https://github.com/cgauge/aws-secretsmanager-caching-extension

Cache server for AWS Secrets Manager
https://github.com/cgauge/aws-secretsmanager-caching-extension

aws container ecs golang lambda lambda-extensions lambda-layer secrets-manager sidecar

Last synced: 5 months ago
JSON representation

Cache server for AWS Secrets Manager

• Host: GitHub
• URL: https://github.com/cgauge/aws-secretsmanager-caching-extension
• Owner: cgauge
• License: lgpl-3.0
• Created: 2022-01-05T17:31:01.000Z (over 4 years ago)
• Default Branch: main
• Last Pushed: 2025-01-15T17:31:37.000Z (over 1 year ago)
• Last Synced: 2025-04-09T17:06:50.495Z (about 1 year ago)
• Topics: aws, container, ecs, golang, lambda, lambda-extensions, lambda-layer, secrets-manager, sidecar
• Language: Go
• Homepage:
• Size: 159 KB
• Stars: 7
• Watchers: 9
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: COPYING

Awesome Lists containing this project

README

          
# AWS Lambda Extension / Sidecar Container

![Diagram cache server](docs/cache-server.png)

## Cache Server

The cache server is written in Golang and it uses the same code to run inside a lambda extension and to run the sidecar container. To be able to run the same extension in different lambda’s runtime, we needed a language that could generate a binary in the end, so we are able to execute the binary directly without caring about the lambda runtime language/version.

The server runs on port 8015 and receives the secret name and the refresh parameters. The refresh parameter is used to invalidate the cache.

## How it works

### Lambda Extension

![Sequence Diagram lambda](docs/lambda-sequence.png)

### Sidecar Container

![Diagram cache server](docs/container-sequence.png)

## Use Case

Use the cache server to retreive database password to connect to the database in different Lambda Runtimes.

Laravel Aurora Connector (https://github.com/cgauge/laravel-aurora-connector) library use this strategy.

Some implementation details can be found here: https://github.com/cgauge/laravel-aurora-connector/blob/main/src/PasswordResolver.php

## Usage

### Lambda Extension

```yml

# CloudFormation

AWSTemplateFormatVersion: '2010-09-09'

Transform: 'AWS::Serverless-2016-10-31'

Resources:

  function:

    Type: AWS::Serverless::Function

    Properties:

      Handler: index.handler

      Runtime: nodejs14.x

      CodeUri: function/.

      Layers:

        - arn:aws:lambda:eu-west-1:12345678:layer:secretsmanager-caching-extension:1

# Serverless Framework

functions:

  hello:

    handler: handler.hello

    layers:

      - arn:aws:lambda:eu-west-1:12345678:layer:secretsmanager-caching-extension:1

```

### Sidecar Container

```yml

# Cloudformation

TaskDefinition:

  Type: 'AWS::ECS::TaskDefinition'

  Properties:

    ContainerDefinitions:

      - Name: Name of your service image

        Image: your.service.image/tag:version

        PortMappings:

          - ContainerPort: '80'

            

      - Name: CacheSecretsService

        Image: customergauge/aws-secretsmanager-caching-sidecar

        PortMappings:

          - ContainerPort: '8015'

    ...

```

## Contributing

Contributions are always welcome, please have a look at our issues to see if there's something you could help with.

## License

AWS Secrets Manager Caching Extension is licensed under LGPLv3 license.