Sceptre: SecretManager resolver in templates throws error

[sopeters]

I'm trying to use Secrets Manager to hold DB passwords and part of my template is

MasterUserPassword: '{{resolve:secretsmanager::SecretString:password}}'

When launching the stack for an existing RDS I'm getting

An error occurred (ValidationError) when calling the UpdateStack operation: Parameters: [MasterUserPassword] must have values

Uploading the template directly into CloudFormation works with no issues.

[ngfgrant]

Hey @sopeters

Which version of Sceptre are you using and can you provide a bit more information about your stack and template? Can you also share the secrets manager custom resolver you are using?

[sopeters]

Hi @ngfgrant - using 2.0.0 release and it's a pretty simple YAML template. No custom resolver as AWS supports {{resolve:secretsmanager::SecretString:}}:

https://aws.amazon.com/blogs/security/how-to-create-and-retrieve-secrets-managed-in-aws-secrets-manager-using-aws-cloudformation-template/ and
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html

I have one template that creates a secret via:

DBSecret:

Type: 'AWS::SecretsManager::Secret'
Properties:
Name: !Ref SecretsPrefix
Description: RDS Access Details
SecretString: !Sub '{"username": "${MasterUsername}", "password": "${MasterUserPassword}"}'

Outputs:
SecretsArn:
Description: "ARN of Secrets entry"
Value: !Ref DBSecret

The DB Template uses it via Parameter and !stack_output:

DB:
Type: AWS::RDS::DBInstance
Properties:
...
MasterUsername: !Join ['', ['{{resolve:secretsmanager:', !Ref SecretsArn, ':SecretString:username}}']]
MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref SecretsArn, ':SecretString:password}}']]

If I upload the template directly into the console and type in the parameters - it works without problems. If I try to run it via 'launch' command I get

An error occurred (ValidationError) when calling the UpdateStack operation: Parameters: [MasterUserPassword] must have values

So I assume it's actually the template validation that errors.

[iAnomaly]

@sopeters, your issue is quite a few months old at this point so maybe you have already resolved it on your own. If not however, the cause of this is that {{ }} notation used by CloudFormation dynamic references clashes with Jinja's templating notation/syntax. Please see the Jinja documentation section on escaping.

[saranyasridharan]

How did you solve your issue ? in my case, I am not getting error also not getting the value resolved. was it working for you after {{ escaping ? @IAnomaly

[AdannaAkwats]

@saranyasridharan
Escaping '{{' worked for me.
Like this:

MasterUsername: !Join ['', ['{{'{{'}}', 'resolve:secretsmanager:', !Ref SecretsArn, ':SecretString:username', '{{'}}'}}']]

[saranyasridharan]

Did you try in userdata file in ec2 creation? @iAnomaly

[iAnomaly]

@saranyasridharan I'm not sure what you are trying to accomplish specifically. If you share an example we might be able to help.

If you are trying to use CloudFormation dynamic references in UserData specifically, it's not supported by CloudFormation. I have a custom Sceptre Resolver for that case here if you would like to read more: https://github.com/iAnomaly/sceptre-resolver-aws-secrets-manager

[saranyasridharan]

Thanks for the reply @iAnomaly . I will take a look.

[zaro0508]

Does your resolver do the same thing as the sceptre-ssm-resolver @iAnomaly?

[iAnomaly]

Not unless that resolver has also added support for AWS Secrets Manager @zaro0508. Systems Manager (SSM)'s Parameter Store is an entirely separate service/feature of AWS.