aws / aws/aws-cdk

aws-secretsmanager: secret string regenerated when non-generated values change

Open
#19,985 11 comments 9 reactions 0 assignees View on GitHub
@aws-cdk/aws-secretsmanager effort/medium feature-request feature/enhancement p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Apologies if deemed a feature request rather than a bug.

Creating a new Secret, with the `generateSecretString` prop, successfully generates the string. But if I make a change to any of the non-generated items in `secretStringTemplate` section, the secret is regenerated.

### Expected Behavior

Changing the value of a non-generated key in the secret JSON (such as hostname or port) should not regenerate the generated value. Or at least there should be an option to specify whether we want the generated value to be regenerated at such a change.

### Current Behavior

The password is regenerated.

### Reproduction Steps

First, generate a secret using the following.

```ts
new Secret(this.parent, "mysecret", {
secretName: "secretName",
generateSecretString: {
secretStringTemplate: JSON.stringify({
address: "address1",
database: "database",
port: "1234",
username: "userName",
}),
generateStringKey: "password",
excludePunctuation: true,
includeSpace: false,
excludeCharacters: "'\\/",
}
}
```

Then, change the `address` field to `"address2"` and deploy.

### Possible Solution

Additional option in [SecretStringGenerator](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.SecretStringGenerator.html) to specify whether we want the generated value to be regenerated at change-time.

### Additional Information/Context

_No response_

### CDK CLI Version

2.20.0

### Framework Version

_No response_

### Node.js Version

16.14.2

### OS

MacOS / Amazon Linux

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the Secret construct's generateSecretString option and the SecretStringGenerator API referenced in the issue. Reproduce the deployment after changing the address in secretStringTemplate, then inspect how that change affects the generated password. Done means non-generated template changes no longer regenerate the generated value, or a documented option controls that behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.