HostedRotationLambdaProperty Struct
Creates a new Lambda rotation function based on one of the Secrets Manager rotation function templates .
You must specify Transform: AWS::SecretsManager-2024-09-16 at the beginning of the CloudFormation template.
For Amazon RDS master user credentials, see AWS::RDS::DBCluster MasterUserSecret .
For Amazon Redshift admin user credentials, see AWS::Redshift::Cluster .
Example
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_secretsmanager as secretsmanager } from 'aws-cdk-lib';
const hostedRotationLambdaProperty: secretsmanager.CfnRotationSchedule.HostedRotationLambdaProperty = {
rotationType: 'rotationType',
// the properties below are optional
excludeCharacters: 'excludeCharacters',
kmsKeyArn: 'kmsKeyArn',
masterSecretArn: 'masterSecretArn',
masterSecretKmsKeyArn: 'masterSecretKmsKeyArn',
rotationLambdaName: 'rotationLambdaName',
runtime: 'runtime',
superuserSecretArn: 'superuserSecretArn',
superuserSecretKmsKeyArn: 'superuserSecretKmsKeyArn',
vpcSecurityGroupIds: 'vpcSecurityGroupIds',
vpcSubnetIds: 'vpcSubnetIds',
};
Properties
excludeCharactersstringexclude_charactersstrexcludeCharactersStringExcludeCharactersstringExcludeCharacters*string#If you don't specify this value, then Secrets Manager uses the key aws/secretsmanager . If aws/secretsmanager doesn't yet exist, then Secrets Manager creates it for you automatically the first time it encrypts the secret value.
masterSecretArnstringmaster_secret_arnstrmasterSecretArnStringMasterSecretArnstringMasterSecretArn*string#notes
You must create the superuser secret before you can set this property.
You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see JSON structure of Secrets Manager secrets .
You can specify MasterSecretArn or SuperuserSecretArn but not both. They represent the same superuser secret.
masterSecretKmsKeyArnstringmaster_secret_kms_key_arnstrmasterSecretKmsKeyArnStringMasterSecretKmsKeyArnstringMasterSecretKmsKeyArn*string#You can specify MasterSecretKmsKeyArn or SuperuserSecretKmsKeyArn but not both. They represent the same superuser secret KMS key .
rotationLambdaNamestringrotation_lambda_namestrrotationLambdaNameStringRotationLambdaNamestringRotationLambdaName*string#notes
Db2SingleUserto use the template SecretsManagerRDSDb2RotationSingleUser .Db2MultiUserto use the template SecretsManagerRDSDb2RotationMultiUser .MySQLSingleUserto use the template SecretsManagerRDSMySQLRotationSingleUser .MySQLMultiUserto use the template SecretsManagerRDSMySQLRotationMultiUser .PostgreSQLSingleUserto use the template SecretsManagerRDSPostgreSQLRotationSingleUserPostgreSQLMultiUserto use the template SecretsManagerRDSPostgreSQLRotationMultiUser .OracleSingleUserto use the template SecretsManagerRDSOracleRotationSingleUser .OracleMultiUserto use the template SecretsManagerRDSOracleRotationMultiUser .MariaDBSingleUserto use the template SecretsManagerRDSMariaDBRotationSingleUser .MariaDBMultiUserto use the template SecretsManagerRDSMariaDBRotationMultiUser .SQLServerSingleUserto use the template SecretsManagerRDSSQLServerRotationSingleUser .SQLServerMultiUserto use the template SecretsManagerRDSSQLServerRotationMultiUser .RedshiftSingleUserto use the template SecretsManagerRedshiftRotationSingleUsr .RedshiftMultiUserto use the template SecretsManagerRedshiftRotationMultiUser .MongoDBSingleUserto use the template SecretsManagerMongoDBRotationSingleUser .MongoDBMultiUserto use the template SecretsManagerMongoDBRotationMultiUser .
notes
Over time, the updated rotation lambda artifacts vended by AWS may not be compatible with the code or shared object files defined in the rotation function deployment package.
Only define the
Runtimekey if:
- You are using
Transform: AWS::SecretsManager-2020-07-23.- The code or shared object files defined in the rotation function deployment package are incompatible with Python 3.10.
The Python Runtime version for with the rotation function. By default, CloudFormation deploys Python 3.10 binaries for the rotation function. To use a different version of Python, you must do the following two steps:
- Deploy the matching version Python binaries with your rotation function.
- Set the version number in this field. For example, for Python 3.10, enter python3.10 .
If you only do one of the steps, your rotation function will be incompatible with the binaries. For more information, see Why did my Lambda rotation function fail with a "pg module not found" error .
superuserSecretArnstringsuperuser_secret_arnstrsuperuserSecretArnStringSuperuserSecretArnstringSuperuserSecretArn*string#notes
You must create the superuser secret before you can set this property.
You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see JSON structure of Secrets Manager secrets .
You can specify MasterSecretArn or SuperuserSecretArn but not both. They represent the same superuser secret.
superuserSecretKmsKeyArnstringsuperuser_secret_kms_key_arnstrsuperuserSecretKmsKeyArnStringSuperuserSecretKmsKeyArnstringSuperuserSecretKmsKeyArn*string#You can specify MasterSecretKmsKeyArn or SuperuserSecretKmsKeyArn but not both. They represent the same superuser secret KMS key .
vpcSecurityGroupIdsstringvpc_security_group_idsstrvpcSecurityGroupIdsStringVpcSecurityGroupIdsstringVpcSecurityGroupIds*string#The template applies the same security groups as on the Lambda rotation function that is created as part of this stack.
The Lambda rotation function is in the same subnet group.