Search code examples
zappa

zappa: where to put aws secret & access keys?

I am trying to use zappa to launch my flask app in aws lambda & api gateway. The flask script requires a separate aws secret & access keys (needed for S3 & dynamoDB), different from the one i used for executing zappa.

I realised that I can't put it in zappa_settings.json, as they will be blocked.

Where should I put them then?

Solution

  • It's best practice not to use AWS Secret & Access Keys inside code if you are using Lambda Function. You should modify your Lambda Function's Execution Role and add the required permissions for accessing S3 and DynamoDB.

    But if you choose not to use Lambda Function's Execution Role, you have many options to store your AWS Secret & Access Keys:

    1. Store them in Lambda Function's Environment Variables. (not recommended)
    2. Store them in AWS SSM Parameter Store as a Secure String.
    3. Store them in AWS Secrets Manager.

    But I recommend you to modify your Lambda Function's Execution Role and add the required permissions for accessing any AWS service in your case S3 and DynamoDB.