feature: Resolve environment variables with values of the Secrets Manager about lambroll HOT 6 CLOSED

Hi.

I suggest to use handlename/ssmwrap for the workaround.

ssmwrap can look up values in the SSM parameter store and run a specified command with environment variables that are set by these values.

$ ssmwrap --names /path/to/foo -- sh -c 'echo $FOO'
value of foo

And SecretManager's secrets can be read via SSM parameter store with the prefix '/aws/reference/secretsmanager'.

So, by these methods, you can run lambroll with environment variables from SecretsManager.

$ ssmwrap --names /aws/reference/secretsmanager/mysecret -- lambroll ...

function.json

{
  "Environment": {
    "Variables": {
      "MYSECRET": "{{ must_env `MYSECRET` }}"
    }
  },
  // ...
}

But, this solution is complex a little.

I'm planning to introduce ssm template function, the same as ecspresso.
https://github.com/kayac/ecspresso#ssm

from lambroll.

@miztch But, I don't recommend setting secrets into Lambda environment variables directly.

Secrets are exposed as plain text if someone can read the lambda function configuration.

If you try this method, please consider that risk.

from lambroll.

Thank you for your immediate reply! I will try the workaround you suggested.

Also, I am already aware of the security risks you pointed out. Thanks for this one as well.
I will also tell my application engineer to eventually modify the code to get it in the function code, as I do not think it is appropriate to include plain text values in environment variables.

from lambroll.

Thank you for the other day.

In my project, I found it difficult to retrieve the secret value using ssmwrap because the secret value was not just a value, but a key/value pair. So I solved this issue by implementing a little custom script.

Therefore I am willing to let you close this issue.

Since we are considering managing these secret values with SSM, there may be an opportunity to use the SSM plugin you implemented in #319. Thanks again for listening to my voice 🙏

from lambroll.