Class: AWSCDK::SecretsManager::CfnRotationSchedule::HostedRotationLambdaProperty

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
secrets_manager/cfn_rotation_schedule.rb

Overview

Creates a new Lambda rotation function based on one of the Secrets Manager rotation function templates .

You must specify Transform: AWS::SecretsManager-2024-09-16 at the beginning of the CloudFormation template.

For Amazon RDS master user credentials, see AWS::RDS::DBCluster MasterUserSecret .

For Amazon Redshift admin user credentials, see AWS::Redshift::Cluster .

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(rotation_type:, exclude_characters: nil, kms_key_arn: nil, master_secret_arn: nil, master_secret_kms_key_arn: nil, rotation_lambda_name: nil, runtime: nil, superuser_secret_arn: nil, superuser_secret_kms_key_arn: nil, vpc_security_group_ids: nil, vpc_subnet_ids: nil) ⇒ HostedRotationLambdaProperty

Returns a new instance of HostedRotationLambdaProperty.

Parameters:

  • rotation_type (String) —

    The rotation template to base the rotation function on, one of the following:.

  • exclude_characters (String, nil) (defaults to: nil) —

    A string of the characters that you don't want in the password.

  • kms_key_arn (String, nil) (defaults to: nil) —

    The ARN of the KMS key that Secrets Manager uses to encrypt the secret.

  • master_secret_arn (String, nil) (defaults to: nil) —

    The ARN of the secret that contains superuser credentials, if you use the Alternating users rotation strategy . CloudFormation grants the execution role for the Lambda rotation function GetSecretValue permission to the secret in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

  • master_secret_kms_key_arn (String, nil) (defaults to: nil) —

    The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the alternating users strategy and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key aws/secretsmanager . CloudFormation grants the execution role for the Lambda rotation function Decrypt , DescribeKey , and GenerateDataKey permission to the key in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

  • rotation_lambda_name (String, nil) (defaults to: nil) —

    The name of the Lambda rotation function.

  • runtime (String, nil) (defaults to: nil) —

    Do not set this value if you are using Transform: AWS::SecretsManager-2024-09-16 .

  • superuser_secret_arn (String, nil) (defaults to: nil) —

    The ARN of the secret that contains superuser credentials, if you use the Alternating users rotation strategy . CloudFormation grants the execution role for the Lambda rotation function GetSecretValue permission to the secret in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

  • superuser_secret_kms_key_arn (String, nil) (defaults to: nil) —

    The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the alternating users strategy and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key aws/secretsmanager . CloudFormation grants the execution role for the Lambda rotation function Decrypt , DescribeKey , and GenerateDataKey permission to the key in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

  • vpc_security_group_ids (String, nil) (defaults to: nil) —

    A comma-separated list of security group IDs applied to the target database.

  • vpc_subnet_ids (String, nil) (defaults to: nil) —

    A comma separated list of VPC subnet IDs of the target database network.



658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 658

def initialize(rotation_type:, exclude_characters: nil, kms_key_arn: nil, master_secret_arn: nil, master_secret_kms_key_arn: nil, rotation_lambda_name: nil, runtime: nil, superuser_secret_arn: nil, superuser_secret_kms_key_arn: nil, vpc_security_group_ids: nil, vpc_subnet_ids: nil)
  @rotation_type = rotation_type
  Jsii::Type.check_type(@rotation_type, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "rotationType")
  @exclude_characters = exclude_characters
  Jsii::Type.check_type(@exclude_characters, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "excludeCharacters") unless @exclude_characters.nil?
  @kms_key_arn = kms_key_arn
  Jsii::Type.check_type(@kms_key_arn, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "kmsKeyArn") unless @kms_key_arn.nil?
  @master_secret_arn = master_secret_arn
  Jsii::Type.check_type(@master_secret_arn, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "masterSecretArn") unless @master_secret_arn.nil?
  @master_secret_kms_key_arn = master_secret_kms_key_arn
  Jsii::Type.check_type(@master_secret_kms_key_arn, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "masterSecretKmsKeyArn") unless @master_secret_kms_key_arn.nil?
  @rotation_lambda_name = rotation_lambda_name
  Jsii::Type.check_type(@rotation_lambda_name, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "rotationLambdaName") unless @rotation_lambda_name.nil?
  @runtime = runtime
  Jsii::Type.check_type(@runtime, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "runtime") unless @runtime.nil?
  @superuser_secret_arn = superuser_secret_arn
  Jsii::Type.check_type(@superuser_secret_arn, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "superuserSecretArn") unless @superuser_secret_arn.nil?
  @superuser_secret_kms_key_arn = superuser_secret_kms_key_arn
  Jsii::Type.check_type(@superuser_secret_kms_key_arn, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "superuserSecretKmsKeyArn") unless @superuser_secret_kms_key_arn.nil?
  @vpc_security_group_ids = vpc_security_group_ids
  Jsii::Type.check_type(@vpc_security_group_ids, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "vpcSecurityGroupIds") unless @vpc_security_group_ids.nil?
  @vpc_subnet_ids = vpc_subnet_ids
  Jsii::Type.check_type(@vpc_subnet_ids, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "vpcSubnetIds") unless @vpc_subnet_ids.nil?
end

Instance Attribute Details

#exclude_characters ⇒ String? (readonly)

A string of the characters that you don't want in the password.

Returns:

  • (String, nil)

See Also:



709
710
711
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 709

def exclude_characters
  @exclude_characters
end

#kms_key_arn ⇒ String? (readonly)

The ARN of the KMS key that Secrets Manager uses to encrypt the secret.

If you don't specify this value, then Secrets Manager uses the key aws/secretsmanager . If aws/secretsmanager doesn't yet exist, then Secrets Manager creates it for you automatically the first time it encrypts the secret value.

Returns:

  • (String, nil)

See Also:



716
717
718
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 716

def kms_key_arn
  @kms_key_arn
end

#master_secret_arn ⇒ String? (readonly)

The ARN of the secret that contains superuser credentials, if you use the Alternating users rotation strategy . CloudFormation grants the execution role for the Lambda rotation function GetSecretValue permission to the secret in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

You must create the superuser secret before you can set this property.

You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see JSON structure of Secrets Manager secrets .

You can specify MasterSecretArn or SuperuserSecretArn but not both. They represent the same superuser secret.

Returns:

  • (String, nil)

See Also:



727
728
729
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 727

def master_secret_arn
  @master_secret_arn
end

#master_secret_kms_key_arn ⇒ String? (readonly)

The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the alternating users strategy and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key aws/secretsmanager . CloudFormation grants the execution role for the Lambda rotation function Decrypt , DescribeKey , and GenerateDataKey permission to the key in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

You can specify MasterSecretKmsKeyArn or SuperuserSecretKmsKeyArn but not both. They represent the same superuser secret KMS key .

Returns:

  • (String, nil)

See Also:



734
735
736
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 734

def master_secret_kms_key_arn
  @master_secret_kms_key_arn
end

#rotation_lambda_name ⇒ String? (readonly)

The name of the Lambda rotation function.

Returns:

  • (String, nil)

See Also:



739
740
741
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 739

def rotation_lambda_name
  @rotation_lambda_name
end

#rotation_type ⇒ String (readonly)

The rotation template to base the rotation function on, one of the following:.

Returns:

  • (String)

See Also:



704
705
706
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 704

def rotation_type
  @rotation_type
end

#runtime ⇒ String? (readonly)

Do not set this value if you are using Transform: AWS::SecretsManager-2024-09-16 .

Over time, the updated rotation lambda artifacts vended by AWS may not be compatible with the code or shared object files defined in the rotation function deployment package.

Only define the Runtime key if:

  • You are using Transform: AWS::SecretsManager-2020-07-23 .
  • The code or shared object files defined in the rotation function deployment package are incompatible with Python 3.10.

The Python Runtime version for with the rotation function. By default, CloudFormation deploys Python 3.10 binaries for the rotation function. To use a different version of Python, you must do the following two steps:

  • Deploy the matching version Python binaries with your rotation function.
  • Set the version number in this field. For example, for Python 3.10, enter python3.10 .

If you only do one of the steps, your rotation function will be incompatible with the binaries. For more information, see Why did my Lambda rotation function fail with a "pg module not found" error .

Returns:

  • (String, nil)

See Also:



758
759
760
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 758

def runtime
  @runtime
end

#superuser_secret_arn ⇒ String? (readonly)

The ARN of the secret that contains superuser credentials, if you use the Alternating users rotation strategy . CloudFormation grants the execution role for the Lambda rotation function GetSecretValue permission to the secret in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

You must create the superuser secret before you can set this property.

You must also include the superuser secret ARN as a key in the JSON of the rotating secret so that the Lambda rotation function can find it. CloudFormation does not hardcode secret ARNs in the Lambda rotation function, so you can use the function to rotate multiple secrets. For more information, see JSON structure of Secrets Manager secrets .

You can specify MasterSecretArn or SuperuserSecretArn but not both. They represent the same superuser secret.

Returns:

  • (String, nil)

See Also:



769
770
771
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 769

def superuser_secret_arn
  @superuser_secret_arn
end

#superuser_secret_kms_key_arn ⇒ String? (readonly)

The ARN of the KMS key that Secrets Manager used to encrypt the superuser secret, if you use the alternating users strategy and the superuser secret is encrypted with a customer managed key. You don't need to specify this property if the superuser secret is encrypted using the key aws/secretsmanager . CloudFormation grants the execution role for the Lambda rotation function Decrypt , DescribeKey , and GenerateDataKey permission to the key in this property. For more information, see Lambda rotation function execution role permissions for Secrets Manager .

You can specify MasterSecretKmsKeyArn or SuperuserSecretKmsKeyArn but not both. They represent the same superuser secret KMS key .

Returns:

  • (String, nil)

See Also:



776
777
778
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 776

def superuser_secret_kms_key_arn
  @superuser_secret_kms_key_arn
end

#vpc_security_group_ids ⇒ String? (readonly)

A comma-separated list of security group IDs applied to the target database.

The template applies the same security groups as on the Lambda rotation function that is created as part of this stack.

Returns:

  • (String, nil)

See Also:



783
784
785
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 783

def vpc_security_group_ids
  @vpc_security_group_ids
end

#vpc_subnet_ids ⇒ String? (readonly)

A comma separated list of VPC subnet IDs of the target database network.

The Lambda rotation function is in the same subnet group.

Returns:

  • (String, nil)

See Also:



790
791
792
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 790

def vpc_subnet_ids
  @vpc_subnet_ids
end

Class Method Details

.jsii_properties ⇒ Object 



792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 792

def self.jsii_properties
  {
    :rotation_type => "rotationType",
    :exclude_characters => "excludeCharacters",
    :kms_key_arn => "kmsKeyArn",
    :master_secret_arn => "masterSecretArn",
    :master_secret_kms_key_arn => "masterSecretKmsKeyArn",
    :rotation_lambda_name => "rotationLambdaName",
    :runtime => "runtime",
    :superuser_secret_arn => "superuserSecretArn",
    :superuser_secret_kms_key_arn => "superuserSecretKmsKeyArn",
    :vpc_security_group_ids => "vpcSecurityGroupIds",
    :vpc_subnet_ids => "vpcSubnetIds",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
 
# File 'secrets_manager/cfn_rotation_schedule.rb', line 808

def to_jsii
  result = {}
  result.merge!({
    "rotationType" => @rotation_type,
    "excludeCharacters" => @exclude_characters,
    "kmsKeyArn" => @kms_key_arn,
    "masterSecretArn" => @master_secret_arn,
    "masterSecretKmsKeyArn" => @master_secret_kms_key_arn,
    "rotationLambdaName" => @rotation_lambda_name,
    "runtime" => @runtime,
    "superuserSecretArn" => @superuser_secret_arn,
    "superuserSecretKmsKeyArn" => @superuser_secret_kms_key_arn,
    "vpcSecurityGroupIds" => @vpc_security_group_ids,
    "vpcSubnetIds" => @vpc_subnet_ids,
  })
  result.compact
end