AWS CDK合成RDS Postgres栈失败：密钥未配置自动轮换问题排查

问题 #

创建Postgres RDS实例时，尝试配置单用户密钥轮换但CDK栈合成失败，报错信息如下：
[Error at /usecase-1-stack/test-uc1-pgdb/Secret/Resource] AwsSolutions-SMG4: The secret does not have automatic rotation scheduled. AWS Secrets Manager can be configured to automatically rotate the secret for a secured service or database.

现有CDK代码：

from aws_cdk import aws_rds as rds
from aws_cdk import aws_secretsmanager as sm
from aws_cdk import aws_ec2 as ec2

curated_rds = rds.DatabaseInstance(
    self,
    f"{env_id}-uc1-pgdb", 
    database_name=curated_db_name,
    engine=rds.DatabaseInstanceEngine.postgres(
        version=rds.PostgresEngineVersion.VER_14_10
    ),
    port=curated_db_port,
    instance_type=ec2.InstanceType.of(
        ec2.InstanceClass.STANDARD5, ec2.InstanceSize.LARGE
    ),
    credentials=rds.Credentials.from_generated_secret(
        "admin",
        encryption_key=data_key,
        secret_name=f"{env_id}-uc1-pgdb-admin",
    ),
    vpc=data_vpc,
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PRIVATE_ISOLATED
    ),
    security_groups=[curated_rds_security_group],
    storage_encrypted=True,
    storage_encryption_key=data_key,
    auto_minor_version_upgrade=True,
    deletion_protection=True,
    multi_az=True,
    publicly_accessible=False,
    enable_performance_insights=True,
)


# curated_rds.add_rotation_single_user(automatically_after=Duration.days(30))
curated_rds.secret.add_rotation_schedule("RotationSchedule",  hosted_rotation=sm.HostedRotation.postgre_sql_single_user(), automatically_after=Duration.days(7))

正确配置密钥轮换的方案 #

核心要点 #

• 优先用RDS内置轮换方法：add_rotation_single_user()会自动处理所有依赖配置，包括Secrets Manager轮换计划、IAM权限、Lambda的VPC访问设置，无需手动配置Secret的轮换计划。
• 确保轮换Lambda能访问RDS：如果RDS部署在私有子网，必须给轮换Lambda指定相同VPC和安全组，否则无法连接数据库完成密钥更新。
• 补全必要导入：代码中必须导入Duration类，否则时间配置会报错。

修正后的代码 #

from aws_cdk import aws_rds as rds
from aws_cdk import aws_secretsmanager as sm
from aws_cdk import aws_ec2 as ec2
from aws_cdk import Duration  # 必须导入Duration类

curated_rds = rds.DatabaseInstance(
    self,
    f"{env_id}-uc1-pgdb", 
    database_name=curated_db_name,
    engine=rds.DatabaseInstanceEngine.postgres(
        version=rds.PostgresEngineVersion.VER_14_10
    ),
    port=curated_db_port,
    instance_type=ec2.InstanceType.of(
        ec2.InstanceClass.STANDARD5, ec2.InstanceSize.LARGE
    ),
    credentials=rds.Credentials.from_generated_secret(
        "admin",
        encryption_key=data_key,
        secret_name=f"{env_id}-uc1-pgdb-admin",
    ),
    vpc=data_vpc,
    vpc_subnets=ec2.SubnetSelection(
        subnet_type=ec2.SubnetType.PRIVATE_ISOLATED
    ),
    security_groups=[curated_rds_security_group],
    storage_encrypted=True,
    storage_encryption_key=data_key,
    auto_minor_version_upgrade=True,
    deletion_protection=True,
    multi_az=True,
    publicly_accessible=False,
    enable_performance_insights=True,
)

# 使用RDS内置单用户轮换方法，自动配置所有必要资源
curated_rds.add_rotation_single_user(
    automatically_after=Duration.days(30),
    # 指定VPC和安全组，确保轮换Lambda能访问私有子网中的RDS
    vpc=data_vpc,
    security_groups=[curated_rds_security_group]
)

手动配置Secret轮换的注意事项（不推荐） #

如果一定要用add_rotation_schedule()方法，必须给托管轮换Lambda配置VPC访问权限，否则无法连接RDS：

curated_rds.secret.add_rotation_schedule(
    "RotationSchedule",
    hosted_rotation=sm.HostedRotation.postgre_sql_single_user(
        vpc=data_vpc,
        security_groups=[curated_rds_security_group]
    ),
    automatically_after=Duration.days(7)
)

内容的提问来源于stack exchange，提问作者Francisco