Auto grant read secret permissions from a secret arn #183
Conversation
thedavl
changed the title
| function grantReadLambdasFromSecretArn(construct: Construct, arn: string, lambdaFunctions: lambda.Function[]) { | ||
| const secret = Secret.fromSecretPartialArn(construct, "DatadogApiKeySecret", arn); | ||
| lambdaFunctions.forEach((functionName) => { | ||
| secret.grantRead(functionName); |
There was a problem hiding this comment.
Users deploying these applications may not have permissions to grant read access to keys in SSM or KMS - is there a way we can make this optional?
There was a problem hiding this comment.
if users don't pass the construct to addLambdaFunctions we won't try to grant anything. We could document this explicitly, only pass in the construct if you want us to try auto-granting secret read permissions?
There was a problem hiding this comment.
the optional construct param is only used for this feature
There was a problem hiding this comment.
We could, but we may need the construct for other work in the near future.
Can we default this to true but allow users to disable this behavior if needed?
It's (occasionally) common to see devops teams own secrets management and have elevated permissions to create or grant read permissions to individual applications, so that individual developer teams can't read arbitrary keys out of secrets storage.
There was a problem hiding this comment.
Gotcha, makes sense. I'll add a config param for disabling it!
…m:DataDog/datadog-cdk-constructs into david.lee/auto-grant-read-secret-from-arn
| } | ||
| [DD_HANDLER_ENV_VAR]: "hello.handler", | ||
| }, | ||
| }, |
There was a problem hiding this comment.
Were these commas added by prettier or eslint? If so, we should get a rule created in the project's lint step to fail if these aren't present.
There was a problem hiding this comment.
will do in another PR!
| construct !== undefined && | ||
| baseProps.grantSecretReadAccess | ||
| ) { | ||
| log.debug("Granting read access to the provided Secret ARN for all your lambda functions."); |
What does this PR do?
If a secret ARN is provided & the construct is passed into
addLambdaFunctions, automatically grant read access to the given secret to all the lambdas added.Motivation
Ease of customer use. So customers don't have to manually grant secret read access anymore
Testing Guidelines
Additional Notes
Types of Changes
Check all that apply