Load AWS Secrets into Cypress as env-variable

Integrate the power of AWS Secrets Manager seamlessly into your Cypress tests with the cypress-aws-secretss-manager plugin. This lightweight yet powerful plugin facilitates the secure loading of secrets stored in AWS Secrets Manager directly into your Cypress environment variables, ensuring a streamlined and secure approach to managing sensitive information in your test scripts.

Install

1$ npm install cypress-aws-secrets-manager --save-dev

or as a global module

1$ npm install -g cypress-aws-secrets-manager

Prerequisites

• AWS CLI Install/Update
• A user to SSO via AWS Identity and Access Management.

Configuration

Code in cypress.config.js:

In your cypress.config.js file:

1module.exports = defineConfig({
2	e2e: {
3		async setupNodeEvents(on, config) {
4			const getSecretFromAWS = require('cypress-aws-secrets-manager')
5			await getSecretFromAWS(on, config)
6		},
7	},
8})

Define AWS login strategy

• AWS_SSO_STRATEGY: 'profile'|'default'|'unset'|'multi'
  • If profile will use the profile name specified inside the awsSecretsManagerConfig (If the profile is not specified, the default profile will be used).
  • If default will use the default sso config.
  • If unset will login without sso authentication, used mostly when running cypress on CI tools, cause them are already authenticated.
  • If multi will try with every strategy, fails only after trying them all.

If not specified the 'multi' strategy will be used.

Define awsSecretsManagerConfig object:

The awsSecretsManagerConfig is an object containing the following parameters:

Parameter	Mandatory	Notes
secretName	TRUE	AWS secret name
profile	FALSE	AWS SSO profile name, if not set the plugin will use 'default' profile
region	TRUE	AWS Secrets Manager region

Pass your AWS configuration to cypress

After defining your strategy and your awsSecretsManagerConfig.
I propose two solutions for you to import this configuration into cypress, it's up to you to decide which one to choose

"Easy" way with cypress-env plugin:

PRO: Zero code solution
CONS: cypress-env needed

Following the plugin's guide, you should end up with a JSON file, which must respect this syntax:

1//environment.json
2{
3	"baseUrl": "https://www.google.com",
4	"env": {
5		"var1": "value1",
6		"var2": "value2",
7		"var3": "value3"
8	}
9}

Simply add "AWS_SSO_STRATEGY" inside the "env" object and add awsSecretsManagerConfig as follows:

1//environment.json
2{
3	"baseUrl": "https://www.google.com",
4	"env": {
5		"AWS_SSO_STRATEGY": "strategy_type",
6		"var1": "value1",
7		"var2": "value2",
8		"var3": "value3"
9	},
10	"awsSecretsManagerConfig": {
11		"secretName": "AWS_SECRET_NAME",
12		"profile": "AWS_PROFILE_NAME",
13		"region": "AWS_REGION"
14	}
15}

No other changes needed

"Complex" way inside cypress.config.js:

PRO: No cypress-env needed
CONS: Solution with some code

1//cypress.config.js
2module.exports = defineConfig({
3	e2e: {
4		async setupNodeEvents(on, config) {
5			const option = {
6				awsSecretsManagerConfig: {
7					secretName: 'AWS_SECRET_NAME',
8					profile: 'AWS_PROFILE_NAME',
9					region: 'AWS_REGION',
10				},
11			}
12			config = {
13				...config,
14				...option,
15			}
16			const getSecretFromAWS = require('cypress-aws-secrets-manager')
17			await getSecretFromAWS(on, config)
18		},
19	},
20	env: {
21		AWS_SSO_STRATEGY: 'strategy_type',
22	},
23})

Overwrite AWS_SSO_STRATEGY property when running on a different machine or on CI

Sometimes you'll need to override the AWS_SSO_STRATEGY property that was provided inside cypress.config.env.
To do so, you'll need to run cypress with the following command:

1npx cypress run -e AWS_SSO_STRATEGY=$OVERWRITING_AWS_SSO_STRATEGY

Where $OVERWRITING_AWS_SSO_STRATEGY is the new strategy value.

Results

Correct configuration

1====================================================================================================
2
3Starting plugin: cypress-aws-secrets-manager
4
5AWS SSO strategy: profile
6
71st attempt: Trying to login into AWS with profile: "AWS_PROFILE_NAME"
8
9AWS SDK credentials are set up correctly!
10
11Extracting secret from: "AWS Secrets Manger"
12
13secret: "{
14    "username": "*****",
15    "password": "*****"
16}"
17
18√ Secret loaded correctly from: "AWS_SECRET_NAME"
19
20====================================================================================================

Missing configuration

Description
Cypress has starter without plugin configurations

1====================================================================================================
2
3Starting plugin: cypress-aws-secrets-manager
4
5√ Missing awsSecretsManagerConfig, continue without secrets!
6
7====================================================================================================

Wrong configuration

Description
Properties: secretName & region are mandatory

1====================================================================================================
2
3Starting plugin: cypress-aws-secrets-manager
4
5ConfigurationError!
6"awsSecretsManagerConfig" object MUST contains these mandatory properties: secretName,region
7
8Passed: {
9 "profile": "AWS_PROFILE_NAME"
10}
11Missing: [
12 "secretName",
13 "region"
14]
15
16====================================================================================================

Wrong credentials

Description
Your credentials are invalid

1====================================================================================================
2
3Starting plugin: cypress-aws-secrets-manager
4
5AWS SSO strategy: "multi"
6
71st attempt: Trying to login into AWS with profile: "AWS_PROFILE_NAME"
8
92nd attempt: Trying to login into AWS with profile: "default"
10
113rd attempt: Trying without specifying credentials
12
13Incorrect plugin configuration!
14ERROR: Could not load credentials from any providers
15
16====================================================================================================

Little tip for you

You can create a bash file that verifies if you are already logged into the AWS account:
NB Change AWS_PROFILE_NAME with your profile name

1#awslogin_script.sh
2
3#!/bin/bash
4
5# Check to see if we are already logged in
6SSO_ACCOUNT=$(aws sts get-caller-identity --query "Account" --profile AWS_PROFILE_NAME)
7
8# If response is the sso_account_id we are already logged in (it has length 14)
9if [ ${#SSO_ACCOUNT} -eq 14 ];  then
10echo "AWS SSO session still valid, no login needed" ;
11
12# Else we login with "aws sso login --profile AWS_PROFILE_NAME"
13else
14echo "" ; echo "AWS SSO session expired, login needed" ; echo ""
15aws sso login --profile AWS_PROFILE_NAME
16
17fi

Then in your package.json file create a script like this:

1//package.json
2{
3	"scripts": {
4		"cy:open": "sh awslogin_script.sh && npx cypress open",
5		"cy:run": "sh awslogin_script.sh && npx cypress run"
6	}
7}

So you'll only have to type this command to open cypress and login into aws:

1npm run cy:open

THE JOB IS DONE!

Happy testing to everyone!

ALEC-JS

🙌 Donate to support my work & further development! 🙌