aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::SecretsManager::Secret] - [BUG] - Unintended password update on `SecretStringTemplate` update

Open
#2,210 0 comments 4 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SecretsManager::Secret

### Resource Name

_No response_

### Issue Description

When updating an AWS Secrets Manager secret with a change to the [`SecretStringTemplate`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html#cfn-secretsmanager-secret-generatesecretstring-secretstringtemplate) property, the password (secret string value) is unexpectedly regenerated. This behavior seems unintended because the change is unrelated to the existing password (secret string) generation parameters.

### Expected Behavior

The password (secret string) should only be regenerated when parameters directly tied to secret generation are modified. E.g.; `ExcludeCharacters`, `IncludeSpace`, `PasswordLength`, `GenerateStringKey`, etc.

Updates to [`SecretStringTemplate`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html#cfn-secretsmanager-secret-generatesecretstring-secretstringtemplate) that do not affect the generation logic should leave the existing password (secret string) unchanged.

### Observed Behavior

A new password (secret string) is generated even when making an unrelated update to [`SecretStringTemplate`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html#cfn-secretsmanager-secret-generatesecretstring-secretstringtemplate), such as adding a new JSON key-value pair, without modifying any password (secret string) generation parameters.

### Test Cases

1. Create the secret using:

```yaml
Secret:
Type: AWS::SecretsManager::Secret
Properties:
Name: MySecret
Description: My little secret
GenerateSecretString:
PasswordLength: 20
ExcludeCharacters: '"@/\'
GenerateStringKey: password
SecretStringTemplate: !Sub |
{
"username" : "yves"
}
```

2. Now add a new property to the secret, without touching the password:

```diff
Secret:
Type: AWS::SecretsManager::Secret
Properties:
Name: MySecret
Description: My little secret
GenerateSecretString:
PasswordLength: 20
ExcludeCharacters: '"@/\'
GenerateStringKey: password
SecretStringTemplate: !Sub |
{
"username" : "yves",
+ "meta" : "data"
}
```

A new secret version is created as expected, but a new `password` value has been generated!

### Other Details

My personal use case is to add metadata to an existing secret without altering the password life cycle

Contributor guide

Open the contributing guide

Research direction

The issue names no repository file, test, or entry point. Start by reproducing the supplied CloudFormation example, changing only SecretStringTemplate, and verify whether a new secret version changes the generated password; done means unrelated template updates preserve the existing password while still applying the metadata change.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.