Does codebuild make multiple calls to secret manager if secret names are the same?

Question

I am storing database credentials in Secret Manager as a stringified JSON. I want CodeBuild to fetch the secret and then set one of the JSON params as an environment variable. If I do this multiple times for the same secret, will it make multiple calls or just one call to Secret Manager?

I'm talking about the env/secrets-manager in the buildspec https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec.env.variables.

I want to do something like this:

```yml
# buildspec.yml
version: 0.2

env:
  secrets-manager:
    DB_PASSWORD: mydbsecret:password
    DB_USERNAME: mydbsecret:username
```

Riku_Kobayashi · Answer

Hello.

I tested it in my environment with the following buildspec.yml:  
```
version: 0.2

env:
  secrets-manager:
    DB_PASSWORD: arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:test:name
    DB_USERNAME: arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:test:test

phases:
  install:
    on-failure: ABORT
    commands:
      - echo $DB_PASSWORD
      - echo $DB_USERNAME
  pre_build:
    on-failure: ABORT
    commands:
      - echo "pre_build phases"
  build:
    on-failure: ABORT
    commands:
      - echo "build phases"
  post_build:
    on-failure: ABORT
    commands:
      - echo "post_build phases"
artifacts:
  files:
    - "**/*"
```

Since CloudTrail has recorded two action of "GetSecretValue" executed by CodeBuild against the same SecretsManager, it can be inferred that access occurs as many times as specified in the buildspec.yml file.  
![a](/media/postImages/original/IM6S3Q6ApGTXyAL3SWb3oF-g)

re:Post Agent · Answer

Based on the available information, there's no explicit documentation that states whether AWS CodeBuild makes a single call or multiple calls to AWS Secrets Manager when retrieving different values from the same secret in a buildspec file.

In your example, you're trying to extract two different fields (`password` and `username`) from the same JSON secret (`mydbsecret`). The buildspec format you've shown is the correct way to reference specific JSON fields within a secret.

When using AWS Secrets Manager with CodeBuild, the service role for your build project must have the `secretsmanager:GetSecretValue` permission. AWS recommends storing secrets with names that start with `/CodeBuild/` (for example, `/CodeBuild/dockerLoginPassword`). If you use the "New service role" option when creating your build project, CodeBuild includes the necessary permissions to access secrets with names that start with `/CodeBuild/`. If your secret names don't follow this pattern, you'll need to update the service role to allow access to those specific secret names.

While the documentation doesn't specifically address whether multiple references to the same secret result in multiple API calls, the implementation details of how CodeBuild retrieves secrets from Secrets Manager are not explicitly documented in the provided sources.  
**Sources**  
[Change build project settings in AWS CodeBuild - AWS CodeBuild](https://docs.aws.amazon.com/codebuild/latest/userguide/change-project.html)  
[Create a build project in AWS CodeBuild - AWS CodeBuild](https://docs.aws.amazon.com/codebuild/latest/userguide/create-project.html)  
[AWS CodeBuild build and test action reference - AWS CodePipeline](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-CodeBuild.html)

Does codebuild make multiple calls to secret manager if secret names are the same?

Add your answer

Relevant content