3 ms·
Have you thought about storing your secrets in SSM or Secrets Manager, giving you lambda role(s) permissions to decrypt and using the appropriate APIs to call t
by igetspam 7y ago
Have you thought about storing your secrets in SSM or Secrets Manager, giving you lambda role(s) permissions to decrypt and using the appropriate APIs to call them? I use SecretString in SSM for a lot of things and it works quite well. There's a QPS limit but you can pay for a higher level of service now and move the bar up.
- mcintyre1994 7y agoThanks for the pointer, I'll look into those services as well. :)
- klohto 7y agoWatch out for the charges. Accessing secrets through API costs money
- robohoe 7y agoAlso watch out for throttling of GET requests/get-parameters API calls. I've found Parameter Store with SecureString sufficient enough but the throttling can kill the Lambda if it gets invoked frequently.
- vegardx 7y agoFor things like this you can abuse organization accounts. They take a few seconds to bootstrap and now you have a completely independent resource limit for that specific service.