Configuring AWS Secrets Manager in Bamboo

Step 1: Create your secret in AWS Secrets Manager

You can create a secret as plaintext or structured text. Creating a plaintext secret is faster and easier than creating a structured secret.

To see how they differ, see the following example, which shows how each option looks in the AWS console and your code.

Plaintext secret

AWS console showing a plaintext secret with the name mySecretId:

password

How this might appear in your code:

{"region":"ap-southeast-2","secretId":"mySecretId"}

Structured secret

AWS console showing a structured secret with the name mySecretId, which has a secretPointer value of password:

{"password": "mySecretPassword"}

How this might appear in your code:

{"region":"ap-southeast-2","secretId":"mySecretId", "secretPointer": "/password"}

In the example above, the JSON keys include:

Detailed steps

1. Ensure you have decided whether to use a plaintext secret or a structured secret (see the content above these steps for further details).

2. Follow the instructions provided by AWS to create a secret:
   Create an AWS Secrets Manager secret - AWS Secrets Manager.

Step 2: Check your permissions to retrieve your secret

To retrieve any secrets from AWS Secrets Manager, Bamboo must have the appropriate AWS permissions, namely:

• secretsmanager:GetSecretValue

Here is a sample Identity and Access Management (IAM) policy providing appropriate permissions (based on a least privilege model):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:role/MyRole"
            },
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "arn:aws:secretsmanager:us-west-2:123456789012:secret:1a2b3c"
        }
    ]
}

Additional info

• For more details on configuring permissions follow the AWS instructions (with linked examples).

• If you’re using your own KMS key for secret retrieval permission, follow the AWS instructions (with examples).

Step 3: Authenticate to AWS

Bamboo uses the AWS SDK for Java 2.x to communicate with AWS Secrets Manager. The SDK will search for credentials in your Bamboo environment in the predefined sequence below until it can be authenticated.

Predefined sequence:

1. Environment variables

2. Java system properties

   If using Java system properties, be aware that these values may be logged by the product on startup.

3. Web identity token from AWS Security Token Service

4. The shared credentials and config files (~/.aws/credentials)

5. Amazon ECS container credentials

6. Amazon EC2 instance profile credentials (recommended by Amazon)

For information on setting credentials in your environment, Amazon has developer guides on Working with AWS Credentials.

Step 4: Confirm that you can retrieve your secret

Now that a secret has been created, the correct permissions are in place and Bamboo is appropriately authenticated to AWS, let’s confirm the secret can be retrieved.

Run the following command from your host environment:

aws secretsmanager get-secret-value --secret-id=mySecretId --region=ap-southeast-2

Step 5: Add the secret to bamboo.cfg.xml

1. Back up the <home-directory>/bamboo.cfg.xml file. Move the backup to a safe place outside of your instance.

2. In the bamboo.cfg.xml file, add or modify the jdbc.password.decrypter.classname property to contain:

   com.atlassian.secrets.store.aws.AwsSecretsManagerStore

3. In the bamboo.cfg.xml file, add or modify the hibernate.connection.password property to contain the coordinates to the secret in AWS Secrets Manager:
   

   {"region":"ap-southeast-2","secretId":"mySecretId", "secretPointer": "/password"}

   The value is defined as a JSON object with the following values:

   • region (required): AWS region where the AWS secret is located

   • secretId (required): name of the secret

   • secretPointer (optional): key containing the password in a secret with the key-value structure. If omitted, the password is treated as plaintext.

4. Once updated bamboo.cfg.xml should contain:
   

   <property name="jdbc.password.decrypter.classname">com.atlassian.secrets.store.aws.AwsSecretsManagerStore</property>
   <property name="hibernate.connection.password">{"region":"ap-southeast-2","secretId":"mySecretId", "secretPointer": "/password"}</property>

5. Restart Bamboo.