aws-retrieve-secret-values.yml

aws-retrieve-secret-values.yml

.retrieve-secret-values:
  before_script:
    - |
        #!/bin/bash
        set -e

        if [[ ! -z $AWS_ACCOUNT_ID && ! -z  $AWS_IAM_ROLE && ! -z $AWS_REGION ]]
        then
            echo 'Assuming role...'
            session_name="${CI_COMMIT_SHORT_SHA}-`date +%Y%m%d`"
            sts=( $(
                aws sts assume-role \
                --role-arn "arn:aws:iam::${AWS_ACCOUNT_ID}:role/${AWS_IAM_ROLE}" \
                --role-session-name "$session_name" \
                --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
                --output text
            ) )
            export "AWS_ACCESS_KEY_ID=${sts[0]}"
            export "AWS_SECRET_ACCESS_KEY=${sts[1]}"
            export "AWS_SESSION_TOKEN=${sts[2]}"
            export "AWS_DEFAULT_REGION=${AWS_REGION}"
        fi
  script:
    - |       
        #!/bin/bash
        set -e
        
        secret_name=$AWS_SECRET_NAME
        SECRET=( $(
            aws secretsmanager get-secret-value \
            --secret-id $secret_name \
            --region $AWS_REGION \
            --query SecretString \
            --output text
        ) )

        echo 'Retrieving secret values...'
        echo "VALUES=$SECRET" >> values.env