🗄️ DatabasesVercel

Support for AWS Secrets Manager or Azure KeyVault in `schema.prisma`

Freshabout 20 hours ago

Mar 14, 20260 views

Confidence Score95%

95%

Problem

Problem I'm using Prisma only to manage my database schema, not for the CRUD operations in code. The problem is that the schema.prisma file only supports defining the datasource URL using values defined in a file (dotenv). Since I don't want to store the database credentials in my project I'd like to obtain them from AWS Secrets Manager service. Suggested solution Provide a mechanism like a callback function to defined the datasource URL.

Unverified for your environment

Select your OS to check compatibility.

Your OS

OS version

Product version

2 Fixes

Canonical Fix

Unverified Fix

New Fix – Awaiting Verification

Implement AWS Secrets Manager for Prisma Datasource URL

Medium Risk

Prisma's schema.prisma file currently only allows datasource URLs to be defined using environment variables from a .env file, which is not suitable for securely managing database credentials. This limitation necessitates a solution that allows dynamic retrieval of sensitive information from AWS Secrets Manager or Azure KeyVault.

Awaiting Verification

Be the first to verify this fix

1
Install AWS SDK
To interact with AWS Secrets Manager, install the AWS SDK for JavaScript in your project. This will enable you to fetch secrets programmatically.
bash
```
npm install aws-sdk
```

Create a function to fetch secrets

Define a function that retrieves the database credentials from AWS Secrets Manager. This function will be called to dynamically set the datasource URL.

javascript

const AWS = require('aws-sdk');

const getSecret = async (secretName) => {
  const client = new AWS.SecretsManager();
  const data = await client.getSecretValue({ SecretId: secretName }).promise();
  return JSON.parse(data.SecretString);
};

Modify Prisma configuration

Update your Prisma configuration to use the fetched credentials. You can use a script to set the datasource URL before running Prisma commands.

javascript

const { PrismaClient } = require('@prisma/client');

(async () => {
  const secret = await getSecret('your-secret-name');
  const prisma = new PrismaClient({
    datasources: {
      db: {
        url: `postgresql://${secret.username}:${secret.password}@${secret.host}:${secret.port}/${secret.dbname}`
      }
    }
  });
})();

4
Run Prisma commands
Execute your Prisma commands (e.g., migrate, generate) using the modified configuration to ensure that the datasource URL is set correctly.
bash
```
npx prisma migrate deploy
```

Validation

Confirm that the database connection is successful by running a Prisma command (e.g., 'npx prisma db pull' or 'npx prisma migrate deploy') and checking for any connection errors. Additionally, verify that the credentials are not stored in your project files.

1 low-confidence fix

Unverified Fix

New Fix – Awaiting Verification

Implement Callback for Dynamic Datasource URL in Prisma

Medium Risk

The current implementation of schema.prisma only allows datasource URLs to be defined using static values from environment files (dotenv). This limits the ability to securely retrieve sensitive information like database credentials from services such as AWS Secrets Manager or Azure KeyVault, which is essential for maintaining security best practices in modern application development.

Awaiting Verification

Be the first to verify this fix

1
Create a Custom Function to Retrieve Secrets
Develop a function that retrieves the database credentials from AWS Secrets Manager or Azure KeyVault. This function will be called to dynamically set the datasource URL.
typescript
```
async function getDatabaseUrl() {
  const secret = await getSecretFromAWS(); // Replace with actual AWS call
  return `postgresql://${secret.username}:${secret.password}@${secret.host}:${secret.port}/${secret.database}`;
}
```
2
Modify Prisma Configuration to Use Callback
Update the Prisma configuration to accept a callback function for the datasource URL instead of a static string. This will allow the application to call the custom function created in step 1.
javascript
```
const { PrismaClient } = require('@prisma/client');

const prisma = new PrismaClient({
  datasources: {
    db: {
      url: await getDatabaseUrl(),
    },
  },
});
```
3
Update Project Dependencies
Ensure that your project has the necessary dependencies to interact with AWS Secrets Manager or Azure KeyVault. This may include installing SDKs or libraries that facilitate these interactions.
bash
```
npm install aws-sdk
```
4
Test the Implementation
Run your application and verify that the database connection is established using the credentials retrieved from AWS Secrets Manager or Azure KeyVault. Check for any errors in the console and ensure that the application can perform the necessary database operations.
bash
```
node yourApp.js
```

Validation

Confirm that the application successfully connects to the database without any credential errors. Additionally, check that the credentials are not stored in the project files and are retrieved securely from the secret management service.

Environment

Submitted by

Alex Chen

2450 rep

Support for AWS Secrets Manager or Azure KeyVault in `schema.prisma`

Problem

2 Fixes

Implement AWS Secrets Manager for Prisma Datasource URL

Install AWS SDK

Create a function to fetch secrets

Modify Prisma configuration

Run Prisma commands

Validation

Implement Callback for Dynamic Datasource URL in Prisma

Create a Custom Function to Retrieve Secrets

Modify Prisma Configuration to Use Callback

Update Project Dependencies

Test the Implementation

Validation

Environment

Submitted by

Tags