CfnRotationScheduleProps
- class aws_cdk.aws_secretsmanager.CfnRotationScheduleProps(*, secret_id, hosted_rotation_lambda=None, rotate_immediately_on_update=None, rotation_lambda_arn=None, rotation_rules=None)
Bases:
object
Properties for defining a
CfnRotationSchedule
.- Parameters:
secret_id (
str
) – The ARN or name of the secret to rotate. To reference a secret also created in this template, use the Ref function with the secret’s logical ID.hosted_rotation_lambda (
Union
[IResolvable
,HostedRotationLambdaProperty
,Dict
[str
,Any
],None
]) – Creates a new Lambda rotation function based on one of the Secrets Manager rotation function templates . To use a rotation function that already exists, specifyRotationLambdaARN
instead. For Amazon RDS master user credentials, see AWS::RDS::DBCluster MasterUserSecret .rotate_immediately_on_update (
Union
[bool
,IResolvable
,None
]) – Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. The rotation schedule is defined inRotationRules
. If you don’t immediately rotate the secret, Secrets Manager tests the rotation configuration by running the`testSecret
step <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html>`_ of the Lambda rotation function. The test creates anAWSPENDING
version of the secret and then removes it. If you don’t specify this value, then by default, Secrets Manager rotates the secret immediately. Rotation is an asynchronous process. For more information, see How rotation works .rotation_lambda_arn (
Optional
[str
]) –The ARN of an existing Lambda rotation function. To specify a rotation function that is also defined in this template, use the Ref function. For Amazon RDS master user credentials, see AWS::RDS::DBCluster MasterUserSecret . To create a new rotation function based on one of the Secrets Manager rotation function templates , specify
HostedRotationLambda
instead.rotation_rules (
Union
[IResolvable
,RotationRulesProperty
,Dict
[str
,Any
],None
]) – A structure that defines the rotation configuration for this secret.
- See:
- ExampleMetadata:
fixture=_generated
Example:
# The code below shows an example of how to instantiate this type. # The values are placeholders you should change. from aws_cdk import aws_secretsmanager as secretsmanager cfn_rotation_schedule_props = secretsmanager.CfnRotationScheduleProps( secret_id="secretId", # the properties below are optional hosted_rotation_lambda=secretsmanager.CfnRotationSchedule.HostedRotationLambdaProperty( rotation_type="rotationType", # the properties below are optional exclude_characters="excludeCharacters", kms_key_arn="kmsKeyArn", master_secret_arn="masterSecretArn", master_secret_kms_key_arn="masterSecretKmsKeyArn", rotation_lambda_name="rotationLambdaName", runtime="runtime", superuser_secret_arn="superuserSecretArn", superuser_secret_kms_key_arn="superuserSecretKmsKeyArn", vpc_security_group_ids="vpcSecurityGroupIds", vpc_subnet_ids="vpcSubnetIds" ), rotate_immediately_on_update=False, rotation_lambda_arn="rotationLambdaArn", rotation_rules=secretsmanager.CfnRotationSchedule.RotationRulesProperty( automatically_after_days=123, duration="duration", schedule_expression="scheduleExpression" ) )
Attributes
- hosted_rotation_lambda
//docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html>`_ . To use a rotation function that already exists, specify
RotationLambdaARN
instead.For Amazon RDS master user credentials, see AWS::RDS::DBCluster MasterUserSecret .
- See:
- Type:
Creates a new Lambda rotation function based on one of the `Secrets Manager rotation function templates <https
- rotate_immediately_on_update
Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window.
The rotation schedule is defined in
RotationRules
.If you don’t immediately rotate the secret, Secrets Manager tests the rotation configuration by running the
`testSecret
step <https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html>`_ of the Lambda rotation function. The test creates anAWSPENDING
version of the secret and then removes it.If you don’t specify this value, then by default, Secrets Manager rotates the secret immediately.
Rotation is an asynchronous process. For more information, see How rotation works .
- rotation_lambda_arn
The ARN of an existing Lambda rotation function.
To specify a rotation function that is also defined in this template, use the Ref function.
For Amazon RDS master user credentials, see AWS::RDS::DBCluster MasterUserSecret .
To create a new rotation function based on one of the Secrets Manager rotation function templates , specify
HostedRotationLambda
instead.
- rotation_rules
A structure that defines the rotation configuration for this secret.