aws-rds: add support for adding secrets to an RDS Proxy

[mneirynck]

Describe the feature

I would like to be able to add secrets to an RDS Proxy after the proxy has been created in an easy to use way.

Use Case

We have an RDS stack and have multiple Application stacks that use SSM exported parameters from the RDS Stack.
The RDS Proxy is created in the RDS stack before any application stack exists, so only one secret is known to the proxy at creation time (the one for the proxy itself).

When we create an application stack we would like to get that RDS Proxy and call a addSecret method on it to add the RDS Secret that is created for the application user.

Proposed Solution

The DatabaseProxy could add a method addSecret(ISecret) that adds the secret to the proxy and grants read access from the proxy to the secret.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.91.0

Environment details (OS name and version, etc.)

Linux

[peterwoodworth]

This should be possible if we calculate this lazily

aws-cdk/packages/aws-cdk-lib/aws-rds/lib/proxy.ts

Line 449 in eea12ea

auth: props.secrets.map(_ => {

However this could potentially be a breaking change if people are using escape hatches here, since producing lazy values messes with escape hatches. Could still be something we support, thanks for the request