aws · blimmer · Dec 31, 2024 · Dec 31, 2024 · Dec 31, 2024 · Dec 31, 2024
diff --git a/.../@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.graphql-rds-serverlessv2.ts b/.../@aws-cdk-testing/framework-integ/test/aws-appsync/test/integ.graphql-rds-serverlessv2.ts
@@ -35,6 +35,8 @@ class TestStack extends cdk.Stack {
       vpc,
       credentials: rds.Credentials.fromGeneratedSecret('clusteradmin', credentialsBaseOptions),
       defaultDatabaseName: 'integdb',
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
     });
 
     const secret = secretmanager.Secret.fromSecretNameV2(this, 'Secret', 'integ-secretName');

diff --git a/...k-testing/framework-integ/test/aws-rds/test/integ.cluster-data-api-to-imported-cluster.ts b/...k-testing/framework-integ/test/aws-rds/test/integ.cluster-data-api-to-imported-cluster.ts
@@ -20,6 +20,8 @@ const cluster = new rds.DatabaseCluster(stack, 'Database', {
   writer: rds.ClusterInstance.serverlessV2('writerInstance'),
   vpc,
   enableDataApi: true,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 const importedCluster = rds.DatabaseCluster.fromDatabaseClusterAttributes(stack, 'ImportedCluster', {

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-data-api.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-data-api.ts
@@ -20,6 +20,8 @@ const cluster = new rds.DatabaseCluster(stack, 'Database', {
   writer: rds.ClusterInstance.serverlessV2('writerInstance'),
   vpc,
   enableDataApi: true,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 cluster.grantDataApiAccess(fucntion);

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-dual.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-dual.ts
@@ -32,6 +32,8 @@ new rds.DatabaseCluster(stack, 'DualstackCluster', {
   vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
   vpc,
   networkType: rds.NetworkType.DUAL,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
 });
 
@@ -49,6 +51,8 @@ new rds.DatabaseCluster(stack, 'Ipv4Cluster', {
     }),
   ],
   networkType: rds.NetworkType.IPV4,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
 });
 

diff --git a/...-testing/framework-integ/test/aws-rds/test/integ.cluster-enable-local-write-forwarding.ts b/...-testing/framework-integ/test/aws-rds/test/integ.cluster-enable-local-write-forwarding.ts
@@ -15,6 +15,8 @@ new rds.DatabaseCluster(stack, 'DatabaseCluster', {
     rds.ClusterInstance.serverlessV2('readerInstance1'),
   ],
   vpc,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   enableLocalWriteForwarding: true,
 });
 
@@ -25,6 +27,8 @@ new rds.DatabaseCluster(stack, 'DatabaseClusterPostgresql', {
     rds.ClusterInstance.serverlessV2('readerInstance1'),
   ],
   vpc,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   enableLocalWriteForwarding: true,
 });
 

diff --git a/...s/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-enhanced-monitoring.ts b/...s/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-enhanced-monitoring.ts
@@ -12,6 +12,8 @@ new rds.DatabaseCluster(stack, 'Database', {
   engine: rds.DatabaseClusterEngine.auroraPostgres({ version: rds.AuroraPostgresEngineVersion.VER_16_1 }),
   writer: rds.ClusterInstance.serverlessV2('writerInstance'),
   vpc,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   monitoringInterval: cdk.Duration.seconds(5),
   enableClusterLevelEnhancedMonitoring: true,
 });

diff --git a/...ws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-instance-ca-certificate.ts b/...ws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-instance-ca-certificate.ts
@@ -29,6 +29,8 @@ new DatabaseCluster(stack, 'Database', {
       ...instanceProps,
     }),
   ],
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 new IntegTest(app, 'cdk-rds-cluster-instance-ca-certificate-test', {

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-instance-id.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-instance-id.ts
@@ -21,6 +21,8 @@ new rds.DatabaseCluster(stack, 'Database', {
   readers: [rds.ClusterInstance.provisioned('reader')],
   instanceUpdateBehaviour: rds.InstanceUpdateBehaviour.ROLLING,
   vpc,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 new integ.IntegTest(app, 'instanceIdentifiersTest', {

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-io.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-io.ts
@@ -18,6 +18,8 @@ const cluster = new DatabaseCluster(stack, 'Database', {
     vpc,
   },
   storageType: DBClusterStorageType.AURORA_IOPT1,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 cluster.connections.allowDefaultPortFromAnyIpv4('Open to the world');

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-kerberos.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-kerberos.ts
@@ -37,6 +37,8 @@ new rds.DatabaseCluster(stack, 'Database', {
   vpc,
   domain: activeDirectory.ref,
   domainRole: iamRole,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 new integ.IntegTest(app, 'integ-cluster-kerberos', {

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-limitless.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-limitless.ts
@@ -21,6 +21,8 @@ class TestStack extends cdk.Stack {
       enableClusterLevelEnhancedMonitoring: true,
       storageType: DBClusterStorageType.AURORA_IOPT1,
       cloudwatchLogsExports: ['postgresql'],
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
     });
   }
 }

diff --git a/.../@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-performance-insights.ts b/.../@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-performance-insights.ts
@@ -26,6 +26,8 @@ class TestStack extends cdk.Stack {
       readers: [ClusterInstance.provisioned('reader', {
         instanceType: ec2.InstanceType.of(ec2.InstanceClass.R7G, ec2.InstanceSize.LARGE),
       })],
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
     });
   }
 }

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-public-subnets.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-public-subnets.ts
@@ -37,6 +37,8 @@ export class TestStack extends Stack {
         vpcSubnets: {
           subnetType: SubnetType.PUBLIC,
         },
+        storageEncrypted: false,
+        isStorageLegacyUnencrypted: true,
       }));
   }
 }

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-rotation.lit.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-rotation.lit.ts
@@ -31,6 +31,8 @@ const cluster = new rds.DatabaseCluster(stack, 'Database', {
       ...instanceProps,
     }),
   ],
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 cluster.addRotationSingleUser();
@@ -48,6 +50,8 @@ const clusterWithCustomRotationOptions = new rds.DatabaseCluster(stack, 'CustomR
       ...instanceProps,
     }),
   ],
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 clusterWithCustomRotationOptions.addRotationSingleUser({
   automaticallyAfter: cdk.Duration.days(7),

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-s3.mysql-8.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-s3.mysql-8.ts
@@ -23,6 +23,8 @@ new rds.DatabaseCluster(stack, 'Database', {
   vpc,
   s3ImportBuckets: [importExportBucket],
   s3ExportBuckets: [importExportBucket],
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 new IntegTest(app, 'aws-cdk-rds-s3-mysql-8-integ-test', {

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-s3.postgres.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-s3.postgres.ts
@@ -30,6 +30,8 @@ class PostgresS3TestStack extends cdk.Stack {
       vpc,
       s3ImportBuckets: [importExportBucket],
       s3ExportBuckets: [importExportBucket],
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
     });
   }
 }

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-s3.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-s3.ts
@@ -37,6 +37,8 @@ const cluster = new DatabaseCluster(stack, 'Database', {
   storageEncryptionKey: kmsKey,
   s3ImportBuckets: [importBucket],
   s3ExportBuckets: [exportBucket],
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 cluster.connections.allowDefaultPortFromAnyIpv4('Open to the world');

diff --git a/...s/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-serverless-v2-acu-0.ts b/...s/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-serverless-v2-acu-0.ts
@@ -16,6 +16,8 @@ export class TestStack extends Stack {
       writer: ClusterInstance.serverlessV2('writer'),
       removalPolicy: RemovalPolicy.DESTROY,
       vpc: vpc,
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
     });
   }
 }

diff --git a/...ges/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-serverless-v2-acu.ts b/...ges/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-serverless-v2-acu.ts
@@ -16,6 +16,8 @@ export class TestStack extends Stack {
       writer: ClusterInstance.serverlessV2('writer'),
       removalPolicy: RemovalPolicy.DESTROY,
       vpc: vpc,
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
     });
   }
 }

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-serverless-v2.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-serverless-v2.ts
@@ -17,6 +17,8 @@ class TestCase extends Construct {
       readers: props.readers,
       removalPolicy: RemovalPolicy.DESTROY,
       vpc: props.vpc,
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
     });
     cluster.metricServerlessDatabaseCapacity({
       period: Duration.minutes(10),

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-snapshot.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-snapshot.ts
@@ -31,6 +31,8 @@ class TestStack extends Stack {
         }),
       ],
       vpc,
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
       removalPolicy: RemovalPolicy.DESTROY,
     });
 
@@ -53,6 +55,8 @@ class TestStack extends Stack {
       ],
       vpc,
       removalPolicy: RemovalPolicy.DESTROY,
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
     });
     fromSnapshot.addRotationSingleUser();
   }

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-ca-certificate.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-ca-certificate.ts
@@ -15,6 +15,8 @@ new DatabaseInstance(stack, 'Instance', {
   }),
   instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MICRO),
   vpc,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   caCertificate: CaCertificate.RDS_CA_RSA2048_G1,
 });
 

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-create-grant.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-create-grant.ts
@@ -26,6 +26,8 @@ const instance = new rds.DatabaseInstance(stack, 'Instance', {
   deletionProtection: false,
   publiclyAccessible: false,
   backupRetention: cdk.Duration.days(0),
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 const role = new iam.Role(stack, 'DBRole', {

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-dual.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-dual.ts
@@ -23,6 +23,8 @@ new rds.DatabaseInstance(stack, 'DualstackInstance', {
   multiAz: false,
   publiclyAccessible: false,
   networkType: rds.NetworkType.DUAL,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
 });
 
@@ -35,6 +37,8 @@ new rds.DatabaseInstance(stack, 'Ipv4Instance', {
   multiAz: false,
   publiclyAccessible: false,
   networkType: rds.NetworkType.IPV4,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
 });
 

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-gp3.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-gp3.ts
@@ -16,6 +16,8 @@ class TestStack extends Stack {
       vpc,
       allocatedStorage: 1000,
       storageType: StorageType.GP3,
+      storageEncrypted: false,
+      isStorageLegacyUnencrypted: true,
       removalPolicy: RemovalPolicy.DESTROY,
     });
   }

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-io2.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-io2.ts
@@ -17,6 +17,8 @@ new DatabaseInstance(stack, 'Instance', {
   },
   allocatedStorage: 1000,
   storageType: StorageType.IO2,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: RemovalPolicy.DESTROY,
 });
 

diff --git a/...k-testing/framework-integ/test/aws-rds/test/integ.instance-kerberos-without-domainRole.ts b/...k-testing/framework-integ/test/aws-rds/test/integ.instance-kerberos-without-domainRole.ts
@@ -25,6 +25,8 @@ new rds.DatabaseInstance(stack, 'Database', {
   instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MEDIUM),
   vpc,
   domain: activeDirectory.ref,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 new integ.IntegTest(app, 'integ-instance-kerberos-without-domainRole', {

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-kerberos.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-kerberos.ts
@@ -37,6 +37,8 @@ new rds.DatabaseInstance(stack, 'Database', {
   vpc,
   domain: activeDirectory.ref,
   domainRole: iamRole,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 new integ.IntegTest(app, 'integ-instance-kerberos', {

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-s3-postgres.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-s3-postgres.ts
@@ -15,6 +15,8 @@ new rds.DatabaseInstance(stack, 'Instance', {
   iamAuthentication: true,
   s3ImportBuckets: [new s3.Bucket(stack, 'ImportBucket', { removalPolicy: cdk.RemovalPolicy.DESTROY })],
   s3ExportBuckets: [new s3.Bucket(stack, 'ExportBucket', { removalPolicy: cdk.RemovalPolicy.DESTROY })],
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
 });
 

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-s3.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-s3.ts
@@ -17,6 +17,8 @@ new DatabaseInstance(stack, 'Database', {
   licenseModel: LicenseModel.LICENSE_INCLUDED,
   s3ImportBuckets: [importBucket],
   s3ExportBuckets: [exportBucket],
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
 });
 

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-with-metric.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-with-metric.ts
@@ -19,6 +19,8 @@ const instance = new rds.DatabaseInstance(stack, 'Instance', {
   iamAuthentication: true,
   cloudwatchLogsExports: ['postgresql'],
   cloudwatchLogsRetention: logs.RetentionDays.THREE_MONTHS,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
 });
 

diff --git a/...@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-with-parameter-group.ts b/...@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.instance-with-parameter-group.ts
@@ -24,6 +24,8 @@ new rds.DatabaseInstance(stack, 'Instance', {
   publiclyAccessible: true,
   iamAuthentication: true,
   parameterGroup,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: cdk.RemovalPolicy.DESTROY,
 });
 

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.proxy-mariadb.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.proxy-mariadb.ts
@@ -21,6 +21,8 @@ const mariaDBInstance = new rds.DatabaseInstance(stack, 'mariaDBInstance', {
     excludeCharacters: '"@/\\',
   }),
   vpc,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: RemovalPolicy.DESTROY,
 });
 

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.proxy-sql-server.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.proxy-sql-server.ts
@@ -23,6 +23,8 @@ const dbInstance = new rds.DatabaseInstance(stack, 'SqlServerDbInstance', {
   }),
   vpc,
   licenseModel: LicenseModel.LICENSE_INCLUDED,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: RemovalPolicy.DESTROY,
 });
 

diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.proxy.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.proxy.ts
@@ -21,6 +21,8 @@ const dbInstance = new rds.DatabaseInstance(stack, 'dbInstance', {
     excludeCharacters: '"@/\\',
   }),
   vpc,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
   removalPolicy: RemovalPolicy.DESTROY,
 });
 
@@ -38,6 +40,8 @@ const cluster = new rds.DatabaseCluster(stack, 'dbCluster', {
     version: rds.AuroraPostgresEngineVersion.VER_14_5,
   }),
   instanceProps: { vpc },
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 // The `DatabaseProxy` internally adds a dependency so that the `TargetGroup` is created after the `DatabaseCluster` is created.
@@ -60,6 +64,8 @@ const clusterWithWriterAndReaders = new rds.DatabaseCluster(stack, 'dbClusterWit
   vpc,
   writer: rds.ClusterInstance.provisioned('writer'),
   readers: [rds.ClusterInstance.provisioned('reader')],
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 new rds.DatabaseProxy(stack, 'Proxy3', {

diff --git a/...dk-testing/framework-integ/test/aws-rds/test/integ.read-replica-with-allocated-storage.ts b/...dk-testing/framework-integ/test/aws-rds/test/integ.read-replica-with-allocated-storage.ts
@@ -14,6 +14,8 @@ const mysqlSource = new rds.DatabaseInstance(stack, 'MysqlSource', {
   backupRetention: Duration.days(5),
   instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.SMALL),
   vpc,
+  storageEncrypted: false,
+  isStorageLegacyUnencrypted: true,
 });
 
 new rds.DatabaseInstanceReadReplica(stack, 'MysqlReplica', {