Update aws secret pattern matcher (#1755)

awslabs · Feb 14, 2024 · 0fa4434 · 0fa4434
1 parent e5ce527
commit 0fa4434
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/.../src/main/java/com/amazonaws/athena/connector/lambda/security/CachableSecretsManager.java b/.../src/main/java/com/amazonaws/athena/connector/lambda/security/CachableSecretsManager.java
@@ -46,8 +46,8 @@ public class CachableSecretsManager
     private static final long MAX_CACHE_AGE_MS = 60_000;
     protected static final int MAX_CACHE_SIZE = 10;
 
-    private static final String SECRET_PATTERN = "(\\$\\{[a-zA-Z0-9-_\\-]+\\})";
-    private static final String SECRET_NAME_PATTERN = "\\$\\{([a-zA-Z0-9-_\\-]+)\\}";
+    private static final String SECRET_PATTERN = "(\\$\\{[a-zA-Z0-9-\\/_\\-\\.\\+=@]+\\})";
+    private static final String SECRET_NAME_PATTERN = "\\$\\{([a-zA-Z0-9-\\/_\\-\\.\\+=@]+)\\}";
     private static final Pattern PATTERN = Pattern.compile(SECRET_PATTERN);
     private static final Pattern NAME_PATTERN = Pattern.compile(SECRET_NAME_PATTERN);
 

diff --git a/...test/java/com/amazonaws/athena/connector/lambda/security/CacheableSecretsManagerTest.java b/...test/java/com/amazonaws/athena/connector/lambda/security/CacheableSecretsManagerTest.java
@@ -124,6 +124,10 @@ public void resolveSecrets()
         String commonErrorsExpected = "ThisIsM}yStringWi${thTwoSecretS{uperSecretSecrets";
         assertEquals(commonErrorsExpected, cachableSecretsManager.resolveSecrets(commonErrors));
 
+        String secretAllowedSpecialChars = "ThisIs${/My}StringW${ith_}All${Of+The}${@llowed=}${Special-Characters.}";
+        String secretAllowedSpecialCharsExpected = "ThisIs/MyStringWith_AllOf+The@llowed=Special-Characters.";
+        assertEquals(secretAllowedSpecialCharsExpected, cachableSecretsManager.resolveSecrets(secretAllowedSpecialChars));
+
         String unknownSecret = "This${Unknown}";
         try {
             cachableSecretsManager.resolveSecrets(unknownSecret);