AWS CDK で作成した Secrets Manager シークレットを GitHub Actions で aws-actions/aws-secretsmanager-get-secrets を使用して環境変数に設定する

import * as cdk from "aws-cdk-lib";
import * as iam from "aws-cdk-lib/aws-iam";
import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
import { Construct } from "constructs";

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);

    const awsAccountId = cdk.Stack.of(this).account;
    const githubOrganizationName = process.env.GITHUB_ORGANIZATION_NAME || "";
    const githubRepositoryName = process.env.GITHUB_REPOSITORY_NAME || "";

    /**
     * Secrets Manager シークレット 1 の作成
     */
    const secret1 = new secretsmanager.Secret(this, "Secret1", {
      secretObjectValue: {
        api_user: cdk.SecretValue.unsafePlainText("user_hoge_"),
        api_key: cdk.SecretValue.unsafePlainText("key_fuga_"),
        config: cdk.SecretValue.unsafePlainText(
          JSON.stringify({ active: "user2_piyo_", standby: "user3_nyan_" })
        ),
      },
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });
    new cdk.CfnOutput(this, "Secret1ArnOutput", {
      value: secret1.secretArn,
      description:
        "Specify this output value with the aws-actions/aws-secretsmanager-get-secret action to get the value of the secret1.",
    });

    /**
     * Secrets Manager シークレット 2 の作成
     */
    const secret2 = new secretsmanager.Secret(this, "Secret2", {
      secretObjectValue: {
        myusername: cdk.SecretValue.unsafePlainText("alejandro_rosalez_"),
        mypassword: cdk.SecretValue.unsafePlainText("EXAMPLE_PASSWORD_"),
      },
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });
    new cdk.CfnOutput(this, "Secret2ArnOutput", {
      value: secret2.secretArn,
      description:
        "Specify this output value with the aws-actions/aws-secretsmanager-get-secret action to get the value of the secret2.",
    });

    /**
     * GitHub Actions OIDC ロールの作成
     */
    const gitHubActionsOidcRole = new iam.Role(this, "GitHubActionsOidcRole", {
      assumedBy: new iam.FederatedPrincipal(
        `arn:aws:iam::${awsAccountId}:oidc-provider/token.actions.githubusercontent.com`,
        {
          StringEquals: {
            "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
          },
          StringLike: {
            "token.actions.githubusercontent.com:sub": `repo:${githubOrganizationName}/${githubRepositoryName}:*`,
          },
        },
        "sts:AssumeRoleWithWebIdentity"
      ),
    });
    new cdk.CfnOutput(this, "GitHubActionsOidcRoleArnOutput", {
      value: gitHubActionsOidcRole.roleArn,
      description:
        "Specify this output value with the aws-actions/configure-aws-credentials action to assume the role.",
    });

    /**
     * GitHub Actions OIDC ロールに Secrets Manager シークレットの読み取り権限を付与
     */
    secret1.grantRead(gitHubActionsOidcRole);
    secret2.grantRead(gitHubActionsOidcRole);
  }
}

name: SECRET_RETRIEVE_TEST

on: workflow_dispatch

jobs:
  get-secrets:
    environment: DEVELOPMENT
    runs-on: ubuntu-latest
    permissions:
      # @see https://github.com/aws-actions/configure-aws-credentials?tab=readme-ov-file#oidc
      id-token: write
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      # AWS 認証情報を設定
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.ROLE_TO_ASSUME_ARN }} # CDK で作成した GitHubActionsOidcRole の ARN
          aws-region: ap-northeast-1 # AWS リージョン

      # Secret1 と Secret2 の値を取得して環境変数に設定
      - name: Get secrets from AWS Secrets Manager
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            SECRET1,${{ vars.SECRET1_ARN }}
            SECRET2,${{ vars.SECRET2_ARN }}
          parse-json-secrets: true # JSONを解析して個別の環境変数に設定

      # 環境変数を使用するサンプルタスク（マスクされないように末尾1文字を削って出力）
      - name: Use environment variables in a task
        run: |
          echo "${SECRET1_API_USER%?}"
          echo "${SECRET1_API_KEY%?}"
          echo "${SECRET1_CONFIG_ACTIVE%?}"
          echo "${SECRET1_CONFIG_STANDBY%?}"
          echo "${SECRET2_MYUSERNAME%?}"
          echo "${SECRET2_MYPASSWORD%?}"

Run echo "${SECRET1_API_USER%?}"
  echo "${SECRET1_API_USER%?}"
  echo "${SECRET1_API_KEY%?}"
  echo "${SECRET1_CONFIG_ACTIVE%?}"
  echo "${SECRET1_CONFIG_STANDBY%?}"
  echo "${SECRET2_MYUSERNAME%?}"
  echo "${SECRET2_MYPASSWORD%?}"
  shell: /usr/bin/bash -e {0}
  env:
    AWS_DEFAULT_REGION: ap-northeast-1
    AWS_REGION: ap-northeast-1
    AWS_ACCESS_KEY_ID: ***
    AWS_SECRET_ACCESS_KEY: ***
    AWS_SESSION_TOKEN: ***
    SECRET1_API_KEY: ***
    SECRET1_API_USER: ***
    SECRET1_CONFIG_ACTIVE: ***
    SECRET1_CONFIG_STANDBY: ***
    SECRET2_MYPASSWORD: ***
    SECRET2_MYUSERNAME: ***
    SECRETS_LIST_CLEAN_UP: ["SECRET1_API_KEY","SECRET1_API_USER","SECRET1_CONFIG_ACTIVE","SECRET1_CONFIG_STANDBY","SECRET2_MYPASSWORD","SECRET2_MYUSERNAME"]
user_hoge
key_fuga
user2_piyo
user3_nyan
alejandro_rosalez
EXAMPLE_PASSWORD

::add-mask::***
##[debug]Injecting secret SECRET1 as environment variable 'SECRET1_API_KEY'.
::add-mask::***
##[debug]Injecting secret SECRET1 as environment variable 'SECRET1_API_USER'.
::add-mask::***
##[debug]Injecting secret SECRET1 as environment variable 'SECRET1_CONFIG_ACTIVE'.
::add-mask::***
##[debug]Injecting secret SECRET1 as environment variable 'SECRET1_CONFIG_STANDBY'.
::add-mask::***
##[debug]Injecting secret SECRET2 as environment variable 'SECRET2_MYUSERNAME'.
::add-mask::***
##[debug]Injecting secret SECRET2 as environment variable 'SECRET2_MYPASSWORD'.