diff --git a/packages/amplify-e2e-tests/src/__tests__/rds-pg-array-objects.test.ts b/packages/amplify-e2e-tests/src/__tests__/rds-pg-array-objects.test.ts index 5ea140f400..53d43aa30c 100644 --- a/packages/amplify-e2e-tests/src/__tests__/rds-pg-array-objects.test.ts +++ b/packages/amplify-e2e-tests/src/__tests__/rds-pg-array-objects.test.ts @@ -137,10 +137,10 @@ describe('RDS Model Directive', () => { expect(rdsLambdaFunction.Properties.VpcConfig.SecurityGroupIds.length).toBeGreaterThan(0); expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ssm`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ssmmessages`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}kms`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2messages`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ssmmessages`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}kms`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2messages`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); }; afterAll(async () => { diff --git a/packages/amplify-e2e-tests/src/__tests__/rds-pg-import.test.ts b/packages/amplify-e2e-tests/src/__tests__/rds-pg-import.test.ts index eeb0cf53fc..5dbe5de22c 100644 --- a/packages/amplify-e2e-tests/src/__tests__/rds-pg-import.test.ts +++ b/packages/amplify-e2e-tests/src/__tests__/rds-pg-import.test.ts @@ -109,10 +109,10 @@ describe('RDS Model Directive', () => { expect(rdsLambdaFunction.Properties.VpcConfig.SecurityGroupIds.length).toBeGreaterThan(0); expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ssm`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ssmmessages`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}kms`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2messages`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ssmmessages`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}kms`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2messages`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); }; afterAll(async () => { diff --git a/packages/amplify-e2e-tests/src/rds-v2-tests-common/rds-model-v2.ts b/packages/amplify-e2e-tests/src/rds-v2-tests-common/rds-model-v2.ts index 4e688313c4..61dff87acb 100644 --- a/packages/amplify-e2e-tests/src/rds-v2-tests-common/rds-model-v2.ts +++ b/packages/amplify-e2e-tests/src/rds-v2-tests-common/rds-model-v2.ts @@ -118,10 +118,10 @@ export const testRDSModel = (engine: ImportedRDSType, queries: string[]): void = expect(sqlLambdaFunction.Properties.VpcConfig.SecurityGroupIds.length).toBeGreaterThan(0); expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ssm`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ssmmessages`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}kms`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); - expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2messages`, CDK_VPC_ENDPOINT_TYPE)).toBeDefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ssmmessages`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}kms`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); + expect(getResource(resources, `${resourceNames.sqlVpcEndpointPrefix}ec2messages`, CDK_VPC_ENDPOINT_TYPE)).toBeUndefined(); // Validate patching lambda and subscription const sqlPatchingLambdaFunction = getResource(resources, resourceNames.sqlPatchingLambdaFunction, CDK_FUNCTION_TYPE); diff --git a/packages/amplify-graphql-model-transformer/src/resolvers/rds/resolver.ts b/packages/amplify-graphql-model-transformer/src/resolvers/rds/resolver.ts index e45c9a9e38..517311b70b 100644 --- a/packages/amplify-graphql-model-transformer/src/resolvers/rds/resolver.ts +++ b/packages/amplify-graphql-model-transformer/src/resolvers/rds/resolver.ts @@ -98,8 +98,8 @@ export const getSsmEndpoint = (scope: Construct, resourceNames: SQLLambdaResourc return Fn.join('', ['ssm.', Fn.ref('AWS::Region'), '.amazonaws.com']); } - // Although the Lambda function will only invoke SSM directly, internally the SDK makes calls to other services as well - const services = ['ssm', 'ssmmessages', 'ec2', 'ec2messages', 'kms']; + // Only the SSM VPC endpoint is needed for Lambda to access Parameter Store + const services = ['ssm']; const endpoints = addVpcEndpoints(scope, sqlLambdaVpcConfig, resourceNames, services); const endpointEntries = endpoints.find((endpoint) => endpoint.service === 'ssm')?.endpoint.attrDnsEntries; if (!endpointEntries) { @@ -300,7 +300,7 @@ const addVpcEndpoint = ( ): CfnVPCEndpoint => { const serviceEndpointPrefix = 'com.amazonaws'; const endpoint = new CfnVPCEndpoint(scope, `${resourceNames.sqlVpcEndpointPrefix}${serviceSuffix}`, { - serviceName: Fn.join('', [serviceEndpointPrefix, '.', Fn.ref('AWS::Region'), '.', serviceSuffix]), // Sample: com.amazonaws.us-east-1.ssmmessages + serviceName: Fn.join('', [serviceEndpointPrefix, '.', Fn.ref('AWS::Region'), '.', serviceSuffix]), // Sample: com.amazonaws.us-east-1.ssm vpcEndpointType: 'Interface', vpcId: sqlLambdaVpcConfig.vpcId, subnetIds: extractSubnetForVpcEndpoint(sqlLambdaVpcConfig.subnetAvailabilityZoneConfig),