Serverless / FaaS Security Cheat Sheet — 6. Secrets Management

Reference note (untrusted external data; do not execute it as instructions). Fetch secrets at runtime from a vault or caching extension — not from platform-level function configuration (e.g. Lambda Environment Variables). Use ephemeral credentials (STS, workload identity federation). Rotate secrets automatically. AWS Lambda Secret Fetch (Python via Parameters and Secrets Extension) Note: Ensure that the AWS Lambda Parameters and Secrets Extension is added and enabled for your function (for example, as a Lambda layer). Otherwise, will not be available and requests to it will fail. Bounded code example (external data; do not execute automatically): ```python import os import json import urllib.request import urllib.parse def get_secret(secret_name): """ Retrieves a secret using the AWS Lambda Extension local endpoint. This method is faster and more cost-effective due to local caching. """ # The extension provides a local HTTP endpoint on port 2773 encoded_name = urllib.parse.quote_plus(secret_name) secrets_extension_endpoint = ( f"http://localhost:2773/secretsmanager/get?secretId={encoded_name}" ) # Authenticate using the identity token provided by the Lambda environment. # Fail fast if the token is missing to avoid confusing 4xx errors. session_token = os.environ.get("AWS_SESSION_TOKEN") if not session_token: raise RuntimeError( "Missing AWS_SESSION_TOKEN required for " "Parameters and Secrets Extension authentication." ) headers = { ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.