AWS Secrets in Staging & Production
# questions-and-feedbacka
an_toni.a
11/13/2024, 9:03 AMHi! We have been using the pre-launch dev envs so far, but now switched to the production plan and got the proper staging & productions envs.
I got to deploy to Staging OK, but I have trouble adding AWS secrets there. I didn't find from the docs how it is supposed to work, I don't remember from where we got the info for how it has been working for dev envs.
Is it somehow different?
I authenticated using metaplay-auth and it worked to deploy the docker image fine, but starting the server fails as secrets are missing.
With the same auth I get this when trying to add secrets:
> $ aws secretsmanager create-secret --region eu-west-1 --name metaplay/p1/deployments/imaginedesign-staging/test --secret-string test
>
> An error occurred (AccessDeniedException) when calling the CreateSecret operation: User: arn:aws:sts::252344532344:assumed-role/metaplay-p1-rare-rice-gameserver-admin/stackapi is not authorized to perform: secretsmanager:CreateSecret on resource: metaplay/p1/deployments/imaginedesign-staging/test because no identity-based policy allows the secretsmanager:CreateSecret action
rare-rice is the name our staging env and i did the auth with the eval that works for deploying
> $ eval $(npx @Metaplay Support/metaplay-auth get-aws-credentials -o beyondlabs -p imaginedesign -e staging -f env)
j
Jurjen
11/13/2024, 9:04 AMHey,
instead of
metaplay/p1/deployments/imaginedesign-staging/testmetaplay/p1/deployments/race-rice/testa
an_toni.a
11/13/2024, 9:04 AMright, i think i tried that yesterday but maybe made a different mistake then
j
Jurjen
11/13/2024, 9:05 AMrace-rice is the unique identifier that won't change even if the project name changes, so the infra stack is called that instead of imaginedesign-staging
a
an_toni.a
11/13/2024, 9:05 AMyes that worked! thanks. indeed i did realize that maybe that's it but somehow failed yesterday anyway
j
Jurjen
11/13/2024, 9:08 AMHappens 😄
Jurjen
11/13/2024, 9:09 AMOur CLI tool knows how to translate
-o beyondlabs -p imaginedesign -e stagingJurjen
11/13/2024, 9:09 AMAt some point, we'll add secret management to our CLI tool as well but we're not there yet 😄
a
an_toni.a
11/13/2024, 9:09 AMthat would be handy yes. the current way is not bad though
an_toni.a
11/13/2024, 11:04 AMhm .. so where we get secrets in the code, i need to make a mapping from the env to the infra name?
earlier we've used the string from GetEnvironmentInfo.GetEnvironmentFamily() directly in the path
no prob to do the mapping ofc but i just wanted to check
and i guess in the yaml files with the aws-sm:// refs it needs the infra name too
an_toni.a
11/13/2024, 11:33 AMlol that GetEnvironmentFamily is our own method, i forgot 😄
j
Jurjen
11/13/2024, 11:47 AMAh yeah, we generally set the secret per environment in the options (e.g. options.staging.yaml refers to race-rice)
a
an_toni.a
11/14/2024, 8:12 AMyep i have that too but i also have code which gets secrets, and a util class for doing it easily
i guess i could have put them to options too .. but it's actually less work to just have a single get call with the secret name and then the generic code constructs the path depending on the env