Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(codebuild): Secret manager env vars get the wrong arn on grant #12703

Closed
JFox opened this issue Jan 26, 2021 · 1 comment · Fixed by #13706
Closed

(codebuild): Secret manager env vars get the wrong arn on grant #12703

JFox opened this issue Jan 26, 2021 · 1 comment · Fixed by #13706
Assignees
@skinny85
Labels
@aws-cdk/aws-codebuild Related to AWS CodeBuild bug This issue is a bug. effort/medium Medium work item – several days of effort p1

Comments

@JFox
Copy link

JFox commented Jan 26, 2021

When adding environment variables to codebuild Projects, cdk adds the grant read for the secret. However, when adding a secret using the <secretName>:<secretKey> format, the generated arn includes the secretKey causing the arn to be wrong (aws::secretsmanager:eu-central-1:00000000000:secret:secretName:secretKey-??????)

Reproduction Steps

Create a codebuild Project using a secret env var with the <secretName>:<secretKey> format

What did you expect to happen?

the arn on the policy not to include the secretKey

What actually happened?

the arn on the policy included the secretKey

Environment

  • CDK CLI Version : 1.86.0
  • Framework Version: 1.86.0
  • Node.js Version: 13.8.0
  • OS : MacOS
  • Language (Version):TypeScript (3.9.7)

Other

This is 🐛 Bug Report
@JFox JFox added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Jan 26, 2021
@github-actions github-actions bot added the @aws-cdk/aws-codebuild Related to AWS CodeBuild label Jan 26, 2021
@skinny85 skinny85 added effort/medium Medium work item – several days of effort p1 and removed needs-triage This issue or PR still needs to be triaged. labels Jan 26, 2021
@skinny85 skinny85 mentioned this issue Mar 12, 2021
Closed
2 tasks
skinny85 added a commit to skinny85/aws-cdk that referenced this issue Mar 19, 2021
@skinny85
fix(codebuild): allow passing the ARN of the Secret in environment va…
fabfd00 
…riables

In the SecretsManager-typed environment variables in CodeBuild,
the code in the Project class assumed those would be passed as names.
As it turns out, CodeBuild also allows passing there entire ARNs of secrets
(both partial, and full), and also optional qualifiers,
separated by colons, that specify SecretsManager attributes like the JSON key,
or the secret version.
Add handling of all of these cases.

Fixes aws#12703
@skinny85 skinny85 mentioned this issue Mar 19, 2021
Merged
@mergify mergify bot closed this as completed in #13706 Mar 26, 2021
mergify bot pushed a commit that referenced this issue Mar 26, 2021
@skinny85
fix(codebuild): allow passing the ARN of the Secret in environment va…
6f6e079 
…riables (#13706)

In the SecretsManager-typed environment variables in CodeBuild,
the code in the Project class assumed those would be passed as names.
As it turns out, CodeBuild also allows passing there entire ARNs of secrets
(both partial, and full), and also optional qualifiers,
separated by colons, that specify SecretsManager attributes like the JSON key,
or the secret version.
Add handling of all of these cases.

Fixes #12703

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

hollanddd pushed a commit to hollanddd/aws-cdk that referenced this issue Mar 31, 2021
@skinny85 @hollanddd
fix(codebuild): allow passing the ARN of the Secret in environment va…
4ddc918 
…riables (aws#13706)

In the SecretsManager-typed environment variables in CodeBuild,
the code in the Project class assumed those would be passed as names.
As it turns out, CodeBuild also allows passing there entire ARNs of secrets
(both partial, and full), and also optional qualifiers,
separated by colons, that specify SecretsManager attributes like the JSON key,
or the secret version.
Add handling of all of these cases.

Fixes aws#12703

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
hollanddd pushed a commit to hollanddd/aws-cdk that referenced this issue Aug 26, 2021
@skinny85 @hollanddd
fix(codebuild): allow passing the ARN of the Secret in environment va…
ff81da3 
…riables (aws#13706)

In the SecretsManager-typed environment variables in CodeBuild,
the code in the Project class assumed those would be passed as names.
As it turns out, CodeBuild also allows passing there entire ARNs of secrets
(both partial, and full), and also optional qualifiers,
separated by colons, that specify SecretsManager attributes like the JSON key,
or the secret version.
Add handling of all of these cases.

Fixes aws#12703

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@skinny85 skinny85

Labels
@aws-cdk/aws-codebuild Related to AWS CodeBuild bug This issue is a bug. effort/medium Medium work item – several days of effort p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(codebuild): allow passing the ARN of the Secret in environment variables skinny85/aws-cdk
2 participants
@JFox @skinny85