mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
99 lines
3.2 KiB
Plaintext
99 lines
3.2 KiB
Plaintext
---
|
|
title: "AWS Lambda"
|
|
sidebarTitle: "AWS Lambda"
|
|
description: "How to use Infisical secrets in AWS Lambda"
|
|
---
|
|
|
|
Learn how to sync Infisical secrets to AWS Lambda regardless of how you deploy your function. This guide covers the following strategies:
|
|
|
|
- Infisical SDKs
|
|
- AWS Secrets Manager integration
|
|
- AWS Systems Manager Parameter Store integration
|
|
- AWS CLI
|
|
|
|
## Choose your sync strategy
|
|
|
|
### 1. Fetch secrets at runtime with Infisical SDKs
|
|
|
|
If you control the Lambda code, the simplest method is to fetch secrets directly from Infisical using one of our SDKs.
|
|
You can read more about the Infisical SDKs [here](/sdks/overview).
|
|
|
|
### 2. Push via secret sync
|
|
|
|
Configure a secret sync from your Infisical project, and Infisical will keep your Secrets Manager or Parameter Store values up to date. Your Lambda function can then reference those secrets directly.
|
|
Learn more about the [AWS Secrets Manager integration](/integrations/secret-syncs/aws-secrets-manager) and the [AWS Parameter Store integration](/integrations/secret-syncs/aws-parameter-store).
|
|
|
|
### 3. Push environment variables directly using the AWS CLI
|
|
|
|
For straightforward workflows or quick rotations, you can push Infisical secrets directly into Lambda environment variables using the AWS CLI.
|
|
|
|
## Prerequisites
|
|
|
|
- AWS CLI v2 installed and authenticated
|
|
- `jq` installed locally
|
|
- An IAM principal with `lambda:UpdateFunctionConfiguration`
|
|
- Infisical CLI (`infisical`) configured
|
|
|
|
### IAM permissions
|
|
|
|
Attach a policy like the one below to the IAM user or role responsible for updating Lambda configuration:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "LambdaConfig",
|
|
"Effect": "Allow",
|
|
"Action": ["lambda:UpdateFunctionConfiguration"],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
<Note>
|
|
{" "}
|
|
Replacing Lambda environment variables using the AWS CLI overwrites the entire
|
|
`Variables` object. Make sure to export your current values so you can import them
|
|
into Infisical.{" "}
|
|
</Note>
|
|
|
|
#### Push secrets to Lambda
|
|
|
|
Use the Infisical CLI to export secrets as JSON and pass them to the AWS CLI.
|
|
The example below targets a project by ID, but you can also use the `--project` and `--env` flags.
|
|
Learn more about `infisical export` [here](/cli/commands/export#infisical-export).
|
|
|
|
```bash
|
|
FUNCTION_NAME=infisical-env-test
|
|
REGION=us-east-1
|
|
PROJECT_ID=1234567890
|
|
|
|
aws lambda update-function-configuration \
|
|
--function-name "$FUNCTION_NAME" \
|
|
--region "$REGION" \
|
|
--environment "$(
|
|
infisical export \
|
|
--format=json \
|
|
--projectId="$PROJECT_ID" \
|
|
| jq 'map({(.key): .value}) | add | {Variables: .}'
|
|
)"
|
|
```
|
|
|
|
On success, the updated `Environment.Variables` block will be returned.
|
|
Verify the values in the Lambda console or by invoking the function.
|
|
|
|
<Tip>
|
|
Automate this step in CI/CD. Run `infisical export` using an Infisical Token
|
|
scoped to your project and environment, and trigger the sync as part of your
|
|
deployment workflow. Learn more about the [Infisical
|
|
Token](/cli/commands/export#infisical-export:infisical-token).
|
|
</Tip>
|
|
|
|
<Note>
|
|
We recommend using automatic secret syncs to AWS Secrets Manager or AWS
|
|
Parameter Store to keep your secrets continuously in sync and avoid manually
|
|
updating the Lambda configuration.
|
|
</Note>
|