priority of decrypt: kms > arn > use dd_api_key

bottlecap/src/secrets/decrypt.rs

@@ -13,10 +13,7 @@ use tracing::debug;
 use tracing::error;
 
 pub async fn resolve_secrets(config: Arc<Config>, aws_config: &AwsConfig) -> Option<String> {
-    if !config.api_key.is_empty() {
-        debug!("DD_API_KEY found, not trying to resolve secrets");
-        Some(config.api_key.clone())
-    } else if !config.api_key_secret_arn.is_empty() || !config.kms_api_key.is_empty() {
+    if !config.api_key_secret_arn.is_empty() || !config.kms_api_key.is_empty() {
         let before_decrypt = Instant::now();
 
         let client = match Client::builder().use_rustls_tls().build() {
@@ -27,10 +24,10 @@ pub async fn resolve_secrets(config: Arc<Config>, aws_config: &AwsConfig) -> Opt
             }
         };
 
-        let decrypted_key = if config.api_key_secret_arn.is_empty() {
-            decrypt_aws_kms(&client, config.kms_api_key.clone(), aws_config).await
+        let decrypted_key = if config.kms_api_key.is_empty() {
+            decrypt_aws_kms(&client, config.api_key_secret_arn.clone(), aws_config).await
         } else {
-            decrypt_aws_sm(&client, config.api_key_secret_arn.clone(), aws_config).await
+            decrypt_aws_sm(&client, config.kms_api_key.clone(), aws_config).await
         };
 
         debug!("Decrypt took {}ms", before_decrypt.elapsed().as_millis());
@@ -43,7 +40,7 @@ pub async fn resolve_secrets(config: Arc<Config>, aws_config: &AwsConfig) -> Opt
             }
         }
     } else {
-        return None;
+        Some(config.api_key.clone())
     }
 }