feat(rds): grantConnect for database instances

[njlynch]

As a follow-on to enabling IAM database auth, this change makes it easier to
grant a user/role access to the database via policy.

fixes #1558

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 463f7d0
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[kevchentw]

Is it possible to enable IAM database auth for database cluster or it is for instance database only?

I have tried to get instance from cluster and grantConnect, but it only create rds-db:connect policy without enable IAM Auth on rds instance.

const cluster = new rds.DatabaseCluster(app, `my-rds`, {
    instances: 2,
    .....
}
readerDatabaseInstance = rds.DatabaseInstance.fromDatabaseInstanceAttributes(app, `apt-${stage}-pitlane-rds-instance-reader`, {
  instanceEndpointAddress: cluster.clusterReadEndpoint.hostname,
  instanceIdentifier: cluster.instanceIdentifiers[0],
  port: cluster.clusterReadEndpoint.port,
  securityGroups: [sg]
})
writerDatabaseInstance = rds.DatabaseInstance.fromDatabaseInstanceAttributes(app, `apt-${stage}-pitlane-rds-instance-writer`, {
  instanceEndpointAddress: cluster.clusterEndpoint.hostname,
  instanceIdentifier: cluster.instanceIdentifiers[1],
  port: cluster.clusterEndpoint.port,
  securityGroups: [sg]
})
readerDatabaseInstance.grantConnect(xxx.taskRole)
writerDatabaseInstance.grantConnect(xxx.taskRole)