[FR] docker compose secrets transform JSON object

[pindab0ter]

Is your feature request related to a problem? Please describe.
When using a JSON object secret, you have to manually specify each and every value.

E.g.:

{"foo":"bar","baz":"qux"}

Would require:

x-secrets:
  Name: my-secrets
  JsonKeys:
    - SecretKey: foo
      VarName: FOO
    - SecretKey: baz
      VarName: BAZ

If I understand correctly from the documentation, it is also possible to do this instead:

x-secrets:
  Name: my-secrets
  JsonKeys:
    - SecretKey: foo
      Transform: uppercase
    - SecretKey: baz
      Transform: uppercase

The problem is that it is easy to forget to add secrets to this list when adding secrets in AWS.

Describe the solution you'd like

I would love to see something like @aws-actions/aws-secretsmanager-get-secrets’s parse-json-secrets option.

Since you already support transforming key names, it would be very useful to have an option that automatically parses all keys in the JSON secret, applies the specified transformation to each key, and exports them all without having to manually enumerate each key.

[JohnPreston]

Hey @pindab0ter
So, that's a very good and admitedly, common use-case I have faced myself across many, many services.
However, the reason why I did not implement it to date, is that this requires get-secret-value API permission on the secret. Which is something I would somewhat much prefered not require at all.

So I could indeed implement a AutoImportJsonKeys property in the x-secrets section but then, GetSecretValue must be granted.

Is that something that you would yourself consider to be acceptable?

EDIT: re on the transform -> the fransform is on the key. so for example (on top of my head, it's been a while), Upper change would transform the my_env_var to MY_ENV_VAR - only on the key/env var name.

[pindab0ter]

Unless I'm missing something, that sounds acceptable to me. @aws-actions/aws-secretsmanager-get-secrets also requires the GetSecretValue permission. That seems reasonable.