AWS Secrets Manager call from Lambda returning null/none

Question

I am using an AWS Lambda function to call AWS Secrets Manager for retrieving secret values but it just returns the value None/Null.

Here is my code:

# Secrets Manager
import boto3
import base64
from botocore.exceptions import ClientError


def lambda_handler(event, context):
    # Secrets Manager
    def get_secret():

        secret_name = "arn:aws:secretsmanager:region:accountid:secret:full-secret-name"
        region_name = "region"

        # Create a Secrets Manager client
        session = boto3.session.Session()
        client = session.client(
            service_name='secretsmanager',
            region_name=region_name
        )

        # Only handle the specific exceptions for the 'GetSecretValue' API.
        # See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
        # We rethrow the exception by default.

        try:
            get_secret_value_response = client.get_secret_value(
                SecretId=secret_name
            )
        except ClientError as e:
            if e.response['Error']['Code'] == 'DecryptionFailureException':
                # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
                # Deal with the exception here, and/or rethrow at your discretion.
                raise e
            elif e.response['Error']['Code'] == 'InternalServiceErrorException':
                # An error occurred on the server side.
                # Deal with the exception here, and/or rethrow at your discretion.
                raise e
            elif e.response['Error']['Code'] == 'InvalidParameterException':
                # You provided an invalid value for a parameter.
                # Deal with the exception here, and/or rethrow at your discretion.
                raise e
            elif e.response['Error']['Code'] == 'InvalidRequestException':
                # You provided a parameter value that is not valid for the current state of the resource.
                # Deal with the exception here, and/or rethrow at your discretion.
                raise e
            elif e.response['Error']['Code'] == 'ResourceNotFoundException':
                # We can't find the resource that you asked for.
                # Deal with the exception here, and/or rethrow at your discretion.
                raise e
        else:
            # Decrypts secret using the associated KMS CMK.
            # Depending on whether the secret is a string or binary, one of these fields will be populated.
            if 'SecretString' in get_secret_value_response:
                secret = get_secret_value_response['SecretString']
            else:
                decoded_binary_secret = base64.b64decode(get_secret_value_response['SecretBinary'])

    secretValue = get_secret()
    print(secretValue)
    return secretValue

In the return, I get null and in the print I get None. Not really sure what I am doing wrong here but it does not error out nor get my value.

The Secret is encrypted but the Lambda IAM Role has use permissions of the KMS key and the KMS key has granted the IAM Role usage as well.

I have also tried setting secret_name to just the Secrets Name like so:

secret_name = "full-secret-name-no-arn"

Regards

this is actually the thing I like about Java. If you declared the function as I want a secret value it would look something like public String getSecret() - and if a secret string isn't returned, the compiler would give you an error. However Python seems to have this behavior that if nothing is explicitly returned, the value 'None' will be returned — committedandroider
– committedandroider, Commented Oct 20, 2019 at 8:58

Tadeusz A. Kadłubowski · Accepted Answer · 2020-02-28 11:13:30Z

Resolution:

# Secrets Manager
import json
import boto3
import base64
import logging
from botocore.exceptions import ClientError

logger = logging.getLogger()
logger.setLevel(logging.INFO)

def lambda_handler(event, context):
    logger.info("Inside lambda_handler...")

    # SecretsManager
    secretValues = json.loads(get_secret())

def get_secret():
    logger.info("Inside get_secret...")
    secret_name = "full-arn-goes-here"
    region_name = "region-goes-here"

    # Create a Secrets Manager client
    session = boto3.session.Session()
    client = session.client(
        service_name='secretsmanager',
        region_name=region_name

    )

    try:
        get_secret_value_response = client.get_secret_value(SecretId=secret_name)
        logger.info("Received Response")
    except ClientError as e:
        if e.response['Error']['Code'] == 'DecryptionFailureException':
            # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InternalServiceErrorException':
            # An error occurred on the server side.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidParameterException':
            # You provided an invalid value for a parameter.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'InvalidRequestException':
            # You provided a parameter value that is not valid for the current state of the resource.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response['Error']['Code'] == 'ResourceNotFoundException':
            # We can't find the resource that you asked for.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        else:
            # Please see https://docs.aws.amazon.com/secretsmanager/latest/apireference/CommonErrors.html for all the other types of errors not handled above
            raise e
    else:
        # Decrypts secret using the associated KMS CMK.
        # Depending on whether the secret is a string or binary, one of these fields will be populated.
        if 'SecretString' in get_secret_value_response:
            logger.info("Inside string response...")
            return get_secret_value_response['SecretString']
        else:
            logger.info("Inside binary response...")
            return base64.b64decode(get_secret_value_response['SecretBinary'])

Just put secretValues = json.loads(get_secret()) inside your handler.

I think the initial issue with the code you had in the question was that you didn't return the secret in get_secret()

Ron Marcelino · Accepted Answer · 2019-11-08 10:10:55Z

4

Your get_secret() doesn't have return statement

answered Nov 8, 2019 at 10:10

Ron Marcelino

5333 silver badges9 bronze badges

Comments

murali nutakki · Accepted Answer · 2021-11-18 17:20:55Z

In addition to the above changes, ensure that your Lambda Execution role has the appropriate privileges for accessing secret manager and KMS services. Here is the sample IAM policy to be attached to the execution role. When applied, the below policy will allow Lambda to retrieve the secret without returning 'None.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:us-west-2:<ACCOUNT_ID>:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:us-west-2:<ACCOUNT_ID>:log-group:/aws/lambda/sampletest*:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecretVersionIds",
                "secretsmanager:PutSecretValue",
                "secretsmanager:UpdateSecret",
                "secretsmanager:TagResource",
                "secretsmanager:UntagResource"
            ],
            "Resource": [
                "arn:aws:secretsmanager:us-west-2:<ACCOUNT_ID>:secret:<SECRET_NAME>"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": "arn:aws:kms:us-west-2:<ACCOUNT_ID>:key/<KMS_ID>"
        }
    ]
}

Mário de Sá Vera · Accepted Answer · 2022-03-03 17:34:00Z

0

The problem is tricky ... as AWS does not give you any valuable log INFO about the lack of permissions to access the secrets manager service. You need to work on the IAM role of the process you are running and add the proper permissions for Secrets Manager access and it will go through no problem !!!

It is a really frustation AWS just returns 'None' without giving you any error message :(

answered Mar 3, 2022 at 17:34

Mário de Sá Vera

3871 gold badge4 silver badges12 bronze badges

Collectives™ on Stack Overflow

AWS Secrets Manager call from Lambda returning null/none

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related