interface DatabaseSecretProps

Language	Type name
.NET	`Amazon.CDK.AWS.RDS.DatabaseSecretProps`
Java	`software.amazon.awscdk.services.rds.DatabaseSecretProps`
Python	`aws_cdk.aws_rds.DatabaseSecretProps`
TypeScript (source)	`@aws-cdk/aws-rds` » `DatabaseSecretProps`

Construction properties for a DatabaseSecret.

Example

declare const instance: rds.DatabaseInstance;
const myUserSecret = new rds.DatabaseSecret(this, 'MyUserSecret', {
  username: 'myuser',
  secretName: 'my-user-secret', // optional, defaults to a CloudFormation-generated name
  masterSecret: instance.secret,
  excludeCharacters: '{}[]()\'"/\\', // defaults to the set " %+~`#$&*()|[]{}:;<>?!'/@\"\\"
});
const myUserSecretAttached = myUserSecret.attach(instance); // Adds DB connections information in the secret

instance.addRotationMultiUser('MyUser', { // Add rotation using the multi user scheme
  secret: myUserSecretAttached,
});

Properties

Name	Type	Description
username	`string`	The username.
encryptionKey?	`IKey`	The KMS key to use to encrypt the secret.
excludeCharacters?	`string`	Characters to not include in the generated password.
masterSecret?	`ISecret`	The master secret which will be used to rotate this secret.
replaceOnPasswordCriteriaChanges?	`boolean`	Whether to replace this secret when the criteria for the password change.
replicaRegions?	`ReplicaRegion[]`	A list of regions where to replicate this secret.
secretName?	`string`	A name for the secret.

username

Type: string

The username.

encryptionKey?

Type: IKey (optional, default: default master key)

The KMS key to use to encrypt the secret.

excludeCharacters?

Type: string (optional, default: " %+~`#$&()|[]{}:;<>?!'/)*

Characters to not include in the generated password.

masterSecret?

Type: ISecret (optional, default: no master secret information will be included)

The master secret which will be used to rotate this secret.

replaceOnPasswordCriteriaChanges?

Type: boolean (optional, default: false)

Whether to replace this secret when the criteria for the password change.

This is achieved by overriding the logical id of the AWS::SecretsManager::Secret with a hash of the options that influence the password generation. This way a new secret will be created when the password is regenerated and the cluster or instance consuming this secret will have its credentials updated.

replicaRegions?

Type: ReplicaRegion[] (optional, default: Secret is not replicated)

A list of regions where to replicate this secret.

secretName?

Type: string (optional, default: A name is generated by CloudFormation.)

A name for the secret.