Misleading information when DD_API_KEY_SECRET_ARN points to non-existing secret

[t0mmili]

Let's say I made a mistake when typing ARN of SecretsManager secret into DD_API_KEY_SECRET_ARN.

The chain of information in DEBUG log is a little bit misleading:

1. Retrieving - ok
2. Found - that's not possible
3. Secrets Manager read error: AccessDeniedException - I assume this is from AWS API...?
4. No API key configured - actually it is, but not found :)

2023-06-23T10:42:03.581+02:00	2023-06-23 08:42:03 UTC | DD_EXTENSION | DEBUG | Retrieving DD_API_KEY_SECRET_ARN=arn:aws:secretsmanager:us-east-2:012345678901:secret:secret-datacat from secrets manager
2023-06-23T10:42:03.581+02:00	2023-06-23 08:42:03 UTC | DD_EXTENSION | DEBUG | Found arn:aws:secretsmanager:us-east-2:012345678901:secret:secret-datacat value, trying to use it.
2023-06-23T10:42:03.701+02:00	2023-06-23 08:42:03 UTC | DD_EXTENSION | DEBUG | Couldn't read API key from Secrets Manager: Secrets Manager read error: AccessDeniedException: User: arn:aws:sts::012345678901:assumed-role/role-my-lambda-use2/my-lambda-use2 is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-2:012345678901:secret:secret-datacat because no identity-based policy allows the secretsmanager:GetSecretValue action
2023-06-23T10:42:03.701+02:00	status code: 400, request id: b507ebca-3b2d-4f6d-bf68-cb5fe57e42ad
2023-06-23T10:42:03.701+02:00	2023-06-23 08:42:03 UTC | DD_EXTENSION | ERROR | No API key configured

[astuyve]

Hey @t0mmili! Thanks for reaching out.

To prevent information leaking (enumeration of secrets, etc), AWS doesn't tell us if the key doesn't exist or if we don't have permissions to read it. Github does the same thing for repositories but in reverse - if you're logged out and try to access a private repo, they throw a 404 page (even though in reality the repo exists but you just aren't logged in).
This is relatively standard practice.

If the AWS SDK throws an error, we log it here which is the third line.
API keys are attempted in order of several possible options, so when we reach the end we log that no API key is configured.

I may consider changing the found arn:aws.... trying to use it, or maybe removing it entirely. But we aren't able to change much more. It sounds like your predominant reason for opening this issue is the logs from the AWS SDK.

I'll close this issue but others can leave comments or upvote this if they'd like to see a verbiage change.

Best!
AJ

[t0mmili]

@astuyve, thanks for great explanation!
In this case I think removing found arn:aws.... trying to use it will not do much, but maybe others want to see such change.