aws-rds: Support manageMasterUserPassword for DatabaseInstanceFromSnapshot

[mazyu36]

Describe the feature

Add manageMasterUserPassword support to DatabaseInstanceFromSnapshotProps.

Use Case

DatabaseInstance and DatabaseClusterFromSnapshot already support manageMasterUserPassword (added in #35734), but DatabaseInstanceFromSnapshot does not. Per the RestoreDBInstanceFromDBSnapshot API docs, this applies to RDS for Oracle only.

An Oracle user restoring an instance from a snapshot currently has to use the L1 escape hatch:

(instance.node.defaultChild as rds.CfnDBInstance).addPropertyOverride('ManageMasterUserPassword', true);

Proposed Solution

Add manageMasterUserPassword to DatabaseInstanceFromSnapshotProps with a synth-time validation that rejects non-Oracle engines.

Other information

• Related PR: feat(rds): support native Secrets Manager integration for RDS Cluster and Instance  #35734

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

[pahud]

Hi @mazyu36,

This is a good catch — it appears PR #35734 covered DatabaseInstance and DatabaseClusterFromSnapshot but missed DatabaseInstanceFromSnapshot. The L1 supports it, so this is a straightforward gap.

Problem at a Glance:

┌─────────────────────────────────┐
│  manageMasterUserPassword       │
├─────────────────────────────────┤
│  ✅ DatabaseInstance            │
│  ✅ DatabaseClusterFromSnapshot │
│  ❌ DatabaseInstanceFromSnapshot│  ← you are here
└─────────────────────────────────┘

In the meantime, you can unblock yourself using @aws-cdk/cfn-property-mixins:

Workaround using CfnPropsMixin

import * as rds from 'aws-cdk-lib/aws-rds';
import { CfnDBInstancePropsMixin } from '@aws-cdk/cfn-property-mixins/aws-rds';

const instance = new rds.DatabaseInstanceFromSnapshot(this, 'Instance', {
  snapshotIdentifier: 'my-snapshot',
  engine: rds.DatabaseInstanceEngine.oracleEe({ version: rds.OracleEngineVersion.VER_19 }),
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.M5, ec2.InstanceSize.LARGE),
  vpc,
});

instance.with(new CfnDBInstancePropsMixin({
  manageMasterUserPassword: true,
}));

Or using the escape hatch you already noted:

(instance.node.defaultChild as rds.CfnDBInstance).addPropertyOverride('ManageMasterUserPassword', true);

That said, this should be a native L2 prop. The fix is effort/small — just follow the pattern from PR #35734 and add Oracle-only validation. A PR would be very welcome!

[gingeekrishna]

I've submitted a fix in #38210. The PR adds manageMasterUserPassword to DatabaseInstanceFromSnapshotProps, wires it through to CfnDBInstance (following the same pattern as DatabaseInstance and DatabaseClusterFromSnapshot from #35734), and includes a synth-time guard that rejects non-Oracle engines since the RestoreDBInstanceFromDBSnapshot API only supports ManageMasterUserPassword for Oracle.