(aws-rds): Cannot change removal policy of DatabaseInstance's admin secret

What is the problem?

It’s not possible to change the default DatabaseInstance.secret removal policy. The instance of the secret does have a apply_removal_policy method bound to it (I can see it when printing dir(secret)), but calling it makes no difference.

Reproduction Steps

Create a rds.DatabaseInstance and the master secret will have a default removal policy DELETE with no way to change it (even if changing the removal policy of the instance).

What did you expect to happen?

I would expect, that calling rds_instance.secret.apply_removal_policy would apply the removal policy.

What actually happened?

It doesn’t

CDK CLI Version

1.134.0 (build dd5e12d)

Framework Version

1.134.0

Node.js Version

v16.12.0

OS

Arch Linux 5.15.4-arch1-1

Language

Python

Language Version

3.9.7

Other information

No response

[mskrip]

@skinny85 Yes, that makes sense. Maybe it would be useful if SecretTargetAttachment had a reference to the Secret resource it’s attaching so the policies can be applied explicitly. But that might be too much of a change to the interface so I’m not sure.

[peterwoodworth]

I believe this is because the secret is declared as an ISecret, which doesn’t have the applyRemovalPolicy() function. I’m not sure if this is something that we can change

To work around this and apply the removal policy you want to the secret, you can use an escape hatch!

Here’s an example for TypeScript, let me know if you need one for Python.

    const db = new DatabaseInstance(this, 'db', {
      vpc: vpc,
      engine: dsb.DatabaseInstanceEngine.postgres({version: dsb.PostgresEngineVersion.VER_13_4})
    });

    const secret = db.node.children[2] as DatabaseSecret
    secret.applyRemovalPolicy(RemovalPolicy.RETAIN)