aws / aws/aws-cdk

secretName from Secret.fromSecretCompleteArn not parsing correctly

Open
#28,930 6 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-secretsmanager bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

I have created a secret that didn't specify a secret name. When attempting to utilize that arn in another stack, the arn parse on it includes the secret version from the arn, which doesn't work as an id for a secret when attempting to retrieve from the secret sdk.

### Expected Behavior

(Other stack)
const otherStackSecretToken = new Secret(this, 'OtherStackSecretToken', {
generateSecretString: {
secretStringTemplate: JSON.stringify({}),
generateStringKey: 'SAMPLE_TOKEN',
passwordLength: 100,
excludePunctuation: true,
},
encryptionKey: sampleEncryptionKey,
});

console.log(otherStackSecretToken.secretFullArn)
out: arn:aws:secretsmanager:us-east-1::secret:OtherStackSecretToken12345-A4ee0mHKKJlq-yR0gFR

(Current Stack)
const sampleSecret = Secret.fromSecretCompleteArn(this, 'SampleSecret', props.internalTokenArn)

console.log(sampleSecret.secretName)
out: OtherStackSecretToken12345-A4ee0mHKKJlq-yR0gFR

### Current Behavior

(Other stack)
const otherStackSecretToken = new Secret(this, 'OtherStackSecretToken', {
generateSecretString: {
secretStringTemplate: JSON.stringify({}),
generateStringKey: 'SAMPLE_TOKEN',
passwordLength: 100,
excludePunctuation: true,
},
encryptionKey: sampleEncryptionKey,
});

console.log(otherStackSecretToken.secretFullArn)
out: arn:aws:secretsmanager:us-east-1::secret:OtherStackSecretToken12345-A4ee0mHKKJlq-yR0gFR

(Current Stack)
const sampleSecret = Secret.fromSecretCompleteArn(this, 'SampleSecret', props.internalTokenArn)

console.log(sampleSecret.secretName)
out: OtherStackSecretToken12345-A4ee0mHKKJlq-yR0gFR

Issues:
Wont work
get_secret_value_response = client.get_secret_value(
SecretId=OtherStackSecretToken12345-A4ee0mHKKJlq-yR0gFR
)

Works
get_secret_value_response = client.get_secret_value(
SecretId=OtherStackSecretToken12345-A4ee0mHKKJlq
)

### Reproduction Steps

(Other stack)
const otherStackSecretToken = new Secret(this, 'OtherStackSecretToken', {
generateSecretString: {
secretStringTemplate: JSON.stringify({}),
generateStringKey: 'SAMPLE_TOKEN',
passwordLength: 100,
excludePunctuation: true,
},
encryptionKey: sampleEncryptionKey,
});

console.log(otherStackSecretToken.secretFullArn)
out: arn:aws:secretsmanager:us-east-1::secret:OtherStackSecretToken12345-A4ee0mHKKJlq-yR0gFR

(Current Stack)
const sampleSecret = Secret.fromSecretCompleteArn(this, 'SampleSecret', props.internalTokenArn)

console.log(sampleSecret.secretName)
out: OtherStackSecretToken12345-A4ee0mHKKJlq-yR0gFR

### Possible Solution

If multiple "-" exist in the resource name, parse the last one off as this is a version.

### Additional Information/Context

_No response_

### CDK CLI Version

^2.14.0

### Framework Version

_No response_

### Node.js Version

latest

### OS

linux

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating the TypeScript implementation of Secret.fromSecretCompleteArn and reproduce the parsing with the ARN shown in the issue. Verify that secretName excludes the final version suffix and that the resulting name works as the Secrets Manager SecretId; add or update coverage if the surrounding implementation provides tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.