Lambda Secrets Management
Environment variables are encrypted at rest with KMS but are visible to anyone with lambda:GetFunctionConfiguration and are baked in at deploy time — wrong for credentials. Fetch secrets at Init from Secrets Manager or SSM Parameter Store (the execution role grants read access) and cache them in a global, using the provided extension or a TTL to pick up rotation.
This Concept is waiting for its first lesson!
Environment variables are encrypted at rest with KMS but are visible to anyone with lambda:GetFunctionConfiguration and are baked in at deploy time — wrong for credentials. Fetch secrets at Init from Secrets Manager or SSM Parameter Store (the execution role grants read access) and cache them in a global, using the provided extension or a TTL to pick up rotation.
Are you a teacher? Sign in to start contributing.
Sign In