aws / aws/aws-cdk

aws-cdk/aws-rds - DatabaseInstanceFromSnapshot - SnapshotCredentials.FromGeneratedSecret: ability to specify secret name

Open
#23,573 4 comments 8 reactions 0 assignees View on GitHub
@aws-cdk/aws-rds feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Hello all!

I am using the AWS CDK in C#, and I am creating a Postgres RDS instance from a snapshot.

The issue I have is regarding [SnapshotCredentials](https://docs.aws.amazon.com/cdk/api/v1/dotnet/api/Amazon.CDK.AWS.RDS.SnapshotCredentials.html)

I would like to be able to have the password generated for me, and stored in secrets manager, but _**I'd like to specify the name of the secret that gets created**_ (like you can do when creating an DatabaseInstance, using [Credentials.FromGeneratedSecret](https://docs.aws.amazon.com/cdk/api/v1/dotnet/api/Amazon.CDK.AWS.RDS.Credentials.html#Amazon_CDK_AWS_RDS_Credentials_FromGeneratedSecret_System_String_Amazon_CDK_AWS_RDS_ICredentialsBaseOptions_))

However, when using the SnapshotCredentials.FromGeneratedSecret method, there is no property that allows you to specify the name of the secret that is generated in secrets manager. In fact, the actual type of the parameter you give this method (SnapshotCredentialsFromGeneratedPasswordOptions) is the same as the FromGeneratedPassword method - this seems like an oversight maybe?

I thought it best to add this as a feature request anyway.

Here's some code for context, highlighting the issue:

`
var postgres = new DatabaseInstanceFromSnapshot(this, "postgres", new DatabaseInstanceFromSnapshotProps
{
Engine = DatabaseInstanceEngine.Postgres(new PostgresInstanceEngineProps
{
Version = PostgresEngineVersion.Of(Config.PostgresEngineVersion, Config.PostgresEngineVersion.Split(".")[0])
}),
InstanceType = new InstanceType(Config.PostgresInstanceType),
Vpc = vpc,
VpcSubnets = new SubnetSelection
{
Subnets = vpc.PrivateSubnets
},
ParameterGroup = ParameterGroup.FromParameterGroupName(this, "parametergroup_postgres", Config.PostgresParameterGroupName),
AutoMinorVersionUpgrade = false,
DeletionProtection = true,
InstanceIdentifier = $"dentally-postgres-{Config.SoftwareEnvironmentName}",
EnablePerformanceInsights = true,
Credentials = SnapshotCredentials.FromGeneratedSecret("postgres", new Snap
{
****CANNOT SPECIFY SECRET NAME****
})
});
`

### Use Case

I'd like to be able to supply the name of the secret so that I can maintain control of the naming conventions/paths used in secrets manager.

### Proposed Solution

Using [ICredentialsBaseOptions](https://docs.aws.amazon.com/cdk/api/v1/dotnet/api/Amazon.CDK.AWS.RDS.ICredentialsBaseOptions.html) as a guide, Create a new data contract for the SnapshotCredentials.FromGeneratedSecret method, and add secrets manager specifc settings to it, including the SecretName property.

### Other Information

I have the matching package reference for the Amazon.CDK.Lib nuget package:
``

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.59.0

### Environment details (OS name and version, etc.)

macos Ventura 13.0.1

Contributor guide

Open the contributing guide

Research direction

Start by tracing SnapshotCredentials.FromGeneratedSecret and SnapshotCredentialsFromGeneratedPasswordOptions, then compare them with Credentials.FromGeneratedSecret and ICredentialsBaseOptions. Done means the snapshot-based generated-secret path accepts a secret name while retaining generated-password behavior and exposes the setting through the CDK API.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, csharp, postgresql, typescript
Domain
cloud, database
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.