[JIRA] (JENKINS-60695) "Filter by AWS secret namespace ID" not working

[d...@fortysix.ch (JIRA)]

Title: Message Title

Dominik Bartholdi created an issue   Jenkins / JENKINS-60695 "Filter by AWS secret namespace ID" not working Issue Type: Bug Assignee: Chris Kilding Components: aws-secrets-manager-credentials-provider-plugin Created: 2020-01-08 13:40 Priority: Major Reporter: Dominik Bartholdi I created credentials like this:  aws secretsmanager create-secret --name 'jks/DB_USER_XXXXX' --secret-string 'zzzzzz' --tags 'Key=jenkins:credentials:username,Value=uuuuu' --description 'dddddddd' Then I used the documented policy template: https://github.com/jenkinsci/aws-secrets-manager-credentials-provider-plugin/blob/master/docs/iam/secret-namespace-id.json to filter credentials by a namespace.  My complete policy looked like this: { "Version": "2012-10-17", "Statement": [ { "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:::secret:jks/*", "Effect": "Allow" }, { "Action": "secretsmanager:ListSecrets", "Resource": "*", "Effect": "Allow" } ] } unfortunate this ends up in this error: com.cloudbees.plugins.credentials.CredentialsUnavailableException: Property 'secret' is currently unavailable, reason: Could not retrieve the credential jks/DB_USER_XXXXX from AWS Secrets Manager at io.jenkins.plugins.credentials.secretsmanager.RealAwsCredentials.getSecretValue(RealAwsCredentials.java:44) at io.jenkins.plugins.credentials.secretsmanager.AwsCredentials.getSecretString(AwsCredentials.java:127) at io.jenkins.plugins.credentials.secretsmanager.AwsCredentials.getPassword(AwsCredentials.java:70) at org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding.bind(UsernamePasswordMultiBinding.java:78) at org.jenkinsci.plugins.credentialsbinding.impl.BindingStep$Execution2.doStart(BindingStep.java:135)   When setting the `"Resource": "*"` for `secretsmanager:GetSecretValue` too, then it works, but the namespace filter does not work.     Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.203940.1578490848000.4754.1578490860430%40Atlassian.JIRA.