| 56 | } |
| 57 | |
| 58 | func NewManager(opts *NewManagerOpts) (*Manager, error) { |
| 59 | if opts.Region == "" || opts.AccessKey == "" || opts.SecretKey == "" { |
| 60 | return nil, errors.New("region, accessKey and the secretKey are required") |
| 61 | } |
| 62 | |
| 63 | l := opts.Logger |
| 64 | if l == nil { |
| 65 | l = log.NewStdLogger(io.Discard) |
| 66 | } |
| 67 | |
| 68 | logger := servicelogger.ScopedHelper(l, "credentials/aws-secrets-manager") |
| 69 | logger.Infow("msg", "configuring secrets-manager", "region", opts.Region, "role", opts.Role, "prefix", opts.SecretPrefix) |
| 70 | |
| 71 | // Using AWS config directly instead of using config.LoadDefaultConfig |
| 72 | // to avoid the default credential chain and use only the static credentials |
| 73 | config := aws.Config{ |
| 74 | Region: opts.Region, |
| 75 | Credentials: awscreds.NewStaticCredentialsProvider(opts.AccessKey, opts.SecretKey, ""), |
| 76 | } |
| 77 | |
| 78 | return &Manager{ |
| 79 | client: secretsmanager.NewFromConfig(config), |
| 80 | secretPrefix: opts.SecretPrefix, logger: logger, |
| 81 | }, nil |
| 82 | } |
| 83 | |
| 84 | // SaveCredentials saves credentials. If opts includes WithExistingSecret, upserts at the given path. |
| 85 | func (m *Manager) SaveCredentials(ctx context.Context, orgID string, creds any, opts ...credentials.SaveOption) (string, error) { |