What is the best way to retrieve secret from AWS PS from within a AWS LambdaFunction?

Question

The lambda function will only be triggered once every hour.
The lambda function is a Spring microservice to check if data is stale from a downstream service and will act accordingly. This service (this endpoint) requires a key to access the downstream service.

I read so many different ways in the documentation that I got lost.
For instance with or without SDK. (I guess better without so no code change are required?) With or without cache. (no need as calling only once an hour doesn't necessitate a cache?) With or without using an additional layer or using an extension. ( this part I do not know what to consider to come up with informed decision). Are there any other things I should take into consideration?

The documentation explains how I can do it but I am not sure which solution would be best and what I should consider to make a good informed decision.
Any help would be very much appreciated.

Accepted Answer

Hi,

AWS Lambda extension is relatively a newer but better option in case you have to fetch parameters/secrets from the Parameter Store. \
Especially because it reduces the no. of API calls made to the Parameter Store, hence reducing latency and cost.

In your case, it does not make any difference in terms of cost, since you have just 1 parameter which is fetched 24 times a day. \
However, having a separate layer for handling parameters allows you to separate the logic of fetching parameters and other operational tasks from your core business logic, hence introducing separation of concern, and making your code cleaner.

Now, it's up to you, if you want a simpler approach with full control over how you fetch and process parameters, and you are okay with making a few changes to your existing code, then use SDK. \
Or else, if you want a streamlined approach without modifying your function code significantly, then use Lambda extensions. \
Hope this helps you make an informed decision.

References: \
[1] https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-integration-lambda-extensions.html \
[2] https://aws.amazon.com/blogs/compute/using-the-aws-parameter-and-secrets-lambda-extension-to-cache-parameters-and-secrets/ \
[3] https://aws.amazon.com/blogs/compute/caching-data-and-configuration-settings-with-aws-lambda-extensions/

Thanks, \
Atul

Answer

Hi Liliane

Since you mention Spring, I guess that you develop in Java.

So, my (opinionated) perspective on your questions:

* if your Lambda runs only once an hour, Lambda (and other) caches are useless: you'd  better fetch directly from AWS SSM Parameter Store. A cache would only bring the risk of incorrect value for no benefit... Access to SSM PS are quite fast: time them in your code to validate.
* the Lambda Java runtime provides direct access to the AWS SDK: you want to use it. Not using the SDK would mean coding the REST requests against the AWS service endpoints (with SigV4...), which is lots of (complex) work. 
* Additionally, if you use the SDK provided by the Lambda runtime, AWS will update it (bgs, vulnerabilities, etc.) for you at no effort on your side

Including SDK yourself would lock it to a given version, which is not what you necessarily want to do when you start: AWS is happy to do the patching for you.

I hope that I properly understood your questions to be then so direct...

Best,

Didier

What is the best way to retrieve secret from AWS PS from within a AWS LambdaFunction?

Relevant content