Use Secrets Manager secrets in Lambda functions

Create and navigate to a new project directory. Example:

mkdir my_function
cd my_function

Create a file named lambda_function.py with the following code. For secret_name, use the name or Amazon Resource Name (ARN) of your secret.

import json
import os
import requests
def lambda_handler(event, context):
 try:
 # Replace with the name or ARN of your secret
 secret_name = "arn:aws:secretsmanager:us-east-1:111122223333:secret:SECRET_NAME"
 
 secrets_extension_endpoint = f"http://localhost:2773/secretsmanager/get?secretId={secret_name}"
 headers = {"X-Aws-Parameters-Secrets-Token": os.environ.get('AWS_SESSION_TOKEN')}
 
 response = requests.get(secrets_extension_endpoint, headers=headers)
 print(f"Response status code: {response.status_code}")
 
 secret = json.loads(response.text)["SecretString"]
 print(f"Retrieved secret: {secret}")
 
 return {
 'statusCode': response.status_code,
 'body': json.dumps({
 'message': 'Successfully retrieved secret',
 'secretRetrieved': True
 })
 }
 
 except Exception as e:
 print(f"Error: {str(e)}")
 return {
 'statusCode': 500,
 'body': json.dumps({
 'message': 'Error retrieving secret',
 'error': str(e)
 })
 }

Create a file named requirements.txt with this content:

requests

Install the dependencies:

pip install -r requirements.txt -t .

Create a .zip file containing all files:

zip -r function.zip .

Create and navigate to a new project directory. Example:

mkdir my_function
cd my_function

Create a file named index.mjs with the following code. For secret_name, use the name or Amazon Resource Name (ARN) of your secret.

import http from 'http';
export const handler = async (event) => {
 try {
 // Replace with the name or ARN of your secret
 const secretName = "arn:aws:secretsmanager:us-east-1:111122223333:secret:SECRET_NAME";
 const options = {
 hostname: 'localhost',
 port: 2773,
 path: `/secretsmanager/get?secretId=${secretName}`,
 headers: {
 'X-Aws-Parameters-Secrets-Token': process.env.AWS_SESSION_TOKEN
 }
 };
 const response = await new Promise((resolve, reject) => {
 http.get(options, (res) => {
 let data = '';
 res.on('data', (chunk) => { data += chunk; });
 res.on('end', () => {
 resolve({ 
 statusCode: res.statusCode, 
 body: data 
 });
 });
 }).on('error', reject);
 });
 const secret = JSON.parse(response.body).SecretString;
 console.log('Retrieved secret:', secret);
 return {
 statusCode: response.statusCode,
 body: JSON.stringify({
 message: 'Successfully retrieved secret',
 secretRetrieved: true
 })
 };
 } catch (error) {
 console.error('Error:', error);
 return {
 statusCode: 500,
 body: JSON.stringify({
 message: 'Error retrieving secret',
 error: error.message
 })
 };
 }
};

Create a .zip file containing the index.mjs file:

zip -r function.zip index.mjs

Create a Maven project:

mvn archetype:generate \
 -DgroupId=example \
 -DartifactId=lambda-secrets-demo \
 -DarchetypeArtifactId=maven-archetype-quickstart \
 -DarchetypeVersion=1.4 \
 -DinteractiveMode=false

Navigate to the project directory:

cd lambda-secrets-demo

Open the pom.xml and replace the contents with the following:

<project xmlns="http://maven.apache.org/POM/4.0.0"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 <modelVersion>4.0.0</modelVersion>
 <groupId>example</groupId>
 <artifactId>lambda-secrets-demo</artifactId>
 <version>1.0-SNAPSHOT</version>
 <properties>
 <maven.compiler.source>11</maven.compiler.source>
 <maven.compiler.target>11</maven.compiler.target>
 </properties>
 <dependencies>
 <dependency>
 <groupId>com.amazonaws</groupId>
 <artifactId>aws-lambda-java-core</artifactId>
 <version>1.2.1</version>
 </dependency>
 </dependencies>
 <build>
 <plugins>
 <plugin>
 <groupId>org.apache.maven.plugins</groupId>
 <artifactId>maven-shade-plugin</artifactId>
 <version>3.2.4</version>
 <executions>
 <execution>
 <phase>package</phase>
 <goals>
 <goal>shade</goal>
 </goals>
 <configuration>
 <createDependencyReducedPom>false</createDependencyReducedPom>
 <finalName>function</finalName>
 </configuration>
 </execution>
 </executions>
 </plugin>
 </plugins>
 </build>
</project>

Rename the /lambda-secrets-demo/src/main/java/example/App.java to Hello.java to match Lambda's default Java handler name (example.Hello::handleRequest):

mv src/main/java/example/App.java src/main/java/example/Hello.java

Open the Hello.java file and replace its contents with the following. For secretName, use the name or Amazon Resource Name (ARN) of your secret.

package example;
import com.amazonaws.services.lambda.runtime.Context;
import com.amazonaws.services.lambda.runtime.RequestHandler;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Hello implements RequestHandler<Object, String> {
 private final HttpClient client = HttpClient.newHttpClient();
 @Override
 public String handleRequest(Object input, Context context) {
 try {
 // Replace with the name or ARN of your secret
 String secretName = "arn:aws:secretsmanager:us-east-1:111122223333:secret:SECRET_NAME";
 String endpoint = "http://localhost:2773/secretsmanager/get?secretId=" + secretName;
 HttpRequest request = HttpRequest.newBuilder()
 .uri(URI.create(endpoint))
 .header("X-Aws-Parameters-Secrets-Token", System.getenv("AWS_SESSION_TOKEN"))
 .GET()
 .build();
 HttpResponse<String> response = client.send(request, 
 HttpResponse.BodyHandlers.ofString());
 String secret = response.body();
 secret = secret.substring(secret.indexOf("SecretString") + 15);
 secret = secret.substring(0, secret.indexOf("\""));
 System.out.println("Retrieved secret: " + secret);
 return String.format(
 "{\"statusCode\": %d, \"body\": \"%s\"}",
 response.statusCode(), "Successfully retrieved secret"
 );
 } catch (Exception e) {
 e.printStackTrace();
 return String.format(
 "{\"body\": \"Error retrieving secret: %s\"}", 
 e.getMessage()
 );
 }
 }
}

Remove the test directory. Maven creates this by default, but we don't need it for this example.

rm -rf src/test

Build the project:

mvn package

Download the JAR file (target/function.jar) for later use.