aws-redshift-alpha: User DatabaseSecret created without masterarn in Secret Text causing multi-user secret rotation to fail
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Multi-User Secret Rotation on Redshift User Secret does not work without a `masterarn` field present in Redshift User Secret serialized JSON text.
The User Construct does not plumb in the Cluster's secret (i.e. the master secret) to the DatabaseSecret in the User constructor.
A [similar change](https://github.com/aws/aws-cdk/commit/a9e5b609b20eff9edaf5775cfbe0802177852475#diff-f2da017a5ffcbbdabed063fde26c976af3a2b9734233149af9da5287a2aec903) was applied to RDS's [DatabaseSecret](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_rds.DatabaseSecret.html) and Cluster to enable Multi-User Secret Rotation
### Expected Behavior
After enabling Multi-User Secret Rotation:
```
cluster.addRotationMultiUser(`${id}CredentialsRotation`, {
secret: redshiftUser.secret,
automaticallyAfter: secureProps.rotationPeriod,
});
```
The Redshift User Secret has a `masterarn` so that Multi-User Secret Rotation works
### Current Behavior
The Secret Rotation Lambda fails with
```
2024-01-10T00:23:45.982-08:00
[ERROR] KeyError: 'masterarn'
Traceback (most recent call last):
File "/var/task/lambda_function.py", line 81, in lambda_handler
set_secret(service_client, arn, token)
File "/var/task/lambda_function.py", line 188, in set_secret
admin_arn = current_dict['masterarn']
```
### Reproduction Steps
```
const cluster = // cluster props
const user = return new User(this, 'User', {
cluster: cluster,
databaseName: databaseName,
username: username,
adminUser: cluster.secret,
});
cluster.addRotationMultiUser(`CredentialsRotation`, {
secret: user.secret
});
```
### Possible Solution
- add masterSecret to [Redshift's DatabaseSecret](https://github.com/aws/aws-cdk/blob/v2.122.0/packages/%40aws-cdk/aws-redshift-alpha/lib/database-secret.ts) similar to how it as done in [RDS's DatabaseSecret](https://github.com/aws/aws-cdk/commit/a9e5b609b20eff9edaf5775cfbe0802177852475#diff-f2da017a5ffcbbdabed063fde26c976af3a2b9734233149af9da5287a2aec903)
- When [creating a new Redshift User](https://github.com/aws/aws-cdk/blob/v2.122.0/packages/%40aws-cdk/aws-redshift-alpha/lib/user.ts#L153), plumb in admin user secret `props.adminUser` to DatabaseSecret's new masterSecret prop
### Additional Information/Context
_No response_
### CDK CLI Version
2.70.0
### Framework Version
_No response_
### Node.js Version
18
### OS
AL2
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start with packages/@aws-cdk/aws-redshift-alpha/lib/database-secret.ts and the User constructor in packages/@aws-cdk/aws-redshift-alpha/lib/user.ts around line 153. Trace how adminUser is passed into DatabaseSecret, then verify that the serialized user secret includes masterarn and that multi-user rotation no longer fails with the reported KeyError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100