How does a local docker container load secrets from AWS Secret Manager?

Question

I have a simple web application running on my machine (Mac) using Docker. I want this application to load secrets from AWS Secret Manager. Does the application need to assume an IAM role to load the secret?

Also, I will eventually deploy this container to a self-managed Kubernetes cluster (no EKS/ECS). Is the process of loading secrets similar?

This is a Python fastAPI application, but examples in Spring Boot are welcomed. I'm more interested in the process.

JarroVGIT · Accepted Answer · 2022-08-01 08:42:46Z

2

There are more ways to Rome in this case, but one way might be:

Create a user that has access to the KMS key;
Create an access key for that user;
Set the access key and username for that user as an environment variable in your local environment.

When deploying to your own K8S cluster, you can also set the environment variables on the Pod (probably through something of a CI/CD pipeline).

The boto3 module knows a certain order in which it will try to authenticate itself, you can find more details here. Just make sure you name the environment variables correctly.

answered Aug 1, 2022 at 8:42

JarroVGIT

5,6042 gold badges25 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How does a local docker container load secrets from AWS Secret Manager?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related