when we use filters option and deploy jenkins with configuration as code, plugin is not able to read if secrets are more than 10 about aws-secrets-manager-credentials-provider-plugin HOT 6 CLOSED

Any update on this team

from aws-secrets-manager-credentials-provider-plugin.

Tired with standalone installation too, its same issue fails with below error

Could not list credentials in Secrets Manager: message=[1 validation error detected: Value '[newrelic-api-key, newrelic-api-key1, newrelic-api-key2, newreli ...' at 'filters.1.member.values' failed to satisfy constraint: Member must have length less than or equal to 10 (Service: AWSSecretsManager; Status Code: 400; Error Code: ValidationException; Request ID: a6f2f509-fd82-4881-923a-a29e05dd3784; Proxy: null)]

Jenkins Version - Jenkins 2.346.3
Aws secret manager plugin - Tried with both 1.1.0 to 1.2.0

from aws-secrets-manager-credentials-provider-plugin.

The first thing to try would be replicating the list-secrets call in the AWS CLI, with the same parameters. That way you'll know if what you are seeing is an AWS limitation, or something in Jenkins.

I imagine this would be along the lines of

aws secretsmanager list-secrets --filters "Key=name,Values=<secret1>,<secret2>..."

Replace with your actual secret names of course.

from aws-secrets-manager-credentials-provider-plugin.

executed aws secretsmanager list-secrets --filters "Key=name,Values=<secret1>,<secret2>..." with actual secret names, it failed with below error

An error occurred (ValidationException) when calling the ListSecrets operation: 1 validation error detected: Value '[newrelic-api-key, newrelic-api-key1, newrelic-api-key2, newreli ...' at 'filters.1.member.values' failed to satisfy constraint: Member must have length less than or equal to 10

from aws-secrets-manager-credentials-provider-plugin.

Right, in that case what you are seeing is a limitation in AWS itself. You won't be able to pass this many filter criteria to it, no matter which tool you use.

If you have a group of secrets that you want to show up in Jenkins, I would recommend creating a common AWS tag on those secrets. That way you'll be able to set the tag key/value as your filter criteria in Jenkins, and only the secrets with that tag will show up in Jenkins.

Please also note that secret filters/tags are purely a client-side option to improve the user (administrator?) experience in Jenkins. They do not provide any kind of security.

from aws-secrets-manager-credentials-provider-plugin.

Thank you so much will explore this option

from aws-secrets-manager-credentials-provider-plugin.