Setting the X-Aws-Parameters-Secrets-Token header in SecretsManagerClient

[NikolayMetchev]

Hello,
I am looking at the lambda documentation here: https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html

I would like to use the AWS-Parameters-and-Secrets-Lambda-Extension in my lambda and the Kotlin SDK.
I think SecretsManagerClient will work but it needs an extra header set. I don't know if the current API allows me to set that header X-Aws-Parameters-Secrets-Token.
Is this something that is supported now?

[lauzadis]

To use this feature, you need to make requests to a locally-hosted secrets manager instance running in Lambda. There is no feature in the Kotlin SDK to do this for you. We expose our internal HTTP client which you could use to make these requests, but ultimately it will be a manual HTTP request to an endpoint like http://localhost:2773/secretsmanager/get?secretId=${SECRET_ID}

[NikolayMetchev]

It almost works with
SecretsManagerClient { endpointUrl = Url.parse("http://localhost:2773") }

However as I say in the request it doesn't set the X-Aws-Parameters-Secrets-Token header.
If there was a way to specify that when constructing a SecretsManagerClient I think it should work.

[lauzadis]

Oh, ok, sorry for doubting that. I think it works because the Secrets Manager client is making requests to the same endpoint Lambda exposes, but that's not guaranteed.

You can add that custom header using an interceptor.

val addSecretsTokenHeaderInterceptor = object : HttpInterceptor {
    override suspend fun modifyBeforeSigning(context: ProtocolRequestInterceptorContext<Any, HttpRequest>): HttpRequest {
        val builder = context.protocolRequest.toBuilder()
        builder.headers.append("X-Aws-Parameters-Secrets-Token", "<your_header_value>")
        return builder.build()
    }
}


// apply interceptor when creating a client
val client = SecretsManagerClient { 
    interceptors += addSecretsTokenHeaderInterceptor
}

For more information on interceptors, check out our documentation page: https://docs.aws.amazon.com/sdk-for-kotlin/latest/developer-guide/interceptors.html

[NikolayMetchev]

Oh wait. I was wrong. It doesn't work. It is a completely different API I guess.

[lauzadis]

Darn, ok, then you should follow the guidance of my first reply and manually send HTTP requests to the endpoint Lambda exposes.