SecretRotation
Secret rotation for a service or database.
Example
declare const myUserSecret: secretsmanager.Secret;
declare const myMasterSecret: secretsmanager.Secret;
declare const myDatabase: ec2.IConnectable;
declare const myVpc: ec2.Vpc;
new secretsmanager.SecretRotation(this, 'SecretRotation', {
application: secretsmanager.SecretRotationApplication.MYSQL_ROTATION_MULTI_USER,
secret: myUserSecret, // The secret that will be rotated
masterSecret: myMasterSecret, // The secret used for the rotation
target: myDatabase,
vpc: myVpc,
});
# my_user_secret: secretsmanager.Secret
# my_master_secret: secretsmanager.Secret
# my_database: ec2.IConnectable
# my_vpc: ec2.Vpc
secretsmanager.SecretRotation(self, "SecretRotation",
application=secretsmanager.SecretRotationApplication.MYSQL_ROTATION_MULTI_USER,
secret=my_user_secret, # The secret that will be rotated
master_secret=my_master_secret, # The secret used for the rotation
target=my_database,
vpc=my_vpc
)
Secret myUserSecret;
Secret myMasterSecret;
IConnectable myDatabase;
Vpc myVpc;
SecretRotation.Builder.create(this, "SecretRotation")
.application(SecretRotationApplication.MYSQL_ROTATION_MULTI_USER)
.secret(myUserSecret) // The secret that will be rotated
.masterSecret(myMasterSecret) // The secret used for the rotation
.target(myDatabase)
.vpc(myVpc)
.build();
// Install: dotnet add package Amazon.CDK.Lib
Secret myUserSecret;
Secret myMasterSecret;
IConnectable myDatabase;
Vpc myVpc;
new SecretRotation(this, "SecretRotation", new SecretRotationProps {
Application = SecretRotationApplication.MYSQL_ROTATION_MULTI_USER,
Secret = myUserSecret, // The secret that will be rotated
MasterSecret = myMasterSecret, // The secret used for the rotation
Target = myDatabase,
Vpc = myVpc
});
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
var myUserSecret Secret
var myMasterSecret Secret
var myDatabase IConnectable
var myVpc Vpc
secretsmanager.NewSecretRotation(this, jsii.String("SecretRotation"), &SecretRotationProps{
Application: secretsmanager.SecretRotationApplication_MYSQL_ROTATION_MULTI_USER(),
Secret: myUserSecret,
// The secret that will be rotated
MasterSecret: myMasterSecret,
// The secret used for the rotation
Target: myDatabase,
Vpc: myVpc,
})
Initializer
new SecretRotation(scope: Construct, id: string, props: SecretRotationProps)
SecretRotation(scope: Construct, id: str, props: SecretRotationProps)
new SecretRotation(Construct scope, String id, SecretRotationProps props)
new SecretRotation(Construct scope, string id, SecretRotationProps props)
NewSecretRotation(Scope Construct, Id *string, Props SecretRotationProps)
Construct Props
applicationSecretRotationApplicationapplicationSecretRotationApplicationapplicationSecretRotationApplicationApplicationSecretRotationApplicationApplicationSecretRotationApplicationrequired#automaticallyAfterDurationautomatically_afterDurationautomaticallyAfterDurationAutomaticallyAfterDurationAutomaticallyAfterDuration= Duration.days(30)#endpointIInterfaceVpcEndpointendpointIInterfaceVpcEndpointendpointIInterfaceVpcEndpointEndpointIInterfaceVpcEndpointEndpointIInterfaceVpcEndpoint= https://secretsmanager.<region>.…#notes · default
If you enable private DNS hostnames for your VPC private endpoint (the default), you don't need to specify an endpoint. The standard Secrets Manager DNS hostname the Secrets Manager CLI and SDKs use by default (https://secretsmanager.<region>.amazonaws.com) automatically resolves to your VPC endpoint.
Default: https://secretsmanager.<region>.amazonaws.com
excludeCharactersstringexclude_charactersstrexcludeCharactersStringExcludeCharactersstringExcludeCharacters*string= no additional characters are exp…#default
Default: no additional characters are explicitly excluded
masterSecretISecretmaster_secretISecretmasterSecretISecretMasterSecretISecretMasterSecretISecret= single user rotation scheme#rotateImmediatelyOnUpdatebooleanrotate_immediately_on_updateboolrotateImmediatelyOnUpdateBooleanRotateImmediatelyOnUpdateboolRotateImmediatelyOnUpdate*bool= true#notes
{
"engine": <required: database engine>,
"host": <required: instance host name>,
"username": <required: username>,
"password": <required: password>,
"dbname": <optional: database name>,
"port": <optional: if not specified, default port will be used>,
"masterarn": <required for multi user rotation: the arn of the master secret which will be used to create users/change passwords>
}
This is typically the case for a secret referenced from an AWS::SecretsManager::SecretTargetAttachment or an ISecret returned by the attach() method of Secret.
securityGroupISecurityGroupsecurity_groupISecurityGroupsecurityGroupISecurityGroupSecurityGroupISecurityGroupSecurityGroupISecurityGroup= a new security group is created#vpcSubnetsSubnetSelectionvpc_subnetsSubnetSelectionvpcSubnetsSubnetSelectionVpcSubnetsSubnetSelectionVpcSubnetsSubnetSelection= the Vpc default strategy if not …#default
Default: the Vpc default strategy if not specified.
Properties
Methods
isConstruct(x: any): boolean@staticmethod def is_construct(x: Any) -> boolpublic static Boolean isConstruct(Object x)public static bool IsConstruct(object x)func IsConstruct(X interface{}) *boolstatic#notes · 1 parameter · returns
Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.
Parameters
xxxxX— Any object.
Returns: true if x is an object created from a class which extends Construct.
toString(): stringdef to_string(self, ) -> strpublic String toString()public string ToString()func ToString() *string#with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.
1 parameter · returns
Parameters
mixinsmixinsmixinsmixinsMixins— The mixins to apply.
Returns: This construct for chaining