RDS Managed Master Secret Without Customer-Managed Key

What this rule checks

Detects RDS instances/clusters using the native Secrets Manager integration (ManageMasterUserPassword) whose managed master-user secret is encrypted with the AWS-managed aws/secretsmanager key instead of a customer-managed KMS key.

How to fix it

1. 1Set MasterUserSecret.KmsKeyId to a customer-managed KMS key
2. 2Apply a key policy that scopes who can decrypt the database credential secret
3. 3Enable key rotation and CloudTrail auditing on the customer-managed key

import { Stack, App } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as rds from 'aws-cdk-lib/aws-rds';

new rds.CfnDBInstance(this, 'Db', {
  engine: 'postgres',
  dbInstanceClass: 'db.t3.micro',
  allocatedStorage: '20',
  manageMasterUserPassword: true,
});

import { Stack, App } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as rds from 'aws-cdk-lib/aws-rds';
import * as kms from 'aws-cdk-lib/aws-kms';

const key = new kms.Key(this, 'SecretKey');
new rds.CfnDBInstance(this, 'Db', {
  engine: 'postgres',
  dbInstanceClass: 'db.t3.micro',
  allocatedStorage: '20',
  manageMasterUserPassword: true,
  masterUserSecret: { kmsKeyId: key.keyArn },
});

CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.

Affected resource types

Intentional? Suppress this finding

Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss rds-managed-secret-without-cmk and the reason is kept in the report, not silently hidden.

In .cdk-insights.json:

{
  "ignoreRules": [
    { "id": "rds-managed-secret-without-cmk", "reason": "Why this is intentional" }
  ]
}

Or inline in your CDK code:

Validations.of(scope).acknowledge({
  id: 'cdk-insights::rds-managed-secret-without-cmk',
  reason: 'Why this is intentional',
});

Use the rule ID rds-managed-secret-without-cmk shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →

More RDS rules