AWS Secrets Manager

1
import {
2
  SecretsManagerClient,
3
  GetSecretValueCommand,
4
  ResourceNotFoundException,
5
  SecretsManagerServiceException,
6
} from '@aws-sdk/client-secrets-manager';
7
import {config} from 'dotenv';
8

9
config();
10

11
interface CachedSecret {
12
  value: string;
13
  expiry: number;
14
}
15

16
const secretCache = new Map<string, CachedSecret>();
17

18
const DEFAULT_CACHE_TTL = 5 * 60 * 1000;
19

20
const defaultRegion = process.env.AWS_REGION;
21

22
/**
23
 * Custom error for when a secret is not found in AWS Secrets Manager.
24
 * This is thrown when the secret does not exist or cannot be accessed.
25
 */
26
class SecretNotFoundError extends Error {
27
  constructor(secretName: string) {
28
    super(`Secret "${secretName}" not found in AWS Secrets Manager.`);
29
    this.name = 'SecretNotFoundError';
30
  }
31
}
32

33
/**
34
 * Custom error for when a secret's value is invalid.
35
 * This can happen if the secret is binary, empty, or not a string.
36
 */
37
class InvalidSecretValueError extends Error {
38
  constructor(secretName: string) {
39
    super(
40
      `Secret "${secretName}" is binary or empty, or does not contain a string value.`,
41
    );
42
    this.name = 'InvalidSecretValueError';
43
  }
44
}
45

46
let secretsManagerClient: SecretsManagerClient | null = null;
47

48
/**
49
 * Initializes and returns a singleton SecretsManagerClient.
50
 * This prevents recreating the client on every `fetchSecret` call.
51
 * @param region - The AWS region to use for the client.
52
 * @returns An initialized SecretsManagerClient instance.
53
 */
54
function getSecretsManagerClient(region: string): SecretsManagerClient {
55
  if (!region) {
56
    throw new Error(
57
      'AWS_REGION is not defined. Please set it in your .env file or pass it as an argument.',
58
    );
59
  }
60
  if (!secretsManagerClient) {
61
    secretsManagerClient = new SecretsManagerClient({region});
62
  }
63
  return secretsManagerClient;
64
}
65

66
/**
67
 * Fetches a secret's string value from AWS Secrets Manager with optional caching.
68
 * @param secretName - The name or ARN of the secret.
69
 * @param options - Optional configuration for fetching the secret.
70
 * @param options.region - Overrides the default AWS region for this fetch operation.
71
 * @param options.cacheTTL - Time-to-live for the cached secret in milliseconds. Set to 0 to disable caching for this call.
72
 * @returns A promise that resolves to the secret string.
73
 * @throws {SecretNotFoundError} If the secret does not exist.
74
 * @throws {InvalidSecretValueError} If the secret's value is binary or empty.
75
 * @throws {Error} For other AWS SDK or network-related errors.
76
 */
77
export async function fetchSecret(
78
  secretName: string,
79
  options?: {region?: string; cacheTTL?: number},
80
): Promise<string> {
81
  const region = options?.region || defaultRegion;
82
  const cacheTTL =
83
    options?.cacheTTL !== undefined ? options.cacheTTL : DEFAULT_CACHE_TTL;
84

85
  if (!region) {
86
    throw new Error(
87
      "AWS_REGION is not defined. Ensure it's in your .env file or passed in options.",
88
    );
89
  }
90

91
  if (cacheTTL > 0) {
92
    const cached = secretCache.get(secretName);
93
    if (cached && Date.now() < cached.expiry) {
94
      return cached.value;
95
    }
96
  }
97

98
  const client = getSecretsManagerClient(region);
99

100
  try {
101
    const command = new GetSecretValueCommand({SecretId: secretName});
102
    const response = await client.send(command);
103

104
    if (response.SecretString) {
105
      const secretValue = response.SecretString;
106
      if (cacheTTL > 0) {
107
        secretCache.set(secretName, {
108
          value: secretValue,
109
          expiry: Date.now() + cacheTTL,
110
        });
111
      }
112
      return secretValue;
113
    } else if (response.SecretBinary) {
114
      throw new InvalidSecretValueError(secretName);
115
    } else {
116
      throw new InvalidSecretValueError(secretName);
117
    }
118
  } catch (error: any) {
119
    console.error(`[ERROR] Failed to fetch secret "${secretName}":`, error);
120
    if (error instanceof ResourceNotFoundException) {
121
      throw new SecretNotFoundError(secretName);
122
    } else if (error instanceof SecretsManagerServiceException) {
123
      throw new Error(
124
        `AWS Secrets Manager error for "${secretName}": ${error.message} (Code: ${error.name})`,
125
      );
126
    } else {
127
      throw new Error(
128
        `An unexpected error occurred while fetching secret "${secretName}": ${error.message}`,
129
      );
130
    }
131
  } finally {
132
    // Add any cleanup or finalization logic here.
133
    // For example, if you had an active connection or resource to close.
134
    // In this specific code, there isn't an obvious resource to clean up
135
    // within the fetchSecret function itself, as the client is a singleton
136
    // and caching is handled by a Map.
137
    // However, for demonstration, you could log something:
138
    console.log(`[INFO] Finished attempting to fetch secret "${secretName}".`);
139
  }
140
}