Long secrets cause an EOF error #6
Comments
|
This is rather interesting. It seems like that the DynamoDB response somehow contains the key but the value is The issue is clearly that the code does not handle the I will probably have time next weekend to look into this. |
|
Hopefully this is what you are looking for. It's not the exact values but I preserved all the fidelity I could and replaced via 🍪 when I couldn't value of key: |
|
I tried to reproduce the issue with no success. I used the values provided by @jasonamyers in the following terraform configuration for testing: provider "credstash" {
region = "us-east-1"
table = "credstash-test"
}
data "credstash_secret" "db_password" {
name = "cookybox.db.default.password.cookieprod"
context = {
app = "cookiebox"
app_id = "e50656e9-5219-4799-adab-ea1ef51deb36"
environment = "cookieprod"
}
}
resource "null_resource" "echo" {
triggers {
id = "${data.credstash_secret.db_password.id}"
}
provisioner "local-exec" {
command = "echo password=${data.credstash_secret.db_password.value}"
}
}Everything works as expected: the password is echoed to stdout. I tried both v0.1.0 (terraform 0.8.8) and v0.1.1 (terraform 0.9.9) versions. @jasonamyers does |
|
Credstash get does work
…On Jul 23, 2017 3:13 PM, "Tamás Michelberger" ***@***.***> wrote:
I tried to reproduce the issue with no success.
I used the values provided by @jasonamyers
<https://github.com/jasonamyers> in the following terraform configuration
for testing:
provider "credstash" {
region = "us-east-1"
table = "credstash-test"
}
data "credstash_secret" "db_password" {
name = "cookybox.db.default.password.cookieprod"
context = {
app = "cookiebox"
app_id = "e50656e9-5219-4799-adab-ea1ef51deb36"
environment = "cookieprod"
}
}
resource "null_resource" "echo" {
triggers {
id = "${data.credstash_secret.db_password.id}"
}
provisioner "local-exec" {
command = "echo password=${data.credstash_secret.db_password.value}"
}
}
Everything works as expected: the password is echoed to stdout. I tried
both v0.1.0 (terraform 0.8.8) and v0.1.1 (terraform 0.9.9) versions.
@jasonamyers <https://github.com/jasonamyers> does credstash get work as
expected for you? Maybe there is something about the data stored in the
DynamoDB table?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#6 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/ABKl-UV4XxvBOG6ANrbLevS4DUUJ4JIeks5sQ6lSgaJpZM4OQ5N8>
.
|
|
I fixed the @jasonamyers can you upgrade to the latest version? This is a pretty trivial change so I guess backporting would not be a big problem but I would not want to do that unless absolutely necessary. As I cannot reproduce the issue this seems to be specific to your environment. To further narrow down the issue you could create a minimal test case that fetches the secret from DynamoDB but does no decryption. Also turning on logging in the |
|
I'm closing this as there is no response and I could not reproduce the issue. |
|
Because this got closed without resolution and we ran into something similar to this, turned out that there was a garbage invisible character somewhere in the particular secret we were retrieving with credstash. We stored a new version of the secret without the garbage invisible character and everything started working. Hopefully the next person to google this will find this and it will help! |
I've encountered an odd issue as we've begun to use this software more and more. We have a password in the list below it's
data.credstash_secret.redshift_passwordthat is 64 characters long. We can use the module for all of the secrets but it. We've put several eyes on it looking for a reason this would occur: (context, missing secret, etc), and we've failed to find anything. This became more confusing when I tried to add that value in the decrypt tests in secrets_tests.go, but it didn't error there. If we remove that one long secret from our terraform config, all the other secrets work great. I'm totally happy to help try to assist with this issue code wise, I'm just struggling for where to start looking for this issue since the tests passed.The key is digest SHA256. We're using TF 0.8.8 and the Version 1.0 of your provider.
Here is the output from a terraform plan:
Error refreshing state: 4 error(s) occurred:
TF_LOG=debug output:
The text was updated successfully, but these errors were encountered: