Cdk Sops Secrets
Overview

FAQ

It does not work, what can I do?

Even though this construct has unit and integration tests, bugs happen. Everything runs through a CloudFormation custom resource provider, so a good starting point is the log of the corresponding Lambda function. It's located in your AWS account under CloudWatch → Log groups:

/aws/lambda/YOUR-STACK-NAME-SingletonLambdaSopsSyncProviderSOMETHINGsomething1234

I get errors with dotenv formatted files

Only very basic dotenv syntax works right now. Only single-line values are accepted. The format must match:

key=value

Comments must be on their own line, not after value assignments.

Error: Error getting data key: 0 successful groups required, got 0

This error (and the failed sync) is related to getsops/sops#948 and #634. Don't create your secret with the --aws-profile flag — that profile gets written into your sops file and is then required in every runtime environment. Define the profile via the AWS_PROFILE environment variable instead.

Error: Asset of sync lambda not found

The Lambda asset code is generated relative to the path of index.ts in this package. Tools like Nx can produce the wrong path, so the asset can't be found.

Override the asset path via cdk.json or the -c flag of the CDK CLI. The context key is sops_sync_provider_asset_path:

cdk deploy -c "sops_sync_provider_asset_path=some/path/asset.zip"

or in cdk.json:

{
  "context": {
    "sops_sync_provider_asset_path": "some/path/asset.zip"
  }
}
Can I upload the sops file myself and provide the required information as a CloudFormation parameter?

Yes. Create a custom SOPS provider with the proper IAM permissions first:

const sopsS3BucketParam = new CfnParameter(this, "s3BucketName", {
  type: "String",
  description: "The name of the Amazon S3 bucket where your sopsFile was uploaded."});
 
const sopsS3KeyParam = new CfnParameter(this, "s3KeyName", {
  type: "String",
  description: "The name of the key of the sopsFile inside the Amazon S3 bucket."});
 
const sopsKmsKeyArn = new CfnParameter(this, "sopsKeyArn", {
  type: "String",
  description: "The ARN of the KMS Key used for sops encryption"});
 
const sopsKmsKey = Key.fromKeyArn(this, 'Key', sopsKmsKeyArn.valueAsString)
 
new SopsSecret(stack, 'SopsSecret', {
  sopsS3Bucket: sopsS3BucketParam.valueAsString,
  sopsS3Key: sopsS3KeyParam.valueAsString,
  sopsKmsKey: [
    sopsKmsKey
  ],
  sopsFileFormat: 'json',
  ...
});
Can I access older versions of the secret stored in Secrets Manager?

Yes. While creating or updating a secret, CDK's native cdk.FileSystem.fingerprint(...) generates the version information for the Secrets Manager secret, so you can reference entries from a specific version:

const versionId = cdk.FileSystem.fingerprint(`./sops/SomeSecrets.json`);
const passphrase = ecs.Secret.fromSecretsManagerVersion(
  secretMgmt,
  { versionId: versionId },
  'MY_PRIVATE_PASSPHRASE',
);
 
const container = TaskDef.addContainer('Container', {
  secrets: {
    MY_PRIVATE_PASSPHRASE: passphrase,
  },
});
I want the raw content of the sops file, but I always get it nested in JSON

For the best raw experience, encrypt your SOPS files in binary format:

sops encrypt ... my-whatever-file --output my-secret-information.sops.binary --input-type binary

You'll lose features like only encrypting values (not keys) — the whole file content is stored in the SOPS file. You can store anything as binary, including binary data itself.

When using binary-encrypted secrets with these constructs, make sure the file ending is also binary, or override it via the sopsFormat property. This does not work for MultiStringParameter.

Powered by Docsbook