DatabaseProxyProps Struct

Construction properties for a DatabaseProxy.

Source: aws-rds/lib/proxy.ts

Example

declare const vpc: ec2.Vpc;
const instance = new rds.DatabaseInstance(this, 'Database', {
  engine: rds.DatabaseInstanceEngine.postgres({
    version: rds.PostgresEngineVersion.VER_17_7,
  }),
  vpc,
  iamAuthentication: true,
});

const proxy = new rds.DatabaseProxy(this, 'Proxy', {
  proxyTarget: rds.ProxyTarget.fromInstance(instance),
  vpc,
  defaultAuthScheme: rds.DefaultAuthScheme.IAM_AUTH, // No secrets required
});

// Grant IAM permissions for database connection
const role = new iam.Role(this, 'DBRole', { assumedBy: new iam.AccountPrincipal(this.account) });
proxy.grantConnect(role, 'database-user'); // Database user must be specified when using IAM auth

Properties

borrowTimeoutDurationborrow_timeoutDurationborrowTimeoutDurationBorrowTimeoutDurationBorrowTimeoutDuration= cdk.Duration.seconds(120)#

The duration for a proxy to wait for a connection to become available in the connection pool.

Only applies when the proxy has opened its maximum number of connections and all connections are busy with client sessions.

Value must be between 1 second and 1 hour, or Duration.seconds(0) to represent unlimited.

clientPasswordAuthTypeClientPasswordAuthTypeclient_password_auth_typeClientPasswordAuthTypeclientPasswordAuthTypeClientPasswordAuthTypeClientPasswordAuthTypeClientPasswordAuthTypeClientPasswordAuthTypeClientPasswordAuthType= CloudFormation defaults will app…#

Specifies the details of authentication used by a proxy to log in as a specific database user.

default

Default: CloudFormation defaults will apply given the specified database engine.

dbProxyNamestringdb_proxy_namestrdbProxyNameStringDbProxyNamestringDbProxyName*string= Generated by CloudFormation (rec…#

The identifier for the proxy.

notes · default

This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens.

Default: Generated by CloudFormation (recommended)

debugLoggingbooleandebug_loggingbooldebugLoggingBooleanDebugLoggingboolDebugLogging*bool= false#

Whether the proxy includes detailed information about SQL statements in its logs.

notes

This information helps you to debug issues involving SQL behavior or the performance and scalability of the proxy connections. The debug information includes the text of SQL statements that you submit through the proxy. Thus, only enable this setting when needed for debugging, and only when you have security measures in place to safeguard any sensitive information that appears in the logs.

defaultAuthSchemeDefaultAuthSchemedefault_auth_schemeDefaultAuthSchemedefaultAuthSchemeDefaultAuthSchemeDefaultAuthSchemeDefaultAuthSchemeDefaultAuthSchemeDefaultAuthScheme= DefaultAuthScheme.NONE#

The default authentication scheme that the proxy uses for client connections to the proxy and connections from the proxy to the underlying database.

When set to DefaultAuthScheme.IAM_AUTH, the proxy uses end-to-end IAM authentication to connect to the database.

iamAuthbooleaniam_authbooliamAuthBooleanIamAuthboolIamAuth*bool= false#

Whether to require or disallow AWS Identity and Access Management (IAM) authentication for connections to the proxy.

idleClientTimeoutDurationidle_client_timeoutDurationidleClientTimeoutDurationIdleClientTimeoutDurationIdleClientTimeoutDuration= cdk.Duration.minutes(30)#

The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it.

You can set this value higher or lower than the connection timeout limit for the associated database.

initQuerystringinit_querystrinitQueryStringInitQuerystringInitQuery*string= no initialization query#

One or more SQL statements for the proxy to run when opening each new database connection.

notes

Typically used with SET statements to make sure that each connection has identical settings such as time zone and character set. For multiple statements, use semicolons as the separator. You can also include multiple variables in a single SET statement, such as SET x=1, y=2.

not currently supported for PostgreSQL.

maxConnectionsPercentnumbermax_connections_percentint | floatmaxConnectionsPercentNumberMaxConnectionsPercentdoubleMaxConnectionsPercent*float64= 100#

The maximum size of the connection pool for each target in a target group.

For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group.

1-100

maxIdleConnectionsPercentnumbermax_idle_connections_percentint | floatmaxIdleConnectionsPercentNumberMaxIdleConnectionsPercentdoubleMaxIdleConnectionsPercent*float64= 50#

Controls how actively the proxy closes idle database connections in the connection pool.

notes

A high value enables the proxy to leave a high percentage of idle connections open. A low value causes the proxy to close idle client connections and return the underlying database connections to the connection pool. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group.

between 0 and MaxConnectionsPercent

proxyTargetProxyTargetproxy_targetProxyTargetproxyTargetProxyTargetProxyTargetProxyTargetProxyTargetProxyTargetrequired#

DB proxy target: Instance or Cluster.

requireTLSbooleanrequire_tlsboolrequireTLSBooleanRequireTLSboolRequireTLS*bool= true#

A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy.

By enabling this setting, you can enforce encrypted TLS connections to the proxy.

roleIRoleroleIRoleroleIRoleRoleIRoleRoleIRole= A role will automatically be cre…#

IAM role that the proxy uses to access secrets in AWS Secrets Manager.

default

Default: A role will automatically be created

secretsISecret[]secretstyping.List[ISecret]secretsList<ISecret>SecretsISecret[]Secrets*[]ISecret= None#

The secret that the proxy uses to authenticate to the RDS DB instance or Aurora DB cluster.

These secrets are stored within Amazon Secrets Manager. One or more secrets are required when defaultAuthScheme is DefaultAuthScheme.NONE.

securityGroupsISecurityGroup[]security_groupstyping.List[ISecurityGroup]securityGroupsList<ISecurityGroup>SecurityGroupsISecurityGroup[]SecurityGroups*[]ISecurityGroup= No security groups#

One or more VPC security groups to associate with the new proxy.

sessionPinningFiltersSessionPinningFilter[]session_pinning_filterstyping.List[SessionPinningFilter]sessionPinningFiltersList<SessionPinningFilter>SessionPinningFiltersSessionPinningFilter[]SessionPinningFilters*[]SessionPinningFilter= no session pinning filters#

Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection.

Including an item in the list exempts that class of SQL operations from the pinning behavior.

vpcIVpcvpcIVpcvpcIVpcVpcIVpcVpcIVpcrequired#

The VPC to associate with the new proxy.

vpcSubnetsSubnetSelectionvpc_subnetsSubnetSelectionvpcSubnetsSubnetSelectionVpcSubnetsSubnetSelectionVpcSubnetsSubnetSelection= the VPC default strategy if not …#

The subnets used by the proxy.

default

Default: the VPC default strategy if not specified.

Used as props by

DatabaseProxy

DatabaseProxyProps Struct ​

Example ​

Properties ​

Used as props by ​

DatabaseProxyProps Struct

Example

Properties

Used as props by