From f43ecb29efb016e7f50a5410ff7a323f91d0e990 Mon Sep 17 00:00:00 2001 From: Piyush Gupta Date: Tue, 18 Nov 2025 20:37:21 +0530 Subject: [PATCH 1/3] docs: adds aws lambda secret sync docs --- docs/docs.json | 4 + docs/integrations/platforms/aws/lambda.mdx | 118 +++++++++++++++++++++ 2 files changed, 122 insertions(+) create mode 100644 docs/integrations/platforms/aws/lambda.mdx diff --git a/docs/docs.json b/docs/docs.json index c3fa85861..ddbbf3dee 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -490,6 +490,10 @@ "pages": [ "integrations/platforms/ansible", "integrations/platforms/apache-airflow", + { + "group": "AWS", + "pages": ["integrations/platforms/aws/lambda"] + }, { "group": "Kubernetes Operator", "pages": [ diff --git a/docs/integrations/platforms/aws/lambda.mdx b/docs/integrations/platforms/aws/lambda.mdx new file mode 100644 index 000000000..597c85f9c --- /dev/null +++ b/docs/integrations/platforms/aws/lambda.mdx @@ -0,0 +1,118 @@ +--- +title: "AWS Lambda" +sidebarTitle: "AWS Lambda" +description: "Keep AWS Lambda environment variables in sync with Infisical" +--- + +Learn how to sync Infisical secrets to AWS Lambda regardless of how you deploy your function. +This guide covers the following strategies: + +- Infisical SDKs +- AWS Secrets Manager integration +- AWS Systems Manager Parameter Store integration +- AWS CLI + +## Choose your sync strategy + +### 1. Fetch secrets at runtime with Infisical SDKs + +If you control the Lambda code, the simplest method is to fetch secrets directly from Infisical using one of our SDKs. +You can read more about the Infisical SDKs [here](/sdks/overview). + +### 2. Sync secrets using AWS Secrets Manager + +Infisical can continuously push secrets into AWS Secrets Manager. +Configure a secret sync from your Infisical project, and Infisical will keep your Secrets Manager values up to date. Your Lambda function can then reference those secrets directly. +Learn more about the AWS Secrets Manager integration [here](/integrations/secret-syncs/aws-secrets-manager). + +### 3. Sync secrets using AWS Systems Manager Parameter Store + +Similarly, Infisical can automatically sync secrets into AWS Systems Manager Parameter Store. +Once configured, your Parameter Store values will remain up to date and can be referenced by your Lambda function. +Learn more about the Parameter Store integration [here](/integrations/secret-syncs/aws-parameter-store). + +### 4. Push environment variables directly using the AWS CLI + +For straightforward workflows or quick rotations, you can push Infisical secrets directly into Lambda environment variables using the AWS CLI. + +## Prerequisites + +- AWS CLI v2 installed and authenticated +- `jq` installed locally +- An IAM principal with `lambda:UpdateFunctionConfiguration` +- Infisical CLI (`infisical`) configured + +### IAM permissions + +Attach a policy like the one below to the IAM user or role responsible for updating Lambda configuration: + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "LambdaConfig", + "Effect": "Allow", + "Action": ["lambda:UpdateFunctionConfiguration"], + "Resource": "*" + } + ] +} +``` + + + {" "} + Replacing Lambda environment variables using the AWS CLI overwrites the entire + `Variables` object. Make sure to export your current values so you can import them + into Infisical.{" "} + + +#### Push secrets to Lambda + +Use the Infisical CLI to export secrets as JSON and pass them to the AWS CLI. +The example below targets a project by ID, but you can also use the `--project` and `--env` flags. +Learn more about `infisical export` [here](/cli/commands/export#infisical-export). + +```bash +FUNCTION_NAME=infisical-env-test +REGION=us-east-1 +PROJECT_ID=1234567890 + +aws lambda update-function-configuration \ + --function-name "$FUNCTION_NAME" \ + --region "$REGION" \ + --environment "$( + infisical export \ + --format=json \ + --projectId="$PROJECT_ID" \ + | jq 'map({(.key): .value}) | add | {Variables: .}' + )" +``` + +On success, the updated `Environment.Variables` block will be returned. +Verify the values in the Lambda console or by invoking the function. + + + {" "} + Automate this step in CI/CD. Run `infisical export` using an Infisical API key + scoped to your project and environment, and trigger the sync as part of your deployment + workflow.{" "} + + +#### Test your Lambda + +Deploy or update your Lambda function, then run a test invocation to confirm the secrets were loaded correctly. +For example, a simple Node.js handler might log the environment variables: + +```javascript +export const handler = async () => { + const allEnvVars = process.env; + console.log("Environment Variables:", JSON.stringify(allEnvVars, null, 2)); +}; +``` + + + We recommend using automatic secret syncs to AWS Secrets Manager or AWS + Systems Manager Parameter Store to keep your secrets continuously in sync and + avoid manually updating the Lambda configuration. + From f0fed07f279f67f71df7d4d55d88c6e1ff8e7493 Mon Sep 17 00:00:00 2001 From: Piyush Gupta Date: Fri, 21 Nov 2025 20:11:46 +0530 Subject: [PATCH 2/3] fix: review comments --- docs/integrations/platforms/aws/lambda.mdx | 45 +++++++--------------- 1 file changed, 13 insertions(+), 32 deletions(-) diff --git a/docs/integrations/platforms/aws/lambda.mdx b/docs/integrations/platforms/aws/lambda.mdx index 597c85f9c..496527651 100644 --- a/docs/integrations/platforms/aws/lambda.mdx +++ b/docs/integrations/platforms/aws/lambda.mdx @@ -1,7 +1,7 @@ --- title: "AWS Lambda" sidebarTitle: "AWS Lambda" -description: "Keep AWS Lambda environment variables in sync with Infisical" +description: "How to use Infisical secrets in AWS Lambda" --- Learn how to sync Infisical secrets to AWS Lambda regardless of how you deploy your function. @@ -19,19 +19,12 @@ This guide covers the following strategies: If you control the Lambda code, the simplest method is to fetch secrets directly from Infisical using one of our SDKs. You can read more about the Infisical SDKs [here](/sdks/overview). -### 2. Sync secrets using AWS Secrets Manager +### 2. Push via secret sync -Infisical can continuously push secrets into AWS Secrets Manager. -Configure a secret sync from your Infisical project, and Infisical will keep your Secrets Manager values up to date. Your Lambda function can then reference those secrets directly. -Learn more about the AWS Secrets Manager integration [here](/integrations/secret-syncs/aws-secrets-manager). +Configure a secret sync from your Infisical project, and Infisical will keep your Secrets Manager or Parameter Store values up to date. Your Lambda function can then reference those secrets directly. +Learn more about the [AWS Secrets Manager integration](/integrations/secret-syncs/aws-secrets-manager) and the [AWS Parameter Store integration](/integrations/secret-syncs/aws-parameter-store). -### 3. Sync secrets using AWS Systems Manager Parameter Store - -Similarly, Infisical can automatically sync secrets into AWS Systems Manager Parameter Store. -Once configured, your Parameter Store values will remain up to date and can be referenced by your Lambda function. -Learn more about the Parameter Store integration [here](/integrations/secret-syncs/aws-parameter-store). - -### 4. Push environment variables directly using the AWS CLI +### 3. Push environment variables directly using the AWS CLI For straightforward workflows or quick rotations, you can push Infisical secrets directly into Lambda environment variables using the AWS CLI. @@ -93,26 +86,14 @@ On success, the updated `Environment.Variables` block will be returned. Verify the values in the Lambda console or by invoking the function. - {" "} - Automate this step in CI/CD. Run `infisical export` using an Infisical API key - scoped to your project and environment, and trigger the sync as part of your deployment - workflow.{" "} + Automate this step in CI/CD. Run `infisical export` using an Infisical API + Token scoped to your project and environment, and trigger the sync as part of + your deployment workflow. Learn more about the [Infisical API + Token](/cli/commands/login#user:plain-token-output-useful-for-scripting-and-ci-cd). -#### Test your Lambda - -Deploy or update your Lambda function, then run a test invocation to confirm the secrets were loaded correctly. -For example, a simple Node.js handler might log the environment variables: - -```javascript -export const handler = async () => { - const allEnvVars = process.env; - console.log("Environment Variables:", JSON.stringify(allEnvVars, null, 2)); -}; -``` - - + We recommend using automatic secret syncs to AWS Secrets Manager or AWS - Systems Manager Parameter Store to keep your secrets continuously in sync and - avoid manually updating the Lambda configuration. - + Parameter Store to keep your secrets continuously in sync and avoid manually + updating the Lambda configuration. + From b97691dd9fd82c6e9b741ffb37f816fcb6d28b59 Mon Sep 17 00:00:00 2001 From: Piyush Gupta Date: Wed, 26 Nov 2025 22:47:01 +0530 Subject: [PATCH 3/3] fix: review comments --- docs/integrations/platforms/aws/lambda.mdx | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/docs/integrations/platforms/aws/lambda.mdx b/docs/integrations/platforms/aws/lambda.mdx index 496527651..8376e98c2 100644 --- a/docs/integrations/platforms/aws/lambda.mdx +++ b/docs/integrations/platforms/aws/lambda.mdx @@ -4,8 +4,7 @@ sidebarTitle: "AWS Lambda" description: "How to use Infisical secrets in AWS Lambda" --- -Learn how to sync Infisical secrets to AWS Lambda regardless of how you deploy your function. -This guide covers the following strategies: +Learn how to sync Infisical secrets to AWS Lambda regardless of how you deploy your function. This guide covers the following strategies: - Infisical SDKs - AWS Secrets Manager integration @@ -86,10 +85,10 @@ On success, the updated `Environment.Variables` block will be returned. Verify the values in the Lambda console or by invoking the function. - Automate this step in CI/CD. Run `infisical export` using an Infisical API - Token scoped to your project and environment, and trigger the sync as part of - your deployment workflow. Learn more about the [Infisical API - Token](/cli/commands/login#user:plain-token-output-useful-for-scripting-and-ci-cd). + Automate this step in CI/CD. Run `infisical export` using an Infisical Token + scoped to your project and environment, and trigger the sync as part of your + deployment workflow. Learn more about the [Infisical + Token](/cli/commands/export#infisical-export:infisical-token).