(docdb): Secretrotation can generate Secrets that are not accepted by cloudformation

[markussiebert]

What is the problem?

Changing properties of a deployed DocDB may fail, because the rotated secret contains characters, that cloudformation won't accept (even if they are "accepted" and rotated by the secret rotation).

   1/30 |5:59:20 PM | UPDATE_FAILED        | AWS::DocDB::DBCluster                       | my-beautifull-database/Database (Database123456789) The parameter MasterUserPassword is not a valid password. Only printable ASCII characters besides '/', '@', '"', ' ' may be used. (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterValue; Request ID:  ...)

The password did contain an @

Reproduction Steps

Create a database with CDK and activate secret rotation single user ... after a while and some secret rotations you will maybe find a situation where neither update nor rollback will succeed... because cloudformation won't accept the password.

What did you expect to happen?

Create a database with CDK and activate secret rotation single user ... after a while and some secret rotations you will maybe find a situation where neither update nor rollback will succeed... because cloudformation won't accept the password.

What actually happened?

Cloudformation was not able to update - Rollback failed also

CDK CLI Version

1.121

Framework Version

No response

Node.js Version

12

OS

mac

Language

Typescript

Language Version

No response

Other information

No response

[skinny85]

Hey @markussiebert,

thanks for opening the issue. Would you mind showing your code? CDK excludes the @ character by default from the generate Secret.

Thanks,
Adam

[markussiebert]

The code is on my working machine ... I have no access till monday ...

Yes, the initial secret is fine, but in my opinion the rotation doesn't respect the default excluded charaters.

aws-cdk/packages/@aws-cdk/aws-docdb/lib/cluster.ts

Line 460 in 557f9c3

return new secretsmanager.SecretRotation(this, id, {

maybe it should include also the default or respect the secret defaults?

return new secretsmanager.SecretRotation(this, id, {
      secret: this.secret,
      automaticallyAfter,
      application: DatabaseCluster.SINGLE_USER_ROTATION_APPLICATION,
      excludeCharacters: '"@/',
      vpc: this.vpc,
      vpcSubnets: this.vpcSubnets,
      target: this,
    });

But will provide my code on mondaay

[skinny85]

Oh, that's probably what it is - the rotation Lambda doesn't have the same excludeCharacters as the Secret itself.

[markussiebert]

@skinny85 I've started to implement a fix for this, would like to hear your opinion on this

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.