Creating a Public MySQL RDS instance with Secrets Manager and CDK

7 min readMar 7, 2024

Introduction

In this article we will show how to create a Public MySQL RDS instance with Secrets Manager in CDK.

We will be using AWS CDK in Java to create this project but similar steps can be done in the language of your choice as well. The CDK code presented can be leveraged for other languages as the steps should be very similar.

Placing an RDS instance in a Public Subnet can still be protected by the Secrets Manager authentication and also the database security group can be updated to only allow access to certain IP addresses. If one places the RDS instance in a private subnet, it is likely that this will require a bastion host or some other mechanism to gain access to the database.

Business Case

The leprechauns love gold and to hide their treasure(sometimes at the end of rainbows). The want to build a treasure database to record their treasures and locations. This way they will not lose their treasure and can find it when they need it!

Architecture Diagram

The above represents what will be deployed in this article. A custom VPC will be deployed with a public subnet and private subnet across 3 availability zones.

We are deploying a MySQL instance within one public subnet. It will be configured to use Secrets Manager for it’s credentials. Additionally a VPC Endpoint will be deployed so that Lambdas can reach the Secrets Manager credentials to authenticate to the RDS instance. An article will be written to show how to deploy a Spring Boot Application on AWS Lambda once we have deployed the above configuration.

Building the CDK Project

Validate the Prerequisites (See the Appendix)

2. Create the CDK Project

cd c:\projects
mkdir javacdk-public_mysql
cd javacdk-public_mysql
cdk init app --language java

2. Open the project up in Eclipse

File-> Open Projects from File System

Your CDK Project should have the following structure based on the code found at https://github.com/collin-smith/javacdk-public_mysql. The key class to update is JavacdkPublicMysqlStack.java which can be found in the repo just listed.

You should be able to build this by right-clicking the project in Project explorer/Run As/Maven Build

It should then successfully build as follows:

Make sure you have your AWS environment set up properly to deploy to the correct account, region etc.

cd c:\projects\javacdk-public_mysql
cdk bootstrap
cdk synth
cdk deploy

After deploying the CDK app with “cdk deploy” you will see something like the following:

A look in the AWS Console

We can see that a MySQL RDS instance has been created as follows:

Take note of the endpoint above as you will need that for when you want to log into the database with MySQL Workbench.

We can also see that a Secrets Manager Secret was created that holds the credentials to the RDS instance.

Accessing the RDS instance with MySQL WorkBench

Since we have allowed public access to the MySQL RDS instance we can log in from our desktops(See code block below). One can create more security for the RDS instance by placing it in a Private subnet but we will look at that in a later blog. In this situation, the endpoint can be protected by configuring the security group to certain IPS if required. Additionally, the Secret offers a password that this pretty hard to guess.

databaseSecurityGroup.addIngressRule(Peer.anyIpv4(), Port.tcp(3306), "MySQL from anywhere");

Testing the RDS instance with MySQL WorkBench

Get the RDS endpoint information from the AWS Console

2. Retrieve the username and password from Secrets Manager

2. Open MySQL WorkBench, press Database -> Connect to Database . Enter the RDS endpoint in the hostname and enter in the username and password(Store in Vault …)

Let’s now create a database called leprechaun typing the command into the Query Tool and pressing the execute button (Lightning bolt)

CREATE DATABASE leprechaun;

We should then select the newly created database by executing the “USE leprechaun;” command

Now that we have the Query Tool open we can create our first table by executing the following script in the Query Tool

CREATE TABLE TREASURE
(
ID INT NOT NULL AUTO_INCREMENT PRIMARY KEY,
DESCRIPTION VARCHAR(50),
LOCATION VARCHAR(600),
CREATED DATETIME
);

We should be able to insert records by executing the following command in the Query Tool

INSERT INTO TREASURE (DESCRIPTION, LOCATION, CREATED) VALUES ('POT OF GOLD', 'UNDER THE RAINBOW', NOW());

We should be able to query records by executing the following command in the Query Tool

SELECT * FROM TREASURE;

Now you have successfully created an RDS instance that you created with CDK and have created a database with a table.

If you wanted to create a spring boot lambda application to interact with this database please continue on to Creating a Spring Boot Java 21 application with a Public MySQL RDS

Tidying up

Once you have finished with your MySQL RDS instance please execute a “cdk destroy” to remove the resources.

cdk destroy

Conclusion

In this article, you have seen how you can create a Public MySQL RDS Instance with Secrets Manager with CDK. This was done using Java but the same principle can be done for any of the languages supported by CDK. With a Custom VPC you can create the right networking to help support the AWS workload that you want to create rather than rely on the default VPC.

As previously mentioned you can create a Spring Boot application to interact with this database at Creating a Spring Boot Java 21 application with a Public MySQL RDS .

Now if you want to read on to other related to the concept of Java 21 Spring Boot with database implementations, please consider the following articles as well:

Appendix

Prerequisites

Access to an AWS Account

Java 21 — The latest Java version to date can be downloaded from here

Confirm that you have the right version in your command line