https://serverless-stack.com/ logo
Join Slack
Powered by
Anyone experienced with `@aws-cdk/aws-secretsmanag...
# help
j
Anyone experienced with 
@aws-cdk/aws-secretsmanager
? I need help retrieving my generated secret to format it with postgres url and pass it on as an environment variable to my fargate service. I have the ff code:
Copy code
import { Secret } from '@aws-cdk/aws-secretsmanager'

const dbCredentials = new Secret(this, 'DBCredentialsSecret', {
  secretName: 'my-db-credentials',
  generateSecretString: {
    secretStringTemplate: JSON.stringify({
      username,
    }),
    excludePunctuation: true,
    includeSpace: false,
    generateStringKey: 'password',
  },
})
I’ve tried outputting the ff syntaxes:
Copy code
dbCredentials.secretValueFromJson('password').toString()
ECSecret.fromSecretsManager(passwordSecret, 'password')
but they only show me the gibberish value (or something similar):
Copy code
{{resolve:secretsmanager:arn:aws:secretsmanager:us-east-2:732453962214:secret:my-db-credentials-c3Qjjv:SecretString:password::}}
I need this exact value specified in here
f
Hey @Jett Robin Andres, where r u printing out this gibberish value, inside the CDK code?
j
it’s inside my stack @Frank. right after I instantiate my rds and assign my credentials to it I output it with this
Copy code
new CfnOutput(this, 'Secret Password', {
  value: dbCredentials.secretValueFromJson('password').toString(),
})
f
is the stack output showing 
{{resolve:secretsmanager:arn:aws:secretsmanager:us-east-2:732453962214:secret:my-db-credentials-c3Qjjv:SecretString:password::}}
? Or are you doing a console.log and seeing it in ur terminal?
j
It’s displayed on the stack output @Frank (1st pic). Using 
console.log
displays it as `$Token[TOKEN.581]`(see 2nd pic)
j
// Session secret const secret = new Secret(this, 'SessionSecret', { secretName: 'KeystoneSession', generateSecretString: { // change as appropriate... passwordLength: 32, }, }); // Task definition const taskImage: ecs_patterns.ApplicationLoadBalancedTaskImageOptions = { image: ecs.ContainerImage.fromDockerImageAsset(asset), // port specified by keystone in Dockerfile containerPort: 3000, secrets: { // required by keystone SESSION_SECRET: ecs.Secret.fromSecretsManager(secret), }, environment: { // pass in aurora connection url DATABASE_URL: props.dbUrl, }, }
// generate password const creds = rds.Credentials.fromGeneratedSecret('keystone'); // create aurora cluster this.cluster = new rds.ServerlessCluster(this, 'KeystoneDatabase', { engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL, parameterGroup: rds.ParameterGroup.fromParameterGroupName(this, 'ParameterGroup', 'default.aurora-postgresql10'), vpc: props.vpc, scaling: props.scaling ?? { autoPause: cdk.Duration.minutes(10), }, credentials: creds, subnetGroup: props.subnet, defaultDatabaseName: props.name, securityGroups: [props.sg], }); // set db values this.username = creds.username this.password = this.cluster.secret!.secretValueFromJson('password').toString() this.hostname = this.cluster.clusterEndpoint.hostname this.port = 5432 } // construct the postgresql connection url public getUrl() { return cdk.Fn.join('', [ '<postgres://'|postgres://'>, this.username, ':', this.password, '@', this.hostname, ':', this.port.toString(), '/', this.name, '?connect_timeout=300' ]) }
Look at the repo if it's not clear how I managed to do it
j
wow, thanks for the help @Joe Kendal! will check this out!
I finally got it to work! It seems like it will always output the gibberish value but I used the ff syntax for my formatted postgres url:
Copy code
dbCredentials.secretValueFromJson('password').toString()
Merry Christmas indeed! 🎄
j
I think there may be two methods with secretsmanager in cdk. 1 to output the cfn token, 1 to actually retrieve the plaintext during synth.
🎄
Open in Slack
PreviousNext
Powered by