Describe the bug

About 2 months ago a this PR got merged, which states that we should be able to alter the master user password of the snapshot using the snapshotCredentials prop. However when using this prop CDK creates a new secret in Secrets Manager, but the master user password still remains unchanged. It seems like the DatabaseSecret that is created is not being used.

Looking at the code of the PR, the masterUserPassword gets changed in the cfnDbCluster while also having the snapshotIdentifier prop. However the docs state to NOT use the masterUserPassword prop together with the snapshotIdentifier prop.

Expected Behavior

When using the snapshotCredentials property with rds.SnapshotCredentials.fromGeneratedSecret() inside the DatabaseClusterFromSnapshot construct. I expect the master user password to be changed to the password that is generated in Secrets Manager.

Current Behavior

A DatabaseSecret is created inside Secrets Manger, however the master user password of the snapshot remains unchanged.

Reproduction Steps

1. Create a RDS DB using Aurora Serverless using the DatabaseCluster construct in CDK
2. Create snapshot
3. Add DatabaseClusterFromSnapshot construct to CDK using the snapshotCredentials with SnapshotCredentials.fromGeneratedSecret(), and remove the DatabaseCluster construct from CDK
4. Try logging in the DB as master user using the generated DatabaseSecret that is created from the DatabaseClusterFromSnapshot

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.27.0

Framework Version

No response

Node.js Version

16

OS

Linux

Language

Typescript

Language Version

No response

Other information

No response