I'm writing a lambda to rotate secrets in AWS Secret Manager. But I'm getting an error from the SDK when I try to make the call. The code I'm using:
import (
"context"
"fmt"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
)
func checkSecret(ctx context.Context, secretName string) error {
awsConfig := aws.NewConfig()
awsConfig.Region = "us-east-1"
client := secretsmanager.NewFromConfig(*awsConfig)
resp, err := client.DescribeSecret(ctx, &secretsmanager.DescribeSecretInput{SecretId: &secretName})
if err != nil {
fmt.Println("ERR Describing Secret: ", err)
return err
}
return nil
}
Invoking this function returns:
operation error Secrets Manager: DescribeSecret,
https response error StatusCode: 400,
RequestID: b4023b03-6455-41e6-be63-639bff8ec56c,
api error MissingAuthenticationTokenException: Missing Authentication Token
However, if I invoke the same function with AWS CLI it works:
> aws secretsmanager describe-secret --secret-id testSecret
{
"ARN": "arn:aws:secretsmanager:us-east-1:xxxxx:secret:testSecret-eOGWj5",
"Name": "testSecret",
"Description": "Test secret to experiment with rotation.",
"RotationEnabled": true,
"RotationLambdaARN": "arn:aws:lambda:us-east-1:xxxxx:function:secretRotator",
"LastChangedDate": "2022-09-14T16:09:32.485000-05:00",
"LastAccessedDate": "2022-09-13T19:00:00-05:00",
"Tags": [],
"VersionIdsToStages": {
"0efac0f5-e7d8-4519-8437-0a1c5f302785": [
"AWSCURRENT"
],
"b7a050c8-69b2-46cd-aba7-7e2927320dad": [
"AWSPENDING"
]
},
"CreatedDate": "2022-09-14T15:25:25.246000-05:00"
}
So my IAM rules appear correct. I'm running this code locally so that AWS CLI and the code are using the same AWS Credentials.
Googling thus far only turns up troubleshooting around API Gateway for this error.