‫So, let's talk about Secrets Manager
‫and its integration with CloudFormation.
‫So in the case of RDS and Aurora,
‫if we specify a CloudFormation template that looks like this
‫and in it, we specify the Manage Master user password
‫bullion to be true, then automatically a secret
‫is going to be created by RDS.
‫How does that work?
‫Where your CloudFormation template, of course,
‫we have defined an RDS or a database,
‫therefore it's going to be created
‫and then RDS will create a secret in Secrets Manager
‫and generate a password for your admin.
‫What's going to happen is that the benefit of this
‫is that the secret is going to be entirely managed by RDS,
‫including the rotation mechanism.
‫So it's a shorthand to make it more simple for you.
‫In that case, if you wanted to have a reference
‫to that secret,
‫what you can do is that you can get the secret ARN
‫out of the Get Attribute function on my cluster,
‫as you can see on the bottom right.
‫So that's the first way of doing things.
‫The second way is to actually define the secret
‫in Secrets Manager within CloudFormation
‫and then you use a dynamic reference.
‫So if we wanted to, again, create an RDS database
‫but this time we wanted to manage the secret ourself,
‫how would we do?
‫Well, the first thing to do would be to generate a secret
‫as part of your resources
‫and you define what it is and the password length and so on.
‫Then you reference the secret in your RDS database instance
‫for the master username and master user password
‫and this is using a dynamic reference.
‫As you can see, the syntax right here with the resolve
‫type of syntax is using a dynamic reference
‫and then we link the secret to the RDS database instance
‫by doing what's called
‫a Secret RDS Database Instance Attachment
‫so that we know and we tell AWS
‫that this secret is tightly linked with our RDS database.
‫Okay, so that's it for this lecture
‫I hope you liked it and I will see you in the next lecture.