在 Cfn L1 构造中解析使用 CDK 创建的秘密答案

【问题标题】：Resolve secret created with CDK in a Cfn L1 Construct在 Cfn L1 构造中解析使用 CDK 创建的秘密
【发布时间】：2021-03-30 02:09:41
【问题描述】：

如何使用通过 Secrets Manager 创建的 L2 Secret 解析为 L1 Cfn 属性值？

from aws_cdk import (
    core,
    aws_secretsmanager as secretsmanager,
    aws_elasticache as elasticache
)
class MyStack(core.Stack):
    def __init__(self, scope: core.Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

        redis_password = secretsmanager.Secret(
            self, "RedisPassword",
            description="Redis auth",
            generate_secret_string=secretsmanager.SecretStringGenerator(
                exclude_characters='/"@'
            )
        )
        self.redis = elasticache.CfnReplicationGroup(self, 'RedisCluster',
            auth_token=redis_password.secret_value,
            # other properties
        )

这给出了错误

jsii.errors.JSIIError: Object of type @aws-cdk/aws-secretsmanager.Secret is not convertible to @aws-cdk/core.CfnElement

在 Cloudformation 中解决一个秘密，我会使用类似的东西

AuthToken: !Sub '{{resolve:secretsmanager:${MySecret}::password}}'

但是 L2 Secret 不会像 L1 构造那样输出 Cfn Ref（据我所知）

我错过了什么？

【问题讨论】：

标签： python amazon-web-services amazon-cloudformation aws-cdk aws-secrets-manager

【解决方案1】：

我只是缺少to_string() 方法

from aws_cdk import (
    core,
    aws_secretsmanager as secretsmanager,
    aws_elasticache as elasticache
)
class MyStack(core.Stack):
    def __init__(self, scope: core.Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

        redis_password = secretsmanager.Secret(
            self, "RedisPassword",
            description="Redis auth",
            generate_secret_string=secretsmanager.SecretStringGenerator(
                exclude_characters='/"@'
            )
        )
        self.redis = elasticache.CfnReplicationGroup(self, 'RedisCluster',
            auth_token=redis_password.secret_value.to_string(),
            # other properties
        )

这合成为

{
  "RedisPasswordED621C10": {
    "Type": "AWS::SecretsManager::Secret",
    "Properties": {
      "Description": "Redis auth",
      "GenerateSecretString": {
        "ExcludeCharacters": "/\"@"
      }
    },
    "Metadata": {
      "aws:cdk:path": "my-cdk-stack/RedisPassword/Resource"
    }
  },
  "RedisCluster": {
    "Type": "AWS::ElastiCache::ReplicationGroup",
    "Properties": {
      "ReplicationGroupDescription": "RedisGroup",
      "AtRestEncryptionEnabled": true,
      "AuthToken": {
        "Fn::Join": [
          "",
          [
            "{{resolve:secretsmanager:",
            {
              "Ref": "RedisPasswordED621C10"
            },
            ":SecretString:::}}"
          ]
        ]
      },
      "OtherProps": "..."
    }
  }
}

【讨论】：