Skip to content

Commit 457aa99

Browse files
feat(core): add methods to SecretValue and aws-secretsmanager Secret to obtain a literal (unresolved by CloudFormation) dynamic reference key (#34397) (#35105)
### Issue # (if applicable) Closes #34397 ### Reason for this change [Dynamic references](https://docs.aws.amazon.com/secretsmanager/latest/userguide/cfn-example_reference-secret.html) allow an AWS Secrets Manager Secret to be retrieved for use in another AWS CloudFormation resource. Currently the key strings for dynamic references must be created using string manipulation, eg ```ts const passwordKey = `${mySecret.secretArn}:SecretString:password`; ``` ### Description of changes The existing static [secretsManager](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/core/lib/secret-value.ts#L98C17-L98C31) function in `aws-cdk-lib/core` includes code to generate a dynamic reference key string. This code was therefore extracted into a new static `cfnDynamicReferenceKey` function to make it available outside the `secretsManager` function. Using this new static function the above code example becomes ```ts const passwordKey = SecretValue.cfnDynamicReferenceKey(mySecret.secretArn, { jsonField: 'password' }); ``` A new instance method `cfnDynamicReferenceKey` was also created in the [Secret](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts#L499) class in `aws-cdk-lib/aws-secretsmanager`, which calls the new static `cfnDynamicReferenceKey` function for the secret that it represents. Using this new instance method the above example becomes ```ts const passwordKey = mySecret.cfnDynamicReferenceKey({ jsonField: 'password' }); ``` ### Description of how you validated changes Unit tests and an integration test. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent f7b5d8c commit 457aa99

File tree

14 files changed

+1011
-3
lines changed

14 files changed

+1011
-3
lines changed

packages/@aws-cdk-testing/framework-integ/test/aws-secretsmanager/test/integ.secret.dynamic-reference-key.js.snapshot/cdk-integ-secrets-dynamic-reference-key.assets.json

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"Resources": {
3+
"SecretA720EF05": {
4+
"Type": "AWS::SecretsManager::Secret",
5+
"Properties": {
6+
"GenerateSecretString": {}
7+
},
8+
"UpdateReplacePolicy": "Delete",
9+
"DeletionPolicy": "Delete"
10+
},
11+
"JSONSecret6FE68AEF": {
12+
"Type": "AWS::SecretsManager::Secret",
13+
"Properties": {
14+
"SecretString": {
15+
"Fn::Join": [
16+
"",
17+
[
18+
"{\"cfnDynamicReferenceKeyWithDefaults\":\"",
19+
{
20+
"Ref": "SecretA720EF05"
21+
},
22+
":SecretString:::\",\"cfnDynamicReferenceKeyWithJsonFieldAndVersionStage\":\"",
23+
{
24+
"Ref": "SecretA720EF05"
25+
},
26+
":SecretString:json-key:version-stage:\",\"cfnDynamicReferenceKeyWithJsonFieldAndVersionId\":\"",
27+
{
28+
"Ref": "SecretA720EF05"
29+
},
30+
":SecretString:json-key::version-id\"}"
31+
]
32+
]
33+
}
34+
},
35+
"UpdateReplacePolicy": "Delete",
36+
"DeletionPolicy": "Delete"
37+
}
38+
},
39+
"Parameters": {
40+
"BootstrapVersion": {
41+
"Type": "AWS::SSM::Parameter::Value<String>",
42+
"Default": "/cdk-bootstrap/hnb659fds/version",
43+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
44+
}
45+
},
46+
"Rules": {
47+
"CheckBootstrapVersion": {
48+
"Assertions": [
49+
{
50+
"Assert": {
51+
"Fn::Not": [
52+
{
53+
"Fn::Contains": [
54+
[
55+
"1",
56+
"2",
57+
"3",
58+
"4",
59+
"5"
60+
],
61+
{
62+
"Ref": "BootstrapVersion"
63+
}
64+
]
65+
}
66+
]
67+
},
68+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
69+
}
70+
]
71+
}
72+
}
73+
}

packages/@aws-cdk-testing/framework-integ/test/aws-secretsmanager/test/integ.secret.dynamic-reference-key.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-secretsmanager/test/integ.secret.dynamic-reference-key.js.snapshot/cdkintegsecretsdynamicreferencekeytestDefaultTestDeployAssert14A59A81.assets.json

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-secretsmanager/test/integ.secret.dynamic-reference-key.js.snapshot/cdkintegsecretsdynamicreferencekeytestDefaultTestDeployAssert14A59A81.template.json

Lines changed: 36 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-secretsmanager/test/integ.secret.dynamic-reference-key.js.snapshot/integ.json

Lines changed: 13 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)