AWS Secret Manager with .Net Core throws socket exception

Question

Anyone have an idea why i am getting this error while trying to the get the AWS secret from the secret manager? It is a docker container running in AWS Fargate.

Unhandled Exception: System.AggregateException: One or more errors occurred. (Invalid argument) ---> System.Net.Http.HttpRequestException: Invalid argument ---> System.Net.Sockets.SocketException: Invalid argument at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)

The code snippet is as below. And the task have adequate IAM role assigned to it.

using System;
using System.IO;
using Amazon;
using Amazon.SecretsManager;
using Amazon.SecretsManager.Model;

namespace AssetView.Contacts.WebApi
{
    public static class SecretManager
    {
        public static string GetSecret(string secretName, string region)
        {
            //string secretName = "av/connectionstring/dev";
            // region = "us-east-1";
            string secret = "";

            MemoryStream memoryStream = new MemoryStream();

            IAmazonSecretsManager client = new AmazonSecretsManagerClient(RegionEndpoint.GetBySystemName(region));

            GetSecretValueRequest request = new GetSecretValueRequest();
            request.SecretId = secretName;
            //request.VersionStage = "AWSCURRENT"; // VersionStage defaults to AWSCURRENT if unspecified.

            GetSecretValueResponse response = null;

            // In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
            // See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
            // We rethrow the exception by default.

            try
            {
                response = client.GetSecretValueAsync(request).Result;
            }
            catch 
            {
                throw;
            }

            // Decrypts secret using the associated KMS CMK.
            // Depending on whether the secret is a string or binary, one of these fields will be populated.
            if (response.SecretString != null)
            {
                secret = response.SecretString;
            }
            else
            {
                memoryStream = response.SecretBinary;
                StreamReader reader = new StreamReader(memoryStream);
                secret = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(reader.ReadToEnd()));
            }

            return secret;
        }
    }
}

The api document doesnt say much: https://docs.aws.amazon.com/sdkfornet/v3/apidocs/items/SecretsManager/MISecretsManagerGetSecretValueAsyncGetSecretValueRequestCancellationToken.html

OK999 OK999 · Accepted Answer · 2019-07-07T16:32:46

Turns out the ECS taskrole was not set to accquire the permission to access Secret manager! The error log was a bit misleading though.

UPDATED: Create am iam role like this:

Type: "AWS::IAM::Role"
Properties:
  RoleName: !Join [ '-', [my-ecsTaskrole, !Ref Environment] ]
  AssumeRolePolicyDocument:
    Version: "2012-10-17"
    Statement:
      -
        Effect: "Allow"
        Principal:
          Service:
            - "ecs-tasks.amazonaws.com" 
        Action: 
          - "sts:AssumeRole"
  Policies:
    -
      PolicyName: !Join [ '-', [mysecretmanagerpolicy, !Ref Environment] ]
      PolicyDocument:
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "secretsmanager:Describe*",
                        "secretsmanager:Get*",
                        "secretsmanager:List*"
                    ],
                    "Resource": "*",
                    "Condition": {
                        "StringEquals": {
                            "secretsmanager:ResourceTag/App": "xyz"
                        }
                    }
                }
            ]
        }

This role grants to only secrets with the specified tag, but you can tweak it.

The function is throwing the error as it needs the secrets, whether you use a role or baked it in the function. It should be there.

AWS Secret Manager with .Net Core throws socket exception

2 Answers