Use Secrets Manager secrets in Lambda functions
Amazon Secrets Manager helps you manage credentials, API keys, and other secrets that your Lambda functions need. You have two main approaches for retrieving secrets in your Lambda functions, both offering better performance and lower costs compared to retrieving secrets directly using the Amazon SDK:
-
Amazon parameters and secrets Lambda extension - A runtime-agnostic solution that provides a simple HTTP interface for retrieving secrets
-
Powertools for Amazon Lambda parameters utility - A code-integrated solution that supports multiple providers (Secrets Manager, Parameter Store, AppConfig) with built-in transformations
Both approaches maintain local caches of secrets, eliminating the need for your function to call Secrets Manager for every invocation. When your function requests a secret, the cache is checked first. If the secret is available and hasn't expired, it's returned immediately. Otherwise, it's retrieved from Secrets Manager, cached, and returned. This caching mechanism results in faster response times and reduced costs by minimizing API calls.
Choosing an approach
Consider these factors when choosing between the extension and PowerTools:
- Use the Amazon parameters and secrets Lambda extension when:
-
You want a runtime-agnostic solution that works with any Lambda runtime
You prefer not to add code dependencies to your function
You only need to retrieve secrets from Secrets Manager or Parameter Store
- Use Powertools for Amazon Lambda parameters utility when:
-
You want an integrated development experience with your application code
You need support for multiple providers (Secrets Manager, Parameter Store, AppConfig)
You want built-in data transformations (JSON parsing, base64 decoding)
You're using Python, TypeScript, Java, or .NET runtimes
When to use Secrets Manager with Lambda
Common scenarios for using Secrets Manager with Lambda include:
-
Storing database credentials that your function uses to connect to Amazon RDS or other databases
-
Managing API keys for external services your function calls
-
Storing encryption keys or other sensitive configuration data
-
Rotating credentials automatically without needing to update your function code
Using the Amazon parameters and secrets Lambda extension
The Amazon parameters and secrets Lambda extension uses a simple HTTP interface compatible with any Lambda runtime. By default, it caches secrets for 300 seconds (5 minutes) and can hold up to 1,000 secrets. You can customize these settings with environment variables.
Use Secrets Manager in a Lambda function
This section assumes that you already have a Secrets Manager secret. To create a secret, see Create an Amazon Secrets Manager secret.
Choose your preferred runtime and follow the steps to create a function that retrieves secrets from Secrets Manager. The example function retrieves a secret from Secrets Manager and can be used to access database credentials, API keys, or other sensitive configuration data in your applications.
Open the Functions page
of the Lambda console. -
Choose Create function.
-
Select Author from scratch.
-
For Function name, enter
secret-retrieval-demo
. -
Choose your preferred Runtime.
-
Choose Create function.
To upload the deployment package
-
In the function's Code tab, choose Upload from and select .zip file (for Python and Node.js) or .jar file (for Java).
-
Upload the deployment package you created earlier.
-
Choose Save.
To add the Amazon Parameters and Secrets Lambda extension as a layer
-
In the function's Code tab, scroll down to Layers.
-
Choose Add a layer.
-
Select Amazon layers.
-
Choose Amazon-Parameters-and-Secrets-Lambda-Extension.
-
Select the latest version.
-
Choose Add.
To add Secrets Manager permissions to your execution role
-
Choose the Configuration tab, and then choose Permissions.
-
Under Role name, choose the link to your execution role. This link opens the role in the IAM console.
-
Choose Add permissions, and then choose Create inline policy.
-
Choose the JSON tab and add the following policy. For
Resource
, enter the ARN of your secret. -
Choose Next.
-
Enter a name for the policy.
-
Choose Create policy.
To test the function
-
Return to the Lambda console.
-
Select the Test tab.
-
Choose Test. You should see the following response:
Environment variables
The Amazon Parameters and Secrets Lambda extension uses the following default settings. You can override these settings by creating the corresponding environment variables. To view the current settings for a function, set PARAMETERS_SECRETS_EXTENSION_LOG_LEVEL
to DEBUG
. The extension will log its configuration information to CloudWatch Logs at the start of each function invocation.
Setting | Default value | Valid values | Environment variable | Details |
---|---|---|---|---|
HTTP port | 2773 | 1 - 65535 | PARAMETERS_SECRETS_EXTENSION_HTTP_PORT | Port for the local HTTP server |
Cache enabled | TRUE | TRUE | FALSE | PARAMETERS_SECRETS_EXTENSION_CACHE_ENABLED | Enable or disable the cache |
Cache size | 1000 | 0 - 1000 | PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE | Set to 0 to disable caching |
Secrets Manager TTL | 300 seconds | 0 - 300 seconds | SECRETS_MANAGER_TTL | Time-to-live for cached secrets. Set to 0 to disable caching. This variable is ignored if the value for PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE is 0. |
Parameter Store TTL | 300 seconds | 0 - 300 seconds | SSM_PARAMETER_STORE_TTL | Time-to-live for cached parameters. Set to 0 to disable caching. This variable is ignored if the value for PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE is 0. |
Log level | INFO | DEBUG | INFO | WARN | ERROR | NONE | PARAMETERS_SECRETS_EXTENSION_LOG_LEVEL | The level of detail reported in logs for the extension |
Max connections | 3 | 1 or greater | PARAMETERS_SECRETS_EXTENSION_MAX_CONNECTIONS | Maximum number of HTTP connections for requests to Parameter Store or Secrets Manager |
Secrets Manager timeout | 0 (no timeout) | All whole numbers | SECRETS_MANAGER_TIMEOUT_MILLIS | Timeout for requests to Secrets Manager (in milliseconds) |
Parameter Store timeout | 0 (no timeout) | All whole numbers | SSM_PARAMETER_STORE_TIMEOUT_MILLIS | Timeout for requests to Parameter Store (in milliseconds) |
Working with secret rotation
If you rotate secrets frequently, the default 300-second cache duration might cause your function to use outdated secrets. You have two options to ensure your function uses the latest secret value:
-
Reduce the cache TTL by setting the
SECRETS_MANAGER_TTL
environment variable to a lower value (in seconds). For example, setting it to60
ensures your function will never use a secret that's more than one minute old. -
Use the
AWSCURRENT
orAWSPREVIOUS
staging labels in your secret request to ensure you get the specific version you want:secretsmanager/get?secretId=YOUR_SECRET_NAME&versionStage=AWSCURRENT
Choose the approach that best balances your needs for performance and freshness. A lower TTL means more frequent calls to Secrets Manager but ensures you're working with the most recent secret values.
Using the parameters utility from Powertools for Amazon Lambda
The parameters utility from Powertools for Amazon Lambda provides a unified interface for retrieving secrets from multiple providers including Secrets Manager, parameter store, and AppConfig. It handles caching, transformations, and provides a more integrated development experience compared to the extension approach.
Benefits of the parameters utility
Multiple providers - Retrieve parameters from Secrets Manager, Parameter Store, and AppConfig using the same interface
Built-in transformations - Automatic JSON parsing, base64 decoding, and other data transformations
Integrated caching - Configurable caching with TTL support to reduce API calls
Type safety - Strong typing support in TypeScript and other supported runtimes
Error handling - Built-in retry logic and error handling
Code examples
The following examples show how to retrieve secrets using the Parameters utility in different runtimes:
- Python
-
Note
For complete examples and setup instructions, see the Parameters utility documentation
. Retrieving secrets from Secrets Manager with Powertools for Amazon Lambda Parameters utility.
from aws_lambda_powertools import Logger from aws_lambda_powertools.utilities import parameters logger = Logger() def lambda_handler(event, context): try: # Get secret with caching (default TTL: 5 seconds) secret_value = parameters.get_secret("my-secret-name") # Get secret with custom TTL secret_with_ttl = parameters.get_secret("my-secret-name", max_age=300) # Get secret and transform JSON secret_json = parameters.get_secret("my-json-secret", transform="json") logger.info("Successfully retrieved secrets") return { 'statusCode': 200, 'body': 'Successfully retrieved secrets' } except Exception as e: logger.error(f"Error retrieving secret: {str(e)}") return { 'statusCode': 500, 'body': f'Error: {str(e)}' }
- TypeScript
-
Note
For complete examples and setup instructions, see the Parameters utility documentation
. Retrieving secrets from Secrets Manager with Powertools for Amazon Lambda Parameters utility.
import { Logger } from '@aws-lambda-powertools/logger'; import { getSecret } from '@aws-lambda-powertools/parameters/secrets'; import type { Context } from 'aws-lambda'; const logger = new Logger(); export const handler = async (event: any, context: Context) => { try { // Get secret with caching (default TTL: 5 seconds) const secretValue = await getSecret('my-secret-name'); // Get secret with custom TTL const secretWithTtl = await getSecret('my-secret-name', { maxAge: 300 }); // Get secret and transform JSON const secretJson = await getSecret('my-json-secret', { transform: 'json' }); logger.info('Successfully retrieved secrets'); return { statusCode: 200, body: 'Successfully retrieved secrets' }; } catch (error) { logger.error('Error retrieving secret', { error }); return { statusCode: 500, body: `Error: ${error}` }; } };
- Java
-
Note
For complete examples and setup instructions, see the Parameters utility documentation
. Retrieving secrets from Secrets Manager with Powertools for Amazon Lambda Parameters utility.
import software.amazon.lambda.powertools.logging.Logging; import software.amazon.lambda.powertools.parameters.SecretsProvider; import software.amazon.lambda.powertools.parameters.ParamManager; import com.amazonaws.services.lambda.runtime.Context; import com.amazonaws.services.lambda.runtime.RequestHandler; public class SecretHandler implements RequestHandler<Object, String> { private final SecretsProvider secretsProvider = ParamManager.getSecretsProvider(); @Logging @Override public String handleRequest(Object input, Context context) { try { // Get secret with caching (default TTL: 5 seconds) String secretValue = secretsProvider.get("my-secret-name"); // Get secret with custom TTL (300 seconds) String secretWithTtl = secretsProvider.withMaxAge(300).get("my-secret-name"); // Get secret and transform JSON MySecret secretJson = secretsProvider.get("my-json-secret", MySecret.class); return "Successfully retrieved secrets"; } catch (Exception e) { return "Error retrieving secret: " + e.getMessage(); } } public static class MySecret { // Define your secret structure here } }
- .NET
-
Note
For complete examples and setup instructions, see the Parameters utility documentation
. Retrieving secrets from Secrets Manager with Powertools for Amazon Lambda Parameters utility.
using AWS.Lambda.Powertools.Logging; using AWS.Lambda.Powertools.Parameters; using Amazon.Lambda.Core; [assembly: LambdaSerializer(typeof(Amazon.Lambda.Serialization.SystemTextJson.DefaultLambdaJsonSerializer))] public class Function { private readonly ISecretsProvider _secretsProvider; public Function() { _secretsProvider = ParametersManager.SecretsProvider; } [Logging] public async Task<string> FunctionHandler(object input, ILambdaContext context) { try { // Get secret with caching (default TTL: 5 seconds) var secretValue = await _secretsProvider.GetAsync("my-secret-name"); // Get secret with custom TTL var secretWithTtl = await _secretsProvider.WithMaxAge(TimeSpan.FromMinutes(5)) .GetAsync("my-secret-name"); // Get secret and transform JSON var secretJson = await _secretsProvider.GetAsync<MySecret>("my-json-secret"); return "Successfully retrieved secrets"; } catch (Exception e) { return $"Error retrieving secret: {e.Message}"; } } public class MySecret { // Define your secret structure here } }
Setup and permissions
To use the Parameters utility, you need to:
Install Powertools for Amazon Lambda for your runtime. For details, see Powertools for Amazon Lambda.
Add the necessary IAM permissions to your function's execution role. Refer to Managing permissions in Amazon Lambda for details.
Configure any optional settings through environment variables.
The required IAM permissions are the same as for the extension approach. The utility will automatically handle caching and API calls to Secrets Manager based on your configuration.