Creating a Secret with KeyMaterial KeyPair value in secretStringTemplate

❓ General Issue

The Question

Hi !

Don’t know if it’s an issue but I’m creating a KeyPair with a CDK CustomResource & trying to put it in a Secret and I’ve a : Failed to parse SecretStringTemplate as JSON

Only for the KeyMaterial, wich is the Private Key like :

“KeyMaterial”: “-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAoWVCG…”

No pb with the other values, they are correctly insert in the Secret; here the code :

const KeyPair = new CustomResource.AwsCustomResource(...)

new secretsmanager.Secret(... , { ...
    generateSecretString: { ...
        secretStringTemplate: JSON.stringify({
          KeyMaterial: KeyPair.getResponseField('KeyMaterial'),
          KeyName: KeyPair.getResponseField('KeyName'),
          KeyPairId: KeyPair.getResponseField('KeyPairId'),
          KeyFingerprint: KeyPair.getResponseField('KeyFingerprint')
        }),

When I put (or not) the key in plaintext string in KeyMaterial: , it’s working.

Any ideas ?

Environment

• CDK CLI Version: CDK Version: 1.35.0 (build e0810c8)
• OS: all
• Language: TypeScript

Other information

[njlynch]

Ah, now I see. You’re calling the “callback” versions of the SDK functions, which aren’t guaranteed to return prior to you returning from the function. Try this:

        case "Create":
            const keyPair = await ec2.createKeyPair(params).promise();
            responseData['PrivateKey'] = keyPair.KeyMaterial.replace(/\n/g, '\\n');
            responseData['KeyName'] = keyPair.KeyName;
            responseData['KeyPairId'] = keyPair.KeyPairId;
            responseData['KeyFingerprint'] = keyPair.KeyFingerprint;
            respond('SUCCESS','Create OK');
            return {
                PhysicalResourceId: id,
                Data: responseData
            };

Also, make sure your Lambda role has appropriate IAM policies to allow it to create key pairs.

[Cloudrage]

Perfect, it’s working now 😃 Thanks again for your help @njlynch !

I’ve created a similar mecanism few years ago with Sceptre but in Python; now using CDK with TypeScript, let’s say it’s quite different ^^ I was at 2 fingers to reuse the Python code 😉