# DatabaseClusterProps

Properties for a new database cluster.

Extends: DatabaseClusterProps
Used as props by: DatabaseCluster

- Source: [`aws-docdb/lib/cluster.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-docdb/lib/cluster.ts#L65)
- Type last changed: v2.265.0 · 13 Aug 2026

## Example

```ts
declare const vpc: ec2.Vpc;
const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
  },
  vpc,
  deletionProtection: true, // Enable deletion protection.
});
```

## Properties

- `backup`: [BackupProps](/cdk/api/v2/docs/aws-cdk-lib.aws_docdb.BackupProps.html) = Backup retention period for automated backups is 1 day. Backup preferred window is set to a 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week. — Backup settings.

  **Default:** Backup retention period for automated backups is 1 day. Backup preferred window is set to a 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week.

- `caCertificate`: [CaCertificate](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.CaCertificate.html) = DocumentDB will choose a certificate authority — The identifier of the CA certificate used for the instances.

  Specifying or updating this property triggers a reboot.

  **Default:** DocumentDB will choose a certificate authority

- `cloudWatchLogsRetention`: [RetentionDays](/cdk/api/v2/docs/aws-cdk-lib.aws_logs.RetentionDays.html) = logs never expire — The number of days log events are kept in CloudWatch Logs.

  When updating
  this property, unsetting it doesn't remove the log retention policy. To
  remove the retention policy, set the value to `Infinity`.

- `cloudWatchLogsRetentionRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) = a new role is created. — The IAM role for the Lambda function associated with the custom resource that sets the retention policy.

- `copyTagsToSnapshot`: boolean = false — Whether to copy tags to the snapshot when a snapshot is created.

- `dbClusterName`: string = A name is automatically generated. — An optional identifier for the cluster.

  **Default:** A name is automatically generated.

- `deletionProtection`: boolean = false — Specifies whether this cluster can be deleted.

  If deletionProtection is
  enabled, the cluster cannot be deleted unless it is modified and
  deletionProtection is disabled. deletionProtection protects clusters from
  being accidentally deleted.

- `enablePerformanceInsights`: boolean = false — A value that indicates whether to enable Performance Insights for the instances in the DB Cluster.

- `engineVersion`: string = the latest major version — What version of the database to start.

- `exportAuditLogsToCloudWatch`: boolean = false — Whether the audit logs should be exported to CloudWatch.

  Note that you also have to configure the audit log export in the Cluster's Parameter Group.

- `exportProfilerLogsToCloudWatch`: boolean = false — Whether the profiler logs should be exported to CloudWatch.

  Note that you also have to configure the profiler log export in the Cluster's Parameter Group.

- `instanceIdentifierBase`: string = `dbClusterName` is used with the word "Instance" appended. If `dbClusterName` is not provided, the identifier is automatically generated. — Base identifier for instances.

  Every replica is named by appending the replica number to this string, 1-based.
  Only applicable for provisioned clusters.

  **Default:** `dbClusterName` is used with the word "Instance" appended. If `dbClusterName` is not provided, the identifier is automatically generated.

- `instanceMaintenanceWindow`: string = a 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week. — The weekly time range during which system maintenance can occur on the cluster's instances.

  The cluster-level `preferredMaintenanceWindow` applies to cluster-wide maintenance events; this prop
  applies to each auto-created instance independently. To use the same window for both, set this prop
  to the same value as `preferredMaintenanceWindow`.

  Format: `ddd:hh24:mi-ddd:hh24:mi`. Must be at least 30 minutes long.
  Example: 'sat:09:00-sat:09:30'

  Only applicable to provisioned clusters; has no effect on serverless clusters because they do not
  create instances.

  **Default:** a 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week.

- `instanceRemovalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) = `RemovalPolicy.DESTROY` when `removalPolicy` is set to `SNAPSHOT`, `removalPolicy` otherwise. — The removal policy to apply to the cluster's instances.

  Cannot be set to `SNAPSHOT`.

  **Default:** `RemovalPolicy.DESTROY` when `removalPolicy` is set to `SNAPSHOT`, `removalPolicy` otherwise.

- `instances`: number = 1 — Number of DocDB compute instances.

- `instanceType`: [InstanceType](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.InstanceType.html) = None — What type of instance to start for the replicas.

  Required for provisioned clusters, not applicable for serverless clusters.

- `kmsKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) = default master key. — The KMS key for storage encryption.

- `manageMasterUserPassword`: boolean = false — Specifies whether to manage the master user password with AWS Secrets Manager.

  When set to true, Amazon DocumentDB will automatically generate and manage the master user password in AWS Secrets Manager.
  This provides enhanced security and automatic password rotation capabilities.

  Constraint: You can't manage the master user password with AWS Secrets Manager if `masterUser.password` is specified.

  The `secret` property of the cluster is not set when using this option. See the
  module README for how to access the managed secret.

- `masterUser`: [Login](/cdk/api/v2/docs/aws-cdk-lib.aws_docdb.Login.html) (required) — Username and password for the administrative user.

- `masterUserSecretKmsKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) = default AWS managed key `aws/secretsmanager` — The AWS KMS key to encrypt a secret that is automatically generated and managed in AWS Secrets Manager.

  This setting is valid only if the master user password is managed by Amazon DocumentDB in AWS Secrets Manager
  for the DB cluster (i.e. when `manageMasterUserPassword` is true).
  If you don't specify this property, then the `aws/secretsmanager` KMS key is used to encrypt the secret.

  **Default:** default AWS managed key `aws/secretsmanager`

- `parameterGroup`: [IDBClusterParameterGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_docdb.IDBClusterParameterGroupRef.html) = no parameter group — The DB parameter group to associate with the instance.

- `port`: number = DatabaseCluster.DEFAULT_PORT — The port the DocumentDB cluster will listen on.

- `preferredMaintenanceWindow`: string = 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week. — A weekly time range in which maintenance should preferably execute.

  Must be at least 30 minutes long.

  Example: 'tue:04:17-tue:04:47'

  **Default:** 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week.

- `removalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) = Retain cluster. — The removal policy to apply when the cluster and its instances are removed or replaced during a stack update, or when the stack is deleted.

  This
  removal policy also applies to the implicit security group created for the
  cluster if one is not supplied as a parameter.

  When set to `SNAPSHOT`, the removal policy for the instances and the security group
  will default to `DESTROY` as those resources do not support the policy.

  Use the `instanceRemovalPolicy` and `securityGroupRemovalPolicy` to change the behavior.

- `securityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) = a new security group is created. — Security group.

- `securityGroupRemovalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) = `RemovalPolicy.DESTROY` when `removalPolicy` is set to `SNAPSHOT`, `removalPolicy` otherwise. — The removal policy to apply to the cluster's security group.

  Cannot be set to `SNAPSHOT`.

  **Default:** `RemovalPolicy.DESTROY` when `removalPolicy` is set to `SNAPSHOT`, `removalPolicy` otherwise.

- `serverlessV2ScalingConfiguration`: [ServerlessV2ScalingConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_docdb.ServerlessV2ScalingConfiguration.html) = None — ServerlessV2 scaling configuration.

  When specified, the cluster will be created as a serverless cluster.

- `storageEncrypted`: boolean = true — Whether to enable storage encryption.

- `storageType`: [StorageType](/cdk/api/v2/docs/aws-cdk-lib.aws_docdb.StorageType.html) = StorageType.STANDARD — The storage type of the DocDB cluster.

  I/O-optimized storage is supported starting with engine version 5.0.0.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) (required) — What subnets to run the DocumentDB instances in.

  Must be at least 2 subnets in two different AZs.

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html) = private subnets — Where to place the instances within the VPC.