- 最新
- 最多得票
- 最多評論
Hello.
I think it is possible to rotate the access token by modifying the rotation Lambda function yourself and getting the access token from Lambda to the external service.
For this purpose, AWS has created a Lambda function that can be used as a reference for rotation.
I think you can edit this code to suit your needs.
https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#OTHER_rotation_templates
I think the structure on page 21 of the PDF below is close to your purpose.
https://d1.awsstatic.com/events/Summits/reinvent2022/SEC325-R_Beyond-database-password-management-5-use-cases-for-AWS-Secrets-Manager.pdf
The code for the rotation Lambda function introduced in the blog below will be helpful.
https://medium.com/@larhdid/fortify-your-apps-security-save-and-rotate-tokens-with-aws-secret-manager-and-lambda-e3f7a99c01e0
But the access token doesn't go from the Lambda to the external service in this scenario, that's the problem. I don't see how to use the four step workflow Secrets uses for rotation when the external service itself provides the new access token.
I've looked at https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html#OTHER_rotation_templates, and if you look at the actual Lambda function code linked to from that section, it is still expecting the secret to be generated by code you control and then sent to the external service.
https://d1.awsstatic.com/events/Summits/reinvent2022/SEC325-R_Beyond-database-password-management-5-use-cases-for-AWS-Secrets-Manager.pdf is indeed the structure I want, but it doesn't actually provide specifics of how to do it in the four step workflow Secrets uses for rotation.
https://medium.com/@larhdid/fortify-your-apps-security-save-and-rotate-tokens-with-aws-secret-manager-and-lambda-e3f7a99c01e0 does not actually use AWS Secrets Manager Rotation by Lambda function at all, the access token update is simply triggered by a schedule.