How to properly use AWS Secrets Manager in a Elastic Beanstalk Deployment on Windows Server

user_15787737 0
Viewed 406

Im trying to pass my applications connectionstring from Secrets Manager into Elastic Beanstalk during deployment. If i remote desktop onto the server i am deploying to, i can run the following command -

aws secretsmanager get-secret-value --secret-id XXX-MY-SECRET-ID --version-stage AWSCURRENT --query=SecretString --output text

And it outputs correctly. All good.

However when i try and automate this through the .ebextensions folder, it always returns an empty string.

So ive tried lots of things, firstly using a container command to point to a Powershell file that i placed in the .ebextensions folder, like so -

container_commands:
 00-myscript:
  command : powershell.exe -ExecutionPolicy Bypass -Command ".\\.ebextensions\\BuildConnectionStrings.ps1"

Then the Powershell command would be

$response = aws secretsmanager get-secret-value --secret-id XXX-MY-SECRET-ID --version-stage AWSCURRENT --query=SecretString --output text 
$FileName = "ConnectionStrings.config"
New-Item $FileName -ItemType File
Set-Content $FileName $response

If i run this directly in powershell, it all works as expected. But when i deploy the site, it just creates an empty file.

Ive tried various combinations of putting the Powershell commands directly in the .ebextensions config files, always with the same result.

I just cant figure out why the same commands work when i run them directly on the server, but not when deployed through EB.

Ive been stuck for days on this, can anyone help?

aws-secrets-manager amazon-elastic-beanstalk windows-server amazon-web-services powershell
1 Answers

So for anyone else that has this problem...

Simply installing the aws cli on the server is not enough. The error i was getting was caused by PowerShell not recognising the aws command (even tho it had been installed).

The solution was to run the following code at the beginning of my script -

$command = "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12"
Invoke-Expression $command
Invoke-WebRequest -Uri "https://awscli.amazonaws.com/AWSCLIV2.msi" -Outfile C:\AWSCLIV2.msi
$arguments = "/i `"C:\AWSCLIV2.msi`" /quiet"
Start-Process msiexec.exe -ArgumentList $arguments -Wait
$env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine")
aws --version

This ensured that the aws cli would be installed (again).

I dont know why this is necessary, but its the only solution ive found

user_157877370
Related