从 AWS Secret Manager 访问密钥

Question

我的秘密存储看起来像这样

秘密经理

SecretName : MultipleKeySecretName

{
  "Key1": "Key1 Value",
  "Key2": "Key2 Value"
}

SecretName : SingleSecretName

{
  "Key1": "Key1 Value"
}

我有一个共享包，其中有一个检索 AWS 秘密值的通用代码。

 public async Task<string> GetValue(string key)
    {
        Requires.ArgumentNotNullOrWhitespace(key, "key");
        var region = RegionEndpoint.GetBySystemName(CurrentRegion);

        if (region == null)
        {
            logger.LogError($"Unable to retrieve key because region is not specified by application");
            throw new ArgumentNullException("Unable to retrieve key because region is not specified by application");
        }

        try
        {
            var secretsManager = new AmazonSecretsManagerClient(region);
            var request = new GetSecretValueRequest
            {
                SecretId = key
            };
            var getSecretValueResponse = await secretsManager.GetSecretValueAsync(request);

            if (getSecretValueResponse.HttpStatusCode != System.Net.HttpStatusCode.OK)
            {
                logger.LogError($"Unable to find secret with keyname : {key} in secret manager");
                throw new ArgumentNullException($"Unable to find secret with keyname : {key} in secret manager");
            }

            var secretStringJson = getSecretValueResponse.SecretString;
            return JsonConvert.DeserializeObject<Dictionary<string, string>>(secretStringJson).Values.FirstOrDefault();
        }
        catch (Exception exception)
        {
            logger.LogError($" An error occurred getting value from secret manager for" +
                   $" Key :{key} Region : {region} {exception.Message}");
            throw;
        }
    }

当我在一个密钥中有单个密钥时，我像这样使用了上面的代码

var mysingleKey =  GetValue("SingleSecretName").Result; //Work perfect for single scenearios

现在我有多个具有相同秘密的密钥，见上文。

var multipleValues =  GetValue("MultipleKeySecretName").Result

根据当前的实现，它总是会带来第一个值。我可以更改共享包以获取值字典。

1. 如何使用上述代码分别获取每个密钥
   这可能吗 (GetValue("SingleSecretName.Key1").Result？
2. 一次调用 AWS Secret Manager 获取多个密钥的最佳方法是什么？
   获取共享代码中的所有值并从字典中获取值？

Answer 1

您的代码的问题是您假设字典中只有一项，并且总是返回它。如果您真的只想从字典中获取一项，则需要指定secretId（您称之为key）以及字典key。然后您可以在结果中查找该键。像这样的：

public async Task<string> GetValueAsync(string secretId, string key)
    {
        Requires.ArgumentNotNullOrWhitespace(secretId, "secretId");
        Requires.ArgumentNotNullOrWhitespace(key, "key");
        var region = RegionEndpoint.GetBySystemName(CurrentRegion);

        if (region == null)
        {
            logger.LogError($"Unable to retrieve key because region is not specified by application");
            throw new ArgumentNullException("Unable to retrieve key because region is not specified by application");
        }

        try
        {
            var secretsManager = new AmazonSecretsManagerClient(region);
            var request = new GetSecretValueRequest
            {
                SecretId = secretId
            };
            var getSecretValueResponse = await secretsManager.GetSecretValueAsync(request);

            if (getSecretValueResponse.HttpStatusCode != System.Net.HttpStatusCode.OK)
            {
                logger.LogError($"Unable to find secret with secretId : {secretId} in secret manager");
                throw new ArgumentException($"Unable to find secret with secretId : {secretId} in secret manager");
            }

            var secretStringJson = getSecretValueResponse.SecretString;
            var secret = JsonConvert.DeserializeObject<Dictionary<string, string>>(secretStringJson);

            if (secret.ContainsKey(key))
            {
                return secret[key];
            }
            else 
            {
                logger.LogError($"Unable to find key within secret : {key}");
                throw new ArgumentException($"Unable to find key within secret : {key}");
            }
        }
        catch (Exception exception)
        {
            logger.LogError($" An error occurred getting value from secret manager for" +
                   $" Key :{key} Region : {region} {exception.Message}");
            throw;
        }
    }