Stefan Olaru Certainly!

Stefan Olaru Took a me a while (converted to cdk and changed/added some things), but here is what I did to generate the bootstrap api key and startup the typesense instance:

Have AWS Secretsmanager generate the bootstrap api key without it ever touching my laptop:

typesense_bootstrap_api_key = secretsmanager.Secret(self, "TypesenseBootstrapAPIKeySecret",
secret_name="TypesenseBootstrapAPIKey",
generate_secret_string=secretsmanager.SecretStringGenerator(
                exclude_uppercase=True,
                exclude_punctuation=True,
                password_length=64,    
            ),
        )

Get the Bootstrap API Key from SecretsManager upon execution of the UserData:

sudo yum install jq

# get the api key for bootstrapping typesense
secretsmanager_resp=$(aws secretsmanager get-secret-value \
                --secret-id {typesense_bootstrap_api_key.secret_name})
ApiKey=$(echo $secretsmanager_resp | jq -r .SecretString)

The Typesense EC2 Instance IAM Role needs additional permissions to get this secret from SecretsManager. I created a SecretsManagerReadOnlyPolicy and attached it to the role:

secrets_manager_read_only_policy = iam.ManagedPolicy(self, "SecretsManagerReadOnlyPolicy",
            managed_policy_name="SecretsManagerReadOnly",
            statements=[iam.PolicyStatement(
                effect=iam.Effect.ALLOW,
                actions=[
                            "secretsmanager:GetResourcePolicy",
                            "secretsmanager:GetSecretValue",
                            "secretsmanager:DescribeSecret",
                            "secretsmanager:ListSecretVersionIds"
                        ],
                resources=["*"]
            )]
        )

I do end up using a lambda function to generate api keys. It gets the bootstrap or admin key (depending on what keyname you pass in the payload) from secretsmanager, reaches out to typesense to generate a new key with whatever name and permissions were passed in the payload, and then stores that new key in secretsmanager. Hopefully this can be run to generate the basic keys I'd want (admin, readwrite, readonly, idk what else) upon CDK deploy, but I don't have a great way to ensure it runs after the typesense server actually starts up for the first time without doing something very hacky.

By the way, my UserData script needed this addition to get the EC2_INSTANCE_ID:

# get instance-id
TOKEN=$(curl -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 600" "instance-data/latest/api/token")
EC2_INSTANCE_ID=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" -s instance-data/latest/meta-data/instance-id)

This is all built into a greater cdk project I have going, but I will pull this out and put it in a public repo when I have time.

Calvin Butler Awesome, thanks for the detailed reply! 👏

Hi Nick, SSL on IP is tricky but you can point a sub/domain to it and install Certbot to issue a free Let's Encrypt certificate.

Stefan Olaru Thanks for the reply. I've tried that but then I run into issues with the certificate being only readable by root, but the typesense service being run by ec2-user. I get this error on startup:

"An error occurred while trying to load server certificate file: /etc/letsencrypt/live/example.com/fullchain.pem"

I've read that putting a load balancer in front of everything will allow us to install an aws issued certificate. Would you have an example of how to do that?

Hi Nick, you could add an ALB in front of your instance, though for a single instance and just for SSL certificate it might be overkill.

Have a look at my other article about running a multi-node Typesense, it uses a Load Balancer blog.stefanolaru.com/how-to-run-highly-available-…

Another (free) option would be to install Nginx which will handle the SSL termination and proxy to Typesense. But it's very likely possible to manage this directly from Typesense ...