Class CfnRotationSchedule.HostedRotationLambdaProperty

Creates a new Lambda rotation function based on one of the Secrets Manager rotation function templates .

Inheritance
System.Object
CfnRotationSchedule.HostedRotationLambdaProperty
Namespace: Amazon.CDK.AWS.SecretsManager
Assembly: Amazon.CDK.AWS.SecretsManager.dll
Syntax (csharp)
public class HostedRotationLambdaProperty : Object, CfnRotationSchedule.IHostedRotationLambdaProperty
Syntax (vb)
Public Class HostedRotationLambdaProperty
    Inherits Object
    Implements CfnRotationSchedule.IHostedRotationLambdaProperty
Remarks

You must specify Transform: AWS::SecretsManager-2020-07-23 at the beginning of the CloudFormation template.

For Amazon RDS master user credentials, see AWS::RDS::DBCluster MasterUserSecret .

Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html

ExampleMetadata: fixture=_generated

Examples
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
using Amazon.CDK.AWS.SecretsManager;

var hostedRotationLambdaProperty = new HostedRotationLambdaProperty {
    RotationType = "rotationType",

    // the properties below are optional
    ExcludeCharacters = "excludeCharacters",
    KmsKeyArn = "kmsKeyArn",
    MasterSecretArn = "masterSecretArn",
    MasterSecretKmsKeyArn = "masterSecretKmsKeyArn",
    RotationLambdaName = "rotationLambdaName",
    Runtime = "runtime",
    SuperuserSecretArn = "superuserSecretArn",
    SuperuserSecretKmsKeyArn = "superuserSecretKmsKeyArn",
    VpcSecurityGroupIds = "vpcSecurityGroupIds",
    VpcSubnetIds = "vpcSubnetIds"
};

Synopsis

Constructors

HostedRotationLambdaProperty()

Properties

ExcludeCharacters

A string of the characters that you don't want in the password.
KmsKeyArn

The ARN of the KMS key that Secrets Manager uses to encrypt the secret.
MasterSecretArn

The ARN of the secret that contains superuser credentials, if you use the Alternating users rotation strategy . CloudFormation grants the execution role for the Lambda rotation function GetSecretValue permission to the secret in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .
MasterSecretKmsKeyArn

The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the alternating users strategy and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key aws/secretsmanager . CloudFormation grants the execution role for the Lambda rotation function Decrypt , DescribeKey , and GenerateDataKey permission to the key in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .
RotationLambdaName

The name of the Lambda rotation function.
RotationType

The rotation template to base the rotation function on, one of the following:.
Runtime

By default, CloudFormation deploys Python 3.9 binaries for the rotation function. To use a different version of Python, you must do the following two steps:.
SuperuserSecretArn

The ARN of the secret that contains superuser credentials, if you use the Alternating users rotation strategy . CloudFormation grants the execution role for the Lambda rotation function GetSecretValue permission to the secret in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .
SuperuserSecretKmsKeyArn

The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the alternating users strategy and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key aws/secretsmanager . CloudFormation grants the execution role for the Lambda rotation function Decrypt , DescribeKey , and GenerateDataKey permission to the key in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .
VpcSecurityGroupIds

A comma-separated list of security group IDs applied to the target database.
VpcSubnetIds

A comma separated list of VPC subnet IDs of the target database network.

Constructors

HostedRotationLambdaProperty()

public HostedRotationLambdaProperty()

Properties

ExcludeCharacters

A string of the characters that you don't want in the password.

public string ExcludeCharacters { get; set; }
Property Value

System.String

Remarks

Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-excludecharacters

KmsKeyArn

The ARN of the KMS key that Secrets Manager uses to encrypt the secret.

public string KmsKeyArn { get; set; }
Property Value

System.String

Remarks

If you don't specify this value, then Secrets Manager uses the key aws/secretsmanager . If aws/secretsmanager doesn't yet exist, then Secrets Manager creates it for you automatically the first time it encrypts the secret value.

Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-kmskeyarn

MasterSecretArn

The ARN of the secret that contains superuser credentials, if you use the Alternating users rotation strategy . CloudFormation grants the execution role for the Lambda rotation function GetSecretValue permission to the secret in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

public string MasterSecretArn { get; set; }
Property Value

System.String

Remarks

You must create the superuser secret before you can set this property.

You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see JSON structure of Secrets Manager secrets .

You can specify MasterSecretArn or SuperuserSecretArn but not both. They represent the same superuser secret.

Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-mastersecretarn

MasterSecretKmsKeyArn

The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the alternating users strategy and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key aws/secretsmanager . CloudFormation grants the execution role for the Lambda rotation function Decrypt , DescribeKey , and GenerateDataKey permission to the key in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

public string MasterSecretKmsKeyArn { get; set; }
Property Value

System.String

Remarks

You can specify MasterSecretKmsKeyArn or SuperuserSecretKmsKeyArn but not both. They represent the same superuser secret KMS key .

Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-mastersecretkmskeyarn

RotationLambdaName

The name of the Lambda rotation function.

public string RotationLambdaName { get; set; }
Property Value

System.String

Remarks

Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-rotationlambdaname

RotationType

The rotation template to base the rotation function on, one of the following:.

public string RotationType { get; set; }
Property Value

System.String

Remarks

    Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-rotationtype

    Runtime

    By default, CloudFormation deploys Python 3.9 binaries for the rotation function. To use a different version of Python, you must do the following two steps:.

    public string Runtime { get; set; }
    Property Value

    System.String

    Remarks

      If you only do one of the steps, your rotation function will be incompatible with the binaries. For more information, see Why did my Lambda rotation function fail with a "pg module not found" error .

      Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-runtime

      SuperuserSecretArn

      The ARN of the secret that contains superuser credentials, if you use the Alternating users rotation strategy . CloudFormation grants the execution role for the Lambda rotation function GetSecretValue permission to the secret in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

      public string SuperuserSecretArn { get; set; }
      Property Value

      System.String

      Remarks

      You must create the superuser secret before you can set this property.

      You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see JSON structure of Secrets Manager secrets .

      You can specify MasterSecretArn or SuperuserSecretArn but not both. They represent the same superuser secret.

      Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-superusersecretarn

      SuperuserSecretKmsKeyArn

      The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the alternating users strategy and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key aws/secretsmanager . CloudFormation grants the execution role for the Lambda rotation function Decrypt , DescribeKey , and GenerateDataKey permission to the key in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

      public string SuperuserSecretKmsKeyArn { get; set; }
      Property Value

      System.String

      Remarks

      You can specify MasterSecretKmsKeyArn or SuperuserSecretKmsKeyArn but not both. They represent the same superuser secret KMS key .

      Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-superusersecretkmskeyarn

      VpcSecurityGroupIds

      A comma-separated list of security group IDs applied to the target database.

      public string VpcSecurityGroupIds { get; set; }
      Property Value

      System.String

      Remarks

      The template applies the same security groups as on the Lambda rotation function that is created as part of this stack.

      Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-vpcsecuritygroupids

      VpcSubnetIds

      A comma separated list of VPC subnet IDs of the target database network.

      public string VpcSubnetIds { get; set; }
      Property Value

      System.String

      Remarks

      The Lambda rotation function is in the same subnet group.

      Link: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html#cfn-secretsmanager-rotationschedule-hostedrotationlambda-vpcsubnetids

      Implements