title: Getting MasterUserPassword for AWS::RDS::DBCluster via SecretsManager in CloudFormation
body: <p>When creating an <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html" rel="nofollow noreferrer"><code>AWS::RDS::DBCluster</code></a>(Aurora-Serverless) in AWS CloudFormation, there is a property <code>MasterUserPassword</code> and its input is specified as <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html#cfn-rds-dbcluster-masteruserpassword" rel="nofollow noreferrer">string</a>. </p>
  
  <p>So, how to put a stack definition yaml so that RDS definition does not use a string but a random password generated by <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secret.html#cfn-secretsmanager-secret-secretstring" rel="nofollow noreferrer"><code>AWS::SecretsManager::Secret</code></a>? Is it possible to reference Secrets-manager-generated password with <code>!Ref</code>, <code>!GetAtt</code> or any other means?</p>
  
  <pre><code>Resources:
    AuroraMysqlAppCredentialSecretStore:
      Type: AWS::SecretsManager::Secret
      Properties:
        Name: AuroraMysqlAppCredentialSecretStore
        GenerateSecretString:
          SecretStringTemplate: '{"username": "admin"}'
          GenerateStringKey: "password"
          PasswordLength: 30
          ExcludeCharacters: '"@/\'
    ApprovalDbCluster:
      Type: AWS::RDS::DBCluster
      Properties:
        Engine: aurora
        EngineMode: serverless
        EngineVersion: '5.6'
        DatabaseName: MyDatabaseName
        MasterUsername: admin
        MasterUserPassword: # HOW TO REFERENCE THE PASSWORD HERE??
        DBClusterIdentifier: my-cluster-1
        BackupRetentionPeriod: 35
        DeletionProtection: false
        ScalingConfiguration:
          AutoPause: true
          MaxCapacity: 8
          MinCapacity: 2
          SecondsUntilAutoPause: 300
        DBSubnetGroupName: my-subnet-name
  </code></pre>
  
  <p>A final note: <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html#cfn-rds-dbcluster-masteruserpassword" rel="nofollow noreferrer">Docs</a> state that <code>MasterUserPassword</code> should not be specified if <code>SourceDBInstanceIdentifier</code> or <code>DBSnapshotIdentifier</code> property is given, but my configuration has neither, so apparently I should specify <code>MasterUserPassword</code>.</p>