Implement AWS Secrets Manager storage backend logic

[pkosiec]

Description

• Start with a short research
  • Ideally, find a solution (e.g. Go library) which supports multiple credentials stores, not only AWS Secret Manager
    • e.g. https://github.com/external-secrets/kubernetes-external-secrets
• Implement logic in Go according to the proposal (https://github.com/capactio/capact/blob/main/docs/proposal/20211207-delegated-storage.md#storage-backend-service-implementation)

Out of scope:
As the future follow-up work depends on the #626, the following points are out of scope:

• If we keep existing Local Hub implementation in JS: Expose as gRPC service (it will be done later if needed), prepare build pipeline, add K8s resources manifests
• If we will rewrite Local Hub in Go: Build the logic inside Local Hub

Reason

See epic #604 for reason and use cases.

[pkosiec]

Here's a quick summary from my short research:

Considered solutions:

• Dapr secrets (https://docs.dapr.io/developing-applications/building-blocks/secrets/secrets-overview/)
  • Another dependency for Capact
  • Unfortunately it allows only retrieving secrets https://docs.dapr.io/reference/api/secrets_api/
• https://github.com/external-secrets/external-secrets
  • Support syncing external secrets to Kubernetes
  • It is one-way only: "External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.". There's a proposal to support creating credentials from K8s: (see e.g. Feature: Reverse Injection/External Sink external-secrets/external-secrets#347).
  • Supports multiple providers: https://github.com/external-secrets/external-secrets#stability-and-support-level
  • It depends on Kubernetes
• Teller
  • While the main use case is to provide secrets for development environment, it has convenient Go API with handy abstractions
  • Simple interface for every provider
  • Supports multiple secret providers - not only AWS Secrets Manager, but also Vault https://github.com/SpectralOps/teller/tree/master/pkg/providers
  • Unfortunately, currently it doesn't support Put method for AWS Secrets Manager, but there is an open PR with the functionality (add aws put methods tellerops/teller#47)
  • Currently doesn't support delete
  • Supports dotenv provider which is great for testing
• https://github.com/cyberark/summon
  • Doesn't support Vault
  • Looks like it supports only secret read
• https://github.com/s12v/exec-with-secrets and other similar solutions
  • Just read access
  • Not really popular, lacking providers support

From the list above, it looks like the Teller is the best candidate for us, even if it currently lacks the AWS Secrets Manager Put and Delete functionality on master - we can use the fork for now and contribute functionality if necessary. I'm going to prepare a small PoC (which, ideally, will evolve into an actual implementation) to confirm it's a good option.