Skip to content

Commit b9ce0ee

Browse files
hsohail94hsohail94
authored
feat(rds): Add dbname parameter to RDS.DatabaseSecret construct (#24729)
As explained under #24728, this PR adds the ability to define a custom database name in the Secrets Manager resource created by the DatabaseSecret construct under @aws-cdk/rds, so that when this secret is pulled by client code and used to set database connection parameters, it can connect to a database of its choosing, rather than using the default database created by the RDS cluster that the secret gets attached to. Closes #24728. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 016e206 commit b9ce0ee

12 files changed

+950
-0
lines changed

‎packages/@aws-cdk/aws-rds/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -386,6 +386,7 @@ declare const instance: rds.DatabaseInstance;
386386
const myUserSecret = new rds.DatabaseSecret(this, 'MyUserSecret', {
387387
username: 'myuser',
388388
secretName: 'my-user-secret', // optional, defaults to a CloudFormation-generated name
389+
dbname: 'mydb', //optional, defaults to the main database of the RDS cluster this secret gets attached to
389390
masterSecret: instance.secret,
390391
excludeCharacters: '{}[]()\'"/\\', // defaults to the set " %+~`#$&*()|[]{}:;<>?!'/@\"\\"
391392
});

‎packages/@aws-cdk/aws-rds/lib/database-secret.ts

+8
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,13 @@ export interface DatabaseSecretProps {
1414
*/
1515
readonly username: string;
1616

17+
/**
18+
* The database name, if not using the default one
19+
*
20+
* @default - whatever the secret generates after the attach method is run
21+
*/
22+
readonly dbname?: string;
23+
1724
/**
1825
* A name for the secret.
1926
*
@@ -79,6 +86,7 @@ export class DatabaseSecret extends secretsmanager.Secret {
7986
passwordLength: 30, // Oracle password cannot have more than 30 characters
8087
secretStringTemplate: JSON.stringify({
8188
username: props.username,
89+
dbname: props.dbname,
8290
masterarn: props.masterSecret?.secretArn,
8391
}),
8492
generateStringKey: 'password',

‎packages/@aws-cdk/aws-rds/test/database-secret.test.ts

+36
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,42 @@ describe('database secret', () => {
3737
expect(getSecretLogicalId(dbSecret, stack)).toEqual('SecretA720EF05');
3838
});
3939

40+
test('create a database secret with a database name and secret name', () => {
41+
// GIVEN
42+
const stack = new Stack();
43+
44+
// WHEN
45+
const customDbSecret = new DatabaseSecret(stack, 'Secret', {
46+
username: 'admin-username',
47+
dbname: 'admindb',
48+
secretName: 'admin-secret',
49+
});
50+
51+
// THEN
52+
Template.fromStack(stack).hasResourceProperties('AWS::SecretsManager::Secret', {
53+
Description: {
54+
'Fn::Join': [
55+
'',
56+
[
57+
'Generated by the CDK for stack: ',
58+
{
59+
Ref: 'AWS::StackName',
60+
},
61+
],
62+
],
63+
},
64+
Name: 'admin-secret',
65+
GenerateSecretString: {
66+
ExcludeCharacters: DEFAULT_PASSWORD_EXCLUDE_CHARS,
67+
GenerateStringKey: 'password',
68+
PasswordLength: 30,
69+
SecretStringTemplate: '{"username":"admin-username","dbname":"admindb"}',
70+
},
71+
});
72+
73+
expect(getSecretLogicalId(customDbSecret, stack)).toEqual('SecretA720EF05');
74+
});
75+
4076
test('with master secret', () => {
4177
// GIVEN
4278
const stack = new Stack();

‎packages/@aws-cdk/aws-rds/test/integ.serverless-cluster-secret-rotation-custom-names.js.snapshot/aws-cdk-rds-integ-secret-rotation.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"c5b5b61dbdfaaef8d13f4a204e19f2cc7e8b0f268b59a82d2f05abc5c1144015": {
5+
"source": {
6+
"path": "aws-cdk-rds-integ-secret-rotation.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "c5b5b61dbdfaaef8d13f4a204e19f2cc7e8b0f268b59a82d2f05abc5c1144015.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-rds/test/integ.serverless-cluster-secret-rotation-custom-names.js.snapshot/aws-cdk-rds-integ-secret-rotation.template.json

+235
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
{
2+
"Transform": "AWS::SecretsManager-2020-07-23",
3+
"Resources": {
4+
"DbSecurity381C2C15": {
5+
"Type": "AWS::KMS::Key",
6+
"Properties": {
7+
"KeyPolicy": {
8+
"Statement": [
9+
{
10+
"Action": "kms:*",
11+
"Effect": "Allow",
12+
"Principal": {
13+
"AWS": {
14+
"Fn::Join": [
15+
"",
16+
[
17+
"arn:",
18+
{
19+
"Ref": "AWS::Partition"
20+
},
21+
":iam::",
22+
{
23+
"Ref": "AWS::AccountId"
24+
},
25+
":root"
26+
]
27+
]
28+
}
29+
},
30+
"Resource": "*"
31+
}
32+
],
33+
"Version": "2012-10-17"
34+
}
35+
},
36+
"UpdateReplacePolicy": "Retain",
37+
"DeletionPolicy": "Retain"
38+
},
39+
"testsecretF8BBC644": {
40+
"Type": "AWS::SecretsManager::Secret",
41+
"Properties": {
42+
"Description": {
43+
"Fn::Join": [
44+
"",
45+
[
46+
"Generated by the CDK for stack: ",
47+
{
48+
"Ref": "AWS::StackName"
49+
}
50+
]
51+
]
52+
},
53+
"GenerateSecretString": {
54+
"ExcludeCharacters": " %+~`#$&*()|[]{}:;<>?!'/@\"\\",
55+
"GenerateStringKey": "password",
56+
"PasswordLength": 30,
57+
"SecretStringTemplate": "{\"username\":\"admin\",\"dbname\":\"admindb\"}"
58+
},
59+
"Name": "admin-secret"
60+
},
61+
"UpdateReplacePolicy": "Delete",
62+
"DeletionPolicy": "Delete"
63+
},
64+
"testsecretAttachment19AD251F": {
65+
"Type": "AWS::SecretsManager::SecretTargetAttachment",
66+
"Properties": {
67+
"SecretId": {
68+
"Ref": "testsecretF8BBC644"
69+
},
70+
"TargetId": {
71+
"Ref": "DatabaseB269D8BB"
72+
},
73+
"TargetType": "AWS::RDS::DBCluster"
74+
}
75+
},
76+
"testsecrettestscheduleEA0B5085": {
77+
"Type": "AWS::SecretsManager::RotationSchedule",
78+
"Properties": {
79+
"SecretId": {
80+
"Ref": "testsecretF8BBC644"
81+
},
82+
"HostedRotationLambda": {
83+
"ExcludeCharacters": " %+~`#$&*()|[]{}:;<>?!'/@\"\\",
84+
"RotationType": "MySQLSingleUser"
85+
},
86+
"RotationRules": {
87+
"AutomaticallyAfterDays": 30
88+
}
89+
}
90+
},
91+
"testsecretPolicyA5D2F46F": {
92+
"Type": "AWS::SecretsManager::ResourcePolicy",
93+
"Properties": {
94+
"ResourcePolicy": {
95+
"Statement": [
96+
{
97+
"Action": "secretsmanager:DeleteSecret",
98+
"Effect": "Deny",
99+
"Principal": {
100+
"AWS": {
101+
"Fn::Join": [
102+
"",
103+
[
104+
"arn:",
105+
{
106+
"Ref": "AWS::Partition"
107+
},
108+
":iam::",
109+
{
110+
"Ref": "AWS::AccountId"
111+
},
112+
":root"
113+
]
114+
]
115+
}
116+
},
117+
"Resource": "*"
118+
},
119+
{
120+
"Action": [
121+
"secretsmanager:DescribeSecret",
122+
"secretsmanager:GetSecretValue"
123+
],
124+
"Effect": "Allow",
125+
"Principal": {
126+
"AWS": {
127+
"Fn::Join": [
128+
"",
129+
[
130+
"arn:",
131+
{
132+
"Ref": "AWS::Partition"
133+
},
134+
":iam::",
135+
{
136+
"Ref": "AWS::AccountId"
137+
},
138+
":root"
139+
]
140+
]
141+
},
142+
"Service": "ecs-tasks.amazonaws.com"
143+
},
144+
"Resource": {
145+
"Ref": "testsecretAttachment19AD251F"
146+
}
147+
}
148+
],
149+
"Version": "2012-10-17"
150+
},
151+
"SecretId": {
152+
"Ref": "testsecretF8BBC644"
153+
}
154+
}
155+
},
156+
"DatabaseB269D8BB": {
157+
"Type": "AWS::RDS::DBCluster",
158+
"Properties": {
159+
"CopyTagsToSnapshot": true,
160+
"DBClusterParameterGroupName": "default.aurora-mysql5.7",
161+
"EnableHttpEndpoint": true,
162+
"Engine": "aurora-mysql",
163+
"EngineMode": "serverless",
164+
"KmsKeyId": {
165+
"Fn::GetAtt": [
166+
"DbSecurity381C2C15",
167+
"Arn"
168+
]
169+
},
170+
"MasterUsername": {
171+
"Fn::Join": [
172+
"",
173+
[
174+
"{{resolve:secretsmanager:",
175+
{
176+
"Ref": "testsecretF8BBC644"
177+
},
178+
":SecretString:username::}}"
179+
]
180+
]
181+
},
182+
"MasterUserPassword": {
183+
"Fn::Join": [
184+
"",
185+
[
186+
"{{resolve:secretsmanager:",
187+
{
188+
"Ref": "testsecretF8BBC644"
189+
},
190+
":SecretString:password::}}"
191+
]
192+
]
193+
},
194+
"StorageEncrypted": true,
195+
"VpcSecurityGroupIds": []
196+
},
197+
"UpdateReplacePolicy": "Snapshot",
198+
"DeletionPolicy": "Snapshot"
199+
}
200+
},
201+
"Parameters": {
202+
"BootstrapVersion": {
203+
"Type": "AWS::SSM::Parameter::Value<String>",
204+
"Default": "/cdk-bootstrap/hnb659fds/version",
205+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
206+
}
207+
},
208+
"Rules": {
209+
"CheckBootstrapVersion": {
210+
"Assertions": [
211+
{
212+
"Assert": {
213+
"Fn::Not": [
214+
{
215+
"Fn::Contains": [
216+
[
217+
"1",
218+
"2",
219+
"3",
220+
"4",
221+
"5"
222+
],
223+
{
224+
"Ref": "BootstrapVersion"
225+
}
226+
]
227+
}
228+
]
229+
},
230+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
231+
}
232+
]
233+
}
234+
}
235+
}

‎packages/@aws-cdk/aws-rds/test/integ.serverless-cluster-secret-rotation-custom-names.js.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"31.0.0"}

‎packages/@aws-cdk/aws-rds/test/integ.serverless-cluster-secret-rotation-custom-names.js.snapshot/cdkrdsintegsecretrotationDefaultTestDeployAssert9780868B.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "cdkrdsintegsecretrotationDefaultTestDeployAssert9780868B.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-rds/test/integ.serverless-cluster-secret-rotation-custom-names.js.snapshot/cdkrdsintegsecretrotationDefaultTestDeployAssert9780868B.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

0 commit comments

Comments
 (0)