diff --git a/cloud/aws/deploytf/.nitric/modules/rds/main.tf b/cloud/aws/deploytf/.nitric/modules/rds/main.tf
new file mode 100644
index 000000000..0fb574742
--- /dev/null
+++ b/cloud/aws/deploytf/.nitric/modules/rds/main.tf
@@ -0,0 +1,144 @@
+# Create a new random password for the RDS cluster
+resource "random_password" "rds_password" {
+  length  = 16
+  special = false
+}
+
+# Create a subnet group for the RDS instance
+resource "aws_db_subnet_group" "rds_subnet_group" {
+  subnet_ids = var.private_subnet_ids
+}
+
+# Create a security group for the RDS instance
+resource "aws_security_group" "rds_security_group" {
+  vpc_id = var.vpc_id
+
+  ingress {
+    from_port = 5432
+    to_port   = 5432
+    protocol  = "tcp"
+    self      = true
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+#  Create a role for the codebuild job
+resource "aws_iam_role" "codebuild_role" {
+  name = "nitric-codebuild-role"
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Principal = {
+          Service = "codebuild.amazonaws.com"
+        },
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+}
+
+# Attach managed policies to the codebuild role
+locals {
+  codebuildManagedPolicies = {
+    "codeBuildAdmin" = "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess"
+    "rdsAdmin"       = "arn:aws:iam::aws:policy/AmazonRDSFullAccess"
+    "ec2Admin"       = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
+    "cloudWatchLogs" = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
+    "ecrReadonly"    = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "codebuild_managed_policies" {
+  for_each = local.codebuildManagedPolicies
+
+  role       = aws_iam_role.codebuild_role.name
+  policy_arn = each.value
+}
+
+# Create an RDS cluster with serverless v2
+resource "aws_rds_cluster" "rds_cluster" {
+  cluster_identifier     = "nitric-rds-cluster"
+  engine                 = "aurora-postgresql"
+  engine_mode            = "provisioned"
+  engine_version         = "13.14"
+  database_name          = "nitric"
+  master_username        = "nitric"
+  master_password        = random_password.rds_password.result
+  db_subnet_group_name   = aws_db_subnet_group.rds_subnet_group.id
+  vpc_security_group_ids = [aws_security_group.rds_security_group.id]
+  skip_final_snapshot    = true
+  deletion_protection    = false
+  serverlessv2_scaling_configuration {
+    max_capacity = var.max_capacity
+    min_capacity = var.min_capacity
+  }
+}
+
+# Create a rds cluster instance
+resource "aws_rds_cluster_instance" "rds_cluster_instance" {
+  cluster_identifier   = aws_rds_cluster.rds_cluster.id
+  instance_class       = "db.serverless"
+  engine               = aws_rds_cluster.rds_cluster.engine
+  engine_version       = aws_rds_cluster.rds_cluster.engine_version
+  db_subnet_group_name = aws_rds_cluster.rds_cluster.db_subnet_group_name
+}
+
+
+
+# Create an AWS Codebuild job to create a database on the RDS cluster
+resource "aws_codebuild_project" "create_database" {
+  name          = "nitric-create-database"
+  description   = "Create the database on the RDS cluster"
+  build_timeout = 60
+  service_role  = aws_iam_role.codebuild_role.arn
+
+  artifacts {
+    type = "NO_ARTIFACTS"
+  }
+
+
+  environment {
+    compute_type = "BUILD_GENERAL1_SMALL"
+    image        = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
+    type         = "LINUX_CONTAINER"
+
+    environment_variable {
+      name = "DB_PASSWORD"
+      value = random_password.rds_password.result
+      type = "PLAINTEXT"
+    }
+  }
+
+
+  vpc_config {
+    subnets            = var.private_subnet_ids
+    security_group_ids = aws_rds_cluster.rds_cluster.vpc_security_group_ids
+    vpc_id             = var.vpc_id
+  }
+
+  source {
+    type = "NO_SOURCE"
+    buildspec = jsonencode({
+      version = "0.2",
+      phases = {
+        build = {
+          commands = [
+            "echo 'Creating database $DB_NAME'",
+            # FIXME: Store the password in a secret manager
+            "export PGPASSWORD=$${DB_PASSWORD}",
+            # "CREATE DATABASE ${DB_NAME}" || echo "database ${DB_NAME} already exists"
+            "psql -h ${aws_rds_cluster.rds_cluster.endpoint} -U ${aws_rds_cluster.rds_cluster.master_username} -d ${aws_rds_cluster.rds_cluster.database_name} -c \"CREATE DATABASE $${DB_NAME}\" || echo \"database $${DB_NAME} already exists\""
+          ]
+        }
+      }
+    })
+  }
+}
diff --git a/cloud/aws/deploytf/.nitric/modules/rds/outputs.tf b/cloud/aws/deploytf/.nitric/modules/rds/outputs.tf
new file mode 100644
index 000000000..fdd5d22e5
--- /dev/null
+++ b/cloud/aws/deploytf/.nitric/modules/rds/outputs.tf
@@ -0,0 +1,29 @@
+output "cluster_endpoint" {
+    description = "The endpoint of the RDS cluster"
+    value       = aws_rds_cluster.rds_cluster.endpoint
+}
+
+output "cluster_username" {
+    description = "The username to connect to the RDS cluster"
+    value       = aws_rds_cluster.rds_cluster.master_username
+}
+
+output "cluster_password" {
+    description = "The password to connect to the RDS cluster"
+    value       = aws_rds_cluster.rds_cluster.master_password
+}
+
+output "codebuild_role_arn" {
+    description = "The arn of the codebuild role"
+    value       = aws_iam_role.codebuild_role.arn
+}
+
+output "security_group_id" {
+    description = "The security group id for the RDS cluster"
+    value       = aws_security_group.rds_security_group.id
+}
+
+output "create_database_project_name" {
+    description = "The name of the create database codebuild project"
+    value       = aws_codebuild_project.create_database.name
+}
\ No newline at end of file
diff --git a/cloud/aws/deploytf/.nitric/modules/rds/variables.tf b/cloud/aws/deploytf/.nitric/modules/rds/variables.tf
new file mode 100644
index 000000000..fb34f8730
--- /dev/null
+++ b/cloud/aws/deploytf/.nitric/modules/rds/variables.tf
@@ -0,0 +1,24 @@
+variable "vpc_id" {
+  type        = string
+  description = "the VPC to assign to the RDS cluster"
+}
+
+variable "private_subnet_ids" {
+  type        = list(string)
+  description = "private subnets to assign to the RDS cluster"
+}
+
+variable "min_capacity" {
+  type        = number
+  description = "the minimum capacity of the RDS cluster"
+}
+
+variable "max_capacity" {
+  type        = number
+  description = "the maximum capacity of the RDS cluster"
+}
+
+variable "stack_id" {
+  type        = string
+  description = "The nitric stack ID"
+}
diff --git a/cloud/aws/deploytf/.nitric/modules/service/main.tf b/cloud/aws/deploytf/.nitric/modules/service/main.tf
index d4a342db5..9c75c13d6 100644
--- a/cloud/aws/deploytf/.nitric/modules/service/main.tf
+++ b/cloud/aws/deploytf/.nitric/modules/service/main.tf
@@ -15,14 +15,6 @@ resource "aws_ecr_repository" "repo" {
 data "aws_ecr_authorization_token" "ecr_auth" {
 }
 
-provider "docker" {
-  registry_auth {
-    address  = data.aws_ecr_authorization_token.ecr_auth.proxy_endpoint
-    username = data.aws_ecr_authorization_token.ecr_auth.user_name
-    password = data.aws_ecr_authorization_token.ecr_auth.password
-  }
-}
-
 # Tag the provided docker image with the ECR repository url
 resource "docker_tag" "tag" {
   source_image = var.image
@@ -85,6 +77,13 @@ resource "aws_iam_role_policy_attachment" "basic-execution" {
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
+# Attach vpc access execution role if subnets are provided
+resource "aws_iam_role_policy_attachment" "vpc-access" {
+  count = length(var.subnet_ids) > 0 ? 1 : 0
+  role       = aws_iam_role.role.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
 # Create a lambda function using the pushed image
 resource "aws_lambda_function" "function" {
   function_name = "${var.service_name}-${var.stack_id}"
@@ -97,6 +96,14 @@ resource "aws_lambda_function" "function" {
     variables = var.environment
   }
 
+  dynamic "vpc_config" {
+    for_each = length(var.subnet_ids) > 0 ? ["1"] : []
+    content {
+      subnet_ids         = var.subnet_ids
+      security_group_ids = var.security_group_ids
+    }
+  }
+
   depends_on = [docker_registry_image.push]
 
   tags = {
diff --git a/cloud/aws/deploytf/.nitric/modules/service/variables.tf b/cloud/aws/deploytf/.nitric/modules/service/variables.tf
index dca84cbbd..710d206b1 100644
--- a/cloud/aws/deploytf/.nitric/modules/service/variables.tf
+++ b/cloud/aws/deploytf/.nitric/modules/service/variables.tf
@@ -1,17 +1,17 @@
 variable "service_name" {
-    type = string
-    description = "The name of the service"
+  type        = string
+  description = "The name of the service"
 }
 
 variable "image" {
-    type = string
-    description = "The docker image to deploy"
+  type        = string
+  description = "The docker image to deploy"
 }
 
 # environment variables
 variable "environment" {
-    type = map(string)
-    description = "Environment variables to set on the lambda function"
+  type        = map(string)
+  description = "Environment variables to set on the lambda function"
 }
 
 variable "stack_id" {
@@ -20,13 +20,28 @@ variable "stack_id" {
 }
 
 variable "memory" {
-    description = "The amount of memory to allocate to the lambda function"
-    type        = number
-    default     = 128
+  description = "The amount of memory to allocate to the lambda function"
+  type        = number
+  default     = 128
 }
 
 variable "timeout" {
-    description = "The timeout for the lambda function"
-    type        = number
-    default     = 10
+  description = "The timeout for the lambda function"
+  type        = number
+  default     = 10
 }
+
+variable "subnet_ids" {
+  description = "The subnet ids to use for the aws lambda function"
+  type        = list(string)
+  default     = []
+}
+
+variable "security_group_ids" {
+  description = "The security group ids to use for the aws lambda function"
+  type        = list(string)
+  default     = []
+
+}
+
+
diff --git a/cloud/aws/deploytf/.nitric/modules/sql/main.tf b/cloud/aws/deploytf/.nitric/modules/sql/main.tf
new file mode 100644
index 000000000..da1db9461
--- /dev/null
+++ b/cloud/aws/deploytf/.nitric/modules/sql/main.tf
@@ -0,0 +1,128 @@
+terraform {
+  required_providers {
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "3.0.2"
+    }
+  }
+}
+
+# Create an ECR repository
+# If there is a migration image uri tag it and push it to ECR
+resource "aws_ecr_repository" "migrate_database" {
+  name = "nitric-migrate-database-${var.db_name}"
+}
+
+# Tag the provided docker image with the ECR repository url
+resource "docker_tag" "tag" {
+  source_image = var.image_uri
+  target_image = aws_ecr_repository.migrate_database.repository_url
+}
+
+# Push the tagged image to the ECR repository
+resource "docker_registry_image" "push" {
+  name = aws_ecr_repository.migrate_database.repository_url
+  triggers = {
+    source_image_id   = docker_tag.tag.source_image_id
+  }
+}
+
+locals {
+  db_url = "postgres://${var.rds_cluster_username}:${var.rds_cluster_password}@${var.rds_cluster_endpoint}/${var.db_name}"
+}
+
+# Create an AWS codebuild project for running migrations
+resource "aws_codebuild_project" "migrate_database" {
+  name         = "nitric-migrate-database-${var.db_name}"
+  description  = "Migrate the database on the RDS cluster"
+  service_role = var.codebuild_role_arn
+
+  artifacts {
+    type = "NO_ARTIFACTS"
+  }
+
+  environment {
+    compute_type                = "BUILD_GENERAL1_SMALL"
+    image                       = "${aws_ecr_repository.migrate_database.repository_url}@${docker_registry_image.push.sha256_digest}"
+    image_pull_credentials_type = "SERVICE_ROLE"
+    type                        = "LINUX_CONTAINER"
+    environment_variable {
+      name  = "DB_NAME"
+      value = var.db_name
+    }
+    environment_variable {
+      name  = "DB_URL"
+      value = local.db_url
+    }
+  }
+
+  vpc_config {
+    subnets            = var.subnet_ids
+    security_group_ids = var.security_group_ids
+    vpc_id             = var.vpc_id
+  }
+
+  source {
+    type = "NO_SOURCE"
+    buildspec = jsonencode({
+      version = "0.2",
+      phases = {
+        build = {
+          commands = [
+            "echo 'Migrating database $DB_NAME'",
+            "cd ${var.work_dir}",
+            var.migrate_command
+          ]
+        }
+      }
+    })
+  }
+}
+
+# Execute the create database codebuild job and wait for it to complete
+resource "null_resource" "execute_create_database" {
+  provisioner "local-exec" {
+    interpreter = ["bash", "-c"]
+    command     = <<EOF
+      BUILD_ID=$(aws codebuild start-build --project-name ${var.create_database_project_name} --region ${var.codebuild_region}  --environment-variables "name=DB_NAME,value=${var.db_name}" --query 'build.id' --output text)
+      STATUS="IN_PROGRESS"
+      while [[ $STATUS == "IN_PROGRESS" ]]; do
+        sleep 5
+        STATUS=$(aws codebuild batch-get-builds --region ${var.codebuild_region} --ids $BUILD_ID --query 'builds[0].buildStatus' --output text)
+      done
+      if [[ $STATUS != "SUCCEEDED" ]]; then
+        echo "Build failed with status $STATUS"
+        exit 1
+      fi
+    EOF
+  }
+  triggers = {
+    image_id = docker_registry_image.push.id
+  }
+}
+
+# Execute the codebuild job using the aws-cli and wait for it to complete
+resource "null_resource" "execute_migrate_database" {
+  provisioner "local-exec" {
+    interpreter = ["bash", "-c"]
+    command     = <<EOF
+      # Start the database migrations
+      BUILD_ID=$(aws codebuild start-build --project-name ${aws_codebuild_project.migrate_database.name} --region ${var.codebuild_region} --query 'build.id' --output text)
+      STATUS="IN_PROGRESS"
+      while [[ $STATUS == "IN_PROGRESS" ]]; do
+        sleep 5
+        # Check database migration status
+        STATUS=$(aws codebuild batch-get-builds --region ${var.codebuild_region} --ids $BUILD_ID --query 'builds[0].buildStatus' --output text)
+      done
+      if [[ $STATUS != "SUCCEEDED" ]]; then
+        echo "Database migrations failed $STATUS"
+        exit 1
+      fi
+    EOF
+  }
+  triggers = {
+    image_id = docker_registry_image.push.id
+  }
+  # Create the database first   
+  depends_on = [docker_registry_image.push, aws_codebuild_project.migrate_database, null_resource.execute_create_database]
+}
diff --git a/cloud/aws/deploytf/.nitric/modules/sql/outputs.tf b/cloud/aws/deploytf/.nitric/modules/sql/outputs.tf
new file mode 100644
index 000000000..e69de29bb
diff --git a/cloud/aws/deploytf/.nitric/modules/sql/variables.tf b/cloud/aws/deploytf/.nitric/modules/sql/variables.tf
new file mode 100644
index 000000000..0a1ef64dc
--- /dev/null
+++ b/cloud/aws/deploytf/.nitric/modules/sql/variables.tf
@@ -0,0 +1,64 @@
+variable "db_name" {
+  description = "The name of the database to create"
+  type        = string
+}
+
+variable "image_uri" {
+  description = "The URI of the docker image to use for the codebuild project"
+  type        = string
+}
+
+variable "rds_cluster_endpoint" {
+  description = "The endpoint of the RDS cluster to connect to"
+  type        = string
+}
+
+variable "rds_cluster_username" {
+  description = "The username to connect to the RDS cluster"
+  type        = string
+}
+
+variable "rds_cluster_password" {
+  description = "The password to connect to the RDS cluster"
+  type        = string
+}
+
+variable "security_group_ids" {
+  description = "The security group ids to use for the codebuild project"
+  type        = list(string)
+}
+
+variable "subnet_ids" {
+  description = "The subnet ids to use for the codebuild project"
+  type        = list(string)
+}
+
+variable "vpc_id" {
+  description = "The vpc id to use for the codebuild project"
+  type        = string
+}
+
+variable "work_dir" {
+  description = "The working directory for the codebuild project"
+  type        = string
+}
+
+variable "codebuild_role_arn" {
+  description = "The arn of the codebuild role"
+  type        = string
+}
+
+variable "codebuild_region" {
+  description = "The region of the codebuild project"
+  type        = string
+}
+
+variable "migrate_command" {
+  description = "The command to run to migrate the database"
+  type        = string
+}
+
+variable "create_database_project_name" {
+  description = "The name of the create database codebuild project"
+  type        = string
+}
diff --git a/cloud/aws/deploytf/.nitric/modules/stack/main.tf b/cloud/aws/deploytf/.nitric/modules/stack/main.tf
index db4479e1e..ebe959282 100644
--- a/cloud/aws/deploytf/.nitric/modules/stack/main.tf
+++ b/cloud/aws/deploytf/.nitric/modules/stack/main.tf
@@ -16,4 +16,4 @@ resource "aws_resourcegroups_group" "group" {
 }
 JSON
   }
-}
\ No newline at end of file
+}
diff --git a/cloud/aws/deploytf/.nitric/modules/vpc/main.tf b/cloud/aws/deploytf/.nitric/modules/vpc/main.tf
new file mode 100644
index 000000000..f09c361d9
--- /dev/null
+++ b/cloud/aws/deploytf/.nitric/modules/vpc/main.tf
@@ -0,0 +1,103 @@
+
+# Get region availability zones
+data "aws_availability_zones" "availability_zones" {}
+
+variable "cidr_block" {
+  type        = string
+  description = "The CIDR block for the VPC"
+  default     = "10.0.0.0/16"
+}
+
+variable "public_subnet_cidrs" {
+  type        = list(string)
+  description = "Public Subnet CIDR values"
+  default     = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
+}
+
+variable "private_subnet_cidrs" {
+  type        = list(string)
+  description = "Private Subnet CIDR values"
+  default     = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+}
+
+# Create a VPC
+resource "aws_vpc" "vpc" {
+  cidr_block           = var.cidr_block
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+}
+
+# Create public subnets
+resource "aws_subnet" "public_subnets" {
+  count             = length(var.public_subnet_cidrs)
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = element(var.public_subnet_cidrs, count.index)
+  availability_zone = element(data.aws_availability_zones.availability_zones.names, count.index)
+}
+
+# Create private subnets
+resource "aws_subnet" "private_subnets" {
+  count             = length(var.private_subnet_cidrs)
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = element(var.private_subnet_cidrs, count.index)
+  availability_zone = element(data.aws_availability_zones.availability_zones.names, count.index)
+}
+
+
+# Create an internet gateway and attach it to the VPC
+resource "aws_internet_gateway" "igw" {
+  vpc_id = aws_vpc.vpc.id
+}
+
+# Allocate an Elastic IP address for the NAT gateway
+resource "aws_eip" "nat_eip" {
+  # vpc = true
+}
+
+# Create a NAT gateway in the public subnet
+# TODO: Create a configurable NAT Gateway strategy for AZ redundancy
+resource "aws_nat_gateway" "nat_gateway" {
+  # The allocation ID of the Elastic IP address to associate with the NAT gateway.
+  # This is required when creating a NAT gateway.
+  allocation_id = aws_eip.nat_eip.id
+
+  # The ID of the subnet in which to create the NAT gateway.
+  # This should be the ID of the public subnet where the NAT gateway will be deployed.
+  subnet_id = aws_subnet.public_subnets[0].id
+}
+
+
+
+# Create a route table for the public subnet that routes traffic to the internet gateway
+resource "aws_route_table" "public_route_table" {
+  vpc_id = aws_vpc.vpc.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.igw.id
+  }
+}
+
+# Associate the public subnet with the public route table
+resource "aws_route_table_association" "public_route_table_association" {
+  count = length(var.public_subnet_cidrs)
+  subnet_id = element(aws_subnet.public_subnets[*].id, count.index)
+  route_table_id = aws_route_table.public_route_table.id
+}
+
+# Create a route table for the private subnet that routes traffic to the NAT gateway
+resource "aws_route_table" "private_route_table" {
+  vpc_id = aws_vpc.vpc.id
+
+  route {
+    cidr_block     = "0.0.0.0/0"
+    nat_gateway_id = aws_nat_gateway.nat_gateway.id
+  }
+}
+
+# Associate the private subnet with the private route table
+resource "aws_route_table_association" "private_route_table_association" {
+  count = length(var.private_subnet_cidrs)
+  subnet_id = element(aws_subnet.private_subnets[*].id, count.index)
+  route_table_id = aws_route_table.private_route_table.id
+}
diff --git a/cloud/aws/deploytf/.nitric/modules/vpc/outputs.tf b/cloud/aws/deploytf/.nitric/modules/vpc/outputs.tf
new file mode 100644
index 000000000..592a7d6eb
--- /dev/null
+++ b/cloud/aws/deploytf/.nitric/modules/vpc/outputs.tf
@@ -0,0 +1,11 @@
+output "vpc_id" {
+  value = aws_vpc.vpc.id
+}
+
+output "private_subnet_ids" {
+  value = aws_subnet.private_subnets[*].id
+}
+
+output "public_subnet_ids" {
+  value = aws_subnet.public_subnets[*].id
+}
diff --git a/cloud/aws/deploytf/.nitric/modules/vpc/variables.tf b/cloud/aws/deploytf/.nitric/modules/vpc/variables.tf
new file mode 100644
index 000000000..e69de29bb
diff --git a/cloud/aws/deploytf/cdktf.json b/cloud/aws/deploytf/cdktf.json
index 5944d164a..506715413 100644
--- a/cloud/aws/deploytf/cdktf.json
+++ b/cloud/aws/deploytf/cdktf.json
@@ -53,7 +53,19 @@
     {
       "name": "http_proxy",
       "source": "./.nitric/modules/http_proxy"
+    },
+    {
+      "name": "vpc",
+      "source": "./.nitric/modules/vpc"
+    },
+    {
+      "name": "rds",
+      "source": "./.nitric/modules/rds"
+    },
+    {
+      "name": "sql",
+      "source": "./.nitric/modules/sql"
     }
   ],
   "context": {}
-}
\ No newline at end of file
+}
diff --git a/cloud/aws/deploytf/deploy.go b/cloud/aws/deploytf/deploy.go
index 41de7e847..ffee27f05 100644
--- a/cloud/aws/deploytf/deploy.go
+++ b/cloud/aws/deploytf/deploy.go
@@ -19,22 +19,28 @@ import (
 	"io/fs"
 
 	"github.com/aws/jsii-runtime-go"
+	ecrauth "github.com/cdktf/cdktf-provider-aws-go/aws/v19/dataawsecrauthorizationtoken"
 	awsprovider "github.com/cdktf/cdktf-provider-aws-go/aws/v19/provider"
+	dockerprovider "github.com/cdktf/cdktf-provider-docker-go/docker/v11/provider"
 	"github.com/hashicorp/terraform-cdk-go/cdktf"
 	"github.com/nitrictech/nitric/cloud/aws/common"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/api"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/bucket"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/keyvalue"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/queue"
+	rds "github.com/nitrictech/nitric/cloud/aws/deploytf/generated/rds"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/schedule"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/secret"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/service"
 	tfstack "github.com/nitrictech/nitric/cloud/aws/deploytf/generated/stack"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/topic"
+	vpc "github.com/nitrictech/nitric/cloud/aws/deploytf/generated/vpc"
 	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/websocket"
 	"github.com/nitrictech/nitric/cloud/common/deploy"
 	"github.com/nitrictech/nitric/cloud/common/deploy/provider"
 	deploymentspb "github.com/nitrictech/nitric/core/pkg/proto/deployments/v1"
+	resourcespb "github.com/nitrictech/nitric/core/pkg/proto/resources/v1"
+	"github.com/samber/lo"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -43,6 +49,9 @@ type NitricAwsTerraformProvider struct {
 	*deploy.CommonStackDetails
 	Stack tfstack.Stack
 
+	Vpc vpc.Vpc
+	Rds rds.Rds
+
 	AwsConfig      *common.AwsConfig
 	Apis           map[string]api.Api
 	Buckets        map[string]bucket.Bucket
@@ -95,8 +104,34 @@ func (a *NitricAwsTerraformProvider) Pre(stack cdktf.TerraformStack, resources [
 		Region: tfRegion.StringValue(),
 	})
 
+	ecrAuthConfig := ecrauth.NewDataAwsEcrAuthorizationToken(stack, jsii.String("ecr_auth"), &ecrauth.DataAwsEcrAuthorizationTokenConfig{})
+	dockerprovider.NewDockerProvider(stack, jsii.String("docker"), &dockerprovider.DockerProviderConfig{
+		RegistryAuth: &[]*map[string]interface{}{
+			{
+				"address":  ecrAuthConfig.ProxyEndpoint(),
+				"username": ecrAuthConfig.UserName(),
+				"password": ecrAuthConfig.Password(),
+			},
+		},
+	})
+
 	a.Stack = tfstack.NewStack(stack, jsii.String("stack"), &tfstack.StackConfig{})
 
+	databases := lo.Filter(resources, func(item *deploymentspb.Resource, idx int) bool {
+		return item.Id.Type == resourcespb.ResourceType_SqlDatabase
+	})
+	// Create a shared database cluster if we have more than one database
+	if len(databases) > 0 {
+		a.Vpc = vpc.NewVpc(stack, jsii.String("vpc"), &vpc.VpcConfig{})
+		a.Rds = rds.NewRds(stack, jsii.String("rds"), &rds.RdsConfig{
+			MinCapacity:      jsii.Number(0.5),
+			MaxCapacity:      jsii.Number(1),
+			VpcId:            a.Vpc.VpcIdOutput(),
+			StackId:          a.Stack.StackIdOutput(),
+			PrivateSubnetIds: cdktf.Token_AsList(a.Vpc.PrivateSubnetIdsOutput(), &cdktf.EncodingOptions{}),
+		})
+	}
+
 	return nil
 }
 
diff --git a/cloud/aws/deploytf/generated/api/jsii/api-0.0.0.tgz b/cloud/aws/deploytf/generated/api/jsii/api-0.0.0.tgz
index ed0365950..b49a59c4e 100644
Binary files a/cloud/aws/deploytf/generated/api/jsii/api-0.0.0.tgz and b/cloud/aws/deploytf/generated/api/jsii/api-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/bucket/jsii/bucket-0.0.0.tgz b/cloud/aws/deploytf/generated/bucket/jsii/bucket-0.0.0.tgz
index 8d690b5ab..b27e8eb76 100644
Binary files a/cloud/aws/deploytf/generated/bucket/jsii/bucket-0.0.0.tgz and b/cloud/aws/deploytf/generated/bucket/jsii/bucket-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/constraints.json b/cloud/aws/deploytf/generated/constraints.json
index bcc8daf0a..70a4b7a02 100644
--- a/cloud/aws/deploytf/generated/constraints.json
+++ b/cloud/aws/deploytf/generated/constraints.json
@@ -1,4 +1,4 @@
 {
-  "cdktf": "0.20.4",
+  "cdktf": "0.20.7",
   "providers": {}
 }
diff --git a/cloud/aws/deploytf/generated/http_proxy/jsii/http_proxy-0.0.0.tgz b/cloud/aws/deploytf/generated/http_proxy/jsii/http_proxy-0.0.0.tgz
index 7cf20e6b9..c2ff8d931 100644
Binary files a/cloud/aws/deploytf/generated/http_proxy/jsii/http_proxy-0.0.0.tgz and b/cloud/aws/deploytf/generated/http_proxy/jsii/http_proxy-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/keyvalue/jsii/keyvalue-0.0.0.tgz b/cloud/aws/deploytf/generated/keyvalue/jsii/keyvalue-0.0.0.tgz
index 13dc41c4b..0d0e2d9ef 100644
Binary files a/cloud/aws/deploytf/generated/keyvalue/jsii/keyvalue-0.0.0.tgz and b/cloud/aws/deploytf/generated/keyvalue/jsii/keyvalue-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/policy/jsii/policy-0.0.0.tgz b/cloud/aws/deploytf/generated/policy/jsii/policy-0.0.0.tgz
index f19a97e50..a8064e81b 100644
Binary files a/cloud/aws/deploytf/generated/policy/jsii/policy-0.0.0.tgz and b/cloud/aws/deploytf/generated/policy/jsii/policy-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/queue/jsii/queue-0.0.0.tgz b/cloud/aws/deploytf/generated/queue/jsii/queue-0.0.0.tgz
index c828d280c..9b967e1be 100644
Binary files a/cloud/aws/deploytf/generated/queue/jsii/queue-0.0.0.tgz and b/cloud/aws/deploytf/generated/queue/jsii/queue-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/rds/Rds.go b/cloud/aws/deploytf/generated/rds/Rds.go
new file mode 100644
index 000000000..93a44d2eb
--- /dev/null
+++ b/cloud/aws/deploytf/generated/rds/Rds.go
@@ -0,0 +1,623 @@
+package rds
+
+import (
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+	_init_ "github.com/nitrictech/nitric/cloud/aws/deploytf/generated/rds/jsii"
+
+	"github.com/aws/constructs-go/constructs/v10"
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/rds/internal"
+)
+
+// Defines an Rds based on a Terraform module.
+//
+// Source at ./.nitric/modules/rds
+type Rds interface {
+	cdktf.TerraformModule
+	// Experimental.
+	CdktfStack() cdktf.TerraformStack
+	ClusterEndpointOutput() *string
+	ClusterPasswordOutput() *string
+	ClusterUsernameOutput() *string
+	CodebuildRoleArnOutput() *string
+	// Experimental.
+	ConstructNodeMetadata() *map[string]interface{}
+	CreateDatabaseProjectNameOutput() *string
+	// Experimental.
+	DependsOn() *[]*string
+	// Experimental.
+	SetDependsOn(val *[]*string)
+	// Experimental.
+	ForEach() cdktf.ITerraformIterator
+	// Experimental.
+	SetForEach(val cdktf.ITerraformIterator)
+	// Experimental.
+	Fqn() *string
+	// Experimental.
+	FriendlyUniqueId() *string
+	MaxCapacity() *float64
+	SetMaxCapacity(val *float64)
+	MinCapacity() *float64
+	SetMinCapacity(val *float64)
+	// The tree node.
+	Node() constructs.Node
+	PrivateSubnetIds() *[]*string
+	SetPrivateSubnetIds(val *[]*string)
+	// Experimental.
+	Providers() *[]interface{}
+	// Experimental.
+	RawOverrides() interface{}
+	SecurityGroupIdOutput() *string
+	// Experimental.
+	SkipAssetCreationFromLocalModules() *bool
+	// Experimental.
+	Source() *string
+	StackId() *string
+	SetStackId(val *string)
+	// Experimental.
+	Version() *string
+	VpcId() *string
+	SetVpcId(val *string)
+	// Experimental.
+	AddOverride(path *string, value interface{})
+	// Experimental.
+	AddProvider(provider interface{})
+	// Experimental.
+	GetString(output *string) *string
+	// Experimental.
+	InterpolationForOutput(moduleOutput *string) cdktf.IResolvable
+	// Overrides the auto-generated logical ID with a specific ID.
+	// Experimental.
+	OverrideLogicalId(newLogicalId *string)
+	// Resets a previously passed logical Id to use the auto-generated logical id again.
+	// Experimental.
+	ResetOverrideLogicalId()
+	SynthesizeAttributes() *map[string]interface{}
+	SynthesizeHclAttributes() *map[string]interface{}
+	// Experimental.
+	ToHclTerraform() interface{}
+	// Experimental.
+	ToMetadata() interface{}
+	// Returns a string representation of this construct.
+	ToString() *string
+	// Experimental.
+	ToTerraform() interface{}
+}
+
+// The jsii proxy struct for Rds
+type jsiiProxy_Rds struct {
+	internal.Type__cdktfTerraformModule
+}
+
+func (j *jsiiProxy_Rds) CdktfStack() cdktf.TerraformStack {
+	var returns cdktf.TerraformStack
+	_jsii_.Get(
+		j,
+		"cdktfStack",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) ClusterEndpointOutput() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"clusterEndpointOutput",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) ClusterPasswordOutput() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"clusterPasswordOutput",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) ClusterUsernameOutput() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"clusterUsernameOutput",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) CodebuildRoleArnOutput() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"codebuildRoleArnOutput",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) ConstructNodeMetadata() *map[string]interface{} {
+	var returns *map[string]interface{}
+	_jsii_.Get(
+		j,
+		"constructNodeMetadata",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) CreateDatabaseProjectNameOutput() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"createDatabaseProjectNameOutput",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) DependsOn() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"dependsOn",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) ForEach() cdktf.ITerraformIterator {
+	var returns cdktf.ITerraformIterator
+	_jsii_.Get(
+		j,
+		"forEach",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) Fqn() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"fqn",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) FriendlyUniqueId() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"friendlyUniqueId",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) MaxCapacity() *float64 {
+	var returns *float64
+	_jsii_.Get(
+		j,
+		"maxCapacity",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) MinCapacity() *float64 {
+	var returns *float64
+	_jsii_.Get(
+		j,
+		"minCapacity",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) Node() constructs.Node {
+	var returns constructs.Node
+	_jsii_.Get(
+		j,
+		"node",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) PrivateSubnetIds() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"privateSubnetIds",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) Providers() *[]interface{} {
+	var returns *[]interface{}
+	_jsii_.Get(
+		j,
+		"providers",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) RawOverrides() interface{} {
+	var returns interface{}
+	_jsii_.Get(
+		j,
+		"rawOverrides",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) SecurityGroupIdOutput() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"securityGroupIdOutput",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) SkipAssetCreationFromLocalModules() *bool {
+	var returns *bool
+	_jsii_.Get(
+		j,
+		"skipAssetCreationFromLocalModules",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) Source() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"source",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) StackId() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"stackId",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) Version() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"version",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Rds) VpcId() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"vpcId",
+		&returns,
+	)
+	return returns
+}
+
+func NewRds(scope constructs.Construct, id *string, config *RdsConfig) Rds {
+	_init_.Initialize()
+
+	if err := validateNewRdsParameters(scope, id, config); err != nil {
+		panic(err)
+	}
+	j := jsiiProxy_Rds{}
+
+	_jsii_.Create(
+		"rds.Rds",
+		[]interface{}{scope, id, config},
+		&j,
+	)
+
+	return &j
+}
+
+func NewRds_Override(r Rds, scope constructs.Construct, id *string, config *RdsConfig) {
+	_init_.Initialize()
+
+	_jsii_.Create(
+		"rds.Rds",
+		[]interface{}{scope, id, config},
+		r,
+	)
+}
+
+func (j *jsiiProxy_Rds) SetDependsOn(val *[]*string) {
+	_jsii_.Set(
+		j,
+		"dependsOn",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Rds) SetForEach(val cdktf.ITerraformIterator) {
+	_jsii_.Set(
+		j,
+		"forEach",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Rds) SetMaxCapacity(val *float64) {
+	if err := j.validateSetMaxCapacityParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"maxCapacity",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Rds) SetMinCapacity(val *float64) {
+	if err := j.validateSetMinCapacityParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"minCapacity",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Rds) SetPrivateSubnetIds(val *[]*string) {
+	if err := j.validateSetPrivateSubnetIdsParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"privateSubnetIds",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Rds) SetStackId(val *string) {
+	if err := j.validateSetStackIdParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"stackId",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Rds) SetVpcId(val *string) {
+	if err := j.validateSetVpcIdParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"vpcId",
+		val,
+	)
+}
+
+// Checks if `x` is a construct.
+//
+// Use this method instead of `instanceof` to properly detect `Construct`
+// instances, even when the construct library is symlinked.
+//
+// Explanation: in JavaScript, multiple copies of the `constructs` library on
+// disk are seen as independent, completely different libraries. As a
+// consequence, the class `Construct` in each copy of the `constructs` library
+// is seen as a different class, and an instance of one class will not test as
+// `instanceof` the other class. `npm install` will not create installations
+// like this, but users may manually symlink construct libraries together or
+// use a monorepo tool: in those cases, multiple copies of the `constructs`
+// library can be accidentally installed, and `instanceof` will behave
+// unpredictably. It is safest to avoid using `instanceof`, and using
+// this type-testing method instead.
+//
+// Returns: true if `x` is an object created from a class which extends `Construct`.
+func Rds_IsConstruct(x interface{}) *bool {
+	_init_.Initialize()
+
+	if err := validateRds_IsConstructParameters(x); err != nil {
+		panic(err)
+	}
+	var returns *bool
+
+	_jsii_.StaticInvoke(
+		"rds.Rds",
+		"isConstruct",
+		[]interface{}{x},
+		&returns,
+	)
+
+	return returns
+}
+
+// Experimental.
+func Rds_IsTerraformElement(x interface{}) *bool {
+	_init_.Initialize()
+
+	if err := validateRds_IsTerraformElementParameters(x); err != nil {
+		panic(err)
+	}
+	var returns *bool
+
+	_jsii_.StaticInvoke(
+		"rds.Rds",
+		"isTerraformElement",
+		[]interface{}{x},
+		&returns,
+	)
+
+	return returns
+}
+
+func (r *jsiiProxy_Rds) AddOverride(path *string, value interface{}) {
+	if err := r.validateAddOverrideParameters(path, value); err != nil {
+		panic(err)
+	}
+	_jsii_.InvokeVoid(
+		r,
+		"addOverride",
+		[]interface{}{path, value},
+	)
+}
+
+func (r *jsiiProxy_Rds) AddProvider(provider interface{}) {
+	if err := r.validateAddProviderParameters(provider); err != nil {
+		panic(err)
+	}
+	_jsii_.InvokeVoid(
+		r,
+		"addProvider",
+		[]interface{}{provider},
+	)
+}
+
+func (r *jsiiProxy_Rds) GetString(output *string) *string {
+	if err := r.validateGetStringParameters(output); err != nil {
+		panic(err)
+	}
+	var returns *string
+
+	_jsii_.Invoke(
+		r,
+		"getString",
+		[]interface{}{output},
+		&returns,
+	)
+
+	return returns
+}
+
+func (r *jsiiProxy_Rds) InterpolationForOutput(moduleOutput *string) cdktf.IResolvable {
+	if err := r.validateInterpolationForOutputParameters(moduleOutput); err != nil {
+		panic(err)
+	}
+	var returns cdktf.IResolvable
+
+	_jsii_.Invoke(
+		r,
+		"interpolationForOutput",
+		[]interface{}{moduleOutput},
+		&returns,
+	)
+
+	return returns
+}
+
+func (r *jsiiProxy_Rds) OverrideLogicalId(newLogicalId *string) {
+	if err := r.validateOverrideLogicalIdParameters(newLogicalId); err != nil {
+		panic(err)
+	}
+	_jsii_.InvokeVoid(
+		r,
+		"overrideLogicalId",
+		[]interface{}{newLogicalId},
+	)
+}
+
+func (r *jsiiProxy_Rds) ResetOverrideLogicalId() {
+	_jsii_.InvokeVoid(
+		r,
+		"resetOverrideLogicalId",
+		nil, // no parameters
+	)
+}
+
+func (r *jsiiProxy_Rds) SynthesizeAttributes() *map[string]interface{} {
+	var returns *map[string]interface{}
+
+	_jsii_.Invoke(
+		r,
+		"synthesizeAttributes",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (r *jsiiProxy_Rds) SynthesizeHclAttributes() *map[string]interface{} {
+	var returns *map[string]interface{}
+
+	_jsii_.Invoke(
+		r,
+		"synthesizeHclAttributes",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (r *jsiiProxy_Rds) ToHclTerraform() interface{} {
+	var returns interface{}
+
+	_jsii_.Invoke(
+		r,
+		"toHclTerraform",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (r *jsiiProxy_Rds) ToMetadata() interface{} {
+	var returns interface{}
+
+	_jsii_.Invoke(
+		r,
+		"toMetadata",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (r *jsiiProxy_Rds) ToString() *string {
+	var returns *string
+
+	_jsii_.Invoke(
+		r,
+		"toString",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (r *jsiiProxy_Rds) ToTerraform() interface{} {
+	var returns interface{}
+
+	_jsii_.Invoke(
+		r,
+		"toTerraform",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
diff --git a/cloud/aws/deploytf/generated/rds/RdsConfig.go b/cloud/aws/deploytf/generated/rds/RdsConfig.go
new file mode 100644
index 000000000..502da573f
--- /dev/null
+++ b/cloud/aws/deploytf/generated/rds/RdsConfig.go
@@ -0,0 +1,26 @@
+package rds
+
+import (
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+)
+
+type RdsConfig struct {
+	// Experimental.
+	DependsOn *[]cdktf.ITerraformDependable `field:"optional" json:"dependsOn" yaml:"dependsOn"`
+	// Experimental.
+	ForEach cdktf.ITerraformIterator `field:"optional" json:"forEach" yaml:"forEach"`
+	// Experimental.
+	Providers *[]interface{} `field:"optional" json:"providers" yaml:"providers"`
+	// Experimental.
+	SkipAssetCreationFromLocalModules *bool `field:"optional" json:"skipAssetCreationFromLocalModules" yaml:"skipAssetCreationFromLocalModules"`
+	// the maximum capacity of the RDS cluster.
+	MaxCapacity *float64 `field:"required" json:"maxCapacity" yaml:"maxCapacity"`
+	// the minimum capacity of the RDS cluster.
+	MinCapacity *float64 `field:"required" json:"minCapacity" yaml:"minCapacity"`
+	// private subnets to assign to the RDS cluster.
+	PrivateSubnetIds *[]*string `field:"required" json:"privateSubnetIds" yaml:"privateSubnetIds"`
+	// The nitric stack ID.
+	StackId *string `field:"required" json:"stackId" yaml:"stackId"`
+	// the VPC to assign to the RDS cluster.
+	VpcId *string `field:"required" json:"vpcId" yaml:"vpcId"`
+}
diff --git a/cloud/aws/deploytf/generated/rds/Rds__checks.go b/cloud/aws/deploytf/generated/rds/Rds__checks.go
new file mode 100644
index 000000000..053ecc989
--- /dev/null
+++ b/cloud/aws/deploytf/generated/rds/Rds__checks.go
@@ -0,0 +1,150 @@
+//go:build !no_runtime_type_checking
+
+package rds
+
+import (
+	"fmt"
+
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+
+	"github.com/aws/constructs-go/constructs/v10"
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+)
+
+func (r *jsiiProxy_Rds) validateAddOverrideParameters(path *string, value interface{}) error {
+	if path == nil {
+		return fmt.Errorf("parameter path is required, but nil was provided")
+	}
+
+	if value == nil {
+		return fmt.Errorf("parameter value is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (r *jsiiProxy_Rds) validateAddProviderParameters(provider interface{}) error {
+	if provider == nil {
+		return fmt.Errorf("parameter provider is required, but nil was provided")
+	}
+	switch provider.(type) {
+	case cdktf.TerraformProvider:
+		// ok
+	case *cdktf.TerraformModuleProvider:
+		provider := provider.(*cdktf.TerraformModuleProvider)
+		if err := _jsii_.ValidateStruct(provider, func() string { return "parameter provider" }); err != nil {
+			return err
+		}
+	case cdktf.TerraformModuleProvider:
+		provider_ := provider.(cdktf.TerraformModuleProvider)
+		provider := &provider_
+		if err := _jsii_.ValidateStruct(provider, func() string { return "parameter provider" }); err != nil {
+			return err
+		}
+	default:
+		if !_jsii_.IsAnonymousProxy(provider) {
+			return fmt.Errorf("parameter provider must be one of the allowed types: cdktf.TerraformProvider, *cdktf.TerraformModuleProvider; received %#v (a %T)", provider, provider)
+		}
+	}
+
+	return nil
+}
+
+func (r *jsiiProxy_Rds) validateGetStringParameters(output *string) error {
+	if output == nil {
+		return fmt.Errorf("parameter output is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (r *jsiiProxy_Rds) validateInterpolationForOutputParameters(moduleOutput *string) error {
+	if moduleOutput == nil {
+		return fmt.Errorf("parameter moduleOutput is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (r *jsiiProxy_Rds) validateOverrideLogicalIdParameters(newLogicalId *string) error {
+	if newLogicalId == nil {
+		return fmt.Errorf("parameter newLogicalId is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func validateRds_IsConstructParameters(x interface{}) error {
+	if x == nil {
+		return fmt.Errorf("parameter x is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func validateRds_IsTerraformElementParameters(x interface{}) error {
+	if x == nil {
+		return fmt.Errorf("parameter x is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetMaxCapacityParameters(val *float64) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetMinCapacityParameters(val *float64) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetPrivateSubnetIdsParameters(val *[]*string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetStackIdParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetVpcIdParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func validateNewRdsParameters(scope constructs.Construct, id *string, config *RdsConfig) error {
+	if scope == nil {
+		return fmt.Errorf("parameter scope is required, but nil was provided")
+	}
+
+	if id == nil {
+		return fmt.Errorf("parameter id is required, but nil was provided")
+	}
+
+	if config == nil {
+		return fmt.Errorf("parameter config is required, but nil was provided")
+	}
+	if err := _jsii_.ValidateStruct(config, func() string { return "parameter config" }); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/cloud/aws/deploytf/generated/rds/Rds__no_checks.go b/cloud/aws/deploytf/generated/rds/Rds__no_checks.go
new file mode 100644
index 000000000..aadfe51fa
--- /dev/null
+++ b/cloud/aws/deploytf/generated/rds/Rds__no_checks.go
@@ -0,0 +1,58 @@
+//go:build no_runtime_type_checking
+
+package rds
+
+// Building without runtime type checking enabled, so all the below just return nil
+
+func (r *jsiiProxy_Rds) validateAddOverrideParameters(path *string, value interface{}) error {
+	return nil
+}
+
+func (r *jsiiProxy_Rds) validateAddProviderParameters(provider interface{}) error {
+	return nil
+}
+
+func (r *jsiiProxy_Rds) validateGetStringParameters(output *string) error {
+	return nil
+}
+
+func (r *jsiiProxy_Rds) validateInterpolationForOutputParameters(moduleOutput *string) error {
+	return nil
+}
+
+func (r *jsiiProxy_Rds) validateOverrideLogicalIdParameters(newLogicalId *string) error {
+	return nil
+}
+
+func validateRds_IsConstructParameters(x interface{}) error {
+	return nil
+}
+
+func validateRds_IsTerraformElementParameters(x interface{}) error {
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetMaxCapacityParameters(val *float64) error {
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetMinCapacityParameters(val *float64) error {
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetPrivateSubnetIdsParameters(val *[]*string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetStackIdParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Rds) validateSetVpcIdParameters(val *string) error {
+	return nil
+}
+
+func validateNewRdsParameters(scope constructs.Construct, id *string, config *RdsConfig) error {
+	return nil
+}
+
diff --git a/cloud/aws/deploytf/generated/rds/internal/types.go b/cloud/aws/deploytf/generated/rds/internal/types.go
new file mode 100644
index 000000000..fcd9adcef
--- /dev/null
+++ b/cloud/aws/deploytf/generated/rds/internal/types.go
@@ -0,0 +1,7 @@
+package internal
+
+import (
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+)
+
+type Type__cdktfTerraformModule = cdktf.TerraformModule
diff --git a/cloud/aws/deploytf/generated/rds/jsii/jsii.go b/cloud/aws/deploytf/generated/rds/jsii/jsii.go
new file mode 100644
index 000000000..27f5c5837
--- /dev/null
+++ b/cloud/aws/deploytf/generated/rds/jsii/jsii.go
@@ -0,0 +1,28 @@
+// Package jsii contains the functionaility needed for jsii packages to
+// initialize their dependencies and themselves. Users should never need to use this package
+// directly. If you find you need to - please report a bug at
+// https://github.com/aws/jsii/issues/new/choose
+package jsii
+
+import (
+	_ "embed"
+
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+
+	constructs "github.com/aws/constructs-go/constructs/v10/jsii"
+	cdktf "github.com/hashicorp/terraform-cdk-go/cdktf/jsii"
+)
+
+//go:embed rds-0.0.0.tgz
+var tarball []byte
+
+// Initialize loads the necessary packages in the @jsii/kernel to support the enclosing module.
+// The implementation is idempotent (and hence safe to be called over and over).
+func Initialize() {
+	// Ensure all dependencies are initialized
+	cdktf.Initialize()
+	constructs.Initialize()
+
+	// Load this library into the kernel
+	_jsii_.Load("rds", "0.0.0", tarball)
+}
diff --git a/cloud/aws/deploytf/generated/rds/jsii/rds-0.0.0.tgz b/cloud/aws/deploytf/generated/rds/jsii/rds-0.0.0.tgz
new file mode 100644
index 000000000..792889277
Binary files /dev/null and b/cloud/aws/deploytf/generated/rds/jsii/rds-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/rds/main.go b/cloud/aws/deploytf/generated/rds/main.go
new file mode 100644
index 000000000..8c8ae3e0b
--- /dev/null
+++ b/cloud/aws/deploytf/generated/rds/main.go
@@ -0,0 +1,61 @@
+// rds
+package rds
+
+import (
+	"reflect"
+
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+)
+
+func init() {
+	_jsii_.RegisterClass(
+		"rds.Rds",
+		reflect.TypeOf((*Rds)(nil)).Elem(),
+		[]_jsii_.Member{
+			_jsii_.MemberMethod{JsiiMethod: "addOverride", GoMethod: "AddOverride"},
+			_jsii_.MemberMethod{JsiiMethod: "addProvider", GoMethod: "AddProvider"},
+			_jsii_.MemberProperty{JsiiProperty: "cdktfStack", GoGetter: "CdktfStack"},
+			_jsii_.MemberProperty{JsiiProperty: "clusterEndpointOutput", GoGetter: "ClusterEndpointOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "clusterPasswordOutput", GoGetter: "ClusterPasswordOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "clusterUsernameOutput", GoGetter: "ClusterUsernameOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "codebuildRoleArnOutput", GoGetter: "CodebuildRoleArnOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "constructNodeMetadata", GoGetter: "ConstructNodeMetadata"},
+			_jsii_.MemberProperty{JsiiProperty: "createDatabaseProjectNameOutput", GoGetter: "CreateDatabaseProjectNameOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "dependsOn", GoGetter: "DependsOn"},
+			_jsii_.MemberProperty{JsiiProperty: "forEach", GoGetter: "ForEach"},
+			_jsii_.MemberProperty{JsiiProperty: "fqn", GoGetter: "Fqn"},
+			_jsii_.MemberProperty{JsiiProperty: "friendlyUniqueId", GoGetter: "FriendlyUniqueId"},
+			_jsii_.MemberMethod{JsiiMethod: "getString", GoMethod: "GetString"},
+			_jsii_.MemberMethod{JsiiMethod: "interpolationForOutput", GoMethod: "InterpolationForOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "maxCapacity", GoGetter: "MaxCapacity"},
+			_jsii_.MemberProperty{JsiiProperty: "minCapacity", GoGetter: "MinCapacity"},
+			_jsii_.MemberProperty{JsiiProperty: "node", GoGetter: "Node"},
+			_jsii_.MemberMethod{JsiiMethod: "overrideLogicalId", GoMethod: "OverrideLogicalId"},
+			_jsii_.MemberProperty{JsiiProperty: "privateSubnetIds", GoGetter: "PrivateSubnetIds"},
+			_jsii_.MemberProperty{JsiiProperty: "providers", GoGetter: "Providers"},
+			_jsii_.MemberProperty{JsiiProperty: "rawOverrides", GoGetter: "RawOverrides"},
+			_jsii_.MemberMethod{JsiiMethod: "resetOverrideLogicalId", GoMethod: "ResetOverrideLogicalId"},
+			_jsii_.MemberProperty{JsiiProperty: "securityGroupIdOutput", GoGetter: "SecurityGroupIdOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "skipAssetCreationFromLocalModules", GoGetter: "SkipAssetCreationFromLocalModules"},
+			_jsii_.MemberProperty{JsiiProperty: "source", GoGetter: "Source"},
+			_jsii_.MemberProperty{JsiiProperty: "stackId", GoGetter: "StackId"},
+			_jsii_.MemberMethod{JsiiMethod: "synthesizeAttributes", GoMethod: "SynthesizeAttributes"},
+			_jsii_.MemberMethod{JsiiMethod: "synthesizeHclAttributes", GoMethod: "SynthesizeHclAttributes"},
+			_jsii_.MemberMethod{JsiiMethod: "toHclTerraform", GoMethod: "ToHclTerraform"},
+			_jsii_.MemberMethod{JsiiMethod: "toMetadata", GoMethod: "ToMetadata"},
+			_jsii_.MemberMethod{JsiiMethod: "toString", GoMethod: "ToString"},
+			_jsii_.MemberMethod{JsiiMethod: "toTerraform", GoMethod: "ToTerraform"},
+			_jsii_.MemberProperty{JsiiProperty: "version", GoGetter: "Version"},
+			_jsii_.MemberProperty{JsiiProperty: "vpcId", GoGetter: "VpcId"},
+		},
+		func() interface{} {
+			j := jsiiProxy_Rds{}
+			_jsii_.InitJsiiProxy(&j.Type__cdktfTerraformModule)
+			return &j
+		},
+	)
+	_jsii_.RegisterStruct(
+		"rds.RdsConfig",
+		reflect.TypeOf((*RdsConfig)(nil)).Elem(),
+	)
+}
diff --git a/cloud/aws/deploytf/generated/rds/version b/cloud/aws/deploytf/generated/rds/version
new file mode 100644
index 000000000..77d6f4ca2
--- /dev/null
+++ b/cloud/aws/deploytf/generated/rds/version
@@ -0,0 +1 @@
+0.0.0
diff --git a/cloud/aws/deploytf/generated/schedule/jsii/schedule-0.0.0.tgz b/cloud/aws/deploytf/generated/schedule/jsii/schedule-0.0.0.tgz
index c5a35e419..dd7c58e73 100644
Binary files a/cloud/aws/deploytf/generated/schedule/jsii/schedule-0.0.0.tgz and b/cloud/aws/deploytf/generated/schedule/jsii/schedule-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/secret/jsii/secret-0.0.0.tgz b/cloud/aws/deploytf/generated/secret/jsii/secret-0.0.0.tgz
index 35e8e554e..f223c8921 100644
Binary files a/cloud/aws/deploytf/generated/secret/jsii/secret-0.0.0.tgz and b/cloud/aws/deploytf/generated/secret/jsii/secret-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/service/Service.go b/cloud/aws/deploytf/generated/service/Service.go
index 43906c81a..babada7de 100644
--- a/cloud/aws/deploytf/generated/service/Service.go
+++ b/cloud/aws/deploytf/generated/service/Service.go
@@ -47,6 +47,8 @@ type Service interface {
 	RawOverrides() interface{}
 	RoleArnOutput() *string
 	RoleNameOutput() *string
+	SecurityGroupIds() *[]*string
+	SetSecurityGroupIds(val *[]*string)
 	ServiceName() *string
 	SetServiceName(val *string)
 	// Experimental.
@@ -55,6 +57,8 @@ type Service interface {
 	Source() *string
 	StackId() *string
 	SetStackId(val *string)
+	SubnetIds() *[]*string
+	SetSubnetIds(val *[]*string)
 	Timeout() *float64
 	SetTimeout(val *float64)
 	// Experimental.
@@ -260,6 +264,16 @@ func (j *jsiiProxy_Service) RoleNameOutput() *string {
 	return returns
 }
 
+func (j *jsiiProxy_Service) SecurityGroupIds() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"securityGroupIds",
+		&returns,
+	)
+	return returns
+}
+
 func (j *jsiiProxy_Service) ServiceName() *string {
 	var returns *string
 	_jsii_.Get(
@@ -300,6 +314,16 @@ func (j *jsiiProxy_Service) StackId() *string {
 	return returns
 }
 
+func (j *jsiiProxy_Service) SubnetIds() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"subnetIds",
+		&returns,
+	)
+	return returns
+}
+
 func (j *jsiiProxy_Service) Timeout() *float64 {
 	var returns *float64
 	_jsii_.Get(
@@ -393,6 +417,14 @@ func (j *jsiiProxy_Service) SetMemory(val *float64) {
 	)
 }
 
+func (j *jsiiProxy_Service) SetSecurityGroupIds(val *[]*string) {
+	_jsii_.Set(
+		j,
+		"securityGroupIds",
+		val,
+	)
+}
+
 func (j *jsiiProxy_Service) SetServiceName(val *string) {
 	if err := j.validateSetServiceNameParameters(val); err != nil {
 		panic(err)
@@ -415,6 +447,14 @@ func (j *jsiiProxy_Service) SetStackId(val *string) {
 	)
 }
 
+func (j *jsiiProxy_Service) SetSubnetIds(val *[]*string) {
+	_jsii_.Set(
+		j,
+		"subnetIds",
+		val,
+	)
+}
+
 func (j *jsiiProxy_Service) SetTimeout(val *float64) {
 	_jsii_.Set(
 		j,
diff --git a/cloud/aws/deploytf/generated/service/ServiceConfig.go b/cloud/aws/deploytf/generated/service/ServiceConfig.go
index 42d68c824..073cbaa84 100644
--- a/cloud/aws/deploytf/generated/service/ServiceConfig.go
+++ b/cloud/aws/deploytf/generated/service/ServiceConfig.go
@@ -23,6 +23,10 @@ type ServiceConfig struct {
 	StackId *string `field:"required" json:"stackId" yaml:"stackId"`
 	// The amount of memory to allocate to the lambda function 128.
 	Memory *float64 `field:"optional" json:"memory" yaml:"memory"`
+	// The security group ids to use for the aws lambda function.
+	SecurityGroupIds *[]*string `field:"optional" json:"securityGroupIds" yaml:"securityGroupIds"`
+	// The subnet ids to use for the aws lambda function.
+	SubnetIds *[]*string `field:"optional" json:"subnetIds" yaml:"subnetIds"`
 	// The timeout for the lambda function 10.
 	Timeout *float64 `field:"optional" json:"timeout" yaml:"timeout"`
 }
diff --git a/cloud/aws/deploytf/generated/service/jsii/service-0.0.0.tgz b/cloud/aws/deploytf/generated/service/jsii/service-0.0.0.tgz
index ccd57e4cd..74a949265 100644
Binary files a/cloud/aws/deploytf/generated/service/jsii/service-0.0.0.tgz and b/cloud/aws/deploytf/generated/service/jsii/service-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/service/main.go b/cloud/aws/deploytf/generated/service/main.go
index c3c42c3df..9f95081bf 100644
--- a/cloud/aws/deploytf/generated/service/main.go
+++ b/cloud/aws/deploytf/generated/service/main.go
@@ -35,10 +35,12 @@ func init() {
 			_jsii_.MemberMethod{JsiiMethod: "resetOverrideLogicalId", GoMethod: "ResetOverrideLogicalId"},
 			_jsii_.MemberProperty{JsiiProperty: "roleArnOutput", GoGetter: "RoleArnOutput"},
 			_jsii_.MemberProperty{JsiiProperty: "roleNameOutput", GoGetter: "RoleNameOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "securityGroupIds", GoGetter: "SecurityGroupIds"},
 			_jsii_.MemberProperty{JsiiProperty: "serviceName", GoGetter: "ServiceName"},
 			_jsii_.MemberProperty{JsiiProperty: "skipAssetCreationFromLocalModules", GoGetter: "SkipAssetCreationFromLocalModules"},
 			_jsii_.MemberProperty{JsiiProperty: "source", GoGetter: "Source"},
 			_jsii_.MemberProperty{JsiiProperty: "stackId", GoGetter: "StackId"},
+			_jsii_.MemberProperty{JsiiProperty: "subnetIds", GoGetter: "SubnetIds"},
 			_jsii_.MemberMethod{JsiiMethod: "synthesizeAttributes", GoMethod: "SynthesizeAttributes"},
 			_jsii_.MemberMethod{JsiiMethod: "synthesizeHclAttributes", GoMethod: "SynthesizeHclAttributes"},
 			_jsii_.MemberProperty{JsiiProperty: "timeout", GoGetter: "Timeout"},
diff --git a/cloud/aws/deploytf/generated/sql/Sql.go b/cloud/aws/deploytf/generated/sql/Sql.go
new file mode 100644
index 000000000..09ddf589f
--- /dev/null
+++ b/cloud/aws/deploytf/generated/sql/Sql.go
@@ -0,0 +1,741 @@
+package sql
+
+import (
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+	_init_ "github.com/nitrictech/nitric/cloud/aws/deploytf/generated/sql/jsii"
+
+	"github.com/aws/constructs-go/constructs/v10"
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/sql/internal"
+)
+
+// Defines an Sql based on a Terraform module.
+//
+// Source at ./.nitric/modules/sql
+type Sql interface {
+	cdktf.TerraformModule
+	// Experimental.
+	CdktfStack() cdktf.TerraformStack
+	CodebuildRegion() *string
+	SetCodebuildRegion(val *string)
+	CodebuildRoleArn() *string
+	SetCodebuildRoleArn(val *string)
+	// Experimental.
+	ConstructNodeMetadata() *map[string]interface{}
+	CreateDatabaseProjectName() *string
+	SetCreateDatabaseProjectName(val *string)
+	DbName() *string
+	SetDbName(val *string)
+	// Experimental.
+	DependsOn() *[]*string
+	// Experimental.
+	SetDependsOn(val *[]*string)
+	// Experimental.
+	ForEach() cdktf.ITerraformIterator
+	// Experimental.
+	SetForEach(val cdktf.ITerraformIterator)
+	// Experimental.
+	Fqn() *string
+	// Experimental.
+	FriendlyUniqueId() *string
+	ImageUri() *string
+	SetImageUri(val *string)
+	MigrateCommand() *string
+	SetMigrateCommand(val *string)
+	// The tree node.
+	Node() constructs.Node
+	// Experimental.
+	Providers() *[]interface{}
+	// Experimental.
+	RawOverrides() interface{}
+	RdsClusterEndpoint() *string
+	SetRdsClusterEndpoint(val *string)
+	RdsClusterPassword() *string
+	SetRdsClusterPassword(val *string)
+	RdsClusterUsername() *string
+	SetRdsClusterUsername(val *string)
+	SecurityGroupIds() *[]*string
+	SetSecurityGroupIds(val *[]*string)
+	// Experimental.
+	SkipAssetCreationFromLocalModules() *bool
+	// Experimental.
+	Source() *string
+	SubnetIds() *[]*string
+	SetSubnetIds(val *[]*string)
+	// Experimental.
+	Version() *string
+	VpcId() *string
+	SetVpcId(val *string)
+	WorkDir() *string
+	SetWorkDir(val *string)
+	// Experimental.
+	AddOverride(path *string, value interface{})
+	// Experimental.
+	AddProvider(provider interface{})
+	// Experimental.
+	GetString(output *string) *string
+	// Experimental.
+	InterpolationForOutput(moduleOutput *string) cdktf.IResolvable
+	// Overrides the auto-generated logical ID with a specific ID.
+	// Experimental.
+	OverrideLogicalId(newLogicalId *string)
+	// Resets a previously passed logical Id to use the auto-generated logical id again.
+	// Experimental.
+	ResetOverrideLogicalId()
+	SynthesizeAttributes() *map[string]interface{}
+	SynthesizeHclAttributes() *map[string]interface{}
+	// Experimental.
+	ToHclTerraform() interface{}
+	// Experimental.
+	ToMetadata() interface{}
+	// Returns a string representation of this construct.
+	ToString() *string
+	// Experimental.
+	ToTerraform() interface{}
+}
+
+// The jsii proxy struct for Sql
+type jsiiProxy_Sql struct {
+	internal.Type__cdktfTerraformModule
+}
+
+func (j *jsiiProxy_Sql) CdktfStack() cdktf.TerraformStack {
+	var returns cdktf.TerraformStack
+	_jsii_.Get(
+		j,
+		"cdktfStack",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) CodebuildRegion() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"codebuildRegion",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) CodebuildRoleArn() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"codebuildRoleArn",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) ConstructNodeMetadata() *map[string]interface{} {
+	var returns *map[string]interface{}
+	_jsii_.Get(
+		j,
+		"constructNodeMetadata",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) CreateDatabaseProjectName() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"createDatabaseProjectName",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) DbName() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"dbName",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) DependsOn() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"dependsOn",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) ForEach() cdktf.ITerraformIterator {
+	var returns cdktf.ITerraformIterator
+	_jsii_.Get(
+		j,
+		"forEach",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) Fqn() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"fqn",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) FriendlyUniqueId() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"friendlyUniqueId",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) ImageUri() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"imageUri",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) MigrateCommand() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"migrateCommand",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) Node() constructs.Node {
+	var returns constructs.Node
+	_jsii_.Get(
+		j,
+		"node",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) Providers() *[]interface{} {
+	var returns *[]interface{}
+	_jsii_.Get(
+		j,
+		"providers",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) RawOverrides() interface{} {
+	var returns interface{}
+	_jsii_.Get(
+		j,
+		"rawOverrides",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) RdsClusterEndpoint() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"rdsClusterEndpoint",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) RdsClusterPassword() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"rdsClusterPassword",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) RdsClusterUsername() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"rdsClusterUsername",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) SecurityGroupIds() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"securityGroupIds",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) SkipAssetCreationFromLocalModules() *bool {
+	var returns *bool
+	_jsii_.Get(
+		j,
+		"skipAssetCreationFromLocalModules",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) Source() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"source",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) SubnetIds() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"subnetIds",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) Version() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"version",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) VpcId() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"vpcId",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Sql) WorkDir() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"workDir",
+		&returns,
+	)
+	return returns
+}
+
+func NewSql(scope constructs.Construct, id *string, config *SqlConfig) Sql {
+	_init_.Initialize()
+
+	if err := validateNewSqlParameters(scope, id, config); err != nil {
+		panic(err)
+	}
+	j := jsiiProxy_Sql{}
+
+	_jsii_.Create(
+		"sql.Sql",
+		[]interface{}{scope, id, config},
+		&j,
+	)
+
+	return &j
+}
+
+func NewSql_Override(s Sql, scope constructs.Construct, id *string, config *SqlConfig) {
+	_init_.Initialize()
+
+	_jsii_.Create(
+		"sql.Sql",
+		[]interface{}{scope, id, config},
+		s,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetCodebuildRegion(val *string) {
+	if err := j.validateSetCodebuildRegionParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"codebuildRegion",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetCodebuildRoleArn(val *string) {
+	if err := j.validateSetCodebuildRoleArnParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"codebuildRoleArn",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetCreateDatabaseProjectName(val *string) {
+	if err := j.validateSetCreateDatabaseProjectNameParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"createDatabaseProjectName",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetDbName(val *string) {
+	if err := j.validateSetDbNameParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"dbName",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetDependsOn(val *[]*string) {
+	_jsii_.Set(
+		j,
+		"dependsOn",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetForEach(val cdktf.ITerraformIterator) {
+	_jsii_.Set(
+		j,
+		"forEach",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetImageUri(val *string) {
+	if err := j.validateSetImageUriParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"imageUri",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetMigrateCommand(val *string) {
+	if err := j.validateSetMigrateCommandParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"migrateCommand",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetRdsClusterEndpoint(val *string) {
+	if err := j.validateSetRdsClusterEndpointParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"rdsClusterEndpoint",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetRdsClusterPassword(val *string) {
+	if err := j.validateSetRdsClusterPasswordParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"rdsClusterPassword",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetRdsClusterUsername(val *string) {
+	if err := j.validateSetRdsClusterUsernameParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"rdsClusterUsername",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetSecurityGroupIds(val *[]*string) {
+	if err := j.validateSetSecurityGroupIdsParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"securityGroupIds",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetSubnetIds(val *[]*string) {
+	if err := j.validateSetSubnetIdsParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"subnetIds",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetVpcId(val *string) {
+	if err := j.validateSetVpcIdParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"vpcId",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Sql) SetWorkDir(val *string) {
+	if err := j.validateSetWorkDirParameters(val); err != nil {
+		panic(err)
+	}
+	_jsii_.Set(
+		j,
+		"workDir",
+		val,
+	)
+}
+
+// Checks if `x` is a construct.
+//
+// Use this method instead of `instanceof` to properly detect `Construct`
+// instances, even when the construct library is symlinked.
+//
+// Explanation: in JavaScript, multiple copies of the `constructs` library on
+// disk are seen as independent, completely different libraries. As a
+// consequence, the class `Construct` in each copy of the `constructs` library
+// is seen as a different class, and an instance of one class will not test as
+// `instanceof` the other class. `npm install` will not create installations
+// like this, but users may manually symlink construct libraries together or
+// use a monorepo tool: in those cases, multiple copies of the `constructs`
+// library can be accidentally installed, and `instanceof` will behave
+// unpredictably. It is safest to avoid using `instanceof`, and using
+// this type-testing method instead.
+//
+// Returns: true if `x` is an object created from a class which extends `Construct`.
+func Sql_IsConstruct(x interface{}) *bool {
+	_init_.Initialize()
+
+	if err := validateSql_IsConstructParameters(x); err != nil {
+		panic(err)
+	}
+	var returns *bool
+
+	_jsii_.StaticInvoke(
+		"sql.Sql",
+		"isConstruct",
+		[]interface{}{x},
+		&returns,
+	)
+
+	return returns
+}
+
+// Experimental.
+func Sql_IsTerraformElement(x interface{}) *bool {
+	_init_.Initialize()
+
+	if err := validateSql_IsTerraformElementParameters(x); err != nil {
+		panic(err)
+	}
+	var returns *bool
+
+	_jsii_.StaticInvoke(
+		"sql.Sql",
+		"isTerraformElement",
+		[]interface{}{x},
+		&returns,
+	)
+
+	return returns
+}
+
+func (s *jsiiProxy_Sql) AddOverride(path *string, value interface{}) {
+	if err := s.validateAddOverrideParameters(path, value); err != nil {
+		panic(err)
+	}
+	_jsii_.InvokeVoid(
+		s,
+		"addOverride",
+		[]interface{}{path, value},
+	)
+}
+
+func (s *jsiiProxy_Sql) AddProvider(provider interface{}) {
+	if err := s.validateAddProviderParameters(provider); err != nil {
+		panic(err)
+	}
+	_jsii_.InvokeVoid(
+		s,
+		"addProvider",
+		[]interface{}{provider},
+	)
+}
+
+func (s *jsiiProxy_Sql) GetString(output *string) *string {
+	if err := s.validateGetStringParameters(output); err != nil {
+		panic(err)
+	}
+	var returns *string
+
+	_jsii_.Invoke(
+		s,
+		"getString",
+		[]interface{}{output},
+		&returns,
+	)
+
+	return returns
+}
+
+func (s *jsiiProxy_Sql) InterpolationForOutput(moduleOutput *string) cdktf.IResolvable {
+	if err := s.validateInterpolationForOutputParameters(moduleOutput); err != nil {
+		panic(err)
+	}
+	var returns cdktf.IResolvable
+
+	_jsii_.Invoke(
+		s,
+		"interpolationForOutput",
+		[]interface{}{moduleOutput},
+		&returns,
+	)
+
+	return returns
+}
+
+func (s *jsiiProxy_Sql) OverrideLogicalId(newLogicalId *string) {
+	if err := s.validateOverrideLogicalIdParameters(newLogicalId); err != nil {
+		panic(err)
+	}
+	_jsii_.InvokeVoid(
+		s,
+		"overrideLogicalId",
+		[]interface{}{newLogicalId},
+	)
+}
+
+func (s *jsiiProxy_Sql) ResetOverrideLogicalId() {
+	_jsii_.InvokeVoid(
+		s,
+		"resetOverrideLogicalId",
+		nil, // no parameters
+	)
+}
+
+func (s *jsiiProxy_Sql) SynthesizeAttributes() *map[string]interface{} {
+	var returns *map[string]interface{}
+
+	_jsii_.Invoke(
+		s,
+		"synthesizeAttributes",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (s *jsiiProxy_Sql) SynthesizeHclAttributes() *map[string]interface{} {
+	var returns *map[string]interface{}
+
+	_jsii_.Invoke(
+		s,
+		"synthesizeHclAttributes",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (s *jsiiProxy_Sql) ToHclTerraform() interface{} {
+	var returns interface{}
+
+	_jsii_.Invoke(
+		s,
+		"toHclTerraform",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (s *jsiiProxy_Sql) ToMetadata() interface{} {
+	var returns interface{}
+
+	_jsii_.Invoke(
+		s,
+		"toMetadata",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (s *jsiiProxy_Sql) ToString() *string {
+	var returns *string
+
+	_jsii_.Invoke(
+		s,
+		"toString",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (s *jsiiProxy_Sql) ToTerraform() interface{} {
+	var returns interface{}
+
+	_jsii_.Invoke(
+		s,
+		"toTerraform",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
diff --git a/cloud/aws/deploytf/generated/sql/SqlConfig.go b/cloud/aws/deploytf/generated/sql/SqlConfig.go
new file mode 100644
index 000000000..c93fa6b61
--- /dev/null
+++ b/cloud/aws/deploytf/generated/sql/SqlConfig.go
@@ -0,0 +1,42 @@
+package sql
+
+import (
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+)
+
+type SqlConfig struct {
+	// Experimental.
+	DependsOn *[]cdktf.ITerraformDependable `field:"optional" json:"dependsOn" yaml:"dependsOn"`
+	// Experimental.
+	ForEach cdktf.ITerraformIterator `field:"optional" json:"forEach" yaml:"forEach"`
+	// Experimental.
+	Providers *[]interface{} `field:"optional" json:"providers" yaml:"providers"`
+	// Experimental.
+	SkipAssetCreationFromLocalModules *bool `field:"optional" json:"skipAssetCreationFromLocalModules" yaml:"skipAssetCreationFromLocalModules"`
+	// The region of the codebuild project.
+	CodebuildRegion *string `field:"required" json:"codebuildRegion" yaml:"codebuildRegion"`
+	// The arn of the codebuild role.
+	CodebuildRoleArn *string `field:"required" json:"codebuildRoleArn" yaml:"codebuildRoleArn"`
+	// The name of the create database codebuild project.
+	CreateDatabaseProjectName *string `field:"required" json:"createDatabaseProjectName" yaml:"createDatabaseProjectName"`
+	// The name of the database to create.
+	DbName *string `field:"required" json:"dbName" yaml:"dbName"`
+	// The URI of the docker image to use for the codebuild project.
+	ImageUri *string `field:"required" json:"imageUri" yaml:"imageUri"`
+	// The command to run to migrate the database.
+	MigrateCommand *string `field:"required" json:"migrateCommand" yaml:"migrateCommand"`
+	// The endpoint of the RDS cluster to connect to.
+	RdsClusterEndpoint *string `field:"required" json:"rdsClusterEndpoint" yaml:"rdsClusterEndpoint"`
+	// The password to connect to the RDS cluster.
+	RdsClusterPassword *string `field:"required" json:"rdsClusterPassword" yaml:"rdsClusterPassword"`
+	// The username to connect to the RDS cluster.
+	RdsClusterUsername *string `field:"required" json:"rdsClusterUsername" yaml:"rdsClusterUsername"`
+	// The security group ids to use for the codebuild project.
+	SecurityGroupIds *[]*string `field:"required" json:"securityGroupIds" yaml:"securityGroupIds"`
+	// The subnet ids to use for the codebuild project.
+	SubnetIds *[]*string `field:"required" json:"subnetIds" yaml:"subnetIds"`
+	// The vpc id to use for the codebuild project.
+	VpcId *string `field:"required" json:"vpcId" yaml:"vpcId"`
+	// The working directory for the codebuild project.
+	WorkDir *string `field:"required" json:"workDir" yaml:"workDir"`
+}
diff --git a/cloud/aws/deploytf/generated/sql/Sql__checks.go b/cloud/aws/deploytf/generated/sql/Sql__checks.go
new file mode 100644
index 000000000..2ee46f649
--- /dev/null
+++ b/cloud/aws/deploytf/generated/sql/Sql__checks.go
@@ -0,0 +1,214 @@
+//go:build !no_runtime_type_checking
+
+package sql
+
+import (
+	"fmt"
+
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+
+	"github.com/aws/constructs-go/constructs/v10"
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+)
+
+func (s *jsiiProxy_Sql) validateAddOverrideParameters(path *string, value interface{}) error {
+	if path == nil {
+		return fmt.Errorf("parameter path is required, but nil was provided")
+	}
+
+	if value == nil {
+		return fmt.Errorf("parameter value is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (s *jsiiProxy_Sql) validateAddProviderParameters(provider interface{}) error {
+	if provider == nil {
+		return fmt.Errorf("parameter provider is required, but nil was provided")
+	}
+	switch provider.(type) {
+	case cdktf.TerraformProvider:
+		// ok
+	case *cdktf.TerraformModuleProvider:
+		provider := provider.(*cdktf.TerraformModuleProvider)
+		if err := _jsii_.ValidateStruct(provider, func() string { return "parameter provider" }); err != nil {
+			return err
+		}
+	case cdktf.TerraformModuleProvider:
+		provider_ := provider.(cdktf.TerraformModuleProvider)
+		provider := &provider_
+		if err := _jsii_.ValidateStruct(provider, func() string { return "parameter provider" }); err != nil {
+			return err
+		}
+	default:
+		if !_jsii_.IsAnonymousProxy(provider) {
+			return fmt.Errorf("parameter provider must be one of the allowed types: cdktf.TerraformProvider, *cdktf.TerraformModuleProvider; received %#v (a %T)", provider, provider)
+		}
+	}
+
+	return nil
+}
+
+func (s *jsiiProxy_Sql) validateGetStringParameters(output *string) error {
+	if output == nil {
+		return fmt.Errorf("parameter output is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (s *jsiiProxy_Sql) validateInterpolationForOutputParameters(moduleOutput *string) error {
+	if moduleOutput == nil {
+		return fmt.Errorf("parameter moduleOutput is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (s *jsiiProxy_Sql) validateOverrideLogicalIdParameters(newLogicalId *string) error {
+	if newLogicalId == nil {
+		return fmt.Errorf("parameter newLogicalId is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func validateSql_IsConstructParameters(x interface{}) error {
+	if x == nil {
+		return fmt.Errorf("parameter x is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func validateSql_IsTerraformElementParameters(x interface{}) error {
+	if x == nil {
+		return fmt.Errorf("parameter x is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetCodebuildRegionParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetCodebuildRoleArnParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetCreateDatabaseProjectNameParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetDbNameParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetImageUriParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetMigrateCommandParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetRdsClusterEndpointParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetRdsClusterPasswordParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetRdsClusterUsernameParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetSecurityGroupIdsParameters(val *[]*string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetSubnetIdsParameters(val *[]*string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetVpcIdParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetWorkDirParameters(val *string) error {
+	if val == nil {
+		return fmt.Errorf("parameter val is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func validateNewSqlParameters(scope constructs.Construct, id *string, config *SqlConfig) error {
+	if scope == nil {
+		return fmt.Errorf("parameter scope is required, but nil was provided")
+	}
+
+	if id == nil {
+		return fmt.Errorf("parameter id is required, but nil was provided")
+	}
+
+	if config == nil {
+		return fmt.Errorf("parameter config is required, but nil was provided")
+	}
+	if err := _jsii_.ValidateStruct(config, func() string { return "parameter config" }); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/cloud/aws/deploytf/generated/sql/Sql__no_checks.go b/cloud/aws/deploytf/generated/sql/Sql__no_checks.go
new file mode 100644
index 000000000..0fcd808a7
--- /dev/null
+++ b/cloud/aws/deploytf/generated/sql/Sql__no_checks.go
@@ -0,0 +1,90 @@
+//go:build no_runtime_type_checking
+
+package sql
+
+// Building without runtime type checking enabled, so all the below just return nil
+
+func (s *jsiiProxy_Sql) validateAddOverrideParameters(path *string, value interface{}) error {
+	return nil
+}
+
+func (s *jsiiProxy_Sql) validateAddProviderParameters(provider interface{}) error {
+	return nil
+}
+
+func (s *jsiiProxy_Sql) validateGetStringParameters(output *string) error {
+	return nil
+}
+
+func (s *jsiiProxy_Sql) validateInterpolationForOutputParameters(moduleOutput *string) error {
+	return nil
+}
+
+func (s *jsiiProxy_Sql) validateOverrideLogicalIdParameters(newLogicalId *string) error {
+	return nil
+}
+
+func validateSql_IsConstructParameters(x interface{}) error {
+	return nil
+}
+
+func validateSql_IsTerraformElementParameters(x interface{}) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetCodebuildRegionParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetCodebuildRoleArnParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetCreateDatabaseProjectNameParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetDbNameParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetImageUriParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetMigrateCommandParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetRdsClusterEndpointParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetRdsClusterPasswordParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetRdsClusterUsernameParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetSecurityGroupIdsParameters(val *[]*string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetSubnetIdsParameters(val *[]*string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetVpcIdParameters(val *string) error {
+	return nil
+}
+
+func (j *jsiiProxy_Sql) validateSetWorkDirParameters(val *string) error {
+	return nil
+}
+
+func validateNewSqlParameters(scope constructs.Construct, id *string, config *SqlConfig) error {
+	return nil
+}
+
diff --git a/cloud/aws/deploytf/generated/sql/internal/types.go b/cloud/aws/deploytf/generated/sql/internal/types.go
new file mode 100644
index 000000000..fcd9adcef
--- /dev/null
+++ b/cloud/aws/deploytf/generated/sql/internal/types.go
@@ -0,0 +1,7 @@
+package internal
+
+import (
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+)
+
+type Type__cdktfTerraformModule = cdktf.TerraformModule
diff --git a/cloud/aws/deploytf/generated/sql/jsii/jsii.go b/cloud/aws/deploytf/generated/sql/jsii/jsii.go
new file mode 100644
index 000000000..d5e3d03e8
--- /dev/null
+++ b/cloud/aws/deploytf/generated/sql/jsii/jsii.go
@@ -0,0 +1,28 @@
+// Package jsii contains the functionaility needed for jsii packages to
+// initialize their dependencies and themselves. Users should never need to use this package
+// directly. If you find you need to - please report a bug at
+// https://github.com/aws/jsii/issues/new/choose
+package jsii
+
+import (
+	_ "embed"
+
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+
+	constructs "github.com/aws/constructs-go/constructs/v10/jsii"
+	cdktf "github.com/hashicorp/terraform-cdk-go/cdktf/jsii"
+)
+
+//go:embed sql-0.0.0.tgz
+var tarball []byte
+
+// Initialize loads the necessary packages in the @jsii/kernel to support the enclosing module.
+// The implementation is idempotent (and hence safe to be called over and over).
+func Initialize() {
+	// Ensure all dependencies are initialized
+	cdktf.Initialize()
+	constructs.Initialize()
+
+	// Load this library into the kernel
+	_jsii_.Load("sql", "0.0.0", tarball)
+}
diff --git a/cloud/aws/deploytf/generated/sql/jsii/sql-0.0.0.tgz b/cloud/aws/deploytf/generated/sql/jsii/sql-0.0.0.tgz
new file mode 100644
index 000000000..b2667bd1f
Binary files /dev/null and b/cloud/aws/deploytf/generated/sql/jsii/sql-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/sql/main.go b/cloud/aws/deploytf/generated/sql/main.go
new file mode 100644
index 000000000..4382992f7
--- /dev/null
+++ b/cloud/aws/deploytf/generated/sql/main.go
@@ -0,0 +1,63 @@
+// sql
+package sql
+
+import (
+	"reflect"
+
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+)
+
+func init() {
+	_jsii_.RegisterClass(
+		"sql.Sql",
+		reflect.TypeOf((*Sql)(nil)).Elem(),
+		[]_jsii_.Member{
+			_jsii_.MemberMethod{JsiiMethod: "addOverride", GoMethod: "AddOverride"},
+			_jsii_.MemberMethod{JsiiMethod: "addProvider", GoMethod: "AddProvider"},
+			_jsii_.MemberProperty{JsiiProperty: "cdktfStack", GoGetter: "CdktfStack"},
+			_jsii_.MemberProperty{JsiiProperty: "codebuildRegion", GoGetter: "CodebuildRegion"},
+			_jsii_.MemberProperty{JsiiProperty: "codebuildRoleArn", GoGetter: "CodebuildRoleArn"},
+			_jsii_.MemberProperty{JsiiProperty: "constructNodeMetadata", GoGetter: "ConstructNodeMetadata"},
+			_jsii_.MemberProperty{JsiiProperty: "createDatabaseProjectName", GoGetter: "CreateDatabaseProjectName"},
+			_jsii_.MemberProperty{JsiiProperty: "dbName", GoGetter: "DbName"},
+			_jsii_.MemberProperty{JsiiProperty: "dependsOn", GoGetter: "DependsOn"},
+			_jsii_.MemberProperty{JsiiProperty: "forEach", GoGetter: "ForEach"},
+			_jsii_.MemberProperty{JsiiProperty: "fqn", GoGetter: "Fqn"},
+			_jsii_.MemberProperty{JsiiProperty: "friendlyUniqueId", GoGetter: "FriendlyUniqueId"},
+			_jsii_.MemberMethod{JsiiMethod: "getString", GoMethod: "GetString"},
+			_jsii_.MemberProperty{JsiiProperty: "imageUri", GoGetter: "ImageUri"},
+			_jsii_.MemberMethod{JsiiMethod: "interpolationForOutput", GoMethod: "InterpolationForOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "migrateCommand", GoGetter: "MigrateCommand"},
+			_jsii_.MemberProperty{JsiiProperty: "node", GoGetter: "Node"},
+			_jsii_.MemberMethod{JsiiMethod: "overrideLogicalId", GoMethod: "OverrideLogicalId"},
+			_jsii_.MemberProperty{JsiiProperty: "providers", GoGetter: "Providers"},
+			_jsii_.MemberProperty{JsiiProperty: "rawOverrides", GoGetter: "RawOverrides"},
+			_jsii_.MemberProperty{JsiiProperty: "rdsClusterEndpoint", GoGetter: "RdsClusterEndpoint"},
+			_jsii_.MemberProperty{JsiiProperty: "rdsClusterPassword", GoGetter: "RdsClusterPassword"},
+			_jsii_.MemberProperty{JsiiProperty: "rdsClusterUsername", GoGetter: "RdsClusterUsername"},
+			_jsii_.MemberMethod{JsiiMethod: "resetOverrideLogicalId", GoMethod: "ResetOverrideLogicalId"},
+			_jsii_.MemberProperty{JsiiProperty: "securityGroupIds", GoGetter: "SecurityGroupIds"},
+			_jsii_.MemberProperty{JsiiProperty: "skipAssetCreationFromLocalModules", GoGetter: "SkipAssetCreationFromLocalModules"},
+			_jsii_.MemberProperty{JsiiProperty: "source", GoGetter: "Source"},
+			_jsii_.MemberProperty{JsiiProperty: "subnetIds", GoGetter: "SubnetIds"},
+			_jsii_.MemberMethod{JsiiMethod: "synthesizeAttributes", GoMethod: "SynthesizeAttributes"},
+			_jsii_.MemberMethod{JsiiMethod: "synthesizeHclAttributes", GoMethod: "SynthesizeHclAttributes"},
+			_jsii_.MemberMethod{JsiiMethod: "toHclTerraform", GoMethod: "ToHclTerraform"},
+			_jsii_.MemberMethod{JsiiMethod: "toMetadata", GoMethod: "ToMetadata"},
+			_jsii_.MemberMethod{JsiiMethod: "toString", GoMethod: "ToString"},
+			_jsii_.MemberMethod{JsiiMethod: "toTerraform", GoMethod: "ToTerraform"},
+			_jsii_.MemberProperty{JsiiProperty: "version", GoGetter: "Version"},
+			_jsii_.MemberProperty{JsiiProperty: "vpcId", GoGetter: "VpcId"},
+			_jsii_.MemberProperty{JsiiProperty: "workDir", GoGetter: "WorkDir"},
+		},
+		func() interface{} {
+			j := jsiiProxy_Sql{}
+			_jsii_.InitJsiiProxy(&j.Type__cdktfTerraformModule)
+			return &j
+		},
+	)
+	_jsii_.RegisterStruct(
+		"sql.SqlConfig",
+		reflect.TypeOf((*SqlConfig)(nil)).Elem(),
+	)
+}
diff --git a/cloud/aws/deploytf/generated/sql/version b/cloud/aws/deploytf/generated/sql/version
new file mode 100644
index 000000000..77d6f4ca2
--- /dev/null
+++ b/cloud/aws/deploytf/generated/sql/version
@@ -0,0 +1 @@
+0.0.0
diff --git a/cloud/aws/deploytf/generated/stack/jsii/stack-0.0.0.tgz b/cloud/aws/deploytf/generated/stack/jsii/stack-0.0.0.tgz
index 515797a8c..9744ad12e 100644
Binary files a/cloud/aws/deploytf/generated/stack/jsii/stack-0.0.0.tgz and b/cloud/aws/deploytf/generated/stack/jsii/stack-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/topic/jsii/topic-0.0.0.tgz b/cloud/aws/deploytf/generated/topic/jsii/topic-0.0.0.tgz
index c21030edd..4b0fd7e5f 100644
Binary files a/cloud/aws/deploytf/generated/topic/jsii/topic-0.0.0.tgz and b/cloud/aws/deploytf/generated/topic/jsii/topic-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/vpc/Vpc.go b/cloud/aws/deploytf/generated/vpc/Vpc.go
new file mode 100644
index 000000000..866fed4fa
--- /dev/null
+++ b/cloud/aws/deploytf/generated/vpc/Vpc.go
@@ -0,0 +1,535 @@
+package vpc
+
+import (
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+	_init_ "github.com/nitrictech/nitric/cloud/aws/deploytf/generated/vpc/jsii"
+
+	"github.com/aws/constructs-go/constructs/v10"
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+	"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/vpc/internal"
+)
+
+// Defines an Vpc based on a Terraform module.
+//
+// Source at ./.nitric/modules/vpc
+type Vpc interface {
+	cdktf.TerraformModule
+	// Experimental.
+	CdktfStack() cdktf.TerraformStack
+	CidrBlock() *string
+	SetCidrBlock(val *string)
+	// Experimental.
+	ConstructNodeMetadata() *map[string]interface{}
+	// Experimental.
+	DependsOn() *[]*string
+	// Experimental.
+	SetDependsOn(val *[]*string)
+	// Experimental.
+	ForEach() cdktf.ITerraformIterator
+	// Experimental.
+	SetForEach(val cdktf.ITerraformIterator)
+	// Experimental.
+	Fqn() *string
+	// Experimental.
+	FriendlyUniqueId() *string
+	// The tree node.
+	Node() constructs.Node
+	PrivateSubnetCidrs() *[]*string
+	SetPrivateSubnetCidrs(val *[]*string)
+	PrivateSubnetIdsOutput() *string
+	// Experimental.
+	Providers() *[]interface{}
+	PublicSubnetCidrs() *[]*string
+	SetPublicSubnetCidrs(val *[]*string)
+	PublicSubnetIdsOutput() *string
+	// Experimental.
+	RawOverrides() interface{}
+	// Experimental.
+	SkipAssetCreationFromLocalModules() *bool
+	// Experimental.
+	Source() *string
+	// Experimental.
+	Version() *string
+	VpcIdOutput() *string
+	// Experimental.
+	AddOverride(path *string, value interface{})
+	// Experimental.
+	AddProvider(provider interface{})
+	// Experimental.
+	GetString(output *string) *string
+	// Experimental.
+	InterpolationForOutput(moduleOutput *string) cdktf.IResolvable
+	// Overrides the auto-generated logical ID with a specific ID.
+	// Experimental.
+	OverrideLogicalId(newLogicalId *string)
+	// Resets a previously passed logical Id to use the auto-generated logical id again.
+	// Experimental.
+	ResetOverrideLogicalId()
+	SynthesizeAttributes() *map[string]interface{}
+	SynthesizeHclAttributes() *map[string]interface{}
+	// Experimental.
+	ToHclTerraform() interface{}
+	// Experimental.
+	ToMetadata() interface{}
+	// Returns a string representation of this construct.
+	ToString() *string
+	// Experimental.
+	ToTerraform() interface{}
+}
+
+// The jsii proxy struct for Vpc
+type jsiiProxy_Vpc struct {
+	internal.Type__cdktfTerraformModule
+}
+
+func (j *jsiiProxy_Vpc) CdktfStack() cdktf.TerraformStack {
+	var returns cdktf.TerraformStack
+	_jsii_.Get(
+		j,
+		"cdktfStack",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) CidrBlock() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"cidrBlock",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) ConstructNodeMetadata() *map[string]interface{} {
+	var returns *map[string]interface{}
+	_jsii_.Get(
+		j,
+		"constructNodeMetadata",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) DependsOn() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"dependsOn",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) ForEach() cdktf.ITerraformIterator {
+	var returns cdktf.ITerraformIterator
+	_jsii_.Get(
+		j,
+		"forEach",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) Fqn() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"fqn",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) FriendlyUniqueId() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"friendlyUniqueId",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) Node() constructs.Node {
+	var returns constructs.Node
+	_jsii_.Get(
+		j,
+		"node",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) PrivateSubnetCidrs() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"privateSubnetCidrs",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) PrivateSubnetIdsOutput() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"privateSubnetIdsOutput",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) Providers() *[]interface{} {
+	var returns *[]interface{}
+	_jsii_.Get(
+		j,
+		"providers",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) PublicSubnetCidrs() *[]*string {
+	var returns *[]*string
+	_jsii_.Get(
+		j,
+		"publicSubnetCidrs",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) PublicSubnetIdsOutput() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"publicSubnetIdsOutput",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) RawOverrides() interface{} {
+	var returns interface{}
+	_jsii_.Get(
+		j,
+		"rawOverrides",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) SkipAssetCreationFromLocalModules() *bool {
+	var returns *bool
+	_jsii_.Get(
+		j,
+		"skipAssetCreationFromLocalModules",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) Source() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"source",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) Version() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"version",
+		&returns,
+	)
+	return returns
+}
+
+func (j *jsiiProxy_Vpc) VpcIdOutput() *string {
+	var returns *string
+	_jsii_.Get(
+		j,
+		"vpcIdOutput",
+		&returns,
+	)
+	return returns
+}
+
+func NewVpc(scope constructs.Construct, id *string, config *VpcConfig) Vpc {
+	_init_.Initialize()
+
+	if err := validateNewVpcParameters(scope, id, config); err != nil {
+		panic(err)
+	}
+	j := jsiiProxy_Vpc{}
+
+	_jsii_.Create(
+		"vpc.Vpc",
+		[]interface{}{scope, id, config},
+		&j,
+	)
+
+	return &j
+}
+
+func NewVpc_Override(v Vpc, scope constructs.Construct, id *string, config *VpcConfig) {
+	_init_.Initialize()
+
+	_jsii_.Create(
+		"vpc.Vpc",
+		[]interface{}{scope, id, config},
+		v,
+	)
+}
+
+func (j *jsiiProxy_Vpc) SetCidrBlock(val *string) {
+	_jsii_.Set(
+		j,
+		"cidrBlock",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Vpc) SetDependsOn(val *[]*string) {
+	_jsii_.Set(
+		j,
+		"dependsOn",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Vpc) SetForEach(val cdktf.ITerraformIterator) {
+	_jsii_.Set(
+		j,
+		"forEach",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Vpc) SetPrivateSubnetCidrs(val *[]*string) {
+	_jsii_.Set(
+		j,
+		"privateSubnetCidrs",
+		val,
+	)
+}
+
+func (j *jsiiProxy_Vpc) SetPublicSubnetCidrs(val *[]*string) {
+	_jsii_.Set(
+		j,
+		"publicSubnetCidrs",
+		val,
+	)
+}
+
+// Checks if `x` is a construct.
+//
+// Use this method instead of `instanceof` to properly detect `Construct`
+// instances, even when the construct library is symlinked.
+//
+// Explanation: in JavaScript, multiple copies of the `constructs` library on
+// disk are seen as independent, completely different libraries. As a
+// consequence, the class `Construct` in each copy of the `constructs` library
+// is seen as a different class, and an instance of one class will not test as
+// `instanceof` the other class. `npm install` will not create installations
+// like this, but users may manually symlink construct libraries together or
+// use a monorepo tool: in those cases, multiple copies of the `constructs`
+// library can be accidentally installed, and `instanceof` will behave
+// unpredictably. It is safest to avoid using `instanceof`, and using
+// this type-testing method instead.
+//
+// Returns: true if `x` is an object created from a class which extends `Construct`.
+func Vpc_IsConstruct(x interface{}) *bool {
+	_init_.Initialize()
+
+	if err := validateVpc_IsConstructParameters(x); err != nil {
+		panic(err)
+	}
+	var returns *bool
+
+	_jsii_.StaticInvoke(
+		"vpc.Vpc",
+		"isConstruct",
+		[]interface{}{x},
+		&returns,
+	)
+
+	return returns
+}
+
+// Experimental.
+func Vpc_IsTerraformElement(x interface{}) *bool {
+	_init_.Initialize()
+
+	if err := validateVpc_IsTerraformElementParameters(x); err != nil {
+		panic(err)
+	}
+	var returns *bool
+
+	_jsii_.StaticInvoke(
+		"vpc.Vpc",
+		"isTerraformElement",
+		[]interface{}{x},
+		&returns,
+	)
+
+	return returns
+}
+
+func (v *jsiiProxy_Vpc) AddOverride(path *string, value interface{}) {
+	if err := v.validateAddOverrideParameters(path, value); err != nil {
+		panic(err)
+	}
+	_jsii_.InvokeVoid(
+		v,
+		"addOverride",
+		[]interface{}{path, value},
+	)
+}
+
+func (v *jsiiProxy_Vpc) AddProvider(provider interface{}) {
+	if err := v.validateAddProviderParameters(provider); err != nil {
+		panic(err)
+	}
+	_jsii_.InvokeVoid(
+		v,
+		"addProvider",
+		[]interface{}{provider},
+	)
+}
+
+func (v *jsiiProxy_Vpc) GetString(output *string) *string {
+	if err := v.validateGetStringParameters(output); err != nil {
+		panic(err)
+	}
+	var returns *string
+
+	_jsii_.Invoke(
+		v,
+		"getString",
+		[]interface{}{output},
+		&returns,
+	)
+
+	return returns
+}
+
+func (v *jsiiProxy_Vpc) InterpolationForOutput(moduleOutput *string) cdktf.IResolvable {
+	if err := v.validateInterpolationForOutputParameters(moduleOutput); err != nil {
+		panic(err)
+	}
+	var returns cdktf.IResolvable
+
+	_jsii_.Invoke(
+		v,
+		"interpolationForOutput",
+		[]interface{}{moduleOutput},
+		&returns,
+	)
+
+	return returns
+}
+
+func (v *jsiiProxy_Vpc) OverrideLogicalId(newLogicalId *string) {
+	if err := v.validateOverrideLogicalIdParameters(newLogicalId); err != nil {
+		panic(err)
+	}
+	_jsii_.InvokeVoid(
+		v,
+		"overrideLogicalId",
+		[]interface{}{newLogicalId},
+	)
+}
+
+func (v *jsiiProxy_Vpc) ResetOverrideLogicalId() {
+	_jsii_.InvokeVoid(
+		v,
+		"resetOverrideLogicalId",
+		nil, // no parameters
+	)
+}
+
+func (v *jsiiProxy_Vpc) SynthesizeAttributes() *map[string]interface{} {
+	var returns *map[string]interface{}
+
+	_jsii_.Invoke(
+		v,
+		"synthesizeAttributes",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (v *jsiiProxy_Vpc) SynthesizeHclAttributes() *map[string]interface{} {
+	var returns *map[string]interface{}
+
+	_jsii_.Invoke(
+		v,
+		"synthesizeHclAttributes",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (v *jsiiProxy_Vpc) ToHclTerraform() interface{} {
+	var returns interface{}
+
+	_jsii_.Invoke(
+		v,
+		"toHclTerraform",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (v *jsiiProxy_Vpc) ToMetadata() interface{} {
+	var returns interface{}
+
+	_jsii_.Invoke(
+		v,
+		"toMetadata",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (v *jsiiProxy_Vpc) ToString() *string {
+	var returns *string
+
+	_jsii_.Invoke(
+		v,
+		"toString",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
+
+func (v *jsiiProxy_Vpc) ToTerraform() interface{} {
+	var returns interface{}
+
+	_jsii_.Invoke(
+		v,
+		"toTerraform",
+		nil, // no parameters
+		&returns,
+	)
+
+	return returns
+}
diff --git a/cloud/aws/deploytf/generated/vpc/VpcConfig.go b/cloud/aws/deploytf/generated/vpc/VpcConfig.go
new file mode 100644
index 000000000..c60e833e4
--- /dev/null
+++ b/cloud/aws/deploytf/generated/vpc/VpcConfig.go
@@ -0,0 +1,22 @@
+package vpc
+
+import (
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+)
+
+type VpcConfig struct {
+	// Experimental.
+	DependsOn *[]cdktf.ITerraformDependable `field:"optional" json:"dependsOn" yaml:"dependsOn"`
+	// Experimental.
+	ForEach cdktf.ITerraformIterator `field:"optional" json:"forEach" yaml:"forEach"`
+	// Experimental.
+	Providers *[]interface{} `field:"optional" json:"providers" yaml:"providers"`
+	// Experimental.
+	SkipAssetCreationFromLocalModules *bool `field:"optional" json:"skipAssetCreationFromLocalModules" yaml:"skipAssetCreationFromLocalModules"`
+	// The CIDR block for the VPC 10.0.0.0/16.
+	CidrBlock *string `field:"optional" json:"cidrBlock" yaml:"cidrBlock"`
+	// Private Subnet CIDR values 10.0.4.0/24 10.0.5.0/24 10.0.6.0/24.
+	PrivateSubnetCidrs *[]*string `field:"optional" json:"privateSubnetCidrs" yaml:"privateSubnetCidrs"`
+	// Public Subnet CIDR values 10.0.1.0/24 10.0.2.0/24 10.0.3.0/24.
+	PublicSubnetCidrs *[]*string `field:"optional" json:"publicSubnetCidrs" yaml:"publicSubnetCidrs"`
+}
diff --git a/cloud/aws/deploytf/generated/vpc/Vpc__checks.go b/cloud/aws/deploytf/generated/vpc/Vpc__checks.go
new file mode 100644
index 000000000..b10fea76d
--- /dev/null
+++ b/cloud/aws/deploytf/generated/vpc/Vpc__checks.go
@@ -0,0 +1,107 @@
+//go:build !no_runtime_type_checking
+
+package vpc
+
+import (
+	"fmt"
+
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+
+	"github.com/aws/constructs-go/constructs/v10"
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+)
+
+func (v *jsiiProxy_Vpc) validateAddOverrideParameters(path *string, value interface{}) error {
+	if path == nil {
+		return fmt.Errorf("parameter path is required, but nil was provided")
+	}
+
+	if value == nil {
+		return fmt.Errorf("parameter value is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (v *jsiiProxy_Vpc) validateAddProviderParameters(provider interface{}) error {
+	if provider == nil {
+		return fmt.Errorf("parameter provider is required, but nil was provided")
+	}
+	switch provider.(type) {
+	case cdktf.TerraformProvider:
+		// ok
+	case *cdktf.TerraformModuleProvider:
+		provider := provider.(*cdktf.TerraformModuleProvider)
+		if err := _jsii_.ValidateStruct(provider, func() string { return "parameter provider" }); err != nil {
+			return err
+		}
+	case cdktf.TerraformModuleProvider:
+		provider_ := provider.(cdktf.TerraformModuleProvider)
+		provider := &provider_
+		if err := _jsii_.ValidateStruct(provider, func() string { return "parameter provider" }); err != nil {
+			return err
+		}
+	default:
+		if !_jsii_.IsAnonymousProxy(provider) {
+			return fmt.Errorf("parameter provider must be one of the allowed types: cdktf.TerraformProvider, *cdktf.TerraformModuleProvider; received %#v (a %T)", provider, provider)
+		}
+	}
+
+	return nil
+}
+
+func (v *jsiiProxy_Vpc) validateGetStringParameters(output *string) error {
+	if output == nil {
+		return fmt.Errorf("parameter output is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (v *jsiiProxy_Vpc) validateInterpolationForOutputParameters(moduleOutput *string) error {
+	if moduleOutput == nil {
+		return fmt.Errorf("parameter moduleOutput is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func (v *jsiiProxy_Vpc) validateOverrideLogicalIdParameters(newLogicalId *string) error {
+	if newLogicalId == nil {
+		return fmt.Errorf("parameter newLogicalId is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func validateVpc_IsConstructParameters(x interface{}) error {
+	if x == nil {
+		return fmt.Errorf("parameter x is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func validateVpc_IsTerraformElementParameters(x interface{}) error {
+	if x == nil {
+		return fmt.Errorf("parameter x is required, but nil was provided")
+	}
+
+	return nil
+}
+
+func validateNewVpcParameters(scope constructs.Construct, id *string, config *VpcConfig) error {
+	if scope == nil {
+		return fmt.Errorf("parameter scope is required, but nil was provided")
+	}
+
+	if id == nil {
+		return fmt.Errorf("parameter id is required, but nil was provided")
+	}
+
+	if err := _jsii_.ValidateStruct(config, func() string { return "parameter config" }); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/cloud/aws/deploytf/generated/vpc/Vpc__no_checks.go b/cloud/aws/deploytf/generated/vpc/Vpc__no_checks.go
new file mode 100644
index 000000000..7ead3a2d2
--- /dev/null
+++ b/cloud/aws/deploytf/generated/vpc/Vpc__no_checks.go
@@ -0,0 +1,38 @@
+//go:build no_runtime_type_checking
+
+package vpc
+
+// Building without runtime type checking enabled, so all the below just return nil
+
+func (v *jsiiProxy_Vpc) validateAddOverrideParameters(path *string, value interface{}) error {
+	return nil
+}
+
+func (v *jsiiProxy_Vpc) validateAddProviderParameters(provider interface{}) error {
+	return nil
+}
+
+func (v *jsiiProxy_Vpc) validateGetStringParameters(output *string) error {
+	return nil
+}
+
+func (v *jsiiProxy_Vpc) validateInterpolationForOutputParameters(moduleOutput *string) error {
+	return nil
+}
+
+func (v *jsiiProxy_Vpc) validateOverrideLogicalIdParameters(newLogicalId *string) error {
+	return nil
+}
+
+func validateVpc_IsConstructParameters(x interface{}) error {
+	return nil
+}
+
+func validateVpc_IsTerraformElementParameters(x interface{}) error {
+	return nil
+}
+
+func validateNewVpcParameters(scope constructs.Construct, id *string, config *VpcConfig) error {
+	return nil
+}
+
diff --git a/cloud/aws/deploytf/generated/vpc/internal/types.go b/cloud/aws/deploytf/generated/vpc/internal/types.go
new file mode 100644
index 000000000..fcd9adcef
--- /dev/null
+++ b/cloud/aws/deploytf/generated/vpc/internal/types.go
@@ -0,0 +1,7 @@
+package internal
+
+import (
+	"github.com/hashicorp/terraform-cdk-go/cdktf"
+)
+
+type Type__cdktfTerraformModule = cdktf.TerraformModule
diff --git a/cloud/aws/deploytf/generated/vpc/jsii/jsii.go b/cloud/aws/deploytf/generated/vpc/jsii/jsii.go
new file mode 100644
index 000000000..a1a14eabd
--- /dev/null
+++ b/cloud/aws/deploytf/generated/vpc/jsii/jsii.go
@@ -0,0 +1,28 @@
+// Package jsii contains the functionaility needed for jsii packages to
+// initialize their dependencies and themselves. Users should never need to use this package
+// directly. If you find you need to - please report a bug at
+// https://github.com/aws/jsii/issues/new/choose
+package jsii
+
+import (
+	_ "embed"
+
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+
+	constructs "github.com/aws/constructs-go/constructs/v10/jsii"
+	cdktf "github.com/hashicorp/terraform-cdk-go/cdktf/jsii"
+)
+
+//go:embed vpc-0.0.0.tgz
+var tarball []byte
+
+// Initialize loads the necessary packages in the @jsii/kernel to support the enclosing module.
+// The implementation is idempotent (and hence safe to be called over and over).
+func Initialize() {
+	// Ensure all dependencies are initialized
+	cdktf.Initialize()
+	constructs.Initialize()
+
+	// Load this library into the kernel
+	_jsii_.Load("vpc", "0.0.0", tarball)
+}
diff --git a/cloud/aws/deploytf/generated/vpc/jsii/vpc-0.0.0.tgz b/cloud/aws/deploytf/generated/vpc/jsii/vpc-0.0.0.tgz
new file mode 100644
index 000000000..93d2de2d9
Binary files /dev/null and b/cloud/aws/deploytf/generated/vpc/jsii/vpc-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/generated/vpc/main.go b/cloud/aws/deploytf/generated/vpc/main.go
new file mode 100644
index 000000000..cdec490c9
--- /dev/null
+++ b/cloud/aws/deploytf/generated/vpc/main.go
@@ -0,0 +1,56 @@
+// vpc
+package vpc
+
+import (
+	"reflect"
+
+	_jsii_ "github.com/aws/jsii-runtime-go/runtime"
+)
+
+func init() {
+	_jsii_.RegisterClass(
+		"vpc.Vpc",
+		reflect.TypeOf((*Vpc)(nil)).Elem(),
+		[]_jsii_.Member{
+			_jsii_.MemberMethod{JsiiMethod: "addOverride", GoMethod: "AddOverride"},
+			_jsii_.MemberMethod{JsiiMethod: "addProvider", GoMethod: "AddProvider"},
+			_jsii_.MemberProperty{JsiiProperty: "cdktfStack", GoGetter: "CdktfStack"},
+			_jsii_.MemberProperty{JsiiProperty: "cidrBlock", GoGetter: "CidrBlock"},
+			_jsii_.MemberProperty{JsiiProperty: "constructNodeMetadata", GoGetter: "ConstructNodeMetadata"},
+			_jsii_.MemberProperty{JsiiProperty: "dependsOn", GoGetter: "DependsOn"},
+			_jsii_.MemberProperty{JsiiProperty: "forEach", GoGetter: "ForEach"},
+			_jsii_.MemberProperty{JsiiProperty: "fqn", GoGetter: "Fqn"},
+			_jsii_.MemberProperty{JsiiProperty: "friendlyUniqueId", GoGetter: "FriendlyUniqueId"},
+			_jsii_.MemberMethod{JsiiMethod: "getString", GoMethod: "GetString"},
+			_jsii_.MemberMethod{JsiiMethod: "interpolationForOutput", GoMethod: "InterpolationForOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "node", GoGetter: "Node"},
+			_jsii_.MemberMethod{JsiiMethod: "overrideLogicalId", GoMethod: "OverrideLogicalId"},
+			_jsii_.MemberProperty{JsiiProperty: "privateSubnetCidrs", GoGetter: "PrivateSubnetCidrs"},
+			_jsii_.MemberProperty{JsiiProperty: "privateSubnetIdsOutput", GoGetter: "PrivateSubnetIdsOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "providers", GoGetter: "Providers"},
+			_jsii_.MemberProperty{JsiiProperty: "publicSubnetCidrs", GoGetter: "PublicSubnetCidrs"},
+			_jsii_.MemberProperty{JsiiProperty: "publicSubnetIdsOutput", GoGetter: "PublicSubnetIdsOutput"},
+			_jsii_.MemberProperty{JsiiProperty: "rawOverrides", GoGetter: "RawOverrides"},
+			_jsii_.MemberMethod{JsiiMethod: "resetOverrideLogicalId", GoMethod: "ResetOverrideLogicalId"},
+			_jsii_.MemberProperty{JsiiProperty: "skipAssetCreationFromLocalModules", GoGetter: "SkipAssetCreationFromLocalModules"},
+			_jsii_.MemberProperty{JsiiProperty: "source", GoGetter: "Source"},
+			_jsii_.MemberMethod{JsiiMethod: "synthesizeAttributes", GoMethod: "SynthesizeAttributes"},
+			_jsii_.MemberMethod{JsiiMethod: "synthesizeHclAttributes", GoMethod: "SynthesizeHclAttributes"},
+			_jsii_.MemberMethod{JsiiMethod: "toHclTerraform", GoMethod: "ToHclTerraform"},
+			_jsii_.MemberMethod{JsiiMethod: "toMetadata", GoMethod: "ToMetadata"},
+			_jsii_.MemberMethod{JsiiMethod: "toString", GoMethod: "ToString"},
+			_jsii_.MemberMethod{JsiiMethod: "toTerraform", GoMethod: "ToTerraform"},
+			_jsii_.MemberProperty{JsiiProperty: "version", GoGetter: "Version"},
+			_jsii_.MemberProperty{JsiiProperty: "vpcIdOutput", GoGetter: "VpcIdOutput"},
+		},
+		func() interface{} {
+			j := jsiiProxy_Vpc{}
+			_jsii_.InitJsiiProxy(&j.Type__cdktfTerraformModule)
+			return &j
+		},
+	)
+	_jsii_.RegisterStruct(
+		"vpc.VpcConfig",
+		reflect.TypeOf((*VpcConfig)(nil)).Elem(),
+	)
+}
diff --git a/cloud/aws/deploytf/generated/vpc/version b/cloud/aws/deploytf/generated/vpc/version
new file mode 100644
index 000000000..77d6f4ca2
--- /dev/null
+++ b/cloud/aws/deploytf/generated/vpc/version
@@ -0,0 +1 @@
+0.0.0
diff --git a/cloud/aws/deploytf/generated/websocket/jsii/websocket-0.0.0.tgz b/cloud/aws/deploytf/generated/websocket/jsii/websocket-0.0.0.tgz
index 16dc28fde..a7cab3c3a 100644
Binary files a/cloud/aws/deploytf/generated/websocket/jsii/websocket-0.0.0.tgz and b/cloud/aws/deploytf/generated/websocket/jsii/websocket-0.0.0.tgz differ
diff --git a/cloud/aws/deploytf/service.go b/cloud/aws/deploytf/service.go
index 69f701365..e616462e0 100644
--- a/cloud/aws/deploytf/service.go
+++ b/cloud/aws/deploytf/service.go
@@ -52,18 +52,32 @@ func (a *NitricAwsTerraformProvider) Service(stack cdktf.TerraformStack, name st
 		"MIN_WORKERS":            jsii.String(fmt.Sprint(config.Workers)),
 		"NITRIC_HTTP_PROXY_PORT": jsii.String(fmt.Sprint(3000)),
 	}
+
+	// TODO: Only apply to requesting services
+	if a.Rds != nil {
+		jsiiEnv["NITRIC_DATABASE_BASE_URL"] = jsii.Sprintf("postgres://%s:%s@%s:%s", *a.Rds.ClusterUsernameOutput(), *a.Rds.ClusterPasswordOutput(),
+			*a.Rds.ClusterEndpointOutput(), "5432")
+	}
+
 	for k, v := range config.GetEnv() {
 		jsiiEnv[k] = jsii.String(v)
 	}
 
-	a.Services[name] = service.NewService(stack, jsii.Sprintf("service_%s", name), &service.ServiceConfig{
+	serviceConfig := &service.ServiceConfig{
 		ServiceName: jsii.String(name),
 		Image:       jsii.String(imageId),
 		Environment: &jsiiEnv,
 		StackId:     a.Stack.StackIdOutput(),
 		Memory:      jsii.Number(typeConfig.Lambda.Memory),
 		Timeout:     jsii.Number(typeConfig.Lambda.Timeout),
-	})
+	}
+
+	if a.Vpc != nil && a.Rds != nil {
+		serviceConfig.SecurityGroupIds = &[]*string{(a.Rds.SecurityGroupIdOutput())}
+		serviceConfig.SubnetIds = cdktf.Token_AsList(a.Vpc.PrivateSubnetIdsOutput(), &cdktf.EncodingOptions{})
+	}
+
+	a.Services[name] = service.NewService(stack, jsii.Sprintf("service_%s", name), serviceConfig)
 
 	return nil
 }
diff --git a/cloud/aws/deploytf/sql.go b/cloud/aws/deploytf/sql.go
index e3c8a04c4..60ef48ad8 100644
--- a/cloud/aws/deploytf/sql.go
+++ b/cloud/aws/deploytf/sql.go
@@ -15,12 +15,37 @@
 package deploytf
 
 import (
-	"fmt"
-
+	"github.com/aws/jsii-runtime-go"
 	"github.com/hashicorp/terraform-cdk-go/cdktf"
+	sql "github.com/nitrictech/nitric/cloud/aws/deploytf/generated/sql"
+	"github.com/nitrictech/nitric/cloud/common/deploy/image"
 	deploymentspb "github.com/nitrictech/nitric/core/pkg/proto/deployments/v1"
+	"github.com/samber/lo"
 )
 
 func (n *NitricAwsTerraformProvider) SqlDatabase(stack cdktf.TerraformStack, name string, config *deploymentspb.SqlDatabase) error {
-	return fmt.Errorf("the AWS Terraform provider does not support SQL databases yet")
+	// Inspect the provided migration image and get its command and working directory
+	inspect, err := image.CommandFromImageInspect(config.GetImageUri(), " ")
+	if err != nil {
+		return err
+	}
+
+	sql.NewSql(stack, jsii.String(name), &sql.SqlConfig{
+		DbName:                    jsii.String(name),
+		ImageUri:                  jsii.String(inspect.ID),
+		RdsClusterEndpoint:        n.Rds.ClusterEndpointOutput(),
+		RdsClusterUsername:        n.Rds.ClusterUsernameOutput(),
+		RdsClusterPassword:        n.Rds.ClusterPasswordOutput(),
+		SubnetIds:                 cdktf.Token_AsList(n.Vpc.PrivateSubnetIdsOutput(), &cdktf.EncodingOptions{}),
+		SecurityGroupIds:          &[]*string{n.Rds.SecurityGroupIdOutput()},
+		CreateDatabaseProjectName: n.Rds.CreateDatabaseProjectNameOutput(),
+		MigrateCommand:            jsii.String(inspect.Cmd),
+		WorkDir:                   jsii.String(lo.Ternary(inspect.WorkDir != "", inspect.WorkDir, "/")),
+		VpcId:                     n.Vpc.VpcIdOutput(),
+		CodebuildRoleArn:          n.Rds.CodebuildRoleArnOutput(),
+		CodebuildRegion:           &n.Region,
+		DependsOn:                 &[]cdktf.ITerraformDependable{n.Rds},
+	})
+
+	return nil
 }
diff --git a/cloud/aws/go.mod b/cloud/aws/go.mod
index df3737cbe..216a1681c 100644
--- a/cloud/aws/go.mod
+++ b/cloud/aws/go.mod
@@ -23,6 +23,7 @@ require (
 	github.com/aws/jsii-runtime-go v1.98.0
 	github.com/aws/smithy-go v1.20.1
 	github.com/cdktf/cdktf-provider-aws-go/aws/v19 v19.20.1
+	github.com/cdktf/cdktf-provider-docker-go/docker/v11 v11.0.0
 	github.com/getkin/kin-openapi v0.113.0
 	github.com/golang/mock v1.6.0
 	github.com/golangci/golangci-lint v1.56.1
@@ -32,7 +33,7 @@ require (
 	github.com/imdario/mergo v0.3.15
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/nitrictech/nitric/cloud/common v0.0.0-20240527032744-811df854d69d
-	github.com/nitrictech/nitric/core v0.0.0-20240527032744-811df854d69d
+	github.com/nitrictech/nitric/core v0.0.0-20240611083659-34f0571203c2
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.28.1
 	github.com/pkg/errors v0.9.1
diff --git a/cloud/aws/go.sum b/cloud/aws/go.sum
index 03872247d..6112cc062 100644
--- a/cloud/aws/go.sum
+++ b/cloud/aws/go.sum
@@ -213,6 +213,8 @@ github.com/ccojocar/zxcvbn-go v1.0.1 h1:+sxrANSCj6CdadkcMnvde/GWU1vZiiXRbqYSCalV
 github.com/ccojocar/zxcvbn-go v1.0.1/go.mod h1:g1qkXtUSvHP8lhHp5GrSmTz6uWALGRMQdw6Qnz/hi60=
 github.com/cdktf/cdktf-provider-aws-go/aws/v19 v19.20.1 h1:W6hu3Zn3AEmEmUF1wmL9qcci/yktAgu6AxvdfJM2N2Y=
 github.com/cdktf/cdktf-provider-aws-go/aws/v19 v19.20.1/go.mod h1:3BBDuC1dXCt+qJY6dY9SSLBIOOjHKeiMM3sJCyHPXSY=
+github.com/cdktf/cdktf-provider-docker-go/docker/v11 v11.0.0 h1:DRt9cAggV4kavJhwCDqdqpYMPgOOs/WYc/Yj2uo6PBs=
+github.com/cdktf/cdktf-provider-docker-go/docker/v11 v11.0.0/go.mod h1:U73UQ/9m5UOVw/4Xa8w3+a9HCwMsYB6omR4qkSIATD4=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -683,8 +685,8 @@ github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm
 github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
 github.com/nitrictech/nitric/cloud/common v0.0.0-20240527032744-811df854d69d h1:sh5U0U2/+DvRGIkabymeCrqELaIKrD+bwxX60Fob8q8=
 github.com/nitrictech/nitric/cloud/common v0.0.0-20240527032744-811df854d69d/go.mod h1:S3pk8Eoj6ag6wYxsMSFrANn/+IHPOPPF2fAQzsySLlM=
-github.com/nitrictech/nitric/core v0.0.0-20240527032744-811df854d69d h1:ycUmScezyK5VCufTDpSKZjuWSxdw0idK1HUUs/d9SaA=
-github.com/nitrictech/nitric/core v0.0.0-20240527032744-811df854d69d/go.mod h1:OfaIrPrJJjrFNOOgYbzoBGUblO2DadoXCrloAsUW0H0=
+github.com/nitrictech/nitric/core v0.0.0-20240611083659-34f0571203c2 h1:4jFhc7iYiRq6Tp9daBJBjTCaBoV6nW/84kLky/2GuTE=
+github.com/nitrictech/nitric/core v0.0.0-20240611083659-34f0571203c2/go.mod h1:atiPRiYDBs4Wx3flZ45KnQenUD6eAdpL0lOLZT91yyM=
 github.com/nunnatsa/ginkgolinter v0.15.2 h1:N2ORxUxPU56R9gsfLIlVVvCv/V/VVou5qVI1oBKBNHg=
 github.com/nunnatsa/ginkgolinter v0.15.2/go.mod h1:oYxE7dt1vZI8cK2rZOs3RgTaBN2vggkqnENmoJ8kVvc=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=