将 AWS Secrets Manager 与 Python 结合使用（Lambda 控制台）

Question

我正在尝试在 AWS 中使用 Secrets Manager a Lambda function。 秘密管理器用于将数据库凭据存储到雪花（用户名、密码）。

我设法在 Secrets Manager 中设置了一个秘密，其中包含几个键/值对（例如，一个用于用户名，另一个用于密码）。

现在我试图在我的 Python function 代码中引用这些值。 AWS 文档提供了以下代码段：

import boto3
import base64
from botocore.exceptions import ClientError


def get_secret():

    secret_name = "MY/SECRET/NAME"
    region_name = "us-west-2"

    # Create a Secrets Manager client
    session = boto3.session.Session()
    client = session.client(
        service_name='secretsmanager',
        region_name=region_name
    )

    # In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
    # See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
    # We rethrow the exception by default.

    try:
        get_secret_value_response = client.get_secret_value(
            SecretId=secret_name
        )
    except ClientError as e:
        if e.response['Error']['Code'] == 'DecryptionFailureException':
            # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InternalServiceErrorException':
            # An error occurred on the server side.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidParameterException':
            # You provided an invalid value for a parameter.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidRequestException':
            # You provided a parameter value that is not valid for the current state of the resource.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'ResourceNotFoundException':
            # We can't find the resource that you asked for.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
    else:
        # Decrypts secret using the associated KMS CMK.
        # Depending on whether the secret is a string or binary, one of these fields will be populated.
        if 'SecretString' in get_secret_value_response:
            secret = get_secret_value_response['SecretString']
        else:
            decoded_binary_secret = base64.b64decode(get_secret_value_response['SecretBinary'])

    # Your code goes here.

稍后在我的def lambda_handler(event, context) function 中，我有以下片段来建立与我的数据库的连接：

        conn = snowflake.connector.connect(
            user=USERNAME,
            password=PASSWORD,
            account=ACCOUNT,
            warehouse=WAREHOUSE,
            role=ROLE
            )

但是，我无法弄清楚如何使用get_secret() function 来返回USERNAME或PASSWORD等参数的值。

如何实现？ 感谢您的帮助！

Answer 1

将 get_secret() 的最后一部分更新为：

else:
        # Decrypts secret using the associated KMS CMK.
        # Depending on whether the secret is a string or binary, one of these fields will be populated.
        if 'SecretString' in get_secret_value_response:
            secret = get_secret_value_response['SecretString']
        else:
            secret = base64.b64decode(get_secret_value_response['SecretBinary'])

return json.loads(secret)  # returns the secret as dictionary

这将返回一个字典，其中包含您在 AWS Secret Manager 控制台中指定的密钥。

Answer 2

• 这是我使用arn的方式，希望对您有所帮助。
• 值得检查您用来存储的内容并相应地使用一个SecretString或SecretBinary

    secrets_client = boto3.client('secretsmanager')
    secret_arn = 'arn:aws:secretsmanager:eu-west-2:xxxxxxxxxxxx:secret:dashboard/auth_token'
    auth_token = secrets_client.get_secret_value(SecretId=secret_arn).get('SecretString')

• boto3 文档
• get_secret_value从指定的密钥版本中检索加密字段SecretString或SecretBinary的内容，以包含内容者为准。
• 您的 lambda 角色应具有以下权限，具体取决于所使用的权限
  • secretsmanager:GetSecretValue
  • kms:Decrypt 。 您不需要此权限即可将账户的默认 AWS 托管 CMK 用于 Secrets Manager。

Answer 3

嗨@Prashanth kumar，你的意思是这样的：def get_secret()：

secret_name = "MySecretForRedshift"
region_name = "us-east-1"

# Create a Secrets Manager client
session = boto3.session.Session()
client = session.client(
    service_name='secretsmanager',
    region_name=region_name
)

# In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
# See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
# We rethrow the exception by default.

try:
    get_secret_value_response = client.get_secret_value(
        SecretId=secret_name
    )
except ClientError as e:
    if e.response['Error']['Code'] == 'DecryptionFailureException':
        # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
    elif e.response['Error']['Code'] == 'InternalServiceErrorException':
        # An error occurred on the server side.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
    elif e.response['Error']['Code'] == 'InvalidParameterException':
        # You provided an invalid value for a parameter.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
    elif e.response['Error']['Code'] == 'InvalidRequestException':
        # You provided a parameter value that is not valid for the current state of the resource.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
    elif e.response['Error']['Code'] == 'ResourceNotFoundException':
        # We can't find the resource that you asked for.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
else:
    # Decrypts secret using the associated KMS CMK.
    # Depending on whether the secret is a string or binary, one of these fields will be populated.
    if 'SecretString' in get_secret_value_response:
        secret = json.loads(get_secret_value_response['SecretString'])
    else:
        secret = json.loads(base64.b64decode(get_secret_value_response['SecretBinary']))
return secret

Answer 4

我创建了一个名为 pysecret 的开源库，这里是 AWS Secret Manager 集成的文档： https://github.com/MacHu-GWU/pysecret-project#aws-key-management-service-and-secret-manager-integration

我可以引导您完成最简单的方法：

1. 手动将您的秘密值放入 json 或使用pysecret创建一个。

from pysecret import AWSSecret

aws_profile = "my_aws_profile"
aws = AWSSecret(profile_name=aws_profile)

secret_id = "my-example-secret"
secret_data = {
    "host": "www.example.com",
    "port": 1234,
    "database": "mydatabase",
    "username": "admin",
    "password": "mypassword",
    "metadata": {
        "creator": "Alice"
    }
}
aws.deploy_secret(name=secret_id, secret_data=secret_data) # or you can pass kms_key_id if you created a custom kms key

然后您应该能够在您的 aws 控制台中看到已创建的密钥。

2. 在 lambda function 或任何 python 代码中读取您的秘密值。

aws = AWSSecret(profile_name=aws_profile) # in lambda code, don't need ``profile_name=aws_profile``
password = aws.get_secret_value(secret_id="my-example-secret", key="password") # mypassword
creator = aws.get_secret_value(secret_id="my-example-secret", key="metadata.creator") # Alice

注意，Lambda Function IAM 角色要求访问密钥

1. 您的 Lambda IAM 角色必须具有 Secret Manager 读取权限。 aws 内置策略 arn:aws:iam::aws:policy/SecretsManagerReadWrite 具有读写功能，如果你很懒，可以使用它。 但我建议您创建一个只有读取权限的自定义策略。
2. 如果您为您的秘密使用自动生成的 kms 密钥，则必须使用aws kms create-grant命令来授予 Lambda Function IAM 角色以访问 kms 密钥以进行加密，以下是 Z5E056C500A1C4B6A7110B50A1C4B6A7110B5ADE 的方法Z5E056C500A1C4B6A7110B5ADE /cli/latest/reference/kms/create-grant.html
3. 如果您使用自定义 kms 密钥，您应该能够在您的 aws 控制台中编辑您的 kms 密钥的用户 select Lambda Function IAM 角色。

希望这能回答你的问题。

如果这有帮助，请给我的项目https://github.com/MacHu-GWU/pysecret-project 加注星标。

Answer 5

AWS 为一些受支持的数据库引擎提供了一些模板，例如 MySQL 等，请查看此模板：

对于不受支持的数据库，请检查此

上面提供的模板将为您提供自定义 function 的示例。