I have a CDK setup in which I create an RDS postgres database. In addition to the database I’m also deploying two FargateService instances – one for my API and one for Hasura.

I want each service to have their own database user accounts and am struggling to figure out how I can create multiple accounts with access to the DB from CDK. Additionally, Hasura requires a connection string to connect to the database. I can stringify the secrets, but it’s considered unsafe because the secret can be leaked through the Cloudformation template.

What is the best practice in this example and is there a way to automatically create new users from CDK?

Thanks for your help!

I’m currently trying to:

1. Run CDK deploy which will create the db, 2 services, and 2 db secrets in the secret manager
2. Go into the secret manager and update the values so they can’t be leaked through the template
3. Connect to the db and add the accounts manually
4. Restart the services so they pull the updated passwords