Skip to content

AWS Secrets Manager CI Backend

What does this MR do and why?

Add AWS Secretsmanager CI Schema

So its available to use AWS Secretsmanager in the GitLab CI Configuration

Changelog: added EE: true

References

resolves #542345 (closed) corresponding runner MR: gitlab-runner!5587 (merged) its not blocking as we raised another mr just for the ci schema json to be non breaking: !191905 (merged)

Screenshots or screen recordings

Before After

How to set up and validate locally

  1. Enable FF ci_aws_secrets_manager
  2. Configure your .gitlab-ci.yml file with the following example:
# Simple configuration example
build-job:
  # Define ID token for OIDC authentication with AWS
  id_tokens:
    MY_TOKEN:
      aud: https://sts.amazonaws.com
  
  # Define AWS secrets to be retrieved
  secrets:
    DATABASE_PASSWORD:
      aws_secrets_manager: 'your-secret-id#field-name'
      token: $MY_TOKEN
      file: false  # Optional: set to false to store value directly in variable
  
  # Environment variables (can be set at project/group level)
  variables:
    AWS_REGION: eu-central-1 # required
    AWS_ROLE_ARN: 'arn:aws:iam::123456789123:role/your-role-name' # optional
  
  stage: build
  script:
    - echo "Accessing secret..."
    - echo "Secret retrieved successfully: $DATABASE_PASSWORD"
  1. Since this MR doesn't include the CI YAML schema updates, you'll need to manually apply changes from MR #191905 to your local development environment.

  2. For end-to-end testing, use the associated [runner changes MR](gitlab-runner!5587 (merged)

) to see the feature working completely.

  1. Ensure your AWS IAM role has appropriate permissions to access the secrets in AWS Secrets Manager.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Henry Sachs

Merge request reports

Loading