rds secret discovery

umccr · Jan 30, 2024 · e3bee77 · e3bee77
1 parent 824b22d
commit e3bee77
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/config/constants.ts b/config/constants.ts
@@ -6,6 +6,7 @@ import { Duration, aws_lambda } from 'aws-cdk-lib';
 const regName = 'OrcaBusSchemaRegistry';
 const eventBusName = 'OrcaBusMain';
 const lambdaSecurityGroupName = 'OrcaBusLambdaSecurityGroup';
+const rdsMasterSecretName = 'orcabus/rds-master'; // pragma: allowlist secret
 
 const orcaBusStatefulConfig = {
   schemaRegistryProps: {
@@ -25,6 +26,7 @@ const orcaBusStatefulConfig = {
     parameterGroupName: 'default.aurora-postgresql15',
     username: 'admin',
     dbPort: 5432,
+    masterSecretName: rdsMasterSecretName,
     monitoring: {
       cloudwatchLogsExports: ['orcabus-postgresql'],
     },
@@ -57,6 +59,7 @@ const orcaBusStatelessConfig = {
   lambdaSecurityGroupName: lambdaSecurityGroupName,
   lambdaRuntimePythonVersion: aws_lambda.Runtime.PYTHON_3_10,
   bclConvertFunctionName: 'orcabus_bcl_convert',
+  rdsMasterSecretName: rdsMasterSecretName,
 };
 
 interface EnvironmentConfig {

diff --git a/lib/workload/orcabus-stateless-stack.ts b/lib/workload/orcabus-stateless-stack.ts
@@ -11,6 +11,7 @@ export interface OrcaBusStatelessConfig {
   lambdaSecurityGroupName: string;
   lambdaRuntimePythonVersion: aws_lambda.Runtime;
   bclConvertFunctionName: string;
+  rdsMasterSecretName: string;
 }
 
 export class OrcaBusStatelessStack extends cdk.Stack {

diff --git a/lib/workload/stateful/database/component.ts b/lib/workload/stateful/database/component.ts
@@ -30,6 +30,7 @@ export type DatabaseProps = MonitoringProps & {
   defaultDatabaseName: string;
   parameterGroupName: string;
   username: string;
+  masterSecretName: string;
   version: rds.AuroraPostgresEngineVersion;
   numberOfInstance: number;
   minACU: number;
@@ -47,6 +48,7 @@ export class DatabaseConstruct extends Construct {
 
     const dbSecret = new rds.DatabaseSecret(this, id + 'DbSecret', {
       username: props.username,
+      secretName: props.masterSecretName,
     });
 
     this.dbSecurityGroup = new ec2.SecurityGroup(this, 'DbSecurityGroup', {