0

I tried all the steps required to use AWS Parameters and Secrets Lambda Extension such like adding layer and using the X-Aws-Parameters-Secrets-Token in the header but the problem is when I call the request to get the secrets by using AWS Lambda Extension I get the "feign.RetryableException: Connection refused (Connection refused) executing GET http://localhost:2773/secretsmanager/get?secretId=test" problem.

Error : Connection refused (Connection refused) executing GET http://localhost:2773/secretsmanager/get?secretId=test" problem.

I really do not understand the problem. The token seems fine as well. I used Feign Client to make a GET request to call the secrets by using AWS Lambda Extension . Could you please check the implementation and let me know the problem?

 //* SecretsAndParametersExtensionAPI class (API class for Feign Client) 
 @Headers({"X-Aws-Parameters-Secrets-Token: {token}"})
 public interface SecretsAndParametersExtensionAPI { // TODO move me

 @RequestLine("GET /secretsmanager/get")
 @Headers("X-Aws-Parameters-Secrets-Token: {token}")
 String getSecret(@Param("token") String token, @QueryMap Map<String, Object>    queryMap);
 }

// Test class to get Secrets by using AWS Secrets Parameters Lambda Extension
@Test
public void testSecretsExtension() {

String sessionToken = EnvVarCommon.SESSION_TOKEN.get();
System.out.println(sessionToken);

try {
  SecretsAndParametersExtensionAPI secretsAndParametersExtensionAPI =
      Feign.builder().target(SecretsAndParametersExtensionAPI.class, "http://localhost:2773/");

  Map<String, Object> queryMap = new HashMap<>();
  queryMap.put("secretId", "test");

  String resultFromSecretExtension =
      secretsAndParametersExtensionAPI.getSecret(sessionToken, queryMap);

  System.out.println("Result From Secret Extension " + resultFromSecretExtension);
  log.debug("Request sent to ULH and ULH send request to LAVIN to download profile picture");

} catch (IllegalStateException | JsonSyntaxException exception) {
  log.error(
      "Failed to get response from ULH for downloading profile picture for the UserID '{}'",
      exception);
}
}

 //* template.yml file (CloudFormation file for adding Layer) 
 Mappings:
RegionToLayerArnMap:
us-east-1:
  "LayerArn": "arn:aws:lambda:us-east-1:177933569100:layer:AWS-Parameters-and-Secrets-Lambda-Extension:2"
us-east-2:
  "LayerArn": "arn:aws:lambda:us-east-2:590474943231:layer:AWS-Parameters-and-Secrets-Lambda-Extension:2"
eu-west-1:
  "LayerArn": "arn:aws:lambda:eu-west-1:015030872274:layer:AWS-Parameters-and-Secrets-Lambda-Extension:2"
eu-west-2:
  "LayerArn": "arn:aws:lambda:eu-west-2:133256977650:layer:AWS-Parameters-and-Secrets-Lambda-Extension:2"
eu-west-3:
  "LayerArn": "arn:aws:lambda:eu-west-3:780235371811:layer:AWS-Parameters-and-Secrets-Lambda-Extension:2"


AlperTestBotLambda:
Type: AWS::Serverless::Function
Condition: EnableAlperTestbot
Properties:
  Tracing: Active
  Runtime: java11
  Environment:
    Variables:
      component: !Ref Component
      componentShortName: !Ref ComponentShortName
      version: !Ref Version
      zone: !Ref Zone
      tenant: !Ref Tenant
      testTenant: "test"
      alperTestQueueName: !Ref AlperTestQueueName
      aws.sessionToken: !Ref SessionToken
  Policies:
    - !Ref SecureParameterAccess
    - !Ref PurgeSqsPolicyTestQueues
  EventInvokeConfig:
    MaximumRetryAttempts: 0
  Layers:
    - !FindInMap [ RegionToLayerArnMap, !Ref "AWS::Region", LayerArn ]
Tonyukuk
  • 5,745
  • 7
  • 35
  • 63
  • The Extension outputs extensive connection and request information to CloudWatch. What do your Lambda logs say? – fedonev Nov 15 '22 at 20:09
  • Hello Fedonav. when I check the logs in the CloudWatch there is nothing about the request that I sent, I think I am not able to go into AWS. But I can see this one in the logs which is printed earlier. "[AWS Parameters and Secrets Lambda Extension] 2022/11/16 04:10:39 INFO ready to serve traffic [AWS Parameters and Secrets Lambda Extension] 2022/11/16 04:10:39 INFO ready to serve traffic " – Tonyukuk Nov 16 '22 at 04:42
  • Have you added your Lambda to a VPC? In that case it won't have any internet access at all per default. See this question for more information: https://stackoverflow.com/questions/62274069/aws-lambda-access-secrets-manager-from-within-vpc – Molossus Dec 14 '22 at 22:48
  • yes thanks Molossus.I did not add – Tonyukuk Feb 24 '23 at 09:46

0 Answers0