AWS CLI - secretsmanager

 

 

zzh@ZZHPC:~$ aws configure
AWS Access Key ID [None]: xxxxxxxxxxxxxxxxxxxx
AWS Secret Access Key [None]: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Default region name [None]: ap-southeast-2
Default output format [None]: json
zzh@ZZHPC:~$ ls -l .aws
total 8
-rw------- 1 zzh zzh  43 Dec 17 19:58 config
-rw------- 1 zzh zzh 116 Dec 17 19:58 credentials

 

zzh@ZZHPC:~$ aws secretsmanager help

AVAILABLE COMMANDS
o batch-get-secret-value

o cancel-rotate-secret

o create-secret

o delete-resource-policy

o delete-secret

o describe-secret

o get-random-password

o get-resource-policy

o get-secret-value

o help

o list-secret-version-ids

o list-secrets

o put-resource-policy

o put-secret-value

o remove-regions-from-replication

o replicate-secret-to-regions

o restore-secret

o rotate-secret

o stop-replication-to-replica

o tag-resource

o untag-resource

o update-secret

o update-secret-version-stage

o validate-resource-policy

zzh@ZZHPC:~$ aws secretsmanager get-secret-value --secret-id zimple_bank

An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:iam::793698357301:user/github-ci is not authorized to perform: secretsmanager:GetSecretValue on resource: zimple_bank because no identity-based policy allows the secretsmanager:GetSecretValue action

Solution:

 

 

zzh@ZZHPC:~$ aws secretsmanager get-secret-value help


SYNOPSIS
            get-secret-value
          --secret-id <value>
          [--version-id <value>]
          [--version-stage <value>]
          [--cli-input-json | --cli-input-yaml]
          [--generate-cli-skeleton <value>]
          [--debug]
          [--endpoint-url <value>]
          [--no-verify-ssl]
          [--no-paginate]
          [--output <value>]
          [--query <value>]
          [--profile <value>]
          [--region <value>]
          [--version <value>]
          [--color <value>]
          [--no-sign-request]
          [--ca-bundle <value>]
          [--cli-read-timeout <value>]
          [--cli-connect-timeout <value>]
          [--cli-binary-format <value>]
          [--no-cli-pager]
          [--cli-auto-prompt]
          [--no-cli-auto-prompt]

OPTIONS
       --secret-id (string)
          The ARN or name of the secret to retrieve.

          For an ARN, we recommend that you specify a complete ARN rather than
          a partial ARN. See Finding a secret from a partial ARN .

       --version-id (string)
          The  unique  identifier of the version of the secret to retrieve. If
          you include both this parameter and VersionStage , the  two  parame-
          ters must refer to the same secret version. If you don't specify ei-
          ther a VersionStage or VersionId , then Secrets Manager returns  the
          AWSCURRENT version.

          This  value  is typically a UUID-type value with 32 hexadecimal dig-
          its.
......

 

zzh@ZZHPC:~/.aws$ aws secretsmanager get-secret-value --secret-id zimple_bank --query SecretString

zzh@ZZHPC:~/.aws$ aws secretsmanager get-secret-value --secret-id zimple_bank --query SecretString --output text

zzh@ZZHPC:~/.aws$ aws secretsmanager get-secret-value --secret-id zimple_bank --query SecretString --output text | jq 'to_entries'
[
  {
    "key": "DB_SOURCE",
    "value": "xxxxxxxxxx"
  },
  {
    "key": "TOKEN_SYMMETRIC_KEY",
    "value": "xxxxxxxxxx"
  }
]

zzh@ZZHPC:~/.aws$ aws secretsmanager get-secret-value --secret-id zimple_bank --query SecretString --output text | jq 'to_entries|map("\(.key)=\(.value)")'
[
  "DB_SOURCE=xxxxxxxxxx",
  "TOKEN_SYMMETRIC_KEY=xxxxxxxxxx"
]

zzh@ZZHPC:~/.aws$ aws secretsmanager get-secret-value --secret-id zimple_bank --query SecretString --output text | jq 'to_entries|map("\(.key)=\(.value)")|.[]'
"DB_SOURCE=xxxxxxxxxx"
"TOKEN_SYMMETRIC_KEY=xxxxxxxxxx"

zzh@ZZHPC:~/.aws$ aws secretsmanager get-secret-value --secret-id zimple_bank --query SecretString --output text | jq -r 'to_entries|map("\(.key)=\(.value)")|.[]'
DB_SOURCE=xxxxxxxxx
TOKEN_SYMMETRIC_KEY=xxxxxxxxxx