aws / aws/aws-cdk

aws-redshift-alpha: User DatabaseSecret created without masterarn in Secret Text causing multi-user secret rotation to fail

Open
#28,852 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-redshift bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Multi-User Secret Rotation on Redshift User Secret does not work without a `masterarn` field present in Redshift User Secret serialized JSON text.

The User Construct does not plumb in the Cluster's secret (i.e. the master secret) to the DatabaseSecret in the User constructor.

A [similar change](https://github.com/aws/aws-cdk/commit/a9e5b609b20eff9edaf5775cfbe0802177852475#diff-f2da017a5ffcbbdabed063fde26c976af3a2b9734233149af9da5287a2aec903) was applied to RDS's [DatabaseSecret](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_rds.DatabaseSecret.html) and Cluster to enable Multi-User Secret Rotation

### Expected Behavior

After enabling Multi-User Secret Rotation:
```
cluster.addRotationMultiUser(`${id}CredentialsRotation`, {
secret: redshiftUser.secret,
automaticallyAfter: secureProps.rotationPeriod,
});
```

The Redshift User Secret has a `masterarn` so that Multi-User Secret Rotation works

### Current Behavior

The Secret Rotation Lambda fails with

```
2024-01-10T00:23:45.982-08:00
[ERROR] KeyError: 'masterarn'
Traceback (most recent call last):
File "/var/task/lambda_function.py", line 81, in lambda_handler
set_secret(service_client, arn, token)
File "/var/task/lambda_function.py", line 188, in set_secret
admin_arn = current_dict['masterarn']
```

### Reproduction Steps

```
const cluster = // cluster props

const user = return new User(this, 'User', {
cluster: cluster,
databaseName: databaseName,
username: username,
adminUser: cluster.secret,
});

cluster.addRotationMultiUser(`CredentialsRotation`, {
secret: user.secret
});
```

### Possible Solution

- add masterSecret to [Redshift's DatabaseSecret](https://github.com/aws/aws-cdk/blob/v2.122.0/packages/%40aws-cdk/aws-redshift-alpha/lib/database-secret.ts) similar to how it as done in [RDS's DatabaseSecret](https://github.com/aws/aws-cdk/commit/a9e5b609b20eff9edaf5775cfbe0802177852475#diff-f2da017a5ffcbbdabed063fde26c976af3a2b9734233149af9da5287a2aec903)
- When [creating a new Redshift User](https://github.com/aws/aws-cdk/blob/v2.122.0/packages/%40aws-cdk/aws-redshift-alpha/lib/user.ts#L153), plumb in admin user secret `props.adminUser` to DatabaseSecret's new masterSecret prop

### Additional Information/Context

_No response_

### CDK CLI Version

2.70.0

### Framework Version

_No response_

### Node.js Version

18

### OS

AL2

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with packages/@aws-cdk/aws-redshift-alpha/lib/database-secret.ts and the User constructor in packages/@aws-cdk/aws-redshift-alpha/lib/user.ts around line 153. Trace how adminUser is passed into DatabaseSecret, then verify that the serialized user secret includes masterarn and that multi-user rotation no longer fails with the reported KeyError.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.