aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Need AWS::SecretsManager::Secret attribute for secret name
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::SecretsManager::Secret
### Resource name
_No response_
### Description
[`AWS::SecretsManager::Secret`](AWS::SecretsManager::Secret) should provide a `Name` attribute that can be queried using `Fn::GetAtt`. Currently it only provides its ARN via `Ref`.
When specifying an [injected ECS secret as an environment variable](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-secret.html) in [`AWS::ECS::TaskDefinition > ContainerDefinitions > Secrets`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-secret.html), the [format of the secret](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/secrets-envvar-secrets-manager.html) is:
`arn:aws:secretsmanager:region:aws_account_id:secret:secret-name:json-key:version-stage:version-id`
Note that we need to refer to the `secret-name`. Suppose that the secret is defined thus:
```yaml
MySecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: !Sub "foo-${someVariable}-bar"
…
```
If we do a `!Ref MySecret`, it gives us the secret ARN. But we need the secret name.
It is clunky to reproduce the entire secret name in the Secrets Manager reference, especially if the name was constructed using variable interpolation (to avoid clashes, as secrets are visible cross-stack):
```yaml
ValueFrom: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:foo-${someVariable}-bar:json-key::"
```
It would be much more convenient if we could query a `Name` attribute of the secret, like this:
```yaml
ValueFrom: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${MySecret.Name}:json-key::"
```
### Other Details
_No response_
Contributor guide
Research direction
No implementation files or tests are mentioned in the issue. Start by locating the repository's coverage entry point and tests for AWS::SecretsManager::Secret, then verify the existing Ref behavior and how resource attributes are represented. Done means the requested Name attribute is queryable with Fn::GetAtt and is covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100