Skip to content

PuseSecret in AWS SecretManager enforces UUID format #4973

@kalampakas

Description

@kalampakas

Describe the bug
The AWS Secret Manager enforces a UUID and that clashes with secrets created with terraform-aws-provider

To Reproduce
Steps to reproduce the behavior:

  1. Create a secret using the terraform AWS provider - or manually create a secret with a VersionId that's a valid random string
  2. Try to PushSecret using the previously created secret to bump the version and the value

Expected behavior
The secret version in AWS SSM is bumped with a new value.

Screenshots
Instead, we get an error like:
set secret failed: could not write remote ref token to target secretstore external-secrets: expected secret version in AWS SSM to be a UUID but got 'terraform-20250627043834191900000095'

Additional context
The issue is created because

oldVersion, ok := n.SetString(strings.ReplaceAll(*id, "-", ""), 16)
while terraform-aws-provider uses https://pkg.go.dev/github.com/hashicorp/terraform-plugin-sdk/v2@v2.37.0/helper/id#UniqueId for the secret's VersionID . We have a use case where a secret is created in terraform but updated via the operator. We hadn't updated the particular use case to use a latest operator, otherwise we'd notice sooner, but the fact remains that the AWS API doesn't specify a UUID , but rather simply a string - a UUID is just typically used as a semantic version ID - https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html#API_GetSecretValue_RequestSyntax

Metadata

Metadata

Assignees

Labels

kind/bugCategorizes issue or PR as related to a bug.

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions