aws-rds: is it possible to implement addRotationSingleUser / addRotationMultiUser for ServerlessClusterFromSnapshot?

[clueleaf]

Describe the feature

While we can add secret rotation by using addRotationSingleUser, addRotationMultiUser for ServerlessCluster custruct, these methods are not implemented in ServerlessClusterFromSnapshot. I still prefer to rotate user secrets when creating a serverless cluster from snapshot.

Are there any problems to add these methods for ServerlessClusterFromSnapshot?
I'll also appreciate any other recommended measures to achieve user rotation.

maybe related: #20434

Use Case

Achieve user rotation for Aurora Serverless cluster created from a snapshot.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.92.0

Environment details (OS name and version, etc.)

macOS Ventura

[indrora]

Thanks for the suggestion. Is there a reasonable way to do this using CloudFormation currently or does it require the SDK/CLI to perform this action?

(ignore the closure; accidental click)

[clueleaf]

Did some further research.
Relating issues are #20434 and #21730 (the later one seemingly shouldn't get closed).

When I created a DB cluster using ServerlessCluster construct, DB secret is stored to Secrets Manager all together, and we can perform addRotationSingleUser.

When using ServerlessClusterFromSnapshot to restore from a snapshot, the secret is not stored to Secrets Manager.
However if I use credentials property like credentials: rds.SnapshotCredentials.fromGeneratedSecret(...) (which added MasterUserPassword property to cfn template), a new secret is stored to Secrets Manager, and I was able to login to the database with it.

The tricky part is, according to CloudFormation document, we shouldn't specify MasterUserPassword property when using SnapshotIdentifier. I have no idea why it actually worked.

Considering the above, I'm not sure what can be done regarding addRotationSingleUser when it is not recommended to store the master secret to Secrets Manager. But I think we can at least implement addRotationMultiUser because this method explicitly requires a secret as its property.