@aws/nx-plugin-mcp 1.0.0-rc.85 → 1.0.0-rc.86
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/docs/guides/py-rdb.mdx
CHANGED
|
@@ -231,6 +231,10 @@ When using RDS Proxy, you do not need to configure the RDS CA bundle in the runt
|
|
|
231
231
|
|
|
232
232
|
<Snippet name="rdb/encryption-key-rotation" />
|
|
233
233
|
|
|
234
|
+
### Admin Credentials
|
|
235
|
+
|
|
236
|
+
<Snippet name="rdb/admin-credentials" />
|
|
237
|
+
|
|
234
238
|
## Connections
|
|
235
239
|
|
|
236
240
|
Use the <Link path="guides/connection">`connection`</Link> generator to integrate this project with others in your workspace. The following connections involve this project:
|
package/docs/guides/ts-rdb.mdx
CHANGED
|
@@ -311,6 +311,10 @@ For more details, see the AWS Lambda [SSL/TLS requirements for Amazon RDS connec
|
|
|
311
311
|
|
|
312
312
|
<Snippet name="rdb/encryption-key-rotation" />
|
|
313
313
|
|
|
314
|
+
### Admin Credentials
|
|
315
|
+
|
|
316
|
+
<Snippet name="rdb/admin-credentials" />
|
|
317
|
+
|
|
314
318
|
## Limitations
|
|
315
319
|
|
|
316
320
|
<OptionFilter when={{ engine: 'mysql' }}>
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
---
|
|
2
|
+
title: Admin Credentials
|
|
3
|
+
---
|
|
4
|
+
import Infrastructure from '@components/infrastructure.astro';
|
|
5
|
+
|
|
6
|
+
The Aurora admin (master) user's password is generated and rotated by Aurora itself in AWS Secrets Manager, using [RDS-managed master user passwords](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html). Your infrastructure code never receives the password, so it cannot leak into a CloudFormation template or Terraform state file. Aurora rotates the secret every 7 days without any rotation function to deploy or maintain.
|
|
7
|
+
|
|
8
|
+
The secret is encrypted with the same customer-managed KMS key as the cluster.
|
|
9
|
+
|
|
10
|
+
Your application never uses these credentials. It connects as a least-privilege database user using IAM authentication — only the migration and create-db-user handlers read the admin secret, and each is granted access to just that secret and its KMS key.
|
|
11
|
+
|
|
12
|
+
<Infrastructure>
|
|
13
|
+
<Fragment slot="cdk">
|
|
14
|
+
|
|
15
|
+
The admin secret is exposed as `secret.secretArn` on the underlying cluster, and `grantSecretRead` grants a consumer read access to it:
|
|
16
|
+
|
|
17
|
+
```ts title="packages/infra/src/stacks/application-stack.ts"
|
|
18
|
+
import { MyDatabase } from '@my-scope/common-constructs';
|
|
19
|
+
|
|
20
|
+
const db = new MyDatabase(this, 'Db', { ... });
|
|
21
|
+
|
|
22
|
+
db.grantSecretRead(myFunction);
|
|
23
|
+
```
|
|
24
|
+
</Fragment>
|
|
25
|
+
<Fragment slot="terraform">
|
|
26
|
+
|
|
27
|
+
The admin secret's ARN is exposed as the `secret_arn` output, alongside the `kms_key_arn` needed to decrypt it:
|
|
28
|
+
|
|
29
|
+
```hcl title="packages/infra/src/main.tf"
|
|
30
|
+
module "my_database" {
|
|
31
|
+
source = "../../common/terraform/src/app/dbs/my-database"
|
|
32
|
+
...
|
|
33
|
+
}
|
|
34
|
+
|
|
35
|
+
output "database_secret_arn" {
|
|
36
|
+
value = module.my_database.secret_arn
|
|
37
|
+
}
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
An RDS-managed secret holds a JSON object with `username` and `password` only — no connection details. Take the host, port and database name from the module's `writer_endpoint`, `cluster_port` and `database_name` outputs.
|
|
41
|
+
</Fragment>
|
|
42
|
+
</Infrastructure>
|