RDS: Cannot connect to Serverless Cluster created from snapshot

[mostafafarzaneh]

Describe the bug

I am using ServerlessClusterFromSnapshot to create cluster from snapshot. for the credential, I tried both rds.SnapshotCredentials.from_generated_secret("admin") and rds.SnapshotCredentials.from_generated_password("admin") . (I do not know the difference between these two methods!)

It creates the cluster successfully but I cannot connect to it with the generated secret in the secret manager. I tried query the database with secret ARN, but no luck.
The snapshot was taken from a database with the same "admin" username.

Expected Behavior

I should be able to create a serverless cluster from the snapshot and connect to it with the newly generated secret.

Current Behavior

It won't let me connect to the database with generated secret

Reproduction Steps

Take a snapshot from a serverless cluster. Then use the ServerlessClusterFromSnapshot method and pass rds.SnapshotCredentials.from_generated_secret("admin") as credential to it.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.13.0

Framework Version

No response

Node.js Version

16.15.0

OS

Debian 10

Language

Python

Language Version

No response

Other information

No response

[mostafafarzaneh]

I ran this command: aws rds describe-db-clusters --db-cluster-identifier and this entry catch my eyes if that help:

"PendingModifiedValues": {
   "MasterUserPassword": "****"
}

[peterwoodworth]

The ServerlessClusterFromSnapshot construct works similarly to DatabaseInstanceFromSnapshot rather than DatabaseClusterFromSnapshot in terms of credentials. Specifically, the former two will allow you to modify the password of the cluster/instance, while the latter one doesn't.

I think that ServerlessClusterFromSnapshot shouldn't allow you to modify the password - see the CloudFormation functionality of DBCluster.MasterUserPassword and DBInstance.MasterUserPassword - only DBInstance allows you to modify the password when creating from snapshot.

CC @jumic @jogold

[mostafafarzaneh]

But I need to start an Aurora serverless cluster from the snapshot. Furthermore, the ServerlessClusterFromSnapshot has a credential attribute that says:

credentials (Optional[[SnapshotCredentials]]) – Master user credentials. Note - It is not possible to change the master username for a snapshot; however, it is possible to provide (or generate) a new password. Default: - The existing username and password from the snapshot will be used.

So according to this, I should be able to change the master password of the cluster. But according to DBCluster.MasterUserPassword, that you provide, I won't be able to change the master password.

It seems there is a contradiction between documents. Anyhow, what is the best way to start an Aurora serverless cluster from snapshot in CDK?

[peterwoodworth]

I've been testing this out today, and overall the credentials prop is pretty buggy and unintuitive. I can't recommend using it for any of the Snapshot constructs at this moment.

DBClusterFromSnapshot

• The construct code guarantees that you cannot set the username or password of the cluster
• However, it still creates a secret and secretTargetAttachment in the same cases as the non snapshot constructs do. So, when it does this, the secret will contain an incorrect password. Should instead use password from the snapshot

ServerlessClusterFromSnapshot

• L2 code allows you to set password of cluster created from snapshot
• However, this does nothing and the correct password is the password of the snapshot

I'll see what I can do about fixing this next week, the current functionality is a bit broken

[peterwoodworth]

To show what I mean, If I create a new Cluster then take a snapshot of that cluster - any clusters i create from that snapshot through the ClusterFromSnapshot constructs will have the same credentials as the first cluster. But, if I specify credentials such that CDK generates a password, that password will be incorrect and I cannot login to the database. If I modify created secret to use password from first cluster, it will work.

[mostafafarzaneh]

In my case when you use ServerlessClusterFromSnapshot and specify credential to be generated with rds.SnapshotCredentials.from_generated_secret("admin"), It creates the secret in the secret manager but does not update the serverless cluster to point to the new credential. I would like to not have to do manual work after creating the cluster.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.