將 AWS Secrets Manager 與 Python 結合使用（Lambda 控制台）

Question

我正在嘗試在 AWS 中使用 Secrets Manager a Lambda function。 秘密管理器用於將數據庫憑據存儲到雪花（用戶名、密碼）。

我設法在 Secrets Manager 中設置了一個秘密，其中包含幾個鍵/值對（例如，一個用於用戶名，另一個用於密碼）。

現在我試圖在我的 Python function 代碼中引用這些值。 AWS 文檔提供了以下代碼段：

import boto3
import base64
from botocore.exceptions import ClientError


def get_secret():

    secret_name = "MY/SECRET/NAME"
    region_name = "us-west-2"

    # Create a Secrets Manager client
    session = boto3.session.Session()
    client = session.client(
        service_name='secretsmanager',
        region_name=region_name
    )

    # In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
    # See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
    # We rethrow the exception by default.

    try:
        get_secret_value_response = client.get_secret_value(
            SecretId=secret_name
        )
    except ClientError as e:
        if e.response['Error']['Code'] == 'DecryptionFailureException':
            # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InternalServiceErrorException':
            # An error occurred on the server side.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidParameterException':
            # You provided an invalid value for a parameter.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidRequestException':
            # You provided a parameter value that is not valid for the current state of the resource.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'ResourceNotFoundException':
            # We can't find the resource that you asked for.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
    else:
        # Decrypts secret using the associated KMS CMK.
        # Depending on whether the secret is a string or binary, one of these fields will be populated.
        if 'SecretString' in get_secret_value_response:
            secret = get_secret_value_response['SecretString']
        else:
            decoded_binary_secret = base64.b64decode(get_secret_value_response['SecretBinary'])

    # Your code goes here.

稍后在我的def lambda_handler(event, context) function 中，我有以下片段來建立與我的數據庫的連接：

        conn = snowflake.connector.connect(
            user=USERNAME,
            password=PASSWORD,
            account=ACCOUNT,
            warehouse=WAREHOUSE,
            role=ROLE
            )

但是，我無法弄清楚如何使用get_secret() function 來返回USERNAME或PASSWORD等參數的值。

如何實現？ 感謝您的幫助！

Answer 1

將 get_secret() 的最后一部分更新為：

else:
        # Decrypts secret using the associated KMS CMK.
        # Depending on whether the secret is a string or binary, one of these fields will be populated.
        if 'SecretString' in get_secret_value_response:
            secret = get_secret_value_response['SecretString']
        else:
            secret = base64.b64decode(get_secret_value_response['SecretBinary'])

return json.loads(secret)  # returns the secret as dictionary

這將返回一個字典，其中包含您在 AWS Secret Manager 控制台中指定的密鑰。

Answer 2

• 這是我使用arn的方式，希望對您有所幫助。
• 值得檢查您用來存儲的內容並相應地使用一個SecretString或SecretBinary

    secrets_client = boto3.client('secretsmanager')
    secret_arn = 'arn:aws:secretsmanager:eu-west-2:xxxxxxxxxxxx:secret:dashboard/auth_token'
    auth_token = secrets_client.get_secret_value(SecretId=secret_arn).get('SecretString')

• boto3 文檔
• get_secret_value從指定的密鑰版本中檢索加密字段SecretString或SecretBinary的內容，以包含內容者為准。
• 您的 lambda 角色應具有以下權限，具體取決於所使用的權限
  • secretsmanager:GetSecretValue
  • kms:Decrypt 。 您不需要此權限即可將賬戶的默認 AWS 托管 CMK 用於 Secrets Manager。

Answer 3

嗨@Prashanth kumar，你的意思是這樣的：def get_secret()：

secret_name = "MySecretForRedshift"
region_name = "us-east-1"

# Create a Secrets Manager client
session = boto3.session.Session()
client = session.client(
    service_name='secretsmanager',
    region_name=region_name
)

# In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
# See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
# We rethrow the exception by default.

try:
    get_secret_value_response = client.get_secret_value(
        SecretId=secret_name
    )
except ClientError as e:
    if e.response['Error']['Code'] == 'DecryptionFailureException':
        # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
    elif e.response['Error']['Code'] == 'InternalServiceErrorException':
        # An error occurred on the server side.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
    elif e.response['Error']['Code'] == 'InvalidParameterException':
        # You provided an invalid value for a parameter.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
    elif e.response['Error']['Code'] == 'InvalidRequestException':
        # You provided a parameter value that is not valid for the current state of the resource.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
    elif e.response['Error']['Code'] == 'ResourceNotFoundException':
        # We can't find the resource that you asked for.
        # Deal with the exception here, and/or rethrow at your discretion.
        raise e
else:
    # Decrypts secret using the associated KMS CMK.
    # Depending on whether the secret is a string or binary, one of these fields will be populated.
    if 'SecretString' in get_secret_value_response:
        secret = json.loads(get_secret_value_response['SecretString'])
    else:
        secret = json.loads(base64.b64decode(get_secret_value_response['SecretBinary']))
return secret

Answer 4

我創建了一個名為 pysecret 的開源庫，這里是 AWS Secret Manager 集成的文檔： https://github.com/MacHu-GWU/pysecret-project#aws-key-management-service-and-secret-manager-integration

我可以引導您完成最簡單的方法：

1. 手動將您的秘密值放入 json 或使用pysecret創建一個。

from pysecret import AWSSecret

aws_profile = "my_aws_profile"
aws = AWSSecret(profile_name=aws_profile)

secret_id = "my-example-secret"
secret_data = {
    "host": "www.example.com",
    "port": 1234,
    "database": "mydatabase",
    "username": "admin",
    "password": "mypassword",
    "metadata": {
        "creator": "Alice"
    }
}
aws.deploy_secret(name=secret_id, secret_data=secret_data) # or you can pass kms_key_id if you created a custom kms key

然后您應該能夠在您的 aws 控制台中看到已創建的密鑰。

2. 在 lambda function 或任何 python 代碼中讀取您的秘密值。

aws = AWSSecret(profile_name=aws_profile) # in lambda code, don't need ``profile_name=aws_profile``
password = aws.get_secret_value(secret_id="my-example-secret", key="password") # mypassword
creator = aws.get_secret_value(secret_id="my-example-secret", key="metadata.creator") # Alice

注意，Lambda Function IAM 角色要求訪問密鑰

1. 您的 Lambda IAM 角色必須具有 Secret Manager 讀取權限。 aws 內置策略 arn:aws:iam::aws:policy/SecretsManagerReadWrite 具有讀寫功能，如果你很懶，可以使用它。 但我建議您創建一個只有讀取權限的自定義策略。
2. 如果您為您的秘密使用自動生成的 kms 密鑰，則必須使用aws kms create-grant命令來授予 Lambda Function IAM 角色以訪問 kms 密鑰以進行加密，以下是 Z5E056C500A1C4B6A7110B50A1C4B6A7110B5ADE 的方法Z5E056C500A1C4B6A7110B5ADE /cli/latest/reference/kms/create-grant.html
3. 如果您使用自定義 kms 密鑰，您應該能夠在您的 aws 控制台中編輯您的 kms 密鑰的用戶 select Lambda Function IAM 角色。

希望這能回答你的問題。

如果這有幫助，請給我的項目https://github.com/MacHu-GWU/pysecret-project 加注星標。

Answer 5

AWS 為一些受支持的數據庫引擎提供了一些模板，例如 MySQL 等，請查看此模板：

對於不受支持的數據庫，請檢查此

上面提供的模板將為您提供自定義 function 的示例。