feat(aws): DatabaseSecret recoveryWindow pass-through; rds.groups fixture immediate deletion

Live run 2 failed re-creating the deterministic secret name inside AWS's
30-day deletion-recovery window from run 1's destroy. recoveryWindow is a
documented TERRACONSTRUCTS DEVIATION (CFN deletes immediately;
recovery_window_in_days is provider-level); fixture uses Duration.days(0).
Live run 3: PASS 44.73s, 13/13, drift oracle clean.

Author: so0k

integ/aws/storage/apps/rds.groups.ts

@@ -10,7 +10,7 @@
 // minimal IEngine literals below carry only the fields these constructs read
 // (same stand-in idiom as test/aws/storage/rds/parameter-group.test.ts).
 import { App, LocalBackend, TerraformOutput } from "cdktn";
-import { aws } from "../../../../src";
+import { aws, Duration } from "../../../../src";
 
 const environmentName = process.env.ENVIRONMENT_NAME ?? "test";
 const region = process.env.AWS_REGION ?? "us-east-1";
@@ -102,6 +102,10 @@ const optionGroup = new aws.storage.rds.OptionGroup(stack, "Options", {
 
 const secret = new aws.storage.rds.DatabaseSecret(stack, "Secret", {
   username: "dbadmin",
+  // Force immediate deletion on destroy so the deterministic secret name can
+  // be re-created across repeated integ runs (run 2 failed on the 30-day
+  // recovery window from run 1's destroy).
+  recoveryWindow: Duration.days(0),
 });
 
 new TerraformOutput(stack, "subnet_group_name", {

src/aws/storage/rds/database-secret.ts

@@ -3,6 +3,7 @@
 import { Annotations } from "cdktn";
 import type { Construct } from "constructs";
 import { DEFAULT_PASSWORD_EXCLUDE_CHARS } from "./private/util";
+import { Duration } from "../../../duration";
 import { md5hash } from "../../../helpers-internal";
 import { AwsStack } from "../../aws-stack";
 import * as secretsmanager from "../../encryption";
@@ -52,6 +53,20 @@ export interface DatabaseSecretProps {
    */
   readonly excludeCharacters?: string;
 
+  /**
+   * The number of days that Secrets Manager waits before it can delete the secret.
+   *
+   * TERRACONSTRUCTS DEVIATION: not present upstream (CloudFormation deletes
+   * secrets immediately on stack delete; deletion recovery is a
+   * Terraform-provider concept, `recovery_window_in_days`). Exposed as a
+   * pass-through to `encryption.SecretProps.recoveryWindow` so deterministic
+   * secret names can be re-created promptly (e.g. integ fixtures use
+   * `Duration.days(0)`).
+   *
+   * @default - AWS default of 30 days
+   */
+  readonly recoveryWindow?: Duration;
+
   /**
    * Whether to replace this secret when the criteria for the password change.
    *
@@ -119,6 +134,7 @@ export class DatabaseSecret extends secretsmanager.Secret {
         excludeCharacters,
       },
       replicaRegions: props.replicaRegions,
+      recoveryWindow: props.recoveryWindow,
     });
 
     // TERRACONSTRUCTS DEVIATION: upstream overrides the CFN logical ID so that CloudFormation