SplunkLogDriverProps adds splunk-token to logging options instead of secretoptions

[lockan]

Bug Description

When creating a Task Definition and adding a SplunkLogDriver, a token property can be provided. The token is a secret value. In our case, we're providing the token from SecretsManager as a SecretValue per the cdk API spec.

In Cloudformation this would be provided to the Task Definition through secretOptions rather than options, and the secret would be hidden from the user in the ECS Console UI.
(See docs: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html)

When doing the same through CDK, the token is added to the Options property, and so the secret is resolved from Secrets Manager as expected, but then is plainly displayed as a string in the ECS console UI. This can also be confirmed by examining the output cloudformation

Reproduction Steps

Sample CDK code to reproduce the issue:

const splunkSecretArn = "arn:aws:secretsmanager:{region}:{accountno}:secret:{secretsmanagerkey}"

...

this.splunkSecretParam = new cdk.CfnParameter(this,
    'SplunkSecretArn', {
    type: 'String',
    description: "Secret manager ARN for the splunk HEC token",
    default: splunkSecretArn
})

...

this.logDriverConfig = new ecs.SplunkLogDriver({
    url: this.parameters.splunkUrl.valueAsString,
    index: this.parameters.splunkIndex.valueAsString,
    token: cdk.SecretValue.secretsManager(this.splunkSecretParam.valueAsString),
 })

this.fargateContainer = this.fargateTaskDefinition.addContainer("fg-containerdef", {
      image: ecs.ContainerImage.fromEcrRepository(this.ecrRepository, "latest"),
      logging: this.logDriverConfig
})

Error Log

Excerpt from the output cloudformation template after doing cdk synthesize. Notice that the splunk-token appears under Options, not SecretOptions.

...
LogConfiguration:
            LogDriver: splunk
            Options:
              splunk-token:
                'Fn::Join':
                  - ''
                  - - '{{resolve:secretsmanager:'
                    - Ref: ExternalSplunkSecretArn
                    - ':SecretString:::}}'
...

Environment

• CLI Version : aws-cli/2.0.0dev0 Python/3.7.4 Darwin/17.7.0 botocore/2.0.0dev0
• Framework Version: 1.31.0 (build 8f3ac79)
• OS : MacOS High Sierra 10.13.16
• Language : javascript / typescript

Other

---

This is 🐛 Bug Report

[tobli]

I'm thinking that any LogDriver parameter should be able to be passed as a Secret. We have an existing (non-cdk) task-def that specifies both splunk-token and splunk-url using secretOptions, but it should extend to all options, regardless of driver.

Right now it seems like splunk-token is the only option typed as a SecretValue, but I don't think that's right, given that it's the arn of the secret that we want to reference, not the value of the secret.

I'd love to help address this, but I'm not sure what the best design would be. Especially not while preserving backwards compatibility. Allowing any option to be passed as a Secret would be nice, including granting the task execution role read access, just like secret environment variables are handled.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.