aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Need AWS::SecretsManager::Secret attribute for secret name

Open
#1,584 6 comments 7 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SecretsManager::Secret

### Resource name

_No response_

### Description

[`AWS::SecretsManager::Secret`](AWS::SecretsManager::Secret) should provide a `Name` attribute that can be queried using `Fn::GetAtt`. Currently it only provides its ARN via `Ref`.

When specifying an [injected ECS secret as an environment variable](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-secret.html) in [`AWS::ECS::TaskDefinition > ContainerDefinitions > Secrets`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-secret.html), the [format of the secret](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/secrets-envvar-secrets-manager.html) is:

`arn:aws:secretsmanager:region:aws_account_id:secret:secret-name:json-key:version-stage:version-id`

Note that we need to refer to the `secret-name`. Suppose that the secret is defined thus:

```yaml
MySecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: !Sub "foo-${someVariable}-bar"

```

If we do a `!Ref MySecret`, it gives us the secret ARN. But we need the secret name.

It is clunky to reproduce the entire secret name in the Secrets Manager reference, especially if the name was constructed using variable interpolation (to avoid clashes, as secrets are visible cross-stack):

```yaml
ValueFrom: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:foo-${someVariable}-bar:json-key::"
```

It would be much more convenient if we could query a `Name` attribute of the secret, like this:

```yaml
ValueFrom: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${MySecret.Name}:json-key::"
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

No implementation files or tests are mentioned in the issue. Start by locating the repository's coverage entry point and tests for AWS::SecretsManager::Secret, then verify the existing Ref behavior and how resource attributes are represented. Done means the requested Name attribute is queryable with Fn::GetAtt and is covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.