Unable to access Secrets in Secret Manager from inside docker service in Greengrass V2

Question

I have been following [this](https://docs.aws.amazon.com/greengrass/v2/developerguide/ipc-secret-manager.html) doc for creating a connection between my docker service running on my device with secret manager in my AWS account and retrieve the secret in my service.

My component name is PnP and my configuration looks like :-
```
{
  "accessControl": {
    "aws.greengrass.SecretManager": {
      "PnP:secrets:1": {
        "policyDescription": "Allows access to a secret.",
        "operations": [
          "aws.greengrass#GetSecretValue"
        ],
        "resources": [
          "*"
        ]
      }
    },
    "aws.greengrass.ipc.pubsub": {
      "PnP:pubsub:1": {
        "policyDescription": "Allows access to publish to input topics.",
        "operations": [
          "aws.greengrass#PublishToTopic"
        ],
        "resources": [
          "cloudwatch/metric/put"
        ]
      }
    },
    "aws.greengrass.ipc.mqttproxy": {
      "PnP:pubsub:2": {
        "policyDescription": "Allows access to subscribe to input topics.",
        "operations": [
          "aws.greengrass#SubscribeToIoTCore"
        ],
        "resources": [
          "*"
        ]
      }
    }
  }
}
```

aws.greengrass.SecretManager configuration is:-
```
{
  "reset": [],
  "merge": {
    "cloudSecrets": [
      {
        "arn": "arn:aws:secretsmanager:us-east-1:#####:secret:secretName"
      },
      {
        "arn": "arn:aws:secretsmanager:us-east-1:#####:secret:secretName2"
      }
    ]
  }
}
```

Also, i have added the permission for Secret in my role:
```
{
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue"
            ],
            "Resource": [
                "arn:aws:secretsmanager:us-east-1:####:secret:secretName",
                "arn:aws:secretsmanager:us-east-1:####:secret:secretName2"
            ]
}
```

Now, i am accessing the same in my java docker container using :-
```
final GreengrassCoreIPCClient client = new GreengrassCoreIPCClient(connection);
log.info("Client: {}", client);
final GetSecretValueRequest getSecretValueRequest = new GetSecretValueRequest();
getSecretValueRequest.setSecretId(secretArn);
getSecretValueRequest.setVersionStage("AWSCURRENT");
final GetSecretValueResponseHandler responseHandler = client.getSecretValue(getSecretValueRequest, Optional.empty());
final CompletableFuture responseFuture = responseHandler.getResponse();
try {
      GetSecretValueResponse response = responseFuture.get(TIMEOUT_SECONDS, TimeUnit.SECONDS);
      response.getSecretValue().postFromJson();
      return response.getSecretValue().getSecretString();
} catch (TimeoutException e) {
       log.error("Timeout Error fetching secret key ", e);
} catch (ExecutionException e) {
       if (e.getCause() instanceof UnauthorizedError) {
              log.error("UnAuthorized Error fetching secret key ", e);
       } else {
             log.error("Authorized Error fetching secret key ", e);
      }
}
```

Now, i am getting exception at this line
responseFuture.get(TIMEOUT_SECONDS, TimeUnit.SECONDS)

in my container service my logs are:
```
13:34:40.462 INFO  - Client: software.amazon.awssdk.aws.greengrass.GreengrassCoreIPCClient@196b8ae
13:34:40.483 INFO  - ResponseHandler: java.util.concurrent.CompletableFuture@2e523e58[Completed exceptionally: java.util.concurrent.CompletionException: software.amazon.awssdk.aws.greengrass.model.ResourceNotFoundError]
13:34:40.484 ERROR - Authorized Error fetching secret key 
java.util.concurrent.ExecutionException: software.amazon.awssdk.aws.greengrass.model.ResourceNotFoundError
	at java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:395) ~[?:?]
	at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2022) ~[?:?]
	at com.amazon.spiderIoT.scanner.secret.SecretManagerImpl.getSecretKey(SecretManagerImpl.java:39) ~[SpiderScannerService-1.0.jar:?]
```

and greengrass.log looks like :-
```
2022-07-06T14:19:49.471Z [ERROR] (Thread-4) com.aws.greengrass.secretmanager.SecretManagerService: secret-access. Error happened with secret access. {secret=arn:aws:secretsmanager:us-east-1:####:secret:secretName, serviceName=aws.greengrass.SecretManager, currentState=RUNNING, Principal=PnP}
com.aws.greengrass.secretmanager.exception.v1.GetSecretException: Secret not found arn:aws:secretsmanager:us-east-1:##:secret:secretName
```

and i have verified using aws cli, and i am able to fetch the secret in console.

Answer

In order for a container to access secrets via the IPC, you need to pass in additional environment variables to your container (e.g., `docker run...`). Please review [this documentation](https://docs.aws.amazon.com/greengrass/v2/developerguide/run-docker-container.html#docker-container-ipc) on accessing IPC via a container and see if that helps. The component lifecycle would look similar to this (focus on the `Run` command):

```json
     "Lifecycle": {
        "Install": "docker load -i {artifacts:path}/publish-to-iot-core.tar",
        "Run": "docker run -v $AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT:$AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT -e SVCUID -e AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT -e MQTT_TOPIC=\"{configuration:/topic}\" -e MQTT_MESSAGE=\"{configuration:/message}\" -e MQTT_QOS=\"{configuration:/qos}\" --rm publish-to-iot-core"
      }
```

Let me know if that helps! If if does, could you please +1 and accept the answer? If not, we'll get you sorted.

Unable to access Secrets in Secret Manager from inside docker service in Greengrass V2

関連するコンテンツ