(aws-rds): Cannot change removal policy of DatabaseInstance's admin secret

[mskrip]

What is the problem?

It's not possible to change the default DatabaseInstance.secret removal policy. The instance of the secret does have a apply_removal_policy method bound to it (I can see it when printing dir(secret)), but calling it makes no difference.

Reproduction Steps

Create a rds.DatabaseInstance and the master secret will have a default removal policy DELETE with no way to change it (even if changing the removal policy of the instance).

What did you expect to happen?

I would expect, that calling rds_instance.secret.apply_removal_policy would apply the removal policy.

What actually happened?

It doesn't

CDK CLI Version

1.134.0 (build dd5e12d)

Framework Version

1.134.0

Node.js Version

v16.12.0

OS

Arch Linux 5.15.4-arch1-1

Language

Python

Language Version

3.9.7

Other information

No response

[peterwoodworth]

I believe this is because the secret is declared as an ISecret, which doesn't have the applyRemovalPolicy() function. I'm not sure if this is something that we can change

To work around this and apply the removal policy you want to the secret, you can use an escape hatch!

Here's an example for TypeScript, let me know if you need one for Python.

    const db = new DatabaseInstance(this, 'db', {
      vpc: vpc,
      engine: dsb.DatabaseInstanceEngine.postgres({version: dsb.PostgresEngineVersion.VER_13_4})
    });

    const secret = db.node.children[2] as DatabaseSecret
    secret.applyRemovalPolicy(RemovalPolicy.RETAIN)

[skinny85]

Hey @mskrip,

thanks for opening the issue. Looks like the Resource class already has applyRemovalPolicy() method, so this should just be a matter of adding that same method to the IResource interface.

PRs are very welcome! 🙂

Thanks,
Adam

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[mskrip]

@skinny85 Unfortunately, the #17746 did not really fix the underlying issue here, since rds_instance.secret is not the Secret resource but SecretTargetAttachment. Therefore, I still have to use the escape hatch here.

[skinny85]

That's a fair point @mskrip. I'm re-opening this one.

I'm wondering what should be correct behavior be here? Should calling applyRemovalPolicy() on the SecretTargetAttachment also change the retention policy of the Secret it's pointing to?

[mskrip]

@skinny85 Yes, that makes sense. Maybe it would be useful if SecretTargetAttachment had a reference to the Secret resource it's attaching so the policies can be applied explicitly. But that might be too much of a change to the interface so I'm not sure.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.