88 lines
2.6 KiB
TypeScript
88 lines
2.6 KiB
TypeScript
import * as cdk from "aws-cdk-lib";
|
|
import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
|
|
import { Construct } from "constructs";
|
|
|
|
interface SecretsStackProps extends cdk.StackProps {
|
|
/**
|
|
* Environment name (dev, staging, prod)
|
|
*/
|
|
environment: string;
|
|
|
|
/**
|
|
* Database username (default: rentall_admin)
|
|
*/
|
|
dbUsername?: string;
|
|
}
|
|
|
|
export class SecretsStack extends cdk.Stack {
|
|
/**
|
|
* Database credentials secret
|
|
*/
|
|
public readonly databaseSecret: secretsmanager.Secret;
|
|
|
|
/**
|
|
* Application secrets (JWT, etc.)
|
|
*/
|
|
public readonly appSecret: secretsmanager.Secret;
|
|
|
|
constructor(scope: Construct, id: string, props: SecretsStackProps) {
|
|
super(scope, id, props);
|
|
|
|
const { environment, dbUsername = "rentall_admin" } = props;
|
|
|
|
// Database credentials secret with auto-generated password
|
|
this.databaseSecret = new secretsmanager.Secret(this, "DatabaseSecret", {
|
|
secretName: `rentall/${environment}/database`,
|
|
description: `Database credentials for rentall ${environment} environment`,
|
|
generateSecretString: {
|
|
secretStringTemplate: JSON.stringify({
|
|
username: dbUsername,
|
|
}),
|
|
generateStringKey: "password",
|
|
excludePunctuation: true,
|
|
excludeCharacters: '/@"\'\\',
|
|
passwordLength: 32,
|
|
},
|
|
});
|
|
|
|
// Application secrets (JWT secret, etc.)
|
|
this.appSecret = new secretsmanager.Secret(this, "AppSecret", {
|
|
secretName: `rentall/${environment}/app`,
|
|
description: `Application secrets for rentall ${environment} environment`,
|
|
generateSecretString: {
|
|
secretStringTemplate: JSON.stringify({
|
|
// Add any additional app secrets here
|
|
}),
|
|
generateStringKey: "jwtSecret",
|
|
excludePunctuation: false,
|
|
passwordLength: 64,
|
|
},
|
|
});
|
|
|
|
// Outputs
|
|
new cdk.CfnOutput(this, "DatabaseSecretArn", {
|
|
value: this.databaseSecret.secretArn,
|
|
description: "Database credentials secret ARN",
|
|
exportName: `DatabaseSecretArn-${environment}`,
|
|
});
|
|
|
|
new cdk.CfnOutput(this, "DatabaseSecretName", {
|
|
value: this.databaseSecret.secretName,
|
|
description: "Database credentials secret name",
|
|
exportName: `DatabaseSecretName-${environment}`,
|
|
});
|
|
|
|
new cdk.CfnOutput(this, "AppSecretArn", {
|
|
value: this.appSecret.secretArn,
|
|
description: "Application secrets ARN",
|
|
exportName: `AppSecretArn-${environment}`,
|
|
});
|
|
|
|
new cdk.CfnOutput(this, "AppSecretName", {
|
|
value: this.appSecret.secretName,
|
|
description: "Application secrets name",
|
|
exportName: `AppSecretName-${environment}`,
|
|
});
|
|
}
|
|
}
|