RDS: add support for DatabaseProxy secret attachment

[toptaljj]

We have a situation where lambda code uses one of four secrets:

• mysql
• mysql-ro (read only)
• proxy-mysql
• proxy-msyql-ro (also read only but using the databaseproxy)

Please understand that that lambda code uses the following keys from the secrets:

• host
• port
• username
• password
• database

Consider this code snippet from our mysql cdk stack:

      // only showing the second of the two "BEFORE CDK PROXY" secrets
      this.mysqlRoSecret = new ssm.Secret(this, 'secret-mysql-ro', {
        secretName: `mysql-ro`,
        generateSecretString: {
          secretStringTemplate: JSON.stringify({
            host: this.clusterEndpoint,
            port: '3306',
            database: `my_data`,
            username: `ro_user`,
          }),
          generateStringKey: 'password',
        },
      })

      const mysqlProxy = new rds.DatabaseProxy(this, 'mysql-proxy', {
        proxyTarget: rds.ProxyTarget.fromCluster(this.cluster),
        secrets: [this.mysqlSecret, this.mysqlRoSecret],    // the "BEFORE" secrets are supported by CDK
        vpc: props.vpc,
      })

      // now that we have the proxy endpoint we can create the "AFTER CDK PROXY" secret(s)
      this.mysqlProxySecret = new ssm.Secret(this, 'secret-mysql-proxy', {
        generateSecretString: {
          secretStringTemplate: JSON.stringify({
            host: mysqlProxy.endpoint,
            port: '3306',
            database: `my_data`,
            username: `proxy_user`,
          }),
          generateStringKey: 'password',
        },
      })
      this.mysqlProxySecret.grantRead(proxyRole)

The next line of CDK should attach this AFTER secret to the proxy.
I opened a support ticket but it was determined that no such method exists in CDK.
There are ways to attach to an RDS instance or cluster, but not to a proxy.

We did try this actually:

    this.mysqlProxySecret.attach(mysqlProxy)

But it does not attach the AFTER secret(s) to the proxy.

One other way to handle this would be to create all secrets before the proxy but just leave out the hostname key in the proxy secrets. Alas, there apparently isn't a way to update the secret(s).

Is this something that should be supported?

[pahud]

The attach() method requires ISecretAttachmentTarget as its target and DatabaseProxy doesn't implement that interface. I probably need more investigation but it seems to be technically possible if we submit a PR for DatabaseProxy to implement ISecretAttachmentTarget. @peterwoodworth wdyt? @toptaljj are you interested to draft a PR for that?

[peterwoodworth]

This would require some testing I think. CloudFormation docs seem to indicate you can't create a SecretTargetAttachment using a DbProxy. However, CloudFormation docs can sometimes be unreliable so we can't rule it out unless we test it. If you can do this, then we should be able to support this feature I think

[toptaljj]

@peterwoodworth i'm not sure to start that journey at this time. for now, we have a workaround.

until cdk can provide a solution to this this chicken-and-egg issue, we're predicting the endpoint url and creating the secret first:

  const app = new cdk.App()
  const env = { account: '<account id>', region: '<aws region>' }
  const aws_svc_hashes = { rds: '<account+service specific hash found by creating an endpoint>'

  new PipelineStack(app, 'mysql-cdk-pipeline', {
    env,
    otherPropsToPass: {
      hash: aws_svc_hashes.rds,
    },
  })

     // TODO: when cdk has a way to either
     // 1. update the secrets with the proxy url for key `host` or
     // 2. update the proxy attribute `secrets` later in the stack
     // then we should NOT use this less than ideal kludge

     const predictedProxyUrl = `${props.stage}-mysql-proxy.proxy-${props.hash}.${props.env?.region}.rds.amazonaws.com`
  
     this.mysqlProxySecret = new ssm.Secret(this, 'secret-mysql-proxy', {
      generateSecretString: {
         secretStringTemplate: JSON.stringify({
           host: predictedProxyUrl,