.RDS reference

ApplyPendingMaintenanceAction

Source: src/AWS/RDS/ApplyPendingMaintenanceAction.ts

Runtime binding for the ApplyPendingMaintenanceAction operation (IAM action rds:ApplyPendingMaintenanceAction).

Applies (or schedules) a pending maintenance action on an RDS resource — e.g. an ops function that rolls maintenance during a controlled window. Provide the implementation with Effect.provide(AWS.RDS.ApplyPendingMaintenanceActionHttp).

ApplyPendingMaintenanceAction: Maintenance

const applyPendingMaintenanceAction =
  yield* AWS.RDS.ApplyPendingMaintenanceAction();

yield* applyPendingMaintenanceAction({
  ResourceIdentifier: clusterArn,
  ApplyAction: "system-update",
  OptInType: "immediate",
});

Aurora

Source: src/AWS/RDS/Aurora.ts

Opinionated Aurora bring-up helper.

Aurora is the fast-start L2 for getting a working database online with one call. It creates a generated admin secret, DB subnet group, Aurora cluster, and a single writer instance by default. Optional readers, parameter groups, and an auto-wired RDS Proxy can be enabled as needs grow.

The return value intentionally exposes the underlying DB* resources so users can expand into the lower-level surface without rewriting the stack.

Aurora: Creating a Database

const db = yield* AWS.RDS.Aurora("AppDb", {
  subnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
  securityGroupIds: [databaseSecurityGroup.groupId],
});

Aurora: Scaling Out

const db = yield* AWS.RDS.Aurora("AppDb", {
  subnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
  securityGroupIds: [databaseSecurityGroup.groupId],
  readers: 2,
  proxy: true,
});

Aurora: Querying from a Function

// the Data API is enabled by default (dataApi: true) — bind
// AWS.RDSData.ExecuteStatement to query without a VPC socket
const executeStatement = yield* AWS.RDSData.ExecuteStatement(db.cluster, {
  secret: db.secret,
  database: "app",
});
const result = yield* executeStatement({ sql: "SELECT 1" });

Connect

Source: src/AWS/RDS/Connect.ts

Runtime binding that resolves connection settings for an Aurora cluster, proxy, or proxy endpoint using a Secrets Manager secret or IAM database authentication.

Binding it yields an Effect (not a callable) that resolves a ConnectionInfo — host, port, credentials, and a ready-to-use url — fresh on every execution. No socket is opened; feed the result into your database driver. Provide the implementation with Effect.provide(AWS.RDS.ConnectHttp).

Connect: Connecting to a Database

Resolve Credentials from a Secret

export default MyFunction.make(
  { main: import.meta.url, functionUrl: true },
  Effect.gen(function* () {
    const db = yield* AWS.RDS.Aurora("AppDb", {
      subnetIds: [subnetA.subnetId, subnetB.subnetId],
      securityGroupIds: [dbSecurityGroup.groupId],
    });
    // init — bind the cluster + admin secret; grants
    // secretsmanager:GetSecretValue and (optionally) attaches the
    // function to the given subnets/security groups
    const connect = yield* AWS.RDS.Connect(db.cluster, {
      secret: db.secret,
      database: "app",
      subnetIds: [subnetA.subnetId, subnetB.subnetId],
      securityGroupIds: [appSecurityGroup.groupId],
    });

    return {
      fetch: Effect.gen(function* () {
        // runtime — resolve host/port/credentials, hand `info.url`
        // (Redacted) to postgres.js / pg / drizzle
        const info = yield* connect;
        return yield* HttpServerResponse.json({
          host: info.host,
          port: info.port,
          database: info.database,
        });
      }).pipe(Effect.orDie),
    };
  }).pipe(Effect.provide(AWS.RDS.ConnectHttp)),
);

IAM Database Authentication

// init — grants rds-db:connect for the `app_iam` user; the runtime half
// presigns a short-lived (15 minute) auth token as the password
const connect = yield* AWS.RDS.Connect(db.cluster, {
  auth: "iam",
  username: "app_iam",
  database: "app",
});

// runtime — long-lived pools should wire info.refreshPassword into the
// driver's lazy-password hook so each new connection gets a fresh token
const info = yield* connect;

CopyDBClusterSnapshot

Source: src/AWS/RDS/CopyDBClusterSnapshot.ts

Runtime binding for the CopyDBClusterSnapshot operation (IAM actions rds:CopyDBClusterSnapshot + rds:AddTagsToResource).

Copies an Aurora cluster snapshot (e.g. to archive it under a new identifier or re-encrypt with a different KMS key). Provide the implementation with Effect.provide(AWS.RDS.CopyDBClusterSnapshotHttp).

CopyDBClusterSnapshot: Managing Cluster Snapshots

const copyDBClusterSnapshot = yield* AWS.RDS.CopyDBClusterSnapshot();

yield* copyDBClusterSnapshot({
  SourceDBClusterSnapshotIdentifier: snapshotId,
  TargetDBClusterSnapshotIdentifier: `archive-${snapshotId}`,
});

CopyDBSnapshot

Source: src/AWS/RDS/CopyDBSnapshot.ts

Runtime binding for the CopyDBSnapshot operation (IAM actions rds:CopyDBSnapshot + rds:AddTagsToResource).

Copies a DB instance snapshot (e.g. to archive it under a new identifier or re-encrypt with a different KMS key). Provide the implementation with Effect.provide(AWS.RDS.CopyDBSnapshotHttp).

CopyDBSnapshot: Managing Instance Snapshots

const copyDBSnapshot = yield* AWS.RDS.CopyDBSnapshot();

yield* copyDBSnapshot({
  SourceDBSnapshotIdentifier: snapshotId,
  TargetDBSnapshotIdentifier: `archive-${snapshotId}`,
});

CreateDBClusterSnapshot

Source: src/AWS/RDS/CreateDBClusterSnapshot.ts

Runtime binding for the CreateDBClusterSnapshot operation (IAM actions rds:CreateDBClusterSnapshot + rds:AddTagsToResource).

Takes a manual snapshot of the bound DBCluster — e.g. a pre-migration backup function or a scheduled snapshot-rotation job. The cluster identifier is injected from the binding. Provide the implementation with Effect.provide(AWS.RDS.CreateDBClusterSnapshotHttp).

CreateDBClusterSnapshot: Managing Cluster Snapshots

// init — bind the operation to the cluster
const createDBClusterSnapshot =
  yield* AWS.RDS.CreateDBClusterSnapshot(cluster);

// runtime
yield* createDBClusterSnapshot({
  DBClusterSnapshotIdentifier: `pre-migration-${runId}`,
});

CreateDBSnapshot

Source: src/AWS/RDS/CreateDBSnapshot.ts

Runtime binding for the CreateDBSnapshot operation (IAM actions rds:CreateDBSnapshot + rds:AddTagsToResource).

Takes a manual snapshot of the bound DBInstance — e.g. a pre-migration backup function or a scheduled snapshot-rotation job. The instance identifier is injected from the binding. Provide the implementation with Effect.provide(AWS.RDS.CreateDBSnapshotHttp).

CreateDBSnapshot: Managing Instance Snapshots

// init — bind the operation to the instance
const createDBSnapshot = yield* AWS.RDS.CreateDBSnapshot(instance);

// runtime
yield* createDBSnapshot({
  DBSnapshotIdentifier: `pre-migration-${runId}`,
});

DBCluster

Source: src/AWS/RDS/DBCluster.ts

An Aurora DB cluster.

DBCluster owns the writer and reader endpoints, cluster-wide networking, and Data API enablement. It can bootstrap master credentials directly or by reading a Secrets Manager secret that contains username and password.

It exposes the full backup, maintenance, monitoring, performance-insights, encryption, scaling, and log-export surface of createDBCluster / modifyDBCluster. Mutable fields are reconciled in place against the observed cloud state; immutable fields (engine, databaseName, dbSubnetGroupName, storageEncrypted, kmsKeyId, engineMode, globalClusterIdentifier, availabilityZones, engineLifecycleSupport) force a replacement.

DBCluster: Serverless v2 Cluster

const cluster = yield* DBCluster("Cluster", {
  engine: "aurora-postgresql",
  engineMode: "provisioned",
  serverlessV2ScalingConfiguration: { MinCapacity: 0.5, MaxCapacity: 4 },
  manageMasterUserPassword: true,
  masterUsername: "alchemy",
  backupRetentionPeriod: "7 days",
  deletionProtection: false,
});

DBCluster: Logs & Monitoring

const cluster = yield* DBCluster("Cluster", {
  engine: "aurora-postgresql",
  enableCloudwatchLogsExports: ["postgresql"],
  enablePerformanceInsights: true,
  monitoringInterval: "60 seconds",
  monitoringRoleArn: monitoringRole.roleArn,
});

DBClusterEndpoint

Source: src/AWS/RDS/DBClusterEndpoint.ts

A custom Aurora cluster endpoint — a DNS name that routes to a chosen subset of a cluster’s instances, on top of the built-in writer and reader endpoints of a DBCluster.

Use it to pin analytics traffic to specific readers or to keep a stable address across instance replacements. Changing the identifier or owning cluster replaces the endpoint; type and membership update in place.

DBClusterEndpoint: Creating Custom Endpoints

Reader Endpoint for a Cluster

const readers = yield* DBClusterEndpoint("Readers", {
  dbClusterIdentifier: cluster.dbClusterIdentifier,
  endpointType: "READER",
});

Pin Specific Instances

const analytics = yield* DBClusterEndpoint("Analytics", {
  dbClusterIdentifier: cluster.dbClusterIdentifier,
  endpointType: "ANY",
  staticMembers: [reporting.dbInstanceIdentifier],
});

DBClusterParameterGroup

Source: src/AWS/RDS/DBClusterParameterGroup.ts

An Aurora cluster parameter group — cluster-wide engine settings shared by every instance in a DBCluster.

Name, family, and description changes force a replacement (RDS has no modify API for these); tags update in place.

DBClusterParameterGroup: Creating a Cluster Parameter Group

Parameter Group for Aurora Postgres 16

const clusterParams = yield* DBClusterParameterGroup("ClusterParams", {
  family: "aurora-postgresql16",
  description: "Cluster-wide settings for the app database",
});

Attach to a Cluster

const cluster = yield* DBCluster("Cluster", {
  engine: "aurora-postgresql",
  dbClusterParameterGroupName: clusterParams.dbClusterParameterGroupName,
});

DBInstance

Source: src/AWS/RDS/DBInstance.ts

An RDS database instance — either a standalone (non-Aurora) database or a member of an Aurora DBCluster.

Exposes the full storage, backup, monitoring, performance-insights, encryption, networking, and log-export surface of createDBInstance / modifyDBInstance. Mutable fields are reconciled in place against the observed cloud state; immutable fields (engine, dbName, masterUsername, availabilityZone, storageEncrypted, kmsKeyId, dbSubnetGroupName) force a replacement.

DBInstance: Standalone Instance

const db = yield* DBInstance("Db", {
  engine: "mysql",
  dbInstanceClass: "db.t3.micro",
  allocatedStorage: 20,
  storageType: "gp3",
  masterUsername: "admin",
  masterUserPassword: Redacted.make("supersecret"),
  backupRetentionPeriod: "7 days",
  deletionProtection: false,
});

DBInstance: Storage Defaults

Omitted storage settings describe desired defaults, including on existing instances: gp3 storage, a minimum allocation of 20 GiB, and the engine’s baseline performance. RDS Custom defaults to 40 GiB; io1/io2 default to 100 GiB and at least 1000 IOPS. Only allocated capacity is a floor because RDS cannot shrink a database. Storage type and performance are reconciled even when the program is unchanged and the cloud settings have drifted.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
});

This starts with 20 GiB of gp3 storage, 3000 IOPS, and 125 MiBps. For small non-SQL Server gp3 volumes, these performance values are fixed and Alchemy omits the unsupported performance fields from AWS requests.

DBInstance: Resetting Storage Performance

Removing performance settings restores the baseline for the desired storage type, effective allocation, engine, and autoscaling limit. AWS requires coupled storage fields together on modifications; Alchemy sends the resolved allocation, type, supported performance fields, and ceiling in the same request. Existing database contents are retained.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
  allocatedStorage: 400,
  iops: 16000,
  storageThroughput: 750,
});

At this allocation PostgreSQL uses striped gp3 storage, so removal requests 12000 IOPS and 500 MiBps. Removing storageType: "gp2" instead selects gp3 without shrinking the allocation. Changes remain subject to AWS’s storage optimization cooldown; redeploying cannot bypass that restriction.

DBInstance: Storage Autoscaling

allocatedStorage is a minimum, not a shrink target. RDS can increase the allocation but cannot reduce it in place. maxAllocatedStorage controls future automatic growth; omitting it or setting it to 0 disables autoscaling.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
  storageType: "gp2",
  allocatedStorage: 20,
  maxAllocatedStorage: 100,
});

If RDS grows this database to 30 GiB, redeploying keeps that capacity and the 100 GiB autoscaling limit. It does not attempt to shrink the database to 20 GiB. An externally changed autoscaling limit is reset to the declared value.

DBInstance: Disabling Storage Autoscaling

Removing maxAllocatedStorage resets autoscaling to its disabled default. Existing allocated storage and database contents remain intact.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
  storageType: "gp2",
  allocatedStorage: 20,
  maxAllocatedStorage: 100,
});

maxAllocatedStorage: 0 has the same behavior. Redeploying with either form also disables autoscaling if it was enabled outside Alchemy.

DBInstance: Cluster Member

const writer = yield* DBInstance("Writer", {
  dbClusterIdentifier: cluster.dbClusterIdentifier,
  dbInstanceClass: "db.serverless",
  engine: "aurora-postgresql",
});

DBInstance: Listener Port Defaults

Omitted listener ports select the database engine’s default: PostgreSQL 5432, MySQL/MariaDB 3306, Oracle 1521, SQL Server 1433, and Db2 50000. Alchemy compares the actual endpoint port, including pending changes, rather than the separate DbInstancePort field returned by AWS.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
});

DBInstance: Resetting the Listener Port

Removing a custom port restores the engine default. Unchanged programs also detect and repair external listener changes. Port changes restart the database, including when restoring defaults after adoption.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
  port: 5433,
});

Aurora and other cluster members inherit their listener from DBCluster; instance port declarations are ignored. RDS Custom creation accepts a port, but an existing Custom instance that needs a listener change fails explicitly instead of silently retaining the wrong port or replacing data.

DBInstance: Association Defaults

Parameter and security-group associations are desired configuration. Omission selects a compatible engine default parameter group and the effective VPC’s default security group, including during adoption. Existing database versions and VPC placement constrain those defaults; the currently attached groups are never used as fallback desired values.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
  dbSubnetGroupName: subnetGroup.dbSubnetGroupName,
});

DBInstance: Resetting Associations

Removing declarations restores defaults. Unchanged programs also repair external attachment drift. Reordering or duplicating security-group IDs does not resend the association request.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
  dbSubnetGroupName: subnetGroup.dbSubnetGroupName,
  dbParameterGroupName: customParameters.dbParameterGroupName,
  vpcSecurityGroupIds: [applicationGroup.groupId],
});

The default security group’s rules determine network access after reset. Detached group resources remain intact. Parameter changes can require a reboot; dbParameterGroupApplyStatuses reports pending-reboot without automatically restarting the database. Aurora instance parameter groups remain instance-managed, while security groups belong to its cluster. Multi-AZ DB cluster associations are cluster-managed. RDS Custom cannot manage parameter groups or modify existing security-group attachments; Db2 BYOL requires an explicit parameter group with IBM licensing IDs.

DBInstance: Security Defaults

Omission is desired configuration, not permission to retain external state: IAM authentication, public access, and deletion protection default to false, network type to IPV4, and log exports to an empty set. Removal and unchanged declarations repair these settings after drift or adoption.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
  dbSubnetGroupName: subnetGroup.dbSubnetGroupName,
  enableIAMDatabaseAuthentication: true,
  enableCloudwatchLogsExports: ["postgresql"],
});

Removing the last two properties disables IAM authentication and log exports. Public access remains instance-managed for Aurora, while IAM authentication, deletion protection, network type, and exports belong to DBCluster. Requested or observed cluster membership suppresses instance writes to those settings. Non-Aurora Multi-AZ cluster members also inherit public accessibility.

DBInstance: Pending Security Changes

return {
  enabled: db.iamDatabaseAuthenticationEnabled,
  pending: db.pendingIamDatabaseAuthenticationEnabled,
  securityGroupStatuses: db.vpcSecurityGroupStatuses,
};

Deployment waits for applied security settings and an operational instance. A matching queued IAM value is promoted with ApplyImmediately without resending the IAM field; an incompatible queued value is overwritten even when the applied value already matches. AWS has no selective queue flush: applying IAM or network-type changes immediately can apply unrelated pending modifications and cause downtime. Alchemy does not wait until maintenance. Network type has no field in AWS PendingModifiedValues, so an externally queued network change cannot be detected until it starts applying. Public access, deletion protection, and log exports use ApplyImmediately:false because AWS applies these immediately regardless of that flag. They do not flush the maintenance queue. Other declared updates retain their existing immediate-application behavior. Static parameter changes remain pending-reboot; Alchemy never calls RebootDBInstance automatically.

DBInstance: Managed Master Secret Policy

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
  masterUserSecretResourcePolicy: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { AWS: reader.roleArn },
      Action: ["secretsmanager:GetSecretValue"],
      Resource: "*",
    }],
  },
});

Declared policies are checked with ValidateResourcePolicy, including unchanged plans, and writes additionally use BlockPublicPolicy. Deployment requires secretsmanager:ValidateResourcePolicy permission. Alchemy compares live policy metadata without reading secret values. RDS owns credential generation, rotation, and secret deletion. Only instance-managed secrets are supported; an Aurora or Multi-AZ cluster owns its own secret, and RDS Custom does not support managed credentials. Explicit denies can still obstruct the deployer’s access or RDS rotation; policy validation is not a guarantee that every declared permission is operationally safe.

DBInstance: Removing a Managed Secret Policy

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
  masterUserSecretResourcePolicy: readerPolicy,
});

Omission or removal deletes the resource policy, including external policies discovered during adoption or unchanged-input drift detection. Identity-based IAM permissions still apply. The secret, its credentials, and RDS rotation remain intact. Deployment waits for policy readback before returning; managing an existing secret also requires secretsmanager:GetResourcePolicy and, when resetting a policy, secretsmanager:DeleteResourcePolicy.

DBInstance: Readiness

Deployment waits for an instance ARN and an operational status: available or storage-optimization. Storage optimization remains online and can continue for hours. Missing or pending observations retain the ten-minute provisioning budget; SDK failures keep their original typed errors rather than being retried by the readiness loop. Unknown statuses and blue/green storage-initialization remain bounded pending observations, never ready.

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  masterUsername: "admin",
  manageMasterUserPassword: true,
});
return { status: db.status };

States requiring intervention, including stopped, storage-full, and incompatible or failed configurations, fail with DBInstanceReadinessBlocked. Alchemy does not automatically start a stopped instance. Restore its operational state and deploy again. Unchanged declarations also check readiness, while storage, port, and association updates wait for both their requested values and an operational instance before returning.

DBInstance: Monitoring & Logs

const db = yield* DBInstance("Db", {
  engine: "postgres",
  dbInstanceClass: "db.t3.micro",
  allocatedStorage: 20,
  monitoringInterval: "60 seconds",
  monitoringRoleArn: monitoringRole.roleArn,
  enablePerformanceInsights: true,
  enableCloudwatchLogsExports: ["postgresql", "upgrade"],
});

DBParameterGroup

Source: src/AWS/RDS/DBParameterGroup.ts

An RDS DB parameter group — instance-level engine settings, applied to a DBInstance (as opposed to the cluster-wide DBClusterParameterGroup).

Name, family, and description changes force a replacement (RDS has no modify API for these); parameters and tags update in place.

DBParameterGroup: Creating a Parameter Group

Parameter Group for Aurora Postgres 16 Instances

const instanceParams = yield* DBParameterGroup("InstanceParams", {
  family: "aurora-postgresql16",
  description: "Instance-level settings for the app database",
});

Set Engine Parameters

const params = yield* DBParameterGroup("MysqlParams", {
  family: "mysql8.4",
  parameters: {
    time_zone: "Australia/Sydney",
    max_connections: "200",
  },
});

Dynamic parameters apply immediately, static ones on the next reboot. Cluster-wide settings belong on DBClusterParameterGroup instead — Postgres timezone, for example, is a cluster parameter on Aurora.

Attach to an Instance

const writer = yield* DBInstance("Writer", {
  dbClusterIdentifier: cluster.dbClusterIdentifier,
  dbInstanceClass: "db.serverless",
  engine: "aurora-postgresql",
  dbParameterGroupName: instanceParams.dbParameterGroupName,
});

DBProxy

Source: src/AWS/RDS/DBProxy.ts

An RDS Proxy for pooled Lambda-to-Aurora connectivity.

The proxy multiplexes many short-lived function connections over a small pool of database connections, absorbing connection storms from Lambda scale-out. It authenticates against the database with credentials read from Secrets Manager via the provided IAM role, then registers targets through a DBProxyTargetGroup. Changing the name, engine family, or subnets replaces the proxy; auth, TLS, timeout, and security groups update in place.

For the common case, Aurora("Db", { proxy: true }) wires the role, proxy, target group, and secret automatically.

DBProxy: Creating a Proxy

const proxy = yield* DBProxy("Proxy", {
  engineFamily: "POSTGRESQL",
  auth: [
    {
      AuthScheme: "SECRETS",
      SecretArn: secret.secretArn,
      IAMAuth: "DISABLED",
    },
  ],
  roleArn: proxyRole.roleArn,
  vpcSubnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
  vpcSecurityGroupIds: [dbSecurityGroup.groupId],
  requireTLS: true,
});

// register the cluster behind the proxy
const targets = yield* DBProxyTargetGroup("ProxyTargets", {
  dbProxyName: proxy.dbProxyName,
  dbClusterIdentifiers: [cluster.dbClusterIdentifier],
});

DBProxyEndpoint

Source: src/AWS/RDS/DBProxyEndpoint.ts

An additional RDS Proxy endpoint — a second DNS name on an existing DBProxy, typically read-only for reader traffic or placed in a different VPC.

Changing the name, owning proxy, subnets, or target role replaces the endpoint; security groups and tags update in place.

DBProxyEndpoint: Creating Proxy Endpoints

const readerEndpoint = yield* DBProxyEndpoint("ReaderEndpoint", {
  dbProxyName: proxy.dbProxyName,
  vpcSubnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
  vpcSecurityGroupIds: [dbSecurityGroup.groupId],
  targetRole: "READ_ONLY",
});

DBProxyTargetGroup

Source: src/AWS/RDS/DBProxyTargetGroup.ts

The proxy target group that registers Aurora clusters or instances behind an RDS Proxy.

Every DBProxy has exactly one default target group; this resource adopts it, tunes its connection pool, and reconciles the registered cluster/instance targets. Deleting it deregisters the targets rather than deleting the group itself.

DBProxyTargetGroup: Registering Targets

Register a Cluster Behind a Proxy

const targets = yield* DBProxyTargetGroup("ProxyTargets", {
  dbProxyName: proxy.dbProxyName,
  dbClusterIdentifiers: [cluster.dbClusterIdentifier],
});

Tune the Connection Pool

const targets = yield* DBProxyTargetGroup("ProxyTargets", {
  dbProxyName: proxy.dbProxyName,
  dbClusterIdentifiers: [cluster.dbClusterIdentifier],
  connectionPoolConfig: {
    MaxConnectionsPercent: 90,
    MaxIdleConnectionsPercent: 10,
  },
});

DBSubnetGroup

Source: src/AWS/RDS/DBSubnetGroup.ts

An RDS DB subnet group for Aurora clusters, instances, and proxies.

RDS requires a subnet group spanning at least two Availability Zones before a cluster or instance can be placed in a VPC. Changing the name replaces the group; the subnet list updates in place.

DBSubnetGroup: Creating a Subnet Group

Subnet Group Across Two AZs

const subnetGroup = yield* DBSubnetGroup("SubnetGroup", {
  subnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
});

Place an Aurora Cluster in the Group

const cluster = yield* DBCluster("Cluster", {
  engine: "aurora-postgresql",
  dbSubnetGroupName: subnetGroup.dbSubnetGroupName,
  vpcSecurityGroupIds: [dbSecurityGroup.groupId],
});

DeleteDBClusterSnapshot

Source: src/AWS/RDS/DeleteDBClusterSnapshot.ts

Runtime binding for the DeleteDBClusterSnapshot operation (IAM action rds:DeleteDBClusterSnapshot).

Deletes a manual Aurora cluster snapshot — the pruning half of a snapshot-rotation function. Provide the implementation with Effect.provide(AWS.RDS.DeleteDBClusterSnapshotHttp).

DeleteDBClusterSnapshot: Managing Cluster Snapshots

const deleteDBClusterSnapshot = yield* AWS.RDS.DeleteDBClusterSnapshot();

yield* deleteDBClusterSnapshot({
  DBClusterSnapshotIdentifier: oldSnapshotId,
});

DeleteDBSnapshot

Source: src/AWS/RDS/DeleteDBSnapshot.ts

Runtime binding for the DeleteDBSnapshot operation (IAM action rds:DeleteDBSnapshot).

Deletes a manual DB instance snapshot — the pruning half of a snapshot-rotation function. Provide the implementation with Effect.provide(AWS.RDS.DeleteDBSnapshotHttp).

DeleteDBSnapshot: Managing Instance Snapshots

const deleteDBSnapshot = yield* AWS.RDS.DeleteDBSnapshot();

yield* deleteDBSnapshot({ DBSnapshotIdentifier: oldSnapshotId });

DescribeDBClusterEndpoints

Source: src/AWS/RDS/DescribeDBClusterEndpoints.ts

Runtime binding for the DescribeDBClusterEndpoints operation (IAM action rds:DescribeDBClusterEndpoints).

Lists an Aurora cluster’s endpoints (writer, reader, and custom endpoints) with their status and member lists. Provide the implementation with Effect.provide(AWS.RDS.DescribeDBClusterEndpointsHttp).

DescribeDBClusterEndpoints: Monitoring Databases

const describeDBClusterEndpoints =
  yield* AWS.RDS.DescribeDBClusterEndpoints();

const page = yield* describeDBClusterEndpoints({
  DBClusterIdentifier: clusterId,
});

DescribeDBClusters

Source: src/AWS/RDS/DescribeDBClusters.ts

Runtime binding for the DescribeDBClusters operation (IAM action rds:DescribeDBClusters).

Lists the account’s RDS/Aurora clusters (or one cluster by identifier) — status, endpoints, members, engine versions — for health checks and cluster discovery. Provide the implementation with Effect.provide(AWS.RDS.DescribeDBClustersHttp).

DescribeDBClusters: Monitoring Databases

const describeDBClusters = yield* AWS.RDS.DescribeDBClusters();

const page = yield* describeDBClusters({
  DBClusterIdentifier: clusterId,
});
const status = page.DBClusters?.[0]?.Status;

DescribeDBClusterSnapshots

Source: src/AWS/RDS/DescribeDBClusterSnapshots.ts

Runtime binding for the DescribeDBClusterSnapshots operation (IAM action rds:DescribeDBClusterSnapshots).

Lists the account’s Aurora cluster snapshots — the discovery half of a snapshot-rotation or verification function. Provide the implementation with Effect.provide(AWS.RDS.DescribeDBClusterSnapshotsHttp).

DescribeDBClusterSnapshots: Managing Cluster Snapshots

const describeDBClusterSnapshots =
  yield* AWS.RDS.DescribeDBClusterSnapshots();

const page = yield* describeDBClusterSnapshots({
  DBClusterIdentifier: clusterId,
  SnapshotType: "manual",
});

DescribeDBInstances

Source: src/AWS/RDS/DescribeDBInstances.ts

Runtime binding for the DescribeDBInstances operation (IAM action rds:DescribeDBInstances).

Lists the account’s RDS instances (or one instance by identifier) — status, endpoint, storage, engine version — for health checks and instance discovery. Provide the implementation with Effect.provide(AWS.RDS.DescribeDBInstancesHttp).

DescribeDBInstances: Monitoring Databases

const describeDBInstances = yield* AWS.RDS.DescribeDBInstances();

const page = yield* describeDBInstances({
  DBInstanceIdentifier: instanceId,
});
const status = page.DBInstances?.[0]?.DBInstanceStatus;

DescribeDBSnapshots

Source: src/AWS/RDS/DescribeDBSnapshots.ts

Runtime binding for the DescribeDBSnapshots operation (IAM action rds:DescribeDBSnapshots).

Lists the account’s DB instance snapshots — the discovery half of a snapshot-rotation or verification function. Provide the implementation with Effect.provide(AWS.RDS.DescribeDBSnapshotsHttp).

DescribeDBSnapshots: Managing Instance Snapshots

const describeDBSnapshots = yield* AWS.RDS.DescribeDBSnapshots();

const page = yield* describeDBSnapshots({
  DBInstanceIdentifier: instanceId,
  SnapshotType: "manual",
});

DescribeEvents

Source: src/AWS/RDS/DescribeEvents.ts

Runtime binding for the DescribeEvents operation (IAM action rds:DescribeEvents).

Lists recent RDS events (instance/cluster/snapshot/parameter-group lifecycle notifications from the last 14 days) — the pull-based counterpart to consumeRdsEvents. Provide the implementation with Effect.provide(AWS.RDS.DescribeEventsHttp).

DescribeEvents: Monitoring Databases

const describeEvents = yield* AWS.RDS.DescribeEvents();

const page = yield* describeEvents({
  SourceType: "db-cluster",
  SourceIdentifier: clusterId,
});

DescribePendingMaintenanceActions

Source: src/AWS/RDS/DescribePendingMaintenanceActions.ts

Runtime binding for the DescribePendingMaintenanceActions operation (IAM action rds:DescribePendingMaintenanceActions).

Lists pending maintenance actions (engine upgrades, OS patches, certificate rotations) across the account’s RDS resources. Provide the implementation with Effect.provide(AWS.RDS.DescribePendingMaintenanceActionsHttp).

DescribePendingMaintenanceActions: Maintenance

const describePendingMaintenanceActions =
  yield* AWS.RDS.DescribePendingMaintenanceActions();

const page = yield* describePendingMaintenanceActions();

FailoverDBCluster

Source: src/AWS/RDS/FailoverDBCluster.ts

Runtime binding for the FailoverDBCluster operation (IAM action rds:FailoverDBCluster).

Forces a failover of the bound DBCluster — promotes a reader to writer, e.g. for chaos testing or AZ evacuation. The cluster identifier is injected from the binding. Provide the implementation with Effect.provide(AWS.RDS.FailoverDBClusterHttp).

FailoverDBCluster: Operating a Cluster

// init — bind the operation to the cluster
const failoverDBCluster = yield* AWS.RDS.FailoverDBCluster(cluster);

// runtime
yield* failoverDBCluster();

RebootDBInstance

Source: src/AWS/RDS/RebootDBInstance.ts

Runtime binding for the RebootDBInstance operation (IAM action rds:RebootDBInstance).

Reboots the bound DBInstance (optionally with a forced failover for Multi-AZ deployments) — e.g. to apply static parameter changes. The instance identifier is injected from the binding. Provide the implementation with Effect.provide(AWS.RDS.RebootDBInstanceHttp).

RebootDBInstance: Operating an Instance

// init — bind the operation to the instance
const rebootDBInstance = yield* AWS.RDS.RebootDBInstance(instance);

// runtime
yield* rebootDBInstance();

StartDBCluster

Source: src/AWS/RDS/StartDBCluster.ts

Runtime binding for the StartDBCluster operation (IAM action rds:StartDBCluster).

Starts the bound DBCluster after it was stopped — e.g. an ops function that wakes a development cluster on a schedule. The cluster identifier is injected from the binding. Provide the implementation with Effect.provide(AWS.RDS.StartDBClusterHttp).

StartDBCluster: Operating a Cluster

// init — bind the operation to the cluster
const startDBCluster = yield* AWS.RDS.StartDBCluster(cluster);

// runtime
yield* startDBCluster();

StartDBInstance

Source: src/AWS/RDS/StartDBInstance.ts

Runtime binding for the StartDBInstance operation (IAM action rds:StartDBInstance).

Starts the bound DBInstance after it was stopped — e.g. an ops function that wakes a development database on a schedule. The instance identifier is injected from the binding. Provide the implementation with Effect.provide(AWS.RDS.StartDBInstanceHttp).

StartDBInstance: Operating an Instance

// init — bind the operation to the instance
const startDBInstance = yield* AWS.RDS.StartDBInstance(instance);

// runtime
yield* startDBInstance();

StopDBCluster

Source: src/AWS/RDS/StopDBCluster.ts

Runtime binding for the StopDBCluster operation (IAM action rds:StopDBCluster).

Stops the bound DBCluster — e.g. an ops function that parks a development cluster overnight to save cost. The cluster identifier is injected from the binding. Provide the implementation with Effect.provide(AWS.RDS.StopDBClusterHttp).

StopDBCluster: Operating a Cluster

// init — bind the operation to the cluster
const stopDBCluster = yield* AWS.RDS.StopDBCluster(cluster);

// runtime
yield* stopDBCluster();

StopDBInstance

Source: src/AWS/RDS/StopDBInstance.ts

Runtime binding for the StopDBInstance operation (IAM action rds:StopDBInstance).

Stops the bound DBInstance — e.g. an ops function that parks a development database overnight to save cost. The instance identifier is injected from the binding. Provide the implementation with Effect.provide(AWS.RDS.StopDBInstanceHttp).

StopDBInstance: Operating an Instance

// init — bind the operation to the instance
const stopDBInstance = yield* AWS.RDS.StopDBInstance(instance);

// runtime
yield* stopDBInstance();