Database secret handling fix (#17)

Author: danielnaab

.github/workflows/_validate.yml

@@ -66,22 +66,22 @@ jobs:
       - name: Build
         run: pnpm build
 
-      - name: Make directory for build artifacts
-        run: mkdir -p output/build-artifacts
-
-      - name: Spotlight app performance budget
-        run: pnpm --filter @flexion/forms-spotlight size:ci > output/build-artifacts/spotlight-size-output.txt
-
-      - name: Design package performance budget
-        run: pnpm --filter @flexion/forms-design size:ci > output/build-artifacts/design-size-output.txt
-
-      - name: Upload size:ci results
-        uses: actions/upload-artifact@v4
-        with:
-          name: size-limit-results
-          path: |
-            output/build-artifacts/spotlight-size-output.txt
-            output/build-artifacts/design-size-output.txt
+      # - name: Make directory for build artifacts
+      #   run: mkdir -p output/build-artifacts
+
+      # - name: Spotlight app performance budget
+      #   run: pnpm --filter @flexion/forms-spotlight size:ci > output/build-artifacts/spotlight-size-output.txt
+
+      # - name: Design package performance budget
+      #   run: pnpm --filter @flexion/forms-design size:ci > output/build-artifacts/design-size-output.txt
+
+      # - name: Upload size:ci results
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: size-limit-results
+      #     path: |
+      #       output/build-artifacts/spotlight-size-output.txt
+      #       output/build-artifacts/design-size-output.txt
 
       - name: Lint source code
         shell: bash

apps/sandbox/src/index.ts

@@ -6,22 +6,31 @@ import { createCustomServer } from './server.js';
 const port = process.env.PORT || 4321;
 
 const getAppRunnerSecrets = async () => {
-  const dbSecretStr = process.env.DB_SECRET;
+  const dbSecretArn = process.env.DB_SECRET;
   const dbHost = process.env.DB_HOST;
   const dbPort = process.env.DB_PORT;
   const dbName = process.env.DB_NAME;
 
-  if (!dbSecretStr || !dbHost || !dbPort || !dbName) {
+  if (!dbSecretArn || !dbHost || !dbPort || !dbName) {
     console.error(
       'Missing required environment variables: DB_SECRET, DB_HOST, DB_PORT, DB_NAME'
     );
     return;
   }
 
+  // Fetch the secret from AWS Secrets Manager using the ARN
+  const vault = getAWSSecretsManagerVault();
+  const dbSecretStr = await vault.getSecret(dbSecretArn);
+
+  if (!dbSecretStr) {
+    console.error('Failed to retrieve secret from Secrets Manager');
+    return;
+  }
+
   const dbSecret = JSON.parse(dbSecretStr);
   if (!dbSecret.username || !dbSecret.password) {
     console.error(
-      '`DB_SECRET` environment variable is missing username or password'
+      'Secret from Secrets Manager is missing username or password'
     );
     return;
   }

infra/cdktf/src/lib/aws/sandbox-stack.ts

@@ -10,8 +10,6 @@ import { Route } from '../../../.gen/providers/aws/route';
 import { SecurityGroup } from '../../../.gen/providers/aws/security-group';
 import { DbSubnetGroup } from '../../../.gen/providers/aws/db-subnet-group';
 import { DbInstance } from '../../../.gen/providers/aws/db-instance';
-import { SecretsmanagerSecret } from '../../../.gen/providers/aws/secretsmanager-secret';
-import { SecretsmanagerSecretVersion } from '../../../.gen/providers/aws/secretsmanager-secret-version';
 import { EcrRepository } from '../../../.gen/providers/aws/ecr-repository';
 import { ApprunnerVpcConnector } from '../../../.gen/providers/aws/apprunner-vpc-connector';
 import { ApprunnerService } from '../../../.gen/providers/aws/apprunner-service';
@@ -20,8 +18,6 @@ import { IamRolePolicy } from '../../../.gen/providers/aws/iam-role-policy';
 import { IamRolePolicyAttachment } from '../../../.gen/providers/aws/iam-role-policy-attachment';
 import { DataAwsAvailabilityZones } from '../../../.gen/providers/aws/data-aws-availability-zones';
 
-import { getDatabaseSecretKey } from '@flexion/forms-infra-core';
-
 interface SandboxStackConfig {
   environment: string;
 }
@@ -151,28 +147,8 @@ export class SandboxStack extends Construct {
       },
     });
 
-    // Generate random password for database
+    // Database username (password will be managed by RDS in Secrets Manager)
     const dbUsername = 'postgres';
-    const dbPassword = Fn.base64encode(
-      Fn.uuid() // Use UUID for a secure random password
-    );
-
-    // Database secret (only username and password - host/port/db passed as env vars)
-    const dbSecret = new SecretsmanagerSecret(this, `${id}-db-secret`, {
-      name: getDatabaseSecretKey(environment),
-      description: `Database credentials for ${environment}`,
-      tags: {
-        Environment: environment,
-      },
-    });
-
-    new SecretsmanagerSecretVersion(this, `${id}-db-secret-version`, {
-      secretId: dbSecret.id,
-      secretString: Fn.jsonencode({
-        username: dbUsername,
-        password: dbPassword,
-      }),
-    });
 
     // RDS Subnet Group
     const dbSubnetGroup = new DbSubnetGroup(this, `${id}-db-subnet-group`, {
@@ -184,7 +160,7 @@ export class SandboxStack extends Construct {
       },
     });
 
-    // RDS Instance
+    // RDS Instance with AWS-managed password in Secrets Manager
     const rdsInstance = new DbInstance(this, `${id}-db`, {
       identifier: `${id}-db`,
       engine: 'postgres',
@@ -194,7 +170,7 @@ export class SandboxStack extends Construct {
       maxAllocatedStorage: 100,
       dbName: 'postgres',
       username: dbUsername,
-      password: dbPassword,
+      manageMasterUserPassword: true,
       dbSubnetGroupName: dbSubnetGroup.name,
       vpcSecurityGroupIds: [rdsSecurityGroup.id],
       publiclyAccessible: false,
@@ -340,7 +316,11 @@ export class SandboxStack extends Construct {
               DB_NAME: 'postgres',
             },
             runtimeEnvironmentSecrets: {
-              DB_SECRET: dbSecret.arn,
+              DB_SECRET: Fn.lookup(
+                Fn.element(rdsInstance.masterUserSecret, 0),
+                'secret_arn',
+                ''
+              ),
             },
           },
         },