允许 lambda 权限访问 secretsmanager 值答案

【问题标题】：Allow lambda permission to access secretsmanager value允许 lambda 权限访问 secretsmanager 值
【发布时间】：2022-01-04 13:27:13
【问题描述】：

我正在使用 Terraform 部署需要在 AWS SecretsManager 中保存机密的 lambda。

我有以下缩写的 lambda：

Lambda


resource "aws_lambda_function" "thisThing" {
  function_name = "functionName"
  runtime = "python3.8"
  handler = "thisThing.handler"

  role = aws_iam_role.lambda_exec.arn
}

resource "aws_iam_role" "lambda_exec" {
  name = "serverless_lambda"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Sid    = ""
      Principal = {
        Service = "lambda.amazonaws.com"
      }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "lambda_policy" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

这里有秘密

秘密

# Secrets

resource "aws_secretsmanager_secret" "SECRET" {
  name = "SECRET"
  recovery_window_in_days = 0
}

resource "aws_secretsmanager_secret_version" "SECRET" {
  secret_id     = "${aws_secretsmanager_secret.SECRET.id}"
  secret_string = "${var.SECRET}"
}

我得到的错误是：

[ERROR] ClientError: An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:sts::439791110569:assumed-role/serverless_lambda/thisThing is not authorized to perform: secretsmanager:GetSecretValue on resource: SECRET because no identity-based policy allows the secretsmanager:GetSecretValue action

这是我第一次使用秘密管理器，我在 AWS 方面不是很有经验，但我认为基于答案 here，我需要添加一个策略，允许我的 lambda exec 角色拥有 @987654322 @权利。我已经做了一些尝试，但我对如何查找不同的策略 ARN 缺乏了解，这让我很失望。

这是我尝试添加的内容（这是错误的，我知道这是错误的。）

resource "aws_iam_role_policy_attachment" "lambda_secretsmanager_role" {
  role = aws_iam_role.lambda_exec.name
  # ? policy_arn = "arn:aws:iam::aws:policy/SecretsManagerGetSecretValue"
}

这不是正确的 ARN，但我不确定在哪里可以找到正确的 ARN。

【问题讨论】：

标签： amazon-web-services aws-lambda terraform terraform-provider-aws

【解决方案1】：

您可以使用aws_iam_role_policy添加权限：

resource "aws_iam_role_policy" "sm_policy" {
  name = "sm_access_permissions"
  role = aws_iam_role.lambda_exec.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "secretsmanager:GetSecretValue",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

如果您想遵循最低权限，那么您可以将Resource = "*" 更改为Resource = "<arn-of-the-secret>"。

【讨论】：