elastic / elastic/apm-aws-lambda

Support secrets manager JSON secrets

Open
#342 4 comments 3 reactions 0 assignees View on GitHub
8.10-candidate aws-λ-extension community enhancement triage
Dominant language
Go
Stars
20
Forks
36
Avg merge
1d 4h
Merged PRs (30d)
3

Description

**Is your feature request related to a problem? Please describe.**
Common way to store secrets in AWS secrets manager is in a JSON format.
However, current implementation supports only plain string value when processing ELASTIC_APM_SECRETS_MANAGER_SECRET_TOKEN_ID environment variable:
https://github.com/elastic/apm-aws-lambda/blob/main/app/aws.go#L70

It may be useful to support json secrets as well.

**Describe the solution you'd like**
We may consider to introduce second level environment variables, like
ELASTIC_APM_SECRETS_MANAGER_SECRET_TOKEN_JSON_FIELD
ELASTIC_APM_SECRETS_MANAGER_API_KEY_JSON_FIELD

If these env variables are set, prior to using secret value, we may attempt to parse string secret value into unstructured JSON map and retrieve token/apikey from map based on provided json field, before this lines:
https://github.com/elastic/apm-aws-lambda/blob/main/app/aws.go#L41
https://github.com/elastic/apm-aws-lambda/blob/main/app/aws.go#L52

**Describe alternatives you've considered**
1. flattening and copying secret value as plain text in the secrets manager - unfortunately it does not work well for our use case.

**Additional context**
Existing doc: https://www.elastic.co/guide/en/apm/lambda/current/aws-lambda-secrets-manager.html

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.