feat(rds): support native Secrets Manager integration for RDS Cluster and Instance

[mazyu36]

Issue # (if applicable)

Closes #29239.

Reason for this change

Implements the manageMasterUserPassword property for RDS clusters and instances, enabling RDS native integration with AWS Secrets Manager for automatic master user password management.

Description of changes

Added manageMasterUserPassword property to rds.Cluster and rds.Instance.

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Add unit tests and integ test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	96 ran	96 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	96 ran	96 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[vishaalmehrishi]

The rest of the RDS README uses Credentials.fromUsername() for credential creation. Using a plain object literal here works but is inconsistent with the established pattern. Consider:

credentials: rds.Credentials.fromUsername('admin', {
  encryptionKey: kmsKey,
}),

[mazyu36]

Good catch. Updated to use Credentials.fromUsername() for consistency.

[vishaalmehrishi]

Let's add manageMasterUserPassword to DatabaseClusterFromSnapshotProps as well. Per the AWS RDS docs, ManageMasterUserPassword is supported when restoring from snapshots. Customers migrating existing databases to RDS-managed passwords would benefit.

[mazyu36]

Added manageMasterUserPassword to DatabaseClusterFromSnapshotProps with tests.

[vishaalmehrishi]

This validation block is duplicated identically in instance.ts (lines 1367-1384). If a new credential property is added in the future, both locations must be updated.

Consider extracting a shared helper alongside renderCredentials:

function validateManagedPasswordCredentials(scope: Construct, credentials?: Credentials): void {
  const unsupportedProps = [
    credentials?.excludeCharacters && 'excludeCharacters',
    credentials?.password && 'password',
    credentials?.replicaRegions && 'replicaRegions',
    credentials?.secret && 'secret',
    credentials?.secretName && 'secretName',
    credentials?.usernameAsString && 'usernameAsString',
  ].filter(Boolean);
  if (unsupportedProps.length > 0) {
    throw new ValidationError(
      `When manageMasterUserPassword is enabled, only 'username' and 'encryptionKey' are allowed. Found: ${unsupportedProps.join(', ')}.`,
      scope,
    );
  }
}

[mazyu36]

Extracted validateManagedPasswordCredentials() to private/util.ts and replaced both inline blocks.

[vishaalmehrishi]

This test passes credentials as a plain object { username: 'testuser', encryptionKey: kmsKey }. Since most users will use Credentials.fromUsername(), consider adding a test (or changing this one) to verify that path works correctly with manageMasterUserPassword. The fromUsername method has internal logic that could interact differently.

[mazyu36]

Added a test using Credentials.fromUsername() with manageMasterUserPassword.

Pull request has been modified.