[aws-ecr-assets] Unable to provide secrets to DockerImageAsset build from SSM

[markusl]

It is common to include company internal artifacts or require some other integrations when running Docker asset builds.
In our case, we just want to simply install some internal NPM packages when building the components.

Using buildArgs of DockerImageAsset for reading parameters from the SSM Secure Strings does not seem to be supported?

This is also somewhat related to #10151 as the internal repositories can only be accessed via VPC connections.

Workaround

The pipeline setup contains:

    synthAction: pipelines.SimpleSynthAction.standardNpmSynth({
      environment: { privileged: true },
      sourceArtifact,
      cloudAssemblyArtifact,

      buildCommand: 'npm run build',
      subdirectory: 'cdk',
      environmentVariables: {
        NPM_TOKEN: {
          type: codebuild.BuildEnvironmentVariableType.PARAMETER_STORE,
          value: 'company-internal-artifactory-token'
        },
      }
    }),

The asset image build uses the provided NPM_TOKEN:

  const dockerAsset = new assets.DockerImageAsset(scope, 'app', {
    directory: '../app',
    buildArgs: {
      NPM_TOKEN: process.env.NPM_TOKEN ?? ''
    }
  });

What did you expect to happen?

We'd like to have a documented way of providing some secrets to the DockerImageAsset.

What actually happened?

The provided secret is printed to the build log without masking it, which is not optimal.

verbose: [0%] debug: docker build --build-arg NPM_TOKEN=xxxxxxxxxx== --tag cdkasset-257bfb6650e113016f7693018e8213ccb5b96188bec5ddeaa4ca282485a31d63 .

Environment

• CDK CLI Version : 1.74.0 (build e86602f)
• Framework Version: 1.74.0 (build e86602f)
• Node.js Version: v14.15.0
• OS : macOs
• Language (Version): TypeScript 4

Other

---

This is 🐛 Bug Report

[rix0rrr]

Duplicate of #10999

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[ColeMurray]

@markusl,

You can use secrets manager and EnvironmentVariableType.SECRETS_MANAGER type to overcome this.

Example:

const synthAction = SimpleSynthAction.standardNpmSynth({
            sourceArtifact,
            cloudAssemblyArtifact,
            installCommand: "npm install -g npm && npm ci",
            buildCommand: 'npm run build',
            rolePolicyStatements: [new iam.PolicyStatement({
                resources: ["*"],
                actions: ["secretsmanager:GetSecretValue"]
            })],
            subdirectory: './deployment',
            environment: {
                privileged: true,
                environmentVariables: {
                    NPM_TOKEN:  {
                        value: '<YOUR VALUE NAME HERE>',
                        type: BuildEnvironmentVariableType.SECRETS_MANAGER
                    }
                }

            },

        });