Inject value from hierarchical JSON key stored in Secrets Manager
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
I want to inject a secret from a specific json-key in a json document stored in SecretsManager.
**Which service(s) is this request for?**
Secrets Manager + ECS (Fargate)
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We have a JSON document stored in Secrets Manager:
```json
{
"key1" : {
"secret1": "secret-value-1",
"secret2": "secret-value-2",
},
"key2" : {
"secret1": "secret-value-3",
"secret2": "secret-value-4",
}
}
```
We are using CDK (C#) to create ECS Fargate containers with injected secrets using:
```csharp
var secret = Secret.FromSecretNameV2(stack, "construct-id", "secret-id");
var ecsSecret = Secret.FromSecretsManager(secret, "key2.secret1");
```
However, when we try to inject that into the containers secrets, the ECS container gives the error:
`unable to retrieve secret from asm: service call has been retried 1 time(s): retrieved secret from Secrets Manager did not contain json key key2.secret1`
**Are you currently working around this issue?**
We are currently having to store a hierarchical JSON document flattened as key/value pairs.
Contributor guide
Research direction
Review the Secrets Manager and ECS Fargate behavior described in the issue, then inspect the CDK C# Secret.FromSecretsManager entry point and AWS service documentation for supported JSON-key syntax. Reproduce the key2.secret1 case and compare it with the flattened workaround; done means a hierarchical JSON value can be injected into the container successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, csharp
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100