DatabaseProxy

class aws_cdk.aws_rds.DatabaseProxy(scope, id, *, proxy_target, secrets, vpc, borrow_timeout=None, client_password_auth_type=None, db_proxy_name=None, debug_logging=None, iam_auth=None, idle_client_timeout=None, init_query=None, max_connections_percent=None, max_idle_connections_percent=None, require_tls=None, role=None, security_groups=None, session_pinning_filters=None, vpc_subnets=None)

Bases: Resource

RDS Database Proxy.

Resource:: AWS::RDS::DBProxy
ExampleMetadata:: infused

Example:

# vpc: ec2.Vpc

cluster = rds.DatabaseCluster(self, "Database",
    engine=rds.DatabaseClusterEngine.aurora_mysql(
        version=rds.AuroraMysqlEngineVersion.VER_3_03_0
    ),
    writer=rds.ClusterInstance.provisioned("writer"),
    vpc=vpc
)

proxy = rds.DatabaseProxy(self, "Proxy",
    proxy_target=rds.ProxyTarget.from_cluster(cluster),
    secrets=[cluster.secret],
    vpc=vpc,
    client_password_auth_type=rds.ClientPasswordAuthType.MYSQL_NATIVE_PASSWORD
)

Parameters:

scope (Construct) –
id (str) –
proxy_target (ProxyTarget) – DB proxy target: Instance or Cluster.
secrets (Sequence[ISecret]) – The secret that the proxy uses to authenticate to the RDS DB instance or Aurora DB cluster. These secrets are stored within Amazon Secrets Manager. One or more secrets are required.
vpc (IVpc) – The VPC to associate with the new proxy.
borrow_timeout (Optional[Duration]) – The duration for a proxy to wait for a connection to become available in the connection pool. Only applies when the proxy has opened its maximum number of connections and all connections are busy with client sessions. Value must be between 1 second and 1 hour, or Duration.seconds(0) to represent unlimited. Default: cdk.Duration.seconds(120)
client_password_auth_type (Optional[ClientPasswordAuthType]) – Specifies the details of authentication used by a proxy to log in as a specific database user. Default: - CloudFormation defaults will apply given the specified database engine.
db_proxy_name (Optional[str]) – The identifier for the proxy. This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can’t end with a hyphen or contain two consecutive hyphens. Default: - Generated by CloudFormation (recommended)
debug_logging (Optional[bool]) – Whether the proxy includes detailed information about SQL statements in its logs. This information helps you to debug issues involving SQL behavior or the performance and scalability of the proxy connections. The debug information includes the text of SQL statements that you submit through the proxy. Thus, only enable this setting when needed for debugging, and only when you have security measures in place to safeguard any sensitive information that appears in the logs. Default: false
iam_auth (Optional[bool]) – Whether to require or disallow AWS Identity and Access Management (IAM) authentication for connections to the proxy. Default: false
idle_client_timeout (Optional[Duration]) – The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it. You can set this value higher or lower than the connection timeout limit for the associated database. Default: cdk.Duration.minutes(30)
init_query (Optional[str]) – One or more SQL statements for the proxy to run when opening each new database connection. Typically used with SET statements to make sure that each connection has identical settings such as time zone and character set. For multiple statements, use semicolons as the separator. You can also include multiple variables in a single SET statement, such as SET x=1, y=2. not currently supported for PostgreSQL. Default: - no initialization query
max_connections_percent (Union[int, float, None]) – The maximum size of the connection pool for each target in a target group. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group. 1-100 Default: 100
max_idle_connections_percent (Union[int, float, None]) – Controls how actively the proxy closes idle database connections in the connection pool. A high value enables the proxy to leave a high percentage of idle connections open. A low value causes the proxy to close idle client connections and return the underlying database connections to the connection pool. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group. between 0 and MaxConnectionsPercent Default: 50
require_tls (Optional[bool]) – A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy. By enabling this setting, you can enforce encrypted TLS connections to the proxy. Default: true
role (Optional[IRole]) – IAM role that the proxy uses to access secrets in AWS Secrets Manager. Default: - A role will automatically be created
security_groups (Optional[Sequence[ISecurityGroup]]) – One or more VPC security groups to associate with the new proxy. Default: - No security groups
session_pinning_filters (Optional[Sequence[SessionPinningFilter]]) – Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection. Including an item in the list exempts that class of SQL operations from the pinning behavior. Default: - no session pinning filters
vpc_subnets (Union[SubnetSelection, Dict[str, Any], None]) – The subnets used by the proxy. Default: - the VPC default strategy if not specified.

Methods

apply_removal_policy(policy)

Apply the given removal policy to this resource.

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you’ve removed it from the CDK application or because you’ve made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

Parameters:

policy (RemovalPolicy) –

Return type:

None

as_secret_attachment_target()

Renders the secret attachment target specifications.

Return type:: SecretAttachmentTargetProps

grant_connect(grantee, db_user=None)

Grant the given identity connection access to the proxy.

Parameters:

grantee (IGrantable) –
db_user (Optional[str]) –

Return type:

Grant

to_string()

Returns a string representation of this construct.

Return type:: str

Attributes

connections: Access to network connections.

db_proxy_arn

DB Proxy ARN.

Attribute:: true

db_proxy_name

DB Proxy Name.

Attribute:: true

endpoint

Endpoint.

Attribute:: true

env

The environment this resource belongs to.

For resources that are created and managed by the CDK (generally, those created by creating new class instances like Role, Bucket, etc.), this is always the same as the environment of the stack they belong to; however, for imported resources (those obtained from static methods like fromRoleArn, fromBucketName, etc.), that might be different than the stack they were imported into.

node: The tree node.

stack: The stack in which this resource is defined.

Static Methods

classmethod from_database_proxy_attributes(scope, id, *, db_proxy_arn, db_proxy_name, endpoint, security_groups)

Import an existing database proxy.

Parameters:

scope (Construct) –
id (str) –
db_proxy_arn (str) – DB Proxy ARN.
db_proxy_name (str) – DB Proxy Name.
endpoint (str) – Endpoint.
security_groups (Sequence[ISecurityGroup]) – The security groups of the instance.

Return type:

IDatabaseProxy

classmethod is_construct(x)

Checks if x is a construct.

Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.

Parameters:: x (Any) – Any object.
Return type:: bool
Returns:: true if x is an object created from a class which extends Construct.

classmethod is_owned_resource(construct)

Returns true if the construct was created by CDK, and false otherwise.

Parameters:

construct (IConstruct) –

Return type:

bool

classmethod is_resource(construct)

Check whether the given construct is a Resource.

Parameters:

construct (IConstruct) –

Return type:

bool