fix(core): fixes leaking private key password to logs in mongo setup (#…

…28)
aws · Jul 31, 2020 · efd1602 · efd1602
1 parent 84e09fb
commit efd1602
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/serverCertFromSecrets.sh b/packages/aws-rfdk/lib/core/scripts/mongodb/3.6/serverCertFromSecrets.sh
@@ -40,12 +40,14 @@ get_secret_string "${CHAIN_ID}"
 printenv RET_VALUE > ./ca.crt
 get_secret_string "${KEY_ID}" 
 printenv RET_VALUE > ./encrypted_key.pem
+
+# Note: We must get the private key passphrase **LAST**. We use the returned
+# environment variable to securely invoke openssl to decrypt the private key.
 get_secret_string "${KEY_PW_ID}"
-export KEY_PW=$(printenv RET_VALUE)
 
 # Decrypt the private key.
-openssl rsa -in ./encrypted_key.pem -passin env:KEY_PW -out ./decrypted_key.pem
-unset KEY_PW
+openssl rsa -in ./encrypted_key.pem -passin env:RET_VALUE -out ./decrypted_key.pem
+unset RET_VALUE
 
 cat key.crt decrypted_key.pem > key.pem