(aws-secretsmanager): grant read fails when secret is fetched using fromSecretNamev2
See original GitHub issueWhat is the problem?
I have manually created a secret named “SECRET-NAME” in SecretsManager and need to request it in one of my stacks, I’m doing it like so:
secret = SMSecret.from_secret_name_v2(
self, "Secret", "SECRET-NAME"
)
When I grant read access to a role like so:
secret.grant_read(role)
It generates the wrong access:
[ ] {
[ ] "Action": [
[+] "secretsmanager:GetSecretValue",
[+] "secretsmanager:DescribeSecret"
[+] ],
[+] "Effect": "Allow",
[+] "Resource": {
[+] "Fn::Join": [
[+] "",
[+] [
[+] "arn:",
[+] {
[+] "Ref": "AWS::Partition"
[+] },
[+] ":secretsmanager:eu-central-1:726654634199:secret:SECRET-NAME-??????"
[+] ]
[+] ]
[+] }
[+] },
Reproduction Steps
Create a manual secret without the secretsmanager added suffix and request it from within your code.
What did you expect to happen?
I would have expected my role to have read access to the role
What actually happened?
A non-existing ARN was used as the secret ARN in the policy
CDK CLI Version
2.0.0-rc.33
Framework Version
No response
Node.js Version
14.16.0
OS
Arch Linux
Language
Python
Language Version
Python 3.9.9
Other information
No response
Issue Analytics
- State:
- Created 2 years ago
- Reactions:2
- Comments:19 (11 by maintainers)
Top Results From Across the Web
Resolve Secrets Manager secret access errors after updating ...
I attempted to retrieve or access an AWS Secrets Manager secret, and received an error similar to one of the following:.
Read more >aws-cdk/aws-secretsmanager module - AWS Documentation
If it set to RETAIN , that removing a secret will fail. Grant permission to use the secret to a role. You must...
Read more >Troubleshoot issues related to Secrets Manager secrets in ECS
AccessDenied error on Amazon Elastic Compute Cloud (Amazon EC2). The task is unable to retrieve secrets from Secrets Manager and fails. Short ...
Read more >Troubleshooting AWS Secrets Manager
An administrator must grant permissions by attaching an IAM policy to your ... Secrets Manager constructs an ARN for a secret with Region,...
Read more >class Secret (construct) · AWS CDK
NET, Amazon.CDK.AWS.SecretsManager.Secret ... Creates a new secret in AWS SecretsManager. ... Grants reading the secret value to some role.
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
I’ll try to reproduce this next week at some point. Thanks for the find @CarsonF
Here’s the doc that explains it