Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(secretsmanager): adds grantWrite to Secret #7858

Merged
merged 8 commits into from
May 21, 2020
Merged

feat(secretsmanager): adds grantWrite to Secret #7858

merged 8 commits into from
May 21, 2020

Conversation

ddneilson
Copy link
Contributor

Commit Message

feat(secretsmanager): adds grantWrite to Secret

End Commit Message

Implements: #7682

Testing

I deployed the following:

#!/usr/bin/env node

import * as cdk from '@aws-cdk/core';
import * as kms from '@aws-cdk/aws-kms';
import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
import * as ec2 from '@aws-cdk/aws-ec2';

const app = new cdk.App();

const stack = new cdk.Stack(app, 'Stack', {});
const key = new kms.Key(stack, 'KMS');
const secret = new secretsmanager.Secret(stack, 'Secret', { encryptionKey: key });
const secret2 = new secretsmanager.Secret(stack, 'Secret2', {});

const vpc = ec2.Vpc.fromVpcAttributes(stack, 'Vpc', {
    vpcId: "vpc-XXXX",
    availabilityZones: [ "us-west-2a" ],
    publicSubnetIds: [ "subnet-XXXX" ],
});
const instance = new ec2.BastionHostLinux(stack, 'Bastion', { 
    vpc: vpc
});
secret.grantRead(instance);
secret.grantWrite(instance);
secret2.grantRead(instance);
secret2.grantWrite(instance);

app.synth();

Then, once the stack is deployed I used ssm to connect to the bastion and ran:

for secret in <secret name 1> <secret name 2>
do
	aws --region us-west-2 secretsmanager put-secret-value --secret-id ${secret} --secret-string "FooValue"
	aws --region us-west-2 secretsmanager get-secret-value --secret-id ${secret}
done

Finally, I verified the contents of the two secrets in the SecretsManager console.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
  • Commit ID: a205831
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
  • Commit ID: 2911821
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@ddneilson
Copy link
Contributor Author

@skinny85 Ready for review whenever you are.

skinny85
skinny85 previously requested changes May 19, 2020
View reviewed changes
Copy link
Contributor

@skinny85 skinny85 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome contribution @ddneilson , thanks so much!

Minor comments, mainly on documentation and test. But this is great!

packages/@aws-cdk/aws-secretsmanager/README.md Outdated Show resolved Hide resolved
packages/@aws-cdk/aws-secretsmanager/README.md Outdated Show resolved Hide resolved
packages/@aws-cdk/aws-secretsmanager/README.md Outdated Show resolved Hide resolved
packages/@aws-cdk/aws-secretsmanager/lib/secret.ts Outdated Show resolved Hide resolved
packages/@aws-cdk/aws-secretsmanager/test/test.secret.ts Outdated Show resolved Hide resolved
@ddneilson ddneilson force-pushed the add_secret_grantwrite branch from 2911821 to d77517b Compare May 20, 2020 05:03
@mergify mergify bot dismissed skinny85’s stale review May 20, 2020 05:03

Pull request has been modified.

@ddneilson
Copy link
Contributor Author

@skinny85 Ready for round 2 when you are.

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
  • Commit ID: d77517b
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
  • Commit ID: 9337a79
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

skinny85
skinny85 approved these changes May 20, 2020
View reviewed changes
Copy link
Contributor

@skinny85 skinny85 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, thanks for the contribution @ddneilson !

@mergify
Copy link
Contributor

mergify bot commented May 20, 2020

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
  • Commit ID: 93cb951
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify
Copy link
Contributor

mergify bot commented May 20, 2020

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
  • Commit ID: aae9142
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify
Copy link
Contributor

mergify bot commented May 20, 2020

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
  • Commit ID: c840887
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify
Copy link
Contributor

mergify bot commented May 20, 2020

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
  • Commit ID: 3a00725
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify
Copy link
Contributor

mergify bot commented May 21, 2020

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot merged commit 3fed84b into aws:master May 21, 2020
@ddneilson ddneilson deleted the add_secret_grantwrite branch May 21, 2020 02:08
karupanerura pushed a commit to karupanerura/aws-cdk that referenced this pull request May 22, 2020
@ddneilson @karupanerura
feat(secretsmanager): adds grantWrite to Secret (aws#7858)
ade8f85 
### Commit Message
feat(secretsmanager): adds grantWrite to Secret
### End Commit Message

Implements: aws#7682

#### Testing

I deployed the following:
```
#!/usr/bin/env node

import * as cdk from '@aws-cdk/core';
import * as kms from '@aws-cdk/aws-kms';
import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
import * as ec2 from '@aws-cdk/aws-ec2';

const app = new cdk.App();

const stack = new cdk.Stack(app, 'Stack', {});
const key = new kms.Key(stack, 'KMS');
const secret = new secretsmanager.Secret(stack, 'Secret', { encryptionKey: key });
const secret2 = new secretsmanager.Secret(stack, 'Secret2', {});

const vpc = ec2.Vpc.fromVpcAttributes(stack, 'Vpc', {
    vpcId: "vpc-XXXX",
    availabilityZones: [ "us-west-2a" ],
    publicSubnetIds: [ "subnet-XXXX" ],
});
const instance = new ec2.BastionHostLinux(stack, 'Bastion', { 
    vpc: vpc
});
secret.grantRead(instance);
secret.grantWrite(instance);
secret2.grantRead(instance);
secret2.grantWrite(instance);

app.synth();
```

Then, once the stack is deployed I used ssm to connect to the bastion and ran:
```
for secret in <secret name 1> <secret name 2>
do
	aws --region us-west-2 secretsmanager put-secret-value --secret-id ${secret} --secret-string "FooValue"
	aws --region us-west-2 secretsmanager get-secret-value --secret-id ${secret}
done
```

Finally, I verified the contents of the two secrets in the SecretsManager console.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@skinny85 skinny85 mentioned this pull request May 30, 2020
Closed
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@skinny85 skinny85 skinny85 approved these changes

Assignees

@skinny85 skinny85

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@ddneilson @aws-cdk-automation @skinny85