Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(secretsmanager): create secret with secretObjectValue #21091

Merged
merged 5 commits into from
Jul 13, 2022

Conversation

corymhall
Copy link
Contributor

@corymhall corymhall commented Jul 11, 2022

A common use case is to create key/value secrets where the values could
be either strings or other secret values. Currently this is possible,
but the user experience is not great. This PR introduces a new input
prop secretObjectValue which is of type { [key: string]: SecretValue }.

For example, you can now create a JSON secret:

new secretsmanager.Secret(stack, 'JSONSecret', {
  secretObjectValue: {
    username: SecretValue.unsafePlainText(user.userName), // intrinsic reference, not exposed as plaintext
    database: SecretValue.unsafePlainText('foo'), // rendered as plain text, but not a secret
    password: accessKey.secretAccessKey, // SecretValue
  },
});

I've also updated the docs to better reflect what unsafe means given
this new context.

fixes #20461


All Submissions:

Adding new Unconventional Dependencies:

  • This PR adds new unconventional dependencies following the process described here

New Features

  • Have you added the new feature to an integration test?
    • Did you use yarn integ to deploy the infrastructure and generate the snapshot (i.e. yarn integ without --dry-run)?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

A common use case is to create key/value secrets where the values could
be either strings _or_ other secret values. Currently this is possible,
but the user experience is not great. This PR introduces a new input
prop `secretObjectValue` which is of type `{ [key: string]: SecretValue }`.

For example, you can now create a JSON secret:
```ts
new secretsmanager.Secret(stack, 'JSONSecret', {
  secretObjectValue: {
    username: SecretValue.unsafePlainText(user.userName), // intrinsic reference, not exposed as plaintext
    database: SecretValue.unsafePlainText('foo'), // rendered as plain text, but not a secret
    password: accessKey.secretAccessKey, // SecretValue
  },
});
```

I've also updated the docs to better reflect what `unsafe` means given
this new context.

fixes #20461
@gitpod-io
Copy link

gitpod-io bot commented Jul 11, 2022

@github-actions github-actions bot added bug This issue is a bug. effort/small Small work item – less than a day of effort p1 labels Jul 11, 2022
@aws-cdk-automation aws-cdk-automation requested a review from a team July 11, 2022 18:28
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Jul 11, 2022
Copy link
Contributor

@mrgrain mrgrain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mergify
Copy link
Contributor

mergify bot commented Jul 13, 2022

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 6101708
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit 5f0eff2 into aws:main Jul 13, 2022
@mergify
Copy link
Contributor

mergify bot commented Jul 13, 2022

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue is a bug. contribution/core This is a PR that came from AWS. effort/small Small work item – less than a day of effort p1
Projects
None yet
Development

Successfully merging this pull request may close these issues.

(core): unable to create JSON secret using secret values
3 participants