aws-amplify / aws-amplify/amplify-cli
Old Function secret values removed after adding a new ones and pusing them to another environment
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### How did you install the Amplify CLI?
_No response_
### If applicable, what version of Node.js are you using?
_No response_
### Amplify CLI Version
12.1.1
### What operating system are you using?
Pop Os
### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
No
### Describe the bug
In a multi-environment project when I add new Secret values to a Lambda in dev, merge changes to staging and push them, CLI tries to remove every old Secret value and only keep the new ones. This happens after CLI prompts me to add values for the new secrets, and then asks if I want to continue.
I see these changes made by the CLI:
Old secrets are removed at `function-parameters.json` from the secretNames array and from the top level comment at app.js of my Lambda (getParameters example).
I have had this issue before, and then resetting changes done by CLI have lead into no problems on the push, but now CLI removed all of my old secrets even after resetting the changes before proceeding with the Amplify push. This makes it extremely scary to push anything into production.
I mentioned this issue on another ticket, where something got fixed at 12.0.0. I had multiple issues on that issue, so perhaps this one was not the one that got fixed.
https://github.com/aws-amplify/amplify-cli/issues/12188
### Expected behavior
Old secret values should not be removed
### Reproduction steps
1. Have a Lambda with one or more existing secret values. Not sure if it matters, but this particular Lambda is added with a API Gateway, so that the Lambda is invoked by REST API.
2. Add two new secret values and push the changes
3. Commit changes to Git
4. Merge changes to another environment and `amplify env checkout newEnv`
5. `amplify push`, add missing values for the new secrets
6. When CLI asks `Are you sure you want to continue? (Y/n) ‣ `, observe from git diff how CLI tries to remove every old existing Secret.
7. Try to reset the changes, and after that proceed with the push
8. After push is completed, observe how the old secrets are removed in the code and in the Parameter store (in cloud).
9. I can recover from this by resetting all the changes occurred after amplify push, and updating each removed secret one by one.
### Project Identifier
6b0d8978f235dda0a7c441c51bcf218f
### Log output
```
# Put your logs below this line
```
### Additional information
_No response_
### Before submitting, please confirm:
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.
Contributor guide
Research direction
Start by reviewing issue #12188 and the multi-environment steps using `amplify env checkout` and `amplify push`. Compare the generated `function-parameters.json` secretNames array and the Lambda `app.js` comment before and after adding secrets, then verify whether existing values remain in Parameter Store after the push.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- backend, cli, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100