sec: warn on plaintext SCHEDULED_TASK_SECRET when secret-name path is active#577
sec: warn on plaintext SCHEDULED_TASK_SECRET when secret-name path is active#577cristim wants to merge 1 commit into
Conversation
… active (closes #451) resolveScheduledTaskSecret previously returned the plaintext SCHEDULED_TASK_SECRET value immediately when both SCHEDULED_TASK_SECRET and SCHEDULED_TASK_SECRET_NAME were set, silently bypassing the secret-manager lookup. Lambda env vars and Terraform state are visible in the AWS console, making the plaintext path a leak surface in production bearer-mode deployments. Two changes: 1. When both variables are configured, log a SECURITY WARNING at startup so operators know the configuration is risky. The message names the exact env var to remove. 2. Drop the `cfg.ScheduledTaskSecret != ""` short-circuit condition so the secret-name path always wins when SCHEDULED_TASK_SECRET_NAME is set and the resolver is available; the plaintext is only used as a genuine fallback when the resolver call fails. Four regression tests cover: both-set (secret-store wins), plaintext-only with no resolver (dev path), resolver-error fallback, and secret-name-only (standard prod path).
cristim
added
bug
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
1 participant
Summary
resolveScheduledTaskSecretininternal/server/app.goto prefer the secret-store path whenSCHEDULED_TASK_SECRET_NAMEis set, instead of silently returning the plaintext valueSECURITY WARNINGlog message at startup when bothSCHEDULED_TASK_SECRET(plaintext, visible in Lambda env / Terraform state) andSCHEDULED_TASK_SECRET_NAMEare configured togetherThe previous behaviour silently bypassed the Secrets Manager lookup whenever the plaintext variable was non-empty, making the production bearer-mode path identical to the dev path even in AWS Lambda deployments.
Closes #451