aws-cdk/aws-rds - DatabaseInstanceFromSnapshot - SnapshotCredentials.FromGeneratedSecret: ability to specify secret name
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
Hello all!
I am using the AWS CDK in C#, and I am creating a Postgres RDS instance from a snapshot.
The issue I have is regarding [SnapshotCredentials](https://docs.aws.amazon.com/cdk/api/v1/dotnet/api/Amazon.CDK.AWS.RDS.SnapshotCredentials.html)
I would like to be able to have the password generated for me, and stored in secrets manager, but _**I'd like to specify the name of the secret that gets created**_ (like you can do when creating an DatabaseInstance, using [Credentials.FromGeneratedSecret](https://docs.aws.amazon.com/cdk/api/v1/dotnet/api/Amazon.CDK.AWS.RDS.Credentials.html#Amazon_CDK_AWS_RDS_Credentials_FromGeneratedSecret_System_String_Amazon_CDK_AWS_RDS_ICredentialsBaseOptions_))
However, when using the SnapshotCredentials.FromGeneratedSecret method, there is no property that allows you to specify the name of the secret that is generated in secrets manager. In fact, the actual type of the parameter you give this method (SnapshotCredentialsFromGeneratedPasswordOptions) is the same as the FromGeneratedPassword method - this seems like an oversight maybe?
I thought it best to add this as a feature request anyway.
Here's some code for context, highlighting the issue:
`
var postgres = new DatabaseInstanceFromSnapshot(this, "postgres", new DatabaseInstanceFromSnapshotProps
{
Engine = DatabaseInstanceEngine.Postgres(new PostgresInstanceEngineProps
{
Version = PostgresEngineVersion.Of(Config.PostgresEngineVersion, Config.PostgresEngineVersion.Split(".")[0])
}),
InstanceType = new InstanceType(Config.PostgresInstanceType),
Vpc = vpc,
VpcSubnets = new SubnetSelection
{
Subnets = vpc.PrivateSubnets
},
ParameterGroup = ParameterGroup.FromParameterGroupName(this, "parametergroup_postgres", Config.PostgresParameterGroupName),
AutoMinorVersionUpgrade = false,
DeletionProtection = true,
InstanceIdentifier = $"dentally-postgres-{Config.SoftwareEnvironmentName}",
EnablePerformanceInsights = true,
Credentials = SnapshotCredentials.FromGeneratedSecret("postgres", new Snap
{
****CANNOT SPECIFY SECRET NAME****
})
});
`
### Use Case
I'd like to be able to supply the name of the secret so that I can maintain control of the naming conventions/paths used in secrets manager.
### Proposed Solution
Using [ICredentialsBaseOptions](https://docs.aws.amazon.com/cdk/api/v1/dotnet/api/Amazon.CDK.AWS.RDS.ICredentialsBaseOptions.html) as a guide, Create a new data contract for the SnapshotCredentials.FromGeneratedSecret method, and add secrets manager specifc settings to it, including the SecretName property.
### Other Information
I have the matching package reference for the Amazon.CDK.Lib nuget package:
``
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.59.0
### Environment details (OS name and version, etc.)
macos Ventura 13.0.1
Contributor guide
Research direction
Start by tracing SnapshotCredentials.FromGeneratedSecret and SnapshotCredentialsFromGeneratedPasswordOptions, then compare them with Credentials.FromGeneratedSecret and ICredentialsBaseOptions. Done means the snapshot-based generated-secret path accepts a secret name while retaining generated-password behavior and exposes the setting through the CDK API.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, csharp, postgresql, typescript
- Domain
- cloud, database
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100