DatabaseProxy L2 construct
RDS Database Proxy.
Example
declare const vpc: ec2.Vpc;
const cluster = new rds.DatabaseCluster(this, 'Database', {
engine: rds.DatabaseClusterEngine.auroraMysql({
version: rds.AuroraMysqlEngineVersion.VER_3_03_0,
}),
writer: rds.ClusterInstance.provisioned('writer'),
vpc,
});
const proxy = new rds.DatabaseProxy(this, 'Proxy', {
proxyTarget: rds.ProxyTarget.fromCluster(cluster),
secrets: [cluster.secret!],
vpc,
clientPasswordAuthType: rds.ClientPasswordAuthType.MYSQL_NATIVE_PASSWORD,
});
# vpc: ec2.Vpc
cluster = rds.DatabaseCluster(self, "Database",
engine=rds.DatabaseClusterEngine.aurora_mysql(
version=rds.AuroraMysqlEngineVersion.VER_3_03_0
),
writer=rds.ClusterInstance.provisioned("writer"),
vpc=vpc
)
proxy = rds.DatabaseProxy(self, "Proxy",
proxy_target=rds.ProxyTarget.from_cluster(cluster),
secrets=[cluster.secret],
vpc=vpc,
client_password_auth_type=rds.ClientPasswordAuthType.MYSQL_NATIVE_PASSWORD
)
Vpc vpc;
DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
.engine(DatabaseClusterEngine.auroraMysql(AuroraMysqlClusterEngineProps.builder()
.version(AuroraMysqlEngineVersion.VER_3_03_0)
.build()))
.writer(ClusterInstance.provisioned("writer"))
.vpc(vpc)
.build();
DatabaseProxy proxy = DatabaseProxy.Builder.create(this, "Proxy")
.proxyTarget(ProxyTarget.fromCluster(cluster))
.secrets(List.of(cluster.getSecret()))
.vpc(vpc)
.clientPasswordAuthType(ClientPasswordAuthType.MYSQL_NATIVE_PASSWORD)
.build();
// Install: dotnet add package Amazon.CDK.Lib
Vpc vpc;
var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
Engine = DatabaseClusterEngine.AuroraMysql(new AuroraMysqlClusterEngineProps {
Version = AuroraMysqlEngineVersion.VER_3_03_0
}),
Writer = ClusterInstance.Provisioned("writer"),
Vpc = vpc
});
var proxy = new DatabaseProxy(this, "Proxy", new DatabaseProxyProps {
ProxyTarget = ProxyTarget.FromCluster(cluster),
Secrets = new [] { cluster.Secret },
Vpc = vpc,
ClientPasswordAuthType = ClientPasswordAuthType.MYSQL_NATIVE_PASSWORD
});
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
var vpc Vpc
cluster := rds.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
Engine: rds.DatabaseClusterEngine_AuroraMysql(&AuroraMysqlClusterEngineProps{
Version: rds.AuroraMysqlEngineVersion_VER_3_03_0(),
}),
Writer: rds.ClusterInstance_Provisioned(jsii.String("writer")),
Vpc: Vpc,
})
proxy := rds.NewDatabaseProxy(this, jsii.String("Proxy"), &DatabaseProxyProps{
ProxyTarget: rds.ProxyTarget_FromCluster(cluster),
Secrets: []ISecret{
cluster.Secret,
},
Vpc: Vpc,
ClientPasswordAuthType: rds.ClientPasswordAuthType_MYSQL_NATIVE_PASSWORD,
})
Initializer
new DatabaseProxy(scope: Construct, id: string, props: DatabaseProxyProps)
DatabaseProxy(scope: Construct, id: str, props: DatabaseProxyProps)
new DatabaseProxy(Construct scope, String id, DatabaseProxyProps props)
new DatabaseProxy(Construct scope, string id, DatabaseProxyProps props)
NewDatabaseProxy(Scope Construct, Id *string, Props DatabaseProxyProps)
Construct Props
borrowTimeoutDurationborrow_timeoutDurationborrowTimeoutDurationBorrowTimeoutDurationBorrowTimeoutDuration= cdk.Duration.seconds(120)#Only applies when the proxy has opened its maximum number of connections and all connections are busy with client sessions.
Value must be between 1 second and 1 hour, or Duration.seconds(0) to represent unlimited.
clientPasswordAuthTypeClientPasswordAuthTypeclient_password_auth_typeClientPasswordAuthTypeclientPasswordAuthTypeClientPasswordAuthTypeClientPasswordAuthTypeClientPasswordAuthTypeClientPasswordAuthTypeClientPasswordAuthType= CloudFormation defaults will app…#default
Default: CloudFormation defaults will apply given the specified database engine.
dbProxyNamestringdb_proxy_namestrdbProxyNameStringDbProxyNamestringDbProxyName*string= Generated by CloudFormation (rec…#notes · default
This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens.
Default: Generated by CloudFormation (recommended)
notes
This information helps you to debug issues involving SQL behavior or the performance and scalability of the proxy connections. The debug information includes the text of SQL statements that you submit through the proxy. Thus, only enable this setting when needed for debugging, and only when you have security measures in place to safeguard any sensitive information that appears in the logs.
defaultAuthSchemeDefaultAuthSchemedefault_auth_schemeDefaultAuthSchemedefaultAuthSchemeDefaultAuthSchemeDefaultAuthSchemeDefaultAuthSchemeDefaultAuthSchemeDefaultAuthScheme= DefaultAuthScheme.NONE#When set to DefaultAuthScheme.IAM_AUTH, the proxy uses end-to-end IAM authentication to connect to the database.
idleClientTimeoutDurationidle_client_timeoutDurationidleClientTimeoutDurationIdleClientTimeoutDurationIdleClientTimeoutDuration= cdk.Duration.minutes(30)#You can set this value higher or lower than the connection timeout limit for the associated database.
initQuerystringinit_querystrinitQueryStringInitQuerystringInitQuery*string= no initialization query#notes
Typically used with SET statements to make sure that each connection has identical settings such as time zone and character set. For multiple statements, use semicolons as the separator. You can also include multiple variables in a single SET statement, such as SET x=1, y=2.
not currently supported for PostgreSQL.
maxConnectionsPercentnumbermax_connections_percentint | floatmaxConnectionsPercentNumberMaxConnectionsPercentdoubleMaxConnectionsPercent*float64= 100#For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group.
1-100
maxIdleConnectionsPercentnumbermax_idle_connections_percentint | floatmaxIdleConnectionsPercentNumberMaxIdleConnectionsPercentdoubleMaxIdleConnectionsPercent*float64= 50#notes
A high value enables the proxy to leave a high percentage of idle connections open. A low value causes the proxy to close idle client connections and return the underlying database connections to the connection pool. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group.
between 0 and MaxConnectionsPercent
proxyTargetProxyTargetproxy_targetProxyTargetproxyTargetProxyTargetProxyTargetProxyTargetProxyTargetProxyTargetrequired#By enabling this setting, you can enforce encrypted TLS connections to the proxy.
default
Default: A role will automatically be created
secretsISecret[]secretstyping.List[ISecret]secretsList<ISecret>SecretsISecret[]Secrets*[]ISecret= None#These secrets are stored within Amazon Secrets Manager. One or more secrets are required when defaultAuthScheme is DefaultAuthScheme.NONE.
securityGroupsISecurityGroup[]security_groupstyping.List[ISecurityGroup]securityGroupsList<ISecurityGroup>SecurityGroupsISecurityGroup[]SecurityGroups*[]ISecurityGroup= No security groups#sessionPinningFiltersSessionPinningFilter[]session_pinning_filterstyping.List[SessionPinningFilter]sessionPinningFiltersList<SessionPinningFilter>SessionPinningFiltersSessionPinningFilter[]SessionPinningFilters*[]SessionPinningFilter= no session pinning filters#Including an item in the list exempts that class of SQL operations from the pinning behavior.
vpcSubnetsSubnetSelectionvpc_subnetsSubnetSelectionvpcSubnetsSubnetSelectionVpcSubnetsSubnetSelectionVpcSubnetsSubnetSelection= the VPC default strategy if not …#default
Default: the VPC default strategy if not specified.
Properties
connectionsConnectionsconnectionsConnectionsconnectionsConnectionsConnectionsConnectionsConnectionsConnectionsrequired#dbProxyRefDBProxyReferencedb_proxy_refDBProxyReferencedbProxyRefDBProxyReferenceDbProxyRefDBProxyReferenceDbProxyRefDBProxyReferencerequired#envResourceEnvironmentenvResourceEnvironmentenvResourceEnvironmentEnvResourceEnvironmentEnvResourceEnvironmentrequired#notes
For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.
For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.
PROPERTY_INJECTION_IDstringproperty_injection_idstrPROPERTY_INJECTION_IDStringPROPERTY_INJECTION_IDstringPROPERTY_INJECTION_ID*stringrequiredstatic#Methods
addEndpoint(id: string, options?: DatabaseProxyEndpointOptions): IDatabaseProxyEndpointdef add_endpoint(self, id: str, options: typing.Optional[DatabaseProxyEndpointOptions] = None) -> IDatabaseProxyEndpointpublic IDatabaseProxyEndpoint addEndpoint(String id, DatabaseProxyEndpointOptions options)public IDatabaseProxyEndpoint AddEndpoint(string id, DatabaseProxyEndpointOptions? options = null)func AddEndpoint(Id *string, Options DatabaseProxyEndpointOptions) IDatabaseProxyEndpoint#applyCrossStackReferenceStrength(strength: ReferenceStrength): voiddef apply_cross_stack_reference_strength(self, strength: ReferenceStrength) -> Nonepublic void applyCrossStackReferenceStrength(ReferenceStrength strength)public void ApplyCrossStackReferenceStrength(ReferenceStrength strength)func ApplyCrossStackReferenceStrength(Strength ReferenceStrength)#notes · 1 parameter
When set, any cross-stack reference to this resource will use the specified mechanism instead of the global default determined by the @aws-cdk/core:defaultCrossStackReferences context key. This is useful for selectively weakening specific references to avoid the "deadly embrace" problem without changing the app-wide default.
Parameters
strengthstrengthstrengthstrengthStrength— - The reference strength to use for this resource.
applyRemovalPolicy(policy: RemovalPolicy): voiddef apply_removal_policy(self, policy: RemovalPolicy) -> Nonepublic void applyRemovalPolicy(RemovalPolicy policy)public void ApplyRemovalPolicy(RemovalPolicy policy)func ApplyRemovalPolicy(Policy RemovalPolicy)#notes
The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.
The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).
asSecretAttachmentTarget(): SecretAttachmentTargetPropsdef as_secret_attachment_target(self, ) -> SecretAttachmentTargetPropspublic SecretAttachmentTargetProps asSecretAttachmentTarget()public SecretAttachmentTargetProps AsSecretAttachmentTarget()func AsSecretAttachmentTarget() SecretAttachmentTargetProps#fromDatabaseProxyAttributes(scope: Construct, id: string, attrs: DatabaseProxyAttributes): IDatabaseProxy@staticmethod def from_database_proxy_attributes(scope: Construct, id: str, attrs: DatabaseProxyAttributes) -> IDatabaseProxypublic static IDatabaseProxy fromDatabaseProxyAttributes(Construct scope, String id, DatabaseProxyAttributes attrs)public static IDatabaseProxy FromDatabaseProxyAttributes(Construct scope, string id, DatabaseProxyAttributes attrs)func FromDatabaseProxyAttributes(Scope Construct, Id *string, Attrs DatabaseProxyAttributes) IDatabaseProxystatic#grantConnect(grantee: IGrantable, dbUser?: string): Grantdef grant_connect(self, grantee: IGrantable, db_user: typing.Optional[str] = None) -> Grantpublic Grant grantConnect(IGrantable grantee, String dbUser)public Grant GrantConnect(IGrantable grantee, string? dbUser = null)func GrantConnect(Grantee IGrantable, DbUser *string) Grant#isConstruct(x: any): boolean@staticmethod def is_construct(x: Any) -> boolpublic static Boolean isConstruct(Object x)public static bool IsConstruct(object x)func IsConstruct(X interface{}) *boolstatic#notes · 1 parameter · returns
Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.
Parameters
xxxxX— Any object.
Returns: true if x is an object created from a class which extends Construct.
isOwnedResource(construct: IConstruct): boolean@staticmethod def is_owned_resource(construct: IConstruct) -> boolpublic static Boolean isOwnedResource(IConstruct construct)public static bool IsOwnedResource(IConstruct construct)func IsOwnedResource(Construct IConstruct) *boolstatic#isResource(construct: IConstruct): boolean@staticmethod def is_resource(construct: IConstruct) -> boolpublic static Boolean isResource(IConstruct construct)public static bool IsResource(IConstruct construct)func IsResource(Construct IConstruct) *boolstatic#toString(): stringdef to_string(self, ) -> strpublic String toString()public string ToString()func ToString() *string#with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.