feat(core): support Docker asset build secrets

packages/@aws-cdk/aws-ecr-assets/lib/image-asset.ts

@@ -98,6 +98,13 @@ export interface DockerImageAssetInvalidationOptions {
    */
   readonly buildArgs?: boolean;
 
+  /**
+   * Use `buildSecrets` while calculating the asset hash
+   *
+   * @default true
+   */
+  readonly buildSecrets?: boolean;
+
   /**
    * Use `target` while calculating the asset hash
    *
@@ -163,6 +170,15 @@ export interface DockerImageAssetOptions extends FingerprintOptions, FileFingerp
    */
   readonly buildArgs?: { [key: string]: string };
 
+  /**
+   * Build secrets to pass to the `docker build` command.
+   *
+   * Docker BuildKit must be enabled.
+   *
+   * @default - no build secrets are passed
+   */
+  readonly buildSecrets?: { [key: string]: string };
+
   /**
    * Docker target to build to
    *
@@ -267,6 +283,11 @@ export class DockerImageAsset extends Construct implements IAsset {
    */
   private readonly dockerBuildArgs?: { [key: string]: string };
 
+  /**
+   * Build secrets to pass to the `docker build` command.
+   */
+  private readonly dockerBuildSecrets?: { [key: string]: string };
+
   /**
    * Docker target to build to
    */
@@ -325,6 +346,7 @@ export class DockerImageAsset extends Construct implements IAsset {
     const extraHash: { [field: string]: any } = {};
     if (props.invalidation?.extraHash !== false && props.extraHash) { extraHash.user = props.extraHash; }
     if (props.invalidation?.buildArgs !== false && props.buildArgs) { extraHash.buildArgs = props.buildArgs; }
+    if (props.invalidation?.buildSecrets !== false && props.buildSecrets) { extraHash.buildSecrets = props.buildSecrets; }
     if (props.invalidation?.target !== false && props.target) { extraHash.target = props.target; }
     if (props.invalidation?.file !== false && props.file) { extraHash.file = props.file; }
     if (props.invalidation?.repositoryName !== false && props.repositoryName) { extraHash.repositoryName = props.repositoryName; }
@@ -353,11 +375,13 @@ export class DockerImageAsset extends Construct implements IAsset {
     const stack = Stack.of(this);
     this.assetPath = staging.relativeStagedPath(stack);
     this.dockerBuildArgs = props.buildArgs;
+    this.dockerBuildSecrets = props.buildSecrets;
     this.dockerBuildTarget = props.target;
 
     const location = stack.synthesizer.addDockerImageAsset({
       directoryName: this.assetPath,
       dockerBuildArgs: this.dockerBuildArgs,
+      dockerBuildSecrets: this.dockerBuildSecrets,
       dockerBuildTarget: this.dockerBuildTarget,
       dockerFile: props.file,
       sourceHash: staging.assetHash,
@@ -411,6 +435,7 @@ function validateProps(props: DockerImageAssetProps) {
   }
 
   validateBuildArgs(props.buildArgs);
+  validateBuildSecrets(props.buildSecrets);
 }
 
 function validateBuildArgs(buildArgs?: { [key: string]: string }) {
@@ -421,6 +446,14 @@ function validateBuildArgs(buildArgs?: { [key: string]: string }) {
   }
 }
 
+function validateBuildSecrets(buildSecrets?: { [key: string]: string }) {
+  for (const [key, value] of Object.entries(buildSecrets || {})) {
+    if (Token.isUnresolved(key) || Token.isUnresolved(value)) {
+      throw new Error('Cannot use tokens in keys or values of "buildSecrets" since they are needed before deployment');
+    }
+  }
+}
+
 function toSymlinkFollow(follow?: FollowMode): SymlinkFollowMode | undefined {
   switch (follow) {
     case undefined: return undefined;

packages/@aws-cdk/aws-ecr-assets/test/demo-image-secret/Dockerfile

@@ -0,0 +1,6 @@
+FROM public.ecr.aws/lambda/python:3.6
+RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret
+EXPOSE 8000
+WORKDIR /src
+ADD . /src
+CMD python3 index.py

packages/@aws-cdk/aws-ecr-assets/test/demo-image-secret/index.py

@@ -0,0 +1,33 @@
+#!/usr/bin/python
+import sys
+import textwrap
+import http.server
+import socketserver
+
+PORT = 8000
+
+
+class Handler(http.server.SimpleHTTPRequestHandler):
+    def do_GET(self):
+        self.send_response(200)
+        self.send_header('Content-Type', 'text/html')
+        self.end_headers()
+        self.wfile.write(textwrap.dedent('''\
+            <!doctype html>
+            <html><head><title>It works</title></head>
+            <body>
+                <h1>Hello from the integ test container</h1>
+                <p>This container got built and started as part of the integ test.</p>
+                <img src="https://media.giphy.com/media/nFjDu1LjEADh6/giphy.gif">
+            </body>
+            ''').encode('utf-8'))
+
+
+def main():
+    httpd = http.server.HTTPServer(("", PORT), Handler)
+    print("serving at port", PORT)
+    httpd.serve_forever()
+
+
+if __name__ == '__main__':
+    main()

packages/@aws-cdk/aws-ecr-assets/test/demo-image-secret/secret.txt

@@ -0,0 +1 @@
+test-secret

packages/@aws-cdk/aws-ecr-assets/test/image-asset.test.ts

@@ -125,6 +125,24 @@ describe('image asset', () => {
     })).toThrow(expected);
   });
 
+  test('fails if using tokens in build secrets keys or values', () => {
+    // GIVEN
+    const stack = new Stack();
+    const token = Lazy.string({ produce: () => 'foo' });
+    const expected = /Cannot use tokens in keys or values of "buildSecrets" since they are needed before deployment/;
+
+    // THEN
+    expect(() => new DockerImageAsset(stack, 'MyAsset1', {
+      directory: path.join(__dirname, 'demo-image'),
+      buildSecrets: { [token]: 'value' },
+    })).toThrow(expected);
+
+    expect(() => new DockerImageAsset(stack, 'MyAsset2', {
+      directory: path.join(__dirname, 'demo-image'),
+      buildSecrets: { key: token },
+    })).toThrow(expected);
+  });
+
   testDeprecated('fails if using token as repositoryName', () => {
     // GIVEN
     const stack = new Stack();
@@ -149,13 +167,15 @@ describe('image asset', () => {
     const asset4 = new DockerImageAsset(stack, 'Asset4', { directory, buildArgs: { opt1: '123', opt2: 'boom' } });
     const asset5 = new DockerImageAsset(stack, 'Asset5', { directory, file: 'Dockerfile.Custom', target: 'NonDefaultTarget' });
     const asset6 = new DockerImageAsset(stack, 'Asset6', { directory, extraHash: 'random-extra' });
+    const asset7 = new DockerImageAsset(stack, 'Asset7', { directory, buildSecrets: { a: 'b' } });
 
     expect(asset1.assetHash).toEqual('13248c55633f3b198a628bb2ea4663cb5226f8b2801051bd0c725950266fd590');
     expect(asset2.assetHash).toEqual('36bf205fb9adc5e45ba1c8d534158a0aed96d190eff433af1d90f3b94f96e751');
     expect(asset3.assetHash).toEqual('4c85bd70e73117b7129c2defbe6dc40a8a3872329f4ddca18d75afa671b38276');
     expect(asset4.assetHash).toEqual('8a91219a7bb0f58b3282dd84acbf4c03c49c765be54ffb7b125be6a50b6c5645');
     expect(asset5.assetHash).toEqual('c02bfba13b2e7e1ff5c778a76e10296b9e8d17f7f8252d097f4170ae04ce0eb4');
     expect(asset6.assetHash).toEqual('3528d6838647a5e9011b0f35aec514d03ad11af05a94653cdcf4dacdbb070a06');
+    expect(asset7.assetHash).toEqual('adef40a1e694f03f8b45807d6061af13fa75d08442d4370a6619afb09d0ef254');
 
   });
 

packages/@aws-cdk/aws-ecr-assets/test/integ.assets-docker.js.snapshot/asset.600ab433dc112602ca7ba940e2720696dd6bfdb7abe79a608c701e522d0afcd9/Dockerfile

@@ -0,0 +1,6 @@
+FROM public.ecr.aws/lambda/python:3.6
+RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret
+EXPOSE 8000
+WORKDIR /src
+ADD . /src
+CMD python3 index.py

packages/@aws-cdk/aws-ecr-assets/test/integ.assets-docker.js.snapshot/asset.600ab433dc112602ca7ba940e2720696dd6bfdb7abe79a608c701e522d0afcd9/index.py

@@ -0,0 +1,33 @@
+#!/usr/bin/python
+import sys
+import textwrap
+import http.server
+import socketserver
+
+PORT = 8000
+
+
+class Handler(http.server.SimpleHTTPRequestHandler):
+    def do_GET(self):
+        self.send_response(200)
+        self.send_header('Content-Type', 'text/html')
+        self.end_headers()
+        self.wfile.write(textwrap.dedent('''\
+            <!doctype html>
+            <html><head><title>It works</title></head>
+            <body>
+                <h1>Hello from the integ test container</h1>
+                <p>This container got built and started as part of the integ test.</p>
+                <img src="https://media.giphy.com/media/nFjDu1LjEADh6/giphy.gif">
+            </body>
+            ''').encode('utf-8'))
+
+
+def main():
+    httpd = http.server.HTTPServer(("", PORT), Handler)
+    print("serving at port", PORT)
+    httpd.serve_forever()
+
+
+if __name__ == '__main__':
+    main()

packages/@aws-cdk/aws-ecr-assets/test/integ.assets-docker.js.snapshot/asset.600ab433dc112602ca7ba940e2720696dd6bfdb7abe79a608c701e522d0afcd9/secret.txt

@@ -0,0 +1 @@
+test-secret

packages/@aws-cdk/aws-ecr-assets/test/integ.assets-docker.js.snapshot/cdk.out

@@ -1 +1 @@
-{"version":"20.0.0"}
+{"version":"23.0.0"}

packages/@aws-cdk/aws-ecr-assets/test/integ.assets-docker.js.snapshot/integ-assets-docker.assets.json

@@ -1,15 +1,15 @@
 {
-  "version": "20.0.0",
+  "version": "23.0.0",
   "files": {
-    "129ed50df2725896720f8593072e2ac18c7c116a97374bea1f973ba8871c68e5": {
+    "8fec9a4f90e122913ce423ddc6ec9683e8785b8fec789096161d8a0f4c23f3d5": {
       "source": {
         "path": "integ-assets-docker.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "129ed50df2725896720f8593072e2ac18c7c116a97374bea1f973ba8871c68e5.json",
+          "objectKey": "8fec9a4f90e122913ce423ddc6ec9683e8785b8fec789096161d8a0f4c23f3d5.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
@@ -40,6 +40,21 @@
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-image-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
+    },
+    "600ab433dc112602ca7ba940e2720696dd6bfdb7abe79a608c701e522d0afcd9": {
+      "source": {
+        "directory": "asset.600ab433dc112602ca7ba940e2720696dd6bfdb7abe79a608c701e522d0afcd9",
+        "dockerBuildSecrets": {
+          "mysecret": "/Users/danielwiltshire/repos/aws-cdk/packages/@aws-cdk/aws-ecr-assets/test/demo-image-secret/secret.txt"
+        }
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "repositoryName": "cdk-hnb659fds-container-assets-${AWS::AccountId}-${AWS::Region}",
+          "imageTag": "600ab433dc112602ca7ba940e2720696dd6bfdb7abe79a608c701e522d0afcd9",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-image-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
     }
   }
 }

packages/@aws-cdk/aws-ecr-assets/test/integ.assets-docker.js.snapshot/integ-assets-docker.template.json

@@ -71,6 +71,11 @@
    "Value": {
     "Fn::Sub": "${AWS::AccountId}.dkr.ecr.${AWS::Region}.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-${AWS::AccountId}-${AWS::Region}:394b24fcdc153a83b1fc400bf2e812ee67e3a5ffafdf977d531cfe2187d95f38"
    }
+  },
+  "ImageUri4": {
+   "Value": {
+    "Fn::Sub": "${AWS::AccountId}.dkr.ecr.${AWS::Region}.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-${AWS::AccountId}-${AWS::Region}:600ab433dc112602ca7ba940e2720696dd6bfdb7abe79a608c701e522d0afcd9"
+   }
   }
  },
  "Parameters": {

packages/@aws-cdk/aws-ecr-assets/test/integ.assets-docker.js.snapshot/integ.json

@@ -1,5 +1,5 @@
 {
-  "version": "20.0.0",
+  "version": "23.0.0",
   "testCases": {
     "integ.assets-docker": {
       "stacks": [

packages/@aws-cdk/aws-ecr-assets/test/integ.assets-docker.js.snapshot/manifest.json

@@ -1,12 +1,6 @@
 {
-  "version": "20.0.0",
+  "version": "23.0.0",
   "artifacts": {
-    "Tree": {
-      "type": "cdk:tree",
-      "properties": {
-        "file": "tree.json"
-      }
-    },
     "integ-assets-docker.assets": {
       "type": "cdk:asset-manifest",
       "properties": {
@@ -23,7 +17,7 @@
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/129ed50df2725896720f8593072e2ac18c7c116a97374bea1f973ba8871c68e5.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/8fec9a4f90e122913ce423ddc6ec9683e8785b8fec789096161d8a0f4c23f3d5.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [
@@ -69,6 +63,12 @@
             "data": "ImageUri3"
           }
         ],
+        "/integ-assets-docker/ImageUri4": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "ImageUri4"
+          }
+        ],
         "/integ-assets-docker/BootstrapVersion": [
           {
             "type": "aws:cdk:logicalId",
@@ -83,6 +83,12 @@
         ]
       },
       "displayName": "integ-assets-docker"
+    },
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
     }
   }
 }