504 lines
16 KiB
TypeScript
504 lines
16 KiB
TypeScript
import type { IParameterGroup } from './parameter-group';
|
|
import type * as ec2 from '../../aws-ec2';
|
|
import type * as kms from '../../aws-kms';
|
|
import type * as secretsmanager from '../../aws-secretsmanager';
|
|
import type { Duration, SecretValue } from '../../core';
|
|
/**
|
|
* Instance properties for database instances
|
|
*/
|
|
export interface InstanceProps {
|
|
/**
|
|
* What type of instance to start for the replicas.
|
|
*
|
|
* @default - t3.medium (or, more precisely, db.t3.medium)
|
|
*/
|
|
readonly instanceType?: ec2.InstanceType;
|
|
/**
|
|
* What subnets to run the RDS instances in.
|
|
*
|
|
* Must be at least 2 subnets in two different AZs.
|
|
*/
|
|
readonly vpc: ec2.IVpc;
|
|
/**
|
|
* Where to place the instances within the VPC
|
|
*
|
|
* @default - the Vpc default strategy if not specified.
|
|
*/
|
|
readonly vpcSubnets?: ec2.SubnetSelection;
|
|
/**
|
|
* Security group.
|
|
*
|
|
* @default a new security group is created.
|
|
*/
|
|
readonly securityGroups?: ec2.ISecurityGroup[];
|
|
/**
|
|
* The DB parameter group to associate with the instance.
|
|
*
|
|
* @default no parameter group
|
|
*/
|
|
readonly parameterGroup?: IParameterGroup;
|
|
/**
|
|
* The parameters in the DBParameterGroup to create automatically
|
|
*
|
|
* You can only specify parameterGroup or parameters but not both.
|
|
* You need to use a versioned engine to auto-generate a DBParameterGroup.
|
|
*
|
|
* @default - None
|
|
*/
|
|
readonly parameters?: {
|
|
[key: string]: string;
|
|
};
|
|
/**
|
|
* Whether to enable Performance Insights for the DB instance.
|
|
*
|
|
* @default - false, unless ``performanceInsightRetention`` or ``performanceInsightEncryptionKey`` is set.
|
|
*/
|
|
readonly enablePerformanceInsights?: boolean;
|
|
/**
|
|
* The amount of time, in days, to retain Performance Insights data.
|
|
*
|
|
* @default 7
|
|
*/
|
|
readonly performanceInsightRetention?: PerformanceInsightRetention;
|
|
/**
|
|
* The AWS KMS key for encryption of Performance Insights data.
|
|
*
|
|
* @default - default master key
|
|
*/
|
|
readonly performanceInsightEncryptionKey?: kms.IKey;
|
|
/**
|
|
* Whether to enable automatic upgrade of minor version for the DB instance.
|
|
*
|
|
* @default - true
|
|
*/
|
|
readonly autoMinorVersionUpgrade?: boolean;
|
|
/**
|
|
* Whether to allow upgrade of major version for the DB instance.
|
|
*
|
|
* @default - false
|
|
*/
|
|
readonly allowMajorVersionUpgrade?: boolean;
|
|
/**
|
|
* Whether to remove automated backups immediately after the DB instance is deleted for the DB instance.
|
|
*
|
|
* @default - true
|
|
*/
|
|
readonly deleteAutomatedBackups?: boolean;
|
|
/**
|
|
* Indicates whether the DB instance is an internet-facing instance.
|
|
*
|
|
* @default - `true` if `vpcSubnets` is `subnetType: SubnetType.PUBLIC`, `false` otherwise
|
|
*/
|
|
readonly publiclyAccessible?: boolean;
|
|
/**
|
|
* A preferred maintenance window day/time range. Should be specified as a range ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC).
|
|
*
|
|
* Example: 'Sun:23:45-Mon:00:15'
|
|
*
|
|
* @default - 30-minute window selected at random from an 8-hour block of time for
|
|
* each AWS Region, occurring on a random day of the week.
|
|
* @see https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_UpgradeDBInstance.Maintenance.html#Concepts.DBMaintenance
|
|
*/
|
|
readonly preferredMaintenanceWindow?: string;
|
|
}
|
|
/**
|
|
* Backup configuration for RDS databases
|
|
*
|
|
* @default - The retention period for automated backups is 1 day.
|
|
* The preferred backup window will be a 30-minute window selected at random
|
|
* from an 8-hour block of time for each AWS Region.
|
|
* @see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html#USER_WorkingWithAutomatedBackups.BackupWindow
|
|
*/
|
|
export interface BackupProps {
|
|
/**
|
|
* How many days to retain the backup
|
|
*/
|
|
readonly retention: Duration;
|
|
/**
|
|
* A daily time range in 24-hours UTC format in which backups preferably execute.
|
|
*
|
|
* Must be at least 30 minutes long.
|
|
*
|
|
* Example: '01:00-02:00'
|
|
*
|
|
* @default - a 30-minute window selected at random from an 8-hour block of
|
|
* time for each AWS Region. To see the time blocks available, see
|
|
* https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html#USER_WorkingWithAutomatedBackups.BackupWindow
|
|
*/
|
|
readonly preferredWindow?: string;
|
|
}
|
|
/**
|
|
* Base options for creating Credentials.
|
|
*/
|
|
export interface CredentialsBaseOptions {
|
|
/**
|
|
* The name of the secret.
|
|
*
|
|
* @default - A name is generated by CloudFormation.
|
|
*/
|
|
readonly secretName?: string;
|
|
/**
|
|
* KMS encryption key to encrypt the generated secret.
|
|
*
|
|
* @default - default master key
|
|
*/
|
|
readonly encryptionKey?: kms.IKey;
|
|
/**
|
|
* The characters to exclude from the generated password.
|
|
* Has no effect if `password` has been provided.
|
|
*
|
|
* @default - the DatabaseSecret default exclude character set (" %+~`#$&*()|[]{}:;<>?!'/@\"\\")
|
|
*/
|
|
readonly excludeCharacters?: string;
|
|
/**
|
|
* A list of regions where to replicate this secret.
|
|
*
|
|
* @default - Secret is not replicated
|
|
*/
|
|
readonly replicaRegions?: secretsmanager.ReplicaRegion[];
|
|
}
|
|
/**
|
|
* Options for creating Credentials from a username.
|
|
*/
|
|
export interface CredentialsFromUsernameOptions extends CredentialsBaseOptions {
|
|
/**
|
|
* Password
|
|
*
|
|
* Do not put passwords in your CDK code directly.
|
|
*
|
|
* @default - a Secrets Manager generated password
|
|
*/
|
|
readonly password?: SecretValue;
|
|
}
|
|
/**
|
|
* Username and password combination
|
|
*/
|
|
export declare abstract class Credentials {
|
|
/**
|
|
* Creates Credentials with a password generated and stored in Secrets Manager.
|
|
*/
|
|
static fromGeneratedSecret(username: string, options?: CredentialsBaseOptions): Credentials;
|
|
/**
|
|
* Creates Credentials from a password
|
|
*
|
|
* Do not put passwords in your CDK code directly.
|
|
*/
|
|
static fromPassword(username: string, password: SecretValue): Credentials;
|
|
/**
|
|
* Creates Credentials for the given username, and optional password and key.
|
|
* If no password is provided, one will be generated and stored in Secrets Manager.
|
|
*/
|
|
static fromUsername(username: string, options?: CredentialsFromUsernameOptions): Credentials;
|
|
/**
|
|
* Creates Credentials from an existing Secrets Manager ``Secret`` (or ``DatabaseSecret``)
|
|
*
|
|
* The Secret must be a JSON string with a ``username`` and ``password`` field:
|
|
* ```
|
|
* {
|
|
* ...
|
|
* "username": <required: username>,
|
|
* "password": <required: password>,
|
|
* }
|
|
* ```
|
|
*
|
|
* @param secret The secret where the credentials are stored
|
|
* @param username The username defined in the secret. If specified the username
|
|
* will be referenced as a string and not a dynamic reference to the username
|
|
* field in the secret. This allows to replace the secret without replacing the
|
|
* instance or cluster.
|
|
*/
|
|
static fromSecret(secret: secretsmanager.ISecret, username?: string): Credentials;
|
|
/**
|
|
* Username
|
|
*/
|
|
abstract readonly username: string;
|
|
/**
|
|
* The name to use for the Secret if a new Secret is to be generated in
|
|
* SecretsManager for these Credentials.
|
|
*
|
|
* @default - A name is generated by CloudFormation.
|
|
*/
|
|
abstract readonly secretName?: string;
|
|
/**
|
|
* Whether the username should be referenced as a string and not as a dynamic
|
|
* reference to the username in the secret.
|
|
*
|
|
* @default false
|
|
*/
|
|
abstract readonly usernameAsString?: boolean;
|
|
/**
|
|
* Password
|
|
*
|
|
* Do not put passwords in your CDK code directly.
|
|
*
|
|
* @default - a Secrets Manager generated password
|
|
*/
|
|
abstract readonly password?: SecretValue;
|
|
/**
|
|
* KMS encryption key to encrypt the generated secret.
|
|
*
|
|
* @default - default master key
|
|
*/
|
|
abstract readonly encryptionKey?: kms.IKey;
|
|
/**
|
|
* Secret used to instantiate this Login.
|
|
*
|
|
* @default - none
|
|
*/
|
|
abstract readonly secret?: secretsmanager.ISecret;
|
|
/**
|
|
* The characters to exclude from the generated password.
|
|
* Only used if `password` has not been set.
|
|
*
|
|
* @default - the DatabaseSecret default exclude character set (" %+~`#$&*()|[]{}:;<>?!'/@\"\\")
|
|
*/
|
|
abstract readonly excludeCharacters?: string;
|
|
/**
|
|
* A list of regions where to replicate the generated secret.
|
|
*
|
|
* @default - Secret is not replicated
|
|
*/
|
|
abstract readonly replicaRegions?: secretsmanager.ReplicaRegion[];
|
|
}
|
|
/**
|
|
* Options used in the `SnapshotCredentials.fromGeneratedPassword` method.
|
|
*/
|
|
export interface SnapshotCredentialsFromGeneratedPasswordOptions {
|
|
/**
|
|
* KMS encryption key to encrypt the generated secret.
|
|
*
|
|
* @default - default master key
|
|
*/
|
|
readonly encryptionKey?: kms.IKey;
|
|
/**
|
|
* The characters to exclude from the generated password.
|
|
*
|
|
* @default - the DatabaseSecret default exclude character set (" %+~`#$&*()|[]{}:;<>?!'/@\"\\")
|
|
*/
|
|
readonly excludeCharacters?: string;
|
|
/**
|
|
* A list of regions where to replicate this secret.
|
|
*
|
|
* @default - Secret is not replicated
|
|
*/
|
|
readonly replicaRegions?: secretsmanager.ReplicaRegion[];
|
|
}
|
|
/**
|
|
* Credentials to update the password for a ``DatabaseInstanceFromSnapshot``.
|
|
*/
|
|
export declare abstract class SnapshotCredentials {
|
|
/**
|
|
* Generate a new password for the snapshot, using the existing username and an optional encryption key.
|
|
* The new credentials are stored in Secrets Manager.
|
|
*
|
|
* Note - The username must match the existing master username of the snapshot.
|
|
*/
|
|
static fromGeneratedSecret(username: string, options?: SnapshotCredentialsFromGeneratedPasswordOptions): SnapshotCredentials;
|
|
/**
|
|
* Generate a new password for the snapshot, using the existing username and an optional encryption key.
|
|
*
|
|
* Note - The username must match the existing master username of the snapshot.
|
|
*
|
|
* NOTE: use `fromGeneratedSecret()` for new Clusters and Instances. Switching from
|
|
* `fromGeneratedPassword()` to `fromGeneratedSecret()` for already deployed Clusters
|
|
* or Instances will update their master password.
|
|
*/
|
|
static fromGeneratedPassword(username: string, options?: SnapshotCredentialsFromGeneratedPasswordOptions): SnapshotCredentials;
|
|
/**
|
|
* Update the snapshot login with an existing password.
|
|
*/
|
|
static fromPassword(password: SecretValue): SnapshotCredentials;
|
|
/**
|
|
* Update the snapshot login with an existing password from a Secret.
|
|
*
|
|
* The Secret must be a JSON string with a ``password`` field:
|
|
* ```
|
|
* {
|
|
* ...
|
|
* "password": <required: password>,
|
|
* }
|
|
* ```
|
|
*/
|
|
static fromSecret(secret: secretsmanager.ISecret): SnapshotCredentials;
|
|
/**
|
|
* The master user name.
|
|
*
|
|
* Must be the **current** master user name of the snapshot.
|
|
* It is not possible to change the master user name of a RDS instance.
|
|
*
|
|
* @default - the existing username from the snapshot
|
|
*/
|
|
abstract readonly username?: string;
|
|
/**
|
|
* Whether a new password should be generated.
|
|
*/
|
|
abstract readonly generatePassword: boolean;
|
|
/**
|
|
* Whether to replace the generated secret when the criteria for the password change.
|
|
*
|
|
* @default false
|
|
*/
|
|
abstract readonly replaceOnPasswordCriteriaChanges?: boolean;
|
|
/**
|
|
* The master user password.
|
|
*
|
|
* Do not put passwords in your CDK code directly.
|
|
*
|
|
* @default - the existing password from the snapshot
|
|
*/
|
|
abstract readonly password?: SecretValue;
|
|
/**
|
|
* KMS encryption key to encrypt the generated secret.
|
|
*
|
|
* @default - default master key
|
|
*/
|
|
abstract readonly encryptionKey?: kms.IKey;
|
|
/**
|
|
* Secret used to instantiate this Login.
|
|
*
|
|
* @default - none
|
|
*/
|
|
abstract readonly secret?: secretsmanager.ISecret;
|
|
/**
|
|
* The characters to exclude from the generated password.
|
|
* Only used if `generatePassword` if true.
|
|
*
|
|
* @default - the DatabaseSecret default exclude character set (" %+~`#$&*()|[]{}:;<>?!'/@\"\\")
|
|
*/
|
|
abstract readonly excludeCharacters?: string;
|
|
/**
|
|
* A list of regions where to replicate the generated secret.
|
|
*
|
|
* @default - Secret is not replicated
|
|
*/
|
|
abstract readonly replicaRegions?: secretsmanager.ReplicaRegion[];
|
|
}
|
|
/**
|
|
* Properties common to single-user and multi-user rotation options.
|
|
*/
|
|
export interface CommonRotationUserOptions {
|
|
/**
|
|
* Specifies the number of days after the previous rotation
|
|
* before Secrets Manager triggers the next automatic rotation.
|
|
*
|
|
* @default - 30 days
|
|
*/
|
|
readonly automaticallyAfter?: Duration;
|
|
/**
|
|
* Specifies characters to not include in generated passwords.
|
|
*
|
|
* @default " %+~`#$&*()|[]{}:;<>?!'/@\"\\"
|
|
*/
|
|
readonly excludeCharacters?: string;
|
|
/**
|
|
* Where to place the rotation Lambda function
|
|
*
|
|
* @default - same placement as instance or cluster
|
|
*/
|
|
readonly vpcSubnets?: ec2.SubnetSelection;
|
|
/**
|
|
* The VPC interface endpoint to use for the Secrets Manager API
|
|
*
|
|
* If you enable private DNS hostnames for your VPC private endpoint (the default), you don't
|
|
* need to specify an endpoint. The standard Secrets Manager DNS hostname the Secrets Manager
|
|
* CLI and SDKs use by default (https://secretsmanager.<region>.amazonaws.com) automatically
|
|
* resolves to your VPC endpoint.
|
|
*
|
|
* @default https://secretsmanager.<region>.amazonaws.com
|
|
*/
|
|
readonly endpoint?: ec2.IInterfaceVpcEndpoint;
|
|
/**
|
|
* The security group for the Lambda rotation function
|
|
*
|
|
* @default - a new security group is created
|
|
*/
|
|
readonly securityGroup?: ec2.ISecurityGroup;
|
|
/**
|
|
* Specifies whether to rotate the secret immediately or wait until the next
|
|
* scheduled rotation window.
|
|
*
|
|
* @default true
|
|
*/
|
|
readonly rotateImmediatelyOnUpdate?: boolean;
|
|
}
|
|
/**
|
|
* Options to add the multi user rotation
|
|
*/
|
|
export interface RotationSingleUserOptions extends CommonRotationUserOptions {
|
|
}
|
|
/**
|
|
* Options to add the multi user rotation
|
|
*/
|
|
export interface RotationMultiUserOptions extends CommonRotationUserOptions {
|
|
/**
|
|
* The secret to rotate. It must be a JSON string with the following format:
|
|
* ```
|
|
* {
|
|
* "engine": <required: database engine>,
|
|
* "host": <required: instance host name>,
|
|
* "username": <required: username>,
|
|
* "password": <required: password>,
|
|
* "dbname": <optional: database name>,
|
|
* "port": <optional: if not specified, default port will be used>,
|
|
* "masterarn": <required: the arn of the master secret which will be used to create users/change passwords>
|
|
* }
|
|
* ```
|
|
*/
|
|
readonly secret: secretsmanager.ISecret;
|
|
}
|
|
/**
|
|
* The retention period for Performance Insight data, in days.
|
|
*
|
|
* Per https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbinstance.html#cfn-rds-dbinstance-performanceinsightsretentionperiod
|
|
* This must be either
|
|
* - 7 days (the default, free tier)
|
|
* - month * 31, where month is a number of months from 1-23
|
|
* - 731 (2 years)
|
|
*/
|
|
export declare enum PerformanceInsightRetention {
|
|
/**
|
|
* Default retention period of 7 days.
|
|
*/
|
|
DEFAULT = 7,
|
|
MONTHS_1 = 31,
|
|
MONTHS_2 = 62,
|
|
MONTHS_3 = 93,
|
|
MONTHS_4 = 124,
|
|
MONTHS_5 = 155,
|
|
MONTHS_6 = 186,
|
|
MONTHS_7 = 217,
|
|
MONTHS_8 = 248,
|
|
MONTHS_9 = 279,
|
|
MONTHS_10 = 310,
|
|
MONTHS_11 = 341,
|
|
MONTHS_12 = 372,
|
|
MONTHS_13 = 403,
|
|
MONTHS_14 = 434,
|
|
MONTHS_15 = 465,
|
|
MONTHS_16 = 496,
|
|
MONTHS_17 = 527,
|
|
MONTHS_18 = 558,
|
|
MONTHS_19 = 589,
|
|
MONTHS_20 = 620,
|
|
MONTHS_21 = 651,
|
|
MONTHS_22 = 682,
|
|
MONTHS_23 = 713,
|
|
/**
|
|
* Long term retention period of 2 years.
|
|
*/
|
|
LONG_TERM = 731
|
|
}
|
|
/**
|
|
* Engine lifecycle support for Amazon RDS and Amazon Aurora
|
|
*/
|
|
export declare enum EngineLifecycleSupport {
|
|
/**
|
|
* Using Amazon RDS extended support
|
|
*/
|
|
OPEN_SOURCE_RDS_EXTENDED_SUPPORT = "open-source-rds-extended-support",
|
|
/**
|
|
* Not using Amazon RDS extended support
|
|
*/
|
|
OPEN_SOURCE_RDS_EXTENDED_SUPPORT_DISABLED = "open-source-rds-extended-support-disabled"
|
|
}
|