cdk-secret-manager-wrapper-layer

that Lambda layer uses a wrapper script to fetch information from Secrets Manager and create environmental variables.

idea from source

Updates

2025-03-02: v2.1.0

• Added architecture parameter support for Lambda Layer
• Updated Python runtime from 3.9 to 3.13
• Fixed handler name in example code
• Improved layer initialization and referencing patterns
• Enhanced compatibility with AWS Lambda ARM64 architecture

Example

1import { App, Stack, CfnOutput, Duration } from 'aws-cdk-lib';
2import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
3import { Function, Runtime, Code, FunctionUrlAuthType, Architecture } from 'aws-cdk-lib/aws-lambda';
4import { CfnSecret } from 'aws-cdk-lib/aws-secretsmanager';
5import { SecretManagerWrapperLayer } from 'cdk-secret-manager-wrapper-layer';
6const env = {
7  region: process.env.CDK_DEFAULT_REGION,
8  account: process.env.CDK_DEFAULT_ACCOUNT,
9};
10const app = new App();
11const stack = new Stack(app, 'testing-stack', { env });
12
13/**
14 * Example create an Secret for testing.
15 */
16const secret = new CfnSecret(stack, 'MySecret', {
17  secretString: JSON.stringify({
18    KEY1: 'VALUE1',
19    KEY2: 'VALUE2',
20    KEY3: 'VALUE3',
21  }),
22});
23
24const lambdaArchitecture = Architecture.X86_64;
25
26const layer = new SecretManagerWrapperLayer(stack, 'SecretManagerWrapperLayer', {
27  lambdaArchitecture,
28});
29
30const lambda = new Function(stack, 'fn', {
31  runtime: Runtime.PYTHON_3_13,
32  code: Code.fromInline(`
33import os
34def handler(events, contexts):
35    env = {}
36    env['KEY1'] = os.environ.get('KEY1', 'Not Found')
37    env['KEY2'] = os.environ.get('KEY2', 'Not Found')
38    env['KEY3'] = os.environ.get('KEY3', 'Not Found')
39    return env
40    `),
41  handler: 'index.handler',
42  layers: [layer.layerVersion],
43  timeout: Duration.minutes(1),
44  /**
45   * you need to define this 4 environment various.
46   */
47  environment: {
48    AWS_LAMBDA_EXEC_WRAPPER: '/opt/get-secrets-layer',
49    SECRET_REGION: stack.region,
50    SECRET_ARN: secret.ref,
51    API_TIMEOUT: '5000',
52  },
53  architecture: lambdaArchitecture,
54});
55
56/**
57 * Add Permission for lambda get secret value from secret manager.
58 */
59lambda.role!.addToPrincipalPolicy(
60  new PolicyStatement({
61    effect: Effect.ALLOW,
62    actions: ['secretsmanager:GetSecretValue'],
63    // Also you can use find from context.
64    resources: [secret.ref],
65  }),
66);
67
68/**
69 * For Testing.
70 */
71const FnUrl = lambda.addFunctionUrl({
72  authType: FunctionUrlAuthType.NONE,
73});
74
75new CfnOutput(stack, 'FnUrl', {
76  value: FnUrl.url,
77});

Testing

1# ex: curl https://sdfghjklertyuioxcvbnmghj.lambda-url.us-east-1.on.aws/
2curl ${FnUrl}
3{"KEY2":"VALUE2","KEY1":"VALUE1","KEY3":"VALUE3"}