Specify a KMS key for creating secrets
complete
E
Evergreen Iguana
When adding an AWS Secrets Manager, is it possible to specify which KMS key is used for creating secrets? This will help any secrets managed by Harness and hosted in SecretsManager be accessed by other accounts.
Log In
A
Abhishek Thamman
marked this post as
complete
The support for using CMK while creating/editing secrets stored in AWS Secret Manager is now released. Please refer to the documentation (https://developer.harness.io/docs/platform/secrets/secrets-management/add-an-aws-secret-manager/#inline-secret-in-aws-secrets-manager) for more details. Please note the following:
Selecting a Customer managed Key (CMK) for encryption is supported in Harness Delegate version 25.11.87300 or later and is behind the feature flag PL_ENABLE_NON_DEFAULT_ENCRYPTION_KEY.
This option would be unavailable if the AWS Secret Manager connector has the option Use "put-secret-value" action to update secret value enabled.
This post was marked as
in progress
A
Abhishek Thamman
marked this post as
long-term
I
Imaginative Mockingbird
Hi Prateek Mittal, currently when adding a new secret Harness just defaults to the key maintained by AWS. However, one current use use case brought to my attention would be the requirement for secrets to be created and managed with specific customer-managed keys. Unfortunately, with our current implementation, users in this scenario are required to create the key initially uuing the aws maintained key, then follow up either via the AWS console, or via AWS CLI and manually specify the ARN for the kms key id the user wanted to initially create the secret with. This makes secret creation a manual 2-step process for users who find themselves in this situation (especially for multiple secrets). The ask would be to add an input field when creating AWS SM connector to optionally specify a specific key id to be utilized when creating new secrets.
Prateek Mittal
marked this post as
pending feedback
Prateek Mittal
This is not supported today. We use the default kms key.
What is the need to specify a different KMS key? Can you explain the reasoning?
Prateek Mittal
marked this post as
under review