Closed ben-eb closed 2 months ago
@peterwoodworth I can take this.
I investigated this. One issue I see is PasswordLength
is not supported here in CFN: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-rotationschedule-hostedrotationlambda.html. I can parameterize the password length on creation but I think it will break during rotation. Waiting for input from the CDK team before I proceed.
The CDK uses the underlying SecretsManager::Secret
parameters: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html (mapped in the CDK as https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.SecretStringGenerator.html).
I was initially incredulous that content out of aws-samples/
would be used in production like this, but it does appear that this is the case: https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#sar-template-oracle-singleuser is the actual live reference for the lambda. Honestly, this is a massive failure on the part of the CloudFormation/SecretsManager team as this should be in a top level AWS organization (aws-samples is generally provided without any level of support).
This appears to be a problem with the AWS Secrets Manager lambda, not the CDK itself.
Yeah, from what I'm reading here, automatic rotation generates a new password with 32 chars every time. But you can generate a secret string with a custom length. Feels like automatic rotation is missing a feature :)
Since it's a problem on CloudFormation/Secrets Manager, I'm going to close this ticket.
Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.
@indrora I agree but is it possible to open a TT to see if the team can update the automatic rotation functionality to include password length as a parameter?
We can absolutely do that, and should do that for customers when applicable. @indrora can you please follow up internally?
Also I don't think this will be the best move here, but @msambol creating issues in the cloudformation coverage roadmap does automatically create tickets internally (though i'm not sure how to follow up on those on my end)
@peterwoodworth Happy to do so in that repo—let me know if you want to go that route or TT.
@peterwoodworth ^ I created a new issue in the other repo.
Closing the issue in favor of https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1824.
Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.
Describe the bug
Hello,
We have an issue with the automatic secret rotation functionality provided by the addRotationMultiUser method.
From a casual glance of the codebase (and the generated CloudFormation template) it would seem that the default behaviour of CDK is to create passwords that are a maximum of 30 characters in length (and this cannot be changed). Indeed, there is a comment explaining the reason:
https://github.com/aws/aws-cdk/blob/7caab7d9690cfcc8a750800686d96d0f7f857fa9/packages/aws-cdk-lib/aws-rds/lib/database-secret.ts#L86
This is relevant to us because we are needing to create a database link from an Oracle database server back to RDS and cannot use more than 30 characters.
However, further automatic updates to this secret (possibly on initial creation also but we have not verified this) will discard this length requirement, resetting it to the default.
We traced this back to https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/blob/67a98d2745b08bc748d17dc0469e48199c039789/SecretsManagerRDSPostgreSQLRotationMultiUser/lambda_function.py#L128 which does not allow us to pass through a maximum password length (so it defaults to 32 instead).
There is an open issue for tracking this bug at https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/issues/51.
Expected Behavior
We would expect the length requirement for the default rotation function to be parameterised so that the maximum password length is passed through.
Indeed, this could unblock support for longer passwords than 32 characters.
Current Behavior
The password length is not passed through, so the password is 32 characters instead of 30.
Reproduction Steps
stack.ts
bin.ts
cdk.json
Running
cdk synth
will produce, among other things, aAWS::Serverless::Application
resource that does not have the secret length as a parameter.Possible Solution
The rotation application sample would need updating to pass through the length parameter.
Additional Information/Context
No response
CDK CLI Version
2.102.0 (build 2abc59a)
Framework Version
No response
Node.js Version
v18.18.2
OS
Mac OS X
Language
TypeScript
Language Version
TypeScript 5.2.2
Other information
No response