Unable to create a triggers for lambda

Below the checklist to locate the issue:

• PEM blocks are complete and properly wrapped
• No trailing whitespace or malformed headers
• If encrypted, password is included and uses PBES1 algorithm (PBES2 is not supported)
• Secrets Manager secret is in the same region as your Lambda function
• Lambda has permission to access the secret (secretsmanager:GetSecretValue)

The error message "PROBLEM: Certificate and/or private key must be in PEM format" indicates that there's an issue with the certificate or private key format you're using for your Lambda trigger.

This specific error typically occurs when setting up an event source mapping with Apache Kafka. Even though your key might appear to be in the correct format in Secrets Manager, there could be a few issues:

1. The certificate or private key might not be properly formatted in PEM format.
2. The private key encryption might be using an algorithm that's not compatible. Specifically, the private key encryption should use a PBES1 algorithm.

To resolve this issue:

1. Verify that both your certificate and key are in proper PEM format.
2. Check that the private key encryption uses a PBES1 algorithm.
3. Make sure there are no extra characters, line breaks, or formatting issues in your certificate or key.

If you're adding a trigger through the Lambda console, follow these steps:

1. Open the Functions page of the Lambda console
2. Select your function
3. In the Function overview pane, choose "Add trigger"
4. Select the AWS service you want to use to invoke your function
5. Fill out the trigger configuration options carefully, ensuring all certificate and key information is correctly formatted

If the issue persists, you might need to regenerate your certificates and keys to ensure they meet the required format specifications.
Sources
Troubleshooting self-managed Apache Kafka event source mapping errors - AWS Lambda
Invoking Lambda with events from other AWS services - AWS Lambda