aws / aws/aws-cdk

(aws-glue-alpha): Unable to use secret that has been imported using aws_cdk.Fn.import_value() with glue connection

Open
#30,291 2 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-glue bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When importing secret using `aws_secretsmanager.Secret.from_secret_complete_arn()` and populating the `secret_complete_arn` with the arn value that has been exported using `CfnOutput` from other stack, it is not possible to use this secret with `aws_glue_alpha.Connection`.

This problem only occurs when you are trying to import secret using the arn from `import_value`, if the arn is harcoded everything works as supposed.

### Expected Behavior

This is the expected behaviour when trying to change `SECRET_ID` with `secret.secret_name` from secret imported with harcoded arn. This also populates the secret name in the console.

CDK change set:

```
[~] AWS::Glue::Connection pipelines/test-pipeline/dev/glue_assets/OracleConnection OracleConnectionXXXXXXXX may be replaced
└─ [~] ConnectionInput (may cause replacement)
└─ [~] .ConnectionProperties:
└─ [~] .SECRET_ID:
└─ @@ -1,13 +1,1 @@
[-] "oldsecret"
[+] "newsecret"

```

### Current Behavior

This is the behaviour when trying to change `SECRET_ID` with `secret.secret_name` from secret imported with aws_cdk.Fn.import_value() arn. This doesn't populate the secret name in console.

CDK change set:

```
[~] AWS::Glue::Connection pipelines/test-pipeline/dev/glue_assets/OracleConnection OracleConnectionXXXXXXXX may be replaced
└─ [~] ConnectionInput (may cause replacement)
└─ [~] .ConnectionProperties:
└─ [~] .SECRET_ID:
└─ @@ -1,13 +1,1 @@
[-] "oldsecret"
[+] {
[+] "Fn::Select": [
[+] 6,
[+] {
[+] "Fn::Split": [
[+] ":",
[+] {
[+] "Fn::ImportValue": "newsecret"
[+] }
[+] ]
[+] }
[+] ]
[+] }
```

### Reproduction Steps

Create secret in a Stack and export it using `CfnOutput`

```
secret = sm.Secret(
self,
TestSecret
secret_name="newsecret",
)

CfnOutput(
self,
"SecretOutput",
value=secret.secret_full_arn,
export_name="newsecret"
)
```

import value in other Stack using `aws_cdk.Fn.import_value()' and create a connection

```
secret_value = aws_cdk.Fn.import_value("newsecret")

glue_alpha.Connection(
self,
id,
connection_name=connection_name,
type=glue_alpha.ConnectionType.JDBC,
subnet=subnet,
security_groups=security_groups,
properties={
"JDBC_CONNECTION_URL": connection_url,
"SECRET_ID": secret_value.secret_name,
},
)

```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.138.0

### Framework Version

_No response_

### Node.js Version

20.11.0

### OS

MacOS

### Language

Python

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start from aws_glue_alpha.Connection and aws_secretsmanager.Secret.from_secret_complete_arn(), then reproduce the synthesized change set using Fn.import_value() versus a hardcoded ARN. Trace how secret_name becomes ConnectionProperties.SECRET_ID; done means the imported ARN produces the same secret-name value and console behavior as the hardcoded ARN.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, data-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.