Go Secrets Manager Update Secret Secret String 额外的 JSON 编码

我可以确认这个命令设置的一个秘密

aws secretsmanager update-secret --secret-id my-secret --secret-string '{"PEM":"-----BEGIN CERTIFICATE-----\n...\n...\n...\n-----END CERTIFICATE-----\n","KEY":"..."}'

按预期工作(请参阅此答案底部的Go演示).

And here is a simplified command that does the whole thing:

aws secretsmanager update-secret --secret-id -secret --secret-string "$(jq -n --arg cert "$(cat /path/to/cert/file)" --arg key "$(cat /path/to/key/file)" -c '{"PEM": $cert, "KEY": $key}')"

以下是一个GO演示，用于验证上传的内容:

package main

import (
    "context"
    "crypto/tls"
    "encoding/json"

    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/service/secretsmanager"
)

func main() {
    secretName := "test1"
    region := "ap-southeast-1"

    config, err := config.LoadDefaultConfig(context.TODO(), config.WithRegion(region))
    if err != nil {
        panic(err)
    }

    svc := secretsmanager.NewFromConfig(config)

    input := &secretsmanager.GetSecretValueInput{
        SecretId: aws.String(secretName),
    }

    result, err := svc.GetSecretValue(context.TODO(), input)
    if err != nil {
        panic(err)
    }

    var secret struct {
        PEM string `json:"PEM"`
        KEY string `json:"KEY"`
    }
    {
    }

    if err := json.Unmarshal([]byte(*result.SecretString), &secret); err != nil {
        panic(err)
    }

    if _, err := tls.X509KeyPair([]byte(secret.PEM), []byte(secret.KEY)); err != nil {
        panic(err)
    }
}