(secretsmanager/rds): addReplicaRegion on Secret created by fromGeneratedSecret

[davidmckenzie]

The ISecret interface that is produced by the RDS fromGeneratedSecret method does not implement addReplicaRegion.

Use Case

DB credentials should always be replicated across regions along with DB snapshots to aid in DR/BC. When creating a new RDS cluster, the auto-generated credentials should be replicated across multiple regions.

Proposed Solution

Either fromGeneratedSecret should allow you to access a full Secret object, or addReplicaRegion should be added to ISecret, in a similar way to addRotationSchedule

Other

I tagged both secretsmanager and rds as I'm not sure which side needs to implement this :)

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[skinny85]

Hey @davidmckenzie,

thanks for opening the issue. I believe you can add the replica regions right now in RDS by going:

const cluster = new rds.DatabaseCluster(this, 'Cluster', {
  credentials: rds.fromGeneratedSecret(...
  // ...
});
(cluster.secret as secretsmanager.Secret).addReplicaRegion('us-east-2');

But I guess the point is to get rid of the that cast there, and make addReplicaRegion() available in ISecret, do I understand your feature request correctly...?

Thanks,
Adam

[davidmckenzie]

Oh neat, thanks! I'm weak in Typescript, didn't know you could do that :)

But yes, it probably would still make sense for it to be available in ISecret, since I assume you could add replicas to imported secrets as well without danger.

[jogold]

How about adding an option to fromGeneratedSecret()?

const cluster = new rds.DatabaseCluster(this, 'Cluster', {
  credentials: rds.fromGeneratedSecret('username', { replicaRegions: [{ region: 'us-east-2' }] }),
  // ...
});

addReplicaRegion() is not available in ISecret because it's not available for an imported secret.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.