aws-secretsmanager: secret string regenerated when non-generated values change
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Apologies if deemed a feature request rather than a bug.
Creating a new Secret, with the `generateSecretString` prop, successfully generates the string. But if I make a change to any of the non-generated items in `secretStringTemplate` section, the secret is regenerated.
### Expected Behavior
Changing the value of a non-generated key in the secret JSON (such as hostname or port) should not regenerate the generated value. Or at least there should be an option to specify whether we want the generated value to be regenerated at such a change.
### Current Behavior
The password is regenerated.
### Reproduction Steps
First, generate a secret using the following.
```ts
new Secret(this.parent, "mysecret", {
secretName: "secretName",
generateSecretString: {
secretStringTemplate: JSON.stringify({
address: "address1",
database: "database",
port: "1234",
username: "userName",
}),
generateStringKey: "password",
excludePunctuation: true,
includeSpace: false,
excludeCharacters: "'\\/",
}
}
```
Then, change the `address` field to `"address2"` and deploy.
### Possible Solution
Additional option in [SecretStringGenerator](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.SecretStringGenerator.html) to specify whether we want the generated value to be regenerated at change-time.
### Additional Information/Context
_No response_
### CDK CLI Version
2.20.0
### Framework Version
_No response_
### Node.js Version
16.14.2
### OS
MacOS / Amazon Linux
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start with the Secret construct's generateSecretString option and the SecretStringGenerator API referenced in the issue. Reproduce the deployment after changing the address in secretStringTemplate, then inspect how that change affects the generated password. Done means non-generated template changes no longer regenerate the generated value, or a documented option controls that behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100