\n\n## š” Highlights\n\n- š Zero-credential codebase ā resolves all database config from AWS SSM Parameter Store & Secrets Manager at runtime\n- ā»ļø Bounded automatic credential rotation with health checks, transaction affinity, and at most one retiring pool\n- ā±ļø Bounded shutdown with explicit drain timeout, aggregate failure, and package-neutral lifecycle events\n- šļø Split-source architecture ā infra teams own host/port/secrets, app teams own pool/timeout/sync settings independently\n- š¦ Dual ESM/CJS module output with full TypeScript declarations and broad NestJS compatibility (v8āv11)\n\n## š Table of Contents\n\n- [Description](#-description)\n- [Tech Stack](#-tech-stack)\n- [Features](#-features)\n- [Architecture](#-architecture)\n- [Project Structure](#-project-structure)\n- [Prerequisites](#-prerequisites)\n- [Installation](#-installation)\n- [Usage](#-usage)\n- [Migrating to 2.0](#migrating-from-1x)\n- [Roadmap](#-roadmap)\n- [FAQ](#-faq)\n- [License](#-license)\n- [Acknowledgments](#-acknowledgments)\n\n## š Description\n\n**NestJS-TypeORM-AWS-Connector** is a production-grade NestJS module that eliminates the pain of managing database configuration in AWS-hosted applications. Instead of hardcoding credentials or juggling environment variables, this connector resolves your entire TypeORM `DataSourceOptions` from **AWS Systems Manager Parameter Store** and **AWS Secrets Manager** ā with built-in credential rotation.\n\nIn modern cloud-native architectures, database credentials are rotated regularly for security compliance. Traditional approaches break connections during rotation, causing downtime. This connector avoids destructive mid-run `DataSource` teardown by validating a replacement connection first, promoting the new driver for future query runners, and retiring the previous pool only after existing query runners drain. It permits at most one current and one retiring generation; later intervals defer instead of growing the pool count.\n\n### Real-World Use Cases\n\n- **ECS Fargate Microservices**: Deploy NestJS APIs on Fargate where credentials are managed by AWS Secrets Manager with automatic rotation policies ā the connector picks up fresh credentials without redeployment.\n- **Multi-Environment Deployments**: Use the same codebase across `dev`, `staging`, and `production` ā each environment resolves its own database configuration from namespaced SSM parameters.\n- **Aurora PostgreSQL / RDS MySQL**: Connect to managed AWS databases where infrastructure teams control host, port, and secret references via Parameter Store, while application teams only configure entities and behavior.\n- **Compliance-First Organizations**: Meet SOC2 and PCI-DSS requirements by never storing credentials in code, environment files, or container images.\n\nThe connector uses a **split-source model**: infrastructure-owned parameters (host, port, secret ID) live in canonical AWS namespaces, while application-owned settings (pool size, timeouts, sync behavior) live in your app's namespace. Raw value overrides let you bypass SSM entirely for local development.\n\n## š ļø Tech Stack\n\n| Category | Technologies |\n| ------------------- | -------------------------------------------- |\n| **Language** | TypeScript |\n| **Runtime** | Node.js |\n| **Framework** | NestJS |\n| **ORM** | TypeORM |\n| **Cloud Services** | AWS SSM Parameter Store, AWS Secrets Manager |\n| **Build Tool** | Rollup |\n| **Linting** | ESLint, Prettier |\n| **CI/CD** | GitHub Actions, Semantic Release |\n| **Package Manager** | npm |\n\n## š Features\n\n- āØ ****AWS Parameter Store Integration** ā Resolves database host, port, name, type, and tuning parameters from structured SSM paths with hierarchical namespace support**\n- āØ ****AWS Secrets Manager Integration** ā Fetches username/password credentials from Secrets Manager with proper error handling for missing or malformed secrets**\n- āØ ****Bounded Credential Rotation** ā Validates a replacement before promotion and permits only the current pool plus one retiring pool**\n- āØ ****Transaction Affinity** ā Query runners and manager-bound transactions stay on the generation where they started**\n- āØ ****Bounded Shutdown** ā Stops new work, waits for active generations, then reports timeout or close failures as one aggregate error**\n- āØ ****Rotation Events** ā Reports deferred rotation, retired generations, and drain timeouts without a Nest EventEmitter dependency**\n- āØ ****Emergency Recovery** ā After 3 consecutive rotation failures, automatically retries recovery without destructively tearing down the live `DataSource`**\n- āØ ****Connection Health Validation** ā Validates both existing and new connections with `SELECT 1` queries before and after rotation**\n- āØ ****Split-Source Configuration Model** ā Infrastructure-owned settings (host, port, secret-id) use canonical AWS namespaces; app-owned settings use your module namespace**\n- āØ ****Raw Value Overrides** ā Bypass SSM entirely for any field by providing direct values ā perfect for local development with `host: '127.0.0.1'`**\n- āØ ****Hierarchical Lookup Resolution** ā Field-level SSM lookup ā canonical defaults ā ssmLookupDefaults ā ParameterStoreConfigModule defaults**\n- āØ ****Dual Module Format** ā Ships both ESM and CJS builds with full TypeScript declarations and source maps**\n- āØ ****Bounded Error Model** ā Static diagnostics expose only a validated error type and optional SQLSTATE while retaining the original failure as `cause`**\n- āØ ****Broad NestJS Compatibility** ā Supports NestJS v8 through v11 as peer dependencies**\n- āØ ****Sync & Async Registration** ā Use `register()` for static config or `registerAsync()` with factory functions for dynamic configuration**\n\n## š Architecture\n\n### System Architecture\n\n```mermaid\nflowchart TD\n appModule[AppModule] --> paramStore[ParameterStoreConfigModule]\n appModule --> connectorModule[TypeOrmAwsConnectorModule]\n connectorModule --> connectorService[TypeOrmAwsConnectorService]\n connectorModule --> rotatorService[RotatorService]\n connectorModule --> scheduleModule[ScheduleModule]\n connectorService --> paramStoreService[ParameterStoreConfigService]\n connectorService --> configService[NestJS ConfigService]\n connectorService --> ssmParameterStore[AWS SSM Parameter Store]\n connectorService --> secretsManager[AWS Secrets Manager]\n rotatorService --> connectorService\n rotatorService --> dataSource[TypeORM DataSource]\n connectorModule --> typeOrmModule[TypeOrmModule.forRootAsync]\n```\n\n### Data Flow\n\n```mermaid\nsequenceDiagram\n participant App as NestJS App\n participant Connector as ConnectorService\n participant SSM as AWS Parameter Store\n participant SM as AWS Secrets Manager\n participant TypeORM as TypeORM DataSource\n participant Rotator as RotatorService\n\n App->>Connector: getTypeOrmOptions()\n Connector->>SSM: Resolve host, port, dbName, type\n SSM-->>Connector: Parameter values\n Connector->>SSM: Resolve secretId\n SSM-->>Connector: Secret ID\n Connector->>SM: GetSecretValue(secretId)\n SM-->>Connector: username + password\n Connector->>SSM: Resolve optional tuning params\n SSM-->>Connector: poolSize, timeouts, etc.\n Connector-->>App: DataSourceOptions\n App->>TypeORM: Initialize DataSource\n\n loop Every rotation interval\n Rotator->>TypeORM: Validate connection health\n Rotator->>Connector: getTypeOrmOptions()\n Connector->>SM: Fetch fresh credentials\n SM-->>Connector: New username + password\n Rotator->>TypeORM: Initialize replacement DataSource\n Rotator->>TypeORM: Verify with SELECT 1\n Rotator->>TypeORM: Promote replacement driver for future query runners\n Rotator->>TypeORM: Retire previous pool after active query runners drain\n end\n```\n\n## š Project Structure\n\n\nClick to expand\n\n```\nNestJS-TypeORM-AWS-Connector/\nāāā .github/\nā āāā workflows/\nā ā āāā mirror-docs-to-docviewer.yml\nā ā āāā mirror-to-codecommit.yml\nā ā āāā qodana-quality-scan.yml\nā ā āāā release.yml\nā ā āāā snyk-security-scan.yml\nā āāā dependabot.yml\nāāā docs/\nā āāā api-reference/\nā āāā getting-started/\nā āāā guides/\nāāā src/\nā āāā modules/\nā ā āāā typeorm-aws-connector/\nā āāā shared/\nā ā āāā constant/\nā ā āāā enum/\nā ā āāā interface/\nā ā āāā provider/\nā ā āāā type/\nā āāā index.ts\nāāā CHANGELOG.md\nāāā commitlint.config.js\nāāā eslint.config.js\nāāā LICENSE\nāāā lint-staged.config.js\nāāā nest-cli.json\nāāā package-lock.json\nāāā package.json\nāāā prettier.config.js\nāāā README.md\nāāā release.config.js\nāāā rollup.config.js\nāāā tsconfig.build.json\nāāā tsconfig.json\n```\n\n\n\n## š Prerequisites\n\n- Node.js >= 20.0.0\n- npm >= 9.0.0\n- @nestjs/common ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0\n- @aws-sdk/client-ssm ^3.535.0\n- typeorm ^0.3.20\n- @elsikora/nestjs-aws-parameter-store-config ^2.0.2 (installed automatically)\n- AWS credentials configured (IAM role, environment variables, or AWS CLI profile)\n\n## š Installation\n\nThese source docs describe the Connector 2 contract. Use a 2.x-only range so installation cannot silently fall back to Connector 1.x. Before the first 2.0 prerelease is published, this command intentionally fails.\n\n```bash\n# Install the connector and its required peer dependencies\nnpm install @elsikora/nestjs-typeorm-aws-connector@^2.0.0-0 @aws-sdk/client-ssm @nestjs/common typeorm\n```\n\nThe connector installs `@aws-sdk/client-secrets-manager`, `@elsikora/nestjs-aws-parameter-store-config`, `@nestjs/config`, and `@nestjs/schedule` as direct dependencies.\n\n### Verify Installation\n\n```bash\nnpm ls @elsikora/nestjs-typeorm-aws-connector\n```\n\n## š” Usage\n\n### Prerequisites: Register Parameter Store Config Module\n\nBefore using the connector, register `ParameterStoreConfigModule` from `@elsikora/nestjs-aws-parameter-store-config`:\n\n```typescript\nimport { Module } from \"@nestjs/common\";\nimport { ConfigModule, ConfigService } from \"@nestjs/config\";\nimport { ENamespace, ParameterStoreConfigModule } from \"@elsikora/nestjs-aws-parameter-store-config\";\n\n@Module({\n\timports: [\n\t\tConfigModule.forRoot(),\n\t\tParameterStoreConfigModule.registerAsync({\n\t\t\timports: [ConfigModule],\n\t\t\tinject: [ConfigService],\n\t\t\tuseFactory: (configService: ConfigService) => ({\n\t\t\t\tapplication: configService.getOrThrow(\"APPLICATION\"),\n\t\t\t\tconfig: { region: configService.getOrThrow(\"AWS_REGION\") },\n\t\t\t\tenvironment: configService.getOrThrow(\"ENVIRONMENT\"),\n\t\t\t\tinstanceName: \"my-api\",\n\t\t\t\tnamespace: ENamespace.AWS_ECS_FARGATE,\n\t\t\t\tshouldDecryptParameters: true,\n\t\t\t}),\n\t\t}),\n\t],\n})\nexport class AppModule {}\n```\n\n---\n\n### Basic Usage: Static Registration\n\n```typescript\nimport { Module } from \"@nestjs/common\";\nimport { TypeOrmModule } from \"@nestjs/typeorm\";\nimport { TypeOrmAwsConnectorModule, TypeOrmAwsConnectorService } from \"@elsikora/nestjs-typeorm-aws-connector\";\nimport { UserEntity } from \"./entities/user.entity\";\n\n@Module({\n\timports: [\n\t\t// Register the connector with your entities\n\t\tTypeOrmAwsConnectorModule.register({\n\t\t\tentities: [UserEntity],\n\t\t}),\n\t\t// Wire it into TypeOrmModule\n\t\tTypeOrmModule.forRootAsync({\n\t\t\timports: [TypeOrmAwsConnectorModule],\n\t\t\tinject: [TypeOrmAwsConnectorService],\n\t\t\tuseFactory: async (connector: TypeOrmAwsConnectorService) => connector.getTypeOrmOptions(),\n\t\t}),\n\t],\n})\nexport class DatabaseModule {}\n```\n\n---\n\n### Custom SSM Lookups\n\nOverride where specific fields are resolved from in Parameter Store:\n\n```typescript\nimport { ENamespace } from \"@elsikora/nestjs-aws-parameter-store-config\";\nimport { TypeOrmAwsConnectorModule } from \"@elsikora/nestjs-typeorm-aws-connector\";\n\nTypeOrmAwsConnectorModule.register({\n\tentities: [UserEntity],\n\tssmLookupDefaults: {\n\t\tinstanceName: \"my-api\",\n\t\tnamespace: ENamespace.AWS_ECS_FARGATE,\n\t},\n\tssmLookups: {\n\t\tsecretId: {\n\t\t\tinstanceName: \"database\",\n\t\t\tnamespace: ENamespace.AWS_SECRETS_MANAGER,\n\t\t\tpath: [\"secret-id\"],\n\t\t},\n\t\thost: {\n\t\t\tinstanceName: \"aurora-postgres\",\n\t\t\tnamespace: ENamespace.AWS_RDS,\n\t\t\tpath: [\"host\"],\n\t\t},\n\t\tport: {\n\t\t\tinstanceName: \"aurora-postgres\",\n\t\t\tnamespace: ENamespace.AWS_RDS,\n\t\t\tpath: [\"port\"],\n\t\t},\n\t\trotationShutdownDrainTimeoutMs: {\n\t\t\tpath: [\"database\", \"rotation\", \"shutdown-drain-timeout-ms\"],\n\t\t},\n\t},\n});\n```\n\n---\n\n### Local Development: Raw Value Overrides\n\nBypass AWS entirely for local development:\n\n```typescript\nimport { EDatabaseType } from \"@elsikora/nestjs-typeorm-aws-connector\";\n\nTypeOrmAwsConnectorModule.register({\n\tentities: [UserEntity],\n\thost: \"127.0.0.1\",\n\tport: 5432,\n\tusername: \"local-user\",\n\tpassword: \"local-password\",\n\tdatabaseName: \"mydb\",\n\ttype: EDatabaseType.POSTGRES,\n});\n```\n\n---\n\n### Enabling Credential Rotation\n\nEnable automatic credential rotation for long-running services:\n\n```typescript\nimport { Logger } from \"@nestjs/common\";\nimport { ETypeOrmAwsConnectorRotationEvent, TypeOrmAwsConnectorModule } from \"@elsikora/nestjs-typeorm-aws-connector\";\n\nconst rotationLogger = new Logger(\"DatabaseRotation\");\n\nTypeOrmAwsConnectorModule.register({\n\tentities: [UserEntity],\n\trotation: {\n\t\tisEnabled: true,\n\t\tintervalMs: 3_600_000, // Rotate every hour\n\t\tshutdownDrainTimeoutMs: 15_000,\n\t\tonEvent: (event) => {\n\t\t\tswitch (event.type) {\n\t\t\t\tcase ETypeOrmAwsConnectorRotationEvent.DRAIN_TIMEOUT: {\n\t\t\t\t\trotationLogger.error(\"Database rotation drain timed out\", event);\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tcase ETypeOrmAwsConnectorRotationEvent.GENERATION_RETIRED: {\n\t\t\t\t\trotationLogger.log(\"Database generation retired\", event);\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t\tcase ETypeOrmAwsConnectorRotationEvent.ROTATION_DEFERRED: {\n\t\t\t\t\trotationLogger.warn(\"Database rotation deferred\", event);\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t},\n});\n```\n\nWhen rotation is enabled, `shutdownDrainTimeoutMs` is required and must be a positive integer. Provide it directly or through the canonical SSM path `typeorm/rotation/shutdown-drain-timeout-ms`; the connector does not invent a shutdown default.\n\nThe rotation service will:\n\n1. Validate current connection health\n2. Fetch fresh credentials from AWS Secrets Manager\n3. Create a replacement `DataSource` with schema synchronization, migrations, schema drop, and extension installation disabled\n4. Verify the replacement connection with a `SELECT 1` query\n5. Promote the replacement driver for future query runners without destroying the live `DataSource`\n6. Keep query runners and manager-bound transactions on the generation where they started\n7. Defer later intervals until the one retiring generation drains and closes\n8. Attempt emergency recovery through the same bounded rotation gate after 3 consecutive failures\n\nAt most two database pools exist during rotation: the current generation and one retiring generation. Overlapping intervals coalesce instead of creating queued replacements.\n\n`onEvent` is an optional, package-neutral observability callback. It can return `void` or `Promise`; its returned promise is not awaited, and its synchronous body should stay small. It must not own correctness or database writes. Listener failures are logged only as a validated error type plus an optional SQLSTATE and are isolated from the rotation lifecycle. Event objects are frozen and contain no credentials.\n\nThe connector permanently sets TypeORM query logging to `false`. Foreign failure messages, stacks, SQL, parameters, driver payloads, credentials, lookup coordinates, profiles, IP addresses, and URLs are never copied into connector logs or wrapper messages. Wrapper errors retain the original failure as `cause` for explicit in-process handling.\n\n| Event | Meaning |\n| -------------------- | ----------------------------------------------------------------------------------------- |\n| `ROTATION_DEFERRED` | Rotation was skipped because another rotation, retirement, or shutdown prevents promotion |\n| `GENERATION_RETIRED` | A current or retiring generation closed successfully |\n| `DRAIN_TIMEOUT` | Active work did not drain, or generation close did not settle, in time |\n\nRotation is intended for long-lived services. For one-shot jobs, migrations, Bootstrap, or explicit CLI tasks, keep `rotation.isEnabled` disabled so the connector does not register a background interval.\n\n### Shutdown Lifecycle\n\nEnable Nest shutdown hooks in long-running applications so `SIGTERM` reaches the connector:\n\n```typescript\nconst app = await NestFactory.create(AppModule);\n\napp.enableShutdownHooks();\nawait app.listen(3000);\n```\n\nDuring shutdown, the connector removes its interval, refuses new query runners, waits up to `shutdownDrainTimeoutMs` for active work, and then closes the current, pending, and retiring generations. If drain or close does not settle, it emits `DRAIN_TIMEOUT`, performs best-effort cleanup, and rejects with one `AggregateError`; callers and orchestrators must treat that shutdown as unclean.\n\nDrain and generation close each have a bounded phase, so the host termination budget must exceed approximately `2 Ć shutdownDrainTimeoutMs` plus the surrounding Nest shutdown work and an operational margin.\n\n---\n\n### Async Registration with Factory\n\n```typescript\nTypeOrmAwsConnectorModule.registerAsync({\n\timports: [ConfigModule],\n\tinject: [ConfigService],\n\tuseFactory: (configService: ConfigService) => {\n\t\tconst isRotationEnabled = configService.get(\"DB_ROTATION_ENABLED\", false);\n\n\t\treturn {\n\t\t\tentities: [UserEntity],\n\t\t\trotation: {\n\t\t\t\tintervalMs: configService.get(\"DB_ROTATION_INTERVAL\", 3_600_000),\n\t\t\t\tisEnabled: isRotationEnabled,\n\t\t\t\t...(isRotationEnabled\n\t\t\t\t\t? {\n\t\t\t\t\t\t\tshutdownDrainTimeoutMs: configService.getOrThrow(\"DB_ROTATION_SHUTDOWN_DRAIN_TIMEOUT\"),\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t};\n\t},\n});\n```\n\nOmit the raw `shutdownDrainTimeoutMs` property when the enabled service should resolve it from Parameter Store instead of `ConfigService`.\n\n---\n\n### Multiple Database Modules In One App\n\nRegister the connector separately inside each Nest database module that owns a specific TypeORM connection. The connector module is scoped to that module registration, so multiple connector instances can safely coexist in one application.\n\n```typescript\nimport { getDataSourceToken } from \"@nestjs/typeorm\";\n\nTypeOrmAwsConnectorModule.registerAsync({\n\tdataSourceToken: getDataSourceToken(\"provider\"),\n\timports: [ConfigModule],\n\tinject: [ConfigService],\n\tuseFactory: (configService: ConfigService) => ({\n\t\tentities: [ProviderEntity],\n\t}),\n});\n```\n\nUse `dataSourceToken` when the connector's `RotatorService` should bind to a named TypeORM `DataSource` instead of the default connection token.\n\n---\n\n### Value Resolution Priority\n\nFor each configuration field, values are resolved in this order:\n\n1. **Raw value override** (provided directly in config)\n2. **SSM Parameter Store lookup** (via structured lookup)\n3. **Built-in default** (only for optional tuning fields like `poolSize`, `connectionTimeoutMs`)\n\nRequired fields (`host`, `port`, `databaseName`, `type`, `secretId`) throw explicit errors if not resolvable. When rotation resolves as enabled, `rotation.shutdownDrainTimeoutMs` is also required. Explicit `rotation` properties take priority over their structured SSM lookups.\n\n### Migrating from 1.x\n\nConnector 2.0 intentionally removes the unbounded rotation and force-only shutdown contract. Existing applications that enable rotation must add a positive `rotation.shutdownDrainTimeoutMs`, enable Nest shutdown hooks for process signals, and decide how to surface the new structured rotation events.\n\nSee the complete [Migrating to 2.0 guide](docs/guides/migrating-to-2-0/page.mdx) before upgrading.\n\n## š£ Roadmap\n\n\nClick to expand\n\n| Task / Feature | Status |\n| ------------------------------------------------------------------ | -------------- |\n| Dual ESM/CJS module output | ā Done |\n| AWS Secrets Manager credential resolution | ā Done |\n| Automatic credential rotation with staged driver promotion | ā Done |\n| Bounded current-plus-one-retiring generation lifecycle | ā Done |\n| Structured package-neutral rotation lifecycle events | ā Done |\n| Emergency recovery after consecutive rotation failures | ā Done |\n| Split-source configuration model (infra vs app namespaces) | ā Done |\n| Raw value overrides for local development | ā Done |\n| Async module registration with factory pattern | ā Done |\n| Semantic release with prerelease channel | ā Done |\n| Support for additional database types (e.g., MariaDB, CockroachDB) | š§ In Progress |\n| Connection pool monitoring and metrics export | š§ In Progress |\n| Read replica support with separate SSM lookups | š§ In Progress |\n| Integration test suite with LocalStack | š§ In Progress |\n\n\n\n## ā FAQ\n\n\nClick to expand\n\n### ā Frequently Asked Questions\n\n**Q: Do I need AWS credentials to use this locally?** A: No! Use raw value overrides to bypass AWS entirely during local development. Set `host`, `port`, `username`, `password`, `databaseName`, and `type` directly in the config.\n\n**Q: Which databases are supported?** A: Currently PostgreSQL (`EDatabaseType.POSTGRES`) and MySQL (`EDatabaseType.MYSQL`). The `type` field is resolved from SSM or set directly.\n\n**Q: What happens if AWS Secrets Manager is unreachable during rotation?** A: The rotation service catches the error, increments a failure counter, and logs only its validated error type and optional SQLSTATE. After 3 consecutive failures, it attempts an emergency recovery with a fresh replacement connection. Failed replacements are discarded, and the currently promoted pool stays in place until a later rotation succeeds.\n\n**Q: Can I use this without `@elsikora/nestjs-aws-parameter-store-config`?** A: No. The connector depends on `ParameterStoreConfigService.get()` for SSM lookups. You must register `ParameterStoreConfigModule` first. However, if you provide raw values for all fields, SSM lookups won't actually be invoked.\n\n**Q: How does the split-source model work?** A: Infrastructure-owned fields like `host`, `port`, and `secretId` default to canonical AWS namespaces (e.g., `aws-rds/aurora-postgres`). Application-owned fields like `poolSize` and `connectionTimeoutMs` use your app's namespace (e.g., `aws-ecs-fargate/my-api`). You can override any lookup.\n\n**Q: Is this compatible with NestJS v8?** A: Yes. The peer dependency accepts `@nestjs/common ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0`.\n\n**Q: How do I disable credential rotation?** A: Don't set the `rotation` config, or explicitly set `rotation.isEnabled: false`. The `RotatorService` will skip interval registration entirely. This is the recommended mode for one-shot jobs, migrations, and other short-lived processes.\n\n**Q: What's the default rotation interval?** A: 1 hour (3,600,000 ms). Override it via `rotation.intervalMs` or the SSM path `typeorm/rotation/interval-ms`.\n\n**Q: Is there a default shutdown drain timeout?** A: No. Rotation-enabled services must provide a positive integer through `rotation.shutdownDrainTimeoutMs` or `typeorm/rotation/shutdown-drain-timeout-ms`. One-shot services with rotation disabled do not require it.\n\n**Q: Can several rotations create several old pools?** A: No. The connector permits one current and at most one retiring generation. Further intervals emit `ROTATION_DEFERRED` until the retiring generation closes.\n\n**Q: What happens to a transaction during credential rotation?** A: Its query runner remains attached to the generation where it started. New query runners use the promoted generation, and ordinary rotation waits for the old pool's runners to release without applying the shutdown timeout. Forced release after `shutdownDrainTimeoutMs` occurs only during process shutdown.\n\n**Q: Does `onEvent` use Nest EventEmitter?** A: No. It is an optional callback in the rotation configuration. Use it to bridge structured events into your logger, metrics, or error reporting system without adding `@nestjs/event-emitter`.\n\n\n\n## š License\n\nThis project is licensed under **MIT**.\n\n## š Acknowledgments\n\n- **[NestJS](https://nestjs.com/)** ā The progressive Node.js framework that makes building server-side applications a joy\n- **[TypeORM](https://typeorm.io/)** ā The ORM that powers the database layer with decorator-based entity definitions\n- **[AWS SDK for JavaScript v3](https://github.com/aws/aws-sdk-js-v3)** ā Modular AWS SDK used for SSM and Secrets Manager client operations\n- **[@elsikora/nestjs-aws-parameter-store-config](https://github.com/ElsiKora/nestjs-aws-parameter-store-config)** ā The Parameter Store config module that provides the structured lookup foundation\n- **[Semantic Release](https://semantic-release.gitbook.io/)** ā Automated versioning and changelog generation\n- **[Rollup](https://rollupjs.org/)** ā Module bundler powering the dual ESM/CJS build output\n- Built with ā¤ļø by [ElsiKora](https://github.com/ElsiKora)\n\n---\n\n
![\"project-logo\"](\"https://6jft62zmy9nx2oea.public.blob.vercel-storage.com/nestjs-typeorm-aws-connector-moPeh5TktoUIqqecoEMyixlLWpCIfL.png\")
\n![\"ElsiKora\"](\"https://img.shields.io/badge/MADE%20BY%20ElsiKora-333333.svg?style=for-the-badge\"){kind=icon}
\n ![\"TypeScript\"](\"https://img.shields.io/badge/TypeScript-3178C6.svg?style=for-the-badge&logo=typescript&logoColor=white\"){kind=icon}
![\"NestJS\"](\"https://img.shields.io/badge/NestJS-E0234E.svg?style=for-the-badge&logo=nestjs&logoColor=white\"){kind=icon}
![\"Node.js\"](\"https://img.shields.io/badge/Node.js-339933.svg?style=for-the-badge&logo=node.js&logoColor=white\"){kind=icon}
![\"AWS\"](\"https://img.shields.io/badge/AWS-232F3E.svg?style=for-the-badge&logo=amazon-aws&logoColor=white\"){kind=icon}
![\"Rollup\"](\"https://img.shields.io/badge/Rollup-EC4A3F.svg?style=for-the-badge&logo=rollup&logoColor=white\"){kind=icon}
![\"ESLint\"](\"https://img.shields.io/badge/ESLint-4B32C3.svg?style=for-the-badge&logo=eslint&logoColor=white\"){kind=icon}
![\"Prettier\"](\"https://img.shields.io/badge/Prettier-F7B93E.svg?style=for-the-badge&logo=prettier&logoColor=black\"){kind=icon}
![\"GitHub](\"https://img.shields.io/badge/GitHub%20Actions-2088FF.svg?style=for-the-badge&logo=github-actions&logoColor=white\"){kind=icon}
![\"npm\"](\"https://img.shields.io/badge/npm-CB3837.svg?style=for-the-badge&logo=npm&logoColor=white\"){kind=icon}
![\"PostgreSQL\"](\"https://img.shields.io/badge/PostgreSQL-4169E1.svg?style=for-the-badge&logo=postgresql&logoColor=white\"){kind=icon}
![\"MySQL\"](\"https://img.shields.io/badge/MySQL-4479A1.svg?style=for-the-badge&logo=mysql&logoColor=white\"){kind=icon}
\n