AWS Secrets Manager Plugin

The AWS Advanced NodeJS Wrapper supports usage of database credentials stored as secrets in the AWS Secrets Manager through the AWS Secrets Manager Connection Plugin. When you create a new connection with this plugin enabled, the plugin will retrieve the secret and the connection will be created with the credentials inside that secret.

Prerequisites

• This plugin requires the following packages to be installed:
  • @aws-sdk/client-secrets-manager

Enabling the AWS Secrets Manager Connection Plugin

To enable the AWS Secrets Manager Connection Plugin, add the plugin code secretsManager to the plugins connection parameter.

This plugin requires a valid set of AWS credentials to retrieve the database credentials from AWS Secrets Manager. The AWS credentials must be located in one of these locations supported by the AWS SDK's default credentials provider. See also at AWS Credentials Configuration

AWS Secrets Manager Connection Plugin Parameters

The following properties are required for the AWS Secrets Manager Connection Plugin to retrieve database credentials from the AWS Secrets Manager.

Parameter	Value	Required	Description	Example	Default Value
secretId	String	Yes	Set this value to be the secret name or the secret ARN.	secretId	null
secretRegion	String	Yes unless the secretId is an ARN	Set this value to be the region your secret is in.	us-east-2	null
secretEndpoint	String	No	Set this value to be the endpoint override to retrieve your secret from. This parameter value should be in the form of a URL, with a valid protocol (ex. https://) and domain (ex. localhost). A port number is not required.	https://localhost:1234	null
secretExpirationSec	Integer	No	This property sets the time in seconds that secrets are cached before it is re-fetched.	600	870
secretUsernameProperty	String	No	Set this value to be the key in the JSON secret that contains the username for database connection.	db_user	username
secretPasswordProperty	String	No	Set this value to be the key in the JSON secret that contains the password for database connection.	db_pass	password

Secret Data

The secret stored in the AWS Secrets Manager should be a JSON object containing the properties username and password. If the secret contains different key names, you can specify them with the secretUsernameProperty and secretPasswordProperty parameters.

Example

Examples of making a connection using credentials fetched from the AWS Secrets Manager can be found at: PostgreSQL example and MySQL example