feat: support custom SSL certs in SQL lambda handler

[palpatim]

Description of changes

Adds support for custom SSL certs in SQL data sources. Changes:

• Updates CDK Construct API to add an optional sslCertConfig attribute to the SQL data source configs
• Updates the Lambda handler deployed to the customer account to look up the SSM paths and return the custom SSL certificate if found
• Adds beginnings of support for Beta SQL Layer in CDK test

New CDK parameters & API

cc: @atierian, @swaminator

AmplifyGraphqlApi and AmplifyData constructs add a new sslCertConfig parameter to the SQL db configs. New config API:

Type declarations

// NEW
export interface SslCertConfig {}

// NEW
export interface SslCertSsmPathConfig extends SslCertConfig {
  readonly ssmPath: string | string[];
}

// MODIFIED
export interface SqlModelDataSourceSsmDbConnectionStringConfig {
  // ...
  // V--- Added
  readonly sslCertConfig?: SslCertConfig;
}

// MODIFIED
export interface SqlModelDataSourceSecretsManagerDbConnectionConfig {
  // ...
  // V--- Added
  readonly sslCertConfig?: SslCertConfig;
}

// MODIFIED
export interface SqlModelDataSourceSsmDbConnectionConfig {
  // ...
  // V--- Added
  readonly sslCertConfig?: SslCertConfig;
}

Call site

const api = new AmplifyGraphqlApi(stack, 'MyApi', {
  definition: AmplifyGraphqlDefinition.fromString(schema, {
    name: 'myStrategy',
    dbType: 'MYSQL',
    dbConnectionConfig: {
      connectionUriSsmPath: '/ssm/path/to/connectionUri',
      // V-------- THIS IS NEWLY ADDED
      sslCertConfig: {
        ssmPath: ['/ssm/path/to/sslCert/1', '/ssm/path/to/sslCert/2']
      }
    }

  }),
  authorizationModes,
});

Note that we should be able to provide a more streamlined interface in the data schema builder; the additional structure in the CDK construct is required to allow disjoint-union-type behavior in a JSII-compatible interface.

Description of how you validated changes

• Unit tests
• E2E tests. Ideally, we'd set up a database that uses a totally custom cert for validation, but Aurora doesn't support custom SSL. Instead, we'll validate that the handler & layer use the SSL cert we pass:
  • Test 1 specifies an invalid SSL cert, and is expected to fail attempting to connect to the database
  • Test 2 specifies a valid SSL cert that duplicates the RDS bundle, and is expected to succeed

Checklist

• PR description included
• yarn test passes
• E2Es pass
  • All but custom SSL
  • Custom SSL
• Tests are changed or added
• Any CDK or CloudFormation parameter changes are called out explicitly

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[sundersc]

This is not ideal. When using secrets manager for credentials, I think we shouldn't use (mix) SSM for SSL certificate alone.

[sundersc]

We can
(1) for now, support ssl certificate only when using SSM config (which is enough to support Gen2 DX).
(2) later, we will support secret manager for SSL certificate.

[palpatim]

Discussed offline. Will remove from Secrets Manager Will rework the type interface to apply it to the SqlModelDataSourceDbConnectionConfig. Requirement is that we preserve future API extensibility, at the cost of additional structure at the declaration. Upcoming commit will accomplish this, and I'll summarize the change in this PR description for API BR & PM approval.

[atierian]

API BR approved.
(I did not review the implementation)

[palpatim]

Reviewed offline with @swaminator and @atierian, both approved API changes.