[custom-resources] Allow passing a Secret value as a parameter to AwsCustomResource #9815
Description
It would be convenient to be able to pass a secret {{resolve}} token as a parameter to the AwsCustomResource class and have it resolved at runtime to the actual secret value.
Use Case
I created a custom resource that looked like this:
const systemUser = new cognito.CfnUserPoolUser(this, "CognitoSystemUser", {
username: 'myUser',
userPoolId: 'myUserPoolId',
});
const cognitoUserSecret = new secrets.Secret(this, "CognitoSystemUserSecret", {
secretName: `auth/internal/MySystemUser`,
generateSecretString: {
secretStringTemplate: JSON.stringify({
Username: user.username,
UserPoolId: user.userPoolId,
ClientId: 'myclientid',
}),
generateStringKey: "Password",
},
});
const customResource = new cr.AwsCustomResource(this, "CognitoSystemUserPasswordSetter", {
onCreate: {
service: "CognitoIdentityServiceProvider",
action: "adminSetUserPassword",
parameters: {
Username: systemUser.username,
UserPoolId: systemUser.userPoolId,
Password: cognitoUserSecret.secretValueFromJson("Password").toString(),
Permanent: true,
},
physicalResourceId: cr.PhysicalResourceId.of(`${systemUser.username}-password-confirmation`),
},
policy: cr.AwsCustomResourcePolicy.fromStatements([
new iam.PolicyStatement({
sid: "AllowSetPasswordForUser",
effect: iam.Effect.ALLOW,
actions: ["cognito-idp:AdminSetUserPassword"],
resources: [
cdk.Arn.format(
{
region: "us-west-2",
service: "cognito-idp",
resource: "userpool",
sep: "/",
resourceName: systemUser.userPoolId,
},
this,
),
],
}),
]),
});
cognitoUserSecret.grantRead(customResource);This almost works, but it does not actually resolve the password to its value in Secrets Manager. In my case, it set the actual password to the literal string {{resolve:secretsmanager:arn:aws:secretsmanager:us-west-2:123456789:secret:auth/internal/MySystemUser-ABCDEF:SecretString:Password::}}.
Proposed Solution
It would be great if the custom resource code looked for {{resolve:secretsmanager}}-style references in the parameters passed to AwsCustomResource and resolved them to their underlying value.
Other
- 👋 I may be able to implement this feature request
-
⚠️ This feature might incur a breaking change
This is a 🚀 Feature Request