Plaintext secrets

[MartinAltmayerTMH]

Is there an option to sync plaintext values to AWS Secrets Manager? From what I can see, SOPS requires me to specify a JSON/YAML object and cdk-sops-secrets will just copy this object (without the special 'sops' key) as a key/value secret.

I'd like to have just a string, without any JSON/YAML around it:

[markussiebert]

Hi @MartinAltmayerTMH have you tried disabling all conversions?

const secret = new SopsSecret(this, 'SopsComplexSecretJSON', {
  convertToJSON: false, // disable converting the encrypted content to JSON
  stringify: false, // disable stringifying all values
  flatten: false, // disable flattening of the object structure
  sopsFilePath: 'secrets/sopsfile-encrypted.json',
});

If it does not work, can you provide an example content?

[MartinAltmayerTMH]

Disabling the conversions will create a plaintext secret in AWS. However, it will still contain the key and the value from the SOPS file. I'd like to store just the value, e.g. 12341234.

The problem is that SOPS requires a top-level object (so they can store their metadata below .sops). I cannot store just a value. This is my example SOPS file:

value: ENC[AES256_GCM,data:bJ2p...]
sops:
  kms:
    - arn: arn:aws:kms:...
      created_at: "2025-01-24T08:55:09Z"
      enc: ...
      aws_profile: ""
  gcp_kms: []
  azure_kv: []
  hc_vault: []
  age: []
  lastmodified: "2025-01-24T08:55:21Z"
  mac: ...
  pgp: []
  unencrypted_suffix: _unencrypted
  version: 3.9.1

And this is the secret created with all conversions disabled:

[markussiebert]

Understood! I think adding an option called "plaintext" that removes the "data" key from the decrypted sops file would solve this issue. The key to be removed should be configurable by the user and default to "data" – that's what sops creates when you encrypt plain text. In your case, it is the key "value".