Question about creating credential rotation Lambda function for Aurora MySQL RDS database

Question

I found this rotation function template, I'm going to modify this template to create my own rotation function and tell Secrets Manager to use it perform the rotation.

My question is which part in the template should I change, it's not very clear in the template, such as line 47-49, should I replace SecretIdwith my Secret ARN?

arn = event['SecretId']
token = event['ClientRequestToken']
step = event['Step']

Another example: line 57

endpoint_url=os.environ['SECRETS_MANAGER_ENDPOINT']

What value should I use for 'SECRETS_MANAGER_ENDPOINT', maybe 'https://secretsmanager.region.amazonaws.com'??

In addition, line 205-206

This is where the lambda will validate the user's permissions. 
Uncomment/modify the below lines to
# tailor these validations to your needs

What exactly I need to add in this part to grant the Secrets Manager permission to call this function?

A bit confused,I've been messing around with the whole credential rotation almost a whole day, any suggestions will be appreciated.

Answer 1

You don't need to make any changes to the logic of loading the event or the environmental variables.

Think of this way. When rotation occurs, secrets manager will invoke your lambda. That invocation has an event associated with it, which contains the rotation step, SecretId of the secret to be rotated, ClientRequestToken, etc

You don't need to modify that logic.

With regards to the lambda you need to set an environment variable for the secrets manager endpoint - https://docs.aws.amazon.com/lambda/latest/dg//go-programming-model-env-variables.html

• ''https://secretsmanager.region.amazonaws.com' but insert the region you're work with - https://secretsmanager.us-west-2.amazonaws.com for example

Answer 2

As @committedandroider said, you do not need to modify the 47-49 because that is passed to the Lambda call by the Secrets Manager rotation engine and line 57 is set as an evironment variable to the Lambda function when you create the function (and yes you should set it to https://secretsmanager.REGION.amazonaws.com).

The Secrets Manager rotation engine will call the lambda four times with a different step value (createSecret, setSecret, testSecret, and finishSecret) each time. The lines 205-206 are part of the testSecret step and are meant to test the new database credentials by establishing a connection to the DB (using the new creds) and running a simple query. The comment is telling you that you can add more checks in there if you like (e.g. doing a select from a table you really care about).

To give Secrets Manager permissions to run the Lambda you must add permissions to the Lambda function granting the service principal secretsmanager.amazonaws.com lambda:InvokeFunction permissions. For example:

aws --region REGION lambda add-permission --function-name LAMBDANAME --statement-id "Rotation" --action "lambda:InvokeFunction" --principal secretsmanager.amazonaws.com

Where REGION is the AWS region you are using and LAMBDANAME is the name you gave the lambda.