Skip to content

AWS/ParameterStore Provider: Ability to add a path prefix to a SecretStore #1649

@alanraison

Description

@alanraison

Describe the solution you'd like
Add a parameter which would automatically add a prefix to the paths of requested secrets in Parameter Store.

What is the added value?
This would allow easier portability of manifests, which look for secrets in paths, between environments using the same AWS account. For example, one SecretStore could be configured to provide secrets from parameters with the prefix /dev/my-app and another could be configured to provide them from /test/my-app and then ExternalSecrets could be configured to look for db-password and just change the SecretStore in which the value is being looked up.

Give us examples of the outcome

For the above example, assuming ParameterStore SecureString values in /dev/my-app/db-password and /test/my-app/db-password;

Dev SecretStore:

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: dev-secrets
spec:
  provider:
    aws:
      service: ParameterStore
      region: eu-west-2
      role: arn:aws:iam::####
      prefix: /dev/my-app/

Test SecretStore:

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: test-secrets
spec:
  provider:
    aws:
      service: ParameterStore
      region: eu-west-2
      role: arn:aws:iam::####
      prefix: /test/my-app/

ExternalSecret:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: secrets
spec:
  secretStoreRef:
    name: dev-secrets # or test-secrets
    kind: SecretStore
  data:
    - secretKey: dbPassword
      remoteRef:
        key: dbPassword # automatically prefixes with /dev/my-app/

Observations (Constraints, Context, etc):

I don't have experience of Secrets Manager, so not sure whether this would be useful for that provider.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions