Store credentials in Secrets Manager consistently + configurable KMS key - #8
Merged
Merged
Conversation
…urable Add an optional secret_kms_key_id parameter (Terraform variable, service attribute, and UI-exposed field in the service spec) so each rds-postgres-server instance can use its own customer-managed KMS key to encrypt its master password secret. Left unset, the secret keeps using the default aws/secretsmanager managed key, same as before. Also thread the same variable through the currently-unused rds-postgres-db/deployment module to keep it consistent with rds-postgres-server's, since both define an equivalent aws_secretsmanager_secret.master resource. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Previously the app user's credentials generated by db_setup lived only in the Terraform state and as a plain nullplatform service/link attribute — unlike rds-postgres-server, which stores its master password in Secrets Manager. Add an aws_secretsmanager_secret/_version pair (nullplatform/rds/<service_id>/app) alongside the existing postgresql_role, following the same naming convention as the master secret, and expose its ARN as app_secret_arn on both the service and link attributes. Wire the new region variable and aws provider into db_setup (needed to create the secret), destroy the secret alongside the app user/password on service delete, and widen the rds-postgres-db IAM policy from read-only GetSecretValue to full secret lifecycle management, scoped to the same nullplatform/rds/* prefix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
6 tasks
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+44
to
+52
| resource "aws_secretsmanager_secret" "app" { | ||
| name = "nullplatform/rds/${var.service_id}/app" | ||
| recovery_window_in_days = 0 | ||
|
|
||
| tags = { | ||
| "managed-by" = "nullplatform" | ||
| "service-id" = var.service_id | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
db_setupare now also stored in Secrets Manager (nullplatform/rds/<service_id>/app), matching howrds-postgres-serveralready handles the master password. Previously they only lived in Terraform state and as a plain nullplatform service/link attribute. The new secret is destroyed alongside the app user on service delete, and its ARN is exposed asapp_secret_arnon service/link attributes. Therds-postgres-dbIAM policy is widened from read-onlyGetSecretValueto full secret lifecycle management, scoped to the samenullplatform/rds/*prefix.secret_kms_key_idparameter (Terraform variable + UI-exposed field) so each instance can use its own customer-managed KMS key to encrypt its master secret. Left unset, it keeps using the defaultaws/secretsmanagermanaged key.Test plan
terraform fmt/validatepass onrds-postgres-server/deploymentandrds-postgres-db/db_setup(done locally)rds-postgres-serverrequirements/deployment in a test account, confirmsecret_kms_key_idleft empty still creates the secret with the default AWS-managed keysecret_kms_key_idto a customer-managed key ARN, confirm the master secret is encrypted with itrds-postgres-dbservice end-to-end, confirmaws_secretsmanager_secretnullplatform/rds/<service_id>/appis created with the correct credentialsapp_secret_arnshows up in service and link attributes🤖 Generated with Claude Code