Borislav Hadzhiev
Tue Sep 28 2021·3 min read
Photo by Anthony Tran
In order to grant a Lambda function access to Secrets Manager, we have to
attach an IAM policy to the function's execution role. The policy should grant
permissions for all the Actions
the function needs to perform on the
secrets.
For example, the following policy grants permissions for the most commonly used secrets manager actions on a specific secret.
YOUR_SECRET_ARN
placeholder in the Resource
element with the secret's ARN.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource" ], "Resource": [ "YOUR_SECRET_ARN" ] } ] }
secretsmanager:GetSecretValue
action.The actions your lambda function needs to perform on the secrets are use case specific.
You could set "secretsmanager:*"
for the Action
element in the policy to
grant full secrets manager access to the lambda function. However, it's best
practice to grant an entity the least permissions that get the job done.
You can view a full list of the secrets manager Actions
in the
Secrets Manager Actions table.
There is a Description
column, which explains what each action does.
To attach a policy to the lambda function's execution role, you have to:
Configuration
tab and then click Permissions
Add permissions
and then click Create inline policy
JSON
editor paste the following policy.YOUR_SECRET_ARN
placeholder and adjust the Actions
your lambda function needs to execute.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:ListSecretVersionIds", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:TagResource", "secretsmanager:UntagResource" ], "Resource": [ "YOUR_SECRET_ARN" ] } ] }
Review Policy
and give your policy a name, then click Create policy
At this point the lambda function's role has been extended with a policy that grants access to some secrets manager actions on a specific secret.
Invoke your lambda function and verify whether it has access to the secret.
If your function is still unable to access the Secrets manager secret, try to
increase the function's timeout
by a second in the AWS console or simply add
an extra print
statement in the code and click the Deploy
button.
If your lambda function still does not have access to the secret, expand the IAM policy you added to the function's role and edit it to look like the policy below.
YOUR_SECRET_ARN
placeholder with secret's ARN.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:*" ], "Resource": [ "YOUR_SECRET_ARN" ] } ] }
The IAM policy above grants full access to a specific secret. Your lambda function will be able to execute all Secrets Manager actions on the secret.
*
symbol is useful when debugging.After you've updated the policy, try to invoke your lambda function again, it should have permissions to execute any action on the secret.
After you verify which actions your lambda needs to run, you can make the IAM policy less permissive.
Deny
effect will always override any Allow
statements.