about AWS-Parameters-and-Secrets-Lambda-Extension for cross AWS account

Question

I am developing a lambda function which retrieve the secret from another AWS account's secret manager. It works by granting assuming role in my own AWS account's lambda and editing the target AWS account trust policy.

Now I would like to cache the secret in the lambda so as to lower the calling secret manager frequency. I find AWS-Parameters-and-Secrets-Lambda-Extension useful but lack of cross account example.  Is cross account workable for this extension?

Steve Kinsman · Answer

It looks like there's a missing piece for cross-account. I see in https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html that the extension allows you to specify the secret by ARN as well as name, so you can reference a secret in another account. Your execution role can be set up to assume a suitable role in that other account. But the problem is getting the extension to do that role assumption - I don't see a way to make that happen.

Depending on your lambda's calling frequency you can at least do some basic caching of the secret by retrieving it outside of the handler function so it's reused for multiple invokes over the lifecycle of the runtime container.

about AWS-Parameters-and-Secrets-Lambda-Extension for cross AWS account

Add your answer

Relevant content