Describe the bug
After our rotator lambda ran, we discovered that the username in the secret had been change to add a _clone suffix.
❯ aws secretsmanager list-secret-version-ids --region="$AWS_REGION" --secret-id="ColdStorageWriter"
{
"Versions": [
{
"VersionId": "6a00bb61-5e22-4cb4-ab46-eb6b78402d05",
"VersionStages": [
"AWSCURRENT",
"AWSPENDING"
],
"LastAccessedDate": "2022-06-09T17:00:00-07:00",
"CreatedDate": "2022-06-08T15:12:32.509000-07:00",
"KmsKeyIds": [
"redacted"
]
},
{
"VersionId": "ec55412e-18ee-46ce-8aa5-e5199b2ece1e",
"VersionStages": [
"AWSPREVIOUS"
],
"LastAccessedDate": "2022-06-07T17:00:00-07:00",
"CreatedDate": "2022-05-09T13:31:13.330000-07:00",
"KmsKeyIds": [
"redacted"
]
}
],
"ARN": "redacted",
"Name": "ColdStorageWriter"
}
❯ aws secretsmanager get-secret-value --region="$AWS_REGION" --secret-id="ColdStorageWriter" --version-id="ec55412e-18ee-46ce-8aa5-e5199b2ece1e"
{
"ARN": "arn:aws:secretsmanager:us-west-2:514308641592:secret:ColdStorageWriter-rZPWY6",
"Name": "ColdStorageWriter",
"VersionId": "ec55412e-18ee-46ce-8aa5-e5199b2ece1e",
"SecretString": "{\"password\":\"redacted\",\"masterarn\":\"redacted did not change",\"username\":\"cold_storage_writer\",\"host\":\"redacted\",\"engine\":\"postgres\",\"proxyHost\":\"redacted\"}",
"VersionStages": [
"AWSPREVIOUS"
],
"CreatedDate": "2022-05-09T13:31:13.330000-07:00"
}
❯ aws secretsmanager get-secret-value --region="$AWS_REGION" --secret-id="ColdStorageWriter"
{
"ARN": "arn:aws:secretsmanager:us-west-2:514308641592:secret:ColdStorageWriter-rZPWY6",
"Name": "ColdStorageWriter",
"VersionId": "6a00bb61-5e22-4cb4-ab46-eb6b78402d05",
"SecretString": "{\"password\": \"redacted", \"masterarn\": \"redacted\", \"username\": \"cold_storage_writer_clone\", \"host\": \"redacted\", \"engine\": \"postgres\", \"proxyHost\": \"redacted\"}",
"VersionStages": [
"AWSCURRENT",
"AWSPENDING"
],
"CreatedDate": "2022-06-08T15:12:32.509000-07:00"
}
Expected Behavior
The rotator should rotate the password without completely undocumented side-effects like, for example, changing the username.
Current Behavior
Our users with addRotationMultiUser() are getting their usernames changed.
Reproduction Steps
import { Aurora } from '@time-loop/cdk-aurora';
import { App, aws_ec2, aws_kms, Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { Namer } from 'multi-convention-namer';
export class AuroraDemoStack extends Stack {
constructor(scope: Construct, props: StackProps) {
const id = new Namer(['aurora', 'demo']);
super(scope, id.pascal, props);
const vpc = aws_ec2.Vpc.fromLookup(this, 'Vpc', {
isDefault: true,
});
const kmsKey = new aws_kms.Key(this, 'Key', {
description: `${id.pascal} encryption key`,
});
const a = new Aurora(this, id, {
defaultDatabaseName: 'demo',
instances: 1, // It's just a demo
kmsKey,
vpc,
});
}
}
// for development, use account/region from cdk cli
const devEnv = {
account: process.env.CDK_DEFAULT_ACCOUNT,
region: process.env.CDK_DEFAULT_REGION,
};
const app = new App();
new AuroraDemoStack(app, { env: devEnv });
app.synth();
Possible Solution
I think that the decision to SAM in the rotator functions has been a mess. These rotator functions should be rewritten in TypeScript and inlined into the code and actually managed.
Related issues
Additional Information/Context
No response
CDK CLI Version
2.27.0 (build 8e89048)
Framework Version
2.27.0
Node.js Version
v16.13.1
OS
Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:29 PDT 2022; root:xnu-8020.121.3~4/RELEASE_ARM64_T8101 arm64
Language
Typescript
Language Version
4.7.3
Other information
No response
Describe the bug
After our rotator lambda ran, we discovered that the username in the secret had been change to add a
_clonesuffix.Expected Behavior
The rotator should rotate the password without completely undocumented side-effects like, for example, changing the username.
Current Behavior
Our users with
addRotationMultiUser()are getting their usernames changed.Reproduction Steps
import { Aurora } from '@time-loop/cdk-aurora';
import { App, aws_ec2, aws_kms, Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { Namer } from 'multi-convention-namer';
export class AuroraDemoStack extends Stack {
constructor(scope: Construct, props: StackProps) {
const id = new Namer(['aurora', 'demo']);
super(scope, id.pascal, props);
}
}
// for development, use account/region from cdk cli
const devEnv = {
account: process.env.CDK_DEFAULT_ACCOUNT,
region: process.env.CDK_DEFAULT_REGION,
};
const app = new App();
new AuroraDemoStack(app, { env: devEnv });
app.synth();
Possible Solution
I think that the decision to SAM in the rotator functions has been a mess. These rotator functions should be rewritten in TypeScript and inlined into the code and actually managed.
Related issues
Additional Information/Context
No response
CDK CLI Version
2.27.0 (build 8e89048)
Framework Version
2.27.0
Node.js Version
v16.13.1
OS
Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:29 PDT 2022; root:xnu-8020.121.3~4/RELEASE_ARM64_T8101 arm64
Language
Typescript
Language Version
4.7.3
Other information
No response