improvement: address feedback

backend/src/services/secret-sync/aws-parameter-store/aws-parameter-store-sync-fns.ts

@@ -317,11 +317,13 @@ export const AwsParameterStoreSyncFns = {
         continue;
       }
 
+      const keyId = syncOptions.keyId ?? "alias/aws/ssm";
+
       // create parameter or update if changed
       if (
         !(key in awsParameterStoreSecretsRecord) ||
         value !== awsParameterStoreSecretsRecord[key].Value ||
-        (syncOptions.keyId ?? "alias/aws/ssm") !== awsParameterStoreMetadataRecord[key]?.KeyId
+        keyId !== awsParameterStoreMetadataRecord[key]?.KeyId
       ) {
         try {
           await putParameter(ssm, {
@@ -329,7 +331,7 @@ export const AwsParameterStoreSyncFns = {
             Type: "SecureString",
             Value: value,
             Overwrite: true,
-            KeyId: syncOptions.keyId
+            KeyId: keyId
           });
         } catch (error) {
           throw new SecretSyncError({

backend/src/services/secret-sync/aws-secrets-manager/aws-secrets-manager-sync-fns.ts

@@ -318,6 +318,8 @@ export const AwsSecretsManagerSyncFns = {
 
     const syncTagsRecord = Object.fromEntries(syncOptions.tags?.map((tag) => [tag.key, tag.value]) ?? []);
 
+    const keyId = syncOptions.keyId ?? "alias/aws/secretsmanager";
+
     if (destinationConfig.mappingBehavior === AwsSecretsManagerSyncMappingBehavior.OneToOne) {
       for await (const entry of Object.entries(secretMap)) {
         const [key, { value, secretMetadata }] = entry;
@@ -330,15 +332,12 @@ export const AwsSecretsManagerSyncFns = {
 
         if (awsSecretsRecord[key]) {
           // skip secrets that haven't changed
-          if (
-            awsValuesRecord[key]?.SecretString !== value ||
-            (syncOptions.keyId ?? "alias/aws/secretsmanager") !== awsDescriptionsRecord[key]?.KmsKeyId
-          ) {
+          if (awsValuesRecord[key]?.SecretString !== value || keyId !== awsDescriptionsRecord[key]?.KmsKeyId) {
             try {
               await updateSecret(client, {
                 SecretId: key,
                 SecretString: value,
-                KmsKeyId: syncOptions.keyId
+                KmsKeyId: keyId
               });
             } catch (error) {
               throw new SecretSyncError({
@@ -352,7 +351,7 @@ export const AwsSecretsManagerSyncFns = {
             await createSecret(client, {
               Name: key,
               SecretString: value,
-              KmsKeyId: syncOptions.keyId
+              KmsKeyId: keyId
             });
           } catch (error) {
             throw new SecretSyncError({
@@ -416,17 +415,17 @@ export const AwsSecretsManagerSyncFns = {
         Object.fromEntries(Object.entries(secretMap).map(([key, secretData]) => [key, secretData.value]))
       );
 
-      if (awsValuesRecord[destinationConfig.secretName]) {
+      if (awsSecretsRecord[destinationConfig.secretName]) {
         await updateSecret(client, {
           SecretId: destinationConfig.secretName,
           SecretString: secretValue,
-          KmsKeyId: syncOptions.keyId
+          KmsKeyId: keyId
         });
       } else {
         await createSecret(client, {
           Name: destinationConfig.secretName,
           SecretString: secretValue,
-          KmsKeyId: syncOptions.keyId
+          KmsKeyId: keyId
         });
       }
 
@@ -458,22 +457,6 @@ export const AwsSecretsManagerSyncFns = {
           });
         }
       }
-
-      for await (const secretKey of Object.keys(awsSecretsRecord)) {
-        if (secretKey === destinationConfig.secretName) {
-          // eslint-disable-next-line no-continue
-          continue;
-        }
-
-        try {
-          await deleteSecret(client, secretKey);
-        } catch (error) {
-          throw new SecretSyncError({
-            error,
-            secretKey
-          });
-        }
-      }
     }
   },
   getSecrets: async (secretSync: TAwsSecretsManagerSyncWithCredentials): Promise<TSecretMap> => {