How can I access AWS Secrets Manager from my Lambda within a VPC?

Question

I am working on a native AWS .NET 6 application with many AWS services being used, such as AWS Lambda, AWS SQS/SNS, AWS EventBridge, DynamoDB, S3, and so on.

I am migrating many of my controllers in my Web API project which is running on an EC2 instance to AWS Lambda Serverless API. This means that my Lambda needs access to my RDS Postgresql instance which is only accessible through VPC. My Lambda needs to be in a VPC in order to make a connection to the RDS.

However, I have stored all my keys and configurations in AWS Secrets Manager. And as you may now, my Lambda cannot access secrets manager because it's in a VPC. I have read many answers and other articles about solutions for that, but I still don't fully understand it. What is the best and a free way to allow my Lambda to access Secrets Manager and also being in a VPC at the same time?

Answer 1

Thanks for the comments on my answer. I managed to make it work. I did the following steps to make it work:

• I created a VPC Endpoint
• I selected the secretsmanager service, which in my region is 'com.amazonaws.eu-west-1.secretsmanager'
• Created a separate Security Group for the Endpoint.
• Created a separate Security Group for my AWS Lambda.
• For the Endpoint's Security Group, I added a rule for both Inboud and Outbound selecting HTTPS, port 443, and the Lambda's SG.
• For the AWS Lambda's Security group, I did the same as the previous step but selected the VPC Endpoint's SG.

And voila, my lambda worked

Of course, not to forget to mention this article: https://aws.amazon.com/blogs/security/how-to-connect-to-aws-secrets-manager-service-within-a-virtual-private-cloud/