How can I create the "_SSH_KEY" from AWS?

[burekas7]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Hi,

I'm using the Workflow:
Currently I'm using the AWS in order to generate secret files using scripts in the "pre-build" section/
I also added "_SSH_KEY" in the Environment Variables.

My question is how can I get the SSH key from AWS instead of add it directly in the Workflow, and where?
Beacuse I know which script to run, but Codemagic use key earlier.

For example running this script:

echo "$(aws secretsmanager get-secret-value \
 --secret-id codemagic | \
 jq -r '.SecretString' | \
 jq -r '.BITBUCKET_SSH_KEY')" >> $BITBUCKET_SSH_KEY

Which mobile framework are you using?

Flutter (Dart)

[dtrdic]

Hey @burekas7, in your latest build, during the Fetching app source step, Codemagic is complaining about the _SSH_KEY you added as an environment variable. It seems that the key is in the wrong format or may not have been copied entirely. Please try adding this key again. Please also share a build id in the future, you can find it on the build overview page

[burekas7]

@dtrdic
I have already solve this, I used the public instead the private key (This why I close the other issue)

Here I'm talking about something else.
I want to keep the SSH key in AWS and not in the Codemagic Environment Variables (As I did for firebase files)
But the problem here is where should I load it, since Codemagic build process needs the key earlier, and there is no option for running the aws script before that.
So my question how can I do it?

[burekas7]

Hi, can anyone help?

[dtrdic]

Have you added AWS_DEFAULT_REGION , AWS_SECRET_ACCESS_KEY , and AWS_ACCESS_KEY_ID variables in the Codemagic UI? Have you followed this documentation that explains on how to import variables with AWS Secrets Manager.
I can't see what you are doing if you don't provide a build id.

[burekas7]

@dtrdic
Here I'm talking about something else.
I am already working with AWS (For generating the Firebase files from AWS)
The question here is very specific, fetching the "_SSH_KEY" from AWS.
But the issue is not "how" here,
the issue is with the CodeMagic flow when and where should I load the "_SSH_KEY"
since Codemagic build process needs the key earlier, and there is no option for running the aws script before that.
So my question how can I do it?

[dtrdic]

hey @burekas7 you can make an environment variable and store it in the CM_ENV environment file, which will be loaded at the build time.

BITBUCKET_SSH_KEY=$(aws secretsmanager get-secret-value \
 --secret-id codemagic | \
 jq -r '.SecretString' | \
 jq -r '.BITBUCKET_SSH_KEY')

Then write it to CM_ENV like this;
echo "CM_BITBUCKET_SSH_KEY=$BITBUCKET_SSH_KEY" >> $CM_ENV
And use $CM_BITBUCKET_SSH_KEY wherever you need in the script.

Check this part of the documentiation, and this, the principles are the same if you work with Workflow editor or codemagic.yaml

[burekas7]

Hi @dtrdic,

Thanks,
But I didn't quite understand the order of operations.
I work with the Workflow editor.

• Where do I run the script that fetch the value from aws for that case fo _SSH_KEY?
• Where do I run the script to affect the CM_ENV, so it will use the SSH Key when starting the build after fetching it from aws?
• From what I know, I don't use _SSH_KEY myself,
  currently the SSH KEY is set in the Workflow directly and the CM flow recognizes and uses it by itself during the build.
  So I didn't understand what is meant by using $CM_BITBUCKET_SSH_KEY

[dtrdic]

Hey @burekas7, actually the above may not be the best approach.. instead of manually creating an SSH key pair on your machine, let Codemagic generate a key pair for you, and just copy the generated public key and store it in your Bitbucket repo, the private part of the key will already be stored on Codemagic

[dtrdic]

I'm tentatively closing the discussion since we haven't heard back from you. You can open the discussion again by replying to this message or opening a new discussion.