RDS: Allow enabling deletion protection for an RDS cluster

[blimmer]

As of now, it doesn't appear that I can enable "Deletion Protection" for my RDS cluster via CDK.

There is an option provided in the DatabaseInstanceNewProps interface, but that's not exposed at the cluster level.

I am able to turn this on via the console:

and it also is a supported value in the AWS::RDS::DBCluster CloudFormation template according to the docs.

Use Case

I would like to prevent my production database cluster from being accidentally deleted due to a mistake in our CDK definitions. If a developer's intention is truly to delete the cluster, I'd like to require them to deploy a change disabling deletion protection, and then proceed with their delete.

Proposed Solution

I propose that we add an optional deletionProtection? boolean attribute to DatabaseClusterProps. To match the default behavior of the CloudFormation template (and to provide better backwards compatibility), this property would be false by default (not specified in the CloudFormation template output at all). If the user specifies true, we would emit DeletionProtection: true in the produced CloudFormation template.

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[blimmer]

For those looking for a workaround in the meantime, you can set this parameter in CDK by accessing the CFN doc:

const cluster = new DatabaseCluster(/* params */);
const cfn = cluster.node.defaultChild as CfnDBCluster;
cfn.deletionProtection = true;

[wswoodruff]

Does deletionProtection default to true for you now? It does when I create a DatabaseInstance — discussion on secure defaults on this thread #5282

[skinny85]

Does deletionProtection default to true for you now? It does when I create a DatabaseInstance — discussion on secure defaults on this thread #5282

It does default to true for Instance. It's not currently surfaced for Cluster, and thus defaults to false for it.