Secrets Management and outputs reference

[gruntwork-support]

This message was extracted from a discussion that originally took place in Gruntwork Community Slack. Names and URLs have been removed where appropriate

From a customer

Hey all! My goal is to create an aurora cluster, take the cluster url that is generated after-the-apply, and seamlessly pass that, one way or another, to my application (which is configured as a backend ecs service). I'd also ideally like this to be dynamic, so that if that URL was to change, the change would make its way to my application.

Firstly, to do this, I'd need to reference the output of one gruntwork module in another. I'm having a hard time finding the docs that explain how to do this, if it's possible at all.

Secondly, I'm curious if anyone has an opinion on the "best" way to do this. Thoughts I've had so far are:

• set the URL as an environment variable on the ecs service
• create a secret in the secrets manager and have my app pull that secret during runtime to get the URL.

The issue I see with both of these approaches is that its not very dynamic. At the very least, I'd have to wait for an aurora failure and potentially reload the secret in that scenario in case it has changed.
Thanks in advance!!

[gruntwork-support]

From a grunt

Hey, person. See my responses below:

Firstly, to do this, I’d need to reference the output of one gruntwork module in another. I’m having a hard time finding the docs that explain how to do this, if it’s possible at all.

Yes, it would be possible - it might depend on your code structure. You can have a look at one example with aurora here. You can also use remote_state for referring to other data which is on a separate TF configuration.

Secondly, I'm curious if anyone has an opinion on the "best" way to do this. Thoughts I've had so far are:

• set the URL as an environment variable on the ecs service
• create a secret in the secrets manager and have my app pull that secret during runtime to get the URL.

Both of these are viable options.I’ll have to look a bit deeper, but on top of my head: the things you might have to consider is if you update the ecs service with a new variable, you might need to restart the service. I don’t see anything wrong with the secrets approach, but I’d have to check with other Grunts in case I’m missing something obvious here.