Contact Us 1-800-596-4880
  1. Homepage
  2. Amazon Secrets Manager Properties Provider (1.2)

  3. Amazon Secrets Manager Properties Provider Examples

All Connectors

Amazon Secrets Manager Properties Provider Examples

The following examples enable you how to configure Amazon Secrets Manager Properties Provider to retrieve your secrets from Amazon Secrets Manager cloud service

When using dynamic configurations (such as #[]), the configuration lifecycle differs significantly from static configurations (such as ${}). For more information, see Dynamic Configuration Lifecycle.

Configure AWS Connection Types

Anypoint Connectors can use Amazon Secrets Manager Properties Provider in their configurations. The following example illustrates how to configure the AWS connection type in the AWS Secrets Manager Properties Override Config of Anypoint Studio:

  1. In Studio, navigate to the Global Elements tab.

  2. Click Create.

  3. In the Choose Global Type window, type AWS Secrets Manager.

  4. Select AWS Secrets Manager Properties Override Config.

  5. Click OK.

  6. In the Global Element Properties window, you can configure the following fields:

Name Type Description Default Value Required

AWS Secrets Manager Region

String

AWS Secrets Manager region, for example, us-east-2.

x

AWS Access Key

String

AWS access key ID.

AWS Secret Key a

String

AWS secret key ID.

Custom Endpoint URL

String

Custom endpoint URL that overrides the default regional AWS Secrets Manager endpoint. Use this field to route Secrets Manager calls through an AWS VPC interface endpoint (AWS PrivateLink) or to a local testing service such as LocalStack, for example, http://localhost:4566. When unset, the connector uses the default regional AWS endpoint.

Role ARN

String

Uniquely identifies a role to gain cross-account access.

External ID

String

The External ID is used to prevent the confused deputy problem when assuming a role in another account.

STS Endpoint URL

String

Custom endpoint URL that overrides the default regional AWS STS endpoint used when assuming a role. Configure this field independently of Custom Endpoint URL to route AWS STS calls through a separate VPC interface endpoint. When unset, the connector uses the default regional AWS STS endpoint.
Example of Amazon Secrets Manager Properties Provider in Global Element Properties window of Anypoint Studio

In the Configuration XML editor, the configuration looks like this:

  <aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config" doc:id="4507e2b4-3205-4400-b903-848dcba504a7" >
		<aws-secrets-manager-properties-override:basic-connection region="us-east-1" />
		<aws-secrets-manager-properties-override:role-connection roleARN="arn:aws:iam::480410955647:role/AmazonSSMRoleForAutomationAssumeQuickSetup" externalId="38cf7bd2-decf-4ac3-8cff-cbad32f29bg9" />
	</aws-secrets-manager-properties-override:config>

If you do not provide credentials, the default AWS connection follows the default credentials provider chain - AWS SDK for Java 2.x. This chain enables you to supply AWS credentials and the region through runtime environment variables (for example, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION) instead of hardcoding them in the Mule app configuration. For the list of supported environment variables and a configuration example, see Environment Variables.

Configure AWS Secrets Manager Using a JSON String

The following example shows how to configure the Amazon Secrets Manager Properties Provider for Amazon S3 Connector by using a JSON string where you create the secret manager keys.

Based on a JSON file that contains accessKey and secretKey:

aws secretsmanager create-secret --name aws-credentials   --secret-string '{"accessKey":"ACCESSKEY", "secretKey":"SECRET"}'

  1. In the Amazon S3 Configuration global element properties window, select fx to set expression values.

  2. Set Access Key to ${aws-secrets::aws-credentials}.accessKey.

  3. Set Secret Key to ${aws-secrets::aws-credentials}.secretKey.

Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with JSON expression

In the Configuration XML editor, the configuration looks like this:

<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration">
		<s3:connection accessKey="#[${aws-secrets::aws-credentials}.accessKey]" secretKey="#[${aws-secrets::aws-credentials}.secretKey]" />
	</s3:config>

Handle JSON Keys with Dots

If your JSON secret contains keys with dots in their names, DataWeave treats the dots as subtrees in JSON. Make sure that configuration fields are set to Expression mode (fx button enabled) when using these syntaxes.

For example, with this JSON structure, access the value using ${aws-secrets::mySecretName}.'myProject.demo.accessKey'.

{
  "myProject.demo.accessKey": "XXXXXXXX",
  "myProject.demo.secretKey": "XXXXXXXX",
  "myProject.demo.region": "us-east-1",
  "myProject.demo.roleArn": "arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole",
  "myProject.example.http.Port": "8081"
 }

For example, with this JSON structure, access the value using ${aws-secrets::mySecretName}.myProject.demo.accessKey.

{
 "myProject": {
  "demo": {
   "accessKey": "XXXXXXXX",
   "secretKey": "XXXXXXXX",
   "region": "us-east-1",
   "roleArn": "arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole"
  }
 }
}

Example: Using JSON Keys with Dots With IBM Connector Configuration

This example shows how to configure IBM MQ Connector using JSON keys with dots in their names:

<ibm-mq:config name="IBM_MQ_Config" doc:name="IBM MQ Config">
	<ibm-mq:connection username="#[${aws-secrets::mySecretName}.'myProject.example.user']" password="#[${aws-secrets::mySecretName}.'myProject.example.pass']">
		<ibm-mq:connection-mode>
			<ibm-mq:client host="localhost" queueManager="QM1" channel="dummyChannel"/>
		</ibm-mq:connection-mode>
	</ibm-mq:connection>
</ibm-mq:config>

Configure AWS Secrets Manager as a String

The following example shows how to configure the secret manager keys as a string for Amazon S3 Connector.

Based on the following string:

aws secretsmanager create-secret --name accessKey  --secret-string "ACCESSKEY"
aws secretsmanager create-secret --name secretKey  --secret-string "SECRET"

In the Amazon S3 Configuration global element properties window:

  1. Set Access Key to ${aws-secrets::accessKey}.

  2. Set Secret Key to ${aws-secrets::secretKey}.

Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with a string value

In the Configuration XML editor, the configuration looks like this:

<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration" >
		<s3:connection accessKey="${aws-secrets::accessKey}" secretKey="${aws-secrets::secretKey}" />
	</s3:config>

Avoid using the $ special character in values stored in the secret manager. If you must use the $ character, use the variable in literal mode, which treats it as a string. After that, you can convert the entire value to JSON and extract the required information.

See Also

Salesforce Help

Back to top