secrets: addRotationSchedule() with fromSecretNameV2() does not create correct iam policy for lambda

[pahud]

Describe the bug

Given the code:

    const alertsServiceCredentials = new secrets.Secret(this, `secret-rotated`, {
      generateSecretString: {
        secretStringTemplate: JSON.stringify({
          username: 'service_rw_',
          engine: 'mysql',
          host: 'dummy-host',
          port: '3306',
          dbname: 'dummy-db'
        }),
        generateStringKey: 'password'
      }
    });

    let adminLogin = secrets.Secret.fromSecretNameV2(this, 'lookup-admin-login', 'MySecret');

    const schedule = alertsServiceCredentials.addRotationSchedule(
      'rotation-schedule',
      {
        automaticallyAfter: Duration.days(30),
        hostedRotation: secrets.HostedRotation.mysqlMultiUser({
          vpc,
          masterSecret: adminLogin
        }),
      }
    );

This will create an IAM policy statement for lambda that only allows to GetSecretValue on partial secret arn without trailing 6 characters hence permission denied.

{
    "Statement": [
        {
            "Action": [
                "secretsmanager:GetSecretValue"
            ],
            "Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:MySecret",
            "Effect": "Allow"
        }
    ]
}

Expected Behavior

should render correct IAM policy statement

Current Behavior

does not render correct IAM policy statement for Lambda role.

Reproduction Steps

see the code above

Possible Solution

1. use fromSecretCompleteArn() to generate full secret arn in the iam policy
2. use escape hatches to append -?????? to the ARN

For example

    const schedule = alertsServiceCredentials.addRotationSchedule(
      'rotation-schedule',
      {
        automaticallyAfter: Duration.days(30),
        hostedRotation: secrets.HostedRotation.mysqlMultiUser({
          vpc,
          masterSecret: adminLogin
        }),
      }
    );

    const cfnRotationSchedule = schedule.node.tryFindChild('Resource') as secrets.CfnRotationSchedule
    cfnRotationSchedule.addPropertyOverride('HostedRotationLambda.MasterSecretArn', `${adminLogin.secretArn}-??????`)

And when you run cdk diff we should see this

Resources
[~] AWS::SecretsManager::RotationSchedule secret-rotated/rotation-schedule secretrotatedrotationscheduleFF5ED1F3 
 └─ [~] HostedRotationLambda
     └─ [~] .MasterSecretArn:
         ├─ [-] arn:aws:secretsmanager:us-east-1:123456789012:secret:MySecret
         └─ [+] arn:aws:secretsmanager:us-east-1:123456789012:secret:MySecret-??????

Additional Information/Context

No response

CDK CLI Version

2.113.0

Framework Version

No response

Node.js Version

v18.16.0

OS

mac

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

ticket V1146438482

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.