How can I retrieve Secrets Manager secrets using Lambda functions in a Amazon VPC?
My AWS Lambda function configured in an Amazon Virtual Private Cloud (Amazon VPC) can't access AWS Secrets Manager.
"My AWS Lambda function configured in an Amazon Virtual Private Cloud (Amazon VPC) can't access AWS Secrets Manager.Short descriptionLambda functions run in a secure Amazon VPC with access to AWS services and the internet. The Lambda service owns this Amazon VPC, and it isn’t connected to your default Amazon VPC.Lambda functions that are connected to your Amazon VPC can access the internet only when you configure your Amazon VPC to provide access. The network interfaces that Lambda creates within your Amazon VPC use private IP addresses and can’t connect to the internet using an internet gateway.For more information, see Internet and service access for VPC-connected functions.Note: It's a best practice not to place Lambda functions in an Amazon VPC unless the function must access other resources in the Amazon VPC.ResolutionFollow these steps to verify your Lambda network configuration and permission settings.Lambda network configurationTo allow a Lambda function that's connected to an Amazon VPC to access Secrets Manager, take one of the following actions:Give your function internet access by placing the function in private subnets and routing the outbound traffic to a NAT gateway in a public subnet. The NAT gateway has a public IP address and connects to the internet through the VPC's internet gateway.-or-Set up an Amazon VPC interface endpoint for Secrets Manager. Your Amazon VPC then connects Secrets Manager from your Lambda function without internet access. Make sure that the Amazon VPC endpoint security group allows port 443 inbound traffic from the Lambda security group or IP address range. And, the Lambda security group allows port 443 outbound traffic to the Amazon VPC endpoint security group or IP address range.Note: If you use AWS PrivateLink VPC endpoints, then make sure that you configure the DHCP options with your Amazon VPC for Domain Name System (DNS). For more information, see DNS attributes for your Amazon VPC.Lambda execution role permissionsGrant permissions to the Lambda execution role to access Secrets Manager secrets. Use the GetSecretValue API call to get the Secrets Manager secret. For more information, see Example: Permission to retrieve secret values.(Optional) AWS Key Management Service (AWS KMS) permissionsIf the Secrets Manager secret is encrypted with an AWS KMS customer managed key instead of the managed key aws/secretsmanager, then additional configuration is required. Make sure to allow the Decrypt API action permission as either the Lambda execution role or the AWS KMS key policy.Related informationHow do I troubleshoot permissions issues with Lambda?Follow"