aws-secrets | Manage secrets on AWS instances | AWS library

Here's the list of public endpoints for AWS Secrets Manager. You would pick the one for the AWS region you are using. If you aren't using a VPC endpoint then you can probably just leave that blank or null, the AWS SDK should pick the endpoint automatically based on the region.

There are two issues here:

1. secrets is of type index signature. you should therefore name your secret (this is the environment variable that will be exposed in your container)
2. an ecs.Secret is expected (you can create it from an sm.Secret)

here is a working version:

OK - so your question is how to READ a secret. Let's try different tutorials:

Example 1: use SecretsManager (much like your original tutorial is doing):

https://nimblegecko.com/how-to-use-aws-secret-manager-secrets-in-dotnet-core-application/

It's the general "S3 doesn't like your signature" message.

See troubleshooting s3a for the normative documentation on debugging the S3A connector.

(Moderators: I'm linking to the ASF docs rather than copy the text as (a) it will only become out of date compared to the normative docs and (b) people need to learn to read the documentation)

You are right, it can be further simplified on code side.

Let's say accountA has secrets and accountB is your app account. Current implementation does the following:

• A client is created inside the accountB using accountA credentials (AssumeRole is followed and is a best practice)
• Secrets are fetched and then used.

What could be done:

• Use resource based policy in accountA that let's the IAM User and/or IAM Role in accountB have access to the secrets placed in accountA.
• Update the KMS key policy in accountA for the key that is used to encrypt/decrypt secrets. Let the same IAM User and/or Role have access to that KMS key. So that they can use it.
• Update the IAM Policy for the IAM User and/or Role in accountB, explicitly allowing it to use the secrets and KMS keys of accountA.

Now, you are able to access the secrets using the same IAM User/Role that is used for the app and theoretically spring-cloud-starter-aws-secrets-manager-config should fetch the secrets from accountA as well (I have not tested it for myself).

The least benefit you will get is not creating assumedRole client for different account. More details on AWS Blog

You're using different versions of spring-boot-starter-parent (2.3.1.RELEASE and 2.3.4.RELEASE) which is probably leading to inconsistent versions where the later or earlier don't have the method. Try using 2.3.4.RELEASE in your application.

[Update]

You're still getting inconsistent versions of org.springframework:* on the classpath:

Depending on your actual context there are two possible variants.

1. Import existing role

If the Lambda function has been predefined (e.g. in a different stack), you can add the additional permissions to the existing Lambda execution role by importing it into this CDK stack first.

The TTL would clean up the Job itself and all it's children objects. ttlSecondsAfterFinished is unset so the Job hasn't been cleaned up.

From the job docco

Note: If your job has restartPolicy = "OnFailure", keep in mind that your container running the Job will be terminated once the job backoff limit has been reached. This can make debugging the Job’s executable more difficult. We suggest setting restartPolicy = "Never" when debugging the Job or using a logging system to ensure output from failed Jobs is not lost inadvertently.

The Job spec you posted doesn't have a backoffLimit so it should try to run the underlying task 6 times.

If the container process exits with a non zero status then it will fail, so can be entirely silent in the logs.

The spec doesn't specify an activeDeadlineSeconds seconds defined so I'm not sure what type of timeout you end up with. I assume this would be a hard failure in the container then so a timeout doesn't come in to play.

You need to pass the configs with --conf:

You do: --spark.kubernetes.driver.secretKeyRef.AWS_ACCESS_KEY_ID=aws-secrets:key

You need: --conf spark.kubernetes.driver.secretKeyRef.AWS_ACCESS_KEY_ID=aws-secrets:key