Secrets in Automation

[colinmo]

When using Automation to integrate with external systems (e.g. linking Jira to Cherwell for incident<->work item triage) how do you safely manage secrets? So far I haven't found anywhere that I can store secrets in Jira and refer to them via {{ smart variables }} or similar so they're not exposed in the raw Webhook code.

[Steve Moss · Accepted solution]

I too am looking for a way to do this! I need some sort of secrets management for Jira automation. Is there perhaps a plugin for this? It would be good if there were built-in methods for achieving this, however.

[Steve Moss]

I wonder if this would work? Not played with it though and not sure if you could use as a smart value in automation? https://www.teamsecrets.io/jira

[colinmo]

Thanks Steve, that does look like it will do the job. Interesting it's locked to S3 buckets from the quick read, and good to note that someone else (ie. you) have noted this isn't provided in Jira (ie. I didn't miss anything obvious)

Cheers for pointing this out.

[Kutumbarao Vallabhaneni]

Hi Steve,

Could you provide me how did you get the credentials from secrets manage - 

My question is I need to provide the Jira user name and password. 

What are the fields you used from Secrets Manager - response.

I did use get_secret_value method, I couldn't succeed. 

Please let me know how did you coded?.

Thanks.

[Steve Moss]

See https://community.atlassian.com/t5/Jira-questions/Re-Re-Secrets-in-Automation/qaq-p/1940616/comment-id/518099#M518099

[Kutumbarao Vallabhaneni]

Hi Steve,

Could you provide me how did you get the credentials from secrets manage - 

My question is I need to provide the Jira user name and password. 

What are the fields you used from Secrets Manager - response.

I did use get_secret_value method, I couldn't succeed. 

Please let me know how did you coded?.

Thanks.

[Steve Moss]

Are you using AWS Secrets Manager? I wasn't able to retrieve via secrets in Jira, but using AWS you should be able to retrieve using the API?

See the docs here https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/secretsmanager.html#SecretsManager.Client.get_secret_value.

Also an example here https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/blob/master/SecretsManagerRDSMySQLRotationSingleUser/lambda_function.py#L412-L418.

[Martin Cleaver]

Did you find an answer?

[Steve Moss]

I didn't get any joy with this. Ended up refactoring into a Lambda in AWS and speaking to the Jira API that way instead. That way we could use Amazon Secrets Manager and not expose secrets via the Jira automation (albeit only project and Jira admins had access).