[aws-rds] When moving from DatabaseCluster to DatabaseClusterFromSnapshot, lose ability to rotate master passwords
See original GitHub issueIf I start with a DatabaseCluster
and then need to switch it to DatabaseClusterFromSnapshot
, I am forced to weaken security because DatabaseClusterFromSnapshot
does not have addRotationSingleUser()
.
Reproduction Steps
Starting point was:
const vpc = ...
const cluster = new DatabaseCluster(this, 'Database', {
engine: DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.VER_11_9 }),
instanceProps: {
vpc: vpc,
},
})
cluster.addRotationSingleUser({ automaticallyAfter: Duration.days(2) })
Then, after removing the cluster
(which creates a snapshot) and recreating it with:
const vpc = ...
const cluster = new DatabaseClusterFromSnapshot(this, 'Database', {
snapshotIdentifier: "",
engine: DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.VER_11_9 }),
instanceProps: {
vpc: vpc,
},
})
// The next line fails to compile!
cluster.addRotationSingleUser({ automaticallyAfter: Duration.days(2) })
the last line cannot be used.
What did you expect to happen?
I expected DatabaseClusterFromSnapshot
to have the same API as DatabaseCluster
.
What actually happened?
error TS2339: Property 'addRotationSingleUser' does not exist on type 'DatabaseClusterFromSnapshot'.
Environment
- CDK CLI Version : 1.88.0 (build f65009b)
- Framework Version: aws-cli/2.1.8 Python/3.7.3 Linux/4.19.128-microsoft-standard exe/x86_64.ubuntu.18 prompt/off
- Node.js Version: v12.20.1
- OS : Ubuntu 18.04 on WSL 2
- Language (Version): TypeScript 3.9.7
Other
I would suggest pulling DatabaseCluster.addRotationSingleUser
and DatabaseCluster.addRotationMultiUser
up into DatabaseClusterNew
(which is the shared superclass of DatabaseClusterFromSnapshot
)
This is 🐛 Bug Report
Issue Analytics
- State:
- Created 3 years ago
- Comments:5 (2 by maintainers)
Top Results From Across the Web
Reset the master user password for an Amazon RDS DB ...
Select Databases. Select the RDS DB instance, and then choose Modify. Note: If you use Aurora, expand the cluster, and choose the instance...
Read more >Password management with Amazon Aurora and Amazon ...
Amazon Aurora changes the master user password for the DB cluster to match the password for the new secret version. You can rotate...
Read more >azdata bdc rotate reference - SQL Server Big Data Clusters
In this article. azdata bdc rotate; Next steps. Applies to Azure Data CLI ( azdata ). This command rotates the passwords of autogenerated...
Read more >Database password rotation with AWS Secrets Manager and ...
Depending on how serious you are about security you may want to consider setting up password rotation for databases. If you're on AWS ......
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Okay, will try to create my first PR for aws-cdk.
The username has to be from the snapshot, yes, but the password can be updated. See here for the details.