aws_docdbelastic : When secret is updated, we have to manually reassign it to docDB

[Exter-dg]

Describe the bug

If docDb uses a secret manager for adminUserPassword and if the secret is updated, it doesn't automatically reflect in document db. It has to be manually reassigned from console.

Expected Behavior

Whenever secret is updated, docDb should automatically be updated

Current Behavior

Whenever secret is updated, docDb password is not updated

Reproduction Steps

Create docDB with below code and then update secret (by changing exclude characters)

import {
  aws_docdbelastic as docdbelastic,
  aws_secretsmanager as secretsmanager
} from 'aws-cdk-lib';

/**
 * Create a new secret
 * https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.Secret.html
 */
const secret = new secretsmanager.Secret(this, 'Secret', {
  description: SecretDescription,
  secretName: SecretName,
  generateSecretString: {
    excludeCharacters: '/@":+&$?#[]',
  }
});

/**
 * Create a new Document DB Elastic Cluster
 * https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_docdbelastic.CfnCluster.html
 */
new docdbelastic.CfnCluster(this, 'elasticDocDbCluster', {
  adminUserName: AdminUserName,
  adminUserPassword: secret.secretArn,
  authType: "SECRET_ARN",
  clusterName: "ClusterName",
  shardCapacity: ShardCapacity,
  shardCount: ShardCount,
  subnetIds: dataSubnets,
  vpcSecurityGroupIds: [securityGroup.securityGroupId],
});

I believe this will also cause an issue similarly for Secret rotation.

Possible Solution

Looks like document db is still using the old version of the secret. Is this expected?

Additional Information/Context

No response

CDK CLI Version

2.123.0

Framework Version

No response

Node.js Version

v16.20.2

OS

Linux/UNIX

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

I guess this is because docdb does not have native secret rotation support but I probably need to check the doc for the latest status. If it does not support then yes we need to manually update it after modify the value in secret manager. But this is beyond the scope of AWS CDK.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.