(core): unable to create JSON secret using secret values

[rix0rrr]

Describe the bug

See #20033 (comment)

With the new API, creating Secrets with compound values looks like this:

const secretValue = secretsmanager.Secret(this, 'Secret', {
  secretStringValue: cdk.SecretValue.unsafePlainText(JSON.stringify({
    username: user.userName,
    database: 'foo',
    password: accessKey.secretAccessKey.unsafeUnwrap(),
  }))
});

Which is not a great experience.

Expected Behavior

Can create JSON secret containing another secret.

Current Behavior

Not allowed.

Reproduction Steps

See linked example.

Possible Solution

I've considered making SecretValue contain compound values, but the API doesn't quite become satisfying:

SecretValue.jsonObject({
    username: 'admin',
    password: SecretValue.ssmSecure(...),
})

Is fine as far as it goes, but the problem with this API is it cannot be distinguished from this invocation:

SecretValue.jsonObject({
    username: 'admin',
    password: 'p4$$w0rd',   // UNSAFE
})

So it would need to be called unsafeJsonObject, but since when used properly this is the normal course for Secret usage, I don't want to call a method unsafe if it isn't actually unsafe.

It also seems that creating compound SecretValues is only used for initializing a Secret, and isn't used anywhere else. So, I'm thinking a better solution is to make it a feature of new sm.Secret:

const secretValue = secretsmanager.Secret(this, 'Secret', {
  secretObjectValue: {
    username: SecretValue.unsafePlainText(user.userName),
    database: SecretValue.unsafePlainText('foo'),
    password: accessKey.secretAccessKey,
  },
});

The type of secretObjectValue would be { [x: string]: SecretValue }

When writing a unit test for this, be sure to test with the @aws-cdk/core.preventUnsafePlaintextSecrets flag on, and update the documentation on SecretValue.unsafePlainText() to explain other reasonable use cases for static strings in here.

Additional Information/Context

No response

CDK CLI Version

Framework Version

No response

Node.js Version

OS

Language

Typescript

Language Version

No response

Other information

No response

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.