[rds] How to setup SecretsManager name for "masterUser" ?

[Cloudrage]

❓ General Issue

The Question

When creating a new rds.DatabaseCluster, I want to be able to set the name of the Secrets generated for the masterUser.
It's needed by a pipeline to get values from it but if the name is generated auto, I can't easily retrieve values directly (without a describe...).
I've seen that it's possible for additional Users, but for the Master ?

[skinny85]

Hello @Cloudrage ,

you do that in the username property of the Login interface, which is the type of the masterUser property in DatabaseClusterProps:

    new rds.DatabaseCluster(this, 'Cluster', {
      // ...
      masterUser: {
        username: 'your-username-here',
      },
    });

Thanks,
Adam

[Cloudrage]

@skinny85 , thanks for your reply, but my question is about the name of the Secrets Generated on our behalf.
For example, CDK create a Secrets with name : DatabaseClusterSecret-nS6N22CBwDYx

But I want to set of name like rds-secrets for my Master User; see ?
It's possible when creating multiple Users and then, attach them to the RDS, but for the Master User, when I enable rotation of the pwd, it's saying that my RDS don't have a Secret and it can't add a rotation without Secrets.

[skinny85]

@Cloudrage you can pass your own password property in masterUser - hopefully as a value from SecretsManager, to not put your passwords in plaintext in code - and this way, the CDK will not create the Secret for you.

[Cloudrage]

Of course, tested and it works.
But in that case, I can't addRotationSingleUser to my RDS, saying that no Secrets is attached to it.
And to be able to rotate Secret, I've to provide my own Lambda to do it instead of the one provided by default by RDS addRotationSingleUser.
So, you're saying that it's not possible to set Secrets Name by the one generated with RDS Construct for DB MasterUser; maybe a feature request ?

[skinny85]

You're probably right. We recently made some large changes to this functionality in #7927 . These are not released yet, but I hope this will cover your use case!

[Cloudrage]

If when adding our own Secrets to the RDS we can use addRotationSingleUser Method without issues, indeed :)

Thanks !

[Cloudrage]

I confirm that CDK 1.66.0 do the job with credentials prop !

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.