SnapshotCredentials Class
Credentials to update the password for a DatabaseInstanceFromSnapshot.
Example
ts
declare const vpc: ec2.Vpc;
const engine = rds.DatabaseInstanceEngine.postgres({ version: rds.PostgresEngineVersion.VER_16_3 });
const myKey = new kms.Key(this, 'MyKey');
new rds.DatabaseInstanceFromSnapshot(this, 'InstanceFromSnapshotWithCustomizedSecret', {
engine,
vpc,
snapshotIdentifier: 'mySnapshot',
credentials: rds.SnapshotCredentials.fromGeneratedSecret('username', {
encryptionKey: myKey,
excludeCharacters: '!&*^#@()',
replicaRegions: [{ region: 'eu-west-1' }, { region: 'eu-west-2' }],
}),
});
Initializer
ts
new SnapshotCredentials()
python
SnapshotCredentials()
java
new SnapshotCredentials()
csharp
new SnapshotCredentials()
go
NewSnapshotCredentials()
Properties
encryptionKeymay be undefinedIKeyencryption_keymay be undefinedIKeyencryptionKeymay be undefinedIKeyEncryptionKeymay be undefinedIKeyEncryptionKeymay be undefinedIKey#KMS encryption key to encrypt the generated secret.
Default: default master key
excludeCharactersmay be undefinedstringexclude_charactersmay be undefinedstrexcludeCharactersmay be undefinedStringExcludeCharactersmay be undefinedstringExcludeCharactersmay be undefined*string#The characters to exclude from the generated password.
Default: the DatabaseSecret default exclude character set (" %+~`#$&*()|[]{}:;<>?!'/@"\")
Only used if generatePassword if true.
generatePasswordbooleangenerate_passwordboolgeneratePasswordBooleanGeneratePasswordboolGeneratePassword*boolrequired#Whether a new password should be generated.
passwordmay be undefinedSecretValuepasswordmay be undefinedSecretValuepasswordmay be undefinedSecretValuePasswordmay be undefinedSecretValuePasswordmay be undefinedSecretValue#The master user password.
Default: the existing password from the snapshot
Do not put passwords in your CDK code directly.
replaceOnPasswordCriteriaChangesmay be undefinedbooleanreplace_on_password_criteria_changesmay be undefinedboolreplaceOnPasswordCriteriaChangesmay be undefinedBooleanReplaceOnPasswordCriteriaChangesmay be undefinedboolReplaceOnPasswordCriteriaChangesmay be undefined*bool= false#Whether to replace the generated secret when the criteria for the password change.
replicaRegionsmay be undefinedReplicaRegion[]replica_regionsmay be undefinedtyping.List[ReplicaRegion]replicaRegionsmay be undefinedList<ReplicaRegion>ReplicaRegionsmay be undefinedReplicaRegion[]ReplicaRegionsmay be undefined*[]ReplicaRegion#A list of regions where to replicate the generated secret.
Default: Secret is not replicated
secretmay be undefinedISecretsecretmay be undefinedISecretsecretmay be undefinedISecretSecretmay be undefinedISecretSecretmay be undefinedISecret= none#Secret used to instantiate this Login.
usernamemay be undefinedstringusernamemay be undefinedstrusernamemay be undefinedStringUsernamemay be undefinedstringUsernamemay be undefined*string#The master user name.
Default: the existing username from the snapshot
Must be the current master user name of the snapshot. It is not possible to change the master user name of a RDS instance.
Methods
fromGeneratedPassword(username: string, options?: SnapshotCredentialsFromGeneratedPasswordOptions): SnapshotCredentials // chainable@staticmethod def from_generated_password(username: str, options: typing.Optional[SnapshotCredentialsFromGeneratedPasswordOptions] = None) -> SnapshotCredentialspublic static SnapshotCredentials fromGeneratedPassword(String username, SnapshotCredentialsFromGeneratedPasswordOptions options)public static SnapshotCredentials FromGeneratedPassword(string username, SnapshotCredentialsFromGeneratedPasswordOptions? options = null)func FromGeneratedPassword(Username *string, Options SnapshotCredentialsFromGeneratedPasswordOptions) SnapshotCredentialsstatic#Generate a new password for the snapshot, using the existing username and an optional encryption key.
notes
Note - The username must match the existing master username of the snapshot.
NOTE: use fromGeneratedSecret() for new Clusters and Instances. Switching from fromGeneratedPassword() to fromGeneratedSecret() for already deployed Clusters or Instances will update their master password.
fromGeneratedSecret(username: string, options?: SnapshotCredentialsFromGeneratedPasswordOptions): SnapshotCredentials // chainable@staticmethod def from_generated_secret(username: str, options: typing.Optional[SnapshotCredentialsFromGeneratedPasswordOptions] = None) -> SnapshotCredentialspublic static SnapshotCredentials fromGeneratedSecret(String username, SnapshotCredentialsFromGeneratedPasswordOptions options)public static SnapshotCredentials FromGeneratedSecret(string username, SnapshotCredentialsFromGeneratedPasswordOptions? options = null)func FromGeneratedSecret(Username *string, Options SnapshotCredentialsFromGeneratedPasswordOptions) SnapshotCredentialsstatic#Generate a new password for the snapshot, using the existing username and an optional encryption key.
The new credentials are stored in Secrets Manager.
Note - The username must match the existing master username of the snapshot.
fromPassword(password: SecretValue): SnapshotCredentials // chainable@staticmethod def from_password(password: SecretValue) -> SnapshotCredentialspublic static SnapshotCredentials fromPassword(SecretValue password)public static SnapshotCredentials FromPassword(SecretValue password)func FromPassword(Password SecretValue) SnapshotCredentialsstatic#Update the snapshot login with an existing password.
fromSecret(secret: ISecret): SnapshotCredentials // chainable@staticmethod def from_secret(secret: ISecret) -> SnapshotCredentialspublic static SnapshotCredentials fromSecret(ISecret secret)public static SnapshotCredentials FromSecret(ISecret secret)func FromSecret(Secret ISecret) SnapshotCredentialsstatic#Update the snapshot login with an existing password from a Secret.
The Secret must be a JSON string with a password field:
{
...
"password": <required: password>,
}