Try to retrieve secure string from parameter store

[jurado75]

Hi EveryOne

I am trying to following this tutorial https://aws.amazon.com/blogs/developer/net-core-configuration-provider-for-aws-systems-manager/ but i am trying to using secure string instead string then i am facing issue 'cause is not working

[ashishdhingra]

Hi @jurado75,

Good afternoon.

I'm unsure what you are doing wrong, unfortunately, I'm unable to reproduce the issue.

Reproduction Steps:

• Created parameter /myapplication/ConnectionStrings/DefaultConnection of Type SecureString and value Server=myServerName\myInstanceName;Database=myDataBase;User Id=myUsername;Password=myPassword;. The parameter is secured using KMS Key ID value alias/aws/ssm (default for current AWS account).
• Created ASP.NET Core Web application targeting .NET 6.0.
  • Added reference to NuGet package Amazon.Extensions.Configuration.SystemsManager version 5.0.2.
  • Modified Program.cs to add below line before var app = builder.Build():

builder.Configuration.AddSystemsManager("/myapplication")

• Modified Pages\Index.cshtml.cs as below:

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.RazorPages;

namespace TestParameterStoreAspNet.Pages
{
    public class IndexModel : PageModel
    {
        private readonly ILogger<IndexModel> _logger;
        private readonly IConfiguration Configuration;

        public IndexModel(ILogger<IndexModel> logger, IConfiguration configuration)
        {
            _logger = logger;
            Configuration = configuration;
        }

        public ContentResult OnGet()
        {
            var defaultConnectionString = Configuration["ConnectionStrings:DefaultConnection"];
            return Content(defaultConnectionString);
        }
    }
}

• Ensure that the default credentials profile is setup.
• Ran the application.

RESULT:
The secure string is successfully retrieved from Systems Manager parameter store.

You might want to check if the credentials used by your application have at least the permissions mentioned at https://github.com/aws/aws-dotnet-extensions-configuration#parameter-store. Also as mentioned in section ** Allowing only specific parameters to run on nodes** at https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html, you should also add the permission to kms:Decrypt so that parameter store secure string values could be decrypted.

Thanks,
Ashish

@bot propose-answer

[jurado75]

Hi @ashishdhingra

I agree with you, i was a mistake from my side, right now its working properly.

Cheers mate :)

[aldrodriguezca]

For anyone who might be interested: It works just fine when accessing data via the configuration object. The problem arises when working with the Options pattern. Under that scenario, the parameters are retrieved with their raw encrypted values.

[ashishdhingra]

The project at https://github.com/aws/aws-dotnet-extensions-configuration/tree/master/samples/Samples uses IOptions pattern. Please review.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.