Create a clustered database with a given number of instances.

Adds the multi user rotation to this cluster.

See [Alternating users rotation strategy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-two-users)

addRotationMultiUser

Adds the single user rotation of the master password to this cluster.

See [Single user rotation strategy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html#rotating-secrets-one-user-one-password)

addRotationSingleUser

This value is represented as a percentage.

It's calculated as the value of the
ServerlessDatabaseCapacity metric divided by the maximum ACU value of the DB cluster.

If this metric approaches a value of 100.0, the DB instance has scaled up as high as it can.
Consider increasing the maximum ACU setting for the cluster.

metricACUUtilization

As a cluster-level metric, it represents the average of the ServerlessDatabaseCapacity values of all the Aurora Serverless v2 DB instances in the cluster.

metricServerlessDatabaseCapacity

The average number of disk read I/O operations per second.

This metric is only available for Aurora database clusters.
For non-Aurora RDS clusters, this metric will not return any data
in CloudWatch.

metricVolumeReadIOPs

The average number of disk write I/O operations per second.

This metric is only available for Aurora database clusters.
For non-Aurora RDS clusters, this metric will not return any data
in CloudWatch.

metricVolumeWriteIOPs

DatabaseCluster

engine

Specifies whether minor engine upgrades are applied automatically to the DB cluster during the maintenance window.

autoMinorVersionUpgrade

The number of seconds to set a cluster's target backtrack window to.

This feature is only supported by the Aurora MySQL database engine and
cannot be enabled on existing clusters.

backtrackWindow

backup

The list of log types that need to be enabled for exporting to CloudWatch Logs.

cloudwatchLogsExports

The number of days log events are kept in CloudWatch Logs.

When updating
this property, unsetting it doesn't remove the log retention policy. To
remove the retention policy, set the value to `Infinity`.

cloudwatchLogsRetention

The IAM role for the Lambda function associated with the custom resource that sets the retention policy.

cloudwatchLogsRetentionRole

clusterIdentifier

[Misspelled] Specifies the scalability mode of the Aurora DB cluster.

Set LIMITLESS if you want to use a limitless database; otherwise, set it to STANDARD.

clusterScailabilityType

Specifies the scalability mode of the Aurora DB cluster.

Set LIMITLESS if you want to use a limitless database; otherwise, set it to STANDARD.

clusterScalabilityType

Whether to copy tags to the snapshot when a snapshot is created.

copyTagsToSnapshot

credentials

databaseInsightsMode

Name of a database which is automatically created inside the cluster.

defaultDatabaseName

Specifies whether to remove automated backups immediately after the DB cluster is deleted.

deleteAutomatedBackups

Indicates whether the DB cluster should have deletion protection enabled.

deletionProtection

Directory ID for associating the DB cluster with a specific Active Directory.

Necessary for enabling Kerberos authentication. If specified, the DB cluster joins the given Active Directory, enabling Kerberos authentication.
If not specified, the DB cluster will not be associated with any Active Directory, and Kerberos authentication will not be enabled.

domain

The IAM role to be used when making API calls to the Directory Service.

The role needs the AWS-managed policy
`AmazonRDSDirectoryServiceAccess` or equivalent.

domainRole

Whether to enable enhanced monitoring at the cluster level.

If set to true, `monitoringInterval` and `monitoringRole` are applied to not the instances, but the cluster.
`monitoringInterval` is required to be set if `enableClusterLevelEnhancedMonitoring` is set to true.

enableClusterLevelEnhancedMonitoring

Whether to enable the Data API for the cluster.

enableDataApi

Whether read replicas can forward write operations to the writer DB instance in the DB cluster.

This setting can only be enabled for Aurora MySQL 3.04 or higher, and for Aurora PostgreSQL 16.4
or higher (for version 16), 15.8 or higher (for version 15), and 14.13 or higher (for version 14).

enableLocalWriteForwarding

Whether to enable Performance Insights for the DB cluster.

enablePerformanceInsights

engineLifecycleSupport

Whether to enable mapping of AWS Identity and Access Management (IAM) accounts to database accounts.

iamAuthentication

Base identifier for instances.

Every replica is named by appending the replica number to this string, 1-based.

instanceIdentifierBase

Settings for the individual instances that are launched.

instanceProps

How many replicas/instances to create.

Has to be at least 1.

instances

instanceUpdateBehaviour

The interval between points when Amazon RDS collects enhanced monitoring metrics.

If you enable `enableClusterLevelEnhancedMonitoring`, this property is applied to the cluster,
otherwise it is applied to the instances.

monitoringInterval

Role that will be used to manage DB monitoring.

If you enable `enableClusterLevelEnhancedMonitoring`, this property is applied to the cluster,
otherwise it is applied to the instances.

monitoringRole

networkType

Additional parameters to pass to the database engine.

parameterGroup

The parameters in the DBClusterParameterGroup to create automatically.

You can only specify parameterGroup or parameters but not both.
You need to use a versioned engine to auto-generate a DBClusterParameterGroup.

parameters

The AWS KMS key for encryption of Performance Insights data.

performanceInsightEncryptionKey

The amount of time, in days, to retain Performance Insights data.

If you set `databaseInsightsMode` to `DatabaseInsightsMode.ADVANCED`, you must set this property to `PerformanceInsightRetention.MONTHS_15`.

performanceInsightRetention

port

A preferred maintenance window day/time range. Should be specified as a range ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC).

Example: 'Sun:23:45-Mon:00:15'

preferredMaintenanceWindow

A list of instances to create as cluster reader instances.

readers

The removal policy to apply when the cluster and its instances are removed from the stack or replaced during an update.

removalPolicy

The Amazon Resource Name (ARN) of the source DB instance or DB cluster if this DB cluster is created as a read replica.

Cannot be used with credentials.

replicationSourceIdentifier

S3 buckets that you want to load data into. This feature is only supported by the Aurora database engine.

This property must not be used if `s3ExportRole` is used.

For MySQL:

s3ExportBuckets

Role that will be associated with this DB cluster to enable S3 export.

This feature is only supported by the Aurora database engine.

This property must not be used if `s3ExportBuckets` is used.
To use this property with Aurora PostgreSQL, it must be configured with the S3 export feature enabled when creating the DatabaseClusterEngine
For MySQL:

s3ExportRole

S3 buckets that you want to load data from. This feature is only supported by the Aurora database engine.

This property must not be used if `s3ImportRole` is used.

For MySQL:

s3ImportBuckets

Role that will be associated with this DB cluster to enable S3 import.

This feature is only supported by the Aurora database engine.

This property must not be used if `s3ImportBuckets` is used.
To use this property with Aurora PostgreSQL, it must be configured with the S3 import feature enabled when creating the DatabaseClusterEngine
For MySQL:

s3ImportRole

securityGroups

Specifies the duration an Aurora Serverless v2 DB instance must be idle before Aurora attempts to automatically pause it.

The duration must be between 300 seconds (5 minutes) and 86,400 seconds (24 hours).

serverlessV2AutoPauseDuration

The maximum number of Aurora capacity units (ACUs) for a DB instance in an Aurora Serverless v2 cluster.

You can specify ACU values in half-step increments, such as 40, 40.5, 41, and so on.
The largest value that you can use is 256.

The maximum capacity must be higher than 0.5 ACUs.

serverlessV2MaxCapacity

The minimum number of Aurora capacity units (ACUs) for a DB instance in an Aurora Serverless v2 cluster.

You can specify ACU values in half-step increments, such as 8, 8.5, 9, and so on.
The smallest value that you can use is 0.

For Aurora versions that support the Aurora Serverless v2 auto-pause feature, the smallest value that you can use is 0.
For versions that don't support Aurora Serverless v2 auto-pause, the smallest value that you can use is 0.5.

serverlessV2MinCapacity

storageEncrypted

The KMS key for storage encryption.

If specified, `storageEncrypted` will be set to `true`.

storageEncryptionKey

The storage type to be associated with the DB cluster.

storageType

subnetGroup

What subnets to run the RDS instances in.

Must be at least 2 subnets in two different AZs.

Where to place the instances within the VPC.

vpcSubnets

The instance to use for the cluster writer.

writer

A database cluster restored from a snapshot.

DatabaseClusterFromSnapshot

The identifier for the DB instance snapshot or DB cluster snapshot to restore from.

You can use either the name or the Amazon Resource Name (ARN) to specify a DB cluster snapshot.
However, you can use only the ARN to specify a DB instance snapshot.

snapshotIdentifier

Credentials for the administrative user.

Note - using this prop only works with `Credentials.fromPassword()` with the
username of the snapshot, `Credentials.fromUsername()` with the username and
password of the snapshot or `Credentials.fromSecret()` with a secret containing
the username and password of the snapshot.

Master user credentials.

Note - It is not possible to change the master username for a snapshot;
however, it is possible to provide (or generate) a new password.

snapshotCredentials

Adds the multi user rotation to this instance.

Adds the single user rotation of the master password to this instance.

Grant the given identity connection access to the database.

[disable-awslint:no-grants]

grantConnect

DatabaseInstance

For supported engines, specifies the character set to associate with the DB instance.

characterSetName

Indicates whether the DB instance is encrypted.

The KMS key that's used to encrypt the DB instance.

The allocated storage size, specified in gibibytes (GiB).

allocatedStorage

allowMajorVersionUpgrade

databaseName

The name of the compute and memory capacity for the instance.

instanceType

licenseModel

The parameters in the DBParameterGroup to create automatically.

You can only specify parameterGroup or parameters but not both.
You need to use a versioned engine to auto-generate a DBParameterGroup.

The time zone of the instance.

This is currently supported only by Microsoft Sql Server.

timezone

The VPC network where the DB subnet group should be created.

Specifies whether changes to the DB instance and any pending modifications are applied immediately, regardless of the `preferredMaintenanceWindow` setting.

If set to `false`, changes are applied during the next maintenance window.

Until RDS applies the changes, the DB instance remains in a drift state.
As a result, the configuration doesn't fully reflect the requested modifications and temporarily diverges from the intended state.

This property also determines whether the DB instance reboots when a static parameter is modified in the associated DB parameter group.

applyImmediately

Indicates that minor engine upgrades are applied automatically to the DB instance during the maintenance window.

The name of the Availability Zone where the DB instance will be located.

availabilityZone

The number of days during which automatic DB snapshots are retained.

Set to zero to disable backups.
When creating a read replica, you must enable automatic backups on the source
database instance by setting the backup retention to a value other than zero.

backupRetention

The identifier of the CA certificate for this DB instance.

Specifying or updating this property triggers a reboot.

For RDS DB engines:

caCertificate

Indicates whether to copy all of the user-defined tags from the DB instance to snapshots of the DB instance.

Indicates whether automated backups should be deleted or retained when you delete a DB instance.

Indicates whether the DB instance should have deletion protection enabled.

The Active Directory directory ID to create the DB instance in.

The IAM role to be used when making API calls to the Directory Service.

The role needs the AWS-managed policy
AmazonRDSDirectoryServiceAccess or equivalent.

Whether to enable Performance Insights for the DB instance.

The life cycle type for this DB instance.

This setting applies only to RDS for MySQL and RDS for PostgreSQL.

A name for the DB instance.

If you specify a name, AWS CloudFormation
converts it to lowercase.

instanceIdentifier

The number of I/O operations per second (IOPS) that the database provisions.

The value must be equal to or greater than 1000.

iops

Upper limit to which RDS can scale the storage in GiB(Gibibyte).

maxAllocatedStorage

The interval, in seconds, between points when Amazon RDS collects enhanced monitoring metrics for the DB instance.

Role that will be used to manage DB instance monitoring.

Specifies if the database instance is a multiple Availability Zone deployment.

multiAz

The option group to associate with the instance.

optionGroup

The DB parameter group to associate with the instance.

The daily time range during which automated backups are performed.

Constraints:
- Must be in the format `hh24:mi-hh24:mi`.
- Must be in Universal Coordinated Time (UTC).
- Must not conflict with the preferred maintenance window.
- Must be at least 30 minutes.

preferredBackupWindow

The weekly time range (in UTC) during which system maintenance can occur.

Format: `ddd:hh24:mi-ddd:hh24:mi`
Constraint: Minimum 30-minute window

The number of CPU cores and the number of threads per core.

processorFeatures

Indicates whether the DB instance is an internet-facing instance.

If not specified,
the instance's vpcSubnets will be used to determine if the instance is internet-facing
or not.

publiclyAccessible

The CloudFormation policy to apply when the instance is removed from the stack or replaced during an update.

S3 buckets that you want to load data into.

This property must not be used if `s3ExportRole` is used.

For Microsoft SQL Server:

Role that will be associated with this DB instance to enable S3 export.

This property must not be used if `s3ExportBuckets` is used.

For Microsoft SQL Server:

S3 buckets that you want to load data from.

This feature is only supported by the Microsoft SQL Server, Oracle, and PostgreSQL engines.

This property must not be used if `s3ImportRole` is used.

For Microsoft SQL Server:

Role that will be associated with this DB instance to enable S3 import.

This feature is only supported by the Microsoft SQL Server, Oracle, and PostgreSQL engines.

This property must not be used if `s3ImportBuckets` is used.

For Microsoft SQL Server:

The security groups to assign to the DB instance.

The storage throughput, specified in mebibytes per second (MiBps).

Only applicable for GP3.

storageThroughput

The storage type to associate with the DB instance.

Storage types supported are gp2, gp3, io1, io2, and standard.

The type of subnets to add to the created DB subnet group.

A database instance restored from a snapshot.

DatabaseInstanceFromSnapshot

The identifier for the Multi-AZ DB cluster snapshot to restore from.

For more information on Multi-AZ DB clusters, see [Multi-AZ DB cluster deployments](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/multi-az-db-clusters-concepts.html) in the *Amazon RDS User Guide* .

Constraints:

- Can't be specified when `snapshotIdentifier` is specified.
- Must be specified when `snapshotIdentifier` isn't specified.
- If you are restoring from a shared manual Multi-AZ DB cluster snapshot, the `clusterSnapshotIdentifier` must be the ARN of the shared snapshot.
- Can't be the identifier of an Aurora DB cluster snapshot.

clusterSnapshotIdentifier

The name or Amazon Resource Name (ARN) of the DB snapshot that's used to restore the DB instance.

If you're restoring from a shared manual DB
snapshot, you must specify the ARN of the snapshot.
Constraints:

- Can't be specified when `clusterSnapshotIdentifier` is specified.
- Must be specified when `clusterSnapshotIdentifier` isn't specified.

DatabaseInstanceReadReplica

The name of the compute and memory capacity classes.

The source database instance.

Each DB instance can have a limited number of read replicas. For more
information, see https://docs.aws.amazon.com/AmazonRDS/latest/DeveloperGuide/USER_ReadRepl.html.

sourceDatabaseInstance

addEndpoint

Renders the secret attachment target specifications.

asSecretAttachmentTarget

DatabaseProxy

proxyTarget

The duration for a proxy to wait for a connection to become available in the connection pool.

Only applies when the proxy has opened its maximum number of connections and all connections are busy with client
sessions.

Value must be between 1 second and 1 hour, or `Duration.seconds(0)` to represent unlimited.

borrowTimeout

Specifies the details of authentication used by a proxy to log in as a specific database user.

Amazon RDS

L2 Constructs13

DatabaseCluster

DatabaseClusterFromSnapshot

DatabaseInstance

DatabaseInstanceFromSnapshot

DatabaseInstanceReadReplica

DatabaseProxy

DatabaseProxyEndpoint

DatabaseSecret

OptionGroup

ParameterGroup

ServerlessCluster

ServerlessClusterFromSnapshot

SubnetGroup

L1 Constructs16

CfnCustomDBEngineVersion

CfnDBCluster

CfnDBClusterParameterGroup

CfnDBInstance

CfnDBParameterGroup

CfnDBProxy

CfnDBProxyEndpoint

CfnDBProxyTargetGroup

CfnDBSecurityGroup

CfnDBSecurityGroupIngress

CfnDBShardGroup

CfnDBSubnetGroup

CfnEventSubscription

CfnGlobalCluster

CfnIntegration

CfnOptionGroup

Get the Amazon RDS Cheat Sheet

Quick Facts

Related Links

More Amazon RDS deep dives