Aws secrets manager

Question

I tried writing a hostedlambdarotation property in AWS cloudformation to rotate my credentials after every X days, but the deployment fails stating the following error - "Transform AWS::SecretsManager-2020-07-23 failed with: PostgreSQLSingleUser is not a supported rotation engine type."

Here in the documentation it says that the above mentioned rotation type is supported. Hostedlambdarotation property

Has anyone faced a similar issue? I am using a postgresql thus want to use the above mentioned rotation policy.

Any help will be much appreciated!

Edit : Sample Code

   {
  "Transform": "AWS::SecretsManager-2020-07-23",
  "Resources": {
    "Test": {
      "Type": "AWS::SecretsManager::Secret",
      "Properties": {
        "Name": "Test",
        "Description": "Secrets for db connectivity",
        "SecretString": "{\"username\":\"test\",\"password\":\"test\",\"engine\":\"postgres\",\"host\":\"test.rds.amazonaws.com\",\"port\":\"5432\",\"dbname\":\"test\"}"
      }
    },
    "TestAttachment": {
      "Type": "AWS::SecretsManager::SecretTargetAttachment",
      "Properties": {
        "SecretId": {
          "Ref": "Test"
        },
        "TargetId": "arn:aws:rds:test",
        "TargetType": "AWS::RDS::DBInstance"
      }
    },
    "TestSecretRotationSchedule": {
      "Type": "AWS::SecretsManager::RotationSchedule",
      "Properties": {
        "SecretId": {
          "Ref": "Test"
        },
        "HostedRotationLambda": {
          "RotationType": "PostgreSQLSingleUser",
          "RotationLambdaName": "SecretsManagerRotation",
          "VpcSecurityGroupIds": "sg-testid",
          "VpcSubnetIds": {
            "Fn::Join": [
              ",",
              [
                "subnet-test01",
                "subnet-test02"
              ]
            ]
          }
        },
        "RotationRules": {
          "AutomaticallyAfterDays": 45
        }
      }
    }
  }
}

Ok, that's understandable. Can you share some kind of pseudocode? E.g. it looks like you're using a custom transform, so it would be good to get some details of that, and just how the template hangs together - otherwise it's very difficult to know what might be going wrong. — PMah, Aug 06 '20 at 08:54
What happens if you get CloudFormation to generate the initial secret using GenerateSecretString, rather than setting the SecretString explicitly? — PMah, Aug 06 '20 at 12:21
Did not try that way. My usecase requires values to be mentioned as the RDS might already be in existence with some pre-defined secrets — Shweta, Aug 06 '20 at 12:41
@PMah I tried with GenerateSecretString as well; it still fails with the same error. — Shweta, Aug 07 '20 at 12:28
I think if I were you I'd raise this with AWS, if you've got a support package with them. Everything looks correct to me... — PMah, Aug 07 '20 at 12:51

score 0 · Answer 1 · answered Aug 26 '20 at 08:32

Maybe it has been updated since you last tried? I just used more or less than same syntax in yaml and it just deployed successfully in CFN.

    AuroraSecretRotationSchedule:
      Type: AWS::SecretsManager::RotationSchedule
      DependsOn:
        - SecretAuroraClusterAttachment
        - AuroraDBInstance
      Properties:
        HostedRotationLambda:
          RotationType: PostgreSQLSingleUser
          RotationLambdaName: "PGMasterSecretRotationLambda"
        SecretId: !Ref AuroraMasterSecret
        RotationRules:
          AutomaticallyAfterDays: 30

Funny thing is I would never have gotten it if not for your question-- I specified the MasterSecretArn parameter previously, which caused an error. Disclaimer: I haven't tested if this lambda actually works, just that it deployed w/o error.

What region are you deploying the lambda in? – Shweta Oct 19 '20 at 17:26 — Shweta, Oct 19 '20 at 17:26

Aws secrets manager

1 Answers1