除了使用Secrets Manager VPC终端节点来轮换秘钥外,AWS还提供了其他一些解决方案。以下是几种选择:
import boto3
def lambda_handler(event, context):
# Create Secrets Manager client
client = boto3.client('secretsmanager')
# Get secret value
get_secret_value_response = client.get_secret_value(
SecretId='my_secret'
)
secret = get_secret_value_response['SecretString']
print(f"Current value of my_secret is {secret}")
# Put new secret value
new_password = 'new_password'
put_secret_value_response = client.put_secret_value(
SecretId='my_secret',
SecretString=new_password,
VersionStages=['AWSPENDING']
)
print(f"Successfully put new value for my_secret with version {put_secret_value_response['VersionId']}")
# Set new version of the secret as the active version
update_secret_version_stage_response = client.update_secret_version_stage(
SecretId='my_secret',
VersionStage='AWSCURRENT',
MoveToVersionId=put_secret_value_response['VersionId'],
RemoveFromVersionId=get_secret_value_response['Version']['VersionId']
)
print(f"Successfully set new version {put_secret_value_response['VersionId']} of my_secret as AWSCURRENT")
import boto3
def lambda_handler(event, context):
# Create SSM client
client = boto3.client('ssm')
# Get current value of parameter
get_parameter_response = client.get_parameter(
Name='/my_secret',
WithDecryption=True
)
current_secret = get_parameter_response['Parameter']['Value']
print(f"Current value of my_secret is {current_secret}")
# Put new value of parameter
new_secret = 'new_secret'
put_parameter_response = client.put_parameter(
Name='/my_secret',
Value=new_secret,
Type='SecureString',
Overwrite=True
)
print