AWS Lambda/Secrets Manager permission no longer working (Pulumi)

Question

This stack was working at one point... I'm not sure what's going on. This permission is no longer doing what it did before, or has become invalid.

I have a Lambda function that rotates a Secret, so naturally it must be triggered by Secrets Manager. So I built up the Permission as follows

import * as aws from '@pulumi/aws'

export const accessTokenSecret = new aws.secretsmanager.Secret('accessTokenSecret', {});

export const smPermission = new aws.lambda.Permission(`${lambdaName}SecretsManagerPermission`, {
  action: 'lambda:InvokeFunction',
  function: rotateKnacklyAccessTokenLambda.name,
  principal: 'secretsmanager.amazonaws.com',
  sourceArn: accessTokenSecret.arn,
})

And the Policy,

{
        Action: [
          'secretsmanager:GetResourcePolicy',
          'secretsmanager:GetSecretValue',
          'secretsmanager:DescribeSecret',
          'secretsmanager:ListSecrets',
          'secretsmanager:RotateSecret',
        ],
        Resource: 'arn:aws:secretsmanager:*:*:*',
        Effect: 'Allow',
      },

Running pulumi up -y yields

  aws:secretsmanager:SecretRotation (knacklyAccessTokenRotation):
    error: 1 error occurred:
        * error enabling Secrets Manager Secret "" rotation: AccessDeniedException: Secrets Manager cannot invoke the specified Lambda function. Ensure that the function policy grants access to the principal secretsmanager.amazonaws.com.

This error confuses me, because the Policy created for the Lambda will not accept the Principal param (which makes sense, the same behaviour happens in the AWS Console), so I'm sure they mean Permission instead of Policy.

Based on the log I can tell that the Permission is being created way after the Lambda/Secrets Manager is, I'm not sure if this is a Pulumi issue similar to how it destroys stacks in the incorrect order (Roles and Policies for example).

I can see the Permission in the AWS Lambda configuration section, so maybe it's ok?

AWS Lambda/Secrets Manager permission no longer working (Pulumi)

0 Answers0