# Credentials

Username and password combination.

- Source: [`aws-rds/lib/props.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-rds/lib/props.ts#L197)
- Type last changed: v2.72.0 · 29 Mar 2023

## Example

```ts
declare const vpc: ec2.IVpc;

const instance1 = new rds.DatabaseInstance(this, "PostgresInstance1", {
  engine: rds.DatabaseInstanceEngine.POSTGRES,
  // Generate the secret with admin username `postgres` and random password
  credentials: rds.Credentials.fromGeneratedSecret('postgres'),
  vpc
});
// Templated secret with username and password fields
const templatedSecret = new secretsmanager.Secret(this, 'TemplatedSecret', {
  generateSecretString: {
    secretStringTemplate: JSON.stringify({ username: 'postgres' }),
    generateStringKey: 'password',
    excludeCharacters: '/@"',
  },
});
// Using the templated secret as credentials
const instance2 = new rds.DatabaseInstance(this, "PostgresInstance2", {
  engine: rds.DatabaseInstanceEngine.POSTGRES,
  credentials: {
    username: templatedSecret.secretValueFromJson('username').toString(),
    password: templatedSecret.secretValueFromJson('password')
  },
  vpc
});
```

## Initializer

```ts
new Credentials()
```

## Properties

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — KMS encryption key to encrypt the generated secret.

  **Default:** default master key

- `excludeCharacters`: string — The characters to exclude from the generated password.

  **Default:** the DatabaseSecret default exclude character set (" %+~`#$&*()|[]{}:;<>?!'/@\"\\")

  Only used if `password` has not been set.

- `password`: [SecretValue](/cdk/api/v2/docs/aws-cdk-lib.SecretValue.html) — Password.

  **Default:** a Secrets Manager generated password

  Do not put passwords in your CDK code directly.

- `replicaRegions`: [ReplicaRegion](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ReplicaRegion.html)[] — A list of regions where to replicate the generated secret.

  **Default:** Secret is not replicated

- `secret`: [ISecret](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ISecret.html) = none — Secret used to instantiate this Login.

- `secretName`: string — The name to use for the Secret if a new Secret is to be generated in SecretsManager for these Credentials.

  **Default:** A name is generated by CloudFormation.

- `username`: string — Username.

- `usernameAsString`: boolean = false — Whether the username should be referenced as a string and not as a dynamic reference to the username in the secret.

## Methods

- `fromGeneratedSecret(username: string, options?: CredentialsBaseOptions): Credentials // chainable` (static) — Creates Credentials with a password generated and stored in Secrets Manager.

- `fromPassword(username: string, password: SecretValue): Credentials // chainable` (static) — Creates Credentials from a password.

  Do not put passwords in your CDK code directly.

- `fromSecret(secret: ISecret, username?: string): Credentials // chainable` (static) — Creates Credentials from an existing Secrets Manager ``Secret`` (or ``DatabaseSecret``).

  The Secret must be a JSON string with a ``username`` and ``password`` field:
  ```
  {
    ...
    "username": <required: username>,
    "password": <required: password>,
  }
  ```

  **Parameters**

  - `secret` — The secret where the credentials are stored.
  - `username` — The username defined in the secret.

- `fromUsername(username: string, options?: CredentialsFromUsernameOptions): Credentials // chainable` (static) — Creates Credentials for the given username, and optional password and key.

  If no password is provided, one will be generated and stored in Secrets Manager.