fix(cli): Fix incorrect parsing of ARNs w/ nested param names

ecs-cli/modules/cli/local/secrets/clients/clients.go

@@ -26,6 +26,11 @@ import (
 	"github.com/pkg/errors"
 )
 
+// ssmSeparator is used to check if ssm parameter names are fully qualified paths
+const ssmSeparator = "/"
+
+const splitAllStrings = -1
+
 // region represents an AWS region.
 type region string
 
@@ -59,8 +64,12 @@ func (d *SSMDecrypter) DecryptSecret(arnOrName string) (string, error) {
 
 	// If the value is an ARN we need to retrieve the parameter name and update the region of the client.
 	paramName := arnOrName
-	if parsedARN, err := arnParser.Parse(arnOrName); err == nil {
-		paramName = parsedARN.Resource[len("parameter/"):] // Resource is formatted as parameter/{paramName}.
+	if arnParser.IsARN(arnOrName) {
+		parsedARN, err := arnParser.Parse(arnOrName)
+		if err != nil {
+			return "", errors.Wrapf(err, "failed to parse resource identifier %s due to %v", arnOrName, err)
+		}
+		paramName = parsedARN.Resource[len("parameter"):] // Resource is formatted as parameter/{paramName}.
 		d.SSMAPI = d.getClient(region(parsedARN.Region))
 	}
 

ecs-cli/modules/cli/local/secrets/clients/clients_test.go

@@ -45,7 +45,7 @@ func TestSSMDecrypter_DecryptSecret(t *testing.T) {
 
 				gomock.InOrder(
 					defaultClient.EXPECT().GetParameter(&ssm.GetParameterInput{
-						Name:           aws.String("TEST_DB_PASSWORD"),
+						Name:           aws.String("/TEST_DB_PASSWORD"),
 						WithDecryption: aws.Bool(true),
 					}).Return(&ssm.GetParameterOutput{
 						Parameter: &ssm.Parameter{
@@ -74,7 +74,7 @@ func TestSSMDecrypter_DecryptSecret(t *testing.T) {
 
 				gomock.InOrder(
 					pdxClient.EXPECT().GetParameter(&ssm.GetParameterInput{
-						Name:           aws.String("TEST_DB_PASSWORD"),
+						Name:           aws.String("/TEST_DB_PASSWORD"),
 						WithDecryption: aws.Bool(true),
 					}).Return(&ssm.GetParameterOutput{
 						Parameter: &ssm.Parameter{
@@ -91,6 +91,37 @@ func TestSSMDecrypter_DecryptSecret(t *testing.T) {
 				}
 			},
 		},
+		"with ARN and forward slashes": {
+			input:        "arn:aws:ssm:us-west-2:11111111111:parameter/TEST/DB/PASSWORD",
+			wantedSecret: "ponies",
+			setupDecrypter: func(ctrl *gomock.Controller) *SSMDecrypter {
+				iadClient := mock_ssmiface.NewMockSSMAPI(ctrl)
+				pdxClient := mock_ssmiface.NewMockSSMAPI(ctrl)
+
+				m := make(map[region]ssmiface.SSMAPI)
+				m["default"] = iadClient
+				m["us-east-1"] = iadClient
+				m["us-west-2"] = pdxClient
+
+				gomock.InOrder(
+					pdxClient.EXPECT().GetParameter(&ssm.GetParameterInput{
+						Name:           aws.String("/TEST/DB/PASSWORD"),
+						WithDecryption: aws.Bool(true),
+					}).Return(&ssm.GetParameterOutput{
+						Parameter: &ssm.Parameter{
+							Value: aws.String("ponies"),
+						},
+					}, nil),
+
+					iadClient.EXPECT().GetParameter(gomock.Any()).Times(0), // Should not have called IAD
+				)
+
+				return &SSMDecrypter{
+					SSMAPI:  iadClient,
+					clients: m,
+				}
+			},
+		},
 		"without ARN": {
 			input:        "TEST_DB_PASSWORD",
 			wantedSecret: "hello",

ecs-cli/modules/cli/local/secrets/secrets_test.go

@@ -31,6 +31,10 @@ func TestName(t *testing.T) {
 			input:  NewContainerSecret("mongodb", "DB_PASSWORD", "arn:aws:secretsmanager:us-east-1:11111111111:secret:alpha/efe/local"),
 			wanted: "mongodb_DB_PASSWORD",
 		},
+		"complex": {
+			input:  NewContainerSecret("mongodb", "DB_PASSWORD", "arn:aws:secretsmanager:us-east-1:11111111111:secret:alpha/efe/local/mongo/aws"),
+			wanted: "mongodb_DB_PASSWORD",
+		},
 	}
 
 	for name, tc := range testCases {