在 Lambda 函数中从 AWS Secrets Manager 检索机密

Question

我一直在尝试在 AWS 的 lambda 函数中使用 Secret Manager。

我正在使用 Secret Manager 存储我的 Redshift 凭据，并希望使用 AWS Secret Manager 提供的示例代码通过 lambda 函数检索密钥。

我在 Secret Manager 中设置了一个 Secret，其中包含我的 redshift 凭据（用户名、密码）

我正在尝试设置一个 lambda 函数，它将从 Secret Manger 获取秘密：下面是示例代码：


import boto3
import base64
from botocore.exceptions import ClientError


def lambda_handler(event, context):
    
    def get_secret():
        secret_name = "test/MySecret"
        region_name = "eu-west-2"

    # Create a Secrets Manager client
    session = boto3.session.Session()
    client = session.client(
        service_name='secretsmanager',
        region_name=region_name
    )
    
    try:
        get_secret_value_response = client.get_secret_value(
            SecretId = secret_name
        )
    except ClientError as e:
        if e.response['Error']['Code'] == 'DecryptionFailureException':
            # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InternalServiceErrorException':
            # An error occurred on the server side.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidParameterException':
            # You provided an invalid value for a parameter.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidRequestException':
            # You provided a parameter value that is not valid for the current state of the resource.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'ResourceNotFoundException':
            # We can't find the resource that you asked for.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
    else:
        # Decrypts secret using the associated KMS CMK.
        # Depending on whether the secret is a string or binary, one of these fields will be populated.
        if 'SecretString' in get_secret_value_response:
            secret = get_secret_value_response['SecretString']
        else:
            decoded_binary_secret = base64.b64decode(get_secret_value_response['SecretBinary'])

我在运行 lambda 函数时遇到以下错误：

{
  "errorMessage": "name 'secret_name' is not defined",
  "errorType": "NameError",
  "stackTrace": [
    "  File \"/var/task/lambda_function.py\", line 22, in lambda_handler\n    SecretId = secret_name\n"
  ]
}

我在 lambda 函数的开头定义了 secret_name，但我收到 secret_name' is not defined 错误。关于如何解决问题的任何建议

Answer 1

所以问题是 python 无法获取 secret_name 变量的值，原因是它在一个函数下

def get_secret():
    secret_name = "test/MySecret"
    region_name = "eu-west-2"

所以如果你只是使用 secret_name = "test/MySecret" 没有函数部分，示例代码应该可以工作

Answer 2

在您的代码中添加 VersionStage 参数！

get_secret_value_response = client.get_secret_value(
            SecretId = secret_name,VersionStage='AWSCURRENT')

在 Lambda 函数中从 AWS Secrets Manager 检索机密

Retrieve secrets from AWS Secrets Manager in a Lambda function

python

amazon-web-services

aws-lambda

aws-secrets-manager