diff --git a/allowed-breaking-changes.txt b/allowed-breaking-changes.txt
index 864ea5178512b..6069472407d94 100644
--- a/allowed-breaking-changes.txt
+++ b/allowed-breaking-changes.txt
@@ -75,7 +75,7 @@ strengthened:@aws-cdk/aws-stepfunctions-tasks.BatchSubmitJobProps
 removed:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps.cluster
 strengthened:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps
 
-# Remove IO2 from autoscaling EbsDeviceVolumeType. This value is not supported 
+# Remove IO2 from autoscaling EbsDeviceVolumeType. This value is not supported
 # at the moment and was not supported in the past.
 removed:@aws-cdk/aws-autoscaling.EbsDeviceVolumeType.IO2
 
@@ -83,12 +83,12 @@ removed:@aws-cdk/aws-autoscaling.EbsDeviceVolumeType.IO2
 removed:@aws-cdk/aws-stepfunctions-tasks.EmrCreateCluster.AutoTerminationPolicyProperty
 removed:@aws-cdk/aws-stepfunctions-tasks.EmrCreateClusterProps.autoTerminationPolicy
 
-# Changed property securityGroupId to optional because either securityGroupId or 
+# Changed property securityGroupId to optional because either securityGroupId or
 # securityGroupName is required. Therefore securityGroupId is no longer mandatory.
 weakened:@aws-cdk/cloud-assembly-schema.SecurityGroupContextQuery
 
 # refactor autoscaling lifecycle hook target bind() methods to make role optional by
-# having bind() methods create the role if it isn't passed to them 
+# having bind() methods create the role if it isn't passed to them
 incompatible-argument:@aws-cdk/aws-autoscaling-hooktargets.FunctionHook.bind
 incompatible-argument:@aws-cdk/aws-autoscaling-hooktargets.QueueHook.bind
 incompatible-argument:@aws-cdk/aws-autoscaling-hooktargets.TopicHook.bind
@@ -106,7 +106,7 @@ removed:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps.maxRecord
 removed:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps.parallelizationFactor
 removed:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps.reportBatchItemFailures
 removed:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps.retryAttempts
-removed:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps.tumblingWindow 
+removed:@aws-cdk/aws-lambda-event-sources.ManagedKafkaEventSourceProps.tumblingWindow
 removed:@aws-cdk/aws-lambda-event-sources.SelfManagedKafkaEventSourceProps.bisectBatchOnError
 removed:@aws-cdk/aws-lambda-event-sources.SelfManagedKafkaEventSourceProps.maxRecordAge
 removed:@aws-cdk/aws-lambda-event-sources.SelfManagedKafkaEventSourceProps.parallelizationFactor
@@ -125,4 +125,8 @@ changed-type:@aws-cdk/aws-elasticloadbalancingv2.NetworkLoadBalancer.vpc
 # removed methods and properties related to event bridge notifications for S3 buckets as they are not yet supported (19 Jan 2022)
 removed:@aws-cdk/aws-s3.Bucket.enableEventBridgeNotification
 removed:@aws-cdk/aws-s3.BucketBase.enableEventBridgeNotification
-removed:@aws-cdk/aws-s3.BucketProps.eventBridgeEnabled
\ No newline at end of file
+removed:@aws-cdk/aws-s3.BucketProps.eventBridgeEnabled
+
+# changed the type of RDS's SnapshotCredentials.secret from Secret to ISecret,
+# shouldn't matter
+changed-type:@aws-cdk/aws-rds.SnapshotCredentials.secret
diff --git a/packages/@aws-cdk/aws-rds/lib/props.ts b/packages/@aws-cdk/aws-rds/lib/props.ts
index 6338fa0368849..8f61088997d96 100644
--- a/packages/@aws-cdk/aws-rds/lib/props.ts
+++ b/packages/@aws-cdk/aws-rds/lib/props.ts
@@ -384,7 +384,7 @@ export abstract class SnapshotCredentials {
    * }
    * ```
    */
-  public static fromSecret(secret: secretsmanager.Secret): SnapshotCredentials {
+  public static fromSecret(secret: secretsmanager.ISecret): SnapshotCredentials {
     return {
       generatePassword: false,
       password: secret.secretValueFromJson('password'),
@@ -435,7 +435,7 @@ export abstract class SnapshotCredentials {
    *
    * @default - none
    */
-  public abstract readonly secret?: secretsmanager.Secret;
+  public abstract readonly secret?: secretsmanager.ISecret;
 
   /**
    * The characters to exclude from the generated password.