Choosing an approach When to use Secrets Manager Using the Amazon parameters and secrets Lambda extension Using the parameters utility from Powertools for Amazon Lambda

Use Secrets Manager secrets in Lambda functions

Amazon Secrets Manager helps you manage credentials, API keys, and other secrets that your Lambda functions need. You have two main approaches for retrieving secrets in your Lambda functions, both offering better performance and lower costs compared to retrieving secrets directly using the Amazon SDK:

Amazon parameters and secrets Lambda extension - A runtime-agnostic solution that provides a simple HTTP interface for retrieving secrets
Powertools for Amazon Lambda parameters utility - A code-integrated solution that supports multiple providers (Secrets Manager, Parameter Store, AppConfig) with built-in transformations

Both approaches maintain local caches of secrets, eliminating the need for your function to call Secrets Manager for every invocation. When your function requests a secret, the cache is checked first. If the secret is available and hasn't expired, it's returned immediately. Otherwise, it's retrieved from Secrets Manager, cached, and returned. This caching mechanism results in faster response times and reduced costs by minimizing API calls.

Choosing an approach

Consider these factors when choosing between the extension and PowerTools:

Use the Amazon parameters and secrets Lambda extension when:

You want a runtime-agnostic solution that works with any Lambda runtime
You prefer not to add code dependencies to your function
You only need to retrieve secrets from Secrets Manager or Parameter Store

Use Powertools for Amazon Lambda parameters utility when:

You want an integrated development experience with your application code
You need support for multiple providers (Secrets Manager, Parameter Store, AppConfig)
You want built-in data transformations (JSON parsing, base64 decoding)
You're using Python, TypeScript, Java, or .NET runtimes

When to use Secrets Manager with Lambda

Common scenarios for using Secrets Manager with Lambda include:

Storing database credentials that your function uses to connect to Amazon RDS or other databases
Managing API keys for external services your function calls
Storing encryption keys or other sensitive configuration data
Rotating credentials automatically without needing to update your function code

Using the Amazon parameters and secrets Lambda extension

The Amazon parameters and secrets Lambda extension uses a simple HTTP interface compatible with any Lambda runtime. By default, it caches secrets for 300 seconds (5 minutes) and can hold up to 1,000 secrets. You can customize these settings with environment variables.

Use Secrets Manager in a Lambda function

This section assumes that you already have a Secrets Manager secret. To create a secret, see Create an Amazon Secrets Manager secret.

Choose your preferred runtime and follow the steps to create a function that retrieves secrets from Secrets Manager. The example function retrieves a secret from Secrets Manager and can be used to access database credentials, API keys, or other sensitive configuration data in your applications.

Python

To create a Python function

Create and navigate to a new project directory. Example:
```
mkdir my_function
cd my_function
```

Create a file named lambda_function.py with the following code. For secret_name, use the name or Amazon Resource Name (ARN) of your secret.


import json
import os
import requests

def lambda_handler(event, context):
    try:
        # Replace with the name or ARN of your secret
        secret_name = "arn:aws-cn:secretsmanager:us-east-1:111122223333:secret:SECRET_NAME"
        
        secrets_extension_endpoint = f"http://localhost:2773/secretsmanager/get?secretId={secret_name}"
        headers = {"X-Aws-Parameters-Secrets-Token": os.environ.get('AWS_SESSION_TOKEN')}
        
        response = requests.get(secrets_extension_endpoint, headers=headers)
        print(f"Response status code: {response.status_code}")
        
        secret = json.loads(response.text)["SecretString"]
        print(f"Retrieved secret: {secret}")
        
        return {
            'statusCode': response.status_code,
            'body': json.dumps({
                'message': 'Successfully retrieved secret',
                'secretRetrieved': True
            })
        }
    
    except Exception as e:
        print(f"Error: {str(e)}")
        return {
            'statusCode': 500,
            'body': json.dumps({
                'message': 'Error retrieving secret',
                'error': str(e)
            })
        }

Create a file named requirements.txt with this content:
```
requests
```
Install the dependencies:
```
pip install -r requirements.txt -t .
```
Create a .zip file containing all files:
```
zip -r function.zip .
```

Node.js

To create a Node.js function

Create and navigate to a new project directory. Example:
```
mkdir my_function
cd my_function
```

Create a file named index.mjs with the following code. For secret_name, use the name or Amazon Resource Name (ARN) of your secret.


import http from 'http';

export const handler = async (event) => {
    try {
        // Replace with the name or ARN of your secret
        const secretName = "arn:aws-cn:secretsmanager:us-east-1:111122223333:secret:SECRET_NAME";
        const options = {
            hostname: 'localhost',
            port: 2773,
            path: `/secretsmanager/get?secretId=${secretName}`,
            headers: {
                'X-Aws-Parameters-Secrets-Token': process.env.AWS_SESSION_TOKEN
            }
        };

        const response = await new Promise((resolve, reject) => {
            http.get(options, (res) => {
                let data = '';
                res.on('data', (chunk) => { data += chunk; });
                res.on('end', () => {
                    resolve({ 
                        statusCode: res.statusCode, 
                        body: data 
                    });
                });
            }).on('error', reject);
        });

        const secret = JSON.parse(response.body).SecretString;
        console.log('Retrieved secret:', secret);

        return {
            statusCode: response.statusCode,
            body: JSON.stringify({
                message: 'Successfully retrieved secret',
                secretRetrieved: true
            })
        };
    } catch (error) {
        console.error('Error:', error);
        return {
            statusCode: 500,
            body: JSON.stringify({
                message: 'Error retrieving secret',
                error: error.message
            })
        };
    }
};

Create a .zip file containing the index.mjs file:
```
zip -r function.zip index.mjs
```

Java

To create a Java function

Create a Maven project:


mvn archetype:generate \
    -DgroupId=example \
    -DartifactId=lambda-secrets-demo \
    -DarchetypeArtifactId=maven-archetype-quickstart \
    -DarchetypeVersion=1.4 \
    -DinteractiveMode=false

Navigate to the project directory:
```
cd lambda-secrets-demo
```

Open the pom.xml and replace the contents with the following:


<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>example</groupId>
    <artifactId>lambda-secrets-demo</artifactId>
    <version>1.0-SNAPSHOT</version>

    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
    </properties>

    <dependencies>
        <dependency>
            <groupId>com.amazonaws</groupId>
            <artifactId>aws-lambda-java-core</artifactId>
            <version>1.2.1</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-shade-plugin</artifactId>
                <version>3.2.4</version>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>shade</goal>
                        </goals>
                        <configuration>
                            <createDependencyReducedPom>false</createDependencyReducedPom>
                            <finalName>function</finalName>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
</project>

Rename the /lambda-secrets-demo/src/main/java/example/App.java to Hello.java to match Lambda's default Java handler name (example.Hello::handleRequest):
```
mv src/main/java/example/App.java src/main/java/example/Hello.java
```

Open the Hello.java file and replace its contents with the following. For secretName, use the name or Amazon Resource Name (ARN) of your secret.


package example;

import com.amazonaws.services.lambda.runtime.Context;
import com.amazonaws.services.lambda.runtime.RequestHandler;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Hello implements RequestHandler<Object, String> {
    private final HttpClient client = HttpClient.newHttpClient();

    @Override
    public String handleRequest(Object input, Context context) {
        try {
            // Replace with the name or ARN of your secret
            String secretName = "arn:aws-cn:secretsmanager:us-east-1:111122223333:secret:SECRET_NAME";
            String endpoint = "http://localhost:2773/secretsmanager/get?secretId=" + secretName;

            HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create(endpoint))
                .header("X-Aws-Parameters-Secrets-Token", System.getenv("AWS_SESSION_TOKEN"))
                .GET()
                .build();

            HttpResponse<String> response = client.send(request, 
                HttpResponse.BodyHandlers.ofString());

            String secret = response.body();
            secret = secret.substring(secret.indexOf("SecretString") + 15);
            secret = secret.substring(0, secret.indexOf("\""));

            System.out.println("Retrieved secret: " + secret);
            return String.format(
                "{\"statusCode\": %d, \"body\": \"%s\"}",
                response.statusCode(), "Successfully retrieved secret"
            );

        } catch (Exception e) {
            e.printStackTrace();
            return String.format(
                "{\"body\": \"Error retrieving secret: %s\"}", 
                e.getMessage()
            );
        }
    }
}

Remove the test directory. Maven creates this by default, but we don't need it for this example.
```
rm -rf src/test
```
Build the project:
```
mvn package
```
Download the JAR file (target/function.jar) for later use.

Open the Functions page of the Lambda console.
Choose Create function.
Select Author from scratch.
For Function name, enter secret-retrieval-demo.
Choose your preferred Runtime.
Choose Create function.

To upload the deployment package

In the function's Code tab, choose Upload from and select .zip file (for Python and Node.js) or .jar file (for Java).
Upload the deployment package you created earlier.
Choose Save.

To add the Amazon Parameters and Secrets Lambda extension as a layer

In the function's Code tab, scroll down to Layers.
Choose Add a layer.
Select Amazon layers.
Choose Amazon-Parameters-and-Secrets-Lambda-Extension.
Select the latest version.
Choose Add.

To add Secrets Manager permissions to your execution role

Choose the Configuration tab, and then choose Permissions.
Under Role name, choose the link to your execution role. This link opens the role in the IAM console.
Choose Add permissions, and then choose Create inline policy.

Choose the JSON tab and add the following policy. For Resource, enter the ARN of your secret.

Choose Next.
Enter a name for the policy.
Choose Create policy.

To test the function

Return to the Lambda console.
Select the Test tab.
Choose Test. You should see the following response:

Environment variables

The Amazon Parameters and Secrets Lambda extension uses the following default settings. You can override these settings by creating the corresponding environment variables. To view the current settings for a function, set PARAMETERS_SECRETS_EXTENSION_LOG_LEVEL to DEBUG. The extension will log its configuration information to CloudWatch Logs at the start of each function invocation.

Setting	Default value	Valid values	Environment variable	Details
HTTP port	2773	1 - 65535	PARAMETERS_SECRETS_EXTENSION_HTTP_PORT	Port for the local HTTP server
Cache enabled	TRUE	TRUE \| FALSE	PARAMETERS_SECRETS_EXTENSION_CACHE_ENABLED	Enable or disable the cache
Cache size	1000	0 - 1000	PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE	Set to 0 to disable caching
Secrets Manager TTL	300 seconds	0 - 300 seconds	SECRETS_MANAGER_TTL	Time-to-live for cached secrets. Set to 0 to disable caching. This variable is ignored if the value for PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE is 0.
Parameter Store TTL	300 seconds	0 - 300 seconds	SSM_PARAMETER_STORE_TTL	Time-to-live for cached parameters. Set to 0 to disable caching. This variable is ignored if the value for PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE is 0.
Log level	INFO	DEBUG \| INFO \| WARN \| ERROR \| NONE	PARAMETERS_SECRETS_EXTENSION_LOG_LEVEL	The level of detail reported in logs for the extension
Max connections	3	1 or greater	PARAMETERS_SECRETS_EXTENSION_MAX_CONNECTIONS	Maximum number of HTTP connections for requests to Parameter Store or Secrets Manager
Secrets Manager timeout	0 (no timeout)	All whole numbers	SECRETS_MANAGER_TIMEOUT_MILLIS	Timeout for requests to Secrets Manager (in milliseconds)
Parameter Store timeout	0 (no timeout)	All whole numbers	SSM_PARAMETER_STORE_TIMEOUT_MILLIS	Timeout for requests to Parameter Store (in milliseconds)

Working with secret rotation

If you rotate secrets frequently, the default 300-second cache duration might cause your function to use outdated secrets. You have two options to ensure your function uses the latest secret value:

Reduce the cache TTL by setting the SECRETS_MANAGER_TTL environment variable to a lower value (in seconds). For example, setting it to 60 ensures your function will never use a secret that's more than one minute old.
Use the AWSCURRENT or AWSPREVIOUS staging labels in your secret request to ensure you get the specific version you want:
```
secretsmanager/get?secretId=YOUR_SECRET_NAME&versionStage=AWSCURRENT
```

Choose the approach that best balances your needs for performance and freshness. A lower TTL means more frequent calls to Secrets Manager but ensures you're working with the most recent secret values.

Using the parameters utility from Powertools for Amazon Lambda

The parameters utility from Powertools for Amazon Lambda provides a unified interface for retrieving secrets from multiple providers including Secrets Manager, parameter store, and AppConfig. It handles caching, transformations, and provides a more integrated development experience compared to the extension approach.

Benefits of the parameters utility

Multiple providers - Retrieve parameters from Secrets Manager, Parameter Store, and AppConfig using the same interface
Built-in transformations - Automatic JSON parsing, base64 decoding, and other data transformations
Integrated caching - Configurable caching with TTL support to reduce API calls
Type safety - Strong typing support in TypeScript and other supported runtimes
Error handling - Built-in retry logic and error handling

Code examples

The following examples show how to retrieve secrets using the Parameters utility in different runtimes:

Python

Note

For complete examples and setup instructions, see the Parameters utility documentation.

Retrieving secrets from Secrets Manager with Powertools for Amazon Lambda Parameters utility.


from aws_lambda_powertools import Logger
from aws_lambda_powertools.utilities import parameters

logger = Logger()

def lambda_handler(event, context):
    try:
        # Get secret with caching (default TTL: 5 seconds)
        secret_value = parameters.get_secret("my-secret-name")
        
        # Get secret with custom TTL
        secret_with_ttl = parameters.get_secret("my-secret-name", max_age=300)
        
        # Get secret and transform JSON
        secret_json = parameters.get_secret("my-json-secret", transform="json")
        
        logger.info("Successfully retrieved secrets")
        
        return {
            'statusCode': 200,
            'body': 'Successfully retrieved secrets'
        }
        
    except Exception as e:
        logger.error(f"Error retrieving secret: {str(e)}")
        return {
            'statusCode': 500,
            'body': f'Error: {str(e)}'
        }

TypeScript

Note

For complete examples and setup instructions, see the Parameters utility documentation.

Retrieving secrets from Secrets Manager with Powertools for Amazon Lambda Parameters utility.


import { Logger } from '@aws-lambda-powertools/logger';
import { getSecret } from '@aws-lambda-powertools/parameters/secrets';
import type { Context } from 'aws-lambda';

const logger = new Logger();

export const handler = async (event: any, context: Context) => {
    try {
        // Get secret with caching (default TTL: 5 seconds)
        const secretValue = await getSecret('my-secret-name');
        
        // Get secret with custom TTL
        const secretWithTtl = await getSecret('my-secret-name', { maxAge: 300 });
        
        // Get secret and transform JSON
        const secretJson = await getSecret('my-json-secret', { transform: 'json' });
        
        logger.info('Successfully retrieved secrets');
        
        return {
            statusCode: 200,
            body: 'Successfully retrieved secrets'
        };
        
    } catch (error) {
        logger.error('Error retrieving secret', { error });
        return {
            statusCode: 500,
            body: `Error: ${error}`
        };
    }
};

Java

Note

For complete examples and setup instructions, see the Parameters utility documentation.

Retrieving secrets from Secrets Manager with Powertools for Amazon Lambda Parameters utility.


import software.amazon.lambda.powertools.logging.Logging;
import software.amazon.lambda.powertools.parameters.SecretsProvider;
import software.amazon.lambda.powertools.parameters.ParamManager;
import com.amazonaws.services.lambda.runtime.Context;
import com.amazonaws.services.lambda.runtime.RequestHandler;

public class SecretHandler implements RequestHandler<Object, String> {
    
    private final SecretsProvider secretsProvider = ParamManager.getSecretsProvider();
    
    @Logging
    @Override
    public String handleRequest(Object input, Context context) {
        try {
            // Get secret with caching (default TTL: 5 seconds)
            String secretValue = secretsProvider.get("my-secret-name");
            
            // Get secret with custom TTL (300 seconds)
            String secretWithTtl = secretsProvider.withMaxAge(300).get("my-secret-name");
            
            // Get secret and transform JSON
            MySecret secretJson = secretsProvider.get("my-json-secret", MySecret.class);
            
            return "Successfully retrieved secrets";
            
        } catch (Exception e) {
            return "Error retrieving secret: " + e.getMessage();
        }
    }
    
    public static class MySecret {
        // Define your secret structure here
    }
}

.NET

Note

For complete examples and setup instructions, see the Parameters utility documentation.

Retrieving secrets from Secrets Manager with Powertools for Amazon Lambda Parameters utility.


using AWS.Lambda.Powertools.Logging;
using AWS.Lambda.Powertools.Parameters;
using Amazon.Lambda.Core;

[assembly: LambdaSerializer(typeof(Amazon.Lambda.Serialization.SystemTextJson.DefaultLambdaJsonSerializer))]

public class Function
{
    private readonly ISecretsProvider _secretsProvider;
    
    public Function()
    {
        _secretsProvider = ParametersManager.SecretsProvider;
    }
    
    [Logging]
    public async Task<string> FunctionHandler(object input, ILambdaContext context)
    {
        try
        {
            // Get secret with caching (default TTL: 5 seconds)
            var secretValue = await _secretsProvider.GetAsync("my-secret-name");
            
            // Get secret with custom TTL
            var secretWithTtl = await _secretsProvider.WithMaxAge(TimeSpan.FromMinutes(5))
                .GetAsync("my-secret-name");
            
            // Get secret and transform JSON
            var secretJson = await _secretsProvider.GetAsync<MySecret>("my-json-secret");
            
            return "Successfully retrieved secrets";
        }
        catch (Exception e)
        {
            return $"Error retrieving secret: {e.Message}";
        }
    }
    
    public class MySecret
    {
        // Define your secret structure here
    }
}

Setup and permissions

To use the Parameters utility, you need to:

Install Powertools for Amazon Lambda for your runtime. For details, see Powertools for Amazon Lambda.
Add the necessary IAM permissions to your function's execution role. Refer to Managing permissions in Amazon Lambda for details.
Configure any optional settings through environment variables.

The required IAM permissions are the same as for the extension approach. The utility will automatically handle caching and API calls to Secrets Manager based on your configuration.

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Tutorial: Use an Amazon S3 trigger to create thumbnails

SQS