This message was deleted.

sparse-intern-71089

10/20/2021, 7:37 AM

This message was deleted.

prehistoric-activity-61023

10/20/2021, 8:23 AM

I can’t see why not 🙂 I’d go that way: • create a random password using

pulumi-random

module (https://github.com/pulumi/pulumi-random) • save this password to SecretManager using https://www.pulumi.com/registry/packages/aws/api-docs/secretsmanager/secret/ • create RDS database using https://www.pulumi.com/registry/packages/aws/api-docs/rds/instance/ (and passing the password created in the first step)

swift-australia-96791

10/20/2021, 8:40 AM

Yeah, thanks for the prompt response. I was looking for an option where I can leverage Credentials for RDS database feature of Secret Manager itself.

swift-australia-96791

10/20/2021, 8:41 AM

but yes if thats not feasible then your solutions is the way to go..

prehistoric-activity-61023

10/20/2021, 8:42 AM

I’m not that familiar with AWS so not sure if I can help. Can you share a link to AWS docs where this feature is described?

swift-australia-96791

10/20/2021, 8:51 AM

https://aws.amazon.com/blogs/security/rotate-amazon-rds-database-credentials-automatically-with-aws-secrets-manager/

prehistoric-activity-61023

10/20/2021, 8:59 AM

well, I guess it’s double but it’s not gonna be as straightforward as we’d like it to be 😄

prehistoric-activity-61023

10/20/2021, 9:01 AM

Secret manager is the way to go. However, the password rotation will be an issue. When you enable rotation in AWS console, AWS magically provisions a lambda for you. If you don’t use console, command line steps are a bit more involving as they require the use of aws serverless repo (SAR). Sadly, official support for SAR is not yet avaiable in terraform. Thus you would have to use
local-exec
provisioner to run aws cli to create rotation lambda as in the linked documentation using SAR.

source: https://stackoverflow.com/a/63546950

prehistoric-activity-61023

10/20/2021, 9:02 AM

I can see that pulumi has some resources for that https://www.pulumi.com/registry/packages/aws/api-docs/secretsmanager/secretrotation/

prehistoric-activity-61023

10/20/2021, 9:03 AM

However, I’m not sure how you should actually “connect” the password from secret manager to RDS so it’s gonna be in sync 🤔

prehistoric-activity-61023

10/20/2021, 9:09 AM

Oh… I think I might get it now… You need to provide the lambda function to actually rotate the password in related services (in this case, RDS database). Right now it’s just a guess on my side. If I’m right, it means that AWS creates a lambda function automatically for that when you use Web Console and in case of IaC, you have to do that on your own (that’s no surprise - many single-clicks on web ui are in fact a series of operations).

prehistoric-activity-61023

10/20/2021, 9:14 AM

hah, it seems I might have guessed just right

prehistoric-activity-61023

10/20/2021, 9:14 AM

@swift-australia-96791 take a look at this: https://github.com/giuseppeborgese/terraform-aws-secret-manager-with-rotation

swift-australia-96791

10/20/2021, 1:34 PM

thanks Jakub for providing useful information, really appreciate for your prompt responses

229 Views

Open in Slack

Previous Next

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.