> **Experimental**
>
> `@aws-cdk/aws-redshift-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# DatabaseSecret

A database secret.

Extends: Construct › Resource › Secret › DatabaseSecret
Implements: IResource, ISecret, IEnvironmentAware, ISecretRef, IConstruct, IDependable

- Stability: [Experimental](/cdk/api/stability.html)
- CloudFormation: [`AWS::SecretsManager::Secret`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-secretsmanager-secret.html)
- L1 type: [`CfnSecret`](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.CfnSecret.html)
- Source: [`lib/database-secret.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0-alpha.0/packages/@aws-cdk/aws-redshift-alpha/lib/database-secret.ts#L36)

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as redshift_alpha from '@aws-cdk/aws-redshift-alpha';
import { aws_kms as kms } from 'aws-cdk-lib';

declare const key: kms.Key;
const databaseSecret = new redshift_alpha.DatabaseSecret(this, 'MyDatabaseSecret', {
  username: 'username',

  // the properties below are optional
  encryptionKey: key,
  excludeCharacters: 'excludeCharacters',
});
```

## Initializer

```ts
new DatabaseSecret(scope: Construct, id: string, props: DatabaseSecretProps)
```

## Construct Props

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) = default master key — The KMS key to use to encrypt the secret.

- `excludeCharacters`: string = '"@/\\\ \'' — Characters to not include in the generated password.

- `username`: string (required) — The username.

## Properties

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — The customer-managed encryption key that is used to encrypt this secret, if any.

  When not specified, the default
  KMS key for the account and region is being used.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) (required) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `excludeCharacters`: string — The string of the characters that are excluded in this secret when it is generated.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) (required) — The tree node.

- `PROPERTY_INJECTION_ID`: string (required) (static) — Uniquely identifies this class.

- `secretArn`: string (required) — The ARN of the secret in AWS Secrets Manager.

  Will return the full ARN if available, otherwise a partial arn.
  For secrets imported by the deprecated `fromSecretName`, it will return the `secretName`.

- `secretFullArn`: string — The full ARN of the secret in AWS Secrets Manager, which is the ARN including the Secrets Manager-supplied 6-character suffix.

  This is equal to `secretArn` in most cases, but is undefined when a full ARN is not available (e.g., secrets imported by name).

- `secretName`: string (required) — The name of the secret.

  For "owned" secrets, this will be the full resource name (secret name + suffix), unless the
  '@aws-cdk/aws-secretsmanager:parseOwnedSecretName' feature flag is set.

- `secretRef`: [SecretReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_secretsmanager.SecretReference.html) (required) — A reference to a Secret resource.

- `secretValue`: [SecretValue](/cdk/api/v2/docs/aws-cdk-lib.SecretValue.html) (required) — Retrieve the value of the stored secret as a `SecretValue`.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) (required) — The stack in which this resource is defined.

## Methods

- `addReplicaRegion(region: string, encryptionKey?: IKeyRef): void` — Adds a replica region for the secret.

  **Parameters**

  - `region` — The name of the region.
  - `encryptionKey` — The customer-managed encryption key to use for encrypting the secret value.

- `addRotationSchedule(id: string, options: RotationScheduleOptions): RotationSchedule` — Adds a rotation schedule to the secret.

- `addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult` — Adds a statement to the IAM resource policy associated with this secret.

  If this secret was created in this stack, a resource policy will be
  automatically created upon the first call to `addToResourcePolicy`. If
  the secret is imported, then this is a no-op.

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `attach(target: ISecretAttachmentTarget): ISecret` — Attach a target to this secret.

  **Parameters**

  - `target` — The target to attach.

  **Returns:** An attached secret

- `cfnDynamicReferenceKey(options?: SecretsManagerSecretOptions): string` — Returns a key which can be used within an AWS CloudFormation dynamic reference to dynamically load this secret from AWS Secrets Manager.

  **Parameters**

  - `options` — Options.

- `denyAccountRootDelete(): void` — Denies the `DeleteSecret` action to all principals within the current account.

- `fromSecretAttributes(scope: Construct, id: string, attrs: SecretAttributes): ISecret` (static) — Import an existing secret into the Stack.

  **Parameters**

  - `scope` — the scope of the import.
  - `id` — the ID of the imported Secret in the construct tree.
  - `attrs` — the attributes of the imported secret.

- `fromSecretCompleteArn(scope: Construct, id: string, secretCompleteArn: string): ISecret` (static) — Imports a secret by complete ARN.

  The complete ARN is the ARN with the Secrets Manager-supplied suffix.

- `fromSecretNameV2(scope: Construct, id: string, secretName: string): ISecret` (static) — Imports a secret by secret name.

  A secret with this name must exist in the same account & region.
  Replaces the deprecated `fromSecretName`.
  Please note this method returns ISecret that only contains partial ARN and could lead to AccessDeniedException
  when you pass the partial ARN to CLI or SDK to get the secret value. If your secret name ends with a hyphen and
  6 characters, you should always use fromSecretCompleteArn() to avoid potential AccessDeniedException.

- `fromSecretPartialArn(scope: Construct, id: string, secretPartialArn: string): ISecret` (static) — Imports a secret by partial ARN.

  The partial ARN is the ARN without the Secrets Manager-supplied suffix.

- `grantRead(grantee: IGrantable, versionStages?: string[]): Grant` — [disable-awslint:no-grants].

- `grantWrite(grantee: IGrantable): Grant` — [disable-awslint:no-grants].

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `isSecret(x: any): boolean` (static) — Return whether the given object is a Secret.

- `secretValueFromJson(jsonField: string): SecretValue` — Interpret the secret as a JSON object and return a field's value from it as a `SecretValue`.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.