如何通过代码读写AWS密钥？CDK创建SecureString参数遇阻求助

一、用SST Secret构造实现（推荐，适配SST场景） #

SST的Secret构造可以直接从环境变量提取密钥，自动同步到AWS Secrets Manager，同时简化Lambda绑定流程，全程无需命令行操作。

代码示例：

import { StackContext, Api, Secret } from "sst/constructs";

export function API({ stack }: StackContext) {
  // 从环境变量读取密钥值，未设置则抛出错误
  const dbPassword = process.env.DB_PASSWORD;
  if (!dbPassword) throw new Error("DB_PASSWORD环境变量未配置");

  // 创建SST Secret，自动在AWS Secrets Manager生成加密条目
  const dbSecret = new Secret(stack, "DBPassword", {
    value: dbPassword,
  });

  // 创建API并将密钥绑定到关联的Lambda函数
  const api = new Api(stack, "MyApi", {
    routes: {
      "GET /": "functions/lambda.handler",
    },
  });

  api.bind([dbSecret]);
}

注意：部署前需确保目标环境变量已正确设置，SST会自动处理密钥加密存储和Lambda权限配置。

二、CDK直接创建SSM SecureString参数 #

CDK的StringParameter支持创建SecureString类型参数，只需显式指定参数类型并传入值（默认使用AWS管理的KMS密钥加密）。

代码示例：

import { Stack, Construct } from "aws-cdk-lib";
import { StringParameter, ParameterType } from "aws-cdk-lib/aws-ssm";
import { Function, Runtime, Code } from "aws-cdk-lib/aws-lambda";
import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";

export class MyStack extends Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    const apiKey = process.env.API_KEY;
    if (!apiKey) throw new Error("API_KEY环境变量未配置");

    // 创建SSM SecureString参数
    const apiKeyParam = new StringParameter(this, "ApiKeyParam", {
      parameterName: "/my-app/api-key",
      stringValue: apiKey,
      type: ParameterType.SECURE_STRING,
    });

    // 创建Lambda函数
    const lambdaFn = new Function(this, "MyLambda", {
      runtime: Runtime.NODEJS_20_X,
      code: Code.fromAsset("lambda"),
      handler: "handler.main",
    });

    // 给Lambda添加读取SSM参数的权限
    lambdaFn.addToRolePolicy(new PolicyStatement({
      effect: Effect.ALLOW,
      actions: ["ssm:GetParameter"],
      resources: [apiKeyParam.parameterArn],
    }));

    // 将参数ARN传入Lambda环境变量，方便函数内读取
    lambdaFn.addEnvironment("API_KEY_PARAM_ARN", apiKeyParam.parameterArn);
  }
}

Lambda内读取参数示例（Node.js）：

import { SSMClient, GetParameterCommand } from "@aws-sdk/client-ssm";

const ssm = new SSMClient();

export async function main(event) {
  const param = await ssm.send(new GetParameterCommand({
    Name: process.env.API_KEY_PARAM_ARN,
    WithDecryption: true,
  }));
  const apiKey = param.Parameter.Value;
  // 业务逻辑处理
}

三、AWS Secrets Manager CDK正确创建密钥并绑定 #

使用Secrets Manager的Secret构造时，直接传入字符串值即可创建加密密钥，再通过环境变量绑定到Lambda（自动处理解密和权限）。

代码示例：

import { Stack, Construct } from "aws-cdk-lib";
import { Secret } from "aws-cdk-lib/aws-secretsmanager";
import { Function, Runtime, Code } from "aws-cdk-lib/aws-lambda";

export class MyStack extends Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    const dbSecretValue = process.env.DB_SECRET;
    if (!dbSecretValue) throw new Error("DB_SECRET环境变量未配置");

    // 创建Secrets Manager加密密钥
    const dbSecret = new Secret(this, "DBSecret", {
      secretStringValue: cdk.SecretValue.plainText(dbSecretValue),
    });

    // 创建Lambda并将密钥作为环境变量传入
    const lambdaFn = new Function(this, "MyLambda", {
      runtime: Runtime.NODEJS_20_X,
      code: Code.fromAsset("lambda"),
      handler: "handler.main",
      environment: {
        DB_SECRET: dbSecret.secretValue.toString(),
      },
    });

    // 自动授予Lambda读取密钥的权限
    dbSecret.grantRead(lambdaFn);
  }
}

内容的提问来源于stack exchange，提问作者chiralcentre