I wrote a lambda function to access a database so the first step is to get secrets from AWS Secrets Manager. I have a private VPC as well as subnets, NAT Gateway, and security group associated with the lambda function. I also have secretsmanager.Secret.grantRead(lambda_exec_role) so the lambda should have access to Secrets Manager.
For some reason when I test it in API Gateway, I got "errno": "ETIMEDOUT" and "code": "NetworkingError" in CloudWatch. And from the printed log I had in the API, getting secrets was failed.
I also tried to add a VPC endpoint for Secrets Manager as in here, but still got the same error.
Appreciated if anyone here could help me with this or give some hints.
Many thanks!
I had trouve with a lambda getting secret content too.
They are several things you can try :
#1 Make sure you have permission to get the secret value, I'll give you mine for a working configuration :
#2 I had trouble too with my VPC and subnets. If misconfugred, you won't be able to call Secret Manager API.
Hoping it could help someone someday. :)
Here's how I got it working in serverless.yml.
AWS Reference: https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html#vpc-endpoint
The following yml appears under the path resources.Resources.YourVPCEndpointNameHere:
# Provides access from the VPC to Secrets Manager
# See https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html#vpc-endpoint
Type: AWS::EC2::VPCEndpoint
Properties:
VpcEndpointType: Interface
ServiceName: com.amazonaws.#{AWS::Region}.secretsmanager
PrivateDnsEnabled: true
# Reference your VPC here
VpcId: !Ref EC2VPC
# Reference your subnet ids here
SubnetIds:
- !Ref EC2SubnetA
- !Ref EC2SubnetB
- !Ref EC2SubnetC
# Reference your security group(s) here
SecurityGroupIds:
- !Ref EC2SecurityGroup
Tip: You'll need the plugin serverless-pseudo-parameters to make #{AWS::Region} work.