aws-amplify / aws-amplify/amplify-hosting
SSM secrets are exposed during build time in Amplify build console
- Dominant language
- Dockerfile
- Stars
- 481
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
### Before opening, please confirm:
- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-hosting/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
### App Id
dvcmciteyppky
### Region
eu-west-1
### Amplify Hosting feature
Backend builds
### Describe the bug
According to the documentation [about env variables](https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html#environment-secrets) the values from `AWS SSM` are shown as environment variable named `secrets` during build time. However when I try to use the secrets variable and put it in file it is exposed in plain text in console log.
This should not happened !
This section of `amplify.yml` :
```
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/zlMvpFileStorageFn/src/main/resources/application.properties
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```
produces the following output:
```
2022-06-22T07:47:14.146Z [INFO]: # Executing command: sed -e "s/ssm.secret.key=.*/ssm.secret.key="SERCET KEY IN PLAIN TEXT IS SHOWN HERE"/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```
### Expected behavior
There should be a way to hide echo commands in AWS console.
### Reproduction steps
This section of `amplify.yml` :
```
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/zlMvpFileStorageFn/src/main/resources/application.properties
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```
produces the following output:
```
2022-06-22T07:47:14.146Z [INFO]: # Executing command: sed -e "s/ssm.secret.key=.*/ssm.secret.key="SERCET KEY IN PLAIN TEXT IS SHOWN HERE"/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```
### Build Settings
```yaml
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/zlMvpFileStorageFn/src/main/resources/application.properties
- sed -e "s/ssm.secret.key=.*/ssm.secret.key=$(echo ${secrets} | jq .AMPLIFY_zlMvpSsmFn_ZL_MVP_ENCRYPTION_KEY)/" -i amplify/backend/function/StorageFn/src/main/resources/application.properties
```
```
### Additional information
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.