本地调用sam模板时解决secretsmanager

如何解决本地调用sam模板时解决secretsmanager

我正在尝试使用 sam local invoke 在本地调用 lambda。该函数调用正常，但我的秘密的环境变量无法解析。当您部署函数时，秘密会按预期解析。但我想避免我的本地代码和我部署的代码有任何不同。那么有没有办法在本地调用时将这些秘密解析为实际的秘密值？目前我只从环境变量中获取字符串值。代码如下。

模板.yaml

    # This is the SAM template that represents the architecture of your serverless application
# https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-template-basics.html

# The AWstemplateFormatVersion identifies the capabilities of the template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/format-version-structure.html
AWstemplateFormatVersion: 2010-09-09
Description: >-
  onConnect

# Transform section specifies one or more macros that AWS CloudFormation uses to process your template
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/transform-section-structure.html
Transform:
- AWS::Serverless-2016-10-31

# Resources declares the AWS resources that you want to include in the stack
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resources-section-structure.html
Resources:
  # Each Lambda function is defined by properties:
  # https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction

  # This is a Lambda function config associated with the source code: hello-from-lambda.js
  helloFromLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/handlers/onConnect.onConnect
      Runtime: nodejs14.x
      MemorySize: 128
      Timeout: 100
      Environment:
        Variables:
          WSS_ENDPOINT: '{{resolve:secretsmanager:prod/wss/api:SecretString:endpoint}}'

onConnect.js

/**
 * A Lambda function that returns a static string
 */
exports.onConnect = async () => {
    const endpoint = process.env.WSS_ENDPOINT;
    console.log(endpoint);
    // If you change this message,you will need to change hello-from-lambda.test.js
    const message = 'Hellddfdsfo from Lambda!';

    // All log statements are written to CloudWatch
    console.info(`${message}`);
    
    return message;
}

解决方法

我想出了一个变通办法，让我拥有一个代码库并在本地“解析”秘密/参数。

我创建了一个非常基本的 lambda 层，如果环境设置为 LOCAL，它的唯一工作就是获取机密。 导入 boto3

obs

我使用 lambda 中的一个参数设置了环境，该参数将调用该层。顺便说一句，这一层最终将解决多个秘密，这就是为什么嵌套的 if 可能看起来有点奇怪。这就是我设置环境的方式：

def get_secret(env,type,secret):
    client = boto3.client('ssm')
    if env == 'LOCAL':
        if type == 'parameter':
            return client.get_parameter(
                Name=secret,)['Parameter']['Value']
    else:
        return secret

现在我可以简单地在我的 lambda 中调用 get_secret 方法，并且取决于我将 Env 设置为秘密的内容，将在运行时获取或从环境变量中返回。

Resources:
  ...
  GetWSSToken:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: get_wss_token
      CodeUri: get_wss_token/
      Handler: app.lambda_handler
      Runtime: python3.7
      Timeout: 30
      Layers:
        - arn:aws:lambda:********:layer:SecretResolver:8
      Environment:
        Variables:
          ENVIRONMENT: !Ref Env
          JWT_SECRET: !FindInMap [ Map,!Ref Env,jwtsecret ]
     ...

Mappings:
  Map:
    LOCAL:
      jwtsecret: jwt_secret
    PROD:
      jwtsecret: '{{resolve:ssm:jwt_secret}}'
    STAGING:
      jwtsecret: '{{resolve:ssm:jwt_secret}}'

Parameters:
  ...
  Env:
    Type: String
    Description: Environment this lambda is being run in.
    Default: LOCAL
    AllowedValues:
      - LOCAL
      - PROD
      - STAGING

我希望这可以帮助那些试图解决这个问题的人。这里的主要问题是将秘密隐藏在代码库之外，并且能够使用即将投入生产的相同代码在本地进行测试。