Skip to content

fix(rds): add manageMasterUserPassword support to DatabaseInstanceFromSnapshot - #38210

Open
gingeekrishna wants to merge 6 commits into
aws:mainfrom
gingeekrishna:fix/38175-managemasteruserpassword-dbinstance-fromsnapshot
Open

fix(rds): add manageMasterUserPassword support to DatabaseInstanceFromSnapshot#38210
gingeekrishna wants to merge 6 commits into
aws:mainfrom
gingeekrishna:fix/38175-managemasteruserpassword-dbinstance-fromsnapshot

Conversation

@gingeekrishna

@gingeekrishna gingeekrishna commented Jun 27, 2026

Copy link
Copy Markdown

Issue # (if applicable)

Closes #38175.

Reason for this change

DatabaseInstance and DatabaseClusterFromSnapshot gained manageMasterUserPassword support in #35734, but DatabaseInstanceFromSnapshot was missed. This property allows RDS to natively manage the master user password in AWS Secrets Manager.

Description of changes

  • Added manageMasterUserPassword?: boolean property to DatabaseInstanceFromSnapshotProps
  • Wired the property through to CfnDBInstance (sets ManageMasterUserPassword, MasterUserSecret KMS key, and suppresses MasterUserPassword) following the same pattern as DatabaseInstance and DatabaseClusterFromSnapshot
  • Added a synth-time validation that rejects non-Oracle engines, because the RestoreDBInstanceFromDBSnapshot API only supports ManageMasterUserPassword for Oracle
  • Exposes the RDS-managed secret via instance.secret (using Secret.fromSecretAttributes on attrMasterUserSecretSecretArn)
  • Added unit tests covering: happy path, KMS encryption key, secret exposure, non-Oracle rejection, unsupported credential properties, and rotation conflict

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Added unit tests; all pass (Tests: 167 passed, 167 total).

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@gingeekrishna
fix(rds): add manageMasterUserPassword support to DatabaseInstanceFro…
2be717d 
…mSnapshot

`DatabaseInstance` and `DatabaseClusterFromSnapshot` gained
`manageMasterUserPassword` in aws#35734, but `DatabaseInstanceFromSnapshot`
was missed.

This PR adds the property to `DatabaseInstanceFromSnapshotProps` and
wires it through to `CfnDBInstance`, following the same pattern as the
existing implementations.  An Oracle-only synth-time guard is also
included because the `RestoreDBInstanceFromDBSnapshot` API only supports
`ManageMasterUserPassword` for Oracle engines.

Closes aws#38175
Copilot AI review requested due to automatic review settings June 27, 2026 15:19
Copilot AI reviewed Jun 27, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-actions github-actions Bot added the beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK label Jun 27, 2026
@aws-cdk-automation
aws-cdk-automation requested a review from a team June 27, 2026 15:19
@github-actions github-actions Bot added effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p2 labels Jun 27, 2026
@gingeekrishna gingeekrishna mentioned this pull request Jun 27, 2026
Open
2 tasks
aws-cdk-automation
aws-cdk-automation previously requested changes Jun 27, 2026
View reviewed changes

@aws-cdk-automation aws-cdk-automation left a comment •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(This review is outdated)

@pahud pahud mentioned this pull request Jun 27, 2026
Open
@gingeekrishna
test(rds): add integ test for DatabaseInstanceFromSnapshot with manag…
25a8172 
…eMasterUserPassword

Adds integration test and snapshot for Oracle DatabaseInstanceFromSnapshot
with manageMasterUserPassword enabled, satisfying the PR linter requirement
for fix() PRs.
@aws-cdk-automation
aws-cdk-automation dismissed their stale review June 27, 2026 16:14

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@pahud pahud mentioned this pull request Jul 16, 2026
Open
@aws-cdk-automation aws-cdk-automation mentioned this pull request Jul 21, 2026
Closed
@aws-cdk-automation aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jul 28, 2026
@aws-cdk-automation aws-cdk-automation mentioned this pull request Aug 5, 2026
Closed
@aws-cdk-automation aws-cdk-automation mentioned this pull request Aug 16, 2026
Open
@aws-cdk-automation aws-cdk-automation added pr/community-review-timeout pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@aws-cdk-automation aws-cdk-automation aws-cdk-automation left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p2 pr/community-review-timeout pr/needs-maintainer-review This PR needs a review from a Core Team Member

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

aws-rds: Support manageMasterUserPassword for DatabaseInstanceFromSnapshot

5 participants

@gingeekrishna @aws-cdk-automation @pahud @ozelalisen