使用 AWS CDK 创建 Aurora PostgreSQL 数据库集群

在本文中，我们将介绍如何使用 AWS CDK 设置一个高度可扩展的 Aurora PostgreSQL 数据库集群。本实现采用了 Serverless v2 实例和 Secrets Manager 等现代最佳实践，以提高安全性和效率。

---

前提条件

在开始之前，您需要具备以下条件：

1. 已生成VPC
2. 已生成isolated subnet，isolated security group

CDK代码

以下是CDK Stack的代码。

import * as cdk from 'aws-cdk-lib';
import { SecurityGroup } from 'aws-cdk-lib/aws-ec2';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import {
  AuroraPostgresEngineVersion,
  ClusterInstance,
  Credentials,
  DatabaseCluster,
  DatabaseClusterEngine,
  SubnetGroup,
} from 'aws-cdk-lib/aws-rds';
import { Secret } from 'aws-cdk-lib/aws-secretsmanager';
import { Construct } from 'constructs';

export class RDSStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // VPC ID
    const vpcId = 'xxx';

    // Isolated Security Group ID
    const isolatedSecurityGroupId = 'xxx';

    // -------------------------------------------

    // 获取 VPC
    const vpc = ec2.Vpc.fromLookup(this, 'VPC', { vpcId: vpcId });

    const rdsSubnetGroup = new SubnetGroup(this, `rds-subnet-group`, {
      vpc: vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
      description: 'Subnet group for RDS',
    });

    // 获取 RDS 安全组
    const rdsSecurityGroup = SecurityGroup.fromLookupById(this, `rds-sg`, isolatedSecurityGroupId);

    // 创建 RDS 密钥
    const dbSecret = new Secret(this, `rds-secret`, {
      secretName: `<SECRET_NAME>`,
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ username: 'postgres' }),
        generateStringKey: 'password',
        passwordLength: 10, // 生成密码的长度
        excludeCharacters: '"@/$&:{}()[]+*=^-|', // 密码中排除的特殊字符
      },
    });

    // 创建 RDS 集群
    new DatabaseCluster(this, `db-cluster`, {
      engine: DatabaseClusterEngine.auroraPostgres({ version: AuroraPostgresEngineVersion.VER_17_2 }), // Aurora PostgreSQL 17.2
      clusterIdentifier: `db-cluster`,
      defaultDatabaseName: '<DATABASE_NAME>',
      vpc: vpc,
      vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }),
      serverlessV2MinCapacity: 0.5,
      serverlessV2MaxCapacity: 64,
      backup: { retention: cdk.Duration.days(7) }, // 备份保留 7 天
      credentials: Credentials.fromSecret(dbSecret),
      subnetGroup: rdsSubnetGroup,
      securityGroups: [rdsSecurityGroup],
      storageEncrypted: true, // 开启加密
      writer: ClusterInstance.serverlessV2(`db-instance-1`, {
        autoMinorVersionUpgrade: false,
        instanceIdentifier: `db-instance-1`,
        enablePerformanceInsights: false,
        publiclyAccessible: false,
      }),
      readers: [
        ClusterInstance.serverlessV2(`db-instance-2`, {
          autoMinorVersionUpgrade: false,
          instanceIdentifier: `db-instance-2`,
          enablePerformanceInsights: false,
          publiclyAccessible: false,
        }),
      ],
    });
  }
}

---

总结

本文介绍了如何使用 AWS CDK 设置 Aurora PostgreSQL 数据库集群。通过 Serverless v2，您可以实现一个高效、可扩展且安全的数据库解决方案。有关进一步的自定义内容，请参考 AWS CDK RDS 文档。