# DatabaseSecretProps

Construction properties for a DatabaseSecret.

Extends: DatabaseSecretProps
Used as props by: DatabaseSecret

- Source: [`aws-rds/lib/database-secret.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-rds/lib/database-secret.ts#L13)
- Type last changed: v2.73.0 · 6 Apr 2023

## Example

```ts
// Create username and password secret for DB Cluster
const secret = new rds.DatabaseSecret(this, 'AuroraSecret', {
  username: 'clusteradmin',
});

// The VPC to place the cluster in
const vpc = new ec2.Vpc(this, 'AuroraVpc');

// Create the serverless cluster, provide all values needed to customise the database.
const cluster = new rds.ServerlessCluster(this, 'AuroraCluster', {
  engine: rds.DatabaseClusterEngine.AURORA_MYSQL,
  vpc,
  credentials: { username: 'clusteradmin' },
  clusterIdentifier: 'db-endpoint-test',
  defaultDatabaseName: 'demos',
});

// Build a data source for AppSync to access the database.
declare const api: appsync.GraphqlApi;
const rdsDS = api.addRdsDataSource('rds', cluster, secret, 'demos');

// Set up a resolver for an RDS query.
rdsDS.createResolver('QueryGetDemosRdsResolver', {
  typeName: 'Query',
  fieldName: 'getDemosRds',
  requestMappingTemplate: appsync.MappingTemplate.fromString(`
  {
    "version": "2018-05-29",
    "statements": [
      "SELECT * FROM demos"
    ]
  }
  `),
  responseMappingTemplate: appsync.MappingTemplate.fromString(`
    $utils.toJson($utils.rds.toJsonObject($ctx.result)[0])
  `),
});

// Set up a resolver for an RDS mutation.
rdsDS.createResolver('MutationAddDemoRdsResolver', {
  typeName: 'Mutation',
  fieldName: 'addDemoRds',
  requestMappingTemplate: appsync.MappingTemplate.fromString(`
  {
    "version": "2018-05-29",
    "statements": [
      "INSERT INTO demos VALUES (:id, :version)",
      "SELECT * WHERE id = :id"
    ],
    "variableMap": {
      ":id": $util.toJson($util.autoId()),
      ":version": $util.toJson($ctx.args.version)
    }
  }
  `),
  responseMappingTemplate: appsync.MappingTemplate.fromString(`
    $utils.toJson($utils.rds.toJsonObject($ctx.result)[1][0])
  `),
});
```

## Properties

- `dbname`: string — The database name, if not using the default one.

  **Default:** whatever the secret generates after the attach method is run

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — The KMS key to use to encrypt the secret.

  **Default:** default master key

- `excludeCharacters`: string — Characters to not include in the generated password.

  **Default:** " %+~`#$&*()|[]{}:;<>?!'/@\"\\"

- `masterSecret`: [ISecret](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ISecret.html) — The master secret which will be used to rotate this secret.

  **Default:** no master secret information will be included

- `replaceOnPasswordCriteriaChanges`: boolean = false — Whether to replace this secret when the criteria for the password change.

  This is achieved by overriding the logical id of the AWS::SecretsManager::Secret
  with a hash of the options that influence the password generation. This
  way a new secret will be created when the password is regenerated and the
  cluster or instance consuming this secret will have its credentials updated.

- `replicaRegions`: [ReplicaRegion](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ReplicaRegion.html)[] — A list of regions where to replicate this secret.

  **Default:** Secret is not replicated

- `secretName`: string — A name for the secret.

  **Default:** A name is generated by CloudFormation.

- `username`: string (required) — The username.