docdb.DatabaseSecret by default calls aws_secretsmanager.Secret specifying exclusion characters of '"', '@', and '/'.
However since many databases use a 'proto://user:password@host.....' connection URL, a colon should be included in this exclusions list.

I'm currently trying to spin up a mongo-express container in my ECS environment but can't get it to connect because the secret that was generated contains a colon and so the connection URL is invalid.

Reproduction Steps

const secret = new docdb.DatabaseSecret(this, 'ClusterSecret', {
    username: 'root',
    secretName: 'myClusterSecret',
});

What did you expect to happen?

A valid secret is generated that can be used in a connection URL

What actually happened?

Secret generated with a ':' in it which makes connection URLs invalid

Environment

• CDK CLI Version : 1.114.0 (build 7e41b6b)
• Framework Version:
• Node.js Version: v15.4.0
• OS : 5.12.15.arch1-1
• Language (Version): Using Typescript but I assume this affect all

Other

Note that while using this within your own applications is controllable (my Spring Boot application builds the connection string and url-encodes the password), providing this to out of the box images as environment secrets is impossible

This is 🐛 Bug Report