Aws-cdk: Secrets Manager - DocumentDB Construct

[jeffcorpuz]

:question: General Issue

Secret's value is not passed into a construct for DocumentDB, rather the whole SecretString is passed instead.

The Question

How does one resolve a SecretString from SecretsManager into a construct for DocumentDB?
Is this possible?

It passes : {resolve:secretsmanager:arn:aws:secretsmanager:us-east-2:****secret:cdk/docdb-****:SecretString:password::} but not the actual value

Code:

    // Get Secret Values for Username and Password
    const secret = sm.Secret.fromSecretAttributes(this, 'cdk/docdb', {
      secretArn: '',
    });

    const credentials = {
      username : secret.secretValueFromJson('username'),
      password : secret.secretValueFromJson('password') 
    };

.....

  // Create documentdb cluster
    const sfDocCluster = new docdb.CfnDBCluster(
      this,
      "StorefrontDocdbCluster",
      {
        storageEncrypted: true,
        availabilityZones: vpc.availabilityZones.splice(3),
        dbClusterIdentifier: "StorefrontDocdbCluster",
        masterUsername: credentials.username,
        masterUserPassword: credentials.password,
        vpcSecurityGroupIds: [sfSecurityGroup.securityGroupName],
        dbSubnetGroupName: sfSubnetGroup.dbSubnetGroupName,
        dbClusterParameterGroupName: sfDocParamGroup.name,
        port
      }
    );

Console Result:

StorefrontDocdbCluster Property validation failure: 

[Length of value {{{resolve:secretsmanager:arn:aws:secretsmanager:us-east-2:****secret:cdk/docdb-****:SecretString:password::}}} for property {/MasterUserPassword} is greater than maximum allowed length {41}, 

Length of value {{{resolve:secretsmanager:arn:aws:secretsmanager:us-east-2:****:secret:cdk/docdb-****:SecretString:username::}}} for property {/MasterUsername} is greater than maximum allowed length {63}]

Environment

• CDK CLI Version: 1.5
• Module Version:
• OS: OSX Mojave
• Language: TypeScript

Other information

[jogold]

It's correct that it passes the {{resolve...}} string see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html#dynamic-references-secretsmanager

Using the secretsmanager dynamic reference guarantees that neither Secrets Manager nor CloudFormation logs or persists any resolved secret value.

This is an issue with CloudFormation itself and how it resolves/validates username and password for a AWS::DocDB::DBCluster, see https://github.com/aws-cloudformation/aws-cloudformation-coverage-roadmap/issues/94 and https://forums.aws.amazon.com/thread.jspa?messageID=891456#891456

[jeffcorpuz]

Thanks @jogold.

Okay so it is actually passing the correct secretstring but so for this particular use case it is not possible at this moment.

[jogold]

for this particular use case it is not possible at this moment.

Exactly. This can only be fixed in CloudFormation not in the CDK.

[jeffcorpuz]

Am I to assume there are other use cases in which CF will not resolve secrets as well? Is there a list of said issues?

[jogold]

I don't know, the documentation says:

The secretsmanager dynamic reference can be used in all resource properties.

But apparently there are some bugs here and there.

[RomainMuller]

@jogold - which documentation is claiming that?

[jogold]

@RomainMuller See Important note here https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html#dynamic-references-secretsmanager

[rix0rrr]

@jeffcorpuz I'm curious, can you confirm the contents of your CFN template?

In your OP, you posted that the template contains {resolve:secretsmanager:arn:aws:secretsmanager:us-east-2:****secret:cdk/docdb-****:SecretString:password::}, and the error message contains {{{.

It should be two curly braces ({{) so I'm curious if that's actually what you're seeing in your template.

In the mean time, treating this as a CloudFormation bug. You can report it here: https://github.com/aws-cloudformation/aws-cloudformation-coverage-roadmap

[jeffcorpuz]

Hi @rix0rrr thanks, will treat it as a CF bug

[hervenivon]

Hi @jeffcorpuz,

Have you created the CloudFormation bug? Where can we track it?

Thank you in advance.

[jogold]

This is an issue with CloudFormation itself and how it resolves/validates username and password for a AWS::DocDB::DBCluster, see aws-cloudformation/aws-cloudformation-coverage-roadmap#94 and https://forums.aws.amazon.com/thread.jspa?messageID=891456#891456