Hi! Were using metaplay hosted solution and would like to store some secrets. As the backend runs on AWS there's AWS's secrets manager available. Is it possible to utilize this to store various secrets that the backend would then be able to access? Would be neat if that would be possible.

Hey @javikefi, thanks for the question - we are in the process of documenting this on docs.metaplay.io, but in the meantime one of our tech team will get back to you with more details very soon. Also, how many secrets do you plan on setting up and how often?

Hello @javikefi , I'm Kai from Metaplay infra team and I'm happy to answer your question!For creating customized AWS secrets, you can follow these steps:

# Install metaplay-auth CLI tool from NPM.
please go check https://www.npmjs.com/package/@metaplay/metaplay-auth

# Login with metaplay-auth CLI
metaplay-auth login

# Save deployment info into environmental variables
eval $(metaplay-auth get-aws-credentials -o <organization name> -p <project name> -e <environment name> -f env)

# Check if you have obtained AWS_ACCESS_KEY from metaplay-auth CLI
echo $AWS_ACCESS_KEY_ID # this should output a string

# Create AWS secrets with AWS CLI
aws secretsmanager create-secret --region eu-west-1 --name metaplay/p1/deployments/<project name>-<environment name>/<secret name> --secret-string <secret value>

Hi! This sounds great! We only need to store couple of API Keys to 3rd party API's we use. Not many secrets in any case. Thanks!

Hi javikefi, we are sorry to hear that, and could you please provide the exact AWS commands alongside with the full error logs from your console (without secret value)?

Sure: eval $(metaplay-auth get-aws-credentials -o beyondlabs -p imaginedesign -e develop -f env) This resulted the AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN To be in env variables. This was the command I ran: aws secretsmanager create-secret --region eu-west-1 --name metaplay/p1/deployments/beyondlabs-develop/aws_hosted_ai --secret-string And the output was: An error occurred (AccessDeniedException) when calling the CreateSecret operation: User: arn:aws:sts::252344532344:assumed-role/metaplay-p1-imaginedesign-develop-gameserver-admin/stackapi is not authorized to perform: secretsmanager:CreateSecret on resource: metaplay/p1/deployments/beyondlabs-develop/aws_hosted_ai because no identity-based policy allows the secretsmanager:CreateSecret action

Thanks! We are investigating and will get back to you soon!

Oh man! Sorry! That was it. I thought I copy pasted it from earlier command but made a mess.

No worries! Glad to know it works 🙂

Yeah, works perfectly. The problem was between seat and screen 😄

Yes, the pod where game server containers run on has RBAC enabled by default. The pod can consume a Kubernetes Service Account named as

gameserver

, which binds to an IAM role

gameserver

that has these permission regarding to AWS Secrets: - secretsmanager:GetSecretValue - secretsmanager:DescribeSecret - secretsmanager:ListSecretVersionIds In short, your game server container should have access to AWS secrets on a fly without any additional configurations 🙂

Fantastic!

This sounds like a server-side issue and it's beyond my knowledge. I will forward it internally and will come back to you soon!

Yeah, it is more that. Thanks!

Hi, Could you provide the server logs? The AWS SDK should fall back to environment variables to consume the credentials.

I'm using a snippet from AWS documentation (for .NET)

Can you link the documentation/snippet?

The AWS User ARN seems to be incorrect.

If you used AWS CLI to authenticate as that user, it likely is using that as priority over the environment based credential provider

Yeah, so basically the AWS_SECRET_ACCESS_KEY was not passed in a correct way to overwrite any existing configurations.

Ah, OK.

One thing you can try (that I haven't tried), is to use the AWS CLI to authenticate with a specific profile, then use your IDEs settings to set the profile environment variable (

AWS_PROFILE

). This does still require that

AWS_WEB_IDENTITY_TOKEN_FILE

is not set. (It's a priority thing :/) The AWS documentation is not very clear on this so it might require some tinkering

I got it working! Thanks guys!

We also have a

SecretUtil.ResolveSecretAsync

utility that can resolve AWS secrets, it has the same issues as your implementation (since it defers to

AmazonSecretsManagerClient

as well) but it might get rid of some boilerplate for you

Ah. OK. Good to know! Thanks!

Feel free to let us know if you have any further questions!

I will. Thanks again!