aws-cdk-lib.aws_docdb

Amazon DocumentDB Construct Library

Starting a Clustered Database

To set up a clustered DocumentDB database, define a DatabaseCluster. You must always launch a database in a VPC. Use the vpcSubnets attribute to control whether your instances will be launched privately or publicly:

declare const vpc: ec2.Vpc;
const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser', // NOTE: 'admin' is reserved by DocumentDB
    excludeCharacters: '\"@/:', // optional, defaults to the set "\"@/" and is also used for eventually created rotations
    secretName: '/myapp/mydocdb/masteruser', // optional, if you prefer to specify the secret name
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
  },
  vpc,
  copyTagsToSnapshot: true  // whether to save the cluster tags when creating the snapshot.
});

# vpc: ec2.Vpc

cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser",  # NOTE: 'admin' is reserved by DocumentDB
        exclude_characters="\"@/:",  # optional, defaults to the set "\"@/" and is also used for eventually created rotations
        secret_name="/myapp/mydocdb/masteruser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PUBLIC
    ),
    vpc=vpc,
    copy_tags_to_snapshot=True
)

Vpc vpc;

DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser") // NOTE: 'admin' is reserved by DocumentDB
                .excludeCharacters("\"@/:") // optional, defaults to the set "\"@/" and is also used for eventually created rotations
                .secretName("/myapp/mydocdb/masteruser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpcSubnets(SubnetSelection.builder()
                .subnetType(SubnetType.PUBLIC)
                .build())
        .vpc(vpc)
        .copyTagsToSnapshot(true)
        .build();

Vpc vpc;

var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser",  // NOTE: 'admin' is reserved by DocumentDB
        ExcludeCharacters = "\"@/:",  // optional, defaults to the set "\"@/" and is also used for eventually created rotations
        SecretName = "/myapp/mydocdb/masteruser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    VpcSubnets = new SubnetSelection {
        SubnetType = SubnetType.PUBLIC
    },
    Vpc = vpc,
    CopyTagsToSnapshot = true
});

var vpc Vpc

cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
		 // NOTE: 'admin' is reserved by DocumentDB
		ExcludeCharacters: jsii.String("\"@/:"),
		 // optional, defaults to the set "\"@/" and is also used for eventually created rotations
		SecretName: jsii.String("/myapp/mydocdb/masteruser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	VpcSubnets: &SubnetSelection{
		SubnetType: ec2.SubnetType_PUBLIC,
	},
	Vpc: Vpc,
	CopyTagsToSnapshot: jsii.Boolean(true),
})

By default, the master password will be generated and stored in AWS Secrets Manager with auto-generated description.

Your cluster will be empty by default.

Serverless Clusters

DocumentDB supports serverless clusters that automatically scale capacity based on your application's needs. To create a serverless cluster, specify the serverlessV2ScalingConfiguration instead of instanceType:

declare const vpc: ec2.Vpc;
const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  vpc,
  serverlessV2ScalingConfiguration: {
    minCapacity: 0.5,
    maxCapacity: 2,
  },
  engineVersion: '5.0.0', // Serverless requires engine version 5.0.0 or higher
});

# vpc: ec2.Vpc

cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    vpc=vpc,
    serverless_v2_scaling_configuration=docdb.ServerlessV2ScalingConfiguration(
        min_capacity=0.5,
        max_capacity=2
    ),
    engine_version="5.0.0"
)

Vpc vpc;

DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .vpc(vpc)
        .serverlessV2ScalingConfiguration(ServerlessV2ScalingConfiguration.builder()
                .minCapacity(0.5)
                .maxCapacity(2)
                .build())
        .engineVersion("5.0.0")
        .build();

Vpc vpc;

var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    Vpc = vpc,
    ServerlessV2ScalingConfiguration = new ServerlessV2ScalingConfiguration {
        MinCapacity = 0.5,
        MaxCapacity = 2
    },
    EngineVersion = "5.0.0"
});

var vpc Vpc

cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	Vpc: Vpc,
	ServerlessV2ScalingConfiguration: &ServerlessV2ScalingConfiguration{
		MinCapacity: jsii.Number(0.5),
		MaxCapacity: jsii.Number(2),
	},
	EngineVersion: jsii.String("5.0.0"),
})

Note: DocumentDB serverless requires engine version 5.0.0 or higher and is not compatible with all features. See the AWS documentation for limitations.

Connecting

To control who can access the cluster, use the .connections attribute. DocumentDB databases have a default port, so you don't need to specify the port:

declare const cluster: docdb.DatabaseCluster;
cluster.connections.allowDefaultPortFromAnyIpv4('Open to the world');

# cluster: docdb.DatabaseCluster

cluster.connections.allow_default_port_from_any_ipv4("Open to the world")

DatabaseCluster cluster;

cluster.connections.allowDefaultPortFromAnyIpv4("Open to the world");

DatabaseCluster cluster;

cluster.Connections.AllowDefaultPortFromAnyIpv4("Open to the world");

var cluster DatabaseCluster

cluster.Connections.AllowDefaultPortFromAnyIpv4(jsii.String("Open to the world"))

The endpoints to access your database cluster will be available as the .clusterEndpoint and .clusterReadEndpoint attributes:

declare const cluster: docdb.DatabaseCluster;
const writeAddress = cluster.clusterEndpoint.socketAddress;   // "HOSTNAME:PORT"

# cluster: docdb.DatabaseCluster

write_address = cluster.cluster_endpoint.socket_address

DatabaseCluster cluster;

String writeAddress = cluster.getClusterEndpoint().getSocketAddress();

DatabaseCluster cluster;

var writeAddress = cluster.ClusterEndpoint.SocketAddress;

var cluster DatabaseCluster

writeAddress := cluster.ClusterEndpoint.socketAddress

If you have existing security groups you would like to add to the cluster, use the addSecurityGroups method. Security groups added in this way will not be managed by the Connections object of the cluster.

declare const vpc: ec2.Vpc;
declare const cluster: docdb.DatabaseCluster;

const securityGroup = new ec2.SecurityGroup(this, 'SecurityGroup', {
  vpc,
});
cluster.addSecurityGroups(securityGroup);

# vpc: ec2.Vpc
# cluster: docdb.DatabaseCluster


security_group = ec2.SecurityGroup(self, "SecurityGroup",
    vpc=vpc
)
cluster.add_security_groups(security_group)

Vpc vpc;
DatabaseCluster cluster;


SecurityGroup securityGroup = SecurityGroup.Builder.create(this, "SecurityGroup")
        .vpc(vpc)
        .build();
cluster.addSecurityGroups(securityGroup);

Vpc vpc;
DatabaseCluster cluster;


var securityGroup = new SecurityGroup(this, "SecurityGroup", new SecurityGroupProps {
    Vpc = vpc
});
cluster.AddSecurityGroups(securityGroup);

var vpc Vpc
var cluster DatabaseCluster


securityGroup := ec2.NewSecurityGroup(this, jsii.String("SecurityGroup"), &SecurityGroupProps{
	Vpc: Vpc,
})
cluster.AddSecurityGroups(securityGroup)

Deletion protection

Deletion protection can be enabled on an Amazon DocumentDB cluster to prevent accidental deletion of the cluster:

declare const vpc: ec2.Vpc;
const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
  },
  vpc,
  deletionProtection: true, // Enable deletion protection.
});

# vpc: ec2.Vpc

cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PUBLIC
    ),
    vpc=vpc,
    deletion_protection=True
)

Vpc vpc;

DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpcSubnets(SubnetSelection.builder()
                .subnetType(SubnetType.PUBLIC)
                .build())
        .vpc(vpc)
        .deletionProtection(true)
        .build();

Vpc vpc;

var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    VpcSubnets = new SubnetSelection {
        SubnetType = SubnetType.PUBLIC
    },
    Vpc = vpc,
    DeletionProtection = true
});

var vpc Vpc

cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	VpcSubnets: &SubnetSelection{
		SubnetType: ec2.SubnetType_PUBLIC,
	},
	Vpc: Vpc,
	DeletionProtection: jsii.Boolean(true),
})

AWS Secrets Manager Integration

DocumentDB clusters can integrate with AWS Secrets Manager to automatically manage master user passwords. This provides enhanced security through automatic password generation and rotation capabilities.

Managed Master User Password

To enable AWS Secrets Manager to manage the master user password, set manageMasterUserPassword to true:

declare const vpc: ec2.Vpc;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  manageMasterUserPassword: true,
  masterUser: {
    username: 'myuser', // Username is still required
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpc,
});

# vpc: ec2.Vpc


cluster = docdb.DatabaseCluster(self, "Database",
    manage_master_user_password=True,
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc=vpc
)

Vpc vpc;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .manageMasterUserPassword(true)
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpc(vpc)
        .build();

Vpc vpc;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    ManageMasterUserPassword = true,
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    Vpc = vpc
});

var vpc Vpc


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	ManageMasterUserPassword: jsii.Boolean(true),
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	Vpc: Vpc,
})

When manageMasterUserPassword is enabled:

• Amazon DocumentDB automatically generates a secure password
• The password is stored in AWS Secrets Manager
• You cannot specify masterUser.password (it will be auto-generated)
• The secret is automatically rotated every 7 days by default

By default (without manageMasterUserPassword), the construct creates and manages a Secrets Manager secret for the master password, and rotation must be configured explicitly with addRotationSingleUser(), which deploys a rotation Lambda function. The manageMasterUserPassword option delegates password management entirely to the DocumentDB service, which includes built-in automatic rotation every 7 days without requiring Lambda functions.

Custom KMS Key for Secret Encryption

You can specify a custom KMS key to encrypt the managed secret:

declare const vpc: ec2.Vpc;
declare const myKmsKey: kms.Key;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  manageMasterUserPassword: true,
  masterUser: {
    username: 'myuser',
  },
  masterUserSecretKmsKey: myKmsKey, // KMS Key for secret encryption
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpc,
});

# vpc: ec2.Vpc
# my_kms_key: kms.Key


cluster = docdb.DatabaseCluster(self, "Database",
    manage_master_user_password=True,
    master_user=docdb.Login(
        username="myuser"
    ),
    master_user_secret_kms_key=my_kms_key,  # KMS Key for secret encryption
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc=vpc
)

Vpc vpc;
Key myKmsKey;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .manageMasterUserPassword(true)
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .masterUserSecretKmsKey(myKmsKey) // KMS Key for secret encryption
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpc(vpc)
        .build();

Vpc vpc;
Key myKmsKey;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    ManageMasterUserPassword = true,
    MasterUser = new Login {
        Username = "myuser"
    },
    MasterUserSecretKmsKey = myKmsKey,  // KMS Key for secret encryption
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    Vpc = vpc
});

var vpc Vpc
var myKmsKey Key


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	ManageMasterUserPassword: jsii.Boolean(true),
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	MasterUserSecretKmsKey: myKmsKey,
	 // KMS Key for secret encryption
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	Vpc: Vpc,
})

Accessing the Managed Secret

The ARN of the secret created by manageMasterUserPassword is not provided by CloudFormation currently (unlike AWS::RDS::DBCluster, the AWS::DocDB::DBCluster resource has no MasterUserSecret.SecretArn attribute), so the secret property of the cluster remains undefined and cannot be used to grant access to the managed secret.

You can retrieve the secret ARN dynamically using a custom resource:

import * as cr from 'aws-cdk-lib/custom-resources';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';

declare const cluster: docdb.DatabaseCluster;
declare const role: iam.Role;

// Call rds:DescribeDBClusters to retrieve the managed secret ARN at deploy time
const getSecretArn = new cr.AwsCustomResource(this, 'GetManagedSecretArn', {
  onUpdate: {
    service: 'DocDB',
    action: 'describeDBClusters',
    parameters: {
      DBClusterIdentifier: cluster.clusterIdentifier,
    },
    physicalResourceId: cr.PhysicalResourceId.of('GetManagedSecretArn'),
  },
  policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
    resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
  }),
});

const managedSecret = secretsmanager.Secret.fromSecretAttributes(this, 'ManagedSecret', {
  secretCompleteArn: getSecretArn.getResponseField('DBClusters.0.MasterUserSecret.SecretArn'),
});
managedSecret.grantRead(role);

import aws_cdk.custom_resources as cr
import aws_cdk.aws_iam as iam
import aws_cdk.aws_secretsmanager as secretsmanager

# cluster: docdb.DatabaseCluster
# role: iam.Role


# Call rds:DescribeDBClusters to retrieve the managed secret ARN at deploy time
get_secret_arn = cr.AwsCustomResource(self, "GetManagedSecretArn",
    on_update=cr.AwsSdkCall(
        service="DocDB",
        action="describeDBClusters",
        parameters={
            "DBClusterIdentifier": cluster.cluster_identifier
        },
        physical_resource_id=cr.PhysicalResourceId.of("GetManagedSecretArn")
    ),
    policy=cr.AwsCustomResourcePolicy.from_sdk_calls(
        resources=cr.AwsCustomResourcePolicy.ANY_RESOURCE
    )
)

managed_secret = secretsmanager.Secret.from_secret_attributes(self, "ManagedSecret",
    secret_complete_arn=get_secret_arn.get_response_field("DBClusters.0.MasterUserSecret.SecretArn")
)
managed_secret.grant_read(role)

import software.amazon.awscdk.customresources.*;
import software.amazon.awscdk.services.iam.*;
import software.amazon.awscdk.services.secretsmanager.*;

DatabaseCluster cluster;
Role role;


// Call rds:DescribeDBClusters to retrieve the managed secret ARN at deploy time
AwsCustomResource getSecretArn = AwsCustomResource.Builder.create(this, "GetManagedSecretArn")
        .onUpdate(AwsSdkCall.builder()
                .service("DocDB")
                .action("describeDBClusters")
                .parameters(Map.of(
                        "DBClusterIdentifier", cluster.getClusterIdentifier()))
                .physicalResourceId(PhysicalResourceId.of("GetManagedSecretArn"))
                .build())
        .policy(AwsCustomResourcePolicy.fromSdkCalls(SdkCallsPolicyOptions.builder()
                .resources(AwsCustomResourcePolicy.ANY_RESOURCE)
                .build()))
        .build();

ISecret managedSecret = Secret.fromSecretAttributes(this, "ManagedSecret", SecretAttributes.builder()
        .secretCompleteArn(getSecretArn.getResponseField("DBClusters.0.MasterUserSecret.SecretArn"))
        .build());
managedSecret.grantRead(role);

using Amazon.CDK.CustomResources;
using Amazon.CDK.AWS.IAM;
using Amazon.CDK.AWS.SecretsManager;

DatabaseCluster cluster;
Role role;


// Call rds:DescribeDBClusters to retrieve the managed secret ARN at deploy time
var getSecretArn = new AwsCustomResource(this, "GetManagedSecretArn", new AwsCustomResourceProps {
    OnUpdate = new AwsSdkCall {
        Service = "DocDB",
        Action = "describeDBClusters",
        Parameters = new Dictionary<string, string> {
            { "DBClusterIdentifier", cluster.ClusterIdentifier }
        },
        PhysicalResourceId = PhysicalResourceId.Of("GetManagedSecretArn")
    },
    Policy = AwsCustomResourcePolicy.FromSdkCalls(new SdkCallsPolicyOptions {
        Resources = AwsCustomResourcePolicy.ANY_RESOURCE
    })
});

var managedSecret = Secret.FromSecretAttributes(this, "ManagedSecret", new SecretAttributes {
    SecretCompleteArn = getSecretArn.GetResponseField("DBClusters.0.MasterUserSecret.SecretArn")
});
managedSecret.GrantRead(role);

import "github.com/aws/aws-cdk-go/awscdk"
import iam "github.com/aws/aws-cdk-go/awscdk"
import secretsmanager "github.com/aws/aws-cdk-go/awscdk"

var cluster DatabaseCluster
var role Role


// Call rds:DescribeDBClusters to retrieve the managed secret ARN at deploy time
getSecretArn := cr.NewAwsCustomResource(this, jsii.String("GetManagedSecretArn"), &AwsCustomResourceProps{
	OnUpdate: &AwsSdkCall{
		Service: jsii.String("DocDB"),
		Action: jsii.String("describeDBClusters"),
		Parameters: map[string]*string{
			"DBClusterIdentifier": cluster.clusterIdentifier,
		},
		PhysicalResourceId: cr.PhysicalResourceId_Of(jsii.String("GetManagedSecretArn")),
	},
	Policy: cr.AwsCustomResourcePolicy_FromSdkCalls(&SdkCallsPolicyOptions{
		Resources: cr.AwsCustomResourcePolicy_ANY_RESOURCE(),
	}),
})

managedSecret := secretsmanager.Secret_FromSecretAttributes(this, jsii.String("ManagedSecret"), &SecretAttributes{
	SecretCompleteArn: getSecretArn.GetResponseField(jsii.String("DBClusters.0.MasterUserSecret.SecretArn")),
})
managedSecret.GrantRead(role)

If the secret is encrypted with a customer managed KMS key (masterUserSecretKmsKey), also pass encryptionKey to Secret.fromSecretAttributes() so that grantRead() grants kms:Decrypt on the key as well.

Rotating credentials

When the master password is generated and stored in AWS Secrets Manager, it can be rotated automatically:

declare const cluster: docdb.DatabaseCluster;
cluster.addRotationSingleUser(); // Will rotate automatically after 30 days

# cluster: docdb.DatabaseCluster

cluster.add_rotation_single_user()

DatabaseCluster cluster;

cluster.addRotationSingleUser();

DatabaseCluster cluster;

cluster.AddRotationSingleUser();

var cluster DatabaseCluster

cluster.AddRotationSingleUser()

const cluster = new docdb.DatabaseCluster(stack, 'Database', {
  masterUser: {
    username: 'docdb',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.R5, ec2.InstanceSize.LARGE),
  vpc,
  removalPolicy: cdk.RemovalPolicy.DESTROY,
});

cluster.addRotationSingleUser();

cluster = docdb.DatabaseCluster(stack, "Database",
    master_user=cdk.aws_docdb.Login(
        username="docdb"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.R5, ec2.InstanceSize.LARGE),
    vpc=vpc,
    removal_policy=cdk.RemovalPolicy.DESTROY
)

cluster.add_rotation_single_user()

DatabaseCluster cluster = DatabaseCluster.Builder.create(stack, "Database")
        .masterUser(Login.builder()
                .username("docdb")
                .build())
        .instanceType(InstanceType.of(InstanceClass.R5, InstanceSize.LARGE))
        .vpc(vpc)
        .removalPolicy(RemovalPolicy.DESTROY)
        .build();

cluster.addRotationSingleUser();

var cluster = new DatabaseCluster(stack, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "docdb"
    },
    InstanceType = InstanceType.Of(InstanceClass.R5, InstanceSize.LARGE),
    Vpc = vpc,
    RemovalPolicy = RemovalPolicy.DESTROY
});

cluster.AddRotationSingleUser();

cluster := docdb.NewDatabaseCluster(stack, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("docdb"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_R5, ec2.InstanceSize_LARGE),
	Vpc: Vpc,
	RemovalPolicy: cdk.RemovalPolicy_DESTROY,
})

cluster.AddRotationSingleUser()

The multi user rotation scheme is also available:

import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';

declare const myImportedSecret: secretsmanager.Secret;
declare const cluster: docdb.DatabaseCluster;

cluster.addRotationMultiUser('MyUser', {
  secret: myImportedSecret, // This secret must have the `masterarn` key
});

import aws_cdk.aws_secretsmanager as secretsmanager

# my_imported_secret: secretsmanager.Secret
# cluster: docdb.DatabaseCluster


cluster.add_rotation_multi_user("MyUser",
    secret=my_imported_secret
)

import software.amazon.awscdk.services.secretsmanager.*;

Secret myImportedSecret;
DatabaseCluster cluster;


cluster.addRotationMultiUser("MyUser", RotationMultiUserOptions.builder()
        .secret(myImportedSecret)
        .build());

using Amazon.CDK.AWS.SecretsManager;

Secret myImportedSecret;
DatabaseCluster cluster;


cluster.AddRotationMultiUser("MyUser", new RotationMultiUserOptions {
    Secret = myImportedSecret
});

import secretsmanager "github.com/aws/aws-cdk-go/awscdk"

var myImportedSecret Secret
var cluster DatabaseCluster


cluster.AddRotationMultiUser(jsii.String("MyUser"), &RotationMultiUserOptions{
	Secret: myImportedSecret,
})

It's also possible to create user credentials together with the cluster and add rotation:

declare const cluster: docdb.DatabaseCluster;
const myUserSecret = new docdb.DatabaseSecret(this, 'MyUserSecret', {
  username: 'myuser',
  masterSecret: cluster.secret,
});
const myUserSecretAttached = myUserSecret.attach(cluster); // Adds DB connections information in the secret

cluster.addRotationMultiUser('MyUser', { // Add rotation using the multi user scheme
  secret: myUserSecretAttached, // This secret must have the `masterarn` key
});

# cluster: docdb.DatabaseCluster

my_user_secret = docdb.DatabaseSecret(self, "MyUserSecret",
    username="myuser",
    master_secret=cluster.secret
)
my_user_secret_attached = my_user_secret.attach(cluster) # Adds DB connections information in the secret

cluster.add_rotation_multi_user("MyUser",  # Add rotation using the multi user scheme
    secret=my_user_secret_attached)

DatabaseCluster cluster;

DatabaseSecret myUserSecret = DatabaseSecret.Builder.create(this, "MyUserSecret")
        .username("myuser")
        .masterSecret(cluster.getSecret())
        .build();
ISecret myUserSecretAttached = myUserSecret.attach(cluster); // Adds DB connections information in the secret

cluster.addRotationMultiUser("MyUser", RotationMultiUserOptions.builder() // Add rotation using the multi user scheme
        .secret(myUserSecretAttached).build());

DatabaseCluster cluster;

var myUserSecret = new DatabaseSecret(this, "MyUserSecret", new DatabaseSecretProps {
    Username = "myuser",
    MasterSecret = cluster.Secret
});
var myUserSecretAttached = myUserSecret.Attach(cluster); // Adds DB connections information in the secret

cluster.AddRotationMultiUser("MyUser", new RotationMultiUserOptions {  // Add rotation using the multi user scheme
    Secret = myUserSecretAttached });

var cluster DatabaseCluster

myUserSecret := docdb.NewDatabaseSecret(this, jsii.String("MyUserSecret"), &DatabaseSecretProps{
	Username: jsii.String("myuser"),
	MasterSecret: cluster.Secret,
})
myUserSecretAttached := myUserSecret.attach(cluster) // Adds DB connections information in the secret

cluster.AddRotationMultiUser(jsii.String("MyUser"), &RotationMultiUserOptions{
	 // Add rotation using the multi user scheme
	Secret: myUserSecretAttached,
})

Note: This user must be created manually in the database using the master credentials. The rotation will start as soon as this user exists.

See also aws-cdk-lib/aws-secretsmanager for credentials rotation of existing clusters.

Audit and profiler Logs

Sending audit or profiler needs to be configured in two places:

1. Check / create the needed options in your ParameterGroup for audit and profiler logs.
2. Enable the corresponding option(s) when creating the DatabaseCluster:

import * as iam from 'aws-cdk-lib/aws-iam';
import * as logs from'aws-cdk-lib/aws-logs';

declare const myLogsPublishingRole: iam.Role;
declare const vpc: ec2.Vpc;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
  },
  vpc,
  exportProfilerLogsToCloudWatch: true, // Enable sending profiler logs
  exportAuditLogsToCloudWatch: true, // Enable sending audit logs
  cloudWatchLogsRetention: logs.RetentionDays.THREE_MONTHS, // Optional - default is to never expire logs
  cloudWatchLogsRetentionRole: myLogsPublishingRole, // Optional - a role will be created if not provided
});

import aws_cdk.aws_iam as iam
import aws_cdk.aws_logs as logs

# my_logs_publishing_role: iam.Role
# vpc: ec2.Vpc


cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PUBLIC
    ),
    vpc=vpc,
    export_profiler_logs_to_cloud_watch=True,  # Enable sending profiler logs
    export_audit_logs_to_cloud_watch=True,  # Enable sending audit logs
    cloud_watch_logs_retention=logs.RetentionDays.THREE_MONTHS,  # Optional - default is to never expire logs
    cloud_watch_logs_retention_role=my_logs_publishing_role
)

import software.amazon.awscdk.services.iam.*;
import software.amazon.awscdk.services.logs.*;

Role myLogsPublishingRole;
Vpc vpc;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpcSubnets(SubnetSelection.builder()
                .subnetType(SubnetType.PUBLIC)
                .build())
        .vpc(vpc)
        .exportProfilerLogsToCloudWatch(true) // Enable sending profiler logs
        .exportAuditLogsToCloudWatch(true) // Enable sending audit logs
        .cloudWatchLogsRetention(RetentionDays.THREE_MONTHS) // Optional - default is to never expire logs
        .cloudWatchLogsRetentionRole(myLogsPublishingRole)
        .build();

using Amazon.CDK.AWS.IAM;
using Amazon.CDK.AWS.Logs;

Role myLogsPublishingRole;
Vpc vpc;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    VpcSubnets = new SubnetSelection {
        SubnetType = SubnetType.PUBLIC
    },
    Vpc = vpc,
    ExportProfilerLogsToCloudWatch = true,  // Enable sending profiler logs
    ExportAuditLogsToCloudWatch = true,  // Enable sending audit logs
    CloudWatchLogsRetention = RetentionDays.THREE_MONTHS,  // Optional - default is to never expire logs
    CloudWatchLogsRetentionRole = myLogsPublishingRole
});

import iam "github.com/aws/aws-cdk-go/awscdk"
import logs "github.com/aws/aws-cdk-go/awscdk"

var myLogsPublishingRole Role
var vpc Vpc


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	VpcSubnets: &SubnetSelection{
		SubnetType: ec2.SubnetType_PUBLIC,
	},
	Vpc: Vpc,
	ExportProfilerLogsToCloudWatch: jsii.Boolean(true),
	 // Enable sending profiler logs
	ExportAuditLogsToCloudWatch: jsii.Boolean(true),
	 // Enable sending audit logs
	CloudWatchLogsRetention: logs.RetentionDays_THREE_MONTHS,
	 // Optional - default is to never expire logs
	CloudWatchLogsRetentionRole: myLogsPublishingRole,
})

Enable Performance Insights

By enabling this feature it will be cascaded and enabled in all instances inside the cluster:

declare const vpc: ec2.Vpc;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
  },
  vpc,
  enablePerformanceInsights: true, // Enable Performance Insights in all instances under this cluster
});

# vpc: ec2.Vpc


cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PUBLIC
    ),
    vpc=vpc,
    enable_performance_insights=True
)

Vpc vpc;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpcSubnets(SubnetSelection.builder()
                .subnetType(SubnetType.PUBLIC)
                .build())
        .vpc(vpc)
        .enablePerformanceInsights(true)
        .build();

Vpc vpc;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    VpcSubnets = new SubnetSelection {
        SubnetType = SubnetType.PUBLIC
    },
    Vpc = vpc,
    EnablePerformanceInsights = true
});

var vpc Vpc


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	VpcSubnets: &SubnetSelection{
		SubnetType: ec2.SubnetType_PUBLIC,
	},
	Vpc: Vpc,
	EnablePerformanceInsights: jsii.Boolean(true),
})

## Removal Policy

This resource supports the snapshot removal policy. To specify it use the removalPolicy property:

declare const vpc: ec2.Vpc;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
  },
  vpc,
  removalPolicy: RemovalPolicy.SNAPSHOT,
});

# vpc: ec2.Vpc


cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PUBLIC
    ),
    vpc=vpc,
    removal_policy=RemovalPolicy.SNAPSHOT
)

Vpc vpc;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpcSubnets(SubnetSelection.builder()
                .subnetType(SubnetType.PUBLIC)
                .build())
        .vpc(vpc)
        .removalPolicy(RemovalPolicy.SNAPSHOT)
        .build();

Vpc vpc;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    VpcSubnets = new SubnetSelection {
        SubnetType = SubnetType.PUBLIC
    },
    Vpc = vpc,
    RemovalPolicy = RemovalPolicy.SNAPSHOT
});

var vpc Vpc


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	VpcSubnets: &SubnetSelection{
		SubnetType: ec2.SubnetType_PUBLIC,
	},
	Vpc: Vpc,
	RemovalPolicy: awscdk.RemovalPolicy_SNAPSHOT,
})

Note: A RemovalPolicy.DESTROY removal policy will be applied to the cluster's instances and security group by default as they don't support the snapshot removal policy.

Visit DeletionPolicy for more details.

To specify a custom removal policy for the cluster's instances, use the instanceRemovalPolicy property:

declare const vpc: ec2.Vpc;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
  },
  vpc,
  removalPolicy: RemovalPolicy.SNAPSHOT,
  instanceRemovalPolicy: RemovalPolicy.RETAIN,
});

# vpc: ec2.Vpc


cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PUBLIC
    ),
    vpc=vpc,
    removal_policy=RemovalPolicy.SNAPSHOT,
    instance_removal_policy=RemovalPolicy.RETAIN
)

Vpc vpc;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpcSubnets(SubnetSelection.builder()
                .subnetType(SubnetType.PUBLIC)
                .build())
        .vpc(vpc)
        .removalPolicy(RemovalPolicy.SNAPSHOT)
        .instanceRemovalPolicy(RemovalPolicy.RETAIN)
        .build();

Vpc vpc;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    VpcSubnets = new SubnetSelection {
        SubnetType = SubnetType.PUBLIC
    },
    Vpc = vpc,
    RemovalPolicy = RemovalPolicy.SNAPSHOT,
    InstanceRemovalPolicy = RemovalPolicy.RETAIN
});

var vpc Vpc


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	VpcSubnets: &SubnetSelection{
		SubnetType: ec2.SubnetType_PUBLIC,
	},
	Vpc: Vpc,
	RemovalPolicy: awscdk.RemovalPolicy_SNAPSHOT,
	InstanceRemovalPolicy: awscdk.RemovalPolicy_RETAIN,
})

To specify a custom removal policy for the cluster's security group, use the securityGroupRemovalPolicy property:

declare const vpc: ec2.Vpc;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
  },
  vpc,
  removalPolicy: RemovalPolicy.SNAPSHOT,
  securityGroupRemovalPolicy: RemovalPolicy.RETAIN,
});

# vpc: ec2.Vpc


cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PUBLIC
    ),
    vpc=vpc,
    removal_policy=RemovalPolicy.SNAPSHOT,
    security_group_removal_policy=RemovalPolicy.RETAIN
)

Vpc vpc;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpcSubnets(SubnetSelection.builder()
                .subnetType(SubnetType.PUBLIC)
                .build())
        .vpc(vpc)
        .removalPolicy(RemovalPolicy.SNAPSHOT)
        .securityGroupRemovalPolicy(RemovalPolicy.RETAIN)
        .build();

Vpc vpc;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    VpcSubnets = new SubnetSelection {
        SubnetType = SubnetType.PUBLIC
    },
    Vpc = vpc,
    RemovalPolicy = RemovalPolicy.SNAPSHOT,
    SecurityGroupRemovalPolicy = RemovalPolicy.RETAIN
});

var vpc Vpc


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	VpcSubnets: &SubnetSelection{
		SubnetType: ec2.SubnetType_PUBLIC,
	},
	Vpc: Vpc,
	RemovalPolicy: awscdk.RemovalPolicy_SNAPSHOT,
	SecurityGroupRemovalPolicy: awscdk.RemovalPolicy_RETAIN,
})

CA certificate

Use the caCertificate property to specify the CA certificate to use for all instances inside the cluster:

declare const vpc: ec2.Vpc;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
  },
  vpc,
  caCertificate: docdb.CaCertificate.RDS_CA_RSA4096_G1, // CA certificate for all instances under this cluster
});

# vpc: ec2.Vpc


cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PUBLIC
    ),
    vpc=vpc,
    ca_certificate=docdb.CaCertificate.RDS_CA_RSA4096_G1
)

Vpc vpc;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpcSubnets(SubnetSelection.builder()
                .subnetType(SubnetType.PUBLIC)
                .build())
        .vpc(vpc)
        .caCertificate(CaCertificate.RDS_CA_RSA4096_G1)
        .build();

Vpc vpc;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    VpcSubnets = new SubnetSelection {
        SubnetType = SubnetType.PUBLIC
    },
    Vpc = vpc,
    CaCertificate = CaCertificate.RDS_CA_RSA4096_G1
});

var vpc Vpc


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	VpcSubnets: &SubnetSelection{
		SubnetType: ec2.SubnetType_PUBLIC,
	},
	Vpc: Vpc,
	CaCertificate: docdb.CaCertificate_RDS_CA_RSA4096_G1(),
})

Storage Type

You can specify storage type for the cluster.

declare const vpc: ec2.Vpc;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpc,
  storageType: docdb.StorageType.IOPT1, // Default is StorageType.STANDARD
});

# vpc: ec2.Vpc


cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc=vpc,
    storage_type=docdb.StorageType.IOPT1
)

Vpc vpc;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpc(vpc)
        .storageType(StorageType.IOPT1)
        .build();

Vpc vpc;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    Vpc = vpc,
    StorageType = StorageType.IOPT1
});

var vpc Vpc


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	Vpc: Vpc,
	StorageType: docdb.StorageType_IOPT1,
})

Note: StorageType.IOPT1 is supported starting with engine version 5.0.0.

Note: For serverless clusters, storage type is managed automatically and cannot be specified.

Maintenance Windows

DocumentDB has two independent maintenance windows: one for cluster-wide events (engine upgrades, etc.) and one per instance (reboots, patches). Use preferredMaintenanceWindow to control the cluster window and instanceMaintenanceWindow to control the window applied to every auto-created instance.

Note: instanceMaintenanceWindow only applies to provisioned clusters. It has no effect on serverless clusters because they don't create instances.

declare const vpc: ec2.Vpc;

const cluster = new docdb.DatabaseCluster(this, 'Database', {
  masterUser: {
    username: 'myuser',
  },
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
  vpc,
  preferredMaintenanceWindow: 'tue:04:17-tue:04:47',  // cluster-wide events
  instanceMaintenanceWindow: 'sat:09:00-sat:09:30',   // applied to every instance
});

# vpc: ec2.Vpc


cluster = docdb.DatabaseCluster(self, "Database",
    master_user=docdb.Login(
        username="myuser"
    ),
    instance_type=ec2.InstanceType.of(ec2.InstanceClass.MEMORY5, ec2.InstanceSize.LARGE),
    vpc=vpc,
    preferred_maintenance_window="tue:04:17-tue:04:47",  # cluster-wide events
    instance_maintenance_window="sat:09:00-sat:09:30"
)

Vpc vpc;


DatabaseCluster cluster = DatabaseCluster.Builder.create(this, "Database")
        .masterUser(Login.builder()
                .username("myuser")
                .build())
        .instanceType(InstanceType.of(InstanceClass.MEMORY5, InstanceSize.LARGE))
        .vpc(vpc)
        .preferredMaintenanceWindow("tue:04:17-tue:04:47") // cluster-wide events
        .instanceMaintenanceWindow("sat:09:00-sat:09:30")
        .build();

Vpc vpc;


var cluster = new DatabaseCluster(this, "Database", new DatabaseClusterProps {
    MasterUser = new Login {
        Username = "myuser"
    },
    InstanceType = InstanceType.Of(InstanceClass.MEMORY5, InstanceSize.LARGE),
    Vpc = vpc,
    PreferredMaintenanceWindow = "tue:04:17-tue:04:47",  // cluster-wide events
    InstanceMaintenanceWindow = "sat:09:00-sat:09:30"
});

var vpc Vpc


cluster := docdb.NewDatabaseCluster(this, jsii.String("Database"), &DatabaseClusterProps{
	MasterUser: &Login{
		Username: jsii.String("myuser"),
	},
	InstanceType: ec2.InstanceType_Of(ec2.InstanceClass_MEMORY5, ec2.InstanceSize_LARGE),
	Vpc: Vpc,
	PreferredMaintenanceWindow: jsii.String("tue:04:17-tue:04:47"),
	 // cluster-wide events
	InstanceMaintenanceWindow: jsii.String("sat:09:00-sat:09:30"),
})

If you want both the cluster and its instances to share the same window, set both props to the same value. When instanceMaintenanceWindow is not provided, a random 30-minute window is picked for each instance, which can cause maintenance events outside the cluster window.

Types

Name	Kind	Summary
ClusterParameterGroup	Construct (L2)	A cluster parameter group.
DatabaseCluster	Construct (L2)	Create a clustered database with a given number of instances.
DatabaseInstance	Construct (L2)	A database instance.
DatabaseSecret	Construct (L2)	A database secret.
CfnDBCluster	Construct (L1)	The AWS::DocDB::DBCluster Amazon DocumentDB (with MongoDB compatibility) resource describes a DBCluster.
CfnDBClusterParameterGroup	Construct (L1)	The AWS::DocDB::DBClusterParameterGroup Amazon DocumentDB (with MongoDB compatibility) resource describes a DBClusterParameterGroup.
CfnDBInstance	Construct (L1)	The AWS::DocDB::DBInstance Amazon DocumentDB (with MongoDB compatibility) resource describes a DBInstance.
CfnDBSubnetGroup	Construct (L1)	The AWS::DocDB::DBSubnetGroup Amazon DocumentDB (with MongoDB compatibility) resource describes a DBSubnetGroup.
CfnEventSubscription	Construct (L1)	Creates an Amazon DocumentDB event notification subscription.
CfnGlobalCluster	Construct (L1)	The AWS::DocDB::GlobalCluster resource represents an Amazon DocumentDB Global Cluster.
BackupProps	Struct	Backup configuration for DocumentDB databases.
CaCertificate	Class	The CA certificate used for a DB instance.
CfnDBCluster.ServerlessV2ScalingConfigurationProperty	Struct	Sets the scaling configuration of an Amazon DocumentDB Serverless cluster.
CfnDBClusterParameterGroupProps	Struct	Properties for defining a CfnDBClusterParameterGroup.
CfnDBClusterProps	Struct	Properties for defining a CfnDBCluster.
CfnDBInstanceProps	Struct	Properties for defining a CfnDBInstance.
CfnDBSubnetGroupProps	Struct	Properties for defining a CfnDBSubnetGroup.
CfnEventSubscriptionProps	Struct	Properties for defining a CfnEventSubscription.
CfnGlobalClusterProps	Struct	Properties for defining a CfnGlobalCluster.
ClusterParameterGroupProps	Struct	Properties for a cluster parameter group.
DatabaseClusterAttributes	Struct	Properties that describe an existing cluster instance.
DatabaseClusterProps	Struct	Properties for a new database cluster.
DatabaseInstanceAttributes	Struct	Properties that describe an existing instance.
DatabaseInstanceProps	Struct	Construction properties for a DatabaseInstanceNew.
DatabaseSecretProps	Struct	Construction properties for a DatabaseSecret.
Endpoint	Class	Connection endpoint of a database cluster or instance.
IClusterParameterGroup	Interface	A parameter group.
IDatabaseCluster	Interface	Create a clustered database with a given number of instances.
IDatabaseInstance	Interface	A database instance.
Login	Struct	Login credentials for a database cluster.
RotationMultiUserOptions	Struct	Options to add the multi user rotation.
ServerlessV2ScalingConfiguration	Struct	ServerlessV2 scaling configuration for DocumentDB clusters.
StorageType	Enum	The storage type of the DocDB cluster.