fix(rds): proxy target is missing KMS permissions

[scub]

When creating an RDS proxy. If the Secrets Manager Secret that holds the credentials is encrypted with a KMS key, any registered ProxyTarget(s) will fail to connect as they lack access the secret as it requires the ability to kms:Decrypt using the Secret's encrypted key.

When this occurs the following can be observed in the DatabaseProxy logs but only when debugLogging is set true.

Credentials couldn't be retrieved. The IAM role "arn:aws:iam:::role/ProxyIAMRole2FE8AB0F" is not authorized to read the AWS Secrets Manager secret with the ARN "arn:aws:secretsmanager:::secret:SecretA720EF05"

Reproduction steps

    const vpc = new Vpc(stack, 'Vpc');
    const kmsKey = new Key(stack, 'Key');
    const kmsEncryptedSecret = new secretsmanager.Secret(stack, 'Secret', {encryptionKey: kmsKey});

    const cluster = new rds.DatabaseCluster(stack, 'Database', {
      engine: rds.DatabaseClusterEngine.AURORA,
      instanceProps: { vpc },
    });

    new rds.DatabaseProxy(stack, 'Proxy', {
      proxyTarget: rds.ProxyTarget.fromCluster(cluster),
      debugLogging: true,
      vpc,
      secrets: [kmsEncryptedSecret],
    });

This is my first CDK PR, i've run the following:

yarn install
npx lerna run build --scope=aws-cdk-lib
cd packages/aws-cdk-lib
npx yarn test aws-rds
npx yarn lint aws-rds
npx yarn eslint --fix aws-rds/lib/proxy.ts aws-rds/test/proxy.test.ts

# Running integration tests
cd ../../
npx lerna run build --scope=@aws-cdk-testing/framework-integ
cd packages/@aws-cdk-testing/framework-integ
npx yarn integ test/aws-rds/test/*.js --update-on-failed

Closes #28850

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[lpizzinidev]

Looks good 👍
Just a minor nit.
Also, can you please update the title of the PR to describe the bug (not the solution)?
Something like fix(rds): proxy target is missing KMS permissions should work.

[xazhao]

The change is pretty straightforward and looks good to me!

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: dab8b51
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).