DatabaseCluster

class aws_cdk.aws_rds.DatabaseCluster(scope, id, *, engine, backtrack_window=None, backup=None, cloudwatch_logs_exports=None, cloudwatch_logs_retention=None, cloudwatch_logs_retention_role=None, cluster_identifier=None, copy_tags_to_snapshot=None, credentials=None, default_database_name=None, deletion_protection=None, domain=None, domain_role=None, enable_data_api=None, iam_authentication=None, instance_identifier_base=None, instance_props=None, instances=None, instance_update_behaviour=None, monitoring_interval=None, monitoring_role=None, network_type=None, parameter_group=None, parameters=None, port=None, preferred_maintenance_window=None, readers=None, removal_policy=None, s3_export_buckets=None, s3_export_role=None, s3_import_buckets=None, s3_import_role=None, security_groups=None, serverless_v2_max_capacity=None, serverless_v2_min_capacity=None, storage_encrypted=None, storage_encryption_key=None, storage_type=None, subnet_group=None, vpc=None, vpc_subnets=None, writer=None)

Bases: DatabaseClusterBase

Create a clustered database with a given number of instances.

Resource:: AWS::RDS::DBCluster
ExampleMetadata:: infused

Example:

# vpc: ec2.Vpc

cluster = rds.DatabaseCluster(self, "Database",
    engine=rds.DatabaseClusterEngine.aurora_mysql(version=rds.AuroraMysqlEngineVersion.VER_3_01_0),
    writer=rds.ClusterInstance.provisioned("writer",
        instance_type=ec2.InstanceType.of(ec2.InstanceClass.R6G, ec2.InstanceSize.XLARGE4)
    ),
    serverless_v2_min_capacity=6.5,
    serverless_v2_max_capacity=64,
    readers=[
        # will be put in promotion tier 1 and will scale with the writer
        rds.ClusterInstance.serverless_v2("reader1", scale_with_writer=True),
        # will be put in promotion tier 2 and will not scale with the writer
        rds.ClusterInstance.serverless_v2("reader2")
    ],
    vpc=vpc
)

Parameters:

scope (Construct) –
id (str) –
engine (IClusterEngine) – What kind of database to start.
backtrack_window (Optional[Duration]) – The number of seconds to set a cluster’s target backtrack window to. This feature is only supported by the Aurora MySQL database engine and cannot be enabled on existing clusters. Default: 0 seconds (no backtrack)
backup (Union[BackupProps, Dict[str, Any], None]) – Backup settings. Default: - Backup retention period for automated backups is 1 day. Backup preferred window is set to a 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week.
cloudwatch_logs_exports (Optional[Sequence[str]]) – The list of log types that need to be enabled for exporting to CloudWatch Logs. Default: - no log exports
cloudwatch_logs_retention (Optional[RetentionDays]) – The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn’t remove the log retention policy. To remove the retention policy, set the value to Infinity. Default: - logs never expire
cloudwatch_logs_retention_role (Optional[IRole]) – The IAM role for the Lambda function associated with the custom resource that sets the retention policy. Default: - a new role is created.
cluster_identifier (Optional[str]) – An optional identifier for the cluster. Default: - A name is automatically generated.
copy_tags_to_snapshot (Optional[bool]) – Whether to copy tags to the snapshot when a snapshot is created. Default: - true
credentials (Optional[Credentials]) – Credentials for the administrative user. Default: - A username of ‘admin’ (or ‘postgres’ for PostgreSQL) and SecretsManager-generated password
default_database_name (Optional[str]) – Name of a database which is automatically created inside the cluster. Default: - Database is not created in cluster.
deletion_protection (Optional[bool]) – Indicates whether the DB cluster should have deletion protection enabled. Default: - true if removalPolicy is RETAIN, undefined otherwise, which will not enable deletion protection. To disable deletion protection after it has been enabled, you must explicitly set this value to false.
domain (Optional[str]) – Directory ID for associating the DB cluster with a specific Active Directory. Necessary for enabling Kerberos authentication. If specified, the DB cluster joins the given Active Directory, enabling Kerberos authentication. If not specified, the DB cluster will not be associated with any Active Directory, and Kerberos authentication will not be enabled. Default: - DB cluster is not associated with an Active Directory; Kerberos authentication is not enabled.
domain_role (Optional[IRole]) – The IAM role to be used when making API calls to the Directory Service. The role needs the AWS-managed policy AmazonRDSDirectoryServiceAccess or equivalent. Default: - If DatabaseClusterBaseProps.domain is specified, a role with the AmazonRDSDirectoryServiceAccess policy is automatically created.
enable_data_api (Optional[bool]) – Whether to enable the Data API for the cluster. Default: - false
iam_authentication (Optional[bool]) – Whether to enable mapping of AWS Identity and Access Management (IAM) accounts to database accounts. Default: false
instance_identifier_base (Optional[str]) – Base identifier for instances. Every replica is named by appending the replica number to this string, 1-based. Default: - clusterIdentifier is used with the word “Instance” appended. If clusterIdentifier is not provided, the identifier is automatically generated.
instance_props (Union[InstanceProps, Dict[str, Any], None]) – (deprecated) Settings for the individual instances that are launched.
instances (Union[int, float, None]) – (deprecated) How many replicas/instances to create. Has to be at least 1. Default: 2
instance_update_behaviour (Optional[InstanceUpdateBehaviour]) – The ordering of updates for instances. Default: InstanceUpdateBehaviour.BULK
monitoring_interval (Optional[Duration]) – The interval, in seconds, between points when Amazon RDS collects enhanced monitoring metrics for the DB instances. Default: no enhanced monitoring
monitoring_role (Optional[IRole]) – Role that will be used to manage DB instances monitoring. Default: - A role is automatically created for you
network_type (Optional[NetworkType]) – The network type of the DB instance. Default: - IPV4
parameter_group (Optional[IParameterGroup]) – Additional parameters to pass to the database engine. Default: - No parameter group.
parameters (Optional[Mapping[str, str]]) – The parameters in the DBClusterParameterGroup to create automatically. You can only specify parameterGroup or parameters but not both. You need to use a versioned engine to auto-generate a DBClusterParameterGroup. Default: - None
port (Union[int, float, None]) – What port to listen on. Default: - The default for the engine is used.
preferred_maintenance_window (Optional[str]) – A preferred maintenance window day/time range. Should be specified as a range ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Example: ‘Sun:23:45-Mon:00:15’ Default: - 30-minute window selected at random from an 8-hour block of time for each AWS Region, occurring on a random day of the week.
readers (Optional[Sequence[IClusterInstance]]) – A list of instances to create as cluster reader instances. Default: - no readers are created. The cluster will have a single writer/reader
removal_policy (Optional[RemovalPolicy]) – The removal policy to apply when the cluster and its instances are removed from the stack or replaced during an update. Default: - RemovalPolicy.SNAPSHOT (remove the cluster and instances, but retain a snapshot of the data)
s3_export_buckets (Optional[Sequence[IBucket]]) – S3 buckets that you want to load data into. This feature is only supported by the Aurora database engine. This property must not be used if s3ExportRole is used. For MySQL: Default: - None
s3_export_role (Optional[IRole]) – Role that will be associated with this DB cluster to enable S3 export. This feature is only supported by the Aurora database engine. This property must not be used if s3ExportBuckets is used. For MySQL: Default: - New role is created if s3ExportBuckets is set, no role is defined otherwise
s3_import_buckets (Optional[Sequence[IBucket]]) – S3 buckets that you want to load data from. This feature is only supported by the Aurora database engine. This property must not be used if s3ImportRole is used. For MySQL: Default: - None
s3_import_role (Optional[IRole]) – Role that will be associated with this DB cluster to enable S3 import. This feature is only supported by the Aurora database engine. This property must not be used if s3ImportBuckets is used. For MySQL: Default: - New role is created if s3ImportBuckets is set, no role is defined otherwise
security_groups (Optional[Sequence[ISecurityGroup]]) – Security group. Default: a new security group is created.
serverless_v2_max_capacity (Union[int, float, None]) – The maximum number of Aurora capacity units (ACUs) for a DB instance in an Aurora Serverless v2 cluster. You can specify ACU values in half-step increments, such as 40, 40.5, 41, and so on. The largest value that you can use is 128 (256GB). The maximum capacity must be higher than 0.5 ACUs. Default: 2
serverless_v2_min_capacity (Union[int, float, None]) – The minimum number of Aurora capacity units (ACUs) for a DB instance in an Aurora Serverless v2 cluster. You can specify ACU values in half-step increments, such as 8, 8.5, 9, and so on. The smallest value that you can use is 0.5. Default: 0.5
storage_encrypted (Optional[bool]) – Whether to enable storage encryption. Default: - true if storageEncryptionKey is provided, false otherwise
storage_encryption_key (Optional[IKey]) – The KMS key for storage encryption. If specified, storageEncrypted will be set to true. Default: - if storageEncrypted is true then the default master key, no key otherwise
storage_type (Optional[DBClusterStorageType]) – The storage type to be associated with the DB cluster. Default: - DBClusterStorageType.AURORA_IOPT1
subnet_group (Optional[ISubnetGroup]) – Existing subnet group for the cluster. Default: - a new subnet group will be created.
vpc (Optional[IVpc]) – What subnets to run the RDS instances in. Must be at least 2 subnets in two different AZs.
vpc_subnets (Union[SubnetSelection, Dict[str, Any], None]) – Where to place the instances within the VPC. Default: - the Vpc default strategy if not specified.
writer (Optional[IClusterInstance]) – The instance to use for the cluster writer. Default: required if instanceProps is not provided

Methods

add_proxy(id, *, secrets, vpc, borrow_timeout=None, client_password_auth_type=None, db_proxy_name=None, debug_logging=None, iam_auth=None, idle_client_timeout=None, init_query=None, max_connections_percent=None, max_idle_connections_percent=None, require_tls=None, role=None, security_groups=None, session_pinning_filters=None, vpc_subnets=None)

Add a new db proxy to this cluster.

Parameters:

id (str) –
secrets (Sequence[ISecret]) – The secret that the proxy uses to authenticate to the RDS DB instance or Aurora DB cluster. These secrets are stored within Amazon Secrets Manager. One or more secrets are required.
vpc (IVpc) – The VPC to associate with the new proxy.
borrow_timeout (Optional[Duration]) – The duration for a proxy to wait for a connection to become available in the connection pool. Only applies when the proxy has opened its maximum number of connections and all connections are busy with client sessions. Value must be between 1 second and 1 hour, or Duration.seconds(0) to represent unlimited. Default: cdk.Duration.seconds(120)
client_password_auth_type (Optional[ClientPasswordAuthType]) – Specifies the details of authentication used by a proxy to log in as a specific database user. Default: - CloudFormation defaults will apply given the specified database engine.
db_proxy_name (Optional[str]) – The identifier for the proxy. This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can’t end with a hyphen or contain two consecutive hyphens. Default: - Generated by CloudFormation (recommended)
debug_logging (Optional[bool]) – Whether the proxy includes detailed information about SQL statements in its logs. This information helps you to debug issues involving SQL behavior or the performance and scalability of the proxy connections. The debug information includes the text of SQL statements that you submit through the proxy. Thus, only enable this setting when needed for debugging, and only when you have security measures in place to safeguard any sensitive information that appears in the logs. Default: false
iam_auth (Optional[bool]) – Whether to require or disallow AWS Identity and Access Management (IAM) authentication for connections to the proxy. Default: false
idle_client_timeout (Optional[Duration]) – The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it. You can set this value higher or lower than the connection timeout limit for the associated database. Default: cdk.Duration.minutes(30)
init_query (Optional[str]) – One or more SQL statements for the proxy to run when opening each new database connection. Typically used with SET statements to make sure that each connection has identical settings such as time zone and character set. For multiple statements, use semicolons as the separator. You can also include multiple variables in a single SET statement, such as SET x=1, y=2. not currently supported for PostgreSQL. Default: - no initialization query
max_connections_percent (Union[int, float, None]) – The maximum size of the connection pool for each target in a target group. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group. 1-100 Default: 100
max_idle_connections_percent (Union[int, float, None]) – Controls how actively the proxy closes idle database connections in the connection pool. A high value enables the proxy to leave a high percentage of idle connections open. A low value causes the proxy to close idle client connections and return the underlying database connections to the connection pool. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group. between 0 and MaxConnectionsPercent Default: 50
require_tls (Optional[bool]) – A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy. By enabling this setting, you can enforce encrypted TLS connections to the proxy. Default: true
role (Optional[IRole]) – IAM role that the proxy uses to access secrets in AWS Secrets Manager. Default: - A role will automatically be created
security_groups (Optional[Sequence[ISecurityGroup]]) – One or more VPC security groups to associate with the new proxy. Default: - No security groups
session_pinning_filters (Optional[Sequence[SessionPinningFilter]]) – Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection. Including an item in the list exempts that class of SQL operations from the pinning behavior. Default: - no session pinning filters
vpc_subnets (Union[SubnetSelection, Dict[str, Any], None]) – The subnets used by the proxy. Default: - the VPC default strategy if not specified.

Return type:

DatabaseProxy

add_rotation_multi_user(id, *, secret, automatically_after=None, endpoint=None, exclude_characters=None, rotate_immediately_on_update=None, security_group=None, vpc_subnets=None)

Adds the multi user rotation to this cluster.

See Alternating users rotation strategy

Parameters:

id (str) –
secret (ISecret) – The secret to rotate. It must be a JSON string with the following format:: { “engine”: <required: database engine>, “host”: <required: instance host name>, “username”: <required: username>, “password”: <required: password>, “dbname”: <optional: database name>, “port”: <optional: if not specified, default port will be used>, “masterarn”: <required: the arn of the master secret which will be used to create users/change passwords> }
automatically_after (Optional[Duration]) – Specifies the number of days after the previous rotation before Secrets Manager triggers the next automatic rotation. Default: - 30 days
endpoint (Optional[IInterfaceVpcEndpoint]) – The VPC interface endpoint to use for the Secrets Manager API. If you enable private DNS hostnames for your VPC private endpoint (the default), you don’t need to specify an endpoint. The standard Secrets Manager DNS hostname the Secrets Manager CLI and SDKs use by default (https://secretsmanager..amazonaws.com) automatically resolves to your VPC endpoint. Default: https://secretsmanager..amazonaws.com
exclude_characters (Optional[str]) – Specifies characters to not include in generated passwords. Default: “ %+~`#$&*()|[]{}:;<>?!’/@”"
rotate_immediately_on_update (Optional[bool]) – Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. Default: true
security_group (Optional[ISecurityGroup]) – The security group for the Lambda rotation function. Default: - a new security group is created
vpc_subnets (Union[SubnetSelection, Dict[str, Any], None]) – Where to place the rotation Lambda function. Default: - same placement as instance or cluster

Return type:

SecretRotation

add_rotation_single_user(*, automatically_after=None, endpoint=None, exclude_characters=None, rotate_immediately_on_update=None, security_group=None, vpc_subnets=None)

Adds the single user rotation of the master password to this cluster.

See Single user rotation strategy

Parameters:

automatically_after (Optional[Duration]) – Specifies the number of days after the previous rotation before Secrets Manager triggers the next automatic rotation. Default: - 30 days
endpoint (Optional[IInterfaceVpcEndpoint]) – The VPC interface endpoint to use for the Secrets Manager API. If you enable private DNS hostnames for your VPC private endpoint (the default), you don’t need to specify an endpoint. The standard Secrets Manager DNS hostname the Secrets Manager CLI and SDKs use by default (https://secretsmanager..amazonaws.com) automatically resolves to your VPC endpoint. Default: https://secretsmanager..amazonaws.com
exclude_characters (Optional[str]) – Specifies characters to not include in generated passwords. Default: “ %+~`#$&*()|[]{}:;<>?!’/@”"
rotate_immediately_on_update (Optional[bool]) – Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. Default: true
security_group (Optional[ISecurityGroup]) – The security group for the Lambda rotation function. Default: - a new security group is created
vpc_subnets (Union[SubnetSelection, Dict[str, Any], None]) – Where to place the rotation Lambda function. Default: - same placement as instance or cluster

Return type:

SecretRotation

apply_removal_policy(policy)

Apply the given removal policy to this resource.

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you’ve removed it from the CDK application or because you’ve made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

Parameters:

policy (RemovalPolicy) –

Return type:

None

as_secret_attachment_target()

Renders the secret attachment target specifications.

Return type:: SecretAttachmentTargetProps

grant_connect(grantee, db_user)

Grant the given identity connection access to the Cluster.

Parameters:

grantee (IGrantable) –
db_user (str) –

Return type:

Grant

grant_data_api_access(grantee)

Grant the given identity to access the Data API.

Parameters:

grantee (IGrantable) –

Return type:

Grant

metric(metric_name, *, account=None, color=None, dimensions_map=None, label=None, period=None, region=None, statistic=None, unit=None)

Return the given named metric for this DBCluster.

Parameters:

metric_name (str) –
account (Optional[str]) – Account which this metric comes from. Default: - Deployment account.
color (Optional[str]) – The hex color code, prefixed with ‘#’ (e.g. ‘#00ff00’), to use when this metric is rendered on a graph. The Color class has a set of standard colors that can be used here. Default: - Automatic color
dimensions_map (Optional[Mapping[str, str]]) – Dimensions of the metric. Default: - No dimensions.
label (Optional[str]) – Label for this metric when added to a Graph in a Dashboard. You can use dynamic labels to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph’s legend. Default: - No label
period (Optional[Duration]) – The period over which the specified statistic is applied. Default: Duration.minutes(5)
region (Optional[str]) – Region which this metric comes from. Default: - Deployment region.
statistic (Optional[str]) – What function to use for aggregating. Use the aws_cloudwatch.Stats helper class to construct valid input strings. Can be one of the following: - “Minimum” | “min” - “Maximum” | “max” - “Average” | “avg” - “Sum” | “sum” - “SampleCount | “n” - “pNN.NN” - “tmNN.NN” | “tm(NN.NN%:NN.NN%)” - “iqm” - “wmNN.NN” | “wm(NN.NN%:NN.NN%)” - “tcNN.NN” | “tc(NN.NN%:NN.NN%)” - “tsNN.NN” | “ts(NN.NN%:NN.NN%)” Default: Average
unit (Optional[Unit]) – Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

Return type: