feat(rds): more extensive secret rotation support #5281

jogold · 2019-12-03T10:34:28Z

Add support for Redshift clusters, DocumentDB databases and the multi user rotation scheme.

Move SecretRotation from aws-rds to aws-secretsmanager.

Add resource policy for secrets and use it to prevent deletion of secrets for which rotation is
enabled.

Update instance class to t3 in aws-rds integration tests (t2 is being deprecated and Oracle
t2 instances cannot be created anymore).

Closes #5194

BREAKING CHANGE: addRotationSingleUser(id: string, options: SecretRotationOptions) is now addRotationSingleUser(automaticallyAfter?: Duration)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

mergify · 2019-12-03T10:35:11Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

aws-cdk-automation · 2019-12-03T10:42:52Z

AWS CodeBuild CI Report

Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

Add support for Redshift clusters, DocumentDB databases and the multi user rotation scheme. Move `SecretRotation` from `aws-rds` to `aws-secretsmanager`. Add resource policy for secrets and use it to prevent deletion of secrets for which rotation is enabled. Update instance class to `t3` in `aws-rds` integration tests (`t2` is being deprecated and Oracle `t2` instances cannot be created anymore). Closes aws#5194 BREAKING CHANGE: `addRotationSingleUser(id: string, options: SecretRotationOptions)` is now `addRotationSingleUser(automaticallyAfter?: Duration)`

aws-cdk-automation · 2019-12-03T12:33:39Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

rix0rrr · 2019-12-12T14:43:04Z

packages/@aws-cdk/aws-rds/lib/cluster.ts

   */
-  public addRotationSingleUser(id: string, options: SecretRotationOptions = {}): SecretRotation {
+  public addRotationSingleUser(automaticallyAfter?: Duration): secretsmanager.SecretRotation {


Why is it a good idea to break this API this strongly? I appreciate that the options are drastically simplified, but the following seems nicely standardized and not too onerous to me:

cluster.addRotationSingleUser('id', { automaticallyAfter: Duration.days(14) });

This is only to reflect the fact that a single rotation can only be added once to a cluster/instance so there's no point naming it...

packages/@aws-cdk/aws-secretsmanager/lib/secret-rotation.ts

rix0rrr · 2019-12-12T14:59:26Z

packages/@aws-cdk/aws-secretsmanager/lib/secret.ts

+    }
+  }
+
+  public denyAccountRootDelete() {


How sure are you this won't affect deletions via CloudFormation?

Yes this has been tested.

This approach is now recommended in the docs, see YAML comments in https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_cloudformation.html

Pull request has been modified.

aws-cdk-automation · 2019-12-12T17:39:10Z

AWS CodeBuild CI Report

Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2019-12-12T19:17:55Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2019-12-12T19:19:21Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2019-12-16T12:33:20Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T13:00:47Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T13:53:07Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T14:38:47Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T14:52:19Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T15:17:25Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

aws-cdk-automation · 2019-12-18T12:44:41Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

jogold requested review from rix0rrr and skinny85 as code owners December 3, 2019 10:34

jogold force-pushed the secret-rotation branch from 8f5b725 to d6360ce Compare December 3, 2019 12:04

jogold changed the title ~~feat(rds,secretsmanager): new databases, multi user scheme~~ feat(rds,secretsmanager): rotation for new databases, multi user scheme Dec 3, 2019

jogold changed the title ~~feat(rds,secretsmanager): rotation for new databases, multi user scheme~~ feat(secretsmanager,rds): rotation for new databases, multi user scheme Dec 3, 2019

SomayaB assigned rix0rrr Dec 3, 2019

rix0rrr previously requested changes Dec 12, 2019

View reviewed changes

jogold added 3 commits December 12, 2019 18:12

Merge branch 'master' into secret-rotation

1f06499

code-block

05eb2ff

SecretRotationApplicationOptions

ee9a719

jogold added 2 commits December 12, 2019 19:51

readonly

9a520fc

JSDoc

a1fe241

Merge branch 'master' into secret-rotation

9f55b83

rix0rrr changed the title ~~feat(secretsmanager,rds): rotation for new databases, multi user scheme~~ feat(rds): rotation for new databases, multi user scheme Dec 20, 2019

rix0rrr changed the title ~~feat(rds): rotation for new databases, multi user scheme~~ feat(rds): more extensive secret rotation support Dec 20, 2019

rix0rrr added the pr/do-not-merge This PR should not be merged at this time. label Dec 20, 2019

rix0rrr approved these changes Dec 20, 2019

View reviewed changes

rix0rrr merged commit b700b77 into aws:master Dec 20, 2019

jogold deleted the secret-rotation branch January 24, 2020 15:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(rds): more extensive secret rotation support #5281

feat(rds): more extensive secret rotation support #5281

jogold commented Dec 3, 2019

mergify bot commented Dec 3, 2019

aws-cdk-automation commented Dec 3, 2019

aws-cdk-automation commented Dec 3, 2019

rix0rrr Dec 12, 2019

jogold Dec 12, 2019

rix0rrr Dec 12, 2019

jogold Dec 12, 2019

aws-cdk-automation commented Dec 12, 2019

aws-cdk-automation commented Dec 12, 2019

aws-cdk-automation commented Dec 12, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

aws-cdk-automation commented Dec 18, 2019

feat(rds): more extensive secret rotation support #5281

feat(rds): more extensive secret rotation support #5281

Conversation

jogold commented Dec 3, 2019

mergify bot commented Dec 3, 2019

aws-cdk-automation commented Dec 3, 2019

AWS CodeBuild CI Report

aws-cdk-automation commented Dec 3, 2019

AWS CodeBuild CI Report

rix0rrr Dec 12, 2019

Choose a reason for hiding this comment

jogold Dec 12, 2019

Choose a reason for hiding this comment

rix0rrr Dec 12, 2019

Choose a reason for hiding this comment

jogold Dec 12, 2019

Choose a reason for hiding this comment

aws-cdk-automation commented Dec 12, 2019

AWS CodeBuild CI Report

aws-cdk-automation commented Dec 12, 2019

AWS CodeBuild CI Report

aws-cdk-automation commented Dec 12, 2019

AWS CodeBuild CI Report

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

aws-cdk-automation commented Dec 18, 2019

AWS CodeBuild CI Report