# DatabaseInstance

A database instance.

Extends: Construct › Resource › DatabaseInstanceBase › DatabaseInstance
Implements: IResource, IConnectable, IDatabaseInstance, ISecretAttachmentTarget, IEnvironmentAware, IDBInstanceRef, IConstruct, IDependable

- CloudFormation: [`AWS::RDS::DBInstance`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.html)
- L1 type: [`CfnDBInstance`](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.CfnDBInstance.html)
- Source: [`aws-rds/lib/instance.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-rds/lib/instance.ts#L1348)
- Type last changed: v2.261.0 · 2 Jul 2026

## Example

```ts
declare const vpc: ec2.Vpc;
const instance = new rds.DatabaseInstance(this, 'Instance', {
  engine: rds.DatabaseInstanceEngine.oracleSe2({ version: rds.OracleEngineVersion.VER_19_0_0_0_2020_04_R1 }),
  // optional, defaults to m5.large
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.SMALL),
  credentials: rds.Credentials.fromGeneratedSecret('syscdk'), // Optional - will default to 'admin' username and generated password
  vpc,
  vpcSubnets: {
    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
  }
});
```

## Initializer

```ts
new DatabaseInstance(scope: Construct, id: string, props: DatabaseInstanceProps)
```

## Construct Props

- `allocatedStorage`: number = 100 — The allocated storage size, specified in gibibytes (GiB).

- `allowMajorVersionUpgrade`: boolean = false — Whether to allow major version upgrades.

- `applyImmediately`: boolean — Specifies whether changes to the DB instance and any pending modifications are applied immediately, regardless of the `preferredMaintenanceWindow` setting.

  **Default:** Changes will be applied immediately

  If set to `false`, changes are applied during the next maintenance window.

  Until RDS applies the changes, the DB instance remains in a drift state.
  As a result, the configuration doesn't fully reflect the requested modifications and temporarily diverges from the intended state.

  This property also determines whether the DB instance reboots when a static parameter is modified in the associated DB parameter group.

- `autoMinorVersionUpgrade`: boolean = true — Indicates that minor engine upgrades are applied automatically to the DB instance during the maintenance window.

- `availabilityZone`: string — The name of the Availability Zone where the DB instance will be located.

  **Default:** no preference

- `backupRetention`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) — The number of days during which automatic DB snapshots are retained.

  **Default:** Duration.days(1) for source instances, disabled for read replicas

  Set to zero to disable backups.
  When creating a read replica, you must enable automatic backups on the source
  database instance by setting the backup retention to a value other than zero.

- `caCertificate`: [CaCertificate](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.CaCertificate.html) — The identifier of the CA certificate for this DB instance.

  **Default:** RDS will choose a certificate authority

  Specifying or updating this property triggers a reboot.

  For RDS DB engines:

- `characterSetName`: string — For supported engines, specifies the character set to associate with the DB instance.

  **Default:** RDS default character set name

- `cloudwatchLogsExports`: string[] — The list of log types that need to be enabled for exporting to CloudWatch Logs.

  **Default:** no log exports

- `cloudwatchLogsRetention`: [RetentionDays](/cdk/api/v2/docs/aws-cdk-lib.aws_logs.RetentionDays.html) — The number of days log events are kept in CloudWatch Logs.

  **Default:** logs never expire

  When updating
  this property, unsetting it doesn't remove the log retention policy. To
  remove the retention policy, set the value to `Infinity`.

- `cloudwatchLogsRetentionRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — The IAM role for the Lambda function associated with the custom resource that sets the retention policy.

  **Default:** a new role is created.

- `copyTagsToSnapshot`: boolean = true — Indicates whether to copy all of the user-defined tags from the DB instance to snapshots of the DB instance.

- `credentials`: [Credentials](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.Credentials.html) — Credentials for the administrative user.

  **Default:** A username of 'admin' (or 'postgres' for PostgreSQL) and SecretsManager-generated password

- `databaseInsightsMode`: [DatabaseInsightsMode](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.DatabaseInsightsMode.html) — The database insights mode.

  **Default:** DatabaseInsightsMode.STANDARD when performance insights are enabled, otherwise not set.

- `databaseName`: string — The name of the database.

  **Default:** no name

- `deleteAutomatedBackups`: boolean = true — Indicates whether automated backups should be deleted or retained when you delete a DB instance.

- `deletionProtection`: boolean — Indicates whether the DB instance should have deletion protection enabled.

  **Default:** true if ``removalPolicy`` is RETAIN, false otherwise

- `domain`: string — The Active Directory directory ID to create the DB instance in.

  **Default:** Do not join domain

- `domainRole`: [IRoleRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_iam.IRoleRef.html) — The IAM role to be used when making API calls to the Directory Service.

  **Default:** The role will be created for you if `DatabaseInstanceNewProps#domain` is specified

  The role needs the AWS-managed policy
  AmazonRDSDirectoryServiceAccess or equivalent.

- `enablePerformanceInsights`: boolean — Whether to enable Performance Insights for the DB instance.

  **Default:** false, unless ``performanceInsightRetention`` or ``performanceInsightEncryptionKey`` is set.

- `engine`: [IInstanceEngine](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.IInstanceEngine.html) (required) — The database engine.

- `engineLifecycleSupport`: [EngineLifecycleSupport](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.EngineLifecycleSupport.html) — The life cycle type for this DB instance.

  **Default:** undefined - AWS RDS default setting is `EngineLifecycleSupport.OPEN_SOURCE_RDS_EXTENDED_SUPPORT`

  This setting applies only to RDS for MySQL and RDS for PostgreSQL.

- `iamAuthentication`: boolean = false — Whether to enable mapping of AWS Identity and Access Management (IAM) accounts to database accounts.

- `instanceIdentifier`: string — A name for the DB instance.

  **Default:** a CloudFormation generated name

  If you specify a name, AWS CloudFormation
  converts it to lowercase.

- `instanceType`: [InstanceType](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.InstanceType.html) — The name of the compute and memory capacity for the instance.

  **Default:** m5.large (or, more specifically, db.m5.large)

- `iops`: number — The number of I/O operations per second (IOPS) that the database provisions.

  **Default:** no provisioned iops if storage type is not specified. For GP3: 3,000 IOPS if allocated storage is less than 400 GiB for MariaDB, MySQL, and PostgreSQL, less than 200 GiB for Oracle and less than 20 GiB for SQL Server. 12,000 IOPS otherwise (except for SQL Server where the default is always 3,000 IOPS).

  The value must be equal to or greater than 1000.

- `licenseModel`: [LicenseModel](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.LicenseModel.html) — The license model.

  **Default:** RDS default license model

- `manageMasterUserPassword`: boolean = false — Whether to use RDS native integration with AWS Secrets Manager for master user password management.

  When enabled, RDS generates and manages the master user password in Secrets Manager.
  Cannot be used together with credentials containing a password.

- `maxAllocatedStorage`: number — Upper limit to which RDS can scale the storage in GiB(Gibibyte).

  **Default:** No autoscaling of RDS instance

- `monitoringInterval`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) — The interval, in seconds, between points when Amazon RDS collects enhanced monitoring metrics for the DB instance.

  **Default:** no enhanced monitoring

- `monitoringRole`: [IRoleRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_iam.IRoleRef.html) — Role that will be used to manage DB instance monitoring.

  **Default:** A role is automatically created for you

- `multiAz`: boolean = false — Specifies if the database instance is a multiple Availability Zone deployment.

- `networkType`: [NetworkType](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.NetworkType.html) = IPV4 — The network type of the DB instance.

- `optionGroup`: [IOptionGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.IOptionGroup.html) — The option group to associate with the instance.

  **Default:** no option group

- `parameterGroup`: [IParameterGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.IParameterGroup.html) — The DB parameter group to associate with the instance.

  **Default:** no parameter group

- `parameters`: { [key: string]: string } = None — The parameters in the DBParameterGroup to create automatically.

  You can only specify parameterGroup or parameters but not both.
  You need to use a versioned engine to auto-generate a DBParameterGroup.

- `performanceInsightEncryptionKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — The AWS KMS key for encryption of Performance Insights data.

  **Default:** default master key

- `performanceInsightRetention`: [PerformanceInsightRetention](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.PerformanceInsightRetention.html) — The amount of time, in days, to retain Performance Insights data.

  **Default:** 7 this is the free tier

  If you set `databaseInsightsMode` to `DatabaseInsightsMode.ADVANCED`, you must set this property to `PerformanceInsightRetention.MONTHS_15`.

- `port`: number — The port for the instance.

  **Default:** the default port for the chosen engine.

- `preferredBackupWindow`: string — The daily time range during which automated backups are performed.

  **Default:** a 30-minute window selected at random from an 8-hour block of time for each AWS Region. To see the time blocks available, see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html#USER_WorkingWithAutomatedBackups.BackupWindow

  Constraints:
  - Must be in the format `hh24:mi-hh24:mi`.
  - Must be in Universal Coordinated Time (UTC).
  - Must not conflict with the preferred maintenance window.
  - Must be at least 30 minutes.

- `preferredMaintenanceWindow`: string — The weekly time range (in UTC) during which system maintenance can occur.

  **Default:** a 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week. To see the time blocks available, see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html#Concepts.DBMaintenance

  Format: `ddd:hh24:mi-ddd:hh24:mi`
  Constraint: Minimum 30-minute window

- `processorFeatures`: [ProcessorFeatures](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.ProcessorFeatures.html) — The number of CPU cores and the number of threads per core.

  **Default:** the default number of CPU cores and threads per core for the chosen instance class. See https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html#USER_ConfigureProcessor

- `publiclyAccessible`: boolean — Indicates whether the DB instance is an internet-facing instance.

  **Default:** `true` if the instance's `vpcSubnets` is `subnetType: SubnetType.PUBLIC`, `false` otherwise

  If not specified,
  the instance's vpcSubnets will be used to determine if the instance is internet-facing
  or not.

- `removalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) — The CloudFormation policy to apply when the instance is removed from the stack or replaced during an update.

  **Default:** RemovalPolicy.SNAPSHOT (remove the resource, but retain a snapshot of the data)

- `s3ExportBuckets`: [IBucket](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.IBucket.html)[] = None — S3 buckets that you want to load data into.

  This property must not be used if `s3ExportRole` is used.

  For Microsoft SQL Server:

- `s3ExportRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — Role that will be associated with this DB instance to enable S3 export.

  **Default:** New role is created if `s3ExportBuckets` is set, no role is defined otherwise

  This property must not be used if `s3ExportBuckets` is used.

  For Microsoft SQL Server:

- `s3ImportBuckets`: [IBucket](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.IBucket.html)[] = None — S3 buckets that you want to load data from.

  This feature is only supported by the Microsoft SQL Server, Oracle, and PostgreSQL engines.

  This property must not be used if `s3ImportRole` is used.

  For Microsoft SQL Server:

- `s3ImportRole`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) — Role that will be associated with this DB instance to enable S3 import.

  **Default:** New role is created if `s3ImportBuckets` is set, no role is defined otherwise

  This feature is only supported by the Microsoft SQL Server, Oracle, and PostgreSQL engines.

  This property must not be used if `s3ImportBuckets` is used.

  For Microsoft SQL Server:

- `securityGroups`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html)[] — The security groups to assign to the DB instance.

  **Default:** a new security group is created

- `storageEncrypted`: boolean — Indicates whether the DB instance is encrypted.

  **Default:** true if storageEncryptionKey has been provided, false otherwise

- `storageEncryptionKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — The KMS key that's used to encrypt the DB instance.

  **Default:** default master key if storageEncrypted is true, no key otherwise

- `storageThroughput`: number — The storage throughput, specified in mebibytes per second (MiBps).

  **Default:** 125 MiBps if allocated storage is less than 400 GiB for MariaDB, MySQL, and PostgreSQL, less than 200 GiB for Oracle and less than 20 GiB for SQL Server. 500 MiBps otherwise (except for SQL Server where the default is always 125 MiBps).

  Only applicable for GP3.

- `storageType`: [StorageType](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.StorageType.html) = StorageType.GP2 — The storage type to associate with the DB instance.

  Storage types supported are gp2, gp3, io1, io2, and standard.

- `subnetGroup`: [IDBSubnetGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_rds.IDBSubnetGroupRef.html) — Existing subnet group for the instance.

  **Default:** a new subnet group will be created.

- `timezone`: string — The time zone of the instance.

  **Default:** RDS default timezone

  This is currently supported only by Microsoft Sql Server.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) (required) — The VPC network where the DB subnet group should be created.

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html) — The type of subnets to add to the created DB subnet group.

  **Default:** private subnets

## Properties

- `cloudwatchLogGroups`: { [key: string]: [ILogGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_logs.ILogGroup.html) } (required) — The log group is created when `cloudwatchLogsExports` is set.

  Each export value will create a separate log group.

- `connections`: [Connections](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) (required) — Access to network connections.

- `dbInstanceEndpointAddress`: string (required) — The instance endpoint address.

- `dbInstanceEndpointPort`: string (required) — The instance endpoint port.

- `dbInstanceRef`: [DBInstanceReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_rds.DBInstanceReference.html) (required) — A reference to this database instance.

- `engine`: [IInstanceEngine](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.IInstanceEngine.html) — The engine of this database Instance.

  May be not known for imported Instances if it wasn't provided explicitly,
  or for read replicas.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) (required) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `instanceArn`: string (required) — The instance arn.

- `instanceEndpoint`: [Endpoint](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.Endpoint.html) (required) — The instance endpoint.

- `instanceIdentifier`: string (required) — The instance identifier.

- `instanceResourceId`: string — The AWS Region-unique, immutable identifier for the DB instance.

  This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB instance is accessed.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) (required) — The tree node.

- `PROPERTY_INJECTION_ID`: string (required) (static) — Uniquely identifies this class.

- `secret`: [ISecret](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ISecret.html) — The AWS Secrets Manager secret attached to the instance.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) (required) — The stack in which this resource is defined.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) (required) — The VPC where this database instance is deployed.

## Methods

- `addProxy(id: string, options: DatabaseProxyOptions): DatabaseProxy` — Add a new db proxy to this instance.

- `addRotationMultiUser(id: string, options: RotationMultiUserOptions): SecretRotation` — Adds the multi user rotation to this instance.

- `addRotationSingleUser(options?: RotationSingleUserOptions): SecretRotation` — Adds the single user rotation of the master password to this instance.

  **Parameters**

  - `options` — the options for the rotation, if you want to override the defaults.

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `asSecretAttachmentTarget(): SecretAttachmentTargetProps` — Renders the secret attachment target specifications.

- `fromDatabaseInstanceAttributes(scope: Construct, id: string, attrs: DatabaseInstanceAttributes): IDatabaseInstance` (static) — Import an existing database instance.

- `fromLookup(scope: Construct, id: string, options: DatabaseInstanceLookupOptions): IDatabaseInstance` (static) — Lookup an existing DatabaseInstance using instanceIdentifier.

- `grantConnect(grantee: IGrantable, dbUser?: string): Grant` — Grant the given identity connection access to the database.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — the Principal to grant the permissions to.
  - `dbUser` — the name of the database user to allow connecting as to the db instance, or the default database user, obtained from the Secret, if not specified.

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `metric(metricName: string, props?: MetricOptions): Metric` — Return the given named metric for this DBInstance.

- `metricCPUUtilization(props?: MetricOptions): Metric` — The percentage of CPU utilization.

  Average over 5 minutes

- `metricDatabaseConnections(props?: MetricOptions): Metric` — The number of database connections in use.

  Average over 5 minutes

- `metricFreeableMemory(props?: MetricOptions): Metric` — The amount of available random access memory.

  Average over 5 minutes

- `metricFreeStorageSpace(props?: MetricOptions): Metric` — The amount of available storage space.

  Average over 5 minutes

- `metricReadIOPS(props?: MetricOptions): Metric` — The average number of disk read I/O operations per second. The average number of disk write I/O operations per second.

  Average over 5 minutes

- `metricWriteIOPS(props?: MetricOptions): Metric` — The average number of disk write I/O operations per second. The average number of disk read I/O operations per second.

  Average over 5 minutes

- `onEvent(id: string, options?: OnEventOptions): Rule` — Defines a CloudWatch event rule which triggers for instance events.

  Use
  `rule.addEventPattern(pattern)` to specify a filter.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.