Repository navigation
Conversation
Contributor
Author
|
Note: This can't be merged until the secretsmanager |
johanngan
force-pushed
the
johanngan/aws-secrets-manager
branch
from
October 12, 2026 20:03
a227381 to
fbdf939
Compare
johanngan
commented
Oct 12, 2026
| @@ -0,0 +1,12 @@ | |||
| <!-- | |||
Contributor
Author
There was a problem hiding this comment.
It seems like the CI is complaining about this, but I think it can be ignored since we're adding a totally new changelog?
Member
There was a problem hiding this comment.
Yeah, we may have to just apply the skip-changelog label
johanngan
force-pushed
the
johanngan/aws-secrets-manager
branch
2 times, most recently
from
October 15, 2026 15:34
279b0d4 to
f6ffafb
Compare
johanngan
force-pushed
the
johanngan/aws-secrets-manager
branch
from
October 30, 2026 15:57
f6ffafb to
af62486
Compare
johanngan
force-pushed
the
johanngan/aws-secrets-manager
branch
from
October 30, 2026 20:55
af62486 to
21ba1c5
Compare
This module defines a new envconfig extension to support Temporal client credentials stored in AWS Secrets Manager. The user specifies a secret ARN or friendly name via envconfig (TOML or environment variables), and the client will automatically fetch the secret material from Secrets Manager, with periodic refreshes to support secret rotation. The AWS Parameters and Secrets Lambda Extension is used if detected in the environment. Otherwise, secrets are retrieved directly from Secrets Manager. See the README or package documentation for usage details.
johanngan
force-pushed
the
johanngan/aws-secrets-manager
branch
from
November 3, 2026 18:25
21ba1c5 to
b20e2fe
Compare
Contributor
Author
|
(Latest push just rebases + |
Sushisource
reviewed
Nov 3, 2026
This prevents us from seeing some random local service listening on port 2773 and confusing it for the Lambda extension.
Makes various assorted improvements to caching behavior: - Always couple cert/key cache entries together so they're always refreshed/invalidated together and can't be retrieved in a torn state. In service of this change, the cache is specialized more from a generic map, and instead exposes per-secret-type get APIs. This unifies the cert bundle/separate cert-key secret paths into a single client cert retrieval path. - Improve concurrency behavior during a cache refresh; don't lock around the fetch and instead allow stale values to be served while another thread has a cache refresh in-flight. In the case that no usable value is in the cache, still respect the caller's context by waiting on a channel instead of the entry's mutex. - Use a separate context and timeout for fetches, so that a caller's deadline or cancellation doesn't affect the cache's failure state. This is accomplished by using a background thread to perform fetches.
Sushisource
reviewed
Nov 5, 2026
This allows each cache entry to directly store its value type instead of a raw byte slice, which allows us to avoid cert parsing on every call to getClientCert().
The SDK does this automatically with opts.Credentials set.
johanngan
force-pushed
the
johanngan/aws-secrets-manager
branch
from
November 6, 2026 01:22
10f08e4 to
81231e8
Compare
Sushisource
approved these changes
Nov 6, 2026
For plugin fetch operations, try to fetch the telemetry providers in the plugin's NewClient() rather than immediately during its ConfigureClient(), so that logging and metrics can happen through the final configured providers, after other plugins and the SDK defaults have had a chance to take effect. Also move the eager cache fetches to NewClient() where possible, since they log and emit metrics. The one exception is the server CA cert, which needs to be configured on the options.
johanngan
force-pushed
the
johanngan/aws-secrets-manager
branch
from
November 7, 2026 00:12
81231e8 to
3cfb9ea
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was changed
This module defines a new envconfig extension to support Temporal client credentials stored in AWS Secrets Manager. The user specifies a secret ARN or friendly name via envconfig (TOML or environment variables), and the client will automatically fetch the secret material from Secrets Manager, with periodic refreshes to support secret rotation.
The AWS Parameters and Secrets Lambda Extension is used if detected in the environment. Otherwise, secrets are retrieved directly from Secrets Manager.
See the README or package documentation for usage details.
Why?
This is intended to be used with the Lambda worker contrib package (and in the future other serverless providers), to make it more convenient to store worker secrets in a secrets manager when using serverless.
Checklist
How was this tested:
Added new unit tests. Also did manual E2E verification with the Lambda worker integration with AWS Secrets Manager with a test setup, which exercised this code code.
Any docs updates needed?
The associated in-repo docs are updated. This specific module is primarily an implementation detail for the Lambda worker integration with Secrets Manager. We'll probably want to update our public docs for Lambda workers, but that can be done later.