InstanceProps: Unable to set CACertificateIdentifier

[farazoman]

Describe the feature

Following this issue: aws-cloudformation/cloudformation-coverage-roadmap#211 ability to set the CACertificateIdentifier was supported in Cloudformation, which i see is also supported in the DBInstance type in CDK. The issue is that if someone wants to use InstanceProps, they have no way via CDK to fix the issue.

Use Case

When regularly needing to update cert auth identifiers via CDK with InstanceProps, there is no way to do so.

Proposed Solution

allow passing the CACertificateIdentifier property to avoid drift in infra code vs actual infra

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.118.0 (build a40f2ec)

Environment details (OS name and version, etc.)

MacOS, Sonoma 14.6...

[ashishdhingra]

@farazoman Good afternoon. Thanks for opening the issue. Could you please elaborate your scenario with a code example.

• There is a property named caCertificate in DatabaseInstanceNewProps.
• The property caCertificate is used in setting caCertificateIdentifier here in DatabaseInstanceNew
• DatabaseInstanceReadReplica inherits from DatabaseInstanceNew class and uses DatabaseInstanceReadReplicaProps in constructor.

Please advise if you are unable to use caCertificate property (which is ultimately used for setting caCertificateIdentifier property).

Thanks,
Ashish

[farazoman]

@ashishdhingra , thanks for responding, so the construction of the db is something like this:

rds.DatabaseCluster(this, 'Cluster', {
      ...(identifier props)
      instanceProps: instanceProps,
      instances: instances,
}

so I am constructing the instance via a cluster by specifying the number of instances I want.

[ashishdhingra]

@farazoman Thanks for your response. So looks like you are requesting to add support for setting caCertificateIdentifier for the instances created while defining DatabaseCluster. Is this correct? If yes, we would perhaps need to add support for caCertificate property in L2 DatabaseCluster properties and use it when creating instances in legacyCreateInstances and/or _createInstances() (we might need to add support in IAuroraClusterInstance).