Secrets Manage：无法轮换密钥，无法调用指定的 Lambda 函数

Question

错误：Secrets Manager 无法调用指定的 Lambda 函数。确保函数策略授予对主体 secretsmanager.amazonaws.com 的访问权限

我正在使用 Secret Manager 来存储用于验证 JWT 的密钥。
我计划的配置是使用以下逻辑轮换弃用密钥：

我的秘密是这样的：

{
  current:'my-current-secret',
  previous:'my-previous-secret',
  alg:'encoding alg',
}

*使用两个秘密并轮换它们似乎有点矫枉过正——我只保留previous令牌的记忆来处理交接的边缘情况。如果身份验证失败，我将检查它是否通过 验证previous，如果验证通过，它将使用current密钥返回更新的 cookie

创建秘密：

putSecretValue({
      current: getRandomPassword(...),
      previous: getSecretValue(...)['current'],
      alg: env.param ? env.param : getSecretValue(...)['alg']
})

我不使用setSecret，testSecret，finishSecret

我没有使用无服务器（我会在某个时候使用，但我想在使用 CLI 的快捷方式之前先熟悉使用 AWS/GUI）我看过：

• 如何授予对 AWS Secrets Manager 的轮换 Lambda 访问权限
• https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-create-generic-template.html

我无法弄清楚我缺少什么 IAM 设置。

当我尝试设置旋转 lambda 时：

这闪烁（这么快，我不得不记录我的屏幕来看看）：

我立即收到以下错误：

我首先让 lambda 完全控制secrets manager并lambdas反向工作到最小控制，但即使将厨房水槽扔在它上面我也无法让它工作：

{
  "permissionsBoundary": {},
  "roleName": "secrets_manager-role-REDACTED",
  "policies": [
    {
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
              "secretsmanager:GetRandomPassword",
              "secretsmanager:CreateSecret",
              "secretsmanager:ListSecrets"
            ],
            "Resource": "*"
          },
          {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "secretsmanager:*",
            "Resource": "arn:aws:secretsmanager:us-east-1:REDACTED:secret:REDACTED"
          }
        ]
      },
      "name": "ReadWriteREDACTEDSecret",
      "id": "REDACTED",
      "type": "managed",
      "arn": "arn:aws:iam::REDACTED:policy/ReadWriteREDACTEDSecret"
    },
    {
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
              "lambda:InvokeFunction",
              "lambda:InvokeAsync"
            ],
            "Resource": "arn:aws:lambda:us-east-1:REDACTED:function:secrets_manager"
          }
        ]
      },
      "name": "invoke_secrets_manager_lambda",
      "id": "REDACTED",
      "type": "managed",
      "arn": "arn:aws:iam::REDACTED:policy/invoke_secrets_manager_lambda"
    },
    {
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:us-east-1:REDACTED:*"
          },
          {
            "Effect": "Allow",
            "Action": [
              "logs:CreateLogStream",
              "logs:PutLogEvents"
            ],
            "Resource": [
              "arn:aws:logs:us-east-1:REDACTED:log-group:/aws/lambda/secrets_manager:*"
            ]
          }
        ]
      },
      "name": "AWSLambdaBasicExecutionRole-REDACTED",
      "id": "REDACTED",
      "type": "managed",
      "arn": "arn:aws:iam::REDACTED:policy/service-role/AWSLambdaBasicExecutionRole-REDACTED"
    },
    {
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "cloudformation:DescribeChangeSet",
              "cloudformation:DescribeStackResources",
              "cloudformation:DescribeStacks",
              "cloudformation:GetTemplate",
              "cloudformation:ListStackResources",
              "cloudwatch:*",
              "cognito-identity:ListIdentityPools",
              "cognito-sync:GetCognitoEvents",
              "cognito-sync:SetCognitoEvents",
              "dynamodb:*",
              "ec2:DescribeSecurityGroups",
              "ec2:DescribeSubnets",
              "ec2:DescribeVpcs",
              "events:*",
              "iam:GetPolicy",
              "iam:GetPolicyVersion",
              "iam:GetRole",
              "iam:GetRolePolicy",
              "iam:ListAttachedRolePolicies",
              "iam:ListRolePolicies",
              "iam:ListRoles",
              "iam:PassRole",
              "iot:AttachPrincipalPolicy",
              "iot:AttachThingPrincipal",
              "iot:CreateKeysAndCertificate",
              "iot:CreatePolicy",
              "iot:CreateThing",
              "iot:CreateTopicRule",
              "iot:DescribeEndpoint",
              "iot:GetTopicRule",
              "iot:ListPolicies",
              "iot:ListThings",
              "iot:ListTopicRules",
              "iot:ReplaceTopicRule",
              "kinesis:DescribeStream",
              "kinesis:ListStreams",
              "kinesis:PutRecord",
              "kms:ListAliases",
              "lambda:*",
              "logs:*",
              "s3:*",
              "sns:ListSubscriptions",
              "sns:ListSubscriptionsByTopic",
              "sns:ListTopics",
              "sns:Publish",
              "sns:Subscribe",
              "sns:Unsubscribe",
              "sqs:ListQueues",
              "sqs:SendMessage",
              "tag:GetResources",
              "xray:PutTelemetryRecords",
              "xray:PutTraceSegments"
            ],
            "Resource": "*"
          }
        ]
      },
      "name": "AWSLambdaFullAccess",
      "id": "REDACTED",
      "type": "managed",
      "arn": "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
    }
  ],
  "trustedEntities": [
    "secretsmanager.amazonaws.com",
    "lambda.amazonaws.com"
  ]
}

我的 lambda 信任政策如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "secretsmanager.amazonaws.com",
          "lambda.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Answer 1

在梳理了 aws gui 大约 10 个小时并进行了广泛的谷歌搜索后，我遇到了一个不同的资源，该资源链接到文档说无法在 gui 中设置 lambda 的函数策略。

我在 cli 中运行了以下命令，一切正常：

aws lambda add-permission \
          --function-name secrets_manager \
          --principal secretsmanager.amazonaws.com \
          --action lambda:InvokeFunction \
          --statement-id SecretsManagerAccess

--function-name secrets_manager 是因为我的 lambda 函数被命名为 secrets_manager

来源： https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-create-generic-template.html