Skip to content

Commit

Permalink
feat(aws): use region if path is full arn
Browse files Browse the repository at this point in the history
  • Loading branch information
werne2j committed Apr 1, 2023
1 parent ddbd42b commit 6d7ed93
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 1 deletion.
4 changes: 4 additions & 0 deletions docs/backends.md
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,10 @@ documentation](https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specify
supplying AWS credentials. Supported credentials and the order in which they are loaded are
described [here](https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials).

**Note About Region**
If you provide the full AWS ARN as the secret path, ex. `arn:aws:secretsmanager:us-east-1:123123123:secret:some-secret`,
the region from the ARN (us-east-1) in this example, will take precedents over the AWS_REGION environment variable listed below.

These are the parameters for AWS:
```
AVP_TYPE: awssecretsmanager
Expand Down
14 changes: 13 additions & 1 deletion pkg/backends/awssecretsmanager.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"context"
"encoding/json"
"fmt"
"regexp"

"github.com/argoproj-labs/argocd-vault-plugin/pkg/utils"
"github.com/aws/aws-sdk-go-v2/aws"
Expand Down Expand Up @@ -40,10 +41,21 @@ func (a *AWSSecretsManager) Login() error {

// GetSecrets gets secrets from aws secrets manager and returns the formatted data
func (a *AWSSecretsManager) GetSecrets(path string, version string, annotations map[string]string) (map[string]interface{}, error) {
var opts = func(o *secretsmanager.Options) {}

input := &secretsmanager.GetSecretValueInput{
SecretId: aws.String(path),
}

re := regexp.MustCompile(`(?m)^(?:[^:]+:){3}([^:]+).*`)
if re.MatchString(path) {
parts := re.FindStringSubmatch(path)

opts = func(o *secretsmanager.Options) {
o.Region = parts[1]
}
}

if version != "" {
if version == AWS_CURRENT || version == AWS_PREVIOUS {
input.VersionStage = aws.String(version)
Expand All @@ -53,7 +65,7 @@ func (a *AWSSecretsManager) GetSecrets(path string, version string, annotations
}

utils.VerboseToStdErr("AWS Secrets Manager getting secret %s at version %s", path, version)
result, err := a.Client.GetSecretValue(context.TODO(), input)
result, err := a.Client.GetSecretValue(context.TODO(), input, opts)
if err != nil {
return nil, err
}
Expand Down

0 comments on commit 6d7ed93

Please sign in to comment.