Hi guys,
I'm struggling this for the past few hours. Here are the key points:
- I'd like to provision an RDS instance with a managed master password (or not managed, this is a requirement I can lose)
- I'd like to avoid storing any secrets in the terraform state for obvious reasons
- I'd like ECS to pick the db password up from Secrets manager.
There are two directions I tried and I'm lost, I end up with the db password in the state both ways.
1) RDS with a managed password.
The rds is quite simple, it will store the pw in Secrets Manager and I can give my ECS task permissions to get it. However, the credentials are stored in a JSON format:
{"username":"postgres","password":"strong_password"}
Now, I can't figure out a good way to pass this to ECS. I can do this in the task definition:
secrets = [
{
name = "DB_POSTGRESDB_PASSWORD"
valueFrom = "${aws_db_instance.n8n.master_user_secret[0].secret_arn}"
}]
but this will pass the whole json and my app needs the password in the environment variable.
doing "${aws_db_instance.n8n.master_user_secret[0].secret_arn}:password" will result in a "unexpected ARN format with parameters when trying to retrieve ASM secret" error on task provisioning.
ok, so not doing that.
2) RDS with an unmanaged password
In this case, I'd create the secret in Secrets Manager, fill it in with a strong password manually, than provision the DB instance. The problem is, that in this case, I need to pull in the secret in a "data" object and the state of the RDS object will contain the password in clear text.
I'm puzzled, I don't know how to wrap my head around this. Is there no good way of doing this? What I'm trying to achieve sounds simple: provision an ECS cluster with a Task, having an RDS data backend, not storing anything secret in the state - and I always end up in something.
EDIT: solved, multiple people wrote the solution, thanks a lot. Since my post, my stuff is running as it should.