DatabaseSecretProps Struct
Construction properties for a DatabaseSecret.
Example
ts
// Create username and password secret for DB Cluster
const secret = new rds.DatabaseSecret(this, 'AuroraSecret', {
username: 'clusteradmin',
});
// The VPC to place the cluster in
const vpc = new ec2.Vpc(this, 'AuroraVpc');
// Create the serverless cluster, provide all values needed to customise the database.
const cluster = new rds.ServerlessCluster(this, 'AuroraCluster', {
engine: rds.DatabaseClusterEngine.AURORA_MYSQL,
vpc,
credentials: { username: 'clusteradmin' },
clusterIdentifier: 'db-endpoint-test',
defaultDatabaseName: 'demos',
});
// Build a data source for AppSync to access the database.
declare const api: appsync.GraphqlApi;
const rdsDS = api.addRdsDataSource('rds', cluster, secret, 'demos');
// Set up a resolver for an RDS query.
rdsDS.createResolver('QueryGetDemosRdsResolver', {
typeName: 'Query',
fieldName: 'getDemosRds',
requestMappingTemplate: appsync.MappingTemplate.fromString(`
{
"version": "2018-05-29",
"statements": [
"SELECT * FROM demos"
]
}
`),
responseMappingTemplate: appsync.MappingTemplate.fromString(`
$utils.toJson($utils.rds.toJsonObject($ctx.result)[0])
`),
});
// Set up a resolver for an RDS mutation.
rdsDS.createResolver('MutationAddDemoRdsResolver', {
typeName: 'Mutation',
fieldName: 'addDemoRds',
requestMappingTemplate: appsync.MappingTemplate.fromString(`
{
"version": "2018-05-29",
"statements": [
"INSERT INTO demos VALUES (:id, :version)",
"SELECT * WHERE id = :id"
],
"variableMap": {
":id": $util.toJson($util.autoId()),
":version": $util.toJson($ctx.args.version)
}
}
`),
responseMappingTemplate: appsync.MappingTemplate.fromString(`
$utils.toJson($utils.rds.toJsonObject($ctx.result)[1][0])
`),
});
Properties
The database name, if not using the default one.
Default: whatever the secret generates after the attach method is run
encryptionKeyoptionalIKeyencryption_keyoptionalIKeyencryptionKeyoptionalIKeyEncryptionKeyoptionalIKeyEncryptionKeyoptionalIKey#The KMS key to use to encrypt the secret.
Default: default master key
excludeCharactersoptionalstringexclude_charactersoptionalstrexcludeCharactersoptionalStringExcludeCharactersoptionalstringExcludeCharactersoptional*string#Characters to not include in the generated password.
Default: " %+~`#$&*()|[]{}:;<>?!'/@"\"
masterSecretoptionalISecretmaster_secretoptionalISecretmasterSecretoptionalISecretMasterSecretoptionalISecretMasterSecretoptionalISecret#The master secret which will be used to rotate this secret.
Default: no master secret information will be included
replaceOnPasswordCriteriaChangesoptionalbooleanreplace_on_password_criteria_changesoptionalboolreplaceOnPasswordCriteriaChangesoptionalBooleanReplaceOnPasswordCriteriaChangesoptionalboolReplaceOnPasswordCriteriaChangesoptional*bool= false#Whether to replace this secret when the criteria for the password change.
notes
This is achieved by overriding the logical id of the AWS::SecretsManager::Secret with a hash of the options that influence the password generation. This way a new secret will be created when the password is regenerated and the cluster or instance consuming this secret will have its credentials updated.
replicaRegionsoptionalReplicaRegion[]replica_regionsoptionaltyping.List[ReplicaRegion]replicaRegionsoptionalList<ReplicaRegion>ReplicaRegionsoptionalReplicaRegion[]ReplicaRegionsoptional*[]ReplicaRegion#A list of regions where to replicate this secret.
Default: Secret is not replicated
secretNameoptionalstringsecret_nameoptionalstrsecretNameoptionalStringSecretNameoptionalstringSecretNameoptional*string#A name for the secret.
Default: A name is generated by CloudFormation.
The username.