Skip to content

Commit 03a0f79

Browse files
ymhirokiymhiroki
authored
fix(rds): database proxies use ids as their resource names directly (under feature flag) (#23703)
fixes #18578 ---- ### All Submissions: * [X] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Construct Runtime Dependencies: * [ ] This PR adds new construct runtime dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-construct-runtime-dependencies) ### New Features * [X] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [X] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 0570e01 commit 03a0f79

14 files changed

+1297
-44
lines changed

‎packages/@aws-cdk/aws-rds/lib/proxy.ts

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import * as ec2 from '@aws-cdk/aws-ec2';
22
import * as iam from '@aws-cdk/aws-iam';
33
import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
44
import * as cdk from '@aws-cdk/core';
5+
import * as cxapi from '@aws-cdk/cx-api';
56
import { Construct } from 'constructs';
67
import { IDatabaseCluster } from './cluster-ref';
78
import { IEngine } from './engine';
@@ -414,7 +415,12 @@ export class DatabaseProxy extends DatabaseProxyBase
414415
private readonly resource: CfnDBProxy;
415416

416417
constructor(scope: Construct, id: string, props: DatabaseProxyProps) {
417-
super(scope, id, { physicalName: props.dbProxyName || id });
418+
super(scope, id);
419+
420+
const physicalName = props.dbProxyName || (
421+
cdk.FeatureFlags.of(this).isEnabled(cxapi.DATABASE_PROXY_UNIQUE_RESOURCE_NAME) ?
422+
cdk.Names.uniqueResourceName(this, { maxLength: 60 }) : id
423+
);
418424

419425
const role = props.role || new iam.Role(this, 'IAMRole', {
420426
assumedBy: new iam.ServicePrincipal('rds.amazonaws.com'),
@@ -447,7 +453,7 @@ export class DatabaseProxy extends DatabaseProxyBase
447453
secretArn: _.secretArn,
448454
};
449455
}),
450-
dbProxyName: this.physicalName,
456+
dbProxyName: physicalName,
451457
debugLogging: props.debugLogging,
452458
engineFamily: bindResult.engineFamily,
453459
idleClientTimeout: props.idleClientTimeout?.toSeconds(),

‎packages/@aws-cdk/aws-rds/test/integ.proxy.js.snapshot/aws-cdk-rds-proxy.assets.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "20.0.0",
2+
"version": "29.0.0",
33
"files": {
4-
"4f288f361e05d7a0cadc909ac72cad71f5ffa327848daac454f6f4717925e6fb": {
4+
"eade7d2d48419acaec1228343071922ec168779f7a6dd46405c9605c5652b43e": {
55
"source": {
66
"path": "aws-cdk-rds-proxy.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "4f288f361e05d7a0cadc909ac72cad71f5ffa327848daac454f6f4717925e6fb.json",
12+
"objectKey": "eade7d2d48419acaec1228343071922ec168779f7a6dd46405c9605c5652b43e.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk/aws-rds/test/integ.proxy.js.snapshot/aws-cdk-rds-proxy.template.json

Lines changed: 310 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -607,7 +607,7 @@
607607
}
608608
}
609609
],
610-
"DBProxyName": "dbProxy",
610+
"DBProxyName": "awscdkrdsproxydbProxy0E60A1B7",
611611
"EngineFamily": "POSTGRESQL",
612612
"RoleArn": {
613613
"Fn::GetAtt": [
@@ -651,6 +651,315 @@
651651
}
652652
]
653653
}
654+
},
655+
"dbClusterSubnets03B9B0E1": {
656+
"Type": "AWS::RDS::DBSubnetGroup",
657+
"Properties": {
658+
"DBSubnetGroupDescription": "Subnets for dbCluster database",
659+
"SubnetIds": [
660+
{
661+
"Ref": "vpcPrivateSubnet1Subnet934893E8"
662+
},
663+
{
664+
"Ref": "vpcPrivateSubnet2Subnet7031C2BA"
665+
}
666+
]
667+
}
668+
},
669+
"dbClusterSecurityGroupCAA1A91F": {
670+
"Type": "AWS::EC2::SecurityGroup",
671+
"Properties": {
672+
"GroupDescription": "RDS security group",
673+
"SecurityGroupEgress": [
674+
{
675+
"CidrIp": "0.0.0.0/0",
676+
"Description": "Allow all outbound traffic by default",
677+
"IpProtocol": "-1"
678+
}
679+
],
680+
"VpcId": {
681+
"Ref": "vpcA2121C38"
682+
}
683+
}
684+
},
685+
"dbClusterSecurityGroupfromawscdkrdsproxyProxyProxySecurityGroup9F179E6FIndirectPortED421002": {
686+
"Type": "AWS::EC2::SecurityGroupIngress",
687+
"Properties": {
688+
"IpProtocol": "tcp",
689+
"Description": "Allow connections to the database Cluster from the Proxy",
690+
"FromPort": {
691+
"Fn::GetAtt": [
692+
"dbClusterE86E47AE",
693+
"Endpoint.Port"
694+
]
695+
},
696+
"GroupId": {
697+
"Fn::GetAtt": [
698+
"dbClusterSecurityGroupCAA1A91F",
699+
"GroupId"
700+
]
701+
},
702+
"SourceSecurityGroupId": {
703+
"Fn::GetAtt": [
704+
"ProxyProxySecurityGroupC42FC3CE",
705+
"GroupId"
706+
]
707+
},
708+
"ToPort": {
709+
"Fn::GetAtt": [
710+
"dbClusterE86E47AE",
711+
"Endpoint.Port"
712+
]
713+
}
714+
}
715+
},
716+
"dbClusterSecretCEA6D7B6": {
717+
"Type": "AWS::SecretsManager::Secret",
718+
"Properties": {
719+
"Description": {
720+
"Fn::Join": [
721+
"",
722+
[
723+
"Generated by the CDK for stack: ",
724+
{
725+
"Ref": "AWS::StackName"
726+
}
727+
]
728+
]
729+
},
730+
"GenerateSecretString": {
731+
"ExcludeCharacters": " %+~`#$&*()|[]{}:;<>?!'/@\"\\",
732+
"GenerateStringKey": "password",
733+
"PasswordLength": 30,
734+
"SecretStringTemplate": "{\"username\":\"postgres\"}"
735+
}
736+
},
737+
"UpdateReplacePolicy": "Delete",
738+
"DeletionPolicy": "Delete"
739+
},
740+
"dbClusterSecretAttachmentAB67A752": {
741+
"Type": "AWS::SecretsManager::SecretTargetAttachment",
742+
"Properties": {
743+
"SecretId": {
744+
"Ref": "dbClusterSecretCEA6D7B6"
745+
},
746+
"TargetId": {
747+
"Ref": "dbClusterE86E47AE"
748+
},
749+
"TargetType": "AWS::RDS::DBCluster"
750+
}
751+
},
752+
"dbClusterE86E47AE": {
753+
"Type": "AWS::RDS::DBCluster",
754+
"Properties": {
755+
"CopyTagsToSnapshot": true,
756+
"DBClusterParameterGroupName": "default.aurora-postgresql14",
757+
"DBSubnetGroupName": {
758+
"Ref": "dbClusterSubnets03B9B0E1"
759+
},
760+
"Engine": "aurora-postgresql",
761+
"EngineVersion": "14.5",
762+
"MasterUsername": {
763+
"Fn::Join": [
764+
"",
765+
[
766+
"{{resolve:secretsmanager:",
767+
{
768+
"Ref": "dbClusterSecretCEA6D7B6"
769+
},
770+
":SecretString:username::}}"
771+
]
772+
]
773+
},
774+
"MasterUserPassword": {
775+
"Fn::Join": [
776+
"",
777+
[
778+
"{{resolve:secretsmanager:",
779+
{
780+
"Ref": "dbClusterSecretCEA6D7B6"
781+
},
782+
":SecretString:password::}}"
783+
]
784+
]
785+
},
786+
"Port": 5432,
787+
"VpcSecurityGroupIds": [
788+
{
789+
"Fn::GetAtt": [
790+
"dbClusterSecurityGroupCAA1A91F",
791+
"GroupId"
792+
]
793+
}
794+
]
795+
},
796+
"UpdateReplacePolicy": "Snapshot",
797+
"DeletionPolicy": "Snapshot"
798+
},
799+
"dbClusterInstance1BCE092AC": {
800+
"Type": "AWS::RDS::DBInstance",
801+
"Properties": {
802+
"DBClusterIdentifier": {
803+
"Ref": "dbClusterE86E47AE"
804+
},
805+
"DBInstanceClass": "db.t3.medium",
806+
"DBSubnetGroupName": {
807+
"Ref": "dbClusterSubnets03B9B0E1"
808+
},
809+
"Engine": "aurora-postgresql"
810+
},
811+
"DependsOn": [
812+
"vpcPrivateSubnet1DefaultRoute1AA8E2E5",
813+
"vpcPrivateSubnet1RouteTableAssociation67945127",
814+
"vpcPrivateSubnet2DefaultRouteB0E07F99",
815+
"vpcPrivateSubnet2RouteTableAssociation007E94D3"
816+
],
817+
"UpdateReplacePolicy": "Delete",
818+
"DeletionPolicy": "Delete"
819+
},
820+
"dbClusterInstance20BA1ECD9": {
821+
"Type": "AWS::RDS::DBInstance",
822+
"Properties": {
823+
"DBClusterIdentifier": {
824+
"Ref": "dbClusterE86E47AE"
825+
},
826+
"DBInstanceClass": "db.t3.medium",
827+
"DBSubnetGroupName": {
828+
"Ref": "dbClusterSubnets03B9B0E1"
829+
},
830+
"Engine": "aurora-postgresql"
831+
},
832+
"DependsOn": [
833+
"vpcPrivateSubnet1DefaultRoute1AA8E2E5",
834+
"vpcPrivateSubnet1RouteTableAssociation67945127",
835+
"vpcPrivateSubnet2DefaultRouteB0E07F99",
836+
"vpcPrivateSubnet2RouteTableAssociation007E94D3"
837+
],
838+
"UpdateReplacePolicy": "Delete",
839+
"DeletionPolicy": "Delete"
840+
},
841+
"ProxyIAMRole2FE8AB0F": {
842+
"Type": "AWS::IAM::Role",
843+
"Properties": {
844+
"AssumeRolePolicyDocument": {
845+
"Statement": [
846+
{
847+
"Action": "sts:AssumeRole",
848+
"Effect": "Allow",
849+
"Principal": {
850+
"Service": "rds.amazonaws.com"
851+
}
852+
}
853+
],
854+
"Version": "2012-10-17"
855+
}
856+
}
857+
},
858+
"ProxyIAMRoleDefaultPolicy59EB0117": {
859+
"Type": "AWS::IAM::Policy",
860+
"Properties": {
861+
"PolicyDocument": {
862+
"Statement": [
863+
{
864+
"Action": [
865+
"secretsmanager:DescribeSecret",
866+
"secretsmanager:GetSecretValue"
867+
],
868+
"Effect": "Allow",
869+
"Resource": {
870+
"Ref": "dbClusterSecretAttachmentAB67A752"
871+
}
872+
}
873+
],
874+
"Version": "2012-10-17"
875+
},
876+
"PolicyName": "ProxyIAMRoleDefaultPolicy59EB0117",
877+
"Roles": [
878+
{
879+
"Ref": "ProxyIAMRole2FE8AB0F"
880+
}
881+
]
882+
}
883+
},
884+
"ProxyProxySecurityGroupC42FC3CE": {
885+
"Type": "AWS::EC2::SecurityGroup",
886+
"Properties": {
887+
"GroupDescription": "SecurityGroup for Database Proxy",
888+
"SecurityGroupEgress": [
889+
{
890+
"CidrIp": "0.0.0.0/0",
891+
"Description": "Allow all outbound traffic by default",
892+
"IpProtocol": "-1"
893+
}
894+
],
895+
"VpcId": {
896+
"Ref": "vpcA2121C38"
897+
}
898+
}
899+
},
900+
"ProxyCB0DFB71": {
901+
"Type": "AWS::RDS::DBProxy",
902+
"Properties": {
903+
"Auth": [
904+
{
905+
"AuthScheme": "SECRETS",
906+
"IAMAuth": "DISABLED",
907+
"SecretArn": {
908+
"Ref": "dbClusterSecretAttachmentAB67A752"
909+
}
910+
}
911+
],
912+
"DBProxyName": "cluster-db-proxy",
913+
"EngineFamily": "POSTGRESQL",
914+
"RoleArn": {
915+
"Fn::GetAtt": [
916+
"ProxyIAMRole2FE8AB0F",
917+
"Arn"
918+
]
919+
},
920+
"VpcSubnetIds": [
921+
{
922+
"Ref": "vpcPrivateSubnet1Subnet934893E8"
923+
},
924+
{
925+
"Ref": "vpcPrivateSubnet2Subnet7031C2BA"
926+
}
927+
],
928+
"RequireTLS": true,
929+
"VpcSecurityGroupIds": [
930+
{
931+
"Fn::GetAtt": [
932+
"ProxyProxySecurityGroupC42FC3CE",
933+
"GroupId"
934+
]
935+
}
936+
]
937+
}
938+
},
939+
"ProxyProxyTargetGroupB462B5C5": {
940+
"Type": "AWS::RDS::DBProxyTargetGroup",
941+
"Properties": {
942+
"DBProxyName": {
943+
"Ref": "ProxyCB0DFB71"
944+
},
945+
"TargetGroupName": "default",
946+
"ConnectionPoolConfigurationInfo": {},
947+
"DBClusterIdentifiers": [
948+
{
949+
"Ref": "dbClusterE86E47AE"
950+
}
951+
]
952+
},
953+
"DependsOn": [
954+
"dbClusterInstance1BCE092AC",
955+
"dbClusterInstance20BA1ECD9",
956+
"dbClusterE86E47AE",
957+
"dbClusterSecretAttachmentAB67A752",
958+
"dbClusterSecretCEA6D7B6",
959+
"dbClusterSecurityGroupfromawscdkrdsproxyProxyProxySecurityGroup9F179E6FIndirectPortED421002",
960+
"dbClusterSecurityGroupCAA1A91F",
961+
"dbClusterSubnets03B9B0E1"
962+
]
654963
}
655964
},
656965
"Parameters": {

‎packages/@aws-cdk/aws-rds/test/integ.proxy.js.snapshot/cdk.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"20.0.0"}
1+
{"version":"29.0.0"}

0 commit comments

Comments
 (0)