Package: aws-cdk.aws-docdb
Amazon DocumentDB Construct Library---AWS CDK v1 has reached End-of-Support on 2023-06-01.
This package is no longer being updated, and users should migrate to AWS CDK v2.For more information on how to migrate, see theMigrating to AWS CDK v2guide.Starting a Clustered DatabaseTo set up a clustered DocumentDB database, define aDatabaseCluster. You must
always launch a database in a VPC. Use thevpcSubnetsattribute to control whether
your instances will be launched privately or publicly:# vpc: ec2.Vpccluster=docdb.DatabaseCluster(self,"Database",master_user=docdb.Login(username="myuser",# NOTE: 'admin' is reserved by DocumentDBexclude_characters="\"@/:",# optional, defaults to the set "\"@/" and is also used for eventually created rotationssecret_name="/myapp/mydocdb/masteruser"),instance_type=ec2.InstanceType.of(ec2.InstanceClass.R5,ec2.InstanceSize.LARGE),vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PUBLIC),vpc=vpc)By default, the master password will be generated and stored in AWS Secrets Manager with auto-generated description.Your cluster will be empty by default.ConnectingTo control who can access the cluster, use the.connectionsattribute. DocumentDB databases have a default port, so
you don't need to specify the port:# cluster: docdb.DatabaseClustercluster.connections.allow_default_port_from_any_ipv4("Open to the world")The endpoints to access your database cluster will be available as the.clusterEndpointand.clusterReadEndpointattributes:# cluster: docdb.DatabaseClusterwrite_address=cluster.cluster_endpoint.socket_addressIf you have existing security groups you would like to add to the cluster, use theaddSecurityGroupsmethod. Security
groups added in this way will not be managed by theConnectionsobject of the cluster.# vpc: ec2.Vpc# cluster: docdb.DatabaseClustersecurity_group=ec2.SecurityGroup(self,"SecurityGroup",vpc=vpc)cluster.add_security_groups(security_group)Deletion protectionDeletion protection can be enabled on an Amazon DocumentDB cluster to prevent accidental deletion of the cluster:# vpc: ec2.Vpccluster=docdb.DatabaseCluster(self,"Database",master_user=docdb.Login(username="myuser"),instance_type=ec2.InstanceType.of(ec2.InstanceClass.R5,ec2.InstanceSize.LARGE),vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PUBLIC),vpc=vpc,deletion_protection=True)Rotating credentialsWhen the master password is generated and stored in AWS Secrets Manager, it can be rotated automatically:# cluster: docdb.DatabaseClustercluster.add_rotation_single_user()cluster=docdb.DatabaseCluster(stack,"Database",master_user=docdb.Login(username="docdb"),instance_type=ec2.InstanceType.of(ec2.InstanceClass.R5,ec2.InstanceSize.LARGE),vpc=vpc,removal_policy=cdk.RemovalPolicy.DESTROY)cluster.add_rotation_single_user()The multi user rotation scheme is also available:importaws_cdk.aws_secretsmanagerassecretsmanager# my_imported_secret: secretsmanager.Secret# cluster: docdb.DatabaseClustercluster.add_rotation_multi_user("MyUser",secret=my_imported_secret)It's also possible to create user credentials together with the cluster and add rotation:# cluster: docdb.DatabaseClustermy_user_secret=docdb.DatabaseSecret(self,"MyUserSecret",username="myuser",master_secret=cluster.secret)my_user_secret_attached=my_user_secret.attach(cluster)# Adds DB connections information in the secretcluster.add_rotation_multi_user("MyUser",# Add rotation using the multi user schemesecret=my_user_secret_attached)Note: This user must be created manually in the database using the master credentials.
The rotation will start as soon as this user exists.See also@aws-cdk/aws-secretsmanagerfor credentials rotation of existing clusters.Audit and profiler LogsSending audit or profiler needs to be configured in two places:Check / create the needed options in your ParameterGroup forauditandprofilerlogs.Enable the corresponding option(s) when creating theDatabaseCluster:importaws_cdk.aws_iamasiamimportaws_cdk.aws_logsaslogs# my_logs_publishing_role: iam.Role# vpc: ec2.Vpccluster=docdb.DatabaseCluster(self,"Database",master_user=docdb.Login(username="myuser"),instance_type=ec2.InstanceType.of(ec2.InstanceClass.R5,ec2.InstanceSize.LARGE),vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PUBLIC),vpc=vpc,export_profiler_logs_to_cloud_watch=True,# Enable sending profiler logsexport_audit_logs_to_cloud_watch=True,# Enable sending audit logscloud_watch_logs_retention=logs.RetentionDays.THREE_MONTHS,# Optional - default is to never expire logscloud_watch_logs_retention_role=my_logs_publishing_role)