Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update secrets-provider to BucketV2 #1704

Merged
merged 3 commits into from
Oct 3, 2024
Merged

Update secrets-provider to BucketV2 #1704

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
514eea1
Update secrets-provider to BucketV2
t0yv0 Sep 19, 2024
88c6562
PR feedback
t0yv0 Oct 3, 2024
862712b
Same for vault
t0yv0 Oct 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 2 additions & 8 deletions secrets-provider/aws/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ pulumi up --yes
Previewing update (aws-kms):
Type Name Plan
+ pulumi:pulumi:Stack pulumi-aws-kms-aws-kms create
+ ├─ aws:s3:Bucket bucket create
+ ├─ aws:s3:BucketV2 bucket create
+ └─ aws:s3:BucketObject secret create
flostadler marked this conversation as resolved.
Show resolved Hide resolved

Resources:
Expand All @@ -73,7 +73,7 @@ Resources:
Updating (aws-kms):
Type Name Status
+ pulumi:pulumi:Stack pulumi-aws-kms-aws-kms created
+ ├─ aws:s3:Bucket bucket created
+ ├─ aws:s3:BucketV2 bucket created
+ └─ aws:s3:BucketObject secret created

Outputs:
Expand All @@ -100,9 +100,3 @@ pulumi up --yes
error: getting secrets manager: secrets (code=Unknown): InvalidSignatureException: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.
status code: 400, request id: 35ff51c6-ef88-4c06-9146-361231b8fd4a
```






10 changes: 7 additions & 3 deletions secrets-provider/aws/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,14 @@ const config = new pulumi.Config();
const bucketName = config.require('bucketName');
const secretValue = config.requireSecret('secretValue');

// Create a private bucket
const bucket = new aws.s3.Bucket("bucket", {
// Create a private bucket.
//
// The configuration is kept very simple as the goal of this example is to demonstrate KMS encryption, not storing
// secrets in buckets securely. In a real-world scenario if you are certain you need to be storing sensitive data in
// buckets and have eliminated other storage options, consider setting up a custom KMS key, enforcing TLS, and enabling
// versioning for the bucket.
const bucket = new aws.s3.BucketV2("bucket", {
bucket: bucketName,
acl: "private",
});

// Create an object from the secret value
Expand Down
11 changes: 3 additions & 8 deletions secrets-provider/vault/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ pulumi up --yes
Previewing update (vault-kms):
Type Name Plan
+ pulumi:pulumi:Stack pulumi-vault-kms-vault-kms create
+ ├─ aws:s3:Bucket bucket create
+ ├─ aws:s3:BucketV2 bucket create
+ └─ aws:s3:BucketObject secret create

Resources:
Expand All @@ -77,7 +77,7 @@ Resources:
Updating (aws-kms):
Type Name Status
+ pulumi:pulumi:Stack pulumi-vault-kms-vault-kms created
+ ├─ aws:s3:Bucket bucket created
+ ├─ aws:s3:BucketV2 bucket created
+ └─ aws:s3:BucketObject secret created

Outputs:
Expand All @@ -99,7 +99,7 @@ You'll notice the secret value is also omitted from the output!
A quick way to verify if the encryption is using the Vault key is to remove your `VAULT_SERVER_TOKEN` environment variable setting:

```bash
unset
unset
pulumi up --yes
error: getting secrets manager: secrets (code=Unknown): Error making API request.

Expand All @@ -108,8 +108,3 @@ Code: 400. Errors:

* missing client token
```





10 changes: 7 additions & 3 deletions secrets-provider/vault/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,14 @@ const config = new pulumi.Config();
const bucketName = config.require('bucketName');
const secretValue = config.requireSecret('secretValue');

// Create a private bucket
const bucket = new aws.s3.Bucket("bucket", {
// Create a private bucket.
//
// The configuration is kept very simple as the goal of this example is to demonstrate KMS encryption, not storing
// secrets in buckets securely. In a real-world scenario if you are certain you need to be storing sensitive data in
// buckets and have eliminated other storage options, consider setting up a custom KMS key, enforcing TLS, and enabling
// versioning for the bucket.
const bucket = new aws.s3.BucketV2("bucket", {
bucket: bucketName,
acl: "private",
});

// Create an object from the secret value
Expand Down
Loading