允许 lambda 权限访问 Secretsmanager 值

Question

我正在使用 Terraform 部署需要在 AWS SecretsManager 中保存机密的 lambda。

我有以下缩写的 lambda：

拉姆达

resource "aws_lambda_function" "thisThing" {
  function_name = "functionName"
  runtime = "python3.8"
  handler = "thisThing.handler"

  role = aws_iam_role.lambda_exec.arn
}

resource "aws_iam_role" "lambda_exec" {
  name = "serverless_lambda"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Sid    = ""
      Principal = {
        Service = "lambda.amazonaws.com"
      }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "lambda_policy" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

这是秘密

秘密

# Secrets

resource "aws_secretsmanager_secret" "SECRET" {
  name = "SECRET"
  recovery_window_in_days = 0
}

resource "aws_secretsmanager_secret_version" "SECRET" {
  secret_id     = "${aws_secretsmanager_secret.SECRET.id}"
  secret_string = "${var.SECRET}"
}

我收到的错误是：

[ERROR] ClientError: An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:sts::439791110569:assumed-role/serverless_lambda/thisThing is not authorized to perform: secretsmanager:GetSecretValue on resource: SECRET because no identity-based policy allows the secretsmanager:GetSecretValue action

这是我第一次使用秘密管理器，我对 AWS 的经验不是很丰富，但我认为根据这里的答案，我需要添加一个策略，允许我的 lambda exec 角色具有GetSecretValue权限。我已经进行了几次尝试，但由于缺乏如何查找不同策略 ARN 的知识，我无法继续下去。

这是我尝试添加的内容（这是错误的，我知道这是错误的。）

resource "aws_iam_role_policy_attachment" "lambda_secretsmanager_role" {
  role = aws_iam_role.lambda_exec.name
  # ? policy_arn = "arn:aws:iam::aws:policy/SecretsManagerGetSecretValue"
}

这不是正确的 ARN，但我不确定在哪里可以找到正确的 ARN。

Answer 1

您可以使用aws_iam_role_policy添加权限：

resource "aws_iam_role_policy" "sm_policy" {
  name = "sm_access_permissions"
  role = aws_iam_role.lambda_exec.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "secretsmanager:GetSecretValue",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

如果您想遵循最小特权权限，那么您可以更改Resource = "*"为Resource = "<arn-of-the-secret>".