feat: support aws secret manager#11417
Conversation
HuanXin-Chen
changed the title
cb26bb8
membphis
left a comment
membphis
left a comment
There was a problem hiding this comment.
LGTM, except minor code style issues
|
|
||
| local secret = require("apisix.secret") | ||
| local value = secret.fetch_by_uri("$secret://aws/mysecret/jack/key") | ||
| ngx.say(value) |
There was a problem hiding this comment.
Just confirm, it will print a nil value in this test case?
And it will be considered as expected output, it make me little confused
I prefer this way:
if value then
ngx.say("secret value: ", value)
end
ngx.say("all done")| return data[sub_key] | ||
| end | ||
|
|
||
| _M.get = get |
There was a problem hiding this comment.
if we need to reuse the function get, the current style is good.
In this code, we do not need to reuse function get, so _M.get is better to read and understand
b9d317c
|
Hi, following the doc to configure this plugin (configured the [lua] secret.lua: fetch(): failed to fetch secret value: failed to retrtive data from aws secret manager: SecretsManager:getSecretValue() failed to connect to 'https://secretsmanager.ap-southeast-2.amazonaws.com:443': 20: unable to get local issuer certificate, client: 192.168.65.1, server: _, request: "GET /anything HTTP/1.1", host: "127.0.0.1:9080" Any suggestion? |
You need to install the CA certificate using the command: sudo apt-get install ca-certificates. And then, make sure that APISIX has configured it with the following setting: ssl_trusted_certificate: /etc/ssl/certs/ca-certificates.crt. |
|
When I used Vault previously I didn't remember having to go through this setup (but again the vault instance is running locally in Docker). What attributed to this differences? 🤔 |
This is because HTTPS is different from HTTP. |
6 participants
Description
Many enterprises are utilizing cloud services from AWS and GCP, relying on the secret manager provided by these platforms to handle sensitive information. Integrating Apache APISIX with these secret managers can streamline the process of using sensitive information within APISIX, enabling users to manage and utilize cloud-stored sensitive data more conveniently, thus enhancing the overall security and usability of the system.
This PR has completed the support for AWS. It added the aws.lua file to the original secret module, allowing users to store their secret information on AWS using the same reference method as before.
Checklist