AWS CodeBuild secrets-manager config with environment variable

Question

Update:

Not sure when this happened, but this works as is described now.

As well as an option in the Pipeline build action to set the secret directly.

---

Original Question:

I have an environment variable set for the secret-id set inside the build phase of a AWS CodePipeline. eg. $SECRET_ID.

I want to use it in the CodeBuild buildspec.yml to get a set of secrets from the Secrets Manager based on my environment. Is it possible to self-reference other variables in a buildspec file?

This is how I would have anticipated it would work, but it doesn't.

version: 0.2

env:
  secrets-manager:
    MY_SECRET: ${SECRET_ID}

phases:
  build:
    commands:
      - echo $MY_SECRET

I receive the following error in the build logs.

Secrets Manager Error Message: ValidationException: Invalid name. Must be a valid name containing alphanumeric characters, or any of the following: -/_+=.@!

Answer 1

You simply need to reference it directly. as : where -

(Required) The local environment variable name. Use this name to access the variable during the build. (Required) The name or Amazon Resource Name (ARN) that serves as a unique identifier for the secret. To access a secret in your AWS account, simply specify the secret name. To access a secret in a different AWS account, specify the secret ARN.

version: 0.2

env: secrets-manager: MY_SECRET: SECRET_ID

phases: build: commands: - echo $MY_SECRET