aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::SecretsManager::Secret] - [BUG] - Unintended password update on `SecretStringTemplate` update
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::SecretsManager::Secret
### Resource Name
_No response_
### Issue Description
When updating an AWS Secrets Manager secret with a change to the [`SecretStringTemplate`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html#cfn-secretsmanager-secret-generatesecretstring-secretstringtemplate) property, the password (secret string value) is unexpectedly regenerated. This behavior seems unintended because the change is unrelated to the existing password (secret string) generation parameters.
### Expected Behavior
The password (secret string) should only be regenerated when parameters directly tied to secret generation are modified. E.g.; `ExcludeCharacters`, `IncludeSpace`, `PasswordLength`, `GenerateStringKey`, etc.
Updates to [`SecretStringTemplate`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html#cfn-secretsmanager-secret-generatesecretstring-secretstringtemplate) that do not affect the generation logic should leave the existing password (secret string) unchanged.
### Observed Behavior
A new password (secret string) is generated even when making an unrelated update to [`SecretStringTemplate`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html#cfn-secretsmanager-secret-generatesecretstring-secretstringtemplate), such as adding a new JSON key-value pair, without modifying any password (secret string) generation parameters.
### Test Cases
1. Create the secret using:
```yaml
Secret:
Type: AWS::SecretsManager::Secret
Properties:
Name: MySecret
Description: My little secret
GenerateSecretString:
PasswordLength: 20
ExcludeCharacters: '"@/\'
GenerateStringKey: password
SecretStringTemplate: !Sub |
{
"username" : "yves"
}
```
2. Now add a new property to the secret, without touching the password:
```diff
Secret:
Type: AWS::SecretsManager::Secret
Properties:
Name: MySecret
Description: My little secret
GenerateSecretString:
PasswordLength: 20
ExcludeCharacters: '"@/\'
GenerateStringKey: password
SecretStringTemplate: !Sub |
{
"username" : "yves",
+ "meta" : "data"
}
```
A new secret version is created as expected, but a new `password` value has been generated!
### Other Details
My personal use case is to add metadata to an existing secret without altering the password life cycle
Contributor guide
Research direction
The issue names no repository file, test, or entry point. Start by reproducing the supplied CloudFormation example, changing only SecretStringTemplate, and verify whether a new secret version changes the generated password; done means unrelated template updates preserve the existing password while still applying the metadata change.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 30/100