fix(rds): addProxy can use kms encrypted secrets

[scub]

When creating an RDS proxy if the Secrets Manager secret that holds the Credentials is encrypted with a KMS key and registered ProxyTarget(s) will fail to connect as they lack access to kms:Decrypt using the encrypted key.

When this occurs the following can be observed in the DatabaseProxy logs but only when debugLogging is set true.

Credentials couldn't be retrieved. The IAM role "arn:aws:iam:::role/ProxyIAMRole2FE8AB0F" is not authorized to read the AWS Secrets Manager secret with the ARN "arn:aws:secretsmanager:::secret:SecretA720EF05"

This is my first CDK PR, i've run the following:

yarn install
npx lerna run build --scope=aws-cdk-lib
cd packages/aws-cdk-lib
npx yarn test aws-rds
npx yarn lint aws-rds
npx yarn eslint --fix aws-rds/lib/proxy.ts aws-rds/test/proxy.test.ts

# Running integration tests
cd ../../
npx lerna run build --scope=@aws-cdk-testing/framework-integ
cd packages/@aws-cdk-testing/framework-integ
npx yarn integ test/aws-rds/test/*.js --update-on-failed

Closes #28850

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[scub]

Exemption Request for changes to integration tests as tests have been provided in packages/aws-cdk-lib/aws-rds/test/proxy.test.ts

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

⚠️ The sha of the head commit of this PR conflicts with #28858. Mergify cannot evaluate rules on this PR. ⚠️

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: f07eb3f
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository