aws-rds: cannot use connections in rds.DatabaseInstance.fromLookup

[mazyu36]

Describe the bug

When importing an RDS instance using rds.DatabaseInstance.fromLookup and attempting to use the connections property, the following error occurs:

CfnSynthesisError: Resolution error: Supplied properties not correct for "CfnSecurityGroupIngressProps"
  fromPort: "3306" should be a number
  toPort: "3306" should be a number.
    at ValidationResult.assertSuccess (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/core/lib/runtime.js:1:2876)
    at convertCfnSecurityGroupIngressPropsToCloudFormation (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/aws-ec2/lib/ec2.generated.js:1:710632)
    at CfnSecurityGroupIngress.renderProperties (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/aws-ec2/lib/ec2.generated.js:1:708378)
    at PostResolveToken.Resources (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/core/lib/cfn-resource.js:1:7982)
    at PostResolveToken.postProcess (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/core/lib/util.js:1:1648)
    at Object.postProcess (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:1313)
    at DefaultTokenResolver.resolveToken (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/core/lib/resolvable.js:1:1554)
    at resolve (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:2909)
    at Object.resolve (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:1187)
    at resolve (/Users/ykmatsud/Documents/git/cdk-conf-2025/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:3218) {
  type: 'CfnSynthesisError'
}

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

The connections property should be usable with an RDS instance imported via rds.DatabaseInstance.fromLookup.

Current Behavior

Unable to use the connections property with an RDS instance imported via rds.DatabaseInstance.fromLookup.

Reproduction Steps

const clientSecurityGroup = new ec2.SecurityGroup(
  this,
  'ClientSecurityGroup',
  {
    vpc,
  },
);

const rdsInstanceFromLookup = rds.DatabaseInstance.fromLookup(
  this,
  'RdsInstanceFromLookup',
  {
    instanceIdentifier,
  },
);

rdsInstanceFromLookup.connections.allowDefaultPortFrom(
  clientSecurityGroup,
);

Possible Solution

The port property in the fromLookup method of rds.DatabaseInstance should be cast to Number. This is not currently done, resulting in the error.

https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-rds/lib/instance.ts#L191

In contrast, the fromLookup method in rds.DatabaseCluster does cast the port to a number, which works correctly.

https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-rds/lib/cluster.ts#L1391

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

v2.210.0

AWS CDK CLI version

2.1024.0

Node.js Version

v22.14.0

OS

OSX

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi @mazyu36,

Thank you for reporting this issue! You've identified a legitimate bug in the DatabaseInstance.fromLookup method.

Root Cause

The issue occurs because DatabaseInstance.fromLookup incorrectly passes the port value as a string (from the AWS API response), but the DatabaseInstanceAttributes interface expects a number. This type mismatch causes the connections property to fail during synthesis.

Bug Fix

The current code violates its own interface contract:

• DatabaseInstanceAttributes.port is declared as number
• But fromLookup passes a string
• This makes connections unusable (the reported bug)

Solution

Cast the port to a number to match both the interface contract and the working implementation in DatabaseCluster.fromLookup:

// In packages/aws-cdk-lib/aws-rds/lib/instance.ts around line 191
port: Number(instance['Endpoint.Port']),

This fix will enable the connections property to work as intended without breaking any existing functionality.

[related-issues-bot-for-aws]

Hi @mazyu36,

Thanks for opening this issue! After reviewing the details, we found some other discussions that may be closely related:

Related Issues

• (rds/docdb): fromDatabaseInstanceAttributes stringifies number tokens incorrectly #11813: Both issues involve the AWS RDS module dealing with port values in DatabaseInstance constructs. The current issue has a port value incorrectly passed as a string from the fromLookup method, while (rds/docdb): fromDatabaseInstanceAttributes stringifies number tokens incorrectly #11813 deals with number tokens being stringified incorrectly in fromDatabaseInstanceAttributes. Both share the same fundamental problem of port values not being correctly typed as numbers, affecting connections functionality.

• (aws_rds): cluster_endpoint.port returns wrong data #12286: Both issues deal with port value type handling in the AWS RDS module. The current issue has the port passed as a string instead of a number in DatabaseInstance.fromLookup, preventing connections from working properly. Similarly, (aws_rds): cluster_endpoint.port returns wrong data #12286 involves port values being represented incorrectly when used with cluster_endpoint.port. Both affect the ability to properly use port values from RDS resources for further connections.

• (aws-rds): Add lookup functonality #31720: Issue (aws-rds): Add lookup functonality #31720 was the original feature request that led to the implementation of the DatabaseInstance.fromLookup functionality. The current issue reports a bug in this implementation where the port is passed as a string instead of a number, preventing the use of the connections property. They're directly connected as one requested the feature and the other reports a defect in that feature.

This message was generated automatically to help connect related conversations and improve discoverability

Please react with 👍 or 👎 to let us know if this response was helpful!

Thank you for helping improve CDK! 🙌