DSQL

import { App } from '@anvil-cloud/sdk';
import * as anvil from '@anvil-cloud/sdk';

export default new App({
  run(ctx) {
    const db = new anvil.aws.DSQL('db', {
      schemas: [{ name: 'app', roles: [{ name: 'app_rw', grants: ['SELECT', 'INSERT', 'UPDATE'] }] }],
    });

    const fn = new anvil.aws.Lambda('processor', {
      runtime: 'nodejs24.x',
      handler: 'functions/processor/index.handler',
    });

    // The same as db.grantConnect(fn, { schemas: [{ schema: 'app', roleName: 'app_rw' }] }).
    // targetRoleArn can be any IAM role, e.g. an ECS task role.
    new anvil.aws.DSQLConnect('processor-connect', {
      clusterArns: db.clusterArns,
      targetRoleArn: fn.roleArn,
      targetName: 'processor',
      dbRoles: ['app_rw'],
      declaredRoles: db.declaredRoles,
      rolesTableName: db.rolesTableName,
    });
  },
});

import anvil_cloud as anvil

def infra(ctx: anvil.Context):
    db = anvil.aws.DSQL("db",
        schemas=[{"name": "app", "roles": [{"name": "app_rw", "grants": ["SELECT", "INSERT", "UPDATE"]}]}],
    )

    fn = anvil.aws.Lambda("processor",
        runtime="nodejs24.x",
        handler="functions/processor/index.handler",
    )

    # The same as db.grant_connect(fn, schemas=[{"schema": "app", "role_name": "app_rw"}]).
    # target_role_arn can be any IAM role, e.g. an ECS task role.
    anvil.aws.DSQLConnect("processor-connect",
        cluster_arns=db.cluster_arns,
        target_role_arn=fn.role_arn,
        target_name="processor",
        db_roles=["app_rw"],
        declared_roles=db.declared_roles,
        roles_table_name=db.roles_table_name,
    )

anvil.App(run=infra)

package main

import (
    "github.com/anvil-cloud/anvil/sdk/go/anvil"
    anvilaws "github.com/anvil-cloud/anvil/sdk/go/anvil/aws"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
    anvil.Run(anvil.AppConfig{
        Run: func(ctx *anvil.Context) error {
            db, err := anvilaws.NewDSQL(ctx.PulumiCtx(), "db", &anvilaws.DSQLArgs{
                Schemas: anvilaws.DSQLSchemaArray{
                    anvilaws.DSQLSchemaArgs{
                        Name: pulumi.String("app"),
                        Roles: anvilaws.DSQLRoleArray{
                            anvilaws.DSQLRoleArgs{
                                Name:   pulumi.String("app_rw"),
                                Grants: anvilaws.DSQLGrantArray{anvilaws.DSQLGrant("SELECT"), anvilaws.DSQLGrant("INSERT"), anvilaws.DSQLGrant("UPDATE")},
                            },
                        },
                    },
                },
            })
            if err != nil {
                return err
            }

            fn, err := anvilaws.NewLambda(ctx.PulumiCtx(), "processor", &anvilaws.LambdaArgs{
                Runtime: anvilaws.LambdaRuntime_Nodejs24_x,
                Handler: pulumi.String("functions/processor/index.handler"),
            })
            if err != nil {
                return err
            }

            // Go has no grantConnect yet, so this is how Go grants connect access.
            // TargetRoleArn can be any IAM role, e.g. an ECS task role.
            _, err = anvilaws.NewDSQLConnect(ctx.PulumiCtx(), "processor-connect", &anvilaws.DSQLConnectArgs{
                ClusterArns:    db.ClusterArns,
                TargetRoleArn:  fn.RoleArn,
                TargetName:     pulumi.String("processor"),
                DbRoles:        pulumi.StringArray{pulumi.String("app_rw")},
                DeclaredRoles:  db.DeclaredRoles,
                RolesTableName: db.RolesTableName,
            })
            return err
        },
    })
}