DBProxy

Source: src/AWS/RDS/DBProxy.ts

An RDS Proxy for pooled Lambda-to-Aurora connectivity.

The proxy multiplexes many short-lived function connections over a small pool of database connections, absorbing connection storms from Lambda scale-out. It authenticates against the database with credentials read from Secrets Manager via the provided IAM role, then registers targets through a DBProxyTargetGroup. Changing the name, engine family, or subnets replaces the proxy; auth, TLS, timeout, and security groups update in place.

For the common case, Aurora("Db", { proxy: true }) wires the role, proxy, target group, and secret automatically.

Creating a Proxy

const proxy = yield* DBProxy("Proxy", {
  engineFamily: "POSTGRESQL",
  auth: [
    {
      AuthScheme: "SECRETS",
      SecretArn: secret.secretArn,
      IAMAuth: "DISABLED",
    },
  ],
  roleArn: proxyRole.roleArn,
  vpcSubnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
  vpcSecurityGroupIds: [dbSecurityGroup.groupId],
  requireTLS: true,
});

// register the cluster behind the proxy
const targets = yield* DBProxyTargetGroup("ProxyTargets", {
  dbProxyName: proxy.dbProxyName,
  dbClusterIdentifiers: [cluster.dbClusterIdentifier],
});