aws / aws/aws-cdk

Deploy ECS ApplicationLoadBalancedFargateService isn't loading Secrets

Open
#20,744 9 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ecs bug documentation good first issue p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

When inejcting secrets to the Secrets object of the `ApplicationLoadBalancedFargateService`'s `taskImageOptions` imported from
`sm.Secret.fromSecretCompleteArn` (including 6 digit hypen), the deploy gets stuck and does not work.

I have also tried importing the secrets by:

`sm.Secret.fromSecretNameV2` and the behaviour is the same.

### Expected Behavior

ECS to deploy with custom secrets

### Current Behavior

CDK deploy freezed stuck at ECS apiService deploy

### Reproduction Steps

```
const importedSecrets = SECRET_NAMES.reduce((acc, key) => {
const secret = sm.Secret.fromSecretCompleteArn(
scope,
`${config.ENVIRONMENT}/${key}`,
secretFullArns[key], // full ARN of the secret identical as AWS
);
return {...acc, [key]: secret};
}, {} as {[key: string]: sm.ISecret});
```
Where `SECRET_NAMES` is an array of secret names
Then,

```
const secretsJson = SECRET_NAMES.reduce(
(acc, key) => ({
...acc,
[key]: ecs.Secret.fromSecretsManager(importedSecrets[key]),
}),
{},
);
```

and then in the fargate service creator:

```
// Fargate service
this.backendService = new ecsPatterns.ApplicationLoadBalancedFargateService(
scope,
'apiService',
{
serviceName: 'apiService',
cluster: this.ecsCluster,
taskSubnets: {
subnetType: ec2.SubnetType.PRIVATE_WITH_NAT,
},
memoryLimitMiB: 2048,
cpu: 1024,
desiredCount: 1,
taskImageOptions: {
containerName: 'apiContainer',
image: ecs.ContainerImage.fromAsset('../api-backend/', {
followSymlinks: SymlinkFollowMode.ALWAYS,
}),
containerPort: config.PORT,
environment: {
NODE_ENV: 'development',
AWS_DEFAULT_REGION: config.AWS_DEFAULT_REGION,
},
logDriver: ecs.LogDrivers.awsLogs({
streamPrefix: `${config.PROJECT_NAME}-logStream`,
logGroup: fargateLog,
}),
secrets: {
DB_BUSINESS_PASSWORD: ecs.Secret.fromSecretsManager(
dbBusinessPasswordSecret,
'password',
),
DB_BUSINESS_HOST: ecs.Secret.fromSecretsManager(
dbBusinessPasswordSecret,
'host',
),

...secretsJson.
// ===========>>> If i comment this line here, the deploy is successfull, but without the secrets i want.

},
},
},
);
```

In the CDK template i see the correct secret name BUT WITHOUT THE HYPHEN

CDK TEMPLATE Secrets from ECS:

```
....
{
"Name": "X_API_KEY",
"ValueFrom": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
"secret-arn-as-it-is-in-aws-console/co****/staging/X_API_KEY"
// The secret arn is exactly equal as it is in aws but without the 6 char hyphen auto-generated when the secret was uploaded.
]
]
}
},
...
```
Parameter name is: `/co****/staging/X_API_KEY`
But in the aws console the arn of the secret is exactly the same as the one in the cdk template but without the hyphen.
Im pretty sure that's the cause of the deploy stuck freeze.

Also,
IAM Permissions from the image task are fine, for example for the secret who's name is:
`/co***/staging/CIPHER_SECRET-??????` where the ? represent the auto hyphen 6 digit

[![Console Synth CDK template][1]][1]

[1]: https://i.stack.imgur.com/sjlxF.png

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

"aws-cdk-lib": "^2.27.0",

### Node.js Version

14.19

### OS

Macos Monterey

### Language

Typescript

### Language Version

"typescript": "^4.7.2"

### Other information

CDK JSON

```
{
"app": "npx ts-node --prefer-ts-exts bin/CdkStarter.ts",
"context": {
"@aws-cdk/aws-apigateway:usagePlanKeyOrderInsensitiveId": true,
"@aws-cdk/aws-rds:lowercaseDbIdentifier": true,
"@aws-cdk/aws-efs:defaultEncryptionAtRest": true,
"@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021": false,
"@aws-cdk/core:stackRelativeExports": false
}
}
```

Contributor guide

Open the contributing guide

Research direction

Start with ApplicationLoadBalancedFargateService taskImageOptions.secrets and the Secret.fromSecretCompleteArn/fromSecretNameV2 paths. Compare the synthesized ECS template's ValueFrom ARN with the imported secret ARN, then reproduce the deployment using the provided TypeScript example. Done means the service deploys successfully while retaining the imported secrets.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.