Skip to content

fix(aws-rds): addProxy can use kms encrypted secrets#28848

Closed
scub wants to merge 1 commit intoaws:mainfrom
scub:aws-rds/kms-proxy-secrets
Closed

fix(aws-rds): addProxy can use kms encrypted secrets#28848
scub wants to merge 1 commit intoaws:mainfrom
scub:aws-rds/kms-proxy-secrets

Conversation

@scub
Copy link
Copy Markdown
Contributor

@scub scub commented Jan 24, 2024

When creating an RDS proxy if the Secrets Manager secret that holds the Credentials is encrypted with a KMS key and registered ProxyTarget(s) will fail to connect as they lack access to kms:Decrypt using the encrypted key.

When this occurs the following can be observed in the DatabaseProxy logs but only when debugLogging is set true.

Credentials couldn't be retrieved. The IAM role "arn:aws:iam:::role/ProxyIAMRole2FE8AB0F" is not authorized to read the AWS Secrets Manager secret with the ARN "arn:aws:secretsmanager:::secret:SecretA720EF05"

Closes #28847

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@github-actions github-actions bot added beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK bug This issue is a bug. p2 labels Jan 24, 2024
@aws-cdk-automation aws-cdk-automation requested a review from a team January 24, 2024 21:51
@scub scub mentioned this pull request Jan 24, 2024
Closed
@scub scub changed the title fix(aws-rds): addProxy can use kms encrypted secrets fix(aws-rds): addProxy unable to use kms encrypted secrets Jan 24, 2024
@scub scub changed the title fix(aws-rds): addProxy unable to use kms encrypted secrets fix(aws-rds): addProxy can use kms encrypted secrets Jan 24, 2024
aws-cdk-automation
aws-cdk-automation requested changes Jan 24, 2024
View reviewed changes
Copy link
Copy Markdown
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@scub scub closed this Jan 24, 2024
@aws-cdk-automation
Copy link
Copy Markdown
Collaborator

aws-cdk-automation commented Jan 24, 2024

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.
❌ The title of the pull request should omit 'aws-' from the name of modified packages. Use 'rds' instead of 'aws-rds'.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

@aws-cdk-automation
Copy link
Copy Markdown
Collaborator

aws-cdk-automation commented Jan 24, 2024

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 304aac0
  • Result: FAILED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@github-actions github-actions bot mentioned this pull request Feb 1, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aws-cdk-automation aws-cdk-automation aws-cdk-automation requested changes

Assignees

No one assigned

Labels

beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK bug This issue is a bug. p2

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

(rds): DatabaseProxy does not support Secrets Manager Secrets that have been encrypted with a KMS key

2 participants

@scub @aws-cdk-automation