Programmatically retrieving secrets from Parameter Store and Secrets Manager

1

AWS Secrets Manager

So we are better off adding the secrets to a central place like Parameter Store or Secrets Manager.

#Identity And Access Management #Identity Provider #SSO 67 social mentions

2

AWS Lambda

Below I'll discuss some ways we can make them available in our Lambda functions. I'll refer to passwords, connection URLs, and API keys as secrets in the rest of this writing to be brief.

#Cloud Computing #Cloud Hosting #Backend As A Service 244 social mentions

3

Amazon Key Management Service

The function's execution role must have the relevant IAM permissions. If we allow the ssm:GetParameters, ssm:GetParameter and ssm:GetParametersByPath actions in the role's policy, the function will be able to retrieve various types and numbers of parameters. If we choose to encrypt the secret with a customer-managed KMS key (i.e., not the default AWS-managed key), we must add the kms:Decrypt permission to the policy, too.

#Network & Admin #Security & Privacy #Password Management 34 social mentions

4

AWS Identity and Access Management

The function's execution role must have the relevant IAM permissions. If we allow the ssm:GetParameters, ssm:GetParameter and ssm:GetParametersByPath actions in the role's policy, the function will be able to retrieve various types and numbers of parameters. If we choose to encrypt the secret with a customer-managed KMS key (i.e., not the default AWS-managed key), we must add the kms:Decrypt permission to the policy, too.

#Identity And Access Management #Identity Provider #SSO 52 social mentions

5

Amazon EKS

Although I'll use Lambda functions in the examples, we can transfer the concepts to other compute resources, like EC2 instances, and ECS or EKS containers.

#Cloud Computing #Developer Tools #Cloud Infrastructure 54 social mentions

6

Amazon ECS

Although I'll use Lambda functions in the examples, we can transfer the concepts to other compute resources, like EC2 instances, and ECS or EKS containers.

#Developer Tools #Containers As A Service #Cloud Computing 46 social mentions

7

Amazon EC2

Although I'll use Lambda functions in the examples, we can transfer the concepts to other compute resources, like EC2 instances, and ECS or EKS containers.

#Cloud Computing #Cloud Infrastructure #VPS 62 social mentions

8

AWS CloudFormation

We can add dynamic references to our CloudFormation templates. This way, the secret's value will be available at deployment time. We can store it as an environment variable in the function code.

#Continuous Integration #DevOps Tools #Continuous Deployment 113 social mentions