AWS Lambda Secrets Manager Example: 2 Ways to Grant Access | Resource Permissions YouTube Tutorial
1. Create Secret in AWS Secrets Manager Create SLACK_BOT_TOKEN secret with random value Give it a name prod/slack-bot/token-v3 2. Create IAM User with Full Access Create admin user and place it in Admin IAM group Configure aws cli aws configure 3. Create IAM Role for AWS Lambda Create IAM Policy AWSLambdaSecretsAccess { "Version" : " 2012-10-17" "Statement" : [ { "Effect" : " Allow" "Action" : " logs:CreateLogGroup" "Resource" : " arn:aws:logs:us-east-1:424432388155:*" "Effect" : " Allow" "Action" : [ " logs:CreateLogStream" " logs:PutLogEvents" "Resource" : " arn:aws:logs:us-east-1:424432388155:log-group:/aws/lambda/secret-access:*" Create secret-access-role IAM Role 4. Create AWS Lambda Function Create secret-access folder Run npm init Install aws-sdk npm i aws-sdk Create app.js Create Dockerfile 5. Deploy Lambda Using Container Image Create ECR secret-access Build and push image aws ecr get-login-password --region us-east-1 | \ docker login --username AWS \ --password-stdin 424432388155.dkr.ecr.us-east-1.amazonaws.com docker build -t 424432388155.dkr.ecr.us-east-1.amazonaws.com/secret-access:v0.1.0 . docker push 424432388155.dkr.ecr.us-east-1.amazonaws.com/secret-access:v0.1.0 Deploy lambda Test with curl (fail) 6. Grant Access for IAM Role { "Effect" : " Allow" "Action" : " secretsmanager:GetSecretValue" "Resource" : " arn:aws:secretsmanager:us-east-1:424432388155:secret:prod/slack-bot/token-v3-<id>" 7. Create Resource-based Policy for Secret { "Version" : " 2012-10-17" "Statement" : [ { "Effect" : " Allow" "Principal" : { "AWS" : " arn:aws:sts::424432388155:assumed-role/secret-access-role/secret-access" "Action" : " secretsmanager:GetSecretValue" "Resource" : " arn:aws:secretsmanager:us-east-1:424432388155:secret:prod/slack-bot/token-v3-<id>" Delete admin IAM user Delete ECR secret-access Delete secret-access-role IAM Role Delete AWSLambdaSecretsAccess IAM Policy Delete secret-access lambda Delete secret-access-API API gateway Delete CloudWatch logs Delete secrets Resource-based policies AWS JSON policy elements: Principal