How to put password as a AWS Parameter Store ARN in app.yml

Product Support

AI-generated summary

Passing AWS Parameter Store ARN in app.yml

Gursharan_Singh is seeking help to securely pass database credentials to a Discourse setup using an AWS Parameter Store ARN in the app.yml file. However, the ARN is being interpreted as a plain password.

pfaffman suggests that using the actual postgres password is a common practice when using RDS, and it may not be possible to use the ARN directly. Gursharan_Singh is concerned about security and prefers not to pass the password directly in the app.yml file.

pfaffman argues that if the database is properly secured with networking and firewalls, knowing the password does not pose a significant risk. It is likely that many Discourse sites on AWS with RDS use this approach.

1

Hello,
I am running discourse setup in ec2 instance docker container. I am using external RDS Postgresql database. I want to pass on credentials as a ARN of parameter store in app.yml file. But seems like app.yml file interpreting ARN as a plain password.

Please suggest the correct way to pass on AWS ARN in app.yml file. My sample app.yml code is below:

DISCOURSE_DB_HOST: testrds.testingabcdkfd.eu-west-1.rds.amazonaws.com
  DISCOURSE_DB_NAME: dbname
  DISCOURSE_DB_USERNAME: dbusername
  DISCOURSE_DB_PASSWORD: arn:aws:ssm:us-west-1:121212121212:parameter/discourse-db-password

I also tried ARN with quotes but did not work.

Thanks in advance.

2

When I’ve used RDS I’ve used the postgres password. I don’t think that you can use the ARN like you’re trying to.

3

I am sure you can do it but I am not getting any post regarding this solution. Passing passwd directly in app.yml is not a secure way. Do you prefer any other method.

Thanks.

4

If your database is protected by a password, you are not secure. You’ll configure networking and firewalls so that only your VM can access the database, so knowing the password doesn’t make much difference.

I’m sure that cdck/discourse.org runs plenty of sites on AWS with RDS and am fairly certain that they configure those very same variables with the password.