aws / aws-cdk

The AWS Cloud Development Kit is a framework for defining cloud infrastructure in code
https://aws.amazon.com/cdk
Apache License 2.0
11.59k stars 3.89k forks source link

aws-redshift-alpha: User DatabaseSecret created without masterarn in Secret Text causing multi-user secret rotation to fail #28852

Open penniman26 opened 8 months ago

penniman26 commented 8 months ago

Describe the bug

Multi-User Secret Rotation on Redshift User Secret does not work without a masterarn field present in Redshift User Secret serialized JSON text.

The User Construct does not plumb in the Cluster's secret (i.e. the master secret) to the DatabaseSecret in the User constructor.

A similar change was applied to RDS's DatabaseSecret and Cluster to enable Multi-User Secret Rotation

Expected Behavior

After enabling Multi-User Secret Rotation:

        cluster.addRotationMultiUser(`${id}CredentialsRotation`, {
            secret: redshiftUser.secret,
            automaticallyAfter: secureProps.rotationPeriod,
        });

The Redshift User Secret has a masterarn so that Multi-User Secret Rotation works

Current Behavior

The Secret Rotation Lambda fails with

2024-01-10T00:23:45.982-08:00
[ERROR] KeyError: 'masterarn'
Traceback (most recent call last):
  File "/var/task/lambda_function.py", line 81, in lambda_handler
    set_secret(service_client, arn, token)
  File "/var/task/lambda_function.py", line 188, in set_secret
    admin_arn = current_dict['masterarn']

Reproduction Steps

      const cluster = // cluster props

       const user = return new User(this, 'User', {
            cluster: cluster,
            databaseName: databaseName,
            username: username,
            adminUser: cluster.secret,
        });

        cluster.addRotationMultiUser(`CredentialsRotation`, {
            secret: user.secret
        });

Possible Solution

Additional Information/Context

No response

CDK CLI Version

2.70.0

Framework Version

No response

Node.js Version

18

OS

AL2

Language

TypeScript

Language Version

No response

Other information

No response

pahud commented 8 months ago

Thank you and we appreciate your PR.