Secrets Manager - DocumentDB Construct

❓ General Issue

Secret’s value is not passed into a construct for DocumentDB, rather the whole SecretString is passed instead.

The Question

How does one resolve a SecretString from SecretsManager into a construct for DocumentDB? Is this possible?

It passes : {resolve:secretsmanager:arn:aws:secretsmanager:us-east-2:****secret:cdk/docdb-****:SecretString:password::} but not the actual value

Code:

    // Get Secret Values for Username and Password
    const secret = sm.Secret.fromSecretAttributes(this, 'cdk/docdb', {
      secretArn: '',
    });

    const credentials = {
      username : secret.secretValueFromJson('username'),
      password : secret.secretValueFromJson('password') 
    };

.....

  // Create documentdb cluster
    const sfDocCluster = new docdb.CfnDBCluster(
      this,
      "StorefrontDocdbCluster",
      {
        storageEncrypted: true,
        availabilityZones: vpc.availabilityZones.splice(3),
        dbClusterIdentifier: "StorefrontDocdbCluster",
        masterUsername: credentials.username,
        masterUserPassword: credentials.password,
        vpcSecurityGroupIds: [sfSecurityGroup.securityGroupName],
        dbSubnetGroupName: sfSubnetGroup.dbSubnetGroupName,
        dbClusterParameterGroupName: sfDocParamGroup.name,
        port
      }
    );

Console Result:

StorefrontDocdbCluster Property validation failure: 

[Length of value {{{resolve:secretsmanager:arn:aws:secretsmanager:us-east-2:****secret:cdk/docdb-****:SecretString:password::}}} for property {/MasterUserPassword} is greater than maximum allowed length {41}, 

Length of value {{{resolve:secretsmanager:arn:aws:secretsmanager:us-east-2:****:secret:cdk/docdb-****:SecretString:username::}}} for property {/MasterUsername} is greater than maximum allowed length {63}]

Environment

• CDK CLI Version: 1.5
• Module Version:
• OS: OSX Mojave
• Language: TypeScript

Other information

[jogold]

I don’t know, the documentation says:

The secretsmanager dynamic reference can be used in all resource properties.

But apparently there are some bugs here and there.

[jogold]

This is an issue with CloudFormation itself and how it resolves/validates username and password for a AWS::DocDB::DBCluster, see aws-cloudformation/aws-cloudformation-coverage-roadmap#94 and https://forums.aws.amazon.com/thread.jspa?messageID=891456#891456