secrets-manager
This middleware fetches secrets from AWS Secrets Manager.
Secrets to fetch can be defined by by name. See AWS docs here.
Secrets are assigned to the function handler's context
object.
The Middleware makes a single API request for each secret as Secrets Manager does not support batch get.
For each secret, you also provide the name under which its value should be added to context
.
Install
To install this middleware you can use NPM:
- npm
- Yarn
npm install --save @middy/secrets-manager
npm install --save-dev @aws-sdk/client-secrets-manager
yarn add @middy/secrets-manager
yarn add --dev @aws-sdk/client-secrets-manager
Options
AwsClient
(object) (defaultSecretsManagerClient
): SecretsManagerClient class constructor (i.e. that has been instrumented with AWS XRay). Must be from@aws-sdk/client-secrets-manager
.awsClientOptions
(object) (optional): Options to pass to SecretsManagerClient class constructor.awsClientAssumeRole
(string) (optional): Internal key where secrets are stored. See @middy/sts on to set this.awsClientCapture
(function) (optional): Enable XRay by passingcaptureAWSv3Client
fromaws-xray-sdk
in.fetchData
(object) (required): Mapping of internal key name to API request parameterSecretId
.disablePrefetch
(boolean) (defaultfalse
): On cold start requests will trigger early if they can. SettingawsClientAssumeRole
disables prefetch.cacheKey
(string) (defaultsecrets-manager
): Cache key for the fetched data responses. Must be unique across all middleware.cacheExpiry
(number) (default-1
): How long fetch data responses should be cached for.-1
: cache forever,0
: never cache,n
: cache for n ms.setToContext
(boolean) (defaultfalse
): Store secrets torequest.context
.
NOTES:
- Lambda is required to have IAM permission for
secretsmanager:GetSecretValue
Sample usage
import middy from '@middy/core'
import secretsManager from '@middy/secrets-manager'
const handler = middy((event, context) => {
return {}
})
handler.use(
secretsManager({
fetchData: {
apiToken: 'dev/api_token'
},
awsClientOptions: {
region: 'us-east-1'
},
setToContext: true
})
)
// Before running the function handler, the middleware will fetch from Secrets Manager
handler(event, context, (_, response) => {
// assuming the dev/api_token has two keys, 'Username' and 'Password'
t.is(context.apiToken.Username, 'username')
t.is(context.apiToken.Password, 'password')
})
Bundling
To exclude @aws-sdk
add @aws-sdk/client-secrets-manager
to the exclude list.