11Description : " AWS CloudFormation Sample Template DocumentDB_Quick_Create: Sample template showing how to create a DocumentDB DB cluster and DB instance. **WARNING** This template creates an Amazon DocumentDB resources and you will be billed for the AWS resources used if you create a stack from this template."
2-
2+ Transform : AWS::SecretsManager-2020-07-23
33Parameters :
44 DBClusterName :
55 Default : " MyCluster1"
@@ -18,24 +18,7 @@ Parameters:
1818 MaxLength : " 64"
1919 AllowedPattern : " [a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*"
2020 ConstraintDescription : " Must begin with a letter and contain only alphanumeric characters."
21-
22- MasterUser :
23- NoEcho : " true"
24- Description : " The database admin account username"
25- Type : " String"
26- MinLength : " 1"
27- MaxLength : " 16"
28- AllowedPattern : " [a-zA-Z][a-zA-Z0-9]*"
29- ConstraintDescription : " Must begin with a letter and contain only alphanumeric characters."
30-
31- MasterPassword :
32- NoEcho : " true"
33- Description : " The database admin account password"
34- Type : " String"
35- MinLength : " 8"
36- MaxLength : " 100"
37- AllowedPattern : " [a-zA-Z0-9]{8,100}"
38- ConstraintDescription : " must contain only alphanumeric characters."
21+
3922 AccessFromCidr :
4023 Description : Lockdown SSH and HTTPS access (default can be accessed from anywhere)
4124 Type : String
@@ -55,13 +38,19 @@ Parameters:
5538 Type : AWS::EC2::Subnet::Id
5639 Subnet3 :
5740 Description : The VPC subnet in which the EC2 instance
58- Type : AWS::EC2::Subnet::Id
41+ Type : AWS::EC2::Subnet::Id
5942 SecurityGroupName :
6043 Description : Lockdown SSH and HTTPS access (default can be accessed from anywhere)
6144 Type : String
45+ VpceSecurityGroupName :
46+ Description : Lockdown SSH and HTTPS access
47+ Type : String
6248 DocDBSubnetGroupName :
6349 Description : Subnet Group Name
6450 Type : String
51+ DocDBSecretName :
52+ Description : Secret Name
53+ Type : String
6554 DBInstanceClass :
6655 Description : " Instance class. Please refer to: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-classes-by-region"
6756 Type : " String"
@@ -81,7 +70,7 @@ Resources:
8170 Properties :
8271 GroupDescription : Amazon DocumentDB Security Group
8372 GroupName : !Ref SecurityGroupName
84- VpcId : !Ref VPC
73+ VpcId : !Ref VPC
8574 SecurityGroupIngress :
8675 - IpProtocol : tcp
8776 CidrIp : !Ref AccessFromCidr
@@ -90,6 +79,47 @@ Resources:
9079 Tags :
9180 - Key : Name
9281 Value : !Ref SecurityGroupName
82+ VpcendpointSecurityGroup :
83+ Type : AWS::EC2::SecurityGroup
84+ Properties :
85+ GroupDescription : vpc endpoint Security Group
86+ GroupName : !Ref VpceSecurityGroupName
87+ VpcId : !Ref VPC
88+ SecurityGroupIngress :
89+ - IpProtocol : tcp
90+ FromPort : " 0"
91+ ToPort : " 65535"
92+ CidrIp : " 0.0.0.0/0"
93+ Tags :
94+ - Key : Name
95+ Value : !Ref VpceSecurityGroupName
96+ SecretsManagerVPCEndpoint :
97+ Type : AWS::EC2::VPCEndpoint
98+ Properties :
99+ SubnetIds :
100+ - Ref : Subnet1
101+ - Ref : Subnet2
102+ SecurityGroupIds :
103+ - !GetAtt VpcendpointSecurityGroup.GroupId
104+ VpcEndpointType : Interface
105+ ServiceName :
106+ Fn::Sub : com.amazonaws.${AWS::Region}.secretsmanager
107+ PrivateDnsEnabled : true
108+ VpcId :
109+ Ref : VPC
110+ DocDBClusterRotationSecret :
111+ Type : ' AWS::SecretsManager::Secret'
112+ Properties :
113+ Name : !Ref DocDBSecretName
114+ Description : secrets for Documentdb
115+ GenerateSecretString :
116+ SecretStringTemplate : ' {"username": "rguser"}'
117+ GenerateStringKey : " password"
118+ PasswordLength : 16
119+ ExcludeCharacters : ' "@/\'
120+ Tags :
121+ - Key : Name
122+ Value : /rl/cc/app/server/config/test
93123 DocumentDBSubnetGroup :
94124 Type : AWS::DocDB::DBSubnetGroup
95125 Properties :
@@ -107,8 +137,9 @@ Resources:
107137 DeletionPolicy : Delete
108138 Properties :
109139 DBClusterIdentifier : !Ref DBClusterName
110- MasterUsername : !Ref MasterUser
111- MasterUserPassword : !Ref MasterPassword
140+ MasterUsername : rguser
141+ MasterUserPassword :
142+ Fn::Sub : " {{resolve:secretsmanager:${DocDBClusterRotationSecret}::password}}"
112143 EngineVersion : 3.6.0
113144 DBSubnetGroupName : !Ref DocumentDBSubnetGroup
114145 VpcSecurityGroupIds :
@@ -120,6 +151,33 @@ Resources:
120151 DBInstanceIdentifier : !Ref DBInstanceName
121152 DBInstanceClass : !Ref DBInstanceClass
122153 DependsOn : DBCluster
154+ SecretDocDBClusterAttachment :
155+ Type : AWS::SecretsManager::SecretTargetAttachment
156+ Properties :
157+ SecretId :
158+ Ref : DocDBClusterRotationSecret
159+ TargetId :
160+ Ref : DBCluster
161+ TargetType : AWS::DocDB::DBCluster
162+ SecretRotationSchedule :
163+ Type : AWS::SecretsManager::RotationSchedule
164+ DependsOn : SecretDocDBClusterAttachment
165+ Properties :
166+ SecretId :
167+ Ref : DocDBClusterRotationSecret
168+ HostedRotationLambda :
169+ RotationType : MongoDBSingleUser
170+ RotationLambdaName : MongoDBSingleUser
171+ VpcSecurityGroupIds :
172+ Ref : DocumentDBSecurityGroup
173+ VpcSubnetIds :
174+ Fn::Join :
175+ - " ,"
176+ - - Ref : Subnet1
177+ - Ref : Subnet2
178+ RotationRules :
179+ Duration : 6h
180+ ScheduleExpression : ' rate(30 days)'
123181
124182Outputs :
125183 ClusterId :
0 commit comments