Make cross-account usage easier about aws-secrets-manager-credentials-provider-plugin HOT 8 CLOSED

I havent found for now how I can see secrets from another account. If its possible, could you share the docs?
By myself I tried to open access to secrets from another account and I was able to get them. But they was not listed from output of "aws secretsmanager list-secrets" and I thought that it is a reason why I can`t use secrets from another account

from aws-secrets-manager-credentials-provider-plugin.

Some examples around cross-account usage would be good.

from aws-secrets-manager-credentials-provider-plugin.

Here is one example of how to do it, if you're able to set profiles in ~/.aws/config: https://stackoverflow.com/a/52805686/1475135

It boils down to setting the role_arn in an AWS profile to the IAM role you want Jenkins to assume (presumably in the other account). And then telling Jenkins to use that AWS profile. As a result when it runs its Secrets Manager calls they should run against the other account.

However, at the last count, Moto - the AWS mock used to test this Jenkins plugin - does not support cross-account operations. So we can't write any automated tests in the plugin's test suite which would demonstrate this working.

from aws-secrets-manager-credentials-provider-plugin.

Related to this, I aim to bring back a custom AWS client configuration feature in PR #43. This allows the STS AssumeRole strategy (among other strategies) to be configured for the plugin within Jenkins config (either in the Web UI or in CasC). This might help people who can't set these properties in the ~/.aws dotfiles.

from aws-secrets-manager-credentials-provider-plugin.

I also faced this problem...

Use case:
DevOps team manages shared development infrastructure inside its own AWS account.
The dedicated Jenkins controllers for other dev teams are deployed in the DevOps account inside the EKS cluster.
Each Jenkins has configured IAM roles that allow certain operations in external AWS accounts owned by the dev team.
Such external operations include launching EC2 jenkins-nodes and the use of allowed resources, such as SecretsManager.

I've used this guide to configure the cross-account access to SM and can confirm that the Jenkins pod can access them

root@jenkins-app-XYZ:/# aws sts get-caller-identity
{
    "UserId": "CENSORED:i-987654321",
    "Account": "<ops-account>",
    "Arn": "arn:aws:sts::<ops-account>:assumed-role/jenkins-eks-role/i-987654321"
}

root@jenkins-app-XYZ:/# aws secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:<region>:<dev-account>:secret:sasha-cred-test-OfRs6e --region <region>
{
    "ARN": "arn:aws:secretsmanager:<region>:<dev-account>:secret:sasha-cred-test-OfRs6e",
    "Name": "sasha-cred-test",
    "VersionId": "be934e3e-fede-4da7-bf1b-9338b9546664",
    "SecretString": "cred-test",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": 1637185003.849
}

...but as reported in #132 (comment) - such items aren't shown while trying to list them.

I was thinking if it's possible to add some options to the global plugin configuration, along with the Endpoint Configuration,
but the AWS CLI doesn't seem to support that 😢
I wish it could be more like ECR, where the URL also includes the Id: <registry-id>.dkr.ecr.<region>.amazonaws.com

from aws-secrets-manager-credentials-provider-plugin.

A potential solution for this problem might be supporting AWS credentials.
Presumable JCasC config:

credentials:
  system:
    domainCredentials:
      - credentials:
          - aws:
              id: "dev-account-access-secretsmanager"
              iamRoleArn: "arn:aws:iam::<dev-account>:role/dev-account-access-secretsmanager"
              scope: SYSTEM

unclassified:
  awsCredentialsProvider:
    endpointConfiguration:
      signingRegion: "<region>"
      credentialId: "dev-account-access-secretsmanager"

In this case, if Jenkins' IAM role allows assuming that external role, it would work like a charm!

from aws-secrets-manager-credentials-provider-plugin.

Hello I am facing this problem as well. In my case we have a Jenkins instance which is provisioned into a manager EKS cluster, which is provisioned into a separate AWS account. This Jenkins instance is then used to manage multiple clusters, and would need to access secrets from multiple AWS accounts to make them available to devs which own the clusters which are being managed by Jenkins.

Currently the plugin seems to pull only the secrets from the account to which its assumed role belongs

from aws-secrets-manager-credentials-provider-plugin.

@thecooldrop and others - plugin v1.1.0 is now released, which allows you to specify different authentication strategies for the AWS client. One of the strategies is an IAM role. Give it a go and see if it helps.

Unfortunately you won't be able to access secrets from multiple accounts, but you should be able to access secrets in a different account to the one Jenkins runs in. That will hopefully be of use to some of you.

from aws-secrets-manager-credentials-provider-plugin.