Is it possible to provide AcceptedArns through config file?

[mehul9595]

Hello,

I'm trying to decouple accepted ARNs list from the program.cs to a config file, I have my config options defined below in appsettings.json,

"SecretsManagerConfigurationProviderOptions": {
   "acceptedSecretArns": [ "my-arn" ]
 }

Then from the code, I just call the manager like below

 try
            {
                var config = builder.Build();
                logger?.Information("reading secure settings from secrets manager");
                builder.AddSecretsManager(region: RegionEndpoint.USWest2);
                config = builder.Build();
            }
            catch (Exception ex)
            {
                logger?.Error(ex, "Unable to configure SecretsManager");
            }
            return builder;

Here, I'm not sure if the accepdSecretArns would be passed down to the library since I don't have the environment to test AWS secrets manager. Could you share your thoughts if this is correct approach?
Also, I would like to make RegionEndpoint as configurable from the appsettings option, any thoughts if I can achieve this?

Thanks

[Kralizek]

Hi @mehul9595

As of right now it is not possible to do as you ask. It should be tested how is it possible to use the configuration system to configure a configuration provider. Unfortunately, I never tried it before.

[gao87926]

There is a walkaround, https://andrewlock.net/secure-secrets-storage-for-asp-net-core-with-aws-secrets-manager-part-2/

Basically, build you config first time, load appsettings, then addSecretManager can use the params from config, at the end, the builder have to build again

[Kralizek]

Keeping this open as a possible 2.1 ergonomics improvement.

In the 2.0 API shape, the old AcceptedSecretArns concept maps most naturally to the explicit known-secret providers. Today consumers can already keep the list of known secrets in configuration by using a small bootstrap configuration step, for example:

var bootstrapConfiguration = builder.Configuration.Build();

var secretIds = bootstrapConfiguration
    .GetSection("SecretsManager:KnownSecrets")
    .Get<string[]>() ?? Array.Empty<string>();

builder.Configuration.AddSecretsManagerKnownSecrets(secretIds);

Example configuration:

{
  "SecretsManager": {
    "KnownSecrets": [
      "my-app/shared",
      "my-app/production"
    ]
  }
}

That said, a dedicated 2.1 helper could make this pattern nicer and less error-prone, for example by binding a strongly typed options section for known-secret ids, reload interval, batch behavior, duplicate-key handling, and related provider settings without introducing circular configuration behavior.