Failed to decrypt secret due to failed to retrieve decrypted secret

fagiani commented 3 years ago

Summary

It throws an error when trying to run ecs-cli local up with a Task Definition that retrieves data from AWS Secrets Manager

Description

Which specific command was run?

ecs-cli local create --task-def-remote my-task-definition --output docker-compose.ecs-local.yml --force
ecs-cli local up

Which version of the CLI you are using? (Run: ecs-cli --version) ecs-cli version 1.21.0 (bb0b8f0)
Which version of Go are you using? (Run: go version) Command go not found
What platform are you using to run ECS CLI commands? (E.g. Linux, macOS, Windows) Linux version 5.4.0-1029-aws (buildd@lcy01-amd64-022) (gcc version 9.3.0 (Ubuntu 9.3.0-17ubuntu1~20.04)) #30-Ubuntu SMP Tue Oct 20 10:06:38 UTC 2020

Config files

docker-compose.yml

version: "3.4"
services:
my-service:
entrypoint:
- web
environment:
  MY_FIRST_ENV: ${my-first-env-label_MY_FIRST_ENV}
  MY_SECOND_ENV: ${my-second-env-label_MY_SECOND_ENV}
image: *****.dkr.ecr.us-east-1.amazonaws.com/my-docker-image:latest
labels:
  ecs-local.secret.MY_FIRST_ENV: 'arn:aws:secretsmanager:us-east-1:*****:secret:my-namespace/my-app-*****:MY_FIRST_ENV::'
  ecs-local.secret.MY_SECOND_ENV: 'arn:aws:secretsmanager:us-east-1:*****:secret:my-namespace/my-app-*****:MY_SECOND_ENV::'
  ecs-local.task-definition-input.type: remote
  ecs-local.task-definition-input.value: my-local-task-definition
logging:
  driver: awslogs
  options:
    awslogs-group: ecs/my-app-log-group
    awslogs-region: us-east-1
    awslogs-stream-prefix: ecs
networks:
  ecs-local-network: null
ports:
- target: 3000
  published: 3000
  protocol: tcp
networks:
ecs-local-network:
external: true

ecs-params.yml N/A

~/.ecs/config

version: v1
default: default
clusters:
default:
cluster: my-cluster
region: us-east-1
default_launch_type: ""

Expected Behavior

Execute the docker-compose and have a container running

Observed Behavior

+ ecs-cli configure --region us-east-1 --cluster my-cluster
INFO[0000] Saved ECS CLI cluster configuration default.
+ ecs-cli local create --task-def-remote my-taskdefinition --output docker-compose.ecs-local.yml --force
INFO[0000] Reading task definition from my-taskdefinition:16

INFO[0000] Task Definition network mode is ignored when running containers locally. Tasks will be run in the ecs-local-network.  networkMode=awsvpc
WARN[0000] awslogs log driver is ignored when running locally. Tasks will default to json-file instead. This can be changed in your compose override file.
INFO[0000] Successfully wrote docker-compose.ecs-local.yml
INFO[0000] Successfully wrote docker-compose.ecs-local.override.yml
+ ecs-cli local up
INFO[0000] The network ecs-local-network already exists
INFO[0000] The amazon-ecs-local-container-endpoints container already exists with ID a06557edbe0667a01a0be4a9e7269999d2cbe902c6a7894e09a11ef6eb308fb6
INFO[0000] Started container with ID a06557edbe0667a01a0be4a9e7269999d2cbe902c6a7894e09a11ef6eb308fb6
FATA[0000] Failed to decrypt secret due to
failed to retrieve decrypted secret from arn:aws:secretsmanager:us-east-1:*****:secret:my-namespace/my-app-*****:MY_FIRST_ENV:: due to ValidationException:Invalid name. Must be a valid name containing alphanumeric characters, or any of the following: -/_+=.@!
        status code: 400, request id: 74d64845-e54b-4ab5-a007-119dafe8edb4: ValidationException: Invalid name. Must be a valid name containing alphanumeric characters, or any of the following: -/_+=.@!
        status code: 400, request id: 74d64845-e54b-4ab5-a007-119dafe8edb4

I was unable to find where the invalid characters are. One of my hypothesis would be that somehow a required permission is not being given to the IAM role and therefore it is unable to retrieve the value and fails validation but if that is the case I am not sure which one it should be and I've tried to allow all Secrets Manager's permissions without success.

If I hardcode label values, then it works but not with Secrets Manager.

Am I missing anything obvious here? Any clues on this are highly appreciated!

gshpychka commented 3 years ago

@efekarakus I am facing the same issue. I'm trying to retrieve a specific JSON key from a secret and it fails.

gshpychka commented 3 years ago

After looking through the source code it seems like it cannot handle references to a specific field in a secret, it can only fetch the whole secret value.

aws / amazon-ecs-cli