ClusterPolicy

Source: src/AWS/DSQL/ClusterPolicy.ts

The resource-based policy of an Aurora DSQL cluster — controls which principals may perform actions on the cluster (most commonly gating dsql:DbConnect / dsql:DbConnectAdmin behind VPC or Organization conditions). A cluster has at most one.

Creating a Cluster Policy

Block Connections from Outside a VPC

const cluster = yield* DSQL.Cluster("AppDb", {});
const policy = yield* DSQL.ClusterPolicy("VpcOnly", {
  clusterId: cluster.clusterId,
  policy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        Principal: { AWS: "*" },
        Action: ["dsql:DbConnect", "dsql:DbConnectAdmin"],
        Resource: "*",
        Condition: { Null: { "aws:SourceVpc": "true" } },
      },
    ],
  }),
});

Restrict Access to an AWS Organization

const policy = yield* DSQL.ClusterPolicy("OrgOnly", {
  clusterId: cluster.clusterId,
  policy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        Principal: { AWS: "*" },
        Action: ["dsql:DbConnect", "dsql:DbConnectAdmin"],
        Resource: "*",
        Condition: {
          StringNotEquals: { "aws:PrincipalOrgID": "o-exampleorgid" },
        },
      },
    ],
  }),
});