Aws-cdk: secret from SecretsManager not resolved correctly

[itajaja]

the secret doesn't seem to be correctly resolved when used in outputs

Reproduction Steps

const secret = secretsManager.Secret.fromSecretArn(
  this,
  'Secrets',
  'arn:aws:secretsmanager:us-east-1:xxx:secret:yyy-secrets-zzz',
);
new cdk.CfnOutput(this, 'testoutput', {
  value: secret.secretValueFromJson('abcdef').toString(),
});

produces the following output:

app.testoutput = {{resolve:secretsmanager:arn:aws:secretsmanager:us-east-1:xxx:secret:yyy-secrets-zzz:SecretString:abcdef::}}

instead of the actual resolved secret

Environment

using aws-cdk v1.8.0

---

This is :bug: Bug Report

[rix0rrr]

This is probably a limitation of the underlying CloudFormation system.

I think they don't expect you to put a secret (something you want to keep hidden) in stack outputs (visible to everyone, will probably appear in CloudFormation logs).

[itajaja]

that makes sense. my actual use case is to use a secret from secretsManager as a k8s secret using aws-cdk's addResource functionality. in that case as well the secret is not resolved. what would be a good workflow there?

[arjanschaaf]

running into the exact same problem creating a k8s secret using CDK + SecretsManager. Any guidance how to make this work would be much appreciated

[adrialucena-seat]

Same use case here. It seems something related to addResource, that doesn't resolve the value.
But using Secret.fromSecretArn to create an environment variable in an ECS task definition works.
Any workarround for this?

[njlynch]

This is a limitation of CloudFormation and dynamic references. From dynamic references docs.

Dynamic references for secure values, such as secretsmanager, are not currently supported in custom resources.

When calling addResource, a custom resource is being created, which is why the secret can't be used a dynamic reference there.

Tagging @eladb as the k8s expert to suggest if there's any workaround that springs to mind.

[itajaja]

thanks. I think we can probably close this issue