# SnapshotCredentials

Credentials to update the password for a ``DatabaseInstanceFromSnapshot``.

- Source: [`aws-rds/lib/props.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-rds/lib/props.ts#L349)
- Type last changed: v2.72.0 · 29 Mar 2023

## Example

```ts
declare const vpc: ec2.Vpc;
const engine = rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_16_3 });
const myKey = new kms.Key(this, 'MyKey');

new rds.DatabaseInstanceFromSnapshot(this, 'InstanceFromSnapshotWithCustomizedSecret', {
  engine,
  vpc,
  snapshotIdentifier: 'mySnapshot',
  credentials: rds.SnapshotCredentials.fromGeneratedSecret('username', {
    encryptionKey: myKey,
    excludeCharacters: '!&*^#@()',
    replicaRegions: [{ region: 'eu-west-1' }, { region: 'eu-west-2' }],
  }),
});
```

## Initializer

```ts
new SnapshotCredentials()
```

## Properties

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — KMS encryption key to encrypt the generated secret.

  **Default:** default master key

- `excludeCharacters`: string — The characters to exclude from the generated password.

  **Default:** the DatabaseSecret default exclude character set (" %+~`#$&*()|[]{}:;<>?!'/@\"\\")

  Only used if `generatePassword` if true.

- `generatePassword`: boolean (required) — Whether a new password should be generated.

- `password`: [SecretValue](/cdk/api/v2/docs/aws-cdk-lib.SecretValue.html) — The master user password.

  **Default:** the existing password from the snapshot

  Do not put passwords in your CDK code directly.

- `replaceOnPasswordCriteriaChanges`: boolean = false — Whether to replace the generated secret when the criteria for the password change.

- `replicaRegions`: [ReplicaRegion](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ReplicaRegion.html)[] — A list of regions where to replicate the generated secret.

  **Default:** Secret is not replicated

- `secret`: [ISecret](/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.ISecret.html) = none — Secret used to instantiate this Login.

- `username`: string — The master user name.

  **Default:** the existing username from the snapshot

  Must be the **current** master user name of the snapshot.
  It is not possible to change the master user name of a RDS instance.

## Methods

- `fromGeneratedPassword(username: string, options?: SnapshotCredentialsFromGeneratedPasswordOptions): SnapshotCredentials // chainable` (static) — Generate a new password for the snapshot, using the existing username and an optional encryption key.

  Note - The username must match the existing master username of the snapshot.

  NOTE: use `fromGeneratedSecret()` for new Clusters and Instances. Switching from
  `fromGeneratedPassword()` to `fromGeneratedSecret()` for already deployed Clusters
  or Instances will update their master password.

- `fromGeneratedSecret(username: string, options?: SnapshotCredentialsFromGeneratedPasswordOptions): SnapshotCredentials // chainable` (static) — Generate a new password for the snapshot, using the existing username and an optional encryption key.

  The new credentials are stored in Secrets Manager.

  Note - The username must match the existing master username of the snapshot.

- `fromPassword(password: SecretValue): SnapshotCredentials // chainable` (static) — Update the snapshot login with an existing password.

- `fromSecret(secret: ISecret): SnapshotCredentials // chainable` (static) — Update the snapshot login with an existing password from a Secret.

  The Secret must be a JSON string with a ``password`` field:
  ```
  {
    ...
    "password": <required: password>,
  }
  ```