feat(secretsmanager): support secrets rotation in GovCloud

[laurelmay]

This follows the same general setup as #14608 to add Secrets Manager rotation support in the aws-us-gov partition, GovCloud (US).

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[njlynch]

Thanks for this contribution, @kylelaker !

Can you provide any documentation or references for these values? I'm not able to find any official sources for them off-hand.

[laurelmay]

@njlynch Not sure of docs, but I've found it in the AWS Console :) So SecretsManagerRDSPostgreSQLRotationSingleUser for example.

Of course, that's a link directly to the GovCloud (US) console, so the result of clicking "Copy as SAM Resource" follows if that's a barrier. Let me know if there's a better place that I could point to. aws serverlessrepo get-application --application-id arn:aws-us-gov:serverlessrepo:us-gov-west-1:023102451235:applications/SecretsManagerRDSPostgreSQLRotationSingleUser seems to work as well.

  SecretsManagerRDSPostgreSQLRotationSingleUser:
    Type: AWS::Serverless::Application
    Properties:
      Location:
        ApplicationId: arn:aws-us-gov:serverlessrepo:us-gov-west-1:023102451235:applications/SecretsManagerRDSPostgreSQLRotationSingleUser
        SemanticVersion: 1.1.93
      Parameters: 
        # The Secrets Manager endpoint to use.
        endpoint: YOUR_VALUE
        # A string of the characters that you don't want in the password.
        # excludeCharacters: ':/@"\'\' # Uncomment to override default value
        # The name of the Lambda function.
        functionName: YOUR_VALUE
        # The service principal for the invoking service.
        # invokingServicePrincipal: 'secretsmanager.amazonaws.com' # Uncomment to override default value
        # The ARN of the KMS key that Secrets Manager uses to encrypt the secret.
        # kmsKeyArn: '' # Uncomment to override default value
        # A comma-separated list of security group IDs applied to the database.
        # vpcSecurityGroupIds: '' # Uncomment to override default value
        # A comma-separated list of VPC subnet IDs applied to the database network.
        # vpcSubnetIds: '' # Uncomment to override default value  

get-application CLI result

aws serverlessrepo get-application --application-id arn:aws-us-gov:serverlessrepo:us-gov-west-1:023102451235:applications/SecretsManagerRDSPostgreSQLRotationSingleUser
{
    "ApplicationId": "arn:aws-us-gov:serverlessrepo:us-gov-west-1:023102451235:applications/SecretsManagerRDSPostgreSQLRotationSingleUser",
    "Author": "AWS Secrets Manager",
    "CreationTime": "2019-06-07T23:11:09.626Z",
    "Description": "Conducts an AWS SecretsManager secret rotation for RDS PostgreSQL using single user rotation scheme",
    "IsVerifiedAuthor": false,
    "Labels": [],
    "LicenseUrl": "https://awsserverlessrepo-applications-igswkzhz6pbo.s3.us-gov-west-1.amazonaws.com/023102451235/SecretsManagerRDSPostgreSQLRotationSingleUser/ce9bd713-d973-47e0-a053-1ad70b50bb23/assets/license.txt?X-Amz-Security-Token=FwoDYXdzEO7%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDG2hL7Lf5IZwxJ1JsSLEAfXRfegvhUB6B6DQvYy%2Bt4Ua8hCi8i6G5EwWTrtUYRi0CVYKmN65nSbTtVabVJ4gtYO5b88VeGWylbZS0hSkDjytHXJVx1szuFS%2BeaLUrMW3%2BpumtFbSEbX8a1h6qq9sxUQH2XuATIFWH0gc95VbQaWydHPcjNagJCpdO9Vpd4mZmLvMzeifMZIf7L6uPZk5LwuGgXLXWgqITGODrYTHHU4o0q6B%2FKlCJxOx96YVfO6gfm4NWdlmdYt2QQ%2BkkCcsoJVRvZAopf%2BYjQYyKvT4hNUT%2BERptCbeWbXjqGHzGLZXwz%2FI1KWtm8dcdLccLpXcdPnUXW6Xsw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20211130T163924Z&X-Amz-SignedHeaders=host&X-Amz-Expires=1800&X-Amz-Credential=ASIA5XB5VB55ZMMMUWGU%2F20211130%2Fus-gov-west-1%2Fs3%2Faws4_request&X-Amz-Signature=d656ede5192ba47a38ee4d7e758447ace1d88cb58352fc446130767e38e0b555",
    "Name": "SecretsManagerRDSPostgreSQLRotationSingleUser",
    "ReadmeUrl": "https://awsserverlessrepo-applications-igswkzhz6pbo.s3.us-gov-west-1.amazonaws.com/023102451235/SecretsManagerRDSPostgreSQLRotationSingleUser/ce9bd713-d973-47e0-a053-1ad70b50bb23/assets/readme.md?X-Amz-Security-Token=FwoDYXdzEO7%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDG2hL7Lf5IZwxJ1JsSLEAfXRfegvhUB6B6DQvYy%2Bt4Ua8hCi8i6G5EwWTrtUYRi0CVYKmN65nSbTtVabVJ4gtYO5b88VeGWylbZS0hSkDjytHXJVx1szuFS%2BeaLUrMW3%2BpumtFbSEbX8a1h6qq9sxUQH2XuATIFWH0gc95VbQaWydHPcjNagJCpdO9Vpd4mZmLvMzeifMZIf7L6uPZk5LwuGgXLXWgqITGODrYTHHU4o0q6B%2FKlCJxOx96YVfO6gfm4NWdlmdYt2QQ%2BkkCcsoJVRvZAopf%2BYjQYyKvT4hNUT%2BERptCbeWbXjqGHzGLZXwz%2FI1KWtm8dcdLccLpXcdPnUXW6Xsw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20211130T163924Z&X-Amz-SignedHeaders=host&X-Amz-Expires=1799&X-Amz-Credential=ASIA5XB5VB55ZMMMUWGU%2F20211130%2Fus-gov-west-1%2Fs3%2Faws4_request&X-Amz-Signature=e3026252cbe203f9c9246a6c52c2db394c64d317b1241519d60cd1baad729df8",
    "Version": {
        "ApplicationId": "arn:aws-us-gov:serverlessrepo:us-gov-west-1:023102451235:applications/SecretsManagerRDSPostgreSQLRotationSingleUser",
        "CreationTime": "2021-11-18T17:48:21.266Z",
        "ParameterDefinitions": [
            {
                "Description": "The Secrets Manager endpoint to use.",
                "Name": "endpoint",
                "ReferencedByResources": [
                    "SecretsManagerRDSPostgreSQLRotationSingleUser"
                ],
                "Type": "String"
            },
            {
                "DefaultValue": ":/@\"'\\",
                "Description": "A string of the characters that you don't want in the password.",
                "Name": "excludeCharacters",
                "ReferencedByResources": [
                    "SecretsManagerRDSPostgreSQLRotationSingleUser"
                ],
                "Type": "String"
            },
            {
                "Description": "The name of the Lambda function.",
                "Name": "functionName",
                "ReferencedByResources": [
                    "SecretsManagerRDSPostgreSQLRotationSingleUser",
                    "SecretsManagerRDSPostgreSQLRotationSingleUser"
                ],
                "Type": "String"
            },
            {
                "DefaultValue": "secretsmanager.amazonaws.com",
                "Description": "The service principal for the invoking service.",
                "Name": "invokingServicePrincipal",
                "ReferencedByResources": [
                    "LambdaPermission"
                ],
                "Type": "String"
            },
            {
                "DefaultValue": "",
                "Description": "The ARN of the KMS key that Secrets Manager uses to encrypt the secret.",
                "Name": "kmsKeyArn",
                "ReferencedByResources": [
                    "SecretsManagerRDSPostgreSQLRotationSingleUser"
                ],
                "Type": "String"
            },
            {
                "DefaultValue": "",
                "Description": "A comma-separated list of security group IDs applied to the database.",
                "Name": "vpcSecurityGroupIds",
                "ReferencedByResources": [
                    "SecretsManagerRDSPostgreSQLRotationSingleUser"
                ],
                "Type": "CommaDelimitedList"
            },
            {
                "DefaultValue": "",
                "Description": "A comma-separated list of VPC subnet IDs applied to the database network.",
                "Name": "vpcSubnetIds",
                "ReferencedByResources": [
                    "SecretsManagerRDSPostgreSQLRotationSingleUser"
                ],
                "Type": "CommaDelimitedList"
            }
        ],
        "RequiredCapabilities": [
            "CAPABILITY_IAM",
            "CAPABILITY_RESOURCE_POLICY"
        ],
        "ResourcesSupported": true,
        "SemanticVersion": "1.1.93",
        "SourceCodeUrl": "https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas",
        "TemplateUrl": "https://awsserverlessrepo-applications-igswkzhz6pbo.s3.us-gov-west-1.amazonaws.com/023102451235/SecretsManagerRDSPostgreSQLRotationSingleUser/ce9bd713-d973-47e0-a053-1ad70b50bb23/1.1.93/transformed-template.yaml?X-Amz-Security-Token=FwoDYXdzEO7%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDG2hL7Lf5IZwxJ1JsSLEAfXRfegvhUB6B6DQvYy%2Bt4Ua8hCi8i6G5EwWTrtUYRi0CVYKmN65nSbTtVabVJ4gtYO5b88VeGWylbZS0hSkDjytHXJVx1szuFS%2BeaLUrMW3%2BpumtFbSEbX8a1h6qq9sxUQH2XuATIFWH0gc95VbQaWydHPcjNagJCpdO9Vpd4mZmLvMzeifMZIf7L6uPZk5LwuGgXLXWgqITGODrYTHHU4o0q6B%2FKlCJxOx96YVfO6gfm4NWdlmdYt2QQ%2BkkCcsoJVRvZAopf%2BYjQYyKvT4hNUT%2BERptCbeWbXjqGHzGLZXwz%2FI1KWtm8dcdLccLpXcdPnUXW6Xsw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20211130T163924Z&X-Amz-SignedHeaders=host&X-Amz-Expires=1800&X-Amz-Credential=ASIA5XB5VB55ZMMMUWGU%2F20211130%2Fus-gov-west-1%2Fs3%2Faws4_request&X-Amz-Signature=fcf0b168bd6c1c06960cb48b4658cc83fa07bcd3d8821bed47495f6dbc66dc8a"
    }
}

[njlynch]

Great, thanks!

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[gitpod-io]

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
• Commit ID: 3fad3dc
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).