RotationMultiUserOptions

class aws_cdk.aws_rds.RotationMultiUserOptions(*, secret, automatically_after=None, endpoint=None, exclude_characters=None, vpc_subnets=None)

Bases: object

Options to add the multi user rotation.

Parameters
  • secret (ISecret) – The secret to rotate. It must be a JSON string with the following format:: { “engine”: <required: database engine>, “host”: <required: instance host name>, “username”: <required: username>, “password”: <required: password>, “dbname”: <optional: database name>, “port”: <optional: if not specified, default port will be used>, “masterarn”: <required: the arn of the master secret which will be used to create users/change passwords> }

  • automatically_after (Optional[Duration]) – Specifies the number of days after the previous rotation before Secrets Manager triggers the next automatic rotation. Default: - 30 days

  • endpoint (Optional[IInterfaceVpcEndpoint]) – The VPC interface endpoint to use for the Secrets Manager API. If you enable private DNS hostnames for your VPC private endpoint (the default), you don’t need to specify an endpoint. The standard Secrets Manager DNS hostname the Secrets Manager CLI and SDKs use by default (https://secretsmanager..amazonaws.com) automatically resolves to your VPC endpoint. Default: https://secretsmanager..amazonaws.com

  • exclude_characters (Optional[str]) – Specifies characters to not include in generated passwords. Default: ” %+~`#$&*()|[]{}:;<>?!’/

  • vpc_subnets (Optional[SubnetSelection]) – Where to place the rotation Lambda function. Default: - same placement as instance or cluster

Example:

# instance is of type DatabaseInstance
# my_imported_secret is of type DatabaseSecret

instance.add_rotation_multi_user("MyUser",
    secret=my_imported_secret
)

Attributes

automatically_after

Specifies the number of days after the previous rotation before Secrets Manager triggers the next automatic rotation.

Default
  • 30 days

Return type

Optional[Duration]

endpoint

The VPC interface endpoint to use for the Secrets Manager API.

If you enable private DNS hostnames for your VPC private endpoint (the default), you don’t need to specify an endpoint. The standard Secrets Manager DNS hostname the Secrets Manager CLI and SDKs use by default (https://secretsmanager..amazonaws.com) automatically resolves to your VPC endpoint.

Default

https://secretsmanager..amazonaws.com

Return type

Optional[IInterfaceVpcEndpoint]

exclude_characters

Specifies characters to not include in generated passwords.

Default

” %+~`#$&*()|[]{}:;<>?!’/

:: “"

Return type

Optional[str]

secret

The secret to rotate.

It must be a JSON string with the following format:

{
   "engine": <required: database engine>,
   "host": <required: instance host name>,
   "username": <required: username>,
   "password": <required: password>,
   "dbname": <optional: database name>,
   "port": <optional: if not specified, default port will be used>,
   "masterarn": <required: the arn of the master secret which will be used to create users/change passwords>
}
Return type

ISecret

vpc_subnets

Where to place the rotation Lambda function.

Default
  • same placement as instance or cluster

Return type

Optional[SubnetSelection]