# DatabaseProxyEndpointOptions

Options for a new DatabaseProxyEndpoint.

- Source: [`aws-rds/lib/proxy-endpoint.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-rds/lib/proxy-endpoint.ts#L40)
- Type last changed: v2.215.0 · 15 Sep 2025

## Example

```ts
declare const vpc: ec2.Vpc;
declare const secrets: secretsmanager.Secret[];
declare const dbInstance: rds.DatabaseInstance;

const proxy = dbInstance.addProxy('Proxy', {
  secrets,
  vpc,
});

// Add a reader endpoint
proxy.addEndpoint('ProxyEndpoint', {
  vpc,
  targetRole: rds.ProxyEndpointTargetRole.READ_ONLY,
});
```

## Properties

- `dbProxyEndpointName`: string — The name of the DB proxy endpoint.

  **Default:** a CDK generated name

- `securityGroups`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html)[] — The VPC security groups to associate with the new proxy endpoint.

  **Default:** Default security group for the VPC

- `targetRole`: [ProxyEndpointTargetRole](/cdk/api/v2/docs/aws-cdk-lib.aws_rds.ProxyEndpointTargetRole.html) — A value that indicates whether the DB proxy endpoint can be used for read/write or read-only operations.

  **Default:** ProxyEndpointTargetRole.READ_WRITE

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) (required) — The VPC of the DB proxy endpoint.

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html) — The subnets of DB proxy endpoint.

  **Default:** the VPC default strategy if not specified.