- Newest
- Most votes
- Most comments
Your understanding is correct, you should consider using AWS Systems Manager parameter store, where you can create parameters in string form and retrieve them using boto3 in your lambda functions.
It supports three types:
- String
- StringList
- SecureString
You can simply put json strings as String type, it's just, after fetching the parameters from parameter store, you'd need to parse that for your required fields.
Lambda function execution role should have systems manager permissions.
SSM Parameter Permissions Documentation
Additional context: Though this is absolutely up to your use case and exact requirement, but to store DB credentials in AWS, it's always better to store those in secretsmanager as that provides auto rotation feature out of the box where parameter store doesn't.
Rotating secrets using secrets manager
Hope you find this information useful.
Comment here if you have additional questions, happy to help.
Abhishek
I have seen secrets used instead of app settings for dot NET applications previously.
Of course as you rightly state, you could use parameter store and also environment variables too.
All have pros and cons.
Thank you. Any links to how to use it in c# Lambda NET6 code?
Hello.
As you say the Systems Manager parameter store is useful.
Another option is to use Secrets Manager.
Especially with Secrets Manager, you can easily implement automatic password rotation, etc. in conjunction with RDS.
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-secrets-manager.html
https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html
Relevant content
- asked 3 years ago
- asked 3 years ago
Thank you, yet another question to this: How to use Parameter Store in AWS Lambda (NET6) c# code? what should be added to code, what replaced in comparison with particular NET 6 code used appsettings.json?
Here is the code snippet for C# to fetch SSM parameters:
// Define a function to fetch AWS SSM parameters function fetchSSMParameters(parameterNames) { var ssmClient = AwsSsmService.create(ssmConfig); var ssmParameters = ssmClient.getParameter(parameterNames);
return ssmParameters; }
// Define the AWS SSM configuration var ssmConfig = { region: "us-east-1", // Update with your desired AWS region accessKeyId: "YOUR_ACCESS_KEY_ID", secretAccessKey: "YOUR_SECRET_ACCESS_KEY" };
// Example usage var parameterNames = ["ParameterName1", "ParameterName2"]; var ssmParameters = fetchSSMParameters(parameterNames);
You may need to adjust/tweak based on your requirement but you may find this helpful for reference.
Comment here if you have additional questions, happy to help.
I’d Recommend using a role instead of keys
A few questions:
@Gary Mclean How to use role instead of keys? Any links to examples?