pahud
commented
3 weeks ago grantRead essentially only grant GetSecretValue and DescribeSecret to the secret. Obviously you will need BatchGetSecretValue.
Before we have a new static method like grantBatchRead(), one option you could have though is to addToPrincipalOrResource() by yourself:
PoC
export class MyStack extends cdk.Stack {
constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// Create a secret in Secrets Manager
const secret = new secretsmanager.Secret(this, 'MySecret', {
secretName: 'my-secret',
generateSecretString: {
secretStringTemplate: JSON.stringify({ username: 'myuser' }),
generateStringKey: 'password',
},
});
// Create a Lambda function
const lambdaFunction = new lambda.Function(this, 'MyLambdaFunction', {
runtime: lambda.Runtime.NODEJS_LATEST,
handler: 'index.handler',
code: lambda.Code.fromAsset('lambda'),
});
// Grant the Lambda function's role access to the secret
iam.Grant.addToPrincipalOrResource({
grantee: lambdaFunction.role!,
actions: ['secretsmanager:BatchGetSecretValue'],
resource: secret,
resourceArns: [secret.secretArn],
})
// secret.grantRead(lambdaFunction.role!);
}
}On synth you should see a new principal policy attached to your lambda service role
MyLambdaFunctionServiceRoleDefaultPolicy23555F9E:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action: secretsmanager:BatchGetSecretValue
Effect: Allow
Resource:
Ref: MySecret8FE80B51
Version: "2012-10-17"
PolicyName: MyLambdaFunctionServiceRoleDefaultPolicy23555F9E
Roles:
- Ref: MyLambdaFunctionServiceRole313A4D46And if you check that policy from the console
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "secretsmanager:BatchGetSecretValue",
"Resource": "arn:aws:secretsmanager:us-east-1:ACCOUNT_ID:secret:my-secret-Z0p63c",
"Effect": "Allow"
}
]
}Now, if you need to "import" a secret using the from* method. You should always use fromSecretCompleteArn() when possible because that would end with the - and 6 chars.
// Create a secret in Secrets Manager
const secret = new secretsmanager.Secret(this, 'MySecret', {
secretName: 'my-secret',
generateSecretString: {
secretStringTemplate: JSON.stringify({ username: 'myuser' }),
generateStringKey: 'password',
},
});
const importedSecret = secretsmanager.Secret.fromSecretCompleteArn(this, 'ImportedSecret', secret.secretArn);And cdk deploy and verify the policy from the IAM console. Make sure the trailing -XXXXXX is included then you should be good.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "secretsmanager:BatchGetSecretValue",
"Resource": "arn:aws:secretsmanager:us-east-1:ACCOUNT_ID:secret:my-secret-Z0p63c",
"Effect": "Allow"
}
]
}This should be exactly the permission you need. Let me know if it works for you.
ghost
JBSchami
Describe the bug
I'm attempting to retrieve secrets using BatchGetSecretValue.
In my CDK app, I've created a
NodejsFunctionLambda.Then, I retrieve the secrets as follows, and grant read access to the lambda:
This worked fine when I had only one secret and was retrieving it using GetSecretValueCommand.
However, now I've switched to using BatchGetSecretValueCommand, and it seems I no longer have access to the secrets.
I get this error when attempting the batch retrieval:
I've only shown one secret in the examples above, but in the actual app I'm repeating this process for the few secrets I have and granting read access for each one.
I found this documentation that mentions adding the following as a permission:
If I look at my lambda in the AWS Console, I can see that it does only have these action permissions for each secret:
Allow: secretsmanager:DescribeSecretAllow: secretsmanager:GetSecretValueAnd clearly
secretsmanager:BatchGetSecretValueis not part of this.So I attempted the following:
And still got the same error. When I look in the AWS Console, the ARNs now don't include the final six characters. When I used
grantRead, the ARNs ended in-??????. Now they don't.I even attempted to add it back in like this:
And it made no difference.
Overall, I can't figure out how to retrieve secrets in a batch.
More specifically, what possible reason could there be for
grantReadto provide access to read and retrieve a secret individually but not as part of a batch? If I usegrantReadWriteDatato grant the same lambda access to a DynamoDB table, I can see clearly in the Console that it includes batch-related actions. So why is there an exception for secrets? If there is permission to read it individually, what is the risk of reading it as part of a batch? This should be the default behavior, just like DynamoDB, or at least there should be an opt-in.I've read in the docs that using the
grant*functions is best practice over providing specific policies like the one I attempted above. There should be an option to use agrant*function for this. Having to specify a policy like the one attempted above is never a better option over something likegrant*.Regression Issue
Last Known Working CDK Version
No response
Expected Behavior
I expected
grantReadwould cover batch retrieval as well as non-batch retrieval.Current Behavior
It does not cover that action and my lambda does not have permission to retrieves secrets by batch, although it has been granted read-related permissions to each secret in question.
Reproduction Steps
Please see above.
Possible Solution
grantReadshould cover batch retrieval.Additional Information/Context
No response
CDK CLI Version
2.159.1 (build c66f4e3)
Framework Version
No response
Node.js Version
v20.16.0
OS
MacOS
Language
TypeScript
Language Version
5.6.2
Other information
No response