aws-amplify / aws-amplify/amplify-hosting

SSM secrets are exposed during build time in Amplify build console

Open
#2,821 3 comments 3 reactions 1 assignee Assigned to @Jay2113 View on GitHub
documentation environment-secrets
Dominant language
Dockerfile
Stars
481
Forks
123
PR merge metrics
No merged PRs in 30d

Description

### Before opening, please confirm:

- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-hosting/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

### App Id

dvcmciteyppky

### Region

eu-west-1

### Amplify Hosting feature

Backend builds

### Describe the bug

According to the documentation [about env variables](https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html#environment-secrets) the values from `AWS SSM` are shown as environment variable named `secrets` during build time. However when I try to use the secrets variable and put it in file it is exposed in plain text in console log.

This should not happened !

This section of `amplify.yml` :

```
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/zlMvpFileStorageFn/src/main/resources/application.properties
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```
produces the following output:
```
2022-06-22T07:47:14.146Z [INFO]: # Executing command: sed -e "s/ssm.secret.key=.*/ssm.secret.key="SERCET KEY IN PLAIN TEXT IS SHOWN HERE"/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```

### Expected behavior

There should be a way to hide echo commands in AWS console.

### Reproduction steps

This section of `amplify.yml` :

```
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/zlMvpFileStorageFn/src/main/resources/application.properties
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```
produces the following output:
```
2022-06-22T07:47:14.146Z [INFO]: # Executing command: sed -e "s/ssm.secret.key=.*/ssm.secret.key="SERCET KEY IN PLAIN TEXT IS SHOWN HERE"/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```

### Build Settings

```yaml
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/zlMvpFileStorageFn/src/main/resources/application.properties
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```
```

### Additional information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.