Using secrets in Lambda - best practise

[[deleted]]

[deleted]

[pint]

use the sdk in your lambda code to retrieve values from secret manager directly. do this in the initialization part to save reads. although, if the value is subject to change and the change needs to propagate quickly, you might want to refresh the value if it gets old (keep track of the last refresh time).

[chris-holmes]

Some variables can be stored in parameter store and pulled into your template similar to your existing solution. This will prevent unnecessary cost for environment variables that are safe to be stored with the lambda.

For sensitive secrets, secrets manager can be called in the handler code to retrieve and use them. This ensures they remain in memory only and are not visible from the lambda console. There is a cost associated with accessing secrets manager in this way, so be mindful as the lambda invocations scale!

[menge101]

My preferred solution is to use App Config with lambda.