# CredentialsBaseOptions

Base options for creating Credentials.

- Source: [`aws-rds/lib/props.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-rds/lib/props.ts#L149)
- Type last changed: v2.72.0 · 29 Mar 2023

## Example

```ts
declare const vpc: ec2.Vpc;
const engine = rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_16_3 });
const myKey = new kms.Key(this, 'MyKey');

new rds.DatabaseInstance(this, 'InstanceWithCustomizedSecret', {
  engine,
  vpc,
  credentials: rds.Credentials.fromGeneratedSecret('postgres', {
    secretName: 'my-cool-name',
    encryptionKey: myKey,
    excludeCharacters: '!&*^#@()',
    replicaRegions: [{ region: 'eu-west-1' }, { region: 'eu-west-2' }],
  }),
});
```

## Properties

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — KMS encryption key to encrypt the generated secret.

  **Default:** default master key

- `excludeCharacters`: string — The characters to exclude from the generated password.

  **Default:** the DatabaseSecret default exclude character set (" %+~`#$&*()|[]{}:;<>?!'/@\"\\")

  Has no effect if `password` has been provided.

- `replicaRegions`: [ReplicaRegion](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ReplicaRegion.html)[] — A list of regions where to replicate this secret.

  **Default:** Secret is not replicated

- `secretName`: string — The name of the secret.

  **Default:** A name is generated by CloudFormation.