feat: ability to change AWS secret description

KiraLT · Jan 18, 2022 · 963a47c · 963a47c
1 parent df83af6
commit 963a47c
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 4 deletions.
diff --git a/README.md b/README.md
@@ -45,5 +45,6 @@ Then go to AWS Secrets dashboard and create a rotation rule for created secrets
 | CERTBOT_SERVER | Letsencrypt API url. | `https://acme-v02.api.letsencrypt.org/directory` |
 | CERTBOT_DIR | Temporary certbot directory where logs and generated certs will be stored. | `/tmp/certbot` |
 | AWS_SECRET_NAME | AWS secret name template, {domain} will be replaced with domain name. | `certbot-{domain}` |
+| AWS_SECRET_DESCRIPTION | AWS secret name description text. | `Auto generated SSL certificate by lambda-certbot` |
 
 Each DNS challenge plugin requires different configuration, check [documentation](https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins) for more information.
diff --git a/app/handler.py b/app/handler.py
@@ -23,7 +23,10 @@ def handler(_event, _context):
         )
 
         upload_certs_as_secrets(
-            certs, name=settings.AWS_SECRET_NAME, secret_names=secret_names
+            certs,
+            name=settings.AWS_SECRET_NAME,
+            secret_names=secret_names,
+            description=settings.AWS_SECRET_DESCRIPTION
         )
     finally:
         shutil.rmtree(str(settings.CERTBOT_DIR), ignore_errors=True)

diff --git a/app/services/aws.py b/app/services/aws.py
@@ -10,7 +10,7 @@ def list_secret_names() -> list[str]:
 
 
 def upload_certs_as_secrets(
-    certs: list[Cert], name: str, secret_names: list[str] = None
+    certs: list[Cert], name: str, secret_names: list[str] = None, description: str = ''
 ) -> None:
     for cert in certs:
         name = name.format(domain=cert.domain)
@@ -19,11 +19,12 @@ def upload_certs_as_secrets(
             name=name,
             data={f.name: f.content for f in cert.files},
             secret_names=secret_names,
+            description=description
         )
 
 
 def create_or_update_secret(
-    name: str, data: dict[str, str], secret_names: list[str] = None
+    name: str, data: dict[str, str], secret_names: list[str] = None, description: str = ''
 ):
     secretsmanager = client("secretsmanager")
     secret_names = secret_names if secret_names is not None else list_secret_names()
@@ -37,6 +38,6 @@ def create_or_update_secret(
 
         secretsmanager.create_secret(
             Name=name,
-            Description=f"Auto generated SSL certificate by lambda-certbot",
+            Description=description,
             SecretString=json.dumps(data),
         )
diff --git a/app/settings.py b/app/settings.py
@@ -13,6 +13,7 @@ class Settings:
     CERTBOT_DIR: Path
     AWS_SECRET_NAME: str
     AWS_DEFAULT_REGION: str
+    AWS_SECRET_DESCRIPTION: str
 
 
 def read_env(name: str, required: bool = False, multi=False, default=None):
@@ -43,4 +44,5 @@ def read_env(name: str, required: bool = False, multi=False, default=None):
     CERTBOT_DIR=Path(read_env("CERTBOT_DIR", default="/tmp/certbot")).resolve(),
     AWS_DEFAULT_REGION=read_env("AWS_DEFAULT_REGION", required=True),
     AWS_SECRET_NAME=read_env("AWS_SECRET_NAME", default="certbot-{domain}"),
+    AWS_SECRET_DESCRIPTION=read_env("AWS_SECRET_DESCRIPTION", default="Auto generated SSL certificate by lambda-certbot"),
 )