Comments (12)
Thanks for reaching out. Supporting SSL connections to DB's is in our backlog and we hope to deliver that in a future release. Until then you can get this working manually by doing the following edits to your lambda:
from aws-secrets-manager-rotation-lambdas.
- Open the Lambda function responsible for rotation of that secret. You can find the arn in the Secrets Manager console under the Rotation Configuration section.
- Download the latest RDS CA Bundle here - https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem and add that file to the Lambda (keep the same name rds-combined-ca-bundle.pem, and don't put it in a directory).
- Change the line that has "pymysql.connect" in lambda_function.py to be:
conn = pymysql.connect(secret_dict['host'], user=secret_dict['username'], passwd=secret_dict['password'], port=port, db=dbname, connect_timeout=5, ssl={'ca': './rds-combined-ca-bundle.pem'}) - Go back to the Secrets Manager console and click "Rotate secret immediately" and it will kick off rotation again and it should work this time.
from aws-secrets-manager-rotation-lambdas.
I got this same issue with Postgres Aurora with force_ssl=1. Over a year of no activity/progress on this just makes it hard to recommend AWS SecretsManager.
from aws-secrets-manager-rotation-lambdas.
The recommended solution doesn't work, because the version of FreeTDS included with pymssql 2.1.1 does not support SSL. Pretty weak that two years later this still hasn't been fixed. An no mention of it in the official AWS docs for configuring secrets rotation against an RDS db.
from aws-secrets-manager-rotation-lambdas.
There is already a KB article on this here but it is for custom lambda functions or ones that are not managed by an automation. Can AWS see this and push for a fix?
Recommended steps are (from-the-top-of-my-head):
- add the ca cert file in the function's file (can even have an S3 pull one-liner - its size is 43KB)
- add a second connection string for SSL-enabled connections
- add an IF condition for enabling the proper connection string according to SSL flag
from aws-secrets-manager-rotation-lambdas.
I haven't tried this yet, but I received some support on this issue and here is what is suggested:
The issue is related to the pymssql version (2.1.1) that's being used. This issue is fixed in the version 2.2.0. The following are the steps to rebuild the lambda function that's used for the secret rotation. (Alternatively, the attachments python.zip for the lambda layer and lambda_function.zip could be used)
python.zip
lambda_function.zip
-
Create an EC2 machine with Amazon Linux 2 with access to the internet (public).
-
Make a directory/folder projects & projects/python. You can name the folders accordingly as per your preference.
mkdir projects projects/python
- Change the working directory.
cd projects/python
- Copy/Install files into the above working directory for pymssql using pip3.
pip3 install pymssql -t ./
- Compress the files.
zip -r python.zip .
-
Create a lambda layer by uploading the above compressed file (python.zip).
-
Download the current lambda function (lambda_function.zip could be used) and just zip the lambda_function.py (Exclude everything else).
-
Upload the function (lambda_function.zip).
-
Add the lambda layer created to the lambda_function.
from aws-secrets-manager-rotation-lambdas.
Agreed on the workaround and thank you for sharing. However, my comment goes to AWS to add some leverage on fixing the lambdas and save us the maintainability issues/work and for all the engines too.
from aws-secrets-manager-rotation-lambdas.
any progress on this?
from aws-secrets-manager-rotation-lambdas.
Hitting the same wall, asking AWS support for ETA on the fix in SAR and will update here
from aws-secrets-manager-rotation-lambdas.
I suppose this announcement resolves this issue?
:)
from aws-secrets-manager-rotation-lambdas.
Though, it doesn't look like the merge to master has happened yet. PR is still out there awaiting final approval.
from aws-secrets-manager-rotation-lambdas.
Yes, SSL/TLS support for rotation has been has been launched and code has been merged in. Please refer to the documentation for setting up rotation and upgrading existing rotation configuration to use SSL connections.
Closing issue.
from aws-secrets-manager-rotation-lambdas.
Related Issues (20)
- Feature Request: Redshift Serverless Namespace admin user rotation HOT 2
- MySQL MultiUser lambda cannot rotate users with host different than default '%' HOT 3
- PostgreSQL SingleUser rotation, isn't working with RDS-Proxy HOT 1
- SecretsManagerRDSPostgreSQLRotationMultiUser doesn't support RDS Aurora Postgres HOT 1
- MultiUser rotations are incompatible with RDS Proxy HOT 12
- MySQL MultiUser Increase Username limit from 16 to 32 HOT 5
- secrets-manager automatic rotation for aws msk HOT 1
- SecretsManagerRDSMySQLRotationSingleUser error when require SSL HOT 4
- Name of IAM role not returned from AWS::SecretsManager::RotationSchedule HOT 1
- Aurora-mysql rotation fix HOT 1
- Update images to latest version of Python HOT 4
- Updating python enginefrom 3.7 to 3.11 Runtime.ImportModuleError HOT 3
- cx_Oracle has a major new release under a new name python-oracledb HOT 2
- MySQL and PostgreSQL support for aurora is inconsistent. HOT 2
- Secrets rotation fails for Oracle RDS with SSL or NNE HOT 4
- SqlServer rotation not respecting EXCLUDE_CHARACTERS HOT 6
- Cloud Formation Rotation type is missing for Elasticache Rotation Lambda HOT 1
- Getting cryptography' package is required while rotating secrets manager rds password HOT 5
- Include requirements.txt for each folder HOT 2
- SecretsManagerRDSMySQLRotationMultiUser through CloudFormation: KeyError 'masterarn' HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-secrets-manager-rotation-lambdas.