Do we need Lambda extensions for accessing AWS Secrets Manager ?

0

Do we need Lambda extensions for accessing AWS Secrets Manager ? I explored Vault, Lambda provides vault extensions, which can optimize the secrets fetching - https://www.hashicorp.com/blog/aws-lambda-extensions-for-hashicorp-vault

The extension can retrieve multiple secrets from Vault, if configured to do so, and writes the full JSON response from HashiCorp Vault to the configured destination. Before a Lambda function is invoked, extensions are initialized and given the opportunity to perform tasks before signaling their readiness

Do we need similar setup in AWS Secrets Manager ? Or Fetching secrets from AWS Secret Manager already optimised for Lambda ?

已提問 2 年前檢視次數 1055 次
3 個答案
0

In order to access secrets manager you only need to define the security policy in your lambda and it should then be able to access it from your code.

More info here

已回答 2 年前
  • I understand, will it cause any performance issues while getting the secrets for every invocation ? I see that the Lambda extensions for vault does some work before lambda gets initialised.

0

You do not need a Lambda extension to retrieve a secret from AWS Secrets Manager in a serverless workload. You should retrieve the secret as a global variable, not in the handler, to maximize performance. To learn more, see https://aws.amazon.com/blogs/networking-and-content-delivery/securing-and-accessing-secrets-from-lambdaedge-using-aws-secrets-manager.

已回答 2 年前
0

This link -https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/cache-secrets-using-aws-lambda-extensions.html provides a way to run local host to cache the secrets.

This setup is not necessary at all the times. Accessing Secrets Manager from Lambda can be done via the boto3 API, but the pattern above is considered best practice as it prevent cold start, increase speed of retrieval and keep the costs for Secrets Manager access low (in cases where you expect a lot of invocations).

已回答 2 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南