2025/05/22 - Amazon Aurora DSQL - 3 updated api methods
Changes Features: support for customer managed encryption keys
{'kmsEncryptionKey': 'string'}
Response {'encryptionDetails': {'encryptionStatus': 'ENABLED | UPDATING | '
'KMS_KEY_INACCESSIBLE | ENABLING',
'encryptionType': 'AWS_OWNED_KMS_KEY | '
'CUSTOMER_MANAGED_KMS_KEY',
'kmsKeyArn': 'string'}}
The CreateCluster API allows you to create both single-region clusters and multi-Region clusters. With the addition of the multiRegionProperties parameter, you can create a cluster with witness Region support and establish peer relationships with clusters in other Regions during creation.
Required permissions
dsql:CreateCluster
Required to create a cluster.
Resources: arn:aws:dsql:region:account-id:cluster/*
dsql:TagResource
Permission to add tags to a resource.
Resources: arn:aws:dsql:region:account-id:cluster/*
dsql:PutMultiRegionProperties
Permission to configure multi-region properties for a cluster.
Resources: arn:aws:dsql:region:account-id:cluster/*
dsql:AddPeerCluster
When specifying multiRegionProperties.clusters, permission to add peer clusters.
Resources:
Local cluster: arn:aws:dsql:region:account-id:cluster/*
Each peer cluster: exact ARN of each specified peer cluster
dsql:PutWitnessRegion
When specifying multiRegionProperties.witnessRegion, permission to set a witness Region. This permission is checked both in the cluster Region and in the witness Region.
Resources: arn:aws:dsql:region:account-id:cluster/*
Condition Keys: dsql:WitnessRegion (matching the specified witness region)
See also: AWS API Documentation
Request Syntax
client.create_cluster(
deletionProtectionEnabled=True|False,
kmsEncryptionKey='string',
tags={
'string': 'string'
},
clientToken='string',
multiRegionProperties={
'witnessRegion': 'string',
'clusters': [
'string',
]
}
)
boolean
If enabled, you can't delete your cluster. You must first disable this property before you can delete your cluster.
string
The KMS key that encrypts and protects the data on your cluster. You can specify the ARN, ID, or alias of an existing key or have Amazon Web Services create a default key for you.
dict
A map of key and value pairs to use to tag your cluster.
(string) --
Unique tag key, maximum 128 Unicode characters in UTF-8.
(string) --
Tag value, maximum 256 Unicode characters in UTF-8.
string
A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. Idempotency ensures that an API request completes only once. With an idempotent request, if the original request completes successfully, the subsequent retries with the same client token return the result from the original successful request and they have no additional effect.
If you don't specify a client token, the Amazon Web Services SDK automatically generates one.
This field is autopopulated if not provided.
dict
The configuration settings when creating a multi-Region cluster, including the witness region and linked cluster properties.
witnessRegion (string) --
The that serves as the witness region for a multi-Region cluster. The witness region helps maintain cluster consistency and quorum.
clusters (list) --
The set of linked clusters that form the multi-Region cluster configuration. Each linked cluster represents a database instance in a different Region.
(string) --
The Amazon Resource Name of the cluster.
dict
Response Syntax
{
'identifier': 'string',
'arn': 'string',
'status': 'CREATING'|'ACTIVE'|'IDLE'|'INACTIVE'|'UPDATING'|'DELETING'|'DELETED'|'FAILED'|'PENDING_SETUP'|'PENDING_DELETE',
'creationTime': datetime(2015, 1, 1),
'multiRegionProperties': {
'witnessRegion': 'string',
'clusters': [
'string',
]
},
'encryptionDetails': {
'encryptionType': 'AWS_OWNED_KMS_KEY'|'CUSTOMER_MANAGED_KMS_KEY',
'kmsKeyArn': 'string',
'encryptionStatus': 'ENABLED'|'UPDATING'|'KMS_KEY_INACCESSIBLE'|'ENABLING'
},
'deletionProtectionEnabled': True|False
}
Response Structure
(dict) --
The output of a created cluster.
identifier (string) --
The ID of the created cluster.
arn (string) --
The ARN of the created cluster.
status (string) --
The status of the created cluster.
creationTime (datetime) --
The time of when created the cluster.
multiRegionProperties (dict) --
The multi-Region cluster configuration details that were set during cluster creation
witnessRegion (string) --
The that serves as the witness region for a multi-Region cluster. The witness region helps maintain cluster consistency and quorum.
clusters (list) --
The set of linked clusters that form the multi-Region cluster configuration. Each linked cluster represents a database instance in a different Region.
(string) --
The Amazon Resource Name of the cluster.
encryptionDetails (dict) --
The encryption configuration for the cluster that was specified during the creation process, including the KMS key identifier and encryption state.
encryptionType (string) --
The type of encryption that protects the data on your cluster.
kmsKeyArn (string) --
The ARN of the KMS key that encrypts data in the cluster.
encryptionStatus (string) --
The status of encryption for the cluster.
deletionProtectionEnabled (boolean) --
Whether deletion protection is enabled on this cluster.
{'encryptionDetails': {'encryptionStatus': 'ENABLED | UPDATING | '
'KMS_KEY_INACCESSIBLE | ENABLING',
'encryptionType': 'AWS_OWNED_KMS_KEY | '
'CUSTOMER_MANAGED_KMS_KEY',
'kmsKeyArn': 'string'}}
Retrieves information about a cluster.
See also: AWS API Documentation
Request Syntax
client.get_cluster(
identifier='string'
)
string
[REQUIRED]
The ID of the cluster to retrieve.
dict
Response Syntax
{
'identifier': 'string',
'arn': 'string',
'status': 'CREATING'|'ACTIVE'|'IDLE'|'INACTIVE'|'UPDATING'|'DELETING'|'DELETED'|'FAILED'|'PENDING_SETUP'|'PENDING_DELETE',
'creationTime': datetime(2015, 1, 1),
'deletionProtectionEnabled': True|False,
'multiRegionProperties': {
'witnessRegion': 'string',
'clusters': [
'string',
]
},
'tags': {
'string': 'string'
},
'encryptionDetails': {
'encryptionType': 'AWS_OWNED_KMS_KEY'|'CUSTOMER_MANAGED_KMS_KEY',
'kmsKeyArn': 'string',
'encryptionStatus': 'ENABLED'|'UPDATING'|'KMS_KEY_INACCESSIBLE'|'ENABLING'
}
}
Response Structure
(dict) --
The output of a cluster.
identifier (string) --
The ID of the retrieved cluster.
arn (string) --
The ARN of the retrieved cluster.
status (string) --
The status of the retrieved cluster.
creationTime (datetime) --
The time of when the cluster was created.
deletionProtectionEnabled (boolean) --
Whether deletion protection is enabled in this cluster.
multiRegionProperties (dict) --
Returns the current multi-Region cluster configuration, including witness region and linked cluster information.
witnessRegion (string) --
The that serves as the witness region for a multi-Region cluster. The witness region helps maintain cluster consistency and quorum.
clusters (list) --
The set of linked clusters that form the multi-Region cluster configuration. Each linked cluster represents a database instance in a different Region.
(string) --
The Amazon Resource Name of the cluster.
tags (dict) --
Map of tags.
(string) --
Unique tag key, maximum 128 Unicode characters in UTF-8.
(string) --
Tag value, maximum 256 Unicode characters in UTF-8.
encryptionDetails (dict) --
The current encryption configuration details for the cluster.
encryptionType (string) --
The type of encryption that protects the data on your cluster.
kmsKeyArn (string) --
The ARN of the KMS key that encrypts data in the cluster.
encryptionStatus (string) --
The status of encryption for the cluster.
{'kmsEncryptionKey': 'string'}
The UpdateCluster API allows you to modify both single-Region and multi-Region cluster configurations. With the multiRegionProperties parameter, you can add or modify witness Region support and manage peer relationships with clusters in other Regions.
Required permissions
dsql:UpdateCluster
Permission to update a DSQL cluster.
Resources: arn:aws:dsql:region:account-id:cluster/cluster-id
dsql:PutMultiRegionProperties
Permission to configure multi-Region properties for a cluster.
Resources: arn:aws:dsql:region:account-id:cluster/cluster-id
dsql:GetCluster
Permission to retrieve cluster information.
Resources: arn:aws:dsql:region:account-id:cluster/cluster-id
dsql:AddPeerCluster
Permission to add peer clusters.
Resources:
Local cluster: arn:aws:dsql:region:account-id:cluster/cluster-id
Each peer cluster: exact ARN of each specified peer cluster
dsql:RemovePeerCluster
Permission to remove peer clusters. The dsql:RemovePeerCluster permission uses a wildcard ARN pattern to simplify permission management during updates.
Resources: arn:aws:dsql:*:account-id:cluster/*
dsql:PutWitnessRegion
Permission to set a witness Region.
Resources: arn:aws:dsql:region:account-id:cluster/cluster-id
Condition Keys: dsql:WitnessRegion (matching the specified witness Region)
This permission is checked both in the cluster Region and in the witness Region.
See also: AWS API Documentation
Request Syntax
client.update_cluster(
identifier='string',
deletionProtectionEnabled=True|False,
kmsEncryptionKey='string',
clientToken='string',
multiRegionProperties={
'witnessRegion': 'string',
'clusters': [
'string',
]
}
)
string
[REQUIRED]
The ID of the cluster you want to update.
boolean
Specifies whether to enable deletion protection in your cluster.
string
The KMS key that encrypts and protects the data on your cluster. You can specify the ARN, ID, or alias of an existing key or have Amazon Web Services create a default key for you.
string
A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. Idempotency ensures that an API request completes only once. With an idempotent request, if the original request completes successfully. The subsequent retries with the same client token return the result from the original successful request and they have no additional effect.
If you don't specify a client token, the Amazon Web Services SDK automatically generates one.
This field is autopopulated if not provided.
dict
The new multi-Region cluster configuration settings to be applied during an update operation.
witnessRegion (string) --
The that serves as the witness region for a multi-Region cluster. The witness region helps maintain cluster consistency and quorum.
clusters (list) --
The set of linked clusters that form the multi-Region cluster configuration. Each linked cluster represents a database instance in a different Region.
(string) --
The Amazon Resource Name of the cluster.
dict
Response Syntax
{
'identifier': 'string',
'arn': 'string',
'status': 'CREATING'|'ACTIVE'|'IDLE'|'INACTIVE'|'UPDATING'|'DELETING'|'DELETED'|'FAILED'|'PENDING_SETUP'|'PENDING_DELETE',
'creationTime': datetime(2015, 1, 1)
}
Response Structure
(dict) --
The details of the cluster after it has been updated.
identifier (string) --
The ID of the cluster to update.
arn (string) --
The ARN of the updated cluster.
status (string) --
The status of the updated cluster.
creationTime (datetime) --
The time of when the cluster was created.