cdk-secret-manager-wrapper-layer
that Lambda layer uses a wrapper script to fetch information from Secrets Manager and create environmental variables.
idea from source
Updates
2025-03-02: v2.1.0
- Added architecture parameter support for Lambda Layer
- Updated Python runtime from 3.9 to 3.13
- Fixed handler name in example code
- Improved layer initialization and referencing patterns
- Enhanced compatibility with AWS Lambda ARM64 architecture
Example
import { App, Stack, CfnOutput, Duration } from 'aws-cdk-lib';
import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
import { Function, Runtime, Code, FunctionUrlAuthType, Architecture } from 'aws-cdk-lib/aws-lambda';
import { CfnSecret } from 'aws-cdk-lib/aws-secretsmanager';
import { SecretManagerWrapperLayer } from 'cdk-secret-manager-wrapper-layer';
const env = {
region: process.env.CDK_DEFAULT_REGION,
account: process.env.CDK_DEFAULT_ACCOUNT,
};
const app = new App();
const stack = new Stack(app, 'testing-stack', { env });
/**
* Example create an Secret for testing.
*/
const secret = new CfnSecret(stack, 'MySecret', {
secretString: JSON.stringify({
KEY1: 'VALUE1',
KEY2: 'VALUE2',
KEY3: 'VALUE3',
}),
});
const lambdaArchitecture = Architecture.X86_64;
const layer = new SecretManagerWrapperLayer(stack, 'SecretManagerWrapperLayer', {
lambdaArchitecture,
});
const lambda = new Function(stack, 'fn', {
runtime: Runtime.PYTHON_3_13,
code: Code.fromInline(`
import os
def handler(events, contexts):
env = {}
env['KEY1'] = os.environ.get('KEY1', 'Not Found')
env['KEY2'] = os.environ.get('KEY2', 'Not Found')
env['KEY3'] = os.environ.get('KEY3', 'Not Found')
return env
`),
handler: 'index.handler',
layers: [layer.layerVersion],
timeout: Duration.minutes(1),
/**
* you need to define this 4 environment various.
*/
environment: {
AWS_LAMBDA_EXEC_WRAPPER: '/opt/get-secrets-layer',
SECRET_REGION: stack.region,
SECRET_ARN: secret.ref,
API_TIMEOUT: '5000',
},
architecture: lambdaArchitecture,
});
/**
* Add Permission for lambda get secret value from secret manager.
*/
lambda.role!.addToPrincipalPolicy(
new PolicyStatement({
effect: Effect.ALLOW,
actions: ['secretsmanager:GetSecretValue'],
// Also you can use find from context.
resources: [secret.ref],
}),
);
/**
* For Testing.
*/
const FnUrl = lambda.addFunctionUrl({
authType: FunctionUrlAuthType.NONE,
});
new CfnOutput(stack, 'FnUrl', {
value: FnUrl.url,
});
Testing
# ex: curl https://sdfghjklertyuioxcvbnmghj.lambda-url.us-east-1.on.aws/
curl ${FnUrl}
{"KEY2":"VALUE2","KEY1":"VALUE1","KEY3":"VALUE3"}
1 maintainer
Metadata
1 maintainer
Release files for cdk-secret-manager-wrapper-layer 2.1.77
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| cdk_secret_manager_wrapper_layer-2.1.77.tar.gz | 42.4 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| cdk_secret_manager_wrapper_layer-2.1.77-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 83.8 kB
Release files / cdk_secret_manager_wrapper_layer-2.1.77.tar.gz
| Download URL | cdk_secret_manager_wrapper_layer-2.1.77.tar.gz |
|---|---|
| Size | 42.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f7b34393dc87424bb66fc050db9aa52880d75c9f5c4b1d6064e54e5ff6c6a032
|
|
BLAKE2b-256 checksum How to use checksums |
20dab862a1cbe11f9ba3c244994473afb6ae0de2f3a49b97194a28c014d5a5f5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.13.3
|
Release files / cdk_secret_manager_wrapper_layer-2.1.77-py3-none-any.whl
| Download URL | cdk_secret_manager_wrapper_layer-2.1.77-py3-none-any.whl |
|---|---|
| Size | 41.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c1ff3e7199275306642a48d035435e93995f5e05c61f5c25f288a28c3da73598
|
|
BLAKE2b-256 checksum How to use checksums |
70c617e0ceda6a8183beaca28d79587eb045ec9c22cace74e170a6951df0229b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.13.3
|
