aws_rds: DatabaseClusterFromSnapshot creates a new secret when using SnapshotCredentials.fromGeneratedSecret()/fromGeneratedPassword

[talalong]

Describe the bug

I am encountering an issue similar to #23815. However, I am utilizing the fromGeneratedSecret() or fromGeneratedPassword() function to reuse the master username from the snapshot ('t3'). The CDK generates two secrets: one with the default username 'postgres' (which I did not expect) and the other with 't3' (as expected)

Expected Behavior

I anticipate having only one secret with the correct username ('t3'). The secret with the default username 'postgres' should not be present in the first place. Using the deprecated property credentials would resolve this issue.

Current Behavior

CDK generates two secrets

Reproduction Steps

Here is an example how I define my DB.

const database = new rds.DatabaseClusterFromSnapshot(this, "Database", {
      engine: rds.DatabaseClusterEngine.auroraPostgres({
        version: rds.AuroraPostgresEngineVersion.VER_14_5,
      }),
      vpc: vpc,
      vpcSubnets: { subnetType: SubnetType.PRIVATE_ISOLATED },
      writer: rds.ClusterInstance.provisioned("ClusterWriter", {
        instanceType: new ec2.InstanceType("t3.medium"),
      }),
      readers: [],
      defaultDatabaseName: "t3",
      backup: { retention: Duration.days(1) },
      storageEncrypted: true,
      cloudwatchLogsExports: ["postgresql"],
      cloudwatchLogsRetention: RetentionDays.ONE_DAY,
      copyTagsToSnapshot: true,
      snapshotCredentials: rds.SnapshotCredentials.fromGeneratedPassword("t3"),
      snapshotIdentifier:
        "arn:aws:rds:eu-central-1:875116653029:snapshot:playground-abc-def",
    });

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.122.0

Framework Version

No response

Node.js Version

18.12.1

OS

Sonoma 14.2.1

Language

TypeScript

Language Version

TypeScript (4.9.5)

Other information

No response

[pahud]

Based on

aws-cdk/packages/aws-cdk-lib/aws-rds/lib/props.ts

Line 366 in 20ad55e

generatePassword: true,

and

aws-cdk/packages/aws-cdk-lib/aws-rds/lib/private/util.ts

Line 118 in 2511956

if (!secret && renderedCredentials?.generatePassword) {

A new Secret will be created

aws-cdk/packages/aws-cdk-lib/aws-rds/lib/private/util.ts

Lines 124 to 130 in 2511956

	new DatabaseSecret(scope, 'SnapshotSecret', {
	username: renderedCredentials.username,
	encryptionKey: renderedCredentials.encryptionKey,
	excludeCharacters: renderedCredentials.excludeCharacters,
	replaceOnPasswordCriteriaChanges: renderedCredentials.replaceOnPasswordCriteriaChanges,
	replicaRegions: renderedCredentials.replicaRegions,
	}),

looks like this is related to #23441

Yes this is probably a bug and we should also make it more clear in the document.

[talalong]

I tried the CDK today with the latest version 2.171 and the issue is gone. I close this issue now. Thank you for your work. 👍

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.