Skip to content

Commit ba90110

Browse files
author
awstools
committed
feat(client-docdb): Support AWS Secret Manager managed password for AWS DocumentDB instance-based cluster.
1 parent fb7afd4 commit ba90110

12 files changed

+284
-6
lines changed

‎clients/client-docdb/src/commands/CreateDBClusterCommand.ts

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ export interface CreateDBClusterCommandOutput extends CreateDBClusterResult, __M
6868
* DeletionProtection: true || false,
6969
* GlobalClusterIdentifier: "STRING_VALUE",
7070
* StorageType: "STRING_VALUE",
71+
* ManageMasterUserPassword: true || false,
72+
* MasterUserSecretKmsKeyId: "STRING_VALUE",
7173
* };
7274
* const command = new CreateDBClusterCommand(input);
7375
* const response = await client.send(command);
@@ -129,6 +131,11 @@ export interface CreateDBClusterCommandOutput extends CreateDBClusterResult, __M
129131
* // ],
130132
* // DeletionProtection: true || false,
131133
* // StorageType: "STRING_VALUE",
134+
* // MasterUserSecret: { // ClusterMasterUserSecret
135+
* // SecretArn: "STRING_VALUE",
136+
* // SecretStatus: "STRING_VALUE",
137+
* // KmsKeyId: "STRING_VALUE",
138+
* // },
132139
* // },
133140
* // };
134141
*

‎clients/client-docdb/src/commands/DeleteDBClusterCommand.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,11 @@ export interface DeleteDBClusterCommandOutput extends DeleteDBClusterResult, __M
101101
* // ],
102102
* // DeletionProtection: true || false,
103103
* // StorageType: "STRING_VALUE",
104+
* // MasterUserSecret: { // ClusterMasterUserSecret
105+
* // SecretArn: "STRING_VALUE",
106+
* // SecretStatus: "STRING_VALUE",
107+
* // KmsKeyId: "STRING_VALUE",
108+
* // },
104109
* // },
105110
* // };
106111
*

‎clients/client-docdb/src/commands/DescribeDBClustersCommand.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,11 @@ export interface DescribeDBClustersCommandOutput extends DBClusterMessage, __Met
115115
* // ],
116116
* // DeletionProtection: true || false,
117117
* // StorageType: "STRING_VALUE",
118+
* // MasterUserSecret: { // ClusterMasterUserSecret
119+
* // SecretArn: "STRING_VALUE",
120+
* // SecretStatus: "STRING_VALUE",
121+
* // KmsKeyId: "STRING_VALUE",
122+
* // },
118123
* // },
119124
* // ],
120125
* // };

‎clients/client-docdb/src/commands/FailoverDBClusterCommand.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,11 @@ export interface FailoverDBClusterCommandOutput extends FailoverDBClusterResult,
101101
* // ],
102102
* // DeletionProtection: true || false,
103103
* // StorageType: "STRING_VALUE",
104+
* // MasterUserSecret: { // ClusterMasterUserSecret
105+
* // SecretArn: "STRING_VALUE",
106+
* // SecretStatus: "STRING_VALUE",
107+
* // KmsKeyId: "STRING_VALUE",
108+
* // },
104109
* // },
105110
* // };
106111
*

‎clients/client-docdb/src/commands/ModifyDBClusterCommand.ts

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@ export interface ModifyDBClusterCommandOutput extends ModifyDBClusterResult, __M
6262
* AllowMajorVersionUpgrade: true || false,
6363
* DeletionProtection: true || false,
6464
* StorageType: "STRING_VALUE",
65+
* ManageMasterUserPassword: true || false,
66+
* MasterUserSecretKmsKeyId: "STRING_VALUE",
67+
* RotateMasterUserPassword: true || false,
6568
* };
6669
* const command = new ModifyDBClusterCommand(input);
6770
* const response = await client.send(command);
@@ -123,6 +126,11 @@ export interface ModifyDBClusterCommandOutput extends ModifyDBClusterResult, __M
123126
* // ],
124127
* // DeletionProtection: true || false,
125128
* // StorageType: "STRING_VALUE",
129+
* // MasterUserSecret: { // ClusterMasterUserSecret
130+
* // SecretArn: "STRING_VALUE",
131+
* // SecretStatus: "STRING_VALUE",
132+
* // KmsKeyId: "STRING_VALUE",
133+
* // },
126134
* // },
127135
* // };
128136
*

‎clients/client-docdb/src/commands/RestoreDBClusterFromSnapshotCommand.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,11 @@ export interface RestoreDBClusterFromSnapshotCommandOutput
126126
* // ],
127127
* // DeletionProtection: true || false,
128128
* // StorageType: "STRING_VALUE",
129+
* // MasterUserSecret: { // ClusterMasterUserSecret
130+
* // SecretArn: "STRING_VALUE",
131+
* // SecretStatus: "STRING_VALUE",
132+
* // KmsKeyId: "STRING_VALUE",
133+
* // },
129134
* // },
130135
* // };
131136
*

‎clients/client-docdb/src/commands/RestoreDBClusterToPointInTimeCommand.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,11 @@ export interface RestoreDBClusterToPointInTimeCommandOutput
128128
* // ],
129129
* // DeletionProtection: true || false,
130130
* // StorageType: "STRING_VALUE",
131+
* // MasterUserSecret: { // ClusterMasterUserSecret
132+
* // SecretArn: "STRING_VALUE",
133+
* // SecretStatus: "STRING_VALUE",
134+
* // KmsKeyId: "STRING_VALUE",
135+
* // },
131136
* // },
132137
* // };
133138
*

‎clients/client-docdb/src/commands/StartDBClusterCommand.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@ export interface StartDBClusterCommandOutput extends StartDBClusterResult, __Met
100100
* // ],
101101
* // DeletionProtection: true || false,
102102
* // StorageType: "STRING_VALUE",
103+
* // MasterUserSecret: { // ClusterMasterUserSecret
104+
* // SecretArn: "STRING_VALUE",
105+
* // SecretStatus: "STRING_VALUE",
106+
* // KmsKeyId: "STRING_VALUE",
107+
* // },
103108
* // },
104109
* // };
105110
*

‎clients/client-docdb/src/commands/StopDBClusterCommand.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,11 @@ export interface StopDBClusterCommandOutput extends StopDBClusterResult, __Metad
101101
* // ],
102102
* // DeletionProtection: true || false,
103103
* // StorageType: "STRING_VALUE",
104+
* // MasterUserSecret: { // ClusterMasterUserSecret
105+
* // SecretArn: "STRING_VALUE",
106+
* // SecretStatus: "STRING_VALUE",
107+
* // KmsKeyId: "STRING_VALUE",
108+
* // },
104109
* // },
105110
* // };
106111
*

‎clients/client-docdb/src/models/models_0.ts

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1222,6 +1222,26 @@ export interface CreateDBClusterMessage {
12221222
* @public
12231223
*/
12241224
StorageType?: string | undefined;
1225+
1226+
/**
1227+
* <p>Specifies whether to manage the master user password with Amazon Web Services Secrets Manager.</p>
1228+
* <p>Constraint: You can't manage the master user password with Amazon Web Services Secrets Manager if <code>MasterUserPassword</code> is specified.</p>
1229+
* @public
1230+
*/
1231+
ManageMasterUserPassword?: boolean | undefined;
1232+
1233+
/**
1234+
* <p>The Amazon Web Services KMS key identifier to encrypt a secret that is automatically generated and managed in Amazon Web Services Secrets Manager.
1235+
* This setting is valid only if the master user password is managed by Amazon DocumentDB in Amazon Web Services Secrets Manager for the DB cluster.</p>
1236+
* <p>The Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key.
1237+
* To use a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN.</p>
1238+
* <p>If you don't specify <code>MasterUserSecretKmsKeyId</code>, then the <code>aws/secretsmanager</code> KMS key is used to encrypt the secret.
1239+
* If the secret is in a different Amazon Web Services account, then you can't use the <code>aws/secretsmanager</code> KMS key to encrypt the secret, and you must use a customer managed KMS key.</p>
1240+
* <p>There is a default KMS key for your Amazon Web Services account.
1241+
* Your Amazon Web Services account has a different default KMS key for each Amazon Web Services Region.</p>
1242+
* @public
1243+
*/
1244+
MasterUserSecretKmsKeyId?: string | undefined;
12251245
}
12261246

12271247
/**
@@ -1291,6 +1311,48 @@ export interface DBClusterMember {
12911311
PromotionTier?: number | undefined;
12921312
}
12931313

1314+
/**
1315+
* <p>Contains the secret managed by Amazon DocumentDB in Amazon Web Services Secrets Manager for the master user password.</p>
1316+
* @public
1317+
*/
1318+
export interface ClusterMasterUserSecret {
1319+
/**
1320+
* <p>The Amazon Resource Name (ARN) of the secret.</p>
1321+
* @public
1322+
*/
1323+
SecretArn?: string | undefined;
1324+
1325+
/**
1326+
* <p>The status of the secret.</p>
1327+
* <p>The possible status values include the following:</p>
1328+
* <ul>
1329+
* <li>
1330+
* <p>creating - The secret is being created.</p>
1331+
* </li>
1332+
* <li>
1333+
* <p>active - The secret is available for normal use and rotation.</p>
1334+
* </li>
1335+
* <li>
1336+
* <p>rotating - The secret is being rotated.</p>
1337+
* </li>
1338+
* <li>
1339+
* <p>impaired - The secret can be used to access database credentials, but it can't be rotated.
1340+
* A secret might have this status if, for example, permissions are changed so that Amazon DocumentDB can no longer access either the secret or the KMS key for the secret.</p>
1341+
* <p>When a secret has this status, you can correct the condition that caused the status.
1342+
* Alternatively, modify the instance to turn off automatic management of database credentials, and then modify the instance again to turn on automatic management of database credentials.</p>
1343+
* </li>
1344+
* </ul>
1345+
* @public
1346+
*/
1347+
SecretStatus?: string | undefined;
1348+
1349+
/**
1350+
* <p>The Amazon Web Services KMS key identifier that is used to encrypt the secret.</p>
1351+
* @public
1352+
*/
1353+
KmsKeyId?: string | undefined;
1354+
}
1355+
12941356
/**
12951357
* <p>Used as a response element for queries on virtual private cloud (VPC) security group
12961358
* membership.</p>
@@ -1534,6 +1596,12 @@ export interface DBCluster {
15341596
* @public
15351597
*/
15361598
StorageType?: string | undefined;
1599+
1600+
/**
1601+
* <p>The secret managed by Amazon DocumentDB in Amazon Web Services Secrets Manager for the master user password.</p>
1602+
* @public
1603+
*/
1604+
MasterUserSecret?: ClusterMasterUserSecret | undefined;
15371605
}
15381606

15391607
/**
@@ -5380,6 +5448,47 @@ export interface ModifyDBClusterMessage {
53805448
* @public
53815449
*/
53825450
StorageType?: string | undefined;
5451+
5452+
/**
5453+
* <p>Specifies whether to manage the master user password with Amazon Web Services Secrets Manager.
5454+
* If the cluster doesn't manage the master user password with Amazon Web Services Secrets Manager, you can turn on this management.
5455+
* In this case, you can't specify <code>MasterUserPassword</code>.
5456+
* If the cluster already manages the master user password with Amazon Web Services Secrets Manager, and you specify that the master user password is not managed with Amazon Web Services Secrets Manager, then you must specify <code>MasterUserPassword</code>.
5457+
* In this case, Amazon DocumentDB deletes the secret and uses the new password for the master user specified by <code>MasterUserPassword</code>.</p>
5458+
* @public
5459+
*/
5460+
ManageMasterUserPassword?: boolean | undefined;
5461+
5462+
/**
5463+
* <p>The Amazon Web Services KMS key identifier to encrypt a secret that is automatically generated and managed in Amazon Web Services Secrets Manager.</p>
5464+
* <p>This setting is valid only if both of the following conditions are met:</p>
5465+
* <ul>
5466+
* <li>
5467+
* <p>The cluster doesn't manage the master user password in Amazon Web Services Secrets Manager.
5468+
* If the cluster already manages the master user password in Amazon Web Services Secrets Manager, you can't change the KMS key that is used to encrypt the secret.</p>
5469+
* </li>
5470+
* <li>
5471+
* <p>You are enabling <code>ManageMasterUserPassword</code> to manage the master user password in Amazon Web Services Secrets Manager.
5472+
* If you are turning on <code>ManageMasterUserPassword</code> and don't specify <code>MasterUserSecretKmsKeyId</code>, then the <code>aws/secretsmanager</code> KMS key is used to encrypt the secret.
5473+
* If the secret is in a different Amazon Web Services account, then you can't use the <code>aws/secretsmanager</code> KMS key to encrypt the secret, and you must use a customer managed KMS key.</p>
5474+
* </li>
5475+
* </ul>
5476+
* <p>The Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key.
5477+
* To use a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN.</p>
5478+
* <p>There is a default KMS key for your Amazon Web Services account.
5479+
* Your Amazon Web Services account has a different default KMS key for each Amazon Web Services Region.</p>
5480+
* @public
5481+
*/
5482+
MasterUserSecretKmsKeyId?: string | undefined;
5483+
5484+
/**
5485+
* <p>Specifies whether to rotate the secret managed by Amazon Web Services Secrets Manager for the master user password.</p>
5486+
* <p>This setting is valid only if the master user password is managed by Amazon DocumentDB in Amazon Web Services Secrets Manager for the cluster.
5487+
* The secret value contains the updated password.</p>
5488+
* <p>Constraint: You must apply the change immediately when rotating the master user password.</p>
5489+
* @public
5490+
*/
5491+
RotateMasterUserPassword?: boolean | undefined;
53835492
}
53845493

53855494
/**

‎clients/client-docdb/src/protocols/Aws_query.ts

Lines changed: 48 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,7 @@ import {
216216
CertificateMessage,
217217
CertificateNotFoundFault,
218218
CloudwatchLogsExportConfiguration,
219+
ClusterMasterUserSecret,
219220
CopyDBClusterParameterGroupMessage,
220221
CopyDBClusterParameterGroupResult,
221222
CopyDBClusterSnapshotMessage,
@@ -3801,6 +3802,12 @@ const se_CreateDBClusterMessage = (input: CreateDBClusterMessage, context: __Ser
38013802
if (input[_ST] != null) {
38023803
entries[_ST] = input[_ST];
38033804
}
3805+
if (input[_MMUP] != null) {
3806+
entries[_MMUP] = input[_MMUP];
3807+
}
3808+
if (input[_MUSKKI] != null) {
3809+
entries[_MUSKKI] = input[_MUSKKI];
3810+
}
38043811
return entries;
38053812
};
38063813

@@ -4829,6 +4836,15 @@ const se_ModifyDBClusterMessage = (input: ModifyDBClusterMessage, context: __Ser
48294836
if (input[_ST] != null) {
48304837
entries[_ST] = input[_ST];
48314838
}
4839+
if (input[_MMUP] != null) {
4840+
entries[_MMUP] = input[_MMUP];
4841+
}
4842+
if (input[_MUSKKI] != null) {
4843+
entries[_MUSKKI] = input[_MUSKKI];
4844+
}
4845+
if (input[_RMUP] != null) {
4846+
entries[_RMUP] = input[_RMUP];
4847+
}
48324848
return entries;
48334849
};
48344850

@@ -5599,6 +5615,23 @@ const de_CertificateNotFoundFault = (output: any, context: __SerdeContext): Cert
55995615
return contents;
56005616
};
56015617

5618+
/**
5619+
* deserializeAws_queryClusterMasterUserSecret
5620+
*/
5621+
const de_ClusterMasterUserSecret = (output: any, context: __SerdeContext): ClusterMasterUserSecret => {
5622+
const contents: any = {};
5623+
if (output[_SA] != null) {
5624+
contents[_SA] = __expectString(output[_SA]);
5625+
}
5626+
if (output[_SS] != null) {
5627+
contents[_SS] = __expectString(output[_SS]);
5628+
}
5629+
if (output[_KKI] != null) {
5630+
contents[_KKI] = __expectString(output[_KKI]);
5631+
}
5632+
return contents;
5633+
};
5634+
56025635
/**
56035636
* deserializeAws_queryCopyDBClusterParameterGroupResult
56045637
*/
@@ -5820,6 +5853,9 @@ const de_DBCluster = (output: any, context: __SerdeContext): DBCluster => {
58205853
if (output[_ST] != null) {
58215854
contents[_ST] = __expectString(output[_ST]);
58225855
}
5856+
if (output[_MUS] != null) {
5857+
contents[_MUS] = de_ClusterMasterUserSecret(output[_MUS], context);
5858+
}
58235859
return contents;
58245860
};
58255861

@@ -6784,8 +6820,8 @@ const de_Event = (output: any, context: __SerdeContext): Event => {
67846820
if (output[_Da] != null) {
67856821
contents[_Da] = __expectNonNull(__parseRfc3339DateTimeWithOffset(output[_Da]));
67866822
}
6787-
if (output[_SA] != null) {
6788-
contents[_SA] = __expectString(output[_SA]);
6823+
if (output[_SAo] != null) {
6824+
contents[_SAo] = __expectString(output[_SAo]);
67896825
}
67906826
return contents;
67916827
};
@@ -7898,8 +7934,8 @@ const de_Subnet = (output: any, context: __SerdeContext): Subnet => {
78987934
if (output[_SAZ] != null) {
78997935
contents[_SAZ] = de_AvailabilityZone(output[_SAZ], context);
79007936
}
7901-
if (output[_SS] != null) {
7902-
contents[_SS] = __expectString(output[_SS]);
7937+
if (output[_SSu] != null) {
7938+
contents[_SSu] = __expectString(output[_SSu]);
79037939
}
79047940
return contents;
79057941
};
@@ -8294,9 +8330,12 @@ const _MDBSG = "ModifyDBSubnetGroup";
82948330
const _MES = "ModifyEventSubscription";
82958331
const _MEV = "MinimumEngineVersion";
82968332
const _MGC = "ModifyGlobalCluster";
8333+
const _MMUP = "ManageMasterUserPassword";
82978334
const _MR = "MaxRecords";
82988335
const _MU = "MasterUsername";
82998336
const _MUP = "MasterUserPassword";
8337+
const _MUS = "MasterUserSecret";
8338+
const _MUSKKI = "MasterUserSecretKmsKeyId";
83008339
const _Me = "Message";
83018340
const _N = "Name";
83028341
const _NDBCI = "NewDBClusterIdentifier";
@@ -8335,6 +8374,7 @@ const _RDBI = "RebootDBInstance";
83358374
const _RE = "ReaderEndpoint";
83368375
const _RFGC = "RemoveFromGlobalCluster";
83378376
const _RI = "ResourceIdentifier";
8377+
const _RMUP = "RotateMasterUserPassword";
83388378
const _RN = "ResourceName";
83398379
const _RPMA = "ResourcePendingMaintenanceActions";
83408380
const _RRI = "ReadReplicaIdentifiers";
@@ -8345,8 +8385,9 @@ const _RT = "RestoreType";
83458385
const _RTFR = "RemoveTagsFromResource";
83468386
const _RTT = "RestoreToTime";
83478387
const _S = "Source";
8348-
const _SA = "SourceArn";
8388+
const _SA = "SecretArn";
83498389
const _SAZ = "SubnetAvailabilityZone";
8390+
const _SAo = "SourceArn";
83508391
const _SCACI = "SupportedCACertificateIdentifiers";
83518392
const _SCRWR = "SupportsCertificateRotationWithoutRestart";
83528393
const _SCT = "SnapshotCreateTime";
@@ -8371,7 +8412,8 @@ const _SIu = "SubnetIds";
83718412
const _SIub = "SubnetIdentifier";
83728413
const _SLETCL = "SupportsLogExportsToCloudwatchLogs";
83738414
const _SN = "SubscriptionName";
8374-
const _SS = "SubnetStatus";
8415+
const _SS = "SecretStatus";
8416+
const _SSu = "SubnetStatus";
83758417
const _ST = "StorageType";
83768418
const _STA = "SnsTopicArn";
83778419
const _STn = "SnapshotType";

0 commit comments

Comments
 (0)