fix(core): remove cdk.Secret #2068
Conversation
`cdk.Secret` was left over from when we thought we were going to do secrets differently. Today, we model secret values as strings, which can be retrieved from one of these: - `ssm.ParameterStoreSecureString.stringValue` - `secretsmanager.SecretString.stringValue` - `cdk.CfnParameter.stringValue` (but don't do that, because the secret will be readable from CloudFormation logs) Fixes #2064. BREAKING CHANGE: Replace use of `cdk.Secret` with `secretsmanager.SecretString` (preferred) or `ssm.ParameterStoreSecureString`.
|
So what we would be trying to achieve then is a flavor of I think the following might be appropriate then: /**
* A marker interface for objects that represent a secret string value
*/
export interface ISecretValue {
stringValue: string;
}Alternatively, in the constructs that want a secret, we just go: if (!cdk.unresolved(input)) {
throw new Error('Oy, are you daft or what?');
} |
|
The latter option is not half bad, and I love the error message. |
|
The problem is there being will prevent people who know they want a literal secret value, for whatever reason.
|
|
Maybe an explicit optional switch that disables this check? |
| @@ -3,3 +3,54 @@ | |||
| ```ts | |||
| const alexaAsk = require('@aws-cdk/alexa-ask'); | |||
| ``` | |||
|
|
|||
There was a problem hiding this comment.
Yes. Did not expect the empty README to be the correct end situation.
packages/@aws-cdk/cdk/lib/secret.ts
Outdated
| * secret values will not allow you to pass in a literal secret value. They do | ||
| * so by calling `Secret.assertSafeSecret()`. | ||
| * | ||
| * You can escape the check by calling `Secret.unsafeSecret()`, but doing |
There was a problem hiding this comment.
Maybe instead of Secret.unsafeSecret we can do Secret.clearText or Secret.plainText? Less about policy, more about mechanism...
cdk.Secretwas left over from when we thought we were going to dosecrets differently. Today, we model secret values as strings, which
can be retrieved from one of these:
ssm.ParameterStoreSecureString.stringValuesecretsmanager.SecretString.stringValuecdk.CfnParameter.stringValue(but don't do that, because the secretwill be readable from CloudFormation logs)
Fixes #2064.
BREAKING CHANGE: Replace use of
cdk.Secretwithsecretsmanager.SecretString(preferred) orssm.ParameterStoreSecureString.Pull Request Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.