ci: migrate CI secrets from AWS SSM to Vault KV#1145
Conversation
Move secret retrieval in get_secrets.sh from aws ssm get-parameter to vault kv get, aligning with the pattern used by datadog-lambda-js. Remove DATADOG_API_SECRET_ARN from CI secrets (the ARN is not sensitive) and hardcode it directly in the integration test utility.
|
Awaiting for kv vault permissions to hit so I can add secrets there |
There was a problem hiding this comment.
Pull request overview
This PR migrates CI secrets management from AWS Systems Manager Parameter Store to HashiCorp Vault KV, aligning with the pattern used in the datadog-lambda-js project. The changes remove the retrieval of DATADOG_API_SECRET_ARN from AWS SSM and instead hardcode the Secrets Manager ARN directly in the integration tests utility file.
Changes:
- Migrate
get_secrets.shfrom AWS SSMget-parametercommands to Vault KVgetcommands for fetching CI secrets - Remove the retrieval of
DATADOG_API_SECRET_ARNenvironment variable from AWS SSM - Hardcode the Datadog API secret ARN in
integration-tests/lib/util.ts
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.gitlab/scripts/get_secrets.sh |
Migrate secret retrieval from AWS SSM to Vault KV, removing DATADOG_API_SECRET_ARN retrieval |
integration-tests/lib/util.ts |
Hardcode the Secrets Manager ARN instead of reading from environment variable |
Prevent word splitting or special character issues by quoting the variable expansion in the -field argument.
| import {ACCOUNT, REGION} from "../config"; | ||
|
|
||
| export const datadogSecretArn = process.env.DATADOG_API_SECRET_ARN!; | ||
| export const datadogSecretArn = 'arn:aws:secretsmanager:us-east-1:425362996713:secret:extension-integration-tests-api-key-PnEPHz'; |
There was a problem hiding this comment.
nit: We may need to document this for future maintenance.
There was a problem hiding this comment.
yeah, this was an overkill, this wasn't designed with ideal secret manager handling, ideally we'd move this into creation on the project and then cleaning it up, but overall, having a secret in the project is still overkill
Summary
get_secrets.shfromaws ssm get-parametertovault kv get, matching the pattern used bydatadog-lambda-jsDATADOG_API_SECRET_ARNfrom CI secrets — the ARN is a public resource identifier, not sensitive dataintegration-tests/lib/util.tsTest plan
kv/k8s/gitlab-runner/datadog-lambda-extension/secretsDD_API_KEY,DD_APP_KEY, and external ID are correctly resolved