Overcast is alpha — behaviour and APIs may change between releases. Pin your version and read the changelog before upgrading.

overcast

RDS master account and passwords

What the master account Overcast creates can and cannot do on each engine, the per-engine password rules, and how a password change reaches a running database.

The administrator RDS creates for you, what it is allowed to do on each engine, and what a password has to look like.

Master account boundaries

The requested master account is the administrator your application connects as. On MySQL, MariaDB and Aurora MySQL it can create databases and users and grant privileges across the instance; the grants follow the selected engine version (the rds_superuser_role model on RDS MySQL 8.0.36+ and Aurora MySQL 3, the revised dynamic privileges and caching_sha2_password on 8.4). On PostgreSQL and Aurora PostgreSQL it is a non-superuser with CREATEDB, CREATEROLE and membership in the emulated rds_superuser role, matching the boundary AWS exposes rather than the stock image’s unrestricted superuser.

What this does not emulate: AWS’s full catalogue of protected internal accounts and rds_* procedures. PostgreSQL extension availability follows the backing image rather than the RDS extension allowlist, and reserved-word validation covers the engine system schemas and common SQL keywords rather than every version-specific reserved word. Code that depends on those administrative edges still needs testing against AWS.

The container’s maintenance account is separate: Overcast uses it during initialisation and password recovery, its generated credential is never returned by the API, and it is not an alternative application credential.

DBName follows the engine’s AWS behaviour. MySQL and MariaDB create no application database when it is omitted; PostgreSQL always has postgres, and an explicit DBName creates an additional database owned by the master account.

Password rules

EngineLength
MySQL, MariaDB, Aurora MySQL8–41
RDS PostgreSQL8–128
Aurora PostgreSQL8–99

All accept printable ASCII except /, ", @ and space. A single quote is valid and is escaped before it reaches the engine.

Important

GetRandomPassword’s default punctuation set contains characters RDS forbids, as AWS’s does — which is why CDK’s Credentials.fromGeneratedSecret excludes them by default. If a {{resolve:secretsmanager:…}} password is refused, set ExcludeCharacters on the generated secret, as you would for AWS.

Password changes

MasterUserPassword is applied to the running database rather than only recorded, so rotating one in a CloudFormation template takes effect and never replaces the instance. The instance must be available for it, and with Docker unavailable the password is stored and seeded into the container built for that instance later. ModifyDBCluster rotates each member in turn — see ModifyDBInstance refuses the new password.