const engine = DatabaseClusterEngine.auroraMysql({
          version: AuroraMysqlEngineVersion.of("8.0.mysql_aurora.3.01.0","8.0")
    });

    const auroraRole = this.createAuroraRole(); // has assume role for rds with s3 read inline policy

    const parameterGroup = new ParameterGroup(this, "ClusterParameterGroup", {
      engine,
      parameters: {
        // this works for the parameter group but does not associate the role with the cluster:
        //aws_default_s3_role: auroraRole.roleArn
      }
    });

    const cluster = new DatabaseCluster(this, "Database", {
      clusterIdentifier: "mycluster",
      defaultDatabaseName: "mydatabase",
      engine,
      credentials: Credentials.fromGeneratedSecret("...", { secretName: "..." }),
      storageEncrypted: true,
      instances: 2,
      backup: {
        retention: Duration.days(7)
      },
      instanceProps: {
        instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MEDIUM),
        vpc,
        vpcSubnets: vpc.selectSubnets({ subnetGroupName: "Private" }),
        securityGroups: [securityGroup]
      },
      parameterGroup,
      s3ImportRole: auroraRole,
    });