(lambda): Make it easy to use "AWS Parameters and Secrets Lambda Extension" with Lambda Functions

[blimmer]

Describe the feature

The AWS Parameters and Secrets Lambda Extension is a great way to securely fetch Secrets Manager Secrets from Lambda functions. Today, I have to reference the documentation and hard-code the Layer ARN from this table to add the layer to my function.

It would be nice if there were a convenience method that automatically determined the proper ARN for the Lambda's architecture and deployment region. It would also be great if the available configuration environment variables were able to be set via CDK.

Use Case

A common pattern for exposing Secrets Manager secrets to Lambda functions is by setting them as environment variables. However, this is insecure because the variable is set in plain text in the console. Additionally, updates to the secret outside of CloudFormation do not update the environment variable. Recent versions of CDK warn you about this, requiring an explicit call to unsafeUnwrap on the Secret.

One way to work around this issue is to call the Secrets Manager API (e.g. via aws-sdk) in your Lambda function. However, this can get expensive because it results in a lot of retrievals of secret values. You then have to implement your own caching behavior if you want to reduce cost.

The AWS Parameters and Secrets Lambda Extension solves both of these problems. The secret is fetched at runtime and it handles caching for you automatically.

Proposed Solution

const myFunc = new lambda.Function(this, 'Function', {
  // existing parameters
});
myFunc.attachParametersAndSecretsExtension();

Then, the logic for the function would look something like (pseudocode):

interface ParametersAndSecretsExtensionConfig {
  parametersSecretsExtensionCacheEnabled?: boolean
  parametersSecretsExtensionCacheSize?: number
  // and the rest of the config properties from: https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html#retrieving-secrets_lambda_env-var
}

class Function {
  // existing logic

  attachParametersAndSecretsExtension(config: ParametersAndSecretsExtensionConfig = {}) {
    this.addLayers(this.getParametersAndSecretsExtensionLayerArn);

    for (const configKey in config) {
      this.addEnvironment(constantCase(configKey), config[configKey].toString());
    }
  }

  private getParametersAndSecretsExtensionLayerArn(): ILayerVersion {
    // logic similar to https://github.com/aws/aws-cdk/blob/f2855dc12b1ff2c1a24f6fbd9de20d9b7079127a/packages/@aws-cdk/region-info/build-tools/fact-tables.ts#L244
    // it returns the proper layer for the region and architecture of the lambda
    const layerArn = lookupArnFromFactTable(this.architecture);

    return LayerVersion.fromLayerArn(layerArn)
  }
}

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.53.0

Environment details (OS name and version, etc.)

MacOS, TypeScript

[peterwoodworth]

Thanks for this feature request @blimmer, this would be an excellent feature for us to support!

I am marking this issue as p2, which means that we are unable to work on this immediately.

We use +1s to help prioritize our work, and are happy to revaluate this issue based on community feedback. You can reach out to the cdk.dev community on Slack to solicit support for reprioritization.

Check out our contributing guide if you're interested in contributing yourself - I'd love to see what you come up with 🙂

[watany-dev]

I want this feature so I will work on this.

[github-actions]

This issue has received a significant amount of attention so we are automatically upgrading its priority. A member of the community will see the re-prioritization and provide an update on the issue.

[mrgrain]

#25725 has to be reverted.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[WilliamTepet]

Currently this feature works like a charm, however, it does not support Cross Account SSM parameter retrieval, could that be supported any time soon?