fix: secrets manager retrieve secretRegion (#306)

aws · Nov 14, 2024 · 8c245d0 · 8c245d0
1 parent 70b74af
commit 8c245d0
Show file tree

Hide file tree

Showing 8 changed files with 31 additions and 18 deletions.
diff --git a/common/lib/authentication/aws_secrets_manager_plugin.ts b/common/lib/authentication/aws_secrets_manager_plugin.ts
@@ -53,17 +53,22 @@ export class AwsSecretsManagerPlugin extends AbstractConnectionPlugin {
     const config: SecretsManagerClientConfig = {};
 
     if (!secretId) {
-      throw new AwsWrapperError(Messages.get("AwsSecretsManagerConnectionPlugin.missingRequiredConfigParameter"));
+      throw new AwsWrapperError(Messages.get("AwsSecretsManagerConnectionPlugin.missingRequiredConfigParameter"), WrapperProperties.SECRET_ID.name);
     }
 
     if (!region) {
       const groups = secretId.match(AwsSecretsManagerPlugin.SECRETS_ARN_PATTERN)?.groups;
       if (groups?.region) {
         region = groups.region;
+      } else {
+        throw new AwsWrapperError(
+          Messages.get("AwsSecretsManagerConnectionPlugin.missingRequiredConfigParameter", WrapperProperties.SECRET_REGION.name)
+        );
       }
-      config.region = region;
     }
 
+    config.region = region;
+
     if (endpoint) {
       config.endpoint = endpoint;
     }

diff --git a/common/lib/database_dialect/limitless_database_dialect.ts b/common/lib/database_dialect/limitless_database_dialect.ts
@@ -1,12 +1,12 @@
 /*
   Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
-
+ 
   Licensed under the Apache License, Version 2.0 (the "License").
   You may not use this file except in compliance with the License.
   You may obtain a copy of the License at
-
+ 
   http://www.apache.org/licenses/LICENSE-2.0
-
+ 
   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

diff --git a/common/lib/highest_weight_host_selector.ts b/common/lib/highest_weight_host_selector.ts
@@ -1,12 +1,12 @@
 /*
   Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
-
+ 
   Licensed under the Apache License, Version 2.0 (the "License").
   You may not use this file except in compliance with the License.
   You may obtain a copy of the License at
-
+ 
   http://www.apache.org/licenses/LICENSE-2.0
-
+ 
   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

diff --git a/common/lib/utils/locales/en.json b/common/lib/utils/locales/en.json
@@ -15,7 +15,7 @@
   "HostInfo.noHostParameter": "Host parameter must be set, HostInfo not found or not provided.",
   "HostInfo.weightLessThanZero": "A HostInfo object was created with a weight value less than 0.",
   "AwsSecretsManagerConnectionPlugin.failedToFetchDbCredentials": "Was not able to either fetch or read the database credentials from AWS Secrets Manager. Ensure the correct secretId and region properties have been provided.",
-  "AwsSecretsManagerConnectionPlugin.missingRequiredConfigParameter": "Configuration parameter 'secretId' is required.",
+  "AwsSecretsManagerConnectionPlugin.missingRequiredConfigParameter": "Configuration parameter '%s' is required.",
   "AwsSecretsManagerConnectionPlugin.unhandledException": "Unhandled exception: '%s'",
   "AwsSecretsManagerConnectionPlugin.endpointOverrideInvalidConnection": "A connection to the provided endpoint could not be established: '%s'.",
   "ClusterAwareReaderFailoverHandler.invalidTopology": "'%s' was called with an invalid (null or empty) topology",

diff --git a/docs/using-the-nodejs-wrapper/using-plugins/UsingTheAwsSecretsManagerPlugin.md b/docs/using-the-nodejs-wrapper/using-plugins/UsingTheAwsSecretsManagerPlugin.md
@@ -20,11 +20,11 @@ The following properties are required for the AWS Secrets Manager Connection Plu
 > [!NOTE]  
 > To use this plugin, you will need to set the following AWS Secrets Manager specific parameters.
 
-| Parameter        | Value  | Required | Description                                                                                                                                                                                                                       | Example                  | Default Value |
-| ---------------- | :----: | :------: | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------- | ------------- |
-| `secretId`       | String |   Yes    | Set this value to be the secret name or the secret ARN.                                                                                                                                                                           | `secretId`               | `null`        |
-| `secretRegion`   | String |    No    | Set this value to be the region your secret is in.                                                                                                                                                                                | `us-east-2`              | `us-east-1`   |
-| `secretEndpoint` | String |    No    | Set this value to be the endpoint override to retrieve your secret from. This parameter value should be in the form of a URL, with a valid protocol (ex. `https://`) and domain (ex. `localhost`). A port number is not required. | `https://localhost:1234` | `null`        |
+| Parameter        | Value  |              Required               | Description                                                                                                                                                                                                                       | Example                  | Default Value |
+| ---------------- | :----: | :---------------------------------: | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------- | ------------- |
+| `secretId`       | String |                 Yes                 | Set this value to be the secret name or the secret ARN.                                                                                                                                                                           | `secretId`               | `null`        |
+| `secretRegion`   | String | Yes unless the `secretId` is an ARN | Set this value to be the region your secret is in.                                                                                                                                                                                | `us-east-2`              | `null`        |
+| `secretEndpoint` | String |                 No                  | Set this value to be the endpoint override to retrieve your secret from. This parameter value should be in the form of a URL, with a valid protocol (ex. `https://`) and domain (ex. `localhost`). A port number is not required. | `https://localhost:1234` | `null`        |
 
 > [!NOTE]  
 > A Secret ARN has the following format: `arn:aws:secretsmanager:<Region>:<AccountId>:secret:SecretName-6RandomCharacters`

diff --git a/examples/aws_driver_example/aws_secrets_manager_mysql_example.ts b/examples/aws_driver_example/aws_secrets_manager_mysql_example.ts
@@ -18,13 +18,17 @@ import { AwsMySQLClient } from "../../mysql/lib";
 
 const mysqlHost = "db-identifier.XYZ.us-east-2.rds.amazonaws.com";
 const port = 3306;
-const secretId = "id";
+const secretId = "SecretName";
+const secretRegion = "us-east-1";
+/* secretId can be set as secret ARN instead. The ARN includes the secretRegion */
+// const secretId = "arn:aws:secretsmanager:us-east-1:AccountId:secret:SecretName-6RandomCharacters";
 
 const client = new AwsMySQLClient({
   // Enable the AWS Secrets Manager Connection Plugin and configure connection parameters.
   host: mysqlHost,
   port: port,
   secretId: secretId,
+  secretRegion: secretRegion,
   plugins: "secretsManager"
 });
 

diff --git a/examples/aws_driver_example/aws_secrets_manager_postgresql_example.ts b/examples/aws_driver_example/aws_secrets_manager_postgresql_example.ts
@@ -19,14 +19,18 @@ import { AwsPGClient } from "../../pg/lib";
 const postgresHost = "db-identifier.XYZ.us-east-2.rds.amazonaws.com";
 const database = "employees";
 const port = 5432;
-const secretId = "id";
+const secretId = "SecretName";
+const secretRegion = "us-east-1";
+/* secretId can be set as secret ARN instead. The ARN includes the secretRegion */
+// const secretId = "arn:aws:secretsmanager:us-east-1:AccountId:secret:SecretName-6RandomCharacters";
 
 const client = new AwsPGClient({
   // Enable the AWS Secrets Manager Connection Plugin and configure connection parameters.
   host: postgresHost,
   database: database,
   port: port,
   secretId: secretId,
+  secretRegion: secretRegion,
   plugins: "secretsManager"
 });
 

diff --git a/tests/unit/reader_failover_handler.test.ts b/tests/unit/reader_failover_handler.test.ts
@@ -46,7 +46,7 @@ describe("reader failover handler", () => {
     when(mockDatabaseDialect.getFailoverRestrictions()).thenReturn([]);
     when(mockPluginService.getDialect()).thenReturn(instance(mockDatabaseDialect));
     when(mockPluginService.getDriverDialect()).thenReturn(instance(mockDriverDialect));
-    when(mockDriverDialect.connect(anything())).thenResolve(mockTargetClient);
+    when(mockDriverDialect.connect(anything(), anything())).thenResolve(mockClientWrapper);
   });
   afterEach(() => {
     reset(mockPluginService);
@@ -82,7 +82,7 @@ describe("reader failover handler", () => {
     expect(result.isConnected).toBe(true);
     expect(result.client).toBe(mockClientWrapper);
     expect(result.newHost).toBe(hosts[successHostIndex]);
-  }, 20000);
+  }, 30000);
 
   it("test failover timeout", async () => {
     // original host list: [active writer, active reader, current connection (reader), active