rds: DatabaseInstanceFromSnapshot ignores the enablePerformanceInsights parameter, always set to True

[TensanT]

Describe the bug

Issues with @aws-cdk/aws-rds

DatabaseInstanceFromSnapshot ignores the enablePerformanceInsights parameter
and always generates EnablePerformanceInsights: true in the CloudFormation
template, regardless of the value passed to the construct.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

2.1101.0

Expected Behavior

When enablePerformanceInsights=False is passed to DatabaseInstanceFromSnapshot, the generated CloudFormation template should contain EnablePerformanceInsights: false.

Current Behavior

The generated CloudFormation template always shows EnablePerformanceInsights: true regardless of the parameter value. Running cdk synth confirms the property is hardcoded to true.

Reproduction Steps

from aws_cdk import Stack, aws_rds as rds, aws_ec2 as ec2
from constructs import Construct

class TestStack(Stack):
def init(self, scope: Construct, id: str, **kwargs):
super().init(scope, id, **kwargs)

    vpc = ec2.Vpc.from_lookup(self, "VPC", vpc_id="vpc-xxxxx")

    # Create instance from snapshot with Performance Insights disabled
    instance = rds.DatabaseInstanceFromSnapshot(
        self, "TestInstance",
        snapshot_identifier="my-snapshot-arn",
        engine=rds.DatabaseInstanceEngine.oracle_ee(
            version=rds.OracleEngineVersion.VER_19
        ),
        instance_type=ec2.InstanceType.of(
            ec2.InstanceClass.R5,
            ec2.InstanceSize.LARGE
        ),
        vpc=vpc,
        enable_performance_insights=False,  # This is ignored
    )

Possible Solution

instance = rds.DatabaseInstanceFromSnapshot(self, "TestInstance", ...)

if not enable_performance_insights:
cfn_instance = instance.node.default_child
cfn_instance.add_property_override("EnablePerformanceInsights", False)

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.234.1

AWS CDK CLI version

2.1101.0

Node.js Version

v22.21.0

OS

Linux

Language

Python

Language Version

Python 3.12

Other information

No response

[pahud]

Hi @TensanT,

Thanks for the detailed reproduction case.

I've confirmed there is a bug in the DatabaseInstanceNew base class constructor (parent of DatabaseInstanceFromSnapshot). The performance insights enablement logic uses JavaScript's || operator, which cannot distinguish between false (explicitly disabled) and undefined (not provided).

One nuance from our reproduction: when enable_performance_insights=False is the only PI-related prop set (your exact snippet), the current code does produce EnablePerformanceInsights: false in the template. Could you double-check whether your actual stack also sets performance_insight_retention, performance_insight_encryption_key, or database_insights_mode? Those are the conditions that trigger the bug — the || chain overrides your explicit false when any of them are present:

  Confirmed Bug Scenario
  ──────────────────────

  ┌───────────────────────────────────────┐
  │  User provides:                       │
  │  enablePerformanceInsights = false    │
  │  performanceInsightRetention = 7      │  (or encryptionKey, or advancedMode)
  └──────────────────┬────────────────────┘
                     ▼
  ┌───────────────────────────────────────┐
  │  DatabaseInstanceNew constructor      │
  │                                       │
  │  const enablePI =                     │
  │    props.enablePerformanceInsights    │ ◀── false (falsy!)
  │    || props.piRetention !== undef     │ ◀── true → wins!
  │    || props.piEncryptionKey !== undef │
  │    || props.insightsMode === ADV      │
  │                                       │
  │  Result: true (overrides the user's   │
  │  explicit false)                      │
  └──────────────────┬────────────────────┘
                     ▼
  ┌───────────────────────────────────────┐
  │  CloudFormation template:             │
  │  EnablePerformanceInsights: true      │ ◀── not what user wanted
  └───────────────────────────────────────┘

There's also a secondary issue on the CFN prop assignment line:

enablePerformanceInsights: enablePerformanceInsights || props.enablePerformanceInsights,

This || again conflates false with undefined, though in practice Section A is the primary culprit.

The fix is to use an explicit undefined check so that a user-provided false is always respected:

// Before (buggy):
const enablePerformanceInsights = props.enablePerformanceInsights
  || props.performanceInsightRetention !== undefined
  || props.performanceInsightEncryptionKey !== undefined
  || props.databaseInsightsMode === DatabaseInsightsMode.ADVANCED;

// After (fixed):
const autoDetected = props.performanceInsightRetention !== undefined
  || props.performanceInsightEncryptionKey !== undefined
  || props.databaseInsightsMode === DatabaseInsightsMode.ADVANCED;

const enablePerformanceInsights = props.enablePerformanceInsights !== undefined
  ? props.enablePerformanceInsights
  : (autoDetected || undefined);

In the meantime, your workaround using add_property_override is a nice solution:

cfn_instance = instance.node.default_child
cfn_instance.add_property_override("EnablePerformanceInsights", False)

Note: related issue #24726 describes a different problem — the CFN template being correct but AWS not applying the setting during snapshot restore. That's a CloudFormation/RDS service-level behavior, not the same root cause as this CDK-level bug.

If you're interested in contributing a fix, a PR would be very welcome! The change would be in packages/aws-cdk-lib/aws-rds/lib/instance.ts in the DatabaseInstanceNew constructor.

[TensanT]

Hi @pahud, i'd like to thank you for your swift response,
Ive tested with DatabaseInstanceFromSnapshot and enable_performance_insights=False:

• No Performance Insight properties → EnablePerformanceInsights: false (works)
• performance_insight_encryption_key → EnablePerformanceInsights: true (bug)
• performance_insight_retention→ EnablePerformanceInsights: true (bug)
• database_insights_mode → EnablePerformanceInsights: false`(works)

Root cause: Setting performance_insight_encryption_key or performance_insight_retention overrides the explicit false value.

[amberkushwaha]

vpc = ec2.Vpc.from_lookup(self, "VPC", vpc_id="vpc-xxxxx")

# Create instance from snapshot with Performance Insights disabled
instance = rds.DatabaseInstanceFromSnapshot(
    self, "TestInstance",
    snapshot_identifier="my-snapshot-arn",
    engine=rds.DatabaseInstanceEngine.oracle_ee(
        version=rds.OracleEngineVersion.VER_19
    ),
    instance_type=ec2.InstanceType.of(
        ec2.InstanceClass.R5,
        ec2.InstanceSize.LARGE
    ),
    vpc=vpc,
    enable_performance_insights=False,  # This is ignored
)

the file