Lambda denied secret manager update

I have a lambda function that can read secrets just fine, but fails to update the secret with the newer token data. The error returns that the assumed execution role does not have the necessary rights to the secret to perform an update action. However, based on the IAM simulator, the role should be able to read/write the secret. So in summary, the policies appear to be setup correctly and attached to the execution role of the Lambda script. ARN's to the secrets are correct. I did not however, create a resource based policy for the secret itself as to my understanding, that is not required as long as the execution role policy has the required ARN's and rights.

주제

서버리스 컴퓨팅 보안, 신원 및 규정 준수

태그

AWS Lambda AWS 시크릿 관리자 IAM 정책

언어

English

RavenTech

질문됨 한 달 전122회 조회

1개 답변

최신
최다 투표
가장 많은 댓글

이 답변이 도움이 되었나요?커뮤니티가 여러분의 지식을 활용할 수 있도록 정답을 찬성하세요.

Hello.

What IAM policy is set for the IAM role configured on Lambda?
If you are using rotation to update secrets, you will need a policy called "secretsmanager:RotateSecret".
If you want to update as is, the policy "secretsmanager:UpdateSecret" is required.
https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecretsmanager.html

전문가

Riku_Kobayashi

답변함 한 달 전

RavenTech
한 달 전
So this script will eventually become the update script called by the rotation process, however, for testing I gave it full write permissions: Allow: secretsmanager:GetSecretValue Allow: secretsmanager:StopReplicationToReplica Allow: secretsmanager:ListSecretVersionIds Allow: secretsmanager:DeleteSecret Allow: secretsmanager:ReplicateSecretToRegions Allow: secretsmanager:RemoveRegionsFromReplication Allow: secretsmanager:DescribeSecret Allow: secretsmanager:PutSecretValue Allow: secretsmanager:UpdateSecretVersionStage Allow: secretsmanager:RestoreSecret Allow: secretsmanager:CreateSecret Allow: secretsmanager:UpdateSecret Allow: secretsmanager:CancelRotateSecret Allow: secretsmanager:GetResourcePolicy Allow: secretsmanager:RotateSecret

Lambda denied secret manager update

관련 콘텐츠