(pipelines): ShellStep Support for secure strings

[quincycs]

General Issue

I want to validate a deployment as described in docs here: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines-readme.html#validation. With ShellStep, I want to do a CURL to an API gateway protected by an APIKEY. I want to use the APIKEY in a secure way without exposing it in logs etc.

The Question

Is there a way to do this with parameter store or secrets manager?

I assume that shellstep somehow gets transformed into a codebuild project. CodeBuild projects seem to support this like: https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec-ref-example

CDK CLI Version

2.10.0

Framework Version

No response

Node.js Version

No response

OS

No response

Language

Typescript

Language Version

No response

Other information

No response

[indrora]

Doing so would involve using the AWS CLI or an SDK to retrieve the secret at that instant.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.