Fjall Docs — deploy AWS infrastructure into your own account

Overview

There is no separate free-tier construct. Use RdsInstance with free-tier-eligible settings, or scaffold the whole application on the Tinkerer tier, which applies those settings for you.

Free-tier eligibility

AWS changed its free tier in 2025. What an account gets depends on when it was created:

Older accounts carry the classic 12-month service allowances (750 hours per month of db.t4g.micro, 20 GB of GP3 storage, 20 GB of backup storage, single-AZ only).
Newer accounts get a credit-based free plan instead of those allowances.

The settings on this page target the classic allowances. Check AWS Free Tier for the terms that apply to your account before you rely on any of them.

Provision through the CLI

The Tinkerer tier is Fjall’s free-tier path. It scaffolds a t4g.micro instance with Multi-AZ off, no proxy, no read replica, and a VPC with no NAT gateway.

fjall create app --name experiment --type tinkerer

To add a Tinkerer-preset database to an existing application:

fjall add database -a experiment --name AppDb --type Instance --databaseName app --tier tinkerer

--tier on fjall add database requires --type as well, because each tier describes each database type differently. Valid tiers: tinkerer, lightweight, standard, resilient, enterprise.

Resource class

import { RdsInstance } from "@fjall/components-infrastructure/lib/resources/aws/database/rdsInstance";

Basic usage

const database = new RdsInstance(this, "DevDatabase", {
  vpc: myVpc,
  databaseName: "development",
  instanceType: "t4g.micro",
  allocatedStorage: 20,
  multiAz: false,
  proxy: false,
  readReplica: false,
});

instanceType takes the bare class.size form (t4g.micro), not the db.-prefixed form AWS uses in its free-tier tables. The construct passes the value straight to new InstanceType(...), so a db. prefix produces an invalid instance class.

Free-tier settings

Setting	Value	Reason
`instanceType`	`"t4g.micro"`	The only free-tier-eligible class
`allocatedStorage`	`20`	Defaults to 100 GB, which exceeds the allowance
`multiAz`	`false`	Defaults to `true`, which doubles instance hours
`proxy`	`false`	RDS Proxy is billed per vCPU-hour
`readReplica`	`false`	A replica is a second billed instance

allocatedStorage and multiAz are the two that bite. Leave them unset and the construct provisions a 100 GB Multi-AZ instance, five times the free storage allowance and twice the free instance hours.

Database Insights is a separate question. It defaults to on in standard mode, which uses the default 7-day retention and carries no charge, so leaving it enabled stays inside the free tier. Set databaseInsights: false only if you want the feature off.

Network placement

The construct puts the instance in a PRIVATE_WITH_EGRESS subnet unless you set publiclyAccessible: true, in which case it uses a PUBLIC subnet. A private-with-egress subnet needs a NAT gateway, which costs roughly $32 per month and is never free. A free-tier VPC therefore has no NAT gateway, and the database has to sit in a public subnet. This is exactly what the Tinkerer tier does.

A publicly accessible database is reachable from the internet subject to its security group. Keep the security group closed to everything but your application, and never run production data this way.

Configuration options

Core properties

Property	Type	Description	Default
`vpc`	`IVpc`	VPC for deployment	Required
`databaseName`	`string`	Database name	ID without `"Rds"`
`instanceType`	`string`	Instance class and size	`"t4g.large"`
`port`	`number`	Database port	`5432`
`publiclyAccessible`	`boolean`	Place in a public subnet	`false`

Storage

Property	Type	Description	Default
`allocatedStorage`	`number`	Initial storage in GB	`100` GB
`maxAllocatedStorage`	`number`	Autoscaling ceiling	`500` GB

Backup and maintenance

Property	Type	Description	Default
`backupRetention`	`Duration`	Backup retention	14 days
`preferredBackupWindow`	`string`	Backup window	`"02:00-03:00"`
`preferredMaintenanceWindow`	`string`	Maintenance window	`"Sat:12:30-Sat:20:30"`

Optional features

Property	Type	Description	Default
`multiAz`	`boolean`	Multi-AZ deployment	`true`
`proxy`	`ProxyConfig \| false`	RDS Proxy	Off
`readReplica`	`ReadReplicaConfig \| false`	Read replica	Off
`databaseInsights`	`DatabaseInsightsConfig \| false`	Performance monitoring	On
`deletionProtection`	`boolean`	Block accidental drop	`true`

Security defaults

RdsInstance applies these regardless of tier, and none of them cost anything on the free tier:

Storage encryption with KMS
GP3 storage
SSL/TLS enforced through the parameter group
Generated credentials in Secrets Manager
IAM database authentication (iamAuthentication, on by default, granted per user with grantIamConnect)
Deletion protection, plus a SNAPSHOT removal policy

Network access

const database = new RdsInstance(this, "FreeDb", {
  vpc: vpc,
  databaseName: "app",
  instanceType: "t4g.micro",
  allocatedStorage: 20,
  multiAz: false,
  proxy: false,
  readReplica: false,
  publiclyAccessible: true,
});

// `api` is your compute construct (ECS service or Lambda function).
api.connections.allowTo(database, Port.tcp(5432), "App to database");

Methods

Method	Returns	Description
`getHostEndpoint()`	`string`	Instance endpoint, or the proxy endpoint if one exists
`getHostPort()`	`string`	Client-facing port as a string, `"5432"` by default
`getCredentials()`	`Secret`	Secrets Manager secret holding username and password
`getConnectionString()`	`string`	`postgresql://host:port/database`
`connections`	`Connections`	Security-group handle for access control

Complete example

import { RdsInstance } from "@fjall/components-infrastructure/lib/resources/aws/database/rdsInstance";
import { Vpc, SubnetType, Port } from "aws-cdk-lib/aws-ec2";
import { CfnOutput, Duration } from "aws-cdk-lib";

// No NAT gateway keeps the VPC free, so the database goes in a public subnet.
const vpc = new Vpc(this, "DevVpc", {
  maxAzs: 2,
  natGateways: 0,
  subnetConfiguration: [{ name: "public", subnetType: SubnetType.PUBLIC }],
});

const database = new RdsInstance(this, "DevDatabase", {
  vpc: vpc,
  databaseName: "development",
  instanceType: "t4g.micro",
  allocatedStorage: 20,
  multiAz: false,
  proxy: false,
  readReplica: false,
  publiclyAccessible: true,
  backupRetention: Duration.days(7),
});

// `api` is your compute construct (ECS service or Lambda function).
api.connections.allowTo(database, Port.tcp(5432), "API to database");

new CfnOutput(this, "DatabaseEndpoint", {
  value: database.getHostEndpoint(),
  description: "Database endpoint",
});

Staying inside the allowance

Run one instance. 750 hours per month covers a single db.t4g.micro running continuously.
Set allocatedStorage: 20 and leave maxAllocatedStorage alone. Autoscaling only fires when the instance fills up.
Set multiAz: false, proxy: false and readReplica: false.
Cut backupRetention to 7 days. Backup storage above the allowance is billed.
Skip the NAT gateway. It is the single largest non-free cost in a small stack.
Tear the stack down before the allowance ends. deletionProtection defaults to true, so set it to false first, or run fjall destroy.

Upgrade path

When the free tier stops fitting, change the same properties in place. Moving the instance into a private subnet also requires a NAT gateway in the VPC.

const database = new RdsInstance(this, "ProdDb", {
  vpc: vpc,
  databaseName: "production",
  instanceType: "t4g.large",
  allocatedStorage: 100,
  multiAz: true,
  proxy: { requireTLS: true },
  readReplica: { instanceType: "t4g.large" },
});

Adding a proxy moves the client-facing port to the engine default (5432), because AWS gives CreateDBProxy no port parameter. If you also set a custom port, the construct emits a synth warning and getHostPort() returns the proxy’s port, not the instance’s.

Cost once the allowance ends

Indicative on-demand pricing in us-east-1. Check the AWS pricing calculator for your region.

Resource	Monthly cost
t4g.micro instance	~$12
20 GB GP3 storage	~$2
Backup storage	~$2
Total	~$16

Use cases

Good for:

Development and throwaway environments
Proofs of concept
Learning and experimentation
CI test databases

Not suitable for:

Production workloads
Anything needing high availability
Applications needing consistent performance
Databases larger than 20 GB

Next Steps

Tinkerer Pattern

Scaffold the whole free-tier stack in one command

RDS Instance

Configure a production-grade PostgreSQL instance

RDS Aurora

Scale up to a managed Aurora cluster

Database Factory

Create databases with the DatabaseFactory pattern

Compute Resources

Database Resources

Storage Resources

Networking Resources

Messaging Resources

Security Resources

RDS Free Tier

Overview

Free-tier eligibility

Provision through the CLI

Resource class

Basic usage

Free-tier settings

Network placement

Configuration options

Core properties

Storage

Backup and maintenance

Optional features

Security defaults

Network access

Methods

Complete example

Staying inside the allowance

Upgrade path

Cost once the allowance ends

Use cases

Next Steps

Tinkerer Pattern

RDS Instance

RDS Aurora

Database Factory

​Overview

​Free-tier eligibility

​Provision through the CLI

​Resource class

​Basic usage

​Free-tier settings

​Network placement

​Configuration options

​Core properties

​Storage

​Backup and maintenance

​Optional features

​Security defaults

​Network access

​Methods

​Complete example

​Staying inside the allowance

​Upgrade path

​Cost once the allowance ends

​Use cases

​Next Steps

Tinkerer Pattern

RDS Instance

RDS Aurora

Database Factory

Overview

Free-tier eligibility

Provision through the CLI

Resource class

Basic usage

Free-tier settings

Network placement

Configuration options

Core properties

Storage

Backup and maintenance

Optional features

Security defaults

Network access

Methods

Complete example

Staying inside the allowance

Upgrade path

Cost once the allowance ends

Use cases

Next Steps