Skip to content

Commit 4a3903f

Browse files
colifrancolifran
authored
feat(lambda): provide support for AWS Parameters and Secrets Extension for Lambda (#25928)
This PR provides support for the AWS Parameters and Secrets Extension for Lambda functions. This extension will allow users to retrieve and cache AWS Secrets Manager secrets and AWS Parameter Store parameters in Lambda functions without using an SDK. Note: Previous PR results in the go build breaking. This removed the circular dependency causing the go build to break: ``` [jsii-pacmak] [INFO] Found 1 modules to package [jsii-pacmak] [INFO] Packaging NPM bundles [jsii-pacmak] [INFO] Loading jsii assemblies and translations [jsii-pacmak] [INFO] Packaging 'go' for aws-cdk-lib [jsii-pacmak] [INFO] go finished [jsii-pacmak] [INFO] Packaged. go (54.9s) | npm pack (5.4s) | load jsii (0.5s) | cleanup (0.0s) ``` Closes #23187 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 0006aa7 commit 4a3903f

File tree

22 files changed

+3209
-0
lines changed

22 files changed

+3209
-0
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.params-and-secrets.js.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "32.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "IntegTestDefaultTestDeployAssertE3E7D2A4.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.params-and-secrets.js.snapshot/IntegTestDefaultTestDeployAssertE3E7D2A4.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.params-and-secrets.js.snapshot/Stack1.assets.json

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"version": "32.0.0",
3+
"files": {
4+
"b375dfd7699947c404936c2d1c4a0b91bd2bb49158ce52f6064bda6d3a7e0ead": {
5+
"source": {
6+
"path": "asset.b375dfd7699947c404936c2d1c4a0b91bd2bb49158ce52f6064bda6d3a7e0ead",
7+
"packaging": "zip"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "b375dfd7699947c404936c2d1c4a0b91bd2bb49158ce52f6064bda6d3a7e0ead.zip",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
},
17+
"64fb6d6ac3e1f7cda4cb6336b78f1be8f0e1f6c6323b232c8e04430a803085a2": {
18+
"source": {
19+
"path": "Stack1.template.json",
20+
"packaging": "file"
21+
},
22+
"destinations": {
23+
"current_account-current_region": {
24+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25+
"objectKey": "64fb6d6ac3e1f7cda4cb6336b78f1be8f0e1f6c6323b232c8e04430a803085a2.json",
26+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
27+
}
28+
}
29+
}
30+
},
31+
"dockerImages": {}
32+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.params-and-secrets.js.snapshot/Stack1.template.json

+287
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,287 @@
1+
{
2+
"Resources": {
3+
"Parameter9E1B4FBA": {
4+
"Type": "AWS::SSM::Parameter",
5+
"Properties": {
6+
"Type": "String",
7+
"Value": "api.example.com",
8+
"Name": "email_url_Stack1"
9+
}
10+
},
11+
"MySecret8FE80B51": {
12+
"Type": "AWS::SecretsManager::Secret",
13+
"Properties": {
14+
"GenerateSecretString": {}
15+
},
16+
"UpdateReplacePolicy": "Delete",
17+
"DeletionPolicy": "Delete"
18+
},
19+
"MyFuncServiceRole54065130": {
20+
"Type": "AWS::IAM::Role",
21+
"Properties": {
22+
"AssumeRolePolicyDocument": {
23+
"Statement": [
24+
{
25+
"Action": "sts:AssumeRole",
26+
"Effect": "Allow",
27+
"Principal": {
28+
"Service": "lambda.amazonaws.com"
29+
}
30+
}
31+
],
32+
"Version": "2012-10-17"
33+
},
34+
"ManagedPolicyArns": [
35+
{
36+
"Fn::Join": [
37+
"",
38+
[
39+
"arn:",
40+
{
41+
"Ref": "AWS::Partition"
42+
},
43+
":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
44+
]
45+
]
46+
}
47+
]
48+
}
49+
},
50+
"MyFuncServiceRoleDefaultPolicyF3C36699": {
51+
"Type": "AWS::IAM::Policy",
52+
"Properties": {
53+
"PolicyDocument": {
54+
"Statement": [
55+
{
56+
"Action": [
57+
"secretsmanager:DescribeSecret",
58+
"secretsmanager:GetSecretValue"
59+
],
60+
"Effect": "Allow",
61+
"Resource": {
62+
"Ref": "MySecret8FE80B51"
63+
}
64+
},
65+
{
66+
"Action": [
67+
"ssm:DescribeParameters",
68+
"ssm:GetParameter",
69+
"ssm:GetParameterHistory",
70+
"ssm:GetParameters"
71+
],
72+
"Effect": "Allow",
73+
"Resource": {
74+
"Fn::Join": [
75+
"",
76+
[
77+
"arn:",
78+
{
79+
"Ref": "AWS::Partition"
80+
},
81+
":ssm:",
82+
{
83+
"Ref": "AWS::Region"
84+
},
85+
":",
86+
{
87+
"Ref": "AWS::AccountId"
88+
},
89+
":parameter/",
90+
{
91+
"Ref": "Parameter9E1B4FBA"
92+
}
93+
]
94+
]
95+
}
96+
}
97+
],
98+
"Version": "2012-10-17"
99+
},
100+
"PolicyName": "MyFuncServiceRoleDefaultPolicyF3C36699",
101+
"Roles": [
102+
{
103+
"Ref": "MyFuncServiceRole54065130"
104+
}
105+
]
106+
}
107+
},
108+
"MyFunc8A243A2C": {
109+
"Type": "AWS::Lambda::Function",
110+
"Properties": {
111+
"Code": {
112+
"S3Bucket": {
113+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
114+
},
115+
"S3Key": "b375dfd7699947c404936c2d1c4a0b91bd2bb49158ce52f6064bda6d3a7e0ead.zip"
116+
},
117+
"Role": {
118+
"Fn::GetAtt": [
119+
"MyFuncServiceRole54065130",
120+
"Arn"
121+
]
122+
},
123+
"Architectures": [
124+
"x86_64"
125+
],
126+
"Environment": {
127+
"Variables": {
128+
"PARAMETERS_AND_SECRETS_EXTENSION_CACHE_ENABLED": "true",
129+
"PARAMETERS_AND_SECRETS_EXTENSION_CACHE_SIZE": "100",
130+
"PARAMETERS_AND_SECRETS_EXTENSION_HTTP_PORT": "2773",
131+
"PARAMETERS_AND_SECRETS_EXTENSION_LOG_LEVEL": "info",
132+
"PARAMETERS_AND_SECRETS_EXTENSION_MAX_CONNECTIONS": "3",
133+
"SECRETS_MANAGER_TIMEOUT_MILLIS": "0",
134+
"SECRETS_MANAGER_TTL": "100",
135+
"SSM_PARAMETER_STORE_TIMEOUT_MILLIS": "0",
136+
"SSM_PARAMETER_STORE_TTL": "100"
137+
}
138+
},
139+
"Handler": "index.handler",
140+
"Layers": [
141+
{
142+
"Fn::FindInMap": [
143+
"ParamsandsecretslayerMap",
144+
{
145+
"Ref": "AWS::Region"
146+
},
147+
"1x0x103xx86x64"
148+
]
149+
}
150+
],
151+
"Runtime": "nodejs18.x"
152+
},
153+
"DependsOn": [
154+
"MyFuncServiceRoleDefaultPolicyF3C36699",
155+
"MyFuncServiceRole54065130"
156+
]
157+
}
158+
},
159+
"Mappings": {
160+
"ParamsandsecretslayerMap": {
161+
"af-south-1": {
162+
"1x0x103xx86x64": "arn:aws:lambda:af-south-1:317013901791:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
163+
},
164+
"ap-east-1": {
165+
"1x0x103xx86x64": "arn:aws:lambda:ap-east-1:768336418462:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
166+
},
167+
"ap-northeast-1": {
168+
"1x0x103xx86x64": "arn:aws:lambda:ap-northeast-1:133490724326:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
169+
},
170+
"ap-northeast-2": {
171+
"1x0x103xx86x64": "arn:aws:lambda:ap-northeast-2:738900069198:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
172+
},
173+
"ap-northeast-3": {
174+
"1x0x103xx86x64": "arn:aws:lambda:ap-northeast-3:576959938190:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
175+
},
176+
"ap-south-1": {
177+
"1x0x103xx86x64": "arn:aws:lambda:ap-south-1:176022468876:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
178+
},
179+
"ap-south-2": {
180+
"1x0x103xx86x64": "arn:aws:lambda:ap-south-2:070087711984:layer:AWS-Parameters-and-Secrets-Lambda-Extension:1"
181+
},
182+
"ap-southeast-1": {
183+
"1x0x103xx86x64": "arn:aws:lambda:ap-southeast-1:044395824272:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
184+
},
185+
"ap-southeast-2": {
186+
"1x0x103xx86x64": "arn:aws:lambda:ap-southeast-2:665172237481:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
187+
},
188+
"ap-southeast-3": {
189+
"1x0x103xx86x64": "arn:aws:lambda:ap-southeast-3:490737872127:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
190+
},
191+
"ca-central-1": {
192+
"1x0x103xx86x64": "arn:aws:lambda:ca-central-1:200266452380:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
193+
},
194+
"cn-north-1": {
195+
"1x0x103xx86x64": "arn:aws-cn:lambda:cn-north-1:287114880934:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
196+
},
197+
"cn-northwest-1": {
198+
"1x0x103xx86x64": "arn:aws-cn:lambda:cn-northwest-1:287310001119:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
199+
},
200+
"eu-central-1": {
201+
"1x0x103xx86x64": "arn:aws:lambda:eu-central-1:187925254637:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
202+
},
203+
"eu-central-2": {
204+
"1x0x103xx86x64": "arn:aws:lambda:eu-central-2:772501565639:layer:AWS-Parameters-and-Secrets-Lambda-Extension:1"
205+
},
206+
"eu-north-1": {
207+
"1x0x103xx86x64": "arn:aws:lambda:eu-north-1:427196147048:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
208+
},
209+
"eu-south-1": {
210+
"1x0x103xx86x64": "arn:aws:lambda:eu-south-1:325218067255:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
211+
},
212+
"eu-south-2": {
213+
"1x0x103xx86x64": "arn:aws:lambda:eu-south-2:524103009944:layer:AWS-Parameters-and-Secrets-Lambda-Extension:1"
214+
},
215+
"eu-west-1": {
216+
"1x0x103xx86x64": "arn:aws:lambda:eu-west-1:015030872274:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
217+
},
218+
"eu-west-2": {
219+
"1x0x103xx86x64": "arn:aws:lambda:eu-west-2:133256977650:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
220+
},
221+
"eu-west-3": {
222+
"1x0x103xx86x64": "arn:aws:lambda:eu-west-3:780235371811:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
223+
},
224+
"me-central-1": {
225+
"1x0x103xx86x64": "arn:aws:lambda:me-central-1:858974508948:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
226+
},
227+
"me-south-1": {
228+
"1x0x103xx86x64": "arn:aws:lambda:me-south-1:832021897121:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
229+
},
230+
"sa-east-1": {
231+
"1x0x103xx86x64": "arn:aws:lambda:sa-east-1:933737806257:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
232+
},
233+
"us-east-1": {
234+
"1x0x103xx86x64": "arn:aws:lambda:us-east-1:177933569100:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
235+
},
236+
"us-east-2": {
237+
"1x0x103xx86x64": "arn:aws:lambda:us-east-2:590474943231:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
238+
},
239+
"us-gov-east-1": {
240+
"1x0x103xx86x64": "arn:aws-us-gov:lambda:us-gov-east-1:129776340158:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
241+
},
242+
"us-gov-west-1": {
243+
"1x0x103xx86x64": "arn:aws-us-gov:lambda:us-gov-west-1:127562683043:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
244+
},
245+
"us-west-1": {
246+
"1x0x103xx86x64": "arn:aws:lambda:us-west-1:997803712105:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
247+
},
248+
"us-west-2": {
249+
"1x0x103xx86x64": "arn:aws:lambda:us-west-2:345057560386:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4"
250+
}
251+
}
252+
},
253+
"Parameters": {
254+
"BootstrapVersion": {
255+
"Type": "AWS::SSM::Parameter::Value<String>",
256+
"Default": "/cdk-bootstrap/hnb659fds/version",
257+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
258+
}
259+
},
260+
"Rules": {
261+
"CheckBootstrapVersion": {
262+
"Assertions": [
263+
{
264+
"Assert": {
265+
"Fn::Not": [
266+
{
267+
"Fn::Contains": [
268+
[
269+
"1",
270+
"2",
271+
"3",
272+
"4",
273+
"5"
274+
],
275+
{
276+
"Ref": "BootstrapVersion"
277+
}
278+
]
279+
}
280+
]
281+
},
282+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
283+
}
284+
]
285+
}
286+
}
287+
}

0 commit comments

Comments
 (0)