vignesh/cdkinfracode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

adding secret manager

Browse source
This commit is contained in:
vickytechkey 2026-08-09 17:24:02 +05:30
parent 17d249a7fa
commit fdbf7784a9
1 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
aws_cdk/lib/aws_cdk-stack.ts
View file

@ -3,6 +3,7 @@ import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as dlm from 'aws-cdk-lib/aws-dlm';
import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
export class AwsCdkStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
@ -61,6 +62,18 @@ export class AwsCdkStack extends cdk.Stack {
}
// 3a. Create DB Credentials Secret in AWS Secrets Manager
const dbSecret = new secretsmanager.Secret(this, 'SellerCentralDbSecret', {
secretName: 'seller-central/db-credentials',
description: 'Database credentials for the Seller Central application',
secretObjectValue: {
username: cdk.SecretValue.unsafePlainText('REPLACE_WITH_DB_USERNAME'),
host: cdk.SecretValue.unsafePlainText('REPLACE_WITH_DB_HOST'),
password: cdk.SecretValue.unsafePlainText('REPLACE_WITH_DB_PASSWORD'),
dbname: cdk.SecretValue.unsafePlainText('REPLACE_WITH_DB_NAME'),
},
});
// Create IAM Role for EC2 Instance (to allow CloudWatch Agent to write logs & metrics)
const role = new iam.Role(this, 'internalsRole', {
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
@ -71,6 +84,9 @@ export class AwsCdkStack extends cdk.Stack {
role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'));
role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEC2ContainerRegistryPowerUser'));
// Grant EC2 role permission to read the DB secret
dbSecret.grantRead(role);
// S3 access for Forgejo storage
role.addToPolicy(new iam.PolicyStatement({
actions: [
@ -257,6 +273,11 @@ export class AwsCdkStack extends cdk.Stack {
value: '16.113.57.127',
description: 'The Elastic IP address of your Mail Server',
});
new cdk.CfnOutput(this, 'DbSecretArn', {
value: dbSecret.secretArn,
description: 'ARN of the DB credentials secret in Secrets Manager',
});
}
}