feat(docdb): cluster - deletion protection (aws#15216)

This commit adds support for `deletionProtection` on docdb `DatabaseCluster`s.

Fixes: aws#15170

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk/aws-docdb/README.md

@@ -60,6 +60,24 @@ const securityGroup = new ec2.SecurityGroup(stack, 'SecurityGroup', {
 cluster.addSecurityGroups(securityGroup);
 ```
 
+## Deletion protection
+
+Deletion protection can be enabled on an Amazon DocumentDB cluster to prevent accidental deletion of the cluster:
+
+```ts
+const cluster = new DatabaseCluster(this, 'Database', {
+    masterUser: {
+        username: 'myuser'
+    },
+    instanceType: ec2.InstanceType.of(ec2.InstanceClass.R5, ec2.InstanceSize.LARGE),
+    vpcSubnets: {
+        subnetType: ec2.SubnetType.PUBLIC,
+    },
+    vpc,
+    deletionProtection: true  // Enable deletion protection.
+});
+```
+
 ## Rotating credentials
 
 When the master password is generated and stored in AWS Secrets Manager, it can be rotated automatically:

packages/@aws-cdk/aws-docdb/lib/cluster.ts

@@ -136,6 +136,16 @@ export interface DatabaseClusterProps {
    * @default - Retain cluster.
    */
   readonly removalPolicy?: RemovalPolicy
+
+  /**
+   * Specifies whether this cluster can be deleted. If deletionProtection is
+   * enabled, the cluster cannot be deleted unless it is modified and
+   * deletionProtection is disabled. deletionProtection protects clusters from
+   * being accidentally deleted.
+   *
+   * @default - false
+   */
+  readonly deletionProtection?: boolean;
 }
 
 /**
@@ -361,6 +371,7 @@ export class DatabaseCluster extends DatabaseClusterBase {
       port: props.port,
       vpcSecurityGroupIds: [this.securityGroupId],
       dbClusterParameterGroupName: props.parameterGroup?.parameterGroupName,
+      deletionProtection: props.deletionProtection,
       // Admin
       masterUsername: secret ? secret.secretValueFromJson('username').toString() : props.masterUser.username,
       masterUserPassword: secret

packages/@aws-cdk/aws-docdb/test/cluster.test.ts

@@ -167,6 +167,27 @@ describe('DatabaseCluster', () => {
     }));
   });
 
+  test('can configure cluster deletion protection', () => {
+    // GIVEN
+    const stack = testStack();
+    const vpc = new ec2.Vpc(stack, 'VPC');
+
+    // WHEN
+    new DatabaseCluster(stack, 'Database', {
+      masterUser: {
+        username: 'admin',
+      },
+      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.SMALL),
+      vpc,
+      deletionProtection: true,
+    });
+
+    // THEN
+    expectCDK(stack).to(haveResource('AWS::DocDB::DBCluster', {
+      DeletionProtection: true,
+    }));
+  });
+
   test('cluster with parameter group', () => {
     // GIVEN
     const stack = testStack();