Correct way to connect AWS Secret Manager

Question

I am trying to connect to AWS Secret manage, on local it works fine on the python server it gives "botocore.exceptions.NoCredentialsError: Unable to locate credentials" error

session = boto3.session.Session()
    client = session.client(
            service_name='secretsmanager',
            region_name=region_name
        )

So I had 2 ways to correct this :

First Method:

 session = boto3.session.Session()
        client = session.client(
                service_name='secretsmanager',
                region_name=region_name,aws_access_key_id=Xxxxxx,
aws_secret_access_key=xxxxxx

            )

Second Method: To have this in a config file (Which will again expose keys)

 session = boto3.session.Session()
        client = session.client(
                service_name='secretsmanager',
                region_name=region_name,aws_access_key_id=confg.access,
aws_secret_access_key=confg.key

            )

Arent, we exposing our key and access keys in github if we are specifying it here.?

What is the correct way to access Secret Manager without specifying it here

Answer 1

You are correct you shouldn't pass your access key and secret key to any running server or service in AWS to avoid exposing it. On your local machine, it worked because your environment is getting your user's permissions via AWS CLI.

What you need to do for a server is to add to the service role a policy allowing it to access the Secrets Manager, then you won't face permissions issues anymore

On Permissions policy examples - AWS Secrets Manager can find examples of how those policies need to be.

And on Assign an IAM Role to an EC2 Instance you can see how to attach a role with a specific policy to an EC2 instance.