Error when running script

[danielbrodin]

Hi,

First of all, thanks for the guide (if I can get it to work 😂).

I have tried to run the script, but it fails pretty fast on two env variables that doesn't exist

backstage-on-aws/infra/app_pipeline.py

Lines 24 to 25 in ce44f7e

	github_app_fnds_arn = props.get("GITHUB_APP_FNDS_ARN")
	github_app_isrc_arn = props.get("GITHUB_APP_ISRC_ARN")

I tried to remove them and the parts using them just to see what happens, but then it fails here where codepipeline is missing

backstage-on-aws/infra/backstage.py

Lines 43 to 44 in ce44f7e

	source_output = codepipeline.Artifact()
	build_output = codepipeline.Artifact()

Can this be solved?

[rbogle]

Hi! Thanks for pointing this out. Yes, I think I remember what this is. It's been a year almost since I touched this. :)
Those vars are left over from a real deployment in my last role, and I am not sure why they made it into main branch.

They should be just one var: `GITHUB_APP_ARN" which is the arn for the secret in secretmanager which holds the github app cert, as described here: bootstrap. The pipeline accesses this secret writes it to file and provides it to the docker build. This way the secret is provided to the Backstage App at run time as an env var to configure Backstage's access to Github.

I can probably clean this up and test it today sometime, but happy to take a PR if you take a stab at it.

[danielbrodin]

Ok, that sounds like a fast fix. But what about the error in backstage.py about the missing codepipeline? From what I can see there is a bunch of missing variables in that file. I haven't used either aws or python that much so maybe I'm missing something?

[annaz-is]

hi @rbogle and @danielbrodin I have been looking into this as well. I've replaced the Github App references with the single GITHUB_APP_ARN and added an import for

    aws_codepipeline as codepipeline,
    aws_codepipeline_actions as actions,

in the bacsktage.py file to resolve the missing codepipeline, as well as missing actions reference.

Now I get the following error:

  File "/home/annaz/repos/backstage-on-aws/infra/backstage.py", line 50, in __init__
    oauth_token=github_token_secret.secret_value_from_json("secret"),
NameError: name 'github_token_secret' is not defined

This is the line in question:

backstage-on-aws/infra/backstage.py

Line 48 in ce44f7e

oauth_token=github_token_secret.secret_value_from_json("secret"),

I´m not too familiar with handling secrets from the SecretsManager, is there any code missing for retrieving a secret?

I would be happy to create a PR with my fixes!

Kind regards :)

[nundys]

Hi @rbogle, @annaz-kvika and @danielbrodin were you able to get this working, I am still struggling, a PR or a patch would be greatly appreciated. Also, the documentation does not mention what name the key (GITHUB_APP_ARN) should take for the pem file (I presume the value is the content of a private key from the Github app) stored in the AWS Secrets Manager?

[rbogle]

Hi all,
Sorry for the radio silence. I merged a PR this morning that I believe fixes the issues and questions you had.
It looks like when I merged the new code with the old something went wrong and a couple of files were not completely merged.

I have not test deployed this PR to be 100% sure, but it does synth without errors

#5

[rbogle]

Hi @rbogle, @annaz-kvika and @danielbrodin were you able to get this working, I am still struggling, a PR or a patch would be greatly appreciated. Also, the documentation does not mention what name the key (GITHUB_APP_ARN) should take for the pem file (I presume the value is the content of a private key from the Github app) stored in the AWS Secrets Manager?

I added an example link in the docs, but TDLR: use the plaintext option for the secret and paste the whole pem contents into the textblock instead of a json object...

[nundys]

Hi @rbogle, I have nearly gotten this to work except for the Secret handling in the following code:-

backstage-on-aws/infra/stage_resources.py

Lines 43 to 51 in 9596831

	if github_auth_secret_name is not None:
	github_auth_secret = secrets.Secret.from_secret_name_v2(
	self, "github-auth-secret", github_auth_secret_name)
	self.secret_mapping.update({'AUTH_GITHUB_CLIENT_ID': ecs.Secret.from_secrets_manager(github_auth_secret, field='id')})
	self.secret_mapping.update({"AUTH_GITHUB_CLIENT_SECRET": ecs.Secret.from_secrets_manager(github_auth_secret, field='secret')})
	if aws_auth_secret_name is not None:
	aws_auth_secret = secrets.Secret.from_secret_name_v2(self, "aws-auth-secret", aws_auth_secret_name)
	self.secret_mapping.update({"AWS_ACCESS_KEY_ID": ecs.Secret.from_secrets_manager(aws_auth_secret, field='id')})
	self.secret_mapping.update({"AWS_ACCESS_KEY_SECRET": ecs.Secret.from_secrets_manager(aws_auth_secret, field='secret')})

1. It appears that the values in the dict that correspond to AUTH_GITHUB_CLIENT_* (and AWS_ACCESS_KEY_*) are not being initialised correctly because an object is returned by ecs.Secret.from_secrets_manager rather than a string.
2. Also, the result is that the ARN in the Policy created doesn't reference the Full ARN resource but just an (incorrect) ARN without the 6 letter random string at the end. Any ideas on how best to solve these issues? Thanks