@techlinksolutions/get-aws-secrets/getAwsSecrets.js

Utility to get secrets from AWS secure secrets manager.

/**
 * Utility module that gets the client secrets at runtime.
 * @module @techlinksolutions/get-aws-secrets
 *
 */
const AWS = require('aws-sdk')

/**
 * Module exports.getSecret
 *
 * @param {string} secretName - The name of the secret you would like to retrieve.
 * @param {string} region     - The region in which the secret resides.
 *
 * @returns {Promise}  - A promise object representing the secret key-value pairs
 *                       returned from the Secrets Manager.
 */
const getSecret = async (secretName, region) => {
  let awsRegion = region,
    secretKeyName = secretName
  var secret

  // Create a Secrets Manager client
  const ssm = new AWS.SecretsManager({
    region: awsRegion,
  })

  const params = {
    SecretId: secretKeyName,
  }

  const response = await ssm
    .getSecretValue(params, function(err, data) {
      if (err) {
        if (err.code === 'DecryptionFailureException')
          // Secrets Manager can't decrypt the protected secret text using the provided KMS key.
          // Deal with the exception here, and/or rethrow at your discretion.
          throw err
        else if (err.code === 'InternalServiceErrorException')
          // An error occurred on the server side.
          // Deal with the exception here, and/or rethrow at your discretion.
          throw err
        else if (err.code === 'InvalidParameterException')
          // You provided an invalid value for a parameter.
          // Deal with the exception here, and/or rethrow at your discretion.
          throw err
        else if (err.code === 'InvalidRequestException')
          // You provided a parameter value that is not valid for the current state of the resource.
          // Deal with the exception here, and/or rethrow at your discretion.
          throw err
        else if (err.code === 'ResourceNotFoundException')
          // We can't find the resource that you asked for.
          // Deal with the exception here, and/or rethrow at your discretion.
          throw err
      } else {
        // Decrypts secret using the associated KMS CMK.
        // Depending on whether the secret is a string or binary, one of these fields will be populated.
        if ('SecretString' in data) {
          secret = data.SecretString
        } else {
          let buff = new Buffer(data.SecretBinary, 'base64')
          secret = buff.toString('ascii')
        }
      }
      return secret
    })
    .promise()

  return response
}
module.exports.getSecret = getSecret