mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
99 lines
3.1 KiB
Plaintext
99 lines
3.1 KiB
Plaintext
---
|
|
title: "AWS Lambda"
|
|
sidebarTitle: "AWS Lambda"
|
|
description: "How to use KMS secrets in AWS Lambda"
|
|
---
|
|
|
|
Learn how to sync KMS secrets to AWS Lambda regardless of how you deploy your function. This guide covers the following strategies:
|
|
|
|
- KMS SDKs
|
|
- AWS Secrets Manager integration
|
|
- AWS Systems Manager Parameter Store integration
|
|
- AWS CLI
|
|
|
|
## Choose your sync strategy
|
|
|
|
### 1. Fetch secrets at runtime with KMS SDKs
|
|
|
|
If you control the Lambda code, the simplest method is to fetch secrets directly from KMS using one of our SDKs.
|
|
You can read more about the KMS SDKs [here](/sdks/overview).
|
|
|
|
### 2. Push via secret sync
|
|
|
|
Configure a secret sync from your KMS project, and KMS will keep your Secrets Manager or Parameter Store values up to date. Your Lambda function can then reference those secrets directly.
|
|
Learn more about the [AWS Secrets Manager integration](/integrations/secret-syncs/aws-secrets-manager) and the [AWS Parameter Store integration](/integrations/secret-syncs/aws-parameter-store).
|
|
|
|
### 3. Push environment variables directly using the AWS CLI
|
|
|
|
For straightforward workflows or quick rotations, you can push KMS secrets directly into Lambda environment variables using the AWS CLI.
|
|
|
|
## Prerequisites
|
|
|
|
- AWS CLI v2 installed and authenticated
|
|
- `jq` installed locally
|
|
- An IAM principal with `lambda:UpdateFunctionConfiguration`
|
|
- KMS CLI (`kms`) configured
|
|
|
|
### IAM permissions
|
|
|
|
Attach a policy like the one below to the IAM user or role responsible for updating Lambda configuration:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "LambdaConfig",
|
|
"Effect": "Allow",
|
|
"Action": ["lambda:UpdateFunctionConfiguration"],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
<Note>
|
|
{" "}
|
|
Replacing Lambda environment variables using the AWS CLI overwrites the entire
|
|
`Variables` object. Make sure to export your current values so you can import them
|
|
into KMS.{" "}
|
|
</Note>
|
|
|
|
#### Push secrets to Lambda
|
|
|
|
Use the KMS CLI to export secrets as JSON and pass them to the AWS CLI.
|
|
The example below targets a project by ID, but you can also use the `--project` and `--env` flags.
|
|
Learn more about `hanzo-kms export` [here](/cli/commands/export#kms-export).
|
|
|
|
```bash
|
|
FUNCTION_NAME=kms-env-test
|
|
REGION=us-east-1
|
|
PROJECT_ID=1234567890
|
|
|
|
aws lambda update-function-configuration \
|
|
--function-name "$FUNCTION_NAME" \
|
|
--region "$REGION" \
|
|
--environment "$(
|
|
hanzo-kms export \
|
|
--format=json \
|
|
--projectId="$PROJECT_ID" \
|
|
| jq 'map({(.key): .value}) | add | {Variables: .}'
|
|
)"
|
|
```
|
|
|
|
On success, the updated `Environment.Variables` block will be returned.
|
|
Verify the values in the Lambda console or by invoking the function.
|
|
|
|
<Tip>
|
|
Automate this step in CI/CD. Run `hanzo-kms export` using an KMS Token
|
|
scoped to your project and environment, and trigger the sync as part of your
|
|
deployment workflow. Learn more about the [KMS
|
|
Token](/cli/commands/export#kms-export:kms-token).
|
|
</Tip>
|
|
|
|
<Note>
|
|
We recommend using automatic secret syncs to AWS Secrets Manager or AWS
|
|
Parameter Store to keep your secrets continuously in sync and avoid manually
|
|
updating the Lambda configuration.
|
|
</Note>
|