如何在AWS Lambda中存储Vue应用密钥并通过Lambda将带AWS认证的Vue应用注册用户凭证存入密钥管理器

Hey there, let's tackle your two questions one by one—this is a pretty common workflow when combining Vue, AWS Lambda, and AWS's secret management tools, so I’ll walk you through it clearly.

1. 如何在AWS Lambda中存储Vue应用的密钥？ #

Storing secrets directly in Lambda code is a big no-no (hardcoding is a major security risk). Instead, use AWS's managed secret services—AWS Secrets Manager or AWS Systems Manager Parameter Store—they’re built for secure, scalable secret storage. Here’s how to set it up:

Option 1: Use AWS Secrets Manager #

• Step 1: Create your secret in Secrets Manager
  Head to the AWS Console, navigate to Secrets Manager, and create a new secret. Choose "Other type of secret" and add key-value pairs for your Vue app’s secrets (e.g., VUE_API_KEY, THIRD_PARTY_SERVICE_TOKEN). Give it a clear name like vue-app-core-secrets.

• Step 2: Grant Lambda permissions to access the secret
  Update your Lambda function’s IAM role to include a policy that allows secretsmanager:GetSecretValue for your specific secret. Example policy snippet:

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "secretsmanager:GetSecretValue",
        "Resource": "arn:aws:secretsmanager:your-region:your-account-id:secret:vue-app-core-secrets-*"
      }
    ]
  }
  

• Step 3: Fetch the secret in your Lambda code
  Use the AWS SDK for JavaScript to retrieve the secret at runtime. Here’s a Node.js example:

  const { SecretsManagerClient, GetSecretValueCommand } = require("@aws-sdk/client-secrets-manager");
  
  const secretsClient = new SecretsManagerClient({ region: "your-region" });
  
  exports.handler = async (event) => {
    try {
      const getSecretCmd = new GetSecretValueCommand({
        SecretId: "vue-app-core-secrets"
      });
      const secretResponse = await secretsClient.send(getSecretCmd);
      const appSecrets = JSON.parse(secretResponse.SecretString);
  
      // Use the secrets in your logic—e.g., pass needed values to Vue
      return {
        statusCode: 200,
        body: JSON.stringify({ apiKey: appSecrets.VUE_API_KEY })
      };
    } catch (err) {
      console.error("Failed to fetch secrets:", err);
      throw err;
    }
  };
  

• Critical note for Vue: Never expose sensitive secrets directly to the frontend! Use Lambda as a proxy—let Vue call Lambda to get non-sensitive config, or have Lambda handle API calls on the frontend’s behalf using the secret.

Option 2: Use AWS Systems Manager Parameter Store #

If you prefer a lower-cost option (Parameter Store has free tiers for basic use), use SecureString parameters:

• Create a SecureString parameter in Parameter Store (e.g., /vue/app/api-key).
• Grant Lambda the ssm:GetParameter permission with WithDecryption: true.
• Fetch it in code with the SSM SDK:

  const { SSMClient, GetParameterCommand } = require("@aws-sdk/client-ssm");
  
  const ssmClient = new SSMClient({ region: "your-region" });
  
  exports.handler = async (event) => {
    try {
      const getParamCmd = new GetParameterCommand({
        Name: "/vue/app/api-key",
        WithDecryption: true
      });
      const paramResponse = await ssmClient.send(getParamCmd);
      const apiKey = paramResponse.Parameter.Value;
  
      return { statusCode: 200, body: JSON.stringify({ apiKey }) };
    } catch (err) {
      console.error("Failed to fetch parameter:", err);
      throw err;
    }
  };
  

2. 将注册用户的凭证存入AWS密钥管理器的具体操作 #

First off: Do NOT store plaintext user passwords in Secrets Manager. AWS Cognito (your auth service) already securely hashes and stores user passwords—you never need to handle plaintext passwords here. This workflow is for storing other sensitive user-specific credentials (like a user’s unique API key, or third-party tokens linked to their account).

Here’s the step-by-step:

Step 1: Set up IAM permissions for Lambda #

Your Lambda function needs permissions to create/update secrets in Secrets Manager. Add this policy to its IAM role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["secretsmanager:CreateSecret", "secretsmanager:PutSecretValue"],
      "Resource": "arn:aws:secretsmanager:your-region:your-account-id:secret:user-credentials/*"
    }
  ]
}

Step 2: Trigger Lambda on user registration (optional) #

If you want to store credentials automatically when a user registers, set up a Post Confirmation trigger in your Cognito User Pool:

• Go to your Cognito User Pool in the AWS Console.
• Navigate to the "Triggers" tab.
• Under "Post confirmation", select your Lambda function. This will trigger Lambda right after a user confirms their account.

Step 3: Write the Lambda code to store user credentials #

Here’s a Node.js example that stores user-specific secrets when triggered by Cognito:

const { SecretsManagerClient, CreateSecretCommand } = require("@aws-sdk/client-secrets-manager");

const secretsClient = new SecretsManagerClient({ region: "your-region" });

exports.handler = async (event) => {
  // Get user data from the Cognito trigger event
  const userSub = event.request.userAttributes.sub; // Unique permanent Cognito user ID
  const userEmail = event.request.userAttributes.email;

  // Example: Generate or retrieve user-specific credentials
  const userCredentials = {
    email: userEmail,
    userSub: userSub,
    customApiKey: `user-api-key-${userSub.slice(0, 8)}` // Generate a unique key
    // Again, NO plaintext passwords!
  };

  try {
    // Use userSub for the secret name (more reliable than email, which can change)
    const secretId = `user-credentials/${userSub}`;
    const createSecretCmd = new CreateSecretCommand({
      Name: secretId,
      SecretString: JSON.stringify(userCredentials),
      Description: `Sensitive credentials for Cognito user ${userSub}`
    });

    await secretsClient.send(createSecretCmd);
    console.log(`Successfully stored credentials for user ${userEmail}`);

    // Pass the event back to Cognito to continue the registration workflow
    return event;
  } catch (err) {
    console.error(`Failed to store credentials for user ${userEmail}:`, err);
    // Handle duplicate secrets: if the secret already exists, use PutSecretValue to update it
    if (err.name === "ResourceExistsException") {
      // Add your update logic here if needed
    }
    throw err;
  }
};

Key Best Practices #

• Use userSub instead of email for secret names: Emails can change, but userSub is a permanent unique ID from Cognito.
• Minimize permissions: Only grant Lambda the exact Secrets Manager actions it needs (avoid wildcard permissions).
• Audit access: Enable Secrets Manager logging to CloudTrail to track who accesses user secrets.
• Handle errors gracefully: Account for edge cases like duplicate secrets or failed API calls.

内容的提问来源于stack exchange，提问作者Godwin Alexander Ekainu