AWS Lambda访问Secrets Manager时出现超时错误的排查求助

大家好，我最近在调试Lambda函数从AWS Secrets Manager拉取密钥时遇到了超时问题，折腾了好一阵没找到原因，来这里求助下各位大佬。

错误信息如下：

Response: { "errorMessage": "2025-07-15T13:55:13.645Z 3***8 Task timed out after 30.03 seconds" }

我的Python Lambda代码是基于AWS官方示例修改的：

import boto3
from botocore.exceptions import ClientError

def get_secret():
    secret_name = "my_secret_name"
    region_name = "eu-west-1"

    # Create a Secrets Manager client
    session = boto3.session.Session()
    client = session.client(
        service_name='secretsmanager',
        region_name=region_name
    )

    try:
        get_secret_value_response = client.get_secret_value(
            SecretId=secret_name
        )
    except ClientError as e:
        # For a list of exceptions thrown, see
        # https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
        raise e

    secret = get_secret_value_response['username_rds']
    return secret

def lambda_handler(event, context):
    username = get_secret()
    return {
        "statusCode": 200,
        "body": f"Fetched RDS username: {username}"
    }

IAM配置（Terraform代码） #

我给Lambda角色附加了自定义的IAM策略，允许访问指定的密钥资源：

resource "aws_iam_role" "lambda_role" {
  name = "${var.lambda_name}_role"
  assume_role_policy = jsonencode({
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }]
  })
}

resource "aws_iam_policy" "custom_secret_policy" {
  name        = "${var.lambda_name}-secret-policy"
  description = "Allow Lambda to read a specific secret"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "ReadSpecificSecret"
        Effect    = "Allow"
        Action = [
          "secretsmanager:GetSecretValue",
          "secretsmanager:DescribeSecret",
          "secretsmanager:ListSecrets"
        ]
        Resource = data.aws_secretsmanager_secret.superset_rds_secret.arn
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "secret_manager_policy_attachment" {
  role       = aws_iam_role.lambda_role.name
  policy_arn = aws_iam_policy.custom_secret_policy.arn
}

网络配置（Terraform代码） #

Lambda部署在默认VPC内，我创建了对应的安全组和Secrets Manager的VPC接口端点：

# Lambda安全组
resource "aws_security_group" "lambda_sg" {
  name        = "sg_${var.lambda_name}"
  description = "Allow all the ports needed for lambda"
  vpc_id      = data.aws_vpc.default.id

  # 允许所有出站流量
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # 允许HTTPS出站流量
  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Secrets Manager VPC接口端点
resource "aws_vpc_endpoint" "secretsmanager" {
  vpc_id            = data.aws_vpc.default.id
  service_name      = "com.amazonaws.eu-west-1.secretsmanager"
  vpc_endpoint_type = "Interface"
  subnet_ids        = [aws_default_subnet.default_az1.id]
  security_group_ids = [aws_security_group.lambda_sg.id]
}

# 默认子网
resource "aws_default_subnet" "default_az1" {
  availability_zone = "eu-west-1a"
}

# Lambda部署配置
resource "aws_lambda_function" "lambda_user_management" {
  function_name = var.lambda_name
  runtime       = "python3.10"
  handler       = "lambda_function.lambda_handler"
  timeout       = 30

  vpc_config {
    security_group_ids = [aws_security_group.lambda_sg.id]
    subnet_ids         = [aws_default_subnet.default_az1.id]
  }

  role = aws_iam_role.lambda_role.arn
  # 其他配置省略...
}

我检查了IAM权限应该是没问题的，VPC和端点也配置了，但Lambda还是超时。想请教下各位，是不是网络或者安全组配置里有什么我漏掉的地方，导致VPC内的Lambda无法访问Secrets Manager呢？

内容来源于stack exchange