在 Lambda 函数中从 AWS Secrets Manager 检索密钥

如何解决在 Lambda 函数中从 AWS Secrets Manager 检索密钥

我一直在尝试在 AWS 的 lambda 函数中使用 Secret Manager。

我正在使用 Secret Manager 来存储我的 Redshift 凭证，并希望使用 AWS Secret Manager 提供的示例代码通过 lambda 函数检索密钥。

我在 secret manager 中设置了一个 Secret，其中包含我的 redshift 凭据（用户名、密码）

我正在尝试设置一个可以从 Secret Manger 获取秘密的 lambda 函数：以下是示例代码：

import boto3
import base64
from botocore.exceptions import ClientError


def lambda_handler(event,context):
    
    def get_secret():
        secret_name = "test/MySecret"
        region_name = "eu-west-2"

    # Create a Secrets Manager client
    session = boto3.session.Session()
    client = session.client(
        service_name='secretsmanager',region_name=region_name
    )
    
    try:
        get_secret_value_response = client.get_secret_value(
            SecretId = secret_name
        )
    except ClientError as e:
        if e.response['Error']['Code'] == 'DecryptionFailureException':
            # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
            # Deal with the exception here,and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InternalServiceErrorException':
            # An error occurred on the server side.
            # Deal with the exception here,and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidParameterException':
            # You provided an invalid value for a parameter.
            # Deal with the exception here,and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidRequestException':
            # You provided a parameter value that is not valid for the current state of the resource.
            # Deal with the exception here,and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'ResourceNotFoundException':
            # We can't find the resource that you asked for.
            # Deal with the exception here,and/or rethrow at your discretion.
            raise e
    else:
        # Decrypts secret using the associated KMS CMK.
        # Depending on whether the secret is a string or binary,one of these fields will be populated.
        if 'SecretString' in get_secret_value_response:
            secret = get_secret_value_response['SecretString']
        else:
            decoded_binary_secret = base64.b64decode(get_secret_value_response['SecretBinary'])

我在运行 lambda 函数时遇到以下错误：

{
  "errorMessage": "name 'secret_name' is not defined","errorType": "NameError","stackTrace": [
    "  File \"/var/task/lambda_function.py\",line 22,in lambda_handler\n    SecretId = secret_name\n"
  ]
}

我已经在 lambda 函数的开头定义了 secret_name，但我收到了 secret_name' is not defined 错误。我如何解决问题的任何建议

解决方法

所以问题是python无法获取secret_name变量的值，原因是它在一个函数下

def get_secret():
    secret_name = "test/MySecret"
    region_name = "eu-west-2"

所以如果你只是使用 secret_name = "test/MySecret" 没有函数部分，示例代码应该可以工作