aws_amazonmq: SecretValue is an IResovable, but it is rejected as an element of the users array

[acosta-edgar]

Describe the bug

in aws_amazonmq, construct cfnBroker, the users property is supposed to accept an array of IResovable, however, it does not accept in the Array a SecretValue, which implements the IResolvable interface.

Expected Behavior

putting a Secret value in the array of users should resolve later on.

Current Behavior

CDK throws a resolution error like this

Resolution error: Synthing a secret value to Resources/${Token[MyStack.AmazonMQ.rabbitmq.LogicalID.299]}/Properties/users/0. Using a SecretValue here risks exposing your secret. Only pass SecretValues to constructs that accept a SecretValue property, or call AWS Secrets Manager directly in your runtime code. Call 'secretValue.unsafeUnwrap()' if you understand and accept the risks.

Reproduction Steps

instantiate a new CfnBroker passing a secret value to the users array. e.g.

let mqProps = {
            autoMinorVersionUpgrade: false,
            brokerName: 'rabbitmq-broker',
            deploymentMode: 'SINGLE_INSTANCE',
            engineType: 'RABBITMQ',
            engineVersion: '3.11.20', 
            hostInstanceType: 'mq.t3.micro',
            publiclyAccessible: false,
            maintenanceWindowStartTime: {
                dayOfWeek: 'Saturday',
                timeOfDay: '22:00',
                timeZone: 'America/Montreal',
            },
            securityGroupIds: [amazonmqSecurityGroup.securityGroupId],
            subnetIds: vpc.vpc.selectSubnets({ 
                subnetType: ec2.SubnetType.PRIVATE_ISOLATED
              }).subnetIds,
            users: [
                cdk.SecretValue.secretsManager(secretName) //<------
            ],
            logs: {
                audit: false,
                general: true,
            }
        };

        const cfnBroker = new mq.CfnBroker(this, 'rabbitmq', mqProps);

Possible Solution

No response

Additional Information/Context

Using Typescript CDK 2.103.1 and also tried with older versions. As well of other versions of node.

CDK CLI Version

2.103.1

Framework Version

No response

Node.js Version

21.1.0

OS

MacOS

Language

TypeScript

Language Version

5.0.4

Other information

No response

[pahud]

I guess this is protected by this feature flag

@aws-cdk/core:checkSecretUsage

check this out:

aws-cdk/packages/@aws-cdk/cx-api/FEATURE_FLAGS.md

Line 517 in f9ee5e6

### @aws-cdk/core:checkSecretUsage

aws-cdk/packages/aws-cdk-lib/core/test/secret-value.test.ts

Lines 34 to 44 in f9ee5e6

	test('secret resolution fails if feature flag is switched on, secret can be unwrapped', () => {
	const app = new App({
	context: { '@aws-cdk/core:checkSecretUsage': true },
	});
	const stack = new Stack(app, 'Stack');
	// WHEN
	const v = SecretValue.unsafePlainText('s3cr3t');
	// THEN
	expect(() => stack.resolve(v)).toThrow(/Using a SecretValue here risks exposing your secret/);

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.