Hi everyone. I'm trying to implement dynamic secre...
# ask-community
r
Hi everyone. I'm trying to implement dynamic secrets usage using
PrefectSecret
Task I want to pass the secret key via
Parameter
. But it says that PrefectSecret argument should be statically defined so impossible to use parameter as secret key. Is that any workaround to solve that? Thanks in advance!
j
You mean you want to be able to determine which secret to pull at run time?
Can you share the code example that doesn’t work? We currently do this ourselves so I’m wondering what’s not working for you.
r
Copy code
from prefect import Flow, task, Parameter
from prefect.tasks.secrets import PrefectSecret


@task
def say_hello(secret=""):
    print("hello {}".format(secret))


with Flow("hello_flowx") as flow:
    secret_key = Parameter("secret_key")
    secret = PrefectSecret(secret_key)
    say_hellox = say_hello(secret)

flow.run(parameters={"secret_key": "secret_key"})
This is the example code When executed it says:
Copy code
A Task was passed as an argument to PrefectSecret, you likely want to first initialize PrefectSecret with any static (non-Task) arguments, then call the initialized task with any dynamic (Task) arguments instead. For example:

  my_task = PrefectSecret(...)  # static (non-Task) args go here
  res = my_task(...)  # dynamic (Task) args go here
j
secrets retrieved using PrefectSecret are encrypted and can be accessed by task. If you would like to see the actual secret value then
Copy code
from prefect.client.secrets import Secret
val=Secret("secret")
val.get()
val.get() will display the secret value
Copy code
from prefect import Flow, task, Parameter
from prefect.tasks.secrets import PrefectSecret
from prefect.client.secrets import Secret



@task
def say_hello(secret):
    print("hello {}".format(secret))



with Flow("hello_flowx") as flow:
    secret_key = Parameter("secret_key")
    secret = Secret(secret_key)
    say_hellox = say_hello(secret)

flow.run(parameters={"secret_key": "secret_key"})
The assumption is you've already set secret.
r
Thanks @Jay Shah! And does the argument value will be exposed on ui/log/server/cloud if we use
Secret
and pass it to task? Or should I just call it inside task func?
j
If you retrieve secret using PrefectSecret, there is no as such function/mechanism that will enable you see what the actual value is (so the value won't be exposed in ui/log/cloud/server). But if you use Secret, the values would be visible. "When using secrets in your tasks, it's generally best practice to pass the secret value in as a parameter, rather than loading the secret from within your task. This makes it easier to swap out what secret should be used, or to pass in secret values loaded via other mechanisms. The standard way to do this is to use a PrefectSecret task to load the secret, and pass the result to your task as an argument." https://docs.prefect.io/orchestration/concepts/secrets.html#using-secrets-in-tasks
👍 2
k
Nice @Jay Shah!
@Marvin archive "Parameters for Secrets and PrefectSecret"
r
Thanks @Jay Shah for the help!
j
👍