AWS跨账号Lambda访问Secrets Manager密钥失败排查

问题描述 #

我拥有两个AWS账号：services和training。training账号中的Lambda需要读取存储在services账号中的Secrets Manager密钥。我已按官方文档配置角色与权限，并通过AWS CLI验证可成功读取密钥：

aws secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:us-east-2:SERVICES:secret:/dev/camp/event_api_secret-YvlRG9 --profile events --region us-east-2

其中events配置文件用于扮演training账号的events-dispatcher角色，该命令成功返回密钥，证明该角色可跨账号访问密钥。

training账号的camp-event-dispatcher Lambda已配置events-dispatcher作为执行角色，处理代码如下：

import {GetSecretValueCommand, SecretsManagerClient} from "@aws-sdk/client-secrets-manager";

const client = new SecretsManagerClient({region: process.env.AWS_REGION});
// TODO: Pass secret ID in environment variable
const command = new GetSecretValueCommand({SecretId: 'arn:aws:secretsmanager:us-east-2:SERVICES:secret:/dev/camp/event_api_secret-YvlRG9'});
const response = await client.send(command);
const secretValue = response.SecretString;

exports.handler =  async function(event, context) {
  console.log(`SECRET value = ${secretValue}`);
  console.log("EVENT: \n" + JSON.stringify(event, null, 2))
  return context.logStreamName
}

但Lambda执行时调用获取密钥接口失败，报错信息如下：

User: arn:aws:sts::TRAINING:assumed-role/camp-event-dispatcher/event_dispatcher is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-2:SERVICES:secret:/dev/camp/event_api_secret-YvlRG9 because no resource-based policy allows the secretsmanager:GetSecretValue action

补充配置信息 #

services账号中密钥的资源策略（已添加报错中提到的假定角色主体，权限比生产环境更宽松）：

{
  "Version" : "2012-10-17",
  "Statement" : [ {
    "Effect" : "Allow",
    "Principal" : {
      "AWS" : "arn:aws:iam::TRAINING:role/event-dispatcher"
    },
    "Action" : "secretsmanager:*",
    "Resource" : "*"
  }, {
    "Effect" : "Allow",
    "Principal" : {
      "AWS" : "arn:aws:sts::TRAINING:assumed-role/camp-event-dispatcher/event_dispatcher"
    },
    "Action" : "secretsmanager:*",
    "Resource" : "*"
  } ]
}

training账号中event-dispatcher角色的权限策略（即Lambda的执行角色）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "arn:aws:secretsmanager:us-east-2:SERVICES:secret:/dev/camp/event_api_secret-YvlRG9"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
            ],
            "Resource": [
                "arn:aws:kms:us-east-2:SERVICES:key/c08bd5e6-4c65-41b0-989e-e1e8db0cad83"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "*"
        }
    ]
}

请问我哪里配置错误？

解决方案 #

问题核心是Lambda代码的执行时机错误：

你将调用Secrets Manager的代码放在了handler函数外部，这部分代码会在Lambda冷启动阶段执行，此时使用的是Lambda服务的临时凭证，而非你配置的event-dispatcher角色凭证。只有handler函数内部的代码才会使用指定的执行角色权限。

修复后的代码 #

import {GetSecretValueCommand, SecretsManagerClient} from "@aws-sdk/client-secrets-manager";

exports.handler =  async function(event, context) {
  const client = new SecretsManagerClient({region: process.env.AWS_REGION});
  const command = new GetSecretValueCommand({SecretId: 'arn:aws:secretsmanager:us-east-2:SERVICES:secret:/dev/camp/event_api_secret-YvlRG9'});
  const response = await client.send(command);
  const secretValue = response.SecretString;

  console.log(`SECRET value = ${secretValue}`);
  console.log("EVENT: \n" + JSON.stringify(event, null, 2))
  return context.logStreamName
}

额外优化建议 #

1. 无需在services账号的密钥资源策略中添加assumed-role类型的ARN，仅保留原角色ARN即可——Lambda会通过角色的信任关系自动获取临时凭证，资源策略只需信任原IAM角色。
2. 检查Lambda执行角色是否正确关联event-dispatcher，确认没有配置错误的权限边界或其他限制策略。

内容的提问来源于stack exchange，提问作者bjlevine