(aws-glue-alpha): Unable to use secret that has been imported using aws_cdk.Fn.import_value() with glue connection
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
When importing secret using `aws_secretsmanager.Secret.from_secret_complete_arn()` and populating the `secret_complete_arn` with the arn value that has been exported using `CfnOutput` from other stack, it is not possible to use this secret with `aws_glue_alpha.Connection`.
This problem only occurs when you are trying to import secret using the arn from `import_value`, if the arn is harcoded everything works as supposed.
### Expected Behavior
This is the expected behaviour when trying to change `SECRET_ID` with `secret.secret_name` from secret imported with harcoded arn. This also populates the secret name in the console.
CDK change set:
```
[~] AWS::Glue::Connection pipelines/test-pipeline/dev/glue_assets/OracleConnection OracleConnectionXXXXXXXX may be replaced
└─ [~] ConnectionInput (may cause replacement)
└─ [~] .ConnectionProperties:
└─ [~] .SECRET_ID:
└─ @@ -1,13 +1,1 @@
[-] "oldsecret"
[+] "newsecret"
```
### Current Behavior
This is the behaviour when trying to change `SECRET_ID` with `secret.secret_name` from secret imported with aws_cdk.Fn.import_value() arn. This doesn't populate the secret name in console.
CDK change set:
```
[~] AWS::Glue::Connection pipelines/test-pipeline/dev/glue_assets/OracleConnection OracleConnectionXXXXXXXX may be replaced
└─ [~] ConnectionInput (may cause replacement)
└─ [~] .ConnectionProperties:
└─ [~] .SECRET_ID:
└─ @@ -1,13 +1,1 @@
[-] "oldsecret"
[+] {
[+] "Fn::Select": [
[+] 6,
[+] {
[+] "Fn::Split": [
[+] ":",
[+] {
[+] "Fn::ImportValue": "newsecret"
[+] }
[+] ]
[+] }
[+] ]
[+] }
```
### Reproduction Steps
Create secret in a Stack and export it using `CfnOutput`
```
secret = sm.Secret(
self,
TestSecret
secret_name="newsecret",
)
CfnOutput(
self,
"SecretOutput",
value=secret.secret_full_arn,
export_name="newsecret"
)
```
import value in other Stack using `aws_cdk.Fn.import_value()' and create a connection
```
secret_value = aws_cdk.Fn.import_value("newsecret")
glue_alpha.Connection(
self,
id,
connection_name=connection_name,
type=glue_alpha.ConnectionType.JDBC,
subnet=subnet,
security_groups=security_groups,
properties={
"JDBC_CONNECTION_URL": connection_url,
"SECRET_ID": secret_value.secret_name,
},
)
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.138.0
### Framework Version
_No response_
### Node.js Version
20.11.0
### OS
MacOS
### Language
Python
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start from aws_glue_alpha.Connection and aws_secretsmanager.Secret.from_secret_complete_arn(), then reproduce the synthesized change set using Fn.import_value() versus a hardcoded ARN. Trace how secret_name becomes ConnectionProperties.SECRET_ID; done means the imported ARN produces the same secret-name value and console behavior as the hardcoded ARN.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, data-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100