cdk-secret-manager-wrapper-layer
that Lambda layer uses a wrapper script to fetch information from Secrets Manager and create environmental variables.
idea from source
Updates
2025-03-02: v2.1.0
- Added architecture parameter support for Lambda Layer
- Updated Python runtime from 3.9 to 3.13
- Fixed handler name in example code
- Improved layer initialization and referencing patterns
- Enhanced compatibility with AWS Lambda ARM64 architecture
Example
import { App, Stack, CfnOutput, Duration } from 'aws-cdk-lib';
import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
import { Function, Runtime, Code, FunctionUrlAuthType, Architecture } from 'aws-cdk-lib/aws-lambda';
import { CfnSecret } from 'aws-cdk-lib/aws-secretsmanager';
import { SecretManagerWrapperLayer } from 'cdk-secret-manager-wrapper-layer';
const env = {
region: process.env.CDK_DEFAULT_REGION,
account: process.env.CDK_DEFAULT_ACCOUNT,
};
const app = new App();
const stack = new Stack(app, 'testing-stack', { env });
/**
* Example create an Secret for testing.
*/
const secret = new CfnSecret(stack, 'MySecret', {
secretString: JSON.stringify({
KEY1: 'VALUE1',
KEY2: 'VALUE2',
KEY3: 'VALUE3',
}),
});
const lambdaArchitecture = Architecture.X86_64;
const layer = new SecretManagerWrapperLayer(stack, 'SecretManagerWrapperLayer', {
lambdaArchitecture,
});
const lambda = new Function(stack, 'fn', {
runtime: Runtime.PYTHON_3_13,
code: Code.fromInline(`
import os
def handler(events, contexts):
env = {}
env['KEY1'] = os.environ.get('KEY1', 'Not Found')
env['KEY2'] = os.environ.get('KEY2', 'Not Found')
env['KEY3'] = os.environ.get('KEY3', 'Not Found')
return env
`),
handler: 'index.handler',
layers: [layer.layerVersion],
timeout: Duration.minutes(1),
/**
* you need to define this 4 environment various.
*/
environment: {
AWS_LAMBDA_EXEC_WRAPPER: '/opt/get-secrets-layer',
SECRET_REGION: stack.region,
SECRET_ARN: secret.ref,
API_TIMEOUT: '5000',
},
architecture: lambdaArchitecture,
});
/**
* Add Permission for lambda get secret value from secret manager.
*/
lambda.role!.addToPrincipalPolicy(
new PolicyStatement({
effect: Effect.ALLOW,
actions: ['secretsmanager:GetSecretValue'],
// Also you can use find from context.
resources: [secret.ref],
}),
);
/**
* For Testing.
*/
const FnUrl = lambda.addFunctionUrl({
authType: FunctionUrlAuthType.NONE,
});
new CfnOutput(stack, 'FnUrl', {
value: FnUrl.url,
});
Testing
# ex: curl https://sdfghjklertyuioxcvbnmghj.lambda-url.us-east-1.on.aws/
curl ${FnUrl}
{"KEY2":"VALUE2","KEY1":"VALUE1","KEY3":"VALUE3"}
1 maintainer
Metadata
1 maintainer
Release files for cdk-secret-manager-wrapper-layer 2.1.315
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| cdk_secret_manager_wrapper_layer-2.1.315.tar.gz | 43.6 kB | Without provenance | Details for cdk_secret_manager_wrapper_layer-2.1.315.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| cdk_secret_manager_wrapper_layer-2.1.315-py3-none-any.whl | Python 3 | none | any | Details for cdk_secret_manager_wrapper_layer-2.1.315-py3-none-any.whl |
Total release size: 85.8 kB
Release files / cdk_secret_manager_wrapper_layer-2.1.315.tar.gz
| Download URL | cdk_secret_manager_wrapper_layer-2.1.315.tar.gz |
|---|---|
| Size | 43.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
04e91caa4b2eb5fce19cfebd5f575c6b07d783f7c31ac7791e41461879cdf7c9
|
|
BLAKE2b-256 checksum How to use checksums |
5ec6dedbdeb31420b868373d609c90f650793fa180247ea8d6c397e9eb9bcf4f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.15.1
|
Release files / cdk_secret_manager_wrapper_layer-2.1.315-py3-none-any.whl
| Download URL | cdk_secret_manager_wrapper_layer-2.1.315-py3-none-any.whl |
|---|---|
| Size | 42.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
4f630f28dd26ed574eab98c5b25d4298720d4f366451a676202a2ee59ec7a297
|
|
BLAKE2b-256 checksum How to use checksums |
40c8f1e393798343bd6bca032adb1b9050a90107a0179bc0b8b765d486268e1a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.15.1
|
Security for cdk-secret-manager-wrapper-layer 2.1.315
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
