Secure Secrets in AWS Using Secrets Manager and Lambda

In modern cloud‑native architectures, securely managing credentials and sensitive configuration values is one of the most critical responsibilities of an architect. Hardcoding passwords or storing them in plain text leads to major security risks, compliance violations, and operational challenges. To address this, AWS Secrets Manager provides a scalable, secure, and cost‑effective way to store, rotate, and retrieve secrets with fine‑grained access control.

In this blog, I walk through the architecture and implementation of integrating AWS Secrets Manager with AWS Lambda, enabling secure access to database credentials or other sensitive values without exposing them in source code or configuration files.

🧩 Why Secrets Manager?

Before jumping into the implementation, here’s why AWS Secrets Manager is preferred:

• Encrypted storage using AWS KMS
• Automatic rotation of database credentials
• Fine‑grained access control through IAM
• No more hardcoded secrets in Lambda or microservices
• Centralized audit logs via CloudTrail
• Environment‑based isolation for dev, QA, and prod environments

This makes it an essential component in any secure microservices or serverless architecture.

Step 1: Creating Secrets in AWS Secrets Manager

To begin, navigate to AWS Management Console → Secrets Manager → Store a new secret.

You have two options:

1. Store RDS credentials (username/password)
2. Store any custom key‑value pairs

In this example, we use the “Other type of secret” option to store custom database credentials such as:

• Username
• Password
• Database URL

Once the values are added, assign a meaningful and environment‑specific name such as:

dev/mySecret  
prod/mySecret

After reviewing, click Store — and your secret is ready for use.

Step 2: Configure the Lambda Function

We now create a Lambda function that retrieves secrets securely at runtime.

🔗 API Integration

A common design pattern is to expose the Lambda through API Gateway, allowing applications to invoke the Lambda while keeping secrets hidden.

⚙️ Environment Configuration (serverless.yml)

If you’re using the Serverless Framework, configure the secret retrieval per environment:

custom:
  secretName: ${self:provider.stage}/mySecret

This ensures the Lambda fetches secrets appropriate for dev, qa, or prod.

🔐 IAM Role for Secret Access

The Lambda function needs permission to read the secret. Create or update an IAM role with:

{
  "Effect": "Allow",
  "Action": [
    "secretsmanager:GetSecretValue"
  ],
  "Resource": "arn:aws:secretsmanager:region:account-id:secret:dev/mySecret-*"
}

Attach this role to your Lambda function to ensure secure and restricted access.

📥 Step 3: Retrieving Secrets in Lambda

Inside your Lambda function, use the AWS SDK to retrieve secret values.

Example Logic

1. Create a Secrets Manager client
2. Call getSecretValue()
3. Parse the returned secret JSON
4. Use the credentials inside your application logic

Sample Pseudocode Representation

const client = new AWS.SecretsManager();

const response = await client.getSecretValue({
  SecretId: process.env.SECRET_NAME
}).promise();

const secret = JSON.parse(response.SecretString);

// secret.username
// secret.password
// secret.db_url

At runtime, Lambda pulls the secret securely, eliminating the need to expose any credentials.

🏛️ Architectural Considerations

As part of architectural best practices:

🔹 Environment-Specific Isolation

Keep secrets per environment (dev/qa/prod) to avoid cross‑environment leakage.

🔹 No Secrets in Lambda Environment Variables

Even encrypted environment variables can be exposed — Secrets Manager avoids this risk completely.

🔹 Monitor Access & Rotations

Use CloudWatch and CloudTrail to track usage patterns and rotations.

🔹 Versioning & Rollbacks

Manage secret updates using versions for safe rollback and auditability.

📦 End‑to‑End Workflow Overview

1. Secret is securely stored in AWS Secrets Manager
2. Lambda retrieves the secret during execution
3. IAM role ensures only authorized functions can access the secret
4. API Gateway provides external access
5. All interactions are logged for audit and compliance

This approach strengthens your security posture and simplifies secret lifecycle management across serverless environments.

🏁 Conclusion

Secure secret management is a foundational requirement in modern cloud architecture. AWS Secrets Manager, paired with Lambda, provides an elegant, reliable, and secure way to manage sensitive data across multiple environments.

By following this architecture, you ensure:

✔ No hardcoded secrets ✔ Minimum blast radius via IAM ✔ Full auditability ✔ Clear environment boundaries ✔ Production‑ready security practices

This implementation not only aligns with security best practices but also demonstrates architectural maturity — an important factor for cloud certifications and professional credibility.