nestjs-aws-secrets-manager

A Nest module wrapper for aws secrets manager

Installation

``bash
npm i nestjs-aws-secrets-manager @aws-sdk/client-secrets-manager
`

Having troubles configuring nestjs-aws-secrets-manager? Clone this repository and cd in a sample:

`bash
cd samples/quick-start
npm install
npm run start:dev
`

Quick start

Import AWSSecretsManagerModule into the root AppModule and use the forRoot() method to configure it. This method accepts the object as AWSSecretsManagerModuleOptions, you can also checkout samples

`typescript
import { Module } from '@nestjs/common';
import { SecretsManagerClient } from '@aws-sdk/client-secrets-manager';

import { AWSSecretsManagerModule, AWSSecretsManagerModuleOptions } from 'nestjs-aws-secrets-manager';

import { AppService } from './app.service';
import { AppController } from './app.controller';
import { AWSDBCredentialsService } from './aws-secrets.service';

const AWSSecretsManagerProps: AWSSecretsManagerModuleOptions = {
secretsManager: new SecretsManagerClient({
region: "ap-south-1"
}),
};


@Module({
imports: [
AWSSecretsManagerModule.forRoot(AWSSecretsManagerProps),
AWSDBCredentialsService
],
controllers: [AppController],
providers: [AppService, AWSDBCredentialsService],
})
export class AppModule { }

`

$3

Now we have getSecretsByID method on AWSSecretsService from we can retrive aws secrets using name or ARN

`typescript
import { Injectable } from '@nestjs/common';
import { AWSSecretsService } from 'nestjs-aws-secrets-manager';

interface DBCredentials {
host: string;
port: number;
user: string;
password: string;
database: string;
}

@Injectable()
export class AWSDBCredentialsService {
constructor(private readonly secretsRetrieverService: AWSSecretsService) { }

async getDBCredentials(): Promise {
return await this.secretsRetrieverService.getSecretsByID('db-credentials'); // where db-credentials is the secret id
}
}

`

$3

We also can able to set value on process on starting, which allows us to retrive secrets using process.env or @nest/config module

`typescript
import { Module } from '@nestjs/common';
import { SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
import { AWSSecretsManagerModule, AWSSecretsManagerModuleOptions, } from 'nestjs-aws-secrets-manager';

import { AppService } from './app.service';
import { AppController } from './app.controller';

const AWSSecretsManagerProps: AWSSecretsManagerModuleOptions = {
secretsManager: new SecretsManagerClient({
region: "ap-south-1"
}),
isSetToEnv: true, // set all secrets to env variables which will be available in process.env or @nest/config module
secretsSource: "test/sm" // OR array or secrets name or ARN [ "db/prod/config" ,"app/prod/config"],
};


@Module({
imports: [
AWSSecretsManagerModule.forRoot(AWSSecretsManagerProps)
],
controllers: [AppController],
providers: [AppService],
})
export class AppModule { }

`

Afterward, Aws secrets from provided secretsSource can be access via process.env for @nestjs/config module

Async configuration

> Caveats: because the way Nest works, you can't inject dependencies exported from the root module itself (using exports). If you use forRootAsync() and need to inject a service, that service must be either imported using the imports options or exported from a global module.
Maybe you need to asynchronously pass your module options, for example when you need a configuration service. In such case, use the forRootAsync() method, returning an options object from the useFactory method:

`typescript

import { Module } from '@nestjs/common';
import { SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
import { AWSSecretsManagerModule } from 'nestjs-aws-secrets-manager';

import { AppService } from './app.service';
import { AppController } from './app.controller';

import { ConfigModule, ConfigService } from '@nestjs/config';
@Module({
imports: [
ConfigModule.forRoot({
isGlobal: true,
}),
AWSSecretsManagerModule.forRootAsync({
useFactory: (configService: ConfigService) => ({
secretsManager: new SecretsManagerClient({
region: configService.get('AWS_REGION')
}),
isSetToEnv: true, // set all secrets to env variables which will be available in process.env or @nest/config module
secretsSource: [
configService.get('AWS_SECRET_ID') // name or array of secret names
],
isDebug: configService.get('NODE_ENV') === 'development'
}),
inject: [ConfigService],
}),
],
controllers: [AppController],
providers: [AppService],
})
export class AppModule { }
`

The factory might be async, can inject dependencies with inject option and import other modules using the imports option.

$3

Configuration options parameter for AWSSecretsManagerModule is defined as AWSSecretsManagerModuleOptions interface

`typescript
export interface AWSSecretsManagerModuleOptions {
secretsManager: SecretsManagerClient;
isSetToEnv?: boolean;
secretsArn?: string | string[];
isDebug?: boolean;
}
`
which is available for import from nestjs-aws-secrets-manager module

`typescript
import { AWSSecretsManagerModuleOptions, } from 'nestjs-aws-secrets-manager';

`

Contributing

New features and bugfixes are always welcome! In order to contribute to this project, follow a few easy steps:

1. Fork this repository and clone it on your machine
2. Open the local repository with Visual Studio Code with the remote development feature enabled (install the Remote Development extension)
3. Create a branch my-awesome-feature and commit to it
4. Run npm run lint, npm run format and npm run build and verify that they complete without errors
5. Push my-awesome-feature` branch to GitHub and open a pull request

Stay in touch

- Author - razzkumar

License

nestjs-aws-secrets-manager is MIT licensed.