ClusterParameterGroup

family

parameters

dbClusterParameterGroupName

description

Create a clustered database with a given number of instances.

Adds the multi user rotation to this cluster.

addRotationMultiUser

Adds the single user rotation of the master password to this cluster.

addRotationSingleUser

addSecurityGroups

Renders the secret attachment target specifications.

asSecretAttachmentTarget

DatabaseCluster

Username and password for the administrative user.

masterUser

What subnets to run the DocumentDB instances in.

Must be at least 2 subnets in two different AZs.

backup

The identifier of the CA certificate used for the instances.

Specifying or updating this property triggers a reboot.

caCertificate

The number of days log events are kept in CloudWatch Logs.

When updating
this property, unsetting it doesn't remove the log retention policy. To
remove the retention policy, set the value to `Infinity`.

cloudWatchLogsRetention

The IAM role for the Lambda function associated with the custom resource that sets the retention policy.

cloudWatchLogsRetentionRole

Whether to copy tags to the snapshot when a snapshot is created.

copyTagsToSnapshot

dbClusterName

Specifies whether this cluster can be deleted.

If deletionProtection is
enabled, the cluster cannot be deleted unless it is modified and
deletionProtection is disabled. deletionProtection protects clusters from
being accidentally deleted.

deletionProtection

A value that indicates whether to enable Performance Insights for the instances in the DB Cluster.

enablePerformanceInsights

engineVersion

Whether the audit logs should be exported to CloudWatch.

Note that you also have to configure the audit log export in the Cluster's Parameter Group.

exportAuditLogsToCloudWatch

Whether the profiler logs should be exported to CloudWatch.

Note that you also have to configure the profiler log export in the Cluster's Parameter Group.

exportProfilerLogsToCloudWatch

Base identifier for instances.

Every replica is named by appending the replica number to this string, 1-based.
Only applicable for provisioned clusters.

instanceIdentifierBase

The removal policy to apply to the cluster's instances.

Cannot be set to `SNAPSHOT`.

instanceRemovalPolicy

instances

What type of instance to start for the replicas.

Required for provisioned clusters, not applicable for serverless clusters.

instanceType

kmsKey

The DB parameter group to associate with the instance.

parameterGroup

The port the DocumentDB cluster will listen on.

port

A weekly time range in which maintenance should preferably execute.

Must be at least 30 minutes long.

Example: 'tue:04:17-tue:04:47'

preferredMaintenanceWindow

The removal policy to apply when the cluster and its instances are removed or replaced during a stack update, or when the stack is deleted.

This
removal policy also applies to the implicit security group created for the
cluster if one is not supplied as a parameter.

When set to `SNAPSHOT`, the removal policy for the instances and the security group
will default to `DESTROY` as those resources do not support the policy.

Use the `instanceRemovalPolicy` and `securityGroupRemovalPolicy` to change the behavior.

removalPolicy

securityGroup

The removal policy to apply to the cluster's security group.

Cannot be set to `SNAPSHOT`.

securityGroupRemovalPolicy

ServerlessV2 scaling configuration.

When specified, the cluster will be created as a serverless cluster.

serverlessV2ScalingConfiguration

storageEncrypted

The storage type of the DocDB cluster.

I/O-optimized storage is supported starting with engine version 5.0.0.

storageType

Where to place the instances within the VPC.

vpcSubnets

DatabaseInstance

The DocumentDB database cluster the instance should launch into.

cluster

The name of the compute and memory capacity classes.

Indicates that minor engine upgrades are applied automatically to the DB instance during the maintenance window.

autoMinorVersionUpgrade

The name of the Availability Zone where the DB instance will be located.

availabilityZone

The identifier of the CA certificate for this DB instance.

Specifying or updating this property triggers a reboot.

A name for the DB instance.

If you specify a name, AWS CloudFormation
converts it to lowercase.

dbInstanceName

A value that indicates whether to enable Performance Insights for the DB Instance.

The weekly time range (in UTC) during which system maintenance can occur.

Format: `ddd:hh24:mi-ddd:hh24:mi`
Constraint: Minimum 30-minute window

The CloudFormation policy to apply when the instance is removed from the stack or replaced during an update.

DatabaseSecret

username

The KMS key to use to encrypt the secret.

encryptionKey

Characters to not include in the generated password.

excludeCharacters

The master secret which will be used to rotate this secret.

masterSecret

secretName

The `AWS::DocDB::DBCluster` Amazon DocumentDB (with MongoDB compatibility) resource describes a DBCluster.

Amazon DocumentDB is a fully managed, MongoDB-compatible document database engine. For more information, see [DBCluster](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_DBCluster.html) in the *Amazon DocumentDB Developer Guide* .

CfnDBCluster

A list of Amazon EC2 Availability Zones that instances in the cluster can be created in.

availabilityZones

The number of days for which automated backups are retained. You must specify a minimum value of 1.

Default: 1

Constraints:

- Must be a value from 1 to 35.

backupRetentionPeriod

Set to `true` to copy all tags from the source cluster snapshot to the target cluster snapshot, and otherwise `false` .

The default is `false` .

The cluster identifier. This parameter is stored as a lowercase string.

Constraints:

- Must contain from 1 to 63 letters, numbers, or hyphens.
- The first character must be a letter.
- Cannot end with a hyphen or contain two consecutive hyphens.

Example: `my-cluster`

dbClusterIdentifier

The name of the cluster parameter group to associate with this cluster.

A subnet group to associate with this cluster.

Constraints: Must match the name of an existing `DBSubnetGroup` . Must not be default.

Example: `mySubnetgroup`

dbSubnetGroupName

Protects clusters from being accidentally deleted.

If enabled, the cluster cannot be deleted unless it is modified and `DeletionProtection` is disabled.

The list of log types that need to be enabled for exporting to Amazon CloudWatch Logs.

You can enable audit logs or profiler logs. For more information, see [Auditing Amazon DocumentDB Events](https://docs.aws.amazon.com/documentdb/latest/developerguide/event-auditing.html) and [Profiling Amazon DocumentDB Operations](https://docs.aws.amazon.com/documentdb/latest/developerguide/profiling.html) .

enableCloudwatchLogsExports

The version number of the database engine to use.

The `--engine-version` will default to the latest major engine version. For production workloads, we recommend explicitly declaring this parameter with the intended major engine version.

If you intend to trigger an in-place upgrade, please refer to [Amazon DocumentDB in-place major version upgrade](https://docs.aws.amazon.com/documentdb/latest/developerguide/docdb-mvu.html) . Note that for an in-place engine version upgrade, you need to remove other cluster properties changes (e.g. SecurityGroupId) from the CFN template.

The cluster identifier of the new global cluster.

globalClusterIdentifier

The AWS  key identifier for an encrypted cluster.

The AWS  key identifier is the Amazon Resource Name (ARN) for the AWS  encryption key. If you are creating a cluster using the same AWS account that owns the AWS  encryption key that is used to encrypt the new cluster, you can use the AWS  key alias instead of the ARN for the AWS  encryption key.

If an encryption key is not specified in `KmsKeyId` :

- If the `StorageEncrypted` parameter is `true` , Amazon DocumentDB uses your default encryption key.

AWS  creates the default encryption key for your AWS account . Your AWS account has a different default encryption key for each AWS Regions .

kmsKeyId

Specifies whether to manage the master user password with Amazon Web Services Secrets Manager.

Constraint: You can't manage the master user password with Amazon Web Services Secrets Manager if `MasterUserPassword` is specified.

manageMasterUserPassword

The name of the master user for the cluster.

Constraints:

- Must be from 1 to 63 letters or numbers.
- The first character must be a letter.
- Cannot be a reserved word for the chosen database engine.

masterUsername

The password for the master database user.

This password can contain any printable ASCII character except forward slash (/), double quote ("), or the "at" symbol (@).

Constraints: Must contain from 8 to 100 characters.

masterUserPassword

The Amazon Web Services KMS key identifier to encrypt a secret that is automatically generated and managed in Amazon Web Services Secrets Manager.

This setting is valid only if the master user password is managed by Amazon DocumentDB in Amazon Web Services Secrets Manager for the DB cluster.

The Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. To use a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN.

If you don't specify `MasterUserSecretKmsKeyId` , then the `aws/secretsmanager` KMS key is used to encrypt the secret. If the secret is in a different Amazon Web Services account, then you can't use the `aws/secretsmanager` KMS key to encrypt the secret, and you must use a customer managed KMS key.

There is a default KMS key for your Amazon Web Services account. Your Amazon Web Services account has a different default KMS key for each Amazon Web Services Region.

masterUserSecretKmsKeyId

The network type of the cluster.

The network type is determined by the `DBSubnetGroup` specified for the cluster. A `DBSubnetGroup` can support only the IPv4 protocol or the IPv4 and the IPv6 protocols ( `DUAL` ).

For more information, see [DocumentDB clusters in a VPC](https://docs.aws.amazon.com/documentdb/latest/developerguide/vpc-clusters.html) in the Amazon DocumentDB Developer Guide.

Valid Values: `IPV4` | `DUAL`

networkType

Specifies the port that the database engine is listening on.

The daily time range during which automated backups are created if automated backups are enabled using the `BackupRetentionPeriod` parameter.

The default is a 30-minute window selected at random from an 8-hour block of time for each AWS Region .

Constraints:

- Must be in the format `hh24:mi-hh24:mi` .
- Must be in Universal Coordinated Time (UTC).
- Must not conflict with the preferred maintenance window.
- Must be at least 30 minutes.

preferredBackupWindow

The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).

Format: `ddd:hh24:mi-ddd:hh24:mi`

The default is a 30-minute window selected at random from an 8-hour block of time for each AWS Region , occurring on a random day of the week.

Valid days: Mon, Tue, Wed, Thu, Fri, Sat, Sun

Constraints: Minimum 30-minute window.

The date and time to restore the cluster to.

Valid values: A time in Universal Coordinated Time (UTC) format.

Constraints:

- Must be before the latest restorable time for the instance.
- Must be specified if the `UseLatestRestorableTime` parameter is not provided.
- Cannot be specified if the `UseLatestRestorableTime` parameter is `true` .
- Cannot be specified if the `RestoreType` parameter is `copy-on-write` .

Example: `2015-03-07T23:45:00Z`

restoreToTime

The type of restore to be performed. You can specify one of the following values:.

- `full-copy` - The new DB cluster is restored as a full copy of the source DB cluster.
- `copy-on-write` - The new DB cluster is restored as a clone of the source DB cluster.

Constraints: You can't specify `copy-on-write` if the engine version of the source DB cluster is earlier than 1.11.

If you don't specify a `RestoreType` value, then the new DB cluster is restored as a full copy of the source DB cluster.

restoreType

Specifies whether to rotate the secret managed by Amazon Web Services Secrets Manager for the master user password.

This setting is valid only if the master user password is managed by Amazon DocumentDB in Amazon Web Services Secrets Manager for the cluster. The secret value contains the updated password.

Constraint: You must apply the change immediately when rotating the master user password.

rotateMasterUserPassword

Contains the scaling configuration of an Amazon DocumentDB Serverless cluster.

The identifier for the snapshot or cluster snapshot to restore from.

You can use either the name or the Amazon Resource Name (ARN) to specify a cluster snapshot. However, you can use only the ARN to specify a snapshot.

Constraints:

- Must match the identifier of an existing snapshot.

snapshotIdentifier

The identifier of the source cluster from which to restore.

Constraints:

- Must match the identifier of an existing `DBCluster` .

sourceDbClusterIdentifier

Specifies whether the cluster is encrypted.

If you specify `SourceDBClusterIdentifier` or `SnapshotIdentifier` and don’t specify `StorageEncrypted` , the encryption property is inherited from the source cluster or snapshot (unless `KMSKeyId` is specified, in which case the restored cluster will be encrypted with that KMS key). If the source is encrypted and `StorageEncrypted` is specified to be true, the restored cluster will be encrypted (if you want to use a different KMS key, specify the `KMSKeyId` property as well). If the source is unencrypted and `StorageEncrypted` is specified to be true, then the `KMSKeyId` property must be specified. If the source is encrypted, don’t specify `StorageEncrypted` to be false as opting out of encryption is not allowed.

The storage type to associate with the DB cluster.

For information on storage types for Amazon DocumentDB clusters, see Cluster storage configurations in the *Amazon DocumentDB Developer Guide* .

Valid values for storage type - `standard | iopt1`

Default value is `standard`

> When you create an Amazon DocumentDB cluster with the storage type set to `iopt1` , the storage type is returned in the response. The storage type isn't returned when you set it to `standard` .

useLatestRestorableTime

A list of EC2 VPC security groups to associate with this cluster.

vpcSecurityGroupIds

The `AWS::DocDB::DBClusterParameterGroup` Amazon DocumentDB (with MongoDB compatibility) resource describes a DBClusterParameterGroup.

For more information, see [DBClusterParameterGroup](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_DBClusterParameterGroup.html) in the *Amazon DocumentDB Developer Guide* .

Parameters in a cluster parameter group apply to all of the instances in a cluster.

A cluster parameter group is initially created with the default parameters for the database engine used by instances in the cluster. To provide custom values for any of the parameters, you must modify the group after you create it. After you create a DB cluster parameter group, you must associate it with your cluster. For the new cluster parameter group and associated settings to take effect, you must then reboot the DB instances in the cluster without failover.

> After you create a cluster parameter group, you should wait at least 5 minutes before creating your first cluster that uses that cluster parameter group as the default parameter group. This allows Amazon DocumentDB to fully complete the create action before the cluster parameter group is used as the default for a new cluster. This step is especially important for parameters that are critical when creating the default database for a cluster, such as the character set for the default database defined by the `character_set_database` parameter.

CfnDBClusterParameterGroup

The description for the cluster parameter group.

Provides a list of parameters for the cluster parameter group.

The name of the DB cluster parameter group.

Constraints:

- Must not match the name of an existing `DBClusterParameterGroup` .

> This value is stored as a lowercase string.

name

The tags to be assigned to the cluster parameter group.

The `AWS::DocDB::DBInstance` Amazon DocumentDB (with MongoDB compatibility) resource describes a DBInstance.

For more information, see [DBInstance](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_DBInstance.html) in the *Amazon DocumentDB Developer Guide* .

CfnDBInstance

The identifier of the cluster that the instance will belong to.

The compute and memory capacity of the instance;

for example, `db.m4.large` . If you change the class of an instance there can be some interruption in the cluster's service.

dbInstanceClass

This parameter does not apply to Amazon DocumentDB.

Amazon DocumentDB does not perform minor version upgrades regardless of the value set.

Default: `false`

The Amazon EC2 Availability Zone that the instance is created in.

Default: A random, system-chosen Availability Zone in the endpoint's AWS Region .

Example: `us-east-1d`

The identifier of the CA certificate for this DB instance.

caCertificateIdentifier

Specifies whether the DB instance is restarted when you rotate your SSL/TLS certificate.

By default, the DB instance is restarted when you rotate your SSL/TLS certificate. The certificate is not updated until the DB instance is restarted.

> Set this parameter only if you are *not* using SSL/TLS to connect to the DB instance.

If you are using SSL/TLS to connect to the DB instance, see [Updating Your Amazon DocumentDB TLS Certificates](https://docs.aws.amazon.com/documentdb/latest/developerguide/ca_cert_rotation.html) and [Encrypting Data in Transit](https://docs.aws.amazon.com/documentdb/latest/developerguide/security.encryption.ssl.html) in the *Amazon DocumentDB Developer Guide* .

certificateRotationRestart

The instance identifier. This parameter is stored as a lowercase string.

Constraints:

- Must contain from 1 to 63 letters, numbers, or hyphens.
- The first character must be a letter.
- Cannot end with a hyphen or contain two consecutive hyphens.

Example: `mydbinstance`

dbInstanceIdentifier

A value that indicates whether to enable Performance Insights for the DB Instance.

For more information, see [Using Amazon Performance Insights](https://docs.aws.amazon.com/documentdb/latest/developerguide/performance-insights.html) .

The time range each week during which system maintenance can occur, in Universal Coordinated Time (UTC).

Format: `ddd:hh24:mi-ddd:hh24:mi`

The default is a 30-minute window selected at random from an 8-hour block of time for each AWS Region , occurring on a random day of the week.

Valid days: Mon, Tue, Wed, Thu, Fri, Sat, Sun

Constraints: Minimum 30-minute window.

The tags to be assigned to the instance.

You can assign up to 10 tags to an instance.

The `AWS::DocDB::DBSubnetGroup` Amazon DocumentDB (with MongoDB compatibility) resource describes a DBSubnetGroup.

subnet groups must contain at least one subnet in at least two Availability Zones in the AWS Region . For more information, see [DBSubnetGroup](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_DBSubnetGroup.html) in the *Amazon DocumentDB Developer Guide* .

CfnDBSubnetGroup

dbSubnetGroupDescription

The Amazon EC2 subnet IDs for the subnet group.

subnetIds

The name for the subnet group. This value is stored as a lowercase string.

Constraints: Must contain no more than 255 letters, numbers, periods, underscores, spaces, or hyphens. Must not be default.

Example: `mySubnetgroup`

The tags to be assigned to the subnet group.

Creates an Amazon DocumentDB event notification subscription.

This action requires a topic Amazon Resource Name (ARN) created by using the Amazon DocumentDB console, the Amazon SNS console, or the Amazon SNS API. To obtain an ARN with Amazon SNS, you must create a topic in Amazon SNS and subscribe to the topic. The ARN is displayed in the Amazon SNS console.

You can specify the type of source ( `SourceType` ) that you want to be notified of. You can also provide a list of Amazon DocumentDB sources ( `SourceIds` ) that trigger the events, and you can provide a list of event categories ( `EventCategories` ) for events that you want to be notified of. For example, you can specify `SourceType = db-instance` , `SourceIds = mydbinstance1, mydbinstance2` and `EventCategories = Availability, Backup` .

If you specify both the `SourceType` and `SourceIds` (such as `SourceType = db-instance` and `SourceIdentifier = myDBInstance1` ), you are notified of all the `db-instance` events for the specified source. If you specify a `SourceType` but do not specify a `SourceIdentifier` , you receive notice of the events for that source type for all your Amazon DocumentDB sources. If you do not specify either the `SourceType` or the `SourceIdentifier` , you are notified of events generated from all Amazon DocumentDB sources belonging to your customer account.

CfnEventSubscription

The Amazon Resource Name (ARN) of the SNS topic created for event notification.

Amazon SNS creates the ARN when you create a topic and subscribe to it.

snsTopicArn

A Boolean value;

set to `true` to activate the subscription, set to `false` to create the subscription but not active it.

enabled

A list of event categories for a `SourceType` that you want to subscribe to.

eventCategories

The list of identifiers of the event sources for which events are returned.

If not specified, then all sources are included in the response. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens.

Constraints:

- If `SourceIds` are provided, `SourceType` must also be provided.
- If the source type is an instance, a `DBInstanceIdentifier` must be provided.
- If the source type is a security group, a `DBSecurityGroupName` must be provided.
- If the source type is a parameter group, a `DBParameterGroupName` must be provided.
- If the source type is a snapshot, a `DBSnapshotIdentifier` must be provided.

sourceIds

The type of source that is generating the events.

For example, if you want to be notified of events generated by an instance, you would set this parameter to `db-instance` . If this value is not specified, all events are returned.

Valid values: `db-instance` , `db-cluster` , `db-parameter-group` , `db-security-group` , `db-cluster-snapshot`

sourceType

The name of the subscription.

Constraints: The name must be fewer than 255 characters.

subscriptionName

The AWS::DocDB::GlobalCluster resource represents an Amazon DocumentDB Global Cluster.

CfnGlobalCluster

The cluster identifier of the global cluster.

Indicates whether the global cluster has deletion protection enabled.

The global cluster can't be deleted when deletion protection is enabled.

The database engine to use for this global cluster.

engine

The engine version to use for this global cluster.

The Amazon Resource Name (ARN) to use as the primary cluster of the global cluster.

You may also choose to instead specify the DBClusterIdentifier. If you provide a value for this parameter, don't specify values for the following settings because Amazon DocumentDB uses the values from the specified source DB cluster: Engine, EngineVersion, StorageEncrypted

Indicates whether the global cluster has storage encryption enabled.

The tags to be assigned to the Amazon DocumentDB resource.

AWS docdb

L2 Constructs4

ClusterParameterGroup

DatabaseCluster

DatabaseInstance

DatabaseSecret

L1 Constructs6

CfnDBCluster

CfnDBClusterParameterGroup

CfnDBInstance

CfnDBSubnetGroup

CfnEventSubscription

CfnGlobalCluster

Learn AWS the Practical Way

Quick Facts

Related Links

More AWS docdb deep dives