awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-06 17:27:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3664 from Infisical/aws-secret-manager-fix

Browse Source 
Fix: Update aws secret manager sync to handle constrained iam policies
This commit is contained in:
Scott Wilson
2025-05-28 09:31:41 -07:00
committed by GitHub
parent 7994034639 cc3551c417
commit 5e0e7763a3
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/secret-sync/aws-secrets-manager/aws-secrets-manager-sync-fns.ts
+9 -7
View File
@@ -57,7 +57,7 @@ const sleep = async () =>
setTimeout(resolve, 1000); setTimeout(resolve, 1000);
}); });
const getSecretsRecord = async (client: SecretsManagerClient): Promise<TAwsSecretsRecord> => { const getSecretsRecord = async (client: SecretsManagerClient, keySchema?: string): Promise<TAwsSecretsRecord> => {
const awsSecretsRecord: TAwsSecretsRecord = {}; const awsSecretsRecord: TAwsSecretsRecord = {};
let hasNext = true; let hasNext = true;
let nextToken: string | undefined; let nextToken: string | undefined;
@@ -72,7 +72,7 @@ const getSecretsRecord = async (client: SecretsManagerClient): Promise<TAwsSecre
if (output.SecretList) { if (output.SecretList) {
output.SecretList.forEach((secretEntry) => { output.SecretList.forEach((secretEntry) => {
if (secretEntry.Name) { if (secretEntry.Name && matchesSchema(secretEntry.Name, keySchema)) {
awsSecretsRecord[secretEntry.Name] = secretEntry; awsSecretsRecord[secretEntry.Name] = secretEntry;
} }
}); });
@@ -311,7 +311,7 @@ export const AwsSecretsManagerSyncFns = {
const client = await getSecretsManagerClient(secretSync); const client = await getSecretsManagerClient(secretSync);
const awsSecretsRecord = await getSecretsRecord(client); const awsSecretsRecord = await getSecretsRecord(client, syncOptions.keySchema);
const awsValuesRecord = await getSecretValuesRecord(client, awsSecretsRecord); const awsValuesRecord = await getSecretValuesRecord(client, awsSecretsRecord);
@@ -468,14 +468,16 @@ export const AwsSecretsManagerSyncFns = {
getSecrets: async (secretSync: TAwsSecretsManagerSyncWithCredentials): Promise<TSecretMap> => { getSecrets: async (secretSync: TAwsSecretsManagerSyncWithCredentials): Promise<TSecretMap> => {
const client = await getSecretsManagerClient(secretSync); const client = await getSecretsManagerClient(secretSync);
const awsSecretsRecord = await getSecretsRecord(client); const awsSecretsRecord = await getSecretsRecord(client, secretSync.syncOptions.keySchema);
const awsValuesRecord = await getSecretValuesRecord(client, awsSecretsRecord); const awsValuesRecord = await getSecretValuesRecord(client, awsSecretsRecord);
const { destinationConfig } = secretSync; const { destinationConfig } = secretSync;
if (destinationConfig.mappingBehavior === AwsSecretsManagerSyncMappingBehavior.OneToOne) { if (destinationConfig.mappingBehavior === AwsSecretsManagerSyncMappingBehavior.OneToOne) {
return Object.fromEntries( return Object.fromEntries(
Object.keys(awsSecretsRecord).map((key) => [key, { value: awsValuesRecord[key].SecretString ?? "" }]) Object.keys(awsSecretsRecord)
.filter((key) => Object.hasOwn(awsValuesRecord, key))
.map((key) => [key, { value: awsValuesRecord[key]?.SecretString ?? "" }])
); );
} }
@@ -501,11 +503,11 @@ export const AwsSecretsManagerSyncFns = {
} }
}, },
removeSecrets: async (secretSync: TAwsSecretsManagerSyncWithCredentials, secretMap: TSecretMap) => { removeSecrets: async (secretSync: TAwsSecretsManagerSyncWithCredentials, secretMap: TSecretMap) => {
const { destinationConfig } = secretSync; const { destinationConfig, syncOptions } = secretSync;
const client = await getSecretsManagerClient(secretSync); const client = await getSecretsManagerClient(secretSync);
const awsSecretsRecord = await getSecretsRecord(client); const awsSecretsRecord = await getSecretsRecord(client, syncOptions.keySchema);
if (destinationConfig.mappingBehavior === AwsSecretsManagerSyncMappingBehavior.OneToOne) { if (destinationConfig.mappingBehavior === AwsSecretsManagerSyncMappingBehavior.OneToOne) {
for await (const secretKey of Object.keys(awsSecretsRecord)) { for await (const secretKey of Object.keys(awsSecretsRecord)) {