RotationSingleUserOptions

class aws_cdk.aws_rds.RotationSingleUserOptions(*, automatically_after=None, endpoint=None, exclude_characters=None, rotate_immediately_on_update=None, security_group=None, vpc_subnets=None)

Bases: CommonRotationUserOptions

Options to add the multi user rotation.

Parameters:

  • automatically_after (Optional[Duration]) – Specifies the number of days after the previous rotation before Secrets Manager triggers the next automatic rotation. Default: - 30 days

  • endpoint (Optional[IInterfaceVpcEndpoint]) – The VPC interface endpoint to use for the Secrets Manager API. If you enable private DNS hostnames for your VPC private endpoint (the default), you don’t need to specify an endpoint. The standard Secrets Manager DNS hostname the Secrets Manager CLI and SDKs use by default (https://secretsmanager..amazonaws.com) automatically resolves to your VPC endpoint. Default: https://secretsmanager..amazonaws.com

  • exclude_characters (Optional[str]) – Specifies characters to not include in generated passwords. Default: “ %+~`#$&*()|[]{}:;<>?!’/@”"

  • rotate_immediately_on_update (Optional[bool]) – Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. Default: true

  • security_group (Optional[ISecurityGroup]) – The security group for the Lambda rotation function. Default: - a new security group is created

  • vpc_subnets (Union[SubnetSelection, Dict[str, Any], None]) – Where to place the rotation Lambda function. Default: - same placement as instance or cluster

ExampleMetadata:

infused

Example:

# instance: rds.DatabaseInstance
# my_security_group: ec2.SecurityGroup


instance.add_rotation_single_user(
    automatically_after=Duration.days(7),  # defaults to 30 days
    exclude_characters="!@#$%^&*",  # defaults to the set " %+~`#/// here*()|[]{}:;<>?!'/@"\"
    security_group=my_security_group,  # defaults to an auto-created security group
    rotate_immediately_on_update=False
)

Attributes

automatically_after

Specifies the number of days after the previous rotation before Secrets Manager triggers the next automatic rotation.

Default:

  • 30 days

endpoint

The VPC interface endpoint to use for the Secrets Manager API.

If you enable private DNS hostnames for your VPC private endpoint (the default), you don’t need to specify an endpoint. The standard Secrets Manager DNS hostname the Secrets Manager CLI and SDKs use by default (https://secretsmanager..amazonaws.com) automatically resolves to your VPC endpoint.

Default:

https://secretsmanager..amazonaws.com

exclude_characters

Specifies characters to not include in generated passwords.

Default:

“ %+~`#$&*()|[]{}:;<>?!’/@”"

rotate_immediately_on_update

Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window.

Default:

true

security_group

The security group for the Lambda rotation function.

Default:

  • a new security group is created

vpc_subnets

Where to place the rotation Lambda function.

Default:

  • same placement as instance or cluster