[aws-rds] When moving from DatabaseCluster to DatabaseClusterFromSnapshot, lose ability to rotate master passwords

[jonahbeckford]

If I start with a DatabaseCluster and then need to switch it to DatabaseClusterFromSnapshot, I am forced to weaken security because DatabaseClusterFromSnapshot does not have addRotationSingleUser().

Reproduction Steps

Starting point was:

const vpc = ...
const cluster = new DatabaseCluster(this, 'Database', {
    engine: DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.VER_11_9 }),
    instanceProps: {
        vpc: vpc,
    },
})
cluster.addRotationSingleUser({ automaticallyAfter: Duration.days(2) })

Then, after removing the cluster (which creates a snapshot) and recreating it with:

const vpc = ...
const cluster = new DatabaseClusterFromSnapshot(this, 'Database', {
    snapshotIdentifier: "",
    engine: DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.VER_11_9 }),
    instanceProps: {
        vpc: vpc,
    },
})
// The next line fails to compile!
cluster.addRotationSingleUser({ automaticallyAfter: Duration.days(2) })

the last line cannot be used.

What did you expect to happen?

I expected DatabaseClusterFromSnapshot to have the same API as DatabaseCluster.

What actually happened?

error TS2339: Property 'addRotationSingleUser' does not exist on type 'DatabaseClusterFromSnapshot'.

Environment

• CDK CLI Version : 1.88.0 (build f65009b)
• Framework Version: aws-cli/2.1.8 Python/3.7.3 Linux/4.19.128-microsoft-standard exe/x86_64.ubuntu.18 prompt/off
• Node.js Version: v12.20.1
• OS : Ubuntu 18.04 on WSL 2
• Language (Version): TypeScript 3.9.7

Other

I would suggest pulling DatabaseCluster.addRotationSingleUser and DatabaseCluster.addRotationMultiUser up into DatabaseClusterNew (which is the shared superclass of DatabaseClusterFromSnapshot)

---

This is 🐛 Bug Report

[skinny85]

Thanks for opening the issue @jonahbeckford! Should be relatively straightforward change to add the addRotationSingleUser() and addRotationMultiUser() methods to DatabaseClusterFromSnapshot.

We really encourage contributions, so if you'd be willing to open us a PR adding this feature, that would be amazing 🙂. Here's our 'Contributing' guide: https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md.

Thanks,
Adam

[jonahbeckford]

Okay, will try to create my first PR for aws-cdk.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[anthonygerrard]

This change adds a credentials property to DatabaseClusterFromSnapshotProps. Documented as

Credentials for the administrative user.

But will these credentials work if you restore from snapshot? My understanding is that you get the admin user of the snapshot.

[skinny85]

The username has to be from the snapshot, yes, but the password can be updated. See here for the details.