I have been following this doc for creating a connection between my docker service running on my device with secret manager in my AWS account and retrieve the secret in my service.
My component name is PnP and my configuration looks like :-
{
"accessControl": {
"aws.greengrass.SecretManager": {
"PnP:secrets:1": {
"policyDescription": "Allows access to a secret.",
"operations": [
"aws.greengrass#GetSecretValue"
],
"resources": [
"*"
]
}
},
"aws.greengrass.ipc.pubsub": {
"PnP:pubsub:1": {
"policyDescription": "Allows access to publish to input topics.",
"operations": [
"aws.greengrass#PublishToTopic"
],
"resources": [
"cloudwatch/metric/put"
]
}
},
"aws.greengrass.ipc.mqttproxy": {
"PnP:pubsub:2": {
"policyDescription": "Allows access to subscribe to input topics.",
"operations": [
"aws.greengrass#SubscribeToIoTCore"
],
"resources": [
"*"
]
}
}
}
}
aws.greengrass.SecretManager configuration is:-
{
"reset": [],
"merge": {
"cloudSecrets": [
{
"arn": "arn:aws:secretsmanager:us-east-1:#####:secret:secretName"
},
{
"arn": "arn:aws:secretsmanager:us-east-1:#####:secret:secretName2"
}
]
}
}
Also, i have added the permission for Secret in my role:
{
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue"
],
"Resource": [
"arn:aws:secretsmanager:us-east-1:####:secret:secretName",
"arn:aws:secretsmanager:us-east-1:####:secret:secretName2"
]
}
Now, i am accessing the same in my java docker container using :-
final GreengrassCoreIPCClient client = new GreengrassCoreIPCClient(connection);
log.info("Client: {}", client);
final GetSecretValueRequest getSecretValueRequest = new GetSecretValueRequest();
getSecretValueRequest.setSecretId(secretArn);
getSecretValueRequest.setVersionStage("AWSCURRENT");
final GetSecretValueResponseHandler responseHandler = client.getSecretValue(getSecretValueRequest, Optional.empty());
final CompletableFuture<GetSecretValueResponse> responseFuture = responseHandler.getResponse();
try {
GetSecretValueResponse response = responseFuture.get(TIMEOUT_SECONDS, TimeUnit.SECONDS);
response.getSecretValue().postFromJson();
return response.getSecretValue().getSecretString();
} catch (TimeoutException e) {
log.error("Timeout Error fetching secret key ", e);
} catch (ExecutionException e) {
if (e.getCause() instanceof UnauthorizedError) {
log.error("UnAuthorized Error fetching secret key ", e);
} else {
log.error("Authorized Error fetching secret key ", e);
}
}
Now, i am getting exception at this line
responseFuture.get(TIMEOUT_SECONDS, TimeUnit.SECONDS)
in my container service my logs are:
13:34:40.462 INFO - Client: software.amazon.awssdk.aws.greengrass.GreengrassCoreIPCClient@196b8ae
13:34:40.483 INFO - ResponseHandler: java.util.concurrent.CompletableFuture@2e523e58[Completed exceptionally: java.util.concurrent.CompletionException: software.amazon.awssdk.aws.greengrass.model.ResourceNotFoundError]
13:34:40.484 ERROR - Authorized Error fetching secret key
java.util.concurrent.ExecutionException: software.amazon.awssdk.aws.greengrass.model.ResourceNotFoundError
at java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:395) ~[?:?]
at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2022) ~[?:?]
at com.amazon.spiderIoT.scanner.secret.SecretManagerImpl.getSecretKey(SecretManagerImpl.java:39) ~[SpiderScannerService-1.0.jar:?]
and greengrass.log looks like :-
2022-07-06T14:19:49.471Z [ERROR] (Thread-4) com.aws.greengrass.secretmanager.SecretManagerService: secret-access. Error happened with secret access. {secret=arn:aws:secretsmanager:us-east-1:####:secret:secretName, serviceName=aws.greengrass.SecretManager, currentState=RUNNING, Principal=PnP}
com.aws.greengrass.secretmanager.exception.v1.GetSecretException: Secret not found arn:aws:secretsmanager:us-east-1:##:secret:secretName
and i have verified using aws cli, and i am able to fetch the secret in console.